diff --git a/‎.changeset/21789-lock-reads-row-provenance.md‎
Lines changed: 13 additions & 0 deletions b/‎.changeset/21789-lock-reads-row-provenance.md‎
Lines changed: 13 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-security/src/packaged-permission-set-lock.test.ts‎
Lines changed: 100 additions & 0 deletions b/‎packages/plugins/plugin-security/src/packaged-permission-set-lock.test.ts‎
Lines changed: 100 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-security/src/packaged-permission-set-lock.ts‎
Lines changed: 23 additions & 1 deletion b/‎packages/plugins/plugin-security/src/packaged-permission-set-lock.ts‎
Lines changed: 23 additions & 1 deletion
diff --git a/‎packages/plugins/plugin-security/src/permission-set-projection.test.ts‎
Lines changed: 34 additions & 0 deletions b/‎packages/plugins/plugin-security/src/permission-set-projection.test.ts‎
Lines changed: 34 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-security/src/permission-set-projection.ts‎
Lines changed: 27 additions & 1 deletion b/‎packages/plugins/plugin-security/src/permission-set-projection.ts‎
Lines changed: 27 additions & 1 deletion
@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+A permission set an organization owns, a clone of a packaged set, and a set saved into a writable runtime package are no longer locked as if a code package shipped them
+
+Clause-②: no
+
+The packaged-permission-set lock decides "is this set shipped by a code package?" from the engine registry. The registry also holds the stored definition rows, and a metadata list read (`GET /api/v1/meta/permission`, which every Studio page load issues) stamps a stored row's package binding onto it. A set saved into a writable runtime package (`PUT /api/v1/meta/permission/:name?package=<id>`) therefore looked code-shipped after the first list read, and every later edit of it answered `403 NOT_OVERRIDABLE` at both the metadata door and the data door. The lock now skips a stored row by its provenance (`_provenance: 'org'`, which every stored row carries), the same test the platform's code-artifact check applies, so those edits are accepted again.
+
+The read had the matching defect. The security plugin keeps a marked in-memory copy of each stored definition for the permission evaluator, and the layered read (`GET /api/v1/meta/permission/:name/layers`) serves that copy as the item's `code` layer. The copy carried no provenance, so an org's own set, a clone and a runtime-package set all reported a `code` layer with no `provenance`, which the console's permission-matrix editor renders as "locked by a code package" while the server accepted the save. The copy now carries `_provenance: 'org'` exactly when the lock judges the set not code-shipped, so the layered read reports `provenance: 'org'` for those sets.
+
+Unchanged: a set a code package ships is still refused at both doors with `403 NOT_OVERRIDABLE` and the same message naming the clone path, and its layered read still reports `provenance: 'package'`, its package id and `editable: false`. No error code, route or field moves.
@@ -77,6 +77,8 @@ import { describe, it, expect } from 'vitest';
 import { PermissionSetSchema } from '@objectstack/spec/security';
 import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate } from '@objectstack/metadata-core';
 import { SysPermissionSet } from './objects/sys-permission-set.object.js';
+import { classifyPackagedPermissionSet } from './packaged-permission-set-lock.js';
+import { registerPackagedPermissionSetLockGate } from './packaged-permission-set-lock-gate.js';
 import {
   createPermissionSetWriteThrough,
   permissionSetRowFields,
@@ -885,3 +887,101 @@ describe('control B — the provenance read is not a name-keyed table read at al
     expect(ql.metaRows.length).toBe(0);
   });
 });
+
+// ─────────────────────────────────────────────────────────────────────────────
+// [#21789] The lock reads the ROW's provenance, not the presence of a package id
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * The registry holds stored rows as well as artifacts. The metadata layer
+ * hydrates every env-wide `sys_metadata` row into it (a list read, and the
+ * boot) as `mergeArtifactProtection(stateTenantAuthorship(row), artifact)`: the
+ * row's `package_id` column stamped on as `_packageId`, `_provenance: 'org'`
+ * written over it, and, only where a code artifact ships the name, the
+ * artifact's envelope written over that. These builders produce exactly those
+ * three bodies, so the verdicts below are about the shapes the boot really
+ * registers, measured on a booted showcase (the dogfood pin
+ * `permission-set-lock-row-provenance.dogfood.test.ts` asserts the hydrated
+ * shape before it asserts the edit).
