@@ -0,0 +1,17 @@
+---
+'@objectstack/verify': patch
+---
+
+fix(verify): the RLS probe persona is provisioned through the registry — `provisionRlsProbePersona` no longer mints a `sys_permission_set` row
+
+Clause-②: no
+
+`provisionRlsProbePersona` used to find-or-create a `sys_permission_set` row named `verify_rls_probe` and grant it. Under ADR-0131 D3/D4 a permission set's one home is the registry: the authorization resolver reads the grant's `permission_set` name and takes the definition from the security catalog, never from a row. So a row this function minted was a copy of a definition nothing read.
+
+It now:
+
+- asks the security catalog (`securityCatalogReaderOf`, the read the resolver itself uses) whether `verify_rls_probe` is registered. `rlsProbeSecurity(config)` registers it at boot;
+- reads the id of the row the boot already seeded for that registered set, because `sys_user_permission_set.permission_set_id` is still a required column;
+- writes the one grant, carrying both columns.
+
+It throws, writing nothing, when the catalog does not serve the probe set or the boot seeded no row for it. `objectstack verify --rls` reports either as a degraded probe persona and fails the run, as it already does for any provisioning failure. Fix for a caller that hits it: boot the stack with `rlsProbeSecurity(config)` as the `security` option of `bootStack`.
@@ -1,21 +1,33 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * [ADR-0131 D4] The RLS probe persona's grant writes BOTH columns of
- * `sys_user_permission_set` — `permission_set_id` and `permission_set` — and
- * the two agree: the name is the `name` of the catalog row the id points at.
+ * [ADR-0131 D3/D4] The RLS probe persona is provisioned through the REGISTRY:
+ * `provisionRlsProbePersona` asks the security catalog whether the probe set is
+ * registered, writes ONE grant naming it, and mints no `sys_permission_set`
+ * row.
  *
- * Driven through the SHIPPED writer, `provisionRlsProbePersona`, over a stack
- * double whose engine stores exactly the payloads it is handed: no platform
- * hook stands behind the writer here, so what lands is the writer's own
- * payload — a writer that drops the name turns this red even though, booted
- * for real, the platform would stamp the column behind it. Both of the
- * writer's branches are pinned: the probe set found by name, and the probe
- * set created because none existed.
+ * The grant still writes BOTH columns of `sys_user_permission_set` —
+ * `permission_set_id` (still a required column) and `permission_set` — and the
+ * two agree: the id is the boot-seeded catalog row's, READ by name, and the name
+ * is that row's `name`.
+ *
+ * Driven through the SHIPPED writer over a stack double whose engine stores
+ * exactly the payloads it is handed and whose catalog is bound with core's own
+ * `bindSecurityCatalogReader` — the binding `securityCatalogReaderOf` reads in
+ * production. No platform hook stands behind the writer here, so what lands is
+ * the writer's own payload. Every refusal is pinned to write NOTHING: a writer
+ * that falls back to minting the set row, or that grants a set the catalog does
+ * not serve, turns this red.
  */
 
 import { describe, expect, it } from 'vitest';
 
+import {
+  bindSecurityCatalogReader,
+  type SecurityCatalogEntry,
+  type SecurityCatalogReader,
+} from '@objectstack/core';
+
 import { provisionRlsProbePersona, RLS_PROBE_EMAIL } from './rls.js';
 
 const PROBE_SET = 'verify_rls_probe';
@@ -33,52 +45,92 @@ function matches(row: Record<string, unknown>, where: Record<string, unknown>):
   return true;
 }
 
