@@ -7,6 +7,7 @@
 '@objectstack/objectql': minor
 '@objectstack/plugin-security': minor
 '@objectstack/service-datasource': minor
+'@objectstack/service-automation': minor
 '@objectstack/platform-objects': minor
 '@objectstack/driver-sql': minor
 '@objectstack/driver-turso': minor
@@ -28,6 +29,7 @@ FROM → TO:
 - An authored filter, list-view column, report grouping, formula or seed key naming `organization_id` on one of the four tables → delete it; no organization owns a row. The field resolver answers it as an unknown field.
 - `new SysMetadataRepository({ engine, organizationId, orgLabel })` → `new SysMetadataRepository({ engine, orgLabel })`. The `organizationId` option is gone: every repository reads and writes the environment's rows.
 - `DatabaseLoader`'s `organizationId` option (and so `MetadataManager.setDatabaseDriver` / `setDataEngine`'s `organizationId` argument) → accepted and ignored, like `environmentId`: no write stamps it and no read filters on it. Drop the argument.
+- `@objectstack/spec`: the published `ApiError.code` / `ErrorCode` enum widens by `LEGACY_ORGANIZATION_ROWS_UNREADABLE`, registered under `@objectstack/metadata-core`.
 - `isLegacyOrganizationRow(row)` (`@objectstack/metadata-core`) → `readLegacyOrganizationRows(driver, table?)`. The row-value test read a key the engine no longer returns, so it is removed. The new read answers from the physical column, through the table's driver (`engine.getDriverForObject`): id → organization, empty on a migrated or fresh database. A seam that cannot answer is refused (`LegacyOrganizationRowsUnreadable`), never read as "none".
 - An existing database → run `os migrate organization-ownership` (review its plan), then `os migrate organization-ownership --apply --plan-file FILE` with that plan file. The ceremony promotes or reports the legacy organization rows, then drops the physical column. Until it has run, the v18 runtime refuses to start against the database.
 
@@ -47,12 +49,12 @@ What else changes:
   - Every `/meta` door serving these rows admits `studio.access`: `/meta/:type/:name/history` and `/audit` admit `studio.access`, `setup.access` or `manage_metadata`; `/packages/:id/commits` admits `studio.access` or `setup.access`. `requiredPermissions` is an AND-gate and cannot name an any-of set, and `setup.access` is held by organization admins, so it could not be the gate. A caller holding only `setup.access` or only `manage_metadata` therefore still reads these rows through `/meta`, but not through the data door.
   - `sys_metadata` stays ungated, before and after: its rows are what `/meta` already serves to every organization.
 - On a database the ceremony has not migrated (which `os serve` refuses, but every `os migrate` boot opens, the ceremony's own among them), the legacy organization rows are still told apart, off the physical column:
-  - boot hydration, the `/meta` list, by-name and draft-preview reads and the authored hook and action binders leave them out;
+  - every read the metadata protocol makes of the family goes through one seam that leaves them out. That covers boot hydration; the `/meta` list, by-name, layered and draft-preview reads; the item lock (`_lock`) the reads report and the save and delete gates enforce; the package-less write and read address; and the package, commit, audit, history and diff reads. Two reads keep them on purpose and read the column themselves: `os migrate meta --stored` reports such a row, and the commit revert refuses a legacy commit by name. The authored hook and action binders leave them out too;
   - the metadata repository's write never resolves to one: before, a save of an address that only a legacy organization's row held rewrote that row in place (measured on the ceremony's template promotion). Now the write targets the environment's row, and with none it creates one, which the re-keyed unique index refuses beside the organization's row until the ceremony settles it;
   - `os migrate meta --stored` reports such a row `skipped` and never re-saves it;
   - `os migrate security-catalog-overlays` neither lists nor deletes it;
   - a commit recorded in a legacy organization's layer is still refused by the revert;
-  - the runtime-datasource reads and the packaged permission-set overlay reading leave them out.
+  - the runtime-datasource reads, the packaged permission-set overlay reading, the kernel:ready security-catalog echo, the stored flow-credential move and a `DatabaseLoader` (engine- or driver-backed) leave them out.
 - `SqlDriver.listPhysicalColumns(object, options?)` (new, read-only): a table's physical column names, from the catalog, joining `options.transaction`. `TursoDriver`'s remote face answers it from the remote catalog. Every boot asks whether the family still carries the retired column, and it asks this way, not through `execute()`. So `os migrate plan` keeps its "a plan writes nothing" line on a migrated or fresh database. The legacy rows themselves are read with a raw statement only where the column exists.
 - `GET /forms/:slug` and `POST /forms/:slug/submit` no longer read the Default Organization's legacy layer. Every metadata read is now environment → code. The doors judge each candidate against the environment's view list, which holds one item per package of a view name. So a withdrawal in one package still closes that name's form in every package. On a deployment with no organization this closes more than before, which is the fail-closed direction. A withdrawal saved only at the organization layer is carried onto the environment by the ceremony's `metadata-promotion` step, which the runtime requires before it starts.
 - The protocol's `getMetaItems` drops its undocumented `legacyFormOrganizationId` request key. It was never in the spec's `GetMetaItemsRequest`, and only those doors passed it. A caller that still passes it now gets the environment's list.
@@ -65,11 +65,27 @@ const legacyFlow = (name: string) => ({
 const TEMPLATE = 'm23429_welcome';
 const template = (subject: string) => ({ name: TEMPLATE, label: 'Welcome', locale: 'en-US', subject, bodyHtml: `<p>${subject}</p>` });
 
