feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1)

[objectstack-fleet]

Fixes #15195
Clause-②: yes (narrowing)

ADR-0131 C1: the Default Organization is load-bearing under single. Scope as triage ruled it: 6040634630 (Q1 → B) for the implementation, 6053354661 (Q1 → A, Q2 → A) for landing it. This is one atomic, cross-lane PR. It carries the @objectstack/verify bootStack re-pin and the dogfood re-pins with the implementation. packages/qa/dogfood and packages/verify (domain:cli) join it, declared on #6024.

What this does

• The boot invariant (D3). Under the single posture, AuthPlugin.start() finds or creates the Default Organization (slug: 'default'), with or without a platform admin. A failed read or insert throws and fails the boot.
  • AppPlugin declares com.objectstack.auth as an order-if-present dependency, so the kernel starts the auth plugin first wherever a host registered it.
  • The organization therefore exists before the inline seed and before kernel:listening.
• The seed-exemption withdrawal (D3/D9). The seed loader stamps the install's organization on every row of an object that carries an organization_id column, sys_ / cloud_ / ai_ seeds included.
  • Suppose no organization is pinned and none can be derived (zero organizations, or several), on an install that registers the organization object. Such a row is refused, counted and named.
  • An object with no organization column is never stamped.
• The owner pin (D3 / ADR-0093 D7). The reconciler binds the first admin as member before the owner bind learns who they are.
  • While the once-only bind is undecided and the Default Organization has no owner, the bootstrap promotes that row to owner in place.
  • It records the decision as promoted.
• The derivation rule for the objects already in scope (D9). resolveSystemInsertOrganization derives at exactly one organization. It refuses at zero (new: reason: 'no-organization'), at several, and under a wall.
  • The refusal reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (status 500).
  • No packages/spec edit.
• bootStack boots the production single shape (D3 / D11). The harness no longer pins the owner bind off (autoDefaultOrganization: !!opts.orgContext is gone). Every boot has the Default Organization, every sign-up is its member, and the harness admin is its owner, as objectstack dev / serve boot it.
  • orgContext is now only the vacuity guard: it asserts that the admin's session carries an organization, and refuses the boot otherwise. It still refuses to compose with multiTenant: 'posture-only'.
  • There is no test-only org-less mode and no escape hatch.
• Unchanged by ruling.
  • The 49 gated platform objects keep isPlatformObjectOutOfTenantAuditScope until C8.
  • The lean-install branch is unchanged, with a pin. That is probeInstallOrganizations answering [] when no organization object is registered.
  • No C3, C5 or C6 surface, no seeder and no applyTenantScope is touched.

Boot order: fresh single, examples/app-showcase through bootStack (measured)

Base 51290bca2c, implementation head c49f46bab1. Seeds: 132 rows over 19 objects. The last two rows were measured with the harness at its old pin. Since this PR, bootStack always boots the owner-bind-on row.

step	base	head
AuthPlugin.start()	no organization	Default Organization inserted: the first insert of the boot (seq 0 of 98)
AppPlugin.start() inline seed	132 rows, all organization_id NULL (sys_business_unit 5 of 5 NULL)	132 rows, 0 NULL, sys_business_unit included
kernel:ready	0 organizations	1
kernel:listening	0 organizations (old harness default). 1 only when a dev admin existed at kernel:ready; even then the organization was the 49th insert, after every seed, and 130 of 132 seed rows stayed NULL	1
dev admin, owner bind on (bootStack now, always)	org created and admin bound owner directly	reconciler binds member; the bootstrap logs "promoted the platform admin to owner"; isPlatformAdmin: true, positions platform_admin, org_owner
dev admin, owner bind off (the old harness default, removed)	no membership, no active organization	member of the Default Organization, the session's active organization

The derivation rule: resolveSystemInsertOrganization, objects in scope

posture	organizations	organization object registered	write carries one	base	head
single	1	yes	no	derived	derived
single	0	yes	no	lands NULL (measured, probe)	refused no-organization (measured, pins)
single	2 or more	yes	no	refused ambiguous-organization	unchanged
single	0	no (lean composition)	no	lands unstamped	unchanged, pinned
isolated / group	any	yes	no	refused walled-posture	unchanged (measured on a posture-only isolated showcase boot: code ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, status 500; the same insert carrying tenantId lands stamped)
any	any	any	yes	stamped with it	unchanged
the 49 gated platform objects	any	any	no	exempt	unchanged (C8)

Acceptance pins (implementation head 4fc2472fd0, base ec8f37c890)

runtime/src/default-organization-boot-invariant.pin.test.ts boots a real kernel twice:

• Kernel A: a fresh deployment nobody signed up to.
• Kernel B: objectstack dev, where the dev admin is created after the organization exists.