-function stackDouble(seed: { sys_permission_set?: any[] } = {}) {
+/** A catalog that serves exactly `names` as permission sets. */
+function catalogServing(names: string[]): SecurityCatalogReader {
+  const entry = (name: string): SecurityCatalogEntry => ({
+    type: 'permission',
+    name,
+    definition: { name },
+    source: 'registry',
+  });
+  return {
+    async resolve(type, name) {
+      return type === 'permission' && names.includes(name) ? entry(name) : undefined;
+    },
+    async list(type) {
+      return type === 'permission' ? names.map(entry) : [];
+    },
+  };
+}
+
+function stackDouble(seed: { sys_permission_set?: any[]; catalog?: SecurityCatalogReader } = {}) {
   const tables: Record<string, any[]> = {
     sys_user: [{ id: 'usr_probe', email: RLS_PROBE_EMAIL }],
     sys_permission_set: seed.sys_permission_set ?? [],
     sys_user_permission_set: [],
   };
+  const inserted: string[] = [];
   const ql = {
     async find(object: string, query: any) {
       const where = query?.where ?? {};
       const rows = (tables[object] ?? []).filter((r) => matches(r, where));
       return typeof query?.limit === 'number' ? rows.slice(0, query.limit) : rows;
     },
     async insert(object: string, data: any) {
+      inserted.push(object);
       (tables[object] ??= []).push({ ...data });
       return { ...data };
     },
   };
+  if (seed.catalog) bindSecurityCatalogReader(ql, seed.catalog);
   const stack = {
     async signUp() { return 'tok_signup'; },
     async signIn() { return 'tok_signin'; },
     kernel: { async getServiceAsync(name: string) { return name === 'objectql' ? ql : undefined; } },
   };
-  return { stack: stack as any, tables };
+  return { stack: stack as any, tables, inserted };
 }
 
-function expectBothColumnsAgree(tables: Record<string, any[]>): void {
-  const grants = tables.sys_user_permission_set;
-  expect(grants).toHaveLength(1);
-  expect(grants[0]).toMatchObject({ user_id: 'usr_probe', permission_set: PROBE_SET });
-  const setRow = tables.sys_permission_set.find((r) => r.id === grants[0].permission_set_id);
-  expect(setRow?.name).toBe(grants[0].permission_set);
-}
+const SEEDED_ROW = { id: 'ps_seeded_probe', name: PROBE_SET };
 
-describe('[ADR-0131 D4] the verify RLS persona grant writes both columns, and they agree', () => {
-  it('when the probe set row already exists (found by name)', async () => {
-    const { stack, tables } = stackDouble({ sys_permission_set: [{ id: 'ps_seeded_probe', name: PROBE_SET }] });
+describe('[ADR-0131 D3/D4] the verify RLS persona is provisioned through the registry', () => {
+  it('grants the registered set by name, with the boot-seeded row id, and mints no set row', async () => {
+    const { stack, tables, inserted } = stackDouble({
+      sys_permission_set: [{ ...SEEDED_ROW }],
+      catalog: catalogServing([PROBE_SET]),
+    });
     const persona = await provisionRlsProbePersona(stack, { objects: [] });
+
     expect(persona.permissionSet).toBe(PROBE_SET);
-    expect(tables.sys_user_permission_set[0]?.permission_set_id).toBe('ps_seeded_probe');
-    expectBothColumnsAgree(tables);
+    expect(inserted).toEqual(['sys_user_permission_set']);
+    expect(tables.sys_permission_set).toEqual([SEEDED_ROW]);
+    const grants = tables.sys_user_permission_set;
+    expect(grants).toHaveLength(1);
+    expect(grants[0]).toMatchObject({
+      user_id: 'usr_probe',
+      permission_set: PROBE_SET,
+      permission_set_id: SEEDED_ROW.id,
+    });
+  });
+
+  it('refuses, writing nothing, when the boot seeded no row for the registered set', async () => {
+    const { stack, inserted } = stackDouble({ catalog: catalogServing([PROBE_SET]) });
+    await expect(provisionRlsProbePersona(stack, { objects: [] })).rejects.toThrow(PROBE_SET);
+    expect(inserted).toEqual([]);
+  });
+
+  it('refuses, writing nothing, when the catalog does not serve the set — a row alone is not the probe set', async () => {
+    const { stack, inserted } = stackDouble({
+      sys_permission_set: [{ ...SEEDED_ROW }],
+      catalog: catalogServing(['admin_full_access']),
+    });
+    await expect(provisionRlsProbePersona(stack, { objects: [] })).rejects.toThrow(PROBE_SET);
+    expect(inserted).toEqual([]);
   });
 
