docs(adr-0131): amend D5 — under a walled posture, deployment-level acceptance of package defaults is host configuration (#23883)

Fixes #23385

One amendment line in ADR-0131 D5. It records that under a walled
posture, the deployment-level acceptance of package defaults for the
`everyone` anchor is host configuration: the security plugin's
`acceptedDefaultPermissionSets` option. There is no NULL-owner row and
no reserved organization (§1.5).

**Authority.** objectstack-ai/cloud#2872, ruling A′ (comment
`6160165869`, maintainer 「同意」), item 3, as triage quoted and verified it
in `6205580248`:

> "Framework follow-up, named and filed in this act as a p3 card
(objectstack, `domain:spec`): under the walled posture the host declares
the accepted deployment-level defaults as configuration (D5) … It does
not block v18."

**The code half** is the companion PR on branch
`claude/issue-23385-walled-accepted-defaults`, whose body opens `Part of
#23385`. This PR branches from `origin/main`, not from that one. Its one
line names the option that the companion PR adds. Land the companion
first, or together with this one, so the record never names an option
`main` does not have.

## The line

Appended at the end of D5, in the record's own `**Amended** (date, card
— authority)` form (the status line's 2026-09-17 note is the precedent):

> **Amended** (2026-10-16, #23385 — objectstack-ai/cloud#2872 ruling A′,
comment `6160165869`, maintainer 「同意」, item 3): under a walled posture
the deployment-level acceptance of package defaults for the `everyone`
anchor (ADR-0090 D5) is configuration too — the security plugin's
`acceptedDefaultPermissionSets` option, read only under a wall, each
name held to the anchor's ADR-0090 D7 gate — with no NULL-owner row and
no reserved organization (§1.5); the `single` posture keeps its
Default-Organization row.

Placement: D5 is the decision the line extends ("Platform standing is
configuration"). The record keeps its amendments on the status line and
in an end section. One line at D5 puts it where a reader of the decision
looks, and leaves the status line and the 2026-09-17 section as they
are. If the maintainer prefers the status-line slot, the same sentence
moves there.

## Gates (local, at head `72dc8a03fd`)

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 19 families for this one path. All
19 ran with their exit codes captured before any pipe, and all exited 0.
`pnpm --filter @objectstack/lint run check:doc-formula-expressions`
first exited 3 (prerequisite: no `dist/`). After `turbo run build
--filter=@objectstack/formula --filter=@objectstack/lint` it exited 0.
`--ran` reconciliation: "19 derived famil(ies) accounted for — 19 run, 0
NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of
them is 3)."

**Changeset:** none. `docs/adr/**` publishes nothing (os-dev fast lane).
The label is the seat's call.

## 维护者速读(草稿)

**改了什么**
ADR-0131 的 D5
末尾加一行修订:在多组织(walled)部署下,"哪些应用包自带的默认权限集给所有登录用户"这件部署级的事,由宿主在安全插件的配置项
`acceptedDefaultPermissionSets` 里声明,而不是在某个组织名下记一行数据。单组织(single)部署照旧。

**为什么改**
云端控制面是多组织部署,没有 slug 为 `default`
的组织。现在每次启动都打一条"建议同步失败"的警告,接受入口还给出"去建一个默认组织"的处方,而这正是 ADR-0131 §1.5
否掉的做法(保留组织)。维护者在 cloud#2872 的裁决 A′ 第 3 项里定了方向:walled 下由宿主用配置声明。代码改动在姊妹
PR 里,这一行把决定记进 ADR。

**风险与代价(含回滚)**
只改文档一行,不发布任何包。风险在于这一行点名的配置项要由姊妹 PR 带进 `main`,所以两者应先后或一起落地。回滚就是删掉这一行。

**席位意见**
建议批准合并。这一行逐句与姊妹 PR #23884 的代码一致:配置项只在 walled 下读取,每个名字都要过 everyone
锚点的高权限检查,不建保留组织、不写无属主行,single 部署照旧。契约复核 PASS(`6215582328`);姊妹代码 PR 的复核也已
PASS(`6215570234`)。唯一的开放点是这行放在 D5 末尾,你合并时可以挪到状态行的修订位。请在 #23884
落地后(或同时)合并本 PR。

**你要做的**
审阅这一行。同意的话,在姊妹代码 PR 落地后(或同时)合并本 PR。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_015jUkR2UVa8FFGk3rWDX49C

---
_Generated by [Claude
Code](https://claude.ai/code/session_015jUkR2UVa8FFGk3rWDX49C)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0131-total-organization-ownership-no-null-organization-id.md

@@ -376,6 +376,7 @@ half, together with the two symbols that carry the migration window —
 `reportLegacyPlatformAdminGrant` and `resetLegacyPlatformAdminGrantReport` — **left D13 on 2026-09-16**
 and retire on the **17.x** line under #11663's design instead (#18336; see the Amendment at the end).
 The `single` anchor's own disposition is #11979's (Choice 4B), which this record does not pre-empt.
+**Amended** (2026-10-16, [#23385](https://github.com/objectstack-ai/objectstack/issues/23385) — objectstack-ai/cloud#2872 ruling A′, comment `6160165869`, maintainer 「同意」, item 3): under a walled posture the deployment-level acceptance of package defaults for the `everyone` anchor (ADR-0090 D5) is configuration too — the security plugin's `acceptedDefaultPermissionSets` option, read only under a wall, each name held to the anchor's ADR-0090 D7 gate — with no NULL-owner row and no reserved organization (§1.5); the `single` posture keeps its Default-Organization row.
 
 ### D6 — Managed definitions are sealed; customization is environment-level state beside them, never an edit and never per organization