feat(objectql,plugin-auth): the Default Organization is load-bearing under `single`; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11)

[hotlong]

⛔ BLOCKED — the v18 development line is not open.

Blocked-by: #15193

_{History: this line read Blocked-by: #15193 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

---

In one sentence. In a single-tenant deployment the one organization must exist before anyone writes anything, because from now on every row has an owner; a write that arrives without an organization is refused in every posture, and only single-tenant can derive the owner.

Scope. (1) ensureDefaultOrganization (packages/plugins/plugin-auth/src/ensure-default-organization.ts) becomes a boot invariant under single: failure is a boot error, not a best-effort warning; it runs before application seed datasets load (SeedLoaderService.load, packages/metadata-protocol/src/seed-loader.ts) and before the first authenticated request — today seeds land during start() and the organization is created by a later sign-up, so a first boot's business seeds (and every sys_business_unit seed, #14547) land NULL. (1b) The seed loader's exemption of sys_ / cloud_ / ai_ seeds from organization stamping (fallbackOrgId never applied to platform seeds) is withdrawn: there are no platform-global seeds left; every seed row is stamped with the resolved organization or the load refuses (D9). seed-tenancy-backfill.ts becomes the attribution path for existing first-boot residue (C7). (2) resolveSystemInsertOrganization (packages/objectql/src/tenancy/system-write-organization.ts): derived only when exactly one organization exists (single), refused otherwise, in every posture; the unclassified branch and the isPlatformObjectOutOfTenantAuditScope gate are bypassed for objects carrying the column (C8 removes them outright). Message per ADR-0123 D4. (3) ⛔ No default to any other owner — the "platform organization" was considered and rejected in ADR-0131 §5.

Collision to read before starting: #11973 (platform-admin re-anchor L3) re-points the same ensure-default-organization function and moves the same trigger. Its re-pointing half is absorbed here; its last-admin-guard re-pricing half is not and stays on that card. Read it first and say in the PR body which half you found already done.

Acceptance. Fresh single boot: the Default Organization is present before the HTTP listener accepts, and an isSystem insert on a tenant-column object with no organization lands stamped with it. Fresh isolated / group boot: the same insert is refused with a message naming the missing organization — positive control: the identical insert carrying tenantId succeeds.

⛔ Stop and report rather than proceeding: touching applyTenantScope (C8 owns it); editing any seeder (C3 owns them).

Refs: ADR-0131 D3, D9, D11 · ADR-0093 · ADR-0123 D2–D4 · #8844 · #14547.

[objectstack-fleet]

v18 pre-opening re-verification (C1): DRIFTED. Still valid, nothing landed. Three new seams must be in scope

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:35Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds:

• ensureDefaultOrganization is still best-effort and runs after an admin exists (plugin-auth/src/ensure-default-organization.ts:317; the warn-only wiring is auth-plugin.ts:1151-1196).
• Seeds still land before any organization exists (runtime/src/app-plugin.ts:1613-1650).
• The sys_/cloud_/ai_ exemption is now at metadata-protocol/src/seed-loader.ts:1190.
• The unclassified early return is at objectql/src/engine.ts:~5762.

Corrections:

• Wrong pointer: resolveSystemInsertOrganization is the private method at objectql/src/engine.ts:5745. system-write-organization.ts exports the pure resolveSystemWriteOrganization (:263).
• Drop the platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 paragraph: it closed completed on 09-28. Both halves landed in 4f65837a7f before this card was cut.

New seams, not in the card:

• The once-only owner bind (fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813, 149153c252, ADR-0093 D7). The live path is createEnsureDefaultOrganizationOnce (plugin-auth/src/default-org-bootstrap-once.ts:55), decided once in the sys_migration ledger.
  • New users are also bound as member at creation (reconcile-membership.ts:196).
  • Read, not measured: creating the Default Organization before the first sign-up could bind the first admin as member, and the once-only bind would then skip the owner bind.
  • Added acceptance pin: the first admin of a fresh single deployment is the owner.
• @objectstack/organizations (c677cda816): the walled-posture bootstrap (organizations-plugin.ts:476) and claimOrphanOrgRows (claim-orphan-org-rows.ts:62).
• The tenancy census gate: scripts/check-platform-object-tenancy-census.mjs and its JSON (26144c2046). Any reclassification touches it.

Family: #21057 is this card's business-unit symptom. Its fix (stamp the seed) lands here, so it now carries Blocked-by: #15195.

