text(spec,platform-objects): two docblocks still describe organization-less rows as live; plus two dormant organization-less code paths to confirm and retire #24902

Activity

1. objectstack-fleet

   added

   pm:queue

   domain:spec

   priority:p3

   on Oct 20, 2026
2. objectstack-fleet commented on Oct 20, 2026

   

   objectstack-fleetBot

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Hold · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-20T14:51Z. The epic seat (epic:#15194) holds this card. It is not for another seat to claim.
   Blocked-by: #24583

   The seat sorted the 18.x line's follow-ups. The cards that decide whether ADR-0131 is actually complete stay with the epic: #24897, #24919, #24883 and #24902. #24899 (security) is dispatched now. #24898 and #24900 stay in the shared queue. The maintainer agreed, verbatim: 「同意」.

   When step 7 (#24583) closes, the seat dispatches:

   • text(spec,platform-objects): two docblocks still describe organization-less rows as live; plus two dormant organization-less code paths to confirm and retire #24902, measure(plugin-auth): the organization-less admin_full_access anchor in the last-admin guard and the pre-organization default-org bootstrap, after ADR-0131 step 7 #24883 and measure(adr-0131 D1): a database 18.0.0 created is certified by its birth marker yet keeps every tenant column nullable, and the ceremony certifies tables it left nullable — D1 is not yet a fact the certificate proves #24919 in parallel. The outcomes of measure(plugin-auth): the organization-less admin_full_access anchor in the last-admin guard and the pre-organization default-org bootstrap, after ADR-0131 step 7 #24883 and measure(adr-0131 D1): a database 18.0.0 created is certified by its birth marker yet keeps every tenant column nullable, and the ceremony certifies tables it left nullable — D1 is not yet a fact the certificate proves #24919 feed the ADR text.
   • docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897 last. It is Tier H and needs the maintainer's approval.
3. objectstack-fleet

   added

   pm:blocked

   pm:dispatched

   and removed

   pm:queue

   pm:blocked

   on Oct 20, 2026
4. objectstack-fleet

   assigned

   os-steve

   on Oct 21, 2026
5. objectstack-fleet commented on Oct 21, 2026

   

   objectstack-fleetBot

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Claim: epic seat round · 2026-10-21T18:20Z · releasing the epic's hold (6293739460) now that step 7 (#24583) is closed (6323222024)
   Session: session_01Y5583bs2RDd53MH6kM1ca3
   Account: os-steve (the card's assignee)
   Branch: claude/issue-24902-tenant-text-dormant-paths
   Worktree: the cloud session's own checkout (mode:cloud)
   Domain: domain:spec
   Seat: epic:#15194
   File surface:

   • packages/spec/src/api/events.zod.ts: the single-posture stamping bullet (~259-262), plus the artifacts its describe regenerates.
   • packages/platform-objects/src/**/sys-sharing-rule.object.ts: the "null = global" text (~99).
   • scripts/check-tenant-chokepoint.mjs: align its header (~136) and its rule (~397) on where(tenantRef, 'is not', null), with its self-test.
   • The dormant organizationOutOfWriteReach and the sys_record_share organization backfill's apply pass (packages/plugins/plugin-sharing/src/backfill-sys-record-share-organizations.ts): confirm each one dead with evidence, then retire it, or keep it with a stated reason. Include their tests.
   • One .changeset/*.md.
   • ⛔ Not packages/plugins/plugin-auth/**: that is measure(plugin-auth): the organization-less admin_full_access anchor in the last-admin guard and the pre-organization default-org bootstrap, after ADR-0131 step 7 #24883.
   • ⛔ Not docs/adr/**: that is docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897.
     Container & model: S, mode:cloud, model: TIER_DEFAULT. A review is owed at the tier the diff's declared face picks. Text-only is no face. Removing an export is the declaration face.
     Clause-②: no — expected for text fixes and dead-code retirement; the dev re-declares it from the diff (removing a reachable export would make it yes)
     Responsibility: the stale text contradicts shipped behaviour after step 7 (feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880 review 6291895530) | none | reached by readers of the spec describes and docs
     Thread-read: 6293739460
     Serial constraints cleared: step 7 is closed. No open PR touches these files.
6. objectstack-fleet commented on Oct 21, 2026

   

