diff --git a/.changeset/12082-census-leg-a.md b/.changeset/12082-census-leg-a.md
new file mode 100644
index 0000000000..460905623a
--- /dev/null
+++ b/.changeset/12082-census-leg-a.md
@@ -0,0 +1,39 @@
+---
+'@object-ui/core': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/plugin-gantt': patch
+'@object-ui/plugin-grid': patch
+'@object-ui/plugin-form': patch
+'@object-ui/app-shell': patch
+---
+
+More write affordances read the affordance-to-grant map, so a caller without the
+grant is no longer offered a write the server then refuses (objectui#12082, leg A
+of the write-census backlog). No row is added: each reuses the row of the same
+verb on the same object.
+
+- **The record overlay's inline edit** — the overlay the calendar, the kanban and
+  the gantt open on a record (`RecordDetailPanel`) — reads the `recordEdit` row,
+  the row the record page reads for the same in-place edit: the object's policy,
+  the effective API operation set and the caller's update grant. A closed row
+  opens no inline-edit session, as an absent `onFieldSave` already did. Each
+  field still asks its own field question, as since objectui#12103.
+- **The gantt's in-chart writes** read `rowEdit` (a bar's drag, resize and
+  progress, its title edited in place, and its dependency links) and `rowDelete`
+  (a row's Delete). A closed row withholds the handler the chart draws the
+  affordance from, the way `readOnly` and `lockField` already do.
+- **A grid's bulk field update** (a `bulkActionDefs` entry with `operation:
+  'update'`) reads `rowEdit`, as its bulk delete reads `rowDelete`: a closed row
+  removes the button from the selection bar, and with it the dialog, its undo
+  and its retry. `custom` operations are unchanged.
+- **A master-detail form's line grids** read `relatedNew` (Add, the entry row
+  and Duplicate) and `relatedRowDelete` (Remove) on the CHILD object, as a
+  line-items panel does. Remove asks the delete grant on an edit form only: a
+  create form's lines are drafts, and a removed one is never a server delete.
+- **A line-items panel** now hands its child object's schema to those two rows,
+  so the child's own policy (`managedBy`, `userActions`) is read too.
+- **The AI build panel's spreadsheet import** (`ExcelImportBar`) reads the
+  `listImport` row of the object it imports into, as the list page's Import
+  does: without it, Import is disabled for that object.
+
+With no permission provider mounted every one of these reads open, as before.
diff --git a/content/docs/plugins/plugin-form.mdx b/content/docs/plugins/plugin-form.mdx
index f181de1fce..06a605e19b 100644
--- a/content/docs/plugins/plugin-form.mdx
+++ b/content/docs/plugins/plugin-form.mdx
@@ -474,7 +474,14 @@ Duplicate) only when the caller may create the CHILD object, and removing one
 only when they may delete it — the `relatedNew` and `relatedRowDelete` rows of the
 affordance-to-grant map in `@object-ui/core`, the same rows a related list reads
 for the same two writes. Its cells ask each column's field question, as the form
-layouts do. With no permission provider mounted both read open.
+layouts do. The child's own policy is read too: the panel hands the child
+object's schema to those two rows, so a child whose `userActions` close create or
+delete offers neither. With no permission provider mounted both read open.
+
+A `MasterDetailForm`'s line grids read the same two rows on the child object.
+Remove asks the delete grant on an edit form only: a create form saves the parent
+and one create per line, so a line removed before that first save is a draft,
+never a server delete, and stays removable for a caller who may only create.
 
 ## Examples
 
diff --git a/content/docs/plugins/plugin-gantt.mdx b/content/docs/plugins/plugin-gantt.mdx
index eac58762c7..6d9653ee83 100644
--- a/content/docs/plugins/plugin-gantt.mdx
+++ b/content/docs/plugins/plugin-gantt.mdx
@@ -36,6 +36,14 @@ The `@object-ui/plugin-gantt` plugin provides Gantt chart visualization for Obje
   `dataSource.update()` automatically (optimistic local update + revert on
   failure). See the [package README](https://github.com/objectstack-ai/objectui/blob/main/packages/plugin-gantt/README.md#drag-and-drop-rescheduling) for details on the
   lower-level `onTaskUpdate` hook when embedding `<GanttView>` directly.
+- **Writes follow the caller's grant**: a bar's drag, resize and progress, its
+  title edited in place and its dependency links are offered only when the
+  `rowEdit` row of the affordance-to-grant map (`@object-ui/core`) allows them —
+  the object's policy, the effective API operation set and the caller's
+  **update** grant — and a row's Delete only when `rowDelete` does. The record
+  drawer's inline edit reads the record page's `recordEdit` row. With no
+  permission provider mounted they read open, as `readOnly` and `lockField`
+  still close them.
 
 <PluginLoader plugins={['gantt']}>
 
diff --git a/content/docs/plugins/plugin-grid.mdx b/content/docs/plugins/plugin-grid.mdx
index cbbda04ec5..16cc4268c2 100644
--- a/content/docs/plugins/plugin-grid.mdx
+++ b/content/docs/plugins/plugin-grid.mdx
@@ -608,6 +608,15 @@ target from that field, so a lookup param renders the record picker and the
 confirm step shows the picked record's label. A param whose field is not in
 the object metadata is refused, and the run is blocked.
 
+The selection bar offers a write only to a caller who may make it. A bulk Delete
+is the `rowDelete` row of the affordance-to-grant map (`@object-ui/core`), and a
+`bulkActionDefs` entry with `operation: 'update'` — a patch written to every
+selected record — is the `rowEdit` row, the same rows the row menu's Delete and
+Edit read: the object's policy, the effective API operation set and the
+caller's **delete** or **update** grant. A closed row removes the button, and
+with it the dialog, its undo and its retry. `custom` entries are unchanged.
+With no permission provider mounted both read open.
+
 ### Row callbacks are component props
 
 `onRowClick`, `onRowSelect`, `onCellChange`, `onRowSave`, `onBatchSave`,
diff --git a/packages/app-shell/src/console/ai/ExcelImportBar.tsx b/packages/app-shell/src/console/ai/ExcelImportBar.tsx
index fa2cdf4b71..94d105b87d 100644
--- a/packages/app-shell/src/console/ai/ExcelImportBar.tsx
+++ b/packages/app-shell/src/console/ai/ExcelImportBar.tsx
@@ -12,6 +12,11 @@
  * mapping, dry-run and the real server-side import. So the magic-flow trial
  * goes from "one sentence → app with demo data" to "app with MY data" — the
  * retention hinge for a spreadsheet refugee.
+ *
+ * Import is the `listImport` row of the affordance-to-grant map (objectui#12082),
+ * the row the console list's Import reads for the same wizard: it is offered for
+ * the picked object only when the caller's create grant and the server's
+ * effective operation set allow it, and picking another object asks again.
  */
 
 import { useEffect, useMemo, useState } from 'react';
@@ -27,6 +32,8 @@ import {
 import { createAuthenticatedFetch } from '@object-ui/auth';
 import { toast } from 'sonner';
 import { useObjectTranslation } from '@object-ui/i18n';
+import { resolveAffordance } from '@object-ui/core';
+import { usePermissions } from '@object-ui/permissions';
 import { ImportWizard } from '@object-ui/plugin-grid';
 
 interface WizardField {
@@ -133,6 +140,17 @@ export function ExcelImportBar({ file, dataSource, defaultObjectName, onDone }:
   const [loadingFields, setLoadingFields] = useState(false);
   const [fields, setFields] = useState<WizardField[] | null>(null);
   const [open, setOpen] = useState(false);
+  const perms = usePermissions();
+  // objectui#12082 — the `listImport` row, asked of the picked object. The bar
+  // has not read that object's schema when it offers Import (it reads it on the
+  // press), so the policy half reads the default bucket; the grant and the
+  // effective operation set are the server's own refusal. With no permission
+  // provider mounted both read open, as before.
+  const importGranted = resolveAffordance('listImport', {
+    objectSchema: null,
+    objectName: selected,
+    perms,
+  }).allowed;
 
   // List the env's user objects so the user can target the import. Uses the
   // uncached meta list endpoint; filters platform/system objects.
@@ -162,7 +180,7 @@ export function ExcelImportBar({ file, dataSource, defaultObjectName, onDone }:
   }, [authFetch, defaultObjectName]); // eslint-disable-line react-hooks/exhaustive-deps
 
