@@ -0,0 +1,46 @@
+---
+'@objectstack/core': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-security': patch
+'@objectstack/service-settings': patch
+---
+
+refactor(core, plugin-auth, plugin-security, service-settings): one definition each for the `admin_full_access` anchor rule and the organization-reach rule, exported from core security
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+Two security rules were each spelled more than once. A change to one copy could leave the other behind. Each now has one definition in `@objectstack/core`'s security module, and every reader calls it. No behaviour change: every reader answers exactly as before.
+
+- **The anchor rule (ADR-0131 D5).** New export: `organizationAnchorsPlatformStanding(grantOrganizationId, { walled, defaultOrganizationId })`, with the type `PlatformStandingAnchorFacts`. It decides which `admin_full_access` grant anchors platform-admin standing:
+  - behind a wall, no grant does;
+  - under `single`, the grant owned by the Default Organization does;
+  - an organization-less grant never does, and neither does any grant when no Default Organization can be named.
+
+  Three readers call it:
+  - the authorization resolver passes the memoised Default Organization;
+  - the last-administrator guard in `@objectstack/plugin-auth` passes the Default Organization as the pending write would leave it;
+  - the first-user promotion's holder scan in `@objectstack/plugin-security` passes the Default Organization it promotes into, and keeps its own system-user exclusion.
+
+  Each reader keeps its own normalizer for a grant row's organization.
+- **The organization-reach rule (ADR-0131 D8/D9).** New exports:
+  - `resolveOrganizationReach({ callerOrganizationId, wallStands, deriveOrganization })`;
+  - `organizationReachAdmits(reach, rowOrganizationId)`;
+  - `organizationReachRowOwner(reach)`;
+  - `organizationIdOf(value)`;
+  - `UNOWNED_ORGANIZATION_REACH`;
+  - the types `OrganizationReach` and `OrganizationReachFacts`.
+
+  The rule decides whose `sys_setting` rows a caller may draw on:
+  - the caller's own organization;
+  - for a caller naming none where no wall stands, the organization D9 derives;
+  - nothing behind a wall;
+  - rows with no organization, only in a composition that registers no organization object.
+
+  `SettingsService` and the resolver's direct localization fallback both call it. Each still supplies its own facts:
+  - the service: the posture in force (the `tenancy` service), with a failed read propagated to its caller;
+  - the fallback: the requested posture (`OS_TENANCY_POSTURE`), with a failed read degraded to the built-in defaults.
+
+  These two differences are kept by design: they make the fallback, which runs only when the service has failed, the stricter reader.
+
+No configuration, metadata or HTTP behaviour changes. Code that does not import the new exports needs no action.
@@ -232,6 +232,28 @@ export {
   type DefaultOrganizationAnswer,
 } from './default-organization.js';
 
+// [ADR-0131 D5] The ONE anchor rule for platform standing: which
+// `admin_full_access` grant anchors it, with the posture and the Default
+// Organization as parameters. The resolver's §6b and plugin-auth's
+// last-administrator guard (over the simulated Default Organization) ask it.
+export {
+  organizationAnchorsPlatformStanding,
+  type PlatformStandingAnchorFacts,
+} from './platform-standing-anchor.js';
+
+// [ADR-0131 D8/D9] The ONE organization-reach rule: whose `sys_setting` rows a
+// caller may draw on. `SettingsService` and the resolver's localization
+// fallback ask it, each with its own posture source and failure policy.
