docs(qa): re-point the platform-owner-email item's legacy-grant anchor at grantAnchorsPlatformStanding

[objectstack-fleet]

Fixes #24438
Clause-②: no

What

pnpm check:platform-checklist is red on main with one problem: areas/access-security.json cites packages/core/src/security/resolve-authz-context.ts#legacyGrantAnchorRetired, and that file no longer declares the symbol. This PR changes that one citation, in source[2] of item access-security.platform-owner-email-anchor, to #grantAnchorsPlatformStanding.

Nothing else changes: not the prose beside the citation, not any clause, step, fixture or oracle, not scripts/symbol-anchors.mjs, not the anchor baseline. Diff: 1 file, +1 / -1.

Where the symbol went

b2e78701f7 (PR #24373) deleted the local flag const legacyGrantAnchorRetired = postureEnforcesWall(resolveTenancyPosture()) from resolveUserAuthzGrants. It added a module-level predicate, grantAnchorsPlatformStanding(grant, { walled, defaultOrganizationId }). §6b now asks it of every admin_full_access grant:

• walled posture: it returns false, so no grant anchors standing;
• single: the organization-less grant anchors, and so does the Default Organization's grant.

The citation's parenthetical reads "the unscoped admin_full_access row derives PLATFORM_ADMIN only when the requested posture enforces no wall". That is still true, and the predicate is now where it is decided: if (anchor.walled) return false;, then organizationId === null || …. The requested posture is still read by postureEnforcesWall(resolveTenancyPosture()), now held in walled. So this is a re-point: the behaviour the citation describes did not move.

Verification

• Base 725a5b131 (origin/main): node scripts/check-platform-checklist.mjs exits 1 with check-platform-checklist: 1 problem(s). That one problem is the ABSENT SYMBOL line the card quotes.
• Head 0c177741b: pnpm check:platform-checklist exits 0, self-tests included. Verdict: check-platform-checklist: OK — 16 areas, 327 items (322 active, 1 planned); … symbol anchors: 855/865 resolved by symbol-anchors.mjs … 18 file floors held.
• node scripts/pm/dispatch-gates.mjs --commands on this diff derives 13 commands. All 13 exit 0 at 0c177741b: check-ci-filter-parity, check-closing-keyword-parity (and its --self-test), check-comment-mask-corpus, check:doc-formula-expressions (lint), check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal.
• --ran reconciliation: "13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero — all 13 recorded an exit code and none of them is 3)".
• check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET, because lint and formula were not built). That is not a measurement. After turbo run build --filter=@objectstack/formula --filter=@objectstack/lint it exited 0.
• No ablation: the diff changes QA-ledger data, not tested behaviour. The base-red and head-green runs above are the before and after.
• No package is touched, so no build closure, package test or typecheck is owed. CI families are read from this PR's check-runs.
• Changeset: docs/qa/** publishes nothing, so the PR carries skip-changeset.

Acceptance notes

• The revision is not bumped (it stays 3). The checklist README bumps revision "on any semantic edit". This edit changes no step, clause, verify or oracle, so a run record pinned to revision 3 still reads the same item.
  • Precedent is split. Five code PRs re-pointed a source anchor in place with no bump: 52ff308b8, 646303eae, df000d4b2, bb7ccde66, 6868514b1. Two docs(qa) PRs bumped: 6792be6ab, and 52c04b360, which edited a verify field.
  • The card's line budget is one line. If a bump is wanted, the follow-up is about six lines: revision 4 plus one history entry.
• The item's own re-author trigger has fired. This is an open question for the access lane, and this PR does not act on it.
  • Clause 6's verify ends: "The single half's own fate is platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's (Choice 4B): if that lands, this clause is re-authored, not read as a regression". PR fix(security): the single-posture platform-admin grant is owned by the Default Organization, and every reader of platform standing reads it #24373 landed platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 at 2026-10-18T19:15Z (state reason completed).
  • The first-user promotion now writes its admin_full_access grant with organization_id set to the Default Organization (packages/plugins/plugin-security/src/bootstrap-platform-admin.ts). The PR's fresh-boot golden moved its grant owner from null to org_default.
  • So on the fresh single boot this item runs, the seeded admin holds the Default Organization's grant, not the organization-less row. Four phrases describe the older boot:
    • personas[0]: "it is grant-anchored via the unscoped admin_full_access row that first-registrant promotion writes";
    • fixtures.knownGaps[0]: "also holds the unscoped admin_full_access grant under single";
    • acceptance[0]: "under single the ADR-0068 D2 unscoped-grant anchor stays the only door";
    • acceptance[5]: "(clauses 1 and 3 observe it live)".
  • Every verdict still holds: M is refused, the admin gets its 200, the organization-less row confers nothing under a wall, and the config anchor still confers.
  • The legacy-row half of clause 6 is still pinned, by the describe '[[Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 L5] the legacy grant row is an anchor under single, and NOWHERE else'. The new half is pinned by '[ADR-0131 D5] under single the Default Organization's admin_full_access grant is the anchor', in the same test file. The item cites that describe nowhere.
  • As the dispatch instructs, this PR does not reword the clause. The question, its options and the evidence are in the report on the card.

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-19T05:07Z · head 0c177741b · card #24438 (claim 6259818491)

• Form. Draft, base main. The body's first line is Fixes #24438, the only closing keyword. Assignee os-warren. skip-changeset: the dev's, and the seat agrees (docs/qa/** ships in no package).
• Scope. 1 file, +1 / −1: source[2] of access-security.platform-owner-email-anchor, #legacyGrantAnchorRetired → #grantAnchorsPlatformStanding. The prose beside the anchor is unchanged.
• The anchor, against origin/main. packages/core/src/security/resolve-authz-context.ts declares function grantAnchorsPlatformStanding(grant, anchor) (about L912): if (anchor.walled) return false; then the organization-less row (or the Default Organization's grant) anchors. So the citation's parenthetical — the unscoped row derives PLATFORM_ADMIN only when the posture enforces no wall — stays true. ✓ The old symbol is absent from the file (0 hits).
• Gate. The dev's before/after: node scripts/check-platform-checklist.mjs exit 1 with the one ABSENT SYMBOL at base 725a5b131; pnpm check:platform-checklist exit 0 at head (855/865 symbol anchors resolved). The gate is watchdog-only, so the local reading is its evidence.
• CI, pinned to head 0c177741b. 43 check-runs, all completed: 32 success, 11 skipped. node scripts/pm/check-expected-skips.mjs --pr 24463 → OK, every skip in the roster. node scripts/pm/check-governed-merges.mjs --pr 24463 → NOT governed; 2 changed lines.
• Open questions, answered by the seat. Q1 (bump the revision for an anchor-only re-point): A, no bump — the README bumps on a semantic edit, and this is not one. Q0 (re-author the item now that platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 has landed): A — filed as docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author #24465, which bumps the revision to 4 and names this re-point in its history entry; it runs after this PR lands (same file).

Landing. Ready, then auto-merge through the queue, by this seat.

---

Generated by Claude Code