[objectstack-fleet]

Fixes #25204

Clause-②: no (narrowing)
Metadata-protocol: none

The build of decision A (retire) on #25204, from the measurement os-dev-report 6342754850 and the seat's decision 6342853688.

What changes

• claimOrphanOrgRows is retired. packages/plugins/organizations/src/claim-orphan-org-rows.ts and its test (8 mock-engine cases) are deleted. In organizations-plugin.ts, Middleware B's "Fallback A" is removed together with its claimed N orphan seed row(s) for first organization log line, and header item 2b is replaced by a statement of why both retired paths (the donor clone and the orphan claim) must not come back. The false "Idempotent: a no-op once an organization-tagged row exists" sentence lived only in the deleted file's header.
• The organization count read is gone. It existed only to pick Fallback A (limit: 2 on sys_organization). A first organization with no seed replay now logs the same "starts empty" line every later organization already logs.
• The export claimOrphanOrgRows leaves @objectstack/organizations's index.ts, and its README row goes with it.
• Regenerated, never by hand: scripts/engine-double-contract.pinned.json (node scripts/check-engine-double-contract.mjs --write: the deleted test's row lost, the new pin's row added) and the tenant-audit census (node scripts/tenant-audit-census.mjs --write: the claim-orphan-org-rows.ts row leaves counts.md, 237 sites become 236). The census page's hand-written prose counts were restated to match, as check-tenant-audit-census requires (the historical carried figures in the first column are left as quoted).
• Prose, five sites: claim-org-seed-ownership.ts header, org-scoping-engine.ts header, plugin-security claim-seed-ownership.ts header, security-plugin.ts (which also named the retired cloneOrgSeedData), and the runtime app-plugin.ts passage that quoted the plugin-security header (reworded rather than left quoting text that no longer exists).
• claim-org-seed-ownership.ts changes in its header prose only. No ceremony change, no ORGANIZATION_OWNERSHIP_SHAPE_GENERATION change.

Pins

packages/plugins/organizations/src/first-organization-orphan-rows.pin.test.ts, against the real plugin's Middleware B over an in-memory engine whose update() opens with assertEngineUpdateDispatch:

• CONTROL: the store holds no organization and three organization-less application rows the probe sees.
• With no seed replay, creating the first organization leaves all three rows NULL and calls no update.
• With a seed replay, the first organization gets the app's seed row (the replay ran once, for the new organization) and the organization-less rows stay NULL.
• claimOrgSeedOwnership still re-owns exactly the rows the replay reported, and touches no organization-less row.

Ablation (Fallback A put back through scripts/ablation-replace.mjs, with claim-orphan-org-rows.ts restored from origin/main under a trap; marker count 1 on disk before the run; restore proven by blob == HEAD and an empty git diff HEAD): Tests 1 failed | 3 passed (4), the failure being the seedless case, expected [] to deeply equal [ 'crm_account:acc_orphan', …(2) ]: the claim wrote all three rows. The replay case stays green under the ablation by construction (the claim ran only when the replay landed nothing).

Changeset

@objectstack/organizations patch, with a BREAKING banner, the FROM/TO line for the retired export, and the ADR-0087 marker not-required (runtime-export-retired @objectstack/organizations#claimOrphanOrgRows).

Acceptance notes

• Local proof (package tests, typecheck, derived gates, R1/R4 boots and the upgrade-harness legs) is recorded with commands and exit codes in the os-dev-report on fix(organizations)!: retire claimOrphanOrgRows — it gives organization-less rows to the first organization, an owner by guess that ADR-0131 D9 and D10 forbid (measured 6342754850) #25204.
• check-governed-merges --branch: 0 of 15 paths hit the register, not governed; 691 changed lines.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/organizations, @objectstack/plugin-security, @objectstack/runtime, touching 7 documentable anchor(s). ⚠️ 4 changed file(s) yielded no anchor (packages/plugins/organizations/README.md, packages/plugins/organizations/src/claim-org-seed-ownership.ts, packages/plugins/organizations/src/index.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

