@@ -0,0 +1,13 @@
+---
+'@objectstack/objectql': patch
+---
+
+refactor(objectql): four more `engine.ts` bodies move into their facets
+
+Clause-②: no
+Metadata-protocol: none
+
+- `ObjectQL#homeAmountServing` moves into `ReferencesAndMasterDetailFacet` unchanged. Its one call of the home-localization resolver now goes through the facet's host, so the resolver is called with the host as its receiver instead of the engine. The resolver type takes no `this`, and the only one the platform installs is an arrow function, so nothing reads that receiver.
+- `ObjectQL#projectHomeAmountsOntoPatch` keeps its body in the facet. The class method now passes `serving` through as given, and the facet computes the default when the caller passes none, as the class did before.
+- `ScopedContext`'s private `derive` and its `[APP_AUTHORED_HOOK_API]` method move into `ScopedContextFacet`. Each builds a new `ScopedContext` and sets that instance's private `appAuthored` through the instance's own internal host, which is not exported. A derived api still keeps the app-authored mark, and an app-authored hook's api still refuses a permanent delete.
+- No behaviour changes and nothing to do on upgrade. The built declaration files are unchanged; the JavaScript moves between modules inside the bundle.
@@ -100,7 +100,7 @@ bugs — it is the protection or the side effect that silently does not happen.
 | # | Behaviour when `isSystem` | Package | What you get / what you lose | Symbol |
 |:--|:---|:---|:---|:---|
 | 1 | **The whole security middleware short-circuits** before any gate runs | plugin-security | Get: every CRUD/FLS/tenant/owner gate below skipped in one branch. Lose: every gate under it in this lane at once, down to and including the write-bypass row that widens the effective write scope to `org` (row 7) — this is the single largest behaviour on the page | `registerAuthzMiddleware` |
-| 1b | **App-authored automation's system context is REFUSED governed writes to the identity-assignment objects** — a flow run's, an app-authored hook's (`runAs: 'system'`, a system context it inherits, its `sudo()`) and an action body's; the one check ahead of the middleware's short-circuit | plugin-security | Get: nothing — an insert, update, delete, transfer, restore or purge of `sys_user_position`, `sys_user_permission_set`, `sys_invitation` or `sys_member` from a context carrying `isSystem` and either a `flowRunId` (a `runAs: 'system'` flow's data nodes) or the app-automation elevation mark (`@objectstack/core`; set only by a hook's `runAs: 'system'` derivation, by the action body's execution-context builder and `ObjectRepository.execute`, and on the api of a hook bound through the hook binder, whose inherited system context and `sudo()` it marks), at any depth of their writes, is refused `PERMISSION_DENIED` before the short-circuit skips the ADR-0090 D12 gate and the identity write guard. Lose: nothing a platform writer held — a system context with neither (the seeders, better-auth and its reconciliation, invitation placement, platform code's `sudo()`, which never sets the mark, and a hook registered in code) passes on to the short-circuit unchanged, reads are not judged, and a `runAs: 'user'` flow or hook carries no `isSystem`, so the D12 gate judges it as the user it acts for | `elevationSource`, `inheritsElevation` |
+| 1b | **App-authored automation's system context is REFUSED governed writes to the identity-assignment objects** — a flow run's, an app-authored hook's (`runAs: 'system'`, a system context it inherits, its `sudo()`) and an action body's; the one check ahead of the middleware's short-circuit | plugin-security | Get: nothing — an insert, update, delete, transfer, restore or purge of `sys_user_position`, `sys_user_permission_set`, `sys_invitation` or `sys_member` from a context carrying `isSystem` and either a `flowRunId` (a `runAs: 'system'` flow's data nodes) or the app-automation elevation mark (`@objectstack/core`; set only by a hook's `runAs: 'system'` derivation, by the action body's execution-context builder and `ObjectRepository.execute`, and on the api of a hook bound through the hook binder, whose inherited system context and `sudo()` it marks), at any depth of their writes, is refused `PERMISSION_DENIED` before the short-circuit skips the ADR-0090 D12 gate and the identity write guard. Lose: nothing a platform writer held — a system context with neither (the seeders, better-auth and its reconciliation, invitation placement, platform code's `sudo()`, which never sets the mark, and a hook registered in code) passes on to the short-circuit unchanged, reads are not judged, and a `runAs: 'user'` flow or hook carries no `isSystem`, so the D12 gate judges it as the user it acts for | `elevationSource`, `appAuthoredHookApi` |
