docs(core): say which bump carries a peer's sys_organization write to the Default Organization memo

Claude-Session: https://claude.ai/code/session_01Ug7sGD6qWVrzQNdihVX3T6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24523-default-organization-memo.md

@@ -7,6 +7,6 @@ perf(core): an administrator whose `admin_full_access` grant belongs to the Defa
 Clause-②: no (a per-engine memo of an unchanged read: no accept set, standing verdict or served body moves; owes the seat's review of record before the queue, at `CONTRACT_REVIEW_TIER` because it is the platform-standing anchor)
 
 - **The Default Organization is read once per engine, not once per request.** Under `single`, `resolveUserAuthzGrants` asks for the Default Organization whenever the principal holds an organization-owned `admin_full_access` grant: one `sys_organization` read, or two when the only organization is not slugged `default`. The answer is now kept per engine across requests. On a booted composition the warm `get-session` costs 8 statements and a data read 10, the same as for an organization-less grant. Before, it cost 9 and 11, or 10 and 12.
-- **What retires it.** Any `sys_organization` write through the engine (insert, update, delete), observed after it settles. A peer replica's write is seen through the `remote` and `metadata` epoch bumps the `authz.invalidated` and metadata bridges deliver. A 30-second bound covers what no seam sees: a peer's write with no bridge attached, a write that started before the engine's observer registered, and a write inside a transaction that has not committed yet. A Default Organization that is deleted and recreated, or a `default` slug moved to another organization, is read again on the next request.
+- **What retires it.** Any `sys_organization` write through the engine (insert, update, delete), observed after it settles. With the `authz.invalidated` bridge attached (the grants cache on, `OS_AUTHZ_GRANTS_CACHE_TTL_MS` above 0, and a cross-process cluster driver), a peer replica's write arrives as a `remote` epoch bump and retires it; every other non-`write` bump (`metadata`, `manual`) retires it too. A 30-second bound covers what no seam sees: a peer's write with no bridge attached, which on the shipped default (the grants cache off) is every peer's write, so there the bound is the only cover for it; a write that started before the engine's observer registered; and a write inside a transaction that has not committed yet. A Default Organization that is deleted and recreated, or a `default` slug moved to another organization, is read again on the next request.
 - **A failed read is not kept.** A read that fails with the authorization store unavailable propagates as before, and the next request reads again. "No Default Organization" (no organization, or several and none `default`) is a real answer and is kept.
 - **Unchanged:** the two reads, their filters and limits, and the platform-standing predicate the answer feeds. An engine without the write epoch and `registerMiddleware`, or a registry that does not hold `sys_organization`, keeps reading every time.

packages/core/src/security/resolve-authz-context.ts

@@ -951,8 +951,9 @@ const DEFAULT_ORGANIZATION_WATCHED_OBJECTS: ReadonlySet<string> = new Set([Syste
  * [#24523] The residual bound on a memoised Default Organization answer —
  * ⛔ never the in-process rule, which is the write seam. It covers only what no
  * seam can see: a peer replica's `sys_organization` write on a deployment with
- * no `authz.invalidated` bridge attached (a peer's delete-and-recreate is
- * #21868's exact failure), a write that started before this engine's observer
+ * no `authz.invalidated` bridge attached — the shipped default, where this
+ * bound is the only cover for a peer's write (a peer's delete-and-recreate is
+ * #21868's exact failure) — a write that started before this engine's observer
  * registered, and a watched write inside an engine transaction that has not
  * committed when its statement completes. The same residual bound the
  * localization success cache defaults to; the price is two reads per engine
@@ -992,9 +993,13 @@ const defaultOrganizationMemo = new WeakMap<object, DefaultOrganizationMemoEntry
  * included), delete — observed after it settles by the leg-5 write seam
  * ({@link watchedWriteState}), so a Default Organization deleted and
  * recreated is read anew on the next request (#21868 is the failure designed
- * against). Across replicas: the bridges' non-`write` epoch bumps (`remote`
- * from `authz.invalidated`, `metadata`), wholesale. Then the residual
- * {@link DEFAULT_ORGANIZATION_MEMO_TTL_MS}.
+ * against). Across replicas: only with the `authz.invalidated` bridge
+ * attached — the grants cache on (`OS_AUTHZ_GRANTS_CACHE_TTL_MS` above 0) and
+ * a cross-process cluster driver — does a peer's write arrive, as a `remote`
+ * epoch bump; that and every other non-`write` bump (`metadata`, plugin-security's
+ * local declaration bump, and `manual`) retire the answer wholesale. Then the
+ * residual {@link DEFAULT_ORGANIZATION_MEMO_TTL_MS}, on the shipped default the
+ * only cover for a peer's write.
  *
  * A stale answer can fail either way, and no design at this cost avoids the
  * granting one: a stale id withholds standing from the new Default