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlocked, pm:blocked → pm:queue. The v18 line is open: #15193 was closed on the maintainer's word. C1, dispatchable first

Blocked-by: none

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:32Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released:

• [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 closed completed in this act (6037915987), on the maintainer's words in the triage seat's chat: 「我建议直接启动 v18 开发吧」, 「你应该先解锁 v18 所有的卡片」, 「同意」.
• The ruling record is decision: open v18 now and ship it in stages — release the last 17.x from main first without waiting for #21908's deny (A), skip the last 17.x (B), or keep #22009's order (C)? #22050 6037890422 (B: v18 develops on main, with no last 17.x).
• This card's Blocked-by: named [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 alone.

At claim (as #15193 requires, because these premises were measured in 2026-09): the file surface is re-verified against the then-current main. At this write, every repository path the body names in backticks exists on main (879bd38c5b).

• Order: ADR-0131 §8 makes C1, C2, C4 and C6 dispatchable first. C3 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204) and C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) wait on this card.

The release state:

• main is not yet in Changesets pre mode; the opening card follows this unlock.
• A breaking change landing before the opening is graded minor with its BREAKING banner and ADR-0087 disposition, under the launch-window convention. Once pre mode is in, major is open.
• ⛔ chore: version packages #21988 is not merged.

[objectstack-fleet]

Claim: PM loop round 61 · 2026-10-07T13:33Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-15195-default-org-load-bearing
Worktree: objectstack-issue-15195
Domain: domain:engine (the card also reaches plugin-auth and @objectstack/organizations, which are domain:services. This seat holds the card whole and declares those files on #6021 before the build.)
Seat: domain:engine#1
Provenance:

• ADR-0131 C1, part of [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194. Triage re-verified it before the opening (6018598650: DRIFTED, three new seams) and unlocked it to pm:queue (6037983378): [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 closed on the maintainer's word, with ruling decision: open v18 now and ship it in stages — release the last 17.x from main first without waiting for #21908's deny (A), skip the last 17.x (B), or keep #22009's order (C)? #22050 B (v18 develops on main). C1 is dispatchable first.
• This card is public: classes, positions and functions only, with no withheld detail.
• The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」). finding(objectql): skipAutomations also skips ObjectQL's own audit stamp — sys_stamp_audit_insert/update are bound through bindHooks, so they carry meta, and a data import with "run automations" unchecked writes rows without created_by/updated_by #22070 is claimed in the same round.
  File surface (at origin/main 3d9188502e), per the body as corrected by triage's re-verification 6018598650. The corrections are applied here; the body is not rewritten.
• (1) The boot invariant under single. plugin-auth's ensureDefaultOrganization (ensure-default-organization.ts) and its once-only path, createEnsureDefaultOrganizationOnce (default-org-bootstrap-once.ts, ADR-0093 D7, the sys_migration ledger):
  • failure is a boot error;
  • it runs before application seed datasets load (runtime/src/app-plugin.ts's seed load and SeedLoaderService.load) and before the first authenticated request.
• (1b) The seed exemption is withdrawn. metadata-protocol/src/seed-loader.ts's sys_/cloud_/ai_ exemption from organization stamping (about :1190) is removed: every seed row is stamped with the resolved organization, or the load refuses (D9).
  • seed-tenancy-backfill.ts's attribution of existing residue is C7's, not this card's.
