@@ -0,0 +1,11 @@
+---
+'@objectstack/client': patch
+---
+
+Clause-②: no
+
+fix(client): `client.automation.getRuntimeStatus()` types its rows as the declared contract `FlowRuntimeState` (#23859)
+
+**What was wrong.** The method declared its answer as `{ flows: Array<{ name, enabled, bound }>; total }`. `GET /automation/_status` serves the automation engine's `getFlowRuntimeStates()` rows unchanged, and each row is the contract `FlowRuntimeState` from `@objectstack/spec/contracts`. The SDK's type therefore hid five optional fields the wire already carries: `status`, `triggerType`, `object`, `reason` (one sentence saying why an enabled, triggered flow is not armed) and `unboundCause` (which of the closed `FLOW_UNBOUND_CAUSES` that sentence describes). A caller that read `row.reason` or `row.unboundCause` got a type error and either cast past it or concluded the field did not exist.
+
+**What changes.** The return type is now `Promise<{ flows: FlowRuntimeState[]; total: number }>`. `name`, `enabled` and `bound` stay required, so existing callers compile unchanged. Read `row.unboundCause` to classify an unarmed flow, and render `row.reason` without parsing it. The request, the route and the values on the wire are unchanged.
@@ -0,0 +1,13 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os migrate organization-ownership` plans a v17 database that still holds the retired `sys_scim_provider` table, listing it as fate 4 instead of refusing it (ADR-0131 D10)
+
+Clause-②: no
+
+`sys_scim_provider` was retired from the platform before the ceremony's inventory was taken, so the inventory had no row for it. Its ADR-0087 entry (`scim-provider-object-retired`) leaves the table in place, untouched, by ruling, so every database that booted a release from before the retirement still holds it, `organization_id` column included. The plan refused such a database with `uninventoried-platform-table` (`sys_scim_provider carries organization_id but the ADR-0131 D10 inventory gives it no fate`), and so did `--apply`, so the ceremony could not run there at all and `os dev` / `os serve` stayed refused.
+
+- **Now** the inventory lists `sys_scim_provider` with fate 4 (`report`), under a new census population, `retired-before-census`. The plan reports its rows and its NULL-organization rows by id. It never attributes them, not even to the Default Organization under `single`, and never deletes them.
+- **NOT NULL:** the table is exempt, so the plan reports it as not receiving NOT NULL. The object is retired, no declaration anchors tenancy on the column, and a SCIM connection scoped to no organization was a legitimate row.
+- The plan's `inventoryDigest` changes with the new row. A plan file written by an earlier CLI no longer matches, so `--apply --plan-file` refuses it with `plan-digest-mismatch`. Re-run `os migrate organization-ownership --out PLAN`, review it, and apply that.
@@ -2,8 +2,9 @@
 
 /**
  * The ADR-0131 D10 inventory's enumeration pin: every object of both #13564
- * censuses, of the platform registry as it stands, and of the cloud supplement
- * carries exactly one fate and a citation. A platform object that lands
+ * censuses, of the platform registry as it stands, of the objects retired
+ * before either census, and of the cloud supplement carries exactly one fate
+ * and a citation. A platform object that lands
  * without an inventory row turns this red by name — the plan would refuse its
  * table on a real database, and this says so before any database does.
  */
@@ -18,6 +19,7 @@ import {
   PLATFORM_OBJECTS_BY_PACKAGE,
   type OrganizationOwnershipSupplementEntry,
 } from '@objectstack/spec/system';
+import { MIGRATIONS_BY_MAJOR } from '@objectstack/spec/migrations';
 import { securityDefaultPermissionSets } from '@objectstack/plugin-security';
 import {
   HostFateSupplementRefusal,
@@ -81,6 +83,15 @@ const CENSUS_2026_08_31_EXAMPLES = [
   'showcase_task', 'showcase_team', 'todo_task',
 ] as const;
 
+/**
+ * Platform objects retired from the tree before the first census was
+ * measured: neither census counted them and the registry no longer names
+ * them, yet a database that booted an earlier release still holds the table,
+ * `organization_id` included. Frozen: a record of what was retired, keyed to
+ * the ADR-0087 entry each row's citation names.
+ */
+const RETIRED_BEFORE_CENSUS = { sys_scim_provider: 'scim-provider-object-retired' } as const;
+
 /**
  * #14570 and #15086, read in: each population's table has its own fate, citing
  * the record that read it in (a runtime string carries no tracker number).
@@ -107,6 +118,31 @@ describe('ADR-0131 D10 inventory — every censused object has one fate and a ci
     expect(unlisted(registered)).toEqual([]);
   });
 
