feat(platform-objects,service-automation,service-realtime)!: seven deployment-level tables lose their injected organization column, and reads need manage_platform_settings (ADR-0131 D7)

[objectstack-fleet]

Part of #15207

Clause-②: no (narrowing: deployment-level objects lose their injected organization column and the global settings rung moves; whether any @objectstack/spec export widens is measured on the built declaration closure by the dev, and the measurement decides)

The line above is the claim's, copied verbatim. This PR moves no settings rung (scope item 3 is not here). The measurement it names: check:api-surface is green on the built spec, so no @objectstack/spec export widens.

Scope and the two decisions

This PR lands scope item (1) of #15207, plus the one objectql edit item (1) needs so that it ships no regression. The seat's claim revision on the card (comment 6043540291) narrows this claim's landing to item (1) and records two decisions on the first round's dev report (comment 6042515710):

• Decision 1 = A. packages/objectql/src/lifecycle/lifecycle-service.ts, tenantWindowsFor only, joins the file surface. The edit is in this PR (section below), so the lifecycle regression the first round measured is closed here, and nothing outside the PR remains before it can be readied. Refusing such an override at save is not decided, and it is not built.
• Decision 2 = A. The seven objects keep requiredPermissions: ['manage_platform_settings']. ADR-0131 D7 says objects without the column "are governed by object permission, not by the wall", and the security table below shows what happens without the gate.

Items (2), (3) and (4) are not built under this claim, so this PR says Part of and the card stays open for them.

What this PR does (scope item 1)

sys_job, sys_job_run, sys_job_queue, sys_flow_dispatch, sys_migration, sys_migration_journal and sys_presence now declare systemFields: { tenant: false }, so the registry injects no organization_id on them (ADR-0131 D7). Each also declares requiredPermissions: ['manage_platform_settings']; the security table below is why that is part of the same change.

• One ADR-0087 D3 semantic entry per removed column (18.sys-*-organization-column-retired.ts), as the card requires, plus one step-18 rationale fragment.
• The platform-object tenancy census artefact regenerated: 57 → 50 objects in reach, systemFields.tenant: false 1 → 8.
• sys_job.global-unique.test.ts: the pin that asserted the injected column is re-premised on its absence, which is the direction its own comment asked to re-check from.
• New pins: the injection plan, the declared opt-out and the capability, per object, each with a control (the same declaration with the opt-out removed gets the column; sys_secret and sys_automation_run, which are tenant-attributed, keep it).

The lifecycle guard (Decision 1)

A tenant-scope lifecycle.retention_overrides entry gives one organization its own retention window, and the reaper and the archiver apply it by partitioning the object's rows on organization_id: a pass for that organization's rows, then a global pass whose $or covers everyone else. On a table with no organization_id column both passes name a column the table lacks. The first round measured it on the real SQL driver (better-sqlite3): both predicates throw INVALID_FILTER, so on a new database such an override on sys_job_run, sys_job_queue or sys_flow_dispatch (the three of the seven that declare a lifecycle) stopped that table's retention.

tenantWindowsFor is the one decision both passes ask. It already answered no windows for a federated object whose organization_id is the registry's unprovisioned injection. It now also answers no windows when the registry provenance of organization_id (resolveInjectedColumnProvenance, @objectstack/spec/data) is 'absent': no injection plan put the column there and the author declared none. The object then runs its one global pass at the global window. No row of such a table belongs to an organization, so a tenant override naming it has nothing to select, and it is not applied. An object that has the column keeps its per-tenant windows.

