Group-scoped page/paragraph gates need the deny+grant pair: correct the role-string-only rule

[Justinvolved]

Follow-up correction to #37, from further live verification on the same DW 10.26.x host. 3.8.1 stated that group-scoped page rows "failed to gate the frontend" and recommended designing gates on role strings only — that was a misdiagnosis of highest-wins resolution: a bare group-id grant is silently overridden by the inherited broad AuthenticatedFrontend grant. Group gates work when written as the deny+grant pair: an explicit AuthenticatedFrontend → None deny plus a <group id> → Read grant on the same entity.

Also live-verifies the PermissionName='Paragraph' row shape (previously hedged in §15), including the pair written via the paragraph's Permissions panel or direct SQL + security-cache flush.

Changes

• foundational/users-permissions.md §15: the "gate by role string" rule becomes "group-scoped gates need the deny+grant pair", with the previously-misread symptom explained; the hide-a-paragraph recipe carries the verified 'Paragraph' row shape; the hide-a-subtree recipe's step 2 notes group grants are effective exactly because of step 1's deny.
• dw-users-permissions/SKILL.md: restrict-a-page recipe rewritten — the broad-role deny named as load-bearing for group-restricted pages.
• dw10-canonical-surfaces.md: routing row updated to "by role or group … group gates need the broad-role deny pair" (and the unescaped | in the table cell replaced so the row renders).
• CHANGELOG [3.8.2] (3.8.1's shipped entry left as-is); marketplace.json 3.8.1 → 3.8.2; validator 0 errors / 0 warnings; manifest --check passes.

---

Generated by Claude Code