diff --git a/.changeset/12082-affordance-grant-map.md b/.changeset/12082-affordance-grant-map.md
new file mode 100644
index 0000000000..d98a7aed2f
--- /dev/null
+++ b/.changeset/12082-affordance-grant-map.md
@@ -0,0 +1,77 @@
+---
+'@object-ui/core': minor
+'@object-ui/permissions': minor
+'@object-ui/plugin-form': patch
+'@object-ui/app-shell': patch
+'@object-ui/fields': patch
+'@object-ui/plugin-list': patch
+'@object-ui/plugin-grid': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/console': patch
+---
+
+A create form asks its fields the create question, so a role that may create
+records but not edit them can fill and submit the form (objectui#12082). Every
+console affordance that offers a write now reads the grant it exercises from
+one map.
+
+**The defect.** A create form gated each field on `checkField(object, field,
+'write')`, whose fallback for a field the permission set does not mention is
+the object's `allowEdit`. Under a grant of `allowCreate: true, allowEdit: false`
+every field of the create form rendered disabled, the outbound filter stripped
+every field from the body, and the save posted an empty record that the server
+refused for its required fields — while the server accepts the same create.
+
+**The server's insert rule, which the create question follows.** The server's
+field-level write step refuses a write that names a field whose explicit
+field-level entry has `editable: false`; a field with no entry passes it, and
+object admission decides the operation (`allowCreate` for an insert,
+`allowEdit` for an update). So a create-form field now reads its explicit entry
+when there is one and the object's create grant when there is none. A field the
+permission set marks `editable: false` stays disabled and out of the body.
+
+**Clause-②: yes (widening)**
+
+- `@object-ui/core` exports the affordance-to-grant map: `AFFORDANCE_GRANTS`
+  (one row per affordance: the CRUD-affordance bit it needs, the object grant it
+  exercises and, for an affordance that offers fields, the field question it
+  asks), `resolveAffordance` (managed-object policy ∧ the server's effective API
+  operation set ∧ the caller's grant, with the row's `userActions` predicates
+  surfaced only when all three allow it), `resolveFieldAffordance`,
+  `formFieldsAffordance`, and their types (`ConsoleAffordance`,
+  `FieldAffordance`, `AffordanceGrant`, `FieldAffordanceGrant`,
+  `AffordanceGrantRow`, `AffordanceGrantPrincipal`, `FieldAffordancePrincipal`,
+  `AffordanceSource`, `AffordanceVerdict`).
+- `@object-ui/permissions`: `checkField`'s action accepts `'create'` beside
+  `'read'` and `'write'`. `MePermissionsProvider` answers it from the explicit
+  field entry when there is one and from `allowCreate` otherwise; the
+  role-based `PermissionProvider` answers it as it answers `'write'`.
+
+**Behaviour, by package.** With no permission provider mounted every grant
+still reads open, as before.
+
+- `@object-ui/plugin-form`: every `ObjectForm` layout's fields and outbound
+  filter ask the question of the form's mode (create or edit). The form-wide
+  lock, with its "You don't have permission to …" notice, also engages when the
+  caller's object grant for the form's mode is denied, not only when the
+  managed-object policy or the effective API operation set closes it. A
+  create-mode `MasterDetailForm`'s line cells ask the create question of the
+  child object, since every line there is a new record.
+- `@object-ui/app-shell`: the record page's Edit and Delete (and the record
+  body's in-place editing) read the caller's update / delete grant; they read
+  none before. The import wizard's write targets ask the create question, so a
+  caller offered Import keeps every field the insert accepts. List New / Import,
+  the related lists and the Attachments panel read the map with the verdicts
+  they had.
+- `@object-ui/fields`: a lookup's "Create new" reads the create grant (and the
+  managed-object policy and operation set) of the object the field references;
+  it read no grant before.
+- `@object-ui/plugin-grid`: row Edit / Delete, in-place editing, the template
+  download and the add-record row read the map; the add-record row now also
+  honours the object's managed-object policy and effective `create` operation.
+- `@object-ui/plugin-detail`: `record:details` in-place editing reads the
+  caller's update grant; the detail header's object gate adds the effective
+  operation set.
+- `@object-ui/plugin-list` and `@object-ui/console`: bulk Delete, the
+  inline-edit toggle and the profile page's language field read the map with
+  the verdicts they had.
diff --git a/apps/console/src/pages/system/ProfilePage.tsx b/apps/console/src/pages/system/ProfilePage.tsx
index f1d73f080a..77fea3046d 100644
--- a/apps/console/src/pages/system/ProfilePage.tsx
+++ b/apps/console/src/pages/system/ProfilePage.tsx
@@ -39,6 +39,7 @@ import { useUpload } from '@object-ui/providers';
 import { useObjectTranslation, type TranslateFn } from '@object-ui/i18n';
 import { useAdapter, extractFieldErrors, extractWriteErrorMessage } from '@object-ui/react';
 import { usePermissions } from '@object-ui/permissions';
+import { resolveFieldAffordance } from '@object-ui/core';
 import { CheckCircle2, AlertCircle, User, Lock, Upload, Loader2, X, Globe } from 'lucide-react';
 
 /**
@@ -461,9 +462,11 @@ interface LanguageCardProps {
  * truth rather than rendering blank.
  *
  * Availability is asked, not discovered from a rejection: the card renders
- * nothing until the row has been read, and `checkField('sys_user', 'locale',
- * 'write')` — which consults field-level permissions and falls back to the
- * object gate's `allowEdit` — decides between an editable control and a
+ * nothing until the row has been read, and the field question an edit asks —
+ * the `editFormFields` row of the affordance-to-grant map, read through
+ * `resolveFieldAffordance` from `@object-ui/core` (objectui#12082): it consults
+ * field-level permissions and falls back to the object gate's `allowEdit` —
+ * decides between an editable control and a
  * read-only one carrying the reason. A failed read hides the card, the same
  * "render nothing rather than something you will have to retract" idiom
  * `LocaleSwitcher` uses for a locale list it does not have yet. That is the
@@ -472,7 +475,7 @@ interface LanguageCardProps {
 function LanguageCard({ userId }: LanguageCardProps) {
   const { t, offerableLanguages } = useObjectTranslation();
   const adapter = useAdapter();
-  const { checkField } = usePermissions();
+  const perms = usePermissions();
 
   const [stored, setStored] = useState<string | null>(null);
   const [choice, setChoice] = useState<string>(USE_DEPLOYMENT_DEFAULT);
@@ -519,7 +522,7 @@ function LanguageCard({ userId }: LanguageCardProps) {
 
   if (!adapter || !rowRead || offerableLanguages === null) return null;
 
-  const writable = checkField('sys_user', 'locale', 'write');
+  const writable = resolveFieldAffordance('editFormFields', perms, 'sys_user', 'locale');
   const dirty = choice !== (stored ?? USE_DEPLOYMENT_DEFAULT);
 
   const handleSave = async (e: React.FormEvent) => {
diff --git a/apps/console/src/pages/system/__tests__/ProfilePage.access.test.tsx b/apps/console/src/pages/system/__tests__/ProfilePage.access.test.tsx
index 8abb2476e4..9ddddbe55b 100644
--- a/apps/console/src/pages/system/__tests__/ProfilePage.access.test.tsx
+++ b/apps/console/src/pages/system/__tests__/ProfilePage.access.test.tsx
@@ -60,7 +60,7 @@ vi.mock('@object-ui/react', async (importOriginal) => ({
 
 vi.mock('@object-ui/permissions', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  usePermissions: () => ({ checkField: () => true }),
+  usePermissions: () => ({ isLoaded: true, checkField: () => true }),
 }));
 
 const { ProfilePage } = await import('../ProfilePage');
diff --git a/apps/console/src/pages/system/__tests__/ProfilePage.language.test.tsx b/apps/console/src/pages/system/__tests__/ProfilePage.language.test.tsx
index e651e3b7fd..fb227bb49a 100644
--- a/apps/console/src/pages/system/__tests__/ProfilePage.language.test.tsx
+++ b/apps/console/src/pages/system/__tests__/ProfilePage.language.test.tsx
@@ -115,7 +115,7 @@ vi.mock('@object-ui/react', async (importOriginal) => ({
 
 vi.mock('@object-ui/permissions', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  usePermissions: () => ({ checkField: () => writable.value }),
+  usePermissions: () => ({ isLoaded: true, checkField: () => writable.value }),
 }));
 
 const { ProfilePage } = await import('../ProfilePage');
diff --git a/apps/console/src/pages/system/__tests__/ProfilePage.sharedSelect-11865.test.tsx b/apps/console/src/pages/system/__tests__/ProfilePage.sharedSelect-11865.test.tsx
index 085f89da72..e578fbcf5f 100644
--- a/apps/console/src/pages/system/__tests__/ProfilePage.sharedSelect-11865.test.tsx
+++ b/apps/console/src/pages/system/__tests__/ProfilePage.sharedSelect-11865.test.tsx
@@ -83,7 +83,7 @@ vi.mock('@object-ui/react', async (importOriginal) => ({
 
 vi.mock('@object-ui/permissions', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  usePermissions: () => ({ checkField: () => true }),
+  usePermissions: () => ({ isLoaded: true, checkField: () => true }),
 }));
 
 const { ProfilePage } = await import('../ProfilePage');
diff --git a/content/docs/plugins/plugin-form.mdx b/content/docs/plugins/plugin-form.mdx
index fcdb8d4017..27a3ffbac0 100644
--- a/content/docs/plugins/plugin-form.mdx
+++ b/content/docs/plugins/plugin-form.mdx
@@ -460,7 +460,7 @@ as well as a simple form whose mobile `stepper` option routes it through the
 wizard, and the parent operation of a master-detail form. Every layout also
 strips what a form never writes, on a create as on an edit: server-owned,
 computed and read-only columns, keys the object does not declare, and fields the
-caller's field-level security refuses — which every layout renders disabled. Every layout also disables every field of a managed object whose `userActions` do not open the form's mode, and of an object whose `create` or `update` the server's effective API operations deny. While that lock holds, the form shows one notice naming the object and the missing permission, and a `wizard` disables Next and its final submit button. A field whose sameness cannot be proven is sent: `5` and `'5'`, `null` and
+caller's field-level security refuses — which every layout renders disabled. A field asks the question of the form's mode: a create form asks whether the caller may set it on a NEW record (the server's insert rule — a field the permission set does not mention falls back to the object's `allowCreate`), and an edit form whether they may change it on an existing one (`allowEdit`), so a role that may create but not edit can fill a create form. Every layout also disables every field of a managed object whose `userActions` do not open the form's mode, of an object whose `create` or `update` the server's effective API operations deny, and of an object whose create (create form) or update (edit form) grant the caller does not hold. While that lock holds, the form shows one notice naming the object and the missing permission, and a `wizard` disables Next and its final submit button. A field whose sameness cannot be proven is sent: `5` and `'5'`, `null` and
 `''`, and a lookup id and its expanded object all count as different. A save with
 nothing changed still sends the full payload, as it always has. The `ifMatch`
 concurrency guard is unchanged, and its **Overwrite** choice now resends only the
diff --git a/packages/app-shell/src/views/ObjectDataPage.tsx b/packages/app-shell/src/views/ObjectDataPage.tsx
index 5c70aa147d..2fd7955664 100644
--- a/packages/app-shell/src/views/ObjectDataPage.tsx
+++ b/packages/app-shell/src/views/ObjectDataPage.tsx
@@ -43,7 +43,7 @@ import { formatMetadataError } from '@object-ui/data-objectstack';
 import { useObjectTranslation, useObjectLabel } from '@object-ui/i18n';
 import { usePermissions, useFieldPermissions } from '@object-ui/permissions';
 import { useAuth, useWorkspaceAdminStatus } from '@object-ui/auth';
-import { resolveFilterPlaceholders } from '@object-ui/core';
+import { resolveAffordance, resolveFilterPlaceholders, type SchemaLike } from '@object-ui/core';
 import { normalizeFilterOperator, ViewFilterRuleSchema } from '@objectstack/spec/ui';
 import type { ViewFilterRule } from '@objectstack/spec/ui';
 import { parseUserFilterParams, applyUserFilterParams } from './userFilterUrlState.js';
@@ -73,7 +73,7 @@ import {
   PREVIEW_QUERY_VALUE,
 } from '../preview/PreviewModeContext.js';
 import { useTenancyPosture } from '../hooks/useTenancyPosture.js';
-import { resolveEffectiveCrudAffordances, type RowCrudPredicates } from '../utils/crudAffordances.js';
+import type { RowCrudPredicates } from '../utils/crudAffordances.js';
 
 /** Field types the auto-derived user-filter bar offers as dropdowns. */
 const USER_FILTER_TYPES = new Set(['select', 'multiselect', 'radio', 'enum', 'boolean']);
@@ -195,7 +195,8 @@ export function ObjectDataPage({ dataSource, objects }: any) {
   const { objectLabel, objectPluralLabel, fieldLabel } = useObjectLabel();
   const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
-  const { can, getObjectApiOperations } = usePermissions();
+  const perms = usePermissions();
+  const { can } = perms;
   const { canRead } = useFieldPermissions(objectName ?? '');
   const { user, activeOrganization } = useAuth();
   const { isAdmin } = useWorkspaceAdminStatus();
@@ -423,17 +424,19 @@ export function ObjectDataPage({ dataSource, objects }: any) {
   // objectstack#3391 effective-API-operation intersection was absent, so the toolbar could
   // offer a create the server would 405.
   //
-  // Resolved exactly as `ObjectView` does: the spec's bucket/`userActions`
-  // matrix (ADR-0103, delegated to `resolveCrudAffordances`), INTERSECTED with
-  // the server-resolved effective API operations for this object. `undefined`
-  // (unrestricted object / old backend) leaves the bucket affordances as-is.
-  const affordances = React.useMemo(
+  // Resolved exactly as `ObjectView` does, through the SAME `listNew` row of
+  // the affordance-to-grant map (`resolveAffordance` in `@object-ui/core`,
+  // objectui#12082): the spec's bucket/`userActions` matrix (ADR-0103,
+  // delegated to `resolveCrudAffordances`), INTERSECTED with the
+  // server-resolved effective API operations for this object, AND the caller's
+  // create grant. `undefined` operations (unrestricted object / old backend)
+  // leave the bucket affordances as-is.
+  const newVerdict = React.useMemo(
     () =>
-      resolveEffectiveCrudAffordances(
-        objectDef as any,
-        objectDef ? getObjectApiOperations(objectDef.name) : undefined,
-      ),
-    [objectDef, getObjectApiOperations],
+      objectDef
+        ? resolveAffordance('listNew', { objectSchema: objectDef as SchemaLike, objectName: objectDef.name, perms })
+        : { allowed: false },
+    [objectDef, perms],
   );
 
   /**
@@ -460,10 +463,8 @@ export function ObjectDataPage({ dataSource, objects }: any) {
    * ONE RENDER POINT here, unlike `ObjectView`: this page has no phone FAB —
    * the whole PageHeader lives under `hidden sm:block`.
    */
-  const objectCanCreate = !!objectDef && affordances.create && can(objectDef.name, 'create');
-  const createPredicates: RowCrudPredicates | undefined = objectCanCreate
-    ? affordances.createPredicates
-    : undefined;
+  const objectCanCreate = newVerdict.allowed;
+  const createPredicates: RowCrudPredicates | undefined = newVerdict.predicates;
   /** `visibleWhen` — fails CLOSED, declared-ness by `?? true` rather than by
    *  truthiness, so `visibleWhen: false` (the objectui#3492 shape) hides "New"
    *  instead of reading as "ungated". The `true` default is a boolean, which
@@ -543,8 +544,8 @@ export function ObjectDataPage({ dataSource, objects }: any) {
             <>
               {/* [#5164] `objectCanCreate && createVisible` — the bucket +
                   object-level `userActions` + objectstack#3391 effective-operations
-                  verdict (all folded into `affordances.create`) AND the
-                  principal's grant, then the toolbar-scope `visibleWhen` layer
+                  verdict AND the principal's grant (the map's `listNew` row,
+                  objectui#12082), then the toolbar-scope `visibleWhen` layer
                   on top of it. Greyed, not gone, is the `disabledWhen` case. */}
               {objectCanCreate && createVisible && (
                 <Button
diff --git a/packages/app-shell/src/views/ObjectView.tsx b/packages/app-shell/src/views/ObjectView.tsx
index 768c2f44a2..c40ccec4f1 100644
--- a/packages/app-shell/src/views/ObjectView.tsx
+++ b/packages/app-shell/src/views/ObjectView.tsx
@@ -11,7 +11,7 @@
 
 import { useMemo, useState, useCallback, useEffect, useRef, lazy, Suspense, type ComponentType } from 'react';
 import { useParams, useSearchParams, useNavigate, useLocation } from 'react-router-dom';
-import { resolveFilterPlaceholders, DENSITY_MODE_TO_ROW_HEIGHT, normalizeListViewSchema, leadWithNameField, type FilterTokenScope } from '@object-ui/core';
+import { resolveFilterPlaceholders, DENSITY_MODE_TO_ROW_HEIGHT, normalizeListViewSchema, leadWithNameField, resolveAffordance, type FilterTokenScope, type SchemaLike } from '@object-ui/core';
 import {
     parseUserFilterParams,
     applyUserFilterParams,
@@ -70,7 +70,7 @@ import { useMobileViewSwitcherRegistration } from '../layout/MobileViewSwitcherC
 import type { MobileViewSwitcherItem } from '../layout/MobileViewSwitcherContext.js';
 import { ManagedByBadge } from '../components/ManagedByBadge.js';
 import { RecordDetailView } from './RecordDetailView.js';
-import { resolveEffectiveCrudAffordances, type RowCrudPredicates } from '../utils/crudAffordances.js';
+import type { RowCrudPredicates } from '../utils/crudAffordances.js';
 import { createIdentityImportDataSource, IDENTITY_IMPORT_OBJECT, type IdentityPasswordPolicy } from './identityImport.js';
 import { IdentityImportOptions, IdentityImportResultExtra, identityImportFields } from './IdentityImportPanels.js';
 import { importTargetFields } from './importTargetFields.js';
@@ -1895,7 +1895,6 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
     const { user, activeOrganization } = useAuth();
     const { isAdmin } = useWorkspaceAdminStatus();
     const perms = usePermissions();
-    const { can, getObjectApiOperations } = perms;
 
     // [ADR-0066 / objectstack#7494] Hand the adapter the session's REPORTED
     // system capabilities so its `updateViewConfig` gate has something to judge
@@ -2057,11 +2056,18 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
     // operation set for this object (from /me/permissions apiOperations), so the
     // toolbar never offers Import/Export/New/Edit/Delete the server would 405.
     // `undefined` (unrestricted object / old backend) leaves affordances as-is.
-    // The identity-import bypass below is independent of `affordances.import`.
-    const affordances = useMemo(
-      () => resolveEffectiveCrudAffordances(objectDef as any, getObjectApiOperations(objectDef.name)),
-      [objectDef, getObjectApiOperations],
-    );
+    // objectui#12082: New and Import are the `listNew` / `listImport` rows of
+    // the affordance-to-grant map (`resolveAffordance` in `@object-ui/core`),
+    // which ANDs the caller's create grant onto that intersection itself and
+    // surfaces the row's `userActions` predicates only when all three allow it.
+    // The identity-import bypass below is independent of the `listImport` row.
+    const { newVerdict, importVerdict } = useMemo(() => {
+      const source = { objectSchema: objectDef as SchemaLike, objectName: objectDef.name, perms };
+      return {
+        newVerdict: resolveAffordance('listNew', source),
+        importVerdict: resolveAffordance('listImport', source),
+      };
+    }, [objectDef, perms]);
 