• Measured on the real registry, at this head: the seven objects, registered through ObjectQL's registry, carry systemFields: { tenant: false }, have no organization_id field, and answer provenance 'absent'. The finding(objectql): the cascade scan still probes a federated object on its other injected anchors — deleting a business unit answers 400 INVALID_FILTER on showcase_ext_customer.owning_business_unit_id (the family closing card after #7738 and #21910) #21918 federated shape answers 'injected-unprovisioned', not 'absent', so the federated line stays and the new line is a second answer to the same question (is there a provisioned organization_id). A federated object that declares systemFields: { tenant: false } answers 'absent' and is covered by the new line.
• Pin and control (lifecycle-service.no-tenant-column.test.ts, on a real ObjectQL engine and registry; the stub driver provisions each table from the registered object's fields and refuses a filter on a column the table lacks, as the SQL driver does): a premise case shows the driver refuses an organization_id filter on the column-less table (INVALID_FILTER, 400); the pin sweeps a column-less sys_job_run with one organization's 90d tenant override, and gets no error and exactly one read, created_at before the 30d cutoff; the control sweeps the same declaration without the opt-out and gets the per-tenant read at 90d and the global $or read at 30d.
• Ablation, one-off. Through scripts/ablation-replace.mjs (anchor hit 1 → 0, blob changed): deleting the new line turns exactly the pin red (report.errors gains the driver's INVALID_FILTER refusal for sys_job_run), with the premise and the control green; the federated reader census turns red too, because its row for the new seam no longer finds a use. Restored: blob equals HEAD and git diff HEAD is empty.
• The federated reader census (federated-injected-column-readers.test.ts) scans every non-test source of the package for each use of a provenance seam, and fails on a use without a row. The new call is one, so it gains one row, skips, on the site that already skips; the set of skipping sites is unchanged. The three federated lifecycle pins from finding(objectql): the cascade scan still probes a federated object on its other injected anchors — deleting a business unit answers 400 INVALID_FILTER on showcase_ext_customer.owning_business_unit_id (the family closing card after #7738 and #21910) #21918 stay green.
• Other readers of the override and the window, census at this head: in lifecycle-service.ts, loadGovernance reads the global and per-tenant retention_overrides (organization ids from sys_organization, no read of the swept table), tenantWindowsFor is the only reader of the per-tenant map, and reap and archiveObject are the only sites that put organization_id into a predicate, both built only from tenantWindowsFor's answer. Governance quotas and growth count rows with no filter; the rotator falls back to reap; the archive's cold keep prune filters on created_at only; the retention floors compare durations and read no rows. Outside objectql, the settings manifest declares the key and service-queue registers a floor; neither reads rows. None names the column.

Writer census, with a firing control

Read at e67ba80049, all non-test sources under packages/. Every write call naming the object (literal or a constant bound to it), its context, and whether the row or options name an organization; a row that is not an inline literal was traced to its type.

object	writers	write sites	verdict
sys_job	DbJobAdapter (service-job)	4	system context; rows name no organization
sys_job_run	DbJobAdapter	2	system context; rows name no organization
sys_job_queue	DbQueueAdapter (service-queue)	9	system context; rows name no organization
sys_flow_dispatch	ObjectStoreFlowDispatchStore (service-automation)	2	system context; key and outcome only
sys_migration	migration-flag helpers, the engine's two flag writes, seed-tenancy, membership-backfill and flow-credential receipts	11 in 6 files	system context; DataMigrationFlagSchema has no organization field
sys_migration_journal	core migration runner	1	system context, or the transaction it opened with one; MigrationJournalEventSchema has no organization field
sys_presence	none through ObjectQL	0	apiMethods: ['get', 'list']; presence travels the realtime path

Raw-SQL writes to the seven tables: 0. The same grep shape finds the raw INSERT INTO sys_packages writes elsewhere, so it can match.

Firing control. The same procedure, run over the three tables the card and triage name as tenant-attributed:

• sys_http_delivery: 6 write sites flagged (caller-supplied context).
• sys_secret: the engine's secret write passes the business write's driver options, so the SQL driver stamps the caller's organization.
• sys_email: the call-site pass is silent (system context), and the row trace fires: the email service stamps organization_id into the row it hands the persistence insert. That is why rows that are not inline literals were traced.

sys_secret stays off this PR (triage's correction; its fate is C7's). sys_http_delivery and sys_email are excluded by the card.

