@@ -187,8 +187,11 @@ describe('[#20083] plain wildcard coverage', () => {
       [{ objects: { '*': { ...WILD, viewAllRecords: true, modifyAllRecords: true } } }],
       source,
     );
-    // Seeded all-false, then folded: the super-user entry shape, not the wildcard's own bits.
-    expect(Object.keys(map.crm_account)).toEqual(['allowCreate', 'allowRead', 'allowEdit', 'allowDelete', 'apiOperations']);
+    // Seeded all-false, then folded: the super-user entry shape, not the wildcard's own key
+    // order — [#20134] with `allowTransfer`, which `modifyAllRecords` grants, appended by the
+    // per-set fold (the wildcard's own `allowTransfer: false` grants nothing and is not copied).
+    expect(Object.keys(map.crm_account)).toEqual(['allowCreate', 'allowRead', 'allowEdit', 'allowDelete', 'allowTransfer', 'apiOperations']);
+    expect(map.crm_account.allowTransfer).toBe(true);
     // …and the private object is the seed's, as before.
     expect(map.crm_secret).toMatchObject({ allowRead: true, allowEdit: true });
   });
@@ -200,3 +203,83 @@ describe('[#20083] plain wildcard coverage', () => {
     expect(map).toEqual({ '*': WILD });
   });
 });
+
+/**
+ * [#20134] A SUPER-USER `'*'` — one carrying `viewAllRecords` or
+ * `modifyAllRecords` — puts on the map every bit it grants, per set, the way
+ * `PermissionEvaluator.checkObjectPermission` resolves it: the seed places an
+ * entry for every registered object the merge left absent, and the per-set
+ * fold reads each set's wildcard through the spec's `objectPermissionGrants`.
+ * The map used to hold only the four bits the merged fold pulls, so
+ * `current_user.can(object, 'transfer')` answered `false` for a platform admin
+ * the server lets transfer, a super-read wildcard lost its own plain bits, and
+ * a super-user wildcard carrying `allowExport` left every unrestricted object
+ * with no entry at all.
+ *
+ * The enforcement-side half — every verb, the shipped super-user sets, the
+ * real `can()` against the real evaluator — is pinned table-driven in
+ * plugin-security's `get-effective-object-permissions.test.ts`.
+ */
+describe('[#20134] super-user wildcard: every bit it grants, per set', () => {
+  const SCHEMAS: Record<string, any> = {
+    crm_account: { name: 'crm_account' },
+    crm_lead: { name: 'crm_lead', enable: { apiMethods: ['get', 'list'] } },
+    crm_secret: { name: 'crm_secret', access: { default: 'private' } },
+  };
+  const source = { allSchemas: () => Object.values(SCHEMAS), schemaOf: (n: string) => SCHEMAS[n] };
+
+  it('the write bypass carries `transfer` onto every entry, a private object\'s included', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': { allowRead: true, allowCreate: true, modifyAllRecords: true } } }],
+      source,
+    );
+    for (const name of Object.keys(SCHEMAS)) {
+      expect(map[name], name).toMatchObject({ allowRead: true, allowEdit: true, allowDelete: true, allowTransfer: true });
+    }
+  });
+
+  it('a super-read wildcard keeps its own plain bits — and nothing it does not grant', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': { viewAllRecords: true, allowEdit: true } } }],
+      source,
+    );
+    for (const name of Object.keys(SCHEMAS)) {
+      expect(map[name], name).toMatchObject({ allowRead: true, allowEdit: true, allowCreate: false, allowDelete: false });
+      expect(map[name], name).not.toHaveProperty('allowTransfer');
+    }
+  });
+
+  it('a set that names the object contributes its explicit entry, never its own wildcard\'s grants', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': { viewAllRecords: true, allowTransfer: true }, crm_account: { allowRead: true } } }],
+      source,
+    );
+    expect(map.crm_account).not.toHaveProperty('allowTransfer');
+    expect(map.crm_lead).toMatchObject({ allowRead: true, allowTransfer: true });
+  });
+
+  it('ANOTHER set\'s super-user wildcard widens a present entry, bit by bit', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [
+        { objects: { crm_account: { allowRead: true } } },
+        { objects: { '*': { viewAllRecords: true, allowTransfer: true, allowExport: true } } },
+      ],
+      source,
+    );
+    // Unrestricted and export-allowed, so annotate has nothing to add to it.
+    expect(map.crm_account).toEqual({ allowRead: true, allowTransfer: true, allowExport: true });
+  });
+
+  it('a super-user wildcard carrying `allowExport` seeds every registered object — annotate keeps its own skip', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { '*': { allowRead: true, allowEdit: true, modifyAllRecords: true, allowExport: true } } }],
+      source,
+    );
+    expect(Object.keys(map)).toEqual(['*', 'crm_account', 'crm_lead', 'crm_secret']);
+    expect(map.crm_account).toMatchObject({ allowRead: true, allowEdit: true, allowTransfer: true, allowExport: true });
+    // An unrestricted object whose export stays allowed: an entry, and no operation set on it.
+    expect(map.crm_account).not.toHaveProperty('apiOperations');
+    // A narrowed one is annotated exactly as before, `export` kept.
+    expect(map.crm_lead.apiOperations).toEqual(['get', 'list', 'aggregate', 'search', 'export']);
+  });
+});
@@ -91,6 +91,10 @@ describe('[#18783] /auth/me/permissions `objects` is the one effective-map funct
         expect(body.objects.sys_member).toMatchObject({ allowEdit: false });     // clamp over the fold
         expect(body.objects.report).toMatchObject({ allowRead: true });          // seed for a super-user
         expect(Array.isArray(body.objects.report.apiOperations)).toBe(true);     // annotation
+        // [#20134] the per-set super-user fold: `modifyAllRecords` grants transfer, on a seeded
+        // entry and on one another set names narrower alike.
+        expect(body.objects.report).toMatchObject({ allowTransfer: true });
+        expect(body.objects.deal).toMatchObject({ allowTransfer: true });
     });
 
