[objectstack-fleet]

Fixes #24883

Clause-②: yes (narrowing)
Metadata-protocol: none

Seat decision 6324268472 (option A). The measurement behind it is 6324239568.

Why

Since 18.x step 7a-2, resolveAuthzContext gives an admin_full_access grant platform standing only under single, and only when the Default Organization owns it (grantAnchorsPlatformStanding). An organization-less grant anchors nothing in any posture (ADR-0131 D1/D5).

Two plugin-auth readers still counted such a grant:

• the last-admin guard's anchorOwnerTest;
• the default-organization bootstrap's grant read.

Two compositions can still hold that row:

• a lean embedding of registerLastAdminGuard with no sys_organization, over a tenant column that accepts NULL (driver-memory enforces no NOT NULL; a pre-7b-0 SQL table is nullable);
• a host outside os serve, on a database built before 18.x.

In both, the guard believed an administrator remained where the resolver saw none. It permitted banning the deployment's only platform administrator, the verified OS_PLATFORM_OWNER_EMAIL account. This PR closes that fail-open.

What changed

• last-admin-guard.ts
  • anchorOwnerTest reads the resolver's rule: a grant anchors only when the Default Organization owns it. Under a wall, or with no nameable Default Organization, none anchors.
  • The header (grade 1), the docblocks and the refusal texts no longer say "unscoped" or "or by none".
  • The walled-remedy clause of the emptied-not-fresh refusal is retired. Under a wall no grant is evidence any more, so the clause could not be reached.
• ensure-default-organization.ts: the bootstrap reads only the Default Organization's grant, and no grant when none is nameable. The organization-less read is gone.
• Tests (the 81 cases the measurement predicted turned red at the first source commit, and all are re-fixtured; none is skipped or weakened):
  • Guard suites (47):
    • each engine registers sys_organization with a default row, and the platform-admin grant is owned by it;
    • the suites now run on a fresh NOT NULL store (relaxEveryRegisteredTenantColumn dropped), except where a case deliberately models a pre-18 row;
    • sqliteEnginePool gains keepBootOrganizations, which keeps the boot's organization rows and refuses a case that changed them.
  • The config-anchor L5 suite now pins BOTH keys, posture and owner, in both directions:
    • an organization-less holder is no survivor under single either: the new direction;
    • the Default Organization's grant still anchors under single.
  • Bootstrap suites (34): the fake engines hold the Default Organization the boot invariant creates, and the promotion's grant is owned by it. The org-create cases go through the config anchor, the one population that needs no organization first.
  • New last-admin-guard.anchor-parity.test.ts (13 cases) runs a real engine with the real resolver:
    • the write-feasibility matrix on sqlite, with the tenant column nullable where the row models a lean embedding or a pre-18 store; with and without the organization object; 0, 1 and 2 organizations; single and isolated. Each case asserts what the engine does with an organization-less grant, then that the guard counts its holder exactly when the resolver does;
    • the negative pin, failure direction (ii), on a lean embedding with no organization object over a nullable tenant column, and on a pre-18 store: banning the resolver's only platform administrator is refused;
    • the positive control.
  • Two new bootstrap pins: an organization-less grant binds nobody, and with no nameable Default Organization no grant is read.
• Deviation from the dispatch: the lean-embedding pin runs on sqlite with a nullable tenant column, not on driver-memory. check:driver-memory-census refuses a new driver-memory consumer without a maintainer ruling, and the guard takes the same path on both drivers. No dependency is added.
• content/docs/permissions/authorization.mdx: the platform-admin anchor wording, and the embedder's remedy.
• One patch changeset with the BREAKING banner, the FROM → TO, and the embedder's remedy (D5's config anchor plus membership).

