@@ -0,0 +1,17 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+feat: Create User can grant a permission set in the same step, judged by the same delegated-administration gate as Setup's grant form
+
+Clause-②: yes (widening: `POST /api/v1/auth/admin/create-user` and the `sys_user` `create_user` action accept an optional `permissionSet`; a request without it is answered exactly as before)
+Metadata-protocol: none
+
+A user created with no permission set signed in to a screen of refusals. Setup → Users → Create User now offers an optional **Permission Set** (the set's machine name, checked against the security catalog).
+
+- **How the grant is written.** The route inserts the `sys_user_permission_set` row under the calling administrator's OWN execution context, never the system's. The security middleware, the ADR-0090 D12 delegated-administration gate (which stamps `granted_by`) and the catalog name check judge it exactly as they judge the grant form. The route's platform-admin gate decides who may create a user; it never decides what that user may be granted.
+- **One step, one outcome.** The account and the grant run in one engine transaction. A refused grant answers the refusal's own status and code (403 `PERMISSION_DENIED` from the gate, 400 `VALIDATION_FAILED` with its `fields` for a name the catalog does not hold), and no user is created. A datasource whose driver has no `beginTransaction` runs the two writes unatomically, the engine's declared limit (ADR-0119 D1).
+- **Refused before anything is written:** a `permissionSet` that is not a string (400), a caller whose own context does not resolve (403), and a host that wires no grant seam (501).
+- **Response.** The success body carries `permissionSet` beside the user, and the result dialog shows it.
+- **Cloud-managed environments are unchanged.** `create_user` stays hidden while `features.cloudManaged` is on.
@@ -93,7 +93,7 @@ what moved this page's population from 225 to 227; nothing about the two sites
 changed, only whether this instrument could see them.
 
 **The expensive failure direction is a keyword.** Sites whose receiver the author
-typed `any` have no type to read, and there are 54 of them — just over a fifth
+typed `any` have no type to read, and there are 55 of them — just over a fifth
 of the population, concentrated in exactly the seed and bootstrap paths this
 control exists for. Scoring an unreadable receiver as "not an engine" would have
 dropped every one of them silently, with a clean exit and a smaller number that
@@ -132,7 +132,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **51 of the 237 sites are spelled that way**. A
+forwarding shim cannot, and **51 of the 238 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -197,10 +197,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **237** |
+| 175 write call sites | quoted in the merged changeset | **238** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **29** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **161 of 237** decidable, **76** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 135 decidably elevated, 0 decidably not, 94 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **162 of 238** decidable, **76** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 135 decidably elevated, 0 decidably not, 95 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -210,18 +210,18 @@ be stated is what this instrument counts, which is written above and re-runnable
 at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
-one, and both are counted in the generated tables below: the 54 sites reached
+one, and both are counted in the generated tables below: the 55 sites reached
 through an erased (`any`) receiver, and the 51 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-135 of 237 (57%) as decidably elevated, with 94 more whose elevation is a
+135 of 238 (57%) as decidably elevated, with 95 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `2 / 237`, and say what it is**: the sites whose options argument was
+⇒ **Cite `2 / 238`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **29 further sites** have an options argument this
@@ -233,28 +233,28 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **237** |
-| …whose object name is statically decidable | 161 |
+| write call sites on the application surface | **238** |
+| …whose object name is statically decidable | 162 |
 | …whose object name is chosen at run time | 76 |
-| …against an object with tenancy ENABLED | 160 |
+| …against an object with tenancy ENABLED | 161 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 178 |
+| threading a tenant context | 179 |
 | PROVABLY carrying none (options read, no context key) | **8** |
 | …of those, against a decidably tenancy-enabled object | **2** |
 | options argument UNREADABLE — may or may not carry one | 51 |
 | …of those, against a decidably tenancy-enabled object | 29 |
 | threading a decidably ELEVATED (`isSystem`) context | 135 |
 | threading a context that is decidably NOT elevated | 0 |
-| threading a context whose elevation is a run-time fact | 94 |
+| threading a context whose elevation is a run-time fact | 95 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
 | receiver carried a readable engine type | 183 |
-| receiver erased, placed by the object NAME | 44 |
+| receiver erased, placed by the object NAME | 45 |
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
-| object name spelled inline | 110 |
+| object name spelled inline | 111 |
 | object name spelled through a `const` | 51 |
 | object name is an `object: string` parameter | 7 |
 | object name is some other run-time expression | 69 |
@@ -307,11 +307,11 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-23 at `fb63d396b`.
+Measured on 2026-10-23 at `d45e01440`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 714 |
+| tracked non-test sources scanned | 716 |
 | engine-shaped types recognised | 87 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 172 |
 
