current_scope 0.2.0 → 0.3.0

data/app/controllers/current_scope/roles_controller.rb

@@ -104,7 +104,7 @@ module CurrentScope
     # name AND the grid diff), else role.updated for a pure grid change. Emits
     # nothing when neither the name nor the grid moved.
     def record_role_update(role, previous_name)
-      diff = role.permission_keys_change || { added: [], removed: [] }
+      diff = role.permission_keys_change || { added: [], removed: [], rejected: [] }
       renamed = previous_name != role.name
       return unless renamed || diff[:added].any? || diff[:removed].any?
 
@@ -126,7 +126,11 @@ module CurrentScope
       # Grid group columns (CRUD checkboxes) submit "controller:group" tokens on
       # a separate, optional channel — permitted leniently so a raw permission_keys
       # post (no groups) still works. Expand them into action keys; the model's
-      # permission_keys= dedups and drops anything not in the catalog.
+      # permission_keys= dedups, and REJECTS anything not in the catalog (the
+      # save fails and `edit` re-renders with the error). The grid can't submit
+      # such a key — cells are built from routed actions only — so a rejection
+      # here means a hand-crafted request, which is worth saying out loud rather
+      # than dropping silently.
       groups = params.fetch(:role, {}).permit(permission_groups: [])[:permission_groups]
       permitted[:permission_keys] = Array(permitted[:permission_keys]) + PermissionGrid.new.expand(groups)
       permitted

data/app/helpers/current_scope/application_helper.rb

@@ -1,15 +1,13 @@
 module CurrentScope
   module ApplicationHelper
-    # Best-effort human label for any host subject/resource. Prefers a record's
-    # own current_scope_label (the Scopeable mixin gives every pickable model
-    # one) so the label a model declares is the label shown everywhere — the
-    # picker, the chips, and the ledger (see Event.label_for) all agree.
+    # Best-effort human label for any host subject/resource. Delegates to the
+    # one shared chain (CurrentScope.label_for) — the same definition the audit
+    # ledger denormalizes (see Event.label_for), so the picker, the chips, and
+    # the ledger agree by construction, not by parallel maintenance.
     def current_scope_label(record)
       return "(none)" if record.nil?
-      return record.current_scope_label if record.respond_to?(:current_scope_label)
 
-      name = record.try(:name) || record.try(:email) || record.try(:title)
-      name || "#{record.class.name} ##{record.id}"
+      CurrentScope.label_for(record)
     end
 
     # Human label for a subject (user/account), honouring config.subject_label
@@ -36,14 +34,49 @@ module CurrentScope
     end
 
     # The configured subject_label (Symbol or Proc) applied to a subject, or nil
-    # when unset or when it resolves to a blank value.
+    # when unset, when it resolves to a blank value, or when it fails.
+    #
+    # subject_label is arbitrary host code running once per row on the admin's
+    # main tool for granting and reviewing roles. One subject with incomplete
+    # data (a Proc doing `u.email.upcase` on a subject whose email is nil) must
+    # not take the whole page down — the same intent the holder-label helpers
+    # below already encode for stale polymorphic types. A failure here costs one
+    # label; a raise costs the page.
     def configured_subject_label(subject)
       label = CurrentScope.config.subject_label
-      if label.respond_to?(:call)
-        label.call(subject).to_s.presence
-      elsif label && subject.respond_to?(label)
-        subject.public_send(label).to_s.presence
+      return if label.nil?
+      return resolve_subject_label(label) { label.call(subject) } if label.respond_to?(:call)
+
+      # Only a Symbol or String names a method. Checked BEFORE respond_to?,
+      # which raises TypeError on anything else ("false is not a symbol nor a
+      # string") — and that raise would land outside the rescue below and 500
+      # the page, which is the bug this method exists to prevent, reached
+      # through a different door.
+      unless label.is_a?(Symbol) || label.is_a?(String)
+        CurrentScope::ApplicationHelper.warn_unusable_subject_label_once(label)
+        return
+      end
+
+      if subject.respond_to?(label)
+        resolve_subject_label(label) { subject.public_send(label) }
+      else
+        # Not a mistake we can render around: this config does nothing for EVERY
+        # subject, silently, which is why it needs saying out loud once.
+        CurrentScope::ApplicationHelper.warn_unknown_subject_label_once(label)
+        nil
       end
+    rescue StandardError => e
+      # Last resort, and the reason it exists: every branch above calls a method
+      # ON the host's config value to classify it — `nil?`, `respond_to?`,
+      # `is_a?`. A pathological value breaks the classification itself, before
+      # any specific guard can classify it, so the guards cannot be where this
+      # is caught. A BasicObject has no #nil?; a delegator can raise from
+      # respond_to?.
+      #
+      # Deliberately does NOT touch `label`: it is the thing that just proved it
+      # cannot be touched. The warning is keyed off the error alone.
+      CurrentScope::ApplicationHelper.warn_subject_label_broken_once(e)
+      nil
     end
 