Verification (local, before CI)

• @objectstack/plugin-auth: 3448 tests, 3438 passed, 0 failed, 10 skipped. pnpm typecheck exit 0, after a full DTS build of the plugin-auth closure.
• @objectstack/organizations: 233/233.
• Ablation, each restored blob == HEAD:
  • putting the organization-less half back in anchorOwnerTest turns 6 cases red: the matrix's no-organization-object row, both negative pins, and three config-anchor pins;
  • putting the bootstrap's null element back turns the 2 new bootstrap pins red.
• check-governed-merges --branch: NOT governed, 0 of 15 paths hit the register (14 at 980cdc13c, plus permission-sets.mdx in bc359a7c).
• The full gate list, the dogfood battery (organization-delete included) and R1/R4 are reported on the card in the os-dev report, against the head they ran on.

Acceptance notes

• The guard's judgeOrganizationDelete (fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016) asks the same count, so it inherits the fix. Its pins are re-run with the dogfood battery.
• File surface: the claim names the two source files, their tests, the docs page and one changeset. The PR stays inside it: no package.json or lockfile change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GvYt2WyJja4rEjcy6pdD4p

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/approvals.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/deployment/self-hosting.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/permissions/authorization.mdx (via registerLastAdminGuard (symbol, a top-level function), admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/permissions/permission-sets.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/permissions/permissions-matrix.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/permissions/sharing-rules.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/ui/audience-based-interfaces.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))

⛔ 10 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v16.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-0.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-1.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-2.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-3.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-5.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-6.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))
• content/docs/releases/v17/17-7.mdx (via ensureDefaultOrganization (symbol, a top-level function))
• content/docs/releases/v18/18-0.mdx (via admin_full_access (literal, a string literal in ensureDefaultOrganization))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 18 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 60b42cd0b79d99252a003b5374b604e36157de79 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7d3af2df0ca548a596f44aedf49856958be6468d — the merge of head bc359a7c731f390b322a3958ffd0d2a259308dec into base 60b42cd0b79d99252a003b5374b604e36157de79, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7d3af2df0ca548a596f44aedf49856958be6468d && git checkout 7d3af2df0ca548a596f44aedf49856958be6468d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 60b42cd0b79d99252a003b5374b604e36157de79 bc359a7c731f390b322a3958ffd0d2a259308dec && git checkout -B drift-repro 60b42cd0b79d99252a003b5374b604e36157de79 && git merge --no-ff bc359a7c731f390b322a3958ffd0d2a259308dec

node scripts/docs-audit/affected-docs.mjs --json 60b42cd0b79d99252a003b5374b604e36157de79

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 60b42cd0b79d99252a003b5374b604e36157de79 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 980cdc13ce8fe6192236205bb2f5a358b16a77ca
Local-runs: none
Scope: .changeset/24883-last-admin-guard-default-organization-anchor.md, content/docs/permissions/authorization.mdx, packages/plugins/plugin-auth/src/tests/sqlite-engine-pool.testkit.ts, packages/plugins/plugin-auth/src/auth-plugin.test.ts, packages/plugins/plugin-auth/src/default-org-bootstrap-once.test.ts, packages/plugins/plugin-auth/src/ensure-default-organization.test.ts, packages/plugins/plugin-auth/src/ensure-default-organization.ts, packages/plugins/plugin-auth/src/last-admin-guard.activation-ledger.test.ts, packages/plugins/plugin-auth/src/last-admin-guard.anchor-parity.test.ts, packages/plugins/plugin-auth/src/last-admin-guard.config-anchor.test.ts, packages/plugins/plugin-auth/src/last-admin-guard.re-pricing.test.ts, packages/plugins/plugin-auth/src/last-admin-guard.test.ts, packages/plugins/plugin-auth/src/last-admin-guard.ts, packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts; read to judge them: packages/core/src/security/resolve-authz-context.ts, packages/plugins/plugin-auth/src/auth-manager.ts, packages/plugins/plugin-auth/src/auth-plugin.ts, packages/plugins/plugin-auth/src/pre-18-tenant-column.testkit.ts, packages/plugins/plugin-auth/src/last-admin-guard.default-organization.test.ts, docs/adr/0131-total-organization-ownership-no-null-organization-id.md (D1, D5, D8, D9 and the 2026-09-17 amendment), AGENTS.md (Post-Task Checklist item 3), scripts/pm/clause2-line.mjs, scripts/pm/check-governed-merges.mjs, .changeset/24583-7a2-organization-less-grant-readers-retired.md

