Give the intake toast one decision, and stop admitting two writes nothing calls

Three surfaces record a dose and all three had to reach the same two
conclusions inside somebody else's record: name the record, and drop an
Undo the server refuses. Two learned it and the dose ledger did not,
because the ternary was written out three times. It is written once now,
in the file the other two already share, with its own test.

POST /api/allergies and POST /api/family-history leave the frozen
delegable write set. The argument that admitted them still stands — an
allergy is the single most useful thing a caregiver can contribute — but
the only surface that posts to either lives in Settings, which a switch
closes, so no delegate could reach the form at any level. That is a
permission frozen ahead of the caller for it, and the list is built the
other way round on purpose.

Both delegable READ arms stay. A caregiver reading the allergy list is
what the feature is for; only the contribute step waits, and it comes
back in the same diff as the surface that offers it.

e2e/account-sharing.spec.ts

@@ -386,6 +386,35 @@ test.describe("account sharing", () => {
     ).toBeVisible();
   });
 
+  test("a query parameter opens nothing the button withholds", async ({
+    page,
+  }) => {
+    // Three deep links reach a create sheet without passing the control that
+    // normally opens it. A parameter that opens a sheet is the same affordance
+    // as the button, and the SSR suite cannot reach any of them: it holds the
+    // paint of a component, never a URL.
+    await page.goto("/measurements?add=WEIGHT");
+    await expect(
+      page.locator('[data-slot="shared-record-banner"]'),
+    ).toBeVisible();
+    await expect(
+      page.locator('[data-slot="responsive-sheet-content"]'),
+    ).toHaveCount(0);
+    // And the button it stands in for is gone too, so nothing on this page
+    // offers the form by either route.
+    await expect(
+      page.getByRole("button", { name: /add measurement/i }),
+    ).toHaveCount(0);
+
+    await page.goto("/medications?new=1");
+    await expect(
+      page.locator('[data-slot="shared-record-banner"]'),
+    ).toBeVisible();
+    await expect(
+      page.locator('[data-slot="medication-wizard-dialog"]'),
+    ).toHaveCount(0);
+  });
+
   test("revoking from the owner's browser drops the delegate out", async ({
     page,
   }) => {

e2e/delegated-writes.spec.ts

@@ -180,6 +180,28 @@ test.describe("delegated writes", () => {
     );
   });
 
+  test("a deep link opens exactly what the level admits", async ({ page }) => {
+    // The gate binds to the level the server resolved, not to a blanket
+    // "somebody else's record" flag. Both halves matter and only a browser
+    // can show either: the SSR suite holds a component's paint, never a URL.
+    //
+    // Admitted: entering a reading, so `?add=` opens the same sheet the
+    // header button opens.
+    await page.goto("/measurements?add=WEIGHT");
+    await expect(
+      page.locator('[data-slot="shared-record-banner"]'),
+    ).toBeVisible();
+    await expect(
+      page.locator('[data-slot="responsive-sheet-content"]').first(),
+    ).toBeVisible();
+
+    // Also admitted: adding a medication with its schedule.
+    await page.goto("/medications?new=1");
+    await expect(
+      page.locator('[data-slot="medication-wizard-dialog"]'),
+    ).toBeVisible();
+  });
+
   test("the owner sees that somebody else was in their record", async () => {
     await ownerPage.goto("/settings/access");
     const rows = ownerPage.locator('[data-slot="record-activity-row"]');