@wildo-ai/saas-models 1.0.1 → 1.1.1

package/dist/esm/resources/resources-registry.shared.core.definitions.js

@@ -16,15 +16,20 @@ import { userSelfPreferencesResourceConfiguration_InitializationFactory } from "
 import { applicationResourceConfiguration_InitializationFactory } from "../applications/applications.shared.resources-config.schemas.js";
 import { organizationResourceConfiguration_InitializationFactory } from "../organizations/organizations.shared.resources-config.schemas.js";
 import { organizationUnitResourceConfiguration_InitializationFactory } from "../organizations/organization-units.shared.resources-config.schemas.js";
+import { organizationUnitMemberResourceConfiguration_InitializationFactory } from "../organizations/organization-unit-members.shared.resources-config.schemas.js";
 import { organizationProfileResourceConfiguration_InitializationFactory } from "../organizations/organization-profile.shared.resources-config.schemas.js";
 import { organizationPreferencesResourceConfiguration_InitializationFactory } from "../organizations/organization-preferences.shared.resources-config.schemas.js";
+import { platformAccessGrantsResourceConfiguration_InitializationFactory } from '../security/authorizations/platform-access-grants.shared.resources-config.schemas.js';
 import { organizationNotificationsResourceConfiguration_InitializationFactory } from "../organizations/organization-notifications.shared.resources-config.schemas.js";
 import { organizationFeaturesResourceConfiguration_InitializationFactory } from "../organizations/organization-features.shared.resources-config.schemas.js";
 import { userFeaturesResourceConfiguration_InitializationFactory } from "../features/user-features.shared.resources-config.schemas.js";
+import { applicationFeaturesResourceConfiguration_InitializationFactory } from "../features/application-features.shared.resources-config.schemas.js";
 import { organizationMembersResourceConfiguration_InitializationFactory } from "../organizations/organization-members.shared.resources-config.schemas.js";
-import { organizationMemberInvitationsResourceConfiguration_InitializationFactory } from "../organizations/organization-member-invitations.shared.resources-config.schemas.js";
 import { orgApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-organization.shared.resources-config.schemas.js";
 import { appApiKeysResourceConfiguration_InitializationFactory } from "../security/api-keys/api-keys-application.shared.resources-config.schemas.js";
+import { orgOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js";
+import { appOAuthClientsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js";
+import { oauthConsentGrantsResourceConfiguration_InitializationFactory } from "../security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.js";
 import { billingAccountsPolymorphicFactories } from "../billing/billing-account.shared.resources-config.schemas.js";
 import { billingAccountsPolymorphicDeclaration } from "../billing/billing-account.shared.schemas.js";
 import { productsResourceConfiguration_InitializationFactory } from "../billing/product.shared.resources-config.schemas.js";
@@ -40,19 +45,27 @@ import { creditPoolsPolymorphicFactories } from "../billing/credit-pool.shared.r
 import { creditPoolsPolymorphicDeclaration } from "../billing/credit-pool.shared.schemas.js";
 import { promotionsResourceConfiguration_InitializationFactory } from "../billing/promotions.shared.resources-config.schemas.js";
 import { referralsResourceConfiguration_InitializationFactory } from "../billing/referral.shared.resources-config.schemas.js";
-import { notificationBadgesResourceConfiguration_InitializationFactory } from "../notifications/notification-badges.shared.resources-config.schemas.js";
+import { userNotificationBadgesResourceConfiguration_InitializationFactory, organizationNotificationBadgesResourceConfiguration_InitializationFactory, } from "../notifications/notification-badges.shared.resources-config.schemas.js";
 import { createResourcesRelationship } from "./resources-relationships.shared.factory.js";
 import { applicationVersionsResourceConfiguration_InitializationFactory } from "../applications/application-versions.shared.resources-config.schemas.js";
 import { applicationMetadataResourceConfiguration_InitializationFactory } from "../applications/application-metadata.shared.resources-config.schemas.js";
 // Queue system resources
 import { jobExecution_ResourceConfiguration_InitializationFactory, jobPayloadStorage_ResourceConfiguration_InitializationFactory } from "../queue/jobs.shared.resources-config.schemas.js";
-// Email system resources
-import { emailTemplateResourceConfiguration_InitializationFactory } from "../notifications/email/email-template.shared.resources-config.schemas.js";
-import { emailHeaderFooterTemplateResourceConfiguration_InitializationFactory } from "../notifications/email/email-header-footer-template.shared.resources-config.schemas.js";
+// Flows-Actors execution resource (persisted flow/actor system executions)
+import { flowActorExecutionsPolymorphicFactories } from "../flows-actors/flows-actors-execution.shared.resources-config.schemas.js";
+import { flowActorExecutionsPolymorphicDeclaration } from "../flows-actors/flows-actors-execution.shared.schemas.js";
+import { flowActorTasksPolymorphicFactories } from "../flows-actors/flows-actors-task.shared.resources-config.schemas.js";
+import { flowActorTasksPolymorphicDeclaration } from "../flows-actors/flows-actors-task.shared.schemas.js";
+import { a2aTokenBudgetStatePolymorphicFactories } from "../flows-actors/a2a-token-budget-state.shared.resources-config.schemas.js";
+import { a2aPushDeliveryLogPolymorphicFactories } from "../flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.js";
+import { a2aTokenBudgetStatePolymorphicDeclaration } from "../flows-actors/a2a-token-budget-state.shared.schemas.js";
+import { a2aPushDeliveryLogPolymorphicDeclaration } from "../flows-actors/a2a-push-delivery-log.shared.schemas.js";
 // Authentication resources
 import { userIdentityLinksResourceConfiguration_InitializationFactory } from "../users/user-identity-links.shared.resources-config.schemas.js";
 // Anonymous session resources (W7.3a)
 import { anonymousUsersResourceConfiguration_InitializationFactory } from "../users/anonymous-users.shared.resources-config.schemas.js";
+// Inbound contacts (Phase 0.5 — public marketing-site lead capture, Q-E=B path)
+import { inboundContactsResourceConfiguration_InitializationFactory } from "../users/inbound-contacts.shared.resources-config.schemas.js";
 // Guidance State resources
 import { userGuidanceStateResourceConfiguration_InitializationFactory, organizationGuidanceStateResourceConfiguration_InitializationFactory } from "../guidance/guidance-state.shared.resources-config.schemas.js";
 // Auth polymorphic resource configs (SSO + SIEM + SCIM)
@@ -60,12 +73,14 @@ import { ssoConfigPolymorphicFactories } from "../security/authentications/sso/s
 import { ssoConfigPolymorphicDeclaration } from "../security/authentications/sso/sso-config.shared.schemas.js";
 import { ssoConnectionPolymorphicFactories } from "../security/authentications/sso/sso-connection.shared.resources-config.schemas.js";
 import { ssoConnectionPolymorphicDeclaration } from "../security/authentications/sso/sso-connection.shared.schemas.js";
-import { authPolicyPolymorphicFactories } from "../security/authentications/policy/auth-policy.shared.resources-config.schemas.js";
-import { authPolicyPolymorphicDeclaration } from "../security/authentications/policy/auth-policy.shared.schemas.js";
 import { siemExportConfigPolymorphicFactories } from "../security/authentications/siem/siem-export-config.shared.resources-config.schemas.js";
 import { siemExportConfigPolymorphicDeclaration } from "../security/authentications/siem/siem-export-config.shared.schemas.js";
 import { siemDeliveryDlqPolymorphicFactories } from "../security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.js";
 import { siemDeliveryDlqPolymorphicDeclaration } from "../security/authentications/siem/siem-delivery-dlq.shared.schemas.js";
+import { webhookConfigPolymorphicFactories } from "../notifications/m2m/webhook-config.shared.resources-config.schemas.js";
+import { webhookConfigPolymorphicDeclaration } from "../notifications/m2m/webhook-config.shared.schemas.js";
+import { m2mWebhookDeliveryLogPolymorphicFactories } from "../notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.js";
+import { m2mWebhookDeliveryLogPolymorphicDeclaration } from "../notifications/m2m/m2m-webhook-delivery-log.shared.schemas.js";
 import { scimTokensPolymorphicFactories } from "../security/authentications/scim/scim-tokens.shared.resources-config.schemas.js";
 import { scimTokensPolymorphicDeclaration } from "../security/authentications/scim/scim-tokens.shared.schemas.js";
 import { scimProvisioningConfigPolymorphicFactories } from "../security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js";
@@ -94,7 +109,52 @@ export const coreSharedResourceRelationship = [
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_PROFILES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // onParentDelete: cascade the profile row when the user is deleted.