   async function openWizard() {
-    if (!selected) return;
+    if (!selected || !importGranted) return;
     setLoadingFields(true);
     try {
       const schema = await dataSource.getObjectSchema(selected);
@@ -215,7 +233,7 @@ export function ExcelImportBar({ file, dataSource, defaultObjectName, onDone }:
         onPick={setSelected}
         disabled={!objects || objects.length === 0}
       />
-      <Button size="sm" onClick={openWizard} disabled={!selected || loadingFields}>
+      <Button size="sm" onClick={openWizard} disabled={!selected || loadingFields || !importGranted}>
         {loadingFields ? t('excelImport.opening') : t('excelImport.importAction')}
       </Button>
       <Button size="sm" variant="ghost" onClick={onDone}>
diff --git a/packages/app-shell/src/console/ai/__tests__/ExcelImportBar.importGrant-12082.test.tsx b/packages/app-shell/src/console/ai/__tests__/ExcelImportBar.importGrant-12082.test.tsx
new file mode 100644
index 0000000000..ee466f5fe4
--- /dev/null
+++ b/packages/app-shell/src/console/ai/__tests__/ExcelImportBar.importGrant-12082.test.tsx
@@ -0,0 +1,141 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#12082 — the AI build panel's spreadsheet import reads the
+ * `listImport` row of the affordance-to-grant map, asked of the object it
+ * imports into.
+ *
+ * `ExcelImportBar` is the second mount of `ImportWizard`: the console list's
+ * Import is the first, and it has read the `listImport` row since the map
+ * landed. The bar read no grant at all, so a caller who may not create records
+ * of the picked object could press Import, map the sheet and run it, and every
+ * row was refused by the server. The bar now offers Import for the picked
+ * object only when its row allows it — the caller's create grant and the
+ * effective operation set — and picking another object asks again.
+ *
+ * Measured through the REAL `MePermissionsProvider`; the wizard is a probe that
+ * records the object it was opened for.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import * as React from 'react';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, cleanup, fireEvent, waitFor, screen, within, act } from '@testing-library/react';
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+
+const h = vi.hoisted(() => ({
+  /** The objects the bar lists as import targets. */
+  objects: [
+    { name: 'crm_account', label: 'Account' },
+    { name: 'crm_deal', label: 'Deal' },
+  ],
+  /** The props each mounted ImportWizard received. */
+  wizard: [] as Array<Record<string, unknown>>,
+}));
+
+vi.mock('@object-ui/auth', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  createAuthenticatedFetch: () => async () =>
+    new Response(JSON.stringify({ data: { items: h.objects } }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }),
+}));
+vi.mock('@object-ui/plugin-grid', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  ImportWizard: (props: { objectName: string }) => {
+    h.wizard.push({ objectName: props.objectName });
+    return <div data-testid="import-wizard" />;
+  },
+}));
+vi.mock('sonner', () => ({ toast: Object.assign(vi.fn(), { success: vi.fn(), error: vi.fn() }) }));
+
+import { ExcelImportBar } from '../ExcelImportBar';
+
+const FILE = new File(['a,b\n1,2'], 'deals.xlsx');
+/** What `t()` answers with no i18n provider: the key itself. */
+const IMPORT = 'excelImport.importAction';
+
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; create: boolean }> = [
+  { shape: 'create-only', bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false }, create: true },
+  { shape: 'edit-only', bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false }, create: false },
+  { shape: 'read-only', bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, create: false },
+  { shape: 'full', bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }, create: true },
+];
+const FULL = SHAPES[3].bits;
+
+const envelope = (objects: Record<string, Record<string, unknown>>): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: objects as never,
+  fields: {},
+});
+
+const settle = () => act(() => new Promise<void>((resolve) => setTimeout(resolve, 50)));
+
+function mount(perms: MePermissionsResponse | null) {
+  const dataSource = {
+    getObjectSchema: vi.fn(async (_name: string) => ({ fields: { title: { type: 'text', label: 'Title' } } })),
+  };
+  const bar = <ExcelImportBar file={FILE} dataSource={dataSource} onDone={vi.fn()} />;
+  render(perms ? <MePermissionsProvider initialPermissions={perms}>{bar}</MePermissionsProvider> : bar);
+  return { dataSource };
+}
+
+const importButton = () => screen.getByRole('button', { name: IMPORT });
+
+/** Press Import; report whether the wizard opened, and for which object. */
+async function pressImport(dataSource: { getObjectSchema: ReturnType<typeof vi.fn> }): Promise<string | null> {
+  fireEvent.click(importButton());
+  await settle();
+  if (!screen.queryByTestId('import-wizard')) {
+    expect(dataSource.getObjectSchema).not.toHaveBeenCalled();
+    return null;
+  }
+  return String(h.wizard[h.wizard.length - 1].objectName);
+}
+
+beforeEach(() => {
+  cleanup();
+  h.wizard.length = 0;
+});
+
+describe.each(SHAPES)('the spreadsheet import bar under a $shape grant on its target (objectui#12082)', ({ bits, create }) => {
+  it('Import is offered exactly when the create grant allows it', async () => {
+    const { dataSource } = mount(envelope({ crm_account: bits, crm_deal: bits }));
+    await settle();
+    expect(importButton()).toHaveTextContent(IMPORT);
+    expect(importButton().hasAttribute('disabled'), 'disabled').toBe(!create);
+    expect(await pressImport(dataSource)).toBe(create ? 'crm_account' : null);
+  });
+});
+
+describe("the spreadsheet import bar: the map's other layers and fail-open (objectui#12082)", () => {
+  it('fail-open: with no permission provider Import is offered, as before', async () => {
+    const { dataSource } = mount(null);
+    await settle();
+    expect(importButton()).not.toBeDisabled();
+    expect(await pressImport(dataSource)).toBe('crm_account');
+  });
+
+  it('an effective operation set without import withholds Import under the full grant', async () => {
+    const { dataSource } = mount(envelope({ crm_account: { ...FULL, apiOperations: ['get', 'list', 'create', 'update'] } }));
+    await settle();
+    expect(importButton()).toBeDisabled();
+    expect(await pressImport(dataSource)).toBeNull();
+  });
+
+  it('the verdict is asked of the PICKED object: a closed target, then an open one', async () => {
+    const { dataSource } = mount(envelope({ crm_account: SHAPES[2].bits, crm_deal: FULL }));
+    await settle();
+    expect(importButton()).toBeDisabled();
+    fireEvent.keyDown(screen.getByRole('combobox'), { key: 'ArrowDown' });
+    const listbox = await screen.findByRole('listbox');
+    fireEvent.click(within(listbox).getAllByRole('option').find((o) => o.textContent === 'Deal')!);
+    await waitFor(() => expect(importButton()).not.toBeDisabled());
+    expect(await pressImport(dataSource)).toBe('crm_deal');
+  });
+});
diff --git a/packages/core/README.md b/packages/core/README.md
index e9c2a1613a..ac0079497f 100644
--- a/packages/core/README.md
+++ b/packages/core/README.md
@@ -224,10 +224,15 @@ An affordance added later gets a row here and reads it through these functions;
 it does not spell its own `can(object, verb)`. That includes an affordance that
 reads NO grant at all — the calendar's quick-create and drag-to-reschedule
 (`calendarQuickCreate`, `calendarReschedule`) and the kanban card move
-(`kanbanCardMove`) were such affordances until they gained their rows. The map's
+(`kanbanCardMove`) were such affordances until they gained their rows. An
+affordance that writes with the same verb on the same object reuses that row:
+the record overlay's inline edit reads `recordEdit`, a gantt's bar edits and a
+grid's bulk field update read `rowEdit`, a gantt row's Delete reads `rowDelete`,
+and the AI build panel's spreadsheet import reads `listImport`. The map's
 enumeration pin in `@object-ui/plugin-form` (`affordanceGrantMap-12082.test.tsx`)
 also counts every write call site in the console tree and holds each to the row
-it sits behind, or to the reason it has none.
+it sits behind, or to the reason it has none — and, for a component whose write
+its host gates (the import wizard), holds every mount to reading the row.
 
 ### Undo snapshot for an update (`captureUpdateUndoData`)
 
diff --git a/packages/core/src/utils/affordanceGrants.ts b/packages/core/src/utils/affordanceGrants.ts
index 2b93624b18..c2dd9917ec 100644
--- a/packages/core/src/utils/affordanceGrants.ts
+++ b/packages/core/src/utils/affordanceGrants.ts
@@ -133,7 +133,9 @@ export const AFFORDANCE_GRANTS = {
   /**
    * The record page's Edit — the header CTA and the record body's in-place
    * editing (the details body and the highlights strip), each of whose fields
-   * asks the update question (objectui#12103).
+   * asks the update question (objectui#12103) — and the record overlay's
+   * inline edit, the same body in the overlay the calendar, kanban and gantt
+   * open (`RecordDetailPanel` in `@object-ui/plugin-detail`).
    */
   recordEdit: { crud: 'edit', grant: 'update', field: 'write' },
   /** The record page's Delete. */
@@ -143,7 +145,12 @@ export const AFFORDANCE_GRANTS = {
    * "+", and the `object-view` node's toolbar button (`@object-ui/plugin-view`).
    */
   listNew: { crud: 'create', grant: 'create' },
-  /** An object list's Import, and the import wizard's writable target fields. */
+  /**
+   * An object list's Import, and the import wizard's writable target fields —
+   * and the AI build panel's spreadsheet import (`ExcelImportBar` in
+   * `@object-ui/app-shell`), the wizard's second mount, asked of the object it
+   * imports into.
+   */
   listImport: { crud: 'import', grant: 'create', field: 'create' },
   /** The import wizard's template download — its endpoint answers 403 without the create grant. */
   importTemplate: { crud: null, grant: 'create' },
@@ -151,23 +158,29 @@ export const AFFORDANCE_GRANTS = {
   listInlineEdit: { crud: 'edit', grant: 'update', field: 'write' },
   /** A list's bulk Delete. */
   listBulkDelete: { crud: 'delete', grant: 'delete' },
-  /** A grid row's Edit. */
+  /**
+   * A grid row's Edit — and the writes that update the same rows in place: a
+   * grid's bulk field update (a `bulkActionDefs` `update` operation, with its
+   * undo and retry), and a gantt task's in-chart edits (a bar's drag, resize
+   * and progress, its title edited in place, and its dependency links).
+   */
   rowEdit: { crud: 'edit', grant: 'update' },
-  /** A grid row's Delete. */
+  /** A grid row's Delete — and a gantt row's Delete. */
   rowDelete: { crud: 'delete', grant: 'delete' },
   /** A grid's inline add-record row. */
   gridAddRow: { crud: 'create', grant: 'create' },
   /**
    * A related list's "+ New", asked of the CHILD object — and a line-items
-   * panel's add-a-line (its Add, entry row and Duplicate), which creates a child
-   * under the same parent.
+   * panel's or a master-detail form's add-a-line (its Add, entry row and
+   * Duplicate), which creates a child under the same parent.
    */
   relatedNew: { crud: 'create', grant: 'create' },
   /** A related list row's Edit, asked of the child object. */
   relatedRowEdit: { crud: 'edit', grant: 'update' },
   /**
    * A related list row's Delete, asked of the child object — and a line-items
-   * panel's remove-a-line, which deletes that child on Save.
+   * panel's or a master-detail EDIT form's remove-a-line, which deletes that
+   * child on Save.
    */
   relatedRowDelete: { crud: 'delete', grant: 'delete' },
   /** A lookup picker's "Create new", asked of the TARGET object. */
diff --git a/packages/plugin-detail/README.md b/packages/plugin-detail/README.md
index e0aab9de07..ee2c1794e9 100644
--- a/packages/plugin-detail/README.md
+++ b/packages/plugin-detail/README.md
@@ -363,6 +363,15 @@ delete action.
 delete action — which is what lets a row locked through a renderer's `lockField`
 open read-only without the panel knowing what a lock is.
 
