@@ -0,0 +1,16 @@
+---
+'@object-ui/plugin-grid': patch
+'@object-ui/components': patch
+'@object-ui/types': patch
+---
+
+fix(plugin-grid): inline edit opens no cell editor on a row the server's record-grained write verdict refuses
+
+Clause-②: no
+Metadata-protocol: none
+
+An editable grid gated its cells on the object-level grant only, while the row kebab on the same rows also read the server's record-grained `update` verdict. A row that sharing, ownership or RLS refuses lost Edit from its kebab but still opened a cell editor, and the save was refused by the server. Now the cells read the same verdict as the kebab:
+
+- **A refused row reads as read-only.** No click, double-click or Enter opens an editor on it, and its cells show no edit cursor. A click on such a cell reaches the row as it does on a read-only grid. Selection, navigation and the row menu are unchanged.
+- **One verdict, fail open.** The cells and the kebab read one batched explain probe for the rows on screen. A row with no answer yet, a failed or absent probe, or a row with no id keeps the object-level behaviour, as before. An editable grid with no kebab Edit now asks the same probe.
+- **New runtime slot `DataTableSchema.isRowEditable`.** `(row) => boolean`, supplied by the host and read by `data-table` before it opens a cell editor. It only narrows `editable`: absent, every row follows `editable` and the column locks as before. It is a function, not metadata, so the zod mirror refuses an authored value by name.
@@ -209,8 +209,29 @@ afterAll(() => {
 beforeEach(() => {
   vi.clearAllMocks();
   lastGridProps = null;
+  // objectstack#27365 — an inline-editable grid asks the record-grained
+  // `update` verdict for its rows (`POST /api/v1/security/explain`). Answer it
+  // here, every row permitted, so it never reaches the network; any other URL
+  // is refused loudly rather than answered.
+  vi.stubGlobal('fetch', vi.fn(async (url: unknown, init?: { body?: unknown }) => {
+    if (!String(url).endsWith('/api/v1/security/explain')) {
+      throw new Error(`unexpected fetch in this suite: ${String(url)}`);
+    }
+    const body = JSON.parse(String(init?.body ?? '{}')) as { recordIds?: string[] };
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({
+        allowed: true,
+        records: (body.recordIds ?? []).map((recordId) => ({ recordId, visible: true })),
+      }),
+    };
+  }));
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
 });
-afterEach(() => cleanup());
 
 const settle = () => act(() => new Promise<void>((resolve) => setTimeout(resolve, 100)));
 
