John Dvorak
8f863275c2
The binary branch of AuthorizationChecker.check rebuilt its options with a fixed six-field object, silently discarding partialGraphContext (and any other caller option) — binary checks denied grants the normal path allowed. Now spreads all caller options through. binary-partial-parity pins: partial grants above the threshold allow, below deny, persistent wins over partial, and binary decisions agree with normal decisions on the same overlay.