@@ -30,8 +30,8 @@
     },
     "managedBy": {
       "status": "dead",
-      "verifiedAt": "2026-10-11",
-      "note": "ADR-0086 D3 — per-record provenance on the metadata-persistence axis (package | platform | user). VERDICT CORRECTED 2026-10-11 (#15204 stage 6b-2): no code reads the AUTHORED key. The cited consumer, bootstrapDeclaredPermissions, stamped `managed_by: 'package'` on every row it wrote and never read `ps.managedBy`, so this row's `live` verdict pointed at a writer of the COLUMN, not a reader of the key; that seeder is now retired (ADR-0131 D3: the boot writes no catalog row). The sys_permission_set.managed_by column is unaffected. Retirement of the authored key is an enforce-or-remove item for the spec seat."
+      "verifiedAt": "2026-10-16",
+      "note": "REMOVED 2026-10-16 — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from stored rows and built artifacts by the protocol-18 conversion permission-set-managed-by-removed. The entry stays because retiredKey keeps the key in the walked shape (the rls.priority precedent); a set's provenance is the package that ships it, decided from that package's artifact and recorded as packageId. History: ADR-0086 D3 per-record provenance (package | platform | user); VERDICT CORRECTED 2026-10-11 (#15204 stage 6b-2): no code read the AUTHORED key — bootstrapDeclaredPermissions stamped the sys_permission_set.managed_by COLUMN and never read ps.managedBy, and that seeder is retired (ADR-0131 D3). The sys_permission_set.managed_by column is a different surface and is unaffected."
     },
     "adminScope": {
       "status": "live",
 
@@ -6874,6 +6874,76 @@ const fieldMalformedScalePrecisionRemoved: MetadataConversion = {
   },
 };
 
+/**
+ * Permission-set `managedBy` removed (protocol 18, #23891 — ADR-0049
+ * enforce-or-remove; the liveness ledger's `dead` verdict of 2026-10-11).
+ *
+ * The key was the AUTHORED per-record provenance of ADR-0086 D3
+ * (`package | platform | user`), and nothing ever read it: the retired
+ * `bootstrapDeclaredPermissions` seeder stamped the `sys_permission_set.managed_by`
+ * COLUMN and never read `ps.managedBy`, and the packaged-set lock decides
+ * provenance from the package's artifact. Setup's form row nevertheless
+ * promised that package upgrades update a `package` set and leave a
+ * `platform` / `user` set alone. The tombstone on `PermissionSetSchema`
+ * refuses it at parse (`PERMISSION_SET_MANAGED_BY_REMOVED` in
+ * `security/permission.zod.ts`). The column is a different surface and is
+ * untouched.
+ *
+ * ## Why a D2 strip
+ *
+ * Setup's form row wrote the key into stored `permission` rows, and a 17.x
+ * build carried whatever an author wrote into its artifact. After the
+ * tombstone the boot door and the metadata save door refuse such a set, and
+ * only the D2 table is replayed at the rehydration seams
+ * (`applyArtifactForwardConversions`, `applyConversionsToStoredItem`), so a
+ * stored row or an installed package's artifact loads only through this
+ * entry. The key leaves whatever it holds: the tombstone refuses every value,
+ * so a strip that kept one would leave a set that cannot load. The strip is
+ * lossless — no grant, owner or upgrade read the value; what an admin believed
+ * it did is the D3 record, the semantic entry `permission-set-managed-by-retired`.
+ * The emitted path names the set, as
+ * `permission-admin-scope-binding-authoring-removed` does.
+ */
+const permissionSetManagedByRemoved: MetadataConversion = {
+  id: 'permission-set-managed-by-removed',
+  toMajor: 18,
+  retiredFromLoadPath: true,
+  retiredAfter: '17.7.0',
+  surface: 'permission.managedBy',
+  summary:
+    "permission-set key 'managedBy' removed (ADR-0049 enforce-or-remove — nothing ever read the authored "
+    + "provenance: a set's provenance is the package that ships it, decided from that package's artifact and "
+    + 'recorded as packageId; the sys_permission_set.managed_by column is unaffected. Delete the key)',
+  apply(stack, emit) {
+    return mapCollection(stack, 'permissions', (ps, path) => {
+      // Name the set, not just its index: the notice is the only record an
+      // upgrading author gets of WHICH set lost the key.
+      const where = typeof ps.name === 'string' ? `${path}(${ps.name})` : path;
+      return stripKeys(ps, ['managedBy'], emit, where);
+    });
+  },
+  fixture: {
+    before: {
+      permissions: [
+        // What Setup's form row wrote into a stored row.
+        { name: 'crm_sales_rep', label: 'Sales Rep', packageId: 'crm', managedBy: 'package' },
+        { name: 'env_reviewer', label: 'Env Reviewer', managedBy: 'user' },
+        // Already canonical: rides through untouched, by reference.
+        { name: 'env_reader', label: 'Env Reader' },
+      ],
+    },
+    after: {
+      permissions: [
+        { name: 'crm_sales_rep', label: 'Sales Rep', packageId: 'crm' },
+        { name: 'env_reviewer', label: 'Env Reviewer' },
+        { name: 'env_reader', label: 'Env Reader' },
+      ],
+    },
+    // One per set carrying the key.
+    expectedNotices: 2,
+  },
+};
+
 /**
  * `record:chatter` / `record:discussion` `position` converges on the
  * renderer's vocabulary (protocol 18, #8762 — maintainer ruling 2026-08-15:
@@ -16836,6 +16906,7 @@ const MAJOR_18_CONVERSIONS: readonly OrderedConversion[] = [
   { conversion: permissionAdminScopeBindingAuthoringRemoved, order: 65 },
   { conversion: permissionAllowRestorePurgeRemoved, order: 16 },
   { conversion: permissionRlsTagsRemoved, order: 42 },
+  { conversion: permissionSetManagedByRemoved, order: 67 },
   { conversion: recordChatterPositionVocabulary, order: 2 },
   { conversion: recordHighlightsFieldIconRemoved, order: 10 },
   { conversion: reportJoinedChartRemoved, order: 38 },
 