     // Externally-triggered refreshes (e.g. global ModalForm submit, undo, redo)
     // reach every `refreshKey` reader through the sum declared with the counter
@@ -2089,10 +2095,8 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
      * rendered twice, so both consume these SAME two values; computing the
      * predicate once here is what keeps them from disagreeing with each other.
      */
-    const objectCanCreate = affordances.create && can(objectDef.name, 'create');
-    const createPredicates: RowCrudPredicates | undefined = objectCanCreate
-      ? affordances.createPredicates
-      : undefined;
+    const objectCanCreate = newVerdict.allowed;
+    const createPredicates: RowCrudPredicates | undefined = newVerdict.predicates;
     /** `visibleWhen` — fails CLOSED, declared-ness by `?? true`. As Import. */
     const createVisible = useRowPredicate(createPredicates?.visibleWhen ?? true, null, {
       fallback: false,
@@ -2150,13 +2154,11 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
      * the same posture the related-list bridge takes, because a predicate may
      * not RE-OPEN what the bucket, the effective API operations (objectstack#3391) or the
      * principal's grant have closed. The identity-import bypass below is a
-     * different affordance entirely (it does not read `affordances.import`) and
+     * different affordance entirely (it does not read the `listImport` row) and
      * is deliberately left outside this layer.
      */
-    const objectCanImport = affordances.import && can(objectDef.name, 'create');
-    const importPredicates: RowCrudPredicates | undefined = objectCanImport
-      ? affordances.importPredicates
-      : undefined;
+    const objectCanImport = importVerdict.allowed;
+    const importPredicates: RowCrudPredicates | undefined = importVerdict.predicates;
     /**
      * `visibleWhen` — fails CLOSED, and counts as DECLARED by `?? true` rather
      * than by truthiness, so `visibleWhen: false` hides Import instead of
diff --git a/packages/app-shell/src/views/RecordAttachmentsPanel.tsx b/packages/app-shell/src/views/RecordAttachmentsPanel.tsx
index 6223bfa12a..a49b338d06 100644
--- a/packages/app-shell/src/views/RecordAttachmentsPanel.tsx
+++ b/packages/app-shell/src/views/RecordAttachmentsPanel.tsx
@@ -23,6 +23,7 @@ import { createObjectStackUploadAdapter } from '@object-ui/providers';
 import { createAuthenticatedFetch } from '@object-ui/auth';
 import { useObjectTranslation, isPermissionError, classifyLoadError } from '@object-ui/react';
 import { usePermissions } from '@object-ui/permissions';
+import { resolveAffordance } from '@object-ui/core';
 
 /**
  * RecordAttachmentsPanel — generic record Attachments surface (objectstack-ai/objectstack#2727,
@@ -162,8 +163,12 @@ export const RecordAttachmentsPanel: React.FC<RecordAttachmentsPanelProps> = ({
   /**
    * objectui#12047 — the two write affordances follow the caller's grant on
    * `sys_attachment`, read from the permissions the console already holds
-   * (`usePermissions`; no request of its own) with the same `can(object, verb)`
-   * call the other console CRUD affordances make.
+   * (`usePermissions`; no request of its own). Since objectui#12082 they are
+   * the `attachmentUpload` / `attachmentDelete` rows of the affordance-to-grant
+   * map (`resolveAffordance` in `@object-ui/core`), the one table every console
+   * CRUD affordance reads. Both rows carry no CRUD-affordance bit: an upload
+   * and a delete go through the storage route, not `sys_attachment`'s generic
+   * data door, so that door's operation set says nothing about them.
    *
    * Upload needs `create`. Without it the three-step presigned flow below
    * commits a `sys_file` and only the final `sys_attachment` insert is
@@ -189,9 +194,9 @@ export const RecordAttachmentsPanel: React.FC<RecordAttachmentsPanelProps> = ({
    * change between render and click, and the parent-record gate judges the
    * record, which this verdict cannot see.
    */
-  const { can } = usePermissions();
-  const canUpload = can('sys_attachment', 'create');
-  const canDelete = can('sys_attachment', 'delete');
+  const perms = usePermissions();
+  const canUpload = resolveAffordance('attachmentUpload', { objectName: 'sys_attachment', perms }).allowed;
+  const canDelete = resolveAffordance('attachmentDelete', { objectName: 'sys_attachment', perms }).allowed;
 
   // Same base-URL convention as RecordDetailView's raw API fetches: the
   // Vite dev console proxies same-origin `/api` unless VITE_SERVER_URL
diff --git a/packages/app-shell/src/views/RecordDetailView.headerActionGates.test.tsx b/packages/app-shell/src/views/RecordDetailView.headerActionGates.test.tsx
index 86c8209dfb..145eb7a9b6 100644
--- a/packages/app-shell/src/views/RecordDetailView.headerActionGates.test.tsx
+++ b/packages/app-shell/src/views/RecordDetailView.headerActionGates.test.tsx
@@ -24,6 +24,13 @@
  * ...and the backward-compatible fallback: a missing effective set (unrestricted
  * object / old backend / no PermissionProvider) leaves today's bucket +
  * `userActions` decision untouched.
+ *
+ * objectui#12082: the gate is now the `recordEdit` / `recordDelete` rows of the
+ * affordance-to-grant map, which ask the operation set THEMSELVES from the
+ * caller's permissions (`getObjectApiOperations`) and AND the caller's object
+ * grant (`can(object, 'update' | 'delete')`). The rows above keep the grant
+ * open, so the operation set stays their only variable; the block at the end
+ * holds the grant half.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -33,50 +40,59 @@ import { resolveRecordHeaderActionGates } from './RecordDetailView';
 // isolates the effective-set intersection as the only variable.
 const platform = { name: 'crm_lead', managedBy: 'platform' };
 
+/** A caller whose effective operation set is `ops` and whose grant is `grants` (every verb by default). */
+const caller = (
+  ops: readonly string[] | null | undefined,
+  grants: Partial<Record<'create' | 'update' | 'delete', boolean>> = {},
+) => ({
+  can: (_object: string, verb: 'create' | 'update' | 'delete') => grants[verb] ?? true,
+  getObjectApiOperations: () => ops ?? undefined,
+});
+
 describe('resolveRecordHeaderActionGates — effective API operations (#3546)', () => {
   it('full-CRUD effective set → Edit and Delete both offered', () => {
     expect(
-      resolveRecordHeaderActionGates(platform, ['get', 'list', 'create', 'update', 'delete']),
+      resolveRecordHeaderActionGates(platform, caller(['get', 'list', 'create', 'update', 'delete'])),
     ).toEqual({ edit: true, delete: true });
   });
 
   it('read-only effective set → neither Edit nor Delete', () => {
-    expect(resolveRecordHeaderActionGates(platform, ['get', 'list'])).toEqual({
+    expect(resolveRecordHeaderActionGates(platform, caller(['get', 'list']))).toEqual({
       edit: false,
       delete: false,
     });
   });
 
   it('update-only effective set → Edit offered, Delete hidden', () => {
-    expect(resolveRecordHeaderActionGates(platform, ['get', 'list', 'update'])).toEqual({
+    expect(resolveRecordHeaderActionGates(platform, caller(['get', 'list', 'update']))).toEqual({
       edit: true,
       delete: false,
     });
   });
 
   it('delete-only effective set → Delete offered, Edit hidden', () => {
-    expect(resolveRecordHeaderActionGates(platform, ['get', 'list', 'delete'])).toEqual({
+    expect(resolveRecordHeaderActionGates(platform, caller(['get', 'list', 'delete']))).toEqual({
       edit: false,
       delete: true,
     });
   });
 
   it('empty effective set ("expose nothing") → neither', () => {
-    expect(resolveRecordHeaderActionGates(platform, [])).toEqual({ edit: false, delete: false });
+    expect(resolveRecordHeaderActionGates(platform, caller([]))).toEqual({ edit: false, delete: false });
   });
 
   it('undefined effective set (unrestricted / old backend) → bucket wins, both offered', () => {
-    expect(resolveRecordHeaderActionGates(platform, undefined)).toEqual({
+    expect(resolveRecordHeaderActionGates(platform, caller(undefined))).toEqual({
       edit: true,
       delete: true,
     });
-    // Omitting the argument entirely must behave identically — this is the
-    // pre-#3546 call shape every non-permission-aware caller still uses.
-    expect(resolveRecordHeaderActionGates(platform)).toEqual({ edit: true, delete: true });
+    // No permissions at all (no PermissionProvider) must behave identically:
+    // neither the operation set nor the grant can be asked, so both read open.
+    expect(resolveRecordHeaderActionGates(platform, undefined)).toEqual({ edit: true, delete: true });
   });
 
   it('null effective set is treated as absent, not as an empty set', () => {
-    expect(resolveRecordHeaderActionGates(platform, null)).toEqual({ edit: true, delete: true });
+    expect(resolveRecordHeaderActionGates(platform, caller(null))).toEqual({ edit: true, delete: true });
   });
 
   // ── Intersection, never union ────────────────────────────────────────────
@@ -85,13 +101,13 @@ describe('resolveRecordHeaderActionGates — effective API operations (#3546)',
     // server set must NOT re-open them — the server governs what it will
     // accept, the bucket governs what the product offers.
     expect(
-      resolveRecordHeaderActionGates({ name: 'sys_automation_run', managedBy: 'engine-owned' }, [
+      resolveRecordHeaderActionGates({ name: 'sys_automation_run', managedBy: 'engine-owned' }, caller([
         'get',
         'list',
         'create',
         'update',
         'delete',
-      ]),
+      ])),
     ).toEqual({ edit: false, delete: false });
   });
 
@@ -99,11 +115,11 @@ describe('resolveRecordHeaderActionGates — effective API operations (#3546)',
     // sys_user opens `edit` via userActions (ADR-0103), but a caller whose
     // effective set lacks `update` must not see the Edit CTA.
     const sysUser = { name: 'sys_user', managedBy: 'better-auth', userActions: { edit: true } };
-    expect(resolveRecordHeaderActionGates(sysUser, ['get', 'list', 'update'])).toEqual({
+    expect(resolveRecordHeaderActionGates(sysUser, caller(['get', 'list', 'update']))).toEqual({
       edit: true,
       delete: false,
     });
-    expect(resolveRecordHeaderActionGates(sysUser, ['get', 'list'])).toEqual({
+    expect(resolveRecordHeaderActionGates(sysUser, caller(['get', 'list']))).toEqual({
       edit: false,
       delete: false,
     });
@@ -111,20 +127,56 @@ describe('resolveRecordHeaderActionGates — effective API operations (#3546)',
 
   it('admin-editable `config` bucket intersects the same way', () => {
     const webhook = { name: 'sys_webhook', managedBy: 'config' };
-    expect(resolveRecordHeaderActionGates(webhook, ['get', 'list', 'update', 'delete'])).toEqual({
+    expect(resolveRecordHeaderActionGates(webhook, caller(['get', 'list', 'update', 'delete']))).toEqual({
       edit: true,
       delete: true,
     });
-    expect(resolveRecordHeaderActionGates(webhook, ['get', 'list', 'update'])).toEqual({
+    expect(resolveRecordHeaderActionGates(webhook, caller(['get', 'list', 'update']))).toEqual({
       edit: true,
       delete: false,
     });
   });
 
   it('a missing objectDef falls back to the platform default (no crash)', () => {
-    expect(resolveRecordHeaderActionGates(undefined, ['get', 'list', 'update'])).toEqual({
+    // With no object name there is no object to ask the operation set or the
+    // grant about, so both read open and the platform default stands. The page
+    // never reaches this gate without an `objectDef` (its not-found arm returns
+    // first); this row only holds that the gate does not throw.
+    expect(resolveRecordHeaderActionGates(undefined, caller(['get', 'list', 'update']))).toEqual({
+      edit: true,
+      delete: true,
+    });
+  });
+});
+
+describe('resolveRecordHeaderActionGates — the caller\'s object grant (objectui#12082)', () => {
+  const FULL_OPS = ['get', 'list', 'create', 'update', 'delete'];
+
+  it('objectui#12081 item 1: a caller with the update grant and `update` in the operation set gets Edit', () => {
+    // The hotclm reading: `allowEdit` held, `update` served. Edit shows; what
+    // hid it on 17.7.0 was the explain engine's record verdict, which the page
+    // ANDs after this gate (`useRecordEditable`), not this gate.
+    expect(resolveRecordHeaderActionGates(platform, caller(FULL_OPS, { update: true, delete: false }))).toEqual({
       edit: true,
       delete: false,
     });
   });
+
+  it('a read-only caller gets neither, even where the operation set serves both', () => {
+    expect(
+      resolveRecordHeaderActionGates(platform, caller(FULL_OPS, { create: false, update: false, delete: false })),
+    ).toEqual({ edit: false, delete: false });
+  });
+
+  it('a create-only caller gets neither: Edit reads the update grant, never the create one', () => {
+    expect(
+      resolveRecordHeaderActionGates(platform, caller(FULL_OPS, { create: true, update: false, delete: false })),
+    ).toEqual({ edit: false, delete: false });
+  });
+
+  it('the grant never re-opens what the bucket closed', () => {
+    expect(
+      resolveRecordHeaderActionGates({ name: 'sys_automation_run', managedBy: 'engine-owned' }, caller(FULL_OPS)),
+    ).toEqual({ edit: false, delete: false });
+  });
 });
diff --git a/packages/app-shell/src/views/RecordDetailView.tsx b/packages/app-shell/src/views/RecordDetailView.tsx
index 82c83eb15b..71b141ab98 100644
--- a/packages/app-shell/src/views/RecordDetailView.tsx
+++ b/packages/app-shell/src/views/RecordDetailView.tsx
@@ -16,14 +16,13 @@ import { useAuth, createAuthenticatedFetch } from '@object-ui/auth';
 import { usePermissions } from '@object-ui/permissions';
 import { useDisplayLocale } from '@object-ui/i18n';
 import { ActionProvider, useObjectTranslation, useObjectLabel, useActionTextLocalizer, usePageAssignment, RecordContextProvider, SchemaRenderer, DiscussionContextProvider, HighlightFieldsProvider, InlineEditProvider, useGlobalUndo, useDataInvalidation, notifyDataChanged, useRowPredicate, classifyLoadError } from '@object-ui/react';
-import { buildExpandFields, captureUpdateUndoData, recordDelete, resolveRecordIdParamSeed, userActionPredicates, withoutDeniedFields } from '@object-ui/core';
+import { buildExpandFields, captureUpdateUndoData, recordDelete, resolveAffordance, resolveRecordIdParamSeed, userActionPredicates, withoutDeniedFields, type AffordanceGrantPrincipal, type SchemaLike } from '@object-ui/core';
 import { toast } from 'sonner';
 import { useRecordPresence, PresenceAvatars } from '@object-ui/collaboration';
 import { Database, ChevronLeft, Lock, AlertTriangle, RotateCw } from 'lucide-react';
 import { MetadataPanel, useMetadataInspector } from './MetadataInspector.js';
 import { SkeletonDetail } from '../skeletons/index.js';
 import { ManagedByBadge } from '../components/ManagedByBadge.js';
-import { resolveEffectiveCrudAffordances } from '../utils/crudAffordances.js';
 import { deriveRelatedLists } from '../utils/deriveRelatedLists.js';
 import { stripDiscussionNodes, hasExplicitAttachments, hasExplicitApprovals } from '../utils/pageSchemaIntrospect.js';
 import { ActionConfirmDialog, type ConfirmDialogState } from './ActionConfirmDialog.js';
@@ -298,15 +297,18 @@ interface ReactionLedger {
  * object — the primary `sys_edit` CTA (which also gates the record-body
  * inline-edit session) and the `sys_delete` overflow item.
  *
- * [objectstack#3546] Each bit is the object's resolved CRUD affordance (lifecycle bucket +
- * `userActions`) INTERSECTED with the server-resolved effective API operation
- * set (`/me/permissions` `apiOperations`) — never a union. So a server grant can
- * never re-open an affordance the object's bucket closed, and a permissive
- * bucket default never survives the server denying `update` / `delete`. This is
- * the detail-surface end of the same intersection the list/toolbar surface
- * applies (objectui#2823). Passing `undefined` for `effectiveApiOperations`
- * (unrestricted object / old backend / no `PermissionProvider`) leaves the
- * bucket + `userActions` decision untouched — backward-compatible.
+ * Each bit is the `recordEdit` / `recordDelete` row of the affordance-to-grant
+ * map (`resolveAffordance` in `@object-ui/core`, objectui#12082): the object's
+ * resolved CRUD affordance (lifecycle bucket + `userActions`) INTERSECTED with
+ * the server-resolved effective API operation set (`/me/permissions`
+ * `apiOperations`, objectstack#3546) AND the caller's object grant — `update`
+ * for Edit, `delete` for Delete. Never a union: a server grant can never
+ * re-open an affordance the object's bucket closed, and a permissive bucket
+ * default never survives the server denying the operation or the caller
+ * lacking the grant. Before the map this gate read no grant at all, so a
+ * read-only caller was offered Edit until the record-level probe answered.
+ * With no `PermissionProvider` the grant and the operation set both read open,
+ * leaving the bucket + `userActions` decision as it always was.
  *
  * Exported so the gate can be unit-tested directly: the record page itself is
  * wired into routing, auth, presence and data fetching too deeply to render in
@@ -315,10 +317,17 @@ interface ReactionLedger {
  */
 export function resolveRecordHeaderActionGates(
   objectDef: unknown,
-  effectiveApiOperations?: readonly string[] | null,
+  perms: AffordanceGrantPrincipal | null | undefined,
 ): { edit: boolean; delete: boolean } {
-  const affordances = resolveEffectiveCrudAffordances(objectDef as any, effectiveApiOperations);
-  return { edit: affordances.edit, delete: affordances.delete };
+  const source = {
+    objectSchema: objectDef as SchemaLike | null | undefined,
+    objectName: (objectDef as { name?: string } | null | undefined)?.name,
+    perms,
+  };
+  return {
+    edit: resolveAffordance('recordEdit', source).allowed,
+    delete: resolveAffordance('recordDelete', source).allowed,
+  };
 }
 
 /** Gated copies of served rows, keyed on the served row object itself. */
@@ -1400,18 +1409,13 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   // are still loading (`isLoaded === false`, e.g. no PermissionProvider in a
   // standalone embed) the gate stays open — fail-open is safe because the
   // server enforces data access regardless; this is purely a UI/DX filter.
-  const { can: canOnObject, isLoaded: permissionsLoaded, getObjectApiOperations, systemPermissions } = perms;
-  // [objectstack#3546] Server-resolved effective API operation set for this object
-  // (`/me/permissions` `apiOperations`). Threaded as the 2nd arg into
-  // `resolveRecordHeaderActionGates` for the detail header's Edit/Delete and
-  // the record-body inline-edit gate, so the detail surface never offers an
-  // operation the server would 405 — the same intersection the list/toolbar
-  // surface already applies (objectui#2823). `undefined` (unrestricted object
-  // / old backend) leaves the bucket affordances untouched (backward-compatible).
-  const effectiveApiOperations = useMemo(
-    () => (objectDef ? getObjectApiOperations(objectDef.name) : undefined),
-    [objectDef, getObjectApiOperations],
-  );
+  const { can: canOnObject, isLoaded: permissionsLoaded, systemPermissions } = perms;
+  // [objectstack#3546] The server-resolved effective API operation set for this
+  // object (`/me/permissions` `apiOperations`) and the caller's object grant
+  // reach the header's Edit/Delete and the record-body inline-edit gate through
+  // `resolveRecordHeaderActionGates(objectDef, perms)`: the affordance-to-grant
+  // map asks both itself (objectui#12082), so this view no longer threads
+  // either one by hand.
   const childRelations = useMemo(
     () => deriveRelatedLists(objectDef, objects, {
       canRead: permissionsLoaded ? (name) => canOnObject(name, 'read') : undefined,
@@ -1448,7 +1452,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   //
   // objectui#4213. `userActions.edit` / `.delete` reached this header in their
   // BOOLEAN form and only in that form: the switch flows through
-  // `resolveRecordHeaderActionGates` → `resolveEffectiveCrudAffordances`, so
+  // `resolveRecordHeaderActionGates` → the affordance-to-grant map, so
   // `userActions: { delete: false }` hid Delete on the list row AND here. The
   // per-record OBJECT form — `{ visibleWhen: … }`, objectui#2614 — was
   // consumed by the list row alone (`plugin-grid`'s
@@ -2661,7 +2665,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   // menu permanently — Delete must never surface as an inline red button
   // just because an object has few actions.
   const synthSystemActions: ActionDef[] = (() => {
-    const objectAffordances = resolveRecordHeaderActionGates(objectDef, effectiveApiOperations);
+    const objectAffordances = resolveRecordHeaderActionGates(objectDef, perms);
     // Object-level gate AND the record-level verdict (objectstack#3821) AND the
     // object's per-record `userActions` predicate (objectui#4213 — see the
     // evaluation block beside `recordDeleteAllowed` above).
@@ -2914,7 +2918,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
             same reason `approvalLocked` does — a draft Save would reject. */}
         <InlineEditProvider
           canEdit={
-            resolveRecordHeaderActionGates(objectDef, effectiveApiOperations).edit
+            resolveRecordHeaderActionGates(objectDef, perms).edit
             && recordWriteAllowed
             && !approvalLocked
             && editVisible
diff --git a/packages/app-shell/src/views/RelatedRecordActionsBridge.tsx b/packages/app-shell/src/views/RelatedRecordActionsBridge.tsx
index c694d015fa..1436798208 100644
--- a/packages/app-shell/src/views/RelatedRecordActionsBridge.tsx
+++ b/packages/app-shell/src/views/RelatedRecordActionsBridge.tsx
@@ -81,10 +81,9 @@ import {
   type RelatedRecordHandlers,
   type RelatedRowActionDef,
 } from '@object-ui/react';
-import { evalRowPredicate, type ActionDef, type RowCrudPredicates } from '@object-ui/core';
+import { evalRowPredicate, resolveAffordance, type ActionDef, type RowCrudPredicates } from '@object-ui/core';
 import { actionRendersAt, type ActionLocation } from '@object-ui/types';
 import { usePermissions } from '@object-ui/permissions';
-import { resolveEffectiveCrudAffordances } from '../utils/crudAffordances.js';
 import { RECORD_FORM_PARAM, RECORD_FORM_OBJECT_PARAM, RECORD_FORM_LINK_PARAM, RECORD_TRAIL_PARAM, appendRecordTrail } from '../urlParams.js';
 