AppPlugin is registered before AuthPlugin on purpose.

pin	where	base	head	control
(a) organization before the listener and before the first seed row; an isSystem insert with no organization lands stamped	kernel A, 3 cases	red	green	an object declaring tenancy: { enabled: false } takes none
(b) isolated / group refuse, with the code and status; the insert carrying tenantId lands	objectql system-write-organization.test.ts and the measured isolated boot above	green (since #8844)	green	the carrying insert
(c) the first admin is the owner, by promotion	kernel B	red	green	isPlatformAdmin read back unchanged
(d) every seed row stamped, sys_ seeds included	kernel A	red	green	the tenancy-off seed lands with no organization
(e) lean-install branch unchanged	objectql and metadata-protocol [ADR-0131 Q2, held as-is] cases	green	green	the registered-but-empty case refuses

Reverse verification of the implementation (from committed 4fc2472fd0):

1. The eight implementation source paths were restored to ec8f37c890 in the tree only.
2. The four packages were rebuilt, and scripts/ablation-dist-preflight.mjs confirmed each head marker absent from dist/.
3. The pin run: 5 failed and 2 passed, as tabled.
4. A trap restore, proven by git diff HEAD empty and per-path blob hashes equal to HEAD.
5. A rebuild with the markers back.

Ablations (scripts/ablation-replace.mjs, each restored and rebuilt):

• The promotion call disabled: (c) turns red (member, not owner).
• com.objectstack.auth removed from AppPlugin.optionalDependencies: every seed row is refused, and (a)'s ordering case and (d) turn red.

M5: the existing tests C1 moved, judged one by one

Each flip was judged against the ruling and none was restored. There are two judgements:

• flipped: the old expectation was the defect C1 fixes, and the pin now holds the new answer.
• re-pinned: the fixture changed and the subject did not.

file	package	judgement	what changed
seed-loader-sole-organization-read-failure.test.ts	metadata-protocol	flipped	no organization, several, or an unprovisioned table no longer write the seed row NULL
seed-loader-org-fallback.test.ts	objectql	flipped	sys_ seeds take the organization; ambiguity refuses
engine-organization-probe-outage.test.ts (cause 2)	objectql	flipped	the empty probe still is not an outage, but zero organizations now refuses
system-write-tenancy-autonumber-split.integration.test.ts	runtime	flipped	the first-boot write is refused at zero organizations, with the stamped control
auth-plugin.test.ts, "autoDefaultOrganization: false opts out"	plugin-auth	flipped	the organization exists anyway
seed-loader-engine-schema-fallback.test.ts	metadata-protocol	re-pinned	the one new engine read is the organization-object registration read
seed-loader-existing-records-read-failure.test.ts	metadata-protocol	re-pinned	the metadata double no longer claims an organization object
protocol-publish-package-drafts.test.ts	objectql	re-pinned	the install holds its Default Organization
packages-seed-apply-disclosure.test.ts, packages-seed-apply-read-decorations.test.ts, http-dispatcher.test.ts	runtime	re-pinned	each install holds its Default Organization
seed-tenancy-autonumber-split.integration.test.ts	runtime	re-pinned	the split is reproduced from pre-C1 residue written at the driver, since the loader can no longer produce it; a new case pins the refusal
auth-plugin.test.ts, the two app:seeded cases	plugin-auth	re-pinned	they delete the organization to reach "no target"
status-mirror-cascade.integration.test.ts	plugin-approvals	re-pinned	The rig registered sys_organization but left it unprovisioned and empty, then system-inserted opportunity, so CI refused it (no-organization). It now provisions sys_organization and seeds the Default Organization before the first insert. sys_organization leaves the expected-absent probe list, by that channel's own contract (a table that started resolving is provisioned now). The subject, an approval decision cascading as the deciding user, is unchanged. The delegation channel still fires (afterAll green).
claim-seed-ownership-warm-boot.test.ts	plugin-security	re-pinned	The rig registered the real identity objects with no auth plugin, so CI refused the crm_case seed inserts in four cases. Every boot of the rig now finds or creates the Default Organization, as the invariant does on every boot. The subject, the warm-boot seed-ownership claim and its target, is unchanged: all 5 cases pass with the same expectations.
runas-system-stamping.integration.test.ts, the SecurityPlugin flip block	service-automation	re-pinned	The rig composed the identity objects with no auth plugin, so the user-less run's create_record was refused (found by the sweep below; CI never reached this suite). The rig now seeds the Default Organization as org_1, the member's organization. The NULL-born case also pins the row's derived organization (org_1), so the 403 is decided by the stamp columns alone, which is the subject. The lean block above it registers no organization object and is unchanged.

