@@ -0,0 +1,115 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#26571] `access-security.anonymous-floor-v18-doors`, acceptance[1],
+// acceptance[3] and acceptance[4], over HTTP on the stock showcase.
+//
+// `anonymous-door-sweep.dogfood.test.ts` sends one unauthenticated request per
+// registered route and scores the everything-else class by status and an error
+// envelope; it never reads `error.code`, its share-link token class accepts
+// any 4xx (401 included), and its form submit sends no forged field. The item
+// scores those legs at the `api` oracle, so this file drives exactly the doors
+// its steps list:
+//
+//   - acceptance[1]: each listed v18 door answers an anonymous caller 401 with
+//     its family's unauthenticated code, and the admin's identical call is
+//     served (the door itself serves) — except `GET /keys`, which the domain
+//     answers 405 because `/keys` serves POST alone, so its 401 is the floor's
+//     by the same argument;
+//   - acceptance[3]: the share-link token face is outside the floor — a bogus
+//     token gets the face's own refusal, never 401;
+//   - acceptance[4]: an anonymous public-form submit that forges `owner_id`
+//     and a non-whitelisted `status` answers 201 with a body that is exactly
+//     `{ id }`.
+//
+// acceptance[2] (the retired `/docs` path, anonymous and as the admin) is
+// pinned in `showcase-anonymous-deny-surfaces.dogfood.test.ts`. Isolated boot:
+// the form submit lands a row.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { bootShowcase } from './showcase-boot.js';
+
+const SYS = { isSystem: true } as const;
+/** The two spellings the item accepts for the floor's machine code, per family. */
+const UNAUTHENTICATED_CODES = ['UNAUTHENTICATED', 'AUTH_REQUIRED'];
+
+/** steps[0]'s doors, by full path (the branding door is outside `/api/v1`). */
+const DOORS = [
+  '/api/v1/notifications',
+  '/api/v1/keys',
+  '/api/v1/share-links',
+  '/api/v1/openapi.json',
+  '/api/v1/i18n/locales',
+  '/api/settings/branding',
+] as const;
+
+const codeOf = (body: any) =>
+  (body?.error && typeof body.error === 'object' ? body.error.code : undefined) ?? body?.code ?? null;
+
+describe('the v18 anonymous floor, door by door, on the stock showcase', () => {
+  let stack: VerifyStack;
+  let admin: string;
+  let ql: any;
+
+  const call = async (path: string, token?: string, init: RequestInit = {}) => {
+    const headers: Record<string, string> = { 'content-type': 'application/json', ...(init.headers as Record<string, string>) };
+    if (token) headers.authorization = `Bearer ${token}`;
+    const res = await stack.raw(path, { ...init, headers });
+    const text = await res.text();
+    let body: any = null;
+    try { body = JSON.parse(text); } catch { /* not JSON */ }
+    return { status: res.status, body, text };
+  };
+
+  beforeAll(async () => {
+    stack = await bootShowcase();
+    admin = await stack.signIn();
+    ql = await stack.kernel.getServiceAsync('objectql');
+  }, 120_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+  });
+
+  it.each(DOORS)('acceptance[1]: anonymous GET %s answers 401 with the unauthenticated code', async (path) => {
+    const r = await call(path, undefined, { method: 'GET' });
+    expect(r.status, r.text).toBe(401);
+    expect(UNAUTHENTICATED_CODES, `the code on ${path}: ${r.text}`).toContain(codeOf(r.body));
+  });
+
+  // `/keys` serves POST alone (#23909 registers every verb so the floor answers
+  // them all), so its GET is the domain's 405 to the admin and is no control.