+**…and a handler is a wiring, not a grant.** The inline edit is the `recordEdit`
+row of the affordance-to-grant map in `@object-ui/core` (objectui#12082), the row
+the record page reads for the same in-place edit: the object's policy (read off
+the `objectSchema` you pass), the effective API operation set and the caller's
+**update** grant. When it is closed the panel opens no inline-edit session, as if
+`onFieldSave` were absent; each field still asks its own field question. The
+delete action is `DetailView`'s own `recordDelete` read. With no permission
+provider mounted both read open.
+
 `RECORD_OVERLAY_DEFAULT_WIDTH` is exported alongside it and is the single code
 home of the default overlay width repo-wide. ⛔ Do not re-spell the literal at a
 call site.
diff --git a/packages/plugin-detail/src/RecordDetailPanel.tsx b/packages/plugin-detail/src/RecordDetailPanel.tsx
index fe042089ba..d584650529 100644
--- a/packages/plugin-detail/src/RecordDetailPanel.tsx
+++ b/packages/plugin-detail/src/RecordDetailPanel.tsx
@@ -28,13 +28,23 @@
  * that omits `onDelete` gets no delete action. That is what lets a gantt row
  * locked through `lockField` open read-only without the panel knowing what a
  * lock is.
+ *
+ * ⚠️ …and a handler handed in is a WIRING, not a grant (objectui#12082). The
+ * inline edit is the `recordEdit` row of the affordance-to-grant map, the row
+ * the record page reads for the same in-place edit: the object's policy, the
+ * server's effective operation set and the caller's update grant. Read HERE,
+ * once, because every host that offers the overlay's inline edit reaches it
+ * through this panel's `onFieldSave` — the calendar, the kanban and the gantt.
+ * A closed row withholds the edit session as an absent handler does. The
+ * delete action is `DetailView`'s own `recordDelete` read, unchanged.
  */
 
 import React from 'react';
-import { isExpandableFieldType } from '@object-ui/core';
+import { isExpandableFieldType, resolveAffordance, type SchemaLike } from '@object-ui/core';
 import type { DataSource } from '@object-ui/types';
 import { SYSTEM_MANAGED_FIELD_NAMES } from '@object-ui/types';
 import { InlineEditProvider } from '@object-ui/react';
+import { usePermissions } from '@object-ui/permissions';
 import { DetailView } from './DetailView';
 import { InlineEditSaveBar } from './InlineEditSaveBar';
 import { useDetailTranslation } from './useDetailTranslation';
@@ -248,19 +258,31 @@ export function RecordDetailPanel({
 }: RecordDetailPanelProps) {
   const { t } = useDetailTranslation();
   const fields = buildRecordDetailFields(record, objectSchema, systemFields);
+  const perms = usePermissions();
+  // objectui#12082 — the overlay's inline edit is the `recordEdit` row, asked
+  // of the object this panel shows, with that object's schema for the policy
+  // half. With no permission provider mounted the grant and the operation set
+  // read open, so a standalone overlay behaves as before.
+  const editGranted = resolveAffordance('recordEdit', {
+    objectSchema: objectSchema as SchemaLike | null | undefined,
+    objectName,
+    perms,
+  }).allowed;
+  const fieldSave = editGranted ? onFieldSave : undefined;
 
   return (
     /* One inline-edit session scoped to this overlay. `canEdit` gates on
        handler presence so an omitted onFieldSave yields a strictly
-       read-only panel (objectui#2407 P1). */
-    <InlineEditProvider canEdit={!!onFieldSave}>
+       read-only panel (objectui#2407 P1) — and on the `recordEdit` verdict
+       above, so a handler the caller may not use yields the same panel. */
+    <InlineEditProvider canEdit={!!fieldSave}>
       <DetailView
         dataSource={dataSource}
         // Capability = handler presence: a caller that omits onFieldSave /
         // onDelete gets a strictly read-only panel (no inline editors, no
         // delete action) — e.g. a gantt row locked via lockField. Hardcoding
         // these on would let the panel bypass row-level locks.
-        inlineEdit={!!onFieldSave}
+        inlineEdit={!!fieldSave}
         schema={{
           type: 'detail-view',
           objectName,
@@ -305,9 +327,9 @@ export function RecordDetailPanel({
           per-field onFieldSave over the draft, preserving the overlay's
           existing persistence contract (plugin-gantt/kanban/calendar). */}
       <InlineEditSaveBar
-        onFieldSave={onFieldSave ? async (field, value) => {
+        onFieldSave={fieldSave ? async (field, value) => {
           try {
-            await onFieldSave(field, value);
+            await fieldSave(field, value);
           } catch (err) {
             console.error('[RecordDetailPanel] inline field save failed:', err);
             // Rethrow so the save bar surfaces the failure inline and keeps
diff --git a/packages/plugin-detail/src/__tests__/RecordDetailPanel.editGrant-12082.test.tsx b/packages/plugin-detail/src/__tests__/RecordDetailPanel.editGrant-12082.test.tsx
new file mode 100644
index 0000000000..d9633019c9
--- /dev/null
+++ b/packages/plugin-detail/src/__tests__/RecordDetailPanel.editGrant-12082.test.tsx
@@ -0,0 +1,134 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectui#12082 — the record overlay's inline edit reads the `recordEdit` row
+ * of the affordance-to-grant map, at its one seam: `RecordDetailPanel`.
+ *
+ * The calendar, the kanban and the gantt each mount `RecordDetailPanel` as the
+ * record overlay and hand it an `onFieldSave` that writes the record. The panel
+ * opened its inline-edit session on that handler's PRESENCE alone, so the
+ * object-level verdict the record page reads for the same in-place edit — the
+ * object's policy, the server's effective operation set and the caller's update
+ * grant — was never asked of the overlay. Since objectui#12103 each field of
+ * the body asks the row's FIELD question, which closes the plain read-only
+ * shape (no field entry → `allowEdit`), but not the three object-level layers:
+ * a field the permission set names `editable: true` under an object grant
+ * without `allowEdit`, an operation set without `update`, and an object policy
+ * that closes edit all still offered the editors, and the server refused the
+ * write.
+ *
+ * Measured through the REAL panel, `DetailView` and `MePermissionsProvider`:
+ * an affordance is offered when a double-click on a field value enters the
+ * edit session (an input carrying the value appears).
+ */
+import React from 'react';
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+import { RecordDetailPanel } from '../RecordDetailPanel';
+
+const OBJECT = 'crm_opportunity';
+const RECORD = { id: 'o1', name: 'Acme renewal', note: 'Call back in May' };
+const FIELDS = { id: { type: 'text' }, name: { type: 'text', label: 'Name' }, note: { type: 'text', label: 'Note' } };
+
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; update: boolean }> = [
+  { shape: 'create-only', bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false }, update: false },
+  { shape: 'edit-only', bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false }, update: true },
+  { shape: 'read-only', bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, update: false },
+  { shape: 'full', bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }, update: true },
+];
+
+const FULL = SHAPES[3].bits;
+
+/**
+ * The caller's permissions. `named` adds an explicit `editable: true` entry for
+ * the field, so the field question answers yes and only the object-level row
+ * can decide.
+ */
+const envelope = (bits: Record<string, unknown>, named = true): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: { [OBJECT]: bits as never },
+  fields: named ? { [`${OBJECT}.note`]: { readable: true, editable: true } } : {},
+});
+
+beforeAll(() => {
+  // useIsMobile() keys off window.innerWidth; pin a desktop width so the
+  // read-mode desktop row (which carries the affordance) renders.
+  Object.defineProperty(window, 'innerWidth', { configurable: true, value: 1280 });
+});
+beforeEach(() => {
+  // The record-level explain probe the record header asks (useRecordEditable),
+  // served from a double that answers `visible: true`, so it moves nothing here.
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => ({ ok: true, json: async () => ({ record: { visible: true } }) })),
+  );
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+/** Mount the overlay payload with a live `onFieldSave`, as the three hosts do. */
+function mount(perms: MePermissionsResponse | null, objectSchema: Record<string, unknown> = { name: OBJECT, fields: FIELDS }) {
+  const panel = (
+    <RecordDetailPanel
+      record={RECORD}
+      objectName={OBJECT}
+      recordId={RECORD.id}
+      objectSchema={objectSchema as never}
+      onFieldSave={vi.fn()}
+    />
+  );
+  render(perms ? <MePermissionsProvider initialPermissions={perms}>{panel}</MePermissionsProvider> : panel);
+}
+
+/** Does a double-click on the field value open an editor for it? */
+function inlineEditOffered(): boolean {
+  fireEvent.doubleClick(screen.getByText(RECORD.note));
+  return screen.queryByDisplayValue(RECORD.note) !== null;
+}
+
+describe.each(SHAPES)('the record overlay under a $shape grant (objectui#12082)', ({ bits, update }) => {
+  it('inline edit is offered exactly when the update grant allows it', () => {
+    mount(envelope(bits));
+    expect(inlineEditOffered()).toBe(update);
+  });
+});
+
+describe("the record overlay: the map's other layers and fail-open (objectui#12082)", () => {
+  it('an effective operation set without update withholds inline edit under the full grant', () => {
+    mount(envelope({ ...FULL, apiOperations: ['get', 'list', 'create', 'delete'] }));
+    expect(inlineEditOffered()).toBe(false);
+  });
+
+  it("an object policy that closes edit withholds inline edit under the full grant", () => {
+    mount(envelope(FULL), { name: OBJECT, fields: FIELDS, userActions: { edit: false } });
+    expect(inlineEditOffered()).toBe(false);
+  });
+
+  it('CONTROL: the plain read-only shape (no field entry) was already closed by the field question', () => {
+    mount(envelope(SHAPES[2].bits, false));
+    expect(inlineEditOffered()).toBe(false);
+  });
+
+  it('CONTROL: the full grant with the full operation set offers inline edit', () => {
+    mount(envelope({ ...FULL, apiOperations: ['get', 'list', 'create', 'update', 'delete'] }));
+    expect(inlineEditOffered()).toBe(true);
+  });
+
+  it('fail-open: with no permission provider inline edit is offered, as before', () => {
+    mount(null);
+    expect(inlineEditOffered()).toBe(true);
+  });
+});
diff --git a/packages/plugin-form/src/LineItemsPanel.lineGrant-12082.test.tsx b/packages/plugin-form/src/LineItemsPanel.lineGrant-12082.test.tsx
index 15ca7169a2..64112edc1e 100644
--- a/packages/plugin-form/src/LineItemsPanel.lineGrant-12082.test.tsx
+++ b/packages/plugin-form/src/LineItemsPanel.lineGrant-12082.test.tsx
@@ -74,11 +74,11 @@ const envelope = (bits: Record<string, unknown>): MePermissionsResponse => ({
   fields: {},
 });
 
-function mount(perms: MePermissionsResponse | null) {
+function mount(perms: MePermissionsResponse | null, childSchema: Record<string, unknown> | null = null) {
   const panel = (
     <SchemaRendererProvider
       dataSource={{
-        getObjectSchema: vi.fn().mockResolvedValue(null),
+        getObjectSchema: vi.fn().mockResolvedValue(childSchema),
         find: vi.fn().mockResolvedValue({ data: ROWS }),
         create: vi.fn(),
         update: vi.fn(),
@@ -122,4 +122,27 @@ describe('LineItemsPanel: the map\'s other layers and fail-open (objectui#12082)
     await settled();
     expect(offered()).toEqual({ add: false, duplicate: false, remove: false });
   });
+
+  // The contract review's rider: the panel already loads the child's schema
+  // (for the save's sanitize), so it hands that schema to the affordance
+  // source, as `RelatedRecordActionsBridge` does, and the child's own policy is
+  // read too — not only its grant and operation set.
+  it("the child object's policy closes add and remove under the full grant", async () => {
+    mount(
+      envelope({ allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }),
+      { name: CHILD, userActions: { create: false, delete: false }, fields: { description: { type: 'text' }, amount: { type: 'number' } } },
+    );
+    await settled();
+    // The child schema settles after the rows paint; wait for the verdict that reads it.
+    await waitFor(() => expect(offered()).toEqual({ add: false, duplicate: false, remove: false }));
+  });
+
+  it('CONTROL: a child schema whose policy leaves create and delete open keeps both', async () => {
+    mount(
+      envelope({ allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }),
+      { name: CHILD, fields: { description: { type: 'text' }, amount: { type: 'number' } } },
+    );
+    await settled();
+    expect(offered()).toEqual({ add: true, duplicate: true, remove: true });
+  });
 });
diff --git a/packages/plugin-form/src/LineItemsPanel.tsx b/packages/plugin-form/src/LineItemsPanel.tsx
index 1183a4d03e..3f156467e4 100644
--- a/packages/plugin-form/src/LineItemsPanel.tsx
+++ b/packages/plugin-form/src/LineItemsPanel.tsx
@@ -40,6 +40,7 @@ import {
   toFilterNodeSafely,
   convertSortToQueryParams,
   resolveAffordance,
+  type SchemaLike,
 } from '@object-ui/core';
 