None of these weakens the no-organization refusal, adds tolerance in the engine, or skips a case.

bootStack and the dogfood: the 24 re-pinned files

At this PR's implementation alone, 24 dogfood files failed; at base they pass. Each was re-pinned on its own cause, to the production single shape. Pins that C1 flips flip to the new answer and none is deleted. The shared helper is leaveOrganization (new, test/armed.ts): it deletes the user's sys_member rows in system context, signs in again, and throws if a membership survives. A user removed from their organization is an ordinary production state, not a test mode.

file	cause	what changed	why it keeps the original intent at the production shape
analytics-adhoc-query-isolation	its memory leg: driver-memory refuses a tenant-scoped read (503), and every session now carries the Default Organization	the memory leg became an objectql-strategy leg on sqlite-wasm, with the analytics plugin's queryCapabilities withholding native SQL. Restart-when: #15212 closed	the file pins isolation under both analytics strategies; the memory driver was only the route to the ObjectQL strategy, and the capability switch reaches it on a driver that answers
analytics-contains-membership	as above	as above	as above
analytics-inline-dataset-admission	as above	as above	as above
analytics-inline-dataset-isolation	as above	as above	as above
armed	the "outside" class was an org-less sign-up; every sign-up is now a member	orgless/orgbound renamed outside/inside; the outside principal leaves the organization; the write-floor disarm text names "Keep the principal a member of the organization"	the floor is still measured on a principal with no active organization against one inside it
delegated-admin-invite	it minted its own slug: 'default' organization (DuplicateRecordError)	reads the boot's Default Organization	same subject inside the deployment's one organization
delegation-of-duty	the delegator is now a member, so the gate reads the delegator's organization's positions (ADR-0091 D3 rule 5), and the fixture's positions had none	sys_position / sys_user_position rows carry the Default Organization; the session double carries activeOrganizationId	same delegation rules, on rows held the way an org-bound deployment holds them
invitation-ledger-row-scope	it minted a second organization (acme-8095) while the reconciler binds every sign-up to the Default Organization	uses the Default Organization	the ledger's row scope is measured inside the deployment's one organization
membership-actor-attribution	minted its own default organization	reads the boot's	unchanged subject
membership-ended-session-revoke	minted its own default organization	reads the boot's	unchanged subject
membership-reconciler	minted its own default organization	reads the boot's	unchanged subject: the reconciler binding through the real sign-up pipeline
membership-role-vocabulary	minted its own default organization	reads the boot's	unchanged subject
org-admin-affordance-reach	it minted reach-org while sign-ups bind to the Default Organization	uses the Default Organization	grades measured in the organization the members are in
organization-delete-federated-fixture	deleting the Default Organization now runs the delete behaviour of every row the deployment owns, the seed included	deletes a second organization (org-21910) that the admin owns and no row belongs to	the cascade scan probes every reference on any organization's delete, so the federated anchor is still reached, without a different question attached
parent-derived-write-refusal-not-visible	an org-less principal was the precondition	boot(inside): the outside principal leaves the organization; the inside boot keeps orgContext: true	same refusal shape, for a principal outside the organization
permission-set-lock-row-provenance	the harness admin was a member	no edit: the harness owner bind	the admin is the deployment's administrator, the Default Organization's owner as objectstack dev boots it
permission-set-write-through-package-binding	as above	no edit	as above
predicate-write-unreadable-not-matched	org-less precondition	as parent-derived-write-refusal-not-visible	as above
sharing-rule-org-less-caller	the org-less personas, and the harness admin as the org-less platform operator	the org-less personas leave the organization. The operator is a new user holding admin_full_access globally who leaves it. The control persona's Default membership is removed before its tenant-A one. Preconditions judge live sessions only, because leaving revokes the sign-up session (#15784)	a sharing rule still must not widen reads for a caller with no organization; each caller is now a production shape
showcase-permission-projection	the harness admin was a member	no edit	as permission-set-lock-row-provenance
single-tenant-identity-create	the old expectation, a sys_business_unit with no organization, is the defect C1 fixes	flipped: organization_id equals the Default Organization's id	ADR-0057's property (creatable single-tenant, no VALIDATION_FAILED) is still the pin
sys-file-metadata-write-refusal	the harness admin was a member	no edit	as permission-set-lock-row-provenance
two-doors-permission	the harness admin was a member	no edit	as permission-set-lock-row-provenance
write-door-unreadable-is-not-found	org-less precondition	as parent-derived-write-refusal-not-visible	as above

Files beyond the declared set (packages/verify/src/harness.ts and the 24 files):

• packages/qa/dogfood/test/armed.ts, which holds the leaveOrganization helper.
• packages/verify/src/harness.org-context.test.ts. The default-boot case now pins the production shape, including the admin's owner membership.
• showcase-external-autoconnect.dogfood.test.ts and showcase-scope-depth.dogfood.test.ts: comments only, correcting the description of the removed org-less boot.
• .changeset/15195-verify-bootstack-production-single.md.
• Cross-lane (domain:services) test fixtures, round 3, tabled under M5: packages/plugins/plugin-approvals/src/status-mirror-cascade.integration.test.ts, packages/plugins/plugin-security/src/claim-seed-ownership-warm-boot.test.ts and packages/services/service-automation/src/runas-system-stamping.integration.test.ts.
• The tenant-audit census (content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md). After each main merge it was regenerated with the gate's own write mode, outside the MERGE state, and the prose figures the gate holds were moved with it: 234 → 236.