+  it.each(DOORS.filter((d) => d !== '/api/v1/keys'))('acceptance[1]: the admin\'s GET %s is served — the door itself serves', async (path) => {
+    const r = await call(path, admin, { method: 'GET' });
+    expect(r.status, r.text).toBe(200);
+  });
+
+  it('acceptance[3]: a bogus share-link token answers the token face\'s own refusal, never the floor\'s 401', async () => {
+    const r = await call('/api/v1/share-links/BOGUS/resolve', undefined, { method: 'GET' });
+    expect(r.status, r.text).not.toBe(401);
+    expect(r.status, 'a refusal, not a serve').toBeGreaterThanOrEqual(400);
+    expect(r.status).toBeLessThan(500);
+    expect(UNAUTHENTICATED_CODES, 'not the floor\'s code').not.toContain(codeOf(r.body));
+  });
+
+  it('acceptance[4]: an anonymous submit forging owner_id and status answers 201 with exactly { id }', async () => {
+    const marker = `anon-floor-v18-${Date.now()}`;
+    const r = await call('/api/v1/forms/contact-us/submit', undefined, {
+      method: 'POST',
+      body: JSON.stringify({
+        name: marker,
+        email: 'anon.floor@example.com',
+        company: 'Floor Co',
+        message: 'v18 floor',
+        owner_id: 'usr_forged_owner',
+        status: 'qualified',
+      }),
+    });
+    expect(r.status, r.text).toBe(201);
+    expect(Object.keys(r.body ?? {}), 'nothing stored, defaulted or stamped is echoed').toEqual(['id']);
+    const [row] = await ql.find('showcase_inquiry', { where: { name: marker }, context: SYS });
+    expect(row?.id, 'the submission landed').toBe(r.body.id);
+    expect(row.owner_id, 'the forged owner was not stored').not.toBe('usr_forged_owner');
+    expect(row.status, 'the non-whitelisted status was not stored').not.toBe('qualified');
+  });
+});
@@ -262,6 +262,19 @@ describe('the catalog activation door, on a booted showcase', () => {
         expect(await rowsOf('position', 'no_such_position')).toEqual([]);
     });
 
+    // [#26571] access-security.security-catalog-activation-and-clone-doors
+    // acceptance[2] over HTTP: the audience anchors are not switchable here.
+    for (const anchor of ['everyone', 'guest']) {
+        it(`the audience anchor \`${anchor}\` is refused 400 and nothing is written`, async () => {
+            const res = await flip('position', anchor, { enabled: false });
+            const text = await res.text();
+
+            expect(res.status, text).toBe(400);
+            expect(text).toContain(`'${anchor}' is an audience anchor`);
+            expect(await rowsOf('position', anchor)).toEqual([]);
+        });
+    }
+
     it('a type with no switch is refused 400 by the door itself — the route is the door\'s, not a router miss', async () => {
         const res = await flip('capability', 'manage_metadata', { enabled: false });
         const text = await res.text();
 
@@ -0,0 +1,95 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#26571] `access-security.grant-table-write-contract`, acceptance[1] and
+// acceptance[3], through the REST data door on the stock showcase.
+//
+// The plugin-security engine pins (`grant-permission-set-name.test.ts`,
+// `granted-by-writer-provenance.test.ts`) prove the contract on a real engine
+// and read the thrown error through `resolveThrownHttpError`. The item's
+// clauses are scored at the `api` oracle, so this file writes the grant table
+// the way an administrator does — `POST /data/sys_user_permission_set` — and
+// reads the answer the wire carries:
+//
+//   - acceptance[1]: a grant naming the retired `permission_set_id` column is
+//     400 INVALID_FIELD; a second identical grant is 409 UNIQUE_VIOLATION;
+//   - acceptance[3]: a grant naming someone else as `granted_by` stores the
+//     caller.
+//
+// acceptance[2] (the inverted window) is pinned beside the window semantics in
+// `permission-set-assignment-window.dogfood.test.ts`. acceptance[4] is the
+// walled-boot leg (knownGaps).