     # Members-list labels that survive a stale/renamed polymorphic type — a
@@ -67,6 +100,129 @@ module CurrentScope
     def current_scope_gid_label(gid)
       record = GlobalID::Locator.locate(gid)
       record ? current_scope_label(record) : gid
+    rescue ActiveRecord::RecordNotFound, NameError
+      # locate RAISES for a deleted record or renamed class (nil is only for
+      # unparseable strings) — same contract the holder helpers rescue above.
+      gid
+    end
+
+    private
+
+    # ponytail: display fallback only — NEVER a decision path. This rescue makes
+    # a label degrade instead of erroring; the resolver, Guard and catalog are
+    # untouched, so it relaxes no fail-closed guarantee. (The same `rescue
+    # StandardError` on a decision path would be a fail-open bug.)
+    #
+    # StandardError rather than the NameError family the holder helpers catch:
+    # those wrap OUR call into a known-shaped record, while this runs a host's
+    # arbitrary Proc, which can raise anything. Catching only NameError would
+    # fix the reported NoMethodError and leave the same page-down bug for a
+    # differently-broken Proc.
+    #
+    # nil rejoins the existing "resolved blank -> default chain" path in
+    # current_scope_subject_label, so no caller learns a new branch.
+    def resolve_subject_label(label)
+      yield.to_s.presence
+    rescue StandardError => e
+      CurrentScope::ApplicationHelper.warn_subject_label_raised_once(label, e)
+      nil
+    end
+
+    class << self
+      # Warn ONCE per (reason, label): a misconfigured subject_label is the same
+      # mistake on every row, so one line is a signal and one-per-subject is
+      # noise the admin will scroll past. Keyed by the label value, so changing
+      # the config in dev warns again for the new value.
+      #
+      # Always-on rather than behind a warn_on_* flag (cf. warn_on_nil_sod_record,
+      # which defaults off because a nil record is often legitimate): a label the
+      # subject can't answer, or one that raises, is unambiguously a mistake.
+      # Mirrors Event.warn_missing_events_table_once.
+      #
+      # Says "this subject" rather than "subjects": under STI some subclasses may
+      # answer and others not, and warn-once means the first non-responder would
+      # otherwise speak for all of them.
+      def warn_unknown_subject_label_once(label)
+        return unless new_subject_label_warning?(:unknown, label)
+
+        Rails.logger&.warn(
+          "[CurrentScope] config.subject_label is #{label.inspect}, but this subject does not " \
+          "respond to it — it is falling back to the default label. If no subject responds to it, " \
+          "this config does nothing. Set it to a method the subject responds to (e.g. :email), a " \
+          "Proc, or nil."
+        )
+      end
+
+      # Not a Symbol, String, Proc, or nil — so it can't name a method and can't
+      # be called. Reports the TYPE, not the value: this is the one warning whose
+      # subject is an arbitrary host object, and calling `inspect` on it could
+      # itself raise — inside the very path that exists to stop a raise.
+      def warn_unusable_subject_label_once(label)
+        return unless new_subject_label_warning?(:unusable, label.class)
+
+        Rails.logger&.warn(
+          "[CurrentScope] config.subject_label is a #{label.class} — it can't name a method and " \
+          "can't be called, so every subject is falling back to the default label. Set it to a " \
+          "Symbol (e.g. :email), a Proc taking the subject, or nil."
+        )
+      end
+
+      def warn_subject_label_raised_once(label, error)
+        return unless new_subject_label_warning?(:raised, label)
+
+        Rails.logger&.warn(
+          "[CurrentScope] config.subject_label raised #{safe_class(error)}: #{safe_message(error)} " \
+          "— that subject fell back to the default label rather than erroring the page. A " \
+          "subject_label must be total: it runs for every subject, including ones with nil or " \
+          "blank attributes."
+        )
+      end
+
+      # The configured value could not even be classified — see the rescue in
+      # configured_subject_label. Keyed by the error's class, and says nothing
+      # about the label itself, because reading the label is what failed.
+      def warn_subject_label_broken_once(error)
+        return unless new_subject_label_warning?(:broken, safe_class(error))
+
+        Rails.logger&.warn(
+          "[CurrentScope] config.subject_label could not be read — #{safe_class(error)}: " \
+          "#{safe_message(error)}. Every subject is falling back to the default label. Set it to " \
+          "a Symbol (e.g. :email), a Proc taking the subject, or nil."
+        )
+      end
+
+      private
+
+      # A host exception's message is arbitrary text produced by arbitrary code:
+      # it may carry newlines that split one warning across several log records,
+      # run to any length, or raise from #message itself. All three would land
+      # in the rescue this runs inside — reporting the failure must not become
+      # the failure.
+      def safe_message(error)
+        error.message.to_s.gsub(/\s+/, " ").strip.truncate(200)
+      rescue StandardError
+        "(message unavailable)"
+      end
+
+      # Same reason as safe_message, one step earlier: `#class` is interpolated
+      # before safe_message is even called, and an exception raised by a host
+      # Proc can override it. The method-level rescue in configured_subject_label
+      # does stop that reaching the page — but at the cost of the accurate
+      # warning, replaced by a misattributed one about the secondary failure.
+      # The diagnostic is the whole point of warning at all, so protect it.
+      def safe_class(error)
+        error.class.name.presence || "an exception"
+      rescue StandardError
+        "an exception"
+      end
+
+      # Set is a core built-in on this gem's Ruby floor (>= 3.2, no require
+      # needed — the codebase already uses bare Set elsewhere), so nothing here
+      # can raise inside the rescue this runs under.
+      def new_subject_label_warning?(reason, label)
+        @subject_label_warnings ||= Set.new
+        !!@subject_label_warnings.add?([ reason, label ])
+      end
     end
   end
 end