Reverse verification of the harness change (committed 05dedeea79, and again on 9aee4d05f1 with identical results; round 3 changes no file it reads):

1. scripts/ablation-replace.mjs (WRAP mode) restored the old pin in harness.ts, with a string-literal marker (REVERSE-15195-OLD-PIN) the bundler keeps.
2. @objectstack/verify was rebuilt, and ablation-dist-preflight confirmed the marker present in dist/.
3. The mutated leg turned red:
   • dogfood, the 24 files: 5 files and 14 tests failed, 204 tests passed. The five are exactly the "no edit" rows above.
   • harness.org-context.test.ts: 1 of 5 failed (expected [ 'member' ] to deeply equal [ 'owner' ]).
4. The file was restored: blob equal to HEAD and git diff HEAD empty. @objectstack/verify was rebuilt, and the preflight --absent passed.

The same leg on c2f7e36d6e left the harness unit test green, because its two assertions hold without the owner bind. 05dedeea79 adds the owner assertion so the unit test reads the line itself. The first attempt was void and is not counted: the tool refused it because the replacement contained the anchor, and nothing ran.

The in-memory driver until C8 (triage Q2 → A)

@objectstack/driver-memory refuses tenant-scoped reads. Under single, every session now carries the Default Organization, so on that driver signed-in reads answer 503 until C8 (#15212, ADR-0131 D8) gives single no read predicate. The plugin-auth changeset states this.

This is not new in production terms. At base, a showcase boot with the owner bind on (the shape objectstack dev boots) already answered the platform admin's GET /data/showcase_category with 503 SERVICE_UNAVAILABLE on the memory driver. Only the harness's org-less pin kept the four analytics memory variants green. Those variants now run on the SQL in-memory driver, with Restart-when: #15212 closed in each file.

Clause-②: the built entry declarations, base ec8f37c890 against head

• @objectstack/objectql:
  • SystemWriteOrganizationDecision's 'no-organization-yet' becomes 'no-organization-object'.
  • SystemWriteRefusalReason gains 'no-organization'.
  • resolveSystemWriteOrganization takes a required organizationObjectRegistered.
• @objectstack/plugin-auth:
  • EnsureDefaultOrganizationOnceOptions gains an optional organizationCreatedByThisProcess.
  • EnsureDefaultOrganizationResult gains an optional ownerPromoted and the 'owner_promotion_failed' reason.
• @objectstack/verify: no declaration change. bootStack now boots an org-bound admin for every caller, so a fixture that relied on an org-less one breaks.
• @objectstack/metadata-protocol, @objectstack/runtime: no public declaration changes.

The accept sets narrow, so the answer is yes (narrowing). The objectql, plugin-auth, metadata-protocol and verify changesets are minor, with the BREAKING banner and an ADR-0087 disposition. The runtime changeset is patch. Driven offline with this body as the pull_request payload (--event), check-changeset-no-major reads Clause-②: yes (narrowing) and passes the level axis. check-adr-0087-registration also passes.

Verification (head ede1fbd345, merge base 9f0de32a03)

Every package that depends on @objectstack/objectql was run in full. That is 45 packages (pnpm --filter '...@objectstack/objectql'); 44 have a test script, and metadata-protocol was added. A package that does not register sys_organization cannot reach the no-organization refusal, but the sweep measured every package rather than relying on that argument. In each log, every SystemWriteOrganizationRequiredError / no-organization match was read; none remain after the fixes.

• Round 3, the three touched packages, at ede1fbd345 (plugin-approvals and plugin-security also ran at b7d0b3469e, which already carried their fixes):
  • plugin-approvals: 62 files, 905 passed.
  • plugin-security: 179 files, 3,775 passed, 45 skipped.
  • service-automation: 175 files, 2,120 passed.
• runtime, re-run at ede1fbd345: 339 files, 5,495 passed, 19 skipped.
• cli: unit tier 264 files, 3,915 passed. Integration tier in four slices: 93 files, 900 passed, 2 skipped.
• The rest of the sweep, at b7d0b3469e / ede1fbd345:

package	files	tests
plugin-audit	40	641
plugin-sharing	40	1,002
trigger-record-change	11	114
trigger-schedule	8	174
service-analytics	180	4,441 (262 skipped)
service-datasource	41	760
service-knowledge	4	49
service-messaging	48	534
service-settings	39	707
service-storage	43	717
service-queue	5	77
service-sms	5	74
rest	262	4,938 (326 skipped)
hono	5	122
http-conformance	8	102
downstream-contract	3	31
client	51	653
client-react	3	34
cloud-connection	41	505
connector-mcp / -openapi / -rest / -slack	3 / 4 / 4 / 3	23 / 36 / 26 / 10
driver-mongodb	31 (5 skipped)	690 (182 skipped)
knowledge-memory / knowledge-ragflow	1 / 1	8 / 10
organizations	11	151
plugin-dev	9	86
plugin-email	31	535
plugin-pinyin-search	2	21
plugin-webhooks	15	165
example-crm / -embed-objectql / -showcase / -todo	5 / 1 / 33 / 7	45 / 2 / 408 / 238