@@ -0,0 +1,14 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// #23891 (ADR-0049 enforce-or-remove; the liveness ledger's `dead` verdict of
+// 2026-10-11). `PermissionSet.managedBy` — the authored per-record provenance
+// `package | platform | user` of ADR-0086 D3 — was never read: the retired
+// `bootstrapDeclaredPermissions` seeder stamped the `sys_permission_set.managed_by`
+// COLUMN without reading the key, and the packaged-set lock decides provenance
+// from the package's artifact. Setup's form row and its labels promised upgrade
+// behaviour nothing kept. The set shape is `strictObject`, so the route is the
+// `retiredKey()` tombstone: the key stays in the walked shape as `[RETIRED]`,
+// and authoring it is a tsc error and a parse error carrying the prescription.
+// The column is a different surface and is untouched. D2:
+// `permission-set-managed-by-removed`; D3: `permission-set-managed-by-retired`.
+export const entry = 'security/PermissionSet:managedBy';
@@ -0,0 +1,33 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+// #23891 (ADR-0049 enforce-or-remove) — the D3 entry of the
+// `permission-set-managed-by-removed` family (one D3 entry per retirement
+// family, even when D2 is lossless). Registered key:
+// `security/PermissionSet:managedBy`. The strip changes no access decision and
+// no upgrade; what it leaves is whatever an admin or author believed the value
+// did.
+export const entry: SemanticMigration = {
+  id: 'permission-set-managed-by-retired',
+  // No backticks in `surface` — build-upgrade-guide.ts renders it inside a code
+  // span AND a table cell.
+  surface: 'permissions[].managedBy — the authored per-record provenance (package / platform / user) on a '
+    + 'permission set',
+  replacement: 'Nothing: delete the key. A set\'s provenance is the package that ships it, decided from that '
+    + 'package\'s artifact and recorded as packageId; a set created in this environment carries neither. The '
+    + 'sys_permission_set.managed_by column the platform keeps is a different surface and is unchanged.',
+  reason: 'The D2 conversion `permission-set-managed-by-removed` deletes `managedBy` from every permission set '
+    + 'in author sources, stored permission rows and built artifacts, and the delete is lossless: no seeder, '
+    + 'package upgrade, lock or gate ever read the authored key, so no set changes who owns it, what an '
+    + 'upgrade does to it, or what it grants. The judgment is about what people believed. Setup\'s form offered '
+    + 'Package (upgrade-owned metadata), Platform and User (environment config), and its help text said a '
+    + 'Package set is updated by package upgrades while a Platform or User set is left alone. Neither was '
+    + 'true: an upgrade updates the sets its package ships, whatever the value; a set marked Package that no '
+    + 'package ships was never updated; and a package-shipped set marked Platform or User was never shielded. '
+    + 'Any runbook or customization plan that relied on the value to keep an upgrade off a set needs another '
+    + 'path — for a packaged set, clone it and edit the clone.',
+  acceptanceCriteria: 'No authored or stored permission set carries `managedBy`; the parse refuses the key '
+    + 'with the prescription. Every set\'s grants are unchanged. Every customization that relied on '
+    + 'managedBy to survive a package upgrade lives on a clone of the packaged set, not on the set itself.',
+};
@@ -2592,6 +2592,20 @@ const STEP18_RATIONALE: readonly RationaleFragment[] = [
       + 'at parse rather than rewritten. Its D3 record is the semantic entry '
       + '`permission-rls-tags-retired`.',
   },
+  {
+    id: 'permission-set-managed-by-retired',
+    order: 99,
+    text:
+      'It also retires the permission set\'s authored `managedBy` (ADR-0049 enforce-or-remove; ADR-0086 D3): '
+      + 'the per-record provenance `package` / `platform` / `user`, which nothing ever read — the retired '
+      + 'seeder stamped the `sys_permission_set.managed_by` column without reading the key, and the '
+      + 'packaged-set lock decides provenance from the package\'s artifact — while Setup\'s form promised '
+      + 'that package upgrades update a `package` set and leave the others alone. It is a `retiredKey()` '
+      + 'tombstone on `PermissionSetSchema`, its form row leaves Setup, and the D2 conversion '
+      + '`permission-set-managed-by-removed` strips it from authored sets, stored rows and built artifacts, '
+      + 'retired from the load path. The column is a different surface and is unchanged. Its D3 record is '
+      + 'the semantic entry `permission-set-managed-by-retired`.',
+  },
   {
     id: 'platform-global-object-organization-column-retired',
     order: 89,
 
