Field.user columns render the raw user id in every grid — ats_employer.owner shows usr_ats_*, not a name - #85

Fixes #67.

ats_employer gains a stored owner_name mirror of the primary contact's sys_user.name, stamped
on write by a new ats_employer_stamp hook, and the reviewer's grid slot (highlightFields, the
authored ats_employer.all columns) names the mirror instead of the pointer. The owner pointer is
untouched and stays authoritative — the F1 approval still notifies record.owner.

Read this first: the card's only comment argues against this approach

The triage comment on #67 calls the mirror "the wrong fix twice over" — denormalising past a
visibility rule, and going stale — and explicitly declines to dispatch, saying the choice belongs to
the maintainer. This PR was dispatched on a decision taken off-card, with two premises attached, and
those premises were re-measured here before any code was touched. The first objection does not
survive the measurement; the second is real and is bounded in code. Both are set out below so the
merge decision is made against the evidence, not against my summary of it.

The two premises, re-measured on a booted server

Both drivers, demo seed complete (818 rows, errored: 0), counts read from the top-level
records / total with hasMore == false and records.length == total asserted first. Full
numbers and method: docs/evidence/issue-67/README.md.

1. No platform persona can read an employer-staff sys_user row — CONFIRMED, and stronger than
stated.

Each platform persona reads exactly its own row. The premise as dispatched said 83 of 113; that was
the card's triage measurement on 54cd69c. The refusal to expand ats_employer.owner is therefore
correct, and this PR does not widen any read.

That drift is not cosmetic and it is wider than this card — every Field.user column in the app now
renders a bare id to a platform persona, including ats_candidate.user, which the triage measured
expanding correctly. Measured and filed separately as #82.

2. The name is already in this audience's hands — CONFIRMED, for the platform audience only.

ats_employer_member.display_name reads Margaret Ellison · admin for all 12 contacts, to both
platform personas, on both drivers. For that audience the mirror restates a fact they hold, which is
what disposes of the "denormalising past the boundary" objection. For the job seeker it does not
— and that is the first defect the WIP had.

What I changed in the WIP, and why

The branch started at ec15479, a commit whose own message says nothing in it was verified. Three
things were wrong; the design bound (name only, no e-mail, no phone; pointer stays authoritative)
held up and is kept.

1. The mirror was readable to job seekers. src/security/permission-sets.ts

Field-level security in this repo is a deny-list, so a new field is readable to every persona that
can read the object. Measured on the WIP as saved, as candidate01@mail.example:

seeker reads 9 verified employers
owner_name = "Margaret Ellison", "Walter Brandt", …      <- all 12 contact names
GET /api/v1/data/ats_employer_member -> 403 PERMISSION_DENIED

The seeker holds no ats_employer_member row, so for them the name was new information — a
rendering repair for 2 reviewers would have disclosed 12 contact names to 80 seeker accounts, which
the pointer it replaces never did (they read it as an opaque usr_ats_*, and it stays that way).
Sealed in JobSeekerSet the way verification_note is. After the seal, measured on both drivers:

platform admin / ops   owner_name readable        (this is the card)
employer admin         owner_name readable, own employer only, 1 row
recruiter              owner_name readable, own employer only, 1 row
job seeker             owner_name absent, 0 of 9 rows; owner pointer unchanged

2. input.owner ?? prev.owner resurrected a removed contact. src/hooks/stamp.hook.ts

?? treats an explicit owner: null as absent, so clearing the primary contact left the previous
person's name in the reviewer's column. Measured on the WIP: PATCH {"owner": null} gave
owner = null, owner_name = "Walter Brandt". Now the handler reads previous only when the
payload omits owner entirely, and clears the mirror when the pointer is cleared — an insert with
no contact writes nothing rather than an explicit null. Measured after the fix: both null.

3. The e-mail fallback lookup was dead code resting on a false premise.

The WIP tried findOne({ id }) then findOne({ email }), commented "seeds address users by their
external id (email)". Two measurements say otherwise: the engine refuses a Field.user value that
is not an existing sys_user id —

PATCH {"owner":"admin@harborline.example"} -> 400 VALIDATION_FAILED / reference_not_found
PATCH {"owner":"usr_nope_missing"}         -> 400 VALIDATION_FAILED / reference_not_found

— and the seeder resolves its externalId reference before hooks run, which is why the neighbouring
member stamp, whose lookup has only ever been by id, titles all 30 seeded rows with real names from
a seed that addresses users by e-mail. One lookup now, by id. This also closes the path the field's
own bound forbids: with the e-mail branch, an unresolvable reference could have left a work e-mail
address in a column that is supposed to carry a name and nothing else.

