@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): a delegated refusal names one reason for a target user the caller cannot read
+
+Clause-②: no — no accept set changes at the write door: every write refused before is still refused, and every write admitted is still admitted. No error code, class or status is added: the answer is the gate's existing scope violation.
+Metadata-protocol: none
+
+- **Rule.** A target user is inside a delegated business-unit subtree only through a business unit of that subtree. A delegated administrator's direct permission-set grant whose target user is outside the subtree is refused with one answer, whether or not the user exists or holds a business-unit membership: `403 DELEGATION_SCOPE_VIOLATION`, the same sentence ("target user … is outside the delegated subtree") and the same details.
+- **A target the caller cannot read.** A target user the grant names (a new grant, or a stored grant pointed at another user) is first asked of the caller's own read door, the question the engine's reference check asks of that user. A user the caller cannot read is answered as a user that does not exist, so it is outside the subtree and gets the same answer.
+- **What a client sees.** A grant to a target user who holds no business-unit membership, or whom the caller cannot read, answers that scope violation, so a console shows its reason, as it does for every other target outside the subtree.
+- **Unchanged.** A target user the caller reads, with a business unit inside the subtree, is admitted exactly as before.
@@ -1818,15 +1818,16 @@ describe('[#26189] DelegatedAdminGate — a scope violation answers DELEGATION_S
       expectOpaqueDenial(await refusalOf(() => grant({ user_id: 'u_east_1', permission_set: 'sub_admin' })), 'sys_user_permission_set');
     });
 
-    it('a stored grant whose set the catalog does not hold, a grant naming no target user, or one whose target has no business unit', async () => {
+    it('a stored grant whose set the catalog does not hold, or a grant naming no target user', async () => {
       // An INSERT naming an unknown set is judged by the allowlist (a scope
-      // violation, above); the catalog miss is the PRE-IMAGE's reason.
+      // violation, above); the catalog miss is the PRE-IMAGE's reason. A target
+      // user with no business unit is outside the subtree: the describe at the
+      // foot of this file.
       h.tables.sys_user_permission_set = [{ id: 'g_retired', user_id: 'u_east_1', permission_set: 'sales_user_retired' }];
       expectOpaqueDenial(await refusalOf(() => h.gate.assert({
         object: 'sys_user_permission_set', operation: 'delete', options: { where: { id: 'g_retired' } }, context: h.ctxOf('delegate'),
       })), 'sys_user_permission_set');
       expectOpaqueDenial(await refusalOf(() => grant({ permission_set: 'sales_user' })), 'sys_user_permission_set');
-      expectOpaqueDenial(await refusalOf(() => grant({ user_id: 'u_delegate', permission_set: 'sales_user' })), 'sys_user_permission_set');
     });
 
     it('a self-service delegation of duty (ADR-0091 D3)', async () => {
@@ -1836,3 +1837,122 @@ describe('[#26189] DelegatedAdminGate — a scope violation answers DELEGATION_S
     });
   });
 });
+
+// ── [ADR-0090 D12; ruling on #26059, Q3] A target user is inside the delegated
+//    subtree only through a business unit of the subtree, so a direct grant to a
+//    target outside it is refused with ONE reason, whether or not the user
+//    exists or holds a business-unit membership: the same class, code, status,
+//    sentence and details, on the thrown value and on the REST door's
+//    classification (`mapDataError`). A target user the write NAMES is first
+//    asked of the caller's own read door, as the engine's reference check asks
+//    it: one the caller cannot read is answered as one that does not exist, so
+//    it is outside the subtree too. One target id, its stored states, and every
+//    write shape that judges a target user.
