@@ -0,0 +1,7 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+Internal move with no behavior change: the organization-scoping helpers and the seed write-refusal accumulator leave `per-organization-catalog.ts` for two new internal modules, `organization-scope.ts` and `write-refusals.ts`
+
+Clause-②: no
@@ -118,7 +118,7 @@ interface BootstrapLogger {
  * injected a sink with no `error`.
  *
  * The spelling is `logSeedDurabilityFailure` in `plugin-security`'s
- * `per-organization-catalog.ts`, re-derived here rather than imported: that
+ * `write-refusals.ts`, re-derived here rather than imported: that
  * helper is deliberately absent from `plugin-security`'s `index.ts` (an
  * intra-package helper, not public API), and `plugin-auth` does not depend on
  * `plugin-security` at runtime. Its two prohibitions are the measured part and
 
@@ -54,7 +54,7 @@ import {
   resolveOwnOrganizationRow,
   seedCtx,
   SEED_ORGANIZATION_SCAN_LIMIT,
-} from './per-organization-catalog.js';
+} from './organization-scope.js';
 import { GRANT_SET_ID_FIELD, GRANT_SET_NAME_FIELD, grantSetNameOf } from './grant-permission-set-name.js';
 
 const SYSTEM_CTX = { isSystem: true } as const;
 
@@ -45,13 +45,17 @@
 import { securityBuiltinPositions } from './builtin-positions.js';
 import {
   createSeedWriteRefusals,
-  resolveOwnOrganizationRow,
-  rowMatchesDeclaration,
-  seedCtx,
-  warnOrganizationLessRows,
   reportSeedWriteRefusals,
   type SeedLogger,
   type SeedWriteRefusals,
+} from './write-refusals.js';
+import {
+  resolveOwnOrganizationRow,
+  seedCtx,
+  warnOrganizationLessRows,
+} from './organization-scope.js';
+import {
+  rowMatchesDeclaration,
 } from './per-organization-catalog.js';
 
 function genId(prefix: string): string {
 
@@ -83,7 +83,7 @@ import {
   createSeedWriteRefusals,
   reportSeedWriteRefusals,
   type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './write-refusals.js';
 import { buildExistingByName, type ExistingByNameIndex } from './seed-name-lookup.js';
 import { readDeclared } from './bootstrap-declared-permissions.js';
 // [#18023] THE owner-comparison predicate, REUSED rather than re-derived. It
 
@@ -62,12 +62,14 @@ import {
 import { defaultPermissionSets } from './objects/default-permission-sets.js';
 import {
   createSeedWriteRefusals,
+  reportSeedWriteRefusals,
+  type SeedWriteRefusals,
+} from './write-refusals.js';
+import {
   resolveOwnOrganizationRow,
   seedCtx,
   warnOrganizationLessRows,
-  reportSeedWriteRefusals,
-  type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './organization-scope.js';
 import {
   permissionSetNameCollisionDiagnostic,
   permissionSetNameIsForeign,
 
@@ -40,12 +40,14 @@ import { buildExistingByName } from './seed-name-lookup.js';
 import { isBuiltinPositionName } from './builtin-positions.js';
 import {
   createSeedWriteRefusals,
-  seedCtx,
-  warnOrganizationLessRows,
   reportSeedWriteRefusals,
   type SeedLogger,
   type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './write-refusals.js';
+import {
+  seedCtx,
+  warnOrganizationLessRows,
+} from './organization-scope.js';
 
 function genId(prefix: string): string {
   const rand = Math.random().toString(36).slice(2, 10);
 
@@ -89,7 +89,7 @@ import {
   createSeedWriteRefusals,
   reportSeedWriteRefusals,
   type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './write-refusals.js';
 import { reportThroughSink } from './seed-refusal-sink.js';
 import {
   resolvePlatformAdminStanding,
@@ -396,7 +396,7 @@ async function tryFind(
 // write indistinguishable from "nothing to do": `seeded` never grows, the pass
 // returns normally, and the boot reports a successful seed of zero rows. Still
 // no rethrow — this pass reports, it does not decide whether the deployment
-// boots. See `reportSeedWriteRefusals` in `per-organization-catalog.ts`.
+// boots. See `reportSeedWriteRefusals` in `write-refusals.ts`.
 async function tryInsert(
   ql: any, object: string, data: any, refusals?: SeedWriteRefusals,
   // Symmetric with {@link tryFind}'s observer, and for the same reason: a
 
@@ -217,7 +217,7 @@ import {
   logSeedDurabilityFailure,
   type SeedLogger,
   type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './write-refusals.js';
 
 const SYSTEM_CTX = { isSystem: true };
 
 
@@ -30,7 +30,7 @@
 import {
   createSeedWriteRefusals,
   type SeedWriteRefusals,
-} from './per-organization-catalog.js';
+} from './write-refusals.js';
 
 const SYSTEM_CTX = { isSystem: true };
Original file line number	Diff line number	Diff line change
`@@ -118,7 +118,7 @@ interface BootstrapLogger {`
`118`	`118`	* injected a sink with no `error`.
`119`	`119`	`*`
`120`	`120`	* The spelling is `logSeedDurabilityFailure` in `plugin-security`'s
`121`		- * `per-organization-catalog.ts`, re-derived here rather than imported: that
	`121`	+ * `write-refusals.ts`, re-derived here rather than imported: that
`122`	`122`	* helper is deliberately absent from `plugin-security`'s `index.ts` (an
`123`	`123`	* intra-package helper, not public API), and `plugin-auth` does not depend on
`124`	`124`	* `plugin-security` at runtime. Its two prohibitions are the measured part and