fix(cloud-connection): refuse install-local sample data for a session with no active organization (ADR-0123 D2/D4)

[objectstack-fleet]

Fixes #21774

Clause-②: no

Under an organization wall, a session with no active organization is ADR-0123 D1's declared state. The install-local sample-data doors now answer it the way ADR-0123 D2 / D4 require, instead of skipping quietly.

What changed

• resolveActiveOrgId (packages/cloud-connection/src/marketplace-install-local-plugin.ts): the "first membership" fallback is deleted, not repaired. It read sys_organization_member, an object nothing defines.
• Reseed and purge answer 403 PERMISSION_DENIED (standard catalog, no new code) with one sentence built in one place (noActiveOrganizationRefusal). The sentence says the session has no active organization and gives the remedy.
• Install still registers the env-wide package. Its seeded block is { mode: "refused", reason }, with the same sentence in reason (was { mode: "skipped", reason: "multi-tenant-no-active-org" }).
• RESEED_SKIPPED stays for reseed's other declines: no-datasets, objectql-or-metadata-missing, seed-error: ….
• storage-service-plugin.ts (comment only, declared cross-lane): the clause citing the deleted fallback now cites ADR-0123 D1. The comment's own rule is unchanged.
• Ratchets moved down by one each for this file (scripts/slot-lookup-baseline.json 15 to 14, scripts/query-options-erasure-baseline.json 2 to 1). The deleted fallback carried those sites.

Measured before the change (origin/main ebfe658c72, real walled boot, posture-only)

Tenancy isolated, isolationActive: true; session activeOrganizationId null; 1 sys_member row for the admin.

• install: 200, seeded {mode: "skipped", reason: "multi-tenant-no-active-org"}
• reseed: 400 RESEED_SKIPPED "Reseed did not run: multi-tenant-no-active-org"
• purge: 400 RESEED_SKIPPED "Purge did not run: multi-tenant-no-active-org. …"
• the fallback's read: Object 'sys_organization_member' not found (thrown, swallowed)

Pins

• Unit: marketplace-install-local-no-active-organization.test.ts (new). It covers walled with no active org and two memberships served by the store, walled with an active org, and single (a spy proves resolveActiveOrgId is never called). The purge unit pin moves to 403.
• Door pin on a real walled boot: packages/qa/dogfood/test/install-local-no-active-organization.dogfood.test.ts (new). In one session: no-org install/reseed/purge, then the same session after set-active to org B, as the control. 7/7 green.
• Reverse verification (A5), committed fix at a1a5513852, through scripts/ablation-replace.mjs, two literal anchors, nested WRAP:
  • anchor 1, the seed refusal line, replaced by the old mode: 'skipped' line: blob 5f88579b38e0 to 24f914c847b4
  • anchor 2, the purge 403, replaced by the old RESEED_SKIPPED / 400: blob to 505004807245
  • On disk: removed lines 0/0, injected lines 1/1.
  • Unit: 4 red (the 3 no-org pins and the purge no-org pin; received skipped and 400), 33 green.
  • Door: 3 red (no-org install/reseed/purge), 4 green (preconditions, nothing seeded, org-B control).
  • Restore: three legs prove blob == HEAD 5f88579b38e0 and an empty git diff HEAD.

Verification (head 0590b46d38)

• pnpm --filter @objectstack/cloud-connection test: 38 files, 466 tests passed.
• typecheck green for cloud-connection, dogfood and service-storage; --listFiles includes both new test files.
• full pnpm lint: exit 0.
• dispatch-gates --commands derived 79 commands; 78 ran green on the final head. check-empty-changeset is red on purpose; see below.

Pending release note corrected (the empty-changeset gate stays red by design)

.changeset/21728-install-local-purge.md is pending, from #21773; the last version PR 617f25f8a4 predates that merge. It said a no-active-organization purge is answered 400 RESEED_SKIPPED. This PR makes that sentence false, and both changesets ship in one release, so its clause now reads 403 PERMISSION_DENIED, naming the missing active organization. Nothing else in that note changed. The gate's own text classes this as a deliberate correction that a person confirms on the PR. Please confirm or reject this edit.

Acceptance notes

• The console (objectui at the pinned .objectui-sha, marketplaceApi.ts postLocalSampleAction) shows error.message for any non-ok status and does not branch on the code or status. The 400 to 403 move is shown to the user as the new sentence. The os package install CLI does not read seeded.
• resolveActiveOrgId reads only the better-auth session. An API-key caller (no session cookie) on a walled boot is refused with the session wording. Before, it was skipped. This was not measured further; carrier: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cloud-connection, @objectstack/service-storage, touching 12 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/services/service-storage/src/storage-service-plugin.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

24 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json ebfe658c7241076064d08a08d0c84e468d4ee3c7.

