@@ -0,0 +1,29 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/plugin-security': patch
+'@objectstack/spec': patch
+---
+
+fix(metadata-protocol)!: a permission set that grants a hierarchy scope is refused on publish, and warned on a draft save, when the runtime mounts no hierarchy resolver; explain names the absent resolver (#26188)
+
+Clause-②: yes (narrowing: on a runtime with no hierarchy resolver, publishing a permission set whose grant uses `own_and_reports`, `unit` or `unit_and_below` is refused, where it used to answer 200; widened: `@objectstack/spec/security` gains the export `findHierarchyScopeGrants`, and `@objectstack/plugin-security`'s `ExplainEngineDeps` gains the optional member `hierarchyResolverMounted`)
+Metadata-protocol: none
+Ruling-ref: #26059 ruling Q3 / Q4 (`6416233738`), items 9a and 9b of the item reading (`6415971852`)
+
+`own_and_reports`, `unit` and `unit_and_below` are enforced only by the enterprise hierarchy resolver (capability `hierarchy-security`, ADR-0057). Without it the open sharing service evaluates them as `own`. `defineStack` already refuses such a grant unless the stack declares `requires: ['hierarchy-security']`, but a runtime save of the same permission set answered 200 with no word, and explain then told a manager that a subordinate's record was outside their unit.
+
+What changes:
+
+- The runtime authoring gate reads whether a hierarchy resolver is mounted (the kernel service `hierarchy-scope-resolver`) on every metadata write. When none is, a permission set whose `readScope` or `writeScope` is a hierarchy depth is refused on publish: a direct active save, the per-item publish of a draft, the package batch publish and a restore to such a version all answer 422 `INVALID_METADATA`, with one `issues[]` entry per grant under the rule `hierarchy-scope-capability-required`. The entry is located at the grant and names the `hierarchy-security` requirement.
+- A draft save of the same body still succeeds. Its answer carries the same finding, at `severity: 'warning'`, in `advisories`.
+- With a resolver mounted, nothing changes. A host with no service registry (the CLI) judges nothing here; `defineStack` is that host's door.
+- `explainAccess`: on a deployment with no resolver, the depth layer's record cell for a hierarchy read depth now reads "Hierarchy resolver absent — requires enterprise; depth evaluated as 'own'." instead of saying the owner is outside the caller's read depth.
+- `@objectstack/spec/security` exports `findHierarchyScopeGrants`, the one list of hierarchy depths and the one finding sentence. `defineStack`'s refusal reads it too, and its message is unchanged.
+
+**BREAKING** for a runtime with no hierarchy resolver that publishes hierarchy-scope grants at runtime.
+
+- **Before.** The publish answered 200 and the grant was enforced as owner-only.
+- **Now.** The publish answers 422 `INVALID_METADATA` with the rule `hierarchy-scope-capability-required`. A draft save warns.
+- **Fix.** Set the grant's `readScope` / `writeScope` to `own` or `org`, or run the permission set on a runtime that mounts the enterprise hierarchy resolver (`hierarchy-security`). Rows already stored are read as before.
