feat(platform-objects): sys_organization declares a name/logo-only rename action at the record header

[objectstack-fleet]

Fixes #24271

Clause-②: yes

Dispatched by the domain:services seat 1 (seat post #6021), claim 6248546668 as amended by the fork ruling 6248721024. Branch claude/issue-24271-organization-rename-door.

What

sys_organization declares rename_organization ("Rename Organization"), so an organization record page can rename the organization. The maintainer's question that filed the card: 「组织 slug 可以改，但是名称不能改吗」.

• The action. type: 'api', target: '/api/v1/auth/organization/update', recordIdParam: 'organizationId', bodyShape: { wrap: 'data' }, requiresFeature: 'multiOrgEnabled', locations: ['record_header', 'list_item']. Its params are name (required, defaultFromRow) and logo (defaultFromRow). It has no slug param. It also carries variant: 'secondary' like its header siblings, mode: 'edit' like update_organization, icon pencil, and the success message "Organization renamed".
• The header order (ruled). It is declared before change_slug. Both sort at order 0, so declaration order breaks the tie. The record header's inline row is now invite_user, set_active_organization, rename_organization. change_slug folds into the ⋯ overflow, and leave_organization (order: 1) stays last. The leave_organization comment that names the inline row is updated. So is the actions block's header comment: it said better-auth's columns are edited "ONLY through update_organization", and it now names both doors.
• Unchanged: update_organization keeps name, slug and logo, its target and list_item alone. It stays the slug door of a composition without the cloud orchestrator. change_slug is not edited. Nothing in plugin-auth changes.
• Translations. The four bundles were regenerated by node scripts/check-i18n-bundles.mjs --write --filter=platform-objects. The zh-CN, ja-JP and es-ES values are translated: 重命名组织 / 组织已重命名, 組織名を変更 / 組織名を変更しました, Renombrar organización / Organización renombrada. A second extract then dropped the six provenance rows the first one had seeded, so no copied English leaf ships.

The spec row (the contract face)

The only spec edit is one line in packages/spec/src/kernel/public-auth-features.ts. It adds 'sys_organization.actions.rename_organization' to PUBLIC_AUTH_FEATURES.multiOrgEnabled.gatedInputs, beside update_organization's row.

• What it books. requiresFeature: 'multiOrgEnabled' lowers at parse time to visible: features.multiOrgEnabled != false. PUBLIC_AUTH_FEATURES records, for each flag /api/v1/auth/config serves, which spec inputs that flag gates.
• Why the guard needs it. packages/platform-objects/src/feature-gate-guard.test.ts holds the registry and the objects' gates in lockstep in both directions. Forward: every booked path must carry the flag's predicate. Reverse: every features.X reference must be booked. The action without the row is red in the reverse direction; the previous round measured it (sys_organization.actions.rename_organization is booked in multiOrgEnabled.gatedInputs: expected false to be true). The row without the action is red in the forward direction. So the two land together.
• What it does not do. It adds no schema key, no enum value, no requiresFeature value and no flag. check:api-surface and check:authorable-surface are green with no regenerated artifact. @objectstack/spec takes a patch. Precedent: b0a1df044 booked sys_organization.actions.invite_user the same way.

Premises, verified before any edit

• P1 holds (better-auth 1.7.3, installed). organization/update takes data as a .partial() object where name and slug are optional and logo is nullish (dist/plugins/organization/routes/crud-org.mjs). The slug-taken check runs only when data.slug is a string. adapter.updateOrganization writes ...data plus metadata, so a body without slug leaves the column alone. Measured on a boot: a name-only body answered 200 and returned the old slug, and the booted pin below reads the slug back unchanged after a name and logo rename.
• P3 holds. plugin-auth's beforeUpdateOrganization returns at its first line when no slug is sent (auth-manager.ts:3607–:3610). The ADR-0092 D2 identity write guard passes better-auth adapter writes: the adapter's writes run as attributed system, so isUserContextWrite is false. better-auth grants organization: ['update'] to owner and admin (access/statement.mjs), not to member. Measured on a boot for the owner: the creator's rename answered 200. The admin grade is a source reading.