     it('[#20083] a PLAIN wildcard reaches every registered public object it covers — the same bytes', async () => {
 
@@ -173,21 +173,24 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
     { name: 'locked', enable: { apiMethods: [] } },                // deny-all (restricting)
   ];
 
-  it('for a modify-all super-user, seeds false-init entries for restricting objects only', () => {
-    // [#18931] `allowExport: true` is what keeps this case about the `apiMethods`
-    // DERIVATION — the same reason the annotate block above grants it. Without
-    // it the export axis also withholds `export`, which is its own reason to
-    // seed `open_obj`, and this assertion would be reading that instead. The
-    // withheld-export case is pinned separately below.
+  // [#20134] INVERTED on purpose. This read "seeds false-init entries for
+  // restricting objects only" and asserted `open_obj` undefined: an unrestricted
+  // object whose export stays allowed needs no `apiOperations`, so the seed
+  // skipped it. But `current_user.can()` reads the entry, and an absent one as
+  // "no grant", so every such object answered `false` for every verb this
+  // principal holds. The #18990 ruling's own headline — every object a
+  // principal can reach gets an entry — now holds for it too; the annotation
+  // keeps its skip, pinned in the #18931 block below.
+  it('for a modify-all super-user, seeds a false-init entry for every registered object', () => {
+    // [#18931] `allowExport: true` is what keeps `open_obj` the export-allowed,
+    // unrestricted case — the one the seed used to skip.
     const objects: Record<string, any> = {
       '*': { modifyAllRecords: true, viewAllRecords: true, allowExport: true },
     };
     seedSuperUserRestrictedObjects(objects, schemas);
     expect(objects.widget).toEqual({ allowCreate: false, allowRead: false, allowEdit: false, allowDelete: false });
     expect(objects.locked).toBeDefined();
-    // an unrestricted object that keeps its FULL closure is NOT seeded — for it
-    // the client's default-allow path is already the right answer
-    expect(objects.open_obj).toBeUndefined();
+    expect(objects.open_obj).toEqual({ allowCreate: false, allowRead: false, allowEdit: false, allowDelete: false });
   });
 
   // [#18990] INVERTED on purpose. This used to read "does not seed for a
@@ -287,15 +290,20 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
       );
     });
 
-    it('stays silent for the same object once the principal really may export', () => {
+    // [#20134] INVERTED on purpose: this read "stays silent" and asserted no
+    // entry at all. The OPERATION channel still says nothing — the control
+    // below — but the entry exists, because `current_user.can()` reads it and
+    // reads an absent one as "no grant" for every verb.
+    it('once the principal really may export: an entry, and no operation set on it', () => {
       // The control: same schema, same super-user bits, `allowExport` granted.
-      // Nothing is withheld, so there is nothing to say and the client's
-      // default-allow path is correct — no entry, exactly as before #18931.
+      // Nothing is withheld, so there is no `apiOperations` to say and the
+      // client's default-allow path for the operation set is correct.
       const objects: Record<string, any> = wildcardOnlyAdmin();
       objects['*'].allowExport = true;
       seedSuperUserRestrictedObjects(objects, unrestricted);
       annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
-      expect(objects.crm_lead).toBeUndefined();
+      expect(objects.crm_lead).toBeDefined();
+      expect(objects.crm_lead).not.toHaveProperty('apiOperations');
     });
 
     // [#18990] INVERTED on purpose, under the ruling on #18990 (batch #159
@@ -326,15 +334,17 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
       );
     });
 
-    it('stays silent for a viewAll-only principal once it really may export', () => {
+    it('a viewAll-only principal once it really may export: an entry read true, and no operation set on it', () => {
       // The ruling's own carve-out — "skip only an unrestricted object whose
-      // export stays allowed" — is the SAME skip the modify-all control above
-      // pins, reached through the same predicate and not a second one.
+      // export stays allowed" — is annotate's skip, and it is the SAME skip the
+      // modify-all control above pins; [#20134] the entry itself is no longer
+      // skipped, so `can()` reads the read the server grants.
       const objects: Record<string, any> = { '*': { viewAllRecords: true, allowExport: true } };
       seedSuperUserRestrictedObjects(objects, unrestricted);
       foldWildcardSuperUser(objects);
       annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
-      expect(objects.crm_lead).toBeUndefined();
+      expect(objects.crm_lead).toMatchObject({ allowRead: true, allowEdit: false });
+      expect(objects.crm_lead).not.toHaveProperty('apiOperations');
     });
   });
 });