@@ -34,26 +34,21 @@ export const permissionForm = defineForm({
         { field: 'label', colSpan: 1, helpText: 'Display label for admins' },
         // #19331 — four declared keys had no control, so the only door to any of
         // them was the Source tab's free-text JSON. `description` is persisted on
-        // sys_permission_set and shown in Setup; the other three are the ADR-0086
-        // D3 provenance pair plus the ADR-0090 D5 baseline flag. The help texts
-        // are an admin's words; the decision records stay here:
+        // sys_permission_set and shown in Setup; of the other three, `packageId`
+        // (ADR-0086 D3) and the ADR-0090 D5 baseline flag keep their rows. The
+        // help texts are an admin's words; the decision records stay here:
         //  - `isDefault` (ADR-0090 D5): an app-level set is auto-bound to the
         //    built-in `everyone` position at boot, after the high-privilege check;
         //    a package-level set materializes a `sys_audience_binding_suggestion`
         //    an admin confirms in Setup.
-        //  - `managedBy` (ADR-0086 D3): `package` rows are re-seeded on upgrade;
-        //    `platform` / `user` rows are environment config package seeding
-        //    never touches.
+        //  - `managedBy` left this form with its key (#23891, ADR-0049
+        //    enforce-or-remove): nothing read the authored value, so its labels
+        //    promised upgrade behaviour no code kept.
         //  - `packageId` (ADR-0086 D3): a value that disagrees with the package
         //    the set ships in or is saved into is refused
         //    (`judgePermissionSetOwnerBinding`).
         { field: 'description', type: 'textarea', colSpan: 2, helpText: 'Human-readable description shown in Setup.' },
         { field: 'isDefault', type: 'boolean', colSpan: 1, helpText: 'Gives this set to everyone who signs in, through the built-in everyone position. A set the app itself declares is granted at startup; a set from an installed package becomes a suggestion an admin confirms in Setup. A set with high-privilege permissions is never granted this way. Default false.' },
-        { field: 'managedBy', type: 'select', colSpan: 1, helpText: 'Who owns this set: Package means it ships with a package and package upgrades update it; Platform and User mean it was created in this environment and upgrades leave it alone.', options: [
-          { label: 'Package (upgrade-owned metadata)', value: 'package' },
-          { label: 'Platform (environment config)', value: 'platform' },
-          { label: 'User (environment config)', value: 'user' },
-        ] },
         { field: 'packageId', type: 'text', colSpan: 2, helpText: 'The package that ships this set; a value naming any other package is refused. Leave empty for a set created in this environment.' },
       ],
     },
 
@@ -668,6 +668,18 @@ const ADMIN_SCOPE_AUTHOR_ENVIRONMENT_SETS_REMOVED =
   + '`includeSubtree`, `manageAssignments`, and `assignablePermissionSets`. '
   + 'Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.';
 
