fn ownership_err( unheld_ownership: Vec<ObjectId>, catalog: &impl SessionCatalog, ) -> Result<(), UnauthorizedError>