Live's Bench entries carry rec:vod_* (item 151 C19) (#548)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 0668db2e..6afda5ba 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -723,8 +723,12 @@ const DEFAULT_GRANTS = [
          .map((cap) => ['games', cap, 'openvibe.bench', []]),
      // Live measures its AI clip picks blind (item 151, Bench #105, the private kind live.clip): one task per held-out
      // stretch, a round per comparison, each policy's pick (or abstention) as an entry. It casts no judgements: people do.
--    ...['bench.task.create', 'bench.round.create', 'bench.entry.create']
++    ...['bench.task.create', 'bench.round.create']
          .map((cap) => ['live', cap, 'openvibe.bench', []]),
++    // An entry names the recording its clip was cut from, and Bench refuses one for a recording the submitting token is
++    // not granted (item 151 C19, Bench #111: the token's ns, `rec:<recording_id>`, fails closed). Live submits its own
++    // VODs, `vod_<id>`. The seed fills the namespaces of the existing row, which was [] (fillNs below).
++    ['live', 'bench.entry.create', 'openvibe.bench', ['rec:vod_*']],
      // The consent registry (L24, 2026-10-31; contracts 0.256.0): a service asks before it uses a person's content or
      // likeness for AI or data, through POST /internal/consent/check. These are the first-party services that use
      // content today; the answer is cached at most 60 s and dropped on network.consent.changed, and a service that
ddiff --git a/test/live-bench-grant.test.js b/test/live-bench-grant.test.js
iindex af0fed6b..802642b4 100644
---- a/test/live-bench-grant.test.js
++++ b/test/live-bench-grant.test.js
@@@ -1,6 +1,7 @@
  /**
   * Live's Bench grants (item 151, Bench #105): Live submits its AI clip picks to the private kind live.clip, and casts
-- * no judgements of its own (people judge them blind).
++ * no judgements of its own (people judge them blind). Its entries carry `rec:vod_*`: Bench #111 refuses an entry for a
++ * recording the token is not granted (item 151 C19).
   *
   *   node test/live-bench-grant.test.js
   */
@@@ -12,7 +13,9 @@ const principals = require('../server/identity/principals');
  const rows = principals.DEFAULT_GRANTS.filter((g) => g[0] === 'live' && g[2] === 'openvibe.bench');
  assert.deepStrictEqual(rows.map((g) => g[1]).sort(), ['bench.entry.create', 'bench.round.create', 'bench.task.create'], 'tasks, rounds and entries; never a judgement');
  for (const g of rows) {
--    assert.deepStrictEqual(g[3], [], 'no namespaces');
++    // An entry names its recording, and Bench refuses a recording the token is not granted (C19, Bench #111): Live's
++    // entries carry its own VODs' namespace; tasks and rounds name no recording.
++    assert.deepStrictEqual(g[3], g[1] === 'bench.entry.create' ? ['rec:vod_*'] : [], `${g[1]} namespaces`);
      const cap = contracts.capabilities.get(g[1]);
      assert.ok(cap, `${g[1]} is a capability`);
  }