Read-only. origin/claude/issue-24883-org-less-admin-anchor was fetched and resolved to 980cdc13ce8fe6192236205bb2f5a358b16a77ca (six commits over merge-base 1b3b65e643, 14 files, +886 / -313), checked out in a detached worktree and read against origin/main 60b42cd0b7. Context read from the public GitHub API: the PR body as it now stands (the seat's three driver-memory corrections are in it), the card #24883, the measurement 6324239568, the seat decision 6324268472 (option A), the amended claim 6324280554, the dev report 6326750586, the check-runs for the head and the branch rules for main. Nothing was built, no test was run, nothing was posted. The one script run was the read-only check-governed-merges.mjs --branch.

① Derived judgments

1. Parity with the resolver — yes, in every composition.

The resolver's predicate (resolve-authz-context.ts:943-949): false when walled, false when no Default Organization is nameable, else grantOrganizationOf(grant) === anchor.defaultOrganizationId, where grantOrganizationOf (:921-928) answers null for a NULL, absent or blank organization_id/organizationId. The guard's anchorOwnerTest at the head (last-admin-guard.ts:1054-1066): defaultOrganizationId is read only when !postureEnforcesWall(resolveTenancyPosture()) and some link names an owner (:1060-1062), and the returned test is owner !== undefined && owner === defaultOrganizationId (:1065) with ownerOf = toId(link.organization_id ?? link.organizationId) (:1059) and toId (:603-607) answering undefined for a non-string, an empty string, null or absent. Composition by composition:

• Walled vs single: walled makes defaultOrganizationId undefined, so nothing anchors (:1060, matching :943-947). Under single the Default Organization's grant anchors, and only it. The count site additionally gates the whole grant leg on !postureEnforcesWall (:1124-1127), as the resolver gates anchorReadsDefaultOrganization on !walled (:1622-1624).
• No nameable Default Organization (zero, or several with none default): the guard's readDefaultOrganizationId (:1009-1039) answers undefined (slug default, else the only one, :1029-1039); the resolver's (:963-971) is the same definition. Nothing anchors on either side.
• No sys_organization registered: the guard returns undefined from the registry probe (:1013-1016); the resolver's registryHoldsObject (:1233-1241) does the same. Nothing anchors on either side, so a lean embedding has no grant-anchored administrator, exactly as the resolver reads it.
• NULL, absent or blank owner: toId yields undefined; the predicate's left conjunct fails (:1065). The resolver's grantOrganizationOf yields null, never equal to a string id. Agreed.
• Someone the guard counts and the resolver does not, or the reverse: none found. The config anchor OS_PLATFORM_OWNER_EMAIL is counted by the guard under every posture through the resolver's own matchesConfiguredPlatformAdmin (:1227-1245, predicate at :1240), and the resolver confers it under every posture (:1794-1796). Organization owners and admins (:1178-1190) are the guard's grade 2 by design, not a platform-admin claim; unchanged. The set-defined and switched-off gates (:1125-1127) mirror the resolver's catalog and ledger reads; unchanged.
• Every count site uses the one predicate: resolveAdminUserIds (:1134-1138, consumed at :1158), the switched-off evidence (:1321-1322), the dangling evidence (:1353, consumed at :1367), and enforceStanding (:1565-1640) and judgeOrganizationDelete (:1886-1896) only ever call resolveAdminUserIds, so they inherit it. No second spelling remains: grep for unscoped, or by none, PLATFORM_OWNER_EMAIL_ENV and walledRemedy over both source files returns nothing.