+export {
+  resolveOrganizationReach,
+  organizationReachAdmits,
+  organizationReachRowOwner,
+  organizationIdOf,
+  UNOWNED_ORGANIZATION_REACH,
+  type OrganizationReach,
+  type OrganizationReachFacts,
+} from './organization-reach.js';
+
 // [ADR-0131 D9, ADR-0138 D4] The ONE "which organization does a caller with no
 // organization of its own act in?" decision. Two askers: the engine's
 // system-context insert (`@objectstack/objectql`, which re-exports these same
 
@@ -0,0 +1,143 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D8/D9] The one organization-reach rule, pinned on its own as a
+ * table over every caller shape, wall and D9 decision. Both readers —
+ * `SettingsService` and the resolver's direct localization fallback — hand
+ * their facts to this rule, so these rows are what both of them answer. Their
+ * own pins (`settings-organization-reach.pin.test.ts`,
+ * `resolve-localization-fallback-organization.pin.test.ts`) hold each reader's
+ * facts — the posture source and the failure policy; this table holds the rule.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  organizationIdOf,
+  organizationReachAdmits,
+  organizationReachRowOwner,
+  resolveOrganizationReach,
+  UNOWNED_ORGANIZATION_REACH,
+  type OrganizationReach,
+} from './organization-reach.js';
+import type { SystemWriteOrganizationDecision } from './system-write-organization.js';
+import * as securityIndex from './index.js';
+
+const DERIVED: SystemWriteOrganizationDecision = { kind: 'derived', organizationId: 'org_only' };
+const LEAN: SystemWriteOrganizationDecision = { kind: 'no-organization-object' };
+const REFUSE_NONE: SystemWriteOrganizationDecision = { kind: 'refuse', reason: 'no-organization', organizationCount: 0 };
+const REFUSE_SEVERAL: SystemWriteOrganizationDecision = {
+  kind: 'refuse',
+  reason: 'ambiguous-organization',
+  organizationCount: 2,
+};
+const REFUSE_WALLED: SystemWriteOrganizationDecision = { kind: 'refuse', reason: 'walled-posture' };
+
+/** The facts for one row, recording which of them the rule asked. */
+function factsOf(callerOrganizationId: unknown, wall: boolean, decision: SystemWriteOrganizationDecision) {
+  const asked: string[] = [];
+  return {
+    asked,
+    facts: {
+      callerOrganizationId,
+      wallStands: () => {
+        asked.push('wall');
+        return wall;
+      },
+      deriveOrganization: async () => {
+        asked.push('derive');
+        return decision;
+      },
+    },
+  };
+}
+
+describe('[ADR-0131 D8/D9] resolveOrganizationReach — the one reach rule', () => {
+  // [caller organization, wall stands?, D9 decision, reach, facts asked]
+  const table: Array<[unknown, boolean, SystemWriteOrganizationDecision, OrganizationReach, string[]]> = [
+    // A caller that names an organization is that organization's, under every
+    // posture, and asks nothing else.
+    ['org_a', false, DERIVED, { kind: 'own', organizationId: 'org_a' }, []],
+    ['org_a', true, REFUSE_WALLED, { kind: 'own', organizationId: 'org_a' }, []],
+    ['org_a', false, LEAN, { kind: 'own', organizationId: 'org_a' }, []],
+    // A caller that names none, behind a wall: unowned, D9 never asked.
+    [undefined, true, DERIVED, UNOWNED_ORGANIZATION_REACH, ['wall']],
+    ['', true, LEAN, UNOWNED_ORGANIZATION_REACH, ['wall']],
+    // A caller that names none, no wall: whatever D9 decides.
+    [undefined, false, DERIVED, { kind: 'own', organizationId: 'org_only' }, ['wall', 'derive']],
+    [null, false, LEAN, { kind: 'no-organization-object' }, ['wall', 'derive']],
+    ['', false, REFUSE_NONE, UNOWNED_ORGANIZATION_REACH, ['wall', 'derive']],
+    [undefined, false, REFUSE_SEVERAL, UNOWNED_ORGANIZATION_REACH, ['wall', 'derive']],
+    [undefined, false, REFUSE_WALLED, UNOWNED_ORGANIZATION_REACH, ['wall', 'derive']],
+    // A non-string caller id names no organization.
+    [42, false, DERIVED, { kind: 'own', organizationId: 'org_only' }, ['wall', 'derive']],
+  ];
+
+  it.each(table)('caller=%j · wall=%s · decision=%j → %j', async (caller, wall, decision, reach, askedFacts) => {
+    const { asked, facts } = factsOf(caller, wall, decision);
+    expect(await resolveOrganizationReach(facts)).toEqual(reach);
+    expect(asked).toEqual(askedFacts);
+  });
+
+  it('a fact that throws propagates — the reader owns its failure policy', async () => {
+    await expect(resolveOrganizationReach({
+      callerOrganizationId: undefined,
+      wallStands: () => { throw new Error('posture unreadable'); },
+      deriveOrganization: async () => DERIVED,
+    })).rejects.toThrow('posture unreadable');
+    await expect(resolveOrganizationReach({
+      callerOrganizationId: undefined,
+      wallStands: async () => false,
+      deriveOrganization: async () => { throw new Error('organization read failed'); },
+    })).rejects.toThrow('organization read failed');
+  });
+});
+
+describe('[ADR-0131 D8] organizationReachRowOwner / organizationReachAdmits — whose rows a reach reads', () => {
+  const own: OrganizationReach = { kind: 'own', organizationId: 'org_a' };
+  const lean: OrganizationReach = { kind: 'no-organization-object' };
+
+  it('the row owner: the organization, NULL for the lean arm, nothing for unowned', () => {
+    expect(organizationReachRowOwner(own)).toBe('org_a');
+    expect(organizationReachRowOwner(lean)).toBeNull();
+    expect(organizationReachRowOwner(UNOWNED_ORGANIZATION_REACH)).toBeUndefined();
+  });
+
+  // [reach, row's organization, admitted?]
+  const rows: Array<[OrganizationReach, unknown, boolean]> = [
+    [own, 'org_a', true],
+    [own, 'org_b', false],
+    // A row with no organization is never an organization's fallback.