• At 9aee4d05f1. Round 3 changes no file these read:
  • dogfood, all 8 shards (OS_TEST_SHARD=k/8): 222 files (1 skipped), 1,753 tests passed, 9 skipped.
  • objectql: 381 files, 7,527 passed.
  • metadata-protocol: 222 files (3 skipped), 28,283 passed.
  • plugin-auth: 128 files, 2,655 passed.
  • verify: 18 files, 133 passed.
• Typecheck: green for plugin-approvals, plugin-security and service-automation at ede1fbd345 (check:test-typecheck OK: the plugin-approvals debt ledger is held, the other two ledgers are empty). Earlier: objectql, runtime, metadata-protocol, plugin-auth, verify and dogfood.
• Gates: dispatch-gates --commands derived 112 for this tree (two i18n families joined), all 112 ran with exit 0, and --ran reconciled 112 of 112 with recorded exit codes. The roster gates whose list lives in a touched directory all exit 0. check-single-claim-paths passed with this PR's context.
• Lint: eslint --no-inline-config over the 51 script and TypeScript files this diff adds or modifies: 0 errors and 0 warnings, 51 files in the JSON report. The config enables no type-aware linting, so this diff cannot move an untouched file's verdict. The full pnpm lint run is CI's.
• Serial: feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 and feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 are still open. Neither shares a file with this PR; no dogfood showcase file and no showcase-security.ts is touched.
• main since the merge base: 27 commits, not merged here. git merge-tree against it is clean. 16 test files they add or change name the organization object (for example plugin-security/src/grant-holder-membership-refusal.test.ts, service-settings/src/settings-organization-isolation.pin.test.ts and dogfood/test/business-unit-and-user-delete-federated-fixture.dogfood.test.ts). They are NOT MEASURED against C1 here; CI's merge-ref run measures them.

Acceptance notes

• The wall's sole-organization seed fallback. The seed loader still derives under a walled posture when a load names no organization and the install holds exactly one organization. This was read, not measured. The walled inline seed is suppressed, and the per-organization replay always names one. carrier: the feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195 claimant.
• The owner-bind ledger. Its admin-already-member second insert (DUPLICATE_RECORD on two concurrent triggers, present at base too) is [finding] every artifact boot on a fresh :memory: database logs Insert operation failed … UNIQUE constraint failed: sys_migration.id with a full knex stack in Boot diagnostics #22099.
• Stale comments. packages/plugins/plugin-sharing/src/sharing-service.ts, sharing-rule-service.ts and sharing-service.test.ts still describe the harness's autoDefaultOrganization: false. They are not edited here (outside the declared set). carrier: none named, so this is noted here only.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/plugin-auth, @objectstack/runtime, @objectstack/verify, touching 44 documentable anchor(s).

32 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 6729e107e806b148d809e42b62e7fc0233d3d324.

⛔ 11 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 cross-cutting symbol(s) contributed no route anchor: organizationId (5 routes)
• 2 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 72 pages), organization_id (literal, 33 pages)
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 46 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6729e107e806b148d809e42b62e7fc0233d3d324 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4e660734be2af04fb2c7d25f20336130a9f53c76 — the merge of head ede1fbd3459d826e884d5c5ba3e3e0476edd0961 into base 6729e107e806b148d809e42b62e7fc0233d3d324, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4e660734be2af04fb2c7d25f20336130a9f53c76 && git checkout 4e660734be2af04fb2c7d25f20336130a9f53c76
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6729e107e806b148d809e42b62e7fc0233d3d324 ede1fbd3459d826e884d5c5ba3e3e0476edd0961 && git checkout -B drift-repro 6729e107e806b148d809e42b62e7fc0233d3d324 && git merge --no-ff ede1fbd3459d826e884d5c5ba3e3e0476edd0961

node scripts/docs-audit/affected-docs.mjs --json 6729e107e806b148d809e42b62e7fc0233d3d324

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6729e107e806b148d809e42b62e7fc0233d3d324 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ede1fbd3459d826e884d5c5ba3e3e0476edd0961
Local-runs: none

Isolated, adversarial read of PR #22186 at the head above (card #15195, ADR-0131 C1). Inputs: the card's body and all 13 comments (triage's scoping 6040634630 Q1 → B, triage's landing ruling 6053354661 Q1 → A / Q2 → A, the take-over claim 6049583616 and its revision, the three os-dev-reports 6052898415 / 6059821487 / 6064009112), ADR-0131 and ADR-0093 D7 as they stand on main (4e4111ca05), the PR body as rewritten at round 3, the 59-file list, the net diff against the merge base 9f0de32a03, the cross-lane declarations on #6024 (6042937973, 6053967589) and #6021 (6039104553, 6064050477), and the check-runs on the head. Nothing was built, run or re-run.

