feat(records): enforce purpose-bound restricted access

docs/EAKTE_ARCHITECTURE.md

@@ -46,11 +46,13 @@ attachment, case/representation, decision, delivery, and correction evidence;
 exercise closure, retention, hold, approval, and simulated transfer; and prove
 search and temporal reconstruction after database backup/restore. The
 remaining boundary is intentionally visible rather than implied: Records #7
-requires selection and target testing of an archive/xdomea endpoint and
-conformance profile. Restricted per-record access grants also remain a
-dedicated access-policy slice. Destruction is represented only as an approved
-pending state; no content deletion or real archive effect is currently
-claimed.
+requires target testing of the selected d.velop d3 archive endpoint and its
+conformance profile. Restricted per-record access is implemented through
+revisioned, effective-dated subject/action/purpose grants. Current grants
+govern historical reads and replays, `records.search` is an explicit purpose,
+and the last active management grant cannot be revoked while a record remains
+restricted. Destruction is represented only as an approved pending state; no
+content deletion or real archive effect is currently claimed.
 
 ## Ownership Boundary
 
@@ -137,9 +139,11 @@ correction path.
   filing independently.
 - The current security context always controls browsing, including historical
   views.
-- Purpose-aware access may be narrower than ordinary read permission and can
-  require case assignment, represented function, mandate, legal basis, or
-  reason-for-access capture.
+- Restricted access is narrower than ordinary module read permission. It
+  requires a current account, membership, group, role, function-assignment, or
+  delegation grant whose action and exact allowed purpose match the request.
+  Manage implies write/read and write implies read; all other matches are
+  exact and fail closed without revealing the record.
 - A record item can reference a message, decision, form submission, report,
   dataset materialization, external DMS object, physical item, or paper scan;
   it is not limited to Files.

docs/RECORDS_DOMAIN_BOUNDARY.md

@@ -52,9 +52,12 @@ The native kernel currently provides:
 - an executable assisted/digital resident-parking-permit reference package
   that proves equivalent filing semantics, URL resume, search, temporal
   reconstruction, and evidence integrity after database backup/restore.
+- revisioned, effective-dated restricted-record grants for accounts,
+  memberships, groups, roles, function assignments, and delegations, with
+  exact read/write/manage actions and allowed purposes. Current grants govern
+  historical reads and idempotent replays; search requires `records.search`.
 
-Restricted object grants remain a separate governed slice. A target-tested
-archive adapter and any destructive effect remain deliberately unimplemented;
+A target-tested archive adapter and any destructive effect remain deliberately unimplemented;
 approved destruction is only a pending lifecycle state.
 
 ## Data-subject requests
@@ -67,9 +70,10 @@ activity only; creating, filing, reviewing, or transferring an eAkte does not
 make that staff member the subject of its contents.
 
 The provider exports bounded record identity, revision, filing, chronology,
-hold, disposition, and transfer lifecycle metadata. It excludes source
+hold, disposition, transfer, and the subject's own restricted-access grant
+lifecycle metadata. It excludes source
 content, record snapshots and search text, opaque institutional contexts and
-payloads, digests, replay keys, launch URLs, approval identifiers, archive
+payloads, grant reasons, digests, replay keys, launch URLs, approval identifiers, archive
 manifests and receipts, and unrelated records. Exact source content remains in
 the source owner's DSAR provider. Record revisions and lifecycle evidence are
 immutable retention evidence; the current record fact receives a
@@ -78,8 +82,8 @@ hold, disposition, or transfer must use the governed eAkte lifecycle.
 
 ## Next Boundary Slice
 
-Complete restricted access and one target-tested archive provider without
-moving source-module ownership into Records. The executable reference journey
+Complete one target-tested archive provider without moving source-module
+ownership into Records. The executable reference journey
 already covers assisted/digital intake, decision, filing, hold, restore,
 search, and archive simulation; it is evidence for the native boundary, not a
 claim of target archive conformance or transferred custody.