os migrate organization-ownership: shipped permission sets stored with managed_by NULL (seeded before the column was written) are refused as authored; extend #23873's ruling A to NULL #24089

Filing-gate category ① (a defect with a measured reach) and ③ (a maintainer direct order). Verbatim, 2026-10-16, the option 「框架沿用裁决A (推荐)」, which reads: "给 objectstack 立 p0 卡：沿用 #23873 已经裁决的 A（按平台镜像接管，平台定义生效，旧行改写验证后删除），把识别条件从「只认 admin」扩大到「admin 或空值」". Standing order: 「相关任务都提到最高优先级」.

Reader: triage routes it; expected route domain:cli (organization-ownership inventory/apply). The executing lane seat claims it. Downstream, cloud's next framework pin carries it (objectstack-ai/cloud#2868).

Dedupe (gh api search/issues total_count, closed included):

• LEGACY_SHIPPED_SET_SEEDS: 1 hit, feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906, the change this extends (closed).
• shipped permission set managed_by null ceremony: 10 hits. The nearest are fix(cli): os migrate organization-ownership plans a v17 database still holding the retired sys_scim_provider, as fate 4 (ADR-0131 D10) #23874, feat(cli): os migrate organization-ownership reports the declared sharing-rule mirrors as advisory while this release's boot still seeds them #23988 and feat(plugin-security)!: no seeder or materializer writes a sys_permission_set row; the boot seeds no row for a declared set (#15204 stage 6b-2) #22900 (closed) and the epics refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204/feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196. None covers a NULL managed_by.
• legacy shipped-set seeds null: 14 hits, nothing on point.
• The ruling this follows: [Decision] The ownership ceremony classes the 8 shipped permission sets an old seeder stored as managed_by='admin' as authored and says to rename them: mirror them, keep blocking with the true remedy, or ask per row? #23873 (closed, ruled A).

What happens

#23906 (cdf37771d0) adopts the shipped permission sets that a pre-2026-08-15 seeder stored as managed_by = 'admin'. Its LEGACY_SHIPPED_SET_SEEDS matches managed_by = 'admin' and a name in SHIPPED_PERMISSION_SET_NAMES.

Older installs carry the same shipped rows with managed_by NULL, created before the column was written at all. Measured on cloud staging: rows created 2026-06-23, re-seeded 2026-10-10, created_by NULL. The inventory's AUTHORED predicate (managed_by notIn [package, platform, system]) treats them as Setup-authored. When the stored body differs from the shipped definition, authored-conversion refuses:

The authored permission admin_full_access differs from the definition the catalog already holds under that name. The catalog's definition stays; rename the authored row (and the grants that name it), then re-run.

This is the wrong remedy, as #23873 established: the admins' grants hang on these names.

Reach, measured on cloud staging with read-only reads of each tenant ledger and sys_permission_set, cloud#2868, 2026-10-16:

• os-58ptra and os-75621z are refused at authored-conversion on 4 NULL rows each: admin_full_access, organization_admin, member_default, viewer_readonly.
• Three more environments hold NULL shipped rows (demo 7, os-0zpadn 4, os-05ayzz 4). They are behind another blocker today and are expected to reach the same refusal.
• Production's oldest environments are expected to hold the same shape. Not measured yet.
• admin-stored rows (os-6zmft7, 7 rows) are covered by feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906 and are not part of this card.

Wanted

• Extend ruling A to NULL. Treat a row whose name is in SHIPPED_PERMISSION_SET_NAMES and whose managed_by is 'admin' or NULL as a legacy shipped-set seed:
  • re-owned as platform;
  • its grants named;
  • deleted as a mirror;
  • the shipped definition stands;
  • the same per-row diff warnings as feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906.
• Category label and citation. The category label and citation name both provenances.
• Precedence. A row with any other non-seeded value stays authored, exactly as today.

Acceptance:

• On a v17-shaped database with NULL-managed_by shipped sets whose bodies differ, --apply adopts them (legacySeedsAdopted counts them), names their grants, and the marker verifies.
• The existing feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906 tests keep passing.
• A new test pins the NULL case.
• An ablation that drops the NULL arm turns the refusal back on.
• A non-shipped name with NULL managed_by is still converted as authored.

Related: #23873, #23906, #23874, objectstack-ai/cloud#2868, objectstack-ai/cloud#2899.