WriteDiff now carries Change{path, before, after} computed by a complete structural diff, with absence represented as a value, rather than paths alone: a rule that tests a value needs both sides, and a create/delete must never produce an empty diff. WriteSubject carries only what a stateless predicate is allowed to reference -- the subject's own account-sourced attributes (starting with handle), the incoming write, and the current version if any -- and nothing that could grow into a store handle. Provisioner::put_record_as and ::delete_record now route external writes through WriteQueue::submit before committing: policy is judged outside self.writing(), and admit (the check-commit-for/records.put/commit_write critical section) only runs on Allow. WriteAuthor::Server writes -- the registration record and the bsky profile -- still bypass the gate entirely, per the administrative bypass list. Change-Id: I93adce7f7ecbfdfda4f98edd484f8490ca9823bb