@@ -5,7 +5,7 @@
 
 fix(objectql, plugin-auth)!: deleting an organization that still owns records is refused with 409 and a per-table count, before anything is deleted; an empty one is deleted whole, its teams and organization-admin grants with it; the engine never clears a tenant column
 
-**The 18.0.0 defect this fixes.** `POST /api/v1/auth/organization/delete` ran better-auth's delete, which removes the organization's members, then its invitations, then the organization row, as three separate writes. The engine's delete cascade then applied the tenant column's `set_null` default to every row the organization still owned. On a database whose tenant column is NOT NULL (one that took the v18 organization-ownership ceremony), the delete answered 500 on `sys_team.organization_id` after the members and invitations were already gone, so the organization survived with no owner and nobody could delete it. On a database 18.0.0 created, where the column is still nullable, the delete answered 200 and left the organization's teams and records with `organization_id = NULL`, owned by nobody and visible to nobody. Every organization created through the door owns a default team, so on a NOT NULL database not even an empty organization could be deleted. Deployments that run `single` are not reached: their one organization keeps the last-administrator guard's 403, and they cannot create another.
+**The 18.0.0 defect this fixes.** `POST /api/v1/auth/organization/delete` ran better-auth's delete, which removes the organization's members, then its invitations, then the organization row, as three separate writes. The engine's delete cascade then applied the tenant column's `set_null` default to every row the organization still owned. On a database whose tenant column is NOT NULL (one that took the v18 organization-ownership ceremony), the delete answered 500 on `sys_team.organization_id` after the members and invitations were already gone, so the organization survived with no owner and nobody could delete it. On a database 18.0.0 created, where the column is still nullable, the delete answered 200 and left the organization's teams and records with `organization_id = NULL`, owned by nobody and visible to nobody. Every organization created through the door owns a default team, so on a NOT NULL database not even an empty organization could be deleted. Deployments that run `single` are not reached the same way: their one organization is the Default Organization, which the last-administrator guard answers first, and they cannot create another.
 
 **What happens now.**
 
@@ -14,8 +14,9 @@ fix(objectql, plugin-auth)!: deleting an organization that still owns records is
 - Engine-owned rows (objects declared `managedBy: 'engine-owned'`) are treated the same way. The platform writes them as a consequence of records or activity, and an administrator cannot delete them over the data API: approval requests, approvers and tokens; automation runs; notifications, their receipts and deliveries; outgoing HTTP deliveries; mailboxes and mirrored mail; record shares and share links; import jobs; audience-binding suggestions; and organization-level settings values and their audit. They never refuse the delete, and they are kept, still naming the deleted organization.
 - So engine-owned and append-only rows outlive the organization, and go on naming it. Under tenant scoping no organization reads them.
 - An attribution column `organization_id` on an object whose tenancy is disabled is kept the same way: not counted, not cleared. A pointer to the organization, such as a session's or an API key's `active_organization_id`, is cleared as before.
+- The Default Organization (slug `default`, or the deployment's only organization, never under an organization wall) is asked the last-administrator guard's question first, and answers `403 PERMISSION_DENIED` while deleting it would leave no platform administrator. Once the guard admits, it is counted like any other organization, before better-auth deletes anything, except that only its members and invitations are left out: its teams and grants are not removed, so they count, and the delete is refused `409 DELETE_RESTRICTED` while it holds them.
 - An organization that owns nothing but its own auth structure is deleted whole: its members and invitations (better-auth), and its teams, their members and the organization-admin grants its owners and admins hold (plugin-auth, from `beforeDeleteOrganization`). Any other grant scoped to the organization counts as a record.
-- The request runs as one engine transaction and rolls back on any error answer, so a delete either removes all of that or none of it. On a datasource whose driver has no transactions, the refusals are the guarantee, because both run before the first write: the record count above, and, for the Default Organization, the last-administrator guard, whose `403` is now asked before better-auth deletes any member (it used to arrive after the members and invitations were gone).
+- The request runs as one engine transaction and rolls back on any error answer, so a delete either removes all of that or none of it. On a datasource whose driver has no transactions, the refusals are the guarantee, because all of them run before the first write: the record count above, and, for the Default Organization, the last-administrator guard, whose `403` is now asked before better-auth deletes any member (it used to arrive after the members and invitations were gone).
 - Under all of this, the engine itself refuses to delete a `sys_organization` row while any row still names it in its tenant column, whatever path reaches the delete: `409 DELETE_RESTRICTED` with the same `dependents` list, which better-auth's door now carries to the wire too. It counts each table rather than reading its rows. An organization is deleted by id only: a delete matching organizations by a filter (`multi: true`) is refused with `409 DELETE_RESTRICTED` naming the by-id route, because only the by-id delete runs this referential pass. A tenant column is never set to NULL.
 - `ObjectQL.organizationOwnedRowCounts(organizationId, { exclude })` answers, per object, how many rows name an organization in their tenant column. It is the question the refusal asks.
 