 /**
@@ -236,7 +235,7 @@ export function RelatedRecordActionsBridge({
   const navigate = useNavigate();
   const { execute } = useAction();
   const [, setSearchParams] = useSearchParams();
-  const { getObjectApiOperations, can } = usePermissions();
+  const perms = usePermissions();
   // [#4646] The host predicate scope (`features.*` / `os.user.*` / …), read
   // ONCE here rather than per resolved child list — `resolve` is hook-free by
   // construction (see the module note). This is the same scope
@@ -372,17 +371,21 @@ export function RelatedRecordActionsBridge({
         // Delete to a principal with no write grant on the child. `can()`
         // answers `true` with no `PermissionProvider`, which keeps standalone
         // embeds exactly where they were.
-        const rawAff = resolveEffectiveCrudAffordances(childDef, getObjectApiOperations(objectName));
-        const objectCanCreate = rawAff.create && can(objectName, 'create');
+        //
+        // [objectui#12082] All three layers are the child's rows of the
+        // affordance-to-grant map — `relatedNew`, `relatedRowEdit`,
+        // `relatedRowDelete` — resolved by `resolveAffordance` from
+        // `@object-ui/core`, the one verdict every console affordance reads.
+        const source = { objectSchema: childDef, objectName, perms };
+        const newVerdict = resolveAffordance('relatedNew', source);
+        const objectCanCreate = newVerdict.allowed;
         // [#4646] The per-scope layer, on top of the object-level verdict above.
         // Surfaced only when that verdict passed — the same posture
         // `resolveRowCrudAffordances` takes for the row predicates
         // (`editPredicates: canEdit ? aff.editPredicates : undefined`): a
         // predicate cannot re-open an affordance the bucket, the effective API
         // operations or the principal's grant already closed.
-        const createPredicates: RowCrudPredicates | undefined = objectCanCreate
-          ? rawAff.createPredicates
-          : undefined;
+        const createPredicates: RowCrudPredicates | undefined = newVerdict.predicates;
         /**
          * `visibleWhen` — fails CLOSED, and counts as DECLARED by `!= null`
          * rather than by truthiness, so `visibleWhen: false` hides "+ New"
@@ -416,10 +419,9 @@ export function RelatedRecordActionsBridge({
             parentObjectFields,
           );
         const aff = {
-          ...rawAff,
           create: objectCanCreate && createVisible,
-          edit: rawAff.edit && can(objectName, 'update'),
-          delete: rawAff.delete && can(objectName, 'delete'),
+          edit: resolveAffordance('relatedRowEdit', source).allowed,
+          delete: resolveAffordance('relatedRowDelete', source).allowed,
         };
         const handlers: RelatedRecordHandlers = {
           // Viewing a child record is always allowed when the list is visible.
@@ -488,7 +490,7 @@ export function RelatedRecordActionsBridge({
     // the #4646 create predicates: a parent record that changes (a save, a
     // status transition) must re-resolve "+ New" for every related list under
     // it, or the toolbar keeps answering for the record's previous state.
-    [objects, base, dataSource, localizeActionTexts, runRowAction, openChildForm, recordHref, openRecord, getObjectApiOperations, can, parentRecord, parentObjectFields, predicateScope, hasParentRecord],
+    [objects, base, dataSource, localizeActionTexts, runRowAction, openChildForm, recordHref, openRecord, perms, parentRecord, parentObjectFields, predicateScope, hasParentRecord],
   );
 
   return (
diff --git a/packages/app-shell/src/views/importTargetFields.test.ts b/packages/app-shell/src/views/importTargetFields.test.ts
index bee70ccf67..2d3e32de35 100644
--- a/packages/app-shell/src/views/importTargetFields.test.ts
+++ b/packages/app-shell/src/views/importTargetFields.test.ts
@@ -15,7 +15,7 @@ const fields = {
   locked_note: { type: 'text', label: '锁定备注', readonly: true },
 };
 
-const permsAllowing = (allow: (field: string, op: 'read' | 'write') => boolean): ImportFieldPerms => ({
+const permsAllowing = (allow: (field: string, op: 'read' | 'write' | 'create') => boolean): ImportFieldPerms => ({
   isLoaded: true,
   checkField: (_obj, field, op) => allow(field, op),
 });
@@ -44,10 +44,12 @@ describe('importTargetFields', () => {
     expect(names).not.toContain('child_sum');
   });
 
-  it('match-only targets are gated on FLS read; write targets on FLS write', () => {
-    // Reader who cannot write `name` and cannot read `locked_note`.
+  it('match-only targets are gated on FLS read; write targets on the FLS insert question', () => {
+    // Reader who cannot write `name` and cannot read `locked_note`. An explicit
+    // field-level refusal answers the insert question (`create`) and the update
+    // one (`write`) alike, so the stub refuses both.
     const out = importTargetFields('device', fields, permsAllowing((field, op) =>
-      op === 'write' ? field === 'slot' : field !== 'locked_note',
+      op === 'read' ? field !== 'locked_note' : field === 'slot',
     ));
     const names = out.map((f) => f.name);
     expect(names).toContain('slot'); // writable
@@ -58,6 +60,23 @@ describe('importTargetFields', () => {
     expect(out.find((f) => f.name === 'name')).toMatchObject({ matchOnly: true, required: false });
   });
 
+  it('objectui#12082: write targets ask the create question — a create-only caller keeps them', () => {
+    // A create-only grant with no field entries: the resolver answers `create`
+    // from `allowCreate` and `write` from `allowEdit`. Import inserts, and the
+    // Import affordance is itself gated on the create grant, so every
+    // insertable field stays a write target. Asking `write` here left this
+    // caller an Import wizard whose every target was match-only.
+    const createOnly = permsAllowing((_field, op) => op !== 'write');
+    const out = importTargetFields('device', fields, createOnly);
+    const byName = Object.fromEntries(out.map((f) => [f.name, f]));
+    expect(byName.name).toMatchObject({ required: true });
+    expect(byName.name.matchOnly).toBeUndefined();
+    expect(byName.slot.matchOnly).toBeUndefined();
+    // CONTROL — the edit-only mirror image loses them: `write` held, `create` refused.
+    const editOnly = importTargetFields('device', fields, permsAllowing((_field, op) => op !== 'create'));
+    expect(editOnly.find((f) => f.name === 'name')).toMatchObject({ matchOnly: true, required: false });
+  });
+
   it('without a loaded perms channel, falls back to schema-only derivation', () => {
     const out = importTargetFields('device', fields, { isLoaded: false, checkField: () => false });
     expect(out.map((f) => f.name).sort()).toEqual(
diff --git a/packages/app-shell/src/views/importTargetFields.ts b/packages/app-shell/src/views/importTargetFields.ts
index bc9699e0ab..f910e7cceb 100644
--- a/packages/app-shell/src/views/importTargetFields.ts
+++ b/packages/app-shell/src/views/importTargetFields.ts
@@ -8,7 +8,11 @@
  * downloadable template) rather than let a user map to a column the import
  * will reject. The FLS bit comes from the server-resolved /me/permissions
  * channel (checkField), not from the schema, which carries no per-caller
- * permission bits (objectstack#3661).
+ * permission bits (objectstack#3661). The question asked is the `listImport`
+ * row's of the affordance-to-grant map (objectui#12082): `create`, the
+ * server's insert rule — the Import affordance itself is gated on the create
+ * grant, so a create-only caller who is offered Import can map every field the
+ * insert accepts, instead of finding every target refused by the edit grant.
  *
  * Storage-backed but non-writable fields — autonumber and `readonly` — stay in
  * the list as MATCH-ONLY targets (#020: "update the row whose record number
@@ -19,6 +23,8 @@
  * matching leaks the column's values by existence.
  */
 
+import { resolveFieldAffordance } from '@object-ui/core';
+
 export interface ImportTargetField {
   name: string;
   label: string;
@@ -31,7 +37,7 @@ export interface ImportTargetField {
 /** Minimal slice of the permissions channel this helper consults. */
 export interface ImportFieldPerms {
   isLoaded: boolean;
-  checkField: (objectName: string, fieldName: string, op: 'read' | 'write') => boolean;
+  checkField(objectName: string, fieldName: string, op: 'read' | 'write' | 'create'): boolean;
 }
 
 const COMPUTED_TYPES = new Set(['formula', 'summary']);
@@ -47,7 +53,7 @@ export function importTargetFields(
     const writable = !computed
       && def?.type !== 'autonumber'
       && !def?.readonly
-      && (!perms?.isLoaded || perms.checkField(objectName, name, 'write'));
+      && resolveFieldAffordance('listImport', perms, objectName, name);
     const matchOnly = !writable && !computed
       && (!perms?.isLoaded || perms.checkField(objectName, name, 'read'));
     if (!writable && !matchOnly) continue;
diff --git a/packages/core/README.md b/packages/core/README.md
index c7902f7d46..8041c5db00 100644
--- a/packages/core/README.md
+++ b/packages/core/README.md
@@ -179,6 +179,44 @@ withoutDeniedFields({ account_code: 'A-1', salary: 100 }, policy, 'account', ['a
 - When nothing is withheld the SAME object comes back, so callers can tell the
   two cases apart by identity.
 
+### Affordance-to-grant map (`AFFORDANCE_GRANTS`, `resolveAffordance`)
+
+Every console affordance that offers a write — a create form's fields, the
+record header's Edit, a list's New and Import, a lookup's "Create new", a grid
+row's Delete, and the rest — reads the grant it exercises from ONE table,
+`AFFORDANCE_GRANTS` (objectui#12082). A row names the CRUD-affordance bit the
+affordance needs, the object grant it exercises (`create`, `update` or
+`delete`) and, for an affordance that offers fields, the field question it asks
+(`create` for an insert, `write` for an update).
+
+`resolveAffordance` is the one verdict: the object's managed-object policy, the
+server's effective API operation set and the caller's grant must all allow it,
+and the row's `userActions` predicates are surfaced only then.
+
+```typescript
+import { resolveAffordance, resolveFieldAffordance } from '@object-ui/core'
+
+// `perms` is structural: `usePermissions()` from `@object-ui/permissions`
+// satisfies it. With no provider mounted every grant reads open.
+const perms = {
+  isLoaded: true,
+  can: (_object: string, grant: 'create' | 'update' | 'delete') => grant === 'create',
+  checkField: (_object: string, _field: string, action: 'create' | 'write') => action === 'create',
+  getObjectApiOperations: () => undefined,
+}
+
+resolveAffordance('listNew', { objectSchema: null, objectName: 'orders', perms })
+// { allowed: true }  — the create grant is held
+resolveAffordance('recordEdit', { objectSchema: null, objectName: 'orders', perms })
+// { allowed: false } — Edit reads the update grant, which is not
+
+resolveFieldAffordance('createFormFields', perms, 'orders', 'title') // true
+resolveFieldAffordance('editFormFields', perms, 'orders', 'title')   // false
+```
+
+An affordance added later gets a row here and reads it through these functions;
+it does not spell its own `can(object, verb)`.
+
 ### Undo snapshot for an update (`captureUpdateUndoData`)
 