2. The failure direction — the fail-open is closed; no legitimate fail-closed is opened.

• Closed: with a verified OS_PLATFORM_OWNER_EMAIL account beside an organization-less holder, the holder is no longer a survivor, so banning the owner is refused. Pinned on a lean embedding and on a pre-18 store (last-admin-guard.anchor-parity.test.ts, the two negative pins, approx :243-283) and on single in the config-anchor suite (last-admin-guard.config-anchor.test.ts, "REFUSES it under single too when the surviving grant is organization-less").
• A fresh single install: the boot invariant creates the Default Organization before any user, the promotion writes the grant owned by it, links.some(ownerOf) is true, the slug read finds it, the holder counts (:1060-1065, :1029-1031). The positive control pins it (anchor-parity, approx :286-311) and the unchanged last-admin-guard.default-organization.test.ts still pins the served shape. R1 in the dev report observed it on a real boot.
• A walled install with the organizations runtime and a declared owner: no grant counted before this PR either (:1124); the owner counts through the config anchor. The wall arm of the L5 suite pins the refusal for both owners (default-organization and none) under group and isolated.
• An 18.0.0-born store: its one admin_full_access grant is owned by the Default Organization (measurement, fixture database.sql:684), so it counts.
• Refusal texts: both emptied-not-fresh refusals (:1329-1340, :1379-1390) now say "in-window Default Organization grant(s)" and keep the remedies "switch the set back on" and "restore the set". Both are reachable only under single with Default-Organization-owned grants, where restoring the set or its activation does restore standing, so each named remedy is true. Under a wall anchorOwnerTest admits nothing, so stranded and dangling are empty and neither refusal fires; the retired walled-remedy clause and the PLATFORM_OWNER_EMAIL_ENV import (:326) were therefore unreachable text, and the docblock at :1300-1304 says so. The one trade: a dangling or switched-off organization-less grant is no longer "emptied" evidence in any posture (:1353, :1321), so a write in that state is read as the bootstrap window; the resolver recognises nobody from that row, so nobody's standing is at stake. Pinned in the config-anchor suite ("a switched-off set is emptied-not-fresh evidence only through a grant that anchors", arms isolated/default-organization, isolated/none, single/none, with the single/default-organization control still refusing).

3. The bootstrap — the right admin is still found and bound.

ensure-default-organization.ts:503-516: findDefaultOrganizationId (:342-347, slug default else the sole organization, through tryFind) then one read of sys_user_permission_set with organization_id: defaultOrgId, or none. The config anchor is read first (:447, :288-307), unchanged. The grant leg is skipped under a wall (:469-470), unchanged.

• Walled fresh boot: the grant leg is not reached; the verified declared owner is found through the config anchor and bound; the Default Organization is created or re-used by slug (:555-559). R4 in the dev report observed it.
• single fresh boot: the Default Organization exists before any user (the boot invariant), the promotion's grant is owned by it, the trigger on the grant insert (:267-271) runs this helper, the Default-Organization read finds the oldest grant, and its holder is promoted from the reconciler's member row to owner. R1 observed it.
• No path creates no admin where one should be bound: under single the engine derives the owner only when exactly one organization exists and refuses at zero or several (ADR-0131 D9), so a grant cannot precede the organization, and with several organizations and none default the resolver anchors nothing either, so no_admin is the agreeing answer. No path binds the wrong one: another organization's grant is not read; an organization-less holder is never bound (the new pin at ensure-default-organization.test.ts:216-232 asserts the read's where names only the Default Organization; the pin at :234-247 asserts no grant read at all).

