Regenerate the security page for the moved lattice disclosure

The star-property disclosure moved from the account service repository to
flamenet-e2e/SECURITY.md, which is the source for this page. Generated,
not hand-edited; check-doc-pages.py reports all 9 pages matching.

This is the first time that disclosure has been published. It was written
on 2026-09-07 in a repository whose SECURITY.md nothing renders.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Resources/Views/security.leaf

@@ -3,7 +3,7 @@
 <!-- GENERATED by Scripts/build-doc-pages.sh from flamenet-e2e/SECURITY.md.
      Edits made HERE are deleted the next time that script runs.
      Change the markdown source and re-run it.
-     source-sha256: be5351648144b12b -->
+     source-sha256: 73372e9266389804 -->
 <article class="band doc doc-generated">
   <div class="wrap wrap-narrow">
 <h1 id="security">Security</h1>
@@ -62,6 +62,34 @@ one user. Native clients do not have this property. Any deployment
 making confidentiality claims to users must be explicit about which
 client those claims apply to.</li>
 </ul>
+<h2
+id="warning-file-labels-the-half-of-the-lattice-that-is-not-enforced">⚠️
+File labels: the half of the lattice that is not enforced</h2>
+<p>The Files screen carries classification labels, and a label set is a
+claim about which rules hold. Only one of the two holds, so the other is
+named here rather than implied away. See flamenet-messenger ios#("#")65 and
+android#("#")15.</p>
+<p><strong>No read up is enforced.</strong> An object your session label
+does not dominate is not visible, and by default writes happen at
+exactly the session label.</p>
+<p><strong>The ★-property, no write down, is not enforced.</strong> A
+principal cleared to a high label may open a session at a lower one and
+write there, carrying down what they read above it. No client stops
+this, because a session label inside a principal's clearance range is a
+legitimate session.</p>
+<p>🔴 This is the half the model exists for. No-read-up stops somebody
+reaching material above them, which most systems get right.
+No-write-down stops the material leaking <em>downward through a person
+who is allowed to see it</em>, which is the threat a lattice is built to
+contain.</p>
+<p>⚠️ Deliberate, and not an oversight: a rule enforced on one client
+and not the other is worse than the gap, and strict enforcement with no
+downgrade path produces a workaround culture. Doing it properly means an
+explicit downgrade action with an audit trail. Until that exists, this
+is written down.</p>
+<p>So "implements Bell-LaPadula" would be too round a word. What exists
+is the <strong>simple security property</strong>, not the
+<strong>★-property</strong>.</p>
 <h2 id="deployment-notes">Deployment notes</h2>
 <ul>
 <li><strong>Persist state encrypted.</strong>