16 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 3e073894db7e6cd7b7e8fdae3da3d81743159515.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 4 changed file(s) yielded no anchor (packages/plugins/organizations/README.md, packages/plugins/organizations/src/claim-org-seed-ownership.ts, packages/plugins/organizations/src/index.ts, …) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: organization_id (literal, 37 pages)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 43 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3e073894db7e6cd7b7e8fdae3da3d81743159515 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 44600bdf33fa0e82278195369dd4f6c7055a3fa9 — the merge of head edd58828f36822bae48e7fa82eb3941f25c3a288 into base 3e073894db7e6cd7b7e8fdae3da3d81743159515, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 44600bdf33fa0e82278195369dd4f6c7055a3fa9 && git checkout 44600bdf33fa0e82278195369dd4f6c7055a3fa9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 3e073894db7e6cd7b7e8fdae3da3d81743159515 edd58828f36822bae48e7fa82eb3941f25c3a288 && git checkout -B drift-repro 3e073894db7e6cd7b7e8fdae3da3d81743159515 && git merge --no-ff edd58828f36822bae48e7fa82eb3941f25c3a288

node scripts/docs-audit/affected-docs.mjs --json 3e073894db7e6cd7b7e8fdae3da3d81743159515

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 3e073894db7e6cd7b7e8fdae3da3d81743159515 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: edd58828f36822bae48e7fa82eb3941f25c3a288
Local-runs: none
Scope: docs/audits/2026-08-tenant-audit-write-call-sites.counts.md, packages/plugins/organizations/README.md, packages/plugins/organizations/src/claim-org-seed-ownership.ts, packages/plugins/organizations/src/claim-orphan-org-rows.test.ts (deleted), packages/plugins/organizations/src/claim-orphan-org-rows.ts (deleted), packages/plugins/organizations/src/first-organization-orphan-rows.pin.test.ts, packages/plugins/organizations/src/index.ts, packages/plugins/organizations/src/org-scoping-engine.ts, packages/plugins/organizations/src/organizations-plugin.ts, packages/plugins/plugin-security/src/claim-seed-ownership.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/runtime/src/app-plugin.ts, scripts/engine-double-contract.pinned.json + packages/plugins/organizations/src/organizations-plugin.test.ts, packages/plugins/organizations/src/org-creation-no-cross-org-copy.test.ts, packages/plugins/organizations/vitest.config.ts, packages/plugins/organizations/tsconfig.json, packages/cli/src/commands/serve.ts, scripts/tenant-audit-census.mjs, scripts/check-tenant-audit-census.mjs, scripts/check-engine-double-contract.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, scripts/check-published-readme-exports.mjs, scripts/adr-anchors/ (register read), .github/workflows/lint.yml, .github/workflows/pr-automation.yml, .objectui-sha and the objectui checkout at cd14d8eeffe11ae03b6acf82e663c1d293dfdf5f, docs/adr/0131-total-organization-ownership-no-null-organization-id.md (D8, D9, D10, D11 on origin/main), AGENTS.md Post-Task Checklist step 3 on origin/main. Prose faces judged under ②: .changeset/25204-claim-orphan-org-rows-retired.md, content/docs/permissions/tenant-audit-census.mdx.

Reading: head edd58828 (three commits: 78b1ed1, 86cf826, edd5882) against merge-base f2ade4afb0, read with git diff and git show, no checkout. Inputs: card #25204 body and all 7 comments (6340943400, 6341022853, 6342271149, measurement 6342754850, decision 6342853688, build claim 6343237947, build report 6344758046), PR #25246 body, file list (15 files, +316/-387, draft, mergeable_state: clean), and the head's check-runs (42 runs, 36 success, 6 skipped by their own if:, 0 failure: Console Pin Gate, Dogfood shards, Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke, 18.x upgrade harness). Later main: 5 commits after the merge-base; 3 touch PR paths. 80ec71d and 42b60b9 add .changeset/*.md only. 9340181 edits security-plugin.ts in regions at old lines 273, 1907, 4011 to 4294, 6711 and 8486, none overlapping the PR's comment hunk at 4972, and adds or edits two organizations test files the PR does not touch; no textual conflict.

① Derived judgments

1. Removed published export — right. claimOrphanOrgRows leaves packages/plugins/organizations/src/index.ts; the one code importer on main was organizations-plugin.ts, whose import the diff removes. git grep at the head: no code reference remains; what remains is the historical CHANGELOGs (never edited), the changeset, the pin's docblock and two retirement notes in the plugin. objectui at the pinned .objectui-sha cd14d8ee (the pin is unchanged by this PR): 0 references to claimOrphanOrgRows and 0 to @objectstack/organizations at all, so the skipped Console Pin Gate hides nothing. The README API-table row is removed — required, since check-published-readme-exports reds a README symbol absent from the built type surface. objectql, plugin-security and runtime CHANGELOGs name the symbol only historically; right to leave them.