 // The panel's own chrome. A provider-less host — a standalone embed, this
@@ -702,16 +703,19 @@ export const LineItemsPanel: React.FC<{ schema: LineItemsPanelSchema }> = ({ sch
   // the child's policy, its effective operation set and the caller's grant on
   // it. They used to read `schema.readonly` alone, so a caller who may not
   // create or delete the child was offered both and Save sent a batch the
-  // server refused. The policy half has no child schema to read here
-  // (`objectSchema: null`, the default bucket). With no permission provider
-  // mounted both read open, as before.
+  // server refused. The policy half reads the child's own schema — the one
+  // this panel already loads for the save's sanitize (`childSchema` above) —
+  // as `RelatedRecordActionsBridge` hands a related list's child schema to the
+  // same two rows; until it arrives it reads the default bucket. With no
+  // permission provider mounted the grant and the operation set read open, as
+  // before.
   const lineAddGranted = useMemo(
-    () => resolveAffordance('relatedNew', { objectSchema: null, objectName: schema.childObject, perms }).allowed,
-    [schema.childObject, perms],
+    () => resolveAffordance('relatedNew', { objectSchema: childSchema as SchemaLike | null, objectName: schema.childObject, perms }).allowed,
+    [childSchema, schema.childObject, perms],
   );
   const lineRemoveGranted = useMemo(
-    () => resolveAffordance('relatedRowDelete', { objectSchema: null, objectName: schema.childObject, perms }).allowed,
-    [schema.childObject, perms],
+    () => resolveAffordance('relatedRowDelete', { objectSchema: childSchema as SchemaLike | null, objectName: schema.childObject, perms }).allowed,
+    [childSchema, schema.childObject, perms],
   );
 
   const gridField = useMemo(
diff --git a/packages/plugin-form/src/MasterDetailForm.lineGrant-12082.test.tsx b/packages/plugin-form/src/MasterDetailForm.lineGrant-12082.test.tsx
new file mode 100644
index 0000000000..ebe7c788ef
--- /dev/null
+++ b/packages/plugin-form/src/MasterDetailForm.lineGrant-12082.test.tsx
@@ -0,0 +1,168 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectui#12082 — a `MasterDetailForm`'s line grids read the
+ * affordance-to-grant map, asked of the CHILD object, the same two rows a
+ * `record:line_items` panel reads for the same two writes: adding a line is
+ * `relatedNew` (a child created under this parent), removing one is
+ * `relatedRowDelete` (a child deleted).
+ *
+ * Before, neither read a grant, so a caller who may not create (or delete) the
+ * child was offered Add, the entry row, Duplicate and Remove, and Save sent a
+ * batch the server refused.
+ *
+ * Remove asks the delete grant only on an EDIT form. Measured below rather than
+ * assumed: a CREATE form's batch is the parent's create followed by one create
+ * per line (`buildMasterDetailBatch`), so a line removed before the first Save
+ * is a draft dropped from that batch and never a server delete. Withholding
+ * Remove there would be a client rule the server does not have, and would
+ * leave a create-only caller unable to take back a line they just added.
+ *
+ * Measured through the REAL `MasterDetailForm`, `GridField` and
+ * `MePermissionsProvider`, over the map pin's four grant shapes on the child;
+ * the parent is fully granted, so only the child's grant decides.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, cleanup } from '@testing-library/react';
+import React from 'react';
+
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+import { registerAllFields } from '@object-ui/fields';
+import { MasterDetailForm } from './MasterDetailForm';
+
+registerAllFields();
+afterEach(cleanup);
+
+const PARENT = 'sales_order';
+const CHILD = 'sales_order_line';
+const COLUMNS = [{ name: 'qty', label: 'Qty', type: 'number' }];
+const LINE = { id: 'L1', order: 'SO1', qty: 3 };
+
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; create: boolean; remove: boolean }> = [
+  { shape: 'create-only', bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false }, create: true, remove: false },
+  { shape: 'edit-only', bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false }, create: false, remove: false },
+  { shape: 'read-only', bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, create: false, remove: false },
+  { shape: 'full', bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }, create: true, remove: true },
+];
+
+const envelope = (child: Record<string, unknown>): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: {
+    [PARENT]: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true },
+    [CHILD]: child as never,
+  },
+  fields: {},
+});
+
+function makeDS(mode: 'create' | 'edit') {
+  return {
+    getObjectSchema: vi.fn(async (obj: string) =>
+      obj === PARENT ? { name: PARENT, fields: { ref: { type: 'text', label: 'Ref' } } } : null,
+    ),
+    findOne: vi.fn().mockResolvedValue({ id: 'SO1', ref: 'SO-1' }),
+    find: vi.fn().mockResolvedValue({ data: mode === 'edit' ? [LINE] : [] }),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+    batchTransaction: vi.fn().mockResolvedValue({ results: [{ id: 'SO2' }] }),
+  };
+}
+
+function mount(mode: 'create' | 'edit', perms: MePermissionsResponse | null, ds = makeDS(mode)) {
+  const form = (
+    <MasterDetailForm
+      schema={{
+        objectName: PARENT,
+        mode,
+        ...(mode === 'edit' ? { recordId: 'SO1' } : {}),
+        fields: ['ref'],
+        details: [{ childObject: CHILD, relationshipField: 'order', columns: COLUMNS }],
+      } as any}
+      dataSource={ds as any}
+    />
+  );
+  const view = render(perms ? <MePermissionsProvider initialPermissions={perms}>{form}</MePermissionsProvider> : form);
+  return { ds, ...view };
+}
+
+const offered = () => ({
+  add: screen.queryByTestId('line-items-add') !== null,
+  duplicate: screen.queryAllByRole('button', { name: 'Duplicate row' }).length > 0,
+  remove: screen.queryAllByRole('button', { name: 'Remove row' }).length > 0,
+});
+
+/** An edit form: wait until the loaded line is drawn. */
+async function lineLoaded() {
+  await waitFor(() => expect(screen.getByDisplayValue('3')).toBeTruthy());
+}
+
+/** A create form: wait for the grid, then type into the entry row so it becomes a line. */
+async function addLineViaEntryRow(value: string) {
+  const cells = await waitFor(() => {
+    const els = screen.getAllByLabelText('Qty') as HTMLInputElement[];
+    if (els.length === 0) throw new Error('grid not drawn yet');
+    return els;
+  });
+  fireEvent.change(cells[cells.length - 1], { target: { value } });
+  await waitFor(() => expect(screen.getByDisplayValue(value)).toBeTruthy());
+}
+
+describe.each(SHAPES)('MasterDetailForm under a $shape grant on the child (objectui#12082)', ({ bits, create, remove }) => {
+  it('edit form: add and duplicate follow the child create grant; remove follows the child delete grant', async () => {
+    mount('edit', envelope(bits));
+    await lineLoaded();
+    expect(offered()).toEqual({ add: create, duplicate: create, remove });
+  });
+
+  it('create form: add follows the child create grant; a drafted line can always be removed', async () => {
+    mount('create', envelope(bits));
+    await waitFor(() => expect(screen.getByText('Ref')).toBeTruthy());
+    if (!create) {
+      // No add affordance at all: no Add button, no entry row, so no line.
+      await waitFor(() => expect(screen.queryByTestId('line-items-add')).toBeNull());
+      expect(screen.queryAllByLabelText('Qty')).toHaveLength(0);
+      return;
+    }
+    await addLineViaEntryRow('7');
+    expect(offered()).toEqual({ add: true, duplicate: true, remove: true });
+  });
+});
+
+describe("MasterDetailForm: remove in a create form, and the map's other layers (objectui#12082)", () => {
+  it("MEASURED: a create form's removed line is never a server delete — the batch holds only creates", async () => {
+    const { ds, container } = mount('create', envelope(SHAPES[3].bits));
+    await addLineViaEntryRow('7');
+    await addLineViaEntryRow('9');
+    fireEvent.click(screen.getAllByRole('button', { name: 'Remove row' })[0]);
+    await waitFor(() => expect(screen.queryByDisplayValue('7')).toBeNull());
+    const ref = container.querySelector('input[name="ref"]') as HTMLInputElement;
+    fireEvent.change(ref, { target: { value: 'SO-2' } });
+    fireEvent.click(screen.getByRole('button', { name: /create/i }));
+    await waitFor(() => expect(ds.batchTransaction).toHaveBeenCalledTimes(1));
+    const ops = ds.batchTransaction.mock.calls[0][0] as Array<{ object: string; action: string; data?: Record<string, unknown> }>;
+    expect(ops.map((o) => `${o.object}:${o.action}`)).toEqual([`${PARENT}:create`, `${CHILD}:create`]);
+    expect(Number(ops[1].data?.qty)).toBe(9);
+  });
+
+  it('fail-open: with no permission provider add and remove are offered, as before', async () => {
+    mount('edit', null);
+    await lineLoaded();
+    expect(offered()).toEqual({ add: true, duplicate: true, remove: true });
+  });
+
+  it('an effective operation set without create and delete withholds both under the full grant', async () => {
+    mount('edit', envelope({ ...SHAPES[3].bits, apiOperations: ['get', 'list', 'update'] }));
+    await lineLoaded();
+    expect(offered()).toEqual({ add: false, duplicate: false, remove: false });
+  });
+});
diff --git a/packages/plugin-form/src/MasterDetailForm.tsx b/packages/plugin-form/src/MasterDetailForm.tsx
index 2053005beb..a74472c1c5 100644
--- a/packages/plugin-form/src/MasterDetailForm.tsx
+++ b/packages/plugin-form/src/MasterDetailForm.tsx
@@ -32,7 +32,7 @@
 
