@@ -1,6 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import {
   countUserAssignedWork,
   isUserBanInForce,
@@ -69,12 +70,16 @@ describe('[#30205] userAssignedWorkFields', () => {
 
 type Row = Record<string, any>;
 
+/** Equality and `$contains`; a logical operator is refused, never read as a field. */
+const match = (row: Row, where: Record<string, any>) => Object.entries(where).every(([k, v]) => {
+  if (k.startsWith('$')) throw new Error('fake engine: unsupported logical operator ' + k);
+  return v && typeof v === 'object' && '$contains' in v ? Array.isArray(row[k]) && row[k].includes(v.$contains) : row[k] === v;
+});
+
 /** An in-memory engine: equality and `$contains` filters, a per-object read/write refusal. */
 function fakeEngine(seed: Record<string, Row[]>, opts: { unreadable?: string[]; refuseUpdate?: (object: string, id: string) => boolean; disabled?: string[] } = {}) {
   const tables = new Map(Object.entries(seed).map(([k, rows]) => [k, rows.map((r) => ({ ...r }))]));
   const calls: Array<{ op: string; object: string; context: any; where?: any }> = [];
-  const match = (row: Row, where: Record<string, any>) => Object.entries(where).every(([k, v]) =>
-    v && typeof v === 'object' && '$contains' in v ? Array.isArray(row[k]) && row[k].includes(v.$contains) : row[k] === v);
   const guard = (object: string, context: any) => {
     if (opts.unreadable?.includes(object) && !context?.isSystem) throw Object.assign(new Error('denied'), { code: 'PERMISSION_DENIED' });
   };
@@ -95,6 +100,7 @@ function fakeEngine(seed: Record<string, Row[]>, opts: { unreadable?: string[];
       return typeof q?.limit === 'number' ? rows.slice(0, q.limit) : rows;
     },
     async update(object, data, o) {
+      assertEngineUpdateDispatch(data, o);
       calls.push({ op: 'update', object, context: o?.context, where: o?.where });
       const row = (tables.get(object) ?? []).find((r) => match(r, o?.where ?? {}));
       if (!row) return null;
 
@@ -66,7 +66,8 @@ function makeStubDriver() {
     async connect() {}, async disconnect() {}, async checkHealth() { return true; },
     async execute() { return null; },
     async find(object: string, ast: any) {
-      return Array.from(storeFor(object).values()).filter((r) => matches(r, ast?.where));
+      const rows = Array.from(storeFor(object).values()).filter((r) => matches(r, ast?.where));
+      return typeof ast?.limit === 'number' ? rows.slice(0, ast.limit) : rows;
     },
     async findOne(object: string, ast: any) {
       for (const r of storeFor(object).values()) if (matches(r, ast?.where)) return r;
@@ -191,7 +192,7 @@ describe('[#30205] a new assignment to a banned user is refused', () => {
     const row: any = await engine.insert('ban_ticket', { title: 'T', assignee: 'u_alice' }, { context: ALICE } as any);
     const err = await refusalOf(() => engine.update('ban_ticket', { assignee: 'u_bob' }, { where: { id: row.id }, context: ALICE } as any));
     expect(err.fields[0]).toMatchObject({ field: 'assignee', code: 'reference_user_banned' });
-    const after: any = await engine.findOne('ban_ticket', { where: { id: row.id }, context: { isSystem: true } } as any);
+    const after: any = await engine.findOne('ban_ticket', { where: { id: row.id }, context: { isSystem: true } });
     expect(after.assignee).toBe('u_alice');
   });
 
 
@@ -24,7 +24,7 @@
 // hand-curated regex table reaching 1 of 17 REST registrars and 4 of 17
 // dispatcher domain files.
 //
-// The population comes from `packages/rest/src/rest-route-ledger.ts` (18
+// The population comes from `packages/rest/src/rest-route-ledger.ts` (19
 // families) and `packages/runtime/src/route-ledger.ts` (23
 // domains) because those two are enumerated from a RUNNING server and guarded
 // in both directions by their own conformance tests — so a new family or
@@ -311,6 +311,15 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
     // family key needs.
     covers: ['rest-family:rest-route-ledger.ts:openapi'],
     note: 'Measured on a booted showcase before the change: an unauthenticated caller was served the document (and its viewer page, since retired) with 200, just as a signed-in caller was, while the record doors on the same boot answered it 401 — ADR-0056 D2 is default-deny and no ADR-0138 D2 door class names this endpoint. The cited proof drives the document anonymously (401, the REST flat envelope, nothing of it served) and with a signed-in member (200, the document) on one boot. The environment-scoped twin mounts only under project scoping, which the showcase does not enable; it is the same handler closure, pinned per base in rest/src/rest-api-description-anonymous-deny.test.ts beside the gated-session 403 and the permission-store-outage 503. A deployment that publishes its API description to readers without an account publishes a static copy of the document instead.' },
+  // #30205 — a user's assigned work, counted and handed over: a family that
+  // arrives classified, the way `/approvals/act` did.
+  { id: 'anonymous-deny-user-work', summary: 'anonymous-deny on the assigned-work count and hand-over', state: 'enforced',
+    enforcement: 'rest/user-work-routes.ts registerUserWorkEndpoints — both handlers (GET assigned-work, POST assigned-work/transfer) open with enforceAuth (→ shouldDenyAnonymous) as their first act after resolving the caller, ahead of the query-parameter and body checks and of any engine read or write; an anonymous caller gets the REST seam\'s flat 401 UNAUTHENTICATED, and a signed-in caller counts and moves only what their own context can read and update',
+    proof: 'showcase-anonymous-deny-surfaces.dogfood.test.ts',
+    // The REST family at ledger granularity: the family is exactly these two
+    // routes and both handlers open with the floor.
+    covers: ['rest-family:rest-route-ledger.ts:user-work'],
+    note: 'New in #30205. The cited proof drives both routes anonymously (401, the REST flat envelope, nothing counted or moved) and with a signed-in member on one boot (the count served 200; the hand-over reaching its own unknown-target refusal, 404, before any write). Row admission and the update of each moved record stay with the security layer behind the engine, because both routes run as the caller.' },
   // #22432 — the `/i18n` dispatcher domain, under the ruling recorded on #22146
   // (the domain gains the domain-level anonymous refusal every other dispatcher
   // domain has, with an objectui companion for the Console's sign-in page).
 
