text(spec,platform-objects): two docblocks still describe organization-less rows as live; plus two dormant organization-less code paths to confirm and retire #24902

Filing gate ①.

• finding: shipped docs text that contradicts behaviour, carried from the feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880 contract review (6291895530, nits) and its os-dev report.
• reach: readers of the published spec describes and docs.
• Reader who acts: the epic seat.
• Dedupe: none.

Text that contradicts behaviour (after 18.x step 7)

• packages/spec/src/api/events.zod.ts ~259-262: a bullet about single-posture stamping contradicts content/docs/.../schema.mdx, as feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880 corrected it. Under D9 the engine derives the Default Organization under single. This is a describe, so regenerate the artifacts.
• packages/platform-objects/src/.../sys-sharing-rule.object.ts ~99: "null = global". Since feat(plugin-sharing,plugin-approvals,metadata-protocol)!: 18.x step 7 part 7a-3 — the organization-less readers of sharing rules, approval units and the seed loader retire #24828 a declared rule is deployment-wide through the typed deploymentWide marker, and a stored row has an organization.
• Gate nit: scripts/check-tenant-chokepoint.mjs ~397 would refuse where(tenantRef, 'is not', null), against its own header (~136). Neither spelling is present today, but align the header and the rule.

Dormant code paths (confirm, then retire or keep with a reason)

• organizationOutOfWriteReach: written against the retired driver NULL arm, now dormant.
• The sys_record_share organization backfill's apply pass (plugin-sharing/src/backfill-sys-record-share-organizations.ts): dead on certified databases.
• Keep plugin-auth's two readers out of this card; they are measure(plugin-auth): the organization-less admin_full_access anchor in the last-admin guard and the pre-organization default-org bootstrap, after ADR-0131 step 7 #24883.