@@ -0,0 +1,10 @@
+---
+'@objectstack/plugin-security': minor
+---
+
+feat(plugin-security): `getRecordFieldAccess` answers `writable`, from the write gate run over an update of the row
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+The record field-access answer gains `writable`. It is not composed from the gate's parts: the plugin keeps the authorization middleware it registers on the engine and runs that same function over a by-id update of the stored row with an empty payload, ending the chain before the engine's executor (hooks, validation, the driver write and audit). Every row-level gate the write meets is therefore the one the verdict meets: the object grant, the row-level security pre-image with the ownership floor, and the controlled-by-parent master. At the chain's end it asks plugin-sharing's by-id gate with the context as the middleware stamped it. Any refusal answers `false`, and so does a boot with no engine. The probe runs on a copy of the caller's context and advances no write epoch, so it leaves no shared state behind. `editable` is unchanged.
@@ -0,0 +1,10 @@
+---
+'@objectstack/plugin-sharing': minor
+---
+
+feat(plugin-sharing): `SharingService.admitsByIdWrite` — the by-id write gate the middleware refuses on
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+The sharing middleware's by-id `update` / `delete` gate is now one service method, `admitsByIdWrite(object, recordId, verb, context)`, and the middleware refuses exactly when it answers `false`. The same calls run in the same order: `canEdit` / `canDelete`, the delegator's gate for an on-behalf-of write, then the authored-row-write deferral. `byIdWriteGateInstalled` says whether the middleware is installed (`false` under `enforce: false`). `plugin-security` asks the method for the record field-access answer's `writable`, so that verdict is the sharing gate's own. Refusals, their messages and their log lines are unchanged.
@@ -0,0 +1,12 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): the record field-access answer says whether the record itself is writable
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+`GetRecordFieldAccessResponseSchema` (`@objectstack/spec/api`, the answer of `GET /api/v1/data/{object}/{id}/field-access`) gains `writable: boolean`: whether the caller may update this record at all, judged by the write gate on the stored row (the object's edit permission, record sharing and ownership, row-level security, and the parent's edit access for a record controlled by its parent). `false` means an update that leaves the record as stored is refused: the caller may not edit it, or the stored record fails a row-level security `check` (a save moving the checked value back inside the check can still pass). `true` does not promise a save succeeds: a pending approval's record lock, conditional read-only and validation rules on the values sent, a data source that refuses writes, the platform's own rules for its own records (comments, attachments, mail messages, approval requests) and an object the API serves read-only are still judged at save. `editable` is unchanged and stays field-level. `ISecurityService.getRecordFieldAccess` documents the member: the write gate's own verdict, never a second evaluator.
+
+Supersedes, in the same release: the `@objectstack/spec` note "a record-scoped field projection, judged on the stored row by the write gate" lists the answer as `{ object, recordId, readable, editable }`; it is now `{ object, recordId, readable, editable, writable }`.
@@ -66,11 +66,20 @@ fields: {
   answer a record's edit form and the record page's in-place edit read. A
   list view's inline edit locks a whole column, which cannot split per row,
   so it keeps the row-blind answer. A row that is absent or that the caller
-  cannot read answers the record read's `404`. The answer is field-level
+  cannot read answers the record read's `404`. `editable` is field-level
   only: the object grant and the record's row-level write scope (sharing,
-  row-level security, ownership) are not part of it, so on a row the caller
-  may read but not write it still lists fields as editable, and the update
-  is refused as a whole.
+  row-level security, ownership) are not part of it. Those are `writable`,
+  the row's own verdict: `false` on a row the caller may read but not write,
+  where an update is refused as a whole, so a client need not offer the
+  edit at all. It comes from the write gate too, run over an update of the
+  row without performing it. A stored row outside a row-level `check` also
+  answers `false`: an update that leaves it as it is fails the check, while a
+  save that moves the checked value back inside it can pass. `true` does not
+  promise a save succeeds: a pending approval's record lock, rules judged on
+  the values sent (conditional read-only, validation), a data source that
+  refuses writes, the platform's own rules for its own records (comments,
+  attachments, mail messages, approval requests) and an object the API serves
+  read-only still apply when the record is saved.