+        // onParentCreate: eagerly seed the profile on user creation (Tier-2
+        // input-derived). Unlike USER_PREFERENCES (pure defaults), a profile's
+        // firstName/lastName do NOT live on the USERS row — they originate in the
+        // registration form / SSO-JIT / SCIM profile, OUTSIDE the USERS-create
+        // payload. Each provisioning path threads them via the
+        // `compositionSeedRequestInput` options channel on its `create(USERS, …)`,
+        // and this override forwards them into the profile seed. When the names are
+        // absent (the org-admin INVITE create — the invitee names the profile later
+        // at acceptance), the override returns `undefined` to DECLINE the seed, so no
+        // nameless/duplicate row is created; the invitation-acceptance flow owns that
+        // single write. USERS is the resource created at every provisioning entry
+        // point, so THIS USERS→USER_PROFILES edge fires — not the read-only USER_SELF
+        // variant.
+        childOperations: {
+            lifecycle: {
+                onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 },
+                onParentCreate: {
+                    enabled: true,
+                    initialData: {
+                        override: (ctx) => {
+                            const requestInput = ctx.requestInput;
+                            const firstName = requestInput?.firstName;
+                            const lastName = requestInput?.lastName;
+                            // A profile REQUIRES a non-empty first+last (UserProfileSchema
+                            // min(1)). DECLINE (undefined) when either is absent OR empty — the
+                            // org-admin INVITE create (no name; the invitee names the profile at
+                            // acceptance) or an IdP that supplied no given/family name — so no
+                            // invalid or nameless row is ever seeded (a clean skip, not a
+                            // swallowed validation failure).
+                            if (typeof firstName !== 'string' || firstName.length === 0 ||
+                                typeof lastName !== 'string' || lastName.length === 0) {
+                                return undefined;
+                            }
+                            // Prefer an IdP-supplied displayName; otherwise derive one so every
+                            // seeded profile carries a non-empty label.
+                            const suppliedDisplayName = requestInput?.displayName;
+                            const displayName = typeof suppliedDisplayName === 'string' && suppliedDisplayName.length > 0
+                                ? suppliedDisplayName
+                                : `${firstName} ${lastName}`;
+                            return { firstName, lastName, displayName };
+                        },
+                    },
+                },
+            },
+        },
         foreignKeyField: 'userId',
         // 1:1 profile: full on READ, summary otherwise
         contextPolicy: {
@@ -107,7 +167,12 @@ export const coreSharedResourceRelationship = [
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_PREFERENCES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // onParentDelete: cascade the preferences row when the user is deleted.
+        // onParentCreate: eagerly seed a default preferences row on user creation
+        // (Tier-1 pure-defaults — the child's Zod defaults fill it; USER_SELF reads
+        // the same collection). USERS is the resource created at registration, so
+        // THIS USERS→USER_PREFERENCES edge fires — not the USER_SELF variant.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         foreignKeyField: 'userId',
         // 1:1 preferences: full on READ, summary otherwise
         contextPolicy: {
@@ -117,9 +182,13 @@ export const coreSharedResourceRelationship = [
             }
         }
     }),
-    // Link Users to UserCredentials (standalone access, internal-only operations)
+    // Link Users to UserCredentials (standalone access, internal-only operations).
+    // STANDALONE keeps credentials off the URL surface; `isPrimaryScope: true` anchors
+    // the resource's `resourcePrimaryScope` enum to USER_SELF (ownership graph is
+    // orthogonal to URL routing — see `resources-relationships.shared.factory.ts` Guard 1).
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_CREDENTIALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         foreignKeyField: 'userId',
@@ -128,16 +197,30 @@ export const coreSharedResourceRelationship = [
     }),
     // Link Users to UserIdentityLinks (1:N — user can have multiple OAuth2/SSO provider connections)
     // Standalone access (internal-only operations), cascade delete on user removal.
-    // Unique compound index: userId + providerRef + connectionType (enforced at DB level)
-    // Secondary index: providerRef + providerUserId (fast lookup during JIT provisioning)
+    // The schema's businessKeySet enforces one external identity binding per exact
+    // social/enterprise tenant connection. Individual DB indexes support callback lookup.
+    // STANDALONE keeps identity links off the URL surface; `isPrimaryScope: true` anchors
+    // the resource's `resourcePrimaryScope` enum to USER_SELF.
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_IDENTITY_LINKS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         foreignKeyField: 'userId',
         // SECURITY: Identity links contain raw IdP profiles — never fetch via context
         contextPolicy: { enabled: false }
     }),
+    // OIDC persistent consent grants — USER_SELF-scoped ("remember this app"). COMPOSITION so a user's
+    // grants cascade-delete with the user; `isPrimaryScope: true` anchors resourcePrimaryScope to
+    // USER_SELF (the owner-only READ/LIST/DELETE filter). Consent state is never context-fetched.
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.OAUTH_CONSENT_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        foreignKeyField: 'userId',
+        contextPolicy: { enabled: false }
+    }),
     // User Self 1:1 relationships - separated for access control
     createResourcesRelationship(CoreResourceType.USER_SELF, CoreResourceType.USER_SELF_PROFILES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
@@ -167,8 +250,22 @@ export const coreSharedResourceRelationship = [
     }),
     // User Self → Organization Members (for context fetching organizationMembers)
     // 1:MANY - user can have multiple organization memberships
+    //
+    // STANDALONE: this relationship exists ONLY to let the backend context-fetch
+    // the caller's own membership on READ (see `contextPolicy` below). It must NOT
+    // mint a URL route. Without an explicit `accessScopeStrategy`, the factory
+    // defaults a MANDATORY parent to `REQUIRES_CONTEXT`, which forced a mandatory
+    // `/user-user-self/{userId}/...` segment into EVERY generated organization-members
+    // route — so the clean `/organizations/{orgId}/organization-members/...` route
+    // was never emitted, and a people-picker searching org members got the
+    // over-nested user-self route (returning only the caller's own membership).
+    // `accessScopeStrategy` (URL routing) and `contextPolicy` (context fetching)
+    // are orthogonal axes; STANDALONE keeps this off the URL surface while the
+    // context fetch is preserved — exactly mirroring the USER_CREDENTIALS /
+    // USER_IDENTITY_LINKS siblings above and the ORGANIZATIONS primary anchor below.
     createResourcesRelationship(CoreResourceType.USER_SELF, CoreResourceType.ORGANIZATION_MEMBERS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        isPrimaryScope: false, // Not primary scope - ORGANIZATION_MEMBERS has ORGANIZATIONS as primary
+        isPrimaryScope: false, // Not primary scope - ORGANIZATION_MEMBERS has ORGANIZATIONS as primary (declared via the STANDALONE rel below)
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
         foreignKeyField: 'userId',
         // For context: fetch full on READ, disabled otherwise (performance)
@@ -180,6 +277,62 @@ export const coreSharedResourceRelationship = [
             }
         }
     }),
+    // ORGANIZATIONS scope anchor for ORGANIZATION_MEMBERS (STANDALONE primary).
+    //
+    // The M:N expansion of `ORGANIZATIONS ↔ USERS via ORGANIZATION_MEMBERS`
+    // synthesizes two OPTIONAL_CONTEXT non-primary peer→junction edges so the
+    // junction is routable under both `/organizations/:id/...` and
+    // `/users/:id/...`. That URL behavior is intentional and stays untouched.
+    //
+    // This separate STANDALONE primary rel exists purely to anchor the
+    // resource's `resourcePrimaryScope` enum to ORGANIZATIONS (matching the
+    // long-standing comment on the USER_SELF rel above). STANDALONE keeps it
+    // off the URL surface (the M:N expansion already handles routing); the
+    // primary-scope flag declares the structural ownership.
+    //
+    // ⚠️ This is the edge that carries the teardown cascade — NOT the `USER_SELF` rel above and
+    // NOT the synthesized M:N peer edges. Picking the wrong one of the three is the easy mistake
+    // here: only this one is the ORGANIZATIONS-side primary anchor, so only this one is traversed
+    // when a tenant is destroyed.
+    //
+    // Until 2026-08-01 it declared NO `childOperations` at all, so membership rows ORPHANED on
+    // tenant deletion while every other org child cascaded. The orphan row was the visible
+    // symptom; the real defect was that nothing reconciled `user.userTypes`, a GLOBAL grant that
+    // could outlive the tenant justifying it.
