From 5ced929f85bbfa925fcf7a6d0f9d9fab5f703497 Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 17:59:54 +0100
Subject: [PATCH 01/18] test(capture): reproduce Viewer board-attachment
 authorization gap

---
 ...aptureBoardAttachmentAuthorizationTests.cs | 133 ++++++++++++++++++
 1 file changed, 133 insertions(+)
 create mode 100644 backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs

diff --git a/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs
new file mode 100644
index 000000000..254a1b0f8
--- /dev/null
+++ b/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs
@@ -0,0 +1,133 @@
+using FluentAssertions;
+using Moq;
+using Taskdeck.Application.DTOs;
+using Taskdeck.Application.Interfaces;
+using Taskdeck.Application.Services;
+using Taskdeck.Domain.Common;
+using Taskdeck.Domain.Entities;
+using Xunit;
+
+namespace Taskdeck.Application.Tests.Services;
+
+public class CaptureBoardAttachmentAuthorizationTests
+{
+    private readonly Mock<IUnitOfWork> _unitOfWork = new();
+    private readonly Mock<IAuthorizationService> _authorization = new();
+    private readonly Mock<IUserRepository> _users = new();
+    private readonly Mock<ILlmQueueRepository> _llmQueue = new();
+    private readonly User _user = new("capture-viewer", "capture-viewer@example.com", "Password1!");
+
+    public CaptureBoardAttachmentAuthorizationTests()
+    {
+        _unitOfWork.SetupGet(unit => unit.Users).Returns(_users.Object);
+        _unitOfWork.SetupGet(unit => unit.LlmQueue).Returns(_llmQueue.Object);
+        _users
+            .Setup(repository => repository.GetByIdAsync(
+                _user.Id,
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(_user);
+        _llmQueue
+            .Setup(repository => repository.AddAsync(
+                It.IsAny<LlmRequest>(),
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync((LlmRequest request, CancellationToken _) => request);
+        _unitOfWork
+            .Setup(unit => unit.SaveChangesAsync(It.IsAny<CancellationToken>()))
+            .ReturnsAsync(1);
+    }
+
+    private CaptureService BuildService() => new(
+        _unitOfWork.Object,
+        _authorization.Object);
+
+    [Fact]
+    public async Task CreateAsync_RejectsReadableBoard_WhenCallerCannotWrite()
+    {
+        var boardId = Guid.NewGuid();
+        _authorization
+            .Setup(service => service.CanReadBoardAsync(_user.Id, boardId))
+            .ReturnsAsync(Result.Success(true));
+        _authorization
+            .Setup(service => service.CanWriteBoardAsync(_user.Id, boardId))
+            .ReturnsAsync(Result.Success(false));
+
+        var result = await BuildService().CreateAsync(
+            _user.Id,
+            new CreateCaptureItemDto(boardId, "Viewer must not attach this capture", "paste"));
+
+        result.IsSuccess.Should().BeFalse();
+        result.ErrorCode.Should().Be(ErrorCodes.Forbidden);
+        _authorization.Verify(
+            service => service.CanWriteBoardAsync(_user.Id, boardId),
+            Times.Once);
+        _llmQueue.Verify(
+            repository => repository.AddAsync(
+                It.IsAny<LlmRequest>(),
+                It.IsAny<CancellationToken>()),
+            Times.Never);
+        _unitOfWork.Verify(
+            unit => unit.SaveChangesAsync(It.IsAny<CancellationToken>()),
+            Times.Never);
+    }
+
+    [Fact]
+    public async Task CreateAsync_PropagatesWriteAuthorizationFailure_WithoutPersistence()
+    {
+        var boardId = Guid.NewGuid();
+        _authorization
+            .Setup(service => service.CanReadBoardAsync(_user.Id, boardId))
+            .ReturnsAsync(Result.Success(true));
+        _authorization
+            .Setup(service => service.CanWriteBoardAsync(_user.Id, boardId))
+            .ReturnsAsync(Result.Failure<bool>(
+                ErrorCodes.NotFound,
+                "Board not found"));
+
+        var result = await BuildService().CreateAsync(
+            _user.Id,
+            new CreateCaptureItemDto(boardId, "Missing board", "paste"));
+
+        result.IsSuccess.Should().BeFalse();
+        result.ErrorCode.Should().Be(ErrorCodes.NotFound);
+        result.ErrorMessage.Should().Be("Board not found");
+        _llmQueue.Verify(
+            repository => repository.AddAsync(
+                It.IsAny<LlmRequest>(),
+                It.IsAny<CancellationToken>()),
+            Times.Never);
+        _unitOfWork.Verify(
+            unit => unit.SaveChangesAsync(It.IsAny<CancellationToken>()),
+            Times.Never);
+    }
+
+    [Fact]
+    public async Task CreateAsync_AllowsWritableBoard_WithoutConsultingReadPermission()
+    {
+        var boardId = Guid.NewGuid();
+        _authorization
+            .Setup(service => service.CanWriteBoardAsync(_user.Id, boardId))
+            .ReturnsAsync(Result.Success(true));
+        _authorization
+            .Setup(service => service.CanReadBoardAsync(_user.Id, boardId))
+            .ThrowsAsync(new InvalidOperationException("Read permission is not the attachment contract"));
+
+        var result = await BuildService().CreateAsync(
+            _user.Id,
+            new CreateCaptureItemDto(boardId, "Editor may attach this capture", "paste"));
+
+        result.IsSuccess.Should().BeTrue();
+        result.Value.BoardId.Should().Be(boardId);
+        _authorization.Verify(
+            service => service.CanReadBoardAsync(It.IsAny<Guid>(), It.IsAny<Guid>()),
+            Times.Never);
+        _llmQueue.Verify(
+            repository => repository.AddAsync(
+                It.Is<LlmRequest>(request =>
+                    request.UserId == _user.Id && request.BoardId == boardId),
+                It.IsAny<CancellationToken>()),
+            Times.Once);
+        _unitOfWork.Verify(
+            unit => unit.SaveChangesAsync(It.IsAny<CancellationToken>()),
+            Times.Once);
+    }
+}

From 770b4872619908784198542f995b289642d5e7f7 Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:00:11 +0100
Subject: [PATCH 02/18] test(capture): add authenticated Viewer attachment
 negative

---
 ...ureBoardAttachmentAuthorizationApiTests.cs | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs

diff --git a/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs b/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs
new file mode 100644
index 000000000..9a8d299f5
--- /dev/null
+++ b/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs
@@ -0,0 +1,97 @@
+using System.Net;
+using System.Net.Http.Json;
+using FluentAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Taskdeck.Api.Tests.Support;
+using Taskdeck.Application.DTOs;
+using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Enums;
+using Taskdeck.Infrastructure.Persistence;
+using Xunit;
+
+namespace Taskdeck.Api.Tests;
+
+public class CaptureBoardAttachmentAuthorizationApiTests : IClassFixture<TestWebApplicationFactory>
+{
+    private readonly TestWebApplicationFactory _factory;
+    private readonly HttpClient _client;
+
+    public CaptureBoardAttachmentAuthorizationApiTests(TestWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+    }
+
+    [Fact]
+    public async Task Viewer_CannotCreateCaptureAttachedToReadableBoard()
+    {
+        var suffix = Guid.NewGuid().ToString("N");
+        var owner = await ApiTestHarness.AuthenticateAsync(_client, $"capture-owner-{suffix}");
+        var board = await ApiTestHarness.CreateBoardAsync(
+            _client,
+            $"Viewer capture boundary {suffix}");
+        var viewer = await ApiTestHarness.AuthenticateAsync(_client, $"capture-viewer-{suffix}");
+
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<TaskdeckDbContext>();
+            db.BoardAccesses.Add(new BoardAccess(
+                board.Id,
+                viewer.UserId,
+                UserRole.Viewer,
+                owner.UserId));
+            await db.SaveChangesAsync();
+        }
+
+        var response = await _client.PostAsJsonAsync(
+            "/api/capture/items",
+            new CreateCaptureItemDto(
+                board.Id,
+                "A Viewer must not attach a capture to this board",
+                "paste"));
+
+        await ApiTestHarness.AssertErrorContractAsync(
+            response,
+            HttpStatusCode.Forbidden,
+            "Forbidden");
+        var captures = await _client.GetFromJsonAsync<List<CaptureItemSummaryDto>>(
+            "/api/capture/items");
+        captures.Should().BeEmpty(
+            "a refused board attachment must not persist a board-scoped capture");
+    }
+
+    [Fact]
+    public async Task Editor_CanCreateCaptureAttachedToWritableBoard()
+    {
+        var suffix = Guid.NewGuid().ToString("N");
+        var owner = await ApiTestHarness.AuthenticateAsync(_client, $"capture-owner-{suffix}");
+        var board = await ApiTestHarness.CreateBoardAsync(
+            _client,
+            $"Editor capture boundary {suffix}");
+        var editor = await ApiTestHarness.AuthenticateAsync(_client, $"capture-editor-{suffix}");
+
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<TaskdeckDbContext>();
+            db.BoardAccesses.Add(new BoardAccess(
+                board.Id,
+                editor.UserId,
+                UserRole.Editor,
+                owner.UserId));
+            await db.SaveChangesAsync();
+        }
+
+        var response = await _client.PostAsJsonAsync(
+            "/api/capture/items",
+            new CreateCaptureItemDto(
+                board.Id,
+                "An Editor may attach a capture to this board",
+                "paste"));
+
+        response.StatusCode.Should().Be(HttpStatusCode.Created);
+        var capture = await response.Content.ReadFromJsonAsync<CaptureItemDto>();
+        capture.Should().NotBeNull();
+        capture!.BoardId.Should().Be(board.Id);
+        capture.UserId.Should().Be(editor.UserId);
+    }
+}

From ff77d8a0332fd273df4456e588bf03677f8e8135 Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:08:37 +0100
Subject: [PATCH 03/18] fix(capture): require write access for board attachment

---
 .../src/Taskdeck.Application/Services/CaptureService.cs  | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/backend/src/Taskdeck.Application/Services/CaptureService.cs b/backend/src/Taskdeck.Application/Services/CaptureService.cs
index 7128c2f64..dc8d6c5a4 100644
--- a/backend/src/Taskdeck.Application/Services/CaptureService.cs
+++ b/backend/src/Taskdeck.Application/Services/CaptureService.cs
@@ -191,12 +191,17 @@ public async Task<Result<CaptureItemDto>> CreateAsync(
 
             if (dto.BoardId.HasValue)
             {
-                var permissionResult = await _authorizationService.CanReadBoardAsync(userId, dto.BoardId.Value);
+                // A board-scoped capture can enter that board's proposal queue. Keep the
+                // attachment boundary aligned with triage: readable Viewer access is not
+                // authority to inject work into a board only writers can modify (#3291).
+                var permissionResult = await _authorizationService.CanWriteBoardAsync(userId, dto.BoardId.Value);
                 if (!permissionResult.IsSuccess)
                     return Result.Failure<CaptureItemDto>(permissionResult.ErrorCode, permissionResult.ErrorMessage);
 
                 if (!permissionResult.Value)
-                    return Result.Failure<CaptureItemDto>(ErrorCodes.Forbidden, "You do not have access to this board");
+                    return Result.Failure<CaptureItemDto>(
+                        ErrorCodes.Forbidden,
+                        "You do not have permission to attach captures to this board");
             }
 
             var sourceResult = ResolveSource(dto.Source);

