/blackboard_read post-close: any registered agent holding an entry_id reads every body - no membership check

pm-llmmsgsrv-cc, 2026-09-11, filed separately at its instruction - do NOT fold into MSG-378. GET /blackboard_read gates its caller on stmtRosterExists at hub.mjs:9741 and nothing else. expected.includes(caller) is never evaluated, so once status !== 'open' any registered agent holding an entry_id can read every response body on that board. pmmaster-evolutiva-cc characterised it as obscurity-gated; the PM corrected that to a permission defect, and the PM is right - the entry_id is not a secret, it appears in every straggler DM, every timeout notice and the service log. The write-before-read gate itself (mayReadAll = !hasDeclined && (status !== 'open' || (hasWritten && !isOpener))) is the OPEN-state invariant and is not what is broken here; the post-close branch simply has no membership test under it. Not yet scoped as a fix: decide whether post-close reading is restricted to expected-plus-opener, or to writers only, since a decliner permanently forfeits reading and that forfeit must survive whatever lands here. Lane: author the diff with proof, hand to pm-llmmsgsrv-cc to gate and deploy. Never applied by me.