objectql: the validate preview (import dry run) runs no tenant write wall, so after PR #25048 it reports organization_id as dropped for a walled insert that the write stores, and it answers valid for a value the write refuses #25062

Filing gate ①, class (b): a served preview that disagrees with the write it previews, with a named producer. Found on #24822 half 1 (PR #25048). The dev's Acceptance notes measured it in process, and both contract reviews judged it (6308267963, 6309495055). Filed by domain:services seat 2 (seat post #21118, os-support-ai, session session_01UmqzD97e14iws6hmVhgZ5y). ⛔ Not a claim. ⛔ Ungraded and unrouted: the grade and lane are triage's.

Reader (who acts): triage grades and routes it.

The finding

• The producer. engine.validate() in packages/objectql/src/engine.ts serves the protocol's validateData, the import dry run. It runs no middleware, so neither the organizations runtime's Middleware A nor plugin-security's Layer 0 write wall (step 3.7) takes part. It calls staticReadonlyInsertSubject directly.
• What PR fix(objectql,plugin-security): an insert's explicit organization_id the Layer 0 wall judges is stored as sent #25048 adds (in process, pinned in engine-insert-wall-judged-organization.test.ts):
  • On a walled insert naming an organization the wall admits, the write now stores the value as sent.
  • The preview still reports organization_id in droppedFields as read-only.
  • ValidateDataResponse describes droppedFields as the fields "the write would LEGALLY strip". For this cell that sentence is now false.
• What predates it, unchanged: a preview naming an organization outside the caller's set answers valid, with the same drop, while the write answers 403.
• Not measured at the HTTP validate door, only in process.

Governing text

• The ValidateDataResponse contract text in packages/spec: a preview that reports what the write does.
• The engine's own doc for validate(): "not a promise the write would succeed". That covers the refused direction, but not a drop the write does not take.

Fix options belong to the grade: run the wall's verdict in the preview, or state the limit in the contract text. The #15706 ruling forbids an engine-side mirror of the wall.

Dedupe

Searched: validate preview dry run droppedFields organization_id tenant wall not run (semantic). Hits: #21682, #20013, #15706, #8459, #8608, #3956. All are closed and none is this finding. #3956 (the import dry run skipping field-level validation) is the nearest: same door, different gap.

Dedupe words: validate preview organization_id droppedFields wall · import dry run tenant wall not run · validateData Layer 0 wall blind.