feat(records): enforce purpose-bound restricted access

docs/EAKTE_ARCHITECTURE.md

@@ -46,11 +46,13 @@ attachment, case/representation, decision, delivery, and correction evidence;
 exercise closure, retention, hold, approval, and simulated transfer; and prove
 search and temporal reconstruction after database backup/restore. The
 remaining boundary is intentionally visible rather than implied: Records #7
-requires selection and target testing of an archive/xdomea endpoint and
-conformance profile. Restricted per-record access grants also remain a
-dedicated access-policy slice. Destruction is represented only as an approved
-pending state; no content deletion or real archive effect is currently
-claimed.
+requires target testing of the selected d.velop d3 archive endpoint and its
+conformance profile. Restricted per-record access is implemented through
+revisioned, effective-dated subject/action/purpose grants. Current grants
+govern historical reads and replays, `records.search` is an explicit purpose,
+and the last active management grant cannot be revoked while a record remains
+restricted. Destruction is represented only as an approved pending state; no
+content deletion or real archive effect is currently claimed.
 
 ## Ownership Boundary
 
@@ -137,9 +139,11 @@ correction path.
   filing independently.
 - The current security context always controls browsing, including historical
   views.
-- Purpose-aware access may be narrower than ordinary read permission and can
-  require case assignment, represented function, mandate, legal basis, or
-  reason-for-access capture.
+- Restricted access is narrower than ordinary module read permission. It
+  requires a current account, membership, group, role, function-assignment, or
+  delegation grant whose action and exact allowed purpose match the request.
+  Manage implies write/read and write implies read; all other matches are
+  exact and fail closed without revealing the record.
 - A record item can reference a message, decision, form submission, report,
   dataset materialization, external DMS object, physical item, or paper scan;
   it is not limited to Files.