+
+describe('[ADR-0090 D12] a delegated refusal names one reason for a target user outside the subtree, whether or not the user exists or holds a business-unit membership', () => {
+  const TARGET = 'u_target';
+  const STATES = [
+    'an id naming no user',
+    'a user with no business-unit membership',
+    'a user whose business unit is outside the subtree',
+  ] as const;
+  /** A state only a write that NAMES the target meets: the caller's read door is asked about it. */
+  const UNREADABLE_INSIDE = 'a user with a business unit inside the subtree whom the caller cannot read';
+  const READABLE_INSIDE = 'a user with a business unit inside the subtree whom the caller reads';
+  type TargetState = (typeof STATES)[number] | typeof UNREADABLE_INSIDE | typeof READABLE_INSIDE;
+
+  /**
+   * A fresh harness with `TARGET` in `state`, over the engine the gate meets in
+   * a real composition: `sys_user` registered and the grant's `user_id` a
+   * lookup to it (the conditions under which the engine's reference check asks
+   * the caller's read door), and a caller read of `sys_user` that returns no
+   * row for a user the caller cannot read. A system read returns every row.
+   */
+  function harnessWith(state: TargetState): ReturnType<typeof makeHarness> {
+    const harness = makeHarness();
+    const unreadable = new Set<string>();
+    const { find, findOne } = harness.ql;
+    const served = (object: string, opts: any, row: any) =>
+      !(object === 'sys_user' && !opts?.context?.isSystem && unreadable.has(row?.id));
+    harness.ql.find = async (object: string, opts: any) =>
+      (await find.call(harness.ql, object, opts)).filter((row: any) => served(object, opts, row));
+    harness.ql.findOne = async (object: string, opts: any) => {
+      const row = await findOne.call(harness.ql, object, opts);
+      return row && served(object, opts, row) ? row : null;
+    };
+    const SCHEMAS: Record<string, unknown> = {
+      sys_user: { name: 'sys_user', fields: {} },
+      sys_user_permission_set: { name: 'sys_user_permission_set', fields: { user_id: { type: 'lookup', reference: 'sys_user' } } },
+    };
+    harness.ql.getSchema = (name: string) => SCHEMAS[name];
+    if (state === 'an id naming no user') return harness;
+    harness.tables.sys_user.push({ id: TARGET });
+    if (state === 'a user whose business unit is outside the subtree') {
+      harness.tables.sys_business_unit_member.push({ id: 'm_target', business_unit_id: 'bu_west', user_id: TARGET });
+    }
+    if (state === UNREADABLE_INSIDE || state === READABLE_INSIDE) {
+      harness.tables.sys_business_unit_member.push({ id: 'm_target', business_unit_id: 'bu_es', user_id: TARGET });
+    }
+    if (state === UNREADABLE_INSIDE) unreadable.add(TARGET);
+    return harness;
+  }
+
+  /**
+   * Every write shape that judges a target user, as `[operation, write, names]`:
+   * a new grant and a stored grant pointed at the target NAME it; a stored
+   * grant of the target removed holds it as stored. Each write is the gate's
+   * own `assert`, never an engine double.
+   */
+  const WRITES: ReadonlyArray<readonly [string, (harness: ReturnType<typeof makeHarness>) => Promise<void>, boolean]> = [
+    ['insert', (harness) => harness.gate.assert({
+      object: 'sys_user_permission_set', operation: 'insert',
+      data: { user_id: TARGET, permission_set: 'sales_user' }, context: harness.ctxOf('delegate'),
+    }), true],
+    ['update', (harness) => {
+      harness.tables.sys_user_permission_set = [{ id: 'g_east', user_id: 'u_east_1', permission_set: 'sales_user' }];
+      return harness.gate.assert({
+        object: 'sys_user_permission_set', operation: 'update',
+        data: { id: 'g_east', user_id: TARGET }, context: harness.ctxOf('delegate'),
+      });
+    }, true],
+    ['delete', (harness) => {
+      harness.tables.sys_user_permission_set = [{ id: 'g_target', user_id: TARGET, permission_set: 'sales_user' }];
+      return harness.gate.assert({
+        object: 'sys_user_permission_set', operation: 'delete',
+        options: { where: { id: 'g_target' } }, context: harness.ctxOf('delegate'),
+      });
+    }, false],
+  ];
+
+  /** Everything a caller is told by a refusal: the thrown value and the REST door's envelope. */
+  const answerOf = (err: any) => ({
+    class: err?.constructor?.name,
+    name: err?.name,
+    code: err?.code,
+    status: err?.status,
+    statusCode: err?.statusCode,
+    message: err?.message,
+    details: err?.details,
+    wire: mapDataError(err, 'sys_user_permission_set'),
+  });
+
+  for (const [shape, write, names] of WRITES) {
+    const states: TargetState[] = names ? [...STATES, UNREADABLE_INSIDE] : [...STATES];
+    it(`${shape}: the ${states.length} target states answer the same scope-violation refusal`, async () => {
+      const answers: Array<ReturnType<typeof answerOf>> = [];
+      for (const state of states) answers.push(answerOf(await refusalOf(() => write(harnessWith(state)))));
+      for (const [i, answer] of answers.entries()) expect(answer, states[i]).toEqual(answers[0]);
+      // The one answer is the caller's own scope: the target outside the subtree.