 - **Union without deny is unchanged.** A matched conditioned lock is still
   out-voted by another set's unconditioned `editable: true`; an entry
   without `when` votes on every row, as before (ADR-0066 ⑧, note of
 
@@ -1757,7 +1757,8 @@ The published metadata item body, opaque by ruling (1C). Shape is the item's own
 | **object** | `string` | ✅ | Object name |
 | **recordId** | `string` | ✅ | The record the projection was judged on |
 | **readable** | `string[]` | ✅ | Fields the caller may read on this object. Reads are judged row-blind, so this equals the object-wide read projection |
-| **editable** | `string[]` | ✅ | Fields the caller may write on this record, as field-level security judges an update of the stored row: a row-conditioned field permission locks a field only on the rows its condition names. A field absent here is refused by the write gate. The object grant, the record's row-level write scope (sharing, row-level security, ownership) and a field's own rules (readonly, computed types) are not part of it |
+| **editable** | `string[]` | ✅ | Fields the caller may write on this record, as field-level security judges an update of the stored row: a row-conditioned field permission locks a field only on the rows its condition names. A field absent here is refused by the write gate. The object grant, the record's row-level write scope (sharing, row-level security, ownership; see `writable`) and a field's own rules (readonly, computed types) are not part of it |
+| **writable** | `boolean` | ✅ | Whether the caller may update this record at all, judged by the write gate on the stored row: the object's edit permission, record sharing and ownership, row-level security, and a parent record's edit access for a record controlled by its parent. False means an update that leaves the record as it is stored is refused: either the caller may not edit this record, or the stored record fails a row-level security check that every save must satisfy, which a save moving the checked value back inside that check can still pass. True does not promise that a save succeeds: a pending approval that locks the record, conditional read-only and validation rules on the values sent, a data source that refuses writes, the platform's own rules for its own records (comments, attachments, mail messages, approval requests) and an object the API serves read-only are judged when the record is saved |
 
 
 ---
 
@@ -0,0 +1,146 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#27175] Would a by-id update of this stored row pass the row-level write
+ * gates? — the verdict the record field-access answer carries as `writable`,
+ * so a record's edit form stops offering an edit the gate refuses whole.
+ *
+ * ⛔ No second evaluator. The answer is not composed here from the gates'
+ * parts: the probe RUNS the gates. It hands the authorization middleware this
+ * plugin registers on the engine — the same function object, so every step
+ * the write meets is the step the probe meets — a synthetic by-id `update` of
+ * `recordId` with an empty payload, and ends the chain where the engine would
+ * take over. Reaching that point means the middleware admitted the write; any
+ * refusal on the way is `false`. Ruling of record 6457467702 (letter B) on the
+ * record projection: the client never re-derives a lock, the server answers
+ * with the gate's own judgement.
+ *
+ * Two middlewares refuse a by-id write for its ROW, and the probe asks both:
+ *
+ *  - this plugin's: the object grant (step 2, with the ADR-0066 D3 capability
+ *    gate and the ADR-0090 D10 delegator ahead of it), the row-level security
+ *    pre-image with the platform ownership floor and its sharing deferral
+ *    (step 2.7), and the controlled-by-parent master (step 2.8);
+ *  - plugin-sharing's, which runs inside this one: its by-id gate, asked
+ *    through `SharingService.admitsByIdWrite` — the method its middleware
+ *    refuses on — with the context exactly as this middleware stamped it for
+ *    the next one (the write depth, an external principal's grant). Skipped
+ *    when the deployment runs without that middleware (`enforce: false`), as
+ *    the write skips it.
+ *
+ * ## Why an empty payload
+ *
+ * The question is the ROW, not a change set: every gate above judges the
+ * stored row and the caller, and none reads the payload. The gates that do —
+ * field-level security (its own answer is `editable`, field by field), the
+ * masked echo, the owner forge — admit an empty one, so the probe asks
+ * nothing about which values a save may carry. One payload gate still speaks:
+ * the RLS `check` post-image (step 3.6) is the stored row merged with nothing,
+ * so a stored row outside a `check` scope answers `false`, while a save that
+ * moves the checked field back inside that scope is admitted by the same
+ * step. That is the gate's own verdict on an update that leaves the row as it
+ * is, and the published describe says so.
+ *
+ * ## Why it writes nothing
+ *
+ * The engine's executor — the `beforeUpdate` hooks, validation, the driver
+ * write, the `afterUpdate` hooks and every audit row they produce — runs
+ * after the last middleware, and the probe never reaches it: the chain's end
+ * throws a sentinel that only this function catches. Before that point the
+ * middleware refuses, reads, and stamps its operation and the context it is
+ * handed; the probe owns the operation and hands a copy of the caller's
+ * context, so the caller's own is never stamped. Its one shared write, the
+ * permission-set memo epoch it advances for a write, is skipped for a probe
+ * ({@link isRowWriteProbe}): a probe changes no grant.
