@@ -0,0 +1,16 @@
+---
+'@objectstack/scenarios': patch
+---
+
+fix(scenarios): the scenario runner's seed owns a row only by a person the row names, and loads each persona's person row with its user
+
+Clause-②: yes (widening) — `./runner` gains two exports, `personaRecords` (the record binding: each persona's `record` row, `object/id` → persona) and `rowOwner` (the persona a seed row is owned by). `personaHandles` keeps its signature and is now the handle map only: it holds a value from a direct scope rule on a declared user-handle field (`account.owner` = `u_sam`), no longer a row id or option value from any other direct scope rule (`e06`, `public`); on the three control cards its answer is unchanged. `seedApp` sets `owner_id` by the new rule and writes the persona's user id into its record row's `user` field.
+Metadata-protocol: none
+
+The seed used to set a row's owner (`owner_id`) from any direct scope value that matched a persona's: an option (`ticket_comment.visibility = public` gave all 237 public comments on `service_desk` to the portal customer, 197 of them on other customers' tickets) or a lookup to a row that is no person (`ticket.group`, `employee.department`), and the last key read won a row two personas matched.
+
+- **Owner rule.** A row is owned by a persona's user only when it IS that persona's `record`, when a declared direct lookup on it (`expect.lookups`) holds that record's id (`ticket.assignee = a02`), or when a declared user-handle field on it holds the persona's handle (the control cards' route, unchanged). The first persona in `run.personas` order the row names owns it. Every other row keeps the inserter, the admin.
+- **Person binding.** Each persona's `record` row is loaded with that persona's user id in its `user` field (`PERSON_USER_FIELD`). Without persona accounts (the gallery's screenshot boot) no `user` field and no record-bound owner is set.
+- **Build prompt.** The Row ownership section names the person rows, asks for an optional `user`-type field named `user` on each person object, lists the lookups that name a person, states the persona order for a row naming two, and adds a platform-boundary line: the open-source server has no hierarchy resolver, so a person who must see rows another person owns gets them through what the build models.
+
+On `service_desk` the portal customer now owns no comment (was 237), the 5 tickets that name both the support agent and the portal customer go to the support agent, the team lead owns no ticket through `group` (was 78), and `cus_03`, `a02`, `a04` are their personas' rows.
@@ -175,7 +175,13 @@ is the seed row that is this person (an employee, an agent, a customer); the loa
 one naming no seeded row. It is required on a persona with a `scope`, unless that persona is
 named through a handle instead (a direct scope rule on a declared user-handle field,
 `owner: u_sam`, as on the three controls), and optional on a global one. The person object's
-user field is `user`, fixed by name: no card chooses it. An operation is a `create` (with `values`), an
+user field is `user`, fixed by name: no card chooses it. The runner loads that row's `user` with the
+persona's user id, and owns (`owner_id`) a seed row by a persona's user only when the row is that
+persona's `record`, a declared lookup on it holds the record's id, or a handle field on it holds the
+persona's handle; the first persona in `run.personas` order the row names wins. A scope on an
+option (`visibility: public`) or on a lookup to a row that is no person (a department, a group)
+gives that persona no rows: the build reaches them by its own means (a read policy, a
+parent-controlled child). An operation is a `create` (with `values`), an
 `update` (with `target` and `values`) or a `delete` (with `target`); a target is a seeded row
 id, and every written field is one the seed carries. Every operation names the persona it
 acts for (`actingAs`) and declares its `outcome`, so grading reads it with code only:
 
@@ -253,10 +253,19 @@ npx @objectstack/scenarios help                                      # the comma
   refuse bare object names. The build prompt asks for the prefix on EVERY item, and the scorer reports each bare
   non-object item name as a failing Build check (`bare-name:<type>:<name>`), so such a build is never verified.
