@@ -0,0 +1,21 @@
+---
+'@objectstack/cli': minor
+---
+
+feat(cli): `os migrate organization-ownership --apply` promotes customized email templates and moves the settings global rung (ADR-0131 D10)
+
+Clause-②: yes (widening)
+
+Two steps join the ceremony, after the authored catalog conversion and before the verified id→name rewrite. Each is checkpointed and resumable like the others.
+
+- **`template-promotion`** (ruling C on ADR-0131 §6 Q1). Every `sys_email_template` row an admin customized (`customized: true`) or authored (`managed_by` other than a seeder) becomes an environment `email_template` item through the metadata door, one per `(name, locale)`, before mirror deletion removes the rows. Seeded, uncustomized copies are not promoted. A promotion that already landed is skipped. The step stops, keeping every row, in three cases:
+  - two rows of one `(name, locale)` that differ;
+  - an environment template that already exists and differs, since the environment's edit is never overwritten;
+  - a door refusal.
+
+  Under a walled posture the rows are reported and kept: promoting them would apply one organization's edit to every organization.
+- **`settings-move`** (ADR-0131 D7). Every `sys_setting` row with `scope = 'global'` is copied into `sys_platform_setting` by the database itself (`INSERT … SELECT`), so `value` and the `value_enc` secret handle move verbatim. The row then leaves `sys_setting`. A key `sys_platform_setting` already holds with the same value is only removed from `sys_setting`. The step stops, moving nothing for that key, in two cases:
+  - `sys_platform_setting` already holds the key with a different value (the one the runtime serves);
+  - `sys_setting` holds differing rows for the key.
+
+Mirror deletion now also deletes the promoted template rows: under `single`, once the promotion step has finished, every remaining `sys_email_template` row is a mirror. The apply report gains `movedOut` / `movedIn` per table, and row counts reconcile as before − deleted − moved out + moved in.
@@ -0,0 +1,13 @@
+---
+'@objectstack/core': minor
+---
+
+feat(core): `emailTemplateDefinitionFromRow` — a `sys_email_template` row as the `email_template` definition it carries (ADR-0131 D10, ruling C on §6 Q1)
+
+Clause-②: yes (widening)
+
+A new pure export beside `permissionSetDefinitionFromRow` and `positionDefinitionFromRow`: one row in, one body out, with no engine, no I/O and no import. The upgrade ceremony (`os migrate organization-ownership --apply`) uses it to promote a customized or admin-authored template row to an environment `email_template` item through the metadata door before the row is deleted. It runs only in that ceremony, never at boot.
+
+The mapping: `body_html` → `bodyHtml`, `body_text` → `bodyText`, `from_address` / `from_name` → `fromOverride`, `reply_to` → `replyTo`, `variables_json` → `variables`, and `active` keeps its stored meaning. `label` falls back to the name and `locale` to `en-US`. The retired `category` / `is_system` columns and every provenance or state column are left out. It does not validate; the door does.
+
+Nothing existing changes.
@@ -7,15 +7,24 @@
  * nothing without `--apply`, and is refused there too.
  */
 
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 import { fileURLToPath } from 'node:url';
 
 const boot = vi.hoisted(() => vi.fn(async () => {
   throw new Error('the database was opened');
 }));
 vi.mock('../../utils/schema-migrate.js', () => ({ bootSchemaStack: boot }));
 
-const { default: MigrateOrganizationOwnership } = await import('./organization-ownership.js');
+type Command = (typeof import('./organization-ownership.js'))['default'];
+let MigrateOrganizationOwnership: Command;
+
+// The command's module graph is large, and oclif reads the package's config on
+// the first run: both are paid outside the 5 s default (CASE_TIMEOUT_MS).
+beforeAll(async () => {
+  ({ default: MigrateOrganizationOwnership } = await import('./organization-ownership.js'));
+}, 60_000);
+
+const CASE_TIMEOUT_MS = 60_000;
 
 const CLI_ROOT = fileURLToPath(new URL('../../..', import.meta.url));
 
