@@ -318,8 +318,16 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
     note: 'Proof file carries the forged owner_id/organization_id submit case; the route-level matrix is covered unit-side in rest public-form-routes.test.ts + plugin-security security-plugin.test.ts (publicFormGrant strip suite).' },
   { id: 'record-share', summary: 'manual record shares (sys_record_share)', state: 'enforced',
     enforcement: 'plugin-sharing/sharing-service.ts buildReadFilter/canEdit' },
-  { id: 'sharing-rules', summary: 'criteria sharing rules (recipients: user/team/position/unit_and_subordinates/business_unit)', state: 'enforced',
-    enforcement: 'plugin-sharing/sharing-rule-service.ts (materialized into sys_record_share); every authorable recipient expands in expandRecipient. The never-enforced owner-type rules + group/guest recipients were removed from the authoring spec (ADR-0078; group renamed → team)', proof: 'showcase-bu-hierarchy-sharing.dogfood.test.ts' },
+  // The recipient enumeration below is re-synced with the authorable enum
+  // `ShareRecipientType` after #15072 landed the `field` kind (card #15240;
+  // maintainer ruling 2026-09-02 on #14103, B). ⛔ The ids stay in this
+  // comment and out of the row's STRINGS: a ledger string reaches readers who
+  // cannot resolve a tracker id (check:doc-authoring, whose baseline is
+  // shrink-only), while the reader who can resolve one is already in the source.
+  { id: 'sharing-rules', summary: 'criteria sharing rules (recipients: user/team/position/unit_and_subordinates/business_unit/field — `field` expands per RECORD)', state: 'enforced',
+    enforcement: 'plugin-sharing/sharing-rule-service.ts (materialized into sys_record_share). The five RULE-WIDE recipients expand in expandRecipient; `field` deliberately does NOT — it has no rule-wide expansion, so expandRecipient THROWS for it rather than answering [] (answering [] is how a rule-wide caller turns "per record" into "nobody": reconcile would then revoke every grant, and revokeRuleGrantsForRetiredRecipients would retire every recipient). Its pairs are derived per record in desiredGrantsForRule (whole-rule pass) and expandRecipientForRecord (caller holding a record), re-materialising on the record\'s own write. The never-enforced owner-type rules + group/guest recipients were removed from the authoring spec (ADR-0078; group renamed → team)',
+    proof: 'showcase-bu-hierarchy-sharing.dogfood.test.ts',
+    note: 'Recipient list re-synced when the `field` kind became enforced. ⭐ These summaries are EXHAUSTIVE, not indicative — recorded here so the gap is not re-filed a third time. The parenthetical list is an order-faithful transcription of the AUTHORABLE enum `ShareRecipientType` (spec/security/sharing.zod.ts), and the file backs that reading: of the 49 `summary` strings, 0 hedge (none carries an `e.g.`, a `such as`, an `etc` or an ellipsis), and the closest structural twin — `scope-depth` — transcribes `ObjectAccessScopeSchema` member-for-member in declaration order. So the drift was a defect, not a stylistic gap, and declaring these summaries INDICATIVE was considered and REFUSED: it would retro-weaken the 16 rows that enumerate, to buy one row a caveat it does not need. `queue` is the one runtime `SharingRuleRecipientType` member deliberately absent: it is reserved (no `sys_queue`), expands to [] and is NOT authorable, so naming it on an `enforced` row would make this row false in the OTHER direction. ⚠️ Nothing mechanical reads `summary` / `enforcement` / `note` — this row is hand-maintained, so re-check it against `ShareRecipientType` whenever that enum moves.' },
   { id: 'hierarchy-widening', summary: 'hierarchy widening — a unit + its subordinate units gain access', state: 'enforced',
     enforcement: 'plugin-sharing/business-unit-graph.ts BusinessUnitGraphService.expandUsers subtree (unit_and_subordinates recipient) — ADR-0057 D5 re-homed off the never-existent sys_position.parent. The narrower business_unit recipient resolves through expandUnitMembers (exactly one unit, no descent) and is pinned by the same proof file: #7807 narrowed the runtime to the declaration after both kinds shared one subtree walk',
     proof: 'showcase-bu-hierarchy-sharing.dogfood.test.ts' },