@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-sharing': patch
+'@objectstack/plugin-security': patch
+'@objectstack/cli': patch
+'@objectstack/spec': patch
+---
+
+fix(plugin-sharing): the declared-rule organization walk ends on the rows read, and a row with no readable id answers unknown; texts that still described the retired NULL-organization reading are corrected
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/plugin-sharing`.** The boot's organization walk for declared sharing-rule scopes (`resolveDeclaredRuleScopes`) judged "short page, stop" on the ids it kept, so a full page of `sys_organization` holding one row with no readable `id` ended the walk early and served a partial list, and the boot sweep then revoked the declared-rule grants of every organization past it. The walk now ends on the number of rows READ, and such a row makes the answer unknown: declared rules are served in no organization until the next boot and no declared rule's grant is revoked, with a warning that names the cause. Under the shipped schema every organization row has a text id, so no install is expected to see the new warning.
+- **`@objectstack/plugin-security`.** The Organization help on `sys_user_position` and `sys_user_permission_set` no longer says an empty value means "global" or "applies in every org context". A grant or assignment applies only in its own organization, and one with no organization applies nowhere. The four locale bundles carry the new text.
+- **`@objectstack/cli`.** `os migrate organization-ownership`'s warning about rows whose owner cannot be derived reads "…while one stays NULL, except on a table whose column is not the tenancy anchor." where it read "(but on a table …)".
+- **`@objectstack/spec`.** Wording only, no schema moves: the upgrade guide's `driver-read-scope-follows-tenant-wall` entry names update and delete "by id or by predicate"; the `sharing-rule-declared-mirror-retired` entry no longer paraphrases ADR-0131 D13 as asking an entry of every retirement; `IEmailService`'s `organizationId` TSDoc no longer says an absent value leaves the row unstamped (the engine stamps the derivable organization or refuses the insert); a TSDoc citation in `schedule-organization.zod.ts` names the run store instead of a deleted file.
@@ -46,8 +46,10 @@ now costs nothing, and the population is **re-derivable** rather than quoted.
 `auditMissingTenant(object, op, options)` is gated in this order:
 
 1. `OS_TENANT_AUDIT=0` — off entirely;
-2. `options.bypassTenantAudit` — the engine sets this for **every**
-   `ExecutionContext.isSystem` write (ObjectQL's `buildDriverOptions`);
+2. `options.bypassTenantAudit` — on an `ExecutionContext.isSystem` write the
+   engine sets it only where the object's schema puts the write out of scope:
+   an object with no tenant field, or a federated one (ObjectQL's
+   `buildDriverOptions`). A caller may still pass it explicitly;
 3. a present `options.tenantId` — the engine fills it from `execCtx.tenantId`;
 4. the deployment posture — the warning is only meaningful on a walled install;
 5. the object having a tenant field.
 
@@ -76,8 +76,8 @@ multi-plant MES example is the ADR's own). It does not.
 `sys_automation_run` has ALREADY been ruled to use: `ObjectStoreSuspendedRunStore`
 resolves a run's organization as `organizationOf(<subject record>) ?? ctx.tenantId`
 — subject first, the acting context as the fallback and *never* the primary
-(`objectql/src/tenancy/platform-object-tenancy.ts`, the `sys_automation_run`
-evidence line). Before this card the two halves disagreed under `group`: the
+(`service-automation/src/suspended-run-store.ts`, where the store stamps a
+run's row). Before this card the two halves disagreed under `group`: the
 history row was stamped from the record while the inbox and delivery rows
 followed an acting context that could not exist there, so they were refused.
 Filling the acting context from the record makes one run carry ONE
 
