@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+'@objectstack/plugin-sharing': patch
+---
+
+`plugin-sharing` recognises the engine's organization refusal through objectql's own published recognizer instead of a locally re-spelled literal, and the `PROVENANCE_WAIVERS` row that excused that local spelling is retired with it (#16160).
+
+Clause-②: no
+
+The waiver carried its own expiry in its `reason`: *removed together with the stamp site when objectql publishes a recognizer*. It does, so both halves land here — `check:error-code-provenance` reconciles a waiver in three directions at once (the `registeredUnder` key still lists the code, the waived package still does not, and the scan still finds a site for the pair), so removing either half alone reddens the gate on the other.
+
+- **`ENGINE_ORGANIZATION_REFUSAL_CODE` is gone.** It was a `constdef` stamp site in `plugin-sharing/src/sharing-rule-service.ts` for a code this package only ever RECOGNISES — `@objectstack/objectql` is the emitter and already carries the row. The per-grant catch now asks `isSystemWriteOrganizationRequiredError(err)`, and the `warn` that reports an absorbed refusal names `SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE`. Both are imported from `@objectstack/objectql`, which exports them for exactly this: a consumer performs the `code` compare without authoring the string, so it acquires no stamp site of its own and cannot drift from what the engine throws.
+- **Nothing about the absorbed set moves.** The catch stays as narrow as it was — one engine refusal absorbed, everything else rethrown unchanged — and `plugin-sharing` still emits this code nowhere: the surviving mention is a structured log field on the refusal it just absorbed, not a refusal envelope of its own.
+- **No error-code membership moves.** `ERROR_CODE_LEDGER` and `StandardErrorCode` are untouched; `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED` stays registered under `@objectstack/objectql` exactly as before. The only ledger change is one `PROVENANCE_WAIVERS` element, 10 waivers → 9, and the gate's site census 339 → 338 with `listed` unchanged at 322.
@@ -23,13 +23,22 @@ import type { ExecutionContext } from '@objectstack/spec/kernel';
 // enforcement hole this closes gets re-opened one seam over.
 import { isRowActive } from '@objectstack/core';
 // [#14754] The engine's organization refusal for a system write on a
-// tenant-scoped object (#8844). Imported as a TYPE only: the runtime check is a
-// `code` compare, which is the convention that class itself documents ("a
-// caller that catches it identifies it by `code`") so the check survives the
-// package boundary where two copies of that module can exist. Typing the
-// literal FROM the class is what keeps the two spellings from drifting — a
-// typo here would not be a failing test, it would be a catch that never fires.
-import type { SystemWriteOrganizationRequiredError } from '@objectstack/objectql';
+// tenant-scoped object (#8844). The runtime check is a `code` compare, which is
+// the convention that refusal itself documents ("a caller that catches it
+// identifies it by `code`") so the check survives the package boundary where
+// two copies of that module can exist — `instanceof` is unsound across the dual
+// build and fails SILENTLY, as a catch that never fires.
+//
+// [#14936] The recognizer and the code are taken FROM the engine rather than
+// re-spelled here. The engine publishes both precisely so a consumer can
+// perform the compare without authoring the string itself: a local literal is a
+// second spelling that can drift from what the engine throws, and it acquires a
+// `check:error-code-provenance` stamp site in this package for a code this
+// package only ever RECOGNISES.
+import {
+  isSystemWriteOrganizationRequiredError,
+  SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE,
+} from '@objectstack/objectql';
 import type { SharingEngine } from './sharing-service.js';
 import type { SharingService } from './sharing-service.js';
 import { normalizeAccessLevel, normalizeStoredAccessLevel } from './access-level.js';
@@ -129,15 +138,6 @@ function rowFromRule(row: any): SharingRuleRow {
   };
 }
 
