feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11)

⛔ BLOCKED — the v18 development line is not open.

Blocked-by: #15193

_{History: this line read Blocked-by: #15193 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. In a single-tenant deployment the one organization must exist before anyone writes anything, because from now on every row has an owner; a write that arrives without an organization is refused in every posture, and only single-tenant can derive the owner.

Scope. (1) ensureDefaultOrganization (packages/plugins/plugin-auth/src/ensure-default-organization.ts) becomes a boot invariant under single: failure is a boot error, not a best-effort warning; it runs before application seed datasets load (SeedLoaderService.load, packages/metadata-protocol/src/seed-loader.ts) and before the first authenticated request — today seeds land during start() and the organization is created by a later sign-up, so a first boot's business seeds (and every sys_business_unit seed, #14547) land NULL. (1b) The seed loader's exemption of sys_ / cloud_ / ai_ seeds from organization stamping (fallbackOrgId never applied to platform seeds) is withdrawn: there are no platform-global seeds left; every seed row is stamped with the resolved organization or the load refuses (D9). seed-tenancy-backfill.ts becomes the attribution path for existing first-boot residue (C7). (2) resolveSystemInsertOrganization (packages/objectql/src/tenancy/system-write-organization.ts): derived only when exactly one organization exists (single), refused otherwise, in every posture; the unclassified branch and the isPlatformObjectOutOfTenantAuditScope gate are bypassed for objects carrying the column (C8 removes them outright). Message per ADR-0123 D4. (3) ⛔ No default to any other owner — the "platform organization" was considered and rejected in ADR-0131 §5.

Collision to read before starting: #11973 (platform-admin re-anchor L3) re-points the same ensure-default-organization function and moves the same trigger. Its re-pointing half is absorbed here; its last-admin-guard re-pricing half is not and stays on that card. Read it first and say in the PR body which half you found already done.

Acceptance. Fresh single boot: the Default Organization is present before the HTTP listener accepts, and an isSystem insert on a tenant-column object with no organization lands stamped with it. Fresh isolated / group boot: the same insert is refused with a message naming the missing organization — positive control: the identical insert carrying tenantId succeeds.

⛔ Stop and report rather than proceeding: touching applyTenantScope (C8 owns it); editing any seeder (C3 owns them).

Refs: ADR-0131 D3, D9, D11 · ADR-0093 · ADR-0123 D2–D4 · #8844 · #14547.

fix(pm): check-half-states reads every `Blocked-by:` directive on a l…

v18 pre-opening re-verification (C1): DRIFTED. Still valid, nothing landed. Three new seams must be in scope

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:35Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds:

ensureDefaultOrganization is still best-effort and runs after an admin exists (plugin-auth/src/ensure-default-organization.ts:317; the warn-only wiring is auth-plugin.ts:1151-1196).
Seeds still land before any organization exists (runtime/src/app-plugin.ts:1613-1650).
The sys_/cloud_/ai_ exemption is now at metadata-protocol/src/seed-loader.ts:1190.
The unclassified early return is at objectql/src/engine.ts:~5762.

Corrections:

Wrong pointer: resolveSystemInsertOrganization is the private method at objectql/src/engine.ts:5745. system-write-organization.ts exports the pure resolveSystemWriteOrganization (:263).
Drop the platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 paragraph: it closed completed on 09-28. Both halves landed in 4f65837a7f before this card was cut.

New seams, not in the card:

The once-only owner bind (fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813, 149153c252, ADR-0093 D7). The live path is createEnsureDefaultOrganizationOnce (plugin-auth/src/default-org-bootstrap-once.ts:55), decided once in the sys_migration ledger.
- New users are also bound as member at creation (reconcile-membership.ts:196).
- Read, not measured: creating the Default Organization before the first sign-up could bind the first admin as member, and the once-only bind would then skip the owner bind.
- Added acceptance pin: the first admin of a fresh single deployment is the owner.
@objectstack/organizations (c677cda816): the walled-posture bootstrap (organizations-plugin.ts:476) and claimOrphanOrgRows (claim-orphan-org-rows.ts:62).
The tenancy census gate: scripts/check-platform-object-tenancy-census.mjs and its JSON (26144c2046). Any reclassification touches it.

Family: #21057 is this card's business-unit symptom. Its fix (stamp the seed) lands here, so it now carries Blocked-by: #15195.

Generated by Claude Code

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C1, dispatchable first

Blocked-by: none

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:32Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released:

[gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 closed completed in this act (6037915987), on the maintainer's words in the triage seat's chat: 「我建议直接启动 v18 开发吧」, 「你应该先解锁 v18 所有的卡片」, 「同意」.
The ruling record is decision: open v18 now and ship it in stages — release the last 17.x from main first without waiting for #21908's deny (A), skip the last 17.x (B), or keep #22009's order (C)? #22050 6037890422 (B: v18 develops on main, with no last 17.x).
This card's Blocked-by: named [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 alone.

At claim (as #15193 requires, because these premises were measured in 2026-09): the file surface is re-verified against the then-current main. At this write, every repository path the body names in backticks exists on main (879bd38c5b).

Order: ADR-0131 §8 makes C1, C2, C4 and C6 dispatchable first. C3 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204) and C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) wait on this card.

The release state:

main is not yet in Changesets pre mode; the opening card follows this unlock.
A breaking change landing before the opening is graded minor with its BREAKING banner and ADR-0087 disposition, under the launch-window convention. Once pre mode is in, major is open.
⛔ chore: version packages #21988 is not merged.

Claim: PM loop round 61 · 2026-10-07T13:33Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-15195-default-org-load-bearing
Worktree: objectstack-issue-15195
Domain: domain:engine (the card also reaches plugin-auth and @objectstack/organizations, which are domain:services. This seat holds the card whole and declares those files on #6021 before the build.)
Seat: domain:engine#1
Provenance:

ADR-0131 C1, part of [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194. Triage re-verified it before the opening (6018598650: DRIFTED, three new seams) and unlocked it to pm:queue (6037983378): [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 closed on the maintainer's word, with ruling decision: open v18 now and ship it in stages — release the last 17.x from main first without waiting for #21908's deny (A), skip the last 17.x (B), or keep #22009's order (C)? #22050 B (v18 develops on main). C1 is dispatchable first.
This card is public: classes, positions and functions only, with no withheld detail.
The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」). finding(objectql): skipAutomations also skips ObjectQL's own audit stamp — sys_stamp_audit_insert/update are bound through bindHooks, so they carry meta, and a data import with "run automations" unchecked writes rows without created_by/updated_by #22070 is claimed in the same round.
File surface (at origin/main 3d9188502e), per the body as corrected by triage's re-verification 6018598650. The corrections are applied here; the body is not rewritten.
(1) The boot invariant under single. plugin-auth's ensureDefaultOrganization (ensure-default-organization.ts) and its once-only path, createEnsureDefaultOrganizationOnce (default-org-bootstrap-once.ts, ADR-0093 D7, the sys_migration ledger):
- failure is a boot error;
- it runs before application seed datasets load (runtime/src/app-plugin.ts's seed load and SeedLoaderService.load) and before the first authenticated request.
(1b) The seed exemption is withdrawn. metadata-protocol/src/seed-loader.ts's sys_/cloud_/ai_ exemption from organization stamping (about :1190) is removed: every seed row is stamped with the resolved organization, or the load refuses (D9).
- seed-tenancy-backfill.ts's attribution of existing residue is C7's, not this card's.
(2) The derivation rule. objectql's private resolveSystemInsertOrganization (engine.ts about :5823; triage's pointer correction) derives only when exactly one organization exists (single) and refuses otherwise, in every posture.
- The unclassified branch and the isPlatformObjectOutOfTenantAuditScope gate are bypassed for objects carrying the column. C8 removes them outright.
- The message follows ADR-0123 D4.
The new seams (triage):
- the once-only owner bind, and reconcile-membership.ts's member-at-creation. Triage read, without measuring, that creating the Default Organization before the first sign-up could bind the first admin as member;
- @objectstack/organizations' walled-posture bootstrap (organizations-plugin.ts) and claimOrphanOrgRows;
- the tenancy census gate (scripts/check-platform-object-tenancy-census.mjs and its JSON), if a reclassification touches it.
(3) ⛔ No default to any other owner (ADR-0131 §5).
Stop and report rather than proceed (the body): touching applyTenantScope (C8 owns it), or editing any seeder (C3, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, owns them). Also stop on any change the measurement shows needs packages/spec (an error-code ledger entry, for example): that is a spec-lane surface and owes a contract review.
Acceptance pins:
- a fresh single boot has the Default Organization before the HTTP listener accepts, and an isSystem insert on a tenant-column object with no organization lands stamped with it;
- a fresh isolated / group boot refuses the same insert with a message naming the missing organization, and the identical insert carrying tenantId succeeds (positive control);
- the first admin of a fresh single deployment is the owner (triage's added pin).
.changeset/15195-*.md.
Container & model: L, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate; this is the seat's call for a p1 security boot invariant across three packages).
Clause-②: no (narrowing)
Provisional. Writes accepted today without an organization (unstamped system inserts in isolated / group, and unstamped platform seeds) are refused.
BREAKING: minor under the launch-window convention (Changesets pre mode is not in yet, per triage 6037983378), a ! subject, an ADR-0087 disposition and a remedy.
The dev measures the built entry declarations and the accept set. If the measurement reaches packages/spec, the seat revises this line and a contract review is owed.
Thread-read: 6037983378
Serial constraints cleared: at 2026-10-07T13:33Z:
Open PRs (chore: version packages #21988, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974), each file list read by filename: none touches plugin-auth's default-organization files, seed-loader.ts, objectql/src/engine.ts, objectql/src/tenancy/, runtime/src/app-plugin.ts, @objectstack/organizations or the tenancy census.
In flight elsewhere:
- feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 (domain:services seat 2, claim 6038279203) is a measurement-only census round, with no build.
- domain:spec's feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 (6038330914) edits injected-system-columns.ts and five platform-objects system objects, and ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082 (6038457723) respells declared indexes. Neither holds a file of this card.
This lane's finding(objectql): skipAutomations also skips ObjectQL's own audit stamp — sys_stamp_audit_insert/update are bound through bindHooks, so they carry meta, and a data import with "run automations" unchecked writes rows without created_by/updated_by #22070 edits engine.ts's hook skip (about :4200), a different region from resolveSystemInsertOrganization. Whichever lands second merges main.
[finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 is Blocked-by: #15195. refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 (C3) and feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5) wait on this card.

