@@ -0,0 +1,61 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Test scaffolding: the organization-less `sys_permission_set` rows an EARLIER
+ * release's platform-admin bootstrap seeded for the platform's default sets
+ * (the "platform bucket").
+ *
+ * [C3 stage 6b-2] No boot writes these rows any more (ADR-0131 D3: the sets are
+ * served from the security catalog, and a grant names its set). A suite that
+ * models an EXISTING database — a grant written before the name column, whose
+ * `permission_set_id` points at one of these rows; an organization's copy cloned
+ * from the bucket — writes them itself, here, in the shape the retired seeder
+ * wrote: `managed_by: 'platform'`, active, the set's facets as JSON columns.
+ * Idempotent: a name that already has an organization-less row is left alone.
+ *
+ * The plugin-auth copy of plugin-security's testkit of the same name, in the
+ * same shape: a test-only helper is not exported across the package boundary.
+ */
+
+import type { PermissionSet } from '@objectstack/spec/security';
+
+const SYS = { isSystem: true } as const;
+
+/** The legacy row id for a default set — stable, so a fixture can point a grant at it. */
+export function legacyBucketRowId(name: string): string {
+  return `ps_bucket_${name}`;
+}
+
+/** Write the legacy platform-bucket row for each set; returns `name → id`. */
+export async function seedLegacyPlatformBucket(
+  engine: { find: (...args: any[]) => Promise<any>; insert: (...args: any[]) => Promise<any> },
+  sets: readonly PermissionSet[],
+): Promise<Record<string, string>> {
+  const ids: Record<string, string> = {};
+  for (const ps of sets) {
+    if (!ps.name) continue;
+    const existing = ((await engine.find('sys_permission_set', { where: { name: ps.name }, context: SYS })) ?? []) as any[];
+    const own = existing.find((r) => !r.organization_id);
+    if (own?.id) {
+      ids[ps.name] = String(own.id);
+      continue;
+    }
+    const id = legacyBucketRowId(ps.name);
+    await engine.insert('sys_permission_set', {
+      id,
+      name: ps.name,
+      label: ps.label ?? ps.name,
+      description: (ps as any).description ?? null,
+      object_permissions: JSON.stringify(ps.objects ?? {}),
+      field_permissions: JSON.stringify(ps.fields ?? {}),
+      system_permissions: JSON.stringify(ps.systemPermissions ?? []),
+      row_level_security: JSON.stringify(ps.rowLevelSecurity ?? []),
+      tab_permissions: JSON.stringify(ps.tabPermissions ?? {}),
+      admin_scope: (ps as any).adminScope ? JSON.stringify((ps as any).adminScope) : null,
+      active: true,
+      managed_by: 'platform',
+    }, { context: SYS });
+    ids[ps.name] = id;
+  }
+  return ids;
+}
@@ -40,6 +40,7 @@ import { SysMetadataActivation } from '@objectstack/platform-objects/system';
 
 import { registerLastAdminGuard, type LastAdminGuardEngine } from './last-admin-guard.js';
 import { ensureDefaultOrganization } from './ensure-default-organization.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 
 const SYS = { isSystem: true } as const;
 const POSTURE_ENV = 'OS_TENANCY_POSTURE';
@@ -153,6 +154,8 @@ async function standingByReader(posture: Posture): Promise<Record<string, unknow
   await user('usr_member', 'member@gra.example', '2025-03-01T00:00:00.000Z');
   await user('usr_agent', 'agent@gra.example', '2025-04-01T00:00:00.000Z');
 
+  // An existing database: the platform-bucket rows an earlier release seeded.
+  await seedLegacyPlatformBucket(engine, bootstrapSets);
   const boot = await bootstrapPlatformAdmin(engine, bootstrapSets);
   expect(boot.adminPromoted).toBe(posture === 'single');
   if (walled) {
 
@@ -36,6 +36,7 @@ import { SysUser, SysAccount, SysMember, SysOrganization } from '@objectstack/pl
 
 import { registerLastAdminGuard, type LastAdminGuardEngine } from './last-admin-guard.js';
 import { ensureDefaultOrganization } from './ensure-default-organization.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 
 const SYS = { context: { isSystem: true } } as any;
 const GUARD_PACKAGE = 'test.grant-readers-unnamed';
@@ -122,6 +123,8 @@ async function soleGrantAnchoredAdmin(): Promise<Rig> {
       'sys_account', { id: `acc_${id}`, user_id: id, account_id: `${id}@un.example`, provider_id: 'credential' }, SYS,
     );
   }
+  // An existing database: the platform-bucket rows an earlier release seeded.
+  await seedLegacyPlatformBucket(engine, (manifest.permissions ?? []) as any[]);
   const boot = await bootstrapPlatformAdmin(engine, (manifest.permissions ?? []) as any[]);
   expect(boot).toMatchObject({ adminPromoted: true });
   return { engine };
 