From 553ad7183149eeccbe8fec318d4224c1c3c88933 Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:20:28 +0100
Subject: [PATCH 04/18] test(capture): import shared error codes

---
 .../Services/CaptureBoardAttachmentAuthorizationTests.cs         | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs
index 254a1b0f8..10cc76aac 100644
--- a/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs
+++ b/backend/tests/Taskdeck.Application.Tests/Services/CaptureBoardAttachmentAuthorizationTests.cs
@@ -5,6 +5,7 @@
 using Taskdeck.Application.Services;
 using Taskdeck.Domain.Common;
 using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Exceptions;
 using Xunit;
 
 namespace Taskdeck.Application.Tests.Services;

From cac5fe03b65fedae7c21eb93d9fd9e1c4d8a2c81 Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 19:36:20 +0100
Subject: [PATCH 05/18] test(capture): align dual-write fixture with write
 authorization

---
 .../Services/CaptureServiceDualWriteTests.cs                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceDualWriteTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceDualWriteTests.cs
index 589a64cf0..4e44b5266 100644
--- a/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceDualWriteTests.cs
+++ b/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceDualWriteTests.cs
@@ -176,7 +176,7 @@ public async Task CreateAsync_WithDualWriteEnabled_ShouldCarryTheBoardAsContextH
         var boardId = Guid.NewGuid();
         Capture? mirrored = null;
         _authorizationServiceMock
-            .Setup(s => s.CanReadBoardAsync(_userId, boardId))
+            .Setup(s => s.CanWriteBoardAsync(_userId, boardId))
             .ReturnsAsync(Result.Success(true));
         _captureStoreMock
             .Setup(s => s.AddAsync(It.IsAny<Capture>(), It.IsAny<CancellationToken>()))

From 2026199a20825e1d2c4615faf04175fb51ea13ed Mon Sep 17 00:00:00 2001
From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com>
Date: Sun, 20 Sep 2026 19:36:38 +0100
Subject: [PATCH 06/18] test(capture): keep authorization usernames within
 contract

---
 .../CaptureBoardAttachmentAuthorizationApiTests.cs   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs b/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs
index 9a8d299f5..45e90fc64 100644
--- a/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs
+++ b/backend/tests/Taskdeck.Api.Tests/CaptureBoardAttachmentAuthorizationApiTests.cs
@@ -25,12 +25,12 @@ public CaptureBoardAttachmentAuthorizationApiTests(TestWebApplicationFactory fac
     [Fact]
     public async Task Viewer_CannotCreateCaptureAttachedToReadableBoard()
     {
-        var suffix = Guid.NewGuid().ToString("N");
-        var owner = await ApiTestHarness.AuthenticateAsync(_client, $"capture-owner-{suffix}");
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var owner = await ApiTestHarness.AuthenticateAsync(_client, "cap-owner");
         var board = await ApiTestHarness.CreateBoardAsync(
             _client,
             $"Viewer capture boundary {suffix}");
-        var viewer = await ApiTestHarness.AuthenticateAsync(_client, $"capture-viewer-{suffix}");
+        var viewer = await ApiTestHarness.AuthenticateAsync(_client, "cap-viewer");
 
         using (var scope = _factory.Services.CreateScope())
         {
@@ -63,12 +63,12 @@ await ApiTestHarness.AssertErrorContractAsync(
     [Fact]
     public async Task Editor_CanCreateCaptureAttachedToWritableBoard()
     {
-        var suffix = Guid.NewGuid().ToString("N");
-        var owner = await ApiTestHarness.AuthenticateAsync(_client, $"capture-owner-{suffix}");
+        var suffix = Guid.NewGuid().ToString("N")[..8];
+        var owner = await ApiTestHarness.AuthenticateAsync(_client, "cap-owner");
         var board = await ApiTestHarness.CreateBoardAsync(
             _client,
             $"Editor capture boundary {suffix}");
-        var editor = await ApiTestHarness.AuthenticateAsync(_client, $"capture-editor-{suffix}");
+        var editor = await ApiTestHarness.AuthenticateAsync(_client, "cap-editor");
 
         using (var scope = _factory.Services.CreateScope())
         {

From 3311e01b383b6f26079731917f127347ad685965 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Mon, 21 Sep 2026 19:45:22 +0100
Subject: [PATCH 07/18] test(capture): align fixtures with write authorization

---
 backend/tests/Taskdeck.Api.Tests/CaptureApiTests.cs | 13 ++++++++++---
 .../Services/CaptureServiceTests.cs                 |  6 +++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/backend/tests/Taskdeck.Api.Tests/CaptureApiTests.cs b/backend/tests/Taskdeck.Api.Tests/CaptureApiTests.cs
index 284aaa6a4..126ed39f8 100644
--- a/backend/tests/Taskdeck.Api.Tests/CaptureApiTests.cs
+++ b/backend/tests/Taskdeck.Api.Tests/CaptureApiTests.cs
@@ -888,8 +888,8 @@ public async Task Triage_ShouldSucceed_WhenTargetBoardMemberIsEditor()
     [Fact]
     public async Task Triage_ShouldReturnForbidden_WhenAlreadyLinkedBoardIsReadOnlyForCaller()
     {
-        // The gate has to sit on the effective board, not only on the triage body: a capture created
-        // with a readable board (create is read-gated) and accepted with no body is the same vector.
+        // Create while the caller is write-capable, then demote the membership before triage. The
+        // already-linked board gate must still reject the read-only caller with no target body.
         var ownerClient = _factory.CreateClient();
         var viewerClient = _factory.CreateClient();
         await ApiTestHarness.AuthenticateAsync(ownerClient, "capture-triage-linked-gate-owner");
@@ -898,8 +898,10 @@ public async Task Triage_ShouldReturnForbidden_WhenAlreadyLinkedBoardIsReadOnlyF
 
         var grantResponse = await ownerClient.PostAsJsonAsync(
             $"/api/boards/{board.Id}/access",
-            new GrantAccessDto(board.Id, viewer.UserId, UserRole.Viewer));
+            new GrantAccessDto(board.Id, viewer.UserId, UserRole.Editor));
         grantResponse.StatusCode.Should().Be(HttpStatusCode.OK);
+        var access = await grantResponse.Content.ReadFromJsonAsync<BoardAccessDto>();
+        access.Should().NotBeNull();
 
         var createResponse = await viewerClient.PostAsJsonAsync(
             "/api/capture/items",
@@ -909,6 +911,11 @@ public async Task Triage_ShouldReturnForbidden_WhenAlreadyLinkedBoardIsReadOnlyF
         created.Should().NotBeNull();
         created!.BoardId.Should().Be(board.Id);
 
+        var demoteResponse = await ownerClient.PutAsJsonAsync(
+            $"/api/boards/{board.Id}/access/{access!.Id}",
+            new UpdateAccessDto(UserRole.Viewer));
+        demoteResponse.StatusCode.Should().Be(HttpStatusCode.OK);
+
         var triageResponse = await viewerClient.PostAsync($"/api/capture/items/{created.Id}/triage", null);
 
         await ApiTestHarness.AssertErrorContractAsync(triageResponse, HttpStatusCode.Forbidden, "Forbidden");
diff --git a/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.cs
index fddbdf5dd..088e70016 100644
--- a/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.cs
+++ b/backend/tests/Taskdeck.Application.Tests/Services/CaptureServiceTests.cs
@@ -125,7 +125,7 @@ public async Task CreateAsync_ShouldPersistCaptureRequestAndReturnDetail()
             .Setup(r => r.GetByIdAsync(userId, default))
             .ReturnsAsync(user);
         _authorizationServiceMock
-            .Setup(s => s.CanReadBoardAsync(userId, boardId))
+            .Setup(s => s.CanWriteBoardAsync(userId, boardId))
             .ReturnsAsync(Result.Success(true));
         _llmQueueRepositoryMock
             .Setup(r => r.AddAsync(It.IsAny<LlmRequest>(), default))
@@ -177,7 +177,7 @@ public async Task CreateAsync_ShouldAssignTranscriptRequestType_ForTranscriptSou
             .Setup(r => r.GetByIdAsync(userId, default))
             .ReturnsAsync(user);
         _authorizationServiceMock
-            .Setup(s => s.CanReadBoardAsync(userId, boardId))
+            .Setup(s => s.CanWriteBoardAsync(userId, boardId))
             .ReturnsAsync(Result.Success(true));
         _llmQueueRepositoryMock
             .Setup(r => r.AddAsync(It.IsAny<LlmRequest>(), default))
@@ -250,7 +250,7 @@ public async Task CreateAsync_ShouldReturnForbidden_WhenBoardAccessIsDenied()
             .Setup(r => r.GetByIdAsync(userId, default))
             .ReturnsAsync(user);
         _authorizationServiceMock
-            .Setup(s => s.CanReadBoardAsync(userId, boardId))
+            .Setup(s => s.CanWriteBoardAsync(userId, boardId))
             .ReturnsAsync(Result.Success(false));
 
         var result = await _service.CreateAsync(userId, dto);

From a38a890b9a4dbf2f5c57244a6ff181eb27de65d1 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Mon, 21 Sep 2026 22:13:39 +0100
Subject: [PATCH 08/18] fix(capture): serialize board authorization with
 enqueue

---
 .../Interfaces/IUnitOfWork.cs                 | 13 ++++++
 .../Services/CaptureService.cs                | 41 +++++++++++++++++++
 .../Repositories/UnitOfWork.cs                |  9 ++++
 3 files changed, 63 insertions(+)

diff --git a/backend/src/Taskdeck.Application/Interfaces/IUnitOfWork.cs b/backend/src/Taskdeck.Application/Interfaces/IUnitOfWork.cs
index 9be0965e5..6db10d4b2 100644
--- a/backend/src/Taskdeck.Application/Interfaces/IUnitOfWork.cs
+++ b/backend/src/Taskdeck.Application/Interfaces/IUnitOfWork.cs
@@ -1,3 +1,5 @@
+using System.Data;
+
 namespace Taskdeck.Application.Interfaces;
 
 public interface IUnitOfWork
@@ -58,6 +60,17 @@ public interface IUnitOfWork
     Task BeginReadTransactionAsync(CancellationToken cancellationToken = default);
 