-interface SeedRow { id: string; type: string; name: string; organization_id: string | null; body: unknown }
+const PKG = 'com.example.m23429';
+const PKG_TEMPLATE = 'm23429_pkg_tpl';
+const LOCKED_TEMPLATE = 'm23429_locked_tpl';
+const tpl = (name: string, subject: string, extra: Record<string, unknown> = {}) =>
+  ({ name, label: name, locale: 'en-US', subject, bodyHtml: `<p>${subject}</p>`, ...extra });
+const permission = (name: string, label: string) => ({ name, label, objects: {} });
+
+interface SeedRow { id: string; type: string; name: string; organization_id: string | null; package_id?: string | null; body: unknown }
 const SEED: SeedRow[] = [
   { id: 'env_flow', type: 'flow', name: 'm23429_env_purge', organization_id: null, body: legacyFlow('m23429_env_purge') },
   { id: 'org_flow', type: 'flow', name: 'm23429_org_purge', organization_id: 'org_a', body: legacyFlow('m23429_org_purge') },
   { id: 'org_template', type: 'email_template', name: TEMPLATE, organization_id: 'org_a', body: template('Org A welcome') },
+  // An organization row BOUND TO A PACKAGE: its binding must never become the
+  // package-less write address (packagelessAddress) or the served row.
+  { id: 'org_pkg_template', type: 'email_template', name: PKG_TEMPLATE, organization_id: 'org_a', package_id: PKG, body: tpl(PKG_TEMPLATE, 'Org A packaged') },
+  // An organization row CARRYING `_lock`: it must never lock the environment's item.
+  { id: 'org_locked_template', type: 'email_template', name: LOCKED_TEMPLATE, organization_id: 'org_a', body: tpl(LOCKED_TEMPLATE, 'Org A locked', { _lock: 'full' }) },
+  // The kernel:ready security-catalog echo: an organization's permission
+  // overlay, beside the environment's control.
+  { id: 'org_permission', type: 'permission', name: 'm23429_org_perm', organization_id: 'org_a', body: permission('m23429_org_perm', 'Org A') },
+  { id: 'env_permission', type: 'permission', name: 'm23429_env_perm', organization_id: null, body: permission('m23429_env_perm', 'Environment') },
 ];
 
 let dir: string;
@@ -153,7 +169,7 @@ beforeAll(async () => {
     const now = new Date().toISOString();
     for (const row of SEED) {
       await k('sys_metadata').insert({
-        id: row.id, type: row.type, name: row.name, organization_id: row.organization_id, package_id: null,
+        id: row.id, type: row.type, name: row.name, organization_id: row.organization_id, package_id: row.package_id ?? null,
         state: 'active', version: 1, checksum: `sha256:seed_${row.id}`, created_at: now, updated_at: now,
         metadata: JSON.stringify(row.body),
       });
@@ -206,8 +222,8 @@ describe('os migrate meta --stored on a v17-shape database — the legacy organi
   }, CASE_TIMEOUT_MS);
 });
 