+  it('retired before either census: listed with fate 4, citing its ADR-0087 entry and no tracker number', () => {
+    const retired = Object.keys(RETIRED_BEFORE_CENSUS);
+    const counted = [...CENSUS_2026_08_31_PLATFORM_WITH_COLUMN, ...CENSUS_2026_08_31_PLATFORM_WITHOUT_COLUMN] as readonly string[];
+    const registered = new Set(Object.values(PLATFORM_OBJECTS_BY_PACKAGE).flat());
+    expect(unlisted(retired)).toEqual([]);
+    for (const [object, adr0087Entry] of Object.entries(RETIRED_BEFORE_CENSUS)) {
+      // The population's premise: no census counted it and the tree no longer declares it.
+      expect(counted, object).not.toContain(object);
+      expect(registered.has(object), object).toBe(false);
+      // The entry the citation names exists, and its ruling is what licenses fate 4: the table stays untouched.
+      const semantic = Object.values(MIGRATIONS_BY_MAJOR).flatMap((step) => step.semantic).find((s) => s.id === adr0087Entry);
+      expect(semantic?.acceptanceCriteria, adr0087Entry).toContain('left in place untouched');
+      const entry = inventoryEntryFor(object)!;
+      expect(entry, object).toMatchObject({ census: ['retired-before-census'], fate: 'report' });
+      expect(entry.citation, object).toContain(adr0087Entry);
+      // A runtime string carries no tracker number.
+      expect(entry.citation, object).not.toMatch(/#\d/);
+      expect(entry.notNullExempt, object).toBeTruthy();
+    }
+    // Control: no other row claims the population.
+    expect(
+      ORGANIZATION_OWNERSHIP_INVENTORY.filter((e) => e.census.includes('retired-before-census')).map((e) => e.object).sort(),
+    ).toEqual([...retired].sort());
+  });
+
   it('the cloud supplement: listed as cloud-carried, fate 4, never a guessed fate', () => {
     expect(CLOUD_PROVIDED_OBJECT_NAMES.length).toBeGreaterThan(0);
     expect(unlisted(CLOUD_PROVIDED_OBJECT_NAMES)).toEqual([]);
 
@@ -24,6 +24,13 @@
  *  - `platform-census-main` — objects the gated census on `main` lists and
  *    the first census did not (`sys_comment_reaction`, `sys_flow_credential`,
  *    `sys_platform_setting`).
+ *  - `retired-before-census` — platform objects retired from the tree before
+ *    the first census was measured, so neither census counted them, whose
+ *    physical tables a database that booted an earlier release still holds,
+ *    `organization_id` included (`sys_scim_provider`, whose ADR-0087 entry
+ *    leaves the table in place untouched). Without a row the plan would
+ *    refuse every such database as carrying an uninventoried platform table.
+ *    Each row is listed with fate 4 and cites the retirement's ADR-0087 entry.
  *  - `example-census-2026-08-31` — the non-platform objects the same census
  *    counted as "28" (it counted the 28 FILES; they declare 33 objects, the
  *    same 33 on `main` today).
@@ -94,6 +101,7 @@ export const ORGANIZATION_OWNERSHIP_FATES: readonly OrganizationOwnershipFate[]
 export type InventoryCensus =
   | 'platform-census-2026-08-31'
   | 'platform-census-main'
+  | 'retired-before-census'
   | 'example-census-2026-08-31'
   | 'cloud-supplement'
   | 'host-supplement';
@@ -191,6 +199,7 @@ const EXAMPLE =
 const P1: readonly InventoryCensus[] = ['platform-census-2026-08-31', 'platform-census-main'];
 const P1_ONLY: readonly InventoryCensus[] = ['platform-census-2026-08-31'];
 const PMAIN: readonly InventoryCensus[] = ['platform-census-main'];
+const RETIRED: readonly InventoryCensus[] = ['retired-before-census'];
 const EX: readonly InventoryCensus[] = ['example-census-2026-08-31'];
 
 /** Rows a package or the platform seeded — the D10 fate-2 mirror selector on the catalog objects. */
@@ -439,6 +448,22 @@ export const ORGANIZATION_OWNERSHIP_INVENTORY: readonly InventoryEntry[] = [
     citation: `${CENSUS_1}; removed from the tree since (re-verification record 6018712820). A physical table left by an older release is listed, its NULL rows reported`,
   },
 