     Task BeginTransactionAsync(CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Begins a transaction at an explicit isolation level. The default implementation keeps
+    /// lightweight test doubles source-compatible; the production unit of work overrides it so
+    /// authorization reads that guard a write can share a serializable snapshot.
+    /// </summary>
+    Task BeginTransactionAsync(
+        IsolationLevel isolationLevel,
+        CancellationToken cancellationToken = default)
+        => BeginTransactionAsync(cancellationToken);
+
     Task CommitTransactionAsync(CancellationToken cancellationToken = default);
     Task RollbackTransactionAsync(CancellationToken cancellationToken = default);
 }
diff --git a/backend/src/Taskdeck.Application/Services/CaptureService.cs b/backend/src/Taskdeck.Application/Services/CaptureService.cs
index dc8d6c5a4..58e3141d5 100644
--- a/backend/src/Taskdeck.Application/Services/CaptureService.cs
+++ b/backend/src/Taskdeck.Application/Services/CaptureService.cs
@@ -1,3 +1,4 @@
+using System.Data;
 using Microsoft.Extensions.Logging;
 using Taskdeck.Application.DTOs;
 using Taskdeck.Application.Interfaces;
@@ -183,6 +184,17 @@ public async Task<Result<CaptureItemDto>> CreateAsync(
         if (userId == Guid.Empty)
             return Result.Failure<CaptureItemDto>(ErrorCodes.ValidationError, "UserId cannot be empty");
 
+        var boardTransactionStarted = false;
+
+        async Task RollbackBoardTransactionAsync()
+        {
+            if (!boardTransactionStarted)
+                return;
+
+            await _unitOfWork.RollbackTransactionAsync(cancellationToken);
+            boardTransactionStarted = false;
+        }
+
         try
         {
             var user = await _unitOfWork.Users.GetByIdAsync(userId, cancellationToken);
@@ -191,22 +203,39 @@ public async Task<Result<CaptureItemDto>> CreateAsync(
 
             if (dto.BoardId.HasValue)
             {
+                // The authorization read and queue insert must share one serializable snapshot.
+                // Otherwise a board owner can demote this caller after CanWriteBoardAsync returns
+                // but before SaveChangesAsync, admitting a capture under stale write authority.
+                await _unitOfWork.BeginTransactionAsync(
+                    IsolationLevel.Serializable,
+                    cancellationToken);
+                boardTransactionStarted = true;
+
                 // A board-scoped capture can enter that board's proposal queue. Keep the
                 // attachment boundary aligned with triage: readable Viewer access is not
                 // authority to inject work into a board only writers can modify (#3291).
                 var permissionResult = await _authorizationService.CanWriteBoardAsync(userId, dto.BoardId.Value);
                 if (!permissionResult.IsSuccess)
+                {
+                    await RollbackBoardTransactionAsync();
                     return Result.Failure<CaptureItemDto>(permissionResult.ErrorCode, permissionResult.ErrorMessage);
+                }
 
                 if (!permissionResult.Value)
+                {
+                    await RollbackBoardTransactionAsync();
                     return Result.Failure<CaptureItemDto>(
                         ErrorCodes.Forbidden,
                         "You do not have permission to attach captures to this board");
+                }
             }
 
             var sourceResult = ResolveSource(dto.Source);
             if (!sourceResult.IsSuccess)
+            {
+                await RollbackBoardTransactionAsync();
                 return Result.Failure<CaptureItemDto>(sourceResult.ErrorCode, sourceResult.ErrorMessage);
+            }
 
             var payload = new CapturePayloadV1(
                 CaptureRequestContract.CurrentSchemaVersion,
@@ -248,6 +277,12 @@ public async Task<Result<CaptureItemDto>> CreateAsync(
 
             await _unitOfWork.SaveChangesAsync(cancellationToken);
 
+            if (boardTransactionStarted)
+            {
+                await _unitOfWork.CommitTransactionAsync(cancellationToken);
+                boardTransactionStarted = false;
+            }
+
             return Result.Success(MapToDetailDto(
                 request,
                 attributedPayload,
@@ -256,8 +291,14 @@ public async Task<Result<CaptureItemDto>> CreateAsync(
         }
         catch (DomainException ex)
         {
+            await RollbackBoardTransactionAsync();
             return Result.Failure<CaptureItemDto>(ex.ErrorCode, ex.Message);
         }
+        catch
+        {
+            await RollbackBoardTransactionAsync();
+            throw;
+        }
     }
 
     public async Task<Result<IReadOnlyList<CaptureItemSummaryDto>>> ListAsync(
diff --git a/backend/src/Taskdeck.Infrastructure/Repositories/UnitOfWork.cs b/backend/src/Taskdeck.Infrastructure/Repositories/UnitOfWork.cs
index 1955d6c38..d967e949e 100644
--- a/backend/src/Taskdeck.Infrastructure/Repositories/UnitOfWork.cs
+++ b/backend/src/Taskdeck.Infrastructure/Repositories/UnitOfWork.cs
@@ -262,6 +262,15 @@ public async Task BeginTransactionAsync(CancellationToken cancellationToken = de
         _transaction = await _context.Database.BeginTransactionAsync(cancellationToken);
     }
 
+    public async Task BeginTransactionAsync(
+        IsolationLevel isolationLevel,
+        CancellationToken cancellationToken = default)
+    {
+        _transaction = await _context.Database.BeginTransactionAsync(
+            isolationLevel,
+            cancellationToken);
+    }
+
     public async Task CommitTransactionAsync(CancellationToken cancellationToken = default)
     {
         var transaction = _transaction;

From 86eca5d8c3817577ef9b1adaf3d4d68932a86a6d Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Mon, 21 Sep 2026 22:13:48 +0100
Subject: [PATCH 09/18] fix(capture): hide board entry points for viewers

---
 .../src/components/board/BoardActionRail.vue         |  9 ++++++++-
 .../src/components/board/BoardDialogHost.vue         |  2 +-
 .../src/tests/components/BoardActionRail.spec.ts     | 11 +++++++++--
 .../src/tests/components/BoardDialogHost.spec.ts     |  6 ++++++
 .../taskdeck-web/src/tests/views/BoardView.spec.ts   | 12 ++++++++++++
 .../src/tests/views/paper/PaperBoardView.spec.ts     |  8 ++++++++
 frontend/taskdeck-web/src/views/BoardView.vue        |  7 ++++++-
 .../taskdeck-web/src/views/paper/PaperBoardView.vue  | 10 +++++++++-
 8 files changed, 59 insertions(+), 6 deletions(-)

diff --git a/frontend/taskdeck-web/src/components/board/BoardActionRail.vue b/frontend/taskdeck-web/src/components/board/BoardActionRail.vue
index 60e37262d..19c45c7f8 100644
--- a/frontend/taskdeck-web/src/components/board/BoardActionRail.vue
+++ b/frontend/taskdeck-web/src/components/board/BoardActionRail.vue
@@ -1,4 +1,11 @@
 <script setup lang="ts">
+withDefaults(defineProps<{
+  /** Board-scoped captures require the server-confirmed write capability. */
+  canCapture?: boolean
+}>(), {
+  canCapture: true,
+})
+
 defineEmits<{
   capture: []
   chat: []
@@ -14,7 +21,7 @@ defineEmits<{
     data-board-action-rail
   >
     <span class="td-action-rail__label">Board Actions</span>
-    <button class="td-action-rail__btn" @click="$emit('capture')">
+    <button v-if="canCapture" class="td-action-rail__btn" @click="$emit('capture')">
       Capture here
     </button>
     <button class="td-action-rail__btn" @click="$emit('chat')">
diff --git a/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue b/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
index 890814400..76724a1a0 100644
--- a/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
+++ b/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
@@ -55,7 +55,7 @@ defineEmits<{
     through the `useShellKeyboardHelp` seam (#2007).
   -->
   <CaptureModal
-    v-if="showCaptureModal && board"
+    v-if="showCaptureModal && board && board.canWrite !== false"
     :board-id="boardId"
     :board-name="board.name"
     @close="$emit('update:showCaptureModal', false)"
diff --git a/frontend/taskdeck-web/src/tests/components/BoardActionRail.spec.ts b/frontend/taskdeck-web/src/tests/components/BoardActionRail.spec.ts
index 5f1577ea0..5d77c9ca4 100644
--- a/frontend/taskdeck-web/src/tests/components/BoardActionRail.spec.ts
+++ b/frontend/taskdeck-web/src/tests/components/BoardActionRail.spec.ts
@@ -3,8 +3,8 @@ import { mount } from '@vue/test-utils'
 import BoardActionRail from '../../components/board/BoardActionRail.vue'
 
 describe('BoardActionRail', () => {
-  function mountRail() {
-    return mount(BoardActionRail)
+  function mountRail(props: { canCapture?: boolean } = {}) {
+    return mount(BoardActionRail, { props })
   }
 
   it('renders all action buttons', () => {
@@ -29,6 +29,13 @@ describe('BoardActionRail', () => {
     expect(wrapper.emitted('capture')).toHaveLength(1)
   })
 
+  it('hides board capture for a read-only board', () => {
+    const wrapper = mountRail({ canCapture: false })
+
+    expect(wrapper.findAll('button').some((button) => button.text().trim() === 'Capture here')).toBe(false)
+    expect(wrapper.emitted('capture')).toBeUndefined()
+  })
+
   it('emits chat when Ask assistant is clicked', async () => {
     const wrapper = mountRail()
     const btn = wrapper.findAll('button').find(b => b.text().trim() === 'Ask assistant')
diff --git a/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts b/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
index ce78522c6..c3f6e6d00 100644
--- a/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
+++ b/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
@@ -119,5 +119,11 @@ describe('BoardDialogHost', () => {
 
     await wrapper.setProps({ board: null })
     expect(wrapper.find('[data-testid="capture-close"]').exists()).toBe(false)
+
+    await wrapper.setProps({
+      board: { ...board, canWrite: false },
+      showCaptureModal: true,
+    })
+    expect(wrapper.find('[data-testid="capture-close"]').exists()).toBe(false)
   })
 })
diff --git a/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts b/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
index c7b20d934..881280d15 100644
--- a/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
@@ -511,6 +511,18 @@ describe('BoardView', () => {
     expect(wrapper.get('[data-testid="capture-modal"]').text()).toContain('Capture Ops Board board-1')
   })
 
+  it('does not expose board capture for a read-only board', async () => {
+    mockBoardStore.currentBoard = {
+      ...mockBoardStore.currentBoard,
+      canWrite: false,
+    }
+    const wrapper = mountView()
+    await waitForUi()
+
+    expect(wrapper.findAll('button').some((node) => node.text().trim() === 'Capture here')).toBe(false)
+    expect(wrapper.find('[data-testid="capture-modal"]').exists()).toBe(false)
+  })
+
   it('opens the column form when add card is triggered without columns', async () => {
     mockBoardStore.currentBoard = {
       ...mockBoardStore.currentBoard,
diff --git a/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts b/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
index 1e4b4efe1..c50643895 100644
--- a/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
@@ -299,6 +299,14 @@ describe('PaperBoardView', () => {
     })
   })
 
