[robertcantu-pure]

Adds smb/DESIGN-write-path.md: how permissionreset-smb will reset DACLs and SACLs on FlashArray over SMB. It builds on the answers to decision record questions 1 and 3 (#58). Design only, no code. The maintainer chose the three-form model (below) over writing every object explicit and protected.

Core model. Each object's rule ACL maps to one of three stored forms:

• inherits: the rule equals what the parent passes down. The object stores those ACEs as inherited, unprotected, and usually needs no write.
• explicit + inherits: explicit ACEs followed by the inherited ones, unprotected.
• protected: anything else; the rule's ACL as explicit ACEs, D:P.

Inherited ACEs are computed from the parent's desired DACL, and the walk is top-down, so written objects stay dynamic. Without that, they become the frozen copy seen in Q1a.

Also covers:

• plan schema 2 (build-spec translates DACL lines; it refuses I flags, OWNER@/GROUP@ in a DACL, and numeric ids)
• separate DACL and SACL writes
• dry run, apply and validate
• a probe preflight
• the inheritance canary (G1) and read-back-every-write (G2) stop conditions
• evidence
• four hardware questions it depends on (Q-INH, Q-EXP, Q-PROT, Q-OWN)
• phases up to smb-v0.1.0

smb/CLAUDE.md and smb/README.md point at it.

Verification

• Documentation only; nothing is built and nothing is qualified.
• Public scan of the tree and origin/main..HEAD commits: clean.
• The lab request for Q-INH, Q-EXP and Q-PROT has been sent. Phase 2 (DACL apply) waits on those answers. Phase 1 (dry run and validate) doesn't.

🤖 Generated with Claude Code