Tests

All on head 1c3722ca1 unless noted.

• Declaration pin, new: packages/platform-objects/src/identity/sys-organization-rename-action.test.ts, 8 tests. It pins the params (exactly name and logo), the locations, the target, recordIdParam and bodyShape (equal to update_organization's), and the lowered gate. It pins one door per field: the only record_header action that writes through organization/update is the rename, and it collects no slug. It pins the header order, with the rename inline and change_slug past the inline budget. Controls: update_organization and change_slug unchanged.
• Matrix row: platform-objects.test.ts's feature-gate lowering matrix gains rename_organization at features.multiOrgEnabled != false.
• Booted pin, new: packages/qa/dogfood/test/organization-rename-door.dogfood.test.ts, 2 tests. It boots the showcase with multiTenant: 'posture-only', creates an organization, builds the request from the REGISTERED action the way the console's api runner does, renames it, and reads slug back unchanged. organization-update-door.dogfood.test.ts ran beside it as the control: 11 of 11 passed.
• pnpm --filter @objectstack/platform-objects exec vitest run --maxWorkers=2: Test Files 76 passed (76), Tests 1176 passed (1176). The package's typecheck exits 0, and tsc -p tsconfig.test.json --listFilesOnly lists the new test.
• @objectstack/spec: vitest run --project local gives Test Files 694 passed (694), Tests 21040 passed | 1 todo. typecheck exits 0. The repo project is CI's.
• plugin-auth src/public-feature-registry.test.ts (the served-key drift guard): 5 of 5 passed.
• Ablation, once (through scripts/ablation-replace.mjs). A slug param was planted in rename_organization and the anchor count went 1 to 0. The declaration pin then answered Tests 2 failed | 6 passed: "expected [ 'name', 'slug', 'logo' ] to deeply equal [ 'name', 'logo' ]" and "rename_organization sends a slug to better-auth". The restore was proven by blob equality: 16a3dce65796 equals HEAD, and git diff HEAD is empty. The pin imports the object from source, so no build sits between the mutation and the run.

Gates

The local subset is node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack over this diff: 88 commands, each run with its exit code captured before any pipe. 87 exited 0. pnpm check:dual-build-cjs-loads answered PREREQUISITE NOT MET (exit 3): it reads every workspace package's dist/, and eight packages outside this diff's build closure have none. It is recorded NOT-MEASURED, and CI runs it. The --ran reconciliation reads 88 derived famil(ies) accounted for — 87 run, 1 NOT-MEASURED. The local-only check:dev-prereqs passed after the spec build.

Acceptance notes

• change_slug in the open-source composition, measured: POST /api/v1/cloud/organizations/{id}/change-slug answers 404 ENDPOINT_NOT_FOUND on a booted showcase. On the stock single-org boot, /auth/config serves multiOrgEnabled: false, so the action is hidden there. On the posture-only boot it serves true, so the record page offers change_slug (now in the overflow) and the click answers that 404. This is handed to the seat as a finding, and nothing is changed here.
• The second slug door at the API level on a cloud composition: better-auth organization/update still accepts data.slug, and beforeUpdateOrganization refuses it only while active environments exist. The record page no longer reaches it (the rename sends no slug). The API door is objectstack-ai/cloud#3000's to carry.
• packages/platform-objects/src/pages/sys-organization.page.ts's header comment lists "Set Active, Edit, Delete, Leave" as the record-header actions. Edit and Delete are list_item only. This is comment drift, outside this claim's file surface, and is left as it is.
• The cloud organization page lists its header actions explicitly. It gains this action in its own card once cloud's framework pin carries it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/spec, touching 10 documentable anchor(s).