+  it('hides board capture for a read-only board', () => {
+    mockBoardStore.currentBoard = { ...board, canWrite: false }
+
+    const wrapper = mountView()
+
+    expect(wrapper.findAll('button').some((button) => button.text().includes('Capture here'))).toBe(false)
+  })
+
   it('does not fetch board data itself because the wrapping BoardView owns loading', () => {
     mountView()
     expect(mockBoardStore.fetchBoard).not.toHaveBeenCalled()
diff --git a/frontend/taskdeck-web/src/views/BoardView.vue b/frontend/taskdeck-web/src/views/BoardView.vue
index f257cf469..93d13abec 100644
--- a/frontend/taskdeck-web/src/views/BoardView.vue
+++ b/frontend/taskdeck-web/src/views/BoardView.vue
@@ -623,6 +623,7 @@ useKeyboardShortcuts([
 
         <BoardActionRail
           v-if="routedBoard"
+          :can-capture="routedBoard.canWrite !== false"
           @capture="openBoardCaptureModal"
           @chat="openBoardChat"
           @review="openBoardReview"
@@ -638,7 +639,11 @@ useKeyboardShortcuts([
           description="Boards are where approved work appears. Capture new input, review the proposed changes, then come back here to manage the result."
         >
           <template #actions>
-            <button class="td-btn td-btn--secondary td-btn--sm" @click="openBoardCaptureModal">Capture here</button>
+            <button
+              v-if="routedBoard.canWrite !== false"
+              class="td-btn td-btn--secondary td-btn--sm"
+              @click="openBoardCaptureModal"
+            >Capture here</button>
             <button class="td-btn td-btn--secondary td-btn--sm" @click="openBoardReview">Review proposals</button>
           </template>
         </WorkspaceHelpCallout>
diff --git a/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue b/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
index 17be74652..dde2c17c0 100644
--- a/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
+++ b/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
@@ -512,6 +512,8 @@ onBeforeRouteUpdate(guardDirtyNavigation)
  * honouring a column end-to-end is the open half of `#1984`.
  */
 function openCapture(_column: Column) {
+  if (routedBoard.value?.canWrite === false) return
+
   void router.push({
     name: 'workspace-inbox',
     query: { boardId: boardId.value },
@@ -526,6 +528,8 @@ function openReview() {
 }
 
 function openCaptureBoard() {
+  if (routedBoard.value?.canWrite === false) return
+
   void router.push({
     name: 'workspace-inbox',
     query: { boardId: boardId.value },
@@ -882,7 +886,11 @@ async function addStarterColumns() {
             data-testid="paper-board-settings"
             @click="openBoardSettings"
           />
-          <PaperHLBtn label="Capture here" @click="openCaptureBoard" />
+          <PaperHLBtn
+            v-if="routedBoard && routedBoard.canWrite !== false"
+            label="Capture here"
+            @click="openCaptureBoard"
+          />
           <PaperHLBtn variant="ember" label="Review" @click="openReview" />
         </div>
       </header>

From e336ccb6b36ee70d2ade78c4a7364ef7fda3f97f Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Mon, 21 Sep 2026 22:43:33 +0100
Subject: [PATCH 10/18] fix(capture): hide column capture for viewers

---
 .../taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts | 1 +
 frontend/taskdeck-web/src/views/paper/PaperBoardColumn.vue    | 4 ++++
 frontend/taskdeck-web/src/views/paper/PaperBoardView.vue      | 1 +
 3 files changed, 6 insertions(+)

diff --git a/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts b/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
index c50643895..95bdf32a7 100644
--- a/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/paper/PaperBoardView.spec.ts
@@ -305,6 +305,7 @@ describe('PaperBoardView', () => {
     const wrapper = mountView()
 
     expect(wrapper.findAll('button').some((button) => button.text().includes('Capture here'))).toBe(false)
+    expect(wrapper.findAll('[data-testid="paper-column-capture"]').length).toBe(0)
   })
 
   it('does not fetch board data itself because the wrapping BoardView owns loading', () => {
diff --git a/frontend/taskdeck-web/src/views/paper/PaperBoardColumn.vue b/frontend/taskdeck-web/src/views/paper/PaperBoardColumn.vue
index e9dd58d70..46b60f3d0 100644
--- a/frontend/taskdeck-web/src/views/paper/PaperBoardColumn.vue
+++ b/frontend/taskdeck-web/src/views/paper/PaperBoardColumn.vue
@@ -54,6 +54,8 @@ const props = withDefaults(
     composerOpen?: boolean
     composerBusy?: boolean
     composerError?: string | null
+    /** Hide board-scoped capture when the current viewer cannot write. */
+    canCapture?: boolean
   }>(),
   {
     cardVariant: 'index',
@@ -68,6 +70,7 @@ const props = withDefaults(
     composerOpen: false,
     composerBusy: false,
     composerError: null,
+    canCapture: true,
   },
 )
 
@@ -318,6 +321,7 @@ const proposalMarker = useBoardProposalMarker('column', () => props.column.id)
         />
 
         <button
+          v-if="canCapture"
           type="button"
           class="paper-board-column__capture"
           :aria-label="t('boardDetail.card.captureAria')"
diff --git a/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue b/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
index dde2c17c0..9b2278d3e 100644
--- a/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
+++ b/frontend/taskdeck-web/src/views/paper/PaperBoardView.vue
@@ -1037,6 +1037,7 @@ async function addStarterColumns() {
             :composer-open="composerColumnId === column.id"
             :composer-busy="composerBusy"
             :composer-error="composerError"
+            :can-capture="routedBoard?.canWrite !== false"
             @capture="openCapture"
             @select="emit('column-select', column.id)"
             @toggle-collapse="toggleColumnCollapse"

From 0a77af8eb46526fe372cc25d04fdabf18072516b Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Mon, 21 Sep 2026 23:28:43 +0100
Subject: [PATCH 11/18] fix(auth): refresh tracked board access before capture

---
 .../Repositories/BoardAccessRepository.cs     |  1 +
 .../BoardAccessRepositoryFreshnessTests.cs    | 62 +++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 backend/tests/Taskdeck.Api.Tests/BoardAccessRepositoryFreshnessTests.cs

diff --git a/backend/src/Taskdeck.Infrastructure/Repositories/BoardAccessRepository.cs b/backend/src/Taskdeck.Infrastructure/Repositories/BoardAccessRepository.cs
index 442977007..f130e9561 100644
--- a/backend/src/Taskdeck.Infrastructure/Repositories/BoardAccessRepository.cs
+++ b/backend/src/Taskdeck.Infrastructure/Repositories/BoardAccessRepository.cs
@@ -18,6 +18,7 @@ public BoardAccessRepository(TaskdeckDbContext context) : base(context)
     public async Task<BoardAccess?> GetByBoardAndUserAsync(Guid boardId, Guid userId, CancellationToken cancellationToken = default)
     {
         return await _context.BoardAccesses
+            .AsNoTracking()
             .Include(ba => ba.User)
             .Include(ba => ba.Board)
             .FirstOrDefaultAsync(ba => ba.BoardId == boardId && ba.UserId == userId, cancellationToken);
diff --git a/backend/tests/Taskdeck.Api.Tests/BoardAccessRepositoryFreshnessTests.cs b/backend/tests/Taskdeck.Api.Tests/BoardAccessRepositoryFreshnessTests.cs
new file mode 100644
index 000000000..950ae21d5
--- /dev/null
+++ b/backend/tests/Taskdeck.Api.Tests/BoardAccessRepositoryFreshnessTests.cs
@@ -0,0 +1,62 @@
+using FluentAssertions;
+using Microsoft.EntityFrameworkCore;
+using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Enums;
+using Taskdeck.Infrastructure.Persistence;
+using Taskdeck.Infrastructure.Repositories;
+using Xunit;
+
+namespace Taskdeck.Api.Tests;
+
+public sealed class BoardAccessRepositoryFreshnessTests
+{
+    [Fact]
+    public async Task GetByBoardAndUserAsync_reads_role_changes_after_an_earlier_read()
+    {
+        var dbPath = Path.Combine(Path.GetTempPath(), $"taskdeck-board-access-freshness-{Guid.NewGuid():N}.db");
+        try
+        {
+            var options = new DbContextOptionsBuilder<TaskdeckDbContext>()
+                .UseSqlite(TestSqlite.ConnectionString(dbPath))
+                .Options;
+
+            var owner = new User("access-freshness-owner", $"access-freshness-owner-{Guid.NewGuid():N}@example.com", "hash");
+            var member = new User("access-freshness-member", $"access-freshness-member-{Guid.NewGuid():N}@example.com", "hash");
+            var board = new Board("Access freshness", ownerId: owner.Id);
+            var access = new BoardAccess(board.Id, member.Id, UserRole.Editor, owner.Id);
+
+            await using (var seed = new TaskdeckDbContext(options))
+            {
+                await seed.Database.MigrateAsync();
+                seed.Users.AddRange(owner, member);
+                seed.Boards.Add(board);
+                seed.BoardAccesses.Add(access);
+                await seed.SaveChangesAsync();
+            }
+
+            await using var reader = new TaskdeckDbContext(options);
+            var repository = new BoardAccessRepository(reader);
+            var initial = await repository.GetByBoardAndUserAsync(board.Id, member.Id);
+            initial!.Role.Should().Be(UserRole.Editor);
+
+            await using (var writer = new TaskdeckDbContext(options))
+            {
+                var persisted = await writer.BoardAccesses.SingleAsync(value =>
+                    value.BoardId == board.Id && value.UserId == member.Id);
+                persisted.UpdateRole(UserRole.Viewer, owner.Id);
+                await writer.SaveChangesAsync();
+            }
+
+            var refreshed = await repository.GetByBoardAndUserAsync(board.Id, member.Id);
+            refreshed!.Role.Should().Be(UserRole.Viewer);
+        }
+        finally
+        {
+            foreach (var suffix in new[] { "", "-wal", "-shm", "-journal" })
+            {
+                try { File.Delete(dbPath + suffix); }
+                catch (IOException) { }
+            }
+        }
+    }
+}

From 34fb5c807bb64dc14cf6bdd4a44bd14ac6193197 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 00:06:44 +0100
Subject: [PATCH 12/18] fix: protect queued capture board writes