@@ -33,19 +33,19 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 237 |
-| Object name statically decidable | 161 |
+| Write call sites | 238 |
+| Object name statically decidable | 162 |
 | Object name chosen at run time | 76 |
-| Against a tenancy-enabled object | 160 |
+| Against a tenancy-enabled object | 161 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 178 |
+| Threading a tenant context | 179 |
 | Provably carrying none | 8 |
 | …and decidably tenancy-enabled | 2 |
 | Options argument unreadable | 51 |
 | …and decidably tenancy-enabled | 29 |
 | Threading a decidably elevated context | 135 |
 | Threading a decidably non-elevated context | 0 |
-| Threading a context of undecidable elevation | 94 |
+| Threading a context of undecidable elevation | 95 |
 
 ## Subtractions the census could NOT defend — enforced
 
@@ -90,11 +90,11 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-23 at `fb63d396b`.
+Measured on 2026-10-23 at `d45e01440`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 714 |
+| tracked non-test sources scanned | 716 |
 | engine-shaped types recognised | 87 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 172 |
@@ -128,6 +128,7 @@ Measured on 2026-10-23 at `fb63d396b`.
 | `packages/plugins/plugin-auth/src/admin-set-user-manager.ts` | `update` | `sys_user` | enabled | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-auth/src/admin-user-endpoints.ts` | `insert` | `sys_audit_log` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/admin-user-endpoints.ts` | `update` | `sys_user` | enabled | elevated | 1 |
+| `packages/plugins/plugin-auth/src/admin-user-endpoints.ts` | `insert` | `sys_user_permission_set` | enabled | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-auth/src/adopt-membership.ts` | `update` | `SystemObjectName.MEMBER` | undecidable | PROVABLY NONE | 1 |
 | `packages/plugins/plugin-auth/src/audience-gate-test-support.ts` | `insert` | `sys_invitation` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/auth-manager-database-hooks.ts` | `update` | `sys_user` | enabled | options unreadable | 2 |
 
@@ -182,6 +182,10 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           },
           mustChangePassword: {
             label: "Require Password Change On First Login"
+          },
+          permissionSet: {
+            label: "Permission Set",
+            helpText: "Optional. Grants this permission set to the new user, so they can open their apps on first sign-in."
           }
         },
         resultDialog: {
@@ -191,6 +195,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           fields: {
             "user.email": "Email",
             "user.phoneNumber": "Phone Number",
+            permissionSet: "Permission Set",
             temporaryPassword: "Temporary Password"
           }
         }
 
@@ -182,6 +182,10 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           },
           mustChangePassword: {
             label: "Exigir cambio de contraseña en el primer inicio de sesión"
+          },
+          permissionSet: {
+            label: "Conjunto de permisos",
+            helpText: "Opcional. Concede este conjunto de permisos al nuevo usuario para que pueda abrir sus aplicaciones desde el primer inicio de sesión."
           }
         },
         resultDialog: {
@@ -191,6 +195,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           fields: {
             "user.email": "Correo electrónico",
             "user.phoneNumber": "Número de teléfono",
+            permissionSet: "Conjunto de permisos",
             temporaryPassword: "Contraseña temporal"
           }
         }
 
@@ -182,6 +182,10 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           },
           mustChangePassword: {
             label: "初回サインイン時にパスワード変更を必須にする"
+          },
+          permissionSet: {
+            label: "権限セット",
+            helpText: "任意。この権限セットを新しいユーザーに付与し、初回サインインから自分のアプリを開けるようにします。"
           }
         },
         resultDialog: {
@@ -191,6 +195,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           fields: {
             "user.email": "メールアドレス",
             "user.phoneNumber": "電話番号",
+            permissionSet: "権限セット",
             temporaryPassword: "一時パスワード"
           }
         }
 
@@ -182,6 +182,10 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
           },
           mustChangePassword: {
             label: "首次登录时必须修改密码"
+          },
+          permissionSet: {
+            label: "权限集",
+            helpText: "可选。将该权限集授予新用户，使其首次登录即可打开自己的应用。"
           }
         },
         resultDialog: {
@@ -191,6 +195,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
           fields: {
             "user.email": "邮箱",
             "user.phoneNumber": "手机号",
+            permissionSet: "权限集",
             temporaryPassword: "临时密码"
           }
         }
 
@@ -54,6 +54,8 @@ describe('create_user — the result dialog holds for a typed and a generated pa
     expect(action('create_user')?.resultDialog?.fields?.map((f) => [f.path, f.format])).toEqual([
       ['user.email', 'text'],
       ['user.phoneNumber', 'text'],
+      // #25338: present only when the request granted a permission set.
+      ['permissionSet', 'text'],
       ['temporaryPassword', 'secret'],
     ]);
   });
 