+    //
+    // Under the WS-A teardown split this cascade fires at PURGE, never at the soft-delete mark.
+    // That ordering is the design, not an implementation detail: the rows are exactly what a
+    // restore re-derives organization-scoped authority from during the retention window, so
+    // removing them at mark time would make the window unrecoverable. The authority half is
+    // handled at the mark instead, by recomputing it from `Organization.status` — see
+    // `isAuthorityConferringOrganizationStatus` and the `request_deletion` operation.
+    //
+    // ⚠️ `nature` moved REFERENCE → COMPOSITION in the same change, and it had to. The framework
+    // refuses a lifecycle on a REFERENCE edge outright — "REFERENCE relationships cannot project to
+    // nested CRUD/read embedding or dependent lifecycle" — because only COMPOSITION resolves to
+    // `lifecycleModelMode: DEPENDENT`, and DEPENDENT is what "the parent owns this row's lifetime"
+    // means. Declaring the cascade while leaving the nature alone would not have been a smaller
+    // change; it would not have built.
+    //
+    // COMPOSITION is also the honest reading, not a concession to the guard. A membership is
+    // meaningless without its organization: it cannot be re-homed, it has no independent identity,
+    // and this very edge already declares ORGANIZATIONS its primary scope. The sibling junction
+    // ORGANIZATION_UNIT_MEMBERS reached the same conclusion on its own ORGANIZATIONS edge above —
+    // COMPOSITION, `isPrimaryScope`, cascade — so the two junctions now describe their tenant
+    // relationship identically instead of disagreeing for historical reasons.
+    //
+    // The USER_SELF → ORGANIZATION_MEMBERS edge above stays REFERENCE and is NOT affected. That
+    // asymmetry is correct and load-bearing: a membership dies with its ORGANIZATION but must
+    // survive its USER's erasure (an erasure keeps the subject row, and `USERS` classifies that
+    // edge NOT_OWNED). Changing the user-side edge too would silently make a subject erasure start
+    // deleting membership rows.
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_MEMBERS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false }
+    }),
     // Organization member join table relationships - explicit for URL generation
     // Note: Removed USERS → ORGANIZATION_MEMBERS to simplify user URL generation
     // Users should primarily be accessed standalone or via application context
@@ -210,10 +363,77 @@ export const coreSharedResourceRelationship = [
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,
         contextPolicy: { enabled: false },
     }),
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_PROFILES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+    // ── Organization unit membership (junction) ──────────────────────────────
+    // Replaced `OrganizationMember.organizationUnitsMembership` (D-B5). Three edges, each earning
+    // its place:
+    //
+    //  1. ORGANIZATIONS → …  is the PRIMARY SCOPE anchor: the row carries `organizationId`, so
+    //     tenant scoping and the contextual filter resolve without a join, and a tenant teardown
+    //     removes assignments with everything else it owns.
+    //  2. ORGANIZATION_MEMBERS → …  is the SEMANTIC parent. A unit assignment presupposes
+    //     membership, so losing the membership is exactly when the assignment stops meaning
+    //     anything — hence the cascade. This is the edge that stops assignments outliving the
+    //     membership that justified them.
+    //  3. ORGANIZATION_UNITS → …  is what the unit DELETE dependents guard was missing. While unit
+    //     assignment lived in an embedded array it was not a registered relationship and not
+    //     portably queryable, so "assigned members" had to be EXCLUDED from that guard (it would
+    //     have failed open on PostgreSQL). As a real edge it becomes a guardable dependent.
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // High cardinality: a tenant can hold one row per (member × unit).
+        contextPolicy: {
+            operationOverrides: {
+                [CoreResourceOperation.LIST]: { enabled: false },
+                [CoreResourceOperation.SEARCH]: { enabled: false },
+            }
+        }
+    }),
+    // OPTIONAL_CONTEXT, not the REQUIRES_CONTEXT default — otherwise the junction is unlistable.
+    //
+    // `generateParentCombinations` puts every REQUIRES_CONTEXT parent into EVERY url combination. With
+    // both this edge and the ORGANIZATION_UNITS edge below defaulting to REQUIRES_CONTEXT, the only
+    // route generated was the fully-nested
+    // `…/organization-members/{m}/organization-units/{u}/organization-unit-members` — so LIST could
+    // only ever be called with BOTH sides already known, returning at most the single row the caller
+    // had just identified. "Which units is this member in?" had NO http surface at all, even though
+    // it is a real, exercised query: SCIM runs exactly it service-side
+    // (`list(ORGANIZATION_UNIT_MEMBERS, ec, { organizationMemberId })`).
+    //
+    // OPTIONAL_CONTEXT makes the parent addressable-but-not-mandatory, so the builder emits the
+    // member-scoped route ALONGSIDE the full one. Permitted here because this edge is not the primary
+    // scope (the factory rejects OPTIONAL_CONTEXT only for `isPrimaryScope`). The ORGANIZATIONS edge
+    // above stays primary-scope and keeps its LIST/SEARCH context override, so this does NOT open an
+    // unbounded org-wide listing of every (member × unit) pair — each new route is still narrowed by
+    // one side of the junction.
+    createResourcesRelationship(CoreResourceType.ORGANIZATION_MEMBERS, CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        nature: RelationshipNature.COMPOSITION,
+        foreignKeyField: 'organizationMemberId',
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
+    // No cascade on this edge ON PURPOSE — it mirrors the unit tree's own delete policy. A unit
+    // DELETE is refused while dependents remain (the operator decides where an orphaned assignment
+    // belongs) rather than silently dropping people's roles behind a single-node delete. Tearing
+    // down the whole ORGANIZATION still removes these rows via edge 1 above.
+    // OPTIONAL_CONTEXT for the same reason as the ORGANIZATION_MEMBERS edge above — this is the
+    // mirrored half. Together the two now yield the unit-scoped route as well, so "who is in this
+    // unit?" is answerable, and both partial routes exist beside the fully-nested one rather than
+    // instead of it.
+    createResourcesRelationship(CoreResourceType.ORGANIZATION_UNITS, CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        nature: RelationshipNature.COMPOSITION,
+        foreignKeyField: 'organizationUnitId',
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_PROFILES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed a default org profile row on org creation
+        // (branding now defaulted → seedable). Fixes the latent missing-row gap.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         foreignKeyField: 'organizationId',
         // 1:1 profile: full on READ
         contextPolicy: {
@@ -223,11 +443,67 @@ export const coreSharedResourceRelationship = [
             }
         }
     }),
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_PREFERENCES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.PLATFORM_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        // The grant belongs to the tenant being reached INTO, which is what makes the tenant able
+        // to see, approve and revoke it. A consent record the consenting party cannot read would
+        // defeat the purpose of modelling consent at all.
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
+        // Purged with the tenant, and deliberately NOT seeded on create: a grant exists only
+        // because an operator asked for one.
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         foreignKeyField: 'organizationId',
+    }),
+    // ── The two PEOPLE a grant names ─────────────────────────────────────
+    //
+    // `operatorUserId` (who asked) and `approvedByUserId` (who agreed) are both `.isForeignKey()` on
+    // `PlatformAccessGrantSchema`, so the registry must be able to resolve each to a resource type —
+    // the frontend registry validates this fail-closed at boot and refuses to initialise otherwise.
+    //
+    // REFERENCE, deliberately NOT composition, and the contrast with the ORGANIZATIONS edge directly
+    // above is the whole point. The tenant OWNS the grant: it is the tenant's consent record, so it
+    // is purged with the tenant. The two users are merely NAMED BY it. Making a user its owner would
+    // resolve `lifecycleModelMode` to DEPENDENT, and that is the same value
+    // `classifySubjectErasureDisposition` reads — a user erasure would then own the row's fate, and
+    // the one thing an access-audit record must survive is the erasure of the person it monitors.
+    // As REFERENCE the erasure classifies it NOT_OWNED and leaves it intact, which is the intent.
+    //
+    // `onParentDelete.enabled: false` states that survival explicitly rather than leaving it to the
+    // nature's default — the question "does this die with the user?" is exactly what a reader of a
+    // privileged-access ledger comes here to ask.
+    //
+    // STANDALONE + `contextPolicy: { enabled: false }`: a grant is addressed under its tenant
+    // (`/organizations/:organizationId/platform-access-grants`), never under a user, and the operator
+    // is by construction NOT a member of the target tenant — so fetching them into the row's context
+    // would be a cross-tenant read on every list.