4. The tests — none weakened; the parity suite is real.

it( counts before/after: last-admin-guard 110/110; config-anchor 18/19; re-pricing 9/9; activation-ledger 9/9; scim 13/13; ensure-default-organization 42/44; default-org-bootstrap-once 5/5; auth-plugin 100/100; anchor-parity 0/4 it( blocks (one a 10-row loop: 13 cases). No skip, todo or only anywhere in the nine files. Total new cases 16 = 3448 - 3432, matching the PR body.
Spot-checked (27): the #5892 and #5941 "platform admin counts, a SCOPED grant does not" pair; #5978 path 1 (grant survivor) and path 3 (re-scoping the Default Organization's grant refused, row stays DEFAULT_ORG); #6084 and #8613 evidence pins; config-anchor L2 and the FIFTH-shape "ALLOWS" case (grants now owned by DEFAULT_ORG); the whole L5 block (the walled refusal over 2 postures x 2 owners, the new single/organization-less refusal, the single/Default-Organization control, "stops refusing WRONGLY" over 3 arms, the single revocation control, the evidence arms and their control); re-pricing "deleting the LAST grant row is permitted"; activation-ledger seedGrantAdmin; scim makePlatformAdmin (now through the engine, owned by DEFAULT_ORG); ensure-default-organization "creates and binds" (moved to a config-only rig), the OLDEST-grant case, the walled L5 case (asserts no insert against the seeded Default Organization), and the two new pins; default-org-bootstrap-once's rig; auth-plugin's two org-create cases (now through a verified declared owner, with a lazily-owned promotionGrant getter at :11-33); the parity matrix, both negative pins and the positive control.

• Purpose changes are all stated: the old "names the remedy that WORKS under a wall" case became the evidence pin because the clause it asserted no longer exists (in-file comment); the auth-plugin org-create cases go through the config anchor because a grant cannot anchor before the organization exists (in-file comment and PR body).
• Pre-18 rows assert the NEW direction: config-anchor legacyStore cases seed beneath the engine and assert refusal of the owner's write (single/none) and permit of the inert row's revocation; the bootstrap pins assert no_admin; the parity negative pins assert PERMISSION_DENIED 403 and banned falsy.
• relaxEveryRegisteredTenantColumn is dropped from last-admin-guard, re-pricing, activation-ledger and scim (each now registers sys_organization, writes a default row at boot and owns grants by it; the pool's keepBootOrganizations keeps the row and refuses a case that changed it, sqlite-engine-pool.testkit.ts:60-66, :139-143, :160-167). It stays in config-anchor behind legacyStore and in anchor-parity behind nullableTenantColumn, both only for cases that model a pre-18 row. Justified.
• last-admin-guard.anchor-parity.test.ts is real: a fresh ObjectQL over SqlDriver better-sqlite3 :memory:, engine.syncSchemas(), the real bindTestSecurityCatalog, the real registerLastAdminGuard, and the real resolveAuthzContext from @objectstack/core with an injected getSession (the resolver reads it at resolve-authz-context.ts:551-555). The matrix asserts the engine's own verdict on the write (D9 code, SQLITE_CONSTRAINT_NOTNULL, derived owner, or stored null) and then that the guard refuses the ban exactly when the resolver grades the holder. Discrimination: with owner === undefined || restored, the nullable / no-object / single / stored-null row would read the holder as counted (ban refused, expected permitted) and both negative pins would admit the owner's ban; the positive control stays green under both and guards the other direction. So the stated ablation turns them red.
• driver-memory to sqlite: acceptable. The guard has no driver branch; the row reaches the table through the engine's no-organization-object exit on both drivers and only the column could refuse it; the measurement already recorded driver-memory's own fail-open, and check:driver-memory-census refuses a new consumer without a ruling. The nullable sqlite column reproduces the same guard path.

6. Docs. authorization.mdx:136-142: "a grant owned by the Default Organization is sufficient only under single; a grant owned by no organization anchors nothing in any posture, and under the walled postures no grant is an anchor" matches resolve-authz-context.ts:943-949. :364-365 and :453-454 drop "unscoped" correctly. The new paragraph :484-491 states the guard's three grades and the lean-embedding consequence accurately against last-admin-guard.ts:131-157.

