@@ -0,0 +1,15 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): the boot heal of drifted `sys_permission_set` rows converges on duplicated names, stops paying a discarded metadata read per row, and a refused existence read no longer inserts a duplicate (#22169)
+
+Clause-②: no
+
+**The heal writes the row it read, by its id.** `reconcilePermissionSetProjection` heals every overlay-less, env-authored record that drifted from its metadata definition. It used to hand each drifted record to a by-name upsert, which re-read the first record of that name (lowest id). On a table holding more than one record per name, only that one was ever written: every other record was logged "re-projected" and left drifted, on every boot. Now each drifted record is updated by its own id, facets only (label, description and the permission columns; identity, `active` and provenance are never touched). The drift line is logged after the write and names the record's id; a refused write is logged as refused instead of as re-projected. On a real engine with 8 names × 3 records, the boot after the healing one went from 116 statements and 16 drift warnings to 4 statements and none.
+
+**The layered metadata read is lazy, once per name.** The heal awaited `getMetaItemLayered` (four statements on the protocol) for every candidate record before deciding whether it needed it, and it does not need it while a `SchemaRegistry` is readable. It is now read only when no registry answers, and once per name per pass.
+
+**A refused existence read declines the insert.** `bootstrapPlatformAdmin` reads each default permission set by name and inserts when it finds none. A refused read answered as "none", so on a table without the per-organization unique index the boot inserted a second record of a set that already existed. A refused read now inserts nothing, and the pass says so once, naming the sets. When `admin_full_access` is one of them, the promotion half reports `admin_permission_set_unreadable` instead of `admin_permission_set_missing`.
+
+**Unchanged.** Existing duplicate records are healed, never deleted: removing them is an operator repair. The live single-mutation projection keeps its per-item read.
@@ -0,0 +1,106 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#22169] `bootstrapPlatformAdmin`'s existence read: a read that did not
+ * answer is not an absent row.
+ *
+ * The seed loop reads each default permission set BY NAME and inserts when it
+ * finds none. Its `tryFind` answers `[]` for a refused read as well as for an
+ * empty table, and the loop inserted on both — so on a table without the
+ * per-organization unique index a refused read minted a second row of a set
+ * that already existed, and a table holding such duplicates can never build
+ * that index again. Measured on a real engine with that index dropped: two
+ * declared sets, two INSERTs, under a refused read.
+ *
+ * The double below has no `update` or `delete` member — the seed pass without
+ * `resync` calls neither — so it is not an engine double those dispatch
+ * contracts govern. Its `find` answers from its rows, bounded by the caller's
+ * `limit`; the refused read is a spy laid over it, so the two inputs the pass
+ * must tell apart — an answer, and a throw — come from one table.
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { bootstrapPlatformAdmin } from './bootstrap-platform-admin.js';
+
+afterEach(() => { vi.restoreAllMocks(); });
+
+function makeQl(seedRows: any[] = []) {
+  const rows: any[] = seedRows.map((r) => ({ ...r }));
+  const inserted: any[] = [];
+  return {
+    rows,
+    inserted,
+    async find(object: string, q: any) {
+      if (object !== 'sys_permission_set') return [];
+      const where = q?.where ?? {};
+      const matched = rows.filter((r) => Object.entries(where).every(([k, v]) => {
+        if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
+        return r[k] === v;
+      }));
+      return typeof q?.limit === 'number' ? matched.slice(0, q.limit) : matched;
+    },
+    async insert(object: string, data: any) {
+      if (object !== 'sys_permission_set') return null;
+      inserted.push({ ...data });
+      rows.push({ ...data });
+      return { id: data.id };
+    },
+  };
+}
+
+/** Every `sys_permission_set` read now throws; every other read still answers. */
+function refuseSetReads(ql: ReturnType<typeof makeQl>): void {
+  const answer = ql.find.bind(ql);
+  vi.spyOn(ql, 'find').mockImplementation(async (object: string, q: any) => {
+    if (object === 'sys_permission_set') throw new Error('fake outage: sys_permission_set read refused');
+    return answer(object, q);
+  });
+}
+
+const set = (name: string) => ({ name, label: name, objects: {}, systemPermissions: [] }) as any;
+
+function capture() {
+  const warns: Array<{ msg: string; meta?: any }> = [];
+  return { warns, logger: { info: () => {}, warn: (msg: string, meta?: any) => warns.push({ msg, meta }) } };
+}
+
+describe('#22169 — bootstrapPlatformAdmin declines the insert when its existence read was refused', () => {
+  it('a refused read inserts NOTHING, and says so once for the whole pass', async () => {
+    const ql = makeQl([{ id: 'ps_existing', name: 'admin_full_access' }]);
+    refuseSetReads(ql);
+    const { warns, logger } = capture();
+