+ */
+const RUNTIME_PACKAGE = 'app.crm_workspace';
+/** Shape 1: a set saved into a writable runtime package, as hydrated. */
+const hydratedRuntimePackageRow = (over: Record<string, any> = {}) => ({
+  ...orgSet({ name: 'workspace_rep' }),
+  _packageId: RUNTIME_PACKAGE,
+  _provenance: 'org',
+  ...over,
+});
+/** Shapes 2 and 3: the org's own set, and a clone, as hydrated (no package column). */
+const hydratedOrgRow = (over: Record<string, any> = {}) => ({ ...orgSet(), _provenance: 'org', ...over });
+/** A code-shipped artifact as the loader registers it (`applyProtection` with a package id). */
+const shippedArtifact = (over: Record<string, any> = {}) => packagedSet({ _provenance: 'package', ...over });
+
+describe('[#21789] the lock judges "shipped by a code package" from the row\'s provenance', () => {
+  it('a set in a writable runtime package, hydrated with its package id, is NOT packaged', () => {
+    expect(classifyPackagedPermissionSet('workspace_rep', makeQl([hydratedRuntimePackageRow()])))
+      .toEqual({ status: 'org' });
+  });
+
+  it('an org-owned set and a clone, hydrated as stored rows, are NOT packaged', () => {
+    const ql = makeQl([hydratedOrgRow(), hydratedOrgRow({ name: 'ehr_quality_inspector_local' })]);
+    expect(classifyPackagedPermissionSet('org_support_agent', ql)).toEqual({ status: 'org' });
+    expect(classifyPackagedPermissionSet('ehr_quality_inspector_local', ql)).toEqual({ status: 'org' });
+  });
+
+  it('control: a code-shipped set stays packaged, alone and beside a stored row of its name', () => {
+    expect(classifyPackagedPermissionSet('ehr_quality_inspector', makeQl([shippedArtifact()])))
+      .toEqual({ status: 'packaged', packageId: 'com.example.ehr' });
+    // A legacy overlay of a shipped name is hydrated wearing the artifact's
+    // envelope, and the artifact is in the same list: still packaged, in either order.
+    const legacyOverlay = shippedArtifact({ systemPermissions: ['overlaid'] });
+    for (const items of [[legacyOverlay, shippedArtifact()], [shippedArtifact(), legacyOverlay]]) {
+      expect(classifyPackagedPermissionSet('ehr_quality_inspector', makeQl(items)))
+        .toEqual({ status: 'packaged', packageId: 'com.example.ehr' });
+    }
+  });
+
+  it('the layered read\'s code layer is judged the same way when there is no registry', () => {
+    const ql = makeQl(null);
+    const read = (code: unknown) => ({ status: 'read' as const, envelope: { code, overlay: null, effective: code } });
+    expect(classifyPackagedPermissionSet('workspace_rep', ql, read(hydratedRuntimePackageRow())))
+      .toEqual({ status: 'org' });
+    expect(classifyPackagedPermissionSet('ehr_quality_inspector', ql, read(shippedArtifact())))
+      .toEqual({ status: 'packaged', packageId: 'com.example.ehr' });
+  });
+
+  it('the data door accepts an edit of a runtime-package set, and the edit lands', async () => {
+    const ql = makeQl([hydratedRuntimePackageRow()]);
+    const protocol = makeHatchOpenProtocol(ql, {});
+    registerPermissionSetProjection(protocol, { ql });
+    await protocol.saveMetaItem({ type: 'permission', name: 'workspace_rep', item: orgSet({ name: 'workspace_rep' }) });
+    const row = ql.permRows.find((r: any) => r.name === 'workspace_rep');
+    expect(row, 'precondition: the projected row exists').toBeTruthy();
+    const savesBefore = protocol.saves.length;
+
+    const rejection = await run(makeMiddleware(ql, protocol), {
+      object: 'sys_permission_set', operation: 'update', context: userCtx,
+      data: { id: row.id, system_permissions: '["support.use","workspace.only"]' },
+    }).then(() => null, (e: any) => e);
+
+    expect(rejection, 'the lock must not refuse a set no code package ships').toBeNull();
+    expect(protocol.saves.length, 'the definition write LANDED').toBe(savesBefore + 1);
+    expect(JSON.parse(ql.permRows.find((r: any) => r.name === 'workspace_rep').system_permissions))
+      .toEqual(['support.use', 'workspace.only']);
+  });
+
+  it('the metadata door accepts a runtime-package set and still refuses a code-shipped one with 403 NOT_OVERRIDABLE', async () => {
+    const ql = makeQl([hydratedRuntimePackageRow(), shippedArtifact()]);
+    let gate: ((ctx: { type: string; name: string; body: unknown }) => Promise<void>) | undefined;
+    const protocol = {
+      registerAuthoringGate: (_type: string, g: typeof gate) => { gate = g; },
+      getMetaItemLayered: async ({ name }: { name: string }) => ({ type: 'permission', name, code: null, overlay: null, effective: null }),
+    };
+    expect(registerPackagedPermissionSetLockGate(protocol, ql)).toBe(true);
+
+    await expect(gate!({ type: 'permission', name: 'workspace_rep', body: orgSet({ name: 'workspace_rep' }) }))
+      .resolves.toBeUndefined();
+    await expect(gate!({ type: 'permission', name: 'ehr_quality_inspector', body: packagedSet() }))
+      .rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403 });
+  });
+});
@@ -87,6 +87,8 @@
  * direction that cannot be undone (an overlay, once minted, wins forever).