-/** The ceremony's `--apply` boot (`organization-ownership.ts`), and its `door.save`. */
-async function saveTemplateOnCeremonyBoot(db: string, subject: string): Promise<unknown> {
+/** The ceremony's `--apply` boot (`organization-ownership.ts`), with `fn` run against its kernel. */
+async function onCeremonyBoot<T>(db: string, fn: (kernel: { getService(name: string): any }) => Promise<T>): Promise<T> {
   const stack = await bootSchemaStack({
     jsonOutput: false,
     databaseUrl: `file:${db}`,
@@ -218,16 +234,21 @@ async function saveTemplateOnCeremonyBoot(db: string, subject: string): Promise<
     composeAuthGatedSecurity: true,
   });
   try {
-    const protocol = (stack.kernel as { getService(name: string): any }).getService('protocol');
-    await protocol.saveMetaItem({ type: 'email_template', name: TEMPLATE, item: template(subject), actor: 'os migrate organization-ownership' });
-    return null;
-  } catch (error) {
-    return error;
+    return await fn(stack.kernel as { getService(name: string): any });
   } finally {
     await stack.shutdown();
   }
 }
 
+/** The ceremony's `door.save` (`protocol.saveMetaItem`, no `source`): `null`, or what it threw. */
+const doorSave = (kernel: { getService(name: string): any }, type: string, name: string, item: unknown) =>
+  kernel.getService('protocol').saveMetaItem({ type, name, item, actor: 'os migrate organization-ownership' })
+    .then(() => null, (error: unknown) => error);
+
+async function saveTemplateOnCeremonyBoot(db: string, subject: string): Promise<unknown> {
+  return onCeremonyBoot(db, (kernel) => doorSave(kernel, 'email_template', TEMPLATE, template(subject)));
+}
+
 describe('the ceremony\'s template-promotion save on a v17-shape database', () => {
   it('a legacy organization template and no environment row: the save never rewrites the organization\'s row — it is refused, nothing written', async () => {
     const db = caseDb();
@@ -252,3 +273,71 @@ describe('the ceremony\'s template-promotion save on a v17-shape database', () =
     expect(rows[0]!.metadata).toMatchObject({ subject: 'Environment welcome' });
   }, CASE_TIMEOUT_MS);
 });
+
+describe('[ADR-0131 D6/D7] the ceremony boot\'s readers ignore a legacy organization row (re-review 6181366782)', () => {
+  it('door.save of a package-less item an organization holds BOUND TO A PACKAGE: the address is the environment\'s, never the organization row\'s package', async () => {
+    const db = caseDb();
+    const error = await onCeremonyBoot(db, (kernel) => doorSave(kernel, 'email_template', PKG_TEMPLATE, tpl(PKG_TEMPLATE, 'Environment')));
+    expect(error, String((error as Error | null)?.message ?? error)).toBeNull();
+    const rows = (await rawRows(db)).filter((r) => r.name === PKG_TEMPLATE);
+    const org = rows.find((r) => r.id === 'org_pkg_template')!;
+    expect(org).toMatchObject({ organization_id: 'org_a' });
+    expect(org.metadata).toEqual(tpl(PKG_TEMPLATE, 'Org A packaged'));
+    const env = rows.filter((r) => r.organization_id === null);
+    expect(env).toHaveLength(1);
+    expect(env[0]!.metadata).toMatchObject({ subject: 'Environment' });
+    const driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: db }, useNullAsDefault: true });
+    try {
+      const pkg = await (driver as any).knex('sys_metadata').where({ id: env[0]!.id }).first('package_id');
+      expect(pkg.package_id ?? null, 'the organization row\'s binding is not the environment row\'s address').toBeNull();
+    } finally {
+      await driver.disconnect();
+    }
+  }, CASE_TIMEOUT_MS);
+
+  it('lock.verdict and the _lock gate: an organization row carrying _lock: full neither reads as the item\'s lock nor is the gate\'s refusal', async () => {
+    const db = caseDb();
+    const { read, error } = await onCeremonyBoot(db, async (kernel) => {
+      const protocol = kernel.getService('protocol');
+      // The ceremony's `lock.verdict` port reads `getMetaItem`.
+      const read = await protocol.getMetaItem({ type: 'email_template', name: LOCKED_TEMPLATE }).catch(() => null);
+      const error = await doorSave(kernel, 'email_template', LOCKED_TEMPLATE, tpl(LOCKED_TEMPLATE, 'Environment'));
+      return { read, error };
+    });
+    expect((read as { lock?: unknown } | null)?.lock ?? 'none').not.toBe('full');
+    expect((read as { editable?: unknown } | null)?.editable).not.toBe(false);
+    // The `_lock` gate runs BEFORE the write. It did not refuse over the
+    // organization's lock: the save reached the store, where the re-keyed
+    // unique index refuses an environment row beside the organization's row of
+    // the same key — the refusal the template pin above measures.
+    expect(String((error as Error | null)?.message ?? error)).toMatch(/Duplicate record refused on 'sys_metadata'/);
+    expect(String((error as Error | null)?.message ?? error)).not.toMatch(/lock/i);
+    const org = (await rawRows(db)).find((r) => r.id === 'org_locked_template')!;
+    expect(org.metadata).toEqual(tpl(LOCKED_TEMPLATE, 'Org A locked', { _lock: 'full' }));
+  }, CASE_TIMEOUT_MS);
+
+  it('the kernel:ready security-catalog echo registers the environment\'s permission overlay and never an organization\'s', async () => {
+    const db = caseDb();
+    const saved = process.env.OS_AUTH_SECRET;
+    process.env.OS_AUTH_SECRET = 'm23429-secret-'.padEnd(40, 'x');
+    try {
+      const { orgEntry, envEntry } = await onCeremonyBoot(db, async (kernel) => {
+        const { createSecurityCatalogReader } = await import('@objectstack/core');
+        const catalog = createSecurityCatalogReader({
+          registry: kernel.getService('objectql').registry,
+          metadata: kernel.getService('metadata'),
+        });
+        return {
+          orgEntry: await catalog.resolve('permission', 'm23429_org_perm'),
+          envEntry: await catalog.resolve('permission', 'm23429_env_perm'),
+        };
+      });
+      expect(envEntry, 'control: the environment\'s overlay is in the catalog').toBeDefined();
+      expect(orgEntry, 'an organization\'s overlay is not the environment\'s').toBeUndefined();
+    } finally {
+      if (saved === undefined) delete process.env.OS_AUTH_SECRET;
+      else process.env.OS_AUTH_SECRET = saved;
+    }
+  }, CASE_TIMEOUT_MS);
+});
+
@@ -3883,16 +3883,6 @@ export class TursoDriver extends SqlDriver {
     return super.analyzeQuery(object, query, options);
   }
 
