Mount POST <basePath> (create). Default false — every first-party host
creates records in-process from an observed suspension (host-kit's
approval bridge), so the HTTP route is an inert "file a request"
affordance at best. When enabled it force-sets requestedBy to the
authenticated actor and 400s on any TCB_ONLY_CREATE_FIELDS member, so it
can never author capability. The actor must also have write access to the
named run; missing and foreign runs both yield 404.
Mount
POST <basePath>(create). Default false — every first-party host creates records in-process from an observed suspension (host-kit's approval bridge), so the HTTP route is an inert "file a request" affordance at best. When enabled it force-setsrequestedByto the authenticated actor and 400s on any TCB_ONLY_CREATE_FIELDS member, so it can never author capability. The actor must also have write access to the named run; missing and foreign runs both yield 404.