@@ -66,6 +66,27 @@ describe('buildEffectiveObjectPermissions', () => {
     expect(map).toEqual({ deal: { allowRead: true } });
   });
 
+  it('seeds before it covers: an entry the seed placed keeps its place and only gains grants', () => {
+    const schemas: Record<string, any> = {
+      a_open: { name: 'a_open' },
+      b_private: { name: 'b_private', access: { default: 'private' } },
+      c_open: { name: 'c_open' },
+    };
+    const map: any = buildEffectiveObjectPermissions(
+      [
+        { objects: { '*': { allowRead: true, viewAllRecords: true } } },
+        { objects: { '*': { allowCreate: true, allowRead: true, allowEdit: true } } },
+      ],
+      { allSchemas: () => Object.values(schemas), schemaOf: (n) => schemas[n] },
+    );
+    // Registration order, not "covered first, seeded after".
+    expect(Object.keys(map)).toEqual(['*', 'a_open', 'b_private', 'c_open']);
+    expect(Object.keys(map.a_open)).toEqual(['allowCreate', 'allowRead', 'allowEdit', 'allowDelete', 'apiOperations']);
+    expect(map.a_open).toMatchObject({ allowCreate: true, allowRead: true, allowEdit: true, allowDelete: false });
+    // The private object takes nothing from the plain wildcard; the read bypass still reads it.
+    expect(map.b_private).toMatchObject({ allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false });
+  });
+
   it('with no schema source at all it is the bare merge plus the fold', () => {
     const map: any = buildEffectiveObjectPermissions([
       { objects: { '*': { modifyAllRecords: true }, deal: { allowRead: false } } },
@@ -74,3 +95,108 @@ describe('buildEffectiveObjectPermissions', () => {
     expect(map.deal.apiOperations).toBeUndefined();
   });
 });
+
+/**
+ * [#20083] A plain `'*'` — a wildcard carrying neither super-user bit — is
+ * materialised onto the registered objects it covers, per set, the way
+ * `PermissionEvaluator.checkObjectPermission` resolves it: a set's explicit
+ * entry is that set's whole answer for the object; otherwise its wildcard
+ * applies to a public object and never to a private one. Without it the map
+ * held no entry for an object reached only through such a wildcard, and
+ * `current_user.can()` read "no grant" where the server allows.
+ *
+ * The enforcement-side half of this parity — every verb, shipped sets, the
+ * real `can()` against the real evaluator — is pinned table-driven in
+ * plugin-security's `get-effective-object-permissions.test.ts`, the one
+ * package that holds both functions.
+ */
+describe('[#20083] plain wildcard coverage', () => {
+  const SCHEMAS: Record<string, any> = {
+    crm_account: { name: 'crm_account' },
+    crm_lead: { name: 'crm_lead', enable: { apiMethods: ['get', 'list'] } },
+    crm_secret: { name: 'crm_secret', access: { default: 'private' } },
+    crm_note: { name: 'crm_note', access: { default: 'public' } },
+  };
+  const source = { allSchemas: () => Object.values(SCHEMAS), schemaOf: (n: string) => SCHEMAS[n] };
+  const WILD = { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true, allowTransfer: false, viewAllRecords: false, modifyAllRecords: false };
+
+  it('puts a plain wildcard\'s grants on every registered public object no set names', () => {
+    const map: any = buildEffectiveObjectPermissions([{ objects: { '*': WILD } }], source);
+    for (const name of ['crm_account', 'crm_lead', 'crm_note']) {
+      expect(map[name], name).toMatchObject({ allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true });
+    }
+    // Only `true` bits travel: a wildcard's `false` grants nothing and is not copied.
+    expect(map.crm_account).not.toHaveProperty('allowTransfer');
+    expect(map.crm_account).not.toHaveProperty('modifyAllRecords');
+    // The later passes still run over the new entries.
+    expect(map.crm_lead.apiOperations).toEqual(expect.arrayContaining(['get', 'list']));
+    expect(map.crm_lead.apiOperations).not.toContain('update');
+  });
+
+  it('never covers a private object', () => {
+    const map: any = buildEffectiveObjectPermissions([{ objects: { '*': WILD } }], source);
+    expect(map).not.toHaveProperty('crm_secret');
+  });
+
+  it('never covers an object the registry does not hold', () => {
+    const map: any = buildEffectiveObjectPermissions([{ objects: { '*': WILD } }], source);
+    expect(Object.keys(map).sort()).toEqual(['*', 'crm_account', 'crm_lead', 'crm_note']);
+  });
+
+  it('a set that names the object contributes its explicit entry, never its own wildcard', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': WILD, crm_account: { allowRead: true, allowEdit: false } } }],
+      source,
+    );
+    expect(map.crm_account).toMatchObject({ allowRead: true, allowEdit: false });
+    expect(map.crm_account).not.toHaveProperty('allowDelete');
+    expect(map.crm_note).toMatchObject({ allowEdit: true, allowDelete: true });
+  });
+
+  it('ANOTHER set\'s plain wildcard widens a present entry, bit by bit', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [
+        { objects: { crm_account: { allowRead: true, allowEdit: false } } },
+        { objects: { '*': { allowRead: true, allowEdit: true, allowExport: true } } },
+      ],
+      source,
+    );
+    expect(map.crm_account).toEqual({ allowRead: true, allowEdit: true, allowExport: true });
+  });
+
+  it('an export-only wildcard lends its bit to a present entry, and adds no entry of its own', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [
+        { objects: { crm_account: { allowRead: true } } },
+        { objects: { '*': { allowExport: true } } },
+      ],
+      source,
+    );
+    expect(map.crm_account).toEqual({ allowRead: true, allowExport: true });
+    // Export is `grant ∧ read`: alone it grants no verb, so nothing is added for it.
+    expect(Object.keys(map).sort()).toEqual(['*', 'crm_account']);
+  });
+
+  it('a wildcard that grants nothing adds nothing', () => {
+    const map: any = buildEffectiveObjectPermissions([{ objects: { '*': { allowRead: false } } }], source);
+    expect(map).toEqual({ '*': { allowRead: false } });
+  });
+
+  it('leaves a super-user wildcard to the seed and the fold', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': { ...WILD, viewAllRecords: true, modifyAllRecords: true } } }],
+      source,
+    );
+    // Seeded all-false, then folded: the super-user entry shape, not the wildcard's own bits.
+    expect(Object.keys(map.crm_account)).toEqual(['allowCreate', 'allowRead', 'allowEdit', 'allowDelete', 'apiOperations']);
+    // …and the private object is the seed's, as before.
+    expect(map.crm_secret).toMatchObject({ allowRead: true, allowEdit: true });
+  });
+
+  it('a throwing registry leaves the merge standing and covers nothing', () => {
+    const map: any = buildEffectiveObjectPermissions([{ objects: { '*': WILD } }], {
+      allSchemas: () => { throw new Error('registry down'); },
+    });
+    expect(map).toEqual({ '*': WILD });
+  });
+});
@@ -10,9 +10,10 @@
 // reintroduced here — the second copy that would let the console and the
 // server's own `current_user.can()` disagree — turns this red.
 //
-// The fixture makes every step of the composition fire (merge, super-user
-// seed, fold, managed-write clamp, apiOperations annotation), because an
-// equality over a map none of them touched would pin nothing.
+// The fixtures make every step of the composition fire (merge, super-user
+// seed, plain-wildcard coverage, fold, managed-write clamp, apiOperations
+// annotation), because an equality over a map none of them touched would pin
+// nothing.
 