@@ -50,19 +59,19 @@ describe('os migrate organization-ownership --apply — the backup precondition'
     expect(payload).toMatchObject({ error: 'apply_refused', reason: 'backup-unacknowledged' });
     expect(exitCode).toBe(1);
     expect(boot).not.toHaveBeenCalled();
-  });
+  }, CASE_TIMEOUT_MS);
 
   it('refuses --backup-taken without --apply, before the boot', async () => {
     const { payload, exitCode } = await runJson(['--backup-taken', '--json']);
     expect(payload).toMatchObject({ error: 'plan_refused', reason: 'flag-without-apply' });
     expect(exitCode).toBe(1);
     expect(boot).not.toHaveBeenCalled();
-  });
+  }, CASE_TIMEOUT_MS);
 
   it('with --backup-taken, goes on to the boot', async () => {
     const { payload } = await runJson(['--apply', '--backup-taken', '--json']);
     expect(payload).toMatchObject({ error: 'boot_failed', reason: 'boot-failed' });
     expect(boot).toHaveBeenCalledTimes(1);
     expect(boot.mock.calls[0]).toEqual([expect.objectContaining({ deferSchemaDdl: true, composeHostStack: true })]);
-  });
+  }, CASE_TIMEOUT_MS);
 });
@@ -84,8 +84,9 @@ async function confirm(question: string): Promise<boolean> {
  * The writing mode. It asks about the backup first — the operator's act and
  * the precondition (D10 item 2): `--backup-taken`, or a yes at the prompt; a
  * non-interactive run without the flag is refused before the boot. It then
- * performs the fates in order — attribution, the verified id→name rewrite,
- * mirror deletion, column drops — through `../../utils/organization-ownership-apply.ts`,
+ * performs the fates in order — attribution, the authored catalog conversion,
+ * the template promotion, the settings global-rung move, the verified id→name
+ * rewrite, mirror deletion, column drops — through `../../utils/organization-ownership-apply.ts`,
  * checkpointing each finished step in the deployment ledger (`sys_migration`,
  * row {@link ORGANIZATION_OWNERSHIP_MIGRATION_ID}) so an interrupted run
  * resumes where it stopped, and ends with the post-check. The ledger row is
@@ -106,7 +107,8 @@ export default class MigrateOrganizationOwnership extends Command {
     'The v18 organization-ownership ceremony (ADR-0131 D10). Without --apply, the read-only plan: per table, the fate, ' +
     'the row counts, the rows whose owner cannot be derived (by id), and which tables will receive NOT NULL, written ' +
     'to a file — never a row or a column changed; it refuses, naming it, any table it cannot enumerate. With --apply ' +
-    '(and a backup): attribution, the verified id-to-name rewrite, mirror deletion and column drops, in that order, ' +
+    '(and a backup): attribution, the authored catalog conversion, the template promotion, the settings move, the ' +
+    'verified id-to-name rewrite, mirror deletion and column drops, in that order, ' +
     'resumable from a recorded checkpoint, then the post-check.';
 
   static override examples = [
@@ -341,6 +343,7 @@ export default class MigrateOrganizationOwnership extends Command {
       const engine = kernel.getService('objectql') as Parameters<typeof recordDataMigrationRun>[0] & { registry?: unknown };
       const protocol = kernel.getService('protocol') as {
         saveMetaItem?: (request: Record<string, unknown>) => Promise<unknown>;
+        getMetaItemsForExecution?: (request: { type: string }) => Promise<{ items?: unknown[] }>;
       } | undefined;
       const catalog = createSecurityCatalogReader({
         registry: engine.registry as never,
@@ -381,6 +384,29 @@ export default class MigrateOrganizationOwnership extends Command {
             await protocol.saveMetaItem({ type, name, item: body, actor: CEREMONY_ACTOR });
           },
         },
+        templates: {
+          // The environment's own row first (it is what a promotion must never
+          // overwrite), then what the registry serves for the bundle member.
+          find: async (name, locale) => {
+            const stored = await executor.query(
+              'SELECT metadata FROM sys_metadata WHERE type = ? AND name = ? AND state = ? AND organization_id IS NULL ' +
+                'AND (bundle_member = ? OR (bundle_member IS NULL AND ? = ?))',
+              ['email_template', name, 'active', locale, locale, 'en-US'],
+            );
+            if (stored.length > 0) {
+              const raw = stored[0]!.metadata;
+              const definition = (typeof raw === 'string' ? JSON.parse(raw) : raw) as Record<string, unknown>;
+              return { definition, environment: true };
+            }
+            if (typeof protocol?.getMetaItemsForExecution !== 'function') return undefined;
+            const listed = await protocol.getMetaItemsForExecution({ type: 'email_template' });
+            const served = (listed?.items ?? []).find((item) => {
+              const i = item as Record<string, unknown> | null;
+              return !!i && i.name === name && (typeof i.locale === 'string' && i.locale ? i.locale : 'en-US') === locale;
+            }) as Record<string, unknown> | undefined;
+            return served ? { definition: served, environment: false } : undefined;
+          },
+        },
         columnDrops: {
           drop: async (tables) => {
             const drift = await liveStack.detectManagedDrift();