 - **Persona contract**: the build is asked for one permission set per persona, named `<namespace>_<persona id>`. The runner
-  grants it to that persona's user, and makes a seed row whose scope field names a persona's handle (`owner: u_sam`)
-  owned by that persona's user. A field the card declares in `run.userHandleFields` (`userHandleFields` in
-  `prompts.ts` reads the declaration, never infers it) is loaded with the user's id in place of the handle text, and
-  the record's `seed.rewritten` lists each field so rewritten.
+  grants it to that persona's user, and loads a seed row as owned (`owner_id`) by a persona's user only when the row
+  names that person (`rowOwner` in `prompts.ts`): it IS the persona's `record`, a declared direct lookup on it holds
+  that record's id (`ticket.assignee` = `a02`), or a declared user-handle field on it holds the persona's handle
+  (`owner: u_sam`). The first persona in `run.personas` order the row names owns it. An option value
+  (`visibility` = `public`), a row id scope and a lookup to a row no persona is (a department, a group) name nobody,
+  so those rows keep the inserter, the admin. Each persona's `record` row is loaded with that persona's user id in its
+  `user` field, which the build prompt asks for as an optional `user`-type field. `personaHandles` is the handle map
+  only; `personaRecords` is the record binding. A field the card declares in `run.userHandleFields`
+  (`userHandleFields` in `prompts.ts` reads the declaration, never infers it) is loaded with the user's id in place of
+  the handle text, and the record's `seed.rewritten` lists each field so rewritten. The build prompt's Row ownership
+  section states all of this, and a platform-boundary line: the open-source server has no hierarchy resolver, so a
+  person who must see rows another person owns gets them through what the build models (a read policy, a
+  parent-controlled child, a field naming them).
 - **Structure contract** (`prompts.ts`): every Build check traces to text the build prompt carries, so a faithful build
   never fails for not guessing a name. Besides the seed (objects and fields) and the persona sets, the contract states
   each `expect` row the exact-name scorer checks by name: every lookup's target, every single-choice field with its
 
@@ -32,7 +32,7 @@
  */
 
 import { applyExpectDelta, truthsOver, type LoadedScenario } from '../loader.js';
-import { isProbedOperation, scenarioNamespace, type CardTitle } from '../schema.js';
+import { isProbedOperation, PERSON_USER_FIELD, scenarioNamespace, type CardTitle } from '../schema.js';
 import {
   gradeCardAnswer,
   gradeCardOperation,
@@ -48,7 +48,7 @@ import { servedAsRequested, type AgentDriver, type StepRef } from './driver.js';
 import { citationLabels, namespaceOfArtifact, namespacedScenario, permissionSetName, templateHostName } from './namespace.js';
 import { agentSetOf, clockDates, observeOperation, observeProbe, probeCall, touchedRowId, type Row } from './observe.js';
 import type { CommandResult } from './project.js';
-import { buildPrompt, iteratePrompt, operationPrompt, personaHandles, questionPrompt, templateIteratePrompt, userHandleFields, verifyArgs } from './prompts.js';
+import { buildPrompt, iteratePrompt, operationPrompt, personaHandles, personaRecords, questionPrompt, rowOwner, templateIteratePrompt, userHandleFields, verifyArgs } from './prompts.js';
 import { lookupKey, requiredLookups, seedPlan, type SeedLookup } from './seed.js';
 import type { ParsedTurn } from './transcript.js';
 
@@ -520,14 +520,21 @@ async function buildHalf(
  * ({@link requiredLookups}), so a cycle is broken on a side the build left
  * optional; without it any side may wait.