⛔ 5 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/src/storage-service-plugin.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ebfe658c7241076064d08a08d0c84e468d4ee3c7 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2037925d57e973c018f4651fdfae7f86c2ebb06b — the merge of head 0590b46d38d5e942324b59a1f3361c98b9978683 into base ebfe658c7241076064d08a08d0c84e468d4ee3c7, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2037925d57e973c018f4651fdfae7f86c2ebb06b && git checkout 2037925d57e973c018f4651fdfae7f86c2ebb06b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ebfe658c7241076064d08a08d0c84e468d4ee3c7 0590b46d38d5e942324b59a1f3361c98b9978683 && git checkout -B drift-repro ebfe658c7241076064d08a08d0c84e468d4ee3c7 && git merge --no-ff 0590b46d38d5e942324b59a1f3361c98b9978683

node scripts/docs-audit/affected-docs.mjs --json ebfe658c7241076064d08a08d0c84e468d4ee3c7

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ebfe658c7241076064d08a08d0c84e468d4ee3c7 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0590b46d38d5e942324b59a1f3361c98b9978683
Local-runs: none

Inputs read: card #21774 (body + all 5 comments: triage 5984276000, claim 5985374476, os-dev report 5985886480, ACCEPT 5985901016, handover 5985929630); PR #21780 (body, 9-file list, net diff against base ebfe658c7241076064d08a08d0c84e468d4ee3c7, which is origin/main as fetched); the 35 check-runs on the head; base files via git show origin/main:PATH; ADR-0123 at docs/adr/0123-no-active-organization-session-semantics.md. The PR is a draft on claude/issue-21774-install-local-no-active-org, no skip-changeset label.

Check-runs on this head (latest per name; every name appears exactly once, all on 0590b46d38): 31 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in) — conclusion skipped, not failure), 1 failure: Check Changeset. That is the ONLY non-green check. Green includes Lint & Repo Gates, all four Type Check jobs, Test Core (6/6 shards + rollup), Dogfood Regression Gate (3/3 + rollup), Dogfood Verify CLI, Temporal Conformance, Spec property liveness, Governed Surface Queue Guard, the single-writer-path and same-issue claim guards, and the branch-claim guard.

① Derived judgments

Accept-set and public-surface changes the diff implies, each judged:

1. resolveActiveOrgId membership fallback deleted, not repaired (marketplace-install-local-plugin.ts, base :2203–:2213 removed). Verified on origin/main: git grep sys_organization_member finds exactly the one call site and the storage-service-plugin.ts:996 comment; the defined membership object is sys_member (packages/platform-objects/src/identity/sys-member.object.ts). The read threw and was swallowed, so no resolved behaviour is lost. The resolver now answers session.activeOrganizationId or null. Right — ADR-0123 D1 (the state is declared; no fourth semantics) and the triage ruling's ⛔ on repairing it to sys_member.

2. Reseed, walled, no active organization: 403 PERMISSION_DENIED with noActiveOrganizationRefusal('reseed'), via applySideEffects(..., door: 'reseed') returning mode: 'refused' and a new branch ahead of the skipped branch. Was 400 RESEED_SKIPPED "Reseed did not run: multi-tenant-no-active-org" (base :1631–:1637). Right — ADR-0123 D2 (catalog code; PERMISSION_DENIED is in the standard catalog, packages/spec/src/api/error-code-ledger.test.ts:285, so ADR-0112 D3 needs no new registration) and D4 (the sentence contains "this session has no active organization" and the remedy). The skipped branch still serves no-datasets, objectql-or-metadata-missing and seed-error: … as 400 RESEED_SKIPPED; the RESEED_SKIPPED ledger row (error-code-ledger.zod.ts:1028, "reseed declined to run; message carries why") keeps live emitters and stays true. Right.

3. Purge, walled, no active organization: 403 PERMISSION_DENIED with noActiveOrganizationRefusal('purge') (diff :1813–:1818); was 400 RESEED_SKIPPED (base :1759–:1768). ADR-0123 D2's delete clause ("a delete under this state matches no row and is governed by the read rule") does not reach this door: purgeSeedRows reads under READ_CONTEXT = { isSystem: true } and deletes under SEED_WRITE_EXECUTION_CONTEXT (marketplace-install-local-purge.ts:86, :239), i.e. past Layer 0, with the scope supplied by this handler — "match no row" is not available without the resolver guessing a scope, which D1 forbids; the base already refused (400); the triage ruling names purge as a tenant-scoped write to refuse. Right.

