@@ -12,8 +12,8 @@ Metadata-protocol: none
 **BREAKING** read narrowing (ADR-0131 D8/D9, follow-up to the organization-less rung fix). It changes which organization a host's settings reads take, not what a metadata author can write, so it ships as `patch` with this banner.
 
 - FROM: a host that bound its own engine (`new SettingsService({ engine })` or `bindEngine(engine)`) and stated no `organization` source read and wrote, for a caller that names no organization, as a composition with no organization object: its rows with no organization answered, and its writes stored none.
-- TO: such a host's service asks D9 itself, through the engine it holds (`resolveGuestOrganization`, the call the plugin's source makes). Under `single` with one organization it reads and writes as that organization; at none or several it has no tenant or user rung. An engine that exposes no `registry` cannot say the organization object is absent, so D9 asks `sys_organization`: an engine that does not know that object refuses the read and the settings call throws `AuthzStoreUnavailableError`. No engine at all (the in-memory store) and `SettingsServicePlugin` are unchanged.
+- TO: such a host's service asks D9 itself, through the engine it holds (`resolveGuestOrganization`, the call the plugin's source makes). Under `single` with one organization it reads and writes as that organization; at none or several it has no tenant or user rung. An engine that exposes no `registry` cannot say the organization object is absent, so D9 asks `sys_organization`. Over a store with no such object, a tenant-rung read or write by a caller naming none is then refused as organization-less (reads answer from the global rung or the default, tenant writes are refused with `SETTINGS_VALIDATION`), or raises `AuthzStoreUnavailableError` naming `sys_organization` where the engine does not know that object. No engine at all (the in-memory store), a stated source, an engine whose `registry.getObject` answers, and `SettingsServicePlugin` (`os serve`, `os dev`) are unchanged.
 
-**Who is affected.** Only a host that binds its own engine on a composition with no organization object and states no source: a control-plane mock or an embedded runtime. A deployment booted through `SettingsServicePlugin` is not.
+**Who is affected.** Only a host that binds its own engine and states no source: a control-plane mock or an embedded runtime. On a composition with an organization object it now reads and writes the derived organization's rows, and its rows with no organization stop answering. On one without, it meets the refusal above. A deployment booted through `SettingsServicePlugin` is not affected.
 
 **The fix.** State the composition at the bind site: `service.bindEngine(engine, audit, { organization: async () => ({ kind: 'no-organization-object' }) })` (a host that hands its engine to the constructor binds it this way instead), or hand over an engine whose `registry.getObject` can answer.
@@ -80,9 +80,9 @@ export {
 // its shape; the action value and target-object constants travel with it for the
 // same reason a pin must not spell them by hand. [#25249] Such a host with no
 // organization object declares it (`bindEngine`'s `organization` extra answering
-// `no-organization-object`); left out, the service asks `sys_organization` through
-// that engine, so its rows with no organization stop answering, or, where the engine
-// does not know that object, the read throws `AuthzStoreUnavailableError`.
+// `no-organization-object`); left out, a tenant-rung read or write by a caller naming
+// none is refused as organization-less, or raises `AuthzStoreUnavailableError`
+// naming `sys_organization`.
 export {
   buildConfigChangeAuditSink,
   CONFIG_CHANGE_ACTION,
 
@@ -45,6 +45,7 @@ const MANIFEST = {
   specifiers: [
     { key: 'brand', type: 'text', label: 'Brand', scope: 'tenant', default: 'none' },
     { key: 'legacy', type: 'text', label: 'Legacy', scope: 'tenant', default: 'none' },
+    { key: 'theme', type: 'text', label: 'Theme', scope: 'user', default: 'none' },
   ],
 } as any;
 
@@ -252,6 +253,8 @@ async function bootSelfBound(organizations: string[] | null, source?: typeof LEA
   for (const id of organizations ?? []) {
     await engine.insert('sys_organization', { id, name: id, slug: id }, SYS);
   }
+  // The user a user-rung write names, as the store already holds it.
+  memory.rowsOf('sys_user').set('usr_1', { id: 'usr_1', name: 'Ada', email: 'ada@example.test' });
   const service = new SettingsService({ env: {} });
   service.registerManifest(MANIFEST);
   service.bindEngine(wrapEngineAsSettingsEngine(engine as any), undefined, source ? { organization: source } : undefined);
@@ -295,15 +298,25 @@ function selfBoundDouble(source?: typeof LEAN_ORGANIZATION_SOURCE) {
 }
 
 describe('[#25249] a host that binds its own engine and states no organization source', () => {
-  it('(a) one organization: it reads and writes as that organization, through an adapter with no registry', async () => {
+  it('(a) one organization: the tenant and user rungs read and write as that organization, through an adapter with no registry', async () => {
     const b = await bootSelfBound([ORG]);
     await b.seed({ key: 'brand', value: 'Acme', organization_id: ORG });
     await b.seed({ key: 'legacy', value: 'Unowned', organization_id: null });
+    await b.seed({ key: 'theme', value: 'Unowned dark', scope: 'user', user_id: 'usr_1', organization_id: null });
 
     expect((await b.service.get(NS, 'brand', {})).value).toBe('Acme');
     expect((await b.service.get(NS, 'legacy', {})).source).toBe('default');
+    expect((await b.service.get(NS, 'theme', { userId: 'usr_1' })).source).toBe('default');
     await b.service.set(NS, 'brand', 'Acme two', {});
-    expect(b.rows()).toEqual([['brand', ORG, 'Acme two'], ['legacy', null, 'Unowned']]);
+    await b.service.set(NS, 'theme', 'Light', { userId: 'usr_1' });
+    await b.service.set(NS, 'theme', 'Light two', { userId: 'usr_1' });
+
+    expect((await b.service.get(NS, 'brand', { tenantId: ORG })).value).toBe('Acme two');
+    expect((await b.service.get(NS, 'theme', { userId: 'usr_1' })).value).toBe('Light two');
+    expect((await b.service.get(NS, 'theme', { userId: 'usr_1', tenantId: ORG })).value).toBe('Light two');
+    expect(b.rows()).toEqual([
+      ['brand', ORG, 'Acme two'], ['legacy', null, 'Unowned'], ['theme', null, 'Unowned dark'], ['theme', ORG, 'Light two'],
+    ]);
   });
 
   it('(b) no organization object, real engine: the probe is refused as a failed read, loudly', async () => {