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { bootShowcase } from './showcase-boot.js';
+import { catalogPermissionSet } from './catalog-permission-set.js';
+
+const SYS = { isSystem: true } as const;
+const GRANTS = '/data/sys_user_permission_set';
+const SET = 'showcase_auditor';
+
+const codeOf = (body: any) => body?.code ?? body?.error?.code;
+const idOf = (b: any) => b?.id ?? b?.record?.id ?? b?.data?.id;
+
+describe('the grant table\'s write contract over the REST data door', () => {
+  let stack: VerifyStack;
+  let ql: any;
+  let admin: string;
+  let adminId: string;
+  const uid: Record<string, string> = {};
+
+  const userIdOf = async (email: string) => String((await ql.findOne('sys_user', { where: { email }, context: SYS }))?.id ?? '');
+
+  beforeAll(async () => {
+    stack = await bootShowcase();
+    admin = await stack.signIn();
+    ql = await stack.kernel.getServiceAsync('objectql');
+    const session = (await (await stack.apiAs(admin, 'GET', '/auth/get-session')).json()) as any;
+    adminId = String(session?.user?.id ?? '');
+    expect(adminId, 'the admin has an id').toBeTruthy();
+    expect(await catalogPermissionSet(ql, SET), `${SET} is served by the catalog`).toBeTruthy();
+    for (const who of ['dup', 'retired', 'provenance', 'granter']) {
+      const email = `grant-contract-${who}@verify.test`;
+      await stack.signUp(email);
+      uid[who] = await userIdOf(email);
+      expect(uid[who], `${who} signed up`).toBeTruthy();
+    }
+  }, 120_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+  });
+
+  it('acceptance[1]: a grant naming the retired permission_set_id column is 400 INVALID_FIELD, and nothing is stored', async () => {
+    const res = await stack.apiAs(admin, 'POST', GRANTS, { user_id: uid.retired, permission_set_id: SET });
+    const body = await res.json();
+    expect([res.status, codeOf(body)], JSON.stringify(body)).toEqual([400, 'INVALID_FIELD']);
+    expect(JSON.stringify(body), 'the refusal names the column').toContain('permission_set_id');
+    expect(await ql.find('sys_user_permission_set', { where: { user_id: uid.retired }, context: SYS })).toEqual([]);
+  });
+
+  it('acceptance[1]: a second identical grant is 409 UNIQUE_VIOLATION, and one row stands', async () => {
+    const first = await stack.apiAs(admin, 'POST', GRANTS, { user_id: uid.dup, permission_set: SET });
+    expect(first.status, await first.clone().text()).toBe(201);
+    const second = await stack.apiAs(admin, 'POST', GRANTS, { user_id: uid.dup, permission_set: SET });
+    const body = await second.json();
+    expect([second.status, codeOf(body)], JSON.stringify(body)).toEqual([409, 'UNIQUE_VIOLATION']);
+    expect(await ql.find('sys_user_permission_set', { where: { user_id: uid.dup }, context: SYS })).toHaveLength(1);
+  });
+
+  it('acceptance[3]: a grant naming ANOTHER user as granted_by stores the caller', async () => {
+    const res = await stack.apiAs(admin, 'POST', GRANTS, {
+      user_id: uid.provenance, permission_set: SET, granted_by: uid.granter,
+    });
+    expect(res.status, await res.clone().text()).toBe(201);
+    const id = idOf(await res.json());
+    expect(id, 'the created grant id').toBeTruthy();
+
+    const read = await stack.apiAs(admin, 'GET', `${GRANTS}/${id}`);
+    expect(read.status).toBe(200);
+    const row = (await read.json()) as any;
+    expect((row?.record ?? row?.data ?? row)?.granted_by, 'the wire read-back names the writer').toBe(adminId);
+    const stored = await ql.findOne('sys_user_permission_set', { where: { id }, context: SYS });
+    expect(stored?.granted_by, 'and so does the stored row').toBe(adminId);
+  });
+});
@@ -0,0 +1,151 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#26571] `access-security.meta-authoring-trail-and-audience-gates`,
+// acceptance[2] and negative[0], over HTTP on the stock showcase.
