docs(spec,plugin-sharing): the master_chain refusals can name the record's own master; canEdit no longer lists the attachment and comment parent gates

The ControlledByParentWriteDenialLeg docblock said the master_chain arm's three
resolution refusals name a master above the record's own master. The walk
resolves the record's own master first, so when that master is itself
controlled_by_parent the refusals can name it too. The two canEdit docblocks
(ISharingService and SharingService) listed the sys_attachment and sys_comment
parent gates among canEdit's callers; those gates read checkEdit and the
master-detail write check now.

Docblock sentences only: no type change, no code change.

Claude-Session: https://claude.ai/code/session_01KNKBCRDJCu5tGy3TEbvtrF
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-sharing/src/sharing-service.ts

@@ -816,10 +816,10 @@ export class SharingService implements ISharingService {
    * verdict that is not `deny`. The truth table is byte-for-byte the historical
    * one — `abstain` is where the old `true` for public / owner-less / bypassed
    * objects went — so every existing caller (the sharing middleware, the
-   * `sys_attachment` parent gate, the ADR-0055 master check) keeps its exact
-   * semantics. A caller that would let this answer OVERRIDE another authority
-   * must read {@link checkEdit} instead, because only there is "I permit this"
-   * distinguishable from "I do not enforce here".
+   * ADR-0055 master check) keeps its exact semantics. A caller that would let
+   * this answer OVERRIDE another authority must read {@link checkEdit} instead,
+   * because only there is "I permit this" distinguishable from "I do not
+   * enforce here".
    */
   async canEdit(
     object: string,

packages/spec/src/contracts/security-service.ts

@@ -312,9 +312,10 @@ export interface OwnershipFloorAlternate {
  *   ({@link ISecurityService.checkAuthoredRowWrite}).
  * - `master_chain`: the chain itself cannot be walked to a master that governs
  *   its own rows. It re-enters an object it has already visited, it exceeds
- *   the depth bound, or a master ABOVE the record's own master has no relation
- *   to derive from, is not present, or has an empty master reference. Above the
- *   first hop the check answers these as refusals, not as defects of the
+ *   the depth bound, or a master that is itself `controlled_by_parent` (the
+ *   record's own master, or any master above it) has no relation to derive its
+ *   own master from, is not present, or has an empty master reference. Past the
+ *   record itself the check answers these as refusals, not as defects of the
  *   request, so they are a leg here and never `unresolvable`.
  *
  * The first three legs run on every hop, so `object_permission` can name the

packages/spec/src/contracts/sharing-service.ts

@@ -291,18 +291,18 @@ export interface ISharingService {
    * [#7144] The write DEPTH in that first sentence is an INPUT this service is
    * handed, never one it resolves — so a caller outside the CRUD middleware
    * (the `sys_comment` and `sys_attachment` PARENT-record gates, which both
-   * reach this service through this method) matches ownership at `own`. That is
-   * the ruled shape, and the fail-open that blocks widening it is written up
-   * once in "Write DEPTH is an input the CALLER supplies" on this interface.
+   * reach this service through {@link checkEdit}) matches ownership at `own`.
+   * That is the ruled shape, and the fail-open that blocks widening it is
+   * written up once in "Write DEPTH is an input the CALLER supplies" on this
+   * interface.
    *
    * [#6428] The two-state PROJECTION of {@link checkEdit}: `true` for every
    * verdict that is not `deny`, i.e. `allow` and `abstain` alike. That
    * collapse is the historical semantics, kept byte-for-byte so existing
    * callers do not drift — it is correct for a caller that only ADDS this gate
    * to whatever else already guards the row (the sharing middleware, the
-   * `sys_attachment` parent gate, the ADR-0055 master check), and WRONG for a
-   * caller that would let this answer override another authority's floor. The
-   * latter must read {@link checkEdit}.
+   * ADR-0055 master check), and WRONG for a caller that would let this answer
+   * override another authority's floor. The latter must read {@link checkEdit}.
    */
   canEdit(
     object: string,