+    const r = await bootstrapPlatformAdmin(ql, [set('admin_full_access'), set('member_default'), set('viewer_readonly')], { logger });
+
+    expect(ql.inserted, '⛔ no row minted on a read that did not answer').toEqual([]);
+    expect(r.seeded).toBe(0);
+    const lines = warns.filter((w) => w.msg.includes('could not be read'));
+    expect(lines, 'one line per pass, never one per set').toHaveLength(1);
+    expect(lines[0]!.meta).toMatchObject({
+      unreadable: 3, total: 3, names: ['admin_full_access', 'member_default', 'viewer_readonly'],
+    });
+    // The promotion half reports the read that failed, not a set that is "missing".
+    expect(r.reason).toBe('admin_permission_set_unreadable');
+  });
+
+  it('control: an EMPTY answer is still "absent" — a fresh install seeds every default set', async () => {
+    const ql = makeQl();
+    const { warns, logger } = capture();
+
+    const r = await bootstrapPlatformAdmin(ql, [set('admin_full_access'), set('member_default')], { logger });
+
+    expect(ql.inserted.map((row) => row.name)).toEqual(['admin_full_access', 'member_default']);
+    expect(r.seeded).toBe(2);
+    expect(warns.filter((w) => w.msg.includes('could not be read'))).toEqual([]);
+  });
+
+  it('control: an existing row is found and left alone — no insert, no unreadable line', async () => {
+    const ql = makeQl([{ id: 'ps_existing', name: 'member_default' }]);
+    const { warns, logger } = capture();
+
+    await bootstrapPlatformAdmin(ql, [set('member_default')], { logger });
+
+    expect(ql.inserted).toEqual([]);
+    expect(warns.filter((w) => w.msg.includes('could not be read'))).toEqual([]);
+  });
+});
@@ -90,6 +90,7 @@ import {
   reportSeedWriteRefusals,
   type SeedWriteRefusals,
 } from './per-organization-catalog.js';
+import { reportThroughSink } from './seed-refusal-sink.js';
 import {
   resolvePlatformAdminStanding,
   type PlatformAdminStandingEntry,
@@ -778,9 +779,26 @@ export async function bootstrapPlatformAdmin(
   // One log per pass, not per refused row: a legacy platform-wide unique index
   // refuses EVERY default permission set, and a line each would bury the remedy.
   const refusals = createSeedWriteRefusals();
+  // [#22169] Names whose existence read was REFUSED, so nothing was inserted
+  // for them — reported once below, after the loop.
+  const unreadable: string[] = [];
   for (const ps of bootstrapPermissionSets) {
     if (!ps.name) continue;
-    const existing = await tryFind(ql, 'sys_permission_set', { name: ps.name }, 1);
+    // ⛔ "Refused" is not "absent". `tryFind` answers `[]` for both, and this
+    // loop used to INSERT on both: on a table without the per-organization
+    // unique index (remote tables built before its retrofit) a refused read
+    // minted a second row of a set that already existed, and a table holding
+    // such duplicates can never build that index again. The observer tells
+    // the two apart; a read that could not answer declines the insert.
+    let readRefused = false;
+    const existing = await tryFind(
+      ql, 'sys_permission_set', { name: ps.name }, 1, undefined, undefined,
+      () => { readRefused = true; },
+    );
+    if (readRefused) {
+      unreadable.push(ps.name);
+      continue;
+    }
     if (existing.length > 0 && existing[0].id) {
       const row = existing[0];
       seeded[ps.name] = row.id;
@@ -835,6 +853,21 @@ export async function bootstrapPlatformAdmin(
   // finished either way. Placing it at the end would make the diagnosis
   // conditional on how promotion happened to resolve.
   reportSeedWriteRefusals(logger, refusals);
+  if (unreadable.length > 0) {
+    // [#22169] ONCE per pass with the names, never a line per set: a refused
+    // read usually means the whole table is unreadable, and a per-name line
+    // would bury its own remedy. `warn`, through the sink derivation the
+    // sibling seeders' unreadable lines use, so it is heard with no logger
+    // injected: nothing was written, so nothing claims to have landed.
+    reportThroughSink(
+      logger,
+      '[security] platform default permission sets left untouched — their sys_permission_set rows could not ' +
+        'be read, so none was inserted: a read that did not answer is not an absent row, and inserting on it ' +
+        'duplicates a set that may already exist. A set that is genuinely absent is seeded by the next boot ' +
+        'whose read answers.',
+      { unreadable: unreadable.length, total: bootstrapPermissionSets.length, names: unreadable },
+    );
+  }
 
   const seededCount = Object.keys(seeded).length;
   // [#11532] Under a walled posture these rows are organization-less BY RULING
@@ -880,7 +913,12 @@ export async function bootstrapPlatformAdmin(
 
   const adminPsId = seeded[PLATFORM_ADMIN_PERMISSION_SET_NAME];
   if (!adminPsId) {
-    return { seeded: seededCount, adminPromoted: false, reason: 'admin_permission_set_missing', ...resyncCounts };
+    // [#22169] `unreadable`, not `missing`, when the read was what failed: the
+    // set may well exist, and the line above says so.
+    const reason = unreadable.includes(PLATFORM_ADMIN_PERMISSION_SET_NAME)
+      ? 'admin_permission_set_unreadable'
+      : 'admin_permission_set_missing';
+    return { seeded: seededCount, adminPromoted: false, reason, ...resyncCounts };
   }
 
   // ── Does this deployment ALREADY have a platform admin? (commit 1c83ca226) ─