---
 .../Services/LlmQueueService.cs               | 69 +++++++++++++++----
 .../Taskdeck.Api.Tests/LlmQueueApiTests.cs    | 43 ++++++++++++
 .../Services/LlmQueueServiceTests.cs          | 30 +++++++-
 .../src/components/board/BoardDialogHost.vue  |  3 +-
 .../src/components/common/CaptureModal.vue    | 22 ++++--
 .../tests/components/BoardDialogHost.spec.ts  |  8 +--
 .../src/tests/components/CaptureModal.spec.ts |  9 +++
 7 files changed, 159 insertions(+), 25 deletions(-)

diff --git a/backend/src/Taskdeck.Application/Services/LlmQueueService.cs b/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
index a1ca53643..fc3070606 100644
--- a/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
+++ b/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
@@ -1,3 +1,4 @@
+using System.Data;
 using Taskdeck.Application.DTOs;
 using Taskdeck.Application.Interfaces;
 using Taskdeck.Domain.Common;
@@ -43,26 +44,23 @@ public LlmQueueService(
 
     public async Task<Result<LlmRequestDto>> AddToQueueAsync(Guid userId, CreateLlmRequestDto dto)
     {
+        var boardTransactionStarted = false;
+
+        async Task RollbackBoardTransactionAsync()
+        {
+            if (!boardTransactionStarted)
+                return;
+
+            await _unitOfWork.RollbackTransactionAsync();
+            boardTransactionStarted = false;
+        }
+
         try
         {
             var user = await _unitOfWork.Users.GetByIdAsync(userId);
             if (user == null)
                 return Result.Failure<LlmRequestDto>(ErrorCodes.NotFound, $"User with ID {userId} not found");
 
-            if (dto.BoardId.HasValue)
-            {
-                var permissionResult = await _authorizationService.CanReadBoardAsync(userId, dto.BoardId.Value);
-                if (!permissionResult.IsSuccess)
-                {
-                    return Result.Failure<LlmRequestDto>(permissionResult.ErrorCode, permissionResult.ErrorMessage);
-                }
-
-                if (!permissionResult.Value)
-                {
-                    return Result.Failure<LlmRequestDto>(ErrorCodes.Forbidden, "You do not have access to this board");
-                }
-            }
-
             var requestTypeValidation = CaptureRequestContract.ValidateRequestType(dto.RequestType);
             if (!requestTypeValidation.IsSuccess)
             {
@@ -88,6 +86,37 @@ public async Task<Result<LlmRequestDto>> AddToQueueAsync(Guid userId, CreateLlmR
                 payload = CaptureRequestContract.SerializePayload(capturePayload);
             }
 
+            if (dto.BoardId.HasValue)
+            {
+                // Capture-shaped queue requests are an alternate capture intake path, not merely
+                // readable board metadata. Keep their write gate and transaction boundary aligned
+                // with CaptureService so a Viewer cannot attach new work through this endpoint.
+                if (capturePayload is not null)
+                {
+                    await _unitOfWork.BeginTransactionAsync(
+                        IsolationLevel.Serializable);
+                    boardTransactionStarted = true;
+                }
+
+                var permissionResult = capturePayload is not null
+                    ? await _authorizationService.CanWriteBoardAsync(userId, dto.BoardId.Value)
+                    : await _authorizationService.CanReadBoardAsync(userId, dto.BoardId.Value);
+                if (!permissionResult.IsSuccess)
+                {
+                    await RollbackBoardTransactionAsync();
+                    return Result.Failure<LlmRequestDto>(permissionResult.ErrorCode, permissionResult.ErrorMessage);
+                }
+
+                if (!permissionResult.Value)
+                {
+                    await RollbackBoardTransactionAsync();
+                    var message = capturePayload is not null
+                        ? "You do not have permission to attach captures to this board"
+                        : "You do not have access to this board";
+                    return Result.Failure<LlmRequestDto>(ErrorCodes.Forbidden, message);
+                }
+            }
+
             var request = new LlmRequest(userId, requestType, payload, dto.BoardId);
             await _unitOfWork.LlmQueue.AddAsync(request);
 
@@ -102,12 +131,24 @@ public async Task<Result<LlmRequestDto>> AddToQueueAsync(Guid userId, CreateLlmR
 
             await _unitOfWork.SaveChangesAsync();
 
+            if (boardTransactionStarted)
+            {
+                await _unitOfWork.CommitTransactionAsync();
+                boardTransactionStarted = false;
+            }
+
             return Result.Success(MapToDto(request));
         }
         catch (DomainException ex)
         {
+            await RollbackBoardTransactionAsync();
             return Result.Failure<LlmRequestDto>(ex.ErrorCode, ex.Message);
         }
+        catch
+        {
+            await RollbackBoardTransactionAsync();
+            throw;
+        }
     }
 
     public async Task<Result<IEnumerable<LlmRequestDto>>> GetUserQueueAsync(Guid userId)
diff --git a/backend/tests/Taskdeck.Api.Tests/LlmQueueApiTests.cs b/backend/tests/Taskdeck.Api.Tests/LlmQueueApiTests.cs
index 1a327157c..fc3fef3b6 100644
--- a/backend/tests/Taskdeck.Api.Tests/LlmQueueApiTests.cs
+++ b/backend/tests/Taskdeck.Api.Tests/LlmQueueApiTests.cs
@@ -2,8 +2,12 @@
 using System.Net.Http.Json;
 using System.Text.Json;
 using FluentAssertions;
+using Microsoft.Extensions.DependencyInjection;
 using Taskdeck.Api.Tests.Support;
 using Taskdeck.Application.DTOs;
+using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Enums;
+using Taskdeck.Infrastructure.Persistence;
 using Xunit;
 
 namespace Taskdeck.Api.Tests;
@@ -118,6 +122,45 @@ public async Task AddToQueue_ShouldReturnForbidden_WhenBoardBelongsToDifferentUs
         await ApiTestHarness.AssertForbiddenAsync(response);
     }
 
+    [Fact]
+    public async Task AddToQueue_ShouldReturnForbidden_WhenViewerSubmitsCaptureForReadableBoard()
+    {
+        using var ownerClient = _factory.CreateClient();
+        using var viewerClient = _factory.CreateClient();
+
+        var owner = await ApiTestHarness.AuthenticateAsync(ownerClient, "llm-capture-owner");
+        var viewer = await ApiTestHarness.AuthenticateAsync(viewerClient, "llm-capture-viewer");
+        var board = await ApiTestHarness.CreateBoardAsync(ownerClient, "llm-capture-protected-board");
+
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<TaskdeckDbContext>();
+            db.BoardAccesses.Add(new BoardAccess(
+                board.Id,
+                viewer.UserId,
+                UserRole.Viewer,
+                owner.UserId));
+            await db.SaveChangesAsync();
+        }
+
+        var response = await viewerClient.PostAsJsonAsync(
+            "/api/llm-queue",
+            new CreateLlmRequestDto(
+                CaptureRequestContract.RequestTypeV1,
+                "A Viewer must not attach a capture through the queue",
+                board.Id));
+
+        await ApiTestHarness.AssertErrorContractAsync(
+            response,
+            HttpStatusCode.Forbidden,
+            "Forbidden");
+
+        var requests = await viewerClient.GetFromJsonAsync<List<LlmRequestDto>>(
+            "/api/llm-queue/user");
+        requests.Should().BeEmpty(
+            "a refused capture attachment must not persist a queue request");
+    }
+
     [Fact]
     public async Task AddToQueue_ShouldReturnBadRequest_WhenCapturePayloadSpoofsProvenanceAttribution()
     {
diff --git a/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
index a1ec21ccd..aa64691e9 100644
--- a/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
+++ b/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
@@ -74,7 +74,7 @@ public async Task AddToQueueAsync_ShouldNormalizeCapturePayload_WhenCaptureReque
 
         _userRepoMock.Setup(r => r.GetByIdAsync(userId, default))
             .ReturnsAsync(user);
-        _authorizationServiceMock.Setup(s => s.CanReadBoardAsync(userId, boardId))
+        _authorizationServiceMock.Setup(s => s.CanWriteBoardAsync(userId, boardId))
             .ReturnsAsync(Result.Success(true));
         _llmQueueRepoMock.Setup(r => r.AddAsync(It.IsAny<LlmRequest>(), default))
             .Callback<LlmRequest, CancellationToken>((request, _) => persistedRequest = request)
@@ -110,7 +110,7 @@ public async Task AddToQueueAsync_ShouldNormalizeToTranscriptRequestType_WhenPay
 
         _userRepoMock.Setup(r => r.GetByIdAsync(userId, default))
             .ReturnsAsync(user);
-        _authorizationServiceMock.Setup(s => s.CanReadBoardAsync(userId, boardId))
+        _authorizationServiceMock.Setup(s => s.CanWriteBoardAsync(userId, boardId))
             .ReturnsAsync(Result.Success(true));
         _llmQueueRepoMock.Setup(r => r.AddAsync(It.IsAny<LlmRequest>(), default))
             .Callback<LlmRequest, CancellationToken>((request, _) => persistedRequest = request)
@@ -225,6 +225,32 @@ public async Task AddToQueueAsync_ShouldReturnForbidden_WhenUserCannotAccessBoar
         _unitOfWorkMock.Verify(u => u.SaveChangesAsync(default), Times.Never);
     }
 
+    [Fact]
+    public async Task AddToQueueAsync_ShouldRejectViewerCaptureAttachment()
+    {
+        var userId = Guid.NewGuid();
+        var boardId = Guid.NewGuid();
+        var user = new User("testuser", "test@example.com", "hashedpassword");
+        var dto = new CreateLlmRequestDto(
+            CaptureRequestContract.RequestTypeV1,
+            "Capture this quick note",
+            boardId);
+
+        _userRepoMock.Setup(r => r.GetByIdAsync(userId, default))
+            .ReturnsAsync(user);
+        _authorizationServiceMock.Setup(s => s.CanWriteBoardAsync(userId, boardId))
+            .ReturnsAsync(Result.Success(false));
+
+        var result = await _service.AddToQueueAsync(userId, dto);
+
+        result.IsSuccess.Should().BeFalse();
+        result.ErrorCode.Should().Be(ErrorCodes.Forbidden);
+        result.ErrorMessage.Should().Contain("attach captures");
+        _llmQueueRepoMock.Verify(r => r.AddAsync(It.IsAny<LlmRequest>(), default), Times.Never);
+        _unitOfWorkMock.Verify(u => u.SaveChangesAsync(default), Times.Never);
+        _unitOfWorkMock.Verify(u => u.RollbackTransactionAsync(default), Times.Once);
+    }
+
     [Fact]
     public async Task AddToQueueAsync_ShouldReturnNotFound_WhenBoardDoesNotExist()
     {
diff --git a/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue b/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
index 76724a1a0..74ba95a7e 100644
--- a/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
+++ b/frontend/taskdeck-web/src/components/board/BoardDialogHost.vue
@@ -55,9 +55,10 @@ defineEmits<{
     through the `useShellKeyboardHelp` seam (#2007).
   -->
   <CaptureModal
-    v-if="showCaptureModal && board && board.canWrite !== false"
+    v-if="showCaptureModal && board"
     :board-id="boardId"
     :board-name="board.name"
+    :can-submit="board.canWrite !== false"
     @close="$emit('update:showCaptureModal', false)"
     @created="$emit('update:showCaptureModal', false)"
   />
diff --git a/frontend/taskdeck-web/src/components/common/CaptureModal.vue b/frontend/taskdeck-web/src/components/common/CaptureModal.vue
index 52977ba34..d39aab6cf 100644
--- a/frontend/taskdeck-web/src/components/common/CaptureModal.vue
+++ b/frontend/taskdeck-web/src/components/common/CaptureModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { nextTick, onMounted, onUnmounted, ref } from 'vue'
+import { computed, nextTick, onMounted, onUnmounted, ref } from 'vue'
 import { useCaptureStore } from '../../store/captureStore'
 import { registerEscapeHandler } from '../../composables/useEscapeStack'
 import { usePerformanceMark } from '../../composables/usePerformanceMark'
@@ -7,10 +7,14 @@ import { formatShortcut } from '../../utils/keyboardShortcuts'
 // Shared with the Paper composer so the two capture surfaces cannot drift (GH-2141).
 import { MAX_TRANSCRIPT_FILE_BYTES, MAX_TRANSCRIPT_LENGTH } from '../../constants/capture'
 