22 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 52ff308b8686f1f5a304341534bd8b8eb1cdd59e.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 143 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 52ff308b8686f1f5a304341534bd8b8eb1cdd59e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5f9defbc20ab2ee3ae5602850daecf20879af165 — the merge of head 1c3722ca1a622f63c566c58903bf137150b956bc into base 52ff308b8686f1f5a304341534bd8b8eb1cdd59e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5f9defbc20ab2ee3ae5602850daecf20879af165 && git checkout 5f9defbc20ab2ee3ae5602850daecf20879af165
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 52ff308b8686f1f5a304341534bd8b8eb1cdd59e 1c3722ca1a622f63c566c58903bf137150b956bc && git checkout -B drift-repro 52ff308b8686f1f5a304341534bd8b8eb1cdd59e && git merge --no-ff 1c3722ca1a622f63c566c58903bf137150b956bc

node scripts/docs-audit/affected-docs.mjs --json 52ff308b8686f1f5a304341534bd8b8eb1cdd59e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 52ff308b8686f1f5a304341534bd8b8eb1cdd59e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1c3722ca1a622f63c566c58903bf137150b956bc
Local-runs: none
Scope: packages/spec/src/kernel/public-auth-features.ts + packages/platform-objects/src/feature-gate-guard.test.ts, packages/platform-objects/src/identity/sys-organization.object.ts, packages/platform-objects/src/identity/sys-organization-rename-action.test.ts, packages/platform-objects/src/platform-objects.test.ts, .changeset/24271-org-rename-door.md; read unchanged at the head for the claims those hunks make: packages/spec/src/kernel/public-auth-features.test.ts, packages/spec/api-surface/kernel.json, packages/spec/export-origins/kernel.json, packages/plugins/plugin-auth/src/auth-manager.ts (beforeUpdateOrganization, :3607), packages/platform-objects/src/identity/sys-organization-invite-action.test.ts, docs/adr/0133-org-management-open-basics.md, docs/adr/0093-tenancy-mode-and-membership-lifecycle.md (D8), .github/workflows/ci.yml (dogfood job if:). The other five paths of the diff (four *.objects.generated.ts bundles, packages/qa/dogfood/test/organization-rename-door.dogfood.test.ts) are the lane seat's ACCEPT at TIER_DEFAULT.

Inputs: card #24271 (body and all six comments, 6248084492 through 6249653353), PR #24317 (body, ten-path file list, net diff origin/main...1c3722ca1), and the 41 check-runs on the head, all completed: every non-skipped run success (Test Core and its six shards, Build Core, Lint & Repo Gates and its nine lanes, Type Check lanes, Check Changeset, Governed Surface Queue Guard, Spec property liveness, the queue and claim guards); the skipped ones are the dogfood shards, Dogfood Verify CLI, Console Pin Gate, Temporal Conformance, Build Docs and the opt-in tarball smoke. Reviewed with no worktree, build, test or gate run; the record was written 2026-10-18T12:26Z.

① Derived judgments

1. The face's one hunk, right. packages/spec/src/kernel/public-auth-features.ts gains 'sys_organization.actions.rename_organization' in PUBLIC_AUTH_FEATURES.multiOrgEnabled.gatedInputs (between update_organization and delete_organization) and two comment lines; nothing else in the file moves. No key on PublicAuthFeatureEntry, no new flag (PUBLIC_AUTH_FEATURE_NAMES stays at 11, pinned by public-auth-features.test.ts:20), no new requiresFeature enum value, no new export (api-surface/kernel.json and export-origins/kernel.json list PUBLIC_AUTH_FEATURES (const) by name only, and neither is in the diff). The path follows the registry grammar the spec test and the guard both parse (object dot actions dot action).

2. The rule and its gate land as one change, right. packages/platform-objects/src/feature-gate-guard.test.ts is unchanged on this head and reads the pair in both directions. Forward: the booked path resolves to the object's rename_organization, whose only visibility is requiresFeature: 'multiOrgEnabled', lowered by lowerRequiresFeature to exactly features.multiOrgEnabled != false (pinned by the rename-action test, "is gated on multiOrgEnabled, the same lowered predicate as update_organization", and by the lowering-matrix row added to platform-objects.test.ts:589). Reverse: that predicate references features.multiOrgEnabled, and the new row books it; the walker floor (37 or more references) only rises. The card records the reverse direction red without the row (dev probe 6248699001 on 8bfb17d47), which is what the guard's code says it would do. Both directions ran in CI on this head: Test Core shards 1 through 6, success.