os-dev-report

{
  "issue": 15195,
  "status": "needs_decision",
  "branch": "claude/issue-15195-default-org-load-bearing",
  "pr": null,
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (subagent: the dispatching PM session's id)",
  "premise_still_valid": true,
  "summary": "Stop condition fired before the first edit: the derivation rule as ruled (the isPlatformObjectOutOfTenantAuditScope gate bypassed for every object carrying the column, refused otherwise in every posture) cannot land without editing C3-owned seeders or moving C5/C6 surfaces, so this returns needs_decision with no code and no PR. Measured on base 3d9188502e with real showcase boots: on a fresh single boot every seed row lands organization_id NULL in start() (41 rows read back on 6 objects, 5 of them sys_business_unit), no organization exists at kernel:listening, and seeds are never re-owned after the org appears; on isolated, pin (b) already holds for app objects. Read, not measured (two prototype experiments were refused by this session's permission classifier): the bypass would stamp the single-posture first-user grant with the Default Organization and so remove the first admin's platform standing, stamp env-layer sys_metadata rows, and refuse a walled boot's own sys_capability seeder and sys_migration ledger writes. Recommendation: option B in open_questions (land the boot invariant, seed stamping, owner pin and the in-scope derivation rule now; the gate bypass stays with C8, where ADR-0131 section 8 and D13 already put it).",
  "tests": "No code change, so no package tests or typechecks were run. Measurement runs at base 3d9188502e (worktree clean, git diff HEAD empty): closure build `pnpm turbo run build --filter='@objectstack/dogfood^...' --concurrency=2` under os-verify-lock → `Tasks: 63 successful, 63 total`, `VERDICT command-exit 0`; `@objectstack/organizations` build → `Tasks: 28 successful`, `VERDICT command-exit 0`. Five probe boots of examples/app-showcase through @objectstack/verify bootStack with a probe plugin recording every engine insert (temporary dogfood test file, removed by trap, never committed), each `Tests 1 passed (1)`, `VERDICT command-exit 0`: base-single-signup (harness default bootstrap off), base-single-none (bootstrap on, no admin: orgsAtListen [] then the harness orgContext guard refused the stack, as expected), base-single-dev (bootstrap on, dev admin signs up at kernel:ready), base-isolated (multiTenant true via a scratch host that declares @objectstack/organizations, OS_AUTH_MEMBERSHIP_POLICY=invite-only). No reverse verification or ablation: nothing was implemented.",
  "mcp_calls": "0",
  "api_writes": "1 - POST /repos/objectstack-ai/objectstack/issues/15195/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write. No pr_create, no label-write.",
  "gates": "n/a - no diff exists (needs_decision before the first edit), so dispatch-gates derives an empty change set; none of the dispatch-listed gates were run.",
  "line_budget": "n/a",
  "files_changed": [],
  "clause_2": "NOT MEASURED: no implementation, so no built entry declarations and no accept set to read. The claim's provisional `no (narrowing)` stands for the card as ruled. Under option B the narrowing is: in single, a seed load and a system insert on an in-scope object with zero or several organizations are refused where they land NULL today; nothing reaches packages/spec (the refusal reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, already in packages/spec/src/api/error-code-ledger.zod.ts:684).",
  "deviations": [
    "Two experiments were refused by this session's permission classifier (reason given: Security Weaken) and were not retried by any other route: (1) an uncommitted prototype removing the isPlatformObjectOutOfTenantAuditScope early return in packages/objectql/src/engine.ts:5841 to measure the ruled bypass on single and isolated boots; (2) a probe that pre-creates the slug=default organization in a probe plugin's start() to measure H2. A plain read of packages/plugins/organizations/src/claim-orphan-org-rows.ts and an aggregation of my own probe output were refused the same way. H2, the bypass consequences and claimOrphanOrgRows are therefore READ or NOT MEASURED, and are labelled so below.",
    "Probe boots used a temporary file packages/qa/dogfood/test/zz-probe-15195.dogfood.test.ts (domain:cli's path) copied in per run and removed by an EXIT trap; it was never staged or committed (git status --porcelain empty after every run).",
    "bootStack pins autoDefaultOrganization to false unless orgContext is set (packages/verify/src/harness.ts:571), so the first single run did not model production; the later single runs set orgContext: true.",
    "Walled boots refuse an undeclared membership policy; the isolated probe declared OS_AUTH_MEMBERSHIP_POLICY=invite-only, as a walled deployment must.",
    "Cross-lane: #6021 carried no reply to declaration 6039104553 when read; no build commit was pushed, so the re-read-before-first-build-push step was never reached."
  ],
  "H1": "CONFIRMED (measured). Inline seeds run in AppPlugin.start() under single (packages/runtime/src/app-plugin.ts:1440-1466; walled skips it at :1433-1439). The seed loader stamps only when exactly one organization already exists (packages/metadata-protocol/src/seed-loader.ts:625-626, :1720-1731), and none does: base-single-signup and base-single-dev read back 41 seeded rows on 6 objects, all organization_id NULL. ensureDefaultOrganization creates the org only once a platform admin exists (packages/plugins/plugin-auth/src/ensure-default-organization.ts:353-373 returns no_admin first) and is wired warn-only (packages/plugins/plugin-auth/src/auth-plugin.ts:1150-1199, catch at :1171-1175). base-single-none measured organizations [] at kernel:listening; the listener opens only on kernel:listening (packages/plugins/plugin-hono-server/src/hono-plugin.ts:705-709). The seed tenancy handoff on the org insert (app-plugin.ts:1652-1679) did not re-own the seeds: base-single-dev still read 41 NULL rows after the org existed.",
  "H2": "CONFIRMED BY READING, NOT MEASURED (the measuring probe was refused). Once a Default Organization exists, a new user's creation binds them as member (packages/plugins/plugin-auth/src/reconcile-membership.ts:235-259, role member at :196, target from tenancy.defaultOrgId(), packages/plugins/plugin-auth/src/tenancy-service.ts:505-545). The owner bootstrap then finds a membership and yields admin_already_in_org (ensure-default-organization.ts:377-384), and the once-gate records that as decided (packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts:89-106). So with the org created at boot, the first admin ends as member and the decision is recorded. Base, with no org before the admin (base-single-dev): admin is owner, posture PLATFORM_ADMIN. Any implementation of (1) must make the owner bind promote the reconciler's own member row on the Default Organization while the bind is undecided.",
  "H3": "CONFIRMED with one correction. One call site: ObjectQL.insert (packages/objectql/src/engine.ts:13603) → resolveSystemInsertOrganization (:5823-5868) → pure resolveSystemWriteOrganization (packages/objectql/src/tenancy/system-write-organization.ts:263-275). Every system insert reaches it: app seeds, per-org replay, bootstrap seeders, ledger rows, first-user grant, the reconciler's sys_member (better-auth tables carry no column). Base behaviour, measured: single with 1 org derives (base-single-dev acceptance insert stamped); single with 0 orgs lands NULL (base-single-signup); isolated refuses (base-isolated, ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, and the tenantId control lands); several orgs under single refuse ambiguous-organization (read, :274). The gate at engine.ts:5841 exempts 49 of the 57 column-carrying platform objects (scripts/platform-object-tenancy-census.json: 57 in reach; packages/objectql/src/tenancy/platform-object-tenancy.ts admits 8). The code already exists in the spec ledger (packages/spec/src/api/error-code-ledger.zod.ts:684): a new refusal reason needs no new code and no spec edit. Correction: the 0-org arm also serves lean compositions with no sys_organization registered (engine.ts:5774-5777); see open question 2.",
  "H4": "CONFIRMED (measured). The exemption is the regexp at packages/metadata-protocol/src/seed-loader.ts:1189-1190 (field doc :413-418). First-party seed datasets that hit it: examples/app-showcase seeds sys_business_unit (5 rows) - NULL on single at base, stamped on isolated because per-org replay passes config.organizationId. After withdrawal no first-party seed refuses in isolated/group: the inline seed is suppressed there (app-plugin.ts:1433-1439) and the replay always carries the organization. A fresh single boot stays green only if the Default Organization exists before AppPlugin.start() seeds; seed-tenancy-backfill.ts was not touched.",
  "H5": "PARTLY MEASURED. A fresh isolated boot comes up at base (base-isolated, with the membership policy declared) and its org bootstrap is the same once-gate (packages/plugins/organizations/src/organizations-plugin.ts:470-528). Its own org-less writes, measured: sys_capability x12 (bootstrap seeder) and sys_migration x2 (ledger records); under the ruled bypass both would be refused (system-write-organization.ts:268-270). claimOrphanOrgRows: NOT MEASURED (the read was refused). group posture: not booted. No reclassification is proposed, so the tenancy census does not move.",
  "boot_order_table": [
    "fresh single, production shape (no dev admin) | step | base 3d9188502e (measured) | ruled target (head not built)",
    "1 | AppPlugin.start() inline seed | 41 rows on 6 objects, organization_id NULL, sys_business_unit x5 included | Default Organization created first; every seed row stamped, sys_ seeds included",
    "2 | start-phase ledger | sys_migration x2, NULL | unchanged under option B",
    "3 | kernel:ready bootstrap seeders | sys_permission_set x17, sys_position x16, sys_position_permission_set x2, sys_capability x12, sys_sharing_rule x2, audience suggestion x1, all NULL | unchanged under option B (C3 owns them)",
    "4 | kernel:ready ensureDefaultOrganization | no_admin, no org created (read) | org already present; a failed creation fails the boot",
    "5 | kernel:listening | organizations: [] (measured) | Default Organization present",
    "6 | first sign-up after listen | org created and admin bound owner by the bootstrap trigger (measured in the dev-admin shape at kernel:ready: owner, PLATFORM_ADMIN) | reconciler binds member first (read), so the owner bind must promote it",
    "seeds after the org exists | still NULL (measured, base-single-dev) | already stamped at step 1"
  ],
  "derivation_rule_table": [
    "posture | organizations | tenantId supplied | base (measured or read) | ruled",
    "single | 0 | no | lands NULL (measured) | refused",
    "single | 1 | no | derived, stamped (measured) | derived",
    "single | 2 or more | no | refused ambiguous-organization (read) | refused",
    "isolated / group | any | no | refused walled-posture (measured, isolated) | refused",
    "any | any | yes | stamped with the supplied tenantId (measured) | unchanged",
    "the 49 platform objects outside the 8 admitted | any | no | exempt, lands NULL (measured: catalog seeders in single, sys_capability and sys_migration in isolated) | card: gate bypassed, so derived or refused; see open question 1"
  ],
  "open_questions": [
    {
      "question": "Q1. The ruled gate bypass at C1. Read consequences: (a) single - the first-user grant is written with explicit organization_id null (packages/plugins/plugin-security/src/bootstrap-platform-admin.ts:1133-1139) after the org exists (measured order in base-single-dev, and always so once C1 creates the org at boot); with the bypass the engine derives the Default Organization for it and the SQL driver overwrites the explicit null (packages/drivers/driver-sql/src/sql-driver.ts:15560), while PLATFORM_ADMIN is derived only from null-organization grants (packages/core/src/security/resolve-authz-context.ts:908-913) and the owner bootstrap's legacy anchor reads organization_id null (ensure-default-organization.ts:359-364). The first admin would lose platform standing and pin (c) would fail, silently. (b) single - env-layer sys_metadata rows are written with organization_id this.organizationId = null (packages/metadata-protocol/src/sys-metadata-repository.ts:692, :741, :886) and read back with organization_id null (:619-623); derivation would stamp them out of the env layer. (c) walled - the boot's own sys_capability seeder and sys_migration ledger writes would be refused. Each repair belongs to another card: C3 (seeders and the D5 grant owner, the card's own stop condition), C5 (sys_metadata), C6 (plumbing columns). Which scope does C1 take?",
      "options": [
        "A - Literal at C1: C1 also takes C3's D5 grant re-owning (seeder plus readers), C5's tenant-less sys_metadata, C6's plumbing column drops and the walled seeders' organization. Cost: three cards' scope in one PR, the seeder stop condition crossed, and ADR-0131 section 8 order inverted (C3 and C5 are blocked by C1).",
        "B - Split by schedule: C1 lands the boot invariant, the seed-exemption withdrawal, the owner pin and the derivation rule for objects already in scope (every app object plus the 8 admitted platform objects: derive at exactly one organization, refuse at zero or several, refuse under a wall). The per-object gate stays until C8, which section 8 already gives every-posture refusal and ledger retirement, and D13 already lists platform-object-tenancy.ts and isPlatformObjectOutOfTenantAuditScope. Cost: 49 column-carrying platform objects keep today's exemption until C8.",
        "C - Narrowed bypass at C1: adjudicate the 49 global/unclassified objects now, admitting those with a citable writer fact and holding the rest global until their card lands. Cost: a 49-object census against the ledger's no-guessing admission bar, on a ledger D13 deletes in C8."
      ],
      "recommendation": "B. Real business need: the measured defects (first-boot seeds NULL and never re-owned, no organization at listen) are fixed by B, and the rows the bypass would add (catalog seeds, ledger rows, env metadata) have their owner defined by C3/C5/C6 with no measured pull to stamp them now. Long-term soundness: B follows ADR-0131 section 8 and D13 and adds no code that later retires; A front-loads three cards, C invests in a ledger scheduled for deletion. Preventing AI mistakes: B keeps the strict contract on every object it covers and does not leave the platform-admin reader half-migrated; A's single-posture failure is silent (the stack boots, the first admin just lacks platform standing). Startup focus: B is the smallest change that delivers pins (a) to (d) and adds no gate."
    },
    {
      "question": "Q2. Compositions that register no sys_organization object (lean embeddings and bare-kernel tests, as the engine docblock at packages/objectql/src/engine.ts:5744-5757 names them). The engine answers them as zero organizations (packages/objectql/src/engine.ts:5774-5777). Under 'refused otherwise, in every posture', every system insert on any object carrying the injected column would be refused there. Which reading?",
      "options": [
        "A - No organization object means no tenancy to enforce: neither stamp nor refuse, stated in the docblock and pinned; the refusal applies wherever sys_organization is registered.",
        "B - Refuse there too: every lean composition must register an organization object, or declare tenancy.enabled false on every object."
      ],
      "recommendation": "A. Real business need: lean embeddings and the bare-kernel test population have no organization concept, and refusing their writes buys no ownership guarantee. Long-term soundness: ADR-0131 D1 governs objects whose rows have an owner; a composition with no owner type is outside it. Preventing AI mistakes: A keeps one declared rule (registered organization object = enforcement) instead of N per-object opt-outs. Startup focus: A changes nothing for lean users."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed - base-single-dev logged one DUPLICATE_RECORD refusal of a sys_migration insert during the kernel:ready owner bind (a second ledger write for an id already present); the boot continued and both ADR-0093 ledger rows were present afterwards. An observation, not a reproduced defect."
  ]
}

Generated by Claude Code

Claim: PM loop round 64 (take-over) · 2026-10-08T00:25Z
Session: session_01EUBvqtauTDmHi2ZgY759p2
Account: os-litant (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-15195-default-org-load-bearing
Worktree: objectstack-issue-15195
Domain: domain:engine (the card also reaches plugin-auth, a domain:services package, declared on #6021 in 6039104553; that post is vacant and no reply came)
Seat: domain:engine#1
Release: claim 6039083940 · session session_017ErfyP2Rx7XWHJA27QjyUi (os-project-manager) · 因: the claimant is unreachable, its session ran out of tokens and its dev with it, before any report on the build round · 去向: this claim, same branch, continuing from its pushed head
Provenance: the maintainer, verbatim in chat to session session_01EUBvqtauTDmHi2ZgY759p2: 「前任项目经理没token了，你接手他所有的开发」. The seat take-over record is 6049493167 on #6367.
Hand-over record: branch head 9ee45a169539c33ac44f2e4176b8acdfbe864cdb (corrected 2026-10-08T05:22Z; the claim first named a non-existent sha with the same prefix, see 6052936688), the last push (2026-10-07T17:11Z, a main merge over four wip commits: the single-posture refusal in objectql, the boot invariant and owner promotion in plugin-auth, the seed stamping in metadata-protocol, the runtime seed order, re-pinned tests and four changesets). No PR is open and no build report was posted. State: the build on triage's Q1 → B (6040634630) is partly done; a continuation dev picks it up from that head, verifies it against the scope below, finishes, and opens the PR. The assignee moved from os-project-manager to os-litant in this act.
File surface (the claim of record 6039083940, narrowed by triage's answer 6040634630 → B):

