@@ -0,0 +1,13 @@
+---
+'@objectstack/spec': patch
+'@objectstack/platform-objects': patch
+---
+
+feat(spec): `ISharingRuleService` declares the optional `declaredRuleNamed` reader that the catalog activation door uses for declared sharing rules
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **The contract member.** `ISharingRuleService` (`@objectstack/spec/contracts`) gains an optional `declaredRuleNamed?(name)` member. It returns `Promise<{ name: string; packageId?: string } | null>`: the rule the application declares under that name, or `null` when nothing servable is declared under it. The answer covers every organization, and it does not depend on whether the activation ledger has the rule switched off. `POST /api/v1/security/_activation/sharing_rule/:name` reads it to confirm the name it is asked to switch. Before this change the door read the method by duck type, and the contract did not mention it.
+- **Optional, so no implementer breaks.** An implementation that serves no declared rules can leave it out. A caller probes for it and refuses fail-closed when it is absent. The activation door still answers `503 SERVICE_UNAVAILABLE` in that case, so the door's behaviour does not change. `@objectstack/plugin-sharing`'s `SharingRuleService` already implements it with a compatible signature.
+- **The ledger's field description.** On `sys_metadata_activation`, the `metadata_type` description now lists every type the ledger holds: `flow`, `action`, `position`, `permission`, `sharing_rule` and `webhook`. It used to stop at `flow`, `permission`, ….
@@ -242,6 +242,80 @@ upgraded from a build that leaked these rows — converges on the next start.
   forces a reconcile on demand.
 </Callout>
 
+### Declared rules are read-only: clone one, then switch it off
+
+A sharing rule comes from one of two sources. The application **declares** it
+(a stack's `sharingRules`), or an organization **authors** its own as a
+`sys_sharing_rule` row. A declared rule is code. It is served from the
+registry and has no row, so it is read-only from every API (ADR-0131 D6,
+regime C):
+
+- `DELETE {basePath}/sharing/rules/:idOrName` on a declared name answers
+  `403 PERMISSION_DENIED`, switched off or not
+  (`SharingRuleService.deleteRule`, `plugin-sharing/src/sharing-rule-service.ts`).
+- `PUT {basePath}/meta/sharing_rule/:name` is refused too. The `/meta` side
+  of this rule is described in
+  [Metadata lifecycle](/docs/concepts/metadata-lifecycle).
+
+**To customise a declared rule, clone it and switch the original off.**
+Create your own rule under a **new name**, with the criteria, recipient and
+access level you want. Then switch the declared rule off through the
+activation door:
+
+```http
+POST {basePath}/security/_activation/sharing_rule/:name
+{ "enabled": false }
+```
+
+The door writes one `sys_metadata_activation` row (`metadata_type:
+'sharing_rule'`, no organization column). The same request then revokes
+every grant that carries the declared rule's name, and `{ "enabled": true }`
+re-derives them (`handleCatalogActivationWrite`,
+`runtime/src/domains/catalog-activation.ts`;
+`bindSharingRuleActivationReconcile` and
+`SharingRuleService.reconcileDeclaredRuleActivation`). The door confirms the
+name through the sharing-rule service's `declaredRuleNamed`, and an unknown
+name answers `404`. A deployment whose sharing-rule service does not provide
+that reader answers `503 SERVICE_UNAVAILABLE`: the door does not write a row
+for a name it cannot confirm is declared.
+
+**A declared rule's name is taken in every organization.** A new row under a
+declared name is refused with `409 RESOURCE_CONFLICT`, and so is an update
+that renames a row onto one. The refusal message names the clone path. This
+applies to `POST {basePath}/sharing/rules`, to Setup's **New** and edit forms,
+and to scripts and imports through the data API
+(`DeclaredSharingRuleNameConflictError` and `bindDeclaredRuleNameGuard`,
+`plugin-sharing/src/sharing-rule-service.ts`). An update that keeps the
+row's name, such as switching your own clone's `active` field, is not
+affected.
+
+**Who may flip the switch.** The ledger row is deployment-level, so the door
+is gated by the activation authority, not by `manage_sharing`:
+
+- the caller must hold `manage_metadata` (`403 PERMISSION_DENIED` otherwise);
+- under a walled tenancy posture (`group` / `isolated`), the caller must also
+  be the **platform operator**, because one row switches the rule off in
+  every organization. An organization administrator is refused with
+  `403 PERMISSION_DENIED`, and the message says to ask the platform operator;
+- under `single`, the `manage_metadata` holder is enough.
+
+These checks are `refuseUngrantedActivationAuthoring` and
+`refuseUngrantedActivationWrite` (`runtime/src/domains/activation-gate.ts`,
+ADR-0126 §5). Rules an organization authors under its own names stay that
+organization's to create, and each is switched by its own `active` field.
+
+**If the reconcile fails.** The grant reconcile runs in an `afterInsert` /
+`afterUpdate` hook on `sys_metadata_activation`, after the ledger row is
+written, and no transaction wraps the two. A reconcile that throws reaches
+the door, which answers the error instead of `200`. The ledger row has
+already been written, though, and it keeps its new value. Some of the rule's
+grants can then disagree with the switch until the next boot. At boot,
+`sweepOrphanedRuleGrants` revokes the grants of a rule that is switched off,
+and the rule backfill re-derives the grants of one that is switched on
+(`SharingServicePlugin`'s `kernel:bootstrapped` handler,
+`plugin-sharing/src/sharing-plugin.ts`). Sending the same switch again re-runs
+the reconcile without waiting for a restart.
+
 ### There is no "share every record" rule
 