  *
- * Row ownership is mapped from the persona handles. A row whose direct scope
- * field names a persona's handle is owned (`owner_id`, the platform's record
- * owner) by that persona's user. A user-handle field (`account.owner`,
- * `userHandleFields`) is itself loaded with a user id — the persona's, or the
- * admin's for a handle no persona holds (`u_tia`), and every handle is the
- * admin's when no persona account is passed (the gallery's screenshot boot) —
- * because a faithful build models it as a user lookup, which refuses the
- * handle text. Any other scope field names a row or an option and is sent
+ * Row ownership follows the persons the card declares ({@link rowOwner}). A
+ * row is owned (`owner_id`, the platform's record owner) by a persona's user
+ * when it IS that persona's `record`, when a declared direct lookup on it holds
+ * that record's id, or when a user-handle field on it holds that persona's
+ * handle; the first persona in `run.personas` order the row names wins. An
+ * option value, a row id scope and a lookup to a row no persona is name
+ * nobody, so those rows keep the inserter (the admin). A persona's own record
+ * is also loaded with that persona's user id in its `user` field
+ * (`PERSON_USER_FIELD`), the binding the build prompt asks the build to model.
+ * A user-handle field (`account.owner`, `userHandleFields`) is itself loaded
+ * with a user id — the persona's, or the admin's for a handle no persona holds
+ * (`u_tia`), and every handle is the admin's when no persona account is passed
+ * (the gallery's screenshot boot, which also leaves every `user` field and
+ * every record-bound owner unset) — because a faithful build models it as a
+ * user lookup, which refuses the handle text. Every other value is sent
  * verbatim.
  *
  * The tally is kept in `seed` as each row is loaded, and `seed` is what is
@@ -546,8 +553,9 @@ export async function seedApp(
 ): Promise<RunHalf['seed']> {
   const { card } = scenario;
   const handles = personaHandles(card);
-  const ownerFields = new Set(card.run.personas.flatMap((p) => (p.scope ?? []).filter((s) => !s.field.includes('.')).map((s) => `${s.object}.${s.field}`)));
+  const records = personaRecords(card);
   const userFields = userHandleFields(card);
+  const accountOf = (persona: string | undefined) => (persona === undefined ? undefined : accounts.find((a) => a.persona === persona));
   const plan = seedPlan(card, required);
   /** `object/id` → the lookup values its second-pass update sets. */
   const later = new Map<string, { object: string; id: string; patch: Record<string, string> }>();
@@ -561,18 +569,18 @@ export async function seedApp(
     for (const row of card.run.seed[object] ?? []) {
       const body: Record<string, unknown> = { ...row };
       for (const [k, v] of Object.entries(row)) {
-        if (typeof v !== 'string' || !ownerFields.has(`${object}.${k}`)) continue;
-        const persona = handles.get(v);
-        const acct = persona ? accounts.find((a) => a.persona === persona) : undefined;
-        if (acct) body.owner_id = acct.userId;
-        if (userFields.has(`${object}.${k}`)) {
-          const userId = acct?.userId ?? app.adminUserId();
-          body[k] = userId;
-          body.owner_id = userId;
-          seed.rewritten = [...new Set([...(seed.rewritten ?? []), `${object}.${k}`])].sort();
-          if (!acct) seed.handlesAsAdmin = [...new Set([...(seed.handlesAsAdmin ?? []), v])].sort();
-        }
+        if (typeof v !== 'string' || !userFields.has(`${object}.${k}`)) continue;
+        const acct = accountOf(handles.get(v));
+        const userId = acct?.userId ?? app.adminUserId();
+        body[k] = userId;
+        body.owner_id = userId;
+        seed.rewritten = [...new Set([...(seed.rewritten ?? []), `${object}.${k}`])].sort();
+        if (!acct) seed.handlesAsAdmin = [...new Set([...(seed.handlesAsAdmin ?? []), v])].sort();
       }
+      const self = accountOf(records.get(`${object}/${row.id}`));
+      if (self) body[PERSON_USER_FIELD] = self.userId;
+      const owner = accountOf(rowOwner(card, object, row));
+      if (owner) body.owner_id = owner.userId;
       const waits = later.get(`${object}/${row.id}`);
       for (const field of Object.keys(waits?.patch ?? {})) delete body[field];
       const r = await app.insertRow(object, body);