7. #25016. auth-manager.ts:8163-8190: for the Default Organization the standing judge is asked first (:8175-8183, a PERMISSION_DENIED is re-thrown as FORBIDDEN 403) and the record count second (:8185-8190, CONFLICT 409). This PR touches neither; the judge (last-admin-guard.ts:1886-1896) runs the same enforceStanding with the members as a companion delete, and with a pending Default-Organization delete readDefaultOrganizationId (:1018-1039) re-derives the anchor after the write. The only verdict that moves is the one the fix exists for: an organization-less holder no longer counts as the survivor that admitted deleting the organization whose owner is the last administrator. The Default-Organization delete pins in the unchanged last-admin-guard.default-organization.test.ts keep their contract, and the dev report re-ran the #25016 pins (21/21) and the full dogfood battery on this head.

② Semver level

patch is right. Metadata-protocol: none (no metadata key, value or type changes; the rows read differently are stored grant rows, not authorable metadata), and under AGENTS.md item 3 the level follows the kind alone: none takes patch, and "a non-protocol change, widening or breaking, ships patch and keeps its BREAKING banner and ADR-0087 disposition". Clause-②: yes (narrowing) is correct: registerLastAdminGuard refuses a write it used to permit. Both declaration lines are line-initial in the changeset (:7-8) and in the PR body, and clause2-line.mjs reads exactly that shape; both Check Changeset runs on the head are green. Present: the BREAKING banner (:12), FROM and TO for registerLastAdminGuard (:14), the two verdict directions (:15-16), the walled-evidence note (:17), ensureDefaultOrganization's FROM and TO (:18), who sees it (:20), the embedder's remedy naming OS_PLATFORM_OWNER_EMAIL plus an owner or admin sys_member row, or registering sys_organization, plus os migrate organization-ownership for a pre-18 database (:22), and exactly one adr-0087: not-required (no-migration-prescription) marker (:10) in the same form as the 7a-2 changeset. Every sentence checked against the head is true. The public export's behaviour change is described in both directions and in the evidence predicate; see B1 for one sentence that is true but narrower than the change.

③ Boundary flags

• B1 — not blocking. Changeset :17 scopes the emptied-evidence change to "Under a walled posture", but the same verdict change holds under single for an organization-less stranded or dangling grant (last-admin-guard.ts:1321, :1353; pinned by the single/none arm in the config-anchor evidence case). The sentence is true, and the single direction is covered by :16 ("permits ... deleting or revoking an organization-less holder"), so nothing is misdescribed; a follow-up could say "in any posture".
• B2 — not blocking. last-admin-guard.anchor-parity.test.ts resolverStanding reads ctx.positions.includes('platform_admin'), the wide list the resolver tells readers not to use for standing (resolve-authz-context.ts:1897-1901); ResolvedAuthzContext.posture is the rung. In this fixture no sys_user_position row exists, so the two readings coincide and the pin discriminates; a later fixture with a position spelled platform_admin would blur it. Suggest ctx.posture === 'PLATFORM_ADMIN'.
• B3 — not blocking. PR body "0 of 16 paths" is stale from the removed driver-memory devDependency commit; the final list is 14 and my run reads "0 of 14" (NOT governed). The dependencies label is likewise stale. PR-body and label only; the changeset is unaffected.
• B4 — not blocking. The PR is still a draft (mergeable_state: blocked); it needs un-drafting and this record before the queue.
• B5 — observation, pre-existing, not this PR's. The guard's readDefaultOrganizationId (:1013-1016) treats an engine with no registry.getObject as holding the organization object and scans the table (fail-closed on a missing table); the resolver's registryHoldsObject (:1233-1241) answers true there too. Both fail safe; parity is unaffected.
• CI (item 8): red required checks: none. Pending required checks: none. All five required contexts on 980cdc13ce are success: TypeScript Type Check, Test Core, Build Core, Lint & Repo Gates, Governed Surface Queue Guard. Every other run is success or skipped (opt-in and schedule-only jobs); both Check Changeset runs and Dogfood Regression Gate are success; no run is in progress.
• Size and governance: check-governed-merges.mjs --branch origin/claude/issue-24883-org-less-admin-anchor: NOT governed, 0 of 14 paths hit the register; +886 / -313 = 1199 changed lines, under the 3000 human-merge threshold; label size/xl. File surface stays inside the amended claim (plugin-auth source and tests, one docs page, one changeset; no packages/core, no docs/adr, no package.json or lockfile).