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import type { BatchTransactionOperation, DataSource, GridFieldMetadata, I18nLabel } from '@object-ui/types';
-import { runBatchTransaction } from '@object-ui/core';
+import { resolveAffordance, runBatchTransaction } from '@object-ui/core';
 import { LineItemsField } from '@object-ui/fields';
 import { Button, Card, CardContent, CardHeader, CardTitle, cn, toast } from '@object-ui/components';
 import {
@@ -682,7 +682,8 @@ interface MasterDetailLinesProps {
    * (objectui#12082): every line of a CREATE form is a new child record, so its
    * cells ask the create question (the server's insert rule); an edit form's
    * lines may already exist, and a per-column lock cannot split per row, so
-   * they keep the edit question.
+   * they keep the edit question. For the same reason only an edit form's
+   * Remove asks the child's delete grant: a create form's lines are drafts.
    */
   formMode: 'create' | 'edit';
 }
@@ -790,6 +791,22 @@ const MasterDetailLines: React.FC<MasterDetailLinesProps> = ({
           table needs. */}
       {entries.map((entry) => {
         const d = entry.config;
+        // objectui#12082 — adding and removing a line are rows of the
+        // affordance-to-grant map, asked of the CHILD object, the same two
+        // rows `LineItemsPanel` reads for the same two writes: a new line is a
+        // child created under this parent (`relatedNew`), a removed line a
+        // child deleted (`relatedRowDelete`). Each is the child's policy, its
+        // effective operation set and the caller's grant on it; the policy half
+        // reads the default bucket, since a fully configured entry loads no
+        // child schema into this render. Remove asks only on an EDIT form: a
+        // create form's batch holds nothing but creates
+        // (`buildMasterDetailBatch`), so a line removed there is a draft dropped
+        // before it is ever written, never a server delete. With no permission
+        // provider mounted both read open, as before.
+        const lineSource = { objectSchema: null, objectName: d.childObject, perms };
+        const lineAddGranted = resolveAffordance('relatedNew', lineSource).allowed;
+        const lineRemoveGranted =
+          formMode === 'create' || resolveAffordance('relatedRowDelete', lineSource).allowed;
         return (
         // Keyed on the entry's SYNTHESIZED identity, not on the map index. The
         // old key put `d.childObject` — `undefined` for a declined entry —
@@ -912,6 +929,10 @@ const MasterDetailLines: React.FC<MasterDetailLinesProps> = ({
                   sortField: entry.sortField,
                   minRows: d.minRows,
                   maxRows: d.maxRows,
+                  // The map rows above: the grid's Add, entry row and Duplicate
+                  // follow `allowAdd`, its per-row Remove `allowDelete`.
+                  allowAdd: lineAddGranted,
+                  allowDelete: lineRemoveGranted,
                   addLabel: d.inlineMode === 'form' ? (d.addLabel || t('detail.add')) : d.addLabel,
                   // Checked against the grid's published type (objectui#11610), so
                   // a key the grid does not declare, or one of its retired
diff --git a/packages/plugin-form/src/__tests__/masterDetailDetailsMembers-8071.test.tsx b/packages/plugin-form/src/__tests__/masterDetailDetailsMembers-8071.test.tsx
index 29f096437f..2a2193ab8d 100644
--- a/packages/plugin-form/src/__tests__/masterDetailDetailsMembers-8071.test.tsx
+++ b/packages/plugin-form/src/__tests__/masterDetailDetailsMembers-8071.test.tsx
@@ -48,7 +48,12 @@
  *     carries `sortField`, which is no member: the block DERIVES it from the
  *     child object (`deriveDetail` picks its `position` / `sort_order` / …
  *     field), and objectui#11070 round 9 retired the detail's `sortField`
- *     member that used to override it. A member dropped from that object, or
+ *     member that used to override it. It also carries `allowAdd` and
+ *     `allowDelete`, which are no members either: they are the
+ *     affordance-to-grant map's verdicts on the CHILD object (`relatedNew` /
+ *     `relatedRowDelete`, objectui#12082), both open with no permission
+ *     provider mounted, as here, so an authored `allowAdd` still reaches
+ *     nothing (row 2). A member dropped from that object, or
  *     a key the grid does not declare, reaches a grid that reads nothing
  *     there; since objectui#11610 the object is checked against
  *     `GridFieldMetadata` at compile time, and a retired snake_case key there
@@ -68,9 +73,10 @@
  *
  *   1. Each member renders as its own section, in AUTHORED order, headed by
  *      `title` (or `Line Items`), with `columns` in authored order.
- *   2. The grid object is exactly six keys. Each authored member arrives under
- *      the grid's key, and off-list members are NOT forwarded, including
- *      one written in the grid's own spelling (`allowAdd`).
+ *   2. The grid object is exactly eight keys. Each authored member arrives
+ *      under the grid's key, and off-list members are NOT forwarded, including
+ *      one written in the grid's own spelling (`allowAdd`): the grid's
+ *      `allowAdd` / `allowDelete` are the map's verdicts, never the author's.
  *   2c. `sortField` is no member (objectui#11070 round 9). On a detail the
  *      block derives, the grid's `sortField` is the child's sort-named field
  *      even when a `sortField` naming another field is written beside it. On
@@ -238,7 +244,7 @@ describe('`object-master-detail-form` — the member shape of `details`', () =>
     expect(gridOf('Line Items').field.columns.map((c: { name: string }) => c.name)).toEqual(['note']);
   });
 
-  it('2. four members reach the grid under its keys, as exactly six keys, and off-list members are not forwarded', async () => {
+  it('2. four members reach the grid under its keys, as exactly eight keys, and off-list members are not forwarded', async () => {
     await mount({
       details: [
         {
@@ -260,6 +266,8 @@ describe('`object-master-detail-form` — the member shape of `details`', () =>
     const field = await waitFor(() => gridOf('Lines').field);
     expect(Object.keys(field).sort(), 'the one object this block hands the grid').toEqual([
       'addLabel',
+      'allowAdd',
+      'allowDelete',
       'columns',
       'maxRows',
       'minRows',
@@ -272,18 +280,24 @@ describe('`object-master-detail-form` — the member shape of `details`', () =>
       addLabel: 'Add a line',
       // The detail's `amountField`, the CHILD column summed.
       totalField: 'qty',
+      // The map's verdicts on the child (objectui#12082), open with no
+      // permission provider: the authored `allowAdd: false` reached nothing.
+      allowAdd: true,
+      allowDelete: true,
     });
     expect(field.sortField, 'a fully configured detail derives nothing (row 2c)').toBeUndefined();
     expect(gridOf('Lines').displayMode).toBe('grid');
   });
 
-  it('2b. control: with none of the four authored and nothing derived, the same six keys arrive EMPTY', async () => {
+  it('2b. control: with none of the four authored and nothing derived, the same eight keys arrive, the members EMPTY', async () => {
     await mount({ details: [{ childObject: 'po_line', relationshipField: 'po', title: 'Lines', columns: [QTY] }] });
     const field = await waitFor(() => gridOf('Lines').field);
     // The key set first: `toEqual` treats a key holding `undefined` as absent,
-    // so on its own it could not tell "six keys, five empty" from "one key".
+    // so on its own it could not tell "eight keys, five empty" from "three keys".
     expect(Object.keys(field).sort()).toEqual([
       'addLabel',
+      'allowAdd',
+      'allowDelete',
       'columns',
       'maxRows',
       'minRows',
@@ -297,6 +311,8 @@ describe('`object-master-detail-form` — the member shape of `details`', () =>
       maxRows: undefined,
       addLabel: undefined,
       totalField: undefined,
+      allowAdd: true,
+      allowDelete: true,
     });
   });
 
diff --git a/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx b/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx
index 23499993c7..525dabd588 100644
--- a/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx
+++ b/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx
@@ -547,6 +547,13 @@ describe('the census: every affordance reads the map (objectui#12082)', () => {
 // — a button that opens a form. The form's submit is a site here, behind the
 // form rows; the opener itself is pinned by its own runtime test
 // (`ObjectView.createGrant-12082.test.tsx` in `@object-ui/plugin-view`).
+//
+// One site key can also hide several doors: a component that issues a write
+// its HOST gates (the import wizard, mounted by the console list and by the AI
+// build panel's spreadsheet import) has one site and one door per mount. Those
+// are listed in `HOST_GATED`, and every mount must be a file its site names —
+// that is how a second mount with no grant read is seen. A host-gated component
+// not listed there is not seen; the list is written by hand, like the ledger.
 // ---------------------------------------------------------------------------
 
 type Verb = 'create' | 'update' | 'delete' | 'batch';
@@ -602,11 +609,13 @@ const DETAIL_SECTION = 'packages/plugin-detail/src/DetailSection.tsx';
 const HEADER_HIGHLIGHT = 'packages/plugin-detail/src/HeaderHighlight.tsx';
 const CONSOLE_LIST = 'packages/app-shell/src/views/ObjectView.tsx';
 const LIST_VIEW = 'packages/plugin-list/src/ListView.tsx';
-
-const OVERLAY_INLINE_EDIT =
-  "the record overlay's inline field edit: `RecordDetailPanel` opens its inline-edit session on handler " +
-  'PRESENCE alone (`canEdit={!!onFieldSave}`), so a caller without the update grant is offered the editors; ' +
-  'the recordEdit row is the candidate';
+// The record overlay's one seam: the calendar, the kanban and the gantt hand it
+// their `onFieldSave`, and it reads the `recordEdit` row before it opens the
+// inline-edit session.
+const RECORD_PANEL = 'packages/plugin-detail/src/RecordDetailPanel.tsx';
+const OBJECT_GANTT = 'packages/plugin-gantt/src/ObjectGantt.tsx';
+const MASTER_DETAIL = 'packages/plugin-form/src/MasterDetailForm.tsx';
+const EXCEL_IMPORT_BAR = 'packages/app-shell/src/console/ai/ExcelImportBar.tsx';
 const ADAPTER = 'a DataSource implementation: it runs the writes its callers hand it';
 
