@@ -46,8 +46,8 @@ import { AuthzStoreUnavailableError } from './authz-store-unavailable.js';
 // second copy of a security-relevant classifier exist. See `tryFind`'s catch.
 //
 // [#13667 / #11663 L5] `resolveTenancyPosture` is the REQUESTED tenancy posture. It
-// is read at exactly one place below (§6b) to key the LEGACY unscoped-grant anchor
-// to the same walled postures the BOOT-side detector already keys on — the same
+// is read at exactly one place below (§6) to key the grant anchor of platform standing
+// ({@link grantAnchorsPlatformStanding}) to the same walled postures the BOOT-side detector already keys on — the same
 // module, the same function, the same fail-stricter direction that detector reads.
 // It asks the ENVIRONMENT, never the engine, so the gate adds no query.
 import { isMissingTableError, resolveTenancyPosture } from '@objectstack/types';
@@ -109,7 +109,7 @@ export interface ResolvedAuthzContext {
   /**
    * [ADR-0095 D2/D3] The monotonic posture rung this principal resolves to,
    * DERIVED once here from held capability grants (never a better-auth role):
-   * `PLATFORM_ADMIN` (an unscoped `admin_full_access` grant, or — since #11663
+   * `PLATFORM_ADMIN` (the anchoring `admin_full_access` grant, or — since #11663
    * L2 — a VERIFIED `sys_user.email` on the deployment's declared
    * administrator list) > `TENANT_ADMIN`
    * (`organization_admin`) > `MEMBER` (the authenticated floor). `EXTERNAL` is
@@ -895,6 +895,52 @@ function grantOrganizationOf(row: unknown): string | null {
   return String(value);
 }
 
+/**
+ * [ADR-0131 D5] Does a stored grant ANCHOR platform-admin standing — the one
+ * predicate, with the posture as its parameter, that §6b asks of every
+ * `admin_full_access` grant:
+ *
+ *  - a walled posture (`group` / `isolated`): no grant anchors standing; it is
+ *    config-derived (`OS_PLATFORM_OWNER_EMAIL`, §6b-config) and nothing else
+ *    (#11663 L5);
+ *  - `single`: the grant the first-user promotion writes, which is owned by the
+ *    Default Organization ({@link readDefaultOrganizationId}), and the
+ *    organization-less row that promotion wrote before it was.
+ *
+ * Any other organization's grant of the set confers the set, never standing.
+ */
+function grantAnchorsPlatformStanding(
+  grant: unknown,
+  anchor: { walled: boolean; defaultOrganizationId: string | undefined },
+): boolean {
+  if (anchor.walled) return false;
+  const organizationId = grantOrganizationOf(grant);
+  return organizationId === null
+    || (anchor.defaultOrganizationId !== undefined && organizationId === anchor.defaultOrganizationId);
+}
+
+/**
+ * [ADR-0131 D3/D5] The deployment's Default Organization: the one with
+ * `slug = 'default'`, else the only organization there is; `undefined` when
+ * neither exists (several organizations, none of them `default`, name none).
+ * The definition plugin-auth's boot invariant (`default-organization-invariant.ts`)
+ * creates the organization by, read-only here — and the one plugin-security's
+ * promotion resolves the owner of the grant it writes by, so the row it writes
+ * is the row this resolver reads as the anchor.
+ *
+ * A composition that registers no organization object holds none, and is not
+ * read: the engine refuses an unregistered name as "object not found".
+ */
+async function readDefaultOrganizationId(ql: any): Promise<string | undefined> {
+  if (!registryHoldsObject(ql, SystemObjectName.ORGANIZATION)) return undefined;
+  const idOf = (row: any): string | undefined =>
+    row?.id === undefined || row?.id === null || String(row.id) === '' ? undefined : String(row.id);
+  const bySlug = await tryFind(ql, SystemObjectName.ORGANIZATION, { slug: 'default' }, 1);
+  if (idOf(bySlug[0])) return idOf(bySlug[0]);
+  const all = await tryFind(ql, SystemObjectName.ORGANIZATION, {}, 2);
+  return all.length === 1 ? idOf(all[0]) : undefined;
+}
+
 /** The activation ledger's catalog types the resolver honours (ADR-0126 §3 regime C, as ADR-0131 D6 amends it). */
 const LEDGER_CATALOG_TYPES = ['position', 'permission'] as const;
 