3. The flag chosen, right. The rename books under multiOrgEnabled, not organization. ADR-0093 D8 keeps features.organization (member management) and features.multiOrgEnabled (organization management) apart, and ADR-0133 records that organization lifecycle actions sit under multiOrgEnabled.gatedInputs. A name/logo rename is organization management and mirrors update_organization's row, so on a single-organization boot it hides with every sibling organization action (the dev's stock-boot reading: /auth/config serves multiOrgEnabled: false).

4. What the row makes a claim about, verified in the object. sys-organization.object.ts at the head declares rename_organization: type: 'api', target /api/v1/auth/organization/update, recordIdParam: 'organizationId', bodyShape: { wrap: 'data' }, locations: ['record_header', 'list_item'], mode: 'edit', variant: 'secondary', requiresFeature: 'multiOrgEnabled', params exactly name (required, defaultFromRow) and logo (defaultFromRow), no slug. The diff's only other hunks in that file are comments; update_organization (name, slug, logo; list_item) and change_slug (cloud orchestrator target; record_header; one slug param) are byte-unchanged, and the new pin's two control tests say so.

5. The ruled header order holds by reading. Stable sort by order (unset = 0) over the five record_header actions in declaration order gives invite_user (-1), set_active_organization (0), rename_organization (0), change_slug (0), leave_organization (1): the inline row is invite, set active, rename; change_slug and leave_organization fold into the overflow, as the amended claim (6248721024) ruled. The older invite pin (sys-organization-invite-action.test.ts:77-90: invite first, leave at index 3 or later, more than three header actions) still holds with five.

6. The slug claim in the object's comment, verified at its real path. beforeUpdateOrganization lives at packages/plugins/plugin-auth/src/auth-manager.ts:3607 (the PR body's auth-manager.ts:3607 drops the packages/plugins/plugin-auth/src/ prefix; the line is right) and returns at once when organization.slug is falsy, so a body with no slug key never reaches the slug guard. The booted reading of that same fact is the dev's, not a check-run (see ③ 6).

7. Accept sets and public surface, net. @objectstack/spec: no accept set changes; an exported constant's value gains one string. @objectstack/platform-objects: SysOrganization gains one named action, a published object the runtime registers and the console renders, and four translation bundles gain its two leaves (tool-regenerated, check:i18n inside Lint & Repo Gates, success). No docs page at the head enumerates sys_organization's header actions or the multiOrgEnabled.gatedInputs list (git grep over content/docs and docs/: none), so no page is owed.

8. Face and tier. reviewFace over the PR's ten paths answers the schema face with hits.schema = [packages/spec/src/kernel/public-auth-features.ts] and no governed-register hit, so the tier is CONTRACT_REVIEW_TIER and this record's Scope: floor is that one path.

② Semver level

• .changeset/24271-org-rename-door.md: @objectstack/platform-objects: minor, @objectstack/spec: patch, and Clause-②: yes as the last line; the PR body carries the same Clause-②: yes. Not skip-changeset. Check Changeset on the head: success.
• yes is right. The widening act is the new action name on a published platform object, served at runtime: an additive widening of @objectstack/platform-objects' public surface, which pr-automation's WHICH LEVEL rule and check-changeset-no-major grade at least minor on the package that grew. minor sits on that package.
• spec patch is right. The row adds no exported symbol, no accepted key and no accepted value (requiresFeature's enum is untouched, no schema moves), so nothing WHICH LEVEL names fires for @objectstack/spec; its only type effect is the literal union of multiOrgEnabled.gatedInputs growing, which has no consumer in this repo beyond the two guards and none in the objectui checkout. Precedent: b0a1df044 (feat(platform-objects): sys_organization declares a record_header invite action; leave_organization folds to the overflow and names what is lost #24216) booked sys_organization.actions.invite_user the same way with spec patch (its changeset .changeset/24016-org-invite-action.md is still at the head), and the CHANGELOG precedent for the set_user_role row calls the row "internal completeness-guard bookkeeping only, no public export shape change".
• Noted, not re-judged: feat(platform-objects): sys_organization declares a record_header invite action; leave_organization folds to the overflow and names what is lost #24216 declared Clause-②: no with platform-objects patch for the same kind of act (a new action on sys_organization). This PR's yes plus minor is the reading the rule supports; the precedent is landed history.
• Nothing is removed or renamed, so no BREAKING banner and no ADR-0087 disposition is owed; check-adr-0087-registration ran inside Lint & Repo Gates, success.

