test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites

The gated 410 arm is reached by two predicates, not one:

    row.revoked_at || (row.expires_at && Date.parse(row.expires_at) <= Date.now())

Both sites pinned only the revoked half. A pin on that half alone leaves
the expired half free to keep answering `410 EXPIRED_OR_REVOKED` on a
switched-off object — the same existence oracle, reached by the other
predicate, and invisible to every assertion in the file.

Both new cases carry the same reverse check the siblings do (with the
block ON an expired link is still 410) and the same
`expectIndistinguishable` byte-equality assertion against the
unknown-token answer. Expiry is stamped on the stored row rather than
minted: `createLink` refuses a past `expiresAt` outright with
`422 EXPIRY_IN_PAST`, so back-dating the row is the only way to reach an
already-expired link — which is what the passage of time does to a live
one, and the stamp the file's existing #13608 pins already use.

The changeset's "Consumer impact" paragraph named only the password-prompt
consequence. The 410 shift is equally consumer-visible — a different
sentence in the objectui console, which branches on the refusal STATUS and
never on the body's error code — so it is now named too, with the measured
consumer and its line range.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Author: claude

.changeset/share-link-probe-policy-gate.md

@@ -56,12 +56,24 @@ viewer still resolves the record. Mint-time behaviour is untouched, no
 `sys_share_link` row is written or read differently, and no error code is added
 or retired.
 
-**Consumer impact.** A viewer that renders its password prompt off
-`401 NEEDS_PASSWORD` shows "link invalid" instead, for links on a switched-off
-object only. That is the intended outcome and was accepted with the ruling: a
+**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
+changes, for links on a switched-off object only — and the measured consumer
+branches on status alone. On the objectui console at `67dadd6`,
+`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
+`res.status` and never on the body's error code, so:
+
+- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
+  rendered the password prompt and now render the 404 copy, "This link is
+  invalid or no longer available.";
+- the 410 arm rendered "This link has expired or was revoked." and now renders
+  that same 404 copy.
+
+Both shifts are the intended outcome and were accepted with the ruling: a
 correct password on such a link yields nothing, so prompting for one teaches the
-holder to open a door that is bricked up. Links on objects whose block is on are
-unaffected, prompt included.
+holder to open a door that is bricked up, and "expired or revoked" is a claim
+about a token whose existence the caller must not be able to confirm. Links on
+objects whose block is on are unaffected — prompt, 410 copy and 200 render
+included.
 
 Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
 adopting option A over option B (keep the 401 and document the accepted oracle)

packages/plugins/plugin-sharing/src/share-link-eligibility.test.ts

@@ -1259,6 +1259,35 @@ describe('[#14637] the route probe reads the standing policy before it answers f
     expectIndistinguishable(await resolve(link.token), await resolve(UNKNOWN_TOKEN));
   });
 
+  it("the 410 arm's OTHER half — an EXPIRED link falls through too, not just a revoked one", async () => {
+    const { driver, service, engine, schemas } = await boot(SHAREABLE);
+    const link = await service.createLink(
+      { object: 'article', recordId: 'a_ok', audience: 'public', permission: 'view' },
+      CALLER,
+    );
+    // Back-dated on the stored row, not minted: `createLink` refuses a past
+    // `expiresAt` outright (`422 EXPIRY_IN_PAST`), so this is the only way to
+    // reach an ALREADY-EXPIRED link — and it is exactly what the passage of
+    // time does to a live one. Same stamp the #13608 pins above use.
+    await driver.update('sys_share_link', link.id, {
+      expires_at: new Date(Date.now() - 60_000).toISOString(),
+    });
+    const resolve = mountResolveRoute(service, engine);
+
+    // `revoked_at` and `expires_at` are two predicates reaching ONE arm, so a
+    // pin on the revoked half alone leaves the expired half free to keep
+    // answering 410 on a switched-off object — the same oracle, reached by the
+    // other predicate.
+    //
+    // Reverse check: with the block ON, an expired link is still 410.
+    const on = await resolve(link.token);
+    expect(on.status).toBe(410);
+    expect(on.body?.error?.code).toBe('EXPIRED_OR_REVOKED');
+
+    switchOff(schemas);
+    expectIndistinguishable(await resolve(link.token), await resolve(UNKNOWN_TOKEN));
+  });
+
   it('fail-closed: an object whose schema the engine cannot answer for is refused, not probed', async () => {
     const { service, engine, schemas } = await boot(SHAREABLE);
     const link = await service.createLink(

packages/runtime/src/domains/share-links-enforcement-context.test.ts

@@ -753,6 +753,8 @@ describe('[#14637] the dispatcher probe reads the standing policy before it answ
         forgetSchema(): void;
         mint(input: { audience?: 'link_only' | 'signed_in'; password?: string }): Promise<string>;
         revoke(token: string): Promise<void>;
+        /** Let the token's own clock run out — the OTHER half of the same 410 arm. */
+        expire(token: string): void;
     }
 
     async function harness(): Promise<Harness> {
@@ -783,6 +785,15 @@ describe('[#14637] the dispatcher probe reads the standing policy before it answ
                 return link.token;
             },
             revoke: async (token: string) => { await svc.revokeLink(token, { isSystem: true } as any); },
+            // Stamped on the row rather than minted: `createLink` refuses a past
+            // `expiresAt` outright (`422 EXPIRY_IN_PAST`), so back-dating the
+            // stored row is the only way to reach an ALREADY-EXPIRED link — which
+            // is exactly what the passage of time does to a live one.
+            expire: (token: string) => {
+                const row = (tables.sys_share_link ?? []).find((r) => r.token === token);
+                if (!row) throw new Error('expire(): no sys_share_link row for that token');
+                row.expires_at = new Date(Date.now() - 60_000).toISOString();
+            },
             resolve: async (token, opts = {}) => {
                 const res = await handleShareLinksRequest(
                     deps,
@@ -874,6 +885,26 @@ describe('[#14637] the dispatcher probe reads the standing policy before it answ
         expectIndistinguishable(await h.resolve(token), await h.resolve(UNKNOWN_TOKEN));
     });
 
+    it("the 410 arm's OTHER half — an EXPIRED link falls through too, not just a revoked one", async () => {
+        const h = await harness();
+        const token = await h.mint({});
+        h.expire(token);
+
+        // `revoked_at` and `expires_at` are two predicates reaching ONE arm
+        // (`share-links.ts`: `row.revoked_at || (row.expires_at && …)`), so a
+        // pin on the revoked half alone leaves the expired half free to keep
+        // answering 410 on a switched-off object — the same oracle, reached by
+        // the other predicate.
+        //
+        // Reverse check: with the block ON, an expired link is still 410.
+        const on = await h.resolve(token);
+        expect(on.status).toBe(410);
+        expect(on.body?.error?.code).toBe('EXPIRED_OR_REVOKED');
+
+        h.switchOff();
+        expectIndistinguishable(await h.resolve(token), await h.resolve(UNKNOWN_TOKEN));
+    });
+
     it('fail-closed: an object whose schema the engine cannot answer for is refused, not probed', async () => {
         const h = await harness();
         const token = await h.mint({ password: 'hunter2' });