 An `undoable` update restores exactly the fields it wrote, from their values
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 98cbc64e71..cd0f047489 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -23,6 +23,9 @@ export * from './builder/schema-builder.js';
 export * from './utils/dom-props.js';
 export * from './utils/filter-converter.js';
 export * from './utils/managedBy.js';
+// The affordance-to-grant map (objectui#12082): every console affordance that
+// offers a write reads the grant it exercises from this one table.
+export * from './utils/affordanceGrants.js';
 export * from './utils/extract-records.js';
 // The non-grid row ceiling (objectui#7210), homed beside the `extractRecords`
 // it wraps by objectui#7508's ruling A′. `@object-ui/react` re-exports three of
diff --git a/packages/core/src/utils/affordanceGrants.ts b/packages/core/src/utils/affordanceGrants.ts
new file mode 100644
index 0000000000..58b60c8b7a
--- /dev/null
+++ b/packages/core/src/utils/affordanceGrants.ts
@@ -0,0 +1,246 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * The affordance-to-grant map (objectui#12082): ONE table naming, for every
+ * console affordance that offers a write, the grant the caller must hold for
+ * it — and ONE resolver every such affordance reads.
+ *
+ * ## The family this closes
+ *
+ * Each console surface used to decide on its own which grant its affordance
+ * reads, and each surface that decided wrongly was found and fixed alone
+ * (objectui#4296, #10107, #11000, #12047). objectui#12082 is the member that
+ * hurt most: a create form gated its fields on the EDIT grant, so a
+ * create-only role could not fill the form it was allowed to submit. The same
+ * pass found the record header not reading the update grant at all, and a
+ * lookup offering "Create new" with no grant read either (objectui#12081). The
+ * cause is one shape — an affordance spelling its own permission logic — so
+ * the fix is one table every affordance reads, not another one-off repair.
+ *
+ * ## What a row says
+ *
+ * `crud` — the resolved CRUD-affordance bit the affordance also needs: the
+ * object's managed-object policy (ADR-0103, the spec's
+ * `resolveCrudAffordances`) intersected with the server's effective API
+ * operation set (`/me/permissions` `apiOperations`, objectstack#3391), both
+ * through {@link resolveEffectiveCrudAffordances}. `null` for an affordance
+ * whose write does not go through the object's generic data door (an
+ * attachment upload goes through the storage route; the import template has
+ * its own endpoint), so that door's operation set says nothing about it.
+ *
+ * `grant` — the caller's object grant it exercises, asked as `can(object,
+ * grant)` (`MePermissionsProvider` maps `create` → `allowCreate`, `update` →
+ * `allowEdit`, `delete` → `allowDelete`).
+ *
+ * `field` — for an affordance that offers FIELDS to write, the field-level
+ * question asked of each one: `create` for an insert, `write` for an update.
+ * They differ only for a field the permission set does not mention, which the
+ * server's field step lets through so that object admission decides: on an
+ * insert that is `allowCreate`, on an update `allowEdit`. A field the set marks
+ * `editable: false` is refused on both, and the resolver answers that the same
+ * way for both questions. So a create form follows what the server enforces on
+ * insert, and adds no rule the server does not have.
+ *
+ * ## The verdict
+ *
+ * An affordance shows when the managed-object policy, the effective API
+ * operation set AND the caller's grant all allow it ({@link resolveAffordance}).
+ * Its `userActions` predicates (the #2614 object form) are surfaced only then:
+ * a predicate narrows, and never re-opens what policy, operation set or grant
+ * closed.
+ *
+ * ## Fail-open, as before
+ *
+ * With no permission provider mounted, `usePermissions()` answers `can` with
+ * `true` and `isLoaded` with `false`, so every grant here reads open and the
+ * field question is not asked at all — a standalone embed, a designer preview
+ * and a public surface behave as they did before permissions existed, and the
+ * server still enforces (the `fieldWriteGate.ts` contract in
+ * `@object-ui/plugin-form`). The policy half is not a per-principal answer and
+ * does not fail open with it, exactly as `resolveEffectiveCrudAffordances`
+ * never did.
+ *
+ * ## Adding an affordance
+ *
+ * Add its row here and read it through {@link resolveAffordance} (or
+ * {@link resolveFieldAffordance} for fields). The enumeration pin in
+ * `@object-ui/plugin-form` (`affordanceGrantMap-12082.test.tsx`) runs every row
+ * against four grant shapes and holds the row set to its own expectation table,
+ * and its census refuses a console source file that reads a CRUD grant without
+ * this map.
+ */
+
+import {
+  resolveEffectiveCrudAffordances,
+  type CrudAffordances,
+  type RowCrudPredicates,
+  type SchemaLike,
+} from './managedBy.js';
+
+/** The caller's object grant an affordance exercises. */
+export type AffordanceGrant = 'create' | 'update' | 'delete';
+
+/**
+ * The field-level question a field affordance asks: `create` follows the
+ * server's insert rule, `write` its update rule.
+ */
+export type FieldAffordanceGrant = 'create' | 'write';
+
+/** One row of {@link AFFORDANCE_GRANTS}. */
+export interface AffordanceGrantRow {
+  /** The resolved CRUD-affordance bit it also needs, or `null` for none. */
+  readonly crud: 'create' | 'import' | 'edit' | 'delete' | null;
+  /** The caller's object grant it exercises. */
+  readonly grant: AffordanceGrant;
+  /** For an affordance that offers fields to write: the field-level question. */
+  readonly field?: FieldAffordanceGrant;
+}
+
+/**
+ * Every console affordance that offers a write → the grant it reads. Each
+ * row's comment names the affordance and the object the grant is asked of;
+ * where no object is named, it is the object the surface shows.
+ */
+export const AFFORDANCE_GRANTS = {
+  /** A create form's fields (every `ObjectForm` layout) and its form-wide lock. */
+  createFormFields: { crud: 'create', grant: 'create', field: 'create' },
+  /** An edit form's fields (every `ObjectForm` layout) and its form-wide lock. */
+  editFormFields: { crud: 'edit', grant: 'update', field: 'write' },
+  /** The record page's Edit — the header CTA and the record body's in-place editing. */
+  recordEdit: { crud: 'edit', grant: 'update' },
+  /** The record page's Delete. */
+  recordDelete: { crud: 'delete', grant: 'delete' },
+  /** An object list's New (toolbar button and the phone "+"). */
+  listNew: { crud: 'create', grant: 'create' },
+  /** An object list's Import, and the import wizard's writable target fields. */
+  listImport: { crud: 'import', grant: 'create', field: 'create' },
+  /** The import wizard's template download — its endpoint answers 403 without the create grant. */
+  importTemplate: { crud: null, grant: 'create' },
+  /** A list's inline (in-cell) editing. */
+  listInlineEdit: { crud: 'edit', grant: 'update' },
+  /** A list's bulk Delete. */
+  listBulkDelete: { crud: 'delete', grant: 'delete' },
+  /** A grid row's Edit. */
+  rowEdit: { crud: 'edit', grant: 'update' },
+  /** A grid row's Delete. */
+  rowDelete: { crud: 'delete', grant: 'delete' },
+  /** A grid's inline add-record row. */
+  gridAddRow: { crud: 'create', grant: 'create' },
+  /** A related list's "+ New", asked of the CHILD object. */
+  relatedNew: { crud: 'create', grant: 'create' },
+  /** A related list row's Edit, asked of the child object. */
+  relatedRowEdit: { crud: 'edit', grant: 'update' },
+  /** A related list row's Delete, asked of the child object. */
+  relatedRowDelete: { crud: 'delete', grant: 'delete' },
+  /** A lookup picker's "Create new", asked of the TARGET object. */
+  lookupCreateNew: { crud: 'create', grant: 'create' },
+  /** The record Attachments panel's Upload, asked of `sys_attachment` (storage route, not the data door). */
+  attachmentUpload: { crud: null, grant: 'create' },
+  /** The record Attachments panel's per-row delete, asked of `sys_attachment`. */
+  attachmentDelete: { crud: null, grant: 'delete' },
+} as const satisfies Record<string, AffordanceGrantRow>;
+
+/** A console affordance with a row in {@link AFFORDANCE_GRANTS}. */
+export type ConsoleAffordance = keyof typeof AFFORDANCE_GRANTS;
+
+/** The affordances that offer fields to write. */
+export type FieldAffordance = {
+  [K in ConsoleAffordance]: (typeof AFFORDANCE_GRANTS)[K] extends { field: FieldAffordanceGrant } ? K : never;
+}[ConsoleAffordance];
+
+/**
+ * The principal surface {@link resolveAffordance} reads — structurally the
+ * subset of `usePermissions()` that answers it, declared here so this module
+ * stays React-free and binds to no provider.
+ */
+export interface AffordanceGrantPrincipal {
+  /** `usePermissions().can` — `true` for every grant with no provider mounted. */
+  can(object: string, grant: AffordanceGrant): boolean;
+  /** The server's effective API operation set for an object; `undefined` leaves the policy as it is. */
+  getObjectApiOperations?(object: string): readonly string[] | undefined;
+}
+
+/** The principal surface {@link resolveFieldAffordance} reads. */
+export interface FieldAffordancePrincipal {
+  /** `false` with no provider mounted: no field question is asked. */
+  isLoaded: boolean;
+  checkField(object: string, field: string, action: FieldAffordanceGrant): boolean;
+}
+
+/** What an affordance is resolved against. */
+export interface AffordanceSource {
+  /** The schema of the object the grant is asked of; `null` reads as the default bucket. */
+  objectSchema?: SchemaLike | null;
+  /** That object's name. Absent: no grant and no operation set can be asked, so both read open. */
+  objectName?: string | null;
+  /** The caller's permissions; absent reads open, as no provider does. */
+  perms?: AffordanceGrantPrincipal | null;
+}
+
+/** One affordance's verdict. */
+export interface AffordanceVerdict {
+  /** Policy ∧ effective API operation set ∧ the caller's grant. */
+  readonly allowed: boolean;
+  /** The row's `userActions` predicate envelope — only when {@link allowed}. */
+  readonly predicates?: RowCrudPredicates;
+}
+
+const PREDICATES: Record<NonNullable<AffordanceGrantRow['crud']>, keyof CrudAffordances> = {
+  create: 'createPredicates',
+  import: 'importPredicates',
+  edit: 'editPredicates',
+  delete: 'deletePredicates',
+};
+
+/**
+ * Resolve one affordance: its row's CRUD-affordance bit (managed-object policy
+ * ∧ the effective API operation set) AND the caller's grant.
+ */
+export function resolveAffordance(
+  affordance: ConsoleAffordance,
+  { objectSchema, objectName, perms }: AffordanceSource = {},
+): AffordanceVerdict {
+  const row: AffordanceGrantRow = AFFORDANCE_GRANTS[affordance];
+  let predicates: RowCrudPredicates | undefined;
+  if (row.crud !== null) {
+    const ops = objectName ? perms?.getObjectApiOperations?.(objectName) : undefined;
+    const crud = resolveEffectiveCrudAffordances(objectSchema, ops);
+    if (!crud[row.crud]) return { allowed: false };
+    predicates = crud[PREDICATES[row.crud]] as RowCrudPredicates | undefined;
+  }
+  if (objectName && perms && !perms.can(objectName, row.grant)) return { allowed: false };
+  return predicates ? { allowed: true, predicates } : { allowed: true };
+}
+
+/**
+ * The field-level half of a field affordance: may the caller write `field`
+ * through it? Asks the resolver the row's question (`create` or `write`); with
+ * no provider mounted (`isLoaded` false) it asks nothing and answers `true`.
+ */
+export function resolveFieldAffordance(
+  affordance: FieldAffordance,
+  perms: FieldAffordancePrincipal | null | undefined,
+  objectName: string,
+  field: string,
+): boolean {
+  if (!perms?.isLoaded) return true;
+  return perms.checkField(objectName, field, AFFORDANCE_GRANTS[affordance].field);
+}
+
+/**
+ * The form row for a form's mode: a create form's fields ask the create
+ * question, every other form that writes asks the edit question, and a `view`
+ * form writes nothing (`undefined`).
+ */
+export function formFieldsAffordance(
+  mode: string | undefined,
+): 'createFormFields' | 'editFormFields' | undefined {
+  if (mode === 'view') return undefined;
+  return mode === 'create' ? 'createFormFields' : 'editFormFields';
+}
diff --git a/packages/fields/src/widgets/LookupField.createGrant-12082.test.tsx b/packages/fields/src/widgets/LookupField.createGrant-12082.test.tsx
new file mode 100644
index 0000000000..c6841934eb
--- /dev/null
+++ b/packages/fields/src/widgets/LookupField.createGrant-12082.test.tsx
@@ -0,0 +1,124 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * A lookup picker offers "Create new" only to a caller who may create the
+ * TARGET object (objectui#12082, folding in objectui#12081 item 6).
+ *
+ * ## The defect
+ *
+ * The built-in quick-create writes a record of the object the field
+ * references. Its button read `allowCreate` — whether the field OFFERS
+ * quick-create — and whether a host could carry the create out, and no grant
+ * at all. Measured in a metadata app's intake wizard: a requester whose
+ * permission set cannot create contract types was offered "Create new" in the
+ * contract-type picker, and the create would have been refused.
+ *
+ * ## What it reads now
+ *
+ * The `lookupCreateNew` row of the affordance-to-grant map in `@object-ui/core`,
+ * asked of the TARGET: its managed-object policy, the server's effective API
+ * operation set for it, and the caller's create grant on it.
+ *
+ * ## The rows
+ *
+ * - the card's reading: create denied on the target → no "Create new";
+ * - CONTROL, create granted on the target → "Create new" shows (a gate that
+ *   always hid it cannot pass);
+ * - the grant read is the TARGET's: create on the form's own object does not
+ *   open it, and its absence there does not close it;
+ * - the target's effective operation set without `create` closes it;
+ * - no permission provider at all leaves it shown (fail-open — the existing
+ *   quick-create rows in `complex-widgets.test.tsx` run provider-less).
+ */
+import { render, screen, fireEvent, waitFor, act, cleanup } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+import { LookupField } from './LookupField';
+
+afterEach(cleanup);
+
+const TARGET = 'clm_contract_type';
+const SOURCE = 'clm_contract';
+
+const field = {
+  name: 'contract_type',
+  label: 'Contract Type',
+  reference: TARGET,
+  reference_field: 'name',
+} as any;
+
+function makeDataSource() {
+  return {
+    find: vi.fn().mockResolvedValue({ data: [], total: 0 }),
+    findOne: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+  };
+}
+
+type Grant = { allowCreate: boolean; apiOperations?: string[] };
+
+/** `/me/permissions` with `target` and `source` grants on the two objects. */
+const envelope = (target: Grant, source: Grant = { allowCreate: true }): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-requester',
+  tenantId: null,
+  roles: ['clm_requester'],
+  permissionSets: ['clm_requester'],
+  objects: {
+    [TARGET]: { allowRead: true, allowEdit: false, allowDelete: false, ...target },
+    [SOURCE]: { allowRead: true, allowEdit: true, allowDelete: false, ...source },
+  },
+  fields: {},
+});
+
+/** Open the picker, type a query that matches nothing, and report whether "Create new" is offered. */
+async function offersCreateNew(perms: MePermissionsResponse | null): Promise<boolean> {
+  const ds = makeDataSource();
+  const widget = <LookupField field={field} value={undefined} onChange={vi.fn()} readonly={false} dataSource={ds as any} />;
+  render(perms ? <MePermissionsProvider initialPermissions={perms}>{widget}</MePermissionsProvider> : widget);
+  await act(async () => {
+    fireEvent.click(screen.getByRole('button', { name: /Select/i }));
+  });
+  const input = await screen.findByRole('combobox');
+  await act(async () => {
+    fireEvent.change(input, { target: { value: 'NDA' } });
+  });
+  await waitFor(() => expect(screen.getByText('No options found')).toBeInTheDocument());
+  return screen.queryByText(/Create new/) !== null;
+}
+
+describe('LookupField "Create new" reads the target object\'s create grant (objectui#12082)', () => {
+  it('objectui#12081 item 6: create denied on the target → no "Create new"', async () => {
+    expect(await offersCreateNew(envelope({ allowCreate: false }))).toBe(false);
+  });
+
+  it('CONTROL — create granted on the target → "Create new" shows', async () => {
+    expect(await offersCreateNew(envelope({ allowCreate: true }))).toBe(true);
+  });
+
+  it('the grant read is the TARGET\'s, not the form object\'s', async () => {
+    expect(await offersCreateNew(envelope({ allowCreate: false }, { allowCreate: true }))).toBe(false);
+    cleanup();
+    expect(await offersCreateNew(envelope({ allowCreate: true }, { allowCreate: false }))).toBe(true);
+  });
+
+  it('the target\'s effective operation set without `create` closes it, whatever the grant', async () => {
+    expect(
+      await offersCreateNew(envelope({ allowCreate: true, apiOperations: ['get', 'list', 'update'] })),
+    ).toBe(false);
+  });
+
+  it('no permission provider → shown (fail-open; the server still enforces)', async () => {
+    expect(await offersCreateNew(null)).toBe(true);
+  });
+});
diff --git a/packages/fields/src/widgets/LookupField.tsx b/packages/fields/src/widgets/LookupField.tsx
index b45a87aec8..ab418c7408 100644
--- a/packages/fields/src/widgets/LookupField.tsx
+++ b/packages/fields/src/widgets/LookupField.tsx
@@ -18,7 +18,7 @@ import type { RecordPickerFilterColumn } from './RecordPickerDialog.js';
 import { PeoplePicker } from './PeoplePicker.js';
 import { useRecordQuery } from './useRecordQuery.js';
 import { deriveLookupColumns } from './deriveLookupColumns.js';
-import { buildExpandFields, getRecordDisplayName, mergeFilterNodes, toPredicateRecord, withoutDeniedFields } from '@object-ui/core';
+import { buildExpandFields, getRecordDisplayName, mergeFilterNodes, resolveAffordance, toPredicateRecord, withoutDeniedFields } from '@object-ui/core';
 import { getRecentLookupIds, pushRecentLookupId } from './recentLookups.js';
 import { getPersonInitials } from './personDisplay.js';
 import { getCellRendererResolver } from './_cell-renderer-bridge.js';
@@ -1157,12 +1157,27 @@ export function LookupField({ value, onChange, field, readonly, error: fieldErro
   // returns a local runner and useHasActionProvider is false.
   const { execute } = useAction();
   const hasActionProvider = useHasActionProvider();
-  const canCreate = !!onCreateNew || (allowCreate && (hasActionProvider || hasDataSource));
+  // objectui#12082 (objectui#12081 item 6) — the built-in quick-create writes a
+  // record of the TARGET object, so it reads that object's `lookupCreateNew`
+  // row of the affordance-to-grant map: its managed-object policy, the
+  // server's effective API operation set for it, and the caller's create grant
+  // on it. `allowCreate` above says the field OFFERS quick-create; it was never
+  // a grant, and nothing here used to ask for one, so a requester who cannot
+  // create contract types was offered "Create new" for one. The schema is the
+  // target's once fetched (`null` until then reads as the default bucket); with
+  // no permission provider the grant reads open. A host-supplied
+  // `onCreateNew` is the host's own affordance and is not gated here.
+  const createGranted = resolveAffordance('lookupCreateNew', {
+    objectSchema: refObjectSchema,
+    objectName: referenceTo,
+    perms,
+  }).allowed;
+  const canCreate = !!onCreateNew || (allowCreate && createGranted && (hasActionProvider || hasDataSource));
   const handleCreateNew = useCallback(
     async (q: string) => {
       const label = (q || '').trim();
       if (onCreateNew) { onCreateNew(label); setIsOpen(false); return; }
-      if (!allowCreate || !referenceTo) return;
+      if (!allowCreate || !createGranted || !referenceTo) return;
       setCreateError(null);
 
       // Preferred path — open the referenced object's FULL create form so the
@@ -1215,7 +1230,7 @@ export function LookupField({ value, onChange, field, readonly, error: fieldErro
         setCreating(false);
       }
     },
-    [onCreateNew, allowCreate, referenceTo, hasActionProvider, execute, dataSource, displayField, declaredDisplayField, idField, effectiveDescriptionField, refObjectSchema, handleSelect, perms],
+    [onCreateNew, allowCreate, createGranted, referenceTo, hasActionProvider, execute, dataSource, displayField, declaredDisplayField, idField, effectiveDescriptionField, refObjectSchema, handleSelect, perms],
   );
 
