feat(records): enforce purpose-bound restricted access

docs/RECORDS_DOMAIN_BOUNDARY.md

@@ -52,9 +52,12 @@ The native kernel currently provides:
 - an executable assisted/digital resident-parking-permit reference package
   that proves equivalent filing semantics, URL resume, search, temporal
   reconstruction, and evidence integrity after database backup/restore.
+- revisioned, effective-dated restricted-record grants for accounts,
+  memberships, groups, roles, function assignments, and delegations, with
+  exact read/write/manage actions and allowed purposes. Current grants govern
+  historical reads and idempotent replays; search requires `records.search`.
 
-Restricted object grants remain a separate governed slice. A target-tested
-archive adapter and any destructive effect remain deliberately unimplemented;
+A target-tested archive adapter and any destructive effect remain deliberately unimplemented;
 approved destruction is only a pending lifecycle state.
 
 ## Data-subject requests
@@ -67,9 +70,10 @@ activity only; creating, filing, reviewing, or transferring an eAkte does not
 make that staff member the subject of its contents.
 
 The provider exports bounded record identity, revision, filing, chronology,
-hold, disposition, and transfer lifecycle metadata. It excludes source
+hold, disposition, transfer, and the subject's own restricted-access grant
+lifecycle metadata. It excludes source
 content, record snapshots and search text, opaque institutional contexts and
-payloads, digests, replay keys, launch URLs, approval identifiers, archive
+payloads, grant reasons, digests, replay keys, launch URLs, approval identifiers, archive
 manifests and receipts, and unrelated records. Exact source content remains in
 the source owner's DSAR provider. Record revisions and lifecycle evidence are
 immutable retention evidence; the current record fact receives a
@@ -78,8 +82,8 @@ hold, disposition, or transfer must use the governed eAkte lifecycle.
 
 ## Next Boundary Slice
 
-Complete restricted access and one target-tested archive provider without
-moving source-module ownership into Records. The executable reference journey
+Complete one target-tested archive provider without moving source-module
+ownership into Records. The executable reference journey
 already covers assisted/digital intake, decision, filing, hold, restore,
 search, and archive simulation; it is evidence for the native boundary, not a
 claim of target archive conformance or transferred custody.