-const props = defineProps<{
+const props = withDefaults(defineProps<{
   boardId?: string | null
   boardName?: string | null
-}>()
+  /** Keep the draft mounted when a live board refresh removes write authority. */
+  canSubmit?: boolean
+}>(), {
+  canSubmit: true,
+})
 
 const emit = defineEmits<{
   close: []
@@ -31,6 +35,8 @@ const uploadedFileName = ref<string | null>(null)
 const modalOpenPerf = usePerformanceMark('modal-open')
 let unregisterEscapeHandler: (() => void) | null = null
 
+const canSubmit = computed(() => props.canSubmit !== false)
+
 modalOpenPerf.start()
 
 function requestClose() {
@@ -121,6 +127,11 @@ async function submit() {
     return
   }
 
+  if (!canSubmit.value) {
+    inlineError.value = 'Write access changed while this capture was open. Keep the draft here or close it and try again later.'
+    return
+  }
+
   const normalizedText = text.value.trim()
   if (!normalizedText) {
     inlineError.value = 'Capture text is required.'
@@ -269,12 +280,15 @@ onUnmounted(() => {
       <div v-if="inlineError" class="td-alert td-alert--error" role="alert">
         {{ inlineError }}
       </div>
+      <div v-else-if="!canSubmit" class="td-alert td-alert--error" role="alert">
+        Write access changed while this capture was open. Your draft is preserved until access is restored.
+      </div>
 
       <footer class="td-capture-modal__actions">
         <button class="td-btn td-btn--secondary" :disabled="saving" @click="requestClose">
           Cancel
         </button>
-        <button class="td-btn td-btn--primary" :disabled="saving" @click="submit">
+        <button class="td-btn td-btn--primary" :disabled="saving || !canSubmit" @click="submit">
           {{ saving ? 'Saving...' : 'Save Capture' }}
         </button>
       </footer>
diff --git a/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts b/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
index c3f6e6d00..e4f8bfe74 100644
--- a/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
+++ b/frontend/taskdeck-web/src/tests/components/BoardDialogHost.spec.ts
@@ -104,16 +104,16 @@ describe('BoardDialogHost', () => {
           StarterPackCatalogModal: true,
           LabelManagerModal: true,
           CaptureModal: {
-            props: ['boardId', 'boardName'],
+            props: ['boardId', 'boardName', 'canSubmit'],
             template: `
-              <button data-testid="capture-close" type="button" @click="$emit('close')">{{ boardName }}|{{ boardId }}</button>
+              <button data-testid="capture-close" type="button" @click="$emit('close')">{{ boardName }}|{{ boardId }}|{{ canSubmit }}</button>
             `,
           },
         },
       },
     })
 
-    expect(wrapper.get('[data-testid="capture-close"]').text()).toBe('Ops Board|board-1')
+    expect(wrapper.get('[data-testid="capture-close"]').text()).toBe('Ops Board|board-1|true')
     await wrapper.get('[data-testid="capture-close"]').trigger('click')
     expect(wrapper.emitted('update:showCaptureModal')).toEqual([[false]])
 
@@ -124,6 +124,6 @@ describe('BoardDialogHost', () => {
       board: { ...board, canWrite: false },
       showCaptureModal: true,
     })
-    expect(wrapper.find('[data-testid="capture-close"]').exists()).toBe(false)
+    expect(wrapper.get('[data-testid="capture-close"]').text()).toBe('Ops Board|board-1|false')
   })
 })
diff --git a/frontend/taskdeck-web/src/tests/components/CaptureModal.spec.ts b/frontend/taskdeck-web/src/tests/components/CaptureModal.spec.ts
index e0831400e..8e2037a76 100644
--- a/frontend/taskdeck-web/src/tests/components/CaptureModal.spec.ts
+++ b/frontend/taskdeck-web/src/tests/components/CaptureModal.spec.ts
@@ -34,6 +34,15 @@ async function waitForUi() {
 }
 
 describe('CaptureModal', () => {
+  it('keeps the draft surface mounted but disables submit when board write access is lost', () => {
+    const wrapper = mount(CaptureModal, {
+      props: { boardId: 'board-1', canSubmit: false },
+    })
+
+    expect(wrapper.get('[role="alert"]').text()).toContain('draft is preserved')
+    expect(wrapper.get('button.td-btn--primary').attributes('disabled')).toBeDefined()
+  })
+
   beforeEach(() => {
     vi.clearAllMocks()
     escapeHandlers.splice(0, escapeHandlers.length)

From f6428698cb8240136ab8e90e94effc098e4747e2 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 00:43:13 +0100
Subject: [PATCH 13/18] test(frontend): align BoardView fixture with write
 capability

---
 frontend/taskdeck-web/src/tests/views/BoardView.spec.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts b/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
index 881280d15..280dc548a 100644
--- a/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/BoardView.spec.ts
@@ -77,6 +77,7 @@ const mockBoardStore = reactive({
     id: 'board-1',
     name: 'Ops Board',
     description: 'Primary board',
+    canWrite: true,
     columns: [
       {
         id: 'column-1',
@@ -204,6 +205,7 @@ describe('BoardView', () => {
       id: 'board-1',
       name: 'Ops Board',
       description: 'Primary board',
+      canWrite: true,
       columns: [
         {
           id: 'column-1',

From aec449ba2cfa285371e84283db5ab1e106a3a95b Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 00:48:36 +0100
Subject: [PATCH 14/18] test(api): reload board access before mutation

---
 .../tests/Taskdeck.Api.Tests/McpResourcesTests.cs  | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/backend/tests/Taskdeck.Api.Tests/McpResourcesTests.cs b/backend/tests/Taskdeck.Api.Tests/McpResourcesTests.cs
index cff4e37e0..49aaa54a6 100644
--- a/backend/tests/Taskdeck.Api.Tests/McpResourcesTests.cs
+++ b/backend/tests/Taskdeck.Api.Tests/McpResourcesTests.cs
@@ -314,7 +314,11 @@ private async Task RevokeBoardAccessAsync(IServiceScope scope, Guid boardId, Gui
         var uow = scope.ServiceProvider.GetRequiredService<IUnitOfWork>();
         var access = await uow.BoardAccesses.GetByBoardAndUserAsync(boardId, userId);
         access.Should().NotBeNull();
-        await uow.BoardAccesses.DeleteAsync(access!);
+        // The authorization query is intentionally no-tracking so repeated reads observe
+        // membership changes. Reload the entity through the tracked identity before mutating it.
+        var trackedAccess = await uow.BoardAccesses.GetByIdAsync(access!.Id);
+        trackedAccess.Should().NotBeNull();
+        await uow.BoardAccesses.DeleteAsync(trackedAccess!);
         await uow.SaveChangesAsync();
     }
 
@@ -328,8 +332,12 @@ private async Task DemoteToViewerAsync(IServiceScope scope, Guid boardId, Guid u
         var uow = scope.ServiceProvider.GetRequiredService<IUnitOfWork>();
         var access = await uow.BoardAccesses.GetByBoardAndUserAsync(boardId, userId);
         access.Should().NotBeNull();
-        access!.UpdateRole(UserRole.Viewer, access.GrantedBy);
-        await uow.BoardAccesses.UpdateAsync(access);
+        // The authorization query is intentionally no-tracking so repeated reads observe
+        // membership changes. Reload the entity through the tracked identity before mutating it.
+        var trackedAccess = await uow.BoardAccesses.GetByIdAsync(access!.Id);
+        trackedAccess.Should().NotBeNull();
+        trackedAccess!.UpdateRole(UserRole.Viewer, trackedAccess.GrantedBy);
+        await uow.BoardAccesses.UpdateAsync(trackedAccess);
         await uow.SaveChangesAsync();
     }
 

From f06012f9a16a0aa4b1faaa8b90b32dfbafc03ef8 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 00:56:44 +0100
Subject: [PATCH 15/18] fix(inbox): gate scoped capture by board write access

---
 .../src/composables/useInboxOrchestrator.ts   | 11 ++++++++
 .../composables/useInboxOrchestrator.spec.ts  | 14 +++++++++++
 .../tests/views/paper/PaperInboxView.spec.ts  | 25 +++++++++++++++++++
 .../src/views/paper/PaperInboxView.vue        |  3 +++
 .../paper/inbox/PaperCaptureComposer.vue      |  3 +++
 .../src/views/paper/inbox/PaperCaptureNib.vue |  6 ++++-
 6 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts b/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
index aadc8e636..3d18c1484 100644
--- a/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
+++ b/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
@@ -105,6 +105,16 @@ export function useInboxOrchestrator(options: {
     const boardId = activeBoardId.value
     return boardId && scopedBoard.value?.id === boardId ? scopedBoard.value.name : boardId ?? ''
   })
+  /**
+   * The scoped Inbox has the same board write boundary as the board page. Keep
+   * older payloads writable, but stop the capture surfaces when the server
+   * explicitly identifies the active board as view-only.
+   */
+  const activeBoardCanWrite = computed(() => {
+    const boardId = activeBoardId.value
+    if (!boardId || scopedBoard.value?.id !== boardId) return true
+    return scopedBoard.value.canWrite !== false
+  })
   const activeColumnName = computed(() => {
     const columnId = activeColumnId.value
     if (!columnId) return ''
@@ -739,6 +749,7 @@ export function useInboxOrchestrator(options: {
     isArchivedHistory,
     isScopeReplacement,
     activeBoardName,
+    activeBoardCanWrite,
     activeColumnName,
     showCaptureModal,
     selectedIds,
diff --git a/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts b/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
index d3e362653..6228f1317 100644
--- a/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
+++ b/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
@@ -507,6 +507,20 @@ describe('useInboxOrchestrator', () => {
       expect(orch.activeColumnName.value).toBe('Column B')
     })
 