+    [own, null, false],
+    [own, undefined, false],
+    [own, '', false],
+    // The lean arm reads the NULL rows only.
+    [lean, null, true],
+    [lean, undefined, true],
+    [lean, '', true],
+    [lean, 'org_a', false],
+    // Unowned reads nothing — a NULL row included.
+    [UNOWNED_ORGANIZATION_REACH, null, false],
+    [UNOWNED_ORGANIZATION_REACH, 'org_a', false],
+  ];
+
+  it.each(rows)('reach=%j · row organization=%j → %s', (reach, rowOrganizationId, admitted) => {
+    expect(organizationReachAdmits(reach, rowOrganizationId)).toBe(admitted);
+  });
+
+  it('"no organization" is spelled one way: a non-empty string, else null', () => {
+    expect(organizationIdOf('org_a')).toBe('org_a');
+    expect(organizationIdOf('')).toBeNull();
+    expect(organizationIdOf(null)).toBeNull();
+    expect(organizationIdOf(undefined)).toBeNull();
+    expect(organizationIdOf(7)).toBeNull();
+  });
+
+  it('is exported from core security — the bindings every reader imports', () => {
+    expect(securityIndex.resolveOrganizationReach).toBe(resolveOrganizationReach);
+    expect(securityIndex.organizationReachAdmits).toBe(organizationReachAdmits);
+    expect(securityIndex.organizationReachRowOwner).toBe(organizationReachRowOwner);
+    expect(securityIndex.organizationIdOf).toBe(organizationIdOf);
+    expect(securityIndex.UNOWNED_ORGANIZATION_REACH).toBe(UNOWNED_ORGANIZATION_REACH);
+  });
+});
@@ -0,0 +1,116 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D8/D9] The ONE organization-reach rule: which organization's
+ * `sys_setting` rows a caller may draw on. Two readers ask it, and must never
+ * disagree about whose rows those are:
+ *
+ *  - `SettingsService` (`@objectstack/service-settings`) — the tenant and user
+ *    rungs of every settings read, and the owner of every settings write;
+ *  - the direct localization fallback (`resolveLocalizationContext`,
+ *    `resolve-authz-context.ts`), which stands in for that service when it is
+ *    absent or has just failed, so it can never answer what the service would
+ *    refuse.
+ *
+ * What differs between the readers is WHERE they learn the facts, never what
+ * the facts decide: the service asks the posture IN FORCE (the `tenancy`
+ * service) and lets a failed read reach its caller; the fallback asks the
+ * REQUESTED posture (`resolveTenancyPosture()`), the stricter source, and
+ * degrades a failed read to the built-in defaults. So the rule takes those
+ * facts as parameters. ⛔ Never restate the rule beside a read: hand the facts
+ * to {@link resolveOrganizationReach}, and judge rows with
+ * {@link organizationReachAdmits}.
+ */
+
+import type { SystemWriteOrganizationDecision } from './system-write-organization.js';
+
+/**
+ * Which rows a caller's organization reach may draw on.
+ *
+ * [ADR-0131 D1/D8] A row with no organization is no organization's: no reach
+ * reads it as a fallback for an organization, and none reads another
+ * organization's row for a caller that names none.
+ *
+ *  - `own` — that organization's rows, and only those. The organization is the
+ *    caller's own, or — for a caller that names none where no wall stands —
+ *    the one organization D9's predicate derives.
+ *  - `no-organization-object` — the composition registers no organization
+ *    object, so no organization can exist (the lean embedding, kept by the
+ *    ruling ADR-0131's D9 note records): the rows written with no
+ *    organization, the only rows such a composition can hold.
+ *  - `unowned` — no organization to name: a caller that names none behind a
+ *    wall, or where D9 derives none (no organization yet, or several). No row
+ *    at all.
+ */
+export type OrganizationReach =
+  | { kind: 'own'; organizationId: string }
+  | { kind: 'no-organization-object' }
+  | { kind: 'unowned' };
+
+/** The reach that reads nothing. */
+export const UNOWNED_ORGANIZATION_REACH: OrganizationReach = Object.freeze({ kind: 'unowned' as const });
+
+/** An organization id with "no organization" spelled one way: a non-empty string, else `null`. */
+export function organizationIdOf(value: unknown): string | null {
+  return typeof value === 'string' && value !== '' ? value : null;
+}
+
+/** The facts the reach rule decides on. */
+export interface OrganizationReachFacts {
+  /** The caller's own organization as it carries it (`tenantId`); normalized by {@link organizationIdOf}. */
+  callerOrganizationId: unknown;
+  /**
+   * Does a wall stand between organizations? Asked only for a caller that
+   * names none. A throw propagates: the reader decides what a posture it could
+   * not read means.