+
+<!-- adr-0087: not-required (no-migration-prescription) a run-time narrowing at the metadata publish door, conditional on a deployment fact (no hierarchy resolver mounted). No authorable key, spelling or stored shape moves: the permission-set schema parses exactly as before, `defineStack` already refused the same grant, and no stored row is read, rewritten or converted. The repair is the author's choice between a non-hierarchy depth and an enterprise runtime, which no ledger entry can derive. The other categories are closed on facts: the packages publish (not unpublished); no ADR-0087 id covers this verdict (not already-registered); the one spec export is added, not moved, renamed or removed; and nothing a stored artifact carries changes type, so no conversion has a source to rewrite. -->
@@ -72,6 +72,7 @@ export interface AuthoringGateHost {
     readonly engine: ObjectStackProtocolImplementation['engine'];
     externalBindingSaveRefusal: ObjectStackProtocolImplementation['externalBindingSaveRefusal'];
     foldStoredCollection: ObjectStackProtocolImplementation['foldStoredCollection'];
+    hierarchyResolverMounted: ObjectStackProtocolImplementation['hierarchyResolverMounted'];
     isArtifactBacked: ObjectStackProtocolImplementation['isArtifactBacked'];
     orgWallEnforced: ObjectStackProtocolImplementation['orgWallEnforced'];
     refuseRestoredBodyTheSaveDoorRefuses: ObjectStackProtocolImplementation['refuseRestoredBodyTheSaveDoorRefuses'];
@@ -168,7 +169,7 @@ export async function runAuthoringGate(
 
 /** The body of `ObjectStackProtocolImplementation#assertRuntimeAuthoringRules`; the method's docblock there is its contract. */
 export async function assertRuntimeAuthoringRules(
-    this: Pick<AuthoringGateHost, 'authoringChannel' | 'engine' | 'foldStoredCollection' | 'orgWallEnforced' | 'resolveSduiManifest' | 'resolveWritePackageScope' | 'rlsMembershipResolverKeys' | 'tenancyPostureInForce'>,
+    this: Pick<AuthoringGateHost, 'authoringChannel' | 'engine' | 'foldStoredCollection' | 'hierarchyResolverMounted' | 'orgWallEnforced' | 'resolveSduiManifest' | 'resolveWritePackageScope' | 'rlsMembershipResolverKeys' | 'tenancyPostureInForce'>,
     evt: {
     type: string; name: string; state: 'draft' | 'active'; body: unknown; source?: string;
     /**
@@ -250,7 +251,21 @@ export async function assertRuntimeAuthoringRules(
     // proxy, which cost the ADR-0090 D11 object posture gate every
     // host-config deployment until #7674 finished the move.
     if (this.authoringChannel === 'package-author') return [];
-    if (evt.state !== 'active') return [];
+    if (evt.state !== 'active') {
+        // [#26188] D1: no rule gates a draft. The one finding a draft does hear
+        // is a hierarchy scope this runtime cannot enforce, as a warning on the
+        // 2xx; it needs no collection read, so the draft keeps paying none.
+        // A `migrate-stored` pass heals storage and hears nothing (see below).
+        if (evt.source === 'migrate-stored') return [];
+        const hierarchyResolverMounted = this.hierarchyResolverMounted();
+        return evaluateRuntimeAuthoringGate({
+            type: PLURAL_TO_SINGULAR[evt.type] ?? evt.type,
+            name: evt.name,
+            state: evt.state,
+            body: evt.body,
+            ...(hierarchyResolverMounted !== undefined ? { hierarchyResolverMounted } : {}),
+        }).advisories;
+    }
     // `os migrate meta --stored --apply` rewrites rows that ALREADY EXIST
     // into the current dialect. It is not an author publishing anything —
     // it is the platform healing its own storage — and #4463 D4 is explicit
@@ -372,6 +387,10 @@ export async function assertRuntimeAuthoringRules(
     // gate stays pure.
     const rlsMembershipResolverKeys = this.rlsMembershipResolverKeys();
 
+    // [#26188] Is a hierarchy resolver mounted — a host fact of the same kind,
+    // read here per publish and passed in so the gate stays pure.
+    const hierarchyResolverMounted = this.hierarchyResolverMounted();
+
     const verdict = evaluateRuntimeAuthoringGate({
         type: singular,
         name: evt.name,
@@ -398,6 +417,8 @@ export async function assertRuntimeAuthoringRules(
         // [#25234] The resolver's keys, read per publish; with them the
         // gate judges who owns each membership key.
         ...(rlsMembershipResolverKeys !== undefined ? { rlsMembershipResolverKeys } : {}),
+        // [#26188] With it the gate refuses a hierarchy scope no resolver enforces.
