feat(cli): os migrate organization-ownership --apply executes only the reviewed plan file (ADR-0131 D10, C7b S4)

[objectstack-fleet]

Part of #15211 (stage S4 of C7b; the other stages are this card's S1 and the split cards #23429 and #23430)

Clause-②: yes (widening)

What

os migrate organization-ownership --apply executes only the plan the operator reviewed (ADR-0131 D10). It compares the reviewed plan's inventory digest, tenancy posture and database. Which rows a --template-choice (or S1's --metadata-choice) deletes is not yet bound to the plan file: #23452 carries that binding, on top of this PR once it is on main.

BREAKING: --apply shipped in @objectstack/cli@18.0.0-next.1, and its bare invocation --apply --backup-taken (with or without --fate-supplement) is now refused, plan-file-required. The replacement is a plan run, then --apply --backup-taken --plan-file plan.json. The changeset carries the banner, the FROM → TO table, and an ADR-0087 ledger entry (cli-organization-ownership-apply-plan-file-required).

• --apply requires --plan-file FILE, the plan file a plan run wrote. Before it writes anything, it refuses:
  • plan-digest-mismatch when the inventory digest it computes differs from the file's, naming both digests and the remedy (plan again with the same flags, review, pass the new file);
  • plan-posture-mismatch when the run resolves another tenancy posture (OS_TENANCY_POSTURE / OS_MULTI_ORG_ENABLED) than the one the plan was computed under, naming both. The posture decides which rows attribution gives an owner and which it reports, and whether authored sets and positions are converted;
  • plan-database-mismatch when the file names another database.
• Two refusals come before the backup question and before the database is opened: plan-file-required (no flag) and plan-file-unusable (the file is not a plan, lacks its digest, posture or database, or cannot be read).
• A checkpoint recorded under another digest is no longer discarded silently. The reviewed plan supersedes it: every step runs again (each is idempotent), and the apply report names the discarded checkpoint in restartedFrom, beside reviewedPlan.
• No flag skips the comparison, and none is needed.

Why

Measured by spec seat 3 (6158876765). A plan made with fate supplement A could be applied with supplement B, which ran B's fates unreviewed, including a fate-2 deletion A never listed. The plan run writes no row (it is read-only), so the only place a plan can record its digest is the plan file. The apply never read that file.

Verification (head d7ef4bd6d7, base: main cb9841aa25, merged)

Delta round (review 6167948246, seat rulings):

• F5: main is merged; it did not conflict, and GitHub reported the PR dirty. The two tests main added get a reviewed plan.
  • organization-ownership-not-declared.integration.test.ts runs the plan first and passes its file.
  • organization-ownership-apply.served-catalog.integration.test.ts passes the reviewedPlan its run computes.
• F6: the changeset is minor with Clause-②: yes (widening), a BREAKING banner, a FROM → TO table and the ADR-0087 disposition.
  • The check refused not-required (no-migration-prescription) beside a FROM → TO prescription, so the bare invocation's retirement is registered as a D3 semantic entry, 18.cli-organization-ownership-apply-plan-file-required; @objectstack/spec gets patch.
  • The WHICH LEVEL rule reads the same as the ruling: the widening takes minor, and the narrowing is carried by the banner and the disposition, not the level.
• F4 revisited: both corrections of the consumed notes are reverted, and the diff against main no longer touches .changeset/pre/.

Earlier rounds (review 6165431301; the code is unchanged since): F1 (fate-supplement plan files), F2 (plan-posture-mismatch), F3 (the one-shot family reaches the apply's boot), and the pinned post-boot refusal mapping.

Checks, on the merged head:

• The whole cli integration tier, vitest run --project integration in 4 shards under the verify lock: 1,111 passed, 0 failed, 2 skipped. Both skips are in files this PR does not touch: preview-read-only.integration.test.ts (a cell that needs OS_TEST_POSTGRES_URL) and test/migrate-meta-default-range.test.ts (a skip in the source).

• The two new tests and the ceremony suites, run after the cli's dependency closure was rebuilt on the merged tree: 8 files, 89/89. Before that rebuild, served-catalog failed 3 cases on dists older than fix(cli,plugin-security): os migrate organization-ownership --apply resolves the built-in positions and the everyone baseline #23433, which the rebuild fixed.

• cli typecheck: exit 0. spec src/migrations: 209/209, with the registry regenerated (it is generated at install and untracked). check:upgrade-guide and check:spec-changes: exit 0.

• dispatch-gates --ran: 91 derived, 91 run, all exit 0, 0 NOT MEASURED. That includes check-adr-0087-registration and check-empty-changeset, which is green again now that the consumed notes are untouched.

• Narrowed lint of the 9 changed .ts files: 0 errors, 0 warnings.

• Reverse verification (ablation-replace, each restore verified blob == HEAD; earlier rounds, code unchanged since):

  Mutation	Pins that went red
  posture comparison removed	the posture pin
  the command's post-boot ReviewedPlanRefusal mapping removed	the mapping pin
  refuseUnreviewedPlan a no-op	the digest and database pins

• Dogfood (first round, bc3525a9cf), with the real os binary on a seeded showcase SQLite database: no plan file is refused; a tampered digest is refused, naming both, with no ceremony row written; the reviewed file runs.