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.PLATFORM_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'operatorUserId',
+        // Server-authored from the session on every grant, so the pointer is always present.
+        parentResourceRequirement: ResourceParentResourceRequirement.MANDATORY,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.PLATFORM_ACCESS_GRANTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'approvedByUserId',
+        // OPTIONAL because the field is `.optional()`: unset until a tenant administrator
+        // approves, and permanently unset on an auto-approved, denied or revoked grant. MANDATORY
+        // would assert an approver every grant must have, which is precisely the distinction
+        // `autoApprovalReason` exists to preserve.
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_PREFERENCES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed a default org preferences row on org creation
+        // (all fields defaulted → seedable). Fixes the latent missing-row gap.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
+        foreignKeyField: 'organizationId',
         // 1:1 preferences: full on READ
         contextPolicy: {
             objectMode: ContextPolicy_ObjectMode.SUMMARY,
@@ -239,35 +515,54 @@ export const coreSharedResourceRelationship = [
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_NOTIFICATIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // onParentCreate: eager-seed a default org notifications row on org creation
+        // (emailNotifications now defaulted → seedable). Fixes the latent
+        // missing-row gap so downstream email fan-out has a routing table.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         foreignKeyField: 'organizationId',
         // Notifications are ephemeral - disable context
         contextPolicy: { enabled: false }
     }),
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_FEATURES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_FEATURES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
+        // Deliberately NO onParentCreate: the scope-features ledger is a cache-resolved
+        // OVERRIDE store, not per-entity state, so eager-seeding it is pure write
+        // amplification. FeatureResolutionBackendService self-heals from defaults when the
+        // row is absent (`if (!scopeDoc) return base`), the 1:1 context-embed omits an
+        // absent child, and the admin-write / billing-sync paths upsert the row lazily the
+        // moment it first holds meaning; an eager empty row (`features:[]`, `limits:{}`,
+        // empty `manualOverrides`) is a resolution no-op. COMPOSITION here means dies-with
+        // (onParentDelete), NOT created-with — the two are orthogonal (DDD). See
+        // .claude/plans/composition-oncreate-lifecycle.md (FEATURES wave, 2026-07-11).
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        foreignKeyField: 'organizationId',
         // Features: summary by default
         contextPolicy: {
             objectMode: ContextPolicy_ObjectMode.SUMMARY,
         }
     }),
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_MEMBER_INVITATIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        isPrimaryScope: true,
-        nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
-        // High cardinality: disable on LIST/SEARCH for performance
-        contextPolicy: {
-            operationOverrides: {
-                [CoreResourceOperation.LIST]: { enabled: false },
-                [CoreResourceOperation.SEARCH]: { enabled: false },
-            }
-        }
-    }),
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_METADATA, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         nature: RelationshipNature.COMPOSITION,
+        // Deliberately NO onParentCreate — the metadata row is created by the
+        // framework-owned Level-A seed `engine-applications:application-metadata`
+        // (`applicationMetadataSeedDefinitions`, opted into by the app's backend module),
+        // NOT by composition.
+        //
+        // This edge DID declare `onParentCreate`, on the hypothesis that the APPLICATION
+        // create path might route through `handler.create` → `executePostOperationLogic`.
+        // It does not, and never did: the apps-manager provisions the APPLICATION row at
+        // the REPOSITORY tier while bootstrapping the application database
+        // (`wildo-application-lifecycle.apps-manager.platform.service.ts` →
+        // `seedAppApplication` → `upsertEntity(repository, …)`), so the post-create hook is
+        // never reached. Measured 2026-08-09: one `applications` row and ZERO
+        // `applicationMetadata` rows in every database of the dev stack.
+        //
+        // A declared lifecycle edge that cannot fire is worse than no edge — it reads as
+        // covered in the registry, in the spec, and in every review, which is exactly how
+        // this went unnoticed. Removed rather than commented as pending. (The sibling
+        // APPLICATION_FEATURES edge records the same blocker.)
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         foreignKeyField: 'appId',
         // 1:1 metadata: full on READ
@@ -291,6 +586,24 @@ export const coreSharedResourceRelationship = [
             }
         }
     }),
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.APPLICATION_FEATURES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        // Deliberately NO onParentCreate — same cache-resolved-ledger rationale as the
+        // ORGANIZATION_FEATURES edge above. TWO extra APP-only blockers even if that
+        // changed: (1) APPLICATION rows are provisioned via the platform CLI / apps-manager
+        // bootstrap, not the engine handler.create → executePostOperationLogic, so the seed
+        // hook never fires on real app provisioning; (2) this edge's foreignKeyField 'appId'
+        // is NOT the APPLICATION primary-scope identifier ('applicationId'), so it is absent
+        // from CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS — createAsSystem's name-based
+        // preserve-list would strip it and seed an orphan row (the boot seedability guard
+        // does not catch this: it probes DTO defaults, not FK persistence).
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        foreignKeyField: 'appId',
+        contextPolicy: {
+            objectMode: ContextPolicy_ObjectMode.SUMMARY,
+        }
+    }),
     // API Keys relationships
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORG_API_KEYS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         isPrimaryScope: true,
@@ -306,16 +619,43 @@ export const coreSharedResourceRelationship = [
         // SECURITY: API keys should never be fetched via context
         contextPolicy: { enabled: false }
     }),
-    // Audit Logs - System resource
+    // OAuth Clients relationships (mirror API Keys — registered client-credentials front)
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.OAUTH_CLIENTS_ORGANIZATION, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: OAuth client secrets should never be fetched via context
+        contextPolicy: { enabled: false }
+    }),
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.OAUTH_CLIENTS_APPLICATION, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        // SECURITY: OAuth client secrets should never be fetched via context
+        contextPolicy: { enabled: false }
+    }),
+    // Audit Logs - System resource.
+    // APPLICATION remains the resource's canonical primary-scope classification,
+    // but an individual audit row does not necessarily describe an application
+    // tenant: organization-scoped, user-only, and system events legitimately omit
+    // applicationId. Keep the FK optional so relationship persistence matches the
+    // forensic event schema instead of silently making every row application-bound.
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.AUDIT_LOGS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'applicationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
-    // Step 19D: Changed from STANDALONE to REQUIRES_CONTEXT for org-scoped Audit Log Viewer
+    // Step 19D: Changed from STANDALONE to REQUIRES_CONTEXT for org-scoped Audit Log Viewer.
+    // parentResourceRequirement=OPTIONAL because AuditableEvent_BaseSchema.organizationId is
+    // optional — audit logs can be application-level events with no org context. accessScopeStrategy
+    // must be explicit (REQUIRES_CONTEXT) because Guard 1 prohibits isPrimaryScope+OPTIONAL_CONTEXT.
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.AUDIT_LOGS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        isPrimaryScope: true,
         foreignKeyField: 'organizationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT,
         nature: RelationshipNature.REFERENCE,
         childOperations: {
             lifecycle: { onParentDelete: { enabled: false } },
@@ -327,29 +667,33 @@ export const coreSharedResourceRelationship = [
             },
         },
     }),
+    // parentResourceRequirement=OPTIONAL because AuditableEvent_BaseSchema.userId is optional —
+    // audit logs can be application-level events with no associated user (e.g. system events).
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.AUDIT_LOGS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
         contextPolicy: { enabled: false }
     }),
-    // Notification Badges - System resource, accessed internally via NotificationBadgeBackendService
-    // Badges are scoped to different parent resources (users, organizations, application)
-    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.NOTIFICATION_BADGES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
-        nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
-        // Notifications: ephemeral, accessed via dedicated service
-        contextPolicy: { enabled: false }
-    }),
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.NOTIFICATION_BADGES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+    // ── Notification Badges (Dual-Scope Polymorphic) ─────────────────────
+    // Each scope owns its own resource type and its own MongoDB collection.
+    // Accessed internally via `NotificationBadgeBackendService`, which dispatches
+    // to the right repository based on the request's scope. The APPLICATION
+    // variant was dropped (no canonical badges declared at app scope; broadcast
+    // remains an option in `NotificationBadgeBackendService.emitBadgeUpdate`).
+    //
+    // Refactor: `.cursor/plans/notification-badges-polymorphism-refactor.md`
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_NOTIFICATION_BADGES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'userId',
         nature: RelationshipNature.COMPOSITION,
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         // Notifications: ephemeral, accessed via dedicated service
         contextPolicy: { enabled: false }
     }),
-    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.NOTIFICATION_BADGES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        isPrimaryScope: true,
+        foreignKeyField: 'organizationId',
         nature: RelationshipNature.COMPOSITION,
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         // Notifications: ephemeral, accessed via dedicated service
@@ -357,107 +701,270 @@ export const coreSharedResourceRelationship = [
     }),
     // Queue System Resources - Internal infrastructure for job tracking and payload storage
     // NOTE: These are INTERNAL resources, not exposed via API URLs.