 
@@ -388,6 +388,48 @@ describe('[#24948] references the delete keeps as they are (seat decision 630599
   });
 });
 
+describe('[#24948] the organization counts carry none of the caller\'s tenant scope (delta review R2)', () => {
+  /**
+   * A tenant layer: scopes every `acct` read whose context carries a
+   * `tenantId` to that organization, as a tenant-scoping middleware does. A caller acting in
+   * OTHER_ORG must not read 0 rows for ORG_ID and pass the refusal.
+   */
+  const scopeByTenant = (engine: ObjectQL) =>
+    engine.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {
+      const tenantId = opCtx.context?.tenantId;
+      if (tenantId && opCtx.object === 'acct' && opCtx.ast) {
+        opCtx.ast.where = { ...(opCtx.ast.where ?? {}), organization_id: tenantId };
+      }
+      await next();
+    });
+  const foreign = { userId: 'u1', tenantId: OTHER_ORG } as any;
+
+  it('organizationOwnedRowCounts counts the organization\'s rows under a foreign tenant scope', async () => {
+    const { engine, store } = await makeEngine([ORGANIZATION, ACCOUNT]);
+    scopeByTenant(engine);
+    store.seed('acct', { id: 'a1', organization_id: ORG_ID });
+    store.seed('acct', { id: 'a2', organization_id: ORG_ID });
+    // CONTROL: the tenant layer is live, and scopes this caller's own count away.
+    expect(await engine.count('acct', { where: { organization_id: ORG_ID }, context: foreign })).toBe(0);
+
+    expect(await engine.organizationOwnedRowCounts(ORG_ID, { context: foreign })).toEqual([{ object: 'acct', count: 2 }]);
+  });
+
+  it('the engine refusal still refuses a caller scoped to another organization', async () => {
+    const { engine, store } = await makeEngine([ORGANIZATION, ACCOUNT]);
+    scopeByTenant(engine);
+    store.seed('acct', { id: 'a1', organization_id: ORG_ID });
+
+    const err: any = await engine
+      .delete('sys_organization', { where: { id: ORG_ID }, context: { ...foreign, isSystem: true } } as any)
+      .then(() => null, (e: any) => e);
+
+    expect(err?.code).toBe('DELETE_RESTRICTED');
+    expect(err?.dependents?.map((d: { object: string }) => d.object)).toEqual(['acct']);
+    expect(store.writes).toEqual([]);
+  });
+});
+
 describe('[#24948] the predicate path is refused for an organization', () => {
   it('a multi delete of sys_organization is refused, by id only, before anything is written', async () => {
     const { engine, store } = await makeEngine([ORGANIZATION, ACCOUNT]);
 
@@ -20090,13 +20090,30 @@ export class ObjectQL implements IObjectQLEngine {
       return { where, count: probed.filter((row) => !cascadeSetHas(cascadeSet.members, childName, row?.id)).length };
     }
     try {
-      return { where, count: await this.count(childName, { where, context: ObjectQL.referenceCheckContext(context) }) };
+      return { where, count: await this.count(childName, { where, context: ObjectQL.organizationCountContext(context) }) };
     } catch (error) {
       if (isMissingTableError(error, childName)) return { where, count: 0 };
       throw error;
     }
   }
 