③ Boundary flags

The dev's final report (6249492189) has open_questions: []; its eight deviations and three out-of-scope findings, answered or escalated:

1. Hand-written zh-CN / ja-JP / es-ES values in the generated bundles. Within AGENTS.md's **/translations/*.generated.ts row: structure by the tool, translated-locale values hand-written. Both extracts were the tool's, the keys match en's, check:i18n is green. Answered.
2. The actions block's header comment restated. It sits directly above actions: and the change made it false; inside the claim's "actions block only" surface. Answered.
3. check:dual-build-cjs-loads NOT MEASURED locally. Run by Lint & Repo Gates ("Every published require entry point actually loads"), success on the head. Answered.
4. Temporary measurement test file. Not among the ten paths. Answered.
5. Commit trailers. Both commits (326f79774, 1c3722ca1) carry AGENTS.md's model-free Claude-Session plus Co-authored-by pair; no model identifier in the PR body, changeset or diff. Answered.
6. The booted pin has no check-run on this head. ci.yml's dogfood job skips on pull_request and merge_group (its if:), and Test Core excludes @objectstack/dogfood, so organization-rename-door.dogfood.test.ts rests on the dev's local 2 of 2 and its dist-via-cache-hit reasoning; its first CI run is the post-merge push or the scheduled battery. The contract face does not depend on it (the guard and the declaration pin ran in Test Core). Escalated to the lane seat as a known CI-unmeasured pin: a red on it in the first full battery is this PR's to own.
7. Only the declaration pin was ablated. Accepted; the booted pin's ablation would need a rebuild the read-only shape forbids here too.
8. Aborted spec run. Nothing from it is cited. Answered.
9. Out of scope, change_slug 404 on an open-source multi-organization boot. Filed as platform-objects sys_organization: change_slug targets a cloud-only route, so on an open-source multi-organization composition the record page offers Change Slug and the click answers 404 #24318 (open, domain:engine, pm:queue). Answered; after this PR the dead door sits in the overflow, not inline.
10. Out of scope, the API-level slug door through organization/update with data.slug on a cloud composition. Carried by objectstack-ai/cloud#3000 per the dev; outside this repo and not readable here. Noted.
11. Out of scope, comment drift at packages/platform-objects/src/pages/sys-organization.page.ts:15 ("Set Active, Edit, Delete, Leave" as the header actions). Verified stale: Edit and Delete are list_item only, and the header now carries invite, set active, rename, change slug, leave. Carrier none. Escalated to the lane seat: fold it into platform-objects sys_organization: change_slug targets a cloud-only route, so on an open-source multi-organization composition the record page offers Change Slug and the click answers 404 #24318's touch of the same object, or a docs-only PR; not this PR's surface.
12. Lane routing (triage note 6249653353). packages/platform-objects is domain:engine's; the card ran under domain:services and the label stays until the dev is done. Process, not contract; the landing note names the lane.
13. Admin-grade rename. The dev's P3 for admin is a source reading (better-auth access/statement.mjs), not a boot. Not a contract matter; noted.

Implemented-by: claude/issue-24271-organization-rename-door
Reviewed-by: session_01Nk17Z26X5DB59iQztDBADH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH · 2026-10-18T12:27Z · head 1c3722ca1a. Contract review PASS 6249904278 at CONTRACT_REVIEW_TIER on this head covers the spec face (public-auth-features.ts). This ACCEPT covers the rest of the diff at TIER_DEFAULT. It lands through the merge queue once every check on this head is green.

• Shape: a draft PR to main. Its first line is Fixes #24271, and that is the only closing keyword in the body. Clause-②: yes is at a line start in the body and in the changeset (@objectstack