the boot invariant under single in plugin-auth (ensure-default-organization.ts, default-org-bootstrap-once.ts, auth-plugin.ts wiring) and the runtime seed order (app-plugin.ts);
the seed-exemption withdrawal in metadata-protocol's seed-loader.ts;
the owner pin, with the member-to-owner promotion (reconcile-membership.ts only if measured necessary);
the derivation rule for objects already in scope in objectql (engine.ts resolveSystemInsertOrganization, tenancy/system-write-organization.ts);
⛔ no C3, C5 or C6 surface; the isPlatformObjectOutOfTenantAuditScope gate stays; the lean-install branch (no organization object registered) stays as-is, with a pin.
Container & model: L, mode:subagent, model: default (dispatch-gates --tier at 2026-10-08T00:25Z: no path-derived mandate on the branch's 26 paths; the seat's call for a p1 security continuation across four packages).
Clause-②: yes
Revised at hand-back (2026-10-08T05:22Z, seat 1): the dev measured the built entry declarations (os-dev-report 6052898415). plugin-auth gains an optional option, an optional result field and a reason literal; objectql's refusal-reason union gains a member and a decision literal is renamed. The public surface widens while the accept sets narrow, so the line is yes; an at-tier contract review is owed before the queue. Record: 6052936688.
The line originally read Clause-②: no, with the reasoning below.
Narrowing: writes accepted today without an organization (unstamped system inserts under single with zero or several organizations, and unstamped platform seeds) are refused. The refusal reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, already in the error-code ledger (dev, 6039940359). minor BREAKING under the launch-window convention.
The dev measures the built entry declarations; a widening found there revises this line and owes a contract review.
Responsibility: n/a — not a defect card
Thread-read: 6040634630
Serial constraints cleared: at 2026-10-08T00:25Z, the open PRs' file lists read by filename against the branch's 26 paths:
PR feat(spec)!: retire the flat string-list arm of manifest.permissions — the structured ADR-0025 block is the only form (#13458) #22094 (domain:spec, Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458) edits runtime/src/app-plugin.ts at its :1134 hunk; this card's seed order is the inline-seed region (about :1440). Different region; whichever lands second merges main.
PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 (draft, domain:services refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205) edits plugin-auth/src/auth-plugin.ts at its :959 hunk; this card's wiring is the default-organization region (about :1150). Different region; whichever lands second merges main.
PR fix(objectql): skipAutomations never skips the builtin audit stamps #22106 (this lane's finding(objectql): skipAutomations also skips ObjectQL's own audit stamp — sys_stamp_audit_insert/update are bound through bindHooks, so they carry meta, and a data import with "run automations" unchecked writes rows without created_by/updated_by #22070) touches none of these files. No other open PR does.