+ *
+ * ## What `true` does not cover
+ *
+ * Rules outside those two middlewares, which a save can still meet: a
+ * pending approval's record lock (its own reader, the approval service's
+ * `getRecordLock`), conditional read-only rules and validation rules on the
+ * values sent, an external datasource that refuses writes, another plugin's
+ * own rules for its own objects (comments, attachments, mail messages,
+ * approval requests), and the REST door's exposure policy for the object (an
+ * object served read-only refuses the PATCH before the engine). ⛔ So `true`
+ * never means "this save will succeed"; `false` means the gate refuses an
+ * update that leaves the row as it is stored.
+ *
+ * Fails CLOSED: no middleware registered (no engine), an unexpected throw, or
+ * a middleware that answers without passing the operation on are all `false`.
+ */
+
+/**
+ * Marks the synthetic operation {@link probeRecordRowWrite} hands the
+ * middleware. A module-private symbol on the operation context, which only
+ * this module constructs — no request, payload or execution context can carry
+ * it.
+ */
+export const ROW_WRITE_PROBE: unique symbol = Symbol('objectstack.security.rowWriteProbe');
+
+/** Whether `opCtx` is a row write probe's synthetic operation. */
+export function isRowWriteProbe(opCtx: unknown): boolean {
+  return !!opCtx && typeof opCtx === 'object' && (opCtx as Record<symbol, unknown>)[ROW_WRITE_PROBE] === true;
+}
+
+/**
+ * Log a gate refusal. A refused write logs `warn`: someone tried to change a
+ * row they may not. A refused probe is a form asking whether to offer an edit
+ * at all, so it logs `debug` with `probe: true` — otherwise every open of a
+ * read-only record writes a line indistinguishable from a denied write, and a
+ * warning channel that fires on reads is one operators learn to ignore.
+ */
+export function logGateRefusal(
+  logger: { warn?: (...args: any[]) => void; debug?: (...args: any[]) => void } | null | undefined,
+  opCtx: unknown,
+  ...args: [message: string, meta?: Record<string, unknown>]
+): void {
+  if (isRowWriteProbe(opCtx)) {
+    logger?.debug?.(args[0], { ...args[1], probe: true });
+    return;
+  }
+  logger?.warn?.(...args);
+}
+
+/** The engine middleware signature `registerAuthzMiddleware` registers. */
+export type AuthzMiddlewareFn = (opCtx: any, chainNext: () => Promise<void>) => Promise<void>;
+
+/** Thrown at the chain's end: the middleware admitted the write. Never escapes. */
+class RowWriteProbeReachedEngine {}
+
+/**
+ * Run `middleware` over a synthetic by-id update of `object`/`recordId` under
+ * a copy of `context`, and answer whether the write reaches the engine.
+ * `sharingAdmits` is asked at the chain's end with the context as the
+ * middleware stamped it; see the module header for both legs.
+ */
+export async function probeRecordRowWrite(
+  middleware: AuthzMiddlewareFn | null | undefined,
+  object: string,
+  recordId: string,
+  context: unknown,
+  sharingAdmits: (stampedContext: any) => Promise<boolean>,
+): Promise<boolean> {
+  if (typeof middleware !== 'function') return false;
+  const probeContext: Record<string, unknown> = { ...((context ?? {}) as Record<string, unknown>) };
+  // The shape the engine's `update()` builds for a by-id update.
+  const opCtx: Record<string | symbol, unknown> = {
+    object,
+    operation: 'update',
+    data: {},
+    options: { where: { id: recordId }, context: probeContext },
+    context: probeContext,
+    [ROW_WRITE_PROBE]: true,
+  };
+  const reachedEngine = new RowWriteProbeReachedEngine();
+  let admitted = false;
+  try {
+    await middleware(opCtx, async () => {
+      admitted = (await sharingAdmits(opCtx.context)) === true;
+      throw reachedEngine;
+    });
+  } catch (e) {
+    if (e === reachedEngine) return admitted;
+    return false;
+  }
+  return false;
+}
@@ -70,6 +70,14 @@
  * imported from the module `security-plugin.ts` imports it from.
  *
  * Nothing re-exports this module, so the published surface does not move.
+ *
+ * ## [#27175] The handler is also returned
+ *
+ * The function registers the handler and returns it, and `start()` keeps it,
+ * so the record field-access answer's `writable` can run the very handler a
+ * write meets over a synthetic by-id update (`record-row-write-probe.ts`).
+ * The handler knows that operation in one place only: it advances no write
+ * epoch for it.