-    // isPrimaryScope is NOT set (would conflict with STANDALONE strategy).
     // Access is exclusively via repository services with INTERNAL variants.
+    // The STANDALONE strategy keeps them out of URL routing; `isPrimaryScope: true`
+    // anchors the scope enum to APPLICATION (ownership graph is orthogonal to
+    // URL routing — see `resources-relationships.shared.factory.ts` Guard 1).
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.JOB_EXECUTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
         nature: RelationshipNature.REFERENCE,
         // Internal resource: never fetch via context, accessed via dedicated services
         contextPolicy: { enabled: false }
     }),
     createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.JOB_PAYLOAD_STORAGE, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
         nature: RelationshipNature.REFERENCE,
         // Internal resource: never fetch via context, accessed via dedicated services
         contextPolicy: { enabled: false }
     }),
-    // ─── Email Template Relationships ───────────────────────────────
-    // EMAIL_TEMPLATES are APPLICATION-scoped (standalone, managed via lifecycle-api)
-    // Note: Standalone resources cannot have isPrimaryScope=true (they are accessed independently)
-    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.EMAIL_TEMPLATES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        // isPrimaryScope removed: STANDALONE access strategy means no parent scope in URL
+    // ── Job Execution Cross-Scope FK Edges ───────────────────────────────
+    //
+    // JobExecution carries the originating execution context (`organizationId`,
+    // `userId`) plus optional payload-storage references. These fields are
+    // genuine FKs into existing resources — they exist so internal queue
+    // services can filter / join. STANDALONE access keeps these edges off the
+    // URL surface (the resource is APPLICATION-primary; admin queries it via
+    // the JobExecution UI, not nested under /organizations/:id/job-executions).
+    //
+    // `parentResourceRequirement: OPTIONAL` matches the schema (`.optional()`
+    // on all four fields). `isPrimaryScope: false` because APPLICATION is the
+    // primary scope anchor (declared above).
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.JOB_EXECUTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'organizationId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false }
+    }),
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.JOB_EXECUTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
-        // Email templates: never fetch via context, accessed via dedicated services
+        foreignKeyField: 'userId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
         contextPolicy: { enabled: false }
     }),
-    // EMAIL_HEADER_FOOTER_TEMPLATES → APPLICATION
-    // Note: Standalone resources cannot have isPrimaryScope=true (they are accessed independently)
-    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.EMAIL_HEADER_FOOTER_TEMPLATES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        // isPrimaryScope removed: STANDALONE access strategy means no parent scope in URL
+    createResourcesRelationship(CoreResourceType.JOB_PAYLOAD_STORAGE, CoreResourceType.JOB_EXECUTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
-        // Header/footer templates: never fetch via context, accessed via dedicated services
+        foreignKeyField: 'inputPayloadStorageId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
         contextPolicy: { enabled: false }
     }),
-    // EMAIL_HEADER_FOOTER_TEMPLATES can optionally be nested under ORGANIZATIONS (for overrides)
-    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.EMAIL_HEADER_FOOTER_TEMPLATES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
-        isPrimaryScope: false, // Not primary - org override path
+    createResourcesRelationship(CoreResourceType.JOB_PAYLOAD_STORAGE, CoreResourceType.JOB_EXECUTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
-        // Org-scoped header/footer: accessed via dedicated services
+        foreignKeyField: 'outputPayloadStorageId',
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
         contextPolicy: { enabled: false }
     }),
+    // Flows-Actors Execution Resources (POLYMORPHIC) — persisted flow/actor system
+    // executions. Owner = the injected scope FK per variant (USER_SELF / ORGANIZATIONS /
+    // APPLICATION primary scope): the default API READ/LIST return only the caller's own
+    // executions (per-scope chat history). COMPOSITION + onParentDelete cascade removes a
+    // scope's executions when the owning user/org/app is deleted (via the default DELETE
+    // op at the repository tier). Not context-fetched (accessed via the conversational
+    // runtime), so contextPolicy is disabled.
+    //   USERS         → userFlowActorExecutions
+    //   ORGANIZATIONS → organizationFlowActorExecutions
+    //   APPLICATION   → applicationFlowActorExecutions
+    ...createPolymorphicScopeRelationships(flowActorExecutionsPolymorphicDeclaration, {
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
+    // Flows-Actors Task Resources (POLYMORPHIC) — the WORK plane behind the A2A `Task`
+    // object, owned by the same three scopes as executions so a task always belongs to
+    // the principal that drove the turn. COMPOSITION + onParentDelete cascade removes a
+    // scope's tasks when the owning user/org/app is deleted.
+    //   USERS         → userFlowActorTasks
+    //   ORGANIZATIONS → organizationFlowActorTasks
+    //   APPLICATION   → applicationFlowActorTasks
+    //
+    // `childCardinality` is left at its MANY default, which is CORRECT here (unlike the
+    // A2ATokenBudgetState sibling below, a singleton that must pin ONE): tasks are
+    // multi-row per scope, so the cascade discovers them via LIST — and this resource
+    // DECLARES a LIST op, so `validateCompositionCascadeDeletability` is satisfied.
+    //
+    // NOTE the deliberate absence of an execution→task relationship: `flowActorExecutionId`
+    // is a SOFT indexed link, not a declared FK, because a task must be able to outlive the
+    // conversation that produced it. See the base schema for the full rationale.
+    ...createPolymorphicScopeRelationships(flowActorTasksPolymorphicDeclaration, {
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
+    // Scope → A2ATokenBudgetState (isPrimaryScope: true, 3 variants; SINGLETON per tenant).
+    //   USERS → userA2aTokenBudgetState, ORGANIZATIONS → organizationA2aTokenBudgetState,
+    //   APPLICATION → applicationA2aTokenBudgetState.
+    // COMPOSITION so a deleted tenant's budget row is cascade-cleaned (IMMEDIATE, depth 1).
+    //
+    // `childCardinality: ONE` is load-bearing, not decoration: this child is a SINGLETON (the
+    // injected owner FK is its unique business key — exactly one row per tenant), and the helper
+    // DEFAULTS to MANY. Beyond being semantically wrong, MANY makes the cascade look for a LIST
+    // discovery op while a 1:1 child is discovered via READ — and this resource declares no LIST.
+    // That mismatch does NOT silently orphan rows: `validateCompositionCascadeDeletability` collects
+    // it and the caller fails CLOSED at boot. (It did exactly that while this resource was being
+    // built — the cardinality was the true cause, not the ops' variant types.)
+    ...createPolymorphicScopeRelationships(a2aTokenBudgetStatePolymorphicDeclaration, {
+        nature: RelationshipNature.COMPOSITION,
+        childCardinality: ResourceRelationshipCardinality.ONE,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
+    // Scope → A2APushDeliveryLog (isPrimaryScope: true, 3 variants; MANY rows per tenant).
+    //   USERS → userA2aPushDeliveryLog, ORGANIZATIONS → organizationA2aPushDeliveryLog,
+    //   APPLICATION → applicationA2aPushDeliveryLog.
+    //
+    // Default cardinality (MANY) — unlike the budget singleton above, there is one row per
+    // (task transition × registered webhook), and the resource declares LIST, so the cascade's
+    // discovery op resolves.
+    //
+    // COMPOSITION with IMMEDIATE cascade: these rows are evidence ABOUT a tenant's deliveries and
+    // have no meaning once the tenant is gone. Deliberately NOT retained the way billing rows are —
+    // a delivery log carries no financial or statutory obligation, and keeping it would leave
+    // webhook URLs (a tenant's own infrastructure addresses) alive after erasure, which is the
+    // opposite of what a subject-erasure path is for.
+    ...createPolymorphicScopeRelationships(a2aPushDeliveryLogPolymorphicDeclaration, {
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
     // ── Billing Relationships (Polymorphic) ─────────────────────────────
     // Scope → BillingAccounts (isPrimaryScope: true, 2 variants)
     // ORGANIZATIONS → organizationBillingAccounts
     // USERS → userBillingAccounts
+    //
+    // ⚠️ RETAINED TOO (coherence follow-up to the billing-retention decision, Paul — 2026-07-29).
