@@ -0,0 +1,26 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+**The permission-set seeder's unowned refusal now moves a counter.** `PermissionSeedOutcome` gains a required `skippedUnowned`, incremented on the `!packageId` branch of `upsertPackagePermissionSet` — the branch that refuses to materialize a declared set with no resolvable owner (#18571).
+
+⛔ **The refusal itself is unchanged.** A `managed_by:'package'` row with no `package_id` makes uninstall undefined, which is exactly the ADR-0086 D3 ambiguity the branch exists to prevent. This card adds a channel, not a verdict.
+
+#18564 gave that refusal its author-visible line. What it left is the programmatic half: the outcome came back with all six counters at zero, so a caller that reads no log at all — a boot report, a Setup surface, a test — could not tell a pass that refused a declaration from a pass with nothing to do. Measured against the sibling axis, which has counted the same refusal at the same boundary since #4967:
+
+```
+axis                       unowned refusal      counter moved   author-visible line
+capability                 skippedUnowned            1                  1
+permission set (before)    — none declared —         0                  1
+permission set (after)     skippedUnowned            1                  1
+```
+
+**Required, not optional** — like `skippedForeign` and unlike `deleted`. An absent key on a *refusal* count reads exactly like a pass with nothing to refuse, which is the defect restated. All four construction sites initialize it (`bootstrapDeclaredPermissions`, `upsertPackagePermissionSet`, `upsertEnvPermissionSet`, `retirePermissionSetRecord`), so every door that returns this outcome answers the question.
+
+**Both doors onto the branch increment it.** The boot catalog loop aggregates it alongside the five counters it already forwarded; the ADR-0086 P2 publish materializer passes no collector and returns its own outcome, so a fix wired only into the aggregation would have left that caller as silent as before.
+
+**The accounting closes.** `seeded + updated + unchanged + skippedEnvAuthored + skippedForeign + skippedUnowned + unreadable` is now the number of named declarations a pass read — pinned by a conservation test modelled on the capability axis'. Before this counter that sum was short by every unowned declaration. (Pre-existing caveat, unchanged and outside this change: a write the engine rejects increments no counter; it is reported through `SeedWriteRefusals`.)
+
+New published surface on `@objectstack/plugin-security`: the `skippedUnowned` member of the barrel-exported `PermissionSeedOutcome`. Reading an outcome is unaffected — the member only adds a number to read.
+
+The sweep for construction sites covered this repository, the pinned `objectui` checkout and the downstream app repositories available to it, and found none outside the package. That is what was measured, and it cannot speak for a consumer outside those trees. So: if you construct a `PermissionSeedOutcome` yourself — a test double standing in for the seeder is the shape that does — add `skippedUnowned: 0`. Nothing else changes.
@@ -52,6 +52,10 @@
       "Bash(curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/auto_merge *)",
       "Bash(node --use-env-proxy scripts/pm/post-stamped.mjs *)",
       "Bash(node --use-env-proxy scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/post-stamped.mjs *)",
+      "Bash(node scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/close-cards.mjs *)",
+      "Bash(node --use-env-proxy scripts/pm/close-cards.mjs *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectstack/issues/* *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/issues/* *)"
     ],
 
@@ -1307,6 +1307,29 @@ jobs:
       - name: Label-write helper self-test
         run: pnpm check:pm-label-write
 
+      # Card-closure helper self-test (#19469) — same family and the same split
+      # as the two steps above, and it drives BOTH of them: `close-cards.mjs` is
+      # the three-step closure (comment · label · close) as one named command,
+      # so a seat's batch closure is one allow-listed prefix instead of a loop
+      # the session's write classifier judges act by act. The LIVE path posts
+      # comments, strips labels and closes cards, so it is emphatically not a
+      # thing CI runs against the board; the offline half is all CI can hold.
+      #
+      # What the self-test instruments is the set of rules a clean tree cannot
+      # exercise, every one of which is silent when it breaks: the skip matrix
+      # (not open · assigned · `pm:retriage` · a pm-state that is not EXACTLY
+      # the expected one · an open PR cross-referencing the card); that an
+      # unreadable card or timeline STOPS the run rather than being read as a
+      # "no"; that a 200 whose body does not read back `closed`, or reads back
+      # another `state_reason`, is not a close; and — the one this tool exists
+      # for — that a comment which lands whose label write then fails STOPS at
+      # that card, naming it and which of the three writes landed, instead of
+      # turning one half-state into a page of them. Weakening any of them leaves
+      # every ordinary invocation just as green, which is the shape
+      # `check:self-test-wired` requires this step for.
+      - name: Card-closure helper self-test
+        run: pnpm check:pm-close-cards
+
       # Board-snapshot archiver self-test (#17390) — same family and the same
       # split as every step around it. The LIVE run reads the whole board over
       # REST and commits the result to an orphan branch, so it is not a thing
 