+  // ── Platform: retired before either census (fate 4) ──
+  {
+    object: 'sys_scim_provider',
+    census: RETIRED,
+    fate: 'report',
+    citation:
+      'ADR-0087 semantic entry scim-provider-object-retired (packages/spec/src/migrations/entries/semantic/' +
+      '18.scim-provider-object-retired.ts): the rc.1-era @better-auth/scim connection object, retired before the ' +
+      'first census with no data-migration path owed (maintainer ruling 2026-08-24), its tables in deployed ' +
+      'databases left in place untouched by ruling. A physical table left by an older release is listed, its NULL ' +
+      'rows reported, never attributed and never deleted',
+    notNullExempt:
+      'the object is retired and its table is left in place untouched, by ruling: no declaration anchors tenancy on ' +
+      'the column, and a connection scoped to no organization was a legitimate row',
+  },
+
   // ── Platform: attribution through a parent anchor (fate 3) ──
   {
     object: 'sys_file',
 
@@ -21,6 +21,7 @@ import {
   type PlanReader,
   type TablePlan,
 } from './organization-ownership-plan.js';
+import { ORGANIZATION_OWNERSHIP_INVENTORY } from './organization-ownership-inventory.js';
 
 let dir: string;
 let file: string;
@@ -222,6 +223,48 @@ describe('ADR-0131 D10 preflight — the per-table plan', () => {
     expect(table(p, 'crm_deal').unattributable).toEqual([{ id: 'deal_2', reason: expect.stringContaining('no Default Organization') }]);
   });
 
+  it('a v17 database still holding the retired sys_scim_provider plans, listing it as fate 4', async () => {
+    // The rc.1-era table every database that booted before the retirement still
+    // holds, in its last declared shape. Neither census counted the object.
+    db.exec(`
+      CREATE TABLE sys_scim_provider (
+        id TEXT PRIMARY KEY, provider_id TEXT, provider_key TEXT, scim_token TEXT,
+        organization_id TEXT, user_id TEXT, created_at TEXT, updated_at TEXT
+      );
+      INSERT INTO sys_scim_provider VALUES
+        ('scim_1', 'okta-scim', 'org_b:okta-scim', 'hash_1', 'org_b', 'usr_1', '2026-07-01', '2026-07-01'),
+        ('scim_2', 'entra-scim', NULL, 'hash_2', NULL, NULL, '2026-07-02', '2026-07-02');
+    `);
+
+    for (const posture of ['isolated', 'single']) {
+      const scim = table(await plan(posture), 'sys_scim_provider');
+      expect(scim, posture).toMatchObject({
+        source: 'inventory',
+        fate: 'report',
+        physical: 'present',
+        organizationColumn: 'present',
+        rows: { total: 2, organizationNull: 1, stamped: 1 },
+        fateCounts: { reportedRows: 1 },
+        // Reported, never attributed — not even to the Default Organization under single.
+        unattributable: [{ id: 'scim_2', reason: 'fate 4: reported, never guessed' }],
+        notNull: { willReceive: false, reason: expect.stringContaining('left in place untouched') },
+      });
+      expect(scim.census, posture).toEqual(['retired-before-census']);
+      expect(scim.citation, posture).toContain('scim-provider-object-retired');
+    }
+
+    // Control: without its row the same database is refused, by name.
+    const r = await refusal(
+      buildOrganizationOwnershipPlan({
+        reader: reader(),
+        posture: 'isolated',
+        database: file,
+        inventory: ORGANIZATION_OWNERSHIP_INVENTORY.filter((e) => e.object !== 'sys_scim_provider'),
+      }),
+    );
+    expect(r).toMatchObject({ reason: 'uninventoried-platform-table', table: 'sys_scim_provider' });
+  });
+
   it('under single with no Default Organization, nothing is assigned and the reason says why', async () => {
     db.exec("UPDATE sys_organization SET slug = 'renamed' WHERE id = 'org_default'");
     const p = await plan('single');
 
@@ -163,6 +163,7 @@ import type {
   AudienceBindingSuggestionSync,
   AutomationResult,
   DelegableScope,
+  FlowRuntimeState,
   ImportObjectResult,
   ObjectDraft,
   RecordShare,
@@ -5664,8 +5665,13 @@ export class ObjectStackClient {
       /**
        * Runtime enable/bound state for every flow — engine state, not
        * persisted metadata (backs the Studio's Automations status badges).
+       *
+       * [#23859] Each row is the declared contract `FlowRuntimeState`: the
+       * route serves `getFlowRuntimeStates()` rows unchanged, so the optional
+       * `status` / `triggerType` / `object` / `reason` / `unboundCause` reach
+       * the caller. A hand-typed `{ name, enabled, bound }` hid them.
        */
-      getRuntimeStatus: async (): Promise<{ flows: Array<{ name: string; enabled: boolean; bound: boolean }>; total: number }> => {
+      getRuntimeStatus: async (): Promise<{ flows: FlowRuntimeState[]; total: number }> => {
           const route = this.getRoute('automation');
           const res = await this.fetch(`${this.baseUrl}${route}/_status`);
           return this.unwrapResponse(res);
 