  */
 import {
   type PluginContext,
@@ -92,6 +100,7 @@ import { crossFieldClassRefusalCarriedBy, findCrossFieldClassRefusal } from '@ob
 import type { SecurityPlugin } from './security-plugin.js';
 import { isGuestEnvelope, requiredCapsForOperation } from './security-plugin.js';
 import { assertFlowSystemIdentityWriteAllowed } from './flow-system-identity-write-refusal.js';
+import { isRowWriteProbe, logGateRefusal, type AuthzMiddlewareFn } from './record-row-write-probe.js';
 import {
   intersectDelegatedScope,
 } from './explain-engine.js';
@@ -270,8 +279,11 @@ export function registerAuthzMiddleware(
   ctx: PluginContext,
   ql: IObjectQLEngine,
   metadata: IMetadataService,
-): void {
-  ql.registerMiddleware(async (opCtx: any, chainNext: () => Promise<void>) => {
+): AuthzMiddlewareFn {
+  // [#27175] The handler is kept as well as registered: the record
+  // field-access answer's `writable` runs THIS function over a synthetic by-id
+  // update (`record-row-write-probe.ts`), so the verdict is the gate's own.
+  const authzMiddleware: AuthzMiddlewareFn = async (opCtx: any, chainNext: () => Promise<void>) => {
     // [#21771] Whether THIS operation was issued from inside another engine
     // operation's pipeline (a cascade, a hook's `ctx.api` write), read before
     // this operation opens a scope of its own; and the scoped `next` every
@@ -309,8 +321,12 @@ export function registerAuthzMiddleware(
     // (which only compares equality) but not harmless on the bus: the
     // `authz.invalidated` bridge publishes per bump. The guard below is
     // therefore about message count, not about correctness.
+    //
+    // [#27175] A row write probe is no write: it changes no grant, and it
+    // must leave no shared state behind, so it advances nothing.
     if (
       !this.epoch.seamOwnedByEngine &&
+      !isRowWriteProbe(opCtx) &&
       (opCtx.operation === 'insert' || opCtx.operation === 'update' || opCtx.operation === 'delete')
     ) {
       this.epoch.bump('write');
@@ -663,7 +679,7 @@ export function registerAuthzMiddleware(
           const developerMessage =
             `[Security] Access denied: '${opCtx.object}' (operation '${opCtx.operation}') requires capability ` +
             `[${required.join(', ')}] — ${missing.length > 0 ? 'caller' : 'the delegator'} is missing [${allMissing.join(', ')}]`;
-          ctx.logger.warn(developerMessage, {
+          logGateRefusal(ctx.logger, opCtx, developerMessage, {
             operation: opCtx.operation,
             object: opCtx.object,
             requiredPermissions: required,
@@ -793,7 +809,7 @@ export function registerAuthzMiddleware(
         const developerMessage =
           `[Security] Access denied: operation '${opCtx.operation}' on object '${opCtx.object}' ` +
           `is not permitted for positions [${positions.join(', ')}]`;
-        ctx.logger.warn(developerMessage, {
+        logGateRefusal(ctx.logger, opCtx, developerMessage, {
           operation: opCtx.operation,
           object: opCtx.object,
           positions,
@@ -1108,7 +1124,7 @@ export function registerAuthzMiddleware(
             const developerMessage =
               `[Security] Access denied: not permitted to ${opCtx.operation} this ` +
               `'${opCtx.object}' record (row-level security)`;
-            ctx.logger.warn(developerMessage, {
+            logGateRefusal(ctx.logger, opCtx, developerMessage, {
               operation: opCtx.operation,
               object: opCtx.object,
               recordId: targetId,
@@ -1758,7 +1774,9 @@ export function registerAuthzMiddleware(
         // the engine (an insert, a predicate update) and a by-id update
         // judged here answer a caller identically.
         const denyCheck = (): never => {
-          this.logger.warn?.(
+          logGateRefusal(
+            this.logger,
+            opCtx,
             `[Security] RLS check FAILED on ${opCtx.operation} '${opCtx.object}' — write denied (fail-closed)`,
           );
           // [#7451] The third end-user situation, and the only one of the
@@ -1774,7 +1792,7 @@ export function registerAuthzMiddleware(
           // Naming the object without the field would send the user hunting.
           const developerMessage =
             `[Security] Access denied: the ${opCtx.operation} would violate a row-level CHECK on '${opCtx.object}'`;
-          ctx.logger.warn(developerMessage, {
+          logGateRefusal(ctx.logger, opCtx, developerMessage, {
             operation: opCtx.operation,
             object: opCtx.object,
             positions,
@@ -2381,5 +2399,7 @@ export function registerAuthzMiddleware(
     // {@link maskOperationResult}, which the ADR-0056 public-form grant
     // branch above reads too — one masker for both.
     this.maskOperationResult(opCtx, permissionSets, secMeta, delegatorSets);
-  });
+  };
+  ql.registerMiddleware(authzMiddleware);
+  return authzMiddleware;
 }