What
Both task-grant notes describe a BReg task bound as a list of collections and operations, and neither says what a collection is. products/casework/TASK_GRANTS.md line 19 gives the shape {type: breg, permissions: [{collection: ..., operations: [...]}]} with an ellipsis where the value goes; products/breg/TASK_GRANTS.md lines 13 and 20 talk about "the compiled collection and operation bounds" and about wider, narrower and partial bounds. An author writing bounds.permissions[].collection has no way to know the value must be the entity's route, not its id. Getting it wrong produces a bound that never matches, and the failure shows up as a refused task rather than as an authoring error.
Evidence
crates/registry-breg/src/compiler.rs around line 1669 builds the compiled task-grant permission source with collection: entity.route.clone(), so the matcher compares against the route.products/casework/TASK_GRANTS.md line 19 and products/breg/TASK_GRANTS.md lines 13 and 20 are the only places the word appears, and neither defines it.
Proposed fix
State in both notes that a BReg task bound collection is the entity's route, with one worked example showing an entity whose id and route differ. Separately, print the compiled task-grant collections in bregctl explain (crates/registry-bregctl/src/lib.rs, the explain command at line 4769), so an author can read the accepted values off a compiled project instead of guessing them.
Found while
Extracting reusable App Kit skills against Registry Stack v0.32.0.
What
Both task-grant notes describe a BReg task bound as a list of collections and operations, and neither says what a collection is.
products/casework/TASK_GRANTS.mdline 19 gives the shape{type: breg, permissions: [{collection: ..., operations: [...]}]}with an ellipsis where the value goes;products/breg/TASK_GRANTS.mdlines 13 and 20 talk about "the compiled collection and operation bounds" and about wider, narrower and partial bounds. An author writingbounds.permissions[].collectionhas no way to know the value must be the entity'sroute, not itsid. Getting it wrong produces a bound that never matches, and the failure shows up as a refused task rather than as an authoring error.Evidence
crates/registry-breg/src/compiler.rsaround line 1669 builds the compiled task-grant permission source withcollection: entity.route.clone(), so the matcher compares against the route.products/casework/TASK_GRANTS.mdline 19 andproducts/breg/TASK_GRANTS.mdlines 13 and 20 are the only places the word appears, and neither defines it.Proposed fix
State in both notes that a BReg task bound collection is the entity's
route, with one worked example showing an entity whoseidandroutediffer. Separately, print the compiled task-grant collections inbregctl explain(crates/registry-bregctl/src/lib.rs, theexplaincommand at line 4769), so an author can read the accepted values off a compiled project instead of guessing them.Found while
Extracting reusable App Kit skills against Registry Stack v0.32.0.