@@ -1426,7 +1472,42 @@ export async function resolveUserAuthzGrants(
   //    positions' — never a catalog row's `active` column.
   // (read in Leg 1 above)
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
-  const applyingGrants = upsRows.filter((r) => grantAppliesInTenant(grantOrganizationOf(r), tenantId));
+  // [ADR-0131 D5 / #11663 L5] The platform-standing ANCHOR of a stored grant — one
+  // derivation site, with the posture as its parameter ({@link grantAnchorsPlatformStanding}):
+  //
+  //  - WALLED: no grant anchors standing. The walled half of the legacy anchor is
+  //    retired, so on a walled rig platform standing is config-derived
+  //    (`OS_PLATFORM_OWNER_EMAIL`, §6b-config) and nothing else.
+  //  - `single` — the DEFAULT, what a deployment that configured no tenancy at all
+  //    resolves to: the `admin_full_access` grant `bootstrapPlatformAdmin` mints for
+  //    the first human user, which D5 has OWNED BY THE DEFAULT ORGANIZATION (#11979;
+  //    maintainer ruling A on #18707 keeps the zero-config promotion and moves only the
+  //    row's owner), and the organization-less row that promotion wrote before it was —
+  //    the row D10's ceremony attributes to that same organization. ⛔ Reading only the
+  //    organization-less row would leave every promoted `single` rig with NO platform
+  //    administrator once its grant is the Default Organization's.
+  //
+  // The REQUESTED posture is the input, not the effective one — the same source and the
+  // same fail-stricter direction the boot side reads: a deployment that ASKED for a wall
+  // stays walled here even while running degraded (`OS_ALLOW_DEGRADED_TENANCY=1`).
+  // `resolveTenancyPosture()` asks the ENVIRONMENT, so the posture costs no query; the
+  // Default Organization is read only for a principal that holds an organization-owned
+  // `admin_full_access` grant under `single`, so a principal holding none issues exactly
+  // the reads it issued before (the batch-equivalence goldens are unchanged).
+  const walled = postureEnforcesWall(resolveTenancyPosture());
+  const defaultOrganizationId =
+    !walled && upsRows.some((r) => grantSetNameOf(r) === ADMIN_FULL_ACCESS && grantOrganizationOf(r) !== null)
+      ? await readDefaultOrganizationId(ql)
+      : undefined;
+  const platformAnchor = { walled, defaultOrganizationId };
+  const anchorsPlatformStanding = (grant: unknown): boolean =>
+    grantSetNameOf(grant) === ADMIN_FULL_ACCESS && grantAnchorsPlatformStanding(grant, platformAnchor);
+  // An anchoring grant applies in whichever organization the principal acts in, as the
+  // organization-less row it replaces always did: platform standing is the deployment's,
+  // never one tenant's.
+  const applyingGrants = upsRows.filter(
+    (r) => grantAppliesInTenant(grantOrganizationOf(r), tenantId) || anchorsPlatformStanding(r),
+  );
   const catalog = securityCatalogReaderOf(ql);
   const grantSetNames: string[] = [];
   for (const grant of applyingGrants) {
@@ -1436,30 +1517,6 @@ export async function resolveUserAuthzGrants(
   // Position-bound sets (§6a), by name, in the order the held positions name them.
   const boundSetNames: string[] = [];
   let disabled = { positions: new Set<string>(), permissions: new Set<string>() };
-  // [#11663 L5] …and under a WALLED posture it no longer is. This is the EXIT of
-  // the migration window L4 opened: the walled half of the legacy unscoped anchor
-  // is RETIRED, so on a walled rig platform standing is config-derived
-  // (`OS_PLATFORM_OWNER_EMAIL`, §6b-config) and nothing else. Read ADR-0131 D5 as
-  // amended 2026-09-17 (#18413) before widening this: the anchor retires here for
-  // the WALLED half only.
-  //
-  // ⛔ The `single` posture is deliberately NOT gated, and this is the whole of why
-  // the flag exists rather than a plain deletion. Under `single` — the DEFAULT, what
-  // a deployment that configured no tenancy at all resolves to — `bootstrapPlatformAdmin`
-  // MINTS this very row for the first human user, and that promotion is ruled correct
-  // and unchanged (Choice 4A, #11974; maintainer 2026-09-08, recorded in ADR-0131's 2026-09-17 amendment, verbatim: "The
-  // rest of Choice 4A (#11974, 2026-08-25) stands: retiring the walled write must not
-  // retire the `single` one"). A development environment started for a moment cannot be
-  // asked to declare an administrator first, so deleting the row route for every posture
-  // would leave every zero-config rig with NO platform administrator at all. The
-  // `single` half's own disposition is Choice 4B (#11979) — ⛔ a different card.
-  //
-  // The REQUESTED posture is the input, not the effective one — the same source and the
-  // same fail-stricter direction the boot side reads: a deployment that ASKED for a wall
-  // stays walled here even while running degraded (`OS_ALLOW_DEGRADED_TENANCY=1`).
-  // `resolveTenancyPosture()` asks the ENVIRONMENT, so this gate issues no query and the
-  // pinned batch-equivalence query multiset cannot move whichever way it answers.
-  const legacyGrantAnchorRetired = postureEnforcesWall(resolveTenancyPosture());
   let hasPlatformAdminGrant = false;
 
