Thanks Kevin, your guidance materially changed the direction I’m looking at. I’ve now done a bounded pass over the public es_new_descendants_client semantics and I think the descendant-scoped model is the right supported foundation to explore. Before I prototype it, there are four details I’d like to clarify because they determine whether this can become a real authority boundary rather than just subtree policy, please check my last post on this series. Thanks.