fix(cli): S1 merge round — the lock is asked before any write of a resolution; the follow-up door save sends the row as written; history duplicates are named (C7b S1)

- The door's lock verdict is asked once, before the history fold, the
  promotion and the in-place write: a refusal leaves nothing written.
  Pinned under a wall with a history table.
- The door save after the in-place write sends the row as written, its
  stored lock family kept, so a rerun meets the same body.
- history-renumber's refusal names the table, each item holding the
  duplicated number and the remedy; both messages pinned.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01USccGXR13sWyTeEwe8QFdH

Author: claude

packages/cli/src/utils/organization-ownership-apply.test.ts

@@ -1365,12 +1365,54 @@ describe('ADR-0131 D10 --apply — a customization conflict resolved by --metada
       });
       expect(asked).toEqual([['view', 'deal_list', null]]);
       expect(step(report).status).toBe('blocked');
-      expect(step(report).blockers.join('\n')).toMatch(/is locked \(_lock=full: shipped locked\).*Nothing was deleted/s);
+      expect(step(report).blockers.join('\n')).toMatch(/is locked \(_lock=full: shipped locked\).*Nothing was written or deleted/s);
       expect(labelOf('md_env')).toBe('Env list');
       expect(deletes()).toEqual([]);
     });
   });
 
+  it('⭐ the lock is asked before the history fold and the promotion: under a wall, a refusal leaves history and rows as they were', async () => {
+    metadataTable([
+      md('md_org', 'org_default', 'view', 'deal_list', { name: 'deal_list', label: 'Org list' }),
+      md('md_env', null, 'view', 'deal_list', { name: 'deal_list', label: 'Env list' }),
+      md('md_lone', 'org_default', 'dashboard', 'sales', { name: 'sales' }),
+    ].join(', '));
+    db.exec(`
+      CREATE TABLE sys_metadata_history (id TEXT PRIMARY KEY, organization_id TEXT, type TEXT, name TEXT,
+        version INTEGER, event_seq INTEGER, checksum TEXT);
+      INSERT INTO sys_metadata_history VALUES
+        ('h_env', NULL, 'view', 'deal_list', 1, 1, 'e1'),
+        ('h_org1', 'org_default', 'view', 'deal_list', 1, 1, 'o1'), ('h_org2', 'org_default', 'view', 'deal_list', 2, 2, 'o2');
+    `);
+    const history = rows('SELECT * FROM sys_metadata_history ORDER BY id');
+    const report = await apply(storingDoor(catalog()), ledger(), {
+      posture: 'isolated',
+      metadataChoices: ['md_org'],
+      columnDrops: { drop: async (columns) => columns.map(({ table, column }) => ({ table, column, outcome: 'not-proposed' as const })) },
+      lock: { verdict: async (type) => (type === 'view' ? { editable: false, lock: 'full' } : { editable: true }) },
+    });
+    expect(step(report).status).toBe('blocked');
+    expect(step(report).blockers.join('\n')).toMatch(/view deal_list could not take the body .*Nothing was written or deleted/s);
+    // No fold, no promotion, no write: history and both rows of the key are as they were.
+    expect(writes.filter((w) => /sys_metadata/.test(w))).toEqual([]);
+    expect(rows('SELECT * FROM sys_metadata_history ORDER BY id')).toEqual(history);
+    expect(owners()).toEqual([['md_env', null], ['md_lone', 'org_default'], ['md_org', 'org_default']]);
+    expect(labelOf('md_env')).toBe('Env list');
+  });
+
+  it('the door save after the in-place write sends the row as written, its stored lock family kept', async () => {
+    metadataTable([
+      md('md_org', 'org_default', 'view', 'crm_lead.intake', formView(true, 'Org copy')),
+      md('md_other', 'org_b', 'view', 'crm_lead.intake', formView(false, 'Other copy')),
+      md('md_env', null, 'view', 'crm_lead.intake', { ...formView(true, 'Env copy'), _lock: 'customize' }),
+    ].join(', '));
+    const c = storingDoor(catalog());
+    const report = await apply(c, ledger(), { views: servedViews(c, []), metadataChoices: ['md_org'] });
+    expect(step(report).status).toBe('done');
+    expect(c.viewSaves.at(-1)!.body).toMatchObject({ label: 'Org copy', _lock: 'customize' });
+    expect((c.viewSaves.at(-1)!.body.config as any).sharing.enabled).toBe(false);
+  });
+
   it('two conflicts of one item that differ only by bundle member are two conflicts, each chosen for', async () => {
     db.exec(`
       CREATE TABLE sys_metadata (id TEXT PRIMARY KEY, organization_id TEXT, type TEXT, name TEXT, state TEXT,
@@ -1775,7 +1817,8 @@ describe('ADR-0131 D10 --apply — history renumbering (seat answers 6162538253,
     // environment scope (NULL is distinct), and no layout can move them.
     viewWithHistory(
       `('md_env', NULL, 'object', 'deal', 'active', NULL, NULL, 1, '{"name":"deal"}')`,
-      `('h_e1', NULL, 'object', 'deal', 1, 7, 'e1'), ('h_e2', NULL, 'object', 'deal', 2, 7, 'e2')`,
+      `('h_e1', NULL, 'object', 'deal', 1, 7, 'e1'), ('h_e2', NULL, 'object', 'deal', 2, 7, 'e2'),
+       ('h_v1', NULL, 'object', 'account', 3, 8, 'v1'), ('h_v2', NULL, 'object', 'account', 3, 9, 'v2')`,
     );
     const drops: string[][] = [];
     const report = await apply(catalog(), ledger(), {
@@ -1788,7 +1831,16 @@ describe('ADR-0131 D10 --apply — history renumbering (seat answers 6162538253,
     });
     const renumber = report.steps.find((s) => s.step === 'history-renumber')!;
     expect(renumber.status).toBe('blocked');
-    expect(renumber.blockers.join('\n')).toMatch(/event_seq is not unique environment-wide: 7 \(2 rows\)/);
+    // The refusal names the table, each item holding the number, and the remedy.
+    expect(renumber.blockers).toContainEqual(
+      'sys_metadata_history: event_seq is not unique environment-wide — event_seq 7: object deal (row h_e1), object deal ' +
+        '(row h_e2). The ceremony never renumbers history a database numbered twice: the organization_id column is not ' +
+        'dropped until every event has its own number. Remedy: give each of these rows a number no other row holds (or ' +
+        'remove the duplicate), then re-run --apply.',
+    );
+    expect(renumber.blockers).toContainEqual(expect.stringMatching(
+      /^sys_metadata_history: a version of an item is held more than once — object account version 3 \(2 rows\)\. .*Remedy: give each of these rows a version no other row of the item holds/,
+    ));
     expect(report.steps.find((s) => s.step === 'column-drops')!.status).toBe('not-reached');
     expect(drops).toEqual([]);
   });