data/app/models/current_scope/current.rb

@@ -14,6 +14,16 @@ module CurrentScope
     # each event; nil when the host hasn't set it. Additive — no reader override.
     attribute :user, :actor, :request_id
 
+    # #50: the collection type the request's controller declared via
+    # current_scope_model, and the controller_path it was declared for. The
+    # Guard stashes both once per request so the advisory path (allowed_to? in
+    # a view) can bind the record-less gate the same way the controller gate
+    # did — but the PATH is stored so a cross-controller advisory question
+    # (allowed_to?(:index, controller: "reports") from a projects view) does
+    # NOT borrow the wrong controller's type (KTD-6). Request-scoped, reset
+    # with everything else, so it never leaks between requests.
+    attribute :collection_model, :collection_model_path
+
     # Per-request memo for the resolver's org-role lookup. A view with N
     # permission-gated elements calls the gate N times, each otherwise re-running
     # the same `RoleAssignment.find_by(subject:)`; caching it here collapses that
@@ -24,10 +34,24 @@ module CurrentScope
 
     # Falls back to the effective subject, so actor is never nil when user is
     # set — callers attribute to `actor` without a nil branch.
+    #
+    # ROUND-TRIP HAZARD: the reader answers with the fallback, not stored
+    # state. Snapshot/restore code (Current.set, Object#with, anything that
+    # reads #actor to write it back) would pin the fallback as an explicit
+    # actor and restore a stale identity once user changes — read the raw
+    # `attributes` hash instead, as TestHelpers#with_current_user does.
     def actor
       super || user
     end
 
+    # True only while a distinct real actor stands behind the effective
+    # subject (act-as). THE definition of "impersonating" — the Permissions
+    # mixin and the mutation guard both delegate here, so the view-level
+    # read-only signal and the write gate can never drift apart.
+    def impersonating?
+      user.present? && actor != user
+    end
+
     # Memoize the org-role lookup for `subject` for the rest of this request/job.
     # Keyed by subject so a check that spans several subjects stays correct.
     # Caches nil (no role) too, so a repeated "no grant" check is one query, not N.