 
@@ -0,0 +1,112 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectstack#27365 — `DataTableSchema.isRowEditable`, the host's per-row
+ * inline-edit verdict.
+ *
+ * `editable` and the per-column locks answer for every row alike. A host that
+ * knows one row is refused by the server (ObjectGrid, from the record-grained
+ * write verdict) hands the table a per-row predicate; a row it answers `false`
+ * for must read exactly like a row of a read-only table:
+ *
+ *   - no trigger opens an editor on it — click, double-click, Enter;
+ *   - its cells take no edit cursor, and a click on them is NOT swallowed, so
+ *     the row's own click (ObjectGrid's record drawer) still fires;
+ *   - every other row is untouched, and with no predicate every row is
+ *     editable exactly as before.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { fireEvent } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { renderComponent } from './test-utils';
+// Registers the renderers at module scope, NOT inside a `beforeAll` (objectui#3010).
+import '../renderers';
+
+const ROWS = [
+  { id: 'own', name: 'My Project' },
+  { id: 'other', name: 'Legacy Sunset' },
+];
+
+const baseSchema = (extra: Record<string, unknown> = {}) =>
+  ({
+    type: 'data-table' as const,
+    editable: true,
+    columns: [{ header: 'Name', accessorKey: 'name' }],
+    data: ROWS,
+    ...extra,
+  }) as any;
+
+/** The `<td>` showing `text`. */
+const cellOf = (container: HTMLElement, text: string) =>
+  Array.from(container.querySelectorAll('tbody td')).find(
+    (td) => td.textContent?.trim() === text,
+  ) as HTMLElement;
+
+const refuseOther = (row: { id: string }) => row.id !== 'other';
+
+describe('data-table — isRowEditable narrows editing per row (objectstack#27365)', () => {
+  it('a refused row opens no editor on click, and its click reaches the row', () => {
+    const onRowClick = vi.fn();
+    const { container } = renderComponent(
+      baseSchema({ singleClickEdit: true, isRowEditable: refuseOther, onRowClick }),
+    );
+    const cell = cellOf(container, 'Legacy Sunset');
+    expect(cell).not.toHaveClass('cursor-text');
+    fireEvent.click(cell);
+    expect(cell.querySelector('input')).toBeNull();
+    expect(onRowClick).toHaveBeenCalledTimes(1);
+  });
+
+  it('a refused row opens no editor on double-click', () => {
+    const { container } = renderComponent(baseSchema({ isRowEditable: refuseOther }));
+    const cell = cellOf(container, 'Legacy Sunset');
+    fireEvent.doubleClick(cell);
+    expect(cell.querySelector('input')).toBeNull();
+  });
+
+  it('a refused row opens no editor on Enter', () => {
+    const { container } = renderComponent(baseSchema({ isRowEditable: refuseOther }));
+    const cell = cellOf(container, 'Legacy Sunset');
+    fireEvent.keyDown(cell, { key: 'Enter' });
+    expect(cell.querySelector('input')).toBeNull();
+  });
+
+  it('CONTROL: the allowed row of the same table still opens its editor, on each trigger', () => {
+    const { container } = renderComponent(
+      baseSchema({ singleClickEdit: true, isRowEditable: refuseOther }),
+    );
+    const cell = cellOf(container, 'My Project');
+    expect(cell).toHaveClass('cursor-text');
+    fireEvent.click(cell);
+    expect(cell.querySelector('input')).not.toBeNull();
+  });
+
+  it('CONTROL: Enter on the allowed row opens its editor', () => {
+    const { container } = renderComponent(baseSchema({ isRowEditable: refuseOther }));
+    const cell = cellOf(container, 'My Project');
+    fireEvent.keyDown(cell, { key: 'Enter' });
+    expect(cell.querySelector('input')).not.toBeNull();
+  });
+
+  it('CONTROL: with no predicate every row is editable, as before', () => {
+    const { container } = renderComponent(baseSchema({ singleClickEdit: true }));
+    const cell = cellOf(container, 'Legacy Sunset');
+    fireEvent.click(cell);
+    expect(cell.querySelector('input')).not.toBeNull();
+  });
+
+  it('narrows only: a predicate answering `true` cannot open a table that is not `editable`', () => {
+    const { container } = renderComponent(
+      baseSchema({ editable: false, singleClickEdit: true, isRowEditable: () => true }),
+    );
+    const cell = cellOf(container, 'My Project');
+    fireEvent.click(cell);
+    expect(cell.querySelector('input')).toBeNull();
+  });
+});
@@ -1206,6 +1206,7 @@ const DataTableRenderer = ({ schema }: { schema: DataTableSchema }) => {
     borderless = false,
     disableInnerScroll = false,
     rowGroups,
+    isRowEditable,
     // Read ONLY to diagnose it. `data-table` does not resolve `bind` and the
     // objectui#6575 ruling is explicit that it must not start — see
     // `dataTableBindDiagnostic.ts`.
@@ -2262,9 +2263,14 @@ const DataTableRenderer = ({ schema }: { schema: DataTableSchema }) => {
     setDragOverColumn(null);
   };
 
+  // objectstack#27365 — the host's per-row verdict narrows `editable` for one
+  // row. Absent, or answering anything but `false`, the row follows
+  // `editable`; a refused row reads exactly like a row of a read-only table.
+  const rowMayEdit = (row: any): boolean => isRowEditable?.(row) !== false;
+
   // Cell editing handlers
   const startEdit = (row: any, columnKey: string) => {
-    if (!editable) return;
+    if (!editable || !rowMayEdit(row)) return;
     const rowKey = pendingRowKeyOf(row);
 