packages/cli/src/utils/organization-ownership-apply.ts

@@ -1049,12 +1049,24 @@ async function historyDuplicates(run: Run): Promise<string[]> {
   const out: string[] = [];
   if (hcols.has('event_seq')) {
     const seq = sql.q('event_seq', HISTORY);
-    const dup = await sql.read(HISTORY, `SELECT ${seq} AS s, COUNT(*) AS n FROM ${h} GROUP BY ${seq} HAVING COUNT(*) > 1 ORDER BY ${seq}`);
+    const dup = await sql.read(HISTORY, `SELECT ${seq} AS s FROM ${h} GROUP BY ${seq} HAVING COUNT(*) > 1 ORDER BY ${seq}`);
     if (dup.length) {
+      const shown = dup.slice(0, 10).map((d) => d.s);
+      const [ty, nm] = ['type', 'name'].map((c) => sql.q(c, HISTORY));
+      const holders = await sql.read(
+        HISTORY,
+        `SELECT ${seq} AS s, ${sql.q('id', HISTORY)} AS id, ${ty} AS t, ${nm} AS n FROM ${h} ` +
+          `WHERE ${seq} IN (${shown.map(() => '?').join(', ')}) ORDER BY ${seq}, ${sql.q('id', HISTORY)}`,
+        shown,
+      );
+      const byNumber = shown.map(
+        (n) => `event_seq ${String(n)}: ${holders.filter((r) => String(r.s) === String(n)).map((r) => `${String(r.t)} ${String(r.n)} (row ${String(r.id)})`).join(', ')}`,
+      );
       out.push(
-        `${HISTORY}.event_seq is not unique environment-wide: ${dup.slice(0, 10).map((d) => `${String(d.s)} (${String(d.n)} rows)`).join(', ')}` +
-          `${dup.length > 10 ? `, and ${dup.length - 10} more` : ''}. The column is not dropped until every event has its own ` +
-          'number. Renumber or remove the duplicated events, then re-run --apply.',
+        `${HISTORY}: event_seq is not unique environment-wide — ${byNumber.join('; ')}` +
+          `${dup.length > 10 ? `; and ${dup.length - 10} more number(s)` : ''}. The ceremony never renumbers history ` +
+          'a database numbered twice: the organization_id column is not dropped until every event has its own number. ' +
+          'Remedy: give each of these rows a number no other row holds (or remove the duplicate), then re-run --apply.',
       );
     }
   }
@@ -1066,10 +1078,11 @@ async function historyDuplicates(run: Run): Promise<string[]> {
     );
     if (dup.length) {
       out.push(
-        `${HISTORY} holds one version of an item more than once: ` +
-          `${dup.slice(0, 10).map((d) => `${String(d.t)} ${String(d.n)} v${String(d.v)} (${String(d.c)} rows)`).join(', ')}` +
-          `${dup.length > 10 ? `, and ${dup.length - 10} more` : ''}. The column is not dropped until every version names one ` +
-          'snapshot. Renumber or remove the duplicated versions, then re-run --apply.',
+        `${HISTORY}: a version of an item is held more than once — ` +
+          `${dup.slice(0, 10).map((d) => `${String(d.t)} ${String(d.n)} version ${String(d.v)} (${String(d.c)} rows)`).join('; ')}` +
+          `${dup.length > 10 ? `; and ${dup.length - 10} more` : ''}. The ceremony never renumbers history a database ` +
+          'numbered twice: the organization_id column is not dropped until every version names one snapshot. Remedy: give ' +
+          'each of these rows a version no other row of the item holds (or remove the duplicate), then re-run --apply.',
       );
     }
   }
@@ -1365,8 +1378,8 @@ async function environmentRowOf(run: Run, conflict: MetadataConflict): Promise<A
 