+   */
+  wallStands: () => boolean | Promise<boolean>;
+  /**
+   * ADR-0131 D9's decision for a caller that names no organization
+   * (`resolveGuestOrganization`). Asked only for such a caller, where no wall
+   * stands. A throw propagates, as above.
+   */
+  deriveOrganization: () => Promise<SystemWriteOrganizationDecision>;
+}
+
+/**
+ * [ADR-0131 D8/D9] The caller's organization reach ({@link OrganizationReach}).
+ *
+ * A caller that names an organization is that organization's, under every
+ * posture. One that names none is `unowned` behind a wall; elsewhere it is
+ * whatever D9 derives: the one organization (`own`), a composition with no
+ * organization object, or none (refused there, so `unowned` here).
+ *
+ * Reads nothing itself: every fact is a parameter, asked lazily and in that
+ * order, so a caller that names an organization asks neither.
+ */
+export async function resolveOrganizationReach(facts: OrganizationReachFacts): Promise<OrganizationReach> {
+  const organizationId = organizationIdOf(facts.callerOrganizationId);
+  if (organizationId !== null) return { kind: 'own', organizationId };
+  if (await facts.wallStands()) return UNOWNED_ORGANIZATION_REACH;
+  const decision = await facts.deriveOrganization();
+  if (decision.kind === 'derived') return { kind: 'own', organizationId: decision.organizationId };
+  if (decision.kind === 'no-organization-object') return { kind: 'no-organization-object' };
+  return UNOWNED_ORGANIZATION_REACH;
+}
+
+/**
+ * The `organization_id` a reach's rows carry — the value a read filters on and
+ * a write stores: the organization for `own`, `null` (no organization) for
+ * `no-organization-object`, and `undefined` for `unowned`, which reads no row.
+ */
+export function organizationReachRowOwner(reach: OrganizationReach): string | null | undefined {
+  if (reach.kind === 'own') return reach.organizationId;
+  if (reach.kind === 'no-organization-object') return null;
+  return undefined;
+}
+
+/**
+ * Is a row owned by `rowOrganizationId` one the reach may draw on? The one
+ * predicate a query's filter, an in-memory filter and a rung's pick share — the
+ * organization is compared HERE, never trusted to the filter.
+ */
+export function organizationReachAdmits(reach: OrganizationReach, rowOrganizationId: unknown): boolean {
+  const owner = organizationReachRowOwner(reach);
+  return owner !== undefined && organizationIdOf(rowOrganizationId) === owner;
+}
@@ -0,0 +1,48 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0131 D5] The one anchor rule, pinned on its own as a table over every
+ * posture and grant-owner shape. Both readers — the resolver's §6b
+ * (`resolve-authz-context.ts`) and plugin-auth's last-administrator guard —
+ * hand their facts to this rule, so these rows are what both of them answer.
+ * Their own pins (`resolve-authz-context*.test.ts`, `last-admin-guard*.test.ts`)
+ * hold each reader's facts; this table holds the rule.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { organizationAnchorsPlatformStanding } from './platform-standing-anchor.js';
+import * as securityIndex from './index.js';
+
+const DEFAULT_ORG = 'org_default';
+
+describe('[ADR-0131 D5] organizationAnchorsPlatformStanding — the one anchor rule', () => {
+  // [posture walled?, Default Organization, grant's organization, anchors?]
+  const table: Array<[boolean, string | undefined, string | null | undefined, boolean]> = [
+    // single: the Default Organization's grant anchors, nothing else does.
+    [false, DEFAULT_ORG, DEFAULT_ORG, true],
+    [false, DEFAULT_ORG, 'org_acme', false],
+    [false, DEFAULT_ORG, null, false],
+    [false, DEFAULT_ORG, undefined, false],
+    // single, no Default Organization nameable (none, several none `default`,
+    // or no organization object): nothing anchors — an organization-less
+    // grant included, which must not match an absent id.
+    [false, undefined, DEFAULT_ORG, false],
+    [false, undefined, null, false],
+    [false, undefined, undefined, false],
+    // walled (`group` / `isolated`): no grant anchors, the Default
+    // Organization's own included.
+    [true, DEFAULT_ORG, DEFAULT_ORG, false],
+    [true, DEFAULT_ORG, 'org_acme', false],
+    [true, DEFAULT_ORG, null, false],
+    [true, undefined, undefined, false],
+  ];
+
+  it.each(table)('walled=%s · default=%s · grant owner=%s → %s', (walled, defaultOrganizationId, owner, anchors) => {
+    expect(organizationAnchorsPlatformStanding(owner, { walled, defaultOrganizationId })).toBe(anchors);
+  });
+
+  it('is exported from core security — the binding every reader imports', () => {
+    expect(securityIndex.organizationAnchorsPlatformStanding).toBe(organizationAnchorsPlatformStanding);
+  });
+});