Acceptance notes

• The flag is --plan-file, not the stage plan's --plan FILE. The ADR already names the bare read-only mode --plan.
• The pending notes of C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 and v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects #23280 are left as they are. Both shipped in 18.0.0-next.1 and are consumed into .changeset/pre/; seat answer Q-S4 A is withdrawn (6167948246). This PR's own note states that their bare invocation is now refused, and gives the replacement.
• The --template-choice gap (the apply deletes against groups recomputed at apply time, not against the plan file's templateConflicts) is carried by feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452. It builds one mechanism for both choice flags on this PR's ReviewedPlan, after this PR is on main.
• Not done, by the review's own grading: the digest and posture refusals could come before the boot (the review's first non-blocking weakness). The database comparison still reads the display label (its second).
• An observation, not caused by this PR. On a freshly seeded showcase database, --apply stops at rewrite: the grants --seed-admin writes (admin_full_access, organization_admin_no_bypass) name sets the ceremony's security catalog does not resolve. This diff touches neither that step nor the catalog composition. It is reported on the card for the ceremony family (6163356782).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/spec, touching 15 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/capabilities.mdx (via os migrate organization-ownership (command, read off packages/cli/src/commands/migrate/organization-ownership.ts))
• content/docs/permissions/permission-sets.mdx (via os migrate organization-ownership (command, read off packages/cli/src/commands/migrate/organization-ownership.ts))

What this run could not see

• 8 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 148 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 394f65e891f0ac6c6be708fb807740d5cb446520 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4ff2526dd03ba3ff39ca2465aa75579edb894914 — the merge of head d7ef4bd6d72fa79e16feb86a0417b56a5a8bda1c into base 394f65e891f0ac6c6be708fb807740d5cb446520, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4ff2526dd03ba3ff39ca2465aa75579edb894914 && git checkout 4ff2526dd03ba3ff39ca2465aa75579edb894914
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 394f65e891f0ac6c6be708fb807740d5cb446520 d7ef4bd6d72fa79e16feb86a0417b56a5a8bda1c && git checkout -B drift-repro 394f65e891f0ac6c6be708fb807740d5cb446520 && git merge --no-ff d7ef4bd6d72fa79e16feb86a0417b56a5a8bda1c

node scripts/docs-audit/affected-docs.mjs --json 394f65e891f0ac6c6be708fb807740d5cb446520

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 394f65e891f0ac6c6be708fb807740d5cb446520 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 66b826f9d9b159bfaf180fc8abde3cde44ec0f16
Local-runs: none

Read: the net diff origin/main...66b826f9d9 (6 files, +357/−10; merge base 5656c5638a, and main has not touched these files since), the PR body, card comments 6162365516, 6163669810, 6163356782, 6164220398, 6164948359, ruling 6163114098, pointer 6158876765, ADR-0131 D10 on origin/main, and the head's check-runs, last read at 2026-10-14T09:37Z. Nothing was built, run or re-run. Every test verdict below comes from reading the code, except the CI conclusions quoted.

① Derived judgments

F1 (must fix): a test on main that this PR leaves untouched now fails. packages/cli/src/commands/migrate/organization-ownership.fate-supplement.integration.test.ts came with #23348 and is in the CI-mandatory integration tier. Two of its cases run --apply --backup-taken without --plan-file:

• with --fate-supplement, the apply step receives the host row (line 147);
• control: without it, the apply step is handed no inventory (line 155).

At this head, runApply refuses plan-file-required before the boot and before applyOrganizationOwnership. So toMatchObject({ report: … }) and expect(apply).toHaveBeenCalledTimes(1) both fail. The dev's 33/33 covered two files only, not this one.

CI agrees. Test Core (3/6) failed at step 12 ("Run this shard's tests"), and its annotation reads packages/cli … pnpm run test exited (1). The required Test Core context failed with it. The failing case's name is not readable here: the proxy refused the job-log download. The failure is consistent with these two cases.

Remedy: give both cases a plan-shaped --plan-file. The apply is mocked there, so only the parse runs.

F2 (must fix, or the seat rules the narrower claim): the posture changes what the apply does, and it is neither in the digest nor compared.

• The plan file records posture. reviewedPlanFromFile reads only generatedAt, database and inventoryDigest.
• The posture comes from OS_TENANCY_POSTURE / OS_MULTI_ORG_ENABLED and is resolved separately on each run.
• Under single with a Default Organization, attribution gives every anchorless NULL row to that organization (organization-ownership-plan.ts, about line 811). That includes every application table, because APPLICATION_OBJECT_FATE is attribution with no anchors. Under isolated/group those rows are reported (fate 4, "never guessed").
• authored-conversion converts organization-authored sets and positions only under single; under a wall it reports them (apply.ts line 572).
• So a plan reviewed under isolated, which lists rows as reported, can be applied under single, which writes owners for them. Plan A runs as plan B through one environment variable, and the changeset's "executes only the plan the operator reviewed" does not hold.
• Remedy: compare posture (for example plan-posture-mismatch), with a pin and its ablation.