-/**
- * [#14754] The one engine refusal a reconcile pass absorbs per grant.
- *
- * Spelled once, and typed from the engine's own declaration so it cannot drift
- * from the code the engine actually throws.
- */
-const ENGINE_ORGANIZATION_REFUSAL_CODE: SystemWriteOrganizationRequiredError['code'] =
-  'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED';
-
 /**
  * [#14754] What one reconcile pass did, plus the grants the engine's
  * organization rule REFUSED in it.
@@ -1649,7 +1649,7 @@ export class SharingRuleService implements ISharingRuleService {
    *
    * `sys_record_share` is tenant-scoped in the #13491 ledger (#14484), so on a
    * walled install an organization-less system insert on it is refused loudly
-   * with {@link ENGINE_ORGANIZATION_REFUSAL_CODE}. `SharingService.grant`
+   * with {@link SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE}. `SharingService.grant`
    * resolves the organization on every path that can; a platform-global rule
    * (`organization_id = null`, its sweep unscoped) materialising onto an
    * organization-less record resolves none, and meets the refusal.
@@ -1663,8 +1663,9 @@ export class SharingRuleService implements ISharingRuleService {
    *
    * ## Why the catch is narrow, and must stay narrow
    *
-   * ONLY {@link ENGINE_ORGANIZATION_REFUSAL_CODE} is absorbed; everything else
-   * rethrows unchanged. Two reasons, and the second is measured:
+   * ONLY the engine's organization refusal is absorbed — recognised through
+   * the engine's own {@link isSystemWriteOrganizationRequiredError}; everything
+   * else rethrows unchanged. Two reasons, and the second is measured:
    *
    * - A catch-all would swallow real defects — a driver outage, a criteria
    *   bug, a permission failure — and report a pass that "completed" having
@@ -1701,15 +1702,15 @@ export class SharingRuleService implements ISharingRuleService {
       );
       return true;
     } catch (err: any) {
-      if (err?.code !== ENGINE_ORGANIZATION_REFUSAL_CODE) throw err;
+      if (!isSystemWriteOrganizationRequiredError(err)) throw err;
       this.logger?.warn?.(
         '[sharing-rule] grant refused by the engine organization rule — counted, pass continues',
         {
           rule: rule.name ?? rule.id,
           object: rule.object_name,
           record: recordId,
           recipient: recipientId,
-          code: ENGINE_ORGANIZATION_REFUSAL_CODE,
+          code: SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE,
         },
       );
       return false;
 
@@ -1677,21 +1677,6 @@ export const PROVENANCE_WAIVERS: readonly ProvenanceWaiver[] = [
       'protocol layer — the registered emitter — turns it into the 403 the wire carries ' +
       '(ADR-0010 §3.3). Spec ships schemas and pure helpers, never an HTTP door.',
   },
-  {
-    package: '@objectstack/plugin-sharing',
-    code: 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED',
-    registeredUnder: '@objectstack/objectql',
-    reason: 'Matches the code, never emits it (#14754, adjudicated on #14937 — maintainer ' +
-      'ruling A, 2026-09-04): `ENGINE_ORGANIZATION_REFUSAL_CODE` in ' +
-      '`plugin-sharing/src/sharing-rule-service.ts` is a `constdef` the per-grant catch in BOTH ' +
-      'reconcile loops compares an incoming `err.code` against, so exactly one engine refusal is ' +
-      'absorbed and a refused grant no longer aborts the pass or its stale-row revocations. The ' +
-      'emitter is `@objectstack/objectql` (`SystemWriteOrganizationRequiredError`, ' +
-      'tenancy/system-write-organization.ts) and the objectql owner key already carries the row ' +
-      '(#8844). Recognising a code is not emitting it; the named constant is typed FROM the ' +
-      'engine\'s own declaration so it cannot drift from what the engine throws. Removed together ' +
-      'with the stamp site when #14936 lands and objectql publishes a recognizer.',
-  },
   {
     package: '@objectstack/types',
     code: 'VALIDATION_FAILED',
 
@@ -371,7 +371,7 @@ import { maskComments, maskCommentsAndLiterals } from './js-comment-mask.mjs';
 // #16421 — the DIRECTION ARM, read through the fleet's one declaration reader.
 // ⛔ Not re-implemented here: the ruling's condition on the arm is that it has a
 // single legal spelling read in a single place, and every reader imports it.
-import { readClause2Line } from './pm/check-clause2-carriers.mjs';
+import { readClause2Line } from './pm/clause2-line.mjs';
 // #16421 — the staging manifest for this gate's own I1/I2 fixture, derived from
 // the module graph rather than typed out. Shared with the OTHER site that copies
 // this gate into a sandbox (`objectui-changeset-digest.mjs`), because two hand
@@ -7024,8 +7024,8 @@ function selfTest() {
     // ⭐ DERIVED, not listed, and derived by a module BOTH staging sites of this
     // gate import (#16421). It was a two-name list here and the same two-name
     // list in `objectui-changeset-digest.mjs`'s `fw-gate` sandbox. Signal (4)
-    // added an edge to `pm/check-clause2-carriers.mjs`, whose own closure is nine
-    // modules deep; this site was updated in the same edit and the other was not,
+    // added an edge to the clause-② declaration reader, then ten thousand lines
+    // of sweep behind it; this site was updated in the same edit and the other was not,
     // and `check:objectui-changeset` went red in CI with an error naming neither
     // the import nor the manifest. One in two is the measured hit rate of "the
     // next author remembers", so neither site holds an opinion about the graph
@@ -7037,7 +7037,7 @@ function selfTest() {
     // moment signal (4) is reached, and the two I-cases below would again report
     // about the wrong thing. This names the one edge that made the list a graph.
     assert(
-      staged.includes(copy) && staged.includes('scripts/pm/check-clause2-carriers.mjs'),
+      staged.includes(copy) && staged.includes('scripts/pm/clause2-line.mjs'),
       `I1/I2: the staged closure must carry the gate AND the declaration reader it imports — got ${staged.length} file(s): ${staged.join(', ')}`,
     );
     w(
 