Security: who reads these tables, before and after

Measured by driving the real SecurityPlugin middleware with a find on sys_job_queue (a scratch harness, not committed), with the shipped organization_admin, admin_full_access and member_default sets:

posture	shape	organization admin	platform admin	member
isolated	before (column injected)	admitted, organization_id = org-1: 0 rows, since every row is NULL	same: 0 rows	403
isolated	column removed, no gate	admitted, no filter: every organization's rows	admitted, no filter	403
isolated	column removed, with the gate (this PR)	403 (missing manage_platform_settings)	admitted, no filter	403
single	before	admitted, no filter	admitted, no filter	403
single	with the gate (this PR)	403	admitted, no filter	403

The middle row is the reason for the gate (Decision 2). With no column there is no tenant wall, and organization_admin's '*' grant carries the superuser bits, so Layer 1 is skipped too. D7 governs these tables by object permission, and the gate is that permission, on the sys_sso_provider precedent. The single rows are a declared narrowing: an organization administrator who is not a platform administrator loses generic reads of these seven tables. No shipped app or nav entry names any of them. Every platform reader and writer uses a system context, which the gate does not apply to.

Existing databases

Schema sync only adds. On an existing database each table keeps its physical organization_id column (and its index where one was provisioned), and the boot drift report names it orphaned: "column exists in the database but not in metadata (orphaned) — os migrate apply --allow-destructive to drop it". It is never dropped automatically, and never in production. By the census the column holds only NULL, so no data step is needed and the drop loses nothing. The v18 ceremony of ADR-0131 D10 (C7) is where a guided drop belongs; this PR invents no migration. The lifecycle guard reads the registered object, not the physical table, so on such a database the orphaned column is simply never named.

Acceptance notes

• Scope items not in this PR (not built under this claim, per the revision 6043540291):
  • (2) sys_audit_log: removing the column opens the no-record rows (config_change, import, platform_admin_standing_change) to every organization's admin, by the same mechanism as the middle row above. The card's "RLS readers filter on tenant_id explicitly" needs either a platform RLS policy on tenant_id plus an explicit sys_audit_log entry in organization_admin without the superuser bits (plugin-security), or a filter in plugin-audit that re-derives the wall's posture ladder. With the guard in this PR, a column-less sys_audit_log would get the global retention window only; whether that is right for audit is item (2)'s call, not made here.
  • (3) the settings global rung: six service-settings manifests (ai, auth, knowledge, mail, sms, storage) and objectql's lifecycle manifest are global and edited at runtime in Setup, so §6 Q3's measurement points to a tenant-less sys_platform_setting, not to configuration. Existing global rows would need a data step to move; that is the C7 ceremony's.
  • (4) feat(spec,security): OrgScopingEntitlement grows platform-global exemption + unbounded-admin suppression, consumed by Layer 0 arming #12699 made total: applySystemFields (objectql) has to receive the deployment's declaration, and the stand-down in plugin-security retires.
• Not decided, not built: a tenant-scope retention_overrides entry naming a table with no organization column is still accepted at save; it now has no effect instead of stopping retention.
• Noted only: sys_job_queue.metadata_json's description says it carries tenant_id; no producer measured writes it there.
• Step-18 rationale order. After the merge of main, this PR's fragment and the builtin node-config fragment both sat at order 85, and the id tie-break rendered this one between the approval-node fragment and the sentence that continues it ("Then the builtin arm stops being presence-only"). No pin refuses a duplicate order, but the rendered text read wrong, so this fragment moved to 86, the next free order. The rendered rationale now runs approval-node, builtin values, then this fragment.

Merge of main

Two merges, both through scripts/pm/os-regen-merge.sh, no rebase and no force-push: b016a64661 (main at aa71c4d9d1) and 1ef09a5127 (main at dd39171835). Neither stopped on a conflict. packages/spec/src/migrations/registry.ts text-merged with the step-18 entries of the flow builtin node-config change, and check:migration-registry reads its generated regions current. scripts/platform-object-tenancy-census.json kept this branch's bytes (main had not changed it), and check-platform-object-tenancy-census is green at this head. .changeset/pre.json does not exist at dd39171835, so the changeset keeps minor with its BREAKING banner.

Tests and gates

Readings at this head, 1ef09a5127, unless a line says otherwise.