os-dev-report

{
  "issue": 15195,
  "status": "needs_decision",
  "branch": "claude/issue-15195-default-org-load-bearing",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22186",
  "session": "session_01EUBvqtauTDmHi2ZgY759p2 (subagent: the dispatching PM session's id)",
  "premise_still_valid": true,
  "summary": "C1 as triage scoped it (Q1 to B) is implemented on the inherited branch and the draft PR #22186 is open at head 4fc2472fd0. The pieces: the Default Organization is a boot invariant in AuthPlugin.start(); AppPlugin is ordered after the auth plugin; the seed loader stamps every row of an object that carries an organization column, sys_ seeds included, or refuses it; the first admin is promoted from the reconciler's member row to owner; and resolveSystemInsertOrganization refuses zero organizations under single where the organization object is registered. The four package suites and typechecks are green, 110 of 110 derived gates were run (109 green, 1 shallow-clone prerequisite), and pins (a) and (d) are red at base and green at head, with ablations. Two inherited defects were corrected. First, the withdrawn seed exemption stamped organization_id on objects with no such column, so the real engine dropped those seed rows (measured). Second, the boot invariant was published from the package barrel with no consumer, and it is now an internal module. The work stops at a decision. The Dogfood Regression Gate (a required check) fails on 24 files at this head; all 24 pass at its base. C1 removes the org-less single boot that @objectstack/verify's bootStack pins (autoDefaultOrganization false) and that those fixtures encode. Re-pinning them crosses into packages/qa/dogfood and packages/verify, and the memory-driver variants cannot pass under single until the engine stops handing a tenant scope (ADR-0131 D8, C8). See open_questions.",
  "base": "BASE for the family rules: worktree created from the remote branch at 9ee45a1695 (merge-base with origin/main aa71c4d9d1); main merged twice more, so the final merge-base and the base of every base-vs-head reading on the final head is ec8f37c890 (earlier probe readings name 51290bca2c, the merge-base they were taken against).",
  "handover": [
    "packages/objectql/src/engine.ts: kept",
    "packages/objectql/src/tenancy/system-write-organization.ts: kept",
    "packages/objectql/src/system-write-organization.test.ts: kept",
    "packages/objectql/src/engine-organization-probe-outage.test.ts: kept (M5: flip correct, the old expectation was the D9 defect)",
    "packages/objectql/src/protocol-publish-package-drafts.test.ts: kept (M5: fixture now holds its Default Organization; subject unchanged)",
    "packages/objectql/src/seed-loader-org-fallback.test.ts: kept (M5: flips are the exemption withdrawal and D9)",
    "packages/plugins/plugin-auth/src/ensure-default-organization.ts: corrected (boot invariant moved out to the internal default-organization-invariant.ts, which the barrel does not export; unused helper removed)",
    "packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts: kept (doc pointer only)",
    "packages/plugins/plugin-auth/src/auth-plugin.ts: kept (import repointed)",
    "packages/plugins/plugin-auth/src/auth-plugin.test.ts: corrected (the added update double routes through assertEngineUpdateDispatch; recorded in scripts/engine-double-contract.pinned.json); its re-pins kept (M5: flips correct or fixture-only)",
    "packages/plugins/plugin-auth/src/ensure-default-organization.test.ts: corrected (import repointed; update double pinned)",
    "packages/metadata-protocol/src/seed-loader.ts: corrected (the stamp now applies only to objects carrying an organization column; the inherited version stamped tenancy-off objects and the engine refused those rows as an unknown field, measured on a real kernel)",
    "packages/metadata-protocol/src/seed-loader-organization-stamp.test.ts: corrected (column-less controls added; the fake declares only the verbs the loader calls; its WHERE matcher refuses combinators)",
    "packages/metadata-protocol/src/seed-loader-engine-schema-fallback.test.ts, seed-loader-existing-records-read-failure.test.ts: kept (M5: fixture-only)",
    "packages/metadata-protocol/src/seed-loader-sole-organization-read-failure.test.ts: kept (M5: flips are the D9 defect)",
    "packages/runtime/src/app-plugin.ts: kept (M3 measured and ablated)",
    "packages/runtime/src/http-dispatcher.test.ts, domains/packages-seed-apply-disclosure.test.ts, domains/packages-seed-apply-read-decorations.test.ts: kept (M5: fixture-only)",
    "packages/runtime/src/seed-tenancy-autonumber-split.integration.test.ts, system-write-tenancy-autonumber-split.integration.test.ts: kept (M5: the first-boot NULL expectation was the defect; the split is reproduced from residue)",
    ".changeset/15195-objectql-no-organization-refused.md: kept, Clause-② line changed to the measured yes (narrowing)",
    ".changeset/15195-metadata-protocol-seed-organization-stamp.md: corrected (column-aware stamp, Clause-② line)",
    ".changeset/15195-plugin-auth-default-organization-boot-invariant.md: corrected (every user bound from the first boot, the in-memory driver consequence, the TypeScript surface, Clause-② line)",
    ".changeset/15195-runtime-app-plugin-after-auth.md: kept"
  ],
  "mechanism_assumptions": {
    "M1": "CONFIRMED, measured. On a head showcase boot with the owner bind on, the reconciler inserts the first admin's sys_member row as member before the platform-admin grant, and the bootstrap logs 'promoted the platform admin to owner'. With the owner bind off (the harness default), the admin stays member. Ablating the promotion call turns pin (c) red: the role stays member.",
    "M2": "CONFIRMED. The refusal reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED; the new reason literal lives in objectql. No packages/spec edit.",
    "M3": "CONFIRMED, measured and ablated. bootStack registers AppPlugin before AuthPlugin. At head the sys_organization insert is the boot's first insert (seq 0 of 98), before every seed row. With com.objectstack.auth removed from AppPlugin.optionalDependencies, the seed runs first and every seed row is refused at zero organizations.",
    "M4": "CONFIRMED as a control. The first admin's get-session reads isPlatformAdmin true with positions including platform_admin at head (harness boots and pin kernels A and B). The null-organization admin_full_access grant is still written.",
    "M5": "Each re-pinned existing test judged (see handover); every flip is either the defect this card fixes or a fixture-only change; none restored."
  },
  "boot_order_table": [
    "fresh single, examples/app-showcase via bootStack; base 51290bca2c, head c49f46bab1 (same implementation as 4fc2472fd0); 132 seed rows over 19 objects",
    "AuthPlugin.start() | base: no organization | head: Default Organization inserted, first insert of the boot (seq 0 of 98)",
    "AppPlugin.start() inline seed | base: 132 rows NULL, sys_business_unit 5 of 5 NULL | head: 0 NULL, sys_business_unit stamped",
    "kernel:ready | base: 0 organizations | head: 1",
    "kernel:listening | base: 0 (harness default); 1 only when a dev admin exists at kernel:ready (orgContext: org was insert 49, after every seed; 130 of 132 seed rows NULL) | head: 1",
    "dev admin, owner bind on | base: org created and admin bound owner directly | head: reconciler binds member, promoted to owner; isPlatformAdmin true",
    "dev admin, owner bind off | base: no membership, no active organization | head: member of the Default Organization, which is the active organization"
  ],
  "derivation_rule_table": [
    "posture | organizations | organization object registered | write carries one | base | head",
    "single | 1 | yes | no | derived | derived",
    "single | 0 | yes | no | lands NULL (measured) | refused no-organization (measured)",
    "single | 2+ | yes | no | refused ambiguous-organization | unchanged",
    "single | 0 | no (lean) | no | lands unstamped | unchanged, pinned",
    "isolated / group | any | yes | no | refused walled-posture | unchanged (measured on a posture-only isolated showcase boot: ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, 500; the tenantId control lands stamped)",
    "any | any | any | yes | stamped with it | unchanged",
    "49 gated platform objects | any | any | no | exempt | unchanged (C8)"
  ],
  "tests": "All at head 4fc2472fd0 unless named. Package suites: @objectstack/objectql 381 files / 7527 passed (shards 1/2 and 2/2); @objectstack/metadata-protocol 222 files / 28251 passed; @objectstack/plugin-auth 126 files / 2642 passed; @objectstack/runtime 337 files / 5469 passed. Every run has VERDICT command-exit 0. Typecheck for all four is green, check:test-typecheck included. Pins: runtime/src/default-organization-boot-invariant.pin.test.ts, a real kernel booted twice. Head: 7 passed. Base ec8f37c890: 5 failed, 2 passed. That base run restored the 8 implementation paths to base in the tree, rebuilt the 4 packages, and confirmed with ablation-dist-preflight --absent that each head marker was gone from dist. The trap restore was proven by git diff HEAD empty and per-path blob hashes equal to HEAD, then the packages were rebuilt with the markers present again. Red at base: (a) x3, (d), and (c)'s precondition (expected [owner] to equal [member]: the organization did not predate the admin). Green at base by design: the HTTP first-sign-up owner case and the platform-admin control. Ablations, each restored and rebuilt: (1) the promotion call disabled turns (c) red, 1 failed / 6 passed. Two earlier attempts are void: a comment marker the bundler strips, and a mutation that left the promotion's update running. (2) com.objectstack.auth removed from AppPlugin.optionalDependencies turns (a)'s ordering case and (d) red, 2 failed, with 10 seed refusals logged. (b) is held by the pre-existing #8844 objectql cases and was measured on a real isolated boot; (e) is held by the objectql and metadata-protocol Q2 cases. Dogfood: all 8 OS_TEST_SHARD slices at head; 24 files fail, 36 tests plus beforeAll failures. The same 24 files at base 51290bca2c: Test Files 24 passed, Tests 218 passed. An uncommitted harness experiment (owner bind on in every boot) left 19 of the 24 failing; the bundler folded its marker, so the evidence that its build was live is the 5 files it turned green. eslint --no-inline-config over the 24 touched TypeScript files: 0 errors, 0 warnings, 24 files in the JSON report. The config has no type-aware rules, so untouched files' verdicts cannot move; the full pnpm lint run is CI's.",
  "gates": "dispatch-gates --commands at 4fc2472fd0 derived 110 commands, and all 110 ran on that head: 109 exit 0, and node scripts/check-engine-split-ratio.mjs --days 90 exit 2 (shallow clone, prerequisite refusal: NOT MEASURED, reason: oldest visible commit is inside the 90-day window). dispatch-gates --ran: 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN (exit codes kept in the runner's own log). Gates that were red during the round and fixed in the diff: check:tenant-audit-census (two new system writes; census regenerated, prose 233 to 235), check:engine-double-contract (new doubles pinned; ledger row added with --write), check:where-matcher, check:slot-lookup. check:dual-build-cjs-loads first answered PREREQUISITE NOT MEASURED, then went green after building the 8 packages it named. Dogfood Regression Gate: red at this head by construction (see open_questions); CI conclusions: in_progress, not awaited.",
  "line_budget": "n/a: no skills/** or other governed path in the diff",
  "files_changed": [
    ".changeset/15195-metadata-protocol-seed-organization-stamp.md",
    ".changeset/15195-objectql-no-organization-refused.md",
    ".changeset/15195-plugin-auth-default-organization-boot-invariant.md",
    ".changeset/15195-runtime-app-plugin-after-auth.md",
    "content/docs/permissions/tenant-audit-census.mdx",
    "docs/audits/2026-08-tenant-audit-write-call-sites.counts.md",
    "packages/metadata-protocol/src/seed-loader.ts",
    "packages/metadata-protocol/src/seed-loader-organization-stamp.test.ts",
    "packages/metadata-protocol/src/seed-loader-engine-schema-fallback.test.ts",
    "packages/metadata-protocol/src/seed-loader-existing-records-read-failure.test.ts",
    "packages/metadata-protocol/src/seed-loader-sole-organization-read-failure.test.ts",
    "packages/objectql/src/engine.ts",
    "packages/objectql/src/tenancy/system-write-organization.ts",
    "packages/objectql/src/system-write-organization.test.ts",
    "packages/objectql/src/engine-organization-probe-outage.test.ts",
    "packages/objectql/src/protocol-publish-package-drafts.test.ts",
    "packages/objectql/src/seed-loader-org-fallback.test.ts",
    "packages/plugins/plugin-auth/src/auth-plugin.ts",
    "packages/plugins/plugin-auth/src/auth-plugin.test.ts",
    "packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts",
    "packages/plugins/plugin-auth/src/default-organization-invariant.ts (new; a plugin-auth file beyond the claim's surface: the seat declares it)",
    "packages/plugins/plugin-auth/src/ensure-default-organization.ts",
    "packages/plugins/plugin-auth/src/ensure-default-organization.test.ts",
    "packages/runtime/src/app-plugin.ts",
    "packages/runtime/src/default-organization-boot-invariant.pin.test.ts (new)",
    "packages/runtime/src/http-dispatcher.test.ts",
    "packages/runtime/src/domains/packages-seed-apply-disclosure.test.ts",
    "packages/runtime/src/domains/packages-seed-apply-read-decorations.test.ts",
    "packages/runtime/src/seed-tenancy-autonumber-split.integration.test.ts",
    "packages/runtime/src/system-write-tenancy-autonumber-split.integration.test.ts",
    "scripts/engine-double-contract.pinned.json"
  ],
  "clause_2": "MEASURED on the built entry declarations, base ec8f37c890 against head: objectql: SystemWriteOrganizationDecision 'no-organization-yet' becomes 'no-organization-object', SystemWriteRefusalReason gains 'no-organization', and resolveSystemWriteOrganization takes a required organizationObjectRegistered. plugin-auth: EnsureDefaultOrganizationOnceOptions gains an optional organizationCreatedByThisProcess, and EnsureDefaultOrganizationResult gains an optional ownerPromoted and the 'owner_promotion_failed' reason. metadata-protocol and runtime: no public declaration change. The surface widens and the accept sets narrow: the PR body carries 'Clause-②: yes (narrowing)' where the claim reads 'Clause-②: no' (open_questions Q3). All three breaking changesets are minor with the BREAKING banner and an ADR-0087 not-required (no-migration-prescription) disposition; .changeset/pre.json is absent on origin/main ec8f37c890.",
  "mcp_calls": "0",
  "api_writes": "3 writes, each through the fleet-write relay as objectstack-fleet[bot]. Each is one POST /repos/objectstack-ai/objectstack/dispatches from the session, then the run's own request: (1) POST /repos/objectstack-ai/objectstack/pulls (pr_create, draft, #22186; read-back identical, 16479 bytes); (2) POST /repos/objectstack-ai/objectstack/issues/22186/assignees (label-write --assign os-litant; read back as the target); (3) POST /repos/objectstack-ai/objectstack/issues/15195/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). No card label or card assignee write. git pushes of the branch are not REST writes.",
  "deviations": [
    "The dispatch named the inherited head as 9ee45a16956d1a0bb575ec97a05e40fa2bc5edca; no such object exists. The remote branch head was 9ee45a169539c33ac44f2e4176b8acdfbe864cdb, with the same 10-character prefix, the four named wip commits and the main merge. The worktree was created from the remote branch.",
    "The container restarted while the first objectql suite run was in flight; that run is void and every package suite was re-run on the final head.",
    "One base-leg call hit the 590 s foreground cap while queued 7m40s behind another agent's lock. The trap restored the tree (git status clean), and the base pin was re-run in the next call against the already-built base dist, with the dist markers re-checked absent.",
    "A foreground loop of four typecheck commands was refused by a built-in safety check that reported a shell -c script running rm; the command contained no removal. The same typechecks were then run as two plain calls with no removal in them; both answered VERDICT command-exit 0.",
    "Main was merged twice (to 033e5c536d, then ec8f37c890, which brought PR #22094's app-plugin.ts hunk and spec changes). The closure was rebuilt and all four suites, typechecks, gates, the pin and dogfood were re-run on the final merge 4fc2472fd0.",
    "Measurement probes: a temporary dogfood test file (packages/qa/dogfood/test/zz-probe-15195.dogfood.test.ts) was copied in per run and removed by an EXIT trap; it was never staged.",
    "Files beyond the claim's surface: packages/plugins/plugin-auth/src/default-organization-invariant.ts (new plugin-auth file, domain:services; the seat declares it). Gate-mandated regenerations: content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md, scripts/engine-double-contract.pinned.json. The real-kernel pin lives in packages/runtime (in surface). No dogfood or verify file was edited.",
    "Worktree removed after the PR opened (node_modules deleted first; git worktree remove succeeded without --force). A follow-up round recreates it from the remote branch."
  ],
  "open_questions": [
    {
      "question": "Q1. C1 removes the org-less single boot. Under single, every boot now has the Default Organization, and every sign-up is its member. @objectstack/verify's bootStack pins autoDefaultOrganization:false to model 'pure single-tenant (no org, no scoping)', and 24 dogfood files encode that shape. All 24 fail at head 4fc2472fd0 and pass at base (measured). By cause: 5 files mint their own slug 'default' organization (DuplicateRecordError); 5 need an org-less principal (sharing-rule-org-less-caller x13, armed x4, and three assertArmed fixtures); 4 are driver='memory' variants (see Q2); 5 see the harness admin as a member instead of an org-less platform admin (permission-set edits, sys_file, two-doors); 1 is the defect C1 fixes (single-tenant-identity-create expects a NULL organization); 4 need a per-file read (delegation-of-duty, invitation-ledger-row-scope, org-admin-affordance-reach, organization-delete-federated-fixture, where deleting the organization now clears it on seeded rows). With the harness's owner bind on in every boot (experiment), 19 still fail. The Dogfood Regression Gate is required. Where and by whom are these landed?",
      "options": [
        "A. This PR absorbs them: bootStack drops the org-less pin and boots the production shape (owner bind on; orgContext's doc and meaning corrected), and each of the 19 remaining files is re-pinned on its own merits (org-less personas built explicitly, find-or-create the default organization, memory variants per Q2, the defect flip). Cost: about 25 files of packages/qa/dogfood and packages/verify join a tenancy PR. That crosses into domain:cli's lane, the PR stays Tier-free but large, and every re-pin needs a per-file judgement of the kind M5 got.",
        "B. Sequenced: a dogfood/verify-lane PR first makes the fixtures independent of whether a single boot has an organization, and C1 lands after it with only its own flips. Cost: several fixtures assert that an org-less boot exists at all (armed, sharing-rule-org-less-caller); they cannot pass at both base and head without inventing a test-only escape, which ADR-0131 D11 forbids. So B either leaves those files for C1 anyway or needs the escape.",
        "C. Keep an explicit org-less single escape for fixtures. Rejected on measurement: under the ruled engine an org-less single install with the organization object registered refuses every seed row and system insert, so the showcase would boot without its data. It would also reintroduce the shape D11 retires."
      ],
      "recommendation": "A. Real business need: production single deployments already boot org-bound (measured at base: the dev and serve shape binds the admin as owner), so the 24 fixtures test a shape no deployment runs once C1 lands. Re-pinning them is the honest cost of the ruled change, not new scope. Long-term soundness: one atomic landing keeps the harness, the fixtures and the runtime agreeing at every commit on main; B either splits a change that cannot be split or needs an escape hatch. Preventing AI mistakes: A leaves no test-only org-less mode for an author to copy into an app, and the harness boots the production shape, so a fixture can no longer pass on a posture no deployment has. Startup focus: no new gate, no new option; the experiment shows the harness change alone clears 5 of 24 files. The seat declares the dogfood and verify paths to their lane."
    },
    {
      "question": "Q2. The in-memory driver under single. @objectstack/driver-memory refuses any read the engine hands a tenant scope, and at head every session carries the Default Organization, so a single deployment on that driver answers a signed-in user's data reads 503 (the four driver='memory' dogfood variants). This is not new in production terms. At base, the same showcase boot with the owner bind on (orgContext, the shape objectstack dev boots) already answers the platform admin's GET /data/showcase_category 503 SERVICE_UNAVAILABLE on the memory driver (measured). What does C1 do about it?",
      "options": [
        "A. Accept it until C8: ADR-0131 D8 gives single no read predicate, so once C8 stops the engine handing a tenant scope under single, the driver serves again. C1 states the consequence (done in the plugin-auth changeset), and the memory-driver dogfood variants move to the SQL in-memory driver or are scoped out until C8.",
        "B. Pull D8's single half forward into C1, so the engine threads no tenantId to drivers under single. This is C8's surface (the one predicate) and sits next to applyTenantScope, which the card's stop condition reserves for C8.",
        "C. Teach the memory driver to accept a tenant scope under single. A consumer-side tolerance against contract-first, and it isolates nothing."
      ],
      "recommendation": "A. Real business need: the memory driver is a test and quick-start backend; the measured base already refuses the production-shape admin on it, so C1 widens an existing incompatibility rather than creating one. Long-term soundness: the fix has a scheduled owner (C8, D8). B front-loads C8 against the card's stop condition, and C adds a lenient branch that C8 would delete. Preventing AI mistakes: A keeps the driver's loud refusal (a 503 naming the cause in the log) instead of a silent unisolated read. Startup focus: no new code; one changeset sentence and the fixture moves Q1 already covers."
    },
    {
      "question": "Q3. Clause-②. The claim of record reads 'Clause-②: no'. Measured on the built entry declarations, the published TypeScript surface grows: plugin-auth gains an optional option, an optional result field and a reason literal, and objectql's refusal-reason union gains a member. Accept sets narrow, and one objectql decision literal is renamed. The PR body and the changesets carry 'Clause-②: yes (narrowing)'. The seat revises the claim, or names a reading under which these additions are not public surface.",
      "options": [
        "A. Revise the claim to yes (narrowing), as measured.",
        "B. Shrink the surface to keep 'no': drop organizationCreatedByThisProcess and pass the same fact through the gate's existing ensure injection in AuthPlugin, leaving ownerPromoted and the new reason literals (output members) as the only additions."
      ],
      "recommendation": "A. Real business need: the option is what lets a ledger-less kernel still bind its first owner now that start() creates the organization; the result field and the reason literals are how a caller sees the promotion. Long-term soundness: B hides a gate input inside an injection hook, where the gate's own docblock can no longer describe it. Preventing AI mistakes: a declared option is a contract an author can read; an override through ensure is not. Startup focus: no new gate either way; the levels stay minor."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed. The once-only owner bind runs on two concurrent triggers. At head, the bind is promoted to owner while the sys_migration ledger records outcome admin-already-member, and the second ledger insert is refused DUPLICATE_RECORD. Base shows the same DUPLICATE_RECORD, and round 1 saw it too. This is an observation of the ledger's outcome label, not a reproduced ownership defect: the final membership is right in every run.",
    "carrier: 承接者:无 · noted, not filed. Read, not measured: the seed loader's sole-organization fallback still derives under a walled posture when a load names no organization and the install holds exactly one organization. D9 says refused under a wall. The walled inline seed is suppressed and the per-organization replay always names its organization, so no first-party path was found that reaches it.",
    "carrier: whoever takes Q1 · noted, not filed. bootStack's orgContext docs and the 'pure single-tenant (no org, no scoping)' comment in packages/verify/src/harness.ts describe a shape this change removes.",
    "dedupe words (for the seat, should any of the above be filed): default-org owner bind ledger outcome race; seed loader sole organization walled posture; bootStack orgContext org-less single"
  ]
}

Generated by Claude Code

Retriage requested: `pm:retriage` · C1 is built (draft PR #22186), and the required dogfood gate needs a lane decision: C1 removes the org-less `single` boot that 24 dogfood files and `@objectstack/verify`'s `bootStack` encode

domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant) · 2026-10-08T05:21Z.

The dev's report is 6052898415: needs_decision, draft PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 (Fixes #15195, head 4fc2472fd0, 31 files, +1603/−209).
⛔ The claim (6049583616) stands, the card keeps pm:dispatched, and PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 stays draft until this is answered.
Correction (the seat's own error): the claim and the dispatch order named the inherited head as 9ee45a16956d1a0bb575ec97a05e40fa2bc5edca. That object does not exist; the remote head was 9ee45a169539c33ac44f2e4176b8acdfbe864cdb (same 10-character prefix, the four wip commits and the main merge). The dev worked from the real head.

What is built (the dev's measurements; the seat read the PR's file list and body, CI has not run): on triage's Q1 → B (6040634630), the Default Organization is a boot invariant in AuthPlugin.start() (the boot's first insert); AppPlugin is ordered after the auth plugin; the seed loader stamps every row of an object that carries an organization column (sys_ seeds included) or refuses it; the first admin is promoted from the reconciler's member row to owner; resolveSystemInsertOrganization refuses zero organizations under single where the organization object is registered; the lean branch is unchanged and pinned. Pins (a) and (d) are red at base and green at head, with ablations; four package suites and typechecks green; 109 of 110 derived gates green (1 shallow-clone prerequisite).

PR state at this stamp: mergeable_state: dirty. Two gate-regenerated files (content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md) conflict with main, so no CI run exists on the head. The next round merges main and regenerates them.