data/app/models/current_scope/event.rb

@@ -90,13 +90,11 @@ module CurrentScope
         )
       end
 
-      # Prefer a record's own view-agnostic label; then the AR default; then
-      # a plain to_s for anything else.
+      # The shared chain (CurrentScope.label_for) — the same label the UI
+      # renders is the one denormalized into target_label, so the ledger and
+      # the screen can't disagree about what a record was called.
       def label_for(record)
-        return record.current_scope_label if record.respond_to?(:current_scope_label)
-        return "#{record.model_name.human} ##{record.id}" if record.respond_to?(:model_name)
-
-        record.to_s
+        CurrentScope.label_for(record)
       end
 
       # Recognizes "table is missing" across adapters and Rails' own schema
@@ -112,6 +110,12 @@ module CurrentScope
           !message.match?(/\bcolumn\b/i) &&
           message.match?(/no such table|could not find table|does(?:n't| not) exist|unknown table|undefined table/i)
       end
+      # PUBLIC: report mode's ledger warning asks this too (#37). It is one
+      # question — "is this the un-migrated-table case?" — and one adapter-shaped
+      # answer, so it gets one definition. A second opinion elsewhere is a second
+      # opinion that drifts, and this one decides which fix an operator is sent
+      # after. (#59 review)
+      public :missing_events_table?
     end
   end
 end

data/app/models/current_scope/role.rb

@@ -8,13 +8,17 @@ module CurrentScope
     has_many :scoped_role_assignments, dependent: :destroy
 
     validates :name, presence: true, uniqueness: true
+    validate :permission_keys_in_catalog
 
     after_save :persist_permission_keys
 
-    # The grid diff computed by the last save: { added: [...], removed: [...] }.
-    # Empty arrays on a no-op save; nil when no grid was staged (a programmatic
-    # save that never set permission_keys). Controllers read this to record the
-    # change — the model itself records nothing (seeds must stay silent).
+    # The grid diff computed by the last save:
+    # { added: [...], removed: [...], rejected: [...] }. Empty arrays on a no-op
+    # save; nil when no grid was staged (a programmatic save that never set
+    # permission_keys). `added`/`removed` describe what actually persisted;
+    # `rejected` names keys the scrub path threw away, so a caller that opted
+    # into silence can still log it. Controllers read this to record the change
+    # — the model itself records nothing (seeds must stay silent).
     attr_reader :permission_keys_change
 
     def grants?(permission_key)
@@ -25,31 +29,78 @@ module CurrentScope
       @pending_permission_keys || role_permissions.pluck(:permission_key)
     end
 
-    # Stages a replacement permission set, dropping keys that aren't in the
-    # catalog (stale keys from removed controllers). Persisted on save, like
-    # any other attribute — never before validations pass.
+    # Stages a replacement permission set. STRICT: a key that isn't in the
+    # route-derived catalog makes the record invalid rather than disappearing.
+    # This is the mass-assignment writer (update!, strong params, the role
+    # grid), so it is deliberately the strict one — the scrub escape hatch must
+    # never be reachable from form params.
     def permission_keys=(keys)
-      @pending_permission_keys = Array(keys).uniq.select { |k| CurrentScope.catalog.include?(k) }
+      assign_permission_keys(keys, scrub: false)
+    end
+
+    # ponytail: one implementation, two intents — the setter is the strict
+    # front door, this is the same staging with the scrub opt-in named at the
+    # call site.
+    #
+    # `scrub: true` is the ONLY sanctioned silent drop, and it exists for one
+    # real case: a controller was removed, so a role still holds keys that no
+    # longer route. Cleaning those up is legitimate and shouldn't require the
+    # operator to name every dead key. Everything else — typos, unrouted
+    # programmatic grants, the never-routed break-glass permission — is a
+    # mistake, and a security-grant API must not swallow mistakes.
+    def assign_permission_keys(keys, scrub: false)
+      # Literal `true` only. Ruby truthiness would let the string "false" — or
+      # any params/config value that found its way here — silently disable the
+      # strict path, which is the exact hole this API exists to close. The
+      # escape hatch opens for a caller that means it, not for one that passed
+      # something along.
+      @scrub_permission_keys = scrub == true
+      # Blank entries are the grid's hidden-field padding, not typos (R2).
+      @pending_permission_keys = Array(keys).map(&:to_s).reject(&:blank?).uniq
     end
 
     def reload(...)
       @pending_permission_keys = nil
+      @scrub_permission_keys = false
       super
     end
 
     private
 
+    def permission_keys_in_catalog
+      return if @pending_permission_keys.nil? || @scrub_permission_keys
+
+      unknown = @pending_permission_keys.reject { |k| CurrentScope.catalog.include?(k) }
+      return if unknown.empty?
+
+      errors.add(
+        :permission_keys,
+        "not in the permission catalog: #{unknown.join(', ')} — check for typos, or use " \
+        "assign_permission_keys(..., scrub: true) to drop stale keys deliberately"
+      )
+    end
+
     def persist_permission_keys
       return if @pending_permission_keys.nil?
 