   /**
diff --git a/packages/permissions/README.md b/packages/permissions/README.md
index d059fe8dae..33cf62967a 100644
--- a/packages/permissions/README.md
+++ b/packages/permissions/README.md
@@ -137,6 +137,33 @@ function DiscountField() {
 }
 ```
 
+### `checkField` — which write a field question is about
+
+`usePermissions().checkField(object, field, action)` answers three questions.
+`'read'` asks whether the caller may see the field. `'write'` asks whether they
+may change it on an EXISTING record (the server's update rule) and `'create'`
+whether they may set it on a NEW one (its insert rule). The two write questions
+differ only for a field the permission set does not mention: the server lets
+such a field through and object admission decides, so `'write'` falls back to
+the object's `allowEdit` and `'create'` to its `allowCreate`. An explicit
+field-level entry answers both the same way.
+
+```tsx
+import { usePermissions } from '@object-ui/permissions';
+
+function TitleInput({ mode }: { mode: 'create' | 'edit' }) {
+  const { checkField } = usePermissions();
+  // A create form asks the create question: a role that may create orders but
+  // not edit them can still fill a new order's title.
+  const writable = checkField('orders', 'title', mode === 'create' ? 'create' : 'write');
+  return <input disabled={!writable} />;
+}
+```
+
+Console affordances do not pick the question themselves: they read it from the
+affordance-to-grant map in `@object-ui/core` (`AFFORDANCE_GRANTS`,
+`resolveAffordance`, `resolveFieldAffordance`).
+
 ### PermissionGuard
 
 Conditionally renders children based on permissions. `fallback` selects the
diff --git a/packages/permissions/src/MePermissionsProvider.tsx b/packages/permissions/src/MePermissionsProvider.tsx
index b9d4ceab10..0fe29ed70d 100644
--- a/packages/permissions/src/MePermissionsProvider.tsx
+++ b/packages/permissions/src/MePermissionsProvider.tsx
@@ -300,19 +300,24 @@ export function MePermissionsProvider({
   const dataKey: object = data ?? NO_DATA;
 
   const checkField = CHECK_FIELD([dataKey], () =>
-    (object: string, field: string, action: 'read' | 'write'): boolean => {
+    (object: string, field: string, action: 'read' | 'write' | 'create'): boolean => {
       if (!data) return false; // fail-closed
       // Normalize casing — backend stores keys lowercase but callers may
       // pass schema.objectName as "Account" / "account" interchangeably.
       const objKey = (object ?? '').toLowerCase();
       const key = `${objKey}.${field}`;
       const fieldPerm = data.fields?.[key] ?? data.fields?.[`${object}.${field}`];
+      // An explicit entry answers `write` and `create` alike: the server's
+      // field step refuses a non-editable field on insert and update both.
       if (fieldPerm) {
         return action === 'read'
           ? fieldPerm.readable !== false
           : fieldPerm.editable !== false;
       }
-      // No explicit field-level override → defer to object-level perms.
+      // No explicit field-level override → defer to object-level perms: the
+      // field step lets the field through and object admission decides, so
+      // the answer is the grant of the operation asked about (objectui#12082)
+      // — `allowCreate` on an insert, `allowEdit` on an update.
       const objPerm = data.objects?.[objKey] ?? data.objects?.[object] ?? data.objects?.['*'];
       if (!objPerm) {
         // [objectstack-ai/objectstack#2926 ④] Unknown-object default is authentication-gated:
@@ -326,8 +331,9 @@ export function MePermissionsProvider({
         //    would brick public forms.
         return data.authenticated !== true;
       }
-      return action === 'read'
-        ? objPerm.allowRead !== false
+      if (action === 'read') return objPerm.allowRead !== false;
+      return action === 'create'
+        ? objPerm.allowCreate !== false
         : objPerm.allowEdit !== false;
     },
   );
diff --git a/packages/permissions/src/PermissionContext.ts b/packages/permissions/src/PermissionContext.ts
index c3b066eaf5..9dff8b1f80 100644
--- a/packages/permissions/src/PermissionContext.ts
+++ b/packages/permissions/src/PermissionContext.ts
@@ -12,8 +12,17 @@ import type { PermissionAction, PermissionCheckResult, FieldLevelPermission } fr
 export interface PermissionContextValue {
   /** Check if action is allowed on object */
   check: (object: string, action: PermissionAction, record?: Record<string, unknown>) => PermissionCheckResult;
-  /** Check field-level permissions */
-  checkField: (object: string, field: string, action: 'read' | 'write') => boolean;
+  /**
+   * Check field-level permissions.
+   *
+   * `write` asks whether the caller may change the field on an existing record
+   * (the server's update rule); `create` whether they may set it on a new one
+   * (its insert rule, objectui#12082). The two differ only for a field the
+   * permission set does not mention: the server's field step lets it through
+   * and object admission decides — `allowEdit` on an update, `allowCreate` on
+   * an insert. An explicit field-level entry answers both the same way.
+   */
+  checkField: (object: string, field: string, action: 'read' | 'write' | 'create') => boolean;
   /** Get field permissions for an object */
   getFieldPermissions: (object: string) => FieldLevelPermission[];
   /** Get row filter for an object */
diff --git a/packages/permissions/src/PermissionProvider.tsx b/packages/permissions/src/PermissionProvider.tsx
index 9bdddca471..900cb10b56 100644
--- a/packages/permissions/src/PermissionProvider.tsx
+++ b/packages/permissions/src/PermissionProvider.tsx
@@ -100,10 +100,15 @@ export function PermissionProvider({
   );
 
   const checkField = CHECK_FIELD([permissions, userRoles], () =>
-    (object: string, field: string, action: 'read' | 'write'): boolean => {
+    (object: string, field: string, action: 'read' | 'write' | 'create'): boolean => {
       const objectConfig = permissions.find((p) => p.object === object);
       if (!objectConfig) return true; // No config means no restrictions
 
+      // A role's field permission has one write bit, `write`, and no
+      // per-operation split: setting a field on a new record (`create`) reads
+      // it exactly as changing it on an existing one does, and a field the
+      // config does not mention keeps this provider's default allow for both.
+
       // Same guard as `evaluator.ts` (objectui#4812): a config that omits the
       // required `roles` must deny or fall through, never throw. Here the
       // fall-through lands on this function's own documented default (allow),
diff --git a/packages/plugin-detail/src/DetailView.tsx b/packages/plugin-detail/src/DetailView.tsx
index 6b32583e7a..089bfcad9b 100644
--- a/packages/plugin-detail/src/DetailView.tsx
+++ b/packages/plugin-detail/src/DetailView.tsx
@@ -44,7 +44,7 @@ import { ActivityTimeline } from './ActivityTimeline';
 import { HistoryTimeline } from './HistoryTimeline';
 import { RecordMetaFooter } from './RecordMetaFooter';
 import { SchemaRenderer, SchemaErrorBoundary, toRenderableSchema, useSafeFieldLabel, useDataInvalidation, useInlineEdit, useRowPredicate } from '@object-ui/react';
-import { buildExpandFields, declaredNameField, getRecordDisplayName, formatTitleTemplate, recordDisplayValueAt, toDisplayDate, userActionPredicates, withoutDeniedFields } from '@object-ui/core';
+import { buildExpandFields, declaredNameField, getRecordDisplayName, formatTitleTemplate, recordDisplayValueAt, resolveAffordance, toDisplayDate, userActionPredicates, withoutDeniedFields } from '@object-ui/core';
 import { usePermissions } from '@object-ui/permissions';
 import { useLocalization, useDisplayLocale, resolveFieldCurrency } from '@object-ui/i18n';
 import type { DetailViewSchema, DataSource, ActionSchema, SchemaNode } from '@object-ui/types';
@@ -388,13 +388,24 @@ export const DetailView: React.FC<DetailViewProps> = ({
    * Only consulted when the object-level check already passes — when it
    * doesn't, the buttons are hidden anyway and the request would be waste.
    * Fails open (see `useRecordEditable`); the server remains the authority.
+   *
+   * [objectui#12082] The object-level check is the `recordEdit` /
+   * `recordDelete` row of the affordance-to-grant map (`resolveAffordance` in
+   * `@object-ui/core`) — the same rows the console record page's header reads:
+   * the server's effective operation set and the caller's grant. The row's
+   * third layer, the object's own policy (bucket + the BOOLEAN `userActions`
+   * form), is deliberately left out here (`objectSchema: null`): on this
+   * surface it is the HOST's channel, lowered into `showEdit` / `showDelete`,
+   * and this view must not grow a second definition of it (objectui#4419,
+   * pinned in `DetailView.userActionPredicates.test.tsx`). With no provider
+   * mounted the grant and the operation set read open.
    */
   const objectAllowsUpdate = React.useMemo(
-    () => !perms?.isLoaded || !rawSchema.objectName || perms.can(rawSchema.objectName, 'update'),
+    () => resolveAffordance('recordEdit', { objectSchema: null, objectName: rawSchema.objectName, perms }).allowed,
     [perms, rawSchema.objectName],
   );
   const objectAllowsDelete = React.useMemo(
-    () => !perms?.isLoaded || !rawSchema.objectName || perms.can(rawSchema.objectName, 'delete'),
+    () => resolveAffordance('recordDelete', { objectSchema: null, objectName: rawSchema.objectName, perms }).allowed,
     [perms, rawSchema.objectName],
   );
   const recordId =
diff --git a/packages/plugin-detail/src/renderers/record-details.tsx b/packages/plugin-detail/src/renderers/record-details.tsx
index 3eba0bfb9b..9146423aee 100644
--- a/packages/plugin-detail/src/renderers/record-details.tsx
+++ b/packages/plugin-detail/src/renderers/record-details.tsx
@@ -20,7 +20,7 @@ import {
   declaredNameField,
   deriveTitleField,
   formatTitleTemplate,
-  isObjectInlineEditable,
+  resolveAffordance,
   type FieldRulePredicate,
   recordDisplayValueAt,
   resolveFieldRuleState,
@@ -933,8 +933,7 @@ export const RecordDetailsRenderer: React.FC<RecordDetailsRendererProps> = ({
   // user-editable, so the per-field double-click / pencil affordances must not
   // be offered on them — unless the object opened `userActions.edit` (the
   // ADR-0103 admin/user-writable set). This is the shared resolved `edit`
-  // affordance from `@object-ui/core` (`isObjectInlineEditable`), the single
-  // source of truth — formerly a hand-mirrored `NON_EDITABLE_BUCKETS` set kept
+  // affordance from `@object-ui/core`, the single source of truth — formerly a hand-mirrored `NON_EDITABLE_BUCKETS` set kept
   // in lockstep by hand because plugin-detail can't depend on app-shell.
   // Authors can still force-disable with `inlineEdit: false`.
   // [objectstack#3546] Also AND inline-editability with the server's effective API
@@ -942,10 +941,17 @@ export const RecordDetailsRenderer: React.FC<RecordDetailsRendererProps> = ({
   // record body must not offer double-click/pencil editing the server would
   // 405. `undefined` (unrestricted / old backend) leaves the bucket affordance
   // untouched (backward-compatible).
-  const objectInlineEditable = isObjectInlineEditable(
-    objSchema,
-    perms?.getObjectApiOperations?.(objectName),
-  );
+  // [objectui#12082] …and AND the caller's update grant: this is the
+  // `recordEdit` row of the affordance-to-grant map (`resolveAffordance` from
+  // `@object-ui/core`), the SAME row the record page's header Edit reads, so
+  // the body's pencils and the header CTA cannot disagree. Before the map the
+  // body read no grant, so a standalone `record:details` offered in-place
+  // editing to a read-only caller. With no provider the grant reads open.
+  const objectInlineEditable = resolveAffordance('recordEdit', {
+    objectSchema: objSchema,
+    objectName,
+    perms,
+  }).allowed;
   const inlineEditDefault = (schema.inlineEdit ?? true) && objectInlineEditable;
 
   const synthesized: any = {
diff --git a/packages/plugin-form/src/DrawerForm.tsx b/packages/plugin-form/src/DrawerForm.tsx
index 0a99730198..772bde0e93 100644
--- a/packages/plugin-form/src/DrawerForm.tsx
+++ b/packages/plugin-form/src/DrawerForm.tsx
@@ -549,7 +549,7 @@ export const DrawerForm: React.FC<DrawerFormProps> = ({
       // retains state for unmounted/disabled fields, so the render gate above
       // is not enough on its own (`80c54122e`).
       const payload = sanitizeFormData(data, objectSchema, {
-        canEdit: fieldWriteGate(perms, schema.objectName),
+        canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
       });
       // Omit the fields the producer owns (#4069) — see
       // `omitServerResolvedDefaults` for why an empty key is not the same as
diff --git a/packages/plugin-form/src/MasterDetailForm.tsx b/packages/plugin-form/src/MasterDetailForm.tsx
index b0dc78caea..2053005beb 100644
--- a/packages/plugin-form/src/MasterDetailForm.tsx
+++ b/packages/plugin-form/src/MasterDetailForm.tsx
@@ -677,6 +677,14 @@ interface MasterDetailLinesProps {
    * entry's own config cannot carry it (objectui#6394).
    */
   parentObjectName: string;
+  /**
+   * The form's mode, which picks the question the child grids' cells ask
+   * (objectui#12082): every line of a CREATE form is a new child record, so its
+   * cells ask the create question (the server's insert rule); an edit form's
+   * lines may already exist, and a per-column lock cannot split per row, so
+   * they keep the edit question.
+   */
+  formMode: 'create' | 'edit';
 }
 
 /**
@@ -703,6 +711,7 @@ const MasterDetailLines: React.FC<MasterDetailLinesProps> = ({
   onRowExpand,
   onAddViaForm,
   parentObjectName,
+  formMode,
 }) => {
   // The subtotal / tax / grand-total stack formats in the display locale; it
   // used to pass `toLocaleString` an explicit `undefined`, i.e. the MACHINE's
@@ -893,7 +902,7 @@ const MasterDetailLines: React.FC<MasterDetailLinesProps> = ({
                   // the record-form containers share: a child column the caller
                   // may not read is omitted, and one they may read but not edit
                   // renders its cells locked (objectui#10163).
-                  columns: applyColumnPermissions(d.columns, { perms, objectName: d.childObject }),
+                  columns: applyColumnPermissions(d.columns, { perms, objectName: d.childObject, mode: formMode }),
                   // Show the per-grid running total whenever an amount column is
                   // set — unless the document totals stack below subsumes it.
                   // The grid's `totalField` names the CHILD column summed (this
@@ -1819,6 +1828,7 @@ export const MasterDetailForm: React.FC<MasterDetailFormProps> = ({
         onRowExpand={(entryId, rowIdx) => setExpanded({ entryId, rowIdx })}
         onAddViaForm={addRowViaForm}
         parentObjectName={schema.objectName}
+        formMode={isEdit ? 'edit' : 'create'}
       />
 
       {/* Per-row "expand to full form": an inline editor panel for the selected
diff --git a/packages/plugin-form/src/ModalForm.tsx b/packages/plugin-form/src/ModalForm.tsx
index 78db783957..d3d9bb567a 100644
--- a/packages/plugin-form/src/ModalForm.tsx
+++ b/packages/plugin-form/src/ModalForm.tsx
@@ -635,7 +635,7 @@ export const ModalForm: React.FC<ModalFormProps> = ({
       // enough on its own — but the verdict is the same resolver's, adapted by
       // `fieldWriteGate` rather than copied here (`80c54122e`).
       const payload = sanitizeFormData(data, objectSchema, {
-        canEdit: fieldWriteGate(perms, schema.objectName),
+        canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
       });
       // Omit the fields the producer owns (#4069) — see
       // `omitServerResolvedDefaults` for why an empty key is not the same as
diff --git a/packages/plugin-form/src/ObjectForm.effectiveOps.test.tsx b/packages/plugin-form/src/ObjectForm.effectiveOps.test.tsx
index f038a11a2e..65d1d691a8 100644
--- a/packages/plugin-form/src/ObjectForm.effectiveOps.test.tsx
+++ b/packages/plugin-form/src/ObjectForm.effectiveOps.test.tsx
@@ -44,6 +44,9 @@ const { permsStub, state } = vi.hoisted(() => {
     permsStub: {
       isLoaded: false,
       checkField: () => true,
+      // The caller's object grant (objectui#12082) holds every verb, so the
+      // effective set stays the only variable, as the comment above says.
+      can: () => true,
       getObjectApiOperations: () => state.effectiveOps,
     },
   };
diff --git a/packages/plugin-form/src/ObjectForm.tsx b/packages/plugin-form/src/ObjectForm.tsx
index 855efdbfb4..6863214488 100644
--- a/packages/plugin-form/src/ObjectForm.tsx
+++ b/packages/plugin-form/src/ObjectForm.tsx
@@ -1285,7 +1285,7 @@ const SimpleObjectForm: React.FC<{ schema: LocalizedObjectFormSchema; dataSource
     // the record as the form now holds it, whether or not a field was written.
     const { payload, writePayload } = formWritePayload(formData, schema, {
       objectSchema,
-      canEdit: fieldWriteGate(perms, schema.objectName),
+      canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
       snapshot: loadedRecordRef.current,
     });
 
diff --git a/packages/plugin-form/src/SplitForm.tsx b/packages/plugin-form/src/SplitForm.tsx
index b15d023603..c4943fb461 100644
--- a/packages/plugin-form/src/SplitForm.tsx
+++ b/packages/plugin-form/src/SplitForm.tsx
@@ -384,7 +384,7 @@ export const SplitForm: React.FC<SplitFormProps> = ({
       // the identical payload.
       const { writePayload } = formWritePayload(data, schema, {
         objectSchema,
-        canEdit: fieldWriteGate(perms, schema.objectName),
+        canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
         snapshot: loadedRecordRef.current,
       });
 
diff --git a/packages/plugin-form/src/TabbedForm.tsx b/packages/plugin-form/src/TabbedForm.tsx
index 407edd9fa1..a4c89660ff 100644
--- a/packages/plugin-form/src/TabbedForm.tsx
+++ b/packages/plugin-form/src/TabbedForm.tsx
@@ -483,7 +483,7 @@ export const TabbedForm: React.FC<TabbedFormProps> = ({
       // the identical payload.
       const { writePayload } = formWritePayload(data, schema, {
         objectSchema,
-        canEdit: fieldWriteGate(perms, schema.objectName),
+        canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
         snapshot: loadedRecordRef.current,
       });
 
diff --git a/packages/plugin-form/src/WizardForm.tsx b/packages/plugin-form/src/WizardForm.tsx
index 084f5bb88b..04bb23e5fc 100644
--- a/packages/plugin-form/src/WizardForm.tsx
+++ b/packages/plugin-form/src/WizardForm.tsx
@@ -959,7 +959,7 @@ export const WizardForm: React.FC<WizardFormProps> = ({
         // payload. A simple form's mobile `stepper` renders through here too.
         const { writePayload } = formWritePayload(mergedData, schema, {
           objectSchema,
-          canEdit: fieldWriteGate(perms, schema.objectName),
+          canEdit: fieldWriteGate(perms, schema.objectName, schema.mode),
           snapshot: loadedRecordRef.current,
         });
 
diff --git a/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx b/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx
new file mode 100644
index 0000000000..117d868126
--- /dev/null
+++ b/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx
@@ -0,0 +1,374 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * The enumeration pin for the affordance-to-grant map (objectui#12082).
+ *
+ * `AFFORDANCE_GRANTS` in `@object-ui/core` names, for every console affordance
+ * that offers a write, the grant it exercises; `resolveAffordance` /
+ * `resolveFieldAffordance` are the one verdict every such affordance reads.
+ * The family this closes — each affordance deciding on its own which grant it
+ * reads — was fixed one member at a time before (objectui#4296, #10107,
+ * #11000, #12047) and kept recurring, so this pin holds the whole table and
+ * the whole tree, not one more member.
+ *
+ * ## What it holds
+ *
+ * 1. **The row set equals this file's own expectation table.** `EXPECTED_GRANT`
+ *    below is written here, by hand, NOT derived from the map: a row added to
+ *    the map without an expectation, or one dropped from it, turns this red.
+ * 2. **Every row × four grant shapes** — create-only, edit-only, read-only and
+ *    full — through the REAL `MePermissionsProvider`: each affordance shows
+ *    exactly when its grant allows it. A row naming the wrong grant (the p1
+ *    defect was a create affordance reading the edit grant) fails at least two
+ *    shapes.
+ * 3. **The field question** of every field row, over the same four shapes and
+ *    over explicit field-level entries: the create question follows the
+ *    server's insert rule (no entry → `allowCreate`), the edit question its
+ *    update rule (no entry → `allowEdit`), and an explicit entry answers both
+ *    alike.
+ * 4. **The form reader itself** (`gateFormFields`, `closedFormAffordance`) over
+ *    the four shapes, both modes — the p1 card's reader, read through the map.
+ * 5. **Fail-open**: with no permission provider every row and every field
+ *    question reads open, as the `fieldWriteGate.ts` docblock states.
+ * 6. **The census**: no console source file outside the map reads a CRUD
+ *    grant on its own. The population and the readers it refuses are named in
+ *    that block; a reader added later that spells its own grant read — the
+ *    shape of every earlier member of this family — turns it red, naming the
+ *    file.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import { render, cleanup } from '@testing-library/react';
+import React from 'react';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  AFFORDANCE_GRANTS,
+  resolveAffordance,
+  resolveFieldAffordance,
+  type ConsoleAffordance,
+  type FieldAffordance,
+} from '@object-ui/core';
+import { MePermissionsProvider, usePermissions, type MePermissionsResponse } from '@object-ui/permissions';
+import { closedFormAffordance, gateFormFields } from './fieldWriteGate';
+// The ONE answer to "is this span a comment, or code?" — a census that strips
+// comments with a private regex reports clean over code a phantom comment ate.
+// @ts-expect-error — plain-JS shared helper, intentionally untyped (`allowJs: false`)
+import { stripComments as stripCommentsUntyped } from '../../../scripts/js-comment-mask.mjs';
+
