@@ -0,0 +1,10 @@
+---
+'@objectstack/cli': patch
+---
+
+fix: `os migrate apply --allow-destructive` no longer says the organization-ownership ceremony verified on a database that was created from empty
+
+Clause-②: no
+Metadata-protocol: none
+
+On a database an 18.x release created from empty, the ceremony's `sys_migration` row is the birth marker the boot guard writes (`details.birth`): it records that no ceremony was owed, not that one ran. When such a database dropped an `organization_id` column, the success line still read "the organization-ownership ceremony verified (TIME)", with TIME being the database's creation. The line now says which row let the drop through: for a birth marker, that the database was created from empty (its creation time and the platform version that created it) and the ceremony is not needed for it; for a ceremony run, the same sentence as before. The line is read from the marker the gate already reads, with no second database read. `--json` output, exit codes and which drops are allowed are unchanged.
@@ -182,6 +182,80 @@ describe('os migrate apply --allow-destructive: the organization-ownership refus
   }
 });
 
+/**
+ * The two rows that let the drop through, as each writer stores it: the boot
+ * guard's birth marker (`details.birth`, on a datastore created from empty)
+ * and the ceremony's verified run (`details: { checkpoint }`).
+ */
+const BIRTH_AT = '2026-10-23T15:07:36.127Z';
+const BIRTH_MARKER = {
+  id: 'adr-0131-organization-ownership', last_run_at: BIRTH_AT, verified_at: BIRTH_AT, applied_at: null, blocking: 0, advisory: 0,
+  details: JSON.stringify({ birth: { shapeGeneration: 1, platformVersion: '18.0.0', createdAt: BIRTH_AT } }),
+};
+const CEREMONY_RUN = {
+  ...VERIFIED,
+  details: JSON.stringify({ checkpoint: { ceremony: 'ADR-0131 D10', inventoryDigest: 'd1', shapeGeneration: 1, completed: {} } }),
+};
+
+/** The success line the human face printed for this gate. */
+function organizationSuccessLine(): string | undefined {
+  return log.mock.calls.map((c: unknown[]) => c.map(String).join(' '))
+    .find((line: string) => line.includes('organization_id on sys_platform_setting:'));
+}
+
+describe('os migrate apply --allow-destructive: the success line names the row that let the drop through', () => {
+  it('a birth marker: the database was created from empty, at its creation time, and no ceremony is claimed', async () => {
+    bootWithOrganizationDrop();
+    mocks.readOrganizationOwnershipMarker.mockResolvedValue({ verified: true, flag: BIRTH_MARKER });
+
+    const { exit } = await runApply(ARGV);
+
+    expect(exit).toBe(0);
+    expect(applyMigrationEntries).toHaveBeenCalledTimes(1);
+    const line = organizationSuccessLine();
+    expect(line, 'the gate printed its success line').toBeDefined();
+    expect(line).toContain('created from empty');
+    expect(line).toContain(BIRTH_AT);
+    expect(line).toContain('birth marker');
+    expect(line).not.toContain('ceremony verified');
+  }, RUN_TIMEOUT);
+
+  it('a ceremony run: the line keeps saying the ceremony verified, at its verified time', async () => {
+    bootWithOrganizationDrop();
+    mocks.readOrganizationOwnershipMarker.mockResolvedValue({ verified: true, flag: CEREMONY_RUN });
+
+    const { exit } = await runApply(ARGV);
+
+    expect(exit).toBe(0);
+    expect(applyMigrationEntries).toHaveBeenCalledTimes(1);
+    const line = organizationSuccessLine();
+    expect(line).toContain(`the organization-ownership ceremony verified (${CEREMONY_RUN.verified_at})`);
+    expect(line).not.toContain('birth marker');
+  }, RUN_TIMEOUT);
+
+  it('a birth marker under --json: the document is the one a ceremony run gets, and no success line is printed', async () => {
+    const payloads = [];
+    for (const flag of [BIRTH_MARKER, CEREMONY_RUN]) {
+      stdout.mockClear();
+      log.mockClear();
+      bootWithOrganizationDrop();
+      mocks.readOrganizationOwnershipMarker.mockResolvedValue({ verified: true, flag });
+      const { exit, payload } = await runApply([...ARGV, '--json']);
+      expect(exit).toBe(0);
+      expect(organizationSuccessLine()).toBeUndefined();
+      payloads.push(payload);
+    }
+    // `duration` is each run's own wall time, so it is checked for shape and
+    // normalised; every other field must be equal.
+    for (const payload of payloads) {
+      expect(typeof payload.duration).toBe('number');
+      expect(payload.duration).toBeGreaterThanOrEqual(0);
+    }
+    const [birth, ceremony] = payloads.map((payload) => ({ ...payload, duration: 0 }));
+    expect(birth).toEqual(ceremony);
+  }, RUN_TIMEOUT);
+});
+
 describe('control', () => {
   it('a verified marker lets the drop through and exits 0, so the harness can tell a refusal from a run', async () => {
     bootWithOrganizationDrop();
 