• @objectstack/objectql: vitest --project local 379 files, 7516 passed; typecheck (tsc --noEmit and the test-layer check) exit 0. The four lifecycle and census files alone: 128 passed.
• @objectstack/spec: build exit 0; check:generated 15 of 15 up to date; typecheck exit 0; vitest --project local 622 files, 18567 passed, 1 todo, and the step-18 ledger merge tests (step18-rationale-merge, conversions-major18-merge, project repo) 2 files, 21 passed, both measured at dc24a4e051. The second merge changed no file under packages/spec (git diff dc24a4e051 1ef09a5127 -- packages/spec is empty).
• @objectstack/platform-objects 64 files, 1028 passed; @objectstack/service-automation 175 files, 2120 passed; @objectstack/service-realtime 5 files, 35 passed. Typecheck exit 0 for each.
• Derived gate families: dispatch-gates --commands, derived with no paths at 1ef09a5127: 103 commands. On the first pass 100 exited 0; check-engine-split-ratio --days 90 exited 2 (this clone was shallow inside its 90-day window), and check:dual-build-cjs-loads and check:i18n exited 3 (prerequisite: built output). After deepening history to 2026-07-02 and a full workspace build, all three re-ran with exit 0. Reconciled with --ran: "103 derived famil(ies) accounted for — 103 run, 0 NOT-MEASURED (a DERIVED zero — all 103 recorded an exit code and none of them is 3)". Among them: check-adr-0087-registration ("1 declared-breaking changeset(s), each carrying an ADR-0087 disposition", the seven ids registered), check-changeset-no-major ("This diff introduces no major bump"), check-platform-object-tenancy-census (83 objects, 50 in reach, 33 outside) and check:nul-bytes OK. check-governed-merges --pr 22107 after the push: 0 of 25 paths hit the governed register.
• Lint, narrowed and proven: eslint --no-inline-config --format json over the 22 changed .ts files: 22 files in the report, 0 errors, 0 warnings. All 22 are inside the config's packages/** population, and eslint.config.mjs enables no type-aware linting (no parserOptions.project, no typed rules), so this diff cannot move a verdict on an untouched file. The full pnpm lint is CI's.
• Changed lines: 1229 (1195 added, 34 deleted) across 25 files against the merge base dd39171835, under the 5,000-line human-merge threshold. The first round's 1022 grew by the lifecycle guard, its pin and census row, and the objectql changeset.

Changesets

• .changeset/15207-deployment-plumbing-no-organization-column.md: minor with the BREAKING banner and the ADR-0087 marker registering the seven ids (pre mode is not on at dd39171835).
• .changeset/15207-lifecycle-no-tenant-column-no-partition.md: @objectstack/objectql patch, the lifecycle guard.

This body was revised in patch round 1 by session session_01GV6oYwgc1kWiUCb1YaprQ7, from the dispatch of the domain:spec seat 2 PM.

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/objectql, @objectstack/platform-objects, @objectstack/service-automation, @objectstack/service-realtime, @objectstack/spec, touching 14 documentable anchor(s).

29 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json dd39171835831634e87023e900cf9f448e706fb0.

⛔ 11 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: organization_id (literal, 33 pages)
• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 142 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json dd39171835831634e87023e900cf9f448e706fb0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c7b26b92b67fd563ed69943ed342f0fd463704e5 — the merge of head 1ef09a51270f02b8e541f7b913e811300c6a81bf into base dd39171835831634e87023e900cf9f448e706fb0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c7b26b92b67fd563ed69943ed342f0fd463704e5 && git checkout c7b26b92b67fd563ed69943ed342f0fd463704e5
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin dd39171835831634e87023e900cf9f448e706fb0 1ef09a51270f02b8e541f7b913e811300c6a81bf && git checkout -B drift-repro dd39171835831634e87023e900cf9f448e706fb0 && git merge --no-ff 1ef09a51270f02b8e541f7b913e811300c6a81bf

node scripts/docs-audit/affected-docs.mjs --json dd39171835831634e87023e900cf9f448e706fb0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs dd39171835831634e87023e900cf9f448e706fb0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1ef09a51270f02b8e541f7b913e811300c6a81bf
Local-runs: none

Inputs read: card #15207 (body and all six comments, 6018668592 and 6038050559 binding, claim 6038184526 and its revision 6043540291 bounding scope), PR #22107 (body, 25-file list, net diff against the merge base dd39171835), the 42 check-runs on the head (37 success, 5 skipped, 0 failures; combined status success), ADR-0131 D7 and D10 at main, and read-only git show / git grep of the head and of main (a959493cdf) through refs of my own. The three open PRs the brief names (#22084, #22094, #22103) were read by gh api GET for the two cross-PR questions.

