@@ -0,0 +1,92 @@
+import { request, expect, type APIRequestContext } from '@playwright/test';
+
+/**
+ * A second, non-admin identity for the live suite (objectstack#27552).
+ *
+ * The global setup signs in as the seeded admin only, and the admin passes
+ * every access check, so no spec signed in that way can see a Console⇄server
+ * access defect. This module makes a member who holds ONE of the showcase's own
+ * permission sets (plus the `everyone` baseline the dev server adds), signs it
+ * in, and hands back a storageState a spec opens a browser context with.
+ *
+ * Why the admin creates the member rather than the member signing up: the dev
+ * server's audience posture is `invite_only`, so `POST /auth/sign-up/email`
+ * answers 403 `SELF_REGISTRATION_CLOSED` (measured on `objectstack dev --fresh`).
+ * `POST /auth/admin/create-user` takes a password and the permission set to
+ * grant in one call, which is the Setup "New user" door.
+ *
+ * One member per permission set, at a fixed address, so a re-run against a
+ * long-lived backend signs the same member in again instead of piling up
+ * users: an "already exists" answer is accepted. Whether that member really
+ * holds the set is not taken on trust here; a spec states the access it relies
+ * on through the server first (read answered, write refused), so a member
+ * created some other way fails there, by name.
+ *
+ * The storageState has the same two halves `global-setup.ts` writes for the
+ * admin: the better-auth cookie for the API origin and the Bearer token the
+ * console adapter reads from the APP origin's localStorage. It is returned,
+ * never written to disk, so no path has to be rooted.
+ */
+const APP = process.env.LIVE_APP_URL || 'http://localhost:5180';
+const API = process.env.LIVE_API_URL || 'http://localhost:3000';
+const MEMBER_PASSWORD = 'live-e2e-member-1';
+
+export type MemberStorageState = {
+  cookies: Awaited<ReturnType<APIRequestContext['storageState']>>['cookies'];
+  origins: { origin: string; localStorage: { name: string; value: string }[] }[];
+};
+
+export interface LiveMember {
+  email: string;
+  /** The Bearer token the member's own API calls send. */
+  token: string;
+  /** Open a browser context with this to act as the member. */
+  storageState: MemberStorageState;
+}
+
+/**
+ * Create (or reuse) the member holding `permissionSet` and sign it in.
+ * `admin` is a request context signed in as an administrator: a spec's
+ * `request` fixture, which carries the global setup's admin cookie.
+ */
+export async function signInMember(admin: APIRequestContext, permissionSet: string): Promise<LiveMember> {
+  const email = `live-e2e.${permissionSet}@objectos.ai`;
+  const created = await admin.post(`${API}/api/v1/auth/admin/create-user`, {
+    data: {
+      email,
+      password: MEMBER_PASSWORD,
+      name: `Live E2E ${permissionSet}`,
+      mustChangePassword: false,
+      permissionSet,
+    },
+  });
+  if (!created.ok()) {
+    const body = await created.json().catch(() => ({}));
+    expect(
+      body?.error?.code,
+      `create-user for ${email} answered ${created.status()}: ${JSON.stringify(body)}`,
+    ).toBe('USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL');
+  }
+
+  const ctx = await request.newContext();
+  try {
+    const res = await ctx.post(`${API}/api/v1/auth/sign-in/email`, {
+      data: { email, password: MEMBER_PASSWORD },
+      headers: { 'Content-Type': 'application/json' },
+    });
+    expect(res.ok(), `member sign-in for ${email} answered ${res.status()}`).toBe(true);
+    const token = res.headers()['set-auth-token'];
+    expect(token, 'member sign-in returned a `set-auth-token` header').toBeTruthy();
+    const { cookies } = await ctx.storageState();
+    return {
+      email,
+      token,
+      storageState: {
+        cookies,
+        origins: [{ origin: APP, localStorage: [{ name: 'auth-session-token', value: token }] }],
+      },
+    };
+  } finally {
+    await ctx.dispose();
+  }
+}
@@ -0,0 +1,136 @@
+import { test, expect, type Page } from '@playwright/test';
+import { signInMember } from './member';
+
+/**
+ * objectstack#27552 — a member who may READ a record but not WRITE it is
+ * refused coherently by the Console, against the real server.