     // Already editing THIS cell — do nothing. Re-entering would reset `editValue`
@@ -2798,7 +2804,7 @@ const DataTableRenderer = ({ schema }: { schema: DataTableSchema }) => {
       return;
     }
 
-    if (!editable) return;
+    if (!editable || !rowMayEdit(paginatedData[rowIndex])) return;
 
     const column = columns.find(col => col.accessorKey === columnKey);
     if (column?.editable === false) return;
@@ -3654,8 +3660,9 @@ const DataTableRenderer = ({ schema }: { schema: DataTableSchema }) => {
                         // A masked column reads as NOT editable here too
                         // (objectui#10583), so its cell neither shows the
                         // edit cursor nor swallows the row's click —
-                        // `startEdit` would refuse it anyway.
-                        const isEditable = editable && col.editable !== false && !col.masked;
+                        // `startEdit` would refuse it anyway. Nor is a row
+                        // the host's per-row verdict refuses (objectstack#27365).
+                        const isEditable = editable && col.editable !== false && !col.masked && rowMayEdit(row);
                         const isFrozen = frozenColumns > 0 && colIndex < frozenColumns;
                         const frozenOffset = isFrozen
                           ? measuredStickyLefts?.[leadingCellCount + colIndex]
 
@@ -70,7 +70,7 @@ import {
 import { ChevronRight, ChevronLeft, ChevronsLeft, ChevronsRight, Download, Rows2, Rows3, Rows4, AlignJustify, Loader2 } from 'lucide-react';
 import { useRowColor } from './useRowColor';
 import { GroupRow } from './GroupRow';
-import { resolveRowCrudAffordances } from './rowCrudAffordances';
+import { resolveRowCrudAffordances, resolveRowRecordCrudAffordance } from './rowCrudAffordances';
 import { useRecordCrudVerdicts } from './hooks/useRecordCrudVerdicts';
 import { resolveLegacyRowActions } from './resolveLegacyRowActions';
 import { resolveBulkActions, resolvePromotedBulkParams } from './resolveBulkActions';
@@ -1007,10 +1007,13 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
     )),
     [data],
   );
+  // objectstack#27365 — the inline cells ask the same `update` question about
+  // the same rows, so an editable grid whose kebab offers no Edit still asks
+  // it: one batched probe, read by both, never a second one.
   const recordVerdict = useRecordCrudVerdicts({
     objectName,
     recordIds: pageRecordIds,
-    update: canEdit,
+    update: canEdit || inlineEditable,
     delete: canDelete,
   });
 
@@ -2546,6 +2549,15 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
     reorderableColumns: schema.reorderableColumns ?? false,
     // [#5143] The authored key ∧ this principal's write verdict on the object.
     editable: inlineEditable,
+    // objectstack#27365 — …∧ the server's record-grained `update` verdict for
+    // THIS row, read through the very accessor the row kebab reads
+    // (`resolveRowRecordCrudAffordance` over `recordVerdict`), so the cells and
+    // the kebab give one answer for one row. Unknown (no answer yet, a failed
+    // probe, a row with no id) keeps the object-level answer: fail open, never
+    // over-hide. `editable` above is still the gate, so this only narrows.
+    isRowEditable: inlineEditable
+      ? (row: any) => resolveRowRecordCrudAffordance(inlineEditable, recordVerdict(rowRecordId(row), 'update'))
+      : undefined,
     // In-place cell editor: render the dedicated @object-ui/fields widget for
     // the field's type — the SAME control the form uses (select→dropdown,
     // boolean→checkbox, date→date picker, multi-select, …). Returning null lets
 
@@ -27,7 +27,7 @@
  * Each "off" reading is paired with an "on" reading on the same probe.
  */
 import React from 'react';
-import { describe, it, expect, vi, afterEach } from 'vitest';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
 import { render, screen, cleanup, fireEvent, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom';
 