 | 2 | **`owner_id` is not auto-stamped on INSERT** (the step 3.5 anchor guard is inside the block row 1 skips) | plugin-security | Lose: the row lands `owner_id = NULL`, so the default `owner_only_writes` policy hides it **from its own creator**. Get: nothing — this is a gap, not a capability | the step 3.5 guard block and the short-circuit that skips it are both inside `registerAuthzMiddleware` |
 | 3 | Row-level read filter resolves to "no filter" | plugin-security | Get: unscoped reads. Lose: row-level scoping entirely | `getReadFilter` |
 | 4 | Field-level security returns **all** fields | plugin-security | Get: every column readable (`getReadableFields`) and writable (`getWritableFields`). Lose: field masking | `resolveProjectionFieldMask` |
@@ -543,10 +543,10 @@ and CI refuses one that differs from what the tree produces.
 | `packages/objectql/src/engine-referential-integrity.ts#masterDetailHeadersCallerReads` | 1 | 29c |
 | `packages/objectql/src/engine-referential-integrity.ts#referencesCheckedBeforeRules` | 1 | 23 |
 | `packages/objectql/src/engine-referential-integrity.ts#storedReferencesCallerReads` | 1 | 23 |
+| `packages/objectql/src/engine-scoped-context.ts#appAuthoredHookApi` | 1 | 1b |
 | `packages/objectql/src/engine-secret-internal-fields.ts#encryptSecretFields` | 1 | 23e |
 | `packages/objectql/src/engine-secret-internal-fields.ts#stripSearchCompanionFromRead` | 1 | 27 |
 | `packages/objectql/src/engine-validate.ts#validate` | 1 | 21b |
-| `packages/objectql/src/engine.ts#inheritsElevation` | 1 | 1b |
 | `packages/objectql/src/engine.ts#insert` | 3 | 21, 22 |
 | `packages/objectql/src/engine.ts#isSystem` | 1 | 64 |
 | `packages/objectql/src/engine.ts#update` | 4 | 19, 20 |
 
@@ -4,8 +4,9 @@
  * [#29986 codemod] The
  * "Realtime, i18n, home amounts, validation messages, references, master-detail"
  * section of `ObjectQL`: the bodies of `setRealtimeService`, `setI18nService`,
- * `setHomeLocalizationResolver`, `homeAmountOrganizationOf`,
- * `previewHomeAmounts`, `projectHomeAmountsOntoPatch`, `referenceExists`,
+ * `setHomeLocalizationResolver`, `homeAmountServing`,
+ * `homeAmountOrganizationOf`, `previewHomeAmounts`,
+ * `projectHomeAmountsOntoPatch`, `referenceExists`,
  * `callerReadableReferenceExists`, `resolveMasterDetailParent`,
  * `resolveMasterDetailParents`, `materializeParentHeader`,
  * `masterDeclaredFields`, `inspectDanglingReferences`, `inspectCascadeDelete`,
@@ -46,8 +47,8 @@ import type { IRealtimeService } from '@objectstack/spec/contracts';
 import { isStoredMetadataBodyObject } from '@objectstack/spec/kernel';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
 import { postureUsesUnionScope } from '@objectstack/spec/security';
-import { homeAmountsTouched, planHomeAmounts, projectHomeAmounts } from './home-amount-projection.js';
-import type { HomeAmountPlanEntry, HomeAmountReads, HomeAmountServing, HomeLocalizationResolver } from './home-amount-projection.js';
+import { EXCHANGE_RATE_OBJECT, homeAmountsTouched, memoizeHomeAmountServing, planHomeAmounts, projectHomeAmounts } from './home-amount-projection.js';
+import type { HomeAmountPlanEntry, HomeAmountReads, HomeAmountServing, HomeLocalization, HomeLocalizationResolver } from './home-amount-projection.js';
 import { resolveMasterDetailRelation } from './master-detail.js';
 import { materializeDeclaredFields } from './declared-fields.js';
 import { collectCascadeDeleteObjects } from './engine-delete-cascade.js';
@@ -109,6 +110,61 @@ export class ReferencesAndMasterDetailFacet {
     this.homeLocalizationResolver = resolver;
   }
 
+  /**
+   * [ADR-0144 D5, Open item 2] What one write's home projection reads, memoized
+   * for that write: each organization's home currency once, and each
+   * (organization, currency, document date) rate once, however many rows ask.