 The predicate is **mandatory on every authoring path**, whether you declare
 
@@ -122,7 +122,7 @@ export const SysMetadataActivation = ObjectSchema.create({
       required: true,
       searchable: true,
       maxLength: 100,
-      description: "The artifact's registry type ('flow', 'permission', …).",
+      description: "The artifact's registry type ('flow', 'action', 'position', 'permission', 'sharing_rule', 'webhook').",
       group: 'Identity',
     }),
 
 
@@ -53,6 +53,7 @@
  */
 
 import { AUDIENCE_ANCHOR_POSITIONS, GUEST_POSITION } from '@objectstack/spec/identity';
+import type { ISharingRuleService } from '@objectstack/spec/contracts';
 import {
     METADATA_ACTIVATION_TABLE,
     ObjectStoreMetadataActivationStore,
@@ -111,10 +112,12 @@ const NOUN: Readonly<Record<CatalogActivationType, string>> = {
  * the code, whether or not the ledger has it switched off. A rule an
  * organization authored is a `sys_sharing_rule` row with a switch of its own
  * (`active`) and is never addressed here.
+ *
+ * The reader is the contract's own optional member,
+ * `ISharingRuleService.declaredRuleNamed` (`@objectstack/spec/contracts`): this
+ * door probes for its presence and answers 503 when it is absent.
  */
-interface DeclaredSharingRuleReader {
-    declaredRuleNamed(name: string): Promise<{ name: string; packageId?: string } | null>;
-}
+type DeclaredSharingRuleReader = Required<Pick<ISharingRuleService, 'declaredRuleNamed'>>;
 
 function declaredSharingRuleReaderOf(service: unknown): DeclaredSharingRuleReader | undefined {
     const candidate = service as Partial<DeclaredSharingRuleReader> | null | undefined;
 
@@ -614,6 +614,31 @@ export interface ISharingRuleService {
    * upserts/reconciles only that record's share rows.
    */
   evaluateAllForRecord(object: string, recordId: string, context: ExecutionContext): Promise<SharingRuleEvaluationResult[]>;
+
+  /**
+   * [ADR-0131 D6 regime C] The rule the application DECLARES under `name` (a
+   * stack's `sharingRules`), or `null` when it declares no rule the service
+   * serves under that name. It answers for the declaration itself: in every
+   * organization, and whether or not the activation ledger
+   * (`sys_metadata_activation`, `metadata_type: 'sharing_rule'`) has it
+   * switched off. A rule an organization authored is a `sys_sharing_rule` row
+   * and is never answered here.
+   *
+   * The catalog activation door (`POST /security/_activation/sharing_rule/:name`)
+   * reads it to confirm that the name it is asked to switch is a declaration,
+   * and records `packageId` on the ledger row it writes.
+   *
+   * **Optional, deliberately.** An implementation that serves no declared
+   * rules need not carry it. A caller MUST probe for presence and refuse
+   * fail-closed when it is absent: the activation door answers
+   * `503 SERVICE_UNAVAILABLE` rather than write a ledger row for a name
+   * nothing can confirm is declared.
+   *
+   * @param name - The declared rule's machine name
+   * @returns the declaration's `name`, plus `packageId` when a package ships
+   *   it; `null` when nothing servable is declared under `name`
+   */
+  declaredRuleNamed?(name: string): Promise<{ name: string; packageId?: string } | null>;
 }
 
 // ─────────────────────────────────────────────────────────────────────