@@ -84,6 +84,8 @@ import type {
     AnalyticsResult,
     AutomationResult,
     DelegableScope,
+    FlowRuntimeState,
+    FlowUnboundCause,
     ImportObjectResult,
     RecordShare,
     RemoteTable,
@@ -1418,6 +1420,45 @@ export function metaResetResponseDeclaresTheWireReceipt(): void {
     void metaResetBody.projectionApplied;
 }
 
+/**
+ * [#23859] `automation.getRuntimeStatus()` hand-typed its rows as
+ * `{ name, enabled, bound }`. `GET /automation/_status` serves the engine's
+ * `getFlowRuntimeStates()` rows unchanged (that pass-through is pinned in
+ * `packages/runtime/src/domain-handler-registry.test.ts`), and those rows are
+ * the declared contract `FlowRuntimeState`. The narrower annotation hid
+ * `status`, `triggerType`, `object`, `reason` and `unboundCause` from every SDK
+ * caller, who then cast past it or concluded the fields did not exist.
+ *
+ * Type-level for the reason this file's header gives: the runtime pin in
+ * `meta-automation-descriptors.test.ts` is green against either annotation.
+ */
+type RuntimeStatusRow = Awaited<ReturnType<ObjectStackClient['automation']['getRuntimeStatus']>>['flows'][number];
+
+export async function returnTypePrecisionPins23859(): Promise<void> {
+    // ── the answer IS the contract, envelope and element ──────────────────
+    // RED BEFORE: the hand-typed element is not `FlowRuntimeState`.
+    expectTypeOf(await client.automation.getRuntimeStatus()).toEqualTypeOf<{
+        flows: FlowRuntimeState[];
+        total: number;
+    }>();
+
+    // ── the optional fields a caller can now read, with the contract's own
+    //    optionality and vocabulary ──────────────────────────────────────
+    // RED BEFORE: each indexed access is TS2339 on the hand-typed row.
+    expectTypeOf<RuntimeStatusRow['reason']>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<RuntimeStatusRow['unboundCause']>().toEqualTypeOf<FlowUnboundCause | undefined>();
+    expectTypeOf<RuntimeStatusRow['status']>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<RuntimeStatusRow['triggerType']>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<RuntimeStatusRow['object']>().toEqualTypeOf<string | undefined>();
+
+    // ⚠️ GREEN IN BOTH STATES, a compatibility guard rather than evidence: the
+    // three fields the old annotation named stay REQUIRED, so a caller that
+    // read them still compiles.
+    expectTypeOf<RuntimeStatusRow['name']>().toEqualTypeOf<string>();
+    expectTypeOf<RuntimeStatusRow['enabled']>().toEqualTypeOf<boolean>();
+    expectTypeOf<RuntimeStatusRow['bound']>().toEqualTypeOf<boolean>();
+}
+
 describe('client SDK return-type precision (#8140)', () => {
     it('exposes the type-level pins to tsc without executing a request', () => {
         // The assertions above are evaluated by `tsc` under
@@ -1439,6 +1480,7 @@ describe('client SDK return-type precision (#8140)', () => {
         expect(typeof returnTypePrecisionPins13023).toBe('function');
         expect(typeof deleteDataResponseIsNotTheMetaResetShape).toBe('function');
         expect(typeof metaResetResponseDeclaresTheWireReceipt).toBe('function');
+        expect(typeof returnTypePrecisionPins23859).toBe('function');
         expect(typeof commitRollbackResponseIsNotTheVersionRollbackShape).toBe('function');
         // `environmentIsNotTheCloudWireRow` left with its subject (#16325): the
         // guard is now the `@ts-expect-error`'d import at the top of the file.
 
@@ -1630,7 +1630,8 @@ describe('#9084 — the rest-server.ts transport tripwire keys off mechanics', (
     // [#23050 slice 6] Length 6 → 7 (`security-routes.ts`), still 0 over it.
     // [#23050 slice 7] Length 7 → 8 (`discovery-routes.ts`), still 0 over it.
     // [#23050 slice 8] Length 8 → 9 (`email-routes.ts`), still 0 over it.
-    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(9);
+    // [#23050 slice 9] Length 9 → 10 (`search-routes.ts`), still 0 over it.
+    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(10);
     expect(REST_SERVER_REGISTRAR_PATHS[0]).toBe(REST_SERVER);
     const listed = REST_SERVER_REGISTRAR_PATHS.map((file) => readFileSync(join(REPO_ROOT, file), 'utf8'));
     for (const probe of [MECHANICS, ROUTES]) {