RLS audits need four proofs and default privileges

For a server-owned table in an exposed schema, prove independently that the schema is exposed, browser roles have relevant schema and table privileges, RLS policies constrain rows, and the deployed publishable client can reach the REST surface. Inspect owner default privileges so future tables do not recreate the gap. Use metadata or zero-row probes; report reachability, recurrence, and ruled-out surfaces separately without reading private rows or mutating data.