Q1. Where do the 24 dogfood re-pins land? Measured: all 24 files fail at head and pass at base. bootStack pins autoDefaultOrganization: false ("pure single-tenant (no org, no scoping)"), a shape C1 removes. By cause: 5 mint their own default organization (duplicate), 5 need an org-less principal, 4 are driver='memory' variants (Q2), 5 see the harness admin as a member instead of an org-less platform admin, 1 is the defect C1 fixes, 4 need a per-file read. The Dogfood Regression Gate is required.

A. This PR absorbs them: bootStack boots the production shape, and each file is re-pinned on its merits. About 25 files of packages/qa/dogfood and packages/verify (domain:cli) join this PR.
B. Sequenced: a domain:cli PR first makes the fixtures independent of whether a single boot has an organization, then C1 lands. Cost: several fixtures assert that an org-less boot exists at all; they cannot pass at both base and head without a test-only escape, which ADR-0131 D11 forbids.
C. An org-less single escape for fixtures. Rejected on measurement: the ruled engine refuses every seed row of an org-less single install.
The seat's read: A (one atomic landing; no test-only org-less mode left for an author to copy). It makes this a cross-lane single PR, which is triage's to designate; the seat declares the domain:cli paths on [PM seat] domain:cli — 🟢 os-project-manager · session_019SvPnd2bzECRNmAU9i6E4k #6024 once answered.

Q2. The in-memory driver under single. driver-memory refuses any read handed a tenant scope; at head every session carries the Default Organization, so its signed-in data reads answer 503. Measured at base: the production-shape boot (owner bind on) already answers the platform admin 503 on that driver.

A. Accept until C8 (ADR-0131 D8 gives single no read predicate): the plugin-auth changeset states the consequence, and the four memory variants move to the SQL in-memory driver or are scoped out until C8.
B. Pull D8's single half into C1: C8's surface, next to applyTenantScope, which this card's stop condition reserves.
C. A lenient memory-driver branch: consumer-side tolerance, isolates nothing.
The seat's read: A.

Q3, decided by the seat (measurement, not a fork): the built entry declarations widen (plugin-auth: an optional option, an optional result field and a reason literal; objectql: a refusal-reason member and a renamed decision literal), while the accept sets narrow. The claim's Clause-②: no is revised to yes in this act, as measured; the PR body already reads Clause-②: yes (narrowing). An at-tier contract review is owed before the queue, and the seat commissions it after the build round.

Cross-lane, declared in this act: the new packages/plugins/plugin-auth/src/default-organization-invariant.ts (internal, not exported) to domain:services; the two census regenerations are gate-mandated outputs.

Noted, not filed (report): the once-only owner-bind ledger records admin-already-member with a DUPLICATE_RECORD on its second insert at base and head (final membership correct); the seed loader's sole-organization fallback under a wall is read-only, with no first-party path found; bootStack's orgContext docs describe the removed shape (rides Q1).

Path: access — one organization owns every row | 缺项 | P1

Triage: `pm:retriage` answer: Q1 → A, Q2 → A; Q3 noted. `pm:retriage` removed; the claim and `pm:dispatched` stand

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T05:53Z. ⛔ Not a claim, ⛔ not a dispatch.

This answers 6052936688, on the dev's report 6052898415 (draft PR #22186).

Q1 → A. One atomic landing. PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 carries the dogfood and bootStack re-pins.
- Designation: this is a cross-lane single PR. packages/qa/dogfood and packages/verify (domain:cli) join it, declared on [PM seat] domain:cli — 🟢 os-project-manager · session_019SvPnd2bzECRNmAU9i6E4k #6024 as the seat proposes. Each of the 24 files is re-pinned on its own merits, by the cause the report lists.
- B is ruled out: several fixtures assert that an org-less single boot exists, so they cannot pass at both base and head without a test-only escape, which ADR-0131 D11 forbids.
- C is ruled out on measurement: the ruled engine refuses every seed row of an org-less single install.
- The bootStack orgContext docs that describe the removed shape ride the same PR.
Q2 → A. Accept until C8.
- The plugin-auth changeset states the consequence: driver-memory refuses tenant-scoped reads, so under single its signed-in reads answer 503 until C8 (feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212, ADR-0131 D8) gives single no read predicate.
- The four memory variants move to the SQL in-memory driver, or are scoped out with Restart-when: #15212 closed named in the PR.
- The production-shape boot already answers 503 on that driver at base (measured), so this is not a new regression of a shipped path.
- B is ruled out: it takes C8's surface, which this card's stop condition reserves. C is ruled out: a lenient memory branch isolates nothing.
Q3 noted. Clause-②: yes as the seat measured: the built entry declarations widen while the accept sets narrow. The at-tier contract review is owed before the queue, as commissioned.
Carried, not new cards:
- the owner-bind ledger's admin-already-member second insert is [finding] every artifact boot on a fresh :memory: database logs Insert operation failed … UNIQUE constraint failed: sys_migration.id with a full knex stack in Boot diagnostics #22099 (p3, domain:services);
- the wall's sole-organization seed fallback stays a read-only note in Acceptance notes, with carrier: the claimant.
⛔ Classes, positions and functions only on this card.

Claim amendment · 2026-10-08T06:35Z · domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant), to the claim 6049583616, on triage's answer 6053354661 (Q1 → A, Q2 → A, Q3 noted).

File surface adds (a cross-lane single PR by triage's designation; declared on [PM seat] domain:cli — 🟢 os-project-manager · session_019SvPnd2bzECRNmAU9i6E4k #6024 in 6053967589): packages/verify/src/harness.ts (bootStack boots the production single shape; the orgContext docs) and the 24 files under packages/qa/dogfood/test/ the report lists, each re-pinned on its cause. The four driver='memory' variants move to the SQL in-memory driver or are scoped out with Restart-when: #15212 closed.
Serial constraint, recorded now (同区域串行): this lane's feat(objectql,metadata,runtime)!: refuse a package whose position, permission set or capability name is already held by an installed package, the environment catalog or a built-in (ruling Q4 = A on #15196; narrows ADR-0048 §3.4) #22135 (PR feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197, in a patch round) also edits showcase-composition dogfood files and the shared helper showcase-security.ts. feat(objectql,metadata,runtime)!: refuse a package whose position, permission set or capability name is already held by an installed package, the environment catalog or a built-in (ruling Q4 = A on #15196; narrows ADR-0048 §3.4) #22135 is expected to land first; this build reads its diff before touching a shared file, keeps both intents where both touch one, and merges main again once it lands. domain:spec's PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 (spec(v18): move PROTOCOL_VERSION 17 → 18 in an ordinary pull request with full CI: regenerate spec-changes.json and the 17 → 18 upgrade-guide section, rewrite the in-repo ^17 handshakes, and give the lockstep test one pre-mode exception (#22085 Q1) #22130) edits ^17 handshake strings in three of the same files; whichever lands later merges main.
Next round: merge main (PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 is dirty on two gate-regenerated census files), regenerate them, build the re-pins, run all 8 dogfood shards. The continuation goes to the same dev, same branch. Then the at-tier contract review (Clause-②: yes), then the queue.
The maintainer was shown Q1 and Q2 in this seat's chat (batch 2, recommendation 1A 2A, matching triage's letters). A maintainer answer that differs overrides this one.