@@ -36,7 +36,7 @@ import {
 } from '../../utils/schema-migration-plugins.js';
 import { OCCUPANCY_HINT, probeMigrationTarget } from '../../utils/migrate-occupancy-gate.js';
 import { describeOccupancy } from '../../utils/sqlite-occupancy.js';
-import { ceremonyOrganizationColumnDrops } from '../../utils/organization-ownership-drop-gate.js';
+import { ceremonyOrganizationColumnDrops, organizationOwnershipBirthOf } from '../../utils/organization-ownership-drop-gate.js';
 import {
   DropGateReads,
   describeDriftEntries,
@@ -627,9 +627,17 @@ export default class MigrateApply extends Command {
           return;
         }
         if (!flags.json) {
+          // Say which row let the drop through (#25466): a birth marker
+          // records that no ceremony was owed, never that one ran.
+          const birth = organizationOwnershipBirthOf(marker.flag);
           printSuccess(
-            `organization_id on ${organizationDrops.join(', ')}: the organization-ownership ceremony verified `
-            + `(${marker.flag?.verified_at}) — the drop may proceed.`,
+            birth
+              ? `organization_id on ${organizationDrops.join(', ')}: this database was created from empty `
+                + `(${birth.createdAt}${birth.platformVersion ? `, platform ${birth.platformVersion}` : ''}) and carries the `
+                + 'organization-ownership birth marker, so it holds no legacy organization rows and the ceremony is not '
+                + 'needed for it — the drop may proceed.'
+              : `organization_id on ${organizationDrops.join(', ')}: the organization-ownership ceremony verified `
+                + `(${marker.flag?.verified_at}) — the drop may proceed.`,
           );
         }
       }
 
@@ -38,7 +38,7 @@
  */
 
 import type { MigrationFlagEngine } from '@objectstack/platform-objects/system';
-import type { DataMigrationFlag } from '@objectstack/spec/system';
+import { OrganizationOwnershipBirthMarkerSchema, type DataMigrationFlag } from '@objectstack/spec/system';
 
 /** The column the ceremony owns the drop of. */
 export const ORGANIZATION_COLUMN = 'organization_id';
@@ -67,3 +67,39 @@ export async function readOrganizationOwnershipMarker(
   const flag = await readDataMigrationFlag(engine, ORGANIZATION_OWNERSHIP_MIGRATION_ID);
   return { verified: isDataMigrationFlagVerified(flag), flag };
 }
+
+/**
+ * Which row let the drop through, for the success line `os migrate apply`
+ * prints: the BIRTH MARKER or a ceremony run. Both are the ceremony's
+ * verified `sys_migration` row, and the gate treats them alike; only the text
+ * differs. The boot guard writes the birth marker on a datastore it observed
+ * being created from empty, with `details.birth`
+ * (`OrganizationOwnershipBirthMarkerSchema`, `@objectstack/spec/system`); the
+ * ceremony writes `details: { checkpoint }`, replacing the whole field, so a
+ * row carries one or the other. It claims no ceremony ran, so the line must
+ * not say one verified.
+ *
+ * Pure: it reads the `flag` the gate's one marker read returned, never the
+ * database again. Answers `null` for a ceremony run, a row without details,
+ * or no row; `createdAt` falls back to the row's `verified_at` (the guard
+ * writes both from one clock) when the birth object does not parse.
+ */
+export function organizationOwnershipBirthOf(
+  flag: Pick<DataMigrationFlag, 'details' | 'verified_at'> | null,
+): { createdAt: string | null; platformVersion: string | null } | null {
+  if (!flag) return null;
+  let details: unknown = flag.details;
+  if (typeof details === 'string') {
+    try {
+      details = JSON.parse(details);
+    } catch {
+      return null;
+    }
+  }
+  const birth = (details as { birth?: unknown } | null)?.birth;
+  if (birth === null || typeof birth !== 'object') return null;
+  const parsed = OrganizationOwnershipBirthMarkerSchema.safeParse(birth);
+  return parsed.success
+    ? { createdAt: parsed.data.createdAt, platformVersion: parsed.data.platformVersion }
+    : { createdAt: flag.verified_at ?? null, platformVersion: null };
+}