 /**
@@ -700,7 +709,7 @@ const WRITE_SITES: Record<string, WriteSite> = {
   'packages/plugin-calendar/src/ObjectCalendar.tsx :: ObjectCalendar > submitQuickCreate :: create':
     mapped(['calendarQuickCreate'], 'packages/plugin-calendar/src/ObjectCalendar.tsx'),
   'packages/plugin-calendar/src/ObjectCalendar.tsx :: ObjectCalendar > renderRecordOverlay > onFieldSave :: update':
-    unmapped(OVERLAY_INLINE_EDIT),
+    mapped(['recordEdit'], RECORD_PANEL),
   'packages/plugin-calendar/src/ObjectCalendar.tsx :: ObjectCalendar > renderRecordOverlay > onDelete :: delete':
     mapped(['recordDelete'], DETAIL_VIEW),
   // ── plugin-designer ──
@@ -724,8 +733,10 @@ const WRITE_SITES: Record<string, WriteSite> = {
     outOfFamily('a public embeddable form submits with no signed-in principal, so there is no grant to read; the server\'s public-form policy decides'),
   'packages/plugin-form/src/LineItemsPanel.tsx :: LineItemsPanel > save :: batch':
     mapped(['relatedNew', 'relatedRowDelete', 'editFormFields'], 'packages/plugin-form/src/LineItemsPanel.tsx', FIELD_WRITE_GATE),
-  'packages/plugin-form/src/MasterDetailForm.tsx :: MasterDetailForm > sendBatch :: batch':
-    unmapped("the master's fields are behind the form rows (its header ObjectForm), but its line grids' add / remove read no child grant; relatedNew / relatedRowDelete are the candidates, except that a create-mode master's removed line is never a server delete"),
+  'packages/plugin-form/src/MasterDetailForm.tsx :: MasterDetailForm > sendBatch :: batch': {
+    ...mapped(['createFormFields', 'editFormFields', 'relatedNew', 'relatedRowDelete'], MASTER_DETAIL, FIELD_WRITE_GATE),
+    note: "the master's fields are its header ObjectForm's; its line grids' add reads relatedNew of the child, and remove relatedRowDelete on an EDIT form only — a create form's batch holds only creates, so a removed line there is never a server delete",
+  } as WriteSite,
   'packages/plugin-form/src/ModalForm.tsx :: ModalForm > handleSubmit :: create': mapped(['createFormFields'], FIELD_WRITE_GATE),
   'packages/plugin-form/src/ModalForm.tsx :: ModalForm > handleSubmit :: update': mapped(['editFormFields'], FIELD_WRITE_GATE),
   'packages/plugin-form/src/ObjectForm.tsx :: SimpleObjectForm > handleSubmit :: create': mapped(['createFormFields'], FIELD_WRITE_GATE),
@@ -739,33 +750,33 @@ const WRITE_SITES: Record<string, WriteSite> = {
   'packages/plugin-form/src/occSave.tsx :: useOccSave > saveWithOcc :: update': helper('saveWithOcc'),
   // ── plugin-gantt ──
   'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > handleTaskUpdateDefault :: update':
-    unmapped("a gantt's drag / resize of a task bar writes its dates and reads no update grant (only `readOnly` and `lockField`)"),
+    mapped(['rowEdit'], OBJECT_GANTT),
   'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > persistDependencies :: update':
-    unmapped("a gantt's dependency edit writes the dependencies field and reads no update grant"),
+    mapped(['rowEdit'], OBJECT_GANTT),
   'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > confirmDelete :: delete':
-    unmapped("a gantt row kebab's Delete reads no delete grant"),
-  'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > renderRecordOverlay :: update': unmapped(OVERLAY_INLINE_EDIT),
+    mapped(['rowDelete'], OBJECT_GANTT),
+  'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > renderRecordOverlay :: update': mapped(['recordEdit'], RECORD_PANEL),
   'packages/plugin-gantt/src/ObjectGantt.tsx :: ObjectGantt > renderRecordOverlay :: delete': mapped(['recordDelete'], DETAIL_VIEW),
   // ── plugin-grid ──
   'packages/plugin-grid/src/ImportWizard.tsx :: ImportWizard > legacyImport :: create': {
-    ...mapped(['listImport'], CONSOLE_LIST, 'packages/app-shell/src/views/importTargetFields.ts'),
-    note: "the console list's Import; the AI build panel's spreadsheet import (`ExcelImportBar`) mounts the same wizard with no grant read",
+    ...mapped(['listImport'], CONSOLE_LIST, 'packages/app-shell/src/views/importTargetFields.ts', EXCEL_IMPORT_BAR),
+    note: "one site, two mounts: the console list's Import and the AI build panel's spreadsheet import (`ExcelImportBar`) each read the row where they offer Import; HOST_GATED below holds every mount of the wizard to this list",
   } as WriteSite,
   'packages/plugin-grid/src/ObjectGrid.tsx :: ObjectGrid > defaultRowSave :: update': mapped(['listInlineEdit'], OBJECT_GRID),
   'packages/plugin-grid/src/ObjectGrid.tsx :: ObjectGrid > defaultBatchSave :: update': mapped(['listInlineEdit'], OBJECT_GRID),
   'packages/plugin-grid/src/hooks/useBulkExecutor.ts :: useBulkExecutor > run > perRow :: delete': mapped(['rowDelete'], OBJECT_GRID),
   'packages/plugin-grid/src/hooks/useBulkExecutor.ts :: useBulkExecutor > run > perRow :: update':
-    unmapped("a grid's bulk field update (a `bulkActionDefs` update operation) reads no update grant; only its delete operation rides the rowDelete verdict"),
+    mapped(['rowEdit'], OBJECT_GRID),
   'packages/plugin-grid/src/hooks/useBulkExecutor.ts :: useBulkExecutor > undo :: update':
-    unmapped("the undo of a grid bulk field update, the inverse of that unmapped write"),
+    mapped(['rowEdit'], OBJECT_GRID),
   'packages/plugin-grid/src/hooks/useBulkExecutor.ts :: useBulkExecutor > retry :: delete': mapped(['rowDelete'], OBJECT_GRID),
   'packages/plugin-grid/src/hooks/useBulkExecutor.ts :: useBulkExecutor > retry :: update':
-    unmapped("the retry of a grid bulk field update, that same unmapped write"),
+    mapped(['rowEdit'], OBJECT_GRID),
   // ── plugin-kanban ──
   'packages/plugin-kanban/src/ObjectKanban.tsx :: ObjectKanban > persistCardMove :: update':
     mapped(['kanbanCardMove'], 'packages/plugin-kanban/src/ObjectKanban.tsx'),
   'packages/plugin-kanban/src/ObjectKanban.tsx :: ObjectKanban > renderRecordOverlay > onFieldSave :: update':
-    unmapped(OVERLAY_INLINE_EDIT),
+    mapped(['recordEdit'], RECORD_PANEL),
   'packages/plugin-kanban/src/ObjectKanban.tsx :: ObjectKanban > renderRecordOverlay > onDelete :: delete':
     mapped(['recordDelete'], DETAIL_VIEW),
   // ── plugin-view ──
@@ -805,14 +816,34 @@ function scopeName(n: ts.Node, sf: ts.SourceFile): string | null {
   return null;
 }
 
-/** The write sites in one source text, and the map rows it reads. */
-function scanWrites(rel: string, text: string): { sites: Set<string>; rowsRead: Set<string> } {
+/**
+ * Write sites inside a component its HOST gates — component name → the site.
+ *
+ * The component issues the write, but the affordance that opens it (an Import
+ * button) is drawn by whoever mounts it, so each mount is a door of its own
+ * behind one site key: the census above cannot tell two mounts apart. So every
+ * console source that mounts the component (a JSX element of that name) must
+ * be named in the site's `readBy`, and the mapped-site check holds each named
+ * file to reading one of the site's rows. A mount added later with no grant
+ * read turns this red, naming the file.
+ */
+const HOST_GATED: Readonly<Record<string, string>> = {
+  ImportWizard: 'packages/plugin-grid/src/ImportWizard.tsx :: ImportWizard > legacyImport :: create',
+};
+
+/** The write sites in one source text, the map rows it reads, and the host-gated components it mounts. */
+function scanWrites(rel: string, text: string): { sites: Set<string>; rowsRead: Set<string>; mounts: Set<string> } {
   const sf = ts.createSourceFile(rel, text, ts.ScriptTarget.Latest, false, rel.endsWith('x') ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
   const sites = new Set<string>();
   const rowsRead = new Set<string>();
+  const mounts = new Set<string>();
   const visit = (n: ts.Node, chain: string[]): void => {
     const name = scopeName(n, sf);
     const here = name ? [...chain, name] : chain;
+    if (ts.isJsxOpeningElement(n) || ts.isJsxSelfClosingElement(n)) {
+      const tag = n.tagName.getText(sf);
+      if (Object.prototype.hasOwnProperty.call(HOST_GATED, tag)) mounts.add(tag);
+    }
     if (ts.isCallExpression(n)) {
       const callee = n.expression;
       const calleeText = callee.getText(sf);
@@ -837,23 +868,25 @@ function scanWrites(rel: string, text: string): { sites: Set<string>; rowsRead:
     ts.forEachChild(n, (c) => visit(c, here));
   };
   visit(sf, []);
-  return { sites, rowsRead };
+  return { sites, rowsRead, mounts };
 }
 
-function writeCensus(): { sites: Set<string>; rowsReadBy: Map<string, Set<string>> } {
+function writeCensus(): { sites: Set<string>; rowsReadBy: Map<string, Set<string>>; mountsBy: Map<string, Set<string>> } {
   const sites = new Set<string>();
   const rowsReadBy = new Map<string, Set<string>>();
+  const mountsBy = new Map<string, Set<string>>();
   for (const file of consoleSources()) {
     const rel = path.relative(repoRoot, file).split(path.sep).join('/');
     const scanned = scanWrites(rel, readFileSync(file, 'utf8'));
     for (const s of scanned.sites) sites.add(s);
     if (scanned.rowsRead.size) rowsReadBy.set(rel, scanned.rowsRead);
+    for (const m of scanned.mounts) mountsBy.set(m, (mountsBy.get(m) ?? new Set()).add(rel));
   }
-  return { sites, rowsReadBy };
+  return { sites, rowsReadBy, mountsBy };
 }
 
 describe('the write census: every write call site sits behind a map row, or says why not (objectui#12082)', () => {
-  const { sites, rowsReadBy } = writeCensus();
+  const { sites, rowsReadBy, mountsBy } = writeCensus();
 
   it('CONTROL — the recognizer fires on each shape, and not on a collection\'s delete(key)', () => {
     const { sites: found, rowsRead } = scanWrites(
@@ -877,6 +910,13 @@ describe('the write census: every write call site sits behind a map row, or says
       'pin/probe.tsx :: save :: update',
     ]);
     expect([...rowsRead]).toEqual(['rowEdit']);
+    // …and the mount walk fires on a host-gated component's JSX element, in
+    // either form, and on nothing else.
+    const { mounts } = scanWrites(
+      'pin/mounts.tsx',
+      'const A = () => <><ImportWizard open /><ImportWizardHelp /><Other><ImportWizard></ImportWizard></Other></>;',
+    );
+    expect([...mounts]).toEqual(['ImportWizard']);
   });
 