Other inputs outside the digest:

• --template-choice: apply-only by design. The plan lists each conflict and the operator chooses at apply, under 6020178017.
• The database's state between plan and apply (new rows, a new application table, a Default Organization created in between): D10 does not bind it, so it is not this stage's to bind.
• The ceremony's code: the digest covers the inventory, not the steps. A later release's CLI with an unchanged inventory accepts an earlier plan file. ceremonyVersion is in the file but not compared, so "another release" is caught only when the inventory moved. Not blocking.

Unreviewed plans: what is refused, and when.

• Refused before the backup question and before the boot, pinned with boot not called: no flag (plan-file-required), a missing file, not JSON, an apply report, an empty digest, a missing database (plan-file-unusable). --plan-file without --apply is refused as flag-without-apply.
• Digest and database mismatch are refused after the backup question and after the served boot, as the PR says. They are refused before the ledger read, before validateTemplateChoices, before every step, and so before mirror-deletion's gate re-read and before any UPDATE, DELETE or DDL. planFor issues SELECT only.
• Weakness (not blocking): inventoryDigest(inventory) is a pure function of the merged inventory, which runApply already holds. The digest refusal could come before the backup question and the boot. As built, the operator confirms a backup for an apply that will be refused, and a boot failure hides the mismatch. The claim that nothing is written before the refusal rests on the one-shot boot's no-write design. The dogfood measured sys_migration ceremony rows, not whole-database identity.
• Weakness (not blocking): plan-database-mismatch compares stack.dbLabel, a display string (describeDb: a DSN with credentials and query string stripped, a SQLite filename as written, or the client name when the config carries no address). It can wrongly accept two databases that differ only in the query string, two configs without an address, or a relative SQLite path resolved from another directory. The module's own describeDriverSqliteFile warns against reading identity off this string.

Checkpoint under another digest. A checkpoint is reused only when its digest equals the current digest, and after the refusal the current digest is the reviewed one. A checkpoint under another digest yields completed: {}, so no step the reviewed plan names is skipped. It is reported in restartedFrom (the superseded list) and announced by onProgress.

The refusal. It names the file and both digests (or both database labels), says that nothing was written, and gives the remedy (plan again with the same flags, review, pass the new file). Reason codes are stable, the --json error is apply_refused, and the exit code is 1. Gap: the command-level mapping of a ReviewedPlanRefusal raised after the boot (the catch branch in runApply) is pinned by no test. If that branch were removed, the refusal would surface as apply_failed with "re-run --apply to resume". Only the dogfood observed the mapping.

Do the tests fail when the comparison is removed?

• The ablation turned refuseUnreviewedPlan into a no-op, and both mismatch pins failed. That covers the database path too, since both checks live in that one function.
• The checkpoint-supersede path was not ablated. By reading, its pin fails if restartedFrom is dropped (toEqual), or if a checkpoint under a foreign digest is reused (resumedFrom would be non-empty and attribution would read checkpointed).

What on main invokes --apply without --plan-file:

• F1, above.
• F3 (must fix): schema-migrate.one-shot-family.integration.test.ts line 204 declares --apply --backup-taken … as this command's write mode. It is now refused before the boot, so the [finding] seven more dry-run / report-only CLI commands boot the app seed loader and rewrite seeded rows (the family of #21349) #21391 "a write mode runs no seed write" pin and the finding(cli): os secret orphans, a report that "writes nothing", composes the settings service with its default crypto provider, which mints a key file in the key home in a development posture with no key #21471 key-material pin pass without testing anything for this command. Nothing fails; the coverage is simply gone. Give that mode a plan file so it boots again.
• F4 is under ②.
• content/docs (capabilities.mdx, permission-sets.mdx) only mentions --apply in prose, which stays true. The CLI examples are updated.
• Stale, not blocking: the module doc's "It asks about the backup first", and the oclif description does not mention the plan file.

② Semver level

• patch with Clause-②: no is correct by the WHICH LEVEL rule. The command's released surface (18.0.0-next.0, CHANGELOG cc305a3) is the plan mode only. 22937-* and 23280-* are still pending in .changeset/, not in .changeset/pre/.
• --plan-file is refused outside the unreleased --apply, so no released invocation accepts a new key or loses one.
• reviewedPlan and restartedFrom sit on the unreleased apply report, and the plan payload is unchanged.
• The narrowing lands inside C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937's pending minor release (Clause-②: yes (widening)), so the combined level is unchanged.
• Q-S4 → A, as applied: the corrected example (--apply --backup-taken --plan-file plan.json) is accurate, and it runs as written at this head. Minor: the note's "The backup comes first" bullet now trails the plan-file refusal.
• Check Changeset fails only for the correction. In both runs only step 12 (Reject an empty-frontmatter changeset added by this PR) failed. Its one failure annotation names .changeset/22937-cli-organization-ownership-apply.md as a deliberate correction. ADR-0087 (step 13) and the major/level guard (step 15) are green.
• F4 (seat decision): the same defect in another note. .changeset/23280-host-fate-supplement.md line 20 is pending and minor: os migrate organization-ownership --fate-supplement host-fates.json --apply --backup-taken. At this head that invocation is refused as plan-file-required, so the compiled CHANGELOG would print it, which is the reason given for Q-S4 A. The seat's answer named C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937's note only. Either extend A to this note, with the confirmation on the PR, or rule otherwise.

