@@ -0,0 +1,22 @@
+---
+'@objectstack/core': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-security': patch
+'@objectstack/cli': patch
+---
+
+fix(core,plugin-auth)!: the last-admin guard judges a `sys_organization` insert that moves the Default Organization, and one definition of the Default Organization is exported from core
+
+Clause-②: yes (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any metadata schema is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. The narrowing is one more organization write the last-administrator guard refuses at runtime. -->
+
+**BREAKING** for a `single`-posture deployment whose only organization is not slugged `default` and whose last administrator holds nothing but the Default Organization's `admin_full_access` grant.
+
+- **`registerLastAdminGuard` (`@objectstack/plugin-auth`) now judges a `sys_organization` insert.** Under `single` the Default Organization is the one slugged `default`, else the only one, and its `admin_full_access` grant is what makes the platform administrator one (ADR-0131 D5). Adding an organization can move it with no grant touched: a second organization beside a sole one with another slug leaves none, and a new one slugged `default` takes its place.
+  - FROM: the insert was admitted. The administrator lost platform standing in silence, and the guard then admitted a ban or delete of that same administrator, because it no longer counted anyone.
+  - TO: the insert is refused (`PERMISSION_DENIED`, 403, on `sys_organization`) when it would leave nobody who can sign in and administer. An organization owner or admin, an `OS_PLATFORM_OWNER_EMAIL` administrator, or a Default Organization slugged `default` (which a new organization cannot move) admits it, as on the update and delete halves. Under a wall no grant anchors, so the insert is admitted and costs no reads.
+- **One definition of the Default Organization (`@objectstack/core`).** New exports: `findDefaultOrganization(read)` (the rule, over a read the caller supplies), `DEFAULT_ORGANIZATION_SLUG`, and `readDefaultOrganizationId(ql)` (the resolver's own read, which fails loud on an unreachable store). plugin-auth's boot invariant, default-organization bootstrap, tenancy service and last-admin guard, plugin-security's `resolveDefaultOrganizationId`, and the ownership ceremony's plan now name the organization through it. Each keeps its own read policy: whether a failed read throws or reads as none, the guard's simulation of a pending write, and the ceremony's raw SQL. Two edge answers align with the resolver's. A `default`-slugged row with a blank id now falls through to the only-organization reading in the ceremony's plan. A numeric id is now read as its string in plugin-security's reader.
+
+**What an operator does.** Before you create a second organization on a `single` deployment whose only organization has another slug, either give that organization the slug `default` (while it is the only one, that changes nothing else), or make sure another account can administer: an organization owner or admin, or an address in `OS_PLATFORM_OWNER_EMAIL`.
@@ -0,0 +1,80 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D3/D5] The one definition of the Default Organization, pinned on
+ * its own: `slug = 'default'`, else the only organization, else none. Every
+ * reader (the resolver, plugin-auth's boot invariant, bootstrap, tenancy
+ * service and last-admin guard, plugin-security's promotion, the ownership
+ * ceremony) hands its read to this rule, so these cases are what all of them
+ * answer.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { DEFAULT_ORGANIZATION_SLUG, findDefaultOrganization } from './default-organization.js';
+import { readDefaultOrganizationId } from './resolve-authz-context.js';
+
+type Row = { id?: unknown; slug?: string };
+
+/** A read over `rows` that answers the two questions the rule asks, and records them. */
+function readOver(rows: Row[]) {
+  const asked: Array<{ where: Readonly<Record<string, unknown>>; limit: number }> = [];
+  const read = async (where: Readonly<Record<string, unknown>>, limit: number): Promise<Row[]> => {
+    asked.push({ where, limit });
+    return rows.filter((row) => !('slug' in where) || row.slug === where.slug).slice(0, limit);
+  };
+  return { read, asked };
+}
+
+describe('[ADR-0131 D3/D5] findDefaultOrganization — the one definition', () => {
+  it('the organization slugged `default` wins, beside others, and the second read is never issued', async () => {
+    const { read, asked } = readOver([{ id: 'org_acme', slug: 'acme' }, { id: 'org_def', slug: 'default' }]);
+    expect(await findDefaultOrganization(read)).toEqual({ id: 'org_def', row: { id: 'org_def', slug: 'default' }, several: false });
+    expect(asked).toEqual([{ where: { slug: DEFAULT_ORGANIZATION_SLUG }, limit: 1 }]);
+  });
+
+  it('else the only organization, whatever its slug', async () => {
+    const { read, asked } = readOver([{ id: 'org_acme', slug: 'acme' }]);
+    expect(await findDefaultOrganization(read)).toMatchObject({ id: 'org_acme', several: false });
+    expect(asked).toEqual([{ where: { slug: 'default' }, limit: 1 }, { where: {}, limit: 2 }]);
+  });
+
+  it('several, none of them `default`, name none — and say so', async () => {
+    const { read } = readOver([{ id: 'org_a', slug: 'a' }, { id: 'org_b', slug: 'b' }]);
+    expect(await findDefaultOrganization(read)).toEqual({ id: undefined, row: undefined, several: true });
+  });
+
+  it('no organization names none, and is not "several"', async () => {
+    const { read } = readOver([]);
+    expect(await findDefaultOrganization(read)).toEqual({ id: undefined, row: undefined, several: false });
+  });
+
+  it('a row with no usable id names nothing: a blank-id `default` falls through to the only-organization reading', async () => {
+    expect((await findDefaultOrganization(readOver([{ id: '', slug: 'default' }]).read)).id).toBeUndefined();
+    expect((await findDefaultOrganization(readOver([{ id: null, slug: 'default' }, { id: 'org_b', slug: 'b' }]).read)).id)
+      .toBeUndefined();
+  });
+
+  it('a read that fails propagates: what an unreadable store means is the caller\'s read policy', async () => {
+    const boom = new Error('store unreachable');
+    await expect(findDefaultOrganization(async () => { throw boom; })).rejects.toBe(boom);
+  });
+});
+
+describe('[ADR-0131 D5] readDefaultOrganizationId — the resolver\'s read over the one definition', () => {
+  const engineOver = (rows: Row[], registered = true) => ({
+    registry: { getObject: (name: string) => (registered && name === 'sys_organization' ? { name } : undefined) },
+    async find(_object: string, query: { where?: Record<string, unknown>; limit?: number }) {
+      return readOver(rows).read(query.where ?? {}, query.limit ?? 100);
+    },
+  });
+
+  it('answers what the definition answers', async () => {
+    expect(await readDefaultOrganizationId(engineOver([{ id: 'org_acme', slug: 'acme' }]))).toBe('org_acme');
+    expect(await readDefaultOrganizationId(engineOver([{ id: 'org_acme', slug: 'acme' }, { id: 'org_b', slug: 'b' }]))).toBeUndefined();
+  });
+
+  it('a composition that registers no organization object holds none, and is not read', async () => {
+    expect(await readDefaultOrganizationId(engineOver([{ id: 'org_acme', slug: 'acme' }], false))).toBeUndefined();
+  });
+});