@@ -88,6 +88,7 @@
     "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",
+    "check:pm-close-cards": "node scripts/pm/close-cards.mjs --self-test",
     "check:pm-board-snapshot": "node scripts/pm/board-snapshot.mjs --self-test",
     "check:pm-changeset-deadline-census": "node scripts/pm/changeset-deadline-census.mjs --self-test",
     "check:pm-governed-merges": "node scripts/pm/check-governed-merges.mjs --self-test",
 
@@ -13,6 +13,7 @@ import {
   PERMISSION_SET_DECLARATION_UNOWNED,
   PERMISSION_SET_ROWS_UNREADABLE,
 } from './seed-refusal-diagnostics.js';
+import { permissionSetRowFields } from './permission-set-projection.js';
 
 /** [#18091] Seeded from this file, for the class pin at the bottom. */
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -395,3 +396,107 @@ describe('[#18091] the two remaining permission-set refusals reach the author',
     expect(source).toContain("options.logger?.info?.(");
   });
 });
+
+// ───────────────────────────────────────────────────────────────────────────
+// [#18571] The unowned refusal's PROGRAMMATIC half. #18564 gave this branch an
+// author-visible line; the outcome still came back with every counter at zero,
+// so a caller that reads no log at all could not tell a pass that refused a
+// declaration from a pass with nothing to do. The capability axis has counted
+// the same refusal at the same ADR-0086 D3 boundary since #4967.
+// ───────────────────────────────────────────────────────────────────────────
+
+/** Silent sink — these tests assert the COUNTER, and #18091 owns the line. */
+const mute = () => ({ info: () => {}, warn: () => {} });
+
+describe('[#18571] the unowned permission-set refusal moves a counter', () => {
+  it('BOOT-LOOP DOOR: an unowned declaration increments skippedUnowned', async () => {
+    const ql = makeQl([declaredSet({ _packageId: undefined })]);
+
+    const r = await bootstrapDeclaredPermissions(ql, undefined, { logger: mute() });
+
+    expect(r.skippedUnowned).toBe(1);
+    // ⛔ The refusal itself is UNCHANGED — an unowned `managed_by:'package'`
+    //    row is the ADR-0086 D3 ambiguity this branch exists to prevent.
+    expect(ql.rows).toHaveLength(0);
+    expect(r.seeded + r.updated + r.unchanged).toBe(0);
+    // ⛔ And it lands in its OWN counter, never borrowed from a sibling: an
+    //    unowned declaration is not a foreign row and not an env-authored one.
+    expect(r.skippedForeign).toBe(0);
+    expect(r.skippedEnvAuthored).toBe(0);
+    expect(r.unreadable).toBe(0);
+  });
+
+  it('PUBLISH DOOR (ADR-0086 P2): the materializer increments it too', async () => {
+    // ⚠️ The second door onto the same branch, and the reason testing one is
+    // testing half: the publish materializer upserts ONE set and passes no
+    // collector, so a fix wired into the boot loop's aggregation alone would
+    // leave this caller's outcome exactly as silent as before.
+    const ql = makeQl();
+
+    const r = await upsertPackagePermissionSet(ql, declaredSet({ _packageId: undefined }), null, mute());
+
+    expect(r.skippedUnowned).toBe(1);
+    expect(ql.rows).toHaveLength(0);
+    expect(r.seeded).toBe(0);
+  });
+
+  it('CONTROL: a pass that refuses nothing leaves it at 0 through both doors', async () => {
+    // ⛔ The discriminating half. Without it, a counter incremented on every
+    //    declaration would satisfy both assertions above.
+    const boot = await bootstrapDeclaredPermissions(makeQl([declaredSet()]), undefined, { logger: mute() });
+    expect(boot).toMatchObject({ seeded: 1, skippedUnowned: 0 });
+
+    const publish = await upsertPackagePermissionSet(makeQl(), declaredSet(), 'com.example.crm', mute());
+    expect(publish).toMatchObject({ seeded: 1, skippedUnowned: 0 });
+  });
+
+  it('⭐ CONSERVATION: every named declaration lands in exactly one counter', async () => {
+    // Modelled on the capability axis' `materializedNames reconciles with the
+    // outcome counters`. The point is not the six numbers — it is that they
+    // SUM to the input, which is precisely what an uncounted refusal broke.
+    const body = (name: string, over: Record<string, any> = {}) =>
+      declaredSet({ name, _packageId: 'com.a', ...over });
+    const sets = [
+      body('crm_new'),                                     // → seeded