+    // The account was NOT part of the original 16 edges — it has a core DELETE op, so the
+    // cascade-deletability guard never flagged it — but leaving it enabled made the retention
+    // decision incoherent: hard-deleting a scope killed the account while its retained invoices /
+    // subscriptions / usage records / credit pools survived pointing at a dead row.
+    //
+    // Why the dangling reference was not survivable, concretely (traced 2026-07-29):
+    //   • `providerCustomerId` is `.isBackendOnly()` and lives ONLY here. The retained children carry
+    //     their own provider ids (`providerInvoiceId`, `providerSubscriptionId`) but NOT the provider
+    //     CUSTOMER id — so deleting the account destroys the only local key that maps a retained
+    //     invoice back to the customer it was billed to. A financial record you cannot reconcile
+    //     against the provider defeats the purpose of retaining it. Nothing provider-side is cleaned
+    //     up on delete either (no customer deletion, no subscription cancellation), so this was a
+    //     purely LOCAL mapping being thrown away while the provider-side record lived on.
+    //   • The usage-flush sweep (`UsageMeteringBackendService.flushScopeToProvider`) selects on
+    //     `reportedToProvider: false`, groups by this FK, and skips its "mark as reported" write when
+    //     the customer id cannot be resolved. Retained usage rows whose account was deleted are
+    //     therefore re-selected by EVERY subsequent sweep and can never drain — a permanent,
+    //     monotonically growing error backlog. (Latent today: no cron calls `flushToProvider` yet.)
+    //   • `onSubscriptionChanged` (feature sync, fired by the subscription post-operation hook) and
+    //     the webhook router's `emitBillingEvent` both dereference this FK off a retained child; both
+    //     are null-guarded, so they degrade to a warn + silent no-op rather than crashing.
+    //   • Relationship context population (`contextPolicy: {}` on the child edges below) fetches this
+    //     account as SUMMARY on every child READ/LIST; it is fault-tolerant, so the miss becomes a
+    //     per-request warn forever rather than an error.
+    // No chart or aggregation reads billing, and no billing schema uses `forwardedLabel`, so those
+    // surfaces were unaffected either way.
+    //
+    // The account row now carries a dangling scope FK of its own after a scope delete — but that is
+    // exactly the danglingness the 2026-07-29 decision already accepted for its four child families,
+    // not a new kind of inconsistency. As with those children, the nature stays COMPOSITION (the
+    // account genuinely belongs to its scope); only the dies-with-parent behaviour is declined.
+    //
+    // With this cascade disabled, a DIRECT hard delete of the account became the only remaining path
+    // into the forbidden half-state described below. That path is now closed at runtime: the billing
+    // account's DELETE carries a fail-closed dependents guard that refuses with 409
+    // `BILLING_ACCOUNT_HAS_DEPENDENTS` while any retained child still references the account
+    // (`assertNoBillingAccountDependents`, wired as a DELETE prefix custom implementation). Keep that
+    // guard's family list in lock-step with the retained edges declared here.
     ...createPolymorphicScopeRelationships(billingAccountsPolymorphicDeclaration, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the note above.
     }),
     // Scope → Subscriptions (isPrimaryScope: true, 2 variants)
     // ORGANIZATIONS → organizationSubscriptions
     // USERS → userSubscriptions
     ...createPolymorphicScopeRelationships(billingSubscriptionsPolymorphicDeclaration, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
     }),
     // BillingAccounts → Subscriptions (variant-matched, 1:N)
     // organizationBillingAccounts → organizationSubscriptions
     // userBillingAccounts → userSubscriptions
     ...createPolymorphicRelationships(billingAccountsPolymorphicDeclaration, billingSubscriptionsPolymorphicDeclaration, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
         contextPolicy: {},
     }),
     // ── Polymorphic Billing Children ─────────────────────────────────────
+    //
+    // ⚠️ BILLING RETENTION (compliance decision, Paul — 2026-07-29): subscriptions / invoiceRefs /
+    // usageRecords / creditPools are RETAINED, never cascade-deleted. The financial audit trail must
+    // survive the deletion of the scope or the billing account that produced it (tax / SOX retention),
+    // so every `onParentDelete` below is DISABLED — 16 edges in total (4 families × 2 parents × 2 scope
+    // variants). These are the entries formerly tracked as `KNOWN_CASCADE_DELETABILITY_GAPS`.
+    //
+    // Why NOT `retentionPolicy` + `IMPERSONALIZE_AND_RETAIN`: that machinery also HIDES and FREEZES the
+    // row (reachable only through the audited see-through path), and these invoices must stay visible
+    // for ordinary accounting. It is also the wrong tool semantically — a billing row holds no personal
+    // data of its own (no name, email or address; the person is a foreign key), so there is nothing on
+    // it to scrub. The PII lives on the linked USER, which is where impersonalization belongs: erasing
+    // a subject scrubs the user row and keeps it, so these financial rows keep resolving to an
+    // anonymized subject.
+    //
+    // A COMPOSITION without `onParentDelete` is an explicitly supported combination — it leaves the
+    // children behind by design choice (see `validateCompositionCascadeDeletability`). The nature stays
+    // COMPOSITION because these rows genuinely belong to their scope; only the dies-with-parent
+    // behaviour is declined.
+    //
+    // The `Scope → BillingAccounts` edge above was RETAINED on the same day as a coherence follow-up
+    // (18 disabled billing cascades in total). Without it these 16 edges kept rows whose owning account
+    // had been deleted — see the rationale block at that declaration. Do not re-enable either half in
+    // isolation: retaining the children while deleting the account strands the provider-customer
+    // mapping, and deleting the children while retaining the account discards the audit trail.
     // Invoice Refs — scope relationships (2 variants)
     ...createPolymorphicScopeRelationships(invoiceRefsPolymorphicDeclaration, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
     }),
     // BillingAccounts → InvoiceRefs (variant-matched, 1:N)
     ...createPolymorphicRelationships(billingAccountsPolymorphicDeclaration, invoiceRefsPolymorphicDeclaration, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
         contextPolicy: {},
     }),
-    // Usage Records — scope relationships (3 variants)
+    // Usage Records — scope relationships (2 variants: ORG, USER)
     ...createPolymorphicScopeRelationships(usageRecordsPolymorphicDeclaration, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
     }),
     // BillingAccounts → UsageRecords (variant-matched, 1:N)
     ...createPolymorphicRelationships(billingAccountsPolymorphicDeclaration, usageRecordsPolymorphicDeclaration, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
         contextPolicy: { enabled: false },
     }),
-    // Credit Pools — scope relationships (3 variants)
+    // Credit Pools — scope relationships (2 variants: ORG, USER)
     ...createPolymorphicScopeRelationships(creditPoolsPolymorphicDeclaration, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
     }),
     // BillingAccounts → CreditPools (variant-matched, 1:N)
     ...createPolymorphicRelationships(billingAccountsPolymorphicDeclaration, creditPoolsPolymorphicDeclaration, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } }, // RETAIN (compliance decision 2026-07-29) — see the billing-retention note above.
         contextPolicy: {},
     }),
     // Referrals keep shared FK field names (`referrerBillingAccountId`, `referredBillingAccountId`)
-    // instead of polymorphic per-variant field expansion, so their billing-account links must
-    // be declared explicitly for registry FK resolution and nested relationship semantics.
+    // instead of polymorphic per-variant field expansion. Each is declared a per-record
+    // DISCRIMINATED polymorphic FK on `ReferralSchema` (`polymorphicVariants:
+    // BILLING_SCOPE_DISCRIMINATED_FK_VARIANTS` + `polymorphicDiscriminatorField:
+    // 'referrer|referredScopeType'`). These sibling relationships enumerate the candidate
+    // billing-account branches per FK; the concrete branch is resolved PER RECORD via the
+    // scope discriminator (Resources_SharedUtils.resolveDiscriminatedPolymorphicForeignKeyTarget),
+    // and the registry FK→type map keeps only a non-authoritative representative for these fields.
     createResourcesRelationship(CoreResourceType.USER_BILLING_ACCOUNTS, CoreResourceType.REFERRALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         nature: RelationshipNature.REFERENCE,
@@ -493,18 +1000,94 @@ export const coreSharedResourceRelationship = [
         childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
         contextPolicy: {},
     }),
-    // ── Guidance State Relationships (Tri-Scope) ─────────────────────────
+    // ── Catalog & Internal Scope Anchors (STANDALONE primary) ────────────
+    //
+    // Catalog-tier resources (products, prices, promotions) and shared lookup
+    // tables (referrals, files, userFeatures) need a primary-scope anchor so
+    // that `createResourceConfiguration_Initialization` can derive their
+    // `resourcePrimaryScope` enum without falling back to a silent default.