2. What else the plugin does at first-organization creation.

   • Per-org seed replay: code unchanged (same resolveKernelService lookups, same replayed rule, same info line). Right; the new pin's replay case holds it.
   • Seed ownership claim claimOrgSeedOwnership: header prose only, writes owner_id scoped to one organization and never organization_id, as its new header states. Right; the pin's fourth case holds it.
   • The sys_organization count read (limit: 2) is gone with its failed to count organizations warn arm. Consequence: the starts empty info line now fires for every organization whose replay landed nothing, the first included; before it fired only when the count was above 1. No test on main or at the head pins the first organization's silence or the count read (the only log-line pin in organizations-plugin.test.ts, line 370, is the absence of per-org seed replay failed, falling back, unchanged). Right: one fewer read, one fewer failure mode, an informational line in its place. The falling back wording now falls back to that line alone; harmless, see ③.

3. Does any write that previously stamped an organization now leave a row NULL that a served composition depends on? No. The only removed write is the claim's update({ id, organization_id }) on organization_id IS NULL rows of application objects, reachable only under a wall (serve.ts:4358 at the head: multiTenant = tenancyPosture !== 'single', and the plugin entitles only group and isolated), only when the replay landed nothing, only when the store held exactly one organization. The measurement counted 0 claimable rows on every store this release produces or serves (fresh single, group, isolated, seedless isolated, both 18.0.0-born fixtures, the ceremonied fixture, lean embedding); D9 refuses an organization-less walled insert and the 7b-0 driver refuses it at NOT NULL. The one reachable population is an uncertified 18.0.0-born walled store holding NULL application rows and no organization: exactly the rows D10 fate 4 says stay NULL and reported, never guessed. Under a wall the D8 predicate has no NULL arm, so those rows were unreadable to the first organization before the claim ran and stay unreadable after; the claim's stamp was the only thing that made them visible, and that stamp is the guess being retired. D11: identical ownership rules in every posture, so the walled plugin had no licence single lacks. The build report's R4 leg (a walled os serve over the measurement's repro store) read 11 of 11 rows still NULL after boot, starts empty logged, 0 claim lines; the same shape on main claimed all 11.

4. plugin-security and runtime edits — right, comment-only. claim-seed-ownership.ts header: the twin is now claimOrgSeedOwnership (owner_id, one organization), an accurate pairing. security-plugin.ts:4974-4976: the comment drops claimOrphanOrgRows and the cloud#1345-retired cloneOrgSeedData name the measurement had routed to chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203; taken here in the same hunk, fine. app-plugin.ts:2148-2156: the passage quoted plugin-security header text that no longer exists; reworded to state the reason directly, as the measurement asked (never edit a quotation out from under a quoting site). The ADR anchor file on security-plugin.ts is untouched and check:adr-anchors is green.

5. Regenerated files — produced by their generators, consistent with the removed row.

   • docs/audits/2026-08-tenant-audit-write-call-sites.counts.md: the one row claim-orphan-org-rows.ts | update | schema.name | undecidable | elevated | 1 leaves, and every total moves by exactly that row's attributes: sites 237 to 236; run-time-named object 77 to 76 (schema.name); threading a tenant context 178 to 177 (SYSTEM_CTX); decidably elevated 135 to 134; readable engine-type receiver 196 to 195 (the typed OrgScopingEngine receiver); other run-time expression 70 to 69; tenancy-enabled 159, unreadable 51, provable-none 8 and undecidable elevation 94 unchanged, as an undecidable-object row leaves them. The generator's corpus is tracked non-test sources under packages/services and packages/plugins, so the new .pin.test.ts adds no row. Measured on 2026-10-22 at 78b1ed16a is the HEAD the generator stamps by git rev-parse at run time (the branch's first commit, recorded by the second), and the gate deliberately never compares it. check-tenant-audit-census compares the generated region byte-for-byte: green in Lint.
   • scripts/engine-double-contract.pinned.json: the (claim-orphan-org-rows.test.ts, update, 2) row leaves (a departed file is the RETAINED rule's accepted case) and (first-organization-orphan-rows.pin.test.ts, update, 1) enters in file-sorted position between claim-org-seed-ownership.test.ts and org-creation-no-cross-org-copy.test.ts. The new file holds exactly one engine double whose update opens with assertEngineUpdateDispatch, so pinned 1 is the count the scanner yields; 18 other .pin.test.ts rows show the scanner reaches that suffix. check:engine-double-contract green in Lint.