+        ...(hierarchyResolverMounted !== undefined ? { hierarchyResolverMounted } : {}),
     });
     if (verdict.error) throw verdict.error;
     return verdict.advisories;
 
@@ -50,7 +50,12 @@ import { ObjectStackProtocolImplementation } from './protocol.js';
 import type { MetadataAuthoringChannel } from './protocol.js';
 import { SDUI_MANIFEST_SERVICE } from './index.js';
 import { RLS_MEMBERSHIP_RESOLVER_SERVICE } from '@objectstack/spec/contracts';
-import { PUBLIC_FORM_INTAKE_UNAVAILABLE, stampHtmlPageRequires } from './runtime-authoring-gate.js';
+import {
+    HIERARCHY_SCOPE_CAPABILITY_REQUIRED,
+    HIERARCHY_SCOPE_RESOLVER_SERVICE,
+    PUBLIC_FORM_INTAKE_UNAVAILABLE,
+    stampHtmlPageRequires,
+} from './runtime-authoring-gate.js';
 
 /** The issue's body. Zod-valid: `approvers[].value` is just a string to the schema. */
 const brokenApprovalFlow = () => ({
@@ -4720,3 +4725,88 @@ describe('runtime authoring gate on VIEW writes — a public form declaring a fi
         expect(activeViewRows(rows)).toHaveLength(1);
     });
 });
+
+// ─────────────────────────────────────────────────────────────────────────────
+// #26188 — a HIERARCHY scope on a runtime with no hierarchy resolver. The door
+// reads resolver presence per write (`HIERARCHY_SCOPE_RESOLVER_SERVICE`): with
+// none, publishing the grant is refused and a draft save answers 200 carrying
+// the same finding as a `warning` advisory; with one, nothing changes. The pure
+// rows are `runtime-authoring-gate.hierarchy-scope.test.ts`.
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('runtime authoring gate on PERMISSION writes — hierarchy scope without a resolver (#26188)', () => {
+    let warn: ReturnType<typeof vi.spyOn>;
+    beforeEach(() => {
+        warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+    afterEach(() => {
+        warn.mockRestore();
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+
+    const managerSet = () => ({
+        name: 'sales_manager',
+        label: 'Sales Manager',
+        objects: { leave_request: { allowRead: true, readScope: 'unit_and_below' } },
+    });
+    const NO_RESOLVER = () => new Map<string, any>();
+    const RESOLVER = () => new Map<string, any>([[HIERARCHY_SCOPE_RESOLVER_SERVICE, { resolveOwnerIds: async () => [] }]]);
+
+    function permissionProtocol(services: () => Map<string, any>) {
+        const { engine, rows } = makeStubEngine();
+        const protocol = new ObjectStackProtocolImplementation(engine, services as any, 'env_test') as any;
+        return { protocol, rows };
+    }
+    const settle = (p: Promise<unknown>) =>
+        p.then((result) => ({ result: result as any, err: null as any }), (err) => ({ result: null as any, err }));
+    const rowsOf = (rows: Map<string, Row>, state: 'draft' | 'active') =>
+        Array.from(rows.values()).filter((r) => r.type === 'permission' && r.state === state);
+    const hierarchyFindings = (list: ReadonlyArray<{ rule: string }> | undefined) =>
+        (list ?? []).filter((i) => i.rule === HIERARCHY_SCOPE_CAPABILITY_REQUIRED);
+
+    it('no resolver, publish: refused 422 INVALID_METADATA naming the grant, and nothing is written', async () => {
+        const { protocol, rows } = permissionProtocol(NO_RESOLVER);
+        const { err } = await settle(protocol.saveMetaItem({ type: 'permission', name: 'sales_manager', item: managerSet() }));
+        expect({ code: err?.code, status: err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        const findings = hierarchyFindings(err.issues);
+        expect(findings).toEqual([expect.objectContaining({
+            severity: 'error',
+            path: 'permissions.sales_manager.objects.leave_request.readScope',
+        })]);
+        expect((findings[0] as any).message).toContain('`hierarchy-security`');
+        expect(rowsOf(rows, 'active')).toHaveLength(0);
+    });
+
+    it('no resolver, draft: saved (200) with the same finding as a warning advisory; publishing it is refused', async () => {
+        const { protocol, rows } = permissionProtocol(NO_RESOLVER);
+        const refused = await settle(protocol.saveMetaItem({ type: 'permission', name: 'sales_manager', item: managerSet() }));