4. Install, walled, no active organization: still 200 success, package registered env-wide, seeded: { mode: 'refused', reason } with the install sentence (package installed; join or select an organization, then reseed). Was { mode: 'skipped', reason: 'multi-tenant-no-active-org' }. withSampleData stays unset (the mode === 'inline' && rows > 0 guard at base :1157 is untouched). Right per the triage direction. Public-surface reading of the new value 'refused': it is a host response, not a published schema — packages/spec/src has no install-local response schema (app-install.zod.ts seededRecords is a different system shape); the return type sits on a private method; no consumer reads seeded.mode (objectui at pinned .objectui-sha 2e818d0b51: no seeded reader under packages/app-shell/src/console/marketplace; packages/cli/src: none). Not a Clause-② event. Right.

5. noActiveOrganizationRefusal + NO_ACTIVE_ORGANIZATION_CODE/STATUS: module-private, one sentence for three doors, not exported. D4 satisfied in one place. Right.

6. Wire-visible 400 to 403 on reseed and purge: a refusal replacing a refusal; no accept set moves. The console consumer (marketplaceApi.ts:802–:817 at 2e818d0b51, postLocalSampleAction) throws error.message with .code for any non-ok status and branches on neither status nor code — verified, so the user sees the new sentence. The purge's 400 was never released (see ②). Right.

7. single posture and walled-with-active-org paths unchanged: organizationWallActive false means the resolver is never called (unit pin spies on it); with an org, all three doors act in it (unit + door control in org B). Right; the claim fence "no change to the unwalled path" holds.

8. storage-service-plugin.ts: a 4-line comment edit only (base :995–:998); the clause citing the deleted fallback now cites ADR-0123 D1 and the rule ("no active organization means no stamp") is unchanged. Cross-lane declared in the claim (5985374476, seat post [PM seat] domain:services · seat 2 — ⏳ vacant #21118) — that post is outside this brief's inputs and is recorded as declared, not re-read; the single-writer-path guard on the head is green. Right.

9. Ratchets scripts/slot-lookup-baseline.json 15 to 14 and scripts/query-options-erasure-baseline.json 2 to 1 for the plugin file: the deleted fallback carried exactly one const ql: any = ctx.getService('objectql') (the SLOT_LOOKUP_ANY_MESSAGE shape) and one ql.find(..., { … } as any) (the query-options/no-any-erasure shape); the added code carries neither. Both checkers are exact-count (a decrease without --update fails), both run in Lint & Repo Gates (lint.yml:438–:461), which is green. Right.

10. Pins: new unit file (3 no-org pins, 3 active-org controls, 1 single spy pin; memberships served under both object spellings so a guessing resolver goes red); purge unit pin moved to 403; new dogfood file lands in the isolated project (include: ['test/**/*.test.ts'] minus SHARED_SHOWCASE, packages/qa/dogfood/vitest.config.ts:280–:282) and ran under the green Dogfood Regression Gate. The A5 ablation is the dev's own measurement, consistent with the two anchors in the diff; not re-run here. Right.

11. Claim fences: no new error code; no packages/spec path in the 9 files; service-storage comment-only; ledger entry shape (withSampleData, sampleDataPurged) unchanged. All held. No content/docs page states the old 400 answer or multi-tenant-no-active-org (grep on main: only the generated ledger listings of RESEED_SKIPPED, still true), so no doc edit was owed; the Docs Drift comment is advisory.

No accept set is widened or narrowed anywhere in the diff.

② Semver level

• .changeset/21774-install-local-no-active-org.md (new): "@objectstack/cloud-connection": patch. @objectstack/cloud-connection is a released, non-private package (17.6.0, public exports); a bug fix in a released package takes patch, never skip-changeset. Right. The PR body and the changeset both declare Clause-②: no with no arm — well-formed, and matched by the diff: no schema accepts more, no export or code is added, refusals keep refusing. Right. Sentence by sentence against the head: (a) reseed and purge "answer 403 PERMISSION_DENIED, with a message saying the session has no active organization and that one must be joined or selected" — TRUE (noActiveOrganizationRefusal text + the two 403 returns); (b) "Before, the reseed answered 400 RESEED_SKIPPED (multi-tenant-no-active-org)" — TRUE of the base; (c) "the purge, which starts deleting in this same release, refuses the same way from the start" — TRUE: the purge's deleting landed in fix(cloud-connection): install-local purge deletes seed rows through the engine by their seed key #21773 (d7fff217, 2026-10-04) after the last version PR (617f25f8, 2026-10-02, an ancestor of it), so 21728 is pending and both notes ship together; (d) "Reseed's other declines are unchanged and still answer 400 RESEED_SKIPPED: … no seed datasets, … no data engine or metadata service, and a seed run that threw" — TRUE (no-datasets, objectql-or-metadata-missing, seed-error: stay skipped); (e) install "still installs the package … seeded block now reads { mode: "refused", reason: "…" } … says to select one and then reseed. Before, it read { mode: "skipped", reason: "multi-tenant-no-active-org" }" — TRUE; (f) "No organization is guessed … The fallback read an object no package defines, so it never resolved anything" — TRUE (grep above); (g) "Unchanged. … Without a wall (single posture), no organization is read, and the three doors act table-wide" — TRUE.