+/** Local annotation, since the import above is untyped — the call site stays checked. */
+const stripComments: (source: string) => string = stripCommentsUntyped;
+
+afterEach(cleanup);
+
+type Grant = 'create' | 'update' | 'delete';
+
+/**
+ * Which grant each affordance needs — written by hand, from the card's rows and
+ * the census, never read off the map. The map must agree with it row for row.
+ */
+const EXPECTED_GRANT: Record<string, Grant> = {
+  // The card's rows.
+  createFormFields: 'create',
+  editFormFields: 'update',
+  recordEdit: 'update',
+  listNew: 'create',
+  listImport: 'create',
+  lookupCreateNew: 'create',
+  // The rows the census found.
+  recordDelete: 'delete',
+  importTemplate: 'create',
+  listInlineEdit: 'update',
+  listBulkDelete: 'delete',
+  rowEdit: 'update',
+  rowDelete: 'delete',
+  gridAddRow: 'create',
+  relatedNew: 'create',
+  relatedRowEdit: 'update',
+  relatedRowDelete: 'delete',
+  attachmentUpload: 'create',
+  attachmentDelete: 'delete',
+};
+
+/** The field rows, and which grant their no-entry fallback reads. */
+const EXPECTED_FIELD_GRANT: Record<string, Grant> = {
+  createFormFields: 'create',
+  editFormFields: 'update',
+  listImport: 'create',
+};
+
+const OBJECT = 'pin_object';
+
+/** The four grant shapes, as `/me/permissions` carries them, and the verbs each holds. */
+const SHAPES: Array<{ shape: string; bits: Record<string, boolean>; holds: ReadonlySet<Grant> }> = [
+  {
+    shape: 'create-only',
+    bits: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false },
+    holds: new Set<Grant>(['create']),
+  },
+  {
+    shape: 'edit-only',
+    bits: { allowCreate: false, allowRead: true, allowEdit: true, allowDelete: false },
+    holds: new Set<Grant>(['update']),
+  },
+  {
+    shape: 'read-only',
+    bits: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false },
+    holds: new Set<Grant>(),
+  },
+  {
+    shape: 'full',
+    bits: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true },
+    holds: new Set<Grant>(['create', 'update', 'delete']),
+  },
+];
+
+const envelope = (bits: Record<string, boolean>, fields: MePermissionsResponse['fields'] = {}): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-pin',
+  tenantId: null,
+  roles: ['member'],
+  permissionSets: ['member'],
+  objects: { [OBJECT]: bits },
+  fields,
+});
+
+/** The value `usePermissions()` hands a reader under `perms` — or with no provider at all. */
+function principalUnder(perms: MePermissionsResponse | null): ReturnType<typeof usePermissions> {
+  let captured: ReturnType<typeof usePermissions> | null = null;
+  function Probe() {
+    captured = usePermissions();
+    return null;
+  }
+  render(perms ? (
+    <MePermissionsProvider initialPermissions={perms}>
+      <Probe />
+    </MePermissionsProvider>
+  ) : (
+    <Probe />
+  ));
+  if (!captured) throw new Error('the probe did not render');
+  return captured;
+}
+
+const ROWS = Object.keys(AFFORDANCE_GRANTS) as ConsoleAffordance[];
+const FIELD_ROWS = ROWS.filter((r) => 'field' in AFFORDANCE_GRANTS[r]) as FieldAffordance[];
+
+describe('the affordance-to-grant map: its rows (objectui#12082)', () => {
+  it('the map has exactly the rows this pin expects — a row with no expectation turns this red', () => {
+    expect([...ROWS].sort()).toEqual(Object.keys(EXPECTED_GRANT).sort());
+    expect([...FIELD_ROWS].sort()).toEqual(Object.keys(EXPECTED_FIELD_GRANT).sort());
+  });
+
+  it('every row names the grant the expectation table names', () => {
+    for (const row of ROWS) {
+      expect(AFFORDANCE_GRANTS[row].grant, row).toBe(EXPECTED_GRANT[row]);
+    }
+  });
+});
+
+describe.each(SHAPES)('every row under a $shape grant (objectui#12082)', ({ bits, holds }) => {
+  it('each affordance shows exactly when its grant allows it', () => {
+    const perms = principalUnder(envelope(bits));
+    const got = Object.fromEntries(
+      ROWS.map((row) => [row, resolveAffordance(row, { objectSchema: { managedBy: 'platform' }, objectName: OBJECT, perms }).allowed]),
+    );
+    const want = Object.fromEntries(ROWS.map((row) => [row, holds.has(EXPECTED_GRANT[row])]));
+    expect(got).toEqual(want);
+  });
+
+  it('each field row asks its own question: no field entry → the grant of the operation it writes', () => {
+    const perms = principalUnder(envelope(bits));
+    const got = Object.fromEntries(FIELD_ROWS.map((row) => [row, resolveFieldAffordance(row, perms, OBJECT, 'any_field')]));
+    const want = Object.fromEntries(FIELD_ROWS.map((row) => [row, holds.has(EXPECTED_FIELD_GRANT[row])]));
+    expect(got).toEqual(want);
+  });
+
+  it('an explicit field entry answers every field row alike, whatever the object grant', () => {
+    const perms = principalUnder(
+      envelope(bits, {
+        [`${OBJECT}.locked`]: { readable: true, editable: false },
+        [`${OBJECT}.open`]: { readable: true, editable: true },
+      }),
+    );
+    for (const row of FIELD_ROWS) {
+      // The server's field step refuses `editable: false` on insert and update
+      // alike, and lets an editable entry through to object admission — which
+      // is the row's object verdict above, not the field question.
+      expect(resolveFieldAffordance(row, perms, OBJECT, 'locked'), `${row} locked`).toBe(false);
+      expect(resolveFieldAffordance(row, perms, OBJECT, 'open'), `${row} open`).toBe(true);
+    }
+  });
+
+  it.each(['create', 'edit'] as const)('the form reader, %s mode: fields and the form-wide lock follow the form row', (mode) => {
+    const perms = principalUnder(envelope(bits));
+    const allowed = holds.has(mode === 'create' ? 'create' : 'update');
+    const fields: Array<{ name: string; disabled?: boolean }> = [{ name: 'title' }, { name: 'amount' }];
+    const drawn = gateFormFields(fields, {
+      perms,
+      objectName: OBJECT,
+      mode,
+      objectSchema: null,
+    })!;
+    expect(drawn.map((f) => !!f.disabled)).toEqual([!allowed, !allowed]);
+    expect(closedFormAffordance({ perms, objectName: OBJECT, mode, objectSchema: null })).toBe(
+      allowed ? undefined : mode,
+    );
+  });
+});
+
+describe('the map\'s other two layers still intersect (objectui#12082)', () => {
+  it('a bucket that closes a row keeps it closed under the full grant; a row with no CRUD bit ignores the bucket', () => {
+    const perms = principalUnder(envelope(SHAPES[3].bits));
+    for (const row of ROWS) {
+      const verdict = resolveAffordance(row, { objectSchema: { managedBy: 'append-only' }, objectName: OBJECT, perms }).allowed;
+      expect(verdict, row).toBe(AFFORDANCE_GRANTS[row].crud === null);
+    }
+  });
+
+  it('an effective operation set that serves nothing closes every row with a CRUD bit', () => {
+    const perms = principalUnder({
+      ...envelope(SHAPES[3].bits),
+      objects: { [OBJECT]: { ...SHAPES[3].bits, apiOperations: [] } },
+    });
+    for (const row of ROWS) {
+      const verdict = resolveAffordance(row, { objectSchema: null, objectName: OBJECT, perms }).allowed;
+      expect(verdict, row).toBe(AFFORDANCE_GRANTS[row].crud === null);
+    }
+  });
+});
+
+describe('fail-open: no permission provider mounted (objectui#12082)', () => {
+  it('every row and every field question reads open', () => {
+    const perms = principalUnder(null);
+    expect(perms.isLoaded).toBe(false);
+    for (const row of ROWS) {
+      expect(resolveAffordance(row, { objectSchema: null, objectName: OBJECT, perms }).allowed, row).toBe(true);
+    }
+    for (const row of FIELD_ROWS) {
+      expect(resolveFieldAffordance(row, perms, OBJECT, 'any_field'), row).toBe(true);
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The census: no console source reads a CRUD grant outside the map.
+//
+// Population: every `.ts` / `.tsx` under `packages/*/src` and `apps/*/src`,
+// tests, stories and declaration files excluded, with comments stripped by
+// `scripts/js-comment-mask.mjs`. The
+// enumeration is a walk of the tree from this file's own location, and the
+// control below holds that the walk reached the readers this card converted —
+// a walk that found nothing would otherwise read as a clean tree.
+//
+// A read is one of the three shapes every earlier member of this family took:
+//
+//  - `can(x, '<write verb>')` / `check(x, '<write verb>')` — an object grant
+//    read directly (write verbs only: `create`, `update`, `edit`, `delete`,
+//    `import`);
+//  - `checkField(x, f, 'write' | 'create')` — a field write question asked
+//    directly;
+//  - `resolveEffectiveCrudAffordances(` / `isObjectInlineEditable(` — the
+//    policy half used as a verdict, without the grant.
+//
+// The map's own module and the policy module it reads are where these belong,
+// and `@object-ui/permissions` is the resolver that answers them. Every other
+// file must hold none, unless it is named in `OUT_OF_FAMILY` with the reason it
+// is not an affordance-to-grant reader. READ gates (`can(x, 'read')`, the
+// route, navigation and related-list visibility gates) are not matched: every
+// one of the four grant shapes holds read, so they are a different question —
+// may the caller SEE — and not this family's.
+// ---------------------------------------------------------------------------
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+// packages/plugin-form/src -> repo root
+const repoRoot = path.resolve(here, '../../..');
+
+const HOME = new Set([
+  'packages/core/src/utils/affordanceGrants.ts',
+  'packages/core/src/utils/managedBy.ts',
+]);
+const RESOLVER_DIR = 'packages/permissions/src/';
+
+const OUT_OF_FAMILY: Record<string, string> = {
+  'packages/app-shell/src/utils/managedByEmptyState.ts':
+    "chooses an empty list's COPY from the object's bucket ('entries appear automatically'), principal-independent by design; it shows or hides no affordance — the page's New button is the listNew row",
+};
+
+const READS: RegExp[] = [
+  /\b(?:can|cannot|check)\(\s*[^,()]+,\s*['"](?:create|update|edit|delete|import)['"]\s*\)/,
+  /\bcheckField\([^()]*,\s*['"](?:write|create)['"]\s*\)/,
+  /\b(?:resolveEffectiveCrudAffordances|isObjectInlineEditable)\(/,
+];
+
+function sourcesUnder(dir: string, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    if (name === 'node_modules' || name === 'dist' || name === '__tests__') continue;
+    const full = path.join(dir, name);
+    if (statSync(full).isDirectory()) sourcesUnder(full, out);
+    else if (/\.tsx?$/.test(name) && !/\.(test|spec|stories)\.tsx?$/.test(name) && !name.endsWith('.d.ts')) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+
+function census(): Map<string, number> {
+  const roots: string[] = [];
+  for (const top of ['packages', 'apps']) {
+    for (const pkg of readdirSync(path.join(repoRoot, top))) {
+      const src = path.join(repoRoot, top, pkg, 'src');
+      try {
+        if (statSync(src).isDirectory()) roots.push(src);
+      } catch {
+        // no src/ — not a source package
+      }
+    }
+  }
+  const hits = new Map<string, number>();
+  for (const file of roots.flatMap((r) => sourcesUnder(r))) {
+    const rel = path.relative(repoRoot, file).split(path.sep).join('/');
+    const code = stripComments(readFileSync(file, 'utf8'));
+    const n = code.split('\n').filter((line) => READS.some((re) => re.test(line))).length;
+    if (n > 0) hits.set(rel, n);
+  }
+  return hits;
+}
+
+describe('the census: every affordance reads the map (objectui#12082)', () => {
+  const hits = census();
+
+  it('CONTROL — the walk reaches the map and the readers it replaced', () => {
+    // The map's home module holds a read (its own call of the policy), so a
+    // walk that reached nothing cannot pass as a clean tree.
+    expect(hits.has('packages/core/src/utils/affordanceGrants.ts')).toBe(true);
+    for (const reader of [
+      'packages/plugin-form/src/fieldWriteGate.ts',
+      'packages/app-shell/src/views/RecordDetailView.tsx',
+      'packages/fields/src/widgets/LookupField.tsx',
+    ]) {
+      expect(readFileSync(path.join(repoRoot, reader), 'utf8'), reader).toMatch(/\bresolve(?:Field)?Affordance\b/);
+    }
+  });
+
+  it('no console source outside the map reads a CRUD grant on its own', () => {
+    const outside = [...hits.keys()]
+      .filter((f) => !HOME.has(f) && !f.startsWith(RESOLVER_DIR))
+      .sort();
+    expect(
+      outside,
+      'A console source reads a CRUD grant without the affordance-to-grant map. Add the ' +
+        "affordance's row to AFFORDANCE_GRANTS in @object-ui/core and read it through " +
+        'resolveAffordance / resolveFieldAffordance, or — if it is not an affordance-to-grant ' +
+        'reader — name it in OUT_OF_FAMILY here with the reason.',
+    ).toEqual(Object.keys(OUT_OF_FAMILY).sort());
+  });
+});
diff --git a/packages/plugin-form/src/createFormGrant-12082.test.tsx b/packages/plugin-form/src/createFormGrant-12082.test.tsx
new file mode 100644
index 0000000000..ec08d199e4
--- /dev/null
+++ b/packages/plugin-form/src/createFormGrant-12082.test.tsx
@@ -0,0 +1,292 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * A create form asks the CREATE question of its fields, so a create-only role
+ * can fill the form it is allowed to submit (objectui#12082).
+ *
+ * ## The defect
+ *
+ * The card's role holds `allowCreate: true, allowEdit: false` on
+ * `clm_contract_version`: requesters create versions and never edit them. The
+ * form's field gate asked `checkField(object, field, 'write')` in every mode
+ * but `view`, and with no field-level entry that question falls back to the
+ * object's `allowEdit`. So every field of the CREATE form rendered disabled,
+ * and the outbound filter, which asks the same question, stripped every field
+ * from the body: the save posted `{}` and the server answered
+ * `400 VALIDATION_FAILED` for the required fields. The server accepts the same
+ * create (`201`) under the role's real `allowCreate`.
+ *
+ * ## The server's insert rule, which the create question follows
+ *
+ * The security middleware's field-level write step refuses an insert that
+ * names a field whose explicit field-level entry has `editable: false`; a
+ * field with no entry passes it, and object admission (`insert` →
+ * `allowCreate`) decides the create. So a create-form field reads: explicit
+ * field entry → its `editable`; no entry → the object's create grant. That is
+ * the `createFormFields` row of the affordance-to-grant map in
+ * `@object-ui/core`, which every form layout reads.
+ *
+ * ## The rows
+ *
+ * - the card's repro, on every layout `ObjectForm` routes to: a create-only
+ *   grant draws every field enabled, with no notice;
+ * - the payload, on the three containers that submit in one step: the body
+ *   carries what was typed;
+ * - CONTROL, the same grant on an EDIT form: every field stays disabled — the
+ *   edit question still reads `allowEdit`;
+ * - CONTROL, an explicit field-level `editable: false` stays disabled in the
+ *   create form and is absent from the body — the field rule the server has on
+ *   insert is kept, and no rule it lacks is added.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, cleanup } from '@testing-library/react';
+import React from 'react';
+
+import { MePermissionsProvider, type MePermissionsResponse } from '@object-ui/permissions';
+import { registerAllFields } from '@object-ui/fields';
+import { ObjectForm } from './ObjectForm';
+import { MasterDetailForm } from './MasterDetailForm';
+
+registerAllFields();
+afterEach(cleanup);
+
+const OBJECT = 'clm_contract_version';
+
+const FIELDS = {
+  contract: { type: 'text', label: 'Contract' },
+  version_no: { type: 'number', label: 'Version No.' },
+  notes: { type: 'text', label: 'Notes' },
+};
+const RECORD = { id: 'v1', contract: 'C-1', version_no: 1, notes: 'first' };
+
+/** `/me/permissions` for the card's requester: create, never edit. */
+const createOnly = (fields: MePermissionsResponse['fields'] = {}): MePermissionsResponse => ({
+  authenticated: true,
+  userId: 'u-requester',
+  tenantId: null,
+  roles: ['clm_requester'],
+  permissionSets: ['clm_requester'],
+  objects: {
+    [OBJECT]: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false },
+  },
+  fields,
+});
+
+const sections = (names: string[]) => [{ name: 'main', label: 'Main', fields: names }];
+
+const LAYOUTS: Array<{ layout: string; schema: (names: string[]) => Record<string, unknown> }> = [
+  { layout: 'simple / sections (default arm)', schema: (n) => ({ sections: sections(n) }) },
+  { layout: 'drawer / sections (DrawerForm)', schema: (n) => ({ formType: 'drawer', sections: sections(n) }) },
+  { layout: 'modal / sections (ModalForm)', schema: (n) => ({ formType: 'modal', sections: sections(n) }) },
+  { layout: 'tabbed / sections (TabbedForm)', schema: (n) => ({ formType: 'tabbed', sections: sections(n) }) },
+  { layout: 'split / sections (SplitForm)', schema: (n) => ({ formType: 'split', sections: sections(n) }) },
+  { layout: 'wizard / sections (WizardForm)', schema: (n) => ({ formType: 'wizard', sections: sections(n) }) },
+  { layout: 'simple / flat (default arm)', schema: (n) => ({ fields: n }) },
+  { layout: 'drawer / flat (DrawerForm)', schema: (n) => ({ formType: 'drawer', fields: n }) },
+  { layout: 'modal / flat (ModalForm)', schema: (n) => ({ formType: 'modal', fields: n }) },
+];
+
+/** The layouts that submit in one step, through the form element. */
+const SUBMITTING = LAYOUTS.filter((l) => l.layout.includes('/ flat'));
+
+function makeDS() {
+  return {
+    getObjectSchema: vi.fn().mockResolvedValue({ name: OBJECT, label: 'Contract Version', fields: FIELDS }),
+    findOne: vi.fn().mockResolvedValue({ ...RECORD }),
+    find: vi.fn().mockResolvedValue({ data: [] }),
+    create: vi.fn(async (_o: string, d: Record<string, unknown>) => ({ id: 'v2', ...d })),
+    update: vi.fn(async (_o: string, _id: string, d: Record<string, unknown>) => ({ ...RECORD, ...d })),
+  };
+}
+
+function mount(
+  layout: (names: string[]) => Record<string, unknown>,
+  mode: 'create' | 'edit',
+  perms: MePermissionsResponse,
+  ds: ReturnType<typeof makeDS>,
+) {
+  render(
+    <MePermissionsProvider initialPermissions={perms}>
+      <ObjectForm
+        schema={{
+          type: 'object-form',
+          objectName: OBJECT,
+          ...layout(Object.keys(FIELDS)),
+          mode,
+          ...(mode === 'edit' ? { recordId: 'v1' } : {}),
+          showSubmit: true,
+          open: true,
+        } as any}
+        dataSource={ds as any}
+      />
+    </MePermissionsProvider>,
+  );
+}
+
+/** Every drawn field → `true` when it kept NO enabled control (locked). */
+function lockedByField(): Record<string, boolean> {
+  const out: Record<string, boolean> = {};
+  for (const item of document.body.querySelectorAll('[data-field]')) {
+    const name = item.getAttribute('data-field') as string;
+    out[name] = item.querySelector('input:not([disabled]), textarea:not([disabled])') === null;
+  }
+  return out;
+}
+
+const notices = () => Array.from(document.body.querySelectorAll('[data-testid="closed-affordance-notice"]'));
+
+async function formOnScreen(mode: 'create' | 'edit') {
+  await waitFor(() => {
+    const el = document.body.querySelector('input[name="contract"]') as HTMLInputElement | null;
+    if (!el) throw new Error('form not drawn yet');
+    if (mode === 'edit' && el.value !== RECORD.contract) throw new Error('record not on screen yet');
+  });
+}
+
+function type(name: string, value: string) {
+  const el = document.body.querySelector(`input[name="${name}"]`) as HTMLInputElement | null;
+  if (!el) throw new Error(`${name} not drawn`);
+  fireEvent.change(el, { target: { value } });
+}
+
+async function submit(ds: ReturnType<typeof makeDS>) {
+  const form = document.body.querySelector('form');
+  if (!form) throw new Error('no form element');
+  fireEvent.submit(form);
+  await waitFor(() => expect(ds.create).toHaveBeenCalled());
+  const [object, body] = ds.create.mock.calls[0];
+  return { object, body: body as Record<string, unknown> };
+}
+
+describe.each(LAYOUTS)('ObjectForm $layout under a create-only grant (objectui#12082)', ({ schema }) => {
+  it('the create form draws every field enabled, with no closed-affordance notice', async () => {
+    mount(schema, 'create', createOnly(), makeDS());
+    await formOnScreen('create');
+    expect(lockedByField()).toEqual({ contract: false, version_no: false, notes: false });
+    expect(notices()).toHaveLength(0);
+  });
+
+  it('CONTROL — an edit form under the same grant stays disabled', async () => {
+    mount(schema, 'edit', createOnly(), makeDS());
+    await formOnScreen('edit');
+    expect(lockedByField()).toEqual({ contract: true, version_no: true, notes: true });
+  });
+
+  it('CONTROL — an explicit field-level editable: false stays disabled in the create form', async () => {
+    mount(
+      schema,
+      'create',
+      createOnly({ [`${OBJECT}.notes`]: { readable: true, editable: false } }),
+      makeDS(),
+    );
+    await formOnScreen('create');
+    // Only the field the entry names: whether its siblings are open is the
+    // repro row above, so this row stays a control on both sides of the fix.
+    expect(lockedByField().notes).toBe(true);
+  });
+});
+
+describe.each(SUBMITTING)('ObjectForm $layout — the create-only body (objectui#12082)', ({ schema }) => {
+  it('the submitted create body carries the typed fields', async () => {
+    const ds = makeDS();
+    mount(schema, 'create', createOnly(), ds);
+    await formOnScreen('create');
+    type('contract', 'C-7');
+    type('version_no', '3');
+    type('notes', 'signed copy');
+    const { object, body } = await submit(ds);
+    expect(object).toBe(OBJECT);
+    expect(body).toMatchObject({ contract: 'C-7', version_no: 3, notes: 'signed copy' });
+  });
+
+  // The lit half (`contract`, `version_no` on the wire) keeps "absent" meaning
+  // "the field rule fired" rather than "the form sent nothing", so this row is
+  // red wherever the repro row is.
+  it('CONTROL — an explicit field-level editable: false never reaches the create body', async () => {
+    const ds = makeDS();
+    mount(schema, 'create', createOnly({ [`${OBJECT}.notes`]: { readable: true, editable: false } }), ds);
+    await formOnScreen('create');
+    type('contract', 'C-7');
+    type('version_no', '3');
+    const { body } = await submit(ds);
+    expect(body).toMatchObject({ contract: 'C-7', version_no: 3 });