• (2) The derivation rule. objectql's private resolveSystemInsertOrganization (engine.ts about :5823; triage's pointer correction) derives only when exactly one organization exists (single) and refuses otherwise, in every posture.
  • The unclassified branch and the isPlatformObjectOutOfTenantAuditScope gate are bypassed for objects carrying the column. C8 removes them outright.
  • The message follows ADR-0123 D4.
• The new seams (triage):
  • the once-only owner bind, and reconcile-membership.ts's member-at-creation. Triage read, without measuring, that creating the Default Organization before the first sign-up could bind the first admin as member;
  • @objectstack/organizations' walled-posture bootstrap (organizations-plugin.ts) and claimOrphanOrgRows;
  • the tenancy census gate (scripts/check-platform-object-tenancy-census.mjs and its JSON), if a reclassification touches it.
• (3) ⛔ No default to any other owner (ADR-0131 §5).
• Stop and report rather than proceed (the body): touching applyTenantScope (C8 owns it), or editing any seeder (C3, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, owns them). Also stop on any change the measurement shows needs packages/spec (an error-code ledger entry, for example): that is a spec-lane surface and owes a contract review.
• Acceptance pins:
  • a fresh single boot has the Default Organization before the HTTP listener accepts, and an isSystem insert on a tenant-column object with no organization lands stamped with it;
  • a fresh isolated / group boot refuses the same insert with a message naming the missing organization, and the identical insert carrying tenantId succeeds (positive control);
  • the first admin of a fresh single deployment is the owner (triage's added pin).
• .changeset/15195-*.md.
  Container & model: L, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate; this is the seat's call for a p1 security boot invariant across three packages).
  Clause-②: no (narrowing)
• Provisional. Writes accepted today without an organization (unstamped system inserts in isolated / group, and unstamped platform seeds) are refused.
• BREAKING: minor under the launch-window convention (Changesets pre mode is not in yet, per triage 6037983378), a ! subject, an ADR-0087 disposition and a remedy.
• The dev measures the built entry declarations and the accept set. If the measurement reaches packages/spec, the seat revises this line and a contract review is owed.
  Thread-read: 6037983378
  Serial constraints cleared: at 2026-10-07T13:33Z:
• Open PRs (chore: version packages #21988, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974), each file list read by filename: none touches plugin-auth's default-organization files, seed-loader.ts, objectql/src/engine.ts, objectql/src/tenancy/, runtime/src/app-plugin.ts, @objectstack/organizations or the tenancy census.
• In flight elsewhere:
  • feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 (domain:services seat 2, claim 6038279203) is a measurement-only census round, with no build.
  • domain:spec's feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 (6038330914) edits injected-system-columns.ts and five platform-objects system objects, and ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082 (6038457723) respells declared indexes. Neither holds a file of this card.
• This lane's finding(objectql): skipAutomations also skips ObjectQL's own audit stamp — sys_stamp_audit_insert/update are bound through bindHooks, so they carry meta, and a data import with "run automations" unchecked writes rows without created_by/updated_by #22070 edits engine.ts's hook skip (about :4200), a different region from resolveSystemInsertOrganization. Whichever lands second merges main.
• [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 is Blocked-by: #15195. refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 (C3) and feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5) wait on this card.