+  /**
+   * [#24948] The context an organization's row counts run under: system
+   * identity, and nothing of the caller's scope. A `tenantId` carried in from
+   * a caller acting in another organization would scope the count to THAT
+   * organization and read 0 rows naming this one, so the refusal would pass on
+   * an undercount. Only the request's transaction and trace are kept: the
+   * count must see the request's own uncommitted writes. The ordinary
+   * reference probes keep the caller's scope ({@link referenceCheckContext}).
+   */
+  private static organizationCountContext(context?: ExecutionContext): ExecutionContext {
+    return {
+      isSystem: true,
+      ...(context?.transaction !== undefined ? { transaction: context.transaction } : {}),
+      ...(context?.traceId !== undefined ? { traceId: context.traceId } : {}),
+    } as ExecutionContext;
+  }
+
   /**
    * [#24948] May the refusal disclose `count` to the caller? Only when the
    * caller's own identity counts the same rows: the elevated count read rows
@@ -20222,7 +20239,7 @@ export class ObjectQL implements IObjectQLEngine {
       try {
         count = await this.count(childName, {
           where: this.referenceProbeFilter(tenantField, fdef, organizationId),
-          context: ObjectQL.referenceCheckContext(options?.context),
+          context: ObjectQL.organizationCountContext(options?.context),
         });
       } catch (error) {
         if (isMissingTableError(error, childName)) continue;
 
@@ -212,6 +212,7 @@ import {
 import {
   ORGANIZATION_DELETE_PATH,
   ORGANIZATION_DELETE_REFUSAL_CODE,
+  defaultOrganizationDeleteRefusal,
   isDefaultOrganizationTarget,
   organizationDeleteRefusal,
   organizationNotEmptyBody,
@@ -8112,9 +8113,11 @@ export class AuthManager {
    * refusal, and no count. Everything this cannot decide falls through to the
    * vendor: no session, no organization id, no membership, a lookup that
    * failed. The COUNT does not fall through: it is the guard, and a guard that
-   * could not be evaluated must not pass, so its failure propagates. The
-   * Default Organization stays the last-administrator guard's to answer: the
-   * guard's own question is asked here, so its 403 lands before the first write.
+   * could not be evaluated must not pass, so its failure propagates, and so
+   * does a failure deciding whether the target is the Default Organization.
+   * The Default Organization is asked the last-administrator guard's question
+   * first (a 403), then its own record count (the same 409), both here, before
+   * the first write.
    */
   private async assertOrganizationDeletable(ctx: any): Promise<void> {
     const engine = this.getDataEngine();
@@ -8123,7 +8126,6 @@ export class AuthManager {
     if (!organizationId) return;
 
     let organization: any;
-    let defaultOrganization = false;
     try {
       const actor = await this.resolveActor(ctx);
       if (!actor?.userId) return; // the vendor answers 401
@@ -8145,34 +8147,42 @@ export class AuthManager {
       if (!permitted) return; // the vendor answers YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_ORGANIZATION
       organization = await sys.findOne('sys_organization', { where: { id: organizationId } });
       if (!organization) return; // the vendor answers 400
-      defaultOrganization = await isDefaultOrganizationTarget(engine, organization, postureEnforcesWall(resolveTenancyPosture()));
     } catch {
       // A lookup that did not complete hands the request back to the vendor,
       // which re-reads everything it decides; the engine's own refusal still
       // stands under the delete.
       return;
     }
 