+ *
+ * Access is the defect class the admin-only live suite cannot see: the seeded
+ * admin passes every check. #27138 is the escape this spec stands guard over:
+ * the edit dialog offered editable fields on a row the caller could read but
+ * not write, and the save was refused whole.
+ *
+ * The member holds the showcase's own `showcase_manager` set: on
+ * `showcase_inquiry` (OWD `private`) it reads org-wide but writes only its own
+ * rows (`readScope: 'org'`, `writeScope: 'own'`). An inquiry the admin creates
+ * is therefore readable and not writable for the member: a ROW verdict, not an
+ * object-level one, which is the shape #27138 had.
+ *
+ * What is asserted, in order:
+ *  1. the premise, through the server: the member's read of the record answers
+ *     and its update is refused (`PERMISSION_DENIED`, 403), so the UI half below
+ *     can never pass on a record the member could write after all;
+ *  2. as the member, the edit form opened by URL (`?form=`) says the record is
+ *     read-only (`closed-affordance-notice`), draws every field disabled and
+ *     offers no submit; the record page under it offers neither the Edit button
+ *     nor the inline-edit pencils; and the member's browser sent no write;
+ *  3. control, as the admin: the same form on the same record has no notice,
+ *     the same record page offers Edit and the pencils (so step 2's absences are
+ *     not a selector that finds nothing), and a save through the form persists.
+ */
+const API = process.env.LIVE_API_URL || 'http://localhost:3000';
+const OBJECT = 'showcase_inquiry';
+const recordPath = (id: string) => `/apps/showcase_app/${OBJECT}/record/${id}`;
+const formPath = (id: string) => `${recordPath(id)}?form=${encodeURIComponent(id)}`;
+
+// The record header's Edit CTA and the record body's inline-edit pencils carry
+// no test id; their accessible names are the `detail.edit` and
+// `detail.editInlineHint` strings, en or zh.
+const editButton = (page: Page) => page.getByRole('button', { name: /^(Edit|编辑)$/ });
+const inlineEditPencils = (page: Page) => page.getByRole('button', { name: /^(Double-click to edit|双击编辑)$/ });
+
+test.use({ viewport: { width: 1440, height: 900 } });
+
+test('a member who may read but not write an inquiry gets a read-only form and no edit affordance; the admin edits it', async ({
+  browser,
+  page,
+  request,
+  playwright,
+}) => {
+  // Three page loads in two browser contexts, one of them cold.
+  test.setTimeout(120_000);
+  // The record: created by the admin, so the admin owns it.
+  const name = `Read-only member e2e ${Date.now()}`;
+  const createRes = await request.post(`${API}/api/v1/data/${OBJECT}`, {
+    data: { name, email: 'read-only-member@example.com', message: 'Created by the live access spec.' },
+  });
+  expect(createRes.ok(), `admin create answered ${createRes.status()}`).toBe(true);
+  const created = await createRes.json();
+  const id: string = created.id ?? created.record?.id ?? created.data?.id;
+  expect(id, 'the created inquiry id').toBeTruthy();
+
+  const member = await signInMember(request, 'showcase_manager');
+
+  await test.step('premise: the server lets the member read the record and refuses its update', async () => {
+    const api = await playwright.request.newContext({ extraHTTPHeaders: { Authorization: `Bearer ${member.token}` } });
+    try {
+      const read = await api.get(`${API}/api/v1/data/${OBJECT}/${id}`);
+      expect(read.status(), 'the member reads the admin-owned inquiry').toBe(200);
+      const write = await api.patch(`${API}/api/v1/data/${OBJECT}/${id}`, { data: { company: 'Member write' } });
+      expect(write.status(), 'the member update is refused').toBe(403);
+      expect((await write.json()).code).toBe('PERMISSION_DENIED');
+    } finally {
+      await api.dispose();
+    }
+  });
+
+  await test.step('as the member: a read-only form with a named notice, no edit affordance, no write sent', async () => {
+    const context = await browser.newContext({
+      storageState: member.storageState,
+      baseURL: test.info().project.use.baseURL,
+      viewport: { width: 1440, height: 900 },
+    });
+    try {
+      const memberPage = await context.newPage();
+      const writes: string[] = [];
+      memberPage.on('request', (r) => {
+        if (r.method() !== 'GET' && r.url().includes(`/api/v1/data/${OBJECT}`)) writes.push(`${r.method()} ${r.url()}`);
+      });
+
+      await memberPage.goto(formPath(id));
+      const dialog = memberPage.getByRole('dialog');
+      await expect(dialog).toBeVisible({ timeout: 30_000 });
+      // The notice is drawn from the server's row verdict, so once it shows the
+      // verdict has arrived and the absences below are not read too early.
