Story-2499 · functions lane · ER-21 / ER-22 / ER-25

Privilege is a membrane, not a wall

Mental model: privileged material stays inside the matter team's secure workroom. The system may read it, pool it, embed it, and compare it; the locked exit door prevents it from becoming a filing or another external artifact.

Why the old wall failed the product

The v1 wall rejected privileged files before they became documents. That prevented internal legal analysis—the very work privilege exists to protect. The tempting opposite, removing the filter everywhere, would let client advice leak into a filing. The membrane keeps internal computation open and makes egress the hard boundary.

The tag travels with the material

privileged upload
      ↓
Document + import ledger
      ↓
Deep Read rows + Reading Findings
      ↓
assertions + chunks + graph projections
      ↓
internal retrieval and comparison remain eligible

Every persistent derived store carries the source privilege tag. Strategy analysis also carries its document_home; it may be embedded for internal use but remains outside record/world-fact retrieval. A factual assertion from a privileged Record can participate in internal comparison, while work-product analysis never becomes an evidence assertion.

The exit door fails closed

internal matter-team read      → allowed, tag retained
comparator retrieval          → allowed, tag retained
exhibit / annexure register   → privileged rows excluded
filing lead-document link     → service rejects + DB trigger rejects
future export surface         → must introduce an explicit tagged egress seam

The database trigger is the backstop: even a direct SQL write cannot link a privileged document as a filing's lead. It locks classification against concurrent filing writes, so neither transaction order creates a gap. Existing exhibit and annexure queries already exclude privileged documents. General export, shared Brief, and chronology-export routes do not exist in this repository yet, so this change does not claim a dead helper protects them.

Changing the tag updates the descendants

The migration backfills existing assertions, chunks, findings, Deep Read envelopes, and document descendants, then installs locked writers that propagate later privilege or home changes. A Record-to-strategy correction removes factual assertions; graph reads resolve only current Record-home facts; and bundle snapshots lock classification so a concurrent flip invalidates the completed snapshot instead of being overtaken by stale publication. It also deletes the inert v1 refusal-ledger rows: there is no compatibility path that keeps the wall alive.

Scope boundary: this is the functions data layer only. Mira's privileged-answer behavior belongs to T3j / #2500. The migration is chained to the single current Alembic head.

One-sentence recall

Privileged material may think inside the workroom, but its tag follows every derivative and the filing door will not open for it.