   // 5b. [ADR-0090 D5] Audience anchor: every AUTHENTICATED member implicitly
@@ -1526,28 +1583,23 @@ export async function resolveUserAuthzGrants(
     if (!name) continue;
     const body = await catalogSetBody(catalog, name);
     if (!body) continue;
-    const ownGrant = grantOrganizationOf(grant) !== null;
     const active = !disabled.permissions.has(name);
     take(body, active);
-    // platform_admin (ADR-0068 D2) is DERIVED from an UNSCOPED admin_full_access
+    // platform_admin (ADR-0068 D2) is DERIVED from the anchoring admin_full_access
     // USER grant — the single source of truth (no trusted stored boolean). The
-    // set is the catalog's one `admin_full_access` (ADR-0131 D4); an
-    // organization's grant of it confers the set, never platform standing.
+    // set is the catalog's one `admin_full_access` (ADR-0131 D4); a grant the
+    // anchor does not read (any other organization's, and every grant under a
+    // wall) confers the set, never platform standing.
     //
     // [ADR-0049] A DEACTIVATED set confers no standing either: a deactivated
     // `admin_full_access` must not keep conferring PLATFORM_ADMIN.
     //
-    // [#11663 L5] `legacyGrantAnchorRetired` gates the ANCHOR, not the grant: the
-    // set's own name and capabilities are pushed below exactly as for any other
-    // held set, on every posture. What a walled rig stops deriving from the
-    // grant is PLATFORM_ADMIN STANDING — the rung, the built-in
-    // `platform_admin` position and everything downstream of them.
-    if (
-      !ownGrant
-      && body.name === ADMIN_FULL_ACCESS
-      && active
-      && !legacyGrantAnchorRetired
-    ) {
+    // [#11663 L5] The posture gates the ANCHOR, not the grant: the set's own name
+    // and capabilities are pushed below exactly as for any other held set, on
+    // every posture. What a walled rig stops deriving from the grant is
+    // PLATFORM_ADMIN STANDING — the rung, the built-in `platform_admin` position
+    // and everything downstream of them.
+    if (anchorsPlatformStanding(grant) && active) {
       hasPlatformAdminGrant = true;
     }
   }
@@ -1582,8 +1634,8 @@ export async function resolveUserAuthzGrants(
   //     ADDITIVE, never subtractive: nothing above is revoked here (design §5
   //     step 3). A deployment that has declared no administrators resolves
   //     exactly as it did — `platformAdminConfig.emails` is empty and the branch
-  //     short-circuits before it looks at any row. Under `single` the legacy grant
-  //     read above then remains the only anchor; under a WALLED posture [#11663 L5]
+  //     short-circuits before it looks at any row. Under `single` the grant anchor
+  //     read above (§6) then remains the only anchor; under a WALLED posture [#11663 L5]
   //     that read is retired, so an undeclared walled rig has NO platform
   //     administrator — which is the fail-closed answer the boot-side backstop in
   //     `plugin-security` announces at startup.
@@ -1622,7 +1674,7 @@ export async function resolveUserAuthzGrants(
 
   // 6d. [ADR-0095 D2/D3] Resolve the posture rung ONCE, from held CAPABILITY
   //     grants — never from a better-auth role. `PLATFORM_ADMIN` from the
-  //     unscoped `admin_full_access` grant (the same `viewAllRecords`/
+  //     anchoring `admin_full_access` grant (the same `viewAllRecords`/
   //     `modifyAllRecords` evidence the superuser bypass trusts); `TENANT_ADMIN`
   //     from the `organization_admin` grant (auto-provisioned from the better-
   //     auth owner/admin role at §3 above — a provisioning source, not an
@@ -1668,7 +1720,9 @@ export async function resolveUserAuthzGrants(
  *
  * ADR-0068 D2 defined PLATFORM standing as one thing: an UNSCOPED
  * (`organization_id = null`) `sys_user_permission_set` grant on the
- * `admin_full_access` set, held **now**. Since #11663 L2 there is a SECOND
+ * `admin_full_access` set, held **now** — under `single` since ADR-0131 D5 the
+ * grant owned by the Default Organization, beside that legacy row (§6,
+ * {@link grantAnchorsPlatformStanding}). Since #11663 L2 there is a SECOND
  * anchor beside it — a `sys_user` row whose VERIFIED email is on the
  * deployment's declared administrator list (`OS_PLATFORM_OWNER_EMAIL`) — and
  * this predicate answers for both, for free, because it is a projection rather
@@ -1679,7 +1733,7 @@ export async function resolveUserAuthzGrants(
  *
  * It is a PROJECTION of {@link resolveUserAuthzGrants}, never a second
  * derivation: the answer is the `PLATFORM_ADMIN` rung of the posture ladder,
- * and that rung is derived from the unscoped-grant evidence and nothing else.
+ * and that rung is derived from the anchoring-grant evidence and nothing else.
  * Everything that governs those grants therefore applies here by construction
  * and cannot drift from it — the ADR-0091 validity window (§6), the ADR-0049
  * `active` flag on the catalogue row (§6b), the system-identity read, and the
 