-  it('when the probe set row is created by the writer', async () => {
-    const { stack, tables } = stackDouble();
-    await provisionRlsProbePersona(stack, { objects: [] });
-    expect(tables.sys_permission_set).toHaveLength(1);
-    expectBothColumnsAgree(tables);
+  it('refuses, writing nothing, when no catalog is bound to the engine at all', async () => {
+    const { stack, inserted } = stackDouble({ sys_permission_set: [{ ...SEEDED_ROW }] });
+    await expect(provisionRlsProbePersona(stack, { objects: [] })).rejects.toThrow(PROBE_SET);
+    expect(inserted).toEqual([]);
   });
 });
@@ -79,6 +79,7 @@
 // never be read as N× the reach.
 
 
+import { securityCatalogReaderOf } from '@objectstack/core';
 import { SecurityPlugin, securityDefaultPermissionSets, appSecurityPluginOptions } from '@objectstack/plugin-security';
 import { AUDIENCE_ANCHOR_POSITIONS } from '@objectstack/spec/identity';
 import type { PermissionSet } from '@objectstack/spec/security';
@@ -299,9 +300,9 @@ export interface RlsProbePersona {
   token: string;
   email: string;
   userId: string;
-  /** Name of the minted `sys_permission_set` row. */
+  /** Name of the registered probe set the grant holds. */
   permissionSet: string;
-  /** Objects the minted set grants read+edit on. */
+  /** Objects the probe set grants read+edit on. */
   grantedObjects: number;
 }
 
@@ -401,15 +402,20 @@ export function rlsProbeSecurity(config: any): SecurityPlugin {
  * select, nothing else).
  *
  * Requires the stack to have been booted with {@link rlsProbeSecurity}, which is
- * what puts the set's `rowLevelSecurity` on the resolution path. This function
- * only writes the two RBAC link rows, and it writes them through the kernel's
- * ObjectQL engine under a system context, the same way `bootstrapPlatformAdmin`
- * seeds them: the persona is test SETUP, not the surface under test, so routing
- * it through the data door would make the proof depend on whether this
- * deployment happens to let an admin POST `sys_permission_set` — a second thing
- * that can fail for reasons unrelated to RLS.
+ * what REGISTERS the set (ADR-0131 D3: the registry is a permission set's one
+ * home) and so puts its `rowLevelSecurity` on the resolution path. This function
+ * mints no permission set: it asks the security catalog — the read the
+ * authorization resolver itself uses — whether the probe set is registered, and
+ * writes one RBAC row, the grant, naming that set. It writes through the
+ * kernel's ObjectQL engine under a system context, the same way
+ * `bootstrapPlatformAdmin` seeds grants: the persona is test SETUP, not the
+ * surface under test, so routing it through the data door would make the proof
+ * depend on whether this deployment happens to let an admin POST a grant — a
+ * second thing that can fail for reasons unrelated to RLS.
  *
- * Throws when the stack has no ObjectQL engine or the user cannot be resolved.
+ * Throws when the stack has no ObjectQL engine, the user cannot be resolved, the
+ * catalog does not serve the probe set, or the boot left no catalog row whose id
+ * the grant's still-required `permission_set_id` column can take.
  * Callers must NOT swallow that into a weaker persona silently: run degraded and
  * say so (`RlsProbeDescriptor.degraded`), or fail.
  */
@@ -441,38 +447,37 @@ export async function provisionRlsProbePersona(
 
   const probeSet = rlsProbePermissionSet(config);
 
