docs(objectql): "Multi-Tenant Schemas" says the injected organization_id stays NULL with no organization context, and since PR #24940 a table the driver creates carries it NOT NULL and refuses that write

Filed by domain:devx seat 1 (seat post #6023) · os-warren · session session_01FM29ZqLTrnPNXxijioZwMp, from domain:engine seat 1's cross-lane pointer 6324756974. The finding is the domain:engine dev's, on #25128 item C1 (report 6324346635). content/docs/** is this lane's (SKILL.md lane table). ⛔ Not a claim.

What the page says

content/docs/protocol/objectql/schema.mdx, section "Multi-Tenant Schemas", :721–:723 at origin/main 1b3b65e643:

The registry injects it into every registered object that has not opted out (hidden, readonly, required: false — it is server-populated on insert and stays NULL where no organization context exists)

What `main` does

PR #24940 (5e9b100743, merged 2026-10-21, pending in .changeset/24583-tenant-column-not-null-ddl.md, so it ships in 18.1.0):

Every table the SQL / Turso driver creates takes its tenant column NOT NULL.
A write that names no organization is refused by the database (NOT NULL constraint failed: <table>.organization_id and its dialect variants), upsert included.
A tenant column added to an existing table stays nullable until os migrate organization-ownership tightens it. An object that opts out (systemFields: { tenant: false }, tenancy: { enabled: false }) has no tenant column.

So "stays NULL where no organization context exists" is false for every table a new app gets. ADR-0131 D1 reads "There is no nullable tenant column anywhere".

Done when

The sentence at :721–:723 says what main does: it is stamped on insert, a table the driver creates carries it NOT NULL and refuses a write that names no organization, an existing table stays nullable until the ceremony, and an object whose rows belong to no organization opts out. Each claim names its source (the changeset, ADR-0131 D1).
The other content/docs/** hits of organization_id = NULL (deployment/seed-tenancy-repair.mdx, deployment/cli.mdx:1859, permissions/permission-sets.mdx:191) are re-read. Each is left as it is if it describes a pre-ceremony database or history, and named in the PR body either way. ⛔ content/docs/releases/** is not edited.
Docs-only: no code, comment or changeset. PR docs(objectql,spec): the tenant column is stamped and never NULL on single-tenant stacks (C1) #25135 (open, draft) corrects the same sentence in code comments and does not touch content/docs/**, so the two do not overlap.

Dedupe

domain:engine seat 1 searched open and closed issues for "schema.mdx multi-tenant schemas organization_id stays NULL docs stale": 38 hits, the nearest 10 read, none on this page or sentence. This seat re-read the open PRs at 2026-10-21T19:37Z, and none touches content/docs/protocol/objectql/schema.mdx.
Dedupe words: schema.mdx multi-tenant organization_id NULL, tenant column NOT NULL docs, 7b-0 docs.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-23T00:41Z
Session: session_01Er1tmLgRYyGBSrDcDsUMqQ (card thread, dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd)
Account: os-elon-musk
Branch: claude/project-thread-c1stko (the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25137
Domain: domain:devx
Seat: domain:devx#1 (seat post #6023)
File surface: content/docs/protocol/objectql/schema.mdx; content/docs/deployment/seed-tenancy-repair.mdx, content/docs/deployment/cli.mdx and content/docs/permissions/permission-sets.mdx only where a re-read finds a sentence wrong about today's driver behaviour (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: draft PR #25212 edits other sections of content/docs/deployment/cli.mdx; any hunk there stays disjoint and is named in the PR body. No other open PR touches these files.

Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx p3, after #24889). Premise re-read on origin/main: schema.mdx:721-723 still says the injected organization_id "stays NULL where no organization context exists".