       # Capture the prior keys BEFORE delete_all so the diff survives the swap.
       previous = role_permissions.pluck(:permission_key)
-      staged = @pending_permission_keys
-      @permission_keys_change = { added: staged - previous, removed: previous - staged }
+      # Defense in depth: on the strict path validation already proved every key
+      # is in the catalog, so this filter is a no-op. It is what the scrub path
+      # relies on, and it means no future code path that skips validations
+      # (insert_all, update_column, a bare `save(validate: false)`) can smuggle
+      # an unknown key into the table.
+      staged = @pending_permission_keys.select { |k| CurrentScope.catalog.include?(k) }
+      @permission_keys_change = {
+        added: staged - previous,
+        removed: previous - staged,
+        rejected: @pending_permission_keys - staged
+      }
 
       role_permissions.delete_all
       role_permissions.insert_all(staged.map { |k| { permission_key: k } }) if staged.any?
       @pending_permission_keys = nil
+      @scrub_permission_keys = false
     end
   end
 end

data/app/views/current_scope/roles/edit.html.erb

@@ -4,7 +4,7 @@
 
 <%= form_with model: @role do |f| %>
   <% if @role.errors.any? %>
-    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
   <% end %>
 
   <p><%= f.label :name %> <%= f.text_field :name %></p>
@@ -20,10 +20,33 @@
   </p>
 
   <h2>Permission grid</h2>
+  <%# The injected break-glass action's bare name (nil when break-glass is
+      off) — the hint below and the per-row exemption check both read it. The
+      CATALOG owns the parse: its split("#", -1) + blank-raise catches a
+      malformed "reports#" that a loose split here would silently turn into a
+      believable wrong action name. (#79 review, qodo) %>
+  <% bypass_action = CurrentScope.config.allow_sod_bypass ? CurrentScope.catalog.bypass_action : nil %>
   <p class="cs-hint">
     One row per controller, one checkbox per action group — derived from the
     app's routes, so new controllers appear here automatically. Columns are
     fixed: a blank cell means the controller doesn't route that action.
+    <%# The break-glass column is the one thing here that is NOT an action you
+        can route, so the "derived from the app's routes" line above would
+        otherwise make it look like a mistake. %>
+    <% if CurrentScope.config.allow_sod_bypass %>
+      Break-glass is on, so controllers with a separation-of-duties action also
+      show a <code><%= bypass_action %></code>
+      column: granting it lets that role's holder override the four-eyes veto on
+      their own record, where the record allows it. Every use is audited.
+    <% end %>
+  </p>
+  <%# Unconditional on purpose (R9): the limit of the mark must be stated even
+      when nothing is marked — an unmarked row is a non-answer, not a proof. %>
+  <p class="cs-hint cs-ungated-hint">
+    Rows tagged "gate not run" are controllers provably never gated — the tag
+    appears only when the callback chain proves it. An unmarked row is not
+    proof the gate runs there (a conditional skip, for example, is unprovable
+    and renders unmarked).
   </p>
 