  */
 
+import { isTenantAuthored } from '@objectstack/metadata-core';
+
 /**
  * ⛔ This module imports NOTHING from the rest of the plugin, and that is
  * structural rather than stylistic: `permission-set-projection.ts` imports
@@ -146,7 +148,24 @@ export type LayeredProbe =
   | { status: 'read'; envelope: unknown }
   | { status: 'failed'; reason: string };
 
-/** Is this registry/layer item a real shipped artifact for `name`? */
+/**
+ * Is this registry/layer item a real shipped artifact for `name`?
+ *
+ * [#21789] A package id on the item does not answer that by itself. The
+ * registry holds stored rows as well as artifacts: the metadata layer hydrates
+ * env-wide `sys_metadata` rows into it, and the list read (`getMetaItems`)
+ * stamps the row's `package_id` column onto the body as `_packageId` on the
+ * way. A set saved into a writable runtime package therefore carries a package
+ * id just as a code-shipped one does, and reading "has a package id" as
+ * "shipped by code" locked it after the first list read. What tells the two apart is the
+ * provenance the hydrator writes on every stored row (ADR-0010
+ * `_provenance: 'org'`), read through `isTenantAuthored`: the exclusion
+ * `isCodeArtifactBody` and `SchemaRegistry.getArtifactItem` already apply, so
+ * this is the platform's one answer, not a second one. A stored row of a name a
+ * code package ships is hydrated wearing the artifact's envelope
+ * (`_provenance: 'package'`), and the artifact itself is in the same list, so a
+ * code-shipped set stays locked.
+ */
 function declaredPackageIdOf(item: any, name: string): string | null {
   if (!item || typeof item !== 'object') return null;
   if (item.name !== name) return null;
@@ -155,6 +174,9 @@ function declaredPackageIdOf(item: any, name: string): string | null {
   // set look packaged on the next pass, which is a lock that latches on the
   // wrong evidence.
   if (item[ENV_PROJECTION_MARKER]) return null;
+  // A stored (tenant-authored) row is never a shipped artifact, whatever
+  // package it is bound to. See the doc comment.
+  if (isTenantAuthored(item)) return null;
   const packageId = item._packageId ?? item.packageId;
   if (typeof packageId !== 'string' || packageId === '') return null;
   if (packageId === RUNTIME_SHADOW_PACKAGE_ID) return null;
 
@@ -419,6 +419,40 @@ describe('projectPermissionMutation (the awaited projector)', () => {
     expect(healed?._envProjection).toBeUndefined();
   });
 
+  // [#21789] The echo is served by the protocol's layered read as the item's
+  // `code` layer, and the envelope's `provenance` is read off it — so the echo
+  // must say what the lock says, or the read reports a lock the doors do not
+  // enforce (an org's own set rendered "locked by a code package").
+  it('[#21789] the echo of a set no code package ships says so: `_provenance: \'org\'`', async () => {
+    const ql = makeQl();
+    // The registry holds the stored row the way the hydrator registers it —
+    // a runtime package id stamped on, tenant provenance written over it.
+    (ql as any).registry = {
+      listItems: (t: string) => (t === 'permission'
+        ? [{ ...envBody(), _packageId: 'app.crm_workspace', _provenance: 'org' }]
+        : []),
+    };
+    const protocol = makeProtocol(ql);
+    ql.metaRows.push({ id: 'm1', type: 'permission', name: 'organization_admin', state: 'active', organization_id: null, metadata: JSON.stringify(envBody()) });
+    const metadata = makeMetadataFacade();
+    await projectPermissionMutation(protocol, { ql, metadata }, { type: 'permission', name: 'organization_admin', state: 'active' });
+    const entry = metadata.registry.get('permission/organization_admin');
+    expect({ marker: entry?._envProjection, provenance: entry?._provenance }).toEqual({ marker: true, provenance: 'org' });
+  });
+
+  it('[#21789] control: the echo of a legacy overlay of a code-shipped set does NOT claim tenant provenance', async () => {
+    const ql = makeQl();
+    const shipped = { ...envBody({ systemPermissions: ['declared.only'] }), _packageId: 'com.example.crm', _provenance: 'package' };
+    (ql as any).registry = { listItems: (t: string) => (t === 'permission' ? [shipped] : []) };
+    const protocol = makeProtocol(ql, { organization_admin: shipped });
+    ql.metaRows.push({ id: 'm1', type: 'permission', name: 'organization_admin', state: 'active', organization_id: null, metadata: JSON.stringify(envBody({ systemPermissions: ['overlaid'] })) });
+    const metadata = makeMetadataFacade();
+    await projectPermissionMutation(protocol, { ql, metadata }, { type: 'permission', name: 'organization_admin', state: 'active' });
+    const entry = metadata.registry.get('permission/organization_admin');
+    expect(entry?.systemPermissions, 'precondition: the overlay was projected').toEqual(['overlaid']);
+    expect({ marker: entry?._envProjection, provenance: entry?._provenance ?? null }).toEqual({ marker: true, provenance: null });
+  });
+
   it('skips draft saves and non-permission events', async () => {
     const ql = makeQl();
     const protocol = makeProtocol(ql);
 
@@ -97,6 +97,7 @@ import type { PermissionSetNameCollisionDiagnostic } from './permission-set-name
 import {
   ENV_PROJECTION_MARKER,
   assertPermissionSetNotPackageDeclared,
+  classifyPackagedPermissionSet,
   type LayeredProbe,
 } from './packaged-permission-set-lock.js';
 import { PermissionSetNameConflictError } from './errors.js';
@@ -723,6 +724,21 @@ export async function upsertEnvPermissionSet(
  * artifact after the overlay is gone. When the overlay disappears, a stale
  * echo is healed back to `restoreTo` (the declared body) or dropped.