[objectstack-fleet]

os-dev-report

{
  "issue": 15195,
  "status": "needs_decision",
  "branch": "claude/issue-15195-default-org-load-bearing",
  "pr": null,
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (subagent: the dispatching PM session's id)",
  "premise_still_valid": true,
  "summary": "Stop condition fired before the first edit: the derivation rule as ruled (the isPlatformObjectOutOfTenantAuditScope gate bypassed for every object carrying the column, refused otherwise in every posture) cannot land without editing C3-owned seeders or moving C5/C6 surfaces, so this returns needs_decision with no code and no PR. Measured on base 3d9188502e with real showcase boots: on a fresh single boot every seed row lands organization_id NULL in start() (41 rows read back on 6 objects, 5 of them sys_business_unit), no organization exists at kernel:listening, and seeds are never re-owned after the org appears; on isolated, pin (b) already holds for app objects. Read, not measured (two prototype experiments were refused by this session's permission classifier): the bypass would stamp the single-posture first-user grant with the Default Organization and so remove the first admin's platform standing, stamp env-layer sys_metadata rows, and refuse a walled boot's own sys_capability seeder and sys_migration ledger writes. Recommendation: option B in open_questions (land the boot invariant, seed stamping, owner pin and the in-scope derivation rule now; the gate bypass stays with C8, where ADR-0131 section 8 and D13 already put it).",
  "tests": "No code change, so no package tests or typechecks were run. Measurement runs at base 3d9188502e (worktree clean, git diff HEAD empty): closure build `pnpm turbo run build --filter='@objectstack/dogfood^...' --concurrency=2` under os-verify-lock → `Tasks: 63 successful, 63 total`, `VERDICT command-exit 0`; `@objectstack/organizations` build → `Tasks: 28 successful`, `VERDICT command-exit 0`. Five probe boots of examples/app-showcase through @objectstack/verify bootStack with a probe plugin recording every engine insert (temporary dogfood test file, removed by trap, never committed), each `Tests 1 passed (1)`, `VERDICT command-exit 0`: base-single-signup (harness default bootstrap off), base-single-none (bootstrap on, no admin: orgsAtListen [] then the harness orgContext guard refused the stack, as expected), base-single-dev (bootstrap on, dev admin signs up at kernel:ready), base-isolated (multiTenant true via a scratch host that declares @objectstack/organizations, OS_AUTH_MEMBERSHIP_POLICY=invite-only). No reverse verification or ablation: nothing was implemented.",
  "mcp_calls": "0",
  "api_writes": "1 - POST /repos/objectstack-ai/objectstack/issues/15195/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write. No pr_create, no label-write.",
  "gates": "n/a - no diff exists (needs_decision before the first edit), so dispatch-gates derives an empty change set; none of the dispatch-listed gates were run.",
  "line_budget": "n/a",
  "files_changed": [],
  "clause_2": "NOT MEASURED: no implementation, so no built entry declarations and no accept set to read. The claim's provisional `no (narrowing)` stands for the card as ruled. Under option B the narrowing is: in single, a seed load and a system insert on an in-scope object with zero or several organizations are refused where they land NULL today; nothing reaches packages/spec (the refusal reuses ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, already in packages/spec/src/api/error-code-ledger.zod.ts:684).",
  "deviations": [
    "Two experiments were refused by this session's permission classifier (reason given: Security Weaken) and were not retried by any other route: (1) an uncommitted prototype removing the isPlatformObjectOutOfTenantAuditScope early return in packages/objectql/src/engine.ts:5841 to measure the ruled bypass on single and isolated boots; (2) a probe that pre-creates the slug=default organization in a probe plugin's start() to measure H2. A plain read of packages/plugins/organizations/src/claim-orphan-org-rows.ts and an aggregation of my own probe output were refused the same way. H2, the bypass consequences and claimOrphanOrgRows are therefore READ or NOT MEASURED, and are labelled so below.",
    "Probe boots used a temporary file packages/qa/dogfood/test/zz-probe-15195.dogfood.test.ts (domain:cli's path) copied in per run and removed by an EXIT trap; it was never staged or committed (git status --porcelain empty after every run).",
    "bootStack pins autoDefaultOrganization to false unless orgContext is set (packages/verify/src/harness.ts:571), so the first single run did not model production; the later single runs set orgContext: true.",
    "Walled boots refuse an undeclared membership policy; the isolated probe declared OS_AUTH_MEMBERSHIP_POLICY=invite-only, as a walled deployment must.",
    "Cross-lane: #6021 carried no reply to declaration 6039104553 when read; no build commit was pushed, so the re-read-before-first-build-push step was never reached."
  ],