+      const err = await refusalOf(() => write(harnessWith('an id naming no user')));
+      expectScopeViolation(err, 'sys_user_permission_set',
+        /^\[Security\] Outside your delegated scope: delegated '\w+' on sys_user_permission_set rejected — target user 'u_target' is outside the delegated subtree \(scope from 'sub_admin'\)\.$/);
+      expect(err.details).toEqual({ operation: shape, object: 'sys_user_permission_set', permissionSet: 'sales_user' });
+    });
+  }
+
+  it('CONTROL: the same target with a business unit inside the subtree, read by the caller, is admitted on every write shape', async () => {
+    for (const [shape, write] of WRITES) {
+      await expect(write(harnessWith(READABLE_INSIDE)), shape).resolves.toBeUndefined();
+    }
+  });
+});
@@ -543,6 +543,45 @@ function mayName(t: DelegatedTarget, side: 'next' | 'prev', column: string): boo
   return t.reads.has(column);
 }
 
+/** The direct-grant holder column, and the object it references. */
+const GRANT_HOLDER_FIELD = 'user_id';
+const GRANT_HOLDER_OBJECT = 'sys_user';
+
+/**
+ * Does the write NAME the grant's holder — an insert's row, or an update whose
+ * payload points the grant at a different user than the row stores? A holder
+ * the row already stores is not named: the engine's reference check forgives
+ * a value the row stores, and the grant-holder membership hook judges it as
+ * stored (`grant-holder-membership-refusal.ts`, `onUpdate`).
+ */
+function namesTargetUser(t: DelegatedTarget): boolean {
+  if (!t.next) return false;
+  if (!t.prev) return true;
+  const norm = (v: unknown) => (v === undefined || v === null || v === '' ? null : String(v));
+  return norm(t.next[GRANT_HOLDER_FIELD]) !== norm(t.prev[GRANT_HOLDER_FIELD]);
+}
+
+/**
+ * Does the engine's reference check ask the caller's own read door about the
+ * holder `object`'s write names, and refuse one it does not return? It asks
+ * when the live schema's `user_id` is a non-`readonly` `lookup` / `user`
+ * reference to `sys_user` and `sys_user` is registered
+ * (`assertReferencesResolve`, `@objectstack/objectql`; the grant-holder
+ * membership hook's `referenceCheckAsksCaller` steps aside on the same test).
+ * The direct-grant object declares that reference itself
+ * (`sys-user-permission-set.object.ts`), so its target is not resolved again
+ * here: the test reads only what a composition can still change, whether
+ * `sys_user` is registered and whether the live field is still a writable
+ * lookup. Anywhere else, an engine that hands over no schema included, it
+ * answers no, and the holder is judged on its memberships alone: the gate
+ * refuses no named holder the write would not be refused for anyway.