Implemented-by: claude/issue-24883-org-less-admin-anchor
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS

[objectstack-fleet]

Seat ACCEPT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-21T21:52Z. PR #25141 at bc359a7c731f390b322a3958ffd0d2a259308dec (#24883, seat decision A 6324268472; claim 6324280554; os-dev-report 6326750586). ACCEPT.

Seat check

• Shape. 15 paths, +897 / -322. check-governed-merges: NOT governed, under 3,000 lines. This is an ordinary queue landing.
• What it does.
  • The last-admin guard's anchorOwnerTest counts only the Default Organization's admin_full_access grant, so it answers the resolver's grantAnchorsPlatformStanding question (7a-2) in every composition.
  • The default-organization bootstrap's organization-less read is retired.
  • This closes the guard's only fail-open. A lean embedding, or a pre-18 host, could ban the resolver's only platform administrator.
• Review. CONTRACT_REVIEW_TIER (narrowing face). PASS 6326981452 at 980cdc13c:
  • the guard and the resolver agree in every composition;
  • the fail-open is closed, and no legitimate action is newly refused;
  • the bootstrap still binds the right administrator;
  • no test is weakened: 81 re-fixtured, none skipped, and the 13-case anchor-parity suite runs a real engine with the real resolver;
  • the changeset is true;
  • fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016's 403-then-409 order is kept.
• Delta since the review. bc359a7c is docs-only (permission-sets.mdx). Its stale "organization-less grant is the original anchor" bullet now says the Default Organization's grant anchors standing under single only, and an organization-less grant anchors nothing. The seat read it and widened the claim's docs surface to that one page.
• Accepted deviation. The lean-embedding negative pin runs on sqlite with a nullable tenant column, not on driver-memory. check:driver-memory-census refuses a new driver-memory consumer without a maintainer ruling, and the guard takes the same path on both drivers. The seat corrected the PR body's three sentences about it.
• Changeset. patch, Clause-②: yes (narrowing), Metadata-protocol: none. It carries a BREAKING banner, FROM and TO, and the embedder's remedy (OS_PLATFORM_OWNER_EMAIL plus membership, or register sys_organization), plus the ADR-0087 marker.
• Line rules (dev-measured on 980cdc13c).
  • R1, os dev --fresh: healthy, with 0 organization-less grants.
  • R4, walled os serve with organizations: healthy, with 0 organization-less grants.
  • Full dogfood: 2,395 passed, 0 failed.
  • The fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016 organization-delete pins: 21/21.
• Gate check-runs on bc359a7c. The required checks (TypeScript Type Check, Test Core, Build Core, Lint & Repo Gates, Governed Surface Queue Guard) all succeeded: 36 success, 6 skipped, 0 failed.
• Noted, not blocking.
  • B1: changeset line 17 scopes a point to walled postures that also holds under single; line 16 already covers it.
  • B2: the parity pin reads positions where it could read the posture rung. The two are equivalent in its fixture.
  • B5: a pre-existing observation.
  • B3 (the body's path count and the stale dependencies label) is fixed.
  • Both case notes (organizationOutOfWriteReach, and this retirement) go into docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897's ADR notes.
• Landing. The seat flips the PR ready and enables auto-merge. Fixes #24883 closes the card.