+      await expect(dialog.getByTestId('closed-affordance-notice')).toBeVisible({ timeout: 30_000 });
+      for (const field of ['name', 'email', 'company', 'message']) {
+        await expect(dialog.locator(`[name="${field}"]`), `${field} is drawn read-only`).toBeDisabled();
+      }
+      await expect(dialog.getByTestId('modal-form-footer').locator('button[type="submit"]')).toHaveCount(0);
+
+      await memberPage.goto(recordPath(id));
+      await expect(memberPage.getByRole('heading', { name, exact: true })).toBeVisible({ timeout: 30_000 });
+      await expect(memberPage.getByRole('button', { name: /^(More actions|更多操作)$/ })).toBeVisible();
+      await expect(editButton(memberPage)).toHaveCount(0);
+      await expect(inlineEditPencils(memberPage)).toHaveCount(0);
+
+      expect(writes, 'the member browser attempted no write').toEqual([]);
+    } finally {
+      await context.close();
+    }
+  });
+
+  await test.step('control, as the admin: the same form is editable and its save persists', async () => {
+    await page.goto(recordPath(id));
+    await expect(editButton(page)).toBeVisible({ timeout: 30_000 });
+    await expect(inlineEditPencils(page).first()).toBeVisible();
+
+    await page.goto(formPath(id));
+    const dialog = page.getByRole('dialog');
+    await expect(dialog).toBeVisible({ timeout: 30_000 });
+    const company = dialog.locator('input[name="company"]');
+    await expect(company).toBeEnabled({ timeout: 30_000 });
+    await expect(dialog.getByTestId('closed-affordance-notice')).toHaveCount(0);
+
+    const value = `Admin edit ${Date.now()}`;
+    await company.fill(value);
+    const saved = page.waitForResponse(
+      (r) => r.request().method() !== 'GET' && r.url().includes(`/api/v1/data/${OBJECT}/${id}`),
+    );
+    await dialog.getByTestId('modal-form-footer').locator('button[type="submit"]').click();
+    expect((await saved).ok(), 'the admin save answered 2xx').toBe(true);
+
+    const after = await (await request.get(`${API}/api/v1/data/${OBJECT}/${id}`)).json();
+    expect((after.record ?? after.data ?? after).company).toBe(value);
+  });
+});
@@ -112,7 +112,7 @@
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:live": "playwright test --config=playwright.live.config.ts",
     "test:e2e:live:ci": "playwright test --config=playwright.live.config.ts screen-flow.spec.ts action-modal.spec.ts master-detail.spec.ts saved-view-filter.spec.ts studio-object-designer.spec.ts studio-editor.spec.ts",
-    "test:e2e:live:nightly": "playwright test --config=playwright.live.config.ts cascading-options.spec.ts declared-sharing-rules-reach-13091.spec.ts field-conditional-rules.spec.ts form-view-subforms.spec.ts grid-conditional-rules.spec.ts grid-file-upload.spec.ts grid-parent-rules.spec.ts inline-edit-polish-2572.spec.ts list-row-action-cel.spec.ts record-history-display.spec.ts required-when-submit.spec.ts summary-rollup.spec.ts user-filters.spec.ts",
+    "test:e2e:live:nightly": "playwright test --config=playwright.live.config.ts cascading-options.spec.ts declared-sharing-rules-reach-13091.spec.ts field-conditional-rules.spec.ts form-view-subforms.spec.ts grid-conditional-rules.spec.ts grid-file-upload.spec.ts grid-parent-rules.spec.ts inline-edit-polish-2572.spec.ts list-row-action-cel.spec.ts read-only-member-record.spec.ts record-history-display.spec.ts required-when-submit.spec.ts summary-rollup.spec.ts user-filters.spec.ts",
     "test:e2e:import-harness": "playwright test --config=playwright.import-harness.config.ts",
     "test:e2e:import-console": "playwright test --config=playwright.import-console.config.ts"
   },