docs+test(free): freeze price-write boundary and correct PERMISSION_REVOKED (#295)

[MrDarkRoot]

Authorization

Founder GO: #295 comment 2026-10-15T13:47:48Z (boundary + copy only) under #294 P0 GO. Scope is #295 only.

Base / head

• Base: aaf7dff9603a947feb630776908229e19fc5793c (fetched origin/main at implementation time).
• [v0.3.0] Make apply-journal transitions conditional on the prior state #296 status at base: NOT merged (PR fix(free): journal compare-and-set on prior state (#296) #300 OPEN). The banner explicitly does not claim journal CAS; it names [v0.3.0] Make apply-journal transitions conditional on the prior state #296 a separate pending gate.

Scope (7 files, +163/-1)

• FREE-PRICE-APPLY-CONTRACT.md: dated [v0.3.0] Freeze the price-write boundary as a tested contract #295 supersession banner (in-scope writers, out-of-scope list, save()-hook caveat, plan.actor_id principal, clicker note, frozen policy, entry points, tripwire limits). Historical text untouched.
• FREE-JOB-ENGINE-CONTRACT.md: dated cross-link superseding the stale REST-only resume sentence; sentence retained.
• class-job-state.php: PERMISSION_REVOKED now names the preview creator (plan actor). Authorization untouched. Undo wording verified matching initiator_id, unchanged. .pot untouched (no workflow requires same-change catalog refresh; i18n-catalog passes).
• tests/jobs/price-write-allowlist.php (new): full-tree file-and-symbol allowlist + copy regression + 5 negative controls on temp trees.
• jobs/undo/admin in-container.sh: wire the check next to no-replan-audit.
• No mutator edits, no schema/version/readme/route changes.

Tests

• php wordpress/tests/jobs/price-write-allowlist.php wordpress/writeleash -> exit 0: 61 files scanned, 5 negatives fail-closed with file+op diagnostics, copy assertion PASS.
• php wordpress/tests/jobs/no-replan-audit.php wordpress/writeleash -> exit 0.
• php wordpress/tests/admin/i18n-catalog.php -> exit 0 (610 entries).
• bash .github/ci/pr-fast.sh -> exit 0, PR_FAST PASS (lint 226 files).
• Ownership classifier: CODE_INTEGRATION [admin, jobs, undo], PR_FAST true.
• BLOCKED locally (no Docker): jobs/admin/undo container suites incl. new check wiring -> must go green in CI before merge. Not claimed as passing.

Risks

Token scan misses variable methods, concatenated names, raw SQL (stated in test output + banner); paired with runtime mutation suites. .pot refresh deferred to the normal catalog workflow.

Maintainer: inspect diff + CI before merge. Do not merge until jobs/undo/admin workflows pass.