os-dev-report

{
  "issue": 15195,
  "status": "done",
  "branch": "claude/issue-15195-default-org-load-bearing",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22186",
  "session": "session_01EUBvqtauTDmHi2ZgY759p2",
  "premise_still_valid": true,
  "round": "build round 2 (triage 6053354661: Q1 to A one atomic landing, Q2 to A accept until C8)",
  "head": "9aee4d05f1 (pushed; origin/main 9f0de32a03 merged at 4b40ca31f5)",
  "summary": "PR #22186 now carries the bootStack and dogfood re-pins with the C1 implementation, as one atomic landing. packages/verify/src/harness.ts boots the production single shape: the owner bind is always on, and orgContext is only the vacuity guard. Each of the 24 dogfood files is re-pinned on its own cause; the re-pin table is in the replacement body. single-tenant-identity-create flips to the new answer; nothing is deleted, and there is no org-less test mode. The four analytics memory legs move to an objectql-strategy leg on sqlite-wasm, with Restart-when: #15212 closed. The plugin-auth changeset states the driver-memory 503 until C8. At head 9aee4d05f1, all 8 dogfood shards, the five package suites, six typechecks, the 110 derived gates and a reverse verification of the harness change are green, or red where they should be. The full replacement PR body is in pr_body_replacement; the PR body itself was not PATCHed.",
  "tests": "All at head 9aee4d05f1 after rebuilding the dogfood dependency closure (71 turbo tasks, exit 0). DOGFOOD, 8 shards (OS_TEST_SHARD=k/8, one shard per locked call), files/tests per shard: 1/8 28/284; 2/8 28/184; 3/8 28/142; 4/8 28/187+1 skipped; 5/8 28/226; 6/8 28/221; 7/8 26+1 skipped/242+2 skipped; 8/8 27/267+6 skipped. Totals: 222 files (221 passed, 1 skipped), 1753 tests passed, 9 skipped, 0 failed. None of the touched dogfood files has a skip construct. PACKAGE SUITES: objectql --shard=1/2 191 files/3712 passed, --shard=2/2 190/3815; runtime --shard=1/2 170/2944 passed+4 skipped, --shard=2/2 169/2551+15 skipped; metadata-protocol 222 passed+3 skipped files, 28283 passed+19 skipped; plugin-auth 128 files, 2655 passed+10 skipped; verify 18 files, 133 passed (harness.org-context.test.ts 5/5). TYPECHECK green: objectql, metadata-protocol, dogfood (tsc --listFiles counts 257 files under test/), runtime, plugin-auth, verify; check:test-typecheck OK where the package has it. REVERSE VERIFICATION of the harness change: scripts/ablation-replace.mjs WRAP mode put the old pin back in packages/verify/src/harness.ts (autoDefaultOrganization tied to opts.orgContext, string-literal marker REVERSE-15195-OLD-PIN): anchor 1 to 0, blob a7d5e7b8a6 to e4a78926e9. The verify package was rebuilt and ablation-dist-preflight found the marker in 2 dist files. Mutated leg: the 24 dogfood files gave 5 failed / 19 passed files and 14 failed / 204 passed tests. The 5 are exactly the files with no edit (permission-set-lock-row-provenance, permission-set-write-through-package-binding, showcase-permission-projection, sys-file-metadata-write-refusal, two-doors-permission). harness.org-context.test.ts gave 1 failed / 4 passed: AssertionError expected [ 'member' ] to deeply equal [ 'owner' ]. Restore: blob back to HEAD a7d5e7b8a6, git diff HEAD empty, rebuilt, preflight --absent exit 0, trap re-verified the hash. The run was identical at 05dedeea79 and at 9aee4d05f1. The same leg at c2f7e36d6e left the harness unit test green, so 05dedeea79 added the owner assertion. LINT: eslint --no-inline-config --format json over the 48 .ts/.mts/.mjs files the diff adds or modifies (git diff --diff-filter=AM origin/main...HEAD) gave 48 files in the JSON report, 0 errors, 0 warnings. The population is eslint.config.mjs files glob '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}' minus NEVER_LINTED. The config enables no type-aware linting (no parserOptions.project; stated at eslint.config.mjs:326-328), so this diff cannot move an untouched file's verdict. Full pnpm lint is CI's.",
  "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 110 at 9aee4d05f1, change set 56 paths vs merge base 9f0de32a0. All 110 ran, each recorded as 'cmd :: exit N': 110 exit 0. --ran reconciliation: '110 derived famil(ies) accounted for, 110 run, 0 NOT-MEASURED (a DERIVED zero, all 110 recorded an exit code and none of them is 3)'. Roster gates whose list lives in a touched directory (not in the derived total) all exit 0: check-changeset-fixed, check-published-list-mirrors, authz-resolver, console-injection, error-code-casing, filter-alias-parity, i18n-stale-fill, published-readme-exports, route-ledger-census, tenant-chokepoint. check-single-claim-paths passed with PR_NUMBER=22186 (read-only): 'PR #22186 modifies none of the 1 declared at-most-one-writer path(s)'. Offline level axis with the replacement body as the --event payload: check-changeset-no-major reads 'Clause-②: yes (narrowing)', direction arm narrowing, minor accounted for, exit 0; the same with 'Clause-②: no (narrowing)' also exits 0. check-adr-0087-registration exit 0. Earlier at 05dedeea79: 110/110 exit 0 as well.",
  "line_budget": "n/a: no skills/** or governed ledger touched. Diff vs origin/main: 56 files, +2120/-461 = 2581 changed lines, under the human-merge threshold of 5000.",
  "files_changed_this_round": [
    "packages/verify/src/harness.ts (owner bind always on; orgContext doc)",
    "packages/verify/src/harness.org-context.test.ts (beyond the declared set: the default-boot case pins the production shape and the admin's owner membership)",
    "packages/qa/dogfood/test/armed.ts (beyond the declared set: the leaveOrganization helper)",
    "19 of the 24 declared dogfood files (the other 5 need no edit)",
    "packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts, showcase-scope-depth.dogfood.test.ts (beyond the declared set: comments only)",
    ".changeset/15195-verify-bootstack-production-single.md (new), .changeset/15195-plugin-auth-default-organization-boot-invariant.md (Q2 consequence)",
    "content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (regenerated after both main merges: 234 to 236)"
  ],
  "commits_this_round": [
    "cd7f73b25a merge origin/main",
    "fbc0e914e2 census regenerated",
    "5c97ee0d4a wip(verify)",
    "cee4376fee wip(dogfood)",
    "98a89bc560 changesets and comments",
    "c2f7e36d6e merge origin/main 3b493184e1",
    "05dedeea79 test(verify) owner assertion",
    "4b40ca31f5 merge origin/main 9f0de32a03",
    "9aee4d05f1 census regenerated"
  ],
  "serial_work": "#22197 and #22215 are still open, neither merged. Their file lists share no path with this branch; read via REST GET pulls/N/files. Their dogfood files (authored-row-write-scope, bulk-widener-probe, owd-public-read-write-write-floor, showcase-d7-default-profile, view-container-default-form) pass in this branch's 8 shards at their main versions. main was merged twice this round, census conflicts resolved per the order, without either sibling landing. The second merge was needed because main's census edits conflicted with the branch, which would have stopped CI on the PR. After the final merge, main moved 9 more commits, to 81bd9fa6fe. Those are not merged; git merge-tree HEAD origin/main is clean.",
  "deviations": [
    "The order calls OS_TEST_SHARD k/8 the CI split. ci.yml runs the Dogfood Regression Gate as k/3. Ran k/8 as ordered; the 8 shards together are the same 222 files.",
    "main was merged a second time (9f0de32a03) although neither sibling had landed: main's census edits had made the PR conflict. Everything was re-run on the merged head.",
    "Added commit 05dedeea79 (verify test only): the reverse verification showed the harness unit test did not read the changed line.",
    "Deepened the shared clone (git fetch --shallow-since=2026-07-03 origin main) so check-engine-split-ratio could compute; its earlier exit 2 was a prerequisite refusal.",
    "Void runs, not counted. (1) Dogfood shards 1 and 2 were first killed by my own inner timeout 280 while queued for the lock, then rerun with OS_VERIFY_LOCK_WAIT. (2) Reverse verification attempt 1: ablation-replace refused because the replacement contained the anchor; nothing ran. (3) Gate chunk 93-110 at 05dedeea79 hit my timeout at gate 107; gates 107-110 were rerun. (4) At 05dedeea79 the runtime shard 1 run passed the 600 s tool cap and was moved to the background; I blocked on it in the foreground (tail --pid) and read its result.",
    "check:skill-examples and check:dual-build-cjs-loads at c2f7e36d6e first returned exit 3, PREREQUISITE NOT MET (unbuilt dist). I built client-react and 7 packages and reran them; at 9aee4d05f1 the build preceded the gates.",
    "Read-only REST GETs via gh api: pulls/22197, pulls/22215 (+ /files), pulls/22186 (body, mergeable)."
  ],
  "mcp_calls": "0",
  "api_writes": "1: POST issue comment on #15195 (this os-dev-report) via scripts/pm/post-stamped.mjs, relayed by fleet-write as objectstack-fleet[bot]. git push is not a REST write. No label, PR-body or assignee write.",
  "open_questions": [
    {
      "question": "The Clause-② line conflicts with a rule that landed this round. The order's second body line is 'Clause-②: yes (narrowing)'. #22223 (5d5a88eff0, docs(pm-dispatch), landed 07:18Z, after triage 6053354661) says a card that narrows a published accept set is 'Clause-②: no', stays in its lane and owes one contract-review-tier review. #22275 (81bd9fa6fe) already uses 'Clause-②: no (narrowing)'. Which spelling goes in line 2 of the body and in the four changesets that carry the line?",
      "options": [
        "A: keep 'Clause-②: yes (narrowing)' as triage and the order state. The level axis passes (measured offline).",
        "B: switch to 'Clause-②: no (narrowing)' per #22223. Body line 2 and the Clause-② line in the objectql, plugin-auth, metadata-protocol and verify changesets change. The level axis also passes (measured offline: narrowing arm, minor accounted for). The lane and the review stay as triage set them."
      ],
      "recommendation": "B if #22223 binds this card, because the narrowing arm, not 'yes', is what the gate grades, and the rule now spells narrowing as 'no'. Otherwise A. The body keeps A, as ordered, pending the seat's call. The changesets are a one-line edit each, which I will make on a patch round if asked."
    }
  ],
  "out_of_scope_findings": [
    "carrier: the #15195 claimant (this branch), per triage 6053354661. The wall's sole-organization seed fallback: the seed loader still derives under a walled posture when a load names no organization and the install holds exactly one. Read, not measured. Noted in Acceptance notes, not filed.",
    "carrier: #22099 (p3, domain:services), carried, not new. The owner-bind ledger's admin-already-member second insert (DUPLICATE_RECORD on two concurrent triggers, present at base too).",
    "carrier: none named; Acceptance notes only. packages/plugins/plugin-sharing/src/sharing-service.ts:1895, sharing-rule-service.ts:417 and sharing-service.test.ts:1326 still describe the harness's autoDefaultOrganization: false. Stale comments, outside the declared set, not edited."
  ],
  "pr_body_replacement": "Fixes #15195\nClause-②: yes (narrowing)\n\nADR-0131 C1: the Default Organization is load-bearing under `single`. Scope as triage ruled it: 6040634630 (Q1 → B) for the implementation, 6053354661 (Q1 → A, Q2 → A) for landing it. This is one atomic, cross-lane PR. It carries the `@objectstack/verify` `bootStack` re-pin and the dogfood re-pins with the implementation. `packages/qa/dogfood` and `packages/verify` (`domain:cli`) join it, declared on #6024.\n\n## What this does\n\n- **The boot invariant (D3).** Under the `single` posture, `AuthPlugin.start()` finds or creates the Default Organization (`slug: 'default'`), with or without a platform admin. A failed read or insert throws and fails the boot.\n  - `AppPlugin` declares `com.objectstack.auth` as an order-if-present dependency, so the kernel starts the auth plugin first wherever a host registered it.\n  - The organization therefore exists before the inline seed and before `kernel:listening`.\n- **The seed-exemption withdrawal (D3/D9).** The seed loader stamps the install's organization on every row of an object that carries an `organization_id` column, `sys_` / `cloud_` / `ai_` seeds included.\n  - Suppose no organization is pinned and none can be derived (zero organizations, or several), on an install that registers the organization object. Such a row is refused, counted and named.\n  - An object with no organization column is never stamped.\n- **The owner pin (D3 / ADR-0093 D7).** The reconciler binds the first admin as `member` before the owner bind learns who they are.\n  - While the once-only bind is undecided and the Default Organization has no owner, the bootstrap promotes that row to `owner` in place.\n  - It records the decision as `promoted`.\n- **The derivation rule for the objects already in scope (D9).** `resolveSystemInsertOrganization` derives at exactly one organization. It refuses at zero (new: `reason: 'no-organization'`), at several, and under a wall.\n  - The refusal reuses `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED` (status 500).\n  - No `packages/spec` edit.\n- **`bootStack` boots the production `single` shape (D3 / D11).** The harness no longer pins the owner bind off (`autoDefaultOrganization: !!opts.orgContext` is gone). Every boot has the Default Organization, every sign-up is its member, and the harness admin is its owner, as `objectstack dev` / `serve` boot it.\n  - `orgContext` is now only the vacuity guard: it asserts that the admin's session carries an organization, and refuses the boot otherwise. It still refuses to compose with `multiTenant: 'posture-only'`.\n  - There is no test-only org-less mode and no escape hatch.\n- **Unchanged by ruling.**\n  - The 49 gated platform objects keep `isPlatformObjectOutOfTenantAuditScope` until C8.\n  - The lean-install branch is unchanged, with a pin. That is `probeInstallOrganizations` answering `[]` when no organization object is registered.\n  - No C3, C5 or C6 surface, no seeder and no `applyTenantScope` is touched.\n\n## Boot order: fresh `single`, `examples/app-showcase` through `bootStack` (measured)\n\nBase `51290bca2c`, implementation head `c49f46bab1`. Seeds: 132 rows over 19 objects. The last two rows were measured with the harness at its old pin. Since this PR, `bootStack` always boots the owner-bind-on row.\n\n| step | base | head |\n| :--- | :--- | :--- |\n| `AuthPlugin.start()` | no organization | Default Organization inserted: the first insert of the boot (seq 0 of 98) |\n| `AppPlugin.start()` inline seed | 132 rows, all `organization_id` NULL (`sys_business_unit` 5 of 5 NULL) | 132 rows, 0 NULL, `sys_business_unit` included |\n| `kernel:ready` | 0 organizations | 1 |\n| `kernel:listening` | 0 organizations (old harness default). 1 only when a dev admin existed at `kernel:ready`; even then the organization was the 49th insert, after every seed, and 130 of 132 seed rows stayed NULL | 1 |\n| dev admin, owner bind on (`bootStack` now, always) | org created and admin bound `owner` directly | reconciler binds `member`; the bootstrap logs \"promoted the platform admin to owner\"; `isPlatformAdmin: true`, positions `platform_admin`, `org_owner` |\n| dev admin, owner bind off (the old harness default, removed) | no membership, no active organization | `member` of the Default Organization, the session's active organization |\n\n## The derivation rule: `resolveSystemInsertOrganization`, objects in scope\n\n| posture | organizations | organization object registered | write carries one | base | head |\n| :--- | :--- | :--- | :--- | :--- | :--- |\n| `single` | 1 | yes | no | derived | derived |\n| `single` | 0 | yes | no | lands NULL (measured, probe) | refused `no-organization` (measured, pins) |\n| `single` | 2 or more | yes | no | refused `ambiguous-organization` | unchanged |\n| `single` | 0 | no (lean composition) | no | lands unstamped | unchanged, pinned |\n| `isolated` / `group` | any | yes | no | refused `walled-posture` | unchanged (measured on a `posture-only` isolated showcase boot: code `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`, status 500; the same insert carrying `tenantId` lands stamped) |\n| any | any | any | yes | stamped with it | unchanged |\n| the 49 gated platform objects | any | any | no | exempt | unchanged (C8) |\n\n## Acceptance pins (implementation head `4fc2472fd0`, base `ec8f37c890`)\n\n`runtime/src/default-organization-boot-invariant.pin.test.ts` boots a real kernel twice:\n- **Kernel A:** a fresh deployment nobody signed up to.