+      body('crm_own', { label: 'Fresh' }),                 // → updated
+      body('crm_same'),                                    // → unchanged
+      body('crm_env'),                                     // → skippedEnvAuthored
+      body('crm_foreign'),                                 // → skippedForeign
+      declaredSet({ name: 'crm_orphan', _packageId: undefined }), // → skippedUnowned
+    ];
+    const ql = makeQl(sets);
+    // Its own row, stale — the stored label is not what the declaration says.
+    ql.rows.push({
+      id: 'ps_own', name: 'crm_own', managed_by: 'package', package_id: 'com.a',
+      ...permissionSetRowFields(body('crm_own', { label: 'Stale' })),
+    });
+    // Its own row, already converged — `recordDiffersFromBody` calls it equal,
+    // so no UPDATE is issued and the name lands in `unchanged`, not `updated`.
+    ql.rows.push({
+      id: 'ps_same', name: 'crm_same', managed_by: 'package', package_id: 'com.a',
+      ...permissionSetRowFields(body('crm_same')),
+    });
+    ql.rows.push({ id: 'ps_env', name: 'crm_env', managed_by: 'user', object_permissions: '{"kept":true}' });
+    ql.rows.push({ id: 'ps_far', name: 'crm_foreign', managed_by: 'package', package_id: 'com.z', object_permissions: '{}' });
+
+    const out = await bootstrapDeclaredPermissions(ql, undefined, { logger: mute() });
+
+    expect(out).toMatchObject({
+      seeded: 1, updated: 1, unchanged: 1,
+      skippedEnvAuthored: 1, skippedForeign: 1, skippedUnowned: 1,
+      unreadable: 0,
+    });
+    // ⚠️ The sum is taken over EVERY counter the outcome declares, so a future
+    //    counter added without a home here fails this pin instead of hiding in
+    //    a hand-picked subset — the failure mode `skippedUnowned` itself was.
+    const counted = out.seeded + out.updated + out.unchanged
+      + out.skippedEnvAuthored + out.skippedForeign + out.skippedUnowned + out.unreadable;
+    expect(counted).toBe(sets.length);
+    // …and the refusal that wrote nothing really wrote nothing: five inputs
+    // reached a row, the sixth did not.
+    expect(ql.rows.map((r) => r.name).sort()).toEqual(
+      ['crm_env', 'crm_foreign', 'crm_new', 'crm_own', 'crm_same'],
+    );
+    expect(ql.rows.some((r) => r.name === 'crm_orphan')).toBe(false);
+  });
+});
@@ -229,18 +229,23 @@ export async function upsertPackagePermissionSet(
     collisions?: PermissionSetNameCollisionDiagnostic[];
   },
 ): Promise<PermissionSeedOutcome> {
-  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0 };
+  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0, skippedUnowned: 0 };
   if (!ps?.name) return out;
   // A `managed_by:'package'` row without a `package_id` would make uninstall
   // undefined again — the exact ambiguity ADR-0086 D3 exists to remove — so a
   // set with no resolvable owner is skipped rather than materialized unowned.
   if (!packageId) {
+    out.skippedUnowned += 1;
     // [#18091] ⛔ The refusal is unchanged — an unowned row would re-create the
     // ADR-0086 D3 ambiguity. What changed is that it arrives. Measured on the
     // pre-fix tree with no logger, through BOTH doors that reach this branch
     // (the boot loop and the ADR-0086 P2 publish materializer, which passes no
-    // collector): author-visible console lines = 0, and this branch moves no
-    // counter either, so the outcome said nothing about it.
+    // collector): author-visible console lines = 0.
+    //
+    // [#18571] And a counter, because the LINE is not the programmatic half: a
+    // caller that reads no log at all — a boot report, a test — asked the
+    // outcome and got six zeros back, indistinguishable from a pass with
+    // nothing to do. Both doors above increment it; the boot loop forwards it.
     //
     // Its own wording, because the consequence is not the capability axis':
     // the declared set stays runtime-enforced and only the RECORD is missing.
@@ -374,7 +379,7 @@ export async function bootstrapDeclaredPermissions(
   metadataService: any,
   options: SeedOptions = {},
 ): Promise<PermissionSeedOutcome> {
-  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0 };
+  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0, skippedUnowned: 0 };
   if (!ql || typeof ql.find !== 'function' || typeof ql.insert !== 'function') return out;
 
