docs(core): re-key the §6b-config posture-gate comment to the ruling it cites (#18645)

Fixes #18380

Clause-②: no

Comment-only repair at
`packages/core/src/security/resolve-authz-context.ts` §6b-config. No
behaviour, no assertion, no logic touched — the diff is 32 insertions /
11 deletions, all of them inside one `//` block.

## The defect

The comment justifying the posture gate on the legacy-grant deprecation
notice stated the PRE-reversal rule as current fact, and cited a pin as
live support for it:

> the `single` promotion is pinned NEVER to consult that variable
(`bootstrap-platform-admin-walled-owner.test.ts`, "never consults the
owner-email variable")

The maintainer ruling of 2026-09-08 (decision batch #100, recorded on
#16682, comment `5587754690`) reversed exactly that point, verbatim:

> **F3 — the Choice 4A sentence is superseded for this one point.**
Under `single` posture the first-boot promotion consults
`OS_PLATFORM_OWNER_EMAIL` first.

## What the pin records now — read, not assumed

| probe | reading |
|---|---|
| `never consults the owner-email variable`, repo-wide under `packages/`
| **1** —
`packages/plugins/plugin-security/src/bootstrap-platform-admin-walled-owner.test.ts:436`
|
| firing control `owner-email variable`, same corpus | **4 files** ⇒ the
1 above is a reading, not a dead grep |

That single hit lives at `:434-456`, inside a block that opens `⚠️
RE-AUTHORED by #16682`, says the case "used to assert the opposite",
quotes the maintainer ruling, and is followed by a case titled `a
declared owner DOES redirect the single-org promotion (#16682), and
'single' still promotes`. So the citation **resolved** and did **not**
support the claim — it recorded its reversal. The repaired comment now
cites the pin for what the pin says.

## What the reversal did NOT change — the gate's real justification

Verified by reading
`packages/plugins/plugin-security/src/bootstrap-platform-admin.ts`
(read-only; another lane):

- The declared-owner leg mints the **same** unscoped `admin_full_access`
row — `promote()` is one call site serving both legs (`:867`),
`organization_id: null`.
- A rig that already holds such a row never reaches that leg: `if
(!walled && unscopedHolder) return { reason: 'already_have_admin' }`
(`:687`) runs first.
- The ruling's own second sentence preserves the standing this gate
rests on: "The rest of Choice 4A (#11974, 2026-08-25) stands: retiring
the walled write must not retire the `single` one, and the over-denial
invariant (`adminPromoted === true` with a grant row minted) stays
pinned."

⇒ The notice's first half ("it is removed in a later release") is still
false for a `single` rig, so the posture gate stays right. Its second
half ("Re-anchor ... by declaring its administrators in configuration")
is **no longer inert** under `single` — which is what the old comment
got backwards — but it still does not move such a rig off the grant row.
The repaired comment says that, instead of the reversed premise.

## The neighbouring clause was stale too, and is fixed

The old text read "That holds whichever way Choice 4B (#11979) is
eventually ruled". Checked rather than assumed: **4B is already ruled**,
and what is pending is the landing — #11663 comment `5404675670`
(maintainer acceptance 2026-08-25), verbatim: "**4B is ruled as the
sequenced follow-up, not dropped** (card filed ...)"; #11979 is open and
`pm:blocked` behind #11978. The clause now says ruled and filed, not
landed.

## Verification — final head `cb602a03b3`

Gate derivation and reconciliation were run once, on this head:

```
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RANFILE
  -> 47 derived, 45 run, 2 NOT-MEASURED, 0 UNRUN   (exit 0)
```

- **44 of 45 green.**
- `pnpm check:cross-package-test-inputs` :: **exit 1** — the known gate
defect **#18621**, not this PR's red. It fires on the mere existence of
`packages/spec/dist/`, which the dependency-closure build creates.
Control measured here: with `packages/spec/dist/` moved aside the same
command exits **0** ("OK: 29 package(s) read outside themselves, all
declared"), and restored byte-for-byte afterwards (216 files before, 216
after).
- `pnpm check:dual-build-cjs-loads` and `pnpm check:lean-entry-closure`
:: **exit 3, PREREQUISITE NOT MET** — both refuse to measure without a
whole-repo `dist/`. Recorded as NOT MEASURED, declared to CI; a
comment-only diff cannot move either.

Targeted, under the shared verify lock:

```
pnpm --filter '@objectstack/core...' build      -> VERDICT command-exit 0
pnpm --filter @objectstack/core typecheck       -> exit 0 (tsc + examples + check:test-typecheck)
pnpm --filter @objectstack/core test            -> exit 0 — Test Files 51 passed (51), Tests 1316 passed (1316)
```

Repo-wide `pnpm lint` (`eslint . --no-inline-config`) also run in full:
**exit 0**, so no narrowing had to be declared.