   objectstack-fleetBot

   on Oct 21, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 24902,
     "status": "done",
     "branch": "claude/issue-24902-tenant-text-dormant-paths",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/25140",
     "session": "session_01Pjh5f11tyUbYMQmSZaJZFS",
     "premise_still_valid": true,
     "summary": "Text: DataEvent.organizationId TSDoc and describe (events.zod.ts) now match schema.mdx: under single the engine stamps the Default Organization (ADR-0131 D9), and absence = an object outside the wall, or a composition with no organization object. events.mdx regenerated. sys_sharing_rule.organization_id help 'null = global' becomes 'The organization this rule belongs to.' (en regenerated; zh-CN/ja-JP/es-ES hand values updated). Gate: check-tenant-chokepoint exempts exactly a literal 'is not' operator (Knex querybuilder.js:456-457 compiles it to IS NOT NULL), and its header names all three IS NOT NULL spellings; +1 silent and +1 refused self-test case, battery floor 22->24. Dormant paths: both KEPT, neither retired. organizationOutOfWriteReach is ALIVE (storage-routes.ts:780, three upload doors; only its organization-less-row branch at metadata-store.ts:809 is NULL-arm era, and it is reachable on a host without the os-serve-only boot guard). The sys_record_share backfill apply pass has no production caller, does not ship, and is dead on an 18.x driver-created store (probe), but the published 17.3 notes direct operators to it, so it is kept per dispatch. Two decisions for the seat are in open_questions. #25128 C1 comments are not in these files: left to #25128.",
     "tests": "HEAD 02067f8c. pnpm --filter @objectstack/spec test: 706 files, 21465 passed, 1 todo. pnpm --filter @objectstack/plugin-sharing test: 53 files, 1200 passed. plugin-sharing typecheck exit 0. Gate reverse check (fix committed first; trap restore with git checkout HEAD --): the new condition replaced by true gives self-test exit 1, naming the new silent case; restored, git diff HEAD empty. Probe A (throwaway vitest, not committed) on plugin-sharing: driver-created sys_record_share, no relax: an organization-less grant is refused NOT NULL; plan {scanned:0, planned:0}; apply written 0. Probe B: service-storage vitest error-envelope.conformance.test.ts + metadata-store.test.ts -t 'switching active organization|organizationOutOfWriteReach': 2 files, 7 passed.",
     "gates": "dispatch-gates --commands: 130 commands, exit codes captured per command before any pipe. 127 exit 0. Three exit 3 (prerequisite): check-plugin-teardown-shape --self-test (shallow clone; fetched the pinned commit, then exit 0); spec check:skill-examples (built client-react, then exit 0); check:dual-build-cjs-loads NOT MEASURED locally (needs 10 untouched packages built), declared to CI. --ran: 130 derived / 130 run / 0 unrun. check:generated exit 0 (14/14 after --fix of check:docs). check:tenant-chokepoint scan and self-test exit 0. check-i18n-bundles --write exit 0. check-governed-merges --branch: NOT governed, 95 changed lines. CI check-runs: in_progress at report time.",
     "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
     "mcp_calls": "4 — mcp__github__issue_read x3 (get, get_comments x2); reads only",
     "api_writes": "2 relay strokes — fleet-write pr_create (POST /repos/objectstack-ai/objectstack/pulls + POST issues/25140/assignees), and this os-dev-report comment (POST issues/24902/comments); plus git push",
     "open_questions": [
       {
         "question": "organizationOutOfWriteReach answers 'in reach' for an organization-less row, but since D8 the scoped write cannot reach it. On a host without the os-serve-only boot guard, over a database that has not been through the ceremony, the door writes, misses and answers the 500 outage text. Change it?",
         "options": [
           "A keep as is: the state exists only on a database that has not been through the ceremony; note it in the #24897 ADR text",
           "B the door refuses such a row with its own answer (new refusal text; touches storage-routes.ts, outside this claim)"
         ],
         "recommendation": "A, because the boot guard plus 7b-0 make the state invalid everywhere os serve runs, and B adds a new refusal surface for residue"
       },
       {
         "question": "Retire the sys_record_share organization backfill (module and two tests) now, or keep it?",
         "options": [
           "A keep it until the 17.x upgrade window is formally closed (the published 17.3 notes direct operators to it)",
           "B retire it with its tests, the engine-double-contract.pinned.json row and the tenant-audit census counts, plus a docs-only erratum PR for 17.3"
         ],
         "recommendation": "A, because the release notes are an external plan step and B moves two ledgers outside this claim's file surface"
       }
     ],
     "out_of_scope_findings": [
       "carrier: #24897 · noted, not filed · storage-routes.ts:761 says 'a row stamped with no organization stays in reach', which has been stale since D8 (same root as open_questions[0])",
       "carrier: seat · noted, not filed · the claim's File surface names packages/platform-objects/src/**/sys-sharing-rule.object.ts; the file is at packages/plugins/plugin-sharing/src/objects/ and was edited there"
     ]
   }

   ---

   Generated by Claude Code
7. objectstack-fleet

   closed this as completedin #25140on Oct 21, 2026
8. objectstack-fleet commented on Oct 21, 2026

   

   objectstack-fleetBot

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Landed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-21T20:55Z. PR #25140 merged into main as 60b42cd0b7, and it closes this card.

   • What landed:
     • the DataEvent.organizationId description now matches D9, and events.mdx is regenerated;
     • the sharing-rule Organization help no longer says "null = global", in all four locales;
     • check-tenant-chokepoint exempts only the literal where(col, 'is not', null), pinned both ways.
   • Seat ACCEPT: 6325596117.
   • Seat decisions: organizationOutOfWriteReach and the sys_record_share organization backfill are both kept, with reasons. The first one's uncertified-database case, and the stale comment at storage-routes.ts:761, go into docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897's ADR notes.
   • Dev session: archived.