@@ -34,11 +34,12 @@
  *      `plugin-security`'s `resolvePlatformAdminStanding` serves the audit
  *      surface with, so the account this helper binds is the account the
  *      audit surface reports as holding standing.
- *   2. **Legacy grant anchor** (Choice 4A), **under a NON-WALLED posture
- *      only**: the oldest unscoped `sys_user_permission_set` row on
- *      `admin_full_access`. This is what still anchors `single`-posture
- *      deployments — first-user promotion keeps writing the grant row there,
- *      by ruling, and #11979 is the card that disposes of it.
+ *   2. **Grant anchor** (Choice 4A), **under a NON-WALLED posture
+ *      only**: the oldest `sys_user_permission_set` row on `admin_full_access`
+ *      owned by the Default Organization, or by none (a row written before
+ *      ADR-0131 D5 moved its owner). This is what still anchors
+ *      `single`-posture deployments — first-user promotion keeps writing the
+ *      grant row there, by ruling, owned by the Default Organization (#11979).
  *
  *      ⛔ Under a walled posture this anchor is RETIRED. P5's honoured
  *      migration window closed with the legacy-grant removal leg (design §5
@@ -85,6 +86,7 @@ import { postureEnforcesWall } from '@objectstack/spec/security';
 import { resolveTenancyPosture } from '@objectstack/types';
 import { GRANT_SET_NAME_FIELD } from './grant-set-name.js';
 import { permissionSetInEffect } from './catalog-set-in-effect.js';
+import { resolveDefaultOrgId } from './tenancy-service.js';
 
 interface BootstrapLogger {
   info: (message: string, meta?: Record<string, any>) => void;
@@ -443,8 +445,9 @@ export async function ensureDefaultOrganization(
   //    exactly as before (Choice 4A).
   let adminUserId: string | undefined = await findConfigAnchoredAdminUserId(ql);
 
-  // 2. LEGACY grant anchor (oldest cross-tenant `admin_full_access` grant) —
-  //    still what anchors `single` posture (Choice 4A; #11979 disposes of it),
+  // 2. GRANT anchor (oldest `admin_full_access` grant owned by the Default
+  //    Organization or by none) — what anchors `single` posture (Choice 4A;
+  //    ADR-0131 D5 owns the promotion's row by the Default Organization),
   //    and ⛔ RETIRED under a wall [#11663 L5].
   //
   //    The key is the derivation site's own expression, read from the
@@ -489,12 +492,24 @@ export async function ensureDefaultOrganization(
     // confers nothing. The answer is then `no_admin`, which decides nothing
     // (`default-org-bootstrap-once.ts` records no decision on it), so a later
     // trigger binds once the grant names its set.
-    const adminGrants = await tryFind(
-      ql,
-      'sys_user_permission_set',
-      { [GRANT_SET_NAME_FIELD]: 'admin_full_access', organization_id: null },
-      50,
-    );
+    //
+    // [ADR-0131 D5] …owned by the Default Organization, which is the owner
+    // `single`'s first-user promotion writes, or by no organization, which is
+    // the row an earlier release's promotion wrote before D10's ceremony
+    // attributed it — the two the derivation site reads as the anchor
+    // (`grantAnchorsPlatformStanding`, `resolve-authz-context.ts`). Reading only
+    // the organization-less row would answer `no_admin` on every deployment
+    // promoted since, and never bind its administrator.
+    const defaultOrgId = await resolveDefaultOrgId(ql);
+    const adminGrants: any[] = [];
+    for (const organizationId of defaultOrgId ? [null, defaultOrgId] : [null]) {
+      adminGrants.push(...await tryFind(
+        ql,
+        'sys_user_permission_set',
+        { [GRANT_SET_NAME_FIELD]: 'admin_full_access', organization_id: organizationId },
+        50,
+      ));
+    }
     if (adminGrants.length === 0) {
       return { defaultOrgCreated: false, memberCreated: false, reason: 'no_admin' };
     }