@@ -286,6 +286,24 @@ export const SysUser = ObjectSchema.create({
           required: false,
           defaultValue: true,
         },
+        // [#25338] Optional: grant one permission set in the same step, so a
+        // new user does not sign in to a screen of refusals. INLINE, not
+        // field-backed: the grant object lives in plugin-security, whose
+        // metadata the console need not have loaded on this list, and an
+        // unresolvable field-backed param makes the dialog refuse the whole
+        // action. The grant column is a text field anyway (its picker is a
+        // widget hint params do not inherit), so nothing is lost.
+        // The route writes the grant under the administrator's OWN context in
+        // the same transaction as the account: the delegated-administration
+        // gate and the catalog name check judge it as they judge Setup's
+        // grant form, and a refusal creates no user.
+        {
+          name: 'permissionSet',
+          type: 'text',
+          label: 'Permission Set',
+          required: false,
+          helpText: 'Optional. Grants this permission set to the new user, so they can open their apps on first sign-in.',
+        },
       ],
       resultDialog: {
         title: 'User Created',
@@ -301,6 +319,7 @@ export const SysUser = ObjectSchema.create({
           // phone-based users, temporaryPassword only when the server minted one.
           { path: 'user.email', label: 'Email', format: 'text' },
           { path: 'user.phoneNumber', label: 'Phone Number', format: 'text' },
+          { path: 'permissionSet', label: 'Permission Set', format: 'text' },
           { path: 'temporaryPassword', label: 'Temporary Password', format: 'secret' },
         ],
       },
Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,10 @@ export const enObjects: NonNullable<TranslationData['objects']> = {`
`182`	`182`	`},`
`183`	`183`	`mustChangePassword: {`
`184`	`184`	`label: "Require Password Change On First Login"`
	`185`	`+ },`
	`186`	`+ permissionSet: {`
	`187`	`+ label: "Permission Set",`
	`188`	`+ helpText: "Optional. Grants this permission set to the new user, so they can open their apps on first sign-in."`
`185`	`189`	`}`
`186`	`190`	`},`
`187`	`191`	`resultDialog: {`
`@@ -191,6 +195,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {`
`191`	`195`	`fields: {`
`192`	`196`	`"user.email": "Email",`
`193`	`197`	`"user.phoneNumber": "Phone Number",`
	`198`	`+ permissionSet: "Permission Set",`
`194`	`199`	`temporaryPassword: "Temporary Password"`
`195`	`200`	`}`
`196`	`201`	`}`
Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,10 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {`
`182`	`182`	`},`
`183`	`183`	`mustChangePassword: {`
`184`	`184`	`label: "Exigir cambio de contraseña en el primer inicio de sesión"`
	`185`	`+ },`
	`186`	`+ permissionSet: {`
	`187`	`+ label: "Conjunto de permisos",`
	`188`	`+ helpText: "Opcional. Concede este conjunto de permisos al nuevo usuario para que pueda abrir sus aplicaciones desde el primer inicio de sesión."`
`185`	`189`	`}`
`186`	`190`	`},`
`187`	`191`	`resultDialog: {`
`@@ -191,6 +195,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {`
`191`	`195`	`fields: {`
`192`	`196`	`"user.email": "Correo electrónico",`
`193`	`197`	`"user.phoneNumber": "Número de teléfono",`
	`198`	`+ permissionSet: "Conjunto de permisos",`
`194`	`199`	`temporaryPassword: "Contraseña temporal"`
`195`	`200`	`}`
`196`	`201`	`}`
Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,10 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {`
`182`	`182`	`},`
`183`	`183`	`mustChangePassword: {`
`184`	`184`	`label: "初回サインイン時にパスワード変更を必須にする"`
	`185`	`+ },`
	`186`	`+ permissionSet: {`
	`187`	`+ label: "権限セット",`
	`188`	`+ helpText: "任意。この権限セットを新しいユーザーに付与し、初回サインインから自分のアプリを開けるようにします。"`
`185`	`189`	`}`
`186`	`190`	`},`
`187`	`191`	`resultDialog: {`
`@@ -191,6 +195,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {`
`191`	`195`	`fields: {`
`192`	`196`	`"user.email": "メールアドレス",`
`193`	`197`	`"user.phoneNumber": "電話番号",`
	`198`	`+ permissionSet: "権限セット",`
`194`	`199`	`temporaryPassword: "一時パスワード"`
`195`	`200`	`}`
`196`	`201`	`}`
Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,10 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {`
`182`	`182`	`},`
`183`	`183`	`mustChangePassword: {`
`184`	`184`	`label: "首次登录时必须修改密码"`
	`185`	`+ },`
	`186`	`+ permissionSet: {`
	`187`	`+ label: "权限集",`
	`188`	`+ helpText: "可选。将该权限集授予新用户，使其首次登录即可打开自己的应用。"`
`185`	`189`	`}`
`186`	`190`	`},`
`187`	`191`	`resultDialog: {`
`@@ -191,6 +195,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {`
`191`	`195`	`fields: {`
`192`	`196`	`"user.email": "邮箱",`
`193`	`197`	`"user.phoneNumber": "手机号",`
	`198`	`+ permissionSet: "权限集",`
`194`	`199`	`temporaryPassword: "临时密码"`
`195`	`200`	`}`
`196`	`201`	`}`