   it('CONTROL — the walk reached the data door and the five sites the card names', () => {
@@ -949,4 +989,40 @@ describe('the write census: every write call site sits behind a map row, or says
     // issuing one, so it is read where it is offered, not counted as a site.
     expect(rowsReadBy.get('packages/plugin-view/src/ObjectView.tsx')?.has('listNew')).toBe(true);
   });
+
+  it("the record overlay's inline edit is ONE seam: all three hosts' writes sit behind recordEdit, read only at RecordDetailPanel", () => {
+    const overlay = Object.entries(WRITE_SITES).filter(
+      ([key]) => key.includes(' > renderRecordOverlay') && key.endsWith(' :: update'),
+    );
+    expect(overlay.map(([key]) => key.split(' :: ')[0]).sort()).toEqual([
+      'packages/plugin-calendar/src/ObjectCalendar.tsx',
+      'packages/plugin-gantt/src/ObjectGantt.tsx',
+      'packages/plugin-kanban/src/ObjectKanban.tsx',
+    ]);
+    for (const [key, site] of overlay) {
+      expect(site, key).toEqual({ kind: 'mapped', rows: ['recordEdit'], readBy: [RECORD_PANEL] });
+    }
+    expect(rowsReadBy.get(RECORD_PANEL)?.has('recordEdit')).toBe(true);
+  });
+
+  it('every mount of a host-gated write component is a file its site names, so each mount reads the row', () => {
+    const problems: string[] = [];
+    for (const [component, key] of Object.entries(HOST_GATED)) {
+      const site = WRITE_SITES[key];
+      if (site?.kind !== 'mapped') {
+        problems.push(`${key}: the site ${component} hosts is not a mapped entry`);
+        continue;
+      }
+      for (const file of mountsBy.get(component) ?? []) {
+        if (!site.readBy.includes(file)) {
+          problems.push(`${file} mounts ${component} but is not named by ${key}: read its row where the mount offers it, and name the file there`);
+        }
+      }
+    }
+    expect(problems).toEqual([]);
+  });
+
+  it('CONTROL — the mount walk reaches both mounts of the import wizard', () => {
+    expect([...(mountsBy.get('ImportWizard') ?? [])]).toEqual(expect.arrayContaining([CONSOLE_LIST, EXCEL_IMPORT_BAR]));
+  });
 });
diff --git a/packages/plugin-gantt/src/ObjectGantt.tsx b/packages/plugin-gantt/src/ObjectGantt.tsx
index b9a8e46f94..2614eb0dd3 100644
--- a/packages/plugin-gantt/src/ObjectGantt.tsx
+++ b/packages/plugin-gantt/src/ObjectGantt.tsx
@@ -73,6 +73,8 @@ import {
   createFieldColorResolver,
   resolveRecordSourceConfig,
   resolveRecordSourceObjectName,
+  resolveAffordance,
+  type SchemaLike,
   applyNonGridRowCeiling,
   nonGridRowCeilingQuery,
   type NonGridCeilingResult,
@@ -2284,6 +2286,27 @@ export const ObjectGantt: React.FC<ObjectGanttProps> = ({
     }
   }, [pendingDelete, effectiveDataSource, resource, data, reload, notifyWriteError, t]);
 