① Derived judgments

Scope against the revision 6043540291: right. The diff lands item (1) and nothing else: seven object files gain systemFields: { tenant: false } and requiredPermissions: ['manage_platform_settings']; one objectql edit (tenantWindowsFor, Decision 1 = A); the gate kept (Decision 2 = A). Items (2), (3), (4) are untouched, the PR says Part of #15207, and the "Part-of PR must not also close its card" check is green, so the card stays open as the revision requires.

Membership of each object, by the writer (D7's rule): right.

• sys_job, sys_job_run, sys_job_queue, sys_flow_dispatch, sys_migration, sys_migration_journal are the six D7 names the ADR itself lists as "operational plumbing whose rows no writer attributes to an organization". The round-1 census (6042515710, writer_census) cites system contexts for every write site; I spot-checked the three sole-writer files at the head: service-job/src/db-job-adapter.ts (11 SYSTEM_CTX uses, one isSystem: true), service-queue/src/db-queue-adapter.ts (16 SYSTEM_CTX), service-automation/src/flow-dispatch-store.ts (7 SYSTEM_CTX, one isSystem: true). The row contracts DataMigrationFlagSchema and MigrationJournalEventSchema carry no organization field.
• sys_presence is not in D7's list by name but is in the card's and was re-verified by triage ("no ObjectQL writer at all"). At the head no non-test source under service-realtime/src writes it; the only other naming sites in the tree are skip lists (plugin-audit/src/audit-writers.ts SKIP_OBJECTS, metadata-protocol/src/protocol.ts search-index prefix skip). A table nothing writes has no writer attributing rows, so by D7's rule it is deployment-level. Right.
• The firing control is credible: the same procedure flags sys_http_delivery (6 caller-context sites), sys_secret (driver-options stamp) and sys_email (row trace), the three the card and triage name as tenant data; sys_secret stays off per triage's correction. Right.

The access change, per posture: right, and the narrowing is declared. Mechanism verified at the head: the security middleware short-circuits system contexts at security-plugin.ts:2331, and the requiredPermissions AND-gate (step 1.5, :2716) runs before the CRUD grant for every principal that holds a permission set. organization_admin (default-permission-sets.ts:391) carries the '*' object grant with viewAllRecords / modifyAllRecords and systemPermissions: ['manage_org_users', 'setup.access', 'setup.write'], so it does not hold the gate; admin_full_access spreads the kernel platform-admin list from @objectstack/spec, and manage_platform_settings is scope: 'platform' (capabilities.ts:63) and in PLATFORM_ADMIN_ONLY_CAPABILITIES (security-plugin.ts:202).

• isolated / group, before: the wall compared a NULL column to the caller's organization, so every non-system reader, platform administrators included, got zero rows (unless the deployment declared the table platform-global). After: a manage_platform_settings holder lists every row; everyone else is refused 403. No non-system reader is newly refused anything it could read before; the platform administrator is newly admitted, which is what D7 means by deployment-level state governed by object permission. Without the gate the organization_admin wildcard would have admitted every organization's admin to every row, so the gate is part of the same change, not a follow-up. Right.
• single, before: any principal with a read grant on the object, an organization administrator included, could read every row through the generic data door. After: only a manage_platform_settings holder. This is the one real narrowing. It is declared in the changeset, in all seven D3 entries and in the step-18 fragment; no shipped app, nav, view or client package names any of the seven (the only non-code hits are generated translation tables); and every in-tree reader is a system context the gate does not apply to. I accept it as D7's "object permission" on the sys_sso_provider / sys_scim_connection_credential precedent: the tables hold other organizations' job errors, queue payloads and migration traces, and option B (explicit set entries) is bypassable by any app set carrying a '*' grant. Right.
• sys_presence exposes apiMethods: ['get', 'list'] only; presence itself travels the realtime path, so the gate changes nothing on that path. Right.