\n- **Kernel B:** `objectstack dev`, where the dev admin is created after the organization exists.\n\n`AppPlugin` is registered before `AuthPlugin` on purpose.\n\n| pin | where | base | head | control |\n| :--- | :--- | :--- | :--- | :--- |\n| (a) organization before the listener and before the first seed row; an `isSystem` insert with no organization lands stamped | kernel A, 3 cases | red | green | an object declaring `tenancy: { enabled: false }` takes none |\n| (b) `isolated` / `group` refuse, with the code and status; the insert carrying `tenantId` lands | `objectql` `system-write-organization.test.ts` and the measured isolated boot above | green (since #8844) | green | the carrying insert |\n| (c) the first admin is the owner, by promotion | kernel B | red | green | `isPlatformAdmin` read back unchanged |\n| (d) every seed row stamped, `sys_` seeds included | kernel A | red | green | the tenancy-off seed lands with no organization |\n| (e) lean-install branch unchanged | `objectql` and `metadata-protocol` `[ADR-0131 Q2, held as-is]` cases | green | green | the registered-but-empty case refuses |\n\n**Reverse verification of the implementation** (from committed `4fc2472fd0`):\n1. The eight implementation source paths were restored to `ec8f37c890` in the tree only.\n2. The four packages were rebuilt, and `scripts/ablation-dist-preflight.mjs` confirmed each head marker absent from `dist/`.\n3. The pin run: 5 failed and 2 passed, as tabled.\n4. A trap restore, proven by `git diff HEAD` empty and per-path blob hashes equal to HEAD.\n5. A rebuild with the markers back.\n\n**Ablations** (`scripts/ablation-replace.mjs`, each restored and rebuilt):\n- **The promotion call disabled:** (c) turns red (`member`, not `owner`).\n- **`com.objectstack.auth` removed from `AppPlugin.optionalDependencies`:** every seed row is refused, and (a)'s ordering case and (d) turn red.\n\n## `bootStack` and the dogfood: the 24 re-pinned files\n\nAt this PR's implementation alone, 24 dogfood files failed; at base they pass. Each was re-pinned on its own cause, to the production `single` shape. Pins that C1 flips flip to the new answer and none is deleted. The shared helper is `leaveOrganization` (new, `test/armed.ts`): it deletes the user's `sys_member` rows in system context, signs in again, and throws if a membership survives. A user removed from their organization is an ordinary production state, not a test mode.\n\n| file | cause | what changed | why it keeps the original intent at the production shape |\n| :--- | :--- | :--- | :--- |\n| `analytics-adhoc-query-isolation` | its `memory` leg: `driver-memory` refuses a tenant-scoped read (503), and every session now carries the Default Organization | the `memory` leg became an `objectql-strategy` leg on `sqlite-wasm`, with the analytics plugin's `queryCapabilities` withholding native SQL. `Restart-when: #15212 closed` | the file pins isolation under both analytics strategies; the memory driver was only the route to the ObjectQL strategy, and the capability switch reaches it on a driver that answers |\n| `analytics-contains-membership` | as above | as above | as above |\n| `analytics-inline-dataset-admission` | as above | as above | as above |\n| `analytics-inline-dataset-isolation` | as above | as above | as above |\n| `armed` | the \"outside\" class was an org-less sign-up; every sign-up is now a member | `orgless`/`orgbound` renamed `outside`/`inside`; the outside principal leaves the organization; the write-floor disarm text names \"Keep the principal a member of the organization\" | the floor is still measured on a principal with no active organization against one inside it |\n| `delegated-admin-invite` | it minted its own `slug: 'default'` organization (`DuplicateRecordError`) | reads the boot's Default Organization | same subject inside the deployment's one organization |\n| `delegation-of-duty` | the delegator is now a member, so the gate reads the delegator's organization's positions (ADR-0091 D3 rule 5), and the fixture's positions had none | `sys_position` / `sys_user_position` rows carry the Default Organization; the session double carries `activeOrganizationId` | same delegation rules, on rows held the way an org-bound deployment holds them |\n| `invitation-ledger-row-scope` | it minted a second organization (`acme-8095`) while the reconciler binds every sign-up to the Default Organization | uses the Default Organization | the ledger's row scope is measured inside the deployment's one organization |\n| `membership-actor-attribution` | minted its own `default` organization | reads the boot's | unchanged subject |\n| `membership-ended-session-revoke` | minted its own `default` organization | reads the boot's | unchanged subject |\n| `membership-reconciler` | minted its own `default` organization | reads the boot's | unchanged subject: the reconciler binding through the real sign-up pipeline |\n| `membership-role-vocabulary` | minted its own `default` organization | reads the boot's | unchanged subject |\n| `org-admin-affordance-reach` | it minted `reach-org` while sign-ups bind to the Default Organization | uses the Default Organization | grades measured in the organization the members are in |\n| `organization-delete-federated-fixture` | deleting the Default Organization now runs the delete behaviour of every row the deployment owns, the seed included | deletes a second organization (`org-21910`) that the admin owns and no row belongs to | the cascade scan probes every reference on any organization's delete, so the federated anchor is still reached, without a different question attached |\n| `parent-derived-write-refusal-not-visible` | an org-less principal was the precondition | `boot(inside)`: the outside principal leaves the organization; the inside boot keeps `orgContext: true` | same refusal shape, for a principal outside the organization |\n| `permission-set-lock-row-provenance` | the harness admin was a `member` | no edit: the harness owner bind | the admin is the deployment's administrator, the Default Organization's owner as `objectstack dev` boots it |\n| `permission-set-write-through-package-binding` | as above | no edit | as above |\n| `predicate-write-unreadable-not-matched` | org-less precondition | as `parent-derived-write-refusal-not-visible` | as above |\n| `sharing-rule-org-less-caller` | the org-less personas, and the harness admin as the org-less platform operator | the org-less personas leave the organization. The operator is a new user holding `admin_full_access` globally who leaves it. The control persona's Default membership is removed before its tenant-A one. Preconditions judge live sessions only, because leaving revokes the sign-up session (#15784) | a sharing rule still must not widen reads for a caller with no organization; each caller is now a production shape |\n| `showcase-permission-projection` | the harness admin was a `member` | no edit | as `permission-set-lock-row-provenance` |\n| `single-tenant-identity-create` | the old expectation, a `sys_business_unit` with no organization, is the defect C1 fixes | flipped: `organization_id` equals the Default Organization's id | ADR-0057's property (creatable single-tenant, no `VALIDATION_FAILED`) is still the pin |\n| `sys-file-metadata-write-refusal` | the harness admin was a `member` | no edit | as `permission-set-lock-row-provenance` |\n| `two-doors-permission` | the harness admin was a `member` | no edit | as `permission-set-lock-row-provenance` |\n| `write-door-unreadable-is-not-found` | org-less precondition | as `parent-derived-write-refusal-not-visible` | as above |\n\n**Files beyond the declared set** (`packages/verify/src/harness.ts` and the 24 files):\n- `packages/qa/dogfood/test/armed.ts`, which holds the `leaveOrganization` helper.\n- `packages/verify/src/harness.org-context.test.ts`. The default-boot case now pins the production shape, including the admin's `owner` membership.\n- `showcase-external-autoconnect.dogfood.test.ts` and `showcase-scope-depth.dogfood.test.ts`: comments only, correcting the description of the removed org-less boot.\n- `.changeset/15195-verify-bootstack-production-single.md`.\n- The tenant-audit census (`content/docs/permissions/tenant-audit-census.mdx`, `docs/audits/2026-08-tenant-audit-write-call-sites.counts.md`). After each `main` merge it was regenerated with the gate's own write mode, outside the MERGE state, and the prose figures the gate holds were moved with it: 234 → 236.\n\n**Reverse verification of the harness change** (committed `05dedeea79`, and again on the final head `9aee4d05f1` with identical results):\n1. `scripts/ablation-replace.mjs` (WRAP mode) restored the old pin in `harness.ts`, with a string-literal marker (`REVERSE-15195-OLD-PIN`) the bundler keeps.\n2. `@objectstack/verify` was rebuilt, and `ablation-dist-preflight` confirmed the marker present in `dist/`.\n3. The mutated leg turned red:\n   - dogfood, the 24 files: 5 files and 14 tests failed, 204 tests passed. The five are exactly the \"no edit\" rows above.\n   - `harness.org-context.test.ts`: 1 of 5 failed (`expected [ 'member' ] to deeply equal [ 'owner' ]`).\n4. The file was restored: blob equal to HEAD and `git diff HEAD` empty. `@objectstack/verify` was rebuilt, and the preflight `--absent` passed.\n\nThe same leg on `c2f7e36d6e` left the harness unit test green, because its two assertions hold without the owner bind. `05dedeea79` adds the `owner` assertion so the unit test reads the line itself. The first attempt was void and is not counted: the tool refused it because the replacement contained the anchor, and nothing ran.\n\n## The in-memory driver until C8 (triage Q2 → A)\n\n`@objectstack/driver-memory` refuses tenant-scoped reads. Under `single`, every session now carries the Default Organization, so on that driver signed-in reads answer `503` until C8 (#15212, ADR-0131 D8) gives `single` no read predicate. The `plugin-auth` changeset states this.\n\nThis is not new in production terms. At base, a showcase boot with the owner bind on (the shape `objectstack dev` boots) already answered the platform admin's `GET /data/showcase_category` with `503 SERVICE_UNAVAILABLE` on the memory driver. Only the harness's org-less pin kept the four analytics `memory` variants green. Those variants now run on the SQL in-memory driver, with `Restart-when: #15212 closed` in each file.\n\n## Clause-②: the built entry declarations, base `ec8f37c890` against head\n\n- **`@objectstack/objectql`:**\n  - `SystemWriteOrganizationDecision`'s `'no-organization-yet'` becomes `'no-organization-object'`.\n  - `SystemWriteRefusalReason` gains `'no-organization'`.\n  - `resolveSystemWriteOrganization` takes a required `organizationObjectRegistered`.\n- **`@objectstack/plugin-auth`:**\n  - `EnsureDefaultOrganizationOnceOptions` gains an optional `organizationCreatedByThisProcess`.\n  - `EnsureDefaultOrganizationResult` gains an optional `ownerPromoted` and the `'owner_promotion_failed'` reason.\n- **`@objectstack/verify`:** no declaration change. `bootStack` now boots an org-bound admin for every caller, so a fixture that relied on an org-less one breaks.\n- **`@objectstack/metadata-protocol`, `@objectstack/runtime`:** no public declaration changes.\n\nThe accept sets narrow, so the answer is `yes (narrowing)`. The objectql, plugin-auth, metadata-protocol and verify changesets are `minor`, with the BREAKING banner and an ADR-0087 disposition. The runtime changeset is `patch`. Driven offline with this body as the `pull_request` payload (`--event`), `check-changeset-no-major` reads `Clause-②: yes (narrowing)` and passes the level axis. `check-adr-0087-registration` also passes.\n\n## Verification (head `9aee4d05f1`, `origin/main` `9f0de32a03` merged)\n\n- **Dogfood, all 8 shards (`OS_TEST_SHARD=k/8`), on the rebuilt closure:** 222 files: 221 passed, 1 skipped. 1,753 tests passed and 9 skipped. CI runs the same 222 files as `k/3`.\n- **Package suites:**\n  - `@objectstack/objectql`: 381 files, 7,527 passed.\n  - `@objectstack/runtime`: 339 files, 5,495 passed, 19 skipped.\n  - `@objectstack/metadata-protocol`: 222 files (3 skipped); 28,283 passed, 19 skipped.\n  - `@objectstack/plugin-auth`: 128 files, 2,655 passed, 10 skipped.\n  - `@objectstack/verify`: 18 files, 133 passed.\n- **Typecheck:** green for objectql, runtime, metadata-protocol, plugin-auth, verify and dogfood. `check:test-typecheck` passes where the package has it. The dogfood program lists 257 files under `test/`.\n- **Gates:** `dispatch-gates --commands` derived 110 for this tree, all 110 ran with exit 0, and `--ran` reconciled 110 of 110 with recorded exit codes. The build ran first, so `check:skill-examples` (`client-react`) and `check:dual-build-cjs-loads` (seven packages outside the dogfood closure) read current `dist/`. `check-engine-split-ratio` ran on a deepened clone (`--shallow-since=2026-07-03`).\n- **Roster gates whose list lives in a touched directory:** all exit 0. That covers changeset-fixed, published-list-mirrors, authz-resolver, console-injection, error-code-casing, filter-alias-parity, i18n-stale-fill, published-readme-exports, route-ledger-census and tenant-chokepoint. `check-single-claim-paths` also passed with this PR's context.\n- **Lint:** `eslint --no-inline-config` over the 48 script and TypeScript files this diff adds or modifies: 0 errors and 0 warnings, 48 files in the JSON report. The config enables no type-aware linting (`eslint.config.mjs`: no `parserOptions.project`), so this diff cannot move an untouched file's verdict. The full `pnpm lint` run is CI's.\n- **Serial with #22197 and #22215:** neither PR shares a file with this one, and neither has landed. Whichever lands second re-runs the dogfood shards against the other's boot shape.\n- **`main` since the last merge:** 9 commits (to `81bd9fa6fe`), not merged here. `git merge-tree` against it is clean. One of them, `81bd9fa6fe`, refuses a non-system `sys_user_position` / `sys_user_permission_set` write whose user is not a member of the row's organization. This PR's fixtures write those rows in system context, which that refusal leaves alone (read, not measured).\n\n## Acceptance notes\n\n- **The wall's sole-organization seed fallback.** The seed loader still derives under a walled posture when a load names no organization and the install holds exactly one organization. This was read, not measured. The walled inline seed is suppressed, and the per-organization replay always names one. `carrier:` the #15195 claimant.\n- **The owner-bind ledger.** Its `admin-already-member` second insert (`DUPLICATE_RECORD` on two concurrent triggers, present at base too) is #22099.\n- **Stale comments.** `packages/plugins/plugin-sharing/src/sharing-service.ts`, `sharing-rule-service.ts` and `sharing-service.test.ts` still describe the harness's `autoDefaultOrganization: false`. They are not edited here (outside the declared set). `carrier:` none named, so this is noted here only.\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01EUBvqtauTDmHi2ZgY759p2)_\n"
}