+    it('exposes the scoped board write capability to Inbox surfaces', async () => {
+      mockRoute.query = { boardId: 'board-viewer' }
+      mockBoardsApi.getBoard.mockResolvedValueOnce({
+        ...makeBoard('board-viewer', 'Viewer board', 'column-1', 'Column 1'),
+        canWrite: false,
+      })
+      const orch = createOrchestrator()
+      mountedCallback!()
+
+      await flushAsyncWork()
+
+      expect(orch.activeBoardCanWrite.value).toBe(false)
+    })
+
     it('keeps B names after an obsolete A metadata failure resolves last', async () => {
       const boardA = deferred<BoardDetail>()
       const boardB = deferred<BoardDetail>()
diff --git a/frontend/taskdeck-web/src/tests/views/paper/PaperInboxView.spec.ts b/frontend/taskdeck-web/src/tests/views/paper/PaperInboxView.spec.ts
index a97c82864..3e8537c67 100644
--- a/frontend/taskdeck-web/src/tests/views/paper/PaperInboxView.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/paper/PaperInboxView.spec.ts
@@ -45,6 +45,7 @@ const orchestratorState = {
   isArchivedHistory: ref(false),
   isScopeReplacement: ref(false),
   activeBoardName: ref(''),
+  activeBoardCanWrite: ref(true),
   activeColumnName: ref(''),
   selectedItemId: ref<string | null>(null),
   loadInbox: vi.fn<() => Promise<void>>(),
@@ -100,6 +101,7 @@ describe('PaperInboxView', () => {
     orchestratorState.isArchivedHistory.value = false
     orchestratorState.isScopeReplacement.value = false
     orchestratorState.activeBoardName.value = ''
+    orchestratorState.activeBoardCanWrite.value = true
     orchestratorState.activeColumnName.value = ''
     orchestratorState.selectedItemId.value = null
     orchestratorState.loadInbox.mockResolvedValue(undefined)
@@ -157,6 +159,29 @@ describe('PaperInboxView', () => {
     expect(wrapper.attributes('data-variant')).toBe('composer')
   })
 
+  it('preserves the scoped draft while disabling capture for a read-only board', async () => {
+    orchestratorState.activeBoardId.value = 'board-viewer'
+    orchestratorState.activeBoardName.value = 'Viewer board'
+    orchestratorState.activeBoardCanWrite.value = false
+
+    const wrapper = mount(PaperInboxView)
+    const composerBody = wrapper.get<HTMLTextAreaElement>('[data-testid="paper-composer-body"]')
+    await composerBody.setValue('Keep this draft until write access returns')
+    await composerBody.trigger('keydown', { key: 'Enter', metaKey: true })
+
+    const composer = wrapper.findComponent({ name: 'PaperCaptureComposer' })
+    expect(composer.get<HTMLButtonElement>('button.pbtn-ember').element.disabled).toBe(true)
+    expect(composerBody.element.value).toBe('Keep this draft until write access returns')
+    expect(mockCaptureStore.createItem).not.toHaveBeenCalled()
+
+    ;(wrapper.vm as unknown as { setVariant: (next: 'nib' | 'composer') => void }).setVariant('nib')
+    await wrapper.vm.$nextTick()
+    const nib = wrapper.findComponent({ name: 'PaperCaptureNib' })
+    expect(nib.get<HTMLButtonElement>('button.pbtn-ember').element.disabled).toBe(true)
+    expect(nib.get<HTMLTextAreaElement>('textarea').element.value).toBe('')
+    wrapper.unmount()
+  })
+
   it('renders archived capture history read-only and blocks Paper capture and triage mutations', async () => {
     orchestratorState.isArchivedHistory.value = true
     orchestratorState.activeBoardId.value = 'board-archived'
diff --git a/frontend/taskdeck-web/src/views/paper/PaperInboxView.vue b/frontend/taskdeck-web/src/views/paper/PaperInboxView.vue
index 3a6eaf66e..eea89d070 100644
--- a/frontend/taskdeck-web/src/views/paper/PaperInboxView.vue
+++ b/frontend/taskdeck-web/src/views/paper/PaperInboxView.vue
@@ -87,6 +87,7 @@ const {
   isArchivedHistory,
   isScopeReplacement,
   activeBoardName,
+  activeBoardCanWrite,
   loadInbox,
   clearScope,
 } = useInboxOrchestrator({
@@ -609,6 +610,7 @@ defineExpose({ variant, toggleVariant, setVariant })
         :error-id="nibError ? CAPTURE_ERROR_ID : null"
         :active-board-id="activeBoardId"
         :active-board-name="activeBoardName"
+        :can-submit="activeBoardCanWrite"
         @submit="onNibSubmit"
       />
       <PaperCaptureComposer
@@ -618,6 +620,7 @@ defineExpose({ variant, toggleVariant, setVariant })
         :submitting="captureSubmitting"
         :invalid="!!composerError"
         :error-id="composerError ? CAPTURE_ERROR_ID : null"
+        :can-submit="activeBoardCanWrite"
         @submit="onComposerSubmit"
       />
       <p
diff --git a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
index b4a654efb..cf591d17b 100644
--- a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
+++ b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
@@ -35,6 +35,8 @@ const props = defineProps<{
   invalid?: boolean
   /** DOM id of the failure receipt to associate via `aria-describedby`. */
   errorId?: string | null
+  /** Server-confirmed write capability for the active Inbox board. */
+  canSubmit?: boolean
 }>()
 
 /** The capture sources this composer can file. */
@@ -128,6 +130,7 @@ const canSubmit = computed(
     body.value.trim().length > 0 &&
     !props.submitting &&
     !fileReading.value &&
+    props.canSubmit !== false &&
     selectedBoardIsWritable.value &&
     !transcriptTooLong.value,
 )
diff --git a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
index 6a40faec2..6c9eeb660 100644
--- a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
+++ b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
@@ -39,6 +39,8 @@ const props = defineProps<{
   activeBoardId?: string | null
   /** Human-readable active board name, when the scoped route has one. */
   activeBoardName?: string | null
+  /** Server-confirmed write capability for the active Inbox board. */
+  canSubmit?: boolean
 }>()
 
 const emit = defineEmits<{
@@ -48,7 +50,9 @@ const emit = defineEmits<{
 const { t } = useI18n()
 const text = ref('')
 const inputRef = ref<HTMLTextAreaElement | null>(null)
-const canSubmit = computed(() => text.value.trim().length > 0 && !props.submitting)
+const canSubmit = computed(
+  () => text.value.trim().length > 0 && !props.submitting && props.canSubmit !== false,
+)
 const variantShortcut = computed(() => formatShortcut('mod+;'))
 const destination = computed(() => {
   if (!props.activeBoardId) {

From 2dac12ef8772fe315a1e2a2a118abdca4793bd25 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 01:00:40 +0100
Subject: [PATCH 16/18] fix(queue): normalize capture request types before
 authorization

---
 .../Services/LlmQueueService.cs               |  5 ++-
 .../Services/LlmQueueServiceTests.cs          | 31 +++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/backend/src/Taskdeck.Application/Services/LlmQueueService.cs b/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
index fc3070606..a0f49948d 100644
--- a/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
+++ b/backend/src/Taskdeck.Application/Services/LlmQueueService.cs
@@ -67,7 +67,10 @@ async Task RollbackBoardTransactionAsync()
                 return Result.Failure<LlmRequestDto>(requestTypeValidation.ErrorCode, requestTypeValidation.ErrorMessage);
             }
 
-            var requestType = dto.RequestType;
+            // Validation accepts surrounding whitespace, so carry the same normalized value
+            // into capture classification. Otherwise a padded capture type could select the
+            // readable-board gate instead of the write gate below.
+            var requestType = dto.RequestType.Trim();
             var payload = dto.Payload;
             CapturePayloadV1? capturePayload = null;
             if (CaptureRequestContract.IsCaptureRequestType(requestType))
diff --git a/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs b/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
index aa64691e9..7f02fae2c 100644
--- a/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
+++ b/backend/tests/Taskdeck.Application.Tests/Services/LlmQueueServiceTests.cs
@@ -251,6 +251,37 @@ public async Task AddToQueueAsync_ShouldRejectViewerCaptureAttachment()
         _unitOfWorkMock.Verify(u => u.RollbackTransactionAsync(default), Times.Once);
     }
 
+    [Fact]
+    public async Task AddToQueueAsync_ShouldUseWriteGateForWhitespacePaddedCaptureRequestType()
+    {
+        var userId = Guid.NewGuid();
+        var boardId = Guid.NewGuid();
+        var user = new User("testuser", "test@example.com", "hashedpassword");
+        var dto = new CreateLlmRequestDto(
+            $" {CaptureRequestContract.RequestTypeV1} ",
+            "Capture this padded quick note",
+            boardId);
+
+        _userRepoMock.Setup(r => r.GetByIdAsync(userId, default))
+            .ReturnsAsync(user);
+        _authorizationServiceMock.Setup(s => s.CanWriteBoardAsync(userId, boardId))
+            .ReturnsAsync(Result.Success(false));
+        _authorizationServiceMock.Setup(s => s.CanReadBoardAsync(userId, boardId))
+            .ReturnsAsync(Result.Success(true));
+
+        var result = await _service.AddToQueueAsync(userId, dto);
+
+        result.IsSuccess.Should().BeFalse();
+        result.ErrorCode.Should().Be(ErrorCodes.Forbidden);
+        _authorizationServiceMock.Verify(s => s.CanWriteBoardAsync(userId, boardId), Times.Once);
+        _authorizationServiceMock.Verify(s => s.CanReadBoardAsync(userId, boardId), Times.Never);
+        _unitOfWorkMock.Verify(
+            u => u.BeginTransactionAsync(System.Data.IsolationLevel.Serializable, default),
+            Times.Once);
+        _unitOfWorkMock.Verify(u => u.RollbackTransactionAsync(default), Times.Once);
+        _llmQueueRepoMock.Verify(r => r.AddAsync(It.IsAny<LlmRequest>(), default), Times.Never);
+    }
+
     [Fact]
     public async Task AddToQueueAsync_ShouldReturnNotFound_WhenBoardDoesNotExist()
     {

From 7704fb114eacb197ed8f5c5916d00b29ae69b856 Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 01:34:20 +0100
Subject: [PATCH 17/18] Fix scoped Inbox capture escape hatch