+ */
+function referenceCheckAsksCallerAboutUser(ql: any, object: string): boolean {
+  if (typeof ql?.getSchema !== 'function' || !ql.getSchema(GRANT_HOLDER_OBJECT)) return false;
+  const def = ql.getSchema(object)?.fields?.[GRANT_HOLDER_FIELD];
+  return Boolean(def) && def.readonly !== true && (def.type === 'lookup' || def.type === 'user');
+}
+
 export class DelegatedAdminGate {
   constructor(private readonly deps: DelegatedAdminGateDeps) {}
 
@@ -1075,6 +1114,35 @@ export class DelegatedAdminGate {
     return row && typeof row === 'object' ? row : null;
   }
 
+  /**
+   * Does the caller's own read door return user `userId`? The question the
+   * engine's reference check asks of a `user_id` a write names
+   * (`masterDetailHeadersCallerReads`, `@objectstack/objectql`) and the
+   * grant-holder membership hook asks before it
+   * (`grant-holder-membership-refusal.ts`, `callerReadsHolder`): one `sys_user`
+   * read WHERE `id` equals the value, projected to `id`, under the caller's
+   * own context, so every read visibility and wall answers it, and only a row
+   * whose id IS the value counts. A user it does not return is a user the
+   * caller cannot read, answered as a user that does not exist (the
+   * platform's rule for every user a non-system write names). A read the read
+   * door REFUSES (a declared 4xx) returns no user either; a store fault
+   * propagates as raised, as for the gate's other reads: an outage is neither
+   * an answer nor a refusal.
+   */
+  private async callerReadsUser(opCtx: any, userId: string): Promise<boolean> {
+    const ql = this.deps.ql;
+    if (!ql?.find) return false;
+    let rows: unknown;
+    try {
+      rows = await ql.find(GRANT_HOLDER_OBJECT, { where: { id: userId }, fields: ['id'], context: opCtx.context });
+    } catch (e) {
+      const status = declaredHttpStatus(e);
+      if (status !== undefined && status < 500) return false;
+      throw e;
+    }
+    return (Array.isArray(rows) ? rows : []).some((r: any) => r?.id != null && String(r.id) === userId);
+  }
+
   /**
    * Is position `positionName` inside the organization boundary? `null` when
    * every set it carries is; otherwise the first failure, naming the set.
@@ -1465,7 +1533,16 @@ export class DelegatedAdminGate {
       const row = t.next ?? t.prev ?? {};
       const { setRow, setName, unresolved, setNamed } = await this.directGrantSet(t, row);
       const targetUserId = row.user_id ? String(row.user_id) : null;
-      const userBUs = targetUserId ? await this.businessUnitsOfUser(targetUserId) : new Set<string>();
+      // A target user the write NAMES, where the engine's reference check asks
+      // the caller's read door about it, is first asked of that door
+      // ({@link callerReadsUser}): a user it does not return is answered as a
+      // user that does not exist, which holds no business unit the subtree can
+      // cover. So an unreadable target is outside the subtree, whatever it is.
+      const userBUs = targetUserId
+        && (!namesTargetUser(t) || !referenceCheckAsksCallerAboutUser(this.deps.ql, opCtx.object)
+          || (await this.callerReadsUser(opCtx, targetUserId)))
+        ? await this.businessUnitsOfUser(targetUserId)
+        : new Set<string>();
       // [ruling of record 6649064874] Named only when the caller
       // wrote or reads it ({@link mayName}); the verdict is the stored row's.
       const userNamed = mayName(t, side, 'user_id');
@@ -1479,12 +1556,15 @@ export class DelegatedAdminGate {
             : "the grant's permission set is not in the scope's allowlist");
         }
         if (!targetUserId) return 'the grant names no target user';
-        if (userBUs.size === 0) {
-          return `${userNamed ? `target user '${targetUserId}'` : "the grant's target user"} has no business-unit membership — only a tenant admin may grant outside the tree`;
-        }
-        let inSubtree = false;
-        for (const bu of userBUs) if (s.subtree.has(bu)) { inSubtree = true; break; }
-        if (!inSubtree) {
+        // [ADR-0090 D12; ruling on #26059, Q3] A target user is inside the
+        // subtree only through a business unit of the subtree. A user holding
+        // no business-unit membership has none, and neither has an id naming
+        // no user, nor a named user the caller cannot read (above): each is
+        // outside the subtree, exactly as a user whose units all lie elsewhere
+        // is. So the refusal is one reason, one class, one sentence and one set
+        // of details for all of them, whether or not the target exists or
+        // holds a membership.
+        if (![...userBUs].some((bu) => s.subtree.has(bu))) {
           return outsideScope(userNamed
             ? `target user '${targetUserId}' is outside the delegated subtree`
             : "the grant's target user is outside the delegated subtree");