  "H1": "CONFIRMED (measured). Inline seeds run in AppPlugin.start() under single (packages/runtime/src/app-plugin.ts:1440-1466; walled skips it at :1433-1439). The seed loader stamps only when exactly one organization already exists (packages/metadata-protocol/src/seed-loader.ts:625-626, :1720-1731), and none does: base-single-signup and base-single-dev read back 41 seeded rows on 6 objects, all organization_id NULL. ensureDefaultOrganization creates the org only once a platform admin exists (packages/plugins/plugin-auth/src/ensure-default-organization.ts:353-373 returns no_admin first) and is wired warn-only (packages/plugins/plugin-auth/src/auth-plugin.ts:1150-1199, catch at :1171-1175). base-single-none measured organizations [] at kernel:listening; the listener opens only on kernel:listening (packages/plugins/plugin-hono-server/src/hono-plugin.ts:705-709). The seed tenancy handoff on the org insert (app-plugin.ts:1652-1679) did not re-own the seeds: base-single-dev still read 41 NULL rows after the org existed.",
  "H2": "CONFIRMED BY READING, NOT MEASURED (the measuring probe was refused). Once a Default Organization exists, a new user's creation binds them as member (packages/plugins/plugin-auth/src/reconcile-membership.ts:235-259, role member at :196, target from tenancy.defaultOrgId(), packages/plugins/plugin-auth/src/tenancy-service.ts:505-545). The owner bootstrap then finds a membership and yields admin_already_in_org (ensure-default-organization.ts:377-384), and the once-gate records that as decided (packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts:89-106). So with the org created at boot, the first admin ends as member and the decision is recorded. Base, with no org before the admin (base-single-dev): admin is owner, posture PLATFORM_ADMIN. Any implementation of (1) must make the owner bind promote the reconciler's own member row on the Default Organization while the bind is undecided.",
  "H3": "CONFIRMED with one correction. One call site: ObjectQL.insert (packages/objectql/src/engine.ts:13603) → resolveSystemInsertOrganization (:5823-5868) → pure resolveSystemWriteOrganization (packages/objectql/src/tenancy/system-write-organization.ts:263-275). Every system insert reaches it: app seeds, per-org replay, bootstrap seeders, ledger rows, first-user grant, the reconciler's sys_member (better-auth tables carry no column). Base behaviour, measured: single with 1 org derives (base-single-dev acceptance insert stamped); single with 0 orgs lands NULL (base-single-signup); isolated refuses (base-isolated, ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, and the tenantId control lands); several orgs under single refuse ambiguous-organization (read, :274). The gate at engine.ts:5841 exempts 49 of the 57 column-carrying platform objects (scripts/platform-object-tenancy-census.json: 57 in reach; packages/objectql/src/tenancy/platform-object-tenancy.ts admits 8). The code already exists in the spec ledger (packages/spec/src/api/error-code-ledger.zod.ts:684): a new refusal reason needs no new code and no spec edit. Correction: the 0-org arm also serves lean compositions with no sys_organization registered (engine.ts:5774-5777); see open question 2.",
  "H4": "CONFIRMED (measured). The exemption is the regexp at packages/metadata-protocol/src/seed-loader.ts:1189-1190 (field doc :413-418). First-party seed datasets that hit it: examples/app-showcase seeds sys_business_unit (5 rows) - NULL on single at base, stamped on isolated because per-org replay passes config.organizationId. After withdrawal no first-party seed refuses in isolated/group: the inline seed is suppressed there (app-plugin.ts:1433-1439) and the replay always carries the organization. A fresh single boot stays green only if the Default Organization exists before AppPlugin.start() seeds; seed-tenancy-backfill.ts was not touched.",
  "H5": "PARTLY MEASURED. A fresh isolated boot comes up at base (base-isolated, with the membership policy declared) and its org bootstrap is the same once-gate (packages/plugins/organizations/src/organizations-plugin.ts:470-528). Its own org-less writes, measured: sys_capability x12 (bootstrap seeder) and sys_migration x2 (ledger records); under the ruled bypass both would be refused (system-write-organization.ts:268-270). claimOrphanOrgRows: NOT MEASURED (the read was refused). group posture: not booted. No reclassification is proposed, so the tenancy census does not move.",
  "boot_order_table": [
    "fresh single, production shape (no dev admin) | step | base 3d9188502e (measured) | ruled target (head not built)",
    "1 | AppPlugin.start() inline seed | 41 rows on 6 objects, organization_id NULL, sys_business_unit x5 included | Default Organization created first; every seed row stamped, sys_ seeds included",
    "2 | start-phase ledger | sys_migration x2, NULL | unchanged under option B",
    "3 | kernel:ready bootstrap seeders | sys_permission_set x17, sys_position x16, sys_position_permission_set x2, sys_capability x12, sys_sharing_rule x2, audience suggestion x1, all NULL | unchanged under option B (C3 owns them)",
    "4 | kernel:ready ensureDefaultOrganization | no_admin, no org created (read) | org already present; a failed creation fails the boot",
    "5 | kernel:listening | organizations: [] (measured) | Default Organization present",
    "6 | first sign-up after listen | org created and admin bound owner by the bootstrap trigger (measured in the dev-admin shape at kernel:ready: owner, PLATFORM_ADMIN) | reconciler binds member first (read), so the owner bind must promote it",
    "seeds after the org exists | still NULL (measured, base-single-dev) | already stamped at step 1"
  ],
  "derivation_rule_table": [
    "posture | organizations | tenantId supplied | base (measured or read) | ruled",
    "single | 0 | no | lands NULL (measured) | refused",
    "single | 1 | no | derived, stamped (measured) | derived",
    "single | 2 or more | no | refused ambiguous-organization (read) | refused",
