@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security)!: a delegated business-unit walk never starts at a unit outside the caller's organization
+
+Clause-②: no (narrowing) — the delegated-administration gate holds the root of every delegated business-unit walk to the same organization as its descendants, so the range a self-delegation's anchor is judged against holds units of the caller's organization only. Nothing is widened: no export, error code or status is added.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export of the package entry changes: a delegation row keeps its shape and meaning, and the range its anchor is judged against is bounded to the caller's organization. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing in the delegated-administration gate (`@objectstack/plugin-security`), only for a self-delegation that is anchored, or whose holding is anchored, at a unit outside the caller's organization.
+
+- **Rule.** ADR-0105 D6 (red line 2): every business-unit mechanism operates within one organization. A delegated business-unit walk, its root included, covers only units of the caller's organization. A self-delegation (ADR-0091 D3) anchored at a unit outside the caller's organization, or whose holding's anchor is outside it, is refused `403 PERMISSION_DENIED` with the same answer as an anchor outside the delegator's range, and nothing is stored.
+- **Unchanged.** An anchor inside the delegator's range, and an unanchored delegation, are admitted as before. A scope's by-name anchor keeps every answer it gave.
+- **Who moves.** Nobody whose delegations and holdings anchor at units of their own organization.
@@ -741,6 +741,73 @@ describe('DelegatedAdminGate — self-delegation anchor containment (cloud#830 f
   });
 });
 
+// ── [ADR-0105 D6] The walk's root is one organization's, on a driver that scopes NOTHING ─
+//
+// Red line 2: every BU mechanism operates within one organization. The
+// harness `ql` ignores `context`, so the root read hands back a unit of any
+// organization and the row-level predicate is the only thing standing — the
+// same predicate the walk applies to every descendant. The posture rig
+// (`delegated-admin-own-name-set.posture.test.ts`) pins the rule through the
+// doors on a real engine; this half also pins an organization-less unit, which
+// a real table cannot hold (its tenant column is NOT NULL, ADR-0131 D1).
+describe("[ADR-0105 D6] DelegatedAdminGate — a delegated business-unit walk never starts at a unit outside the caller's organization", () => {
+  /** A unit of another organization with a unit below it, and an organization-less unit. */
+  function withUnitsOutsideTheOrganization(d: ReturnType<typeof makeAnchoredDelegationHarness>) {
+    d.tables.sys_business_unit.push(
+      { id: 'bu_x', name: 'x_desk', parent_business_unit_id: null, organization_id: 'org_other' },
+      { id: 'bu_x_field', name: 'x_field', parent_business_unit_id: 'bu_x', organization_id: 'org_other' },
+      { id: 'bu_none', name: 'none', parent_business_unit_id: null, organization_id: null },
+    );
+    return d;
+  }
+  const OUTSIDE = ['bu_x', 'bu_x_field', 'bu_none'];
+  /** The refusal of `u_boss`'s delegation anchored at `unit`: its envelope, and its message with the anchor spelled out. */
+  const answerAt = async (d: ReturnType<typeof makeAnchoredDelegationHarness>, unit: string) => {
+    const err = await refusalOf(() => d.delegate('u_boss', d.base({ business_unit_id: unit })));
+    return [err.code, err.status, String(err.message).split(`'${unit}'`).join("'ANCHOR'")];
+  };
+
+  it("an unanchored holding's range holds no root outside the caller's organization: a member unit there is refused as any unit outside the range", async () => {
+    const d = withUnitsOutsideTheOrganization(makeAnchoredDelegationHarness());
+    d.tables.sys_user_position.find((r: any) => r.id === 'ha').business_unit_id = null;
+    d.tables.sys_business_unit_member.push(
+      { id: 'm_boss_x', user_id: 'u_boss', business_unit_id: 'bu_x', organization_id: 'org_other' },
+      { id: 'm_boss_none', user_id: 'u_boss', business_unit_id: 'bu_none', organization_id: DELEGATION_ORG },
+    );
+    const outside = await answerAt(d, 'bu_hq');
+    expect(outside.slice(0, 2), String(outside[2])).toEqual(['PERMISSION_DENIED', 403]);
+    for (const unit of OUTSIDE) expect(await answerAt(d, unit), unit).toEqual(outside);
+    // CONTROL: the member unit of the caller's organization still roots the range.
+    await expect(d.delegate('u_boss', d.base({ business_unit_id: 'bu_es' }))).resolves.toBeUndefined();
+  });
+
+  it("a holding anchored at a unit outside the caller's organization roots no range: no anchor is admitted through it", async () => {
+    // The answer of a holding whose anchor names no unit at all: no range.