@@ -0,0 +1,58 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Test scaffolding: the organization-less `sys_permission_set` rows an EARLIER
+ * release's platform-admin bootstrap seeded for the platform's default sets
+ * (the "platform bucket").
+ *
+ * [C3 stage 6b-2] No boot writes these rows any more (ADR-0131 D3: the sets are
+ * served from the security catalog, and a grant names its set). A suite that
+ * models an EXISTING database — a grant written before the name column, whose
+ * `permission_set_id` points at one of these rows; an organization's copy cloned
+ * from the bucket — writes them itself, here, in the shape the retired seeder
+ * wrote: `managed_by: 'platform'`, active, the set's facets as JSON columns.
+ * Idempotent: a name that already has an organization-less row is left alone.
+ */
+
+import type { PermissionSet } from '@objectstack/spec/security';
+
+const SYS = { isSystem: true } as const;
+
+/** The legacy row id for a default set — stable, so a fixture can point a grant at it. */
+export function legacyBucketRowId(name: string): string {
+  return `ps_bucket_${name}`;
+}
+
+/** Write the legacy platform-bucket row for each set; returns `name → id`. */
+export async function seedLegacyPlatformBucket(
+  engine: { find: (...args: any[]) => Promise<any>; insert: (...args: any[]) => Promise<any> },
+  sets: readonly PermissionSet[],
+): Promise<Record<string, string>> {
+  const ids: Record<string, string> = {};
+  for (const ps of sets) {
+    if (!ps.name) continue;
+    const existing = ((await engine.find('sys_permission_set', { where: { name: ps.name }, context: SYS })) ?? []) as any[];
+    const own = existing.find((r) => !r.organization_id);
+    if (own?.id) {
+      ids[ps.name] = String(own.id);
+      continue;
+    }
+    const id = legacyBucketRowId(ps.name);
+    await engine.insert('sys_permission_set', {
+      id,
+      name: ps.name,
+      label: ps.label ?? ps.name,
+      description: (ps as any).description ?? null,
+      object_permissions: JSON.stringify(ps.objects ?? {}),
+      field_permissions: JSON.stringify(ps.fields ?? {}),
+      system_permissions: JSON.stringify(ps.systemPermissions ?? []),
+      row_level_security: JSON.stringify(ps.rowLevelSecurity ?? []),
+      tab_permissions: JSON.stringify(ps.tabPermissions ?? {}),
+      admin_scope: (ps as any).adminScope ? JSON.stringify((ps as any).adminScope) : null,
+      active: true,
+      managed_by: 'platform',
+    }, { context: SYS });
+    ids[ps.name] = id;
+  }
+  return ids;
+}
@@ -50,6 +50,7 @@ import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { SysUser, SysAccount } from '@objectstack/platform-objects/identity';
 import { bootstrapPlatformAdmin, shouldReplayBootstrapFor } from './bootstrap-platform-admin.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 import { SysPermissionSet } from './objects/sys-permission-set.object.js';
 import { SysUserPermissionSet } from './objects/sys-user-permission-set.object.js';
 import { defaultPermissionSets } from './objects/default-permission-sets.js';
@@ -319,6 +320,8 @@ describe('#14348 — the promotion target is the oldest human that can AUTHENTIC
     // written by hand — which is exactly the row the old selector would have
     // picked.
     const { logger: seedLogger } = collectingLogger();
+    // An existing database: the platform-bucket rows an earlier release seeded.
+    await seedLegacyPlatformBucket(engine as any, defaultPermissionSets);
     const seedPass = await bootstrapPlatformAdmin(engine as any, defaultPermissionSets, {
       logger: seedLogger,
     });
 
@@ -70,6 +70,7 @@ import {
   PLATFORM_ADMIN_CANDIDATE_PAGE_SIZE,
   PLATFORM_ADMIN_CANDIDATE_SCAN_CEILING,
 } from './bootstrap-platform-admin.js';
+import { seedLegacyPlatformBucket } from './__tests__/legacy-catalog-rows.testkit.js';
 import { SysPermissionSet } from './objects/sys-permission-set.object.js';
 import { SysUserPermissionSet } from './objects/sys-user-permission-set.object.js';
 import { defaultPermissionSets } from './objects/default-permission-sets.js';
@@ -744,6 +745,8 @@ describe('#16682 — the promotion target is chosen, not sampled', () => {
       // this change's to make. A declared owner must not move an existing grant.
       const engine = await boot();
       await seedUser(engine as any, 'usr_person0', 'person0@demo.example', '2025-01-01T00:00:00.000Z', false);
+      // An existing database: the platform-bucket rows an earlier release seeded.
+      await seedLegacyPlatformBucket(engine as any, defaultPermissionSets);
       const first = await bootstrapPlatformAdmin(engine as any, defaultPermissionSets, {});
       expect(first.reason).toBe('no_authenticable_user');
       const sets = await findRows(engine, 'sys_permission_set', { name: 'admin_full_access' });