feat(plugin-security): walled bootstrap stops minting the platform-admin grant row; platformAdmin audit service; legacy-grant deprecation pointer (L4) (#13514)

* feat(plugin-security): walled bootstrap stops minting the platform-admin grant row; platformAdmin audit service; legacy-grant deprecation pointer

Under walled postures bootstrapPlatformAdmin writes no sys_user_permission_set
row any more - standing is config-derived at the one derivation site
(resolve-authz-context 6b-config). single keeps first-user promotion and its
grant row byte-for-byte (Choice 4A). The walled branch now reports: a per-boot
standing log (one implementation with the new read-only platformAdmin service:
configuredEmails() + standing()), and a once-per-process deprecation pointer
for a detected legacy org-less grant, through the same latch the derivation-
site reporter uses, naming OS_PLATFORM_OWNER_EMAIL and the holder.

shouldReplayBootstrapFor narrows with the retired elevation: sys_user
insert/create under non-walled postures only - the #11343 update arm existed
solely to re-attempt the walled elevation after the verifying write, and under
walled postures no sys_user write can change the bootstrap's answer at all.

The local isEmailVerified alias is gone; the shared predicates
(isEmailVerifiedUserRow, normalizePlatformAdminEmail) are consumed directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

* docs(permissions): re-anchor system-context census citations after the bootstrap rewrite shifted security-plugin.ts line numbers

Pure line rot: the #11974 edit moved seven isSystem read sites (and one
NON_READ_ANCHORS citation target) by +19/+20 lines; every re-anchored line
is content-identical to its merge-base counterpart (measured pair by pair
before editing). check-system-context-census --fix refused mechanically
(#13490's false-refusal shape: it counts shifted NON_READ_ANCHORS
citations as read anchors), so the eight citations are re-anchored by hand
to proven-identical lines. Census verdict line is back byte-identical to
the merge base's: 109 sites, 145 anchors, 27 declared non-read.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-steve

.changeset/walled-bootstrap-stops-granting.md

@@ -0,0 +1,46 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+feat(plugin-security): walled bootstrap stops minting the platform-admin grant row; read-only `platformAdmin` audit service; legacy-grant deprecation pointer (#11974, #11663 L4)
+
+Under **walled postures** (`group` / `isolated`), `bootstrapPlatformAdmin` no
+longer writes the org-less `sys_user_permission_set` row pointing at
+`admin_full_access`. Platform-admin standing on those deployments is
+**config-derived** at the one derivation site (`resolve-authz-context.ts`
+§6b-config, landed with #11663 L2): every account whose stored `sys_user` row
+holds a declared `OS_PLATFORM_OWNER_EMAIL` address and reads VERIFIED resolves
+`PLATFORM_ADMIN` at request time — nothing to mint, nothing to revoke, no
+window in which a row grants standing that policy would refuse. The `single`
+posture keeps first-user promotion and its grant row byte-for-byte (#11663
+Choice 4A; 4B is the sequenced follow-up).
+
+What the walled bootstrap still does:
+
+- **Reports standing** — one info line per boot listing, per declared
+  address: registered? verified? which account holds standing. The same
+  implementation serves the new read-only **`platformAdmin` service**
+  (`configuredEmails()` + `standing()`, registered by SecurityPlugin), so the
+  log and the audit surface can never disagree. The service is frozen and has
+  no writable member — there is deliberately no runtime path that changes who
+  a platform administrator is (#11663 Choice 3A).
+- **Points legacy grants at the config path** — a detected legacy org-less
+  human grant logs exactly one deprecation line per process (shared latch
+  with the derivation-site reporter) naming `OS_PLATFORM_OWNER_EMAIL`, the
+  holder and the config line that re-anchors them. Nothing is revoked: the
+  legacy row still confers during the loud, time-boxed migration window
+  (#11663 P5).
+
+The bootstrap-replay trigger (`shouldReplayBootstrapFor`) narrows with the
+retired elevation: it now fires only for `sys_user` insert/create under
+non-walled postures (the `single` first-user promotion). The #11343 update arm
+(`email_verified` / `email`) existed solely to re-attempt the walled elevation
+after the owner's verifying write; with standing derived at request time there
+is nothing to re-attempt, and under walled postures no `sys_user` write can
+change the bootstrap's answer at all.
+
+Walled bootstrap outcomes: a declared usable config now answers
+`reason: 'walled_config_derived'` (replacing `walled_owner_not_registered` /
+`walled_owner_not_verified`, whose distinctions moved into the standing
+report); `walled_owner_email_undeclared` stays for the unset/blank/refused
+backstop (Choice 2B: one unparseable entry fails the whole variable closed).

content/docs/permissions/system-context.mdx

@@ -87,14 +87,14 @@ that silently does not happen.
 
 | # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
 |:--|:---|:---|:---|:---|
-| 1 | **The whole security middleware short-circuits** before any gate runs | plugin-security | Get: every CRUD/FLS/tenant/owner gate below skipped in one branch. Lose: all of rows 2–6 at once — this is the single largest behaviour on the page | `security-plugin.ts:1565` |
-| 2 | **`owner_id` is not auto-stamped on INSERT** (the step 3.5 anchor guard is inside the block row 1 skips) | plugin-security | Lose: the row lands `owner_id = NULL`, so the default `owner_only_writes` policy hides it **from its own creator**. Get: nothing — this is a gap, not a capability | guard at `security-plugin.ts:2491` (the step 3.5 block), skipped by `:1565` |
-| 3 | Row-level read filter resolves to "no filter" | plugin-security | Get: unscoped reads. Lose: row-level scoping entirely | `security-plugin.ts:4295` |
-| 4 | Field-level security returns **all** fields | plugin-security | Get: every column readable. Lose: field masking | `security-plugin.ts:4446` |
-| 5 | Export permission granted unconditionally | plugin-security | Get: `canExport` is `true` | `security-plugin.ts:4524` |
-| 6 | Write bypass = `true`, effective write scope = `org` | plugin-security | Get: widest write scope without holding any capability | `security-plugin.ts:1392`, `:1414` |
+| 1 | **The whole security middleware short-circuits** before any gate runs | plugin-security | Get: every CRUD/FLS/tenant/owner gate below skipped in one branch. Lose: all of rows 2–6 at once — this is the single largest behaviour on the page | `security-plugin.ts:1585` |
+| 2 | **`owner_id` is not auto-stamped on INSERT** (the step 3.5 anchor guard is inside the block row 1 skips) | plugin-security | Lose: the row lands `owner_id = NULL`, so the default `owner_only_writes` policy hides it **from its own creator**. Get: nothing — this is a gap, not a capability | guard at `security-plugin.ts:2511` (the step 3.5 block), skipped by `:1585` |
+| 3 | Row-level read filter resolves to "no filter" | plugin-security | Get: unscoped reads. Lose: row-level scoping entirely | `security-plugin.ts:4314` |
+| 4 | Field-level security returns **all** fields | plugin-security | Get: every column readable. Lose: field masking | `security-plugin.ts:4465` |
+| 5 | Export permission granted unconditionally | plugin-security | Get: `canExport` is `true` | `security-plugin.ts:4543` |
+| 6 | Write bypass = `true`, effective write scope = `org` | plugin-security | Get: widest write scope without holding any capability | `security-plugin.ts:1412`, `:1434` |
 | 7 | Metadata-plane schema masking exempt (ADR-0106 D4) | metadata-core | Get: unmasked object schema. Note: the exemption is a **caller** property — it short-circuits before the security service is consulted | `object-schema-fls.ts:228` |
-| 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3808` |
+| 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3827` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
 | 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1288` |