• .changeset/21728-install-local-purge.md — the DELIBERATE CORRECTION, named by path. Present on the merge base (added by fix(cloud-connection): install-local purge deletes seed rows through the engine by their seed key #21773 at d7fff217), pending and unreleased (the only chore: version packages after it does not exist; 617f25f8 predates it). The PR changes one sentence of its Scope. bullet (1 addition, 1 deletion; the rest of the file is byte-identical):

  • OLD: "A session with no active organization is answered 400 RESEED_SKIPPED (multi-tenant-no-active-org), the way reseed answers it." — would be FALSE once this PR ships: at the head the purge answers 403 PERMISSION_DENIED, and the string multi-tenant-no-active-org no longer exists in the plugin. Since both notes compile into one release, keeping it would publish a false sentence beside a true one.
  • NEW: "A session with no active organization is refused with 403 PERMISSION_DENIED and a message naming the missing active organization, the way reseed refuses it." — TRUE of the code at this head: handlePurge returns { code: NO_ACTIVE_ORGANIZATION_CODE, message: noActiveOrganizationRefusal('purge') } with status 403; the message carries "this session has no active organization"; reseed refuses through the same builder, code and status.
  • The surrounding, unchanged sentences of that bullet ("removes only the seed rows of the caller's active organization…"; "Without a wall … the match is table-wide…") and the rest of the note remain true at the head.
  • Class: DELIBERATE CORRECTION, not COLLISION — the edited file is card-scoped 21728-…, the PR adds its own 21774-…, and the edit is one clause. The skip-changeset label is correctly absent (ruling D on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375: never applied to a PR that edits an existing changeset).

• The red. Check Changeset fails by the gate's content-blind foreign-changeset rule (scripts/check-empty-changeset.mjs, finding: random changeset filenames collide silently across parallel agents — a round overwrote a sibling PR's minor changeset and every gate stayed green #17712: --diff-filter=MD over .changeset/*.md present at the merge base and not added by this PR); the diff's M .changeset/21728-install-local-purge.md row is that refusal's input. The job's log could not be fetched (the Actions log endpoint is refused by this container's proxy), so the cause is derived from the gate's documented rule and the diff row; the job's other two scripts have nothing to red (patch bump, no with no arm). The workflow's own text classes this red as the point of the class and states Check Changeset is not a required context. Confirmed: a DELIBERATE CORRECTION red, and the only non-green check on the head.

③ Boundary flags

• open_questions[0] — confirm the correction to pending .changeset/21728-install-local-purge.md? A: keep it. Judged above, sentence by sentence; the seat's answer A (5985901016) is confirmed independently here.
• Deviation: edit to a pending note — answered as above; the path belongs on this claim's surface, as the ACCEPT recorded.
• Deviation: two baselines ratcheted down by one — right (① item 9).
• Deviation: main merge was a no-op — verified: the PR base equals origin/main ebfe658c72.
• Deviation: new seeded.mode value 'refused' — a host-response value with no published schema, no export, no code, no reader; not a Clause-② event (① item 4).
• Deviation: a new dogfood file rather than a block in the purge file — right; it boots its own walled fixture and correctly stays out of SHARED_SHOWCASE.
• A1 (measured-before) and A5 (ablation) — the dev's measurements on a real boot; consistent with the base code I read and the diff's anchors; not re-run under this brief's read-only rule.
• Out-of-scope note (carrier: none): a walled API-key caller (no better-auth session) is now refused at these doors with the "this session" wording where it was skipped before. Answered, not escalated: the refusal direction is ADR-0123's own (a caller naming no tenant cannot land a tenant-scoped row), the wording is a nit for a principal the dev did not measure and requireInstallCapability decides whether such a caller is admitted at all; not a landing blocker. Filing a carrier card is the seat's call.
• ADR-0123 D2 delete clause vs. the purge 403 — raised and answered in ① item 3.
• Cross-lane service-storage comment — declared in the claim; declaration post outside this brief's inputs; single-writer-path guard green.
• Docs Drift advisory (1 file with no anchor: the comment-only storage-service-plugin.ts) — nothing owed; no doc states the falsified sentence.

Implemented-by: claude/issue-21774-install-local-no-active-org
Reviewed-by: session_01RWZbGvPFcRKvUqASZtunCU

Independence: INDEPENDENT AGENT

VERDICT: PASS