+        const { result, err } = await settle(
+            protocol.saveMetaItem({ type: 'permission', name: 'sales_manager', item: managerSet(), mode: 'draft' }),
+        );
+        expect(err).toBeNull();
+        expect(result).toMatchObject({ success: true, state: 'draft' });
+        const published = hierarchyFindings(refused.err.issues)[0] as Record<string, unknown>;
+        expect(result.advisories).toEqual([{ ...published, severity: 'warning' }]);
+        expect(rowsOf(rows, 'draft')).toHaveLength(1);
+
+        const promoted = await settle(protocol.publishMetaItem({ type: 'permission', name: 'sales_manager' }));
+        expect({ code: promoted.err?.code, status: promoted.err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect(hierarchyFindings(promoted.err.issues)).toHaveLength(1);
+        expect(rowsOf(rows, 'active')).toHaveLength(0);
+    });
+
+    it('a resolver mounted: the same grant publishes, and neither door says anything about it', async () => {
+        const { protocol, rows } = permissionProtocol(RESOLVER);
+        const draft = await settle(
+            protocol.saveMetaItem({ type: 'permission', name: 'sales_manager', item: managerSet(), mode: 'draft' }),
+        );
+        expect(draft.err).toBeNull();
+        expect(hierarchyFindings(draft.result.advisories)).toEqual([]);
+        const live = await settle(protocol.saveMetaItem({ type: 'permission', name: 'sales_manager', item: managerSet() }));
+        expect(live.err).toBeNull();
+        expect(live.result).toMatchObject({ success: true, state: 'active' });
+        expect(hierarchyFindings(live.result.advisories)).toEqual([]);
+        expect(rowsOf(rows, 'active')).toHaveLength(1);
+    });
+});
@@ -27,6 +27,7 @@ import { stripUnauthorableProperties } from './unauthorable-nodes.js';
 // admits anything. See the module header for the predicate and its controls.
 import { markErasedAuthoringInput } from './erased-authoring-mark.js';
 import {
+    HIERARCHY_SCOPE_RESOLVER_SERVICE,
     SDUI_MANIFEST_SERVICE,
     isUsableSduiManifest,
     stampHtmlPageRequires,
@@ -7146,6 +7147,7 @@ export class ObjectStackProtocolImplementation implements
             get authoringChannel() { return readAuthoringChannel(); },
             get engine() { return readEngine(); },
             foldStoredCollection: (...a) => this.foldStoredCollection(...a),
+            hierarchyResolverMounted: (...a) => this.hierarchyResolverMounted(...a),
             orgWallEnforced: (...a) => this.orgWallEnforced(...a),
             resolveSduiManifest: (...a) => this.resolveSduiManifest(...a),
             resolveWritePackageScope: (...a) => this.resolveWritePackageScope(...a),
@@ -7540,6 +7542,30 @@ export class ObjectStackProtocolImplementation implements
         return keys as readonly string[];
     }
 
+    /**
+     * [#26188] Is a hierarchy resolver mounted on this runtime — a service
+     * registered under `HIERARCHY_SCOPE_RESOLVER_SERVICE` (ADR-0057; the
+     * enterprise `hierarchy-security` capability registers one, the open edition
+     * none)? The input the runtime authoring gate refuses an unenforceable
+     * hierarchy scope with on publish, and warns on a draft save with.
+     *
+     * Read per write, as {@link rlsMembershipResolverKeys} reads its service, so a
+     * resolver registered after this protocol is assembled is seen by the next
+     * write; nothing is recorded. `undefined` — the CLI's reading, under which
+     * nothing is judged — when this host has no service registry or the lookup
+     * throws.
+     */
+    private hierarchyResolverMounted(): boolean | undefined {
+        const registry = this.getServicesRegistry?.();
+        if (!registry) return undefined;
+        try {
+            const resolver = registry.get(HIERARCHY_SCOPE_RESOLVER_SERVICE);
+            return resolver !== undefined && resolver !== null;
+        } catch {
+            return undefined;
+        }
+    }
+
     /**
      * Run the registered projector for a just-persisted mutation (ADR-0094).
      * Returns `undefined` when no projector is registered for the type;