---
 .../src/composables/useInboxOrchestrator.ts   | 12 ++++---
 .../composables/useInboxOrchestrator.spec.ts  | 22 ++++++++++++
 .../paper/inbox/PaperCaptureComposer.spec.ts  | 34 ++++++++++++++++---
 .../paper/inbox/PaperCaptureComposer.vue      | 31 ++++++++++++++---
 4 files changed, 87 insertions(+), 12 deletions(-)

diff --git a/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts b/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
index 3d18c1484..8cdbdc4c9 100644
--- a/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
+++ b/frontend/taskdeck-web/src/composables/useInboxOrchestrator.ts
@@ -107,12 +107,15 @@ export function useInboxOrchestrator(options: {
   })
   /**
    * The scoped Inbox has the same board write boundary as the board page. Keep
-   * older payloads writable, but stop the capture surfaces when the server
-   * explicitly identifies the active board as view-only.
+   * older payloads writable once the matching board is loaded, but fail closed
+   * while that metadata is loading or unavailable: the server is still the
+   * authority, and a capture surface must not advertise a board-scoped write
+   * before its capability is known.
    */
   const activeBoardCanWrite = computed(() => {
     const boardId = activeBoardId.value
-    if (!boardId || scopedBoard.value?.id !== boardId) return true
+    if (!boardId) return true
+    if (scopedBoard.value?.id !== boardId) return false
     return scopedBoard.value.canWrite !== false
   })
   const activeColumnName = computed(() => {
@@ -134,7 +137,8 @@ export function useInboxOrchestrator(options: {
       if (requestGeneration !== scopedBoardLoadGeneration || activeBoardId.value !== boardId) return
       scopedBoard.value = board.id === boardId ? board : null
     } catch {
-      // The scoped inbox remains usable when the board metadata is unavailable.
+      // The list remains usable when metadata is unavailable, but capture
+      // surfaces stay disabled until the matching capability is known.
       if (requestGeneration === scopedBoardLoadGeneration && activeBoardId.value === boardId) {
         scopedBoard.value = null
       }
diff --git a/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts b/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
index 6228f1317..5cd3060a9 100644
--- a/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
+++ b/frontend/taskdeck-web/src/tests/composables/useInboxOrchestrator.spec.ts
@@ -521,6 +521,28 @@ describe('useInboxOrchestrator', () => {
       expect(orch.activeBoardCanWrite.value).toBe(false)
     })
 
+    it('fails closed while scoped board metadata is loading or unavailable', async () => {
+      const pendingBoard = deferred<BoardDetail>()
+      mockRoute.query = { boardId: 'board-pending' }
+      mockBoardsApi.getBoard.mockReturnValueOnce(pendingBoard.promise)
+      const orch = createOrchestrator()
+      mountedCallback!()
+
+      expect(orch.activeBoardCanWrite.value).toBe(false)
+
+      pendingBoard.resolve(makeBoard('board-pending', 'Pending board', 'column-1', 'Column 1'))
+      await flushAsyncWork()
+      expect(orch.activeBoardCanWrite.value).toBe(true)
+
+      mockRoute.query = { boardId: 'board-failed' }
+      mockBoardsApi.getBoard.mockRejectedValueOnce(new Error('metadata unavailable'))
+      watcherForSource(orch.activeBoardId)[1]('board-failed', 'board-pending', () => {})
+      expect(orch.activeBoardCanWrite.value).toBe(false)
+
+      await flushAsyncWork()
+      expect(orch.activeBoardCanWrite.value).toBe(false)
+    })
+
     it('keeps B names after an obsolete A metadata failure resolves last', async () => {
       const boardA = deferred<BoardDetail>()
       const boardB = deferred<BoardDetail>()
diff --git a/frontend/taskdeck-web/src/tests/views/paper/inbox/PaperCaptureComposer.spec.ts b/frontend/taskdeck-web/src/tests/views/paper/inbox/PaperCaptureComposer.spec.ts
index 394bec2ac..0e3712de0 100644
--- a/frontend/taskdeck-web/src/tests/views/paper/inbox/PaperCaptureComposer.spec.ts
+++ b/frontend/taskdeck-web/src/tests/views/paper/inbox/PaperCaptureComposer.spec.ts
@@ -528,8 +528,13 @@ describe('PaperCaptureComposer', () => {
   it('blocks capture while a read-only board is the active scope', async () => {
     // defaultBoardId can preselect a board the user only reads; capturing into it
     // would produce an item that 403s the moment it is accepted for triage.
-    mockBoardStore.boards = [{ id: 'board-readonly', name: 'Archive', canWrite: false }]
-    const wrapper = mount(PaperCaptureComposer, { props: { defaultBoardId: 'board-readonly' } })
+    mockBoardStore.boards = [
+      { id: 'board-readonly', name: 'Archive', canWrite: false },
+      { id: 'board-writable', name: 'Working', canWrite: true },
+    ]
+    const wrapper = mount(PaperCaptureComposer, {
+      props: { defaultBoardId: 'board-readonly', canSubmit: false },
+    })
 
     await wrapper.find('textarea').setValue('a thought that has nowhere to land')
     await wrapper.find('textarea').trigger('keydown', { key: 'Enter', metaKey: true })
@@ -538,10 +543,31 @@ describe('PaperCaptureComposer', () => {
     const captureButton = wrapper.findAll('button').find((button) => button.text().includes('Capture'))
     expect(captureButton?.attributes('disabled')).toBeDefined()
 
-    // Switching to "no board" unblocks it — the escape hatch is one click away.
-    await wrapper.setProps({ defaultBoardId: null })
+    // Switching to "no board" unblocks it — the escape hatch is one click away,
+    // even while the parent continues to report the original scoped board as
+    // read-only.
+    await wrapper.get('[data-testid="paper-composer-board"]').setValue('')
+    await wrapper.find('textarea').trigger('keydown', { key: 'Enter', metaKey: true })
+    expect(wrapper.emitted('submit')).toHaveLength(1)
+    expect((wrapper.emitted('submit')?.[0]?.[0] as { boardId: string | null }).boardId).toBeNull()
+  })
+
+  it('unblocks a read-only scoped gate when a writable board is selected', async () => {
+    mockBoardStore.boards = [
+      { id: 'board-readonly', name: 'Archive', canWrite: false },
+      { id: 'board-writable', name: 'Working', canWrite: true },
+    ]
+    const wrapper = mount(PaperCaptureComposer, {
+      props: { defaultBoardId: 'board-readonly', canSubmit: false },
+    })
+
+    await wrapper.find('textarea').setValue('file this on the working board')
+    await wrapper.get('[data-testid="paper-composer-board"]').setValue('board-writable')
     await wrapper.find('textarea').trigger('keydown', { key: 'Enter', metaKey: true })
+
     expect(wrapper.emitted('submit')).toHaveLength(1)
+    expect((wrapper.emitted('submit')?.[0]?.[0] as { boardId: string | null }).boardId)
+      .toBe('board-writable')
   })
 
   it('keeps the draft after submit until the parent confirms success', async () => {
diff --git a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
index cf591d17b..ce3d2511b 100644
--- a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
+++ b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureComposer.vue
@@ -27,7 +27,7 @@ import type { CaptureSource } from '../../../types/capture'
  * length limit, so the choice is stated plainly next to the control rather
  * than implied.
  */
-const props = defineProps<{
+const props = withDefaults(defineProps<{
   /** Optional board id to default the picker to. */
   defaultBoardId?: string | null
   submitting?: boolean
@@ -37,7 +37,11 @@ const props = defineProps<{
   errorId?: string | null
   /** Server-confirmed write capability for the active Inbox board. */
   canSubmit?: boolean
-}>()
+}>(), {
+  // Preserve the pre-capability prop contract for callers that do not pass a
+  // scoped-board decision: only an explicit `false` disables submission.
+  canSubmit: true,
+})
 
 /** The capture sources this composer can file. */
 export type ComposerSource = Extract<CaptureSource, 'Typed' | 'TranscriptPaste' | 'TranscriptFile'>
@@ -58,6 +62,12 @@ const { t } = useI18n()
 
 const body = ref('')
 const boardId = ref<string | null>(props.defaultBoardId ?? null)
+const boardSelection = computed<string | null>({
+  get: () => boardId.value,
+  set: (value) => {
+    boardId.value = value || null
+  },
+})
 const labelInput = ref('')
 const labels = ref<string[]>([])
 const dueAt = ref<string>('')
@@ -116,6 +126,19 @@ const selectedBoardIsWritable = computed(() => {
   return selected ? isBoardWritable(selected) : true
 })
 
+/**
+ * `canSubmit` describes the board that opened a scoped Inbox. It must not
+ * disable the composer's board picker escape hatch after the user changes the
+ * destination to no board or to another board. Known read-only picker options
+ * remain blocked by `selectedBoardIsWritable` above.
+ */
+const scopedBoardSelectionCanSubmit = computed(
+  () =>
+    props.canSubmit !== false ||
+    props.defaultBoardId == null ||
+    boardId.value !== props.defaultBoardId,
+)
+
 /**
  * Transcript bodies carry the server's larger limit; a paste beyond it would
  * 400 on arrival, so it is refused here beside the draft instead. `Typed`
@@ -130,7 +153,7 @@ const canSubmit = computed(
     body.value.trim().length > 0 &&
     !props.submitting &&
     !fileReading.value &&
-    props.canSubmit !== false &&
+    scopedBoardSelectionCanSubmit.value &&
     selectedBoardIsWritable.value &&
     !transcriptTooLong.value,
 )
@@ -452,7 +475,7 @@ defineExpose({ focus: () => bodyRef.value?.focus(), resetDraft, snapshotDraft, r
         <label class="paper-composer__label">
           <span class="tk-eyebrow">{{ t('inbox.boardPicker.label') }}</span>
           <select
-            v-model="boardId"
+            v-model="boardSelection"
             class="paper-composer__select"
             data-testid="paper-composer-board"
             :aria-label="t('inbox.boardPicker.composerAria')"

From 3c37b19f2d6391491237943daa5a6c7c9f981dcb Mon Sep 17 00:00:00 2001
From: Chris0Jeky <jeky.tck@gmail.com>
Date: Tue, 22 Sep 2026 01:40:56 +0100
Subject: [PATCH 18/18] Preserve direct nib capture callers

---
 .../src/views/paper/inbox/PaperCaptureNib.vue             | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
index 6c9eeb660..de38678e6 100644
--- a/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
+++ b/frontend/taskdeck-web/src/views/paper/inbox/PaperCaptureNib.vue
@@ -19,7 +19,7 @@ import { formatShortcut } from '../../../utils/keyboardShortcuts'
  * render a static ember placeholder at the same position so the intended
  * structure is reviewable.
  */
-const props = defineProps<{
+const props = withDefaults(defineProps<{
   /**
    * When true, suppress the textarea and render the static ember placeholder
    * for ~1.4s.  The parent owns the timer so it can also reset state.
@@ -41,7 +41,11 @@ const props = defineProps<{
   activeBoardName?: string | null
   /** Server-confirmed write capability for the active Inbox board. */
   canSubmit?: boolean
-}>()
+}>(), {
+  // Preserve the pre-capability prop contract for direct callers: only an
+  // explicit `false` disables submission.
+  canSubmit: true,
+})
 
 const emit = defineEmits<{
   (event: 'submit', text: string): void