① Derived judgments

The narrowing, against triage's scope (Q1 → B). Each piece judged against ADR-0131's text:

• Boot invariant (D3) — right. AuthPlugin.start() calls the new internal ensureDefaultOrganizationExists when the posture in force is single: find by slug: 'default', else the sole organization, else insert; a failed read propagates and a failed insert throws BOOT REFUSED …. That is D3's "a failure becomes a boot error", and it no longer waits for an admin. Several organizations with no default → nothing created, a warning, and D9's refusal governs the writes (§5: nothing defaults to any other owner). Not gated on autoDefaultOrganization, which now governs only the owner bind — the option's docblock says so and the changeset carries the BREAKING sentence. Pinned on a real kernel (default-organization-boot-invariant.pin.test.ts, kernel A: the organization is the only row at kernel:listening on a boot nobody signed up to, and its insert precedes the first seed row).
• AppPlugin order-if-present on com.objectstack.auth — right. optionalDependencies gains the auth plugin's declared name (auth-plugin.ts:306), so the kernel starts it first wherever a host listed it; the pin registers AppPlugin before AuthPlugin on purpose and the body's ablation shows the pin reds without the declaration. A composition without the auth plugin is unaffected.
• Seed-loader stamp (D3/D9) — right. The /^(sys_|cloud_|ai_)/ exemption is gone; resolveSoleOrganizationId now answers sole / unowned / no-organization-object, and loadDataset stamps every row of an object whose registered schema carries organization_id (seedRowNeedsOrganization: authored column or the injected tenant column, and not tenancy: { enabled: false }) — sys_ seeds included — or REFUSES the row when the install registers the organization object and holds zero or several (counted in errors, named, logged once per dataset at error, nothing written). A column-less object is never stamped, pinned or derived (this also corrects the inherited defect where a stamped column-less row was lost at the engine). A row carrying its own organization_id wins. Pinned in seed-loader-organization-stamp.test.ts with the discriminating controls (pinned org, author-named org, tenancy-off object) and on the real kernel (pin d: the sys_business_unit seed carries the organization; the tenancy-off seed carries none).
• Owner promotion (ADR-0093 D7) — right. D7 keeps the owner bind with ensureDefaultOrganization and says the reconciler-first order must be safe. With the organization now predating the admin, the reconciler always binds member first; promoteReconciledMemberToOwner promotes that one row in place only when the once-only bind is undecided, the admin holds exactly one membership, on the Default Organization, with role member, and that organization has no owner — each condition pinned (decided bind, existing owner, other role, other organization all leave the row alone). The ledger records promoted; a failed promotion reports at error and leaves the bind undecided. organizationCreatedByThisProcess admits the bind on a ledger-less kernel for the organization this process created, which is the fresh-install case the gate already admitted. Kernel B pins the end state (one owner row, isPlatformAdmin unchanged).
• resolveSystemInsertOrganization (D9) — right, within scope. resolveSystemWriteOrganization derives at exactly one organization; refuses at several (ambiguous-organization, unchanged), under a wall (walled-posture, unchanged, no probe), and now at zero where the composition registers the organization object (no-organization). The isPlatformObjectOutOfTenantAuditScope early return above it is untouched at the head (read at engine.ts:5841), so the 49 gated platform objects keep their exemption until C8 as 6040634630 rules. No seeder, no sys-metadata-repository, no plumbing column, no applyTenantScope and no platform-object-tenancy.ts is in the diff; packages/spec is untouched.
  • Status 500 — right. ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED is already registered (packages/spec/src/api/error-code-ledger.zod.ts:684) with the ledger's own rationale: neither the client's bad input nor a missing request precondition. The new reason shares that class exactly — reaching it under single means the boot invariant was broken after boot (organization deleted) or the composition never booted the auth plugin, which no caller can repair by changing its request. The message names what is missing (ADR-0123 D4). No new code, so no ledger gap and no spec-lane edit.
  • Lean-install branch — unchanged and pinned. probeInstallOrganizations is untouched; the one new fact, organizationObjectRegistered: !!this._registry.getObject(ORGANIZATION_OBJECT), is what separates the two readings of an empty probe. Pinned [ADR-0131 Q2, held as-is] four times: the pure function, the engine with lean: true (never asks the driver), and the seed loader twice (no organization object; the engine refusing the unregistered name). Whether D9 reaches that composition stays C8's (feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212), as 6040634630 records.

The public surface, on the built entry declarations. The dev's list is right, and two of its objectql items are NARROWINGS of a published TypeScript surface, not widenings — named here so the record says so:

• @objectstack/objectql: SystemWriteOrganizationDecision loses the member 'no-organization-yet' (a consumer branching on it now has a dead branch or a type error) and gains 'no-organization-object' with a narrower meaning; resolveSystemWriteOrganization gains a REQUIRED organizationObjectRegistered (an existing caller fails to compile — deliberately, the docblock says, so no caller inherits the permissive reading by omission); SystemWriteRefusalReason gains 'no-organization' (a widening).
• @objectstack/plugin-auth: an optional organizationCreatedByThisProcess on EnsureDefaultOrganizationOnceOptions, an optional ownerPromoted and the 'owner_promotion_failed' reason on EnsureDefaultOrganizationResult — widenings only, as its changeset says.
• @objectstack/metadata-protocol, @objectstack/runtime, @objectstack/verify: no declaration change; bootStack's behaviour changes.

