Sole modeled publisher: ordinary sessions lose public-write capability; one modeled publisher consumes admitted public projections and holds the only public-write authority (priority-assessment directive section 8; supersedes hook/check-only enforcement)

[gunbai-bot]

Auto-opened by session-dashboard for session snappy-lark-489.
Pushing to session/snappy-lark-489-sole-publisher advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Closed per operator verdict (REQUEST RECUT BEFORE MERGING).

#7577 bundled three things the mandate forbids merging as one: (1) generic authorization-kernel rehome, (2) placement-gate/roster coupling, and (3) sole-publisher model — plus a title that overclaimed live capability loss while slice 1 is model+shadow only.

Successor lanes

Lane	Owner	PR	Scope
PR A — authorization kernel (std.access + authorization_profile, visibility_grant dissolution, principal projection, migrated witnesses)	vivid-crab-386	#7586	Re-scope to drop publication plumbing; no parallel kernel PR
Deletion — remove placement gate + per-file roster authority	vivid-newt-418	(pending merge)	Must land before publisher work
PR B — sole modeled publisher model + shadow	snappy-lark-489	(new branch after A + deletion)	PublicationPolicy / PublicProjectionPlan / PublicationDecisionReceipt / change-local admission; no roster; live credential removal deferred

Recut plan thread: clever-ferret-451 msg_12645fbd / snappy-lark reply msg_d79be034.