6. The new pin — right, and it drives the real plugin. first-organization-orphan-rows.pin.test.ts runs OrganizationsPlugin.init and start, then middlewares[1], which is Middleware B (A registers at head line 343, B at 389). With no seed-datasets or seed-replayer service, resolveKernelService returns undefined, replayed stays false and the middleware reaches the retired site: the suite asserts the three NULL rows stay NULL and update is never called. The replay case asserts the replayer ran once for the new organization and replayed short-circuits. hook is a no-op so the default-org bootstrap cannot race the rows. The reported ablation (Fallback A restored: seedless case red, expected [] to deeply equal [ 'crm_account:acc_orphan', ...(2) ]) is what the code would do. Reached by vitest (src/**/*.test.ts) and by the package's test type-check (pnpm check:test-typecheck).

7. R1 to R4. The build report records R1 (fresh single os dev: Tenancy: single, 0 [org-scoping] lines, the plugin not composed, data API 200) and R4 (walled os serve over the repro store, item 3 above), both consistent with the code. No leg in the report is labelled R2 or R3; the walled seeded boots (group and isolated with a replay) were measured on main in 6342754850, the replay path is unchanged by this diff, and the pin's replay case holds it. Judged sufficient; flagged in ③ for the seat to confirm what its dispatch named R2 and R3.

8. Stale prose the diff missed, inside its own touched file. organizations-plugin.ts:378 (Middleware A's comment: the legitimate writers that deliberately name another organization are "the per-org seed replay, the orphan claim, imports, migrations") still lists the retired claim as a live writer, and organizations-plugin.test.ts:179-180 says "per-org seed replay / orphan-claim, migrations". Comments only; the accept set is unchanged and the plugin header twenty lines above names the retirement. The PR body's "five prose sites" is short by these two. Not a FAIL; escalated in ③.

9. Citation check. The diff cites ADR-0131 D9 and D10 everywhere (plugin header, retirement note, pin docblock, changeset, claim-org-seed-ownership.ts), the clauses that forbid the guess. The card body's "D8 says NULL is not a state" names the wrong clause (D8 is one predicate computed once; NULL is not a state is D1); the mis-cite does not propagate into the diff.

10. Governance. No path in the file list is a governed surface; Governed Surface Queue Guard success; the PR is draft with no auto-merge armed, as a narrowing awaiting its record should be.

② Semver level

• Changeset .changeset/25204-claim-orphan-org-rows-retired.md: '@objectstack/organizations': patch; line-initial Clause-②: no (narrowing) and Metadata-protocol: none, both also on the PR body; a **BREAKING** banner; exactly one adr-0087 HTML-comment marker reading not-required (runtime-export-retired @objectstack/organizations#claimOrphanOrgRows) with its why; the migration FROM claimOrphanOrgRows TO no replacement; run os migrate organization-ownership. runtime-export-retired is in the gate's CATEGORIES, and the gate verifies the export really left the package's published entry, that no metadata-surface file moved, that the FROM operand is named, and that a prescription is present: all four hold on this diff. Check Changeset (check-empty-changeset, check-adr-0087-registration, check-changeset-no-major, each --base MERGE_BASE) success.
• Level: under AGENTS.md Post-Task Checklist step 3 on origin/main, the level follows the kind alone: none takes patch, and a non-protocol change, widening or breaking, ships patch and keeps its BREAKING banner and ADR-0087 disposition. patch is the right level; (narrowing) is declared BREAKING and carries its migration. Right.
• What the diff publishes: only @objectstack/organizations changes observable surface (one export removed, one boot-time write removed). plugin-security and runtime receive comment-only edits and carry no changeset; right, nothing a consumer can observe, and the changeset gate accepted it.
• The changeset's prose matches the diff: the "Unchanged" list (replay, insert stamp, Default Organization bootstrap, claimOrgSeedOwnership) is what the code shows; the operator guidance is D10's ceremony; the BREAKING paragraph names the one reachable population correctly.
• content/docs/permissions/tenant-audit-census.mdx (prose face): the generated region is the generator's; the hand-written restatements hit every enforced pattern with the census's values (51 of the 236; the deviation rows 236, 160 of 236, 76 undecidable, 134 decidably elevated, 0, 94; 134 of 236 (57%), 134/236 = 56.8 percent; Cite 2 / 236); the historical carried-figure column (175, 24, 127 of 175, 135 (77%)) is left as quoted, as the page requires. Right.
• Release-board note, not a gate: a breaking entry with no registered ADR-0087 conversion lands in the manual-handling bucket of docs/releases-maintenance.md (line 182); the release seat should expect this entry there.