+    //
+    // STANDALONE keeps these rels off the URL surface (catalog/lookup access
+    // goes through dedicated services, not parent-scoped routes) while
+    // `isPrimaryScope: true` declares the structural ownership: catalog
+    // entities are APPLICATION-tier; user-facing lookups are USER_SELF-tier.
+    //
+    // See `resources-relationships.shared.factory.ts` Guard 1 for the full
+    // rationale on why STANDALONE + isPrimaryScope is the canonical pattern
+    // for resources that are scope-anchored but not URL-routed.
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.PRODUCTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.PRICES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.PROMOTIONS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_FEATURES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.COMPOSITION,
+        foreignKeyField: 'userId',
+        // onParentDelete cascade: USER_FEATURES is a composition part — it dies with its
+        // user. This edge was the lone scope-features sibling MISSING childOperations
+        // (ORGANIZATION_FEATURES / APPLICATION_FEATURES both declared the cascade) →
+        // orphan-on-user-delete risk; now aligned. Deliberately NO onParentCreate: the
+        // scope-features ledger is cache-resolved (see the ORGANIZATION_FEATURES note).
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.FILES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        // applicationId is always propagated to every file record from the execution context
+        // at creation time, regardless of the file's primaryScope (APPLICATION / ORGANIZATIONS /
+        // USER_SELF). It is the top-level tenant isolation field, not the scope discriminator.
+        contextPolicy: { enabled: false },
+    }),
+    // Referrals scope anchor — TEMPORARY SHIM — Phase 4.5 Step 2.5 Layer 3c TODO.
+    //
+    // Referrals naturally inherit polymorphism from `*_billingAccounts` (which
+    // are USER_SELF/ORG-polymorphic). The principled long-term design is to
+    // split `referrals` into the same polymorphic variant pair so each variant
+    // carries its own scope via the parent billing-account chain. Until that
+    // follow-up PR lands, the ORGANIZATIONS edge below carries a STANDALONE
+    // primary anchor so the resource has a defined `resourcePrimaryScope` and
+    // the registry-layer factory's no-fallback throw stays satisfied.
+    // Tracked in `.cursor/plans/m2m-webhook-organization-delivery-phase4-5-hardening.md`
+    // (Phase 4.5 Step 2.5 Layer 3c).
+    createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.REFERRALS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
+    // ── Guidance State Relationships (Dual-Scope) ────────────────────────
     // Each scope entity has 1:1 guidance state — system resource, standalone access
     createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.USER_GUIDANCE_STATE, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         foreignKeyField: 'userId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the guidance-state row on user creation (removes the lazy read-create race; evaluator read-then-creates so no dup).
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_GUIDANCE_STATE, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         foreignKeyField: 'organizationId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the guidance-state row on org creation.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
     // ── Progression State Relationships (Dual-Scope) ─────────────────────────
@@ -513,12 +1096,16 @@ export const coreSharedResourceRelationship = [
         isPrimaryScope: true,
         foreignKeyField: 'userId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the progression-state row on user creation.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_PROGRESSION_STATE, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         foreignKeyField: 'organizationId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the progression-state row on org creation.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
     // ── Lifecycle State Relationships (Dual-Scope) ─────────────────────────
@@ -527,14 +1114,86 @@ export const coreSharedResourceRelationship = [
         isPrimaryScope: true,
         foreignKeyField: 'userId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the lifecycle-state row on user creation — the
+        // genuine latent gap (no READ self-heal); the evaluator read-then-creates so no dup.
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
     createResourcesRelationship(CoreResourceType.ORGANIZATIONS, CoreResourceType.ORGANIZATION_LIFECYCLE_STATE, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.ONE, {
         isPrimaryScope: true,
         foreignKeyField: 'organizationId',
         nature: RelationshipNature.COMPOSITION,
+        // onParentCreate: eager-seed the lifecycle-state row on org creation (latent gap).
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 }, onParentCreate: { enabled: true } } },
         contextPolicy: { enabled: false }
     }),
+    // ── Inbound Contacts (Phase 0.5, Q-E=B) ──────────────────────────────
+    //
+    // APPLICATION-scope lead-capture resource. Two FK edges to USER-shaped
+    // parents are declared MANUALLY (no `isAnonymizable: true`, so the
+    // factory does NOT inject anything for this resource):
+    //
+    // 1. ANONYMOUS_USERS → INBOUND_CONTACTS via `anonymousUserId`
+    //    Filled by the controller pre-flight seam from the active anonymous
+    //    session. Cleared to `null` by the manual transposition hook in
+    //    `AnonymousSessionBackendService` once the user converts.
+    //
+    // 2. USERS → INBOUND_CONTACTS via `userId`
+    //    Filled by the manual transposition hook when the lead converts.
+    //    Distinct from the schema's `relatedUserId` (sales/support manual
+    //    linkage) — see InboundContactSchema JSDoc.
+    //
+    // `relatedUserId` is intentionally NOT modeled as a separate
+    // ResourceRelationship row: it is a sparse, manually-populated free
+    // FK with no auto-context / cascade / URL-routing semantics. Modeling
+    // it would add a second USERS → INBOUND_CONTACTS edge that the URL
+    // builder would have to disambiguate via FK at every nested route, for
+    // zero product gain (sales reps will use the standalone admin URL with
+    // a filter, not a nested /users/:id/inbound-contacts path).
+    //
+    // Both edges use STANDALONE access scope: the resource is admin-listed
+    // from APPLICATION scope, never nested under anonymous-users or users.
+    // parentResourceRequirement=OPTIONAL because anonymousUserId is nullable (cleared to null on conversion).
+    createResourcesRelationship(CoreResourceType.ANONYMOUS_USERS, CoreResourceType.INBOUND_CONTACTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'anonymousUserId',
+        // Lead survives anonymous-session cleanup (transposition rewrites
+        // anonymousUserId → null when the lead converts; expired sessions
+        // never owned the lead's lifecycle).
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
+    createResourcesRelationship(CoreResourceType.USERS, CoreResourceType.INBOUND_CONTACTS, 
+    // ONE → MANY: userId is nullable on the schema (anonymous/unlinked leads have no user).
+    // parentResourceRequirement=OPTIONAL to align with the nullable FK —
+    // MANDATORY (default) would cause a ZodToMongoose required-mismatch crash.
+    ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        nature: RelationshipNature.REFERENCE,
+        foreignKeyField: 'userId',
+        // Lead history is org-owned, not user-owned — survives user
+        // deletion (compliance / audit signal). DELETE on a user does
+        // not cascade to leads they happened to convert from.
+        childOperations: { lifecycle: { onParentDelete: { enabled: false } } },
+        contextPolicy: { enabled: false },
+    }),
+    // INBOUND_CONTACTS scope anchor (STANDALONE primary).
+    //
+    // Phase 4.5 Step 2.5 Layer 3a: declares APPLICATION as the structural
+    // owner of inbound-contacts. The two USER-shaped FK edges above
+    // (ANONYMOUS_USERS / USERS) carry conversion linkage but do NOT define
+    // ownership — leads survive parent deletion and are admin-listed from
+    // APPLICATION scope. STANDALONE keeps this rel inert for URL routing
+    // (no nested /applications/:id/inbound-contacts path).
+    createResourcesRelationship(CoreResourceType.APPLICATION, CoreResourceType.INBOUND_CONTACTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        isPrimaryScope: true,
+        nature: RelationshipNature.REFERENCE,
+        contextPolicy: { enabled: false },
+    }),
     // ── Auth Relationships (Polymorphic — Singletons: 1:1, Collections: 1:N) ──
     // SSO Config — singleton (ONE per scope)
     ...createPolymorphicScopeRelationships(ssoConfigPolymorphicDeclaration, {
@@ -559,18 +1218,6 @@ export const coreSharedResourceRelationship = [
             },
         },
     }),
-    // Auth Policy — singleton (ONE per scope)
-    ...createPolymorphicScopeRelationships(authPolicyPolymorphicDeclaration, {
-        childCardinality: ResourceRelationshipCardinality.ONE,
-        nature: RelationshipNature.COMPOSITION,
-        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
-        contextPolicy: {
-            objectMode: ContextPolicy_ObjectMode.SUMMARY,
-            operationOverrides: {
-                [CoreResourceOperation.READ]: { objectMode: ContextPolicy_ObjectMode.FULL },
-            },
-        },
-    }),
     // SIEM Export Config — singleton (ONE per scope)
     ...createPolymorphicScopeRelationships(siemExportConfigPolymorphicDeclaration, {
         childCardinality: ResourceRelationshipCardinality.ONE,
@@ -617,6 +1264,31 @@ export const coreSharedResourceRelationship = [
             },
         },
     }),
+    // M2M Webhook Config — singleton (ONE per scope), mirrors SIEM Export Config wiring.