   <% grid = CurrentScope::PermissionGrid.new %>
@@ -42,15 +65,58 @@
       </thead>
       <tbody>
         <% grid.controllers.each do |controller| %>
+          <%# A broken controller body's NameError deliberately propagates out
+              of the reflection (KTD-2) — but ONE broken controller must not
+              take down the whole role editor for every other row. The view
+              renders that row as explicitly uninspectable (a visible state,
+              never silence, never "gated"); the rake task keeps propagating,
+              because its output makes proof claims a partial walk can't. %>
+          <% ungated = begin
+               grid.ungated?(controller)
+             rescue NameError
+               :uninspectable
+             end %>
+          <% uninspectable = ungated == :uninspectable
+             ungated = ungated == true %>
+          <% badge_id = "cs_ungated_#{controller.parameterize(separator: '_')}" if ungated %>
           <tr>
             <th scope="row">
               <%# Per-row master: enable/disable every action in this controller at once.
                   Progressive enhancement — with JS off, each cell checkbox still works. %>
               <label class="cs-row-all" title="Enable all <%= controller %> permissions">
                 <input type="checkbox" data-cs-row-all
-                       aria-label="Enable all <%= controller %> permissions">
+                       aria-label="Enable all <%= controller %> permissions"<% if ungated %>
+                       aria-describedby="<%= badge_id %>"<% end %>>
                 <span><%= controller %></span>
               </label>
+              <% if uninspectable %>
+                <%# Not a badge and not silence: the gate state is UNKNOWN here,
+                    and rendering nothing would read as "checked, and gated"
+                    under the hint's own rules. %>
+                <span class="cs-uninspectable-note" id="cs_uninspectable_<%= controller.parameterize(separator: '_') %>">
+                  could not inspect — this controller raised while loading, so its
+                  gate state is unknown. Fix the load error, then reload.
+                </span>
+              <% end %>
+              <% if ungated %>
+                <%# Advisory only — marking is not disabling (KTD-8/R5): nothing
+                    here is grayed or disabled. Same remediation vocabulary as
+                    GatingTripwire's message. The claim is scoped to ROUTED
+                    actions because the injected break-glass cell is live even
+                    on a marked row (KTD-9) and carries its own note below. %>
+                <%# Each remedy names its cause: re-including Guard on a subclass
+                    that inherited a skip is a NO-OP (the Concern short-circuits;
+                    the skip already removed the callback the include would add),
+                    so the inherited-skip host — the #62 shape this badge exists
+                    for — must be pointed at re-assertion, not at include. %>
+                <span class="cs-ungated-badge" id="<%= badge_id %>">
+                  <strong>gate not run</strong> — this controller does not run the
+                  gate; ticking its routed actions grants nothing until it does.
+                  If it inherited a skip, re-assert
+                  <code>before_action :current_scope_check!</code>; if it never had
+                  the gate, include CurrentScope::Guard.
+                </span>
+              <% end %>
             </th>
             <% grid.columns.each do |column| %>
               <% cell = grid.cell(controller, column, granted) %>
@@ -60,13 +126,35 @@
                     readers; the "·" marker is decorative CSS. %>
                 <td class="cs-cell-blank"></td>
               <% else %>
-                <td>
+                <%# column.actions covers both shapes — an ungrouped column is
+                    [action], and a permission_grid_groups entry containing the
+                    bypass action must not defeat the exemption. The two guards:
+                    the INJECTED key must actually sit on this controller (a
+                    grouped cell can be non-blank via its other actions), and
+                    routed? excludes the collision — a REAL routed action merely
+                    named like the bypass permission is ordinary and inert on a
+                    marked row; only the catalog-injected key stays live. (#79) %>
+                <% bypass_exempt = ungated && bypass_action &&
+                     column.actions.include?(bypass_action) &&
+                     CurrentScope.catalog.grouped[controller]&.include?(bypass_action) &&
+                     !CurrentScope.catalog.routed?("#{controller}##{bypass_action}") %>
+                <% note_id = "cs_bypass_exempt_#{controller.parameterize(separator: '_')}" if bypass_exempt %>
+                <td<% if bypass_exempt %> class="cs-cell-bypass"<% end %>>
                   <label>
                     <%= check_box_tag cell.name, cell.value, cell.checked,
                           id: "perm_#{cell.value.parameterize(separator: '_')}",
                           data: { cs_partial: cell.partial },
-                          "aria-label": "#{controller} #{column.label}" %>
+                          "aria-label": "#{controller} #{column.label}",
+                          "aria-describedby": (bypass_exempt ? "#{badge_id} #{note_id}" : badge_id) %>
                   </label>
+                  <% if bypass_exempt %>
+                    <%# KTD-9: break-glass is decided by GATED controllers acting
+                        on the record type, so this grant is live despite the
+                        row's badge — the one cell exempt from its claim. The
+                        class is also the CSS hook that keeps the real granted
+                        wash here while sibling cells are muted. %>
+                    <span class="cs-bypass-exempt" id="<%= note_id %>">exempt — stays live</span>
+                  <% end %>
                   <%# Partial group: preserve the exact granted actions so a no-op
                       save can't promote the group to a full grant. Interacting with
                       the checkbox disables these (JS) so the group control takes over. %>