③ Boundary flags

From the measurement os-dev-report 6342754850:

• claim scan failed warnings on federated objects (carrier: this build): answered. The deleted file was the only emitter; 0 hits at the head outside CHANGELOGs.
• The false "Idempotent" header sentence (carrier: this build): answered; it lived only in the deleted file.
• security-plugin.ts:4976 naming retired cloneOrgSeedData (carrier chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203): taken in this diff's hunk; chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203 need not touch that line. No open questions were recorded.
• The one decision the measurement left open (the first organization's log line once Fallback A is gone): resolved as the unconditional starts empty line; judged right in ① item 2.

From the build os-dev-report 6344758046:

• per-org seed replay failed, falling back now falls back to the starts empty line only (carrier none): accurate; kept because organizations-plugin.test.ts:370 pins its absence by that text, verified at the head. Escalated: stale-wording item for chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203 together with the two missed comments below.
• 127.0.0.1 sign-in answers 403 INVALID_ORIGIN while localhost answers 200 (carrier none): expected behaviour of the trusted-origin check, not this PR's; no action.
• Four gates NOT MEASURED locally at exit 3 (plugin-teardown-shape self-test, spec skill-examples, dual-build-cjs-loads, i18n): all run in the Lint jobs, which are success on this head.
• Console Pin Gate, Dogfood shards, Temporal Conformance and the 18.x upgrade harness skipped on the PR by their own if:: the removed export is covered by reading objectui at the pin (① item 1); the upgrade-harness legs (15 of 15, both fixtures) and the full dogfood battery (287 files, 2398 tests) are recorded locally with exit codes, not CI verdicts, which is this repo's design for a PR.

Raised by this review:

• Escalate to chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203 (stale texts): organizations-plugin.ts:378 and organizations-plugin.test.ts:179-180 still name "the orphan claim" among live writers; comments only.
• Note on the card: the card body cites D8 for "NULL is not a state"; that is D1. The diff cites D9 and D10, correctly.
• R2 and R3: the build report labels only R1 and R4. The behaviour R2 and R3 would exercise (walled seeded boots) is unchanged and pinned; the seat should confirm what its dispatch named under those labels before closing the card.
• Later main commit 9340181 touches security-plugin.ts outside this diff's hunk and two organizations test files this diff does not touch; the queue's merge is clean. No re-base is owed for this record.

Implemented-by: claude/issue-25204-retire-claim-orphan-org-rows
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS

[objectstack-fleet]

Seat ACCEPT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-22T15:54Z. PR #25246 at edd58828f36822bae48e7fa82eb3941f25c3a288 (#25204; decision 6342853688; build claim 6343237947; os-dev-report 6344758046). ACCEPT.

Seat check

• Shape: 15 files, +316 / −387. check-governed-merges --pr 25246: 0 of 15 paths governed, so this is an ordinary queue landing.
• What it does:
  • claimOrphanOrgRows retires: the function, its test, OrganizationsPlugin's Fallback A, and the published @objectstack/organizations export.
  • Under a wall, creating the first organization on a store that holds organization-less application rows no longer gives those rows to it, an owner by guess that ADR-0131 D9 and D10 fate 4 forbid. The ceremony owns those rows and reports them.
  • The per-org seed replay and the seed-ownership claim are unchanged. The sys_organization count read is gone, so a first organization with no replay logs "starts empty".
• Review: CONTRACT_REVIEW_TIER, narrowing face, from an isolated reviewer: PASS 6345105465 at this head.
  • No served composition depends on the removed write: the measurement counted 0 claimable rows on every store this release produces.
  • The regenerated census and engine-double contract match their generators.
  • objectui at the pinned .objectui-sha has no reference.
  • The changeset is right: patch, Clause-②: no (narrowing), Metadata-protocol: none, BREAKING, and ADR-0087 runtime-export-retired.
• CI: 42 runs, 36 success, 6 skipped by their own conditions, 0 failure.
• R1–R4, all measured on this head by the dev:
  • R1: a fresh boot answered health 200 and served data.
  • R2 and R3: the upgrade harness file passed 15/15. Its legs are the 18.0 and 18.0.0 fixtures and the v17 refusal-then-ceremony case. The review asked the seat to confirm this mapping, and it does.
  • R4: a walled os serve over the measurement's repro store left 11 of 11 rows NULL, with 0 claim lines.
  • Full dogfood passed 2398/2398.
• Carried: two comments still name "the orphan claim" as a live writer: organizations-plugin.ts:378 and organizations-plugin.test.ts:179-180. They join chore: ADR-0131 small carriers — resolveDeclaredRuleScopes checks the raw page length, the semantic-entry and ceremony wording, and the help texts and docblocks that still say NULL organization means global #25203.
• Landing: the seat flips the PR ready and enables auto-merge. Fixes #25204 closes the card.