+/**
+ * [#23891] The prescription for the retired authored key
+ * `PermissionSetSchema.managedBy` — see the tombstone on that schema.
+ */
+const PERMISSION_SET_MANAGED_BY_REMOVED =
+  '`permission.managedBy` was removed in @objectstack/spec 18 (ADR-0049 enforce-or-remove, ADR-0086 D3) — '
+  + 'nothing ever read the authored key: no seeder, package upgrade or lock consulted it, so `package` never made '
+  + 'a set upgrade-owned and `platform` or `user` never shielded one from an upgrade. Delete the key; a set\'s '
+  + 'provenance is the package that ships it, decided from that package\'s artifact and recorded as `packageId`, '
+  + 'and a set created in this environment carries neither. '
+  + 'Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.';
+
 /**
  * [ADR-0090 D12] Delegated-administration scope.
  *
@@ -885,8 +897,7 @@ export const PermissionSetSchema = lazySchema(() => strictObject(
   /**
    * [ADR-0086 D3] Owning package for a package-shipped permission set
    * (absent ⇒ environment-authored). Persisted on `sys_permission_set`
-   * records together with the per-record `managedBy` provenance, this is
-   * what makes the metadata↔config boundary machine-checkable and package
+   * records, this is what makes the metadata↔config boundary machine-checkable and package
    * uninstall well-defined (remove the package's own sets).
    *
    * The owner is the package that ships the set or that it is saved into:
@@ -903,16 +914,19 @@ export const PermissionSetSchema = lazySchema(() => strictObject(
   packageId: z.string().optional().describe('[ADR-0086 D3] Owning package id for a package-shipped set (absent = env-authored); a value that disagrees with the package that ships the set, or that it is saved into, is refused by the stack schema (defineStack, os validate, os build), the package registration, and the metadata save, restore and publish doors'),
 
   /**
-   * [ADR-0086 D3] Per-record provenance on the existing
-   * metadata-persistence axis (`package | platform | user`):
-   * `package` = versioned package metadata (seeded by
-   * `bootstrapDeclaredPermissions`, re-seeded on upgrade, read-mostly for
-   * admins per ADR-0010); `platform`/`user` = environment config, live-edited
-   * and never touched by package seeding. Distinct from the `sys_permission_set`
-   * TABLE's object-affordance `managedBy: 'config'`, which stays.
+   * REMOVED (#23891, ADR-0049 enforce-or-remove): the authored per-record
+   * provenance `package | platform | user` (ADR-0086 D3). No code ever read
+   * the AUTHORED key — the retired `bootstrapDeclaredPermissions` seeder
+   * stamped the `sys_permission_set.managed_by` COLUMN and never read
+   * `ps.managedBy`, and the packaged-set lock decides provenance from the
+   * package's artifact — so the key promised upgrade behaviour nothing kept.
+   * The column is a different surface and is untouched, as is the
+   * `sys_permission_set` TABLE's object-affordance `managedBy: 'config'`.
+   * The ADR-0087 D2 conversion `permission-set-managed-by-removed` strips the
+   * key from stored rows and built artifacts; the D3 record is the semantic
+   * entry `permission-set-managed-by-retired`.
    */
-  managedBy: z.enum(['package', 'platform', 'user']).optional()
-    .describe('[ADR-0086 D3] Record provenance: package (upgrade-owned metadata) vs platform/user (env config)'),
+  managedBy: retiredKey(PERMISSION_SET_MANAGED_BY_REMOVED),
 
   /**
    * [ADR-0090 D5] Marks this set as the app's baseline for the built-in
 
@@ -86,7 +86,7 @@ import {
 } from '../automation/builtin-node-config.zod';
 import { NotifyConfigSchema } from '../automation/io-node-config.zod';
 import { ScriptConfigSchema, SubflowConfigSchema } from '../automation/schemaless-node-config.zod';
-import { AdminScopeSchema } from '../security/permission.zod';
+import { AdminScopeSchema, PermissionSetSchema } from '../security/permission.zod';
 import { SharingLevel } from '../security/sharing.zod';
 import { DatasourceSchema } from '../data/datasource.zod';
 import { PageComponentSchema, PageSchema } from '../ui/page.zod';
@@ -247,6 +247,7 @@ const JOIN: Readonly<Record<string, readonly Renderer[]>> = {
     tombstone(AdminScopeSchema, 'permission.adminScope', 'manageBindings'),
     tombstone(AdminScopeSchema, 'permission.adminScope', 'authorEnvironmentSets'),
   ],
+  'permission-set-managed-by-removed': [tombstone(PermissionSetSchema, 'permission', 'managedBy')],
   'manifest-permissions-string-list-removed': [
     refusal('manifest.permissions as a list of strings', () => ManifestPermissionsSchema.safeParse(['system.user.read'])),
   ],