New content-library response serializes can_edit_library without request context #39169

Checked 2026-09-30: master source at ca039029e4918f02903b1c7d62adf8b3ad74f75b and release/verawood source at 18ce9a9c2b20c745b0ee94f615c13855acd9624b. Both carry this code path. This is a source diagnostic; no upstream full integration suite or production mutation ran.

LibraryRootView.post grants the creator admin permissions and then constructs the response serializer without request context. The serializer permission method returns false when context has no request. The library detail GET does supply request context.

Reproduction: create a v2 library as an author allowed to create libraries; inspect can_edit_library in the POST response, then fetch the detail as the same author. The create response follows the no-request/false branch despite the just-granted permissions; the context-aware detail can report the actual permission.

Expected: the successful create response reports the creator's actual edit permission, consistently with the detail response. Pass the request through get_serializer or explicit serializer context. Test creator, reader and denied caller without weakening authorization.

This report's current-source claim is the missing context and deterministic serializer false branch. No fresh end-to-end library creation ran for this filing. Duplicate checks: current issue/PR searches for LibraryRootView and can_edit_library context returned no matching report.