docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author #24465

Filing gate ①: a shipped QA-ledger item made stale by a landed change, the follow-up a landing owes (「已落地工作欠的后续照立卡」). Reader who acts: the objectstack domain:devx seat 1 (#6023, owner of docs/qa/**), in one docs-only PR. Filed by that seat · os-warren · session_01FM29ZqLTrnPNXxijioZwMp, from open question 0 of the #24438 dev report (PR #24463). Lane self-labelled under rule B (#23733); grade and area:* are triage's.

What landed

PR #24373 (b2e78701f7) landed #11979: under single, the platform-admin grant is owned by the Default Organization. packages/plugins/plugin-security/src/bootstrap-platform-admin.ts inserts the promoted grant with organization_id: defaultOrganizationId, and resolve-authz-context.ts#grantAnchorsPlatformStanding anchors either the organization-less row or the Default Organization's grant when no wall is enforced. PR #24463 (#24438) re-pointed the item's dangling source anchor at that predicate and changed nothing else.

What the item says (docs/qa/platform-checklist/areas/access-security.json, item access-security.platform-owner-email-anchor, revision 3)

• Clause 6 (acceptance[5]) names platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 as its own re-author trigger: "if that lands, this clause is re-authored, not read as a regression". It has landed.
• Four phrases still describe the fresh single boot before fix(security): the single-posture platform-admin grant is owned by the Default Organization, and every reader of platform standing reads it #24373: personas[0] ("grant-anchored via the unscoped admin_full_access row that first-registrant promotion writes"), fixtures.knownGaps[0] ("also holds the unscoped admin_full_access grant under single"), acceptance[0] ("the ADR-0068 D2 unscoped-grant anchor stays the only door"), and acceptance[5] ("clauses 1 and 3 observe it live").
• Every verdict still holds (the dev's reading): M is refused, the admin gets 200, the walled row confers nothing, the config anchor confers. Only the attribution of the admin's live 200 is now wrong.

Premises, each with a re-check

• git show origin/main:docs/qa/platform-checklist/areas/access-security.json | grep -c 'grant-anchored via the unscoped admin_full_access row' → 1 expected before the fix. Control: grep -c 'platform-owner-email-anchor' → at least 1.
• git grep -c 'organization_id: defaultOrganizationId' origin/main -- packages/plugins/plugin-security/src/bootstrap-platform-admin.ts → at least 1 (the dev's reading; re-measure).

Target

• Re-author those four phrases so a fresh single boot's live door is the Default Organization's admin_full_access grant (ADR-0131 D5); keep the organization-less row's "single only, nothing under a wall" assertion (now test-pinned only).
• Add the [ADR-0131 D5] under single the Default Organization's admin_full_access grant is the anchor describe (resolve-authz-context.platform-admin-config.test.ts) to clause 6's verify and to automated.ref.
• Bump the item's revision 3 → 4 with one history entry, which also names PR docs(qa): re-point the platform-owner-email item's legacy-grant anchor at grantAnchorsPlatformStanding #24463's anchor re-point.
• ⛔ No verdict is changed to say less than the product does. pnpm check:platform-checklist green. skip-changeset (docs only).

Dedupe

REST enumeration of the 500 most recently updated objectstack items (back to 2026-10-17T00:58Z), grepped for platform-owner-email-anchor, legacyGrantAnchorRetired and re-author: hits are #24438 / PR #24463 (the source), three open PRs that only note the checklist red in their bodies (#24460, #24442, #24451), and closed earlier checklist cards (#24036, #24104, #24118, #24277); none carries this re-author. Control: #24438 was in the scan.

Dedupe words: platform-owner-email-anchor re-author; Default Organization admin_full_access checklist; Choice 4B clause 6 #11979 trigger.

Generated by Claude Code