A grant is a real control-plane users row with auth_source hq, not a federation shim: the instance authenticates it with no runtime dependency on admin. CountOtherOwners counts control-plane owners so a locally-created owner satisfies the last-owner rule too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>