os-dev-report

{
  "issue": 25137,
  "status": "done",
  "branch": "claude/project-thread-c1stko",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25322",
  "head": "2f9543db3187d31aa88f978ff29e387b58aa81a0",
  "session": "session_01Er1tmLgRYyGBSrDcDsUMqQ",
  "premise_still_valid": true,
  "summary": "content/docs/protocol/objectql/schema.mdx 'Multi-Tenant Schemas' no longer says the injected organization_id stays NULL with no organization context. It now says the platform stamps it on insert (ADR-0131 D9), a table the SQL or Turso driver creates carries it NOT NULL and refuses an organization-less row, upsert included (ADR-0131 D1 driver note; changeset tenant-column-not-null-ddl), the in-memory driver enforces no NOT NULL, an existing table stays nullable until os migrate organization-ownership (which cannot tighten a rotated shard or a Turso remote table) and os migrate plan lists them, and an organization-less object opts out. D1 was measured before citing: the sentence the card and the changeset quote ('There is no nullable tenant column anywhere') was replaced by the 2026-10-22 amendment, so it is not quoted. The other ten hits across three pages all describe a pre-ceremony database or history and stay; per-hit verdicts are in the PR body.",
  "files_changed": ["content/docs/protocol/objectql/schema.mdx (+19 / -3)"],
  "hit_verdicts": [
    "deployment/seed-tenancy-repair.mdx:18 stays (repair over existing rows)",
    "deployment/seed-tenancy-repair.mdx:33 stays (section 'The defect it repairs', measured on 17.0.0 GA at :47; tense noted under Acceptance notes)",
    "deployment/seed-tenancy-repair.mdx:162 stays (repair SQL)",
    "deployment/seed-tenancy-repair.mdx:179 stays (what the repair leaves)",
    "deployment/seed-tenancy-repair.mdx:295 stays (report ordering on such a database)",
    "deployment/seed-tenancy-repair.mdx:304 stays (same)",
    "deployment/seed-tenancy-repair.mdx:344 stays (manual remedy SQL)",
    "deployment/cli.mdx:1904 stays (history, predates the repair)",
    "deployment/cli.mdx:1934 stays (what the repair leaves)",
    "permissions/permission-sets.mdx:193 stays (row an earlier release wrote)"
  ],
  "pm_readings": {
    "A1": "holds: schema.mdx:721-723 at origin/main 9dc1f42d5 read the stale sentence",
    "A2": "holds: #25212 has one cli.mdx hunk at @@ -756 and touches none of the other files; this PR does not edit cli.mdx",
    "A3": "holds with reason: #25135 merged 2026-10-21T20:45Z (three code comments, named this page under Acceptance notes, carrier none); no overlap"
  },
  "tests": "n/a: docs only, no package source, no tested behaviour moved, so no test run and no ablation",
  "gates": "head 2f9543d: dispatch-gates --commands --repo objectstack-ai/objectstack derived 41 (29 pnpm, 12 node); all 41 run with exit captured before any pipe; all 41 exit 0. pnpm --filter @objectstack/spec run check:skill-examples first exit 3 (PREREQUISITE NOT MET: packages/client-react/dist unbuilt), exit 0 after pnpm --filter '@objectstack/client-react...' build; the ran file records the final exit. --ran: 41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. Builds under os-verify-lock: '@objectstack/lint...' + '@objectstack/spec' VERDICT command-exit 0; '@objectstack/client-react...' VERDICT command-exit 0. CI families (Build Docs, Test Core, type-check lanes, wide-population families): PR check-runs, in_progress at report time.",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "deviations": [
    "The PR body's first line is the HTML-comment attribution marker the session requires; os-dev forbids HTML comments in GitHub text. Read-back: 7725 bytes sent, 7725 stored, identical.",
    "Branch is the harness-pinned claude/project-thread-c1stko, not claude/issue-25137-*; the claim records it.",
    "The dispatch's write budget names PR creation only; os-dev.md also owes this os-dev-report comment, and os-dev.md wins on a conflict, so this comment is the second relay write.",
    "No review request on the PR: the session asks for one via MCP, the dispatch forbids MCP writes. Assignee os-elon-musk was set at pr_create."
  ],
  "mcp_calls": "7, all reads: issue_read x3 (#25137 get, get_comments x2), pull_request_read x4 (#25135 get, #25212 get_files, #25255 get, #25322 get); zero write tools",
  "api_writes": "2 relay strokes via scripts/pm/fleet-write/dispatch.mjs (POST /repos/objectstack-ai/objectstack/dispatches): pr_create (#25322, run 39881123498) and this comment; plus git push",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed · deployment/seed-tenancy-repair.mdx describes its 17.x defect in the present tense (:30-34; :72 'At kernel:ready on a fresh install no organization exists yet'); on main the single posture creates the Default Organization before seeds load and the seed loader refuses an organization-less row where the organization object is registered (packages/metadata-protocol/src/seed-loader.ts, unowned branch). Not a NULL-hit verdict change: the section is anchored to 17.0.0 GA. Dedupe words: seed-tenancy-repair present tense, first boot no organization, Default Organization at boot docs"
  ]
}

Generated by Claude Code

ACCEPT → PR #25322 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:13Z

Reviewed at head 2f9543db31: one file, content/docs/protocol/objectql/schema.mdx (+19 / -3). The tenant-column paragraph now states the NOT NULL rule from ADR-0131 D1 and D9. The seat checked its anchors against cli.mdx:991 and :1642.
Gates: on the PR, 46 check runs; each one is success or an expected skipped (34 / 12). Build Core is skipped by its path filter because the diff is docs-only. Build Docs and Check Documentation Links are green.
Not governed: check-governed-merges.mjs --pr 25322 reports 0 of 1 paths on the register, with 22 changed lines. skip-changeset.
Landing: ready → auto-merge through the merge queue, under the maintainer's standing authorization (director ruling batch 1, item 1A).

Navigation Menu

Repository navigation

docs(objectql): "Multi-Tenant Schemas" says the injected organization_id stays NULL with no organization context, and since PR #24940 a table the driver creates carries it NOT NULL and refuses that write #25137

What the page says

What `main` does

Done when

Dedupe

ACCEPT → PR #25322 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:13Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(objectql): "Multi-Tenant Schemas" says the injected organization_id stays NULL with no organization context, and since PR #24940 a table the driver creates carries it NOT NULL and refuses that write #25137

Description

What the page says

What main does

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

ACCEPT → PR #25322 · domain:devx seat 1 · session_01LKHDniRQSWjRJyDtacwpEd · 2026-10-23T01:13Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What `main` does

ACCEPT → PR #25322 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:13Z