Data at rest: right. Schema sync is additive, so an existing database keeps the physical organization_id (and its index where one was provisioned); driver-sql/src/schema-drift.ts:1380 names it "column exists in the database but not in metadata (orphaned)" with the --allow-destructive remedy, and nothing drops it automatically. After this change nothing writes it: SqlDriver.injectTenantOnInsert stamps only resolveTenantField(object), which answers none for the seven; nothing reads it: Layer 0 keys on the registered object's field, the lifecycle guard reads the registry, and the field resolver now answers organization_id as unknown on these objects. The column held only NULL by the census, so the guided drop in C7's v18 ceremony (D10 fate 1) loses nothing, and this PR invents no migration. Right.

The lifecycle guard: right. tenantWindowsFor now returns no windows when resolveInjectedColumnProvenance(obj, 'organization_id') === 'absent'. At the head that function (spec/src/data/injected-system-column-provenance.ts:317) answers 'absent' exactly when the injection plan carries no tenant column and the author declared none, and injectedSystemColumnDefs reads resolveInjectedSystemColumns, which honours systemFields.tenant: false and tenancy.enabled: false. The predicate is the right one because it names the very column the two partition predicates hardcode (reap :1650/:1658, archiveObject :1499/:1504), and those are the only two sites that put organization_id into a filter, both built solely from this function's answer. It is disjoint from the federated line: isFederatedUnprovisionedInjectedColumn requires 'injected-unprovisioned', so the #21918 case keeps its own branch; an author-declared organization_id answers 'author' and keeps its partition; a local default answers 'injected-provisioned' and keeps its windows (the control in the new pin shows the per-tenant 90d read and the global $or read). The two other provenance readers in engine.ts (:15946 relation scan, :16438 cascade walk) iterate an object's declared fields, so a column-less object never reaches them with organization_id; nothing else throws. The pin runs on a real ObjectQL registry with a driver that refuses unknown columns, carries a premise case and a control, and the dev's one-off ablation turned exactly the pin red. One observation, not a flag: an object whose tenancy anchor is a differently named tenantField also answers 'absent' for organization_id; before this PR its partitioned pass would have named organization_id anyway and been refused, so the guard turns an existing refusal into one global pass. Not a regression.

Seven D3 step-18 entries: right. One per column, ids sys-flow-dispatch-, sys-job-, sys-job-queue-, sys-job-run-, sys-migration-journal-, sys-migration-, sys-presence-organization-column-retired, each citing the writer census, the posture change, the gate and the orphaned-column remedy; inserted in sorted position in the generated region of migrations/registry.ts. The claim allowed "conversions/registry.ts or wherever the playbook places a column removal"; the entries' header is right that no authorable spec key moves, so no D2 conversion and no RETIRED_KEYS_BY_MAJOR row exists to pair with, and a D3 semantic entry is the ADR-0087 record the card asks for. The changeset's adr-0087 marker comment registers the same seven ids; Check Changeset and Lint & Repo Gates are green on the head.

Step-18 rationale order 86: right against main; one collision to name. On the merge base and on main today (a959493cdf, which has moved past the merge base by 18.cbp-master-detail-required-lint-error.ts and four changesets, none adding a fragment above 85) the highest STEP18_RATIONALE order is 85 (flow-builtin-node-config-values-refused), so 86 is the next free order and the move from 85 restores the approval-node / builtin-values continuity the dev describes. Open PRs: #22094 holds manifest-permissions-string-list-retired at 85 on a base that predates main's 85, so it will duplicate 85 at its own merge, not this PR's concern; #22103 holds declared-index-bare-unique-true-retired at 86 on the same stale base, so whichever of #22103 and this PR lands second renders a duplicate 86. main already carries seven duplicate orders (56, 60, 62, 66, 67, 74, 77) and no gate refuses one; the id tie-break puts declared-index-... before deployment-plumbing-..., and both open a new topic, so no sentence is split. The second lander owns the re-check; nothing is owed here.