 /**
  * One `sys_metadata` row takes a body in place, by ONE statement, doing to the
- * row what the metadata door does on a save: the door's lock gate first (a
- * locked item stays locked: the write is refused, nothing written); the row's
+ * row what the metadata door does on a save (its caller has asked the door's
+ * lock gate first, before any write of the resolution); the row's
  * stored `_lock` family kept (the door never sets, changes or removes it,
  * ADR-0010 §3.5), whatever the body carries; and `checksum` restamped from the
  * written body (`hashSpec`, the door's own), which the repository serves as
@@ -1380,14 +1393,6 @@ async function writeBody(
   address: { type: string; name: string; packageId: string | null },
   version?: number,
 ): Promise<Record<string, unknown>> {
-  const verdict = await run.opts.lock.verdict(address.type, address.name, address.packageId);
-  if (!verdict.editable) {
-    throw new Error(
-      `the ${address.type} ${address.name} is locked (_lock=${verdict.lock ?? 'unknown'}` +
-        `${verdict.lockReason ? `: ${verdict.lockReason}` : ''}), so the metadata door would refuse this write, and the ` +
-        'ceremony does not make it',
-    );
-  }
   const written: Record<string, unknown> = Object.fromEntries(Object.entries(body).filter(([k]) => !k.startsWith('_lock')));
   for (const [k, v] of Object.entries(row.stored ?? {})) if (k.startsWith('_lock')) written[k] = v;
   const sql = run.sql;
@@ -1484,6 +1489,21 @@ async function resolveMetadataConflict(run: Run, r: MetadataResolution, notes: s
   }
   const env = environment[0];
   const address = { type: conflict.type, name: conflict.name, packageId: conflict.packageId };
+  // The door's lock gate, asked ONCE and before any write of this resolution
+  // (the history fold, the promotion, the in-place write): a locked item stays
+  // locked, and a refusal leaves nothing written.
+  const writes = env ? !(env.body && sameBody(env.body, body)) : chosen.organizationId !== null;
+  if (writes) {
+    const verdict = await run.opts.lock.verdict(address.type, address.name, address.packageId);
+    if (!verdict.editable) {
+      return (
+        `${what} could not take the body of the chosen row ${chosen.id}: the item is locked (_lock=${verdict.lock ?? 'unknown'}` +
+        `${verdict.lockReason ? `: ${verdict.lockReason}` : ''}), so the metadata door would refuse the write, and the ` +
+        'ceremony does not make it. Nothing was written or deleted; unlock the item, or choose the row the environment ' +
+        'already holds, then re-run.'
+      );
+    }
+  }
   // The body the key's environment row must read back with: the chosen body, as written.
   let expected: Record<string, unknown> = env?.body && sameBody(env.body, body) ? env.body : body;
   try {
@@ -1502,7 +1522,8 @@ async function resolveMetadataConflict(run: Run, r: MetadataResolution, notes: s
       }
       expected = await writeBody(run, { id: env.id, stored: env.body }, body, address, version);
     }
-    if (closing.length) await run.opts.door.save(conflict.type as never, conflict.name, body, { packageId: conflict.packageId });
+    // The row as written (its stored lock family kept), so a rerun's door save meets the same body.
+    if (closing.length) await run.opts.door.save(conflict.type as never, conflict.name, expected, { packageId: conflict.packageId });
   } catch (error) {
     return (
       `${what} could not take the body of the chosen row ${chosen.id}` +