+//
+// A view that names `requiredPermissions` is served only to a caller holding
+// every one of them (#22639). `meta-view-dashboard-audience-gate.test.ts`
+// drives RestServer over a mock protocol and covers the list prune, the plain
+// by-name refusal and the cached arm; it has no `/published`, `/layers` or
+// `?state=draft` door, no `/history` leg for an authoring-trail holder, and no
+// real ETag path. This file drives those doors on a booted showcase:
+//
+//   - a scratch list view `showcase_task.qa_gated_view` gated on a capability
+//     neither member holds, saved by the admin with a pending draft;
+//   - a `setup.access`-only member: the view is absent from `GET /meta/view`,
+//     and every by-name door (plain, `/published`, `/layers`, `?state=draft`)
+//     answers 403 PERMISSION_DENIED; `/history` answers 403 FORBIDDEN, the
+//     authoring-trail gate refusing first;
+//   - a `studio.access` member (admitted by the trail gate): `/history`
+//     answers the audience refusal, 403 PERMISSION_DENIED;
+//   - the admin reads the view on every door (the control);
+//   - negative[0]: the admin's ETag replayed by the member as `If-None-Match`
+//     is never a 304.
+//
+// acceptance[1] (setup.access-only on history/audit/diff/commits) is pinned
+// by `wall-authoring-trail-doors.dogfood.test.ts`. Isolated boot: the file
+// saves metadata.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { bootShowcase } from './showcase-boot.js';
+
+const SYS = { isSystem: true } as const;
+const VIEW = 'showcase_task.qa_gated_view';
+const ITEM = `/meta/view/${VIEW}`;
+/** A declared capability the admin holds and neither member does. */
+const GATE = 'manage_users';
+const SETUP_SET = 'qa_audience_setup_only';
+const STUDIO_SET = 'qa_audience_studio';
+
+const codeOf = (body: any) =>
+  (body?.error && typeof body.error === 'object' ? body.error.code : undefined) ?? body?.code ?? null;
+
+describe('a gated view on every alternate /meta door (#22639)', () => {
+  let stack: VerifyStack;
+  let ql: any;
+  let admin: string;
+  let setupOnly: string;
+  let studio: string;
+
+  const read = async (token: string, path: string, headers: Record<string, string> = {}) => {
+    const res = await stack.raw(`/api/v1${path}`, { method: 'GET', headers: { authorization: `Bearer ${token}`, ...headers } });
+    const text = await res.text();
+    let body: any = null;
+    try { body = JSON.parse(text); } catch { /* not JSON */ }
+    return { status: res.status, body, text, etag: res.headers.get('etag') };
+  };
+
+  const grant = async (email: string, set: string) => {
+    const token = await stack.signUp(email);
+    const userId = (await ql.findOne('sys_user', { where: { email }, context: SYS }))?.id;
+    expect(userId, `${email} provisioned`).toBeTruthy();
+    await ql.insert('sys_user_permission_set', { user_id: userId, permission_set: set }, { context: SYS });
+    return token;
+  };
+
+  beforeAll(async () => {
+    stack = await bootShowcase();
+    admin = await stack.signIn();
+    ql = await stack.kernel.getServiceAsync('objectql');
+
+    for (const [name, caps] of [[SETUP_SET, ['setup.access']], [STUDIO_SET, ['studio.access']]] as const) {
+      const saved = await stack.apiAs(admin, 'PUT', `/meta/permission/${name}`, { name, label: name, objects: {}, systemPermissions: [...caps] });
+      expect(saved.status, await saved.clone().text()).toBe(200);
+    }
+    setupOnly = await grant('audience-setup@verify.test', SETUP_SET);
+    studio = await grant('audience-studio@verify.test', STUDIO_SET);
+
+    const body = {