@@ -1103,6 +1103,8 @@ describe('the ledger-sourced population and its baseline bite', () => {
       'rest-family:rest-route-ledger.ts:metadata',
       // [#22430] classified by `anonymous-deny-api-description`.
       'rest-family:rest-route-ledger.ts:openapi',
+      // [#30205] classified by `anonymous-deny-user-work`: it arrived classified.
+      'rest-family:rest-route-ledger.ts:user-work',
     ]);
     // …and the two halves partition the population exactly: nothing minted by
     // a ledger probe is both, and nothing is neither.
 
@@ -51,6 +51,7 @@
 // authz-row: anonymous-deny-packages
 // authz-row: anonymous-deny-analytics
 // authz-row: anonymous-deny-api-description
+// authz-row: anonymous-deny-user-work
 // authz-row: anonymous-deny-i18n
 //
 // ── Why the translation faces are here (#22432) ────────────────────────────
@@ -180,6 +181,26 @@ const API_DESCRIPTION_ENDPOINTS: readonly ApiDescriptionEndpoint[] = [
 const RETIRED_VIEWER_PATH = '/docs';
 const NEVER_SERVED_PATH = '/this-route-does-not-exist';
 
+// ── #30205 — a user's assigned work, counted and handed over (@objectstack/rest)
+//
+// Both handlers open with the floor, ahead of the query-parameter check and
+// any engine read. The ids are ones no user holds, so the member controls
+// read nothing and write nothing: the count answers an empty summary, and the
+// hand-over refuses the unknown target before any write.
+interface UserWorkFace {
+  readonly face: string;
+  readonly method: 'GET' | 'POST';
+  readonly path: string;
+  readonly body?: unknown;
+}
+const USER_WORK_FACES: readonly UserWorkFace[] = [
+  { face: 'the assigned-work count', method: 'GET', path: '/security/users/usr_nobody_30205/assigned-work' },
+  {
+    face: 'the assigned-work hand-over', method: 'POST', path: '/security/users/usr_nobody_30205/assigned-work/transfer',
+    body: { toUserId: 'usr_nobody_either_30205' },
+  },
+];
+
 // ── #22432 — the translation faces (dispatcher-mounted; runtime domains/i18n.ts)
 //
 // One handler body serves every face, so the floor is its first statement. The
@@ -809,6 +830,40 @@ describe('showcase: anonymous posture is uniform across surfaces (#2567)', () =>
     expect(await adminRes.text(), 'the retired path answers the admin the ordinary not-found body').toBe(controlBody);
   });
 