    "isolated / group | any | no | refused walled-posture (measured, isolated) | refused",
    "any | any | yes | stamped with the supplied tenantId (measured) | unchanged",
    "the 49 platform objects outside the 8 admitted | any | no | exempt, lands NULL (measured: catalog seeders in single, sys_capability and sys_migration in isolated) | card: gate bypassed, so derived or refused; see open question 1"
  ],
  "open_questions": [
    {
      "question": "Q1. The ruled gate bypass at C1. Read consequences: (a) single - the first-user grant is written with explicit organization_id null (packages/plugins/plugin-security/src/bootstrap-platform-admin.ts:1133-1139) after the org exists (measured order in base-single-dev, and always so once C1 creates the org at boot); with the bypass the engine derives the Default Organization for it and the SQL driver overwrites the explicit null (packages/drivers/driver-sql/src/sql-driver.ts:15560), while PLATFORM_ADMIN is derived only from null-organization grants (packages/core/src/security/resolve-authz-context.ts:908-913) and the owner bootstrap's legacy anchor reads organization_id null (ensure-default-organization.ts:359-364). The first admin would lose platform standing and pin (c) would fail, silently. (b) single - env-layer sys_metadata rows are written with organization_id this.organizationId = null (packages/metadata-protocol/src/sys-metadata-repository.ts:692, :741, :886) and read back with organization_id null (:619-623); derivation would stamp them out of the env layer. (c) walled - the boot's own sys_capability seeder and sys_migration ledger writes would be refused. Each repair belongs to another card: C3 (seeders and the D5 grant owner, the card's own stop condition), C5 (sys_metadata), C6 (plumbing columns). Which scope does C1 take?",
      "options": [
        "A - Literal at C1: C1 also takes C3's D5 grant re-owning (seeder plus readers), C5's tenant-less sys_metadata, C6's plumbing column drops and the walled seeders' organization. Cost: three cards' scope in one PR, the seeder stop condition crossed, and ADR-0131 section 8 order inverted (C3 and C5 are blocked by C1).",
        "B - Split by schedule: C1 lands the boot invariant, the seed-exemption withdrawal, the owner pin and the derivation rule for objects already in scope (every app object plus the 8 admitted platform objects: derive at exactly one organization, refuse at zero or several, refuse under a wall). The per-object gate stays until C8, which section 8 already gives every-posture refusal and ledger retirement, and D13 already lists platform-object-tenancy.ts and isPlatformObjectOutOfTenantAuditScope. Cost: 49 column-carrying platform objects keep today's exemption until C8.",
        "C - Narrowed bypass at C1: adjudicate the 49 global/unclassified objects now, admitting those with a citable writer fact and holding the rest global until their card lands. Cost: a 49-object census against the ledger's no-guessing admission bar, on a ledger D13 deletes in C8."
      ],
      "recommendation": "B. Real business need: the measured defects (first-boot seeds NULL and never re-owned, no organization at listen) are fixed by B, and the rows the bypass would add (catalog seeds, ledger rows, env metadata) have their owner defined by C3/C5/C6 with no measured pull to stamp them now. Long-term soundness: B follows ADR-0131 section 8 and D13 and adds no code that later retires; A front-loads three cards, C invests in a ledger scheduled for deletion. Preventing AI mistakes: B keeps the strict contract on every object it covers and does not leave the platform-admin reader half-migrated; A's single-posture failure is silent (the stack boots, the first admin just lacks platform standing). Startup focus: B is the smallest change that delivers pins (a) to (d) and adds no gate."
    },
    {
      "question": "Q2. Compositions that register no sys_organization object (lean embeddings and bare-kernel tests, as the engine docblock at packages/objectql/src/engine.ts:5744-5757 names them). The engine answers them as zero organizations (packages/objectql/src/engine.ts:5774-5777). Under 'refused otherwise, in every posture', every system insert on any object carrying the injected column would be refused there. Which reading?",
      "options": [
        "A - No organization object means no tenancy to enforce: neither stamp nor refuse, stated in the docblock and pinned; the refusal applies wherever sys_organization is registered.",
        "B - Refuse there too: every lean composition must register an organization object, or declare tenancy.enabled false on every object."
      ],
      "recommendation": "A. Real business need: lean embeddings and the bare-kernel test population have no organization concept, and refusing their writes buys no ownership guarantee. Long-term soundness: ADR-0131 D1 governs objects whose rows have an owner; a composition with no owner type is outside it. Preventing AI mistakes: A keeps one declared rule (registered organization object = enforcement) instead of N per-object opt-outs. Startup focus: A changes nothing for lean users."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed - base-single-dev logged one DUPLICATE_RECORD refusal of a sys_migration insert during the kernel:ready owner bind (a second ledger write for an id already present); the boot continued and both ADR-0093 ledger rows were present afterwards. An observation, not a reproduced defect."
  ]
}

---

Generated by Claude Code