③ Boundary flags

• Deviation, --plan-file instead of --plan FILE: accepted. D10 item 1 names the bare read-only mode --plan. The ADR does not yet record the plan-file precondition of D10 item 3; that ADR text belongs to docs(adr),plugin-security: retire the dead audience-anchor binding gate and restate the ADR text that names the C3-retired security modules (ADR-0138, 0094, 0126, 0131, 0103) #23403, not here.
• Deviation, the C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 note reverted and then corrected: answered by 6164948359 and stated in the PR body. The seat's on-PR confirmation is still owed at ACCEPT.
• Q-S4: answered A. F4 extends the same question to v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects #23280's note, unanswered.
• Dispatch item 4: no acknowledgement flag exists or is needed, and the refusal is loud with no silent re-plan. Met, except for F2's posture route.
• Out-of-scope finding, escalated (carrier: the seat): on a freshly seeded showcase database, rewrite stops on admin_full_access and organization_admin_no_bypass, which the ceremony's security catalog does not resolve. The diff does not touch it; it has not been re-run on bare main, and it needs a card.
• NOT MEASURED by the dev, but measured by CI on this head: the dev's 5 exit-3 gates all passed.
  • check-plugin-teardown-shape (Lint · CI, release & engine gates, step 53);
  • check:i18n, check:i18n-coverage and check:i18n-walk-parity (Type Check · consumer gates, steps 26–28);
  • check:dual-build-cjs-loads (Build Core, step 15).
• Gate verdicts on the head, all completed at 2026-10-14T09:37Z, none still running:
  • Test Core (a required context) failed, because Test Core (3/6) failed in the packages/cli suite (F1). Shards 1, 2, 4, 5 and 6 passed.
  • Check Changeset failed twice, by design (②).
• Not measured by anyone:
  • the posture-mismatch route (F2);
  • plan-database-mismatch and checkpoint supersede through the real binary;
  • whole-database identity after a digest refusal;
  • the name of the case that failed in shard 3/6 (the job log could not be read);
  • F3's file passes in CI, which is exactly the problem: it passes without testing the apply.
• Every other check-run on the head passed or was skipped.

Seat adoption (2026-10-14T09:39Z). Adopted after an audit of the reviewer transcript: one Write, to this record only; 70 Bash calls, all reads (git show, git diff, git ls-tree, REST GETs); no MCP call, no GitHub write, no worktree, build or test run. The seat re-read F1 on origin/main (the two cases at lines 147 and 155 of the fate-supplement integration test call --apply --backup-taken with no plan file) and F4 (.changeset/23280-host-fate-supplement.md:20). The seat rules:

• F1, F2, F3: fix in this PR. F2 compares the plan file's recorded posture against the running posture and refuses on a mismatch, with a pin and an ablation.
• F4: Q-S4 → A extends to this note too (the same class: a wording correction of an unreleased note). The PR body names both corrected sentences.
• Non-blocking: the stale wording (the module doc, the C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 note's backup sentence) rides this patch. The rest stays as noted.

Implemented-by: claude/issue-15211-c7b-plan-digest
Reviewed-by: session_01ADzJtzYTLUfgrRZHxkagkX

VERDICT: FAIL

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0802a12756f042750737f571072111c396702f24
Local-runs: none

Delta review against the FAIL record 6165431301 (head 66b826f9d9). The head has not moved since the brief. Read: the delta 66b826f9d9..0802a12756 (one commit, 9 files, +130/−30), the net diff from merge base 5656c5638a (9 files, +474/−27), the PR body, the dev report 6167752569, the seat answer 6164948359, and the head's check-runs, last read at 2026-10-14T12:04Z. To judge "any other test on main" and the semver premise, I also read current main (cb9841aa25) and a local git merge-tree of it with the head. Nothing was built, run or re-run. Every test verdict below comes from reading the code, except where a dev measurement is quoted.

① Derived judgments

F1, as ruled: fixed. In organization-ownership.fate-supplement.integration.test.ts, both --apply cases now pass --plan-file (writePlan(), a plan-shaped file that includes posture). Each keeps its pin: the host row reaches the mocked apply, and the control case is handed no inventory. The supplement-refusal case at line 205 still runs --apply without a plan file, which is correct: the supplement refusal fires in run() before runApply.

F5 (must fix): main moved, and two newer tests on main run the apply without a reviewed plan. The merge with main has no textual conflicts, so both tests land in the merged tree, and the merged tree breaks them:

• packages/cli/src/utils/organization-ownership-not-declared.integration.test.ts (fix(cli): the ceremony's column drops answer not-declared for a table the booted composition declares no object for #23446, merged 2026-10-14T09:28Z). Line 114 runs the real command --apply --backup-taken with no --plan-file, and it asserts payload.error is undefined. With this PR the run is refused as plan-file-required, so cases (i) and (ii) fail.
• packages/cli/src/utils/organization-ownership-apply.served-catalog.integration.test.ts (fix(cli,plugin-security): os migrate organization-ownership --apply resolves the built-in positions and the everyone baseline #23433, merged 2026-10-14T09:41Z). Line 121 calls applyOrganizationOwnership with no reviewedPlan:
  • at runtime, refuseUnreviewedPlan(run.plan, opts.reviewedPlan) reads inventoryDigest off undefined, so the single and walled cases throw a TypeError;
  • reviewedPlan is required in ApplyOptions, and packages/cli/tsconfig.json includes all of src, so by reading the cli tsc --noEmit also fails.