@@ -54,6 +54,20 @@ vi.mock('@object-ui/permissions', async (importOriginal) => {
 import { ActionProvider, SchemaRenderer } from '@object-ui/react';
 // Registers `object-grid`, the block under test.
 import { ObjectGridRenderer } from '../index';
+import { __clearRecordCrudVerdictCache } from '../hooks/useRecordCrudVerdicts';
+import { installExplainDouble } from './explainDouble';
+
+// objectstack#27365 — an editable grid asks the record-grained `update`
+// verdict for the rows on screen even with no kebab Edit wired. Answer it from
+// the double (every row permitted), never the network.
+beforeEach(() => {
+  __clearRecordCrudVerdictCache();
+  installExplainDouble();
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
 
 afterEach(() => {
   cleanup();
 
@@ -55,14 +55,28 @@
  * reference and the SAME records in ONE render, differing only in the declared
  * key — the shape objectui#6875 established and objectui#7154 reused.
  */
-import { describe, it, expect, vi, beforeAll } from 'vitest';
-import { render, screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, within, cleanup } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import React from 'react';
 
 import { ObjectGrid } from '../ObjectGrid';
 import { registerAllFields } from '@object-ui/fields';
 import { ActionProvider, SchemaRendererProvider } from '@object-ui/react';
+import { __clearRecordCrudVerdictCache } from '../hooks/useRecordCrudVerdicts';
+import { installExplainDouble } from './explainDouble';
+
+// objectstack#27365 — an editable grid asks the record-grained `update`
+// verdict for the rows on screen even with no kebab Edit wired. Answer it from
+// the double (every row permitted), never the network.
+beforeEach(() => {
+  __clearRecordCrudVerdictCache();
+  installExplainDouble();
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
 
 registerAllFields();
 
 
@@ -22,15 +22,29 @@
  * The text cell at the bottom is the CONTROL: a widget that stages on every
  * keystroke commits exactly as before, with no focus and so no blur at all.
  */
-import { describe, it, expect, vi, beforeAll } from 'vitest';
-import { render, screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, within, cleanup } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import React from 'react';
 
 import { ObjectGrid } from '../ObjectGrid';
 import { registerAllFields } from '@object-ui/fields';
 import { ActionProvider, SchemaRendererProvider } from '@object-ui/react';
 import { I18nProvider } from '@object-ui/i18n';
+import { __clearRecordCrudVerdictCache } from '../hooks/useRecordCrudVerdicts';
+import { installExplainDouble } from './explainDouble';
+
+// objectstack#27365 — an editable grid asks the record-grained `update`
+// verdict for the rows on screen even with no kebab Edit wired. Answer it from
+// the double (every row permitted), never the network.
+beforeEach(() => {
+  __clearRecordCrudVerdictCache();
+  installExplainDouble();
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
 
 registerAllFields();
 
 
@@ -11,14 +11,28 @@
  * fake server and assert the editor actually exits (its <input> / trigger is
  * gone) while the staged value is preserved (or reverted, for Escape).
  */
-import { describe, it, expect, vi, beforeAll } from 'vitest';
-import { render, screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, within, cleanup } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import React from 'react';
 
 import { ObjectGrid } from '../ObjectGrid';
 import { registerAllFields } from '@object-ui/fields';
 import { ActionProvider, SchemaRendererProvider } from '@object-ui/react';
+import { __clearRecordCrudVerdictCache } from '../hooks/useRecordCrudVerdicts';
+import { installExplainDouble } from './explainDouble';
+
+// objectstack#27365 — an editable grid asks the record-grained `update`
+// verdict for the rows on screen even with no kebab Edit wired. Answer it from
+// the double (every row permitted), never the network.
+beforeEach(() => {
+  __clearRecordCrudVerdictCache();
+  installExplainDouble();
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
 
 registerAllFields();