+  // ── a user's assigned work (@objectstack/rest) — #30205 ─────────────────
+  //
+  // The refusal is each handler's first act, so the anonymous body is the REST
+  // seam's shared one, whole, and nothing is counted or moved. The member
+  // controls are the teeth: with a session the count is served 200 and the
+  // hand-over reaches its own target check (404), so both doors are mounted
+  // on this boot and the 401 is the floor's answer.
+  it.each(USER_WORK_FACES)('an anonymous caller on $face is denied (401) and served nothing', async (face) => {
+    const r = await anon(face.method, face.path, face.body);
+    expect(r.status, `${face.face}: an anonymous caller must be refused by the floor`).toBe(ANONYMOUS_DENY_STATUS);
+    const body = await r.json();
+    expect(body, `${face.face}: the refusal is the REST seam's shared body, whole`).toEqual(ANONYMOUS_DENY_BODY);
+    expect(body, `${face.face}: nothing of the work rides on the refusal`).not.toHaveProperty('data');
+  });
+
+  it('a signed-in member is served the assigned-work count (200) — the control', async () => {
+    const r = await stack.apiAs(memberToken, 'GET', USER_WORK_FACES[0].path);
+    expect(r.status, 'an authenticated member must clear the floor and be served the count').toBe(200);
+    const body = await r.json();
+    expect(body.data, 'the served body is the count of a user who holds nothing').toMatchObject({
+      userId: 'usr_nobody_30205', total: 0, objects: [],
+    });
+  });
+
+  it('a signed-in member reaches the hand-over\'s own target check (404), and nothing moves — the control', async () => {
+    const face = USER_WORK_FACES[1];
+    const r = await stack.apiAs(memberToken, face.method, face.path, face.body);
+    expect(r.status, 'an authenticated member must clear the floor and meet the target check').toBe(404);
+    const body = await r.json();
+    expect(body.error?.details?.fields?.[0], 'the refusal names the unknown target').toMatchObject({
+      field: 'toUserId', code: 'reference_not_found',
+    });
+  });
+
   // ── the translation faces (dispatcher-mounted; runtime domains/i18n.ts) — #22432
   //
   // The same domain-wide shape as analytics: the floor is the handler's first
 
@@ -2,6 +2,7 @@
 // [#30205] The REST face of a user's assigned work: the counts and the hand-over.
 
 import { describe, it, expect, vi } from 'vitest';
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { RestServer } from './rest-server';
 
 function mockServer() {
@@ -35,8 +36,12 @@ function mockEngine() {
     getConfigs: () => ({ ticket: { name: 'ticket', fields: { owner_id: { type: 'lookup', reference: 'sys_user' } } } }),
     count: vi.fn(async (_o: string, q: any) => rows.filter((r) => r.owner_id === q.where.owner_id).length),
     find: vi.fn(async (o: string, q: any) => (o === 'sys_user' ? users : rows).filter((r: any) =>
-      Object.entries(q.where).every(([k, v]) => r[k] === v)).slice(0, q.limit ?? Infinity)),
+      Object.entries(q.where).every(([k, v]) => {
+        if (k.startsWith('$')) throw new Error('fake engine: unsupported logical operator ' + k);
+        return r[k] === v;
+      })).slice(0, q.limit ?? Infinity)),
     update: vi.fn(async (_o: string, data: any, opts: any) => {
+      assertEngineUpdateDispatch(data, opts);
       const row = rows.find((r) => r.id === opts.where.id)!;
       Object.assign(row, data);
       return row;
 
@@ -30,7 +30,7 @@
  * closures and the `objectQLProvider` field as a getter, read at request time.
  */
 
-import { sendError, sendServerFault } from '@objectstack/types';
+import { sendError, sendOk, sendServerFault } from '@objectstack/types';
 import {
     countUserAssignedWork,
     transferUserAssignedWork,
@@ -108,7 +108,7 @@ export function registerUserWorkEndpoints(this: UserWorkRouteHost, basePath: str
                 const engine = await resolveEngine(environmentId, req);
                 if (!engine) return sendError(res, 501, 'NOT_IMPLEMENTED', 'No data engine is configured on this deployment');
                 const summary = await countUserAssignedWork(engine, userId, context);
-                return res.json({ success: true, data: summary });
+                return sendOk(res, summary);
             } catch (err) {
                 return sendServerFault(res, 500, 'INTERNAL_ERROR', 'Counting the user\'s assigned work failed', err);
             }
@@ -151,7 +151,7 @@ export function registerUserWorkEndpoints(this: UserWorkRouteHost, basePath: str
                         objects,
                         describeFailure: rowFailureAnswer,
                     });
-                    return res.json({ success: true, data: report });
+                    return sendOk(res, report);
                 } catch (err) {
                     if (!(err instanceof UserWorkTransferRefusal)) throw err;
                     return sendError(res, err.status, err.code, err.message, err.field ? {
 
@@ -246,6 +246,8 @@ const MODULES = {
   'packages/services/service-datasource/src/admin-routes.ts': { responses: 0, ok: 0, err: 0 },
   'packages/rest/src/external-datasource-routes.ts': { responses: 0, ok: 0, err: 0 },
   'packages/rest/src/package-routes.ts': { responses: 0, ok: 0, err: 0 },
+  // [#30205] The assigned-work count and hand-over: born on the shared pair.
+  'packages/rest/src/user-work-routes.ts': { responses: 0, ok: 0, err: 0 },
   // #3636 put the right envelope on this module's three read routes but built it
   // inline in four places, so it carried a ratchet at 5 / 4 / 1 until those
   // collapsed behind a local `sendOk` — and then onto the shared one.
 
@@ -31,6 +31,11 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/core/src/security/user-assigned-work.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/core/src/utils/metadata-activation-store.test.ts",
       "verb": "update",
@@ -4721,6 +4726,11 @@
       "verb": "findOne",
       "pinned": 1
     },
+    {
+      "file": "packages/rest/src/user-work-routes.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/runtime/src/action-body-write-stale-summary.test.ts",
       "verb": "delete",