Files outside the claim's listed surface: all owed by this change. objectql/src/federated-injected-column-readers.test.ts (one skips row for the new seam; the census fails on any provenance use without a row, so it is forced, and skips is the right disposition since the guard returns before a partition is built); objectql/src/lifecycle/lifecycle-service.no-tenant-column.test.ts (Decision 1's pin); platform-objects/src/audit/sys-job.global-unique.test.ts (its pin asserted the injected column and had to be re-premised, in the direction its own comment asked for); scripts/platform-object-tenancy-census.json (the gate artefact, 57 to 50 in reach, opt-outs 1 to 8, with check-platform-object-tenancy-census green); migrations/registry.ts generated regions plus the fragment; the three new object-package pins. Nothing in the 25 files is unexplained.

Public surface. No @objectstack/spec export is added, removed or widened; the spec change is additive data in the migrations registry. The object packages narrow (a column leaves seven objects; reads gain a capability gate), which is what the ! and the BREAKING banner say.

② Semver level

• .changeset/15207-deployment-plumbing-no-organization-column.md: @objectstack/platform-objects, @objectstack/service-automation, @objectstack/service-realtime, @objectstack/spec at minor, with the BREAKING banner and the ADR-0087 disposition. .changeset/pre.json is absent at the merge base, at the head and at main a959493cdf (verified by git cat-file), so pre mode is not in, and triage's release-state note (6038050559) plus the claim grade the change exactly this way. check-changeset-no-major is what the launch-window convention enforces, and it is green. Right.
• .changeset/15207-lifecycle-no-tenant-column-no-partition.md: @objectstack/objectql patch. The guard is a behaviour fix in a published package with no surface change. Right; a second changeset rather than a widened first one is the right shape because the package and the grade differ.
• If this lands before chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 (pre mode): the sentence above is the whole story, minor plus BREAKING is the only grade the gate admits, and nothing is owed. If chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 lands first: pre mode is in with the fixed group already taken to 18 by its one major marker, so the version outcome is identical either way, but the convention's letter ("major once it is") then applies to this PR's BREAKING changeset, and the queue lander owes a one-line re-grade of the four minor entries in the first changeset to major before merge; the objectql patch is unaffected.
• Clause-②: no (narrowing: ...), copied verbatim from the claim into the PR body, and Clause-②: no (narrowing) in the changeset. Matches the diff: nothing widens on @objectstack/spec; the narrowing is the object packages'.

③ Boundary flags

Round 1 report 6042515710:

• open_questions[0] (claim expansion to tenantWindowsFor): answered, Decision 1 = A in 6043540291; built at the head with pin, control and census row. Closed.
• open_questions[1] (is the capability gate D7's "object permission", given the single narrowing): answered, Decision 2 = A; the revision hands the single narrowing to this review, and ① above accepts it as declared and right. Closed.
• open_questions[2] (sys_audit_log), [3] (settings global rung), [4] (feat(spec,security): OrgScopingEntitlement grows platform-global exemption + unbounded-admin suppression, consumed by Layer 0 arming #12699 made total): escalated by the revision to the next claim on this card; the card stays open with the dev's four-axis readings recorded. Not this PR's.
• out_of_scope_findings: a tenant-scope retention_overrides entry naming a column-less table is accepted at save (Decision 1 keeps it a note; after this PR it has no effect instead of stopping retention, so the note is now harmless); sys_job_queue.metadata_json's description claims tenant_id with no measured producer (acceptance note only). Both stay notes.
• deviations: AGENTS.md trailer and footer forms (repository rule, not a defect); main not merged (resolved in the patch round); /cli-ids.log written at the container root outside the repo (the user's to delete; not in the diff); scratch probes removed. Nothing in the diff.

Patch round report 6044947704:

• deviations: the forced census row (right, see ①); fragment order 85 to 86 (right, see ①); main merged twice through os-regen-merge.sh, no rebase, no force-push, both merges conflict-free and the spec tree unchanged by the second (check:migration-registry and check:generated current); a second changeset (right, see ②); PR body without a platform footer (the PM's platform-readings.md reading, not a contract matter); two mis-launched suites terminated and re-run with no reading taken from them; history deepened in the local clone for the split-ratio gate; /build1.pid at the container root (the user's); scratch not committed. Nothing in the diff.
• open_questions: none.
• out_of_scope_findings: the two notes above, plus the platform-readings.md footer discrepancy carried to the PM. None owed here.
• not_measured: the full spec vitest --project repo locally; CI's Test Core shards and the workspace type-check lanes are green on the head, which is the gate verdict.

