Verify current-owner permissions before moved AI execution

internal/platform/canvas_ai_model_integration_test.go

@@ -522,4 +522,15 @@ func TestCanonicalAIAdmissionAndLifecycle(t *testing.T) {
 		t.Fatal("deleting a moved target failed to revoke its old job")
 	}
 
+	revoked := start(root, imageID, "image", 1)
+	mutate(func(model *canvasModel) { model.Elements[imageID]["ownerCanvasId"] = child })
+	beforeRevoked := executions.Load()
+	if _, e = db.ExecContext(ctx, `UPDATE workspace_members SET role='viewer' WHERE project=$1 AND workspace_id=$2 AND account_id=$3`, project, workspace, account); e != nil {
+		t.Fatal(e)
+	}
+	execute(revoked["run_id"].(string))
+	if result := call("GET", base(root)+"/ai/runs/"+revoked["run_id"].(string), nil, 200, 0, ""); result["status"] != "failed" || executions.Load() != beforeRevoked {
+		t.Fatal("moved target executed after write permission was revoked")
+	}
+
 }