Clause-②: yes (narrowing) describes this truly: yes because a published surface moves (the pm-dispatch criterion is "widens the accept set or expands the public surface", and plugin-auth and the refusal-reason union expand), (narrowing) because the accept sets and the objectql surface narrow — the arm AGENTS.md makes BREAKING. The #22223 bullet ("a card that narrows a published accept set is no") describes a card that narrows and nothing else; this one also expands the surface, so the body's spelling is the right one and the level-axis gate reads it (Check Changeset green at 16:14Z, after the body write). The objectql changeset names both narrowings (the rename and the required parameter) and the one-line remedy for the parameter; the rename's FROM → TO sits inside the ADR-0087 disposition comment rather than the rendered body — greppable in the shipped CHANGELOG.md, which is what the rule asks, but a visible sentence would serve a human reader better (non-blocking).

The re-pinned tests. 15 it( lines are removed in the diff; each is replaced by a case that pins the ruled answer with a discriminating control, and no skip / todo / xit is added. Spot-checked across the categories:

• flipped, defect C1 fixes: seed-loader-sole-organization-read-failure (the three "writes org-less" controls now refuse, nothing written; the seed-loader resolveSoleOrganizationId swallows every sys_organization read failure behind a comment naming one benign cause, so a transient outage silently seeds org-less rows #12852 subject — a FAILED read propagates — is intact and still asserts findCalls); engine-organization-probe-outage cause 2 (the probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open #9261 subject — a missing table is not an outage — is intact: the probe still answers, and what zero means is now D9's refusal); system-write-tenancy-autonumber-split ("first boot lands untenanted" → refused, no __global__ counter, with the organization-present control deriving WI-00001); auth-plugin.test "autoDefaultOrganization: false opts out" → turns off only the owner bind (the org-less single boot D11 removes); single-tenant-identity-create (organization_id null → the Default Organization's id, ADR-0057's 201 still asserted).
• re-pinned, fixture changed and subject not: seed-tenancy-autonumber-split (the Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686 repair still owes residue the loader can no longer produce, so landPreC1SeedResidue writes it at the driver; a new case pins the loader's refusal); armed (org-less class → a member removed via leaveOrganization; the integrity case still proves outside lacks org_member and inside holds it); sharing-rule-org-less-caller (the org-less personas leave; the platform operator becomes a new global admin_full_access holder who leaves; the two-tenant anti-vacuity premise stays; live sessions only, since leaving revokes the sign-up session per revoke a session whose membership ended, so "Remove member" actually signs the person out — the courtesy half of #15409, ⛔ never the enforcement #15784); the four analytics files (the memory leg becomes an objectql-strategy leg on sqlite-wasm with native SQL withheld, so both strategies are still exercised, each file naming Restart-when: #15212 closed — triage's Q2 → A, both halves); organization-delete-federated-fixture (a second organization the admin owns is deleted; the cascade scan the file pins runs on any organization's delete); the three round-3 rigs (status-mirror-cascade provisions and seeds the organization object and drops sys_organization from the expected-absent list by that channel's own contract; claim-seed-ownership-warm-boot finds-or-creates on every boot as the invariant does, same five expectations; runas-system-stamping seeds org_1 and ADDS an assertion that the NULL-born row derived it — a strengthening).

No subject was weakened, skipped or deleted to reach green.

bootStack's docs — updated to the shape that remains. The orgContext docblock now says ASSERT (the vacuity guard), not switch; the "pure single-tenant (no org, no scoping)" comment at the AuthPlugin registration is replaced by the ADR-0131 D3/D11 statement; the autoDefaultOrganization: !!opts.orgContext pin is gone; no BootOptions key is added or removed; the multiTenant: 'posture-only' incompatibility is kept. harness.org-context.test.ts pins the default boot as the production shape, owner membership included, and the body's reverse verification shows that case reads the changed line.

