A sharing rule on an object without record sharing saves and silently does nothing #30621

domain:server#6 · os-bill · session_01Utp6CXCS98uhsFQYk64epE

Found by the #30209 card thread while measuring row 5 (os-dev-report 6665615192 on PR #30620, out_of_scope_findings, class (c) trap).

What

An administrator can save a sharing rule (sys_sharing_rule) on an object that is not under record-sharing enforcement (measured: sys_session, sys_account, sys_api_key). The save answers 201. The reconcile then logs WARN SHARING_NOT_ENABLED and writes no sys_record_share, so the rule's recipients see nothing more than before. Nothing tells the administrator: the rule sits in Setup looking active and never applies.

Measured: no widening. The rule grants nothing, so this is a misleading-configuration trap, not an access problem.

Expected

The administrator learns at save time that the object does not use record sharing. Either the save door refuses a rule whose object is not under enforcement, with a sentence naming the object and how to enable sharing for it, or the rule is saved and carries a visible "not in effect" state. Refusal is the simpler contract; pick per the existing sharing-rule validation in packages/plugins/plugin-sharing.

Related: #30209 row 5 (the rule's object picker lists every object) is a separate decision on the same surface: option C there is this card's refusal.

Surface

packages/plugins/plugin-sharing (the sys_sharing_rule save path / validation) and its tests; changeset per the outcome (a save refusal is a narrowing).