  *
+ * [#21789] ⭐ The echo also states its PROVENANCE, and it states the lock's
+ * verdict. The metadata manager's get is registry-first, so the protocol's
+ * layered read serves this echo as the item's `code` layer, and the envelope's
+ * `provenance` is read off that layer. Unstamped, every set with an overlay row
+ * (an org's own set, a clone, a set in a writable runtime package) reported a
+ * code layer with no provenance, which is how a client reads "a code package
+ * ships this" (objectui's permission-matrix editor rendered such a set locked
+ * while every write door accepted the save). So the echo carries
+ * `_provenance: 'org'` exactly when {@link classifyPackagedPermissionSet}, the
+ * classifier both write doors ask, answers `org` for the name: the reported
+ * state and the enforced state are one judgment. A `packaged` verdict (a
+ * legacy overlay of a code-shipped set) or an `unknown` one leaves the echo
+ * unstamped, as before, so the read keeps reporting the lock the doors keep
+ * enforcing.
+ *
  * Best-effort: when the facade lacks `registerInMemory`, overlay-only names
  * still resolve via the DatabaseLoader / record dbLoader.
  */
@@ -731,12 +747,14 @@ async function syncEvaluatorRegistry(
   name: string,
   body: any,
   overlayBacked: boolean,
+  tenantAuthored = false,
 ): Promise<void> {
   try {
     if (!metadata || typeof metadata.registerInMemory !== 'function' || !name) return;
     if (overlayBacked && body?.name) {
       metadata.registerInMemory('permission', name, {
         ...stripDecorations(body),
+        ...(tenantAuthored ? { _provenance: 'org' } : {}),
         [ENV_PROJECTION_MARKER]: true,
       });
       return;
@@ -829,6 +847,9 @@ export async function projectPermissionMutation(
   const { ql, metadata, logger } = deps;
   let body: any = null;
   let overlayBacked = false;
+  // [#21789] The layered read, handed to the lock's classifier below as its
+  // second source, exactly as the write doors hand it theirs.
+  let layeredProbe: LayeredProbe | undefined;
   if (protocol && typeof protocol.getMetaItemLayered === 'function') {
     const layered = await protocol.getMetaItemLayered({
       type: 'permission',
@@ -846,6 +867,7 @@ export async function projectPermissionMutation(
     const isEnvelope = layered && typeof layered === 'object'
       && ('effective' in layered || 'overlay' in layered || 'code' in layered);
     if (isEnvelope) {
+      layeredProbe = { status: 'read', envelope: layered };
       const overlay = layered.overlay ?? null;
       overlayBacked = !!overlay;
       const declared = readDeclaredBody(ql, evt.name);
@@ -885,7 +907,11 @@ export async function projectPermissionMutation(
   // unchanged` — never "a write happened". A FAILED write still leaves all
   // three at zero and still skips the sync, exactly as before.
   if (out.seeded + out.updated + out.unchanged > 0) {
-    await syncEvaluatorRegistry(metadata, evt.name, body, overlayBacked);
+    // [#21789] The echo's provenance is the lock's verdict for the name — see
+    // {@link syncEvaluatorRegistry}.
+    const tenantAuthored = overlayBacked
+      && classifyPackagedPermissionSet(evt.name, ql, layeredProbe).status === 'org';
+    await syncEvaluatorRegistry(metadata, evt.name, body, overlayBacked, tenantAuthored);
   }
   return out;
 }