@@ -391,7 +391,7 @@ import { isEntrypoint } from './invoked-as.mjs';
 // from the gate the PM protocol actually runs. Both modules import node
 // builtins only, so this file still runs before `pnpm install`.
 import { CONTRACT_REVIEW_LABEL } from './pm/check-half-states.mjs';
-import { readClause2Line } from './pm/check-clause2-carriers.mjs';
+import { readClause2Line } from './pm/clause2-line.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
@@ -885,7 +885,7 @@ export function render(result) {
 //   ① the CLAUSE-② declaration — "this PR puts a new key on a published
 //      payload" — carried by the `needs:contract-review` gate label and/or by
 //      the fixed `Clause-②: yes` line the PM protocol spells (read here through
-//      `check-clause2-carriers.mjs`'s own `readClause2Line`, imported rather
+//      `clause2-line.mjs`'s own `readClause2Line`, imported rather
 //      than restated, so the two readers cannot drift);
 //   ② the CHANGESET LEVEL for the package whose `packages/**/src/**` the diff
 //      moves.
@@ -1383,7 +1383,7 @@ export function packagesTouched({ cwd, from, head }) {
 // `readClause2Line` returns a REASON with every near miss, and this gate used
 // to print the offending line without it: the reader knew which of three
 // different mistakes the author had made, and the refusal said only "a near
-// miss". The three owe different remedies — `check-clause2-carriers.mjs` says
+// miss". The three owe different remedies — `clause2-line.mjs` says
 // so in its own words ("⛔ The reason changes the sentence, never the state") —
 // so the sentence is what this map supplies.
 //
@@ -1433,7 +1433,7 @@ export function clause2NearMissRemedy(reason, line) {
   }
   return (
     `this gate carries no remedy sentence for a near miss of reason ${JSON.stringify(reason ?? null)} — ` +
-    '`readClause2Line` (scripts/pm/check-clause2-carriers.mjs) reports a reason this file has not been taught, ' +
+    '`readClause2Line` (scripts/pm/clause2-line.mjs) reports a reason this file has not been taught, ' +
     `and the reason plus the line are printed rather than swallowed. The offending line is: ${line}. Whatever the ` +
     'reason, a declaration is `Clause-②: yes` or `Clause-②: no`, bare, at the start of a line of its own. Add the ' +
     'sentence for this reason to CLAUSE2_NEAR_MISS_REMEDIES in scripts/check-changeset-no-major.mjs.'
 
@@ -2321,8 +2321,8 @@ function selfTest() {
     // moved.
     //
     // ⭐ It was a hand MANIFEST, and the manifest is what broke (#16421). That
-    // gate gained one import — `pm/check-clause2-carriers.mjs`, the fleet's one
-    // clause-② declaration reader, whose own closure is nine modules deep — and
+    // gate gained one import — the fleet's one clause-② declaration reader, then
+    // living inside ten thousand lines of sweep with a nine-module closure — and
     // the author updated the gate's OWN I1/I2 staging site in the same edit and
     // not this one. CI went red HERE, on a gate about objectui changesets, with
     // an error naming neither the new import nor this list. Both sites now DERIVE
@@ -2346,7 +2346,7 @@ function selfTest() {
     for (const rel of gateDeps) gw(rel, readFileSync(join(__dirname, '..', rel), 'utf8'));
     check(
       '#6494 the staged gate carries its whole first-party closure — DERIVED, not a hand manifest',
-      gateDeps.includes('scripts/pm/check-clause2-carriers.mjs') && gateDeps.length >= 2,
+      gateDeps.includes('scripts/pm/clause2-line.mjs') && gateDeps.length >= 2,
       `${gateDeps.length} dependenc(ies): ${gateDeps.join(', ')}`,
     );
     gg('add', '-A');