+  // objectui#12082 — the chart's in-chart writes are rows of the
+  // affordance-to-grant map (`resolveAffordance` in `@object-ui/core`), asked of
+  // the object every write below goes to (`resource`): a bar's drag / resize /
+  // progress, its title edited in place and its dependency links update the
+  // task record (`rowEdit`), and the row kebab's Delete deletes it
+  // (`rowDelete`). Each is the object's policy, the effective operation set and
+  // the caller's grant. `GanttView` draws an affordance only when it is handed
+  // its handler, so a closed row is a handler withheld in the JSX below — the
+  // same way `readOnly` and `lockField` already close them. They used to read
+  // no grant at all, so a read-only caller could drag a bar, link two tasks or
+  // delete a row and the server refused the write. With no permission provider
+  // mounted both rows read open, as before. The record overlay's inline edit
+  // reads its own row in `RecordDetailPanel`.
+  const writeAffordanceSource = {
+    objectSchema: objectSchema as SchemaLike | null | undefined,
+    objectName: resource,
+    perms,
+  };
+  const taskEditGranted = resolveAffordance('rowEdit', writeAffordanceSource).allowed;
+  const taskDeleteGranted = resolveAffordance('rowDelete', writeAffordanceSource).allowed;
+
   if (loading) {
     return (
       <div className={className}>
@@ -2499,10 +2522,10 @@ export const ObjectGantt: React.FC<ObjectGanttProps> = ({
             }
             onTaskClick?.(task.data);
           }}
-          onTaskUpdate={handleTaskUpdateDefault}
-          onTaskDelete={requestDelete}
-          onDependencyCreate={ganttConfig?.dependenciesField ? handleDependencyCreate : undefined}
-          onDependencyDelete={ganttConfig?.dependenciesField ? handleDependencyDelete : undefined}
+          onTaskUpdate={taskEditGranted ? handleTaskUpdateDefault : undefined}
+          onTaskDelete={taskDeleteGranted ? requestDelete : undefined}
+          onDependencyCreate={taskEditGranted && ganttConfig?.dependenciesField ? handleDependencyCreate : undefined}
+          onDependencyDelete={taskEditGranted && ganttConfig?.dependenciesField ? handleDependencyDelete : undefined}
           markers={schema.markers}
           autoSchedule={!!ganttConfig?.dependenciesField}
           rescheduleOnConflict={!!ganttConfig?.dependenciesField}
diff --git a/packages/plugin-gantt/src/ObjectGantt.writeGrant-12082.test.tsx b/packages/plugin-gantt/src/ObjectGantt.writeGrant-12082.test.tsx
new file mode 100644
index 0000000000..df21f47b62
--- /dev/null
+++ b/packages/plugin-gantt/src/ObjectGantt.writeGrant-12082.test.tsx
@@ -0,0 +1,180 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectui#12082 — the gantt's in-chart writes read the affordance-to-grant
+ * map: a bar's drag / resize / progress, its title edited in place and its
+ * dependency links are the `rowEdit` row (an update of the task record), and a
+ * row's Delete is the `rowDelete` row.
+ *
+ * Before, none of them read a grant: only the authored `readOnly` and the row
+ * `lockField` closed them, so a read-only caller could drag a bar, link two
+ * tasks or delete a row, and the server refused the write. The fix is the one
+ * `GanttView` already understands: each affordance is the PRESENCE of its
+ * handler (no `onTaskUpdate` draws no draggable bar, no progress handle, no
+ * in-place title edit and no undo; no `onDependencyCreate` / `onDependencyDelete`
+ * draws no link handles; no `onTaskDelete` draws no Delete), so `ObjectGantt`
+ * hands the chart a handler only when the row allows the write.
+ *
+ * `GanttView` is replaced by a probe that records the handlers it is given: the
+ * chart's own "capability = handler presence" contract is pinned in its own
+ * suites (`GanttView.readonly.test.tsx`, `GanttView.links.test.tsx`), and what
+ * is measured here is which handlers `ObjectGantt` hands it under each grant.
+ * Driving a recorded handler is the real path into `ObjectGantt`'s own write.
+ */
+import React from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { act, cleanup, render, screen, waitFor } from '@testing-library/react';
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+
+const probe = vi.hoisted(() => ({
+  props: null as null | Record<string, unknown>,
+}));
+
+vi.mock('./GanttView', async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return {
+    ...actual,
+    GanttView: (props: Record<string, unknown>) => {
+      probe.props = props;
+      return <div data-testid="gantt-probe" />;
+    },
+  };
+});
+
+import { ObjectGantt } from './ObjectGantt';
+
+const OBJECT = 'pm_task';
+const ROWS = [
+  { id: 't1', name: 'Design', start_date: '2024-01-01', end_date: '2024-01-05', depends_on: '' },
+  { id: 't2', name: 'Build', start_date: '2024-01-06', end_date: '2024-01-10', depends_on: '' },
+];
+
+const SCHEMA = {
+  type: 'gantt',
+  objectName: OBJECT,
+  gantt: {
+    titleField: 'name',
+    startDateField: 'start_date',
+    endDateField: 'end_date',
+    dependenciesField: 'depends_on',
+  },
+  data: { provider: 'object', object: OBJECT },
+} as any;
+
+const makeDataSource = (objectSchema: Record<string, unknown> = {}) =>
+  ({
+    find: vi.fn().mockResolvedValue({ data: ROWS }),
+    getObjectSchema: vi.fn().mockResolvedValue({
+      name: OBJECT,
+      fields: {
+        id: { type: 'text' },
+        name: { type: 'text' },
+        start_date: { type: 'date' },
+        end_date: { type: 'date' },
+        depends_on: { type: 'text' },
+      },
+      ...objectSchema,
+    }),
+    update: vi.fn().mockResolvedValue({}),
+    delete: vi.fn().mockResolvedValue(true),
+  }) as any;
+
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; update: boolean; remove: boolean }> = [
+  { shape: 'create-only', bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false }, update: false, remove: false },
+  { shape: 'edit-only', bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false }, update: true, remove: false },
+  { shape: 'read-only', bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, update: false, remove: false },
+  { shape: 'full', bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }, update: true, remove: true },
+];
+
+const envelope = (bits: Record<string, unknown>): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: { [OBJECT]: bits as never },
+  fields: {},
+});
+
+beforeEach(() => {
+  probe.props = null;
+});
+afterEach(cleanup);
+
+type Handler = ((...args: unknown[]) => unknown) | undefined;
+const handler = (name: string): Handler => probe.props?.[name] as Handler;
+const tasks = () => (probe.props?.tasks ?? []) as Array<Record<string, unknown>>;
+
+const UPDATE_HANDLERS = ['onTaskUpdate', 'onDependencyCreate', 'onDependencyDelete'] as const;
+
+async function mount(perms: MePermissionsResponse | null, ds = makeDataSource()) {
+  const gantt = <ObjectGantt schema={SCHEMA} dataSource={ds} />;
+  render(perms ? <MePermissionsProvider initialPermissions={perms}>{gantt}</MePermissionsProvider> : gantt);
+  await screen.findByTestId('gantt-probe');
+  await waitFor(() => expect(tasks().length).toBe(2));
+  return ds;
+}
+
+describe.each(SHAPES)('ObjectGantt under a $shape grant (objectui#12082)', ({ bits, update, remove }) => {
+  it('drag / resize and the dependency edit are offered exactly when the update grant allows them', async () => {
+    const ds = await mount(envelope(bits));
+    for (const name of UPDATE_HANDLERS) {
+      expect(typeof handler(name) === 'function', name).toBe(update);
+    }
+    if (update) {
+      await act(async () => {
+        await handler('onTaskUpdate')!(tasks()[0], { start: new Date(2024, 0, 2), end: new Date(2024, 0, 6) });
+      });
+      await waitFor(() => expect(ds.update).toHaveBeenCalledTimes(1));
+      expect(ds.update.mock.calls[0][0]).toBe(OBJECT);
+      await act(async () => {
+        await handler('onDependencyCreate')!(tasks()[0], tasks()[1], 'fs');
+      });
+      await waitFor(() => expect(ds.update).toHaveBeenCalledTimes(2));
+      expect(ds.update.mock.calls[1][2]).toEqual({ depends_on: 't1' });
+    }
+  });
+
+  it('the row Delete is offered exactly when the delete grant allows it', async () => {
+    await mount(envelope(bits));
+    expect(typeof handler('onTaskDelete') === 'function', 'onTaskDelete').toBe(remove);
+    if (remove) {
+      act(() => {
+        handler('onTaskDelete')!(tasks()[0]);
+      });
+      expect(await screen.findByRole('alertdialog')).toBeTruthy();
+    }
+  });
+});
+
+describe("ObjectGantt: the map's other layers and fail-open (objectui#12082)", () => {
+  it('fail-open: with no permission provider every in-chart write is offered, as before', async () => {
+    await mount(null);
+    for (const name of [...UPDATE_HANDLERS, 'onTaskDelete']) {
+      expect(typeof handler(name), name).toBe('function');
+    }
+  });
+
+  it('an effective operation set without update and delete withholds every in-chart write under the full grant', async () => {
+    await mount(envelope({ ...SHAPES[3].bits, apiOperations: ['get', 'list'] }));
+    for (const name of [...UPDATE_HANDLERS, 'onTaskDelete']) {
+      expect(handler(name), name).toBeUndefined();
+    }
+  });
+
+  it("an object policy that closes edit and delete withholds them under the full grant", async () => {
+    await mount(envelope(SHAPES[3].bits), makeDataSource({ userActions: { edit: false, delete: false } }));
+    // The policy half reads the object schema, which settles after the chart's
+    // first paint; wait for the verdict that reads it.
+    await waitFor(() => expect(handler('onTaskUpdate')).toBeUndefined());
+    for (const name of [...UPDATE_HANDLERS, 'onTaskDelete']) {
+      expect(handler(name), name).toBeUndefined();
+    }
+  });
+});
diff --git a/packages/plugin-grid/src/ObjectGrid.tsx b/packages/plugin-grid/src/ObjectGrid.tsx
index f57324209e..86e2d8f944 100644
--- a/packages/plugin-grid/src/ObjectGrid.tsx
+++ b/packages/plugin-grid/src/ObjectGrid.tsx
@@ -4937,8 +4937,9 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
   // `bulkActions: ['delete']` / `bulkActionDefs[].operation === 'delete'` is a
   // WIRING declaration, not a permission grant — so the built-in delete is
   // filtered out of both when the verdict is off. Custom action ids and
-  // non-delete operations are untouched: they route through the action runner
-  // and carry their own gates.
+  // `custom` operations are untouched: they route through the action runner
+  // and carry their own gates. (An `update` operation is the edit verdict's —
+  // see `bulkActionDefs` below.)
   const declaredBulkActions = schema.batchActions ?? schema.bulkActions;
   const explicitBulkActions = objectCanDelete
     ? declaredBulkActions
@@ -4959,8 +4960,18 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
     localizeLabel: (actionName, fallback) =>
       resolveActionLabel(schema.objectName, actionName, fallback),
   });
+  // [objectui#12082] …and a bulk FIELD UPDATE (`operation: 'update'`) is the
+  // same object's edit verdict, the map's `rowEdit` row the row kebab's Edit
+  // reads (`rowEditVerdict` above): a def that writes a patch to every selected
+  // record must not outlive the caller's update grant, the effective operation
+  // set or the object's policy any more than the bulk delete outlives its
+  // delete verdict. A withheld def takes its dialog with it, and so the
+  // executor's per-row update, its undo and its retry, which re-run that write.
+  // `custom` defs are untouched, as above.
   const bulkActionDefs: BulkActionDef[] = resolvedBulkDefs.filter(
-    (def: BulkActionDef) => objectCanDelete || def?.operation !== 'delete',
+    (def: BulkActionDef) =>
+      (objectCanDelete || def?.operation !== 'delete')
+      && (rowEditVerdict.allowed || def?.operation !== 'update'),
   );
   // Names still dispatched by string: the unresolved ones, plus `'delete'`
   // when the author asked for it — or the implicit bulk-delete affordance.
diff --git a/packages/plugin-grid/src/__tests__/bulkUpdateGrant-12082.test.tsx b/packages/plugin-grid/src/__tests__/bulkUpdateGrant-12082.test.tsx
new file mode 100644
index 0000000000..e514afdb95
--- /dev/null
+++ b/packages/plugin-grid/src/__tests__/bulkUpdateGrant-12082.test.tsx
@@ -0,0 +1,147 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectui#12082 — a grid's bulk field update reads the `rowEdit` row of the
+ * affordance-to-grant map, as its bulk Delete reads `rowDelete`.
+ *
+ * A `bulkActionDefs` entry with `operation: 'update'` writes a patch to every
+ * selected record (`useBulkExecutor`'s per-row update, and its undo and retry,
+ * which re-run the same write). The selection bar drew it whatever the caller
+ * held: only the `delete` operation was filtered, on the object's delete
+ * verdict. So a read-only caller could select rows, run the update, and get
+ * one server refusal per row. The bar now draws an update def only when the
+ * object's edit verdict — the policy, the effective operation set and the
+ * caller's update grant — allows it; a closed verdict removes the button, and
+ * with it the dialog, its undo and its retry.
+ *
+ * Measured through the REAL `ObjectGrid` and `MePermissionsProvider`, over the
+ * map pin's four grant shapes: the bar's buttons after one row is selected.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import '@testing-library/jest-dom';
+import React from 'react';
+
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+import { registerAllFields } from '@object-ui/fields';
+import { ActionProvider, SchemaRendererProvider } from '@object-ui/react';
+import { ObjectGrid } from '../ObjectGrid';
+import { __clearRecordCrudVerdictCache } from '../hooks/useRecordCrudVerdicts';
+import { installExplainDouble } from './explainDouble';
+
+registerAllFields();
+
+const OBJECT = 'crm_deal';
+const ROWS = [
+  { id: 'd1', name: 'Alpha', stage: 'open' },
+  { id: 'd2', name: 'Beta', stage: 'open' },
+];
+
+const DEFS = [
+  { name: 'mark_won', label: 'Mark won', operation: 'update', patch: { stage: 'won' } },
+  { name: 'purge', label: 'Purge', operation: 'delete' },
+  { name: 'notify', label: 'Notify', operation: 'custom' },
+];
+
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; update: boolean; remove: boolean }> = [
+  { shape: 'create-only', bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false }, update: false, remove: false },
+  { shape: 'edit-only', bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false }, update: true, remove: false },
+  { shape: 'read-only', bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, update: false, remove: false },
+  { shape: 'full', bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true }, update: true, remove: true },
+];
+
+const envelope = (bits: Record<string, unknown>): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: { [OBJECT]: bits as never },
+  fields: {},
+});
+
+function mount(perms: MePermissionsResponse | null, objectSchema: Record<string, unknown> = {}) {
+  const dataSource: any = {
+    getObjectSchema: async (name: string) => ({
+      name,
+      fields: { id: { type: 'text' }, name: { type: 'text', label: 'Name' }, stage: { type: 'text', label: 'Stage' } },
+      ...objectSchema,
+    }),
+  };
+  const grid = (
+    <ActionProvider>
+      <SchemaRendererProvider dataSource={dataSource}>
+        <ObjectGrid
+          schema={{
+            type: 'object-grid',
+            objectName: OBJECT,
+            columns: [{ field: 'name', label: 'Name' }],
+            data: { provider: 'value', items: ROWS },
+            bulkActionDefs: DEFS,
+          } as any}
+          dataSource={dataSource}
+        />
+      </SchemaRendererProvider>
+    </ActionProvider>
+  );
+  return render(perms ? <MePermissionsProvider initialPermissions={perms}>{grid}</MePermissionsProvider> : grid);
+}
+
+/** Select the last row and report which bulk buttons the bar draws. */
+async function barOffers(): Promise<{ update: boolean; remove: boolean; custom: boolean }> {
+  await waitFor(() => expect(screen.getByText('Alpha')).toBeInTheDocument());
+  await waitFor(() => expect(screen.getByText('Beta')).toBeInTheDocument());
+  const boxes = screen.queryAllByRole('checkbox');
+  expect(boxes.length, 'the custom def keeps selection on').toBeGreaterThan(0);
+  await userEvent.click(boxes[boxes.length - 1]);
+  await waitFor(() => expect(screen.getByTestId('bulk-action-notify')).toBeInTheDocument());
+  return {
+    update: screen.queryByTestId('bulk-action-mark_won') !== null,
+    remove: screen.queryByTestId('bulk-action-purge') !== null,
+    custom: true,
+  };
+}
+
+beforeEach(() => {
+  __clearRecordCrudVerdictCache();
+  installExplainDouble();
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe.each(SHAPES)('the grid bulk bar under a $shape grant (objectui#12082)', ({ bits, update, remove }) => {
+  it('a bulk field update is offered exactly when the update grant allows it; a bulk delete when the delete grant does', async () => {
+    mount(envelope(bits));
+    expect(await barOffers()).toEqual({ update, remove, custom: true });
+  });
+});
+
+describe("the grid bulk bar: the map's other layers and fail-open (objectui#12082)", () => {
+  it('fail-open: with no permission provider every def is offered, as before', async () => {
+    mount(null);
+    expect(await barOffers()).toEqual({ update: true, remove: true, custom: true });
+  });
+
+  it('an effective operation set without update withholds the bulk field update under the full grant', async () => {
+    mount(envelope({ ...SHAPES[3].bits, apiOperations: ['get', 'list', 'create', 'delete'] }));
+    expect(await barOffers()).toEqual({ update: false, remove: true, custom: true });
+  });
+
+  it('an object policy that closes edit withholds the bulk field update under the full grant', async () => {
+    mount(envelope(SHAPES[3].bits), { userActions: { edit: false } });
+    await barOffers();
+    // The policy half reads the object schema, which settles after the rows
+    // paint; wait for the verdict that reads it rather than the first frame.
+    await waitFor(() => expect(screen.queryByTestId('bulk-action-mark_won')).not.toBeInTheDocument());
+    expect(screen.getByTestId('bulk-action-purge')).toBeInTheDocument();
+  });
+});
diff --git a/packages/plugin-grid/src/__tests__/rowCrudEffectiveOps.test.tsx b/packages/plugin-grid/src/__tests__/rowCrudEffectiveOps.test.tsx
index 77c4d7f1d8..04d4057b6d 100644
--- a/packages/plugin-grid/src/__tests__/rowCrudEffectiveOps.test.tsx
+++ b/packages/plugin-grid/src/__tests__/rowCrudEffectiveOps.test.tsx
@@ -311,7 +311,11 @@ describe('ObjectGrid bulk delete vs the object delete verdict (#3720)', () => {
 
   it('drops a bulkActionDefs entry whose operation is delete', async () => {
     renderGrid({
-      effectiveOps: READ_ONLY,
+      // [objectui#12082] An effective set that serves `update` but not
+      // `delete`: the update def is the control that stays, now that a bulk
+      // field update rides the edit verdict (`bulkUpdateGrant-12082.test.tsx`)
+      // — under READ_ONLY it is withheld too.
+      effectiveOps: ['get', 'list', 'update'],
       schema: {
         bulkActionDefs: [
           { name: 'purge', label: 'Purge', operation: 'delete' },