@@ -632,7 +632,7 @@ export default class OrganizationOwnershipCeremony extends Command {
       printWarning(
         `${summary.unattributableRows} row(s) whose owner cannot be derived are listed by id, with why, in the plan ` +
           'file. The ceremony neither guesses their owner nor deletes them, and --apply does not certify the database ' +
-          'while one stays NULL (but on a table whose column is not the tenancy anchor): assign each its ' +
+          'while one stays NULL, except on a table whose column is not the tenancy anchor. Assign each its ' +
           'organization, or delete it by hand, before or after --apply, and re-run it.',
       );
     }
@@ -1121,7 +1121,7 @@ export default class OrganizationOwnershipCeremony extends Command {
     }
     console.log('');
     // Unattributable rows hold certification (ruling C on ADR-0131 D10 fate
-    // 4) but on a table whose column is not the tenancy anchor; `advisory`
+    // 4), except on a table whose column is not the tenancy anchor; `advisory`
     // counts those and the advisory departures, each said in its own terms.
     const unattributableHeld = report.tables.reduce((n, t) => n + (t.held?.rows ?? 0), 0);
     const unattributableReported = report.tables.reduce((n, t) => n + t.unattributable.length, 0) - unattributableHeld;
 
@@ -3801,7 +3801,7 @@ export const UNATTRIBUTABLE_REMEDY =
 
 /**
  * Unattributable rows the post-check holds against certification: every one,
- * but on a fate-4 table whose column is not the tenancy anchor
+ * except on a fate-4 table whose column is not the tenancy anchor
  * (`InventoryEntry.notNullExempt`), where an organization-less row is a
  * legitimate one and is reported only.
  */
 
@@ -110,7 +110,7 @@ export const SysUserPermissionSet = ObjectSchema.create({
     organization_id: Field.lookup('sys_organization', {
       label: 'Organization',
       required: false,
-      description: 'Optional organization scope. NULL = applies in every org context.',
+      description: 'The organization this grant belongs to.',
     }),
 
     // Provenance, not a business link: the platform writes it, a caller does
 
@@ -16,8 +16,9 @@ import { reservedIdentityNamesCelList, reservedIdentityNameMessage } from './res
  *
  * `position` stores the position's machine name (matches
  * `sys_position.name`), mirroring how `ctx.positions` is keyed everywhere
- * downstream. `organization_id = null` means a cross-tenant (global)
- * assignment.
+ * downstream. `organization_id` is the organization the assignment belongs
+ * to: it applies only while that organization is the active one, and an
+ * organization-less row applies nowhere (ADR-0131 D1).
  *
  * `business_unit_id` is the ASSIGNMENT-LEVEL BU anchor (ADR-0090 Addendum;
  * reserved by ADR-0057 D4). Positions never bind to a business unit at the
@@ -107,7 +108,7 @@ export const SysUserPosition = ObjectSchema.create({
     organization_id: Field.lookup('sys_organization', {
       label: 'Organization',
       required: false,
-      description: 'Tenant that owns this assignment; null = global (cross-tenant).',
+      description: 'The organization this assignment belongs to.',
     }),
 
     // Provenance, not a business link — the same contract as
 
@@ -38,7 +38,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organization",
-        help: "Optional organization scope. NULL = applies in every org context."
+        help: "The organization this grant belongs to."
       },
       granted_by: {
         label: "Granted By",
@@ -104,7 +104,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organization",
-        help: "Tenant that owns this assignment; null = global (cross-tenant)."
+        help: "The organization this assignment belongs to."
       },
       granted_by: {
         label: "Granted By",
 
@@ -38,7 +38,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organización",
-        help: "Ámbito de organización opcional. NULL = se aplica en cualquier contexto de organización."
+        help: "La organización a la que pertenece esta asignación."
       },
       granted_by: {
         label: "Concedido por",
@@ -104,7 +104,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "Organización",
-        help: "Inquilino propietario de esta asignación; nulo = global (entre inquilinos)."
+        help: "La organización a la que pertenece esta asignación."
       },
       granted_by: {
         label: "Otorgado por",
 
@@ -38,7 +38,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "組織",
-        help: "オプションの組織スコープ。NULL = すべての組織コンテキストで適用。"
+        help: "この付与が属する組織。"
       },
       granted_by: {
         label: "付与者",
@@ -104,7 +104,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       organization_id: {
         label: "組織",
-        help: "この割り当てを所有するテナント。Null = グローバル（テナント横断）。"
+        help: "この割り当てが属する組織。"
       },
       granted_by: {
         label: "付与者",