+   *
+   * The rate is the `sys_exchange_rate` row of that currency with the latest
+   * `effective_date` on or before the document date, in the organization the
+   * row lands in. Read `sudo()`-shaped (`{ ...context, isSystem: true }`): a
+   * rank-and-file writer cannot read the rate table (parameter 2 makes it an
+   * administrator's object), yet every write of theirs is converted through
+   * it; the caller's transaction rides along, and `tenantId` is the row's own
+   * organization, so one organization's rate never converts another's
+   * amount. An install without the rate object registered has no rate for any
+   * currency.
+   */
+  static homeAmountServing(this: Pick<ReferencesAndMasterDetailHost, '_registry' | 'find' | 'homeLocalizationResolver'>, context: ExecutionContext | undefined): HomeAmountServing {
+    // One settings read per organization per write answers both the home
+    // currency and the timezone.
+    const localizations = new Map<string, Promise<HomeLocalization | undefined>>();
+    const localizationOf = (organizationId: string | undefined) => {
+      const key = organizationId ?? '';
+      let hit = localizations.get(key);
+      if (!hit) {
+        hit = Promise.resolve(this.homeLocalizationResolver?.(organizationId));
+        localizations.set(key, hit);
+      }
+      return hit;
+    };
+    return memoizeHomeAmountServing({
+      homeCurrency: async (organizationId) => (await localizationOf(organizationId))?.currency,
+      timezone: async (organizationId) => (await localizationOf(organizationId))?.timezone,
+      rateOn: async (organizationId, currency, onOrBefore) => {
+        if (!this._registry.getObject(EXCHANGE_RATE_OBJECT)) return undefined;
+        const rows = await this.find(EXCHANGE_RATE_OBJECT, {
+          where: { currency, effective_date: { $lte: onOrBefore } },
+          orderBy: [{ field: 'effective_date', order: 'desc' }],
+          limit: 1,
+          fields: ['rate', 'effective_date'],
+          context: {
+            ...(context ?? {}),
+            isSystem: true,
+            ...(organizationId !== undefined ? { tenantId: organizationId } : {}),
+          } as ExecutionContext,
+        });
+        const row = rows[0] as { rate?: unknown; effective_date?: unknown } | undefined;
+        if (!row) return undefined;
+        const effective = row.effective_date;
+        return {
+          rate: row.rate,
+          effectiveDate: effective instanceof Date ? effective.toISOString().slice(0, 10) : (typeof effective === 'string' ? effective : undefined),
+        };
+      },
+    });
+  }
+
   /**
    * [ADR-0144 D5] The organization a written row belongs to, for its home
    * projection: the row's own `organization_id`, else the writer's active
 
@@ -6,6 +6,10 @@
  * `sudo`, `withRunAs`, `releaseJoinedHandle`, `txDriver`, `beginTransaction`,
  * `commitTransaction`, `rollbackTransaction`, `serveFormulaField` moved out of
  * `engine.ts` whole by `scripts/codemod-split-engine.mjs` (its second pass).