## Changeset decision: none, `skip-changeset` — measured, not assumed

`@objectstack/core` ships `files: ["dist", "README.md",
"CHANGELOG.md"]`. After building the package, those paths were grepped
with a positive control:

| probe | hits in the published paths |
|---|---|
| needle — text from this PR's comment ("the notice's FIRST half is
false", "re-authored block") | **0** |
| second needle — a pre-existing body comment from the same function
("This gates the NOTICE and nothing else") | **0** |
| **positive control** — a docblock on the exported
`hasPlatformAdminStanding` ("the ID-SHAPED platform-admin question") |
**1** in `dist/index.d.ts`, **1** in `dist/index.d.cts` |

The control lands, so the instrument is live; the needles do not. A
function-**body** comment reaches no published artifact: the declaration
emitter carries only declaration-level docblocks, esbuild drops body
comments from `dist/*.js` / `*.cjs`, and `dropSourcesContent` keeps the
source text out of `dist/*.map`. Nothing published moves ⇒ no changeset,
and the `skip-changeset` label is applied.

## Acceptance notes

- **noted, not filed** —
`bootstrap-platform-admin-walled-owner.test.ts`'s enclosing `describe`
title still reads `single posture — "first user is owner" is ruled
reasonable and UNCHANGED (Choice 4A)`, while the case inside it now
asserts that a declared owner redirects the promotion. The block's own
re-authored docblock explains the split correctly, so this is a
title-level nit, not a defect, and it is in the `domain:services` lane
(read-only for this card). Who will touch it: #11979's implementer —
Choice 4B rewrites exactly this block when it lands.
- No other stale claim about the `single` promotion exists in the edited
file: `OS_PLATFORM_OWNER_EMAIL` appears once more, in the
`hasPlatformAdminStanding` docblock, and that text is accurate.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01CqmCgU5RGDoJYhHUMVp2af)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: huangyiirene

packages/core/src/security/resolve-authz-context.ts

@@ -998,17 +998,38 @@ export async function resolveUserAuthzGrants(
     // detector (`plugin-security/src/bootstrap-platform-admin.ts` §2, which
     // spells the same `postureEnforcesWall(resolveTenancyPosture())`). Under
     // `single` — the DEFAULT posture — `bootstrapPlatformAdmin` MINTS this very
-    // row to promote the first human user, and Choice 4A rules that promotion,
-    // and its row, correct and UNCHANGED. Both halves of the notice are
-    // therefore false for such a rig: the row is not "removed in a later
-    // release", and re-anchoring through the config line gets the operator
-    // nothing, because the `single` promotion is pinned NEVER to consult that
-    // variable (`bootstrap-platform-admin-walled-owner.test.ts`, "never
-    // consults the owner-email variable"). That holds whichever way Choice 4B
-    // (#11979) is eventually ruled: under 4A the row is that rig's permanent
-    // anchor, and under 4B the advice only becomes true once 4B actually lands.
-    // So the migration window's loudness is scoped to the rigs actually in it —
-    // the walled ones, where the row really is the LEGACY anchor.
+    // row, so the notice's FIRST half is false for such a rig: the row is not
+    // "removed in a later release", it is the row that rig's own boot writes.
+    // Choice 4A rules that promotion, and its row, correct, and the maintainer
+    // ruling of 2026-09-08 (decision batch #100, on #16682) left that standing
+    // while re-keying WHO is promoted — verbatim: "The rest of Choice 4A
+    // (#11974, 2026-08-25) stands: retiring the walled write must not retire
+    // the `single` one, and the over-denial invariant (`adminPromoted === true`
+    // with a grant row minted) stays pinned."
+    //
+    // ⚠️ The SECOND half — "Re-anchor this deployment by declaring its
+    // administrators in configuration" — is NOT inert under `single`. The same
+    // ruling, verbatim: "Under `single` posture the first-boot promotion
+    // consults `OS_PLATFORM_OWNER_EMAIL` first." So a declaration DOES decide
+    // the `single` promotion, and the pin records THAT now:
+    // `bootstrap-platform-admin-walled-owner.test.ts` asserts "a declared owner
+    // DOES redirect the single-org promotion (#16682)". ⛔ The string "never
+    // consults the owner-email variable" survives in that file ONLY inside the
+    // re-authored block's account of what the case USED to assert — ⛔ never
+    // cite it as live support for the pre-ruling rule, which is what an earlier
+    // revision of THIS comment did (#18380).
+    //
+    // What the reversal did not change is the thing this gate turns on:
+    // declaring the variable does not move a `single` rig OFF the grant row.
+    // The declared-owner leg mints the same unscoped `admin_full_access` row
+    // (one `promote()` call site serves both legs), and a rig that already
+    // holds one never reaches that leg — the existing-admin check answers
+    // `already_have_admin` before it. Choice 4B (#11979) is the card that would
+    // end that, and it is ruled and filed, ⛔ not landed (#11663 comment
+    // 5404675670, verbatim: "4B is ruled as the sequenced follow-up, not
+    // dropped"). So the migration window's loudness is scoped to the rigs
+    // actually in it — the walled ones, where the row really is the LEGACY
+    // anchor.
     //
     // ⛔ This gates the NOTICE and nothing else. Standing is derived by the
     // `if (configConfersPlatformAdmin) / else if (hasPlatformAdminGrant)` chain