Safe mode belongs to the person, and a household can say who may ask Bobby for what

Safe mode

A defence that became unnecessary rather than redundant

The old arrangement reduced the flag across a person’s groups: in safe mode in any one of them meant in safe mode. That was a defence rather than a convenience — adding a child to a second group to grant one extra permission must not quietly switch their protection off.

Moving the flag onto the person makes the defence unnecessary instead of merely redundant. No membership can lift safe mode, because no group carries it. The back-fill was watched moving a real row before it was believed, because a zero out of a statement running under forced row-level security is indistinguishable from a silent no-op.

Safe mode is not a capability and must not become one. Capabilities combine across a person’s groups, and a protection that combined would be a protection the next membership lifted. A test asserts its absence from the capability list, from both halves of the action map, and from every seeded group.

Nobody can change their own safe mode in either direction, even holding the permission to manage groups — a household could reasonably put a teenager in a group that manages groups, and blocking only “off” would leave “turn it on, turn it off” as a two-step way out. Somebody else is the way back.

Being a minor turns it on once, at the moment the person’s row is written, and it is never recomputed and never swept. An adult in the household can turn it off afterwards and nothing turns it back on, because a fifteen-year-old and a five-year-old are both minors and are not the same person.

The switch can read its own position at last. It had been writable for a day and unreadable, so it could set a value it could not display.

Tools

Sixty-one of them, and two gates each

The first gate is the household’s answer about whether a tool is available here at all, and it applies to whoever flipped it. There is no person in its path and nowhere in it to put one, so a household that turns spending off has turned it off for its own creator. A switch its administrator can route around is decoration, and the test asserts the creator’s own resolved set rather than what the page reports.

The second gate is which permission a person needs in order to ask. Five groups are seeded in every household — Creator, Manager, Member, Guest, Viewer — and labels can be renamed while the identifier underneath cannot, so a rename changes the word and nothing else. Asserted rather than believed: somebody in Viewer is refused an invitation, Viewer is renamed to “Manager”, and they are refused again.

Nothing here is deleted. Turning a tool off updates a boolean; withdrawing a permission and removing somebody from a group both set a date and leave the row. Those columns are the history of who could once reach a spending tool.