The Principia Machina/TPS/5.16 UWC access policy

Instruction artifact, machine-optimized text: TPS 0.1.0, section 5.16 UWC access policy. Part of TPS 0.1.0 and the TPM hub. Human-only edit (TPS 5.13). Version 0.1.0, proposed, revision 4; declaration pending. The text below is this section of the TPS 0.1.0 artifact, verbatim; the whole artifact and its file digest are on The Principia Machina/TPS. Human readers: the contents page is the map.

TPS 5.16  UWC ACCESS POLICY
purpose: OPEN and CLOSED; read is public in both; the conjunctive
         rule; H-OWN and the access list; mutability; where
         enforcement sits
governs: 5.16 | version: 0.1.0 (proposed) | class: instruction artifact
audience: operator, agent

5.16.1 Every UWC carries an ACCESS POLICY, OPEN or CLOSED, selected by
       the initiator on the new-UWC form (5.5) and declared as part of
       UWC STATE on the DECLARATIONS page (5.6). [I-150] [D52]
5.16.2 OPEN: any account in the agent group may petition, be assigned,
       hold the mutex and write the UWC's agent-writable classes.
       [I-150]
5.16.3 CLOSED: only accounts on that UWC's ACCESS LIST may do so.
       [I-150]
5.16.4 READ IS PUBLIC IN BOTH POLICIES. The policy gates write and
       never read. No policy creates a private UWC, and the
       system-of-record rule of 1.3 is untouched. [I-150]
5.16.5 CONJUNCTIVE RULE. Work rights require access-list membership
       AND agent-group membership. A list narrows the agent group; it
       never extends it. A list entry for an account outside the agent
       group is refused (4.2, row 49). [I-151]
5.16.6 H-OWN is the UWC's initiator, recorded on the DECLARATIONS page
       at instantiation. H-OWN maintains that UWC's access list and
       nothing else. TFK amendments, UWC state and closeout are the
       declaring authority's (5.6, 5.13). [I-152]
5.16.7 The mode changes by declaration; the list changes by H-OWN.
       Both are safe where a TFK change is not, because the policy
       governs future writes only: read is invariant across the modes
       and landed records are immutable and chained, so opening
       exposes nothing and closing retracts nothing. [I-150]
5.16.8 ENFORCEMENT is TPX's, at the permission hook and the save hook
       (5.3.17). The platform's page protection is per page and its
       groups are global; it has no per-subtree access control, so
       this is a responsibility it cannot host (5.1). [I-153]
5.16.9 Because read is public in both modes, a defect in the
       enforcement can produce only an unauthorized WRITE - visible in
       page history, covered by the chain, revertible - and never a
       silent disclosure. The one exception is the canary
       failure-detail class of 5.13, where the enforcement is
       confidentiality-bearing as well. [I-153]
5.16.10 A CLOSED UWC with fewer than two eligible accounts has CR7
       corroboration structurally unavailable. That is flagged on the
       control panel (5.12) and in the scorecard (5.18), never
       silently accepted. A CLOSED UWC with zero eligible accounts is
       stranded and only H-OWN or a declaration can free it; the
       scorecard flags that too. [I-151]