+ * The bodies of `derive` and `[APP_AUTHORED_HOOK_API]` moved by hand
+ * (#30975): each writes the private `appAuthored` of the instance it builds,
+ * which the codemod refuses to move (`foreign-private`), so each writes it
+ * through that instance's own host setter.
  *
  * A MOVE, not a redesign. {@link ScopedContextFacet} is a stateless facet of
  * `ScopedContext`: each static method of it is the body of the `ScopedContext`
@@ -32,12 +36,14 @@
 
 import { driverSupportsTransactions } from '@objectstack/spec/data';
 import type { IScopedContext } from '@objectstack/spec/contracts';
+import type { ExecutionContext } from '@objectstack/spec/kernel';
 import { appAutomationElevationOf, markAppAutomationElevation } from '@objectstack/core';
 import { UnscopedHookApi } from './hook-run-as.js';
 import { refuseAppAuthoredPermanentDelete } from './recycle-bin/app-authored-delete.js';
 import type { HookRunAs, HookRunAsRef } from './hook-run-as.js';
-import { ObjectRepository } from './engine.js';
-import type { ObjectQL, ScopedContext } from './engine.js';
+import { scopedContextHost } from './engine-scoped-hosts.js';
+import { ObjectRepository, ScopedContext } from './engine.js';
+import type { ObjectQL } from './engine.js';
 
 /**
  * The `ScopedContext` members the bodies of {@link ScopedContextFacet} read —
@@ -47,7 +53,7 @@ import type { ObjectQL, ScopedContext } from './engine.js';
  * are fields a body assigns.
  */
 export interface ScopedContextHost {
-  readonly appAuthored: ScopedContext['appAuthored'];
+  appAuthored: ScopedContext['appAuthored'];
   derive: ScopedContext['derive'];
   readonly engine: ScopedContext['engine'];
   readonly executionContext: ScopedContext['executionContext'];
@@ -58,6 +64,32 @@ export interface ScopedContextHost {
 
 /** The bodies of `ScopedContext`'s methods: a stateless facet, called by the class's stubs. */
 export class ScopedContextFacet {
+  /**
+   * A child over `executionContext` that keeps this api's provenance.
+   *
+   * The child's private `appAuthored` is written through the child's own host
+   * (`scopedContextHost.of(child)`), the port its class's static block fills:
+   * a module function cannot write another instance's private field directly.
+   */
+  static derive(this: Pick<ScopedContextHost, 'appAuthored' | 'engine'>, executionContext: ExecutionContext): ScopedContext {
+    const child = new ScopedContext(executionContext, this.engine);
+    scopedContextHost.of(child).appAuthored = this.appAuthored;
+    return child;
+  }
+
+  /**
+   * The body of `ScopedContext#[APP_AUTHORED_HOOK_API]`; the method's docblock
+   * there is its contract. The new api's private `appAuthored` is written
+   * through its own host, as in {@link ScopedContextFacet.derive}.
+   */
+  static appAuthoredHookApi(this: Pick<ScopedContextHost, 'engine' | 'executionContext'>): ScopedContext {
+    const ctx = this.executionContext;
+    const inheritsElevation = ctx.isSystem && !ctx.flowRunId && !appAutomationElevationOf(ctx);
+    const api = new ScopedContext(inheritsElevation ? markAppAutomationElevation(ctx, 'hook') : ctx, this.engine);
+    scopedContextHost.of(api).appAuthored = true;
+    return api;
+  }
+
   /** The body of `ScopedContext#object`; the method's docblock there is its contract. */
   static object(this: Pick<ScopedContextHost, 'appAuthored' | 'engine' | 'executionContext'>, name: string): ObjectRepository {
     const repo = new ObjectRepository(name, this.executionContext, this.engine as any);