The H5 security table and the better-sqlite3 lifecycle measurement were scratch harnesses the dev did not commit; this record relies on the committed pins (capability and column asserted per object with controls; the lifecycle pin on a real registry with a refusing driver) and on the middleware reading in ① for the mechanism, and takes the measured row counts as the dev's.

Implemented-by: claude/issue-15207-deployment-level-no-org-column
Reviewed-by: session_01GV6oYwgc1kWiUCb1YaprQ7

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT: PR #22107 at 1ef09a5127 (scope item 1 of #15207: seven deployment-level objects lose the injected organization column and are governed by object permission; the lifecycle tenant partition reads the column's absence). It lands through the queue now; Part of #15207 leaves the card open

domain:spec seat 2 · os-warren · session session_01GV6oYwgc1kWiUCb1YaprQ7 · 2026-10-07T19:22Z · holder of claim 6038184526 (narrowed to item 1 and with Decisions 1 and 2 in 6043540291); the review of record for the reports 6042515710 and 6044947704 (patch round 1).

Checklist (read on GitHub and on origin/main, not from the reports):

• Form: draft, base main, first line Part of #15207, and no closing keyword in the body. Clause-②: no (narrowing: …) starts a line of the body (the claim's line, verbatim), and the changesets carry Clause-②: no (narrowing). PR assignee os-warren. No model identifier in the commits.
• Scope: 25 files, inside the revised claim:
  • the seven object files and their pins (platform-objects, service-automation, service-realtime);
  • objectql's lifecycle-service.ts (tenantWindowsFor), its new pin, and one census row the federated reader census requires;
  • seven D3 step-18 entries, the generated migrations/registry.ts and the tenancy census JSON;
  • two changesets.
    The cross-lane declarations are 6038330914 and 6043548909 ([PM seat] domain:engine — ⏳ vacant #6367) and 6038321237 ([PM seat] domain:services · seat 2 — 🟢 os-elon-musk #21118). Items (2), (3) and (4) are not here.
• What the diff does, as graded:
  • It narrows: the seven objects declare systemFields.tenant: false and requiredPermissions: ['manage_platform_settings']. Under isolated / group, a platform administrator is newly admitted (before, the wall read zero rows for every non-system reader) and everyone else is refused. Under single, an organization admin who is not a platform admin loses generic reads. That is declared, and every in-tree reader is a system context.
  • Membership is by the writer (ADR-0131 D7): the census cites system contexts for every write site, with a firing control (sys_http_delivery, sys_secret, sys_email flagged).
  • The lifecycle guard keys on the column's provenance ('absent') beside the existing federated line. Its pin, control and ablation are recorded; the finding(objectql): the cascade scan still probes a federated object on its other injected anchors — deleting a business unit answers 400 INVALID_FILTER on showcase_ext_customer.owning_business_unit_id (the family closing card after #7738 and #21910) #21918 federated pins stay green.
• Contract review: PASS at CONTRACT_REVIEW_TIER, record 6045154038, on this head (Local-runs: none, identity pair present).

Checks on 1ef09a5127: 37 success and 5 skipped. check-expected-skips reads all 5 as on the roster (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke (opt-in)). check-governed-merges --pr 22107: not governed, 1,229 changed lines. git merge-tree onto origin/main a959493cdf: clean, and .changeset/pre.json is absent there.

Landing condition the record names: if PR #22084 (pre mode) merges first, the four minor entries in .changeset/15207-deployment-plumbing-no-organization-column.md are re-graded major before this PR merges. The objectql patch is unaffected.

Acceptance notes (not filed):

• carrier: none · A tenant-scope lifecycle.retention_overrides entry naming a column-less table is accepted at save and, after this PR, has no effect. Decision 1 keeps refusing it at save out of scope.
• carrier: none · sys_job_queue.metadata_json's description says it carries tenant_id; no producer measured writes it there.

After the merge: the seat checks the squash, removes pm:dispatched, and releases #15207 to pm:queue with items (2), (3) and (4) and the report's questions for them, as the revision 6043540291 records.

Landing: the relay's pr_ready + automerge_enable follows this comment.

---

Generated by Claude Code