-  // [ADR-0131 D4] The grant holds its set BY NAME: `resolveUserAuthzGrants`
-  // reads the grant's `permission_set` column and takes the definition from
-  // the registry (`rlsProbeSecurity`), the copy that carries the narrowing. It
-  // reads neither `permission_set_id` nor this row. The row is read only for
-  // its id, because `permission_set_id` is still a required column and the
-  // platform derives the grant's name from it, refusing a disagreement.
-  // Find-or-create so it works whether or not this boot already seeded the
-  // registered set into the table.
-  const existing = rowsOf(
+  // [ADR-0131 D3/D4] The probe set's one home is the registry: `rlsProbeSecurity`
+  // registers it at boot, and the authorization resolver takes its definition —
+  // narrowing included — from the security catalog by the grant's NAME. Ask
+  // that same catalog, so a stack booted without the probe set fails here,
+  // loudly, instead of granting a name that resolves to nothing.
+  const catalog = securityCatalogReaderOf(ql);
+  const registered = catalog ? await catalog.resolve('permission', RLS_PROBE_PERMISSION_SET) : undefined;
+  if (!registered) {
+    throw new Error(
+      `verify: cannot provision the RLS probe persona — the security catalog does not serve the ` +
+        `'${RLS_PROBE_PERMISSION_SET}' permission set. Boot the stack with \`rlsProbeSecurity(config)\`, ` +
+        'which registers it; a grant naming an unregistered set confers nothing.',
+    );
+  }
+
+  // `sys_user_permission_set.permission_set_id` is still a required column, and
+  // the platform derives the grant's name from it and refuses a disagreement.
+  // The boot seeds a catalog row for every set the security plugin registers
+  // (`bootstrapPlatformAdmin`), the probe set included, so its id is READ here —
+  // never minted: no resolver reads that row, and a row this function wrote
+  // would be one more copy of a definition whose home is the registry.
+  const seeded = rowsOf(
     await ql.find('sys_permission_set', { where: { name: RLS_PROBE_PERMISSION_SET }, limit: 1 }, sysCtx),
   );
-  let permissionSetId = existing[0]?.id;
+  const permissionSetId = seeded[0]?.id;
   if (!permissionSetId) {
-    permissionSetId = genId('ps');
-    await ql.insert(
-      'sys_permission_set',
-      {
-        id: permissionSetId,
-        name: RLS_PROBE_PERMISSION_SET,
-        label: probeSet.label,
-        description:
-          'Ephemeral persona minted by `objectstack verify --rls`: object-level read+edit on every ' +
-          'declared object plus an owner-scoped SELECT narrowing, so a by-id refusal is attributable ' +
-          'to the record gate rather than the object gate.',
-        object_permissions: JSON.stringify(probeSet.objects ?? {}),
-        field_permissions: '{}',
-        system_permissions: '[]',
-        row_level_security: JSON.stringify(probeSet.rowLevelSecurity ?? []),
-        tab_permissions: '{}',
-        active: true,
-      },
-      sysCtx,
+    throw new Error(
+      `verify: cannot provision the RLS probe persona — the boot seeded no sys_permission_set row ` +
+        `named '${RLS_PROBE_PERMISSION_SET}', so the grant has no id for its required ` +
+        'permission_set_id column. The security plugin seeds one for every registered set at ' +
+        "kernel:ready; read its '[security] platform bootstrap' log lines for why it did not.",
     );
   }
   await ql.insert(
@@ -481,7 +486,7 @@ export async function provisionRlsProbePersona(
       id: genId('ups'),
       user_id: userId,
       permission_set_id: permissionSetId,
-      // [ADR-0131 D4] Both columns, agreeing: found or created under exactly
+      // [ADR-0131 D4] Both columns, agreeing: the row was found under exactly
       // this name just above.
       permission_set: RLS_PROBE_PERMISSION_SET,
       organization_id: null,