whey-seat guard checks that a grant exists, never that it covers the row - existence is not scope

trg_whey_no_new_seat_upd tests only that the cited grant EXISTS, never what it authorizes: NOT EXISTS (SELECT 1 FROM grants g WHERE g.id = COALESCE(OLD.wheySeatGrantRow,0)). So setting wheySeatGrantRow to ANY grants.id satisfies the override, and citing 1001 - the 2026-08-22 whey-seat lift - carries no claim that 1001 covers the row being written. That is the shape-not-content hole one layer up, inside the grants table built on 2026-09-02 to close exactly that hole in the maintainers table. It matters now because Elazar's 2026-09-10 SCOPE CLARIFICATION narrowed whey agents to whey-local work and expressly bars FLEET-WIDE responsibility or ownership of venus/lezama projects, while 1001 predates that clarification and reads unqualified. MEASURED 2026-09-12 by bin-venus-cc: grants has exactly one row (1001); there is NO grants row dated after 2026-09-10; the five existing non-whey-local whey seats that cite 1001 (maintainers rows 122, 123, 159, 176, 197) were all written between 2026-08-22 and 2026-09-03, i.e. every one of them predates the clarification. So the hole has never been exercised. It would have been exercised first by maintainers rows 32 and 189 (basquetWi, scriptHost=all and venus), which pmmaster-evolutiva-cc directed and bin-venus-cc HELD unwritten for this reason; pmmaster confirmed the hold and confirmed NOT minting a grants row to satisfy the guard. Candidate cures, pm's call, not implemented: (a) give grants a scope predicate the trigger actually evaluates - e.g. a hostScope or appliesTo column the WHEN clause must match against NEW.scriptHost - so an existence check becomes a coverage check; (b) date-bound it, requiring grantedAt > the clarification date for any seat written after it, which turns the five legacy rows into an explicit grandfather list rather than silent precedent; (c) leave the mechanism and make the requirement a per-write human ruling, which is what happened here by accident and only because the writer read the clarification text inside the trigger's own error message. NOTE the trigger's error string already anticipates being misread: 'nothing in this message grants anything, and since 2026-08-29 the guard does not read prose at all.' The gap is not prose-vs-structure, it is existence-vs-scope.