+    expect(body).not.toHaveProperty('notes');
+  });
+});
+
+/**
+ * The same rule one level down: the line-item grid of a CREATE-mode
+ * `MasterDetailForm`. Every line there is a new child record, so its cells ask
+ * the create question of the child object; a create-only grant on the child
+ * gets live cells. An EDIT form's lines may already exist, and one lock per
+ * column cannot split per row, so its cells keep the edit question — the
+ * control row.
+ */
+describe('MasterDetailForm under a create-only grant on the child (objectui#12082)', () => {
+  const PARENT = 'clm_contract';
+  const CHILD = 'clm_payment_plan';
+  const COLUMNS = [
+    { name: 'seq', label: 'Instalment No.', type: 'number' },
+    { name: 'notes', label: 'Instalment notes', type: 'text' },
+  ];
+  const envelopeFor = (): MePermissionsResponse => ({
+    ...createOnly(),
+    objects: {
+      [PARENT]: { allowCreate: true, allowRead: true, allowEdit: true, allowDelete: false },
+      [CHILD]: { allowCreate: true, allowRead: true, allowEdit: false, allowDelete: false },
+    },
+  });
+  function mountMD(mode: 'create' | 'edit') {
+    const ds = {
+      getObjectSchema: vi.fn(async (obj: string) =>
+        obj === PARENT ? { name: PARENT, fields: { title: { type: 'text', label: 'Title' } } } : null,
+      ),
+      findOne: vi.fn().mockResolvedValue({ id: 'K1', title: 'MSA' }),
+      find: vi.fn().mockResolvedValue({ data: mode === 'edit' ? [{ id: 'P1', contract: 'K1', seq: 1, notes: 'n' }] : [] }),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    };
+    render(
+      <MePermissionsProvider initialPermissions={envelopeFor()}>
+        <MasterDetailForm
+          schema={{
+            objectName: PARENT,
+            mode,
+            ...(mode === 'edit' ? { recordId: 'K1' } : {}),
+            fields: ['title'],
+            details: [{ childObject: CHILD, relationshipField: 'contract', columns: COLUMNS }],
+          } as any}
+          dataSource={ds as any}
+        />
+      </MePermissionsProvider>,
+    );
+  }
+  const cells = (label: string) =>
+    waitFor(() => {
+      const els = screen.getAllByLabelText(label) as HTMLInputElement[];
+      if (els.length === 0) throw new Error(`${label} cells not rendered yet`);
+      return els;
+    });
+
+  it('a create form\'s line cells are live: every line is an insert of the child', async () => {
+    mountMD('create');
+    for (const el of [...(await cells('Instalment No.')), ...(await cells('Instalment notes'))]) {
+      expect(el.disabled).toBe(false);
+    }
+  });
+
+  it('CONTROL — an edit form\'s line cells stay locked under the same grant', async () => {
+    mountMD('edit');
+    await waitFor(async () => expect((await cells('Instalment No.')).length).toBeGreaterThan(1));
+    for (const el of [...(await cells('Instalment No.')), ...(await cells('Instalment notes'))]) {
+      expect(el.disabled).toBe(true);
+    }
+  });
+});
diff --git a/packages/plugin-form/src/fieldWriteGate.ts b/packages/plugin-form/src/fieldWriteGate.ts
index b8c7725bfb..161fdfd94f 100644
--- a/packages/plugin-form/src/fieldWriteGate.ts
+++ b/packages/plugin-form/src/fieldWriteGate.ts
@@ -7,17 +7,26 @@
  */
 
 /**
- * 「May this caller edit this field?」 — asked once, of the resolver that owns
- * the answer (`80c54122e`).
+ * 「May this caller write this field through this form?」 — asked once, of the
+ * resolver that owns the answer (`80c54122e`), with the question the form's
+ * mode asks (objectui#12082).
  *
  * ## The one answer, and where it lives
  *
- * `checkField(object, field, 'write')` in `@object-ui/permissions` IS that
+ * `checkField(object, field, action)` in `@object-ui/permissions` IS that
  * resolver: `MePermissionsProvider` reads the server's `/me/permissions`
  * envelope, looks the caller's field-level grant up by `"<object>.<field>"`,
- * and falls back to the object-level `allowEdit` for a field the permission
- * set never mentions. ⛔ Nothing in this module re-derives any rung of it. It
- * only ADAPTS that one verdict into the two shapes a form container needs:
+ * and falls back to the object-level grant for a field the permission set
+ * never mentions. WHICH question a form asks is not this module's to decide
+ * either: it is the form's row in the affordance-to-grant map
+ * (`AFFORDANCE_GRANTS` in `@object-ui/core`, read through
+ * `formFieldsAffordance` / `resolveFieldAffordance`). A create form asks
+ * `create` — the server's insert rule, whose fallback is `allowCreate` — and
+ * every other form that writes asks `write`, whose fallback is `allowEdit`.
+ * Asking `write` in create mode was objectui#12082: a create-only role met a
+ * create form with every field disabled and a save that posted `{}`.
+ * ⛔ Nothing in this module re-derives any rung of it. It only ADAPTS that one
+ * verdict into the shapes a form container needs:
  *
  *  - {@link fieldWriteGate} — the predicate `sanitizeFormData` takes, so the
  *    OUTBOUND payload never carries a field the caller may read but not edit;
@@ -28,7 +37,9 @@
  *    columns, spelled in the one lock the grid reads (objectui#10163).
  *
  * And one form-level step built on the render pass: {@link gateFormFields},
- * which adds the ADR-0092 D4 managed-object lock to it. It is the ONE step
+ * which adds the form-wide lock to it — the form's affordance closed by the
+ * ADR-0092 D4 managed-object policy, the effective API operation set or the
+ * caller's object grant (objectui#12082). It is the ONE step
  * every `ObjectForm` layout draws its resolved fields through (objectui#10612).
  *
  * ## Why both halves live in one module
@@ -55,15 +66,21 @@
  * would brick those surfaces without adding any security the server does not
  * already provide.
  *
- * ⚠️ The managed-object lock {@link gateFormFields} adds is NOT a
- * per-principal answer, so it does not fail open with the field-level half:
- * its first input is the object's own `managedBy` bucket and `userActions`,
- * read with no principal at all, exactly as the default arm has always read
- * it. Only its second input — the server's effective API operation set — is
- * absent without a provider, and absent leaves the bucket's answer standing.
+ * ⚠️ The form-wide lock {@link gateFormFields} adds is only PARTLY a
+ * per-principal answer, and only that part fails open: its first input is the
+ * object's own `managedBy` bucket and `userActions`, read with no principal at
+ * all, exactly as the default arm has always read it. Its second input — the
+ * server's effective API operation set — is absent without a provider, and
+ * absent leaves the bucket's answer standing; its third — the caller's object
+ * grant, `can` — answers `true` without a provider.
  */
 
-import { resolveEffectiveCrudAffordances, type SchemaLike } from '@object-ui/core';
+import {
+  formFieldsAffordance,
+  resolveAffordance,
+  resolveFieldAffordance,
+  type SchemaLike,
+} from '@object-ui/core';
 
 /**
  * The permission surface this module consumes — structurally the subset of
@@ -73,7 +90,7 @@ import { resolveEffectiveCrudAffordances, type SchemaLike } from '@object-ui/cor
  */
 export interface FieldWritePrincipal {
   isLoaded: boolean;
-  checkField: (object: string, field: string, action: 'read' | 'write') => boolean;
+  checkField(object: string, field: string, action: 'read' | 'write' | 'create'): boolean;
 }
 
 /** A field-name predicate: `true` when the caller may write that field. */
@@ -87,19 +104,30 @@ export type FieldWriteGate = (fieldName: string) => boolean;
  * this straight to `sanitizeFormData`, whose option is absent-or-predicate, so
  * an unresolved principal produces the byte-identical payload it produced
  * before this gate existed.
+ *
+ * `mode` is required, not optional: it picks the question (objectui#12082),
+ * and a container that forgot it would silently strip a create-only caller's
+ * whole body again. A mode that writes nothing (`view`) gets the edit
+ * question, the stricter of the two.
  */
 export function fieldWriteGate(
   perms: FieldWritePrincipal | null | undefined,
   objectName: string,
+  mode: string | undefined,
 ): FieldWriteGate | undefined {
   if (!perms?.isLoaded) return undefined;
-  return (fieldName: string) => perms.checkField(objectName, fieldName, 'write');
+  const affordance = formFieldsAffordance(mode) ?? 'editFormFields';
+  return (fieldName: string) => resolveFieldAffordance(affordance, perms, objectName, fieldName);
 }
 
 export interface ApplyFieldPermissionsOptions {
   perms: FieldWritePrincipal | null | undefined;
   objectName: string;
-  /** A `view`-mode form renders everything read-only already. */
+  /**
+   * The form's mode, which picks the field question (objectui#12082): `create`
+   * asks the insert rule, any other mode but `view` the update rule. A
+   * `view`-mode form renders everything read-only already.
+   */
   mode?: string;
   /**
    * Optional hint placed on a field the caller may read but not edit, used
@@ -131,11 +159,14 @@ function gateByPermission<T extends Record<string, any>>(
 ): T[] | undefined {
   if (!Array.isArray(fields)) return fields;
   if (!perms?.isLoaded) return fields;
+  // The form's row in the affordance-to-grant map: `undefined` for a `view`
+  // form, which asks no write question at all.
+  const affordance = formFieldsAffordance(mode);
   const out: T[] = [];
   for (const f of fields) {
     if (!f?.name) { out.push(f); continue; }
     if (!perms.checkField(objectName, f.name, 'read')) continue; // omit entirely
-    if (mode !== 'view' && !perms.checkField(objectName, f.name, 'write')) {
+    if (affordance && !resolveFieldAffordance(affordance, perms, objectName, f.name)) {
       out.push(markDenied(f));
       continue;
     }
@@ -160,12 +191,14 @@ export function applyFieldPermissions<T extends Record<string, any>>(
 }
 
 /**
- * The principal surface {@link gateFormFields} reads: the field-level resolver
- * plus the server's effective API operation set for an object (`/me/permissions`
- * `apiOperations`, objectstack#3391). `undefined` from it means "no effective set", which
- * leaves the object's own affordance standing.
+ * The principal surface {@link gateFormFields} reads: the field-level resolver,
+ * the server's effective API operation set for an object (`/me/permissions`
+ * `apiOperations`, objectstack#3391; `undefined` means "no effective set",
+ * which leaves the object's own affordance standing), and the caller's object
+ * grant (`usePermissions().can`, objectui#12082).
  */
 export interface FormFieldPrincipal extends FieldWritePrincipal {
+  can(object: string, action: 'create' | 'update' | 'delete'): boolean;
   getObjectApiOperations?: (object: string) => readonly string[] | undefined;
 }
 
@@ -180,20 +213,27 @@ export interface GateFormFieldsOptions extends ApplyFieldPermissionsOptions {
 }
 
 /**
- * The managed-object blanket lock (ADR-0092 D4 / ADR-0103): `true` when the
- * object's resolved CRUD affordance for the form's mode is CLOSED — `edit` for
- * an edit form, `create` for a create form.
+ * The form-wide lock: `true` when the form's affordance is CLOSED — the
+ * `createFormFields` row for a create form, `editFormFields` for an edit form,
+ * resolved through the affordance-to-grant map (`resolveAffordance` in
+ * `@object-ui/core`, objectui#12082).
  *
- * It routes through the SAME shared `resolveEffectiveCrudAffordances` policy
- * the detail (`isObjectInlineEditable`) and grid surfaces use, instead of
- * re-deriving the bucket lock: `platform` and admin-editable `config` resolve
- * open; the engine-owned buckets (`engine-owned`, `append-only`,
- * `better-auth`) resolve closed unless the object OPENED per-record writing via
- * `userActions.{edit,create}` (e.g. sys_user opens `edit` for its profile
- * fields). objectstack#3546 intersects that with the server's effective API operation set
- * for the object, so the lock also engages when the server denies `update`
- * (edit) or `create` (create) — the intersection the detail header and the
- * list toolbar apply.
+ * That resolver is the SAME one the record header, the list toolbar, the
+ * related lists and the grids read, so a form cannot disagree with the button
+ * that opened it. Three layers, intersected:
+ *
+ *  - the managed-object policy (ADR-0092 D4 / ADR-0103): `platform` and
+ *    admin-editable `config` resolve open; the engine-owned buckets
+ *    (`engine-owned`, `append-only`, `better-auth`) resolve closed unless the
+ *    object OPENED per-record writing via `userActions.{edit,create}` (e.g.
+ *    sys_user opens `edit` for its profile fields);
+ *  - the server's effective API operation set for the object (objectstack#3546),
+ *    so the lock engages when the server denies `update` (edit) or `create`
+ *    (create);
+ *  - the caller's object grant (objectui#12082): `allowEdit` for an edit form,
+ *    `allowCreate` for a create form. Before the map, the edit form's half of
+ *    this reached the fields only through the field question's `allowEdit`
+ *    fallback, and the create form's half not at all.
  *
  * Any other mode never locks here: a `view` form disables every field on its
  * own, and a form with no declared mode was never locked by the default arm.
@@ -206,19 +246,19 @@ function managedModeLocked(
   mode: string | undefined,
 ): boolean {
   if (mode !== 'edit' && mode !== 'create') return false;
-  const affordances = resolveEffectiveCrudAffordances(
-    objectSchema,
-    perms?.getObjectApiOperations?.(objectName),
-  );
-  return mode === 'edit' ? !affordances.edit : !affordances.create;
+  const affordance = formFieldsAffordance(mode);
+  if (!affordance) return false;
+  return !resolveAffordance(affordance, { objectSchema, objectName, perms }).allowed;
 }
 
 /** The form-level affordance {@link closedFormAffordance} can report closed. */
 export type ClosedFormAffordance = 'create' | 'edit';
 
 /**
- * Which affordance the managed-object lock found CLOSED for this form, or
- * `undefined` when the lock does not engage (objectui#11000).
+ * Which affordance the form-wide lock found CLOSED for this form, or
+ * `undefined` when the lock does not engage (objectui#11000) — closed by the
+ * managed-object policy, the effective API operation set or, since
+ * objectui#12082, the caller's object grant.
  *
  * It is {@link managedModeLocked}, the very predicate {@link gateFormFields}
  * disables every drawn field on, read for its reason: `create` for a create
@@ -253,7 +293,7 @@ export function closedFormAffordance({
  *
  *  1. field-level security — {@link applyFieldPermissions}: drop what the
  *     caller may not READ, lock what they may read but not WRITE;
- *  2. the managed-object lock — every drawn field is `disabled` when
+ *  2. the form-wide lock — every drawn field is `disabled` when
  *     {@link managedModeLocked} says the mode's affordance is closed. Only
  *     `disabled`, not `readOnly`: the default arm's lock always drew a
  *     disabled input, and the submit button is left as it is.
@@ -303,12 +343,19 @@ const LOCKED_ON_EVERY_ROW = 'true';
  * replaces any `readonlyWhen` it declared — a lock on every row already covers
  * every row a narrower lock would. Rows are untouched: whether a line may be
  * added or removed stays the container's own answer.
+ *
+ * `mode` is the form the grid sits in, and picks the question the cells ask
+ * the same way it does for a form's fields (objectui#12082): a CREATE form's
+ * lines are all new child records, so their cells ask the create question. A
+ * grid anywhere else — an edit form, a record page's line-items block — may
+ * hold existing lines beside new ones, and one lock per column cannot split
+ * per row, so it asks the edit question, as it always did.
  */
 export function applyColumnPermissions<T extends Record<string, any>>(
   columns: T[] | undefined,
-  { perms, objectName }: Pick<ApplyFieldPermissionsOptions, 'perms' | 'objectName'>,
+  { perms, objectName, mode }: Pick<ApplyFieldPermissionsOptions, 'perms' | 'objectName' | 'mode'>,
 ): T[] | undefined {
-  return gateByPermission(columns, perms, objectName, undefined, (c) => ({
+  return gateByPermission(columns, perms, objectName, mode, (c) => ({
     ...c,
     readonlyWhen: LOCKED_ON_EVERY_ROW,
   }));
diff --git a/packages/plugin-form/src/formChrome.i18n-11071.test.tsx b/packages/plugin-form/src/formChrome.i18n-11071.test.tsx
index acda6da3d7..1970e427c0 100644
--- a/packages/plugin-form/src/formChrome.i18n-11071.test.tsx
+++ b/packages/plugin-form/src/formChrome.i18n-11071.test.tsx
@@ -48,7 +48,11 @@ import { registerAllFields } from '@object-ui/fields';
 const { permsStub } = vi.hoisted(() => ({
   permsStub: {
     isLoaded: true,
-    checkField: (_object: string, field: string, op: string) => !(field === 'salary' && op === 'write'),
+    // Readable but not writable: an explicit field-level `editable: false`
+    // refuses the insert question (`create`) and the update one (`write`)
+    // alike (objectui#12082).
+    checkField: (_object: string, field: string, op: string) => !(field === 'salary' && op !== 'read'),
+    can: () => true,
     getObjectApiOperations: () => undefined,
   },
 }));
diff --git a/packages/plugin-form/src/sanitize.ts b/packages/plugin-form/src/sanitize.ts
index cbd29b0959..1333697658 100644
--- a/packages/plugin-form/src/sanitize.ts
+++ b/packages/plugin-form/src/sanitize.ts
@@ -119,7 +119,8 @@ const COMPUTED_FIELD_TYPES = new Set([
  * refused for the next, on the identical object — so it cannot be read off
  * `objectSchema` and must not be re-derived here. `fieldWriteGate` in
  * `./fieldWriteGate` adapts the ONE resolver that owns that answer
- * (`checkField(object, field, 'write')` in `@object-ui/permissions`) into this
+ * (`checkField` in `@object-ui/permissions`, asked the question the form's
+ * mode reads from the affordance-to-grant map — objectui#12082) into this
  * predicate. It arrives here, at the single outbound filter, rather than as a
  * strip loop after each container's call, because every such loop is a copy
  * that can be forgotten — and one of the three containers had forgotten it
diff --git a/packages/plugin-grid/src/ImportWizard.tsx b/packages/plugin-grid/src/ImportWizard.tsx
index b06895dfe3..c02439efdc 100644
--- a/packages/plugin-grid/src/ImportWizard.tsx
+++ b/packages/plugin-grid/src/ImportWizard.tsx
@@ -12,7 +12,7 @@ import {
 } from '@object-ui/components';
 import { Upload, FileSpreadsheet, CheckCircle2, AlertCircle, X, ArrowRight, ArrowLeft, Save, Trash2, ClipboardPaste, Download, Undo2 } from 'lucide-react';
 import { useObjectTranslation, notifyDataChanged } from '@object-ui/react';
-import { sanitizeFileNameBase } from '@object-ui/core';
+import { resolveAffordance, sanitizeFileNameBase } from '@object-ui/core';
 import { useDisplayLocale } from '@object-ui/i18n';
 import { usePermissions } from '@object-ui/permissions';
 import {
@@ -2107,10 +2107,14 @@ export const ImportWizard: React.FC<ImportWizardProps> = ({
   // of the object, the server's own gate on it (it answers 403 otherwise). Same
   // permission source as the toolbar that opens this wizard; with no
   // PermissionProvider mounted `can()` answers true and the server decides.
-  const { can } = usePermissions();
+  // [objectui#12082] That is the `importTemplate` row of the affordance-to-grant
+  // map (`resolveAffordance` in `@object-ui/core`) — the create grant, with no
+  // CRUD-affordance bit: the template has its own endpoint, not the data door.
+  const perms = usePermissions();
   const templateSource = dataSource as Partial<DataSource> | undefined;
   const fetchTemplate = templateSource?.downloadImportTemplate;
-  const downloadTemplate = typeof fetchTemplate === 'function' && can(objectName, 'create')
+  const downloadTemplate = typeof fetchTemplate === 'function'
+    && resolveAffordance('importTemplate', { objectName, perms }).allowed
     ? () => fetchTemplate.call(templateSource, objectName)
     : undefined;
 
diff --git a/packages/plugin-grid/src/ObjectGrid.tsx b/packages/plugin-grid/src/ObjectGrid.tsx
index f43d4b34b2..580aa75584 100644
--- a/packages/plugin-grid/src/ObjectGrid.tsx
+++ b/packages/plugin-grid/src/ObjectGrid.tsx
@@ -58,7 +58,7 @@ import {
   DataEmptyState, resolveIcon,
 } from '@object-ui/components';
 import { usePullToRefresh } from '@object-ui/mobile';
-import { resolveConditionalFormatting, leadWithNameField, buildExpandFields, buildExportFileName, columnIdentity, collectPredicateFieldRefs, collectGroupingFieldRefs, listViewPredicates, isObjectInlineEditable, isProjectableField, isExpandableFieldType, isUnmaterializedFieldType, readObjectSortability, isPlatformSortableField, filterPlatformSortableSort, toFilterNode, toFilterNodeSafely, filterRefusalSubject, FilterOperatorError, convertSortToQueryParams, normalizeSortEntries, type QuerySortEntry, ROW_HEIGHT_TO_DENSITY_MODE, resolveRecordSourceConfig, resolveRecordSourceObjectName, resolveFilterPlaceholders, partitionRowsByPredicate, buildCategoryOrder, buildCategoryRank, type FilterTokenScope } from '@object-ui/core';
+import { resolveConditionalFormatting, leadWithNameField, buildExpandFields, buildExportFileName, columnIdentity, collectPredicateFieldRefs, collectGroupingFieldRefs, listViewPredicates, resolveAffordance, type SchemaLike, isProjectableField, isExpandableFieldType, isUnmaterializedFieldType, readObjectSortability, isPlatformSortableField, filterPlatformSortableSort, toFilterNode, toFilterNodeSafely, filterRefusalSubject, FilterOperatorError, convertSortToQueryParams, normalizeSortEntries, type QuerySortEntry, ROW_HEIGHT_TO_DENSITY_MODE, resolveRecordSourceConfig, resolveRecordSourceObjectName, resolveFilterPlaceholders, partitionRowsByPredicate, buildCategoryOrder, buildCategoryRank, type FilterTokenScope } from '@object-ui/core';
 import { usePermissions } from '@object-ui/permissions';
 import {
   RECORD_OVERLAY_DEFAULT_WIDTH,
@@ -1755,8 +1755,30 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
   // every account, so the row kebab and the bulk bar used to fail open for a
   // read-only principal. Undefined when no object name is resolved (element
   // data source), which leaves the affordance verdict untouched.
-  const permissionUpdate = objectName ? perms.can(objectName, 'update') : undefined;
-  const permissionDelete = objectName ? perms.can(objectName, 'delete') : undefined;
+  //
