feat(spec,plugin-sharing): SharingRuleRow declares the deploymentWide marker; an org-less row's delete by an org admin is pinned a no-op

Claude-Session: https://claude.ai/code/session_01XFEb4fSDbe4fK94S3x5FKX
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-sharing/src/sharing-rule-service.ts

@@ -161,7 +161,9 @@ type DeclaredRuleScope = string | typeof DEPLOYMENT_WIDE_SCOPE;
  * typed marker that replaced the organization-less (`organization_id: null`)
  * projection, in the shape of the declared webhooks' `deploymentWide` (the
  * epic's ruling A on the walled shape of a declared webhook, record
- * 6278609968). It carries no `organization_id` at all.
+ * 6278609968). It carries no `organization_id` at all. The marker itself is
+ * declared on the spec contract (`SharingRuleRow.deploymentWide`); this type
+ * narrows it to present.
  */
 export interface DeploymentWideSharingRule extends SharingRuleRow {
   readonly deploymentWide: true;

packages/plugins/plugin-sharing/src/sharing-rule.test.ts

@@ -1296,6 +1296,18 @@ describe('[#7761] getRule by-id is scoped to the caller organization', () => {
     expect(grantsOf(seededId)).toEqual([]);
   });
 
+  it('an organization-less row is unreachable BY ID — delete is a no-op that leaves the row AND its grants intact', async () => {
+    // The successor of the retired #7795 delete guard: the row is no longer
+    // refused by class, it is simply not the org admin's to address. Grants
+    // are materialised under BOOT (this double registers no organization
+    // object, so the row sweeps the deployment) so the no-op has something to lose.
+    await rules.evaluateRule(seededId, BOOT);
+    expect(grantsOf(seededId)).toHaveLength(1);
+    await rules.deleteRule(seededId, ORG1_ADMIN);
+    expect(engine._tables.sys_sharing_rule.find((r) => r.id === seededId)).toBeTruthy();
+    expect(grantsOf(seededId)).toHaveLength(1);
+  });
+
   // ── unchanged behaviour ──────────────────────────────────────────────
 
   it('the caller’s OWN org rule is still fully addressable by id', async () => {

packages/spec/src/contracts/sharing-service.ts

@@ -481,6 +481,15 @@ export type SharingRuleRecipientType = 'user' | 'team' | 'business_unit' | 'posi
 export interface SharingRuleRow {
   id: string;
   organization_id?: string | null;
+  /**
+   * [ADR-0131 D2/D8] `true` on a DECLARED rule's projection that sweeps the
+   * whole deployment — the one projection a declared rule is served as under
+   * the `single` posture. Such a projection carries no `organization_id`:
+   * deployment-wide is this typed marker, never a NULL organization. Absent on
+   * every stored `sys_sharing_rule` row, and on a declared rule's
+   * per-organization projections under a walled posture.
+   */
+  deploymentWide?: true;
   name: string;
   label: string;
   description?: string | null;