Generated by Claude Code

os-dev-report

{
  "issue": 15195,
  "status": "done",
  "round": "patch round 3 (CI Test Core red on 9aee4d05f1)",
  "branch": "claude/issue-15195-default-org-load-bearing",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22186",
  "head": "ede1fbd345 (pushed; merge base 9f0de32a03, main not merged this round)",
  "session": "session_01EUBvqtauTDmHi2ZgY759p2",
  "premise_still_valid": true,
  "summary": "The CI failures were test rigs that register sys_organization, hold no organization, and system-insert a tenant-scoped row. C1 refuses that shape (D9 no-organization), and no production single boot reaches it. Each rig now holds the Default Organization, as the auth plugin's boot invariant guarantees; the engine and the refusal are untouched. Fixed: plugin-approvals status-mirror-cascade.integration.test.ts (sys_organization provisioned and seeded, and it leaves the expected-absent probe list); plugin-security claim-seed-ownership-warm-boot.test.ts (every boot finds or creates the Default Organization); and service-automation runas-system-stamping.integration.test.ts, which the sweep found and CI never reached (the flip rig seeds the Default Organization as org_1, and the NULL-born case pins the derived organization). The full suites of all 45 objectql-dependent packages, plus metadata-protocol, are green; no refusal remains in any log. The replacement PR body is a file (path below).",
  "failures_measured": "Reproduced locally at 9aee4d05f1 before the fix: plugin-approvals status-mirror-cascade 2 failed / 2 (SystemWriteOrganizationRequiredError: Insert on 'opportunity'), plus afterAll: 'the driver's read refusal for sys_approval_delegation was never emitted' and the engine frame. plugin-security warm-boot 4 failed / 1 passed (Insert on 'crm_case'). The :207 afterAll failure WAS downstream: after the fix, with only sys_organization removed from the list, the delegation channel fires and the file passes 2/2. service-automation runas-system-stamping 1 failed (res.success false at :304, the user-less run's insert refused), found by the sweep at b7d0b3469e.",
  "files": [
    "packages/plugins/plugin-approvals/src/status-mirror-cascade.integration.test.ts",
    "packages/plugins/plugin-security/src/claim-seed-ownership-warm-boot.test.ts",
    "packages/services/service-automation/src/runas-system-stamping.integration.test.ts"
  ],
  "cross_lane_paths": [
    "packages/plugins/plugin-approvals/src/status-mirror-cascade.integration.test.ts (domain:services)",
    "packages/plugins/plugin-security/src/claim-seed-ownership-warm-boot.test.ts (domain:services)",
    "packages/services/service-automation/src/runas-system-stamping.integration.test.ts (domain:services)"
  ],
  "commits": [
    "b7d0b3469e test(plugin-approvals,plugin-security): two engine rigs boot the production single shape",
    "ede1fbd345 test(service-automation): the SecurityPlugin flip rig holds the Default Organization"
  ],
  "sweep": "Population: pnpm --filter '...@objectstack/objectql' gives 45 packages; 44 have a test script (example-multi-package has none). metadata-protocol was added. Every log was searched for SystemWriteOrganizationRequiredError and no-organization; 0 matches after the fixes. Run via turbo run test --continue or vitest, under the verify lock, at b7d0b3469e or ede1fbd345 unless stated. plugin-approvals 62 files/905 passed. plugin-security 179/3775 (+45 skipped). service-automation 175/2120 at ede1fbd345; at b7d0b3469e it was 1 failed (the fixed file). plugin-audit 40/641. plugin-sharing 40/1002. trigger-record-change 11/114. trigger-schedule 8/174. service-analytics 180/4441 (+262 skipped). service-datasource 41/760. service-knowledge 4/49. service-messaging 48/534. service-settings 39/707. service-storage 43/717. service-queue 5/77. service-sms 5/74. rest 262/4938 (+326 skipped). hono 5/122. http-conformance 8/102. downstream-contract 3/31. client 51/653. client-react 3/34. cloud-connection 41/505. connector-mcp 3/23, connector-openapi 4/36, connector-rest 4/26, connector-slack 3/10. driver-mongodb 31+5 skipped files/690 (+182 skipped). knowledge-memory 1/8. knowledge-ragflow 1/10. organizations 11/151. plugin-dev 9/86. plugin-email 31/535. plugin-pinyin-search 2/21. plugin-webhooks 15/165. example-crm 5/45, example-embed-objectql 1/2, example-showcase 33/408, example-todo 7/238. cli unit 264/3915; cli integration (4 vitest slices, all 93 files) 900 passed + 2 skipped. runtime re-run at ede1fbd345: 170/2944 (+4 skipped) and 169/2551 (+15 skipped). Measured at 9aee4d05f1, and round 3 changes no file they read: objectql 381/7527, metadata-protocol 222 (+3 skipped)/28283, plugin-auth 128/2655, verify 18/133, dogfood 8 shards 222 files/1753 passed (+9 skipped).",
  "tests": "Targeted, after each fix: status-mirror-cascade 2/2, claim-seed-ownership-warm-boot 5/5, runas-system-stamping 6/6. Typecheck at ede1fbd345: plugin-approvals, plugin-security, service-automation green; check:test-typecheck OK for each (plugin-approvals' pinned debt ledger holds; the other two are empty).",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) at ede1fbd345 derived 112 (110 plus check:i18n and check:i18n-stale-fill), change set 59 paths vs merge base 9f0de32a0. All 112 ran with exit 0, each recorded as 'cmd :: exit N'. --ran reconciled 112 of 112: 0 NOT-MEASURED, a derived zero. Roster gates in touched directories (changeset-fixed, published-list-mirrors, authz-resolver, console-injection, error-code-casing, filter-alias-parity, i18n-stale-fill, published-readme-exports, route-ledger-census, tenant-chokepoint) all exit 0. check-single-claim-paths passed with PR_NUMBER=22186. Offline, with the round-3 body as the --event payload: check-changeset-no-major reads 'Clause-②: yes (narrowing)' and passes the level axis; check-adr-0087-registration exits 0. Narrowed eslint --no-inline-config over the 51 .ts/.mts/.mjs files the diff adds or modifies (three-dot vs origin/main): 51 files, 0 errors, 0 warnings; the config has no type-aware linting.",
  "body_path": "/tmp/claude-0/-home-user/0c10ffe8-83d4-59c0-98f3-23af57b77239/scratchpad/issue-15195/pr-body-r3.md",
  "body_notes": "Line 1 is 'Fixes #15195', the only closing keyword. Line 2 is 'Clause-②: yes (narrowing)'. The stale 'Not landable yet' banner is gone; the body states triage 6053354661 (Q1 to A, Q2 to A) and that the dogfood re-pins and bootStack ride this PR. It adds an M5 section that tables every existing test C1 moved (round 1 plus the three round-3 rigs) as flipped or re-pinned. The Verification section carries the full sweep table, and the three domain:services fixtures are listed among the files beyond the declared set. No angle brackets, no HTML comments, session-URL footer.",
  "serial": "No file under packages/qa/dogfood/test/ was touched this round, and neither showcase-security.ts nor any showcase dogfood file. #22197 and #22215 are still open.",
  "main_drift": "origin/main is 27 commits past the merge base, not merged this round (the order did not call for it). git merge-tree HEAD origin/main is clean. 16 test files those commits add or change name the organization object, including plugin-security grant-holder-membership-refusal, service-settings settings-organization-isolation.pin and the dogfood business-unit-and-user-delete-federated-fixture. They are NOT MEASURED against C1 here; CI's merge-ref run will measure them.",
  "deviations": [
    "Recreated the worktree from the remote branch: it had been removed at the end of round 2, and this is the same path, not a second worktree.",
    "CI job logs could not be downloaded (blob storage 403 through the proxy), so CI's shard package sets are unknown. The sweep therefore ran every objectql-dependent package instead of only the ones CI did not reach.",
    "Several locked runs passed the 600 s tool cap or were started with nohup. In each case I blocked in the foreground with tail --pid until exit and read the result; no run was left behind.",
    "service-automation's fix adds one assertion (the user-less row's derived organization is org_1), to make the 403's cause explicit."
  ],
  "mcp_calls": "0",
  "api_writes": "1: POST issue comment on #15195 (this os-dev-report) via scripts/pm/post-stamped.mjs (fleet-write relay). git push is not a REST write. Read-only GETs: actions runs/jobs/check-runs for 9aee4d05f1 and pulls/22197, pulls/22215.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: CI's merge-ref run on PR #22186. The 16 test files on main (since 9f0de32a03) that name the organization object are not measured against C1 here (see main_drift). noted, not filed"
  ]
}

Generated by Claude Code

ACCEPT (seat review) — PR #22186 at head `ede1fbd345`

domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant) · read at 2026-10-08T16:25Z.

Reports: build round 2, then patch round 3: os-dev-report 6064009112. The round fixed CI Test Core (4/6, 6/6) red on 9aee4d05f1.
Contract review at CONTRACT_REVIEW_TIER: PASS 6064283974 on this head.

Shape

Draft, base main. Line 1 Fixes #15195, line 2 Clause-②: yes (narrowing), one closing keyword.
The seat wrote the round-3 body. The stale "decision is open" banner is gone: triage ruled Q1 → A and Q2 → A (6053354661), so the dogfood re-pins and bootStack ride this PR.

The change (ADR-0131 C1, triage's Q1 → B scope)

D3 invariant. Under single, AuthPlugin.start() finds or creates the Default Organization, and a failed read or insert fails the boot. AppPlugin orders after com.objectstack.auth where it is present.
Seed loader. It stamps every row of an object that carries organization_id, sys_ seeds included. With no organization pinned and none derivable, it refuses the row. A column-less object is never stamped.
Owner bind. The owner promotion keeps ADR-0093 D7's intent.
System writes. resolveSystemInsertOrganization derives at exactly one organization and refuses at zero (no-organization), at several, and under a wall. It reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (500, already in the ledger), with no packages/spec edit.
Unchanged. The lean-install branch is unchanged and pinned. The 49 gated platform objects stay exempt until C8. No C3/C5/C6 surface is touched.

Patch round 3: CI red, root cause

Test rigs registered the organization object, held no organization, and system-inserted a tenant-scoped row. C1 refuses that shape, and no production single boot reaches it.
Fixed at the producer: each rig holds the Default Organization. The engine and the refusal are untouched.
- plugin-approvals status-mirror-cascade.integration.test.ts: its :207 afterAll was downstream of the refusal, as measured.
- plugin-security claim-seed-ownership-warm-boot.test.ts.
- service-automation runas-system-stamping.integration.test.ts: CI never reached it; the dev's sweep found it.
The full suites of all 45 objectql-dependent packages are green, and no refusal remains in any log.

Clause-② stays yes

The built entry declarations both widen and narrow. objectql renames a decision literal, makes a parameter required and adds a refusal reason; plugin-auth adds an option, a result field and a reason.
docs(pm-dispatch): a card that narrows a published accept set is Clause-② no, stays in its lane and owes one contract-review-tier review before the queue #22223's "narrowing only → no" does not apply. The review agrees.
Changesets: five, matching the five published packages. objectql, metadata-protocol, plugin-auth and verify are minor with the BREAKING banner and an ADR-0087 disposition; runtime is patch.
The review judged minor right under the repo's launch-window convention in pre mode. 8 of the 10 ! changesets of this class since pre entry are minor, and no changeset sentence claims pre mode is absent.

Re-pins

15 it( lines removed, 48 added, none skipped.
The review spot-checked 12 across both categories ("the old expectation was the defect" and "the fixture changed, the subject did not"). No subject was weakened, skipped or deleted.
bootStack's docs describe the remaining shape.

CI on ede1fbd345, by name

All success: Lint & Repo Gates, TypeScript Type Check, Test Core (6/6), Dogfood Regression Gate (3/3), Build Core, Temporal Conformance, Governed Surface Queue Guard.
Body-scoped checks re-ran after the body write: green.
check-expected-skips OK. NOT governed, 2675 changed lines, git merge-tree against origin/main clean.

Cross-lane, re-declared exact before leaving draft

domain:cli on [PM seat] domain:cli — 🟢 os-project-manager · session_019SvPnd2bzECRNmAU9i6E4k #6024: 6053967589, amended in this act.
domain:services on [PM seat] domain:services — ⏳ vacant #6021: 6039104553, the round-3 rigs, and an amendment in this act.

Landing note (the review's escalation)

The pull_request run measured main at 79c35d45e2. main has since moved 8 commits, including test files that name the organization object.
The merge queue re-measures (ci.yml carries merge_group), so the PR lands only through the queue. A red queue run is this PR's to re-pin.
feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 (this lane's feat(objectql,metadata,runtime)!: refuse a package whose position, permission set or capability name is already held by an installed package, the environment catalog or a built-in (ruling Q4 = A on #15196; narrows ADR-0048 §3.4) #22135) is also headed for the queue. They share no file, and whichever is tested second runs on the other's boot shape.

Out of scope, one line each

The walled seed-loader sole-organization fallback is pre-existing; it is C8's row, carried per triage.
The concurrent owner-bind DUPLICATE_RECORD is [finding] every artifact boot on a fresh :memory: database logs Insert operation failed … UNIQUE constraint failed: sys_migration.id with a full knex stack in Boot diagnostics #22099.
main drift is measured by the queue leg.

Next: ready, then auto-merge after the ready-flip checks settle.

Landing record: PR #22186 merged · 2026-10-08T16:59Z

domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant), take-over claim 6049583616.

Merged: PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 through the merge queue at 2026-10-08T16:58Z, squash 34dba5ae1e on origin/main (single parent). The queue leg measured the PR on the current main, including the 8 commits the PR's CI run had not seen. Read by content after a fetch:
- 'no-organization' in packages/objectql/src/tenancy/system-write-organization.ts (3 hits);
- default-organization-invariant imported in plugin-auth's auth-plugin.ts and ensure-default-organization.ts (1 hit each).
Review: ACCEPT 6064350817; contract review PASS 6064283974 on the merged head.
Labels: the card closed completed; pm:dispatched removed in this act. Only this card was named by a closing keyword.
ADR-0131 line: C1 is on main. C8 (feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212) still holds the 49 gated platform objects' exemption and the walled seed-loader fallback, per triage. feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's later stages read the Default Organization as present under single.
Serial: this lane's PR feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 (feat(objectql,metadata,runtime)!: refuse a package whose position, permission set or capability name is already held by an installed package, the environment catalog or a built-in (ruling Q4 = A on #15196; narrows ADR-0048 §3.4) #22135) is in the merge queue behind this PR, so its queue run measures it on C1's boot shape.

feat(plugin-auth,objectql,metadata-protocol,runtime)!: under `single`…

Navigation Menu

Repository navigation

feat(objectql,plugin-auth): the Default Organization is load-bearing under `single`; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195

v18 pre-opening re-verification (C1): DRIFTED. Still valid, nothing landed. Three new seams must be in scope

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C1, dispatchable first

5 remaining items

Retriage requested: `pm:retriage` · C1 is built (draft PR #22186), and the required dogfood gate needs a lane decision: C1 removes the org-less `single` boot that 24 dogfood files and `@objectstack/verify`'s `bootStack` encode

Triage: `pm:retriage` answer: Q1 → A, Q2 → A; Q3 noted. `pm:retriage` removed; the claim and `pm:dispatched` stand

ACCEPT (seat review) — PR #22186 at head `ede1fbd345`

Landing record: PR #22186 merged · 2026-10-08T16:59Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195

Description

Activity

objectstack-fleet commented on Oct 6, 2026

v18 pre-opening re-verification (C1): DRIFTED. Still valid, nothing landed. Three new seams must be in scope

objectstack-fleet commented on Oct 7, 2026

Triage: unlocked, pm:blocked → pm:queue. The v18 line is open: #15193 was closed on the maintainer's word. C1, dispatchable first

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

5 remaining items

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Retriage requested: pm:retriage · C1 is built (draft PR #22186), and the required dogfood gate needs a lane decision: C1 removes the org-less single boot that 24 dogfood files and @objectstack/verify's bootStack encode

objectstack-fleet commented on Oct 8, 2026

Triage: pm:retriage answer: Q1 → A, Q2 → A; Q3 noted. pm:retriage removed; the claim and pm:dispatched stand

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

ACCEPT (seat review) — PR #22186 at head ede1fbd345

objectstack-fleet commented on Oct 8, 2026

Landing record: PR #22186 merged · 2026-10-08T16:59Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

feat(objectql,plugin-auth): the Default Organization is load-bearing under `single`; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C1, dispatchable first

Retriage requested: `pm:retriage` · C1 is built (draft PR #22186), and the required dogfood gate needs a lane decision: C1 removes the org-less `single` boot that 24 dogfood files and `@objectstack/verify`'s `bootStack` encode

Triage: `pm:retriage` answer: Q1 → A, Q2 → A; Q3 noted. `pm:retriage` removed; the claim and `pm:dispatched` stand

ACCEPT (seat review) — PR #22186 at head `ede1fbd345`