   let sets: any[] = readDeclared(ql, 'permission');
@@ -419,6 +424,7 @@ export async function bootstrapDeclaredPermissions(
     out.unreadable += r.unreadable;
     out.skippedEnvAuthored += r.skippedEnvAuthored;
     out.skippedForeign += r.skippedForeign;
+    out.skippedUnowned += r.skippedUnowned;
   }
 
   if (organizationId) {
 
@@ -246,6 +246,28 @@ export interface PermissionSeedOutcome {
   unreadable: number;
   skippedEnvAuthored: number;
   skippedForeign: number;
+  /**
+   * [#18571] Declarations refused for want of an owning package
+   * (`_packageId`/`packageId` both absent), so no `managed_by:'package'` row
+   * was written — the ADR-0086 D3 ambiguity the refusal exists to prevent.
+   *
+   * ⚠️ Required, not optional: it is a REFUSAL count, and an absent key on a
+   * pass that refused reads exactly like a pass that had nothing to refuse.
+   * Every door that returns this outcome initializes it, so a caller may add
+   * it into the accounting unconditionally — `seeded + updated + unchanged +
+   * skippedEnvAuthored + skippedForeign + skippedUnowned + unreadable` is the
+   * number of named declarations this pass read. (Pre-existing caveat,
+   * unchanged: a write the engine REJECTS increments no counter — `tryInsert`
+   * answers `null` and `tryUpdate` `false`, and the refusal travels on
+   * `SeedWriteRefusals` instead.) Before this counter existed that sum was
+   * short by every unowned declaration, and the outcome said nothing at all
+   * about them.
+   *
+   * Named for its `CapabilitySeedOutcome.skippedUnowned` sibling on the
+   * capability axis, which counts the same refusal at the same ADR-0086 D3
+   * boundary — ⛔ not a new vocabulary for one seeder.
+   */
+  skippedUnowned: number;
   /** Records retired because their definition was deleted from metadata. */
   deleted?: number;
   /**
@@ -566,7 +588,7 @@ export async function upsertEnvPermissionSet(
     existing?: ExistingByNameIndex;
   },
 ): Promise<PermissionSeedOutcome> {
-  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0 };
+  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0, skippedUnowned: 0 };
   if (!ql || typeof ql.find !== 'function' || !ps?.name) return out;
 
   // [ADR-0094] `customized` marks a PACKAGE-owned row that an env overlay is
@@ -749,7 +771,7 @@ async function retirePermissionSetRecord(
   name: string,
   logger?: ProjectionLogger,
 ): Promise<PermissionSeedOutcome> {
-  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0, deleted: 0 };
+  const out: PermissionSeedOutcome = { seeded: 0, updated: 0, unchanged: 0, unreadable: 0, skippedEnvAuthored: 0, skippedForeign: 0, skippedUnowned: 0, deleted: 0 };
   const existing = (await tryFind(ql, 'sys_permission_set', { name }, 1))[0];
   if (!existing?.id) return out;
   if (existing.managed_by === 'package') {