+    ...createPolymorphicScopeRelationships(webhookConfigPolymorphicDeclaration, {
+        childCardinality: ResourceRelationshipCardinality.ONE,
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: {
+            objectMode: ContextPolicy_ObjectMode.SUMMARY,
+            operationOverrides: {
+                [CoreResourceOperation.READ]: { objectMode: ContextPolicy_ObjectMode.FULL },
+            },
+        },
+    }),
+    // M2M Webhook Delivery Log — collection (MANY per scope). LIST/SEARCH stay
+    // off the context surface (high-volume noise — admin queries them via the
+    // dedicated UI, not via implicit context inclusion). Mirrors SIEM DLQ wiring.
+    ...createPolymorphicScopeRelationships(m2mWebhookDeliveryLogPolymorphicDeclaration, {
+        nature: RelationshipNature.COMPOSITION,
+        childOperations: { lifecycle: { onParentDelete: { enabled: true, mode: ChildLifecycleMode.IMMEDIATE, maxDepth: 1 } } },
+        contextPolicy: {
+            operationOverrides: {
+                [CoreResourceOperation.LIST]: { enabled: false },
+                [CoreResourceOperation.SEARCH]: { enabled: false },
+            },
+        },
+    }),
 ];
 export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.ORGANIZATIONS]: organizationResourceConfiguration_InitializationFactory,
@@ -629,20 +1301,25 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.USER_SELF_PREFERENCES]: userSelfPreferencesResourceConfiguration_InitializationFactory,
     // Organization-related resources
     [CoreResourceType.ORGANIZATION_UNITS]: organizationUnitResourceConfiguration_InitializationFactory,
+    [CoreResourceType.ORGANIZATION_UNIT_MEMBERS]: organizationUnitMemberResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_PROFILES]: organizationProfileResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_PREFERENCES]: organizationPreferencesResourceConfiguration_InitializationFactory,
+    [CoreResourceType.PLATFORM_ACCESS_GRANTS]: platformAccessGrantsResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_NOTIFICATIONS]: organizationNotificationsResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_FEATURES]: organizationFeaturesResourceConfiguration_InitializationFactory,
     [CoreResourceType.USER_FEATURES]: userFeaturesResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_MEMBERS]: organizationMembersResourceConfiguration_InitializationFactory,
-    [CoreResourceType.ORGANIZATION_MEMBER_INVITATIONS]: organizationMemberInvitationsResourceConfiguration_InitializationFactory,
     // Application resources
     [CoreResourceType.APPLICATION]: applicationResourceConfiguration_InitializationFactory,
     [CoreResourceType.APPLICATION_METADATA]: applicationMetadataResourceConfiguration_InitializationFactory,
     [CoreResourceType.APPLICATION_VERSIONS]: applicationVersionsResourceConfiguration_InitializationFactory,
+    [CoreResourceType.APPLICATION_FEATURES]: applicationFeaturesResourceConfiguration_InitializationFactory,
     // API Keys
     [CoreResourceType.ORG_API_KEYS]: orgApiKeysResourceConfiguration_InitializationFactory,
     [CoreResourceType.APPLICATION_API_KEYS]: appApiKeysResourceConfiguration_InitializationFactory,
+    // OAuth Clients (registered client-credentials front — mirrors API Keys)
+    [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION]: orgOAuthClientsResourceConfiguration_InitializationFactory,
+    [CoreResourceType.OAUTH_CLIENTS_APPLICATION]: appOAuthClientsResourceConfiguration_InitializationFactory,
     // Billing resources — polymorphic variants (3 each for accounts & subscriptions)
     ...billingAccountsPolymorphicFactories,
     ...billingSubscriptionsPolymorphicFactories,
@@ -656,20 +1333,27 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     [CoreResourceType.REFERRALS]: referralsResourceConfiguration_InitializationFactory,
     // Audit and Compliance
     [CoreResourceType.AUDIT_LOGS]: auditLogsResourceConfiguration_InitializationFactory,
-    // Notification Resources
-    [CoreResourceType.NOTIFICATION_BADGES]: notificationBadgesResourceConfiguration_InitializationFactory,
+    // Notification Badges — polymorphic dual-scope (USER + ORG)
+    [CoreResourceType.USER_NOTIFICATION_BADGES]: userNotificationBadgesResourceConfiguration_InitializationFactory,
+    [CoreResourceType.ORGANIZATION_NOTIFICATION_BADGES]: organizationNotificationBadgesResourceConfiguration_InitializationFactory,
     // File Management Resources
     [CoreResourceType.FILES]: filesResourceConfiguration_InitializationFactory,
     // Queue System Resources (internal infrastructure)
     [CoreResourceType.JOB_EXECUTIONS]: jobExecution_ResourceConfiguration_InitializationFactory,
     [CoreResourceType.JOB_PAYLOAD_STORAGE]: jobPayloadStorage_ResourceConfiguration_InitializationFactory,
-    // Email Resources
-    [CoreResourceType.EMAIL_TEMPLATES]: emailTemplateResourceConfiguration_InitializationFactory,
-    [CoreResourceType.EMAIL_HEADER_FOOTER_TEMPLATES]: emailHeaderFooterTemplateResourceConfiguration_InitializationFactory,
+    // Flows-Actors Execution Resource (persisted flow/actor system executions)
+    ...flowActorExecutionsPolymorphicFactories,
+    // Flows-Actors Task Resource (the WORK plane behind the A2A `Task` object)
+    ...flowActorTasksPolymorphicFactories,
+    ...a2aTokenBudgetStatePolymorphicFactories,
+    ...a2aPushDeliveryLogPolymorphicFactories,
     // Authentication Resources
     [CoreResourceType.USER_IDENTITY_LINKS]: userIdentityLinksResourceConfiguration_InitializationFactory,
+    [CoreResourceType.OAUTH_CONSENT_GRANTS]: oauthConsentGrantsResourceConfiguration_InitializationFactory,
     // Anonymous Session Resources (W7.3a)
     [CoreResourceType.ANONYMOUS_USERS]: anonymousUsersResourceConfiguration_InitializationFactory,
+    // Inbound Contacts (Phase 0.5 — public marketing-site lead capture, Q-E=B)
+    [CoreResourceType.INBOUND_CONTACTS]: inboundContactsResourceConfiguration_InitializationFactory,
     // Guidance State Resources
     [CoreResourceType.USER_GUIDANCE_STATE]: userGuidanceStateResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_GUIDANCE_STATE]: organizationGuidanceStateResourceConfiguration_InitializationFactory,
@@ -679,13 +1363,15 @@ export const coreShared_ResourcesConfigurations_FactoryMap = {
     // Lifecycle State Resources
     [CoreResourceType.USER_LIFECYCLE_STATE]: userLifecycleStateResourceConfiguration_InitializationFactory,
     [CoreResourceType.ORGANIZATION_LIFECYCLE_STATE]: organizationLifecycleStateResourceConfiguration_InitializationFactory,
-    // Auth Resources — polymorphic variants (SSO + SIEM + SCIM, 7 × 2 = 14 entries)
+    // Auth Resources — polymorphic variants (SSO + SIEM + SCIM, 6 × 2 = 12 entries)
     ...ssoConfigPolymorphicFactories,
     ...ssoConnectionPolymorphicFactories,
-    ...authPolicyPolymorphicFactories,
     ...siemExportConfigPolymorphicFactories,
     ...siemDeliveryDlqPolymorphicFactories,
     ...scimTokensPolymorphicFactories,
     ...scimProvisioningConfigPolymorphicFactories,
+    // M2M Outbound Webhook Resources — polymorphic dual-scope (2 × 2 = 4 entries)
+    ...webhookConfigPolymorphicFactories,
+    ...m2mWebhookDeliveryLogPolymorphicFactories,
 };
-//# sourceMappingURL=resources-registry.shared.core.definitions.js.map
+//# sourceMappingURL=resources-registry.shared.core.definitions.js.map