Summary

• Chat could not edit nextSteps / statusOverview on a deal, and the agent looped about why. Those core fields are stamped as owned by the next-steps and crm-updater agents (stampCoreFieldOwnership). The write guard forbade any owned field to a caller that is not the owner, and the chat agent is never the owner. The error then blamed a "human-only" flag that was never set, fetch-conversation reported the fields as writable, and a partial write returned success: true with the blocked field silently dropped.
• Authorized humans in chat can now write owned fields. The override is carried by a new server-set actingHumanUserId context key, set only at genuine human chat entry points (in-app chat, headless chat, proposal apply). Subagents the chat spawns (orchestrator, dispatch, SDK Task-delegates) do not get it and are classified like any automation. Authority: read-only seats never; deal owner or editor member via canWriteConversation; org admin via authorize() (write on conversation). agentEditsForbidden locks stay respected except for an admin of the conversation's own org. Any lookup failure falls back to no override.
• Fetch and write now share one classifier (loadFieldWriteFacts + classifyFieldWrites). Fetch reports per-field writable / blockedBy (owner, locked, system, background) / ownerAgentName / blockedReason. agentEditsForbidden stays definition-only so automation consumers (next-steps, crm-updater) are unaffected. Writes return blockedFields with reasons on every result, including partial success, and the all-blocked error states the real reason and the way out. The chat error-handling prompt now says never to guess a cause for an unwritten field.

Behavior changes to be aware of:

• The write guard now refuses scope (it was already shown as read-only in fetch; nothing in skills, prompts or playbook defaults writes it through this tool).
• A failed definitions or ownership load now aborts a non-sync write with the existing retry error instead of silently dropping custom fields or turning owner protection off. CRM-sync writes load only definitions.
• Background and json field ids now come from the effective (org-preferred) definitions, unioned with the user AOP's, instead of the user AOP only.
• There is no separate "deal editor" role in authorize(); deal membership lives in crm_conversation_users and is checked via the existing canWriteConversation predicate (also used by move-event). Folding membership into authorize() is a follow-up.

For the reviewer to decide:

• Headless chat surfaces (Slack/iMessage) apply without an approval card and get the same override as in-app chat.
• Admin-view/staff chat: actingHumanUserId is the viewed user, so the audit log shows the viewed user, not the staff member.
• Thermo review hit the 3-round cap; the third round's findings were fixed but not re-reviewed.

Test plan

• pnpm run autofix:local: everything passes except one apps/mail Jest test, tests/modules/chat-store/chatHistoryList.test.ts ("Yesterday" bucket, date-dependent, no apps/mail changes in this PR). The chain stops there, so the rest was run separately:
• pnpm --filter @zero/server exec vitest run src/: 1153 files, 14299 tests passed.
• pnpm --filter @zero/server run types and pnpm deps:check: clean.
• New/extended tests: resolver and policy (field-write-access.test.ts, field-write-facts.test.ts), fetch verdicts, field-write-actor, surface and harness contexts, and updateConversationFieldsTool.test.ts including a 20+ case matrix asserting fetch and the write guard return the same verdict for (owned, locked, system, plain) x (chat admin, chat editor, unauthorized, agent owner, agent non-owner, chat-spawned subagent).
• Agent-feature note: the only prompt change is one added instruction in mastra/prompts/error-handling.ts; not fire-rate evaluated, since it only governs how an unwritten field is reported.

Verify in p