The residual the triage comment named second is real and unchanged: a later rename of the sys_user
row does not reach back into this column. It is the identical residual
ats_employer_member.display_name has carried since #22, it is stated in the field's own comment,
and a reassignment is not affected — re-pointing owner re-derives the name (measured).

The projected values, cross-checked against an independent source

Never against the column itself. ats_employer_member.display_name is a different column, stamped
by a different handler, from a different row, seeded independently; both the name and the pointer
are compared, so a right name on the wrong contact would fail.

12 of 12 on both the name and the pointer — memory and sqlite, first boot and second boot of one
persistent file.

#43 — the stamp is not re-derived by a payload that does not name its source

The second boot is the one that matters: it is the boot that runs plugin-security's
claimSeedOwnership (multi: true, one SET clause for every matched row) and the seed's re-boot
upsert — [Seeder] Seed loading complete {"inserted":0,"updated":7,"skipped":811,"errored":0}. The
guard returns before computing anything because that payload names owner_id, not owner. Twelve
distinct values after it is the check that no single value was broadcast across the twelve rows.

Browser evidence — admin@platform.example, real Chromium

The review queue, reached by clicking the Employers Pending nav entry. 2 records, zero
usr_ats_* strings on screen:

The authored ats_employer.all view. 12 records, all 12 contact names, zero usr_ats_* on screen:

Two more shots are linked rather than embedded — GitHub's body sanitizer destroyed the third and
fourth image embeds on both of the previous writes of this description, in two different ways, and a
link carries no ! for it to eat:

• The same queue after the second boot of a persistent sqlite database
  — the boot that runs claimSeedOwnership. Names intact, 2 records.
• The employer record page
  — where the honest limits show.

Two things in that record shot are deliberate. The header strip truncates the sixth value to
Zoe Ha… — the shell's layout at 5+ items, the same thing docs/evidence/issue-33/README.md
recorded as Pendi… / Full-ti…; filed as #84. And the Details tab still reads
PRIMARY CONTACT usr_ats_pixelforge_admin: that is the owner pointer, kept, editable, and the
thing the approval flow notifies. owner_name is deliberately in no form section — a derived value
should not be offered as a text box, even one the hook re-derives.

Deliberate non-changes

• searchable is not set on owner_name. Search is a second, wider surface; the reviewer's
  queue is a slice they read.
• readonly is not set. The sibling mirror ats_employer_member.display_name does not set it
  either, and the anti-tamper property is measured: writing the column re-derives it. readonly on
  a value stamped through ctx.input is unmeasured in this repo and would be a second behaviour to
  verify for no gain here.
• No other Field.user column is mirrored. The argument that makes this one defensible —
  the audience already holds the fact — is not available for ats_candidate.user or
  ats_interview.interviewers. See Every Field.user column reads as a bare id to a platform persona: the readable sys_user set is now the caller's own row (1 of 113, was 83) #82.

Gates

$ pnpm validate
  → Validating against ObjectStack Protocol...
  → Running author-time rules (42)...
  → Checking capability providers (#3366)...
  → Checking package docs (ADR-0046)...
  ✓ Validation passed (516ms)
exit 0   (3 pre-existing approver-routing warnings, unchanged by this branch)

$ pnpm lint
  ✓ 7 assertions — the comparator still reports drift, orphans and gaps
  bundle keys (src/translations/en.ts)    514
  source labels collected                 514   (489 os i18n extract + 25 view-nested)
  compared, key present on both sides     514
  ✓ every bundle key restates the label its metadata declares
exit 0   (512 -> 514: `owner_name` label + help, en verbatim from the source, zh-CN translated)

$ pnpm typecheck
> tsc --noEmit
exit 0

Exit codes captured before any pipe. Seed shape unchanged: 818 rows, funnel
88 / 46 / 28 / 14 / 9, ats_employer 12, ats_employer_member 30, ats_candidate 80 — on both
drivers and both sqlite boots.

Out of scope, measured here and filed unassigned: #82 (every Field.user column reads as a bare id
to a platform persona), #83 (a platform administrator cannot create an ats_employer: HTTP 500), #84
(header strip truncation). No changeset: this repository has no changeset mechanism and CI runs only
the three gates above.