+      name: VIEW, object: 'showcase_task', viewKind: 'list', type: 'grid',
+      label: 'QA gated view', columns: ['title'], requiredPermissions: [GATE],
+    };
+    const published = await stack.apiAs(admin, 'PUT', ITEM, body);
+    expect(published.status, await published.clone().text()).toBe(200);
+    const draft = await stack.apiAs(admin, 'PUT', `${ITEM}?mode=draft`, { ...body, label: 'QA gated view (draft)' });
+    expect(draft.status, await draft.clone().text()).toBe(200);
+  }, 120_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+  });
+
+  it('guard the guard: neither member holds the gate; the setup member lacks the trail capabilities, the studio member holds studio.access', async () => {
+    const perms = async (token: string) => {
+      const p = (await (await stack.apiAs(token, 'GET', '/auth/me/permissions')).json()) as any;
+      return ((p?.data ?? p)?.systemPermissions ?? []) as string[];
+    };
+    const setup = await perms(setupOnly);
+    expect(setup).toContain('setup.access');
+    expect(setup).not.toContain(GATE);
+    expect(setup).not.toContain('studio.access');
+    expect(setup).not.toContain('manage_metadata');
+    const st = await perms(studio);
+    expect(st).toContain('studio.access');
+    expect(st).not.toContain(GATE);
+    expect(await perms(admin)).toContain(GATE);
+  });
+
+  it('the gated view is absent from the member\'s list and present in the admin\'s', async () => {
+    const namesOf = (b: any) => ((b?.items ?? b?.data ?? b) as any[]).map((x: any) => x?.name);
+    const member = await read(setupOnly, '/meta/view');
+    expect(member.status, member.text).toBe(200);
+    expect(namesOf(member.body)).not.toContain(VIEW);
+    const control = await read(admin, '/meta/view');
+    expect(namesOf(control.body)).toContain(VIEW);
+  });
+
+  for (const [door, path] of [
+    ['by name', ITEM],
+    ['/published', `${ITEM}/published`],
+    ['/layers', `${ITEM}/layers`],
+    ['?state=draft', `${ITEM}?state=draft`],
+  ] as const) {
+    it(`${door}: the member is refused 403 PERMISSION_DENIED; the admin reads it`, async () => {
+      const member = await read(setupOnly, path);
+      expect([member.status, codeOf(member.body)], member.text).toEqual([403, 'PERMISSION_DENIED']);
+      const control = await read(admin, path);
+      expect(control.status, control.text).toBe(200);
+    });
+  }
+
+  it('/history: a member the trail gate refuses gets 403 FORBIDDEN first; a studio.access member gets the audience refusal; the admin reads it', async () => {
+    const setup = await read(setupOnly, `${ITEM}/history`);
+    expect([setup.status, codeOf(setup.body)], setup.text).toEqual([403, 'FORBIDDEN']);
+    const st = await read(studio, `${ITEM}/history`);
+    expect([st.status, codeOf(st.body)], st.text).toEqual([403, 'PERMISSION_DENIED']);
+    const control = await read(admin, `${ITEM}/history`);
+    expect(control.status, control.text).toBe(200);
+  });
+
+  it('negative[0]: the admin\'s ETag replayed by the member is never a 304', async () => {
+    const control = await read(admin, ITEM);
+    expect(control.status).toBe(200);
+    expect(control.etag, 'the admin\'s read carries a validator').toBeTruthy();
+    const replay = await read(setupOnly, ITEM, { 'if-none-match': control.etag! });
+    expect(replay.status, 'a stale validator buys no 304').not.toBe(304);
+    expect([replay.status, codeOf(replay.body)]).toEqual([403, 'PERMISSION_DENIED']);
+    // Control: the admin's own validator IS a 304, so the replay above was a real one.
+    expect((await read(admin, ITEM, { 'if-none-match': control.etag! })).status).toBe(304);
+  });
+});