data/app/views/current_scope/roles/members.html.erb

@@ -11,7 +11,7 @@
 
 <h2>Add org-wide members</h2>
 <% if @candidates.any? %>
-  <%= form_with url: role_assignment_path, method: :post do %>
+  <%= form_with url: role_assignments_path, method: :post do %>
     <%= hidden_field_tag :role_id, @role.id %>
     <p>
       <%= label_tag "subject_gids", "Subjects" %>
@@ -46,7 +46,7 @@
             <td>
               <% if subject_gid %>
                 <%# Removing = clearing this subject's org-wide role (blank role_id). %>
-                <%= form_with url: role_assignment_path, method: :post,
+                <%= form_with url: role_assignments_path, method: :post,
                       data: { cs_confirm: "Remove #{who} from #{@role.name}?" } do %>
                   <%= hidden_field_tag :subject_gid, subject_gid %>
                   <%= hidden_field_tag :role_id, "" %>
@@ -54,7 +54,7 @@
                 <% end %>
               <% else %>
                 <%# Orphaned assignment (subject deleted): remove it by id. %>
-                <%= button_to "Remove", remove_role_assignment_path(assignment), method: :delete,
+                <%= button_to "Remove", role_assignment_path(assignment), method: :delete,
                       class: "cs-btn", form: { data: { cs_confirm: "Remove this orphaned org-wide assignment?" } } %>
                 <span class="cs-subtle">subject unavailable</span>
               <% end %>

data/app/views/current_scope/roles/new.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with model: @role do |f| %>
   <% if @role.errors.any? %>
-    <p class="cs-alert"><%= @role.errors.full_messages.to_sentence %></p>
+    <p class="cs-alert" role="alert"><%= @role.errors.full_messages.to_sentence %></p>
   <% end %>
 
   <p><%= f.label :name %> <%= f.text_field :name %></p>

data/app/views/current_scope/scoped_role_assignments/new.html.erb

@@ -102,9 +102,18 @@
                 include_blank: "— choose a record —", form: "cs-cascade",
                 data: { current_scope_autosubmit: true } %>
           <% if @searchable && params[:q].present? %>
-            <span class="cs-hint">
-              Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
-            </span>
+            <%# Keyed off the raw SEARCH results, not record_options — a
+                deep-linked @resource is prepended to the options even when the
+                query matched nothing, and must not fake a "matches shown". %>
+            <% if @records.blank? %>
+              <span class="cs-hint cs-picker-empty">
+                No records match “<%= params[:q] %>” — try a different search.
+              </span>
+            <% else %>
+              <span class="cs-hint">
+                Showing up to <%= CurrentScope::ScopedRoleAssignmentsController::DISPLAY_LIMIT %> matches — refine the search to narrow.
+              </span>
+            <% end %>
           <% end %>
         </p>
       <% end %>

data/app/views/current_scope/shared/access_denied.html.erb

@@ -0,0 +1,30 @@
+<%# The engine's front-door 403. Deliberately NOT rendered in the console
+    layout: that layout is a sidebar of links to Roles / Subjects / Events, and
+    showing the console chrome to someone who cannot open any of it reads as
+    "you're in" while every link refuses. Standalone page, engine stylesheet, no
+    navigation offered that isn't there. %>
+<!DOCTYPE html>
+<html lang="en"<%= " data-cs-theme=\"#{cookies[:current_scope_theme]}\"".html_safe if %w[light dark].include?(cookies[:current_scope_theme]) %>>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Access denied — CurrentScope</title>
+  <%= csp_meta_tag %>
+  <%= stylesheet_link_tag "current_scope/application", media: "all" %>
+</head>
+<body>
+  <main class="cs-card cs-denied">
+    <h1>This area needs a full-access role</h1>
+    <p>
+      The authorization console is where roles and permissions are granted, so it
+      can't be gated by a permission you could be granted — it's open only to
+      subjects holding a role marked <strong>full access</strong>.
+    </p>
+    <p class="cs-hint">
+      If you should have it, ask someone who already does to grant you a
+      full-access role. If nobody has one yet, it's granted from the console or a
+      rake task — see the CurrentScope README's bootstrap section.
+    </p>
+  </main>
+</body>
+</html>