+    const noRange = withUnitsOutsideTheOrganization(makeAnchoredDelegationHarness());
+    noRange.tables.sys_user_position.find((r: any) => r.id === 'ha').business_unit_id = 'bu_no_such_unit';
+    const refused = await answerAt(noRange, 'bu_es');
+    expect(refused.slice(0, 2), String(refused[2])).toEqual(['PERMISSION_DENIED', 403]);
+    for (const anchor of ['bu_x', 'bu_none']) {
+      const d = withUnitsOutsideTheOrganization(makeAnchoredDelegationHarness());
+      d.tables.sys_user_position.find((r: any) => r.id === 'ha').business_unit_id = anchor;
+      for (const unit of [...OUTSIDE, 'bu_es']) expect(await answerAt(d, unit), `${anchor} · ${unit}`).toEqual(refused);
+      // CONTROL: unanchored, the delegation is admitted, as before.
+      await expect(d.delegate('u_boss', d.base({}))).resolves.toBeUndefined();
+    }
+  });
+
+  it("CONTROL: a holding anchored at a unit of the caller's organization keeps its subtree, and a unit of another organization under it stays outside", async () => {
+    const d = withUnitsOutsideTheOrganization(makeAnchoredDelegationHarness());
+    d.tables.sys_business_unit.push({ id: 'bu_x_linked', name: 'x_linked', parent_business_unit_id: 'bu_east', organization_id: 'org_other' });
+    for (const unit of ['bu_east', 'bu_es']) {
+      await expect(d.delegate('u_boss', d.base({ business_unit_id: unit })), unit).resolves.toBeUndefined();
+    }
+    const outside = await answerAt(d, 'bu_hq');
+    expect(outside.slice(0, 2), String(outside[2])).toEqual(['PERMISSION_DENIED', 403]);
+    for (const unit of ['bu_x_linked', ...OUTSIDE]) expect(await answerAt(d, unit), unit).toEqual(outside);
+  });
+});
+
 // ── [ADR-0090 D12 / ADR-0105 D8] describeDelegableScope — the READ half ──────
 //
 // A picker narrows with this; the gate still decides. So the property that
 
@@ -1752,11 +1752,31 @@ export class DelegatedAdminGate {
    *  state on a stamped store, `organization-scope.ts`, so met only on a store
    *  whose units carry no organization at all): organization-less descendants
    *  only, so a stamped unit is never reached from one, nor one from a stamped
-   *  root. */
+   *  root.
+   *
+   *  [ADR-0105 D6, red line 2: BU trees remain org-internal] The ROOT is held
+   *  to the same bound as its descendants: it is read under the bound's own
+   *  context, and a root whose row is not a unit of `organizationId` (`null`:
+   *  an organization-less unit) covers nothing — a walk never starts at a unit
+   *  outside the organization it is bounded to, whichever caller names the
+   *  id. */
   private async resolveSubtreeById(rootId: string, organizationId: string | null): Promise<Set<string>> {
     const ids = new Set<string>();
     const ql = this.deps.ql;
     if (!ql?.find || !rootId) return ids;
+    let roots: any[] = [];
+    try {
+      roots = await ql.find('sys_business_unit', {
+        where: { id: String(rootId) },
+        limit: 1, // `id` is the key: one unit or none
+        context: organizationScopedCtx(organizationId ?? undefined),
+      });
+    } catch { roots = []; }
+    // The descendants' predicate, applied to the root: whatever a driver
+    // returned, a unit outside the bound's organization roots no subtree.
+    const rootInOrganization = (Array.isArray(roots) ? roots : [])
+      .some((r: any) => String(r?.id ?? '') === String(rootId) && rowOrganizationId(r) === organizationId);
+    if (!rootInOrganization) return ids;
     ids.add(String(rootId));
     let frontier: string[] = [String(rootId)];
     for (let depth = 0; depth < MAX_TREE_DEPTH && frontier.length > 0; depth++) {
@@ -1788,7 +1808,11 @@ export class DelegatedAdminGate {
    *  resolves the depth anchor to the holder's own membership). A self-delegated
    *  `business_unit_id` anchor must fall inside this set. Fail-closed:
    *  unresolvable holdings/memberships contribute nothing, so an anchor that
-   *  can't be proven inside the delegator's range is refused upstream. */
+   *  can't be proven inside the delegator's range is refused upstream.
+   *
+   *  Every subtree in the union is one organization's, the caller's, its root
+   *  included ({@link resolveSubtreeById}): a holding's anchor or a membership
+   *  that is not a unit of the caller's organization contributes nothing. */
   private async delegatorAnchorSubtree(
     userId: string,
     directHoldings: Array<{ businessUnitId: string | null }>,