Block conflicting extension write selectors

2026-07-26 17:54:52 +03:00
parent d99d57eaf9
commit ad4bd3ec72
7 changed files with 394 additions and 15 deletions
@@ -780,6 +780,9 @@ concrete read-only `metadata.write.plan`. The same strict mode also requires
 the write-preflight smoke to discover an extension form by public
 `extension/ref/form/member` names, compose an allowed plan, and prove that the
 repository and support gates use the same resolved `extension:<GUID>` layer.
+It then submits the same public selector with a deliberately different GUID
+and requires a read-only `blocked / extension_selector_conflict` result, so a
+legacy permissive repository profile cannot authorize a mismatched layer.
 Run that check directly with
 `scripts/smoke_1c_write_preflight.py --require-name-first-extension-form`.