 import { describe, it, expect } from 'vitest';
 import { Hono } from 'hono';
@@ -48,7 +49,7 @@ const ql = {
     getSchema: (name: string) => SCHEMAS[name],
 };
 
-function mount() {
+function mount(resolved: unknown[] = RESOLVED) {
     const services: Record<string, unknown> = {
         auth: {
             api: {
@@ -60,7 +61,7 @@ function mount() {
         },
         objectql: ql,
         metadata: { list: async () => [] as unknown[] },
-        security: { resolvePermissionSetsForContext: async () => RESOLVED },
+        security: { resolvePermissionSetsForContext: async () => resolved },
     };
     const app = new Hono();
     registerCurrentUserEndpoints({
@@ -92,6 +93,25 @@ describe('[#18783] /auth/me/permissions `objects` is the one effective-map funct
         expect(Array.isArray(body.objects.report.apiOperations)).toBe(true);     // annotation
     });
 
+    it('[#20083] a PLAIN wildcard reaches every registered public object it covers — the same bytes', async () => {
+        // The wall-less org admin's shape: a `'*'` with no super-user bit, and a
+        // second set naming one object explicitly. The server lets this subject
+        // write `report` and `deal` through the wildcard, so the map carries them.
+        const plain = [
+            { name: 'ops_plain', objects: { '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true } }, fields: {} },
+            { name: 'sales', objects: { deal: { allowRead: true, allowEdit: false } }, fields: {} },
+        ];
+        const body: any = await (await mount(plain).request(`http://localhost${ME_PERMISSIONS}`)).json();
+        const expected = buildEffectiveObjectPermissions(plain, {
+            allSchemas: () => ql.registry.getAllObjects(),
+            schemaOf: (name) => ql.getSchema(name),
+        });
+        expect(JSON.stringify(body.objects)).toBe(JSON.stringify(expected));
+        expect(body.objects.report).toMatchObject({ allowRead: true, allowEdit: true });        // named by no set
+        expect(body.objects.deal).toMatchObject({ allowRead: true, allowEdit: true });          // another set's wildcard widens it
+        expect(body.objects.sys_member).toMatchObject({ allowRead: true, allowEdit: false });   // the clamp still has the last word
+    });
+
     it('keeps the rest of the envelope on its own merges', async () => {
         const body: any = await (await mount().request(`http://localhost${ME_PERMISSIONS}`)).json();
         expect(body.permissionSets).toEqual(['ops_admin', 'sales']);