② Semver level

• Pre mode is ON at this merge base. a87d8be299 (.changeset/pre.json, mode pre, tag next) is an ancestor of 9f0de32a03. Two card statements are therefore stale premises on this head, not false sentences in the artifacts: the claim 6049583616 ("Changesets pre mode is not in yet, per triage 6037983378", written 00:25Z) and the round-1 report (".changeset/pre.json is absent on origin/main ec8f37c890", a base at 02:59Z — true then, pre entry landed 07:03Z). None of the five changesets and nothing in the PR body says pre mode is absent; each breaking changeset grades minor "under the repo's launch-window convention for breaking changes", which is the convention check-changeset-no-major.mjs's header states as in force until GA — pre mode lifts that guard's refusal of major (its RC exemption) but mandates nothing.
• The right level for a BREAKING narrowing on the v18 pre-release line. By the repo's rule: (narrowing) is BREAKING and takes at least minor with the BREAKING banner and an ADR-0087 disposition; major is admissible in pre mode, not required. By precedent since pre entry: ten ! changesets landed; eight accept-set or runtime-interface narrowings graded minor under the same sentence (a3bcbcf3ca, 9ad3d2470e, 79c35d45e2, 81bd9fa6fe, 7518ee397d, ffb31fca3c, 73a0a6bf1d, d1dbe70ebd), and the two major grades (0e9e7b7066, 326a90a4a3) were authorable spec-export removals with registered ADR-0087 entries — a different class from this PR, which removes no authorable key or export. The fixed group already sits at 18.0.0-next.N from the opening marker, so neither grade moves a version on this line. minor is right for this class; the sentence is true.
• The changesets match the diff. objectql, metadata-protocol, plugin-auth and verify: minor, Clause-②: yes (narrowing), a BREAKING banner, exactly one ADR-0087 disposition marker each (adr-0087: not-required (no-migration-prescription), in the HTML comment the gate reads), and a remedy. runtime: patch for the order-if-present declaration (no declaration change; a composition without the auth plugin is unaffected). The five packages the diff publishes are the five the changesets name; nothing published is left ungraded.
• Clause-②: yes (narrowing) — right, for the reasons in ①.

③ Boundary flags

• The wall's sole-organization seed fallback (read, not measured). The seed loader reads no posture, so under a wall with exactly one organization and a load naming none it still derives — the same branch base had; D9's every-posture refusal is C8's row (§8). The walled inline seed is suppressed and the per-organization replay always names its organization, so no first-party path reaches it. Triage 6053354661 placed it in Acceptance notes with carrier: the claimant; it is there. Answered: pre-existing, outside C1's ruled scope, carried.
• The concurrent owner-bind observation. DUPLICATE_RECORD on the ledger's second insert under two concurrent triggers, present at base, final membership correct in every run: [finding] every artifact boot on a fresh :memory: database logs Insert operation failed … UNIQUE constraint failed: sys_migration.id with a full knex stack in Boot diagnostics #22099 (p3, domain:services) carries it. Answered.
• main drift. CI's pull_request run started 13:44:06Z and measured main@79c35d45e2 + this PR. main has since moved 8 commits to 4e4111ca05; two of them add or edit test files that name the organization object AFTER that run (a3bcbcf3ca, 13:51Z: business-unit-and-user-delete-federated-fixture.dogfood.test.ts, which boots orgContext: true and reads slug: 'default' — compatible with C1 by reading; standalone-stack-seeder-declaration-copy.test.ts, which composes no auth plugin and seeds nothing), plus 9ad3d2470e (defineSeed refuses unknown record keys; this PR's pin data is inline, not defineSeed). NOT MEASURED by the head's check-runs. Escalation: ci.yml builds each queued PR as speculatively merged onto current main and lands it only if green on that result, so the queue leg is the control — the owning seat lands only through the queue and treats a red queue run as this PR's to repin (M5 discipline), never as a reason to bypass. No main merge is required before enqueueing: git merge-tree is clean per the round-3 report and the PR is mergeable.
• Cross-lane declarations. domain:cli ([PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024): harness.ts, the 24 dogfood files and the runtime pin are declared (6042937973, 6053967589); armed.ts was pre-declared conditionally and the condition fired. domain:services ([PM seat] domain:services — 🟢 zhuangjianguo · session_013j5gkUCpqQiti4GgPqqmnt #6021): the plugin-auth files (6039104553) and the three round-3 rigs (6064050477) are declared. Owed before the PR leaves draft, as 6053967589 itself promises: a one-line re-declaration on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024 of harness.org-context.test.ts and the two comment-only showcase files, and on [PM seat] domain:services — 🟢 zhuangjianguo · session_013j5gkUCpqQiti4GgPqqmnt #6021 of the new internal default-organization-invariant.ts (declared on the card in 6052936688, not on the lane post). Neither is a scope change; both are named in the body.
• Serial. feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 and feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 are still open and unmerged; neither shares a file with this PR (body, re-read this round). Whichever lands second merges main.
• Stale comments in plugin-sharing describing the old autoDefaultOrganization: false harness pin are noted in the body with no carrier; outside the declared set, docs-only, not blocking.
• CI on the head. Required contexts all success: TypeScript Type Check, Test Core (6/6 shards + rollup), Dogfood Regression Gate (3/3 + rollup), Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Governed Surface Queue Guard. Body-scoped checks re-ran after the round-3 body write (16:08Z) and concluded success, Check Changeset included (16:14Z). Console Pin Gate and the opt-in tarball smoke are skipped by their own conditions. No red check. The diff touches no governed surface.

Implemented-by: claude/issue-15195-default-org-load-bearing
Reviewed-by: session_01EUBvqtauTDmHi2ZgY759p2

VERDICT: PASS