-  /**
-   * Schema introspection — refused on the REMOTE face. The inherited member
-   * reads every table's columns, foreign keys, primary keys and unique
-   * constraints through Knex (`columnInfo()` and the SQLite pragmas), so a
-   * remote answer would be a second copy of those four readers, the copy
-   * {@link refuseRemoteDriftDetection} declines for drift. Its callers already
-   * treat a throw as "could not introspect": the datasource connection test
-   * answers `ok: false` with this message, and the federation validation sweep
-   * rows the datasource `unreachable`.
-   */
   /**
    * [ADR-0131 D7 · #23429] The physical column names of `object`'s table. The
    * remote arm asks the remote catalog (`pragma_table_info`): the inherited
@@ -3906,12 +3896,29 @@ export class TursoDriver extends SqlDriver {
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)) {
         throw new Error(`listPhysicalColumns: "${table}" is not a table name the remote catalog read can quote.`);
       }
-      const rows = await this.remoteTransport!.execute(`SELECT name FROM pragma_table_info('${table}')`);
+      const sql = `SELECT name FROM pragma_table_info('${table}')`;
+      let rows: unknown;
+      try {
+        rows = await this.remoteTransport!.execute(sql);
+      } catch (error) {
+        // One envelope for both transports, as `execute()` declares it.
+        throw this.rawStatementFault(sql, error);
+      }
       return (Array.isArray(rows) ? rows : []).map((row) => String((row as { name?: unknown }).name ?? ''));
     }
     return super.listPhysicalColumns(object, options);
   }
 
+  /**
+   * Schema introspection — refused on the REMOTE face. The inherited member
+   * reads every table's columns, foreign keys, primary keys and unique
+   * constraints through Knex (`columnInfo()` and the SQLite pragmas), so a
+   * remote answer would be a second copy of those four readers, the copy
+   * {@link refuseRemoteDriftDetection} declines for drift. Its callers already
+   * treat a throw as "could not introspect": the datasource connection test
+   * answers `ok: false` with this message, and the federation validation sweep
+   * rows the datasource `unreachable`.
+   */
   override async introspectSchema(): Promise<IntrospectedSchema> {
     if (this.isRemote) {
       refuseRemoteInheritedMember(