-    // The Default Organization is the last-administrator guard's to answer,
-    // and it answers HERE, before the vendor's first write, so its refusal
+    // Which of the two refusals below applies is part of the guard, so it is
+    // decided outside the fall-through above: a lookup that fails here
+    // refuses, never hands the request to the vendor unasked.
+    const defaultOrganization = await isDefaultOrganizationTarget(
+      engine, organization, postureEnforcesWall(resolveTenancyPosture()),
+    );
+
+    // The Default Organization is asked the last-administrator guard's
+    // question first, HERE, before the vendor's first write, so its refusal
     // leaves every member and invitation as it was on any driver, with or
     // without transactions. The guard fails closed on a lookup it cannot
     // complete, so this never passes for want of an answer. When it admits
-    // the delete, the vendor proceeds and the engine's own refusal still holds
-    // while anything names the organization.
-    if (defaultOrganization) {
-      if (!this.organizationDeleteStandingJudge) return;
+    // the delete, the record count below is asked before the vendor's first
+    // write too, leaving out only what the vendor removes (members and
+    // invitations): plugin-auth removes none of the Default Organization's
+    // structure, so its teams and grants count.
+    if (defaultOrganization && this.organizationDeleteStandingJudge) {
       try {
         await this.organizationDeleteStandingJudge(organizationId);
       } catch (err) {
         if ((err as { code?: unknown } | null)?.code !== 'PERMISSION_DENIED') throw err;
         const { APIError } = await import('better-auth/api');
         throw new APIError('FORBIDDEN', { message: (err as Error).message, code: 'PERMISSION_DENIED' });
       }
-      return;
     }
 
-    const owned = await organizationDeleteRefusal(engine, organizationId);
+    const owned = defaultOrganization
+      ? await defaultOrganizationDeleteRefusal(engine, organizationId)
+      : await organizationDeleteRefusal(engine, organizationId);
     if (owned && owned.length > 0) {
       const { APIError } = await import('better-auth/api');
       throw new APIError('CONFLICT', { code: ORGANIZATION_DELETE_REFUSAL_CODE, ...organizationNotEmptyBody(owned) });
 
@@ -16,6 +16,8 @@ import { ORGANIZATION_ADMIN, ORGANIZATION_ADMIN_NO_BYPASS } from '@objectstack/s
 import {
   ORGANIZATION_AUTH_STRUCTURE,
   ORGANIZATION_DELETE_REFUSAL_CODE,
+  VENDOR_REMOVED_ON_DELETE,
+  defaultOrganizationDeleteRefusal,
   isDefaultOrganizationTarget,
   organizationDeleteRefusal,
   organizationNotEmptyBody,
@@ -105,6 +107,28 @@ describe('[#24948] organizationDeleteRefusal: the records the organization still
   });
 });
 
+describe('[#24948] defaultOrganizationDeleteRefusal: the Default Organization\'s count, once the guard admits', () => {
+  it('leaves out only what better-auth removes, so its teams and every grant count', async () => {
+    const owned = [{ object: 'sys_team', count: 1 }, { object: 'sys_user_permission_set', count: 2 }];
+    const { engine, asked, calls } = makeEngine({ sys_user_permission_set: [{ organization_id: ORG }] }, owned);
+    expect(await defaultOrganizationDeleteRefusal(engine, ORG)).toEqual(owned);
+    expect(asked).toEqual([{ organizationId: ORG, exclude: ['sys_member', 'sys_invitation'] }]);
+    expect([...VENDOR_REMOVED_ON_DELETE]).toEqual(['sys_member', 'sys_invitation']);
+    // No organization-admin grant is subtracted: plugin-auth removes none of them here.
+    expect(calls).toEqual([]);
+  });
+
+  it('answers undefined for an engine that cannot count, and propagates a count that fails', async () => {
+    const { engine } = makeEngine({});
+    delete engine.organizationOwnedRowCounts;
+    expect(await defaultOrganizationDeleteRefusal(engine, ORG)).toBeUndefined();
+    const failing = makeEngine({}).engine;
+    const fault = new Error('connection lost');
+    failing.organizationOwnedRowCounts = async () => { throw fault; };
+    await expect(defaultOrganizationDeleteRefusal(failing, ORG)).rejects.toBe(fault);
+  });
+});
+
 describe('[#24948] organizationNotEmptyBody: the 409 body', () => {
   it('names every table with its count and the remedy, beside the standard DELETE_RESTRICTED code', () => {
     const body = organizationNotEmptyBody([