Nothing else invokes this command's --apply without a plan file:

• In packages/ and examples/ of the merged tree, the only other cases are the deliberate plan-file-required pin and the supplement-refusal case.
• content/docs/** mentions the command only in prose (capabilities.mdx, permission-sets.mdx), and that prose stays true.

Remedy: merge main, then give the first test a plan run and its file, and give the second test a reviewedPlan.

F2: fixed.

• refuseUnreviewedPlan compares reviewed.posture with plan.posture after the SELECT-only planFor. That is before validateTemplateChoices, the ledger read, and every step.
• The refusal is plan-posture-mismatch. It names both values, says that nothing was written, and gives both remedies: apply under the plan's posture, or plan again.
• The pin refuses, before any write, a plan computed under another tenancy posture asserts no writes, no checkpoint, and an unchanged database hash. By reading, it goes red without the comparison, because the digest and database match, so the apply would proceed. The dev measured that ablation red.
• Same source: both modes call resolveTenancyPosture() once in run(), before branching:
  • the plan run writes that value as plan.posture;
  • the apply passes the same value as opts.posture, which both planFor and the authored-conversion step read;
  • so the env vars are the same (OS_TENANCY_POSTURE, else OS_MULTI_ORG_ENABLED true means isolated, else single), and both sides compare the normalized value, with multi normalized to isolated.
• A plan file without posture is refused as plan-file-unusable, before the backup question and the boot. It is pinned.
• Still not compared: ceremonyVersion. It is the literal 1 on both sides, so comparing it would catch nothing until it is bumped. Non-blocking, as the baseline found. client follows the database label. I found no other recorded input that adds actions. Composition and catalog differences can only block a step, as fix(cli): the ceremony's column drops answer not-declared for a table the booted composition declares no object for #23446's not-declared shows.
• Like the digest refusal, the posture refusal still comes after the backup question and the boot (the baseline's non-blocking weakness, which the dev did not change).

F3: fixed.

• The one-shot family's --apply mode declares after: a plan run that writes the reviewed file. runBefore asserts that run returned no error.
• The [finding] seven more dry-run / report-only CLI commands boot the app seed loader and rewrite seeded rows (the family of #21349) #21391 write pin now asserts that the apply's own payload has no error. So it reaches the boot and the real applyOrganizationOwnership, and the seed pin tests this command again. The guard against a vacuous pass is sound.
• The finding(cli): os secret orphans, a report that "writes nothing", composes the settings service with its default crypto provider, which mints a key file in the key home in a development posture with no key #21471 pin reaches the boot too: once the preceding run has written a valid file, no refusal before the boot remains. Minor, non-blocking: like every mode, it asserts only that the error is not boot_failed, not that the apply reached its write.
• Measured locally by the dev (88/88), not by CI (③).

F4 and the riders, as worded: correct. As a remedy: overtaken (see ②).

• Both notes' examples now carry --plan-file plan.json. The C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 bullet now says the plan file comes before the backup question, and that is accurate.
• The PR body names both corrected sentences.
• The stale wording is fixed: the module doc, the oclif description, and the C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 backup bullet.
• The new mapping pin is sound. By reading, removing the ReviewedPlanRefusal catch branch sends the refusal to apply-failed, which emits error: apply_failed, and the pin's toMatchObject with apply_refused, its reason and both values goes red. The dev measured that ablation red.

Carried to S1 (#23452), not a FAIL here: --template-choice deletions come from groups recomputed at apply time.

• The report (out-of-scope item 1) describes the gap honestly. It leaves the placement to the seat and does not name feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452.
• The PR body names neither the gap nor its carrier.
• S4 overclaims nothing in substance: the note lists exactly three comparisons. But the headline "executes only the plan the operator reviewed" is unqualified.
• Rider: one line in the PR body naming feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452 as the carrier.

② Semver level

F6 (must fix, seat ruling): the premise behind patch / Clause-②: no has failed on main. --apply has shipped.

• The version commit 0c52e43075 (chore: version packages (next) #23382, 2026-10-14T10:19Z) consumed 22937-cli-organization-ownership-apply.md and 23280-host-fate-supplement.md into .changeset/pre/.
• packages/cli is now 18.0.0-next.1, and its CHANGELOG prints both bare invocations at lines 44 and 60: --apply --backup-taken and --fate-supplement host-fates.json --apply --backup-taken.
• github-actions pushed the tag @objectstack/cli@18.0.0-next.1 at 2026-10-14T11:58Z. Release run 38551831636 was in its "Publish to npm + push version tags" step at 2026-10-14T12:00Z.

