test(fence): owner filters in any form, statement writes under any name, core commits by list

The owner-filter check missed an aliased() model, an import alias, .in_() and
filter_by; four live inline filters on aliased VideoState go through owned_by now.
Cross-unit writes are seen under any import name, through sa.update and via
__table__. Core modules may commit only where CORE_COMMITS names the reason;
trim_read and audit.gc flush now and their callers commit. The pin target, the
debug-session header and a link's target fetch through owned_row. The docs
claim what the fence holds, and say what is beyond it.

backend/app/README.md

@@ -56,11 +56,16 @@ The domain is four units, each owning its tables (`models.py` in its package):
 - **Whose a row is, `userscope` says** — in every module, core included: `owned_by(Model.user_id,
   user)` for a filter, `owned_row(db, Model, id, user)` for a row by id (someone else's row is the
   same answer as a missing one). A unit's `queries.own_x` returns None and its route answers
-  `not_found`; a core route calls `owned_or_404`.
+  `not_found`; a core route calls `owned_or_404`. A rule `owned_row` cannot say — a job its owner
+  shared, a built-in profile nobody owns, a folder read under `FOR SHARE` — is written out in the
+  unit's own code, beside the reason.
 
 All of it is held by `tests/test_unit_fences.py`, with no exemptions: the unit map, each unit's
-packages and edges (`UNIT_PACKAGES`, `READS`) and the jobs that commit (`UNIT_COMMITS`) are listed
-there.
+packages and edges (`UNIT_PACKAGES`, `READS`) and what may commit (`UNIT_COMMITS`, `CORE_COMMITS`)
+are listed there. It reads the code's AST: an inline owner filter in any form (an alias, `.in_()`,
+`filter_by`), a model built or a statement write (`insert`/`update`/`delete` under any name) across
+units, and a commit off the lists all fail it. An ORM attribute write on another unit's loaded row
+is beyond it — review's to catch.
 
 ## Transaction ownership
 
@@ -73,10 +78,12 @@ mutation it records, so an audit entry can never exist without its change (or vi
 
 - The **operation owner** is the route handler, or a job. A unit's `service` flushes even when it
   makes a whole transition (`service.cancel`): the handler commits it, together with whatever else the
-  request changed. What owns its OWN session commits it: `quota` and `jobruns`' run rows, and a unit's
-  jobs (the worker's `jobdb` writes, the syncs and ingests that commit per page or batch so a later
-  failure loses nothing already stored) — the fence's `UNIT_COMMITS` names each. Everything else
-  flushes.
+  request changed. What owns its OWN session commits it: `quota` and `jobruns`' run rows, the
+  scheduler's jobs, a unit's jobs (the worker's `jobdb` writes, the syncs and ingests that commit per
+  page or batch so a later failure loses nothing already stored), and a few core steps that must land
+  whatever their caller does next (a token's last-used stamp, a refreshed YouTube grant) — the fence's
+  `UNIT_COMMITS` and `CORE_COMMITS` name each with its reason, `test_route_conventions` a route's own
+  committing helpers. Everything else flushes.
 - `SessionLocal` is `expire_on_commit=False`: after a raw `UPDATE` + commit, an ORM object you already
   loaded is **stale**. Read the fresh value from the row (RETURNING, or a re-`SELECT`), not the ORM
   attribute — see `service.decr_ref_count`.