+  // [objectui#12082] Every object-level verdict this grid renders — the row
+  // kebab's Edit / Delete, the bulk bar's Delete, in-place editing and the
+  // add-record row — is a row of the affordance-to-grant map, resolved by
+  // `resolveAffordance` from `@object-ui/core` against this one source: the
+  // object's `managedBy` / `userActions`, the effective operation set and the
+  // caller's grant, all asked of `objectName`. With no `objectName` (an element
+  // or inline data source) nothing is asked and every verdict reads open.
+  //
+  // KEY COLLISION — the OBJECT's `userActions` block, and the only one these
+  // verdicts can consume. `userActions` names two different shapes: on a VIEW
+  // it is toolbar policy (`UserActionsConfigSchema` — `sort`/`search`/`filter`/
+  // `refresh`/`rowHeight`/`addRecordForm`/`editInline`/`buttons`, which rejects
+  // `edit` BY NAME), on an OBJECT it is the CRUD-predicate block `edit`/
+  // `delete`/`create` carrying `visibleWhen`/`disabledWhen`. Only the object
+  // block means anything to the map's rows — or to `listViewPredicates` at the
+  // `$select` read below, which carries the full measurement. So the source
+  // stays `objectSchema`-only and must never gain the VIEW's `userActions` as a
+  // fallback: that is the shadowing this grid was fixed for (maintainer ruling
+  // of 2026-08-20 on objectui#5240, Q3=B). Pinned by
+  // `__tests__/gridNonAuthorKeys.test.tsx`.
+  const affordanceSource = { objectSchema: objectSchema as SchemaLike | null | undefined, objectName, perms };
+  const rowEditVerdict = resolveAffordance('rowEdit', affordanceSource);
+  const rowDeleteVerdict = resolveAffordance('rowDelete', affordanceSource);
   // [#5148] …and the same verdict for `create`, the third face of the shape.
   // Its two siblings above have carried the principal's own grant since #4096
   // while the inline add-record row below rode on the author-declared
@@ -1767,7 +1789,7 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
   // add row underneath stayed live and walked that user through a write it
   // already knew the server would 403. Resolved here beside its siblings so
   // the three read as one block rather than drifting apart again.
-  const permissionCreate = objectName ? perms.can(objectName, 'create') : undefined;
+  const addRowGranted = resolveAffordance('gridAddRow', affordanceSource).allowed;
 
   // [#5143] Whether THIS principal may edit THIS object's rows in place — the
   // single verdict behind every inline-edit affordance this grid renders
@@ -1796,9 +1818,7 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
   // embed, the Studio designer, and a pure inline-data grid with no object
   // semantics at all keep today's behavior. The narrowing only ever engages
   // where there IS an object to have a verdict about.
-  const objectInlineEditable =
-    isObjectInlineEditable(objectSchema, effectiveApiOps) &&
-    (objectName ? perms.can(objectName, 'update') : true);
+  const objectInlineEditable = resolveAffordance('listInlineEdit', affordanceSource).allowed;
 
   // [#5143] The authored request ∧ the verdict — resolved ONCE and read by all
   // three inline-edit props below (`editable`, `renderCellEditor`, and the
@@ -1903,6 +1923,9 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
   // [#4096] …and neither is `apiOperations`, which describes the OBJECT, not
   // the caller — so the principal's own `allowEdit` / `allowDelete` is ANDed on
   // top, matching the toolbar and the record header on the very same screen.
+  // [objectui#12082] Those object layers arrive as the map's `rowEdit` /
+  // `rowDelete` verdicts (`affordanceSource` above); this call adds the row
+  // wiring on top of them.
   //
   // Resolved HERE, above the error / loading early returns, rather than beside
   // the row-actions column it feeds: the record-level layer below is a hook and
@@ -1915,23 +1938,10 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
     rowActionsDeclared,
     hasOnEdit: !!onEdit,
     hasOnDelete: !!onDelete,
-    managedBy: (objectSchema as any)?.managedBy,
-    // KEY COLLISION — the OBJECT's block, and the only one this can consume.
-    // `userActions` names two different shapes: on a VIEW it is toolbar policy
-    // (`UserActionsConfigSchema` — `sort`/`search`/`filter`/`refresh`/
-    // `rowHeight`/`addRecordForm`/`editInline`/`buttons`, which rejects `edit`
-    // BY NAME), on an OBJECT it is the CRUD-predicate block `edit`/`delete`/
-    // `create` carrying `visibleWhen`/`disabledWhen`. Only the object block
-    // means anything to `resolveRowCrudAffordances` — or to
-    // `listViewPredicates` at the `$select` read below, which carries the full
-    // measurement. So this read stays `objectSchema`-only and must never gain a
-    // `(schema as any).userActions ??` left operand: that is the shadowing this
-    // grid was fixed for (maintainer ruling of 2026-08-20 on objectui#5240,
-    // Q3=B). Pinned by `__tests__/gridNonAuthorKeys.test.tsx`.
-    userActions: (objectSchema as any)?.userActions,
-    effectiveApiOperations: effectiveApiOps,
-    permissionUpdate,
-    permissionDelete,
+    // The object's `managedBy` / `userActions` reach these two verdicts through
+    // `affordanceSource.objectSchema` above — see the KEY COLLISION note there.
+    edit: rowEditVerdict,
+    delete: rowDeleteVerdict,
   });
   // [#4296] …and neither of those describes the ROW. `allowEdit` is the
   // principal's verdict on the OBJECT; `writeScope`, the sharing model and RLS
@@ -5556,7 +5566,7 @@ export const ObjectGrid: React.FC<ObjectGridComponentProps> = ({
     // has no record to bind, and that precedent surfaces predicates only AFTER
     // the object-level verdict passed. The conjunct that was missing here is
     // that verdict, which is what this adds.
-    showAddRow: !!operations?.create && (permissionCreate ?? true),
+    showAddRow: !!operations?.create && addRowGranted,
     onAddRecord: onAddRecord,
     rowClassName: schema.rowColor ? (row: any, _idx: number) => getRowClassName(row) : undefined,
     rowStyle: schema.conditionalFormatting?.length ? (row: any, _idx: number) => getRowStyle(row) : undefined,
diff --git a/packages/plugin-grid/src/__tests__/rowCrudAffordances.test.ts b/packages/plugin-grid/src/__tests__/rowCrudAffordances.test.ts
index a3fa4dd4c2..864ac4af2b 100644
--- a/packages/plugin-grid/src/__tests__/rowCrudAffordances.test.ts
+++ b/packages/plugin-grid/src/__tests__/rowCrudAffordances.test.ts
@@ -1,6 +1,42 @@
 // Copyright (c) 2026 ObjectStack Inc. MIT.
 import { describe, it, expect } from 'vitest';
-import { resolveRowCrudAffordances, resolveRowRecordCrudAffordance } from '../rowCrudAffordances';
+import { resolveAffordance, type SchemaLike } from '@object-ui/core';
+import {
+  resolveRowCrudAffordances as resolveFromVerdicts,
+  resolveRowRecordCrudAffordance,
+} from '../rowCrudAffordances';
+
+/**
+ * [objectui#12082] The object layers (a)–(d) now reach the row resolver as the
+ * affordance-to-grant map's `rowEdit` / `rowDelete` verdicts, which `ObjectGrid`
+ * resolves with `resolveAffordance` from the object schema, the effective
+ * operation set and the caller's grant. This adapter keeps every row below in
+ * the shape it was written in — bucket, `userActions`, operation set, grant —
+ * and resolves those through the map exactly as the grid does, so the matrix
+ * now pins the map AND the row wiring together.
+ */
+type RowInputs = Omit<Parameters<typeof resolveFromVerdicts>[0], 'edit' | 'delete'> & {
+  managedBy?: string | null;
+  userActions?: SchemaLike['userActions'];
+  effectiveApiOperations?: readonly string[] | null;
+  permissionUpdate?: boolean;
+  permissionDelete?: boolean;
+};
+
+function resolveRowCrudAffordances(opts: RowInputs) {
+  const { managedBy, userActions, effectiveApiOperations, permissionUpdate, permissionDelete, ...wiring } = opts;
+  const perms = {
+    can: (_object: string, verb: 'create' | 'update' | 'delete') =>
+      (verb === 'update' ? permissionUpdate : verb === 'delete' ? permissionDelete : undefined) !== false,
+    getObjectApiOperations: () => effectiveApiOperations ?? undefined,
+  };
+  const source = { objectSchema: { managedBy, userActions }, objectName: 'row_object', perms };
+  return resolveFromVerdicts({
+    ...wiring,
+    edit: resolveAffordance('rowEdit', source),
+    delete: resolveAffordance('rowDelete', source),
+  });
+}
 
 /** The row-level verdict only — drops the object-level bulk-delete bit. */
 const rowGate = (opts: Parameters<typeof resolveRowCrudAffordances>[0]) => {
diff --git a/packages/plugin-grid/src/rowCrudAffordances.ts b/packages/plugin-grid/src/rowCrudAffordances.ts
index d36439321a..4b8e445b6c 100644
--- a/packages/plugin-grid/src/rowCrudAffordances.ts
+++ b/packages/plugin-grid/src/rowCrudAffordances.ts
@@ -18,9 +18,11 @@
  *     input, not one half of a union with `rowActions` — see "`operations` is
  *     the ceiling" below.
  *
- *  2. The OBJECT's resolved CRUD affordance — the SAME shared policy the
- *     toolbar, the record header, the form and the related lists run
- *     (`resolveEffectiveCrudAffordances` in `@object-ui/core`). It folds three layers:
+ *  2. The OBJECT's resolved verdict — the `rowEdit` / `rowDelete` rows of the
+ *     affordance-to-grant map (`resolveAffordance` in `@object-ui/core`,
+ *     objectui#12082), the SAME resolver the toolbar, the record header, the
+ *     form and the related lists read. The caller resolves it and hands it in
+ *     as `edit` / `delete`; it folds four layers:
  *
  *       a. the ADR-0103 lifecycle bucket (`managedBy`) — engine-owned
  *          `system` / `append-only` / `better-auth` objects default their
@@ -41,8 +43,8 @@
  *
  *       d. [#4096] the CURRENT PRINCIPAL's effective permission on the object
  *          (`/me/permissions` `allowEdit` / `allowDelete`, reached through
- *          `usePermissions().can(obj, 'update' | 'delete')`) — passed in as
- *          `permissionUpdate` / `permissionDelete`.
+ *          `usePermissions().can(obj, 'update' | 'delete')`) — the grant the
+ *          map's rows name.
  *
  * Layer (c) and layer (d) answer DIFFERENT questions and neither substitutes
  * for the other. `apiOperations` is the object's API EXPOSURE SURFACE — "which
@@ -61,7 +63,7 @@
  * survive a server denial, and neither can survive a permission denial. An
  * absent effective set (unrestricted object / old backend / no
  * `PermissionProvider`) leaves the bucket verdict untouched, an absent
- * `permissionUpdate` / `permissionDelete` likewise leaves it untouched — the
+ * grant answer likewise leaves it untouched — the
  * no-provider host keeps today's behavior, because `usePermissions()` without a
  * `PermissionProvider` answers `can: () => true` by design (standalone embeds
  * have no permission source and must not lose their Edit/Delete) — and an
@@ -142,7 +144,7 @@
  * opposite answers to "may this user write THIS record".
  */
 
-import { resolveEffectiveCrudAffordances, type RowCrudPredicates, type UserActionOverride } from '@object-ui/core';
+import type { AffordanceVerdict, RowCrudPredicates, UserActionOverride } from '@object-ui/core';
 
 // The `userActions.{edit,delete}` override shape (bare boolean or #2614 object
 // form) and its per-record predicates are parsed in exactly one place —
@@ -152,6 +154,9 @@ export type { RowCrudPredicates } from '@object-ui/core';
 /** A `userActions.edit` / `delete` flag: bare boolean or the #2614 object form. */
 export type RowCrudUserAction = UserActionOverride;
 
+/** No object to judge (no verdict handed in): nothing narrows, no predicates. */
+const NO_OBJECT_VERDICT: AffordanceVerdict = Object.freeze({ allowed: true });
+
 export function resolveRowCrudAffordances(opts: {
   operationsUpdate?: boolean;
   operationsDelete?: boolean;
@@ -175,35 +180,16 @@ export function resolveRowCrudAffordances(opts: {
   rowActionsDeclared?: boolean;
   hasOnEdit?: boolean;
   hasOnDelete?: boolean;
-  /** The object's ADR-0103 lifecycle bucket; absent → the `platform` default. */
-  managedBy?: string | null;
-  /** The object's `userActions` block ({ create, edit, delete, import }). */
-  userActions?: { edit?: RowCrudUserAction; delete?: RowCrudUserAction } | null;
-  /**
-   * [objectstack#3720] The server-resolved effective API operation set for this object
-   * (`/me/permissions` `apiOperations`, objectstack#3391). `undefined` / `null` (old
-   * backend, unrestricted object, no provider) leaves the object verdict
-   * untouched; an empty array means "expose nothing" → both entries hidden.
-   */
-  effectiveApiOperations?: readonly string[] | null;
-  /**
-   * [#4096] The current principal's effective `update` permission on this
-   * object — `usePermissions().can(objectName, 'update')`, which
-   * `MePermissionsProvider` maps to `/me/permissions` `allowEdit`.
-   *
-   * `undefined` (no object name resolved, caller that has not wired the check)
-   * leaves the verdict untouched, exactly like `effectiveApiOperations`. Note
-   * that "no `PermissionProvider`" does NOT arrive here as `undefined`: the
-   * hook's provider-less fallback answers `true`, which is the same
-   * no-narrowing outcome.
-   */
-  permissionUpdate?: boolean;
   /**
-   * [#4096] The current principal's effective `delete` permission on this
-   * object — `usePermissions().can(objectName, 'delete')` → `allowDelete`.
-   * Same `undefined` semantics as `permissionUpdate`.
+   * [objectui#12082] The OBJECT-level verdict for the generic Edit: the
+   * `rowEdit` row of the affordance-to-grant map, as `resolveAffordance`
+   * returns it — layers (a)–(d) in this module's header, with the object's
+   * `userActions.edit` predicates surfaced only when it allows. Absent: no
+   * object to have a verdict about, which narrows nothing.
    */
-  permissionDelete?: boolean;
+  edit?: AffordanceVerdict;
+  /** [objectui#12082] The `rowDelete` half of {@link edit}, same rule. */
+  delete?: AffordanceVerdict;
 }): {
   canEdit: boolean;
   canDelete: boolean;
@@ -232,18 +218,16 @@ export function resolveRowCrudAffordances(opts: {
    */
   objectDeletePredicates?: RowCrudPredicates;
 } {
-  // The object-level verdict comes from the shared policy — bucket default,
-  // `userActions` override, then the server's effective operation set. The row
-  // gate is that verdict AND the consumer having actually wired the affordance.
-  const aff = resolveEffectiveCrudAffordances(
-    { managedBy: opts.managedBy, userActions: opts.userActions },
-    opts.effectiveApiOperations,
-  );
-  // [#4096] …then the principal's own verdict. `apiOperations` above is the
-  // object's exposure surface and says nothing about WHO is asking, so without
-  // this the row kebab fails open for every account with no write grant.
-  const objectCanEdit = aff.edit && opts.permissionUpdate !== false;
-  const objectCanDelete = aff.delete && opts.permissionDelete !== false;
+  // The object-level verdict is the map's (objectui#12082): bucket default,
+  // `userActions` override, the server's effective operation set and — [#4096]
+  // — the principal's own grant, which the operation set cannot stand in for
+  // (it is the object's exposure surface and says nothing about WHO is
+  // asking). The row gate is that verdict AND the consumer having actually
+  // wired the affordance.
+  const editVerdict = opts.edit ?? NO_OBJECT_VERDICT;
+  const deleteVerdict = opts.delete ?? NO_OBJECT_VERDICT;
+  const objectCanEdit = editVerdict.allowed;
+  const objectCanDelete = deleteVerdict.allowed;
   // [objectui#9819] `operations` is the CEILING — an INTERSECTION, like every
   // layer above. `rowActions` (`wantEditAction` / `wantDeleteAction`) can no
   // longer re-open what the block withheld, and a member the authored block
@@ -259,9 +243,9 @@ export function resolveRowCrudAffordances(opts: {
     canEdit,
     canDelete,
     objectCanDelete,
-    editPredicates: canEdit ? aff.editPredicates : undefined,
-    deletePredicates: canDelete ? aff.deletePredicates : undefined,
-    objectDeletePredicates: objectCanDelete ? aff.deletePredicates : undefined,
+    editPredicates: canEdit ? editVerdict.predicates : undefined,
+    deletePredicates: canDelete ? deleteVerdict.predicates : undefined,
+    objectDeletePredicates: objectCanDelete ? deleteVerdict.predicates : undefined,
   };
 }
 
diff --git a/packages/plugin-list/src/ListView.tsx b/packages/plugin-list/src/ListView.tsx
index b1f7cb3955..c12c9e3eef 100644
--- a/packages/plugin-list/src/ListView.tsx
+++ b/packages/plugin-list/src/ListView.tsx
@@ -21,7 +21,7 @@ import { useDensityMode, resolveInlineAriaProps } from '@object-ui/react';
 import type { ListViewSchema, ObjectMapConfig } from '@object-ui/types';
 import { detectStatusField, isSystemManagedField } from '@object-ui/types';
 import { usePullToRefresh } from '@object-ui/mobile';
-import { type ListViewVisualization, resolveConditionalFormatting, buildExpandFields, buildExportFileName, resolveEffectiveCrudAffordances, isObjectInlineEditable, partitionRowsByPredicate, normalizeListViewSchema, isListViewVisualization, rowHeightToDensityMode, mergeFilterNodes, FilterOperatorError, columnIdentity, collectPredicateFieldRefs, collectGroupingFieldRefs, listViewPredicates, PLATFORM_RECORD_COLUMNS, EXPANDABLE_FIELD_TYPES, UNMATERIALIZED_FIELD_TYPES, readObjectSortability, isPlatformSortableField, filterPlatformSortableSort } from '@object-ui/core';
+import { type ListViewVisualization, resolveConditionalFormatting, buildExpandFields, buildExportFileName, resolveAffordance, type SchemaLike, partitionRowsByPredicate, normalizeListViewSchema, isListViewVisualization, rowHeightToDensityMode, mergeFilterNodes, FilterOperatorError, columnIdentity, collectPredicateFieldRefs, collectGroupingFieldRefs, listViewPredicates, PLATFORM_RECORD_COLUMNS, EXPANDABLE_FIELD_TYPES, UNMATERIALIZED_FIELD_TYPES, readObjectSortability, isPlatformSortableField, filterPlatformSortableSort } from '@object-ui/core';
 import { useObjectLabel, useSafeFieldLabel, createSafeTranslation, useDisplayLocale, pickLocalized } from '@object-ui/i18n';
 // Two resolvers, two vocabularies — the repo spells the distinction into the
 // NAMES (objectui#4167). `resolveInlineI18nLabel` is the spec's own
@@ -1857,7 +1857,8 @@ export const ListView = React.forwardRef<ListViewHandle, ListViewProps>(({
   // Missing effective set (unrestricted object / old backend / no provider)
   // keeps the current behavior. The frontend consumes the effective set the
   // server resolved; it never reads the raw `apiMethods`.
-  const { getObjectApiOperations, can: canDo } = usePermissions();
+  const affordancePerms = usePermissions();
+  const { getObjectApiOperations } = affordancePerms;
   const effectiveApiOps = schema.objectName ? getObjectApiOperations(schema.objectName) : undefined;
   const exportPermitted =
     schema.allowExport !== false &&
@@ -1876,15 +1877,19 @@ export const ListView = React.forwardRef<ListViewHandle, ListViewProps>(({
   // all describe the OBJECT, so without this the most destructive entry on a
   // kanban/gallery board stayed visible for an account with no delete grant.
   // `can()` answers `true` with no `PermissionProvider` (standalone embeds).
+  // [objectui#12082] The four layers are the `listBulkDelete` row of the
+  // affordance-to-grant map, resolved by `resolveAffordance` from
+  // `@object-ui/core` — the one verdict every console affordance reads.
+  const bulkDeleteVerdict = React.useMemo(
+    () => resolveAffordance('listBulkDelete', { objectSchema: objectDef as SchemaLike, objectName: schema.objectName, perms: affordancePerms }),
+    [objectDef, schema.objectName, affordancePerms],
+  );
   const permittedBulkActions = React.useMemo(() => {
     const declared = schema.bulkActions;
     if (!declared || declared.length === 0) return declared;
-    const objectDeleteAllowed =
-      resolveEffectiveCrudAffordances(objectDef as any, effectiveApiOps).delete &&
-      (schema.objectName ? canDo(schema.objectName, 'delete') : true);
-    if (objectDeleteAllowed) return declared;
+    if (bulkDeleteVerdict.allowed) return declared;
     return declared.filter((a: unknown) => String(a).toLowerCase() !== 'delete');
-  }, [schema.bulkActions, schema.objectName, objectDef, effectiveApiOps, canDo]);
+  }, [schema.bulkActions, bulkDeleteVerdict]);
 
   /**
    * [objectui#4420] The PER-RECORD half of the same key, for the same bar.
@@ -1927,10 +1932,10 @@ export const ListView = React.forwardRef<ListViewHandle, ListViewProps>(({
    * through the action runner carrying their own gates, exactly as the
    * object-level gate above leaves them alone.
    */
-  const deleteVisibleWhen = React.useMemo(
-    () => resolveEffectiveCrudAffordances(objectDef as any, effectiveApiOps).deletePredicates?.visibleWhen,
-    [objectDef, effectiveApiOps],
-  );
+  // The predicate envelope rides the SAME `listBulkDelete` verdict
+  // (objectui#12082): surfaced only when the bar's Delete itself is allowed,
+  // which is the only case the bar offers Delete in.
+  const deleteVisibleWhen = bulkDeleteVerdict.predicates?.visibleWhen;
   const predicateScope = usePredicateScope();
   const bulkDeleteEligibility = React.useMemo(
     () => partitionRowsByPredicate(deleteVisibleWhen as never, selectedRows as Array<Record<string, unknown>>, {
@@ -2008,11 +2013,10 @@ export const ListView = React.forwardRef<ListViewHandle, ListViewProps>(({
     if ((schema.userActions as Record<string, boolean | undefined> | undefined)?.editInline !== true) {
       return false;
     }
-    return (
-      isObjectInlineEditable(objectDef as any, effectiveApiOps) &&
-      (schema.objectName ? canDo(schema.objectName, 'update') : true)
-    );
-  }, [schema.userActions, schema.objectName, objectDef, effectiveApiOps, canDo]);
+    // [objectui#12082] The `listInlineEdit` row of the affordance-to-grant map:
+    // the same conjunction, read from the one table.
+    return resolveAffordance('listInlineEdit', { objectSchema: objectDef as SchemaLike, objectName: schema.objectName, perms: affordancePerms }).allowed;
+  }, [schema.userActions, schema.objectName, objectDef, affordancePerms]);
 
   // Normalize exportOptions: support both ObjectUI object format and spec string[] format
   const resolvedExportOptions = React.useMemo(() => {