What follows:

• The changeset's "--apply has not shipped in a release yet (its changeset is still pending), so no released invocation changes" is false, and so is the PR body's matching acceptance note.
• On the released surface, this PR adds a new accepted flag (--plan-file), new keys on the apply report (reviewedPlan, restartedFrom), and new reason values. The delta's plan-posture-mismatch and its posture requirement add to these. Together they are a widening. By WHICH LEVEL that means at least minor with Clause-②: yes (widening).
• The PR also refuses the released invocation --apply --backup-taken. That is a narrowing. In the launch window, that kind of break is carried by the BREAKING banner plus the ADR-0087 disposition, not by the level.
• The baseline's "the narrowing lands inside C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937's pending minor" no longer holds.
• The seat rules the level, the declaration and the banner. The PR's own note must then say that the released bare invocation is now refused.

F4 re-opened by F6.

• Q-S4 A's class, "a wording correction of an unreleased note", no longer applies.
• In the merged tree the two edits land on .changeset/pre/22937-… and .changeset/pre/23280-…, which are consumed notes. They change nothing in the published 18.0.0-next.1 CHANGELOG.
• Seat decision: keep or revert those edits, and carry the correction in this PR's own note instead.

③ Boundary flags

• Gate verdicts on the head: none exist.
  • At 2026-10-14T12:04Z, 0802a12756 had 0 check-runs and 0 workflow runs. Five check suites (vercel, fly-io, claude, cloudflare-workers-and-pages, objectstack-fleet) were queued, with no runs.
  • GitHub reports the PR mergeable: false and mergeable_state: dirty.
  • refs/pull/23437/merge is still 9aa1106aa7, the merge of the previous head 66b826f9d9.
  • So nothing failed and nothing is running, but nothing is measured. That includes Test Core, which was red at the baseline over F1, and Check Changeset.
• Dev deviation, "Main was not merged (the push did not conflict)": that was true locally, for the text only. GitHub says the PR is dirty, and the merged tree breaks the two tests (F5).
• Dev claims not measured by CI: 1,105/0/2 for the integration tier, 83/83, 88/88, typecheck 0, the two new ablations, dispatch-gates at 65 of 65, and check:query-options-erasure red once (attributed to a race) and then exit 0 when run alone.
• Out-of-scope 1 (--template-choice binding): carried to S1 (feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452) by the seat (①).
• Out-of-scope 2 (the digest and posture refusals could come before the boot; the database comparison reads the display label): left undone, as the baseline's non-blocking grading allows.
• The showcase rewrite stop on admin_full_access and organization_admin_no_bypass is reported on the card (6163356782). Since then, fix(cli,plugin-security): os migrate organization-ownership --apply resolves the built-in positions and the everyone baseline #23433 on main touches how the ceremony resolves built-in positions. Whether that bears on the stop is not measured.
• Not measured by anyone:
  • every CI gate on this head;
  • the posture route through the real binary;
  • the merged tree's four failing cases and the tsc failure, which come from reading only;
  • how Check Changeset treats edits to .changeset/pre/ notes;
  • whether the npm publish of 18.0.0-next.1 completed (the tag is pushed and the step was in progress).
• Note on my reads: git fetch auto-followed release tags into the shared checkout's local refs and advanced origin/main there. Nothing else was written outside this record.

Seat adoption (2026-10-14T12:06Z). Adopted after an audit of the reviewer transcript: one Write, to this record only; 60 Bash calls, all reads (git reads with fetches into local refs, REST GETs); no MCP call, no GitHub write, no worktree, build or test run. The seat confirmed F6 on origin/main: packages/cli/CHANGELOG.md (version commit 0c52e43075, #23382) prints both bare invocations at lines 44 and 60. GitHub reports this PR mergeable: false. The seat rules:

• F5: merge main. A conflict is a reason ruling [Decision] After a PR is open, merge main only on a conflict, a main-caused CI red or a queue removal, and re-check only the overlap; or keep merging main before every push #23390 allows. Give both new tests a reviewed plan: organization-ownership-not-declared.integration.test.ts and organization-ownership-apply.served-catalog.integration.test.ts. Run the cli typecheck and the whole cli integration tier on the merged head.
• F6, the level: --apply is released in @objectstack/cli@18.0.0-next.1. This PR adds a flag and refusal codes, which is a widening, and it refuses a released invocation, which is a narrowing. So the changeset is minor, the body says Clause-②: yes (widening), and the note carries the BREAKING banner naming the refused invocation and its replacement, with the ADR-0087 disposition the repo's checks require. Where the WHICH LEVEL rule in .github/workflows/pr-automation.yml or the ADR-0087 check reads otherwise, follow the rule and say so in the PR.
• F4, revisited: revert both corrections of the consumed notes (#22937, #23280). They now sit in .changeset/pre/ and change nothing published. This PR's own note states that 18.0.0-next.1's --apply --backup-taken is refused, and gives the new invocation with --plan-file. Q-S4 → A is withdrawn by this ruling, because its premise ("unreleased note") no longer holds.
• The carrier rider: the PR body names feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452 as the carrier of the --template-choice gap.

Implemented-by: claude/issue-15211-c7b-plan-digest
Reviewed-by: session_01ADzJtzYTLUfgrRZHxkagkX

VERDICT: FAIL

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d7ef4bd6d72fa79e16feb86a0417b56a5a8bda1c
Local-runs: none

Third-round delta review against the FAIL record 6167948246 (head 0802a12756). The head has not moved since the brief. Read: the four commits after 0802a12756 (the revert 91db38b7c0, the merge 15ebc0208f of main at cb9841aa25, then c07af11aa8 and d7ef4bd6d7); the net diff cb9841aa25...d7ef4bd6d7 (10 files, +526/−26) against the old net diff 5656c5638a...0802a12756 (9 files, +474/−27); the PR body; the dev report 6170134203; the WHICH LEVEL rule in .github/workflows/pr-automation.yml; scripts/check-adr-0087-registration.mjs, the semantic registry and its precedents; and the head's check-runs, last read at 2026-10-14T14:34Z. Nothing was built, run or re-run.

Unchanged since the baseline, not re-judged. Of the old net diff's code and tests, six files carry the same added and removed lines against their new base: the command, organization-ownership-apply.ts, its unit test, the apply-flags test, the fate-supplement integration test and the one-shot family. What changed: the two main tests (+3, +13/−2), the changeset (rewritten), one new registry file, and the two consumed-note edits (gone).

① Derived judgments

F5: fixed.

• main is merged. The merge 15ebc0208f carries no hand resolution (its combined diff is empty), GitHub now reports mergeable: true, with mergeable_state: clean at the last read (it was dirty at the baseline), and a git merge-tree of the head with today's main (394f65e891) is clean.
• organization-ownership-not-declared.integration.test.ts: applyIn now runs the real plan (--out plan.json, same --database-url, same process env, so the same posture and database label, no supplement on either side), clears stdout, then runs --apply --backup-taken --plan-file plan.json. The pins are untouched: summary.notDeclared, the named blocker, the kept column, the in-run control, the dropped control column, and exit 1 in case (i). No vacuous pass: the plan run's own outcome is not asserted, but a plan run that fails writes no file, and the apply then answers plan-file-unusable, which the existing payload.error toBeUndefined assertion turns red.
• organization-ownership-apply.served-catalog.integration.test.ts: ceremony() now passes a reviewedPlan with every ReviewedPlan field: inventoryDigest() over the default inventory (the run passes none), the case's own posture (single / isolated), and database v17, matching opts.database. By reading, refuseUnreviewedPlan passes, and the cases still pin the catalog's built-ins and the zz_undeclared blockers. The plan is self-computed, which is right for a test that pins the catalog, not the refusal.
• No other caller without a plan, on the head and on its merge with today's main (the same file set):
  • applyOrganizationOwnership has three callers: the command (passes reviewedPlan), the served-catalog test, and the unit-test apply helper (defaults reviewedPlan; main's added column-drop case goes through it).
  • In packages/ and examples/, the other --apply mentions are prose: schema-migrate.ts, security-plugin.ts, builtin-positions.declaration-phase.test.ts, and json-stdout-purity.e2e.test.ts, which drives only the bare plan form.
  • content/docs/**: capabilities.mdx and permission-sets.mdx name --apply in prose that stays true. environment-variables.mdx matches only an ADR link.

F6: fixed.

• The changeset is '@objectstack/cli': minor plus '@objectstack/spec': patch. It says Clause-②: yes (widening), as does the PR body.
• The BREAKING banner names the narrowing and the release (18.0.0-next.1), and it lists the widening: the flag, the reasons, reviewedPlan and restartedFrom.
• The FROM → TO is true.
  • origin/main's packages/cli/CHANGELOG.md prints both bare invocations under ## 18.0.0-next.1 (lines 44 and 60), and the GitHub Release @objectstack/cli@18.0.0-next.1 was published at 2026-10-14T12:08Z.
  • Both rows' TO is what runApply does: plan-file-required before the backup question and the boot.
  • Row 3's "(no such flag)" is right for next.1.
  • The "has not shipped" sentence is gone.
• The D3 entry is right in shape and placement.
  • The file is packages/spec/src/migrations/entries/semantic/18.cli-organization-ownership-apply-plan-file-required.ts, named major.id.ts per entries/README.md. registry.ts is generated and git-ignored, so the one file is the whole registration.
  • Its id matches the file name and the changeset's adr-0087: registered marker. It sets surface, replacement, reason and acceptanceCriteria, which is the SemanticMigration shape, with no conversionIds (none applies).
  • It has no relevantWhen, which the type requires here: the surface lives in no stack key.
  • It matches the precedents for a non-spec breaking change registered in the ledger: a package bumped minor plus @objectstack/spec: patch, with the same marker (cab6396715, plugin-security; 1f0469655f, trigger-record-change).
  • It is the first entry whose surface is a CLI invocation. Its peers name REST, client or session surfaces outside the schema in the same way.
• Published spec surface beyond the row: none. No schema, export or type changes. The row reaches the generated, uncommitted projections (the built registry, os migrate meta's protocol-18 TODOs, the generated upgrade guide), which is what registration is for.
• Check Changeset, the job that runs check-adr-0087-registration and the level axis, is green on the head (both runs).

F4: fixed. The rider: met.

• .changeset/pre is the same tree (4502ba3aac) on the head, on the merge base and on today's main.
• The notes pre/22937-cli-organization-ownership-apply.md (4b2c410f71) and pre/23280-host-fate-supplement.md (66488a6a3b) are byte-identical to main, and the net diff touches no .changeset/pre/ path.
• The PR body names feat(cli): the organization-ownership ceremony carries the sys_metadata organization layer into the environment, and a choice deletes only the rows the reviewed plan listed (ADR-0131 D10, C7b S1) #23452 as the carrier of the --template-choice binding, both under What and in the acceptance notes. No "has not shipped" claim is left.

The merge breaks no earlier "right" finding. main's side touches the PR's code only through #23446 (a not-declared column-drop outcome, its blocker and summary.notDeclared) and #23433 (the security plugin's init() and the catalog). Neither moves an input of refuseUnreviewedPlan:

• inventoryDigest reads the inventory alone;
• posture is resolved once in run();
• database is stack.dbLabel on both sides.

The refusal order is still: planFor, then refuseUnreviewedPlan, then validateTemplateChoices, then the ledger and the steps. plan-file-required and plan-file-unusable still come before the backup question and the boot.

② Semver level

minor is right under WHICH LEVEL.

• --apply is released in 18.0.0-next.1. This PR adds an accepted flag, --plan-file, new reason values and two report keys. That is a widening, so at least minor.
• It refuses the released bare invocation. That is a narrowing, and in the launch window it is carried by the BREAKING banner plus the ADR-0087 disposition, not by the level. Both are present.
• Clause-②: yes (widening) with the moved cli package at minor satisfies the level axis in check-changeset-no-major.
• @objectstack/spec: patch releases one more registry row and nothing else, which fits its precedents.

③ Boundary flags

• Gate verdicts on the head (2026-10-14T14:34Z): 48 check-runs, all completed: 40 success, 8 skipped, none failed and none running. That includes Check Changeset (both runs), Build Core, all six Test Core shards and their Test Core roll-up, all four Type Check jobs, every Lint job, and Spec property liveness. The skipped ones are conditional jobs: Build Docs, Console Pin Gate, the dogfood matrix and Verify CLI, the packed-tarball smoke, Temporal Conformance, and one run each of Auto Label and Check PR Size. Not read: the job logs. So the claim that the Test Core shards collected the two .integration.test.ts files comes from the cli config (the integration tier runs in queue mode and only *.e2e files are nightly), not from a log line.
• Dev deviations (6170134203):
  • The disposition is registered with a D3 entry, not not-required, because the check refused not-required (no-migration-prescription) beside a FROM → TO table. The seat's ruling allowed this ("follow the rule and say so"), and the PR body says so. The new @objectstack/spec patch release follows from it.
  • The dev saw served-catalog fail 3 cases locally before rebuilding the cli's dependency closure, on dists older than fix(cli,plugin-security): os migrate organization-ownership --apply resolves the built-in positions and the everyone baseline #23433. That is a local artefact; CI builds fresh.
• Dev numbers CI does not reproduce as numbers:
  • Covered by green CI on this head: the cli integration tier at 1,111/0/2, 89/89, the cli typecheck at 0, spec src/migrations at 209/209 (Test Core, Type Check), and dispatch-gates at 91/91 (Lint · PM dispatch-gates).
  • Not tied to a check-run here: check:upgrade-guide and check:spec-changes at 0, and narrowed lint at 0.
  • The earlier ablations still stand, since no runtime code moved.
• Non-blocking, outside the findings:
  • The PR body's acceptance note calls the C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 and v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects #23280 notes "pending" in the same sentence that says they shipped.
  • The PR title reads feat(cli): without !, while the note's own title is feat(cli)!:. I found no rule that requires the mark, so this is not judged.
  • The D3 entry sits in the protocol-18 step, although no 17.x consumer had the surface. The ledger is per-major, so that step is its only home.
• Not measured: the posture route through the real binary; whether the showcase rewrite stop (6163356782) moved with fix(cli,plugin-security): os migrate organization-ownership --apply resolves the built-in positions and the everyone baseline #23433; anything about today's main beyond a clean merge-tree and the same caller set.
• My reads: the git fetch advanced refs/review/pr-23437 and origin/main in the shared checkout, and git merge-tree --write-tree wrote tree objects to its object store. No working-tree file, branch or worktree was touched.

Seat adoption (2026-10-14T14:35Z). Adopted after an audit of the reviewer transcript: its writes are this record and scratch files under the brief's directory; 71 Bash calls, all reads (git show, git diff, git merge-tree, REST GETs); no MCP call, no GitHub write, no worktree, build or test run. The seat re-ran the landing prechecks on d7ef4bd6d7:

• ci-failure.mjs exits 0;
• check-governed-merges.mjs reports no governed path and 552 lines;
• git merge-tree against origin/main exits 0;
• the body carries no closing keyword (Part of #15211).

The three ③ nits do not block; the PR title's missing ! matches no rule.

Implemented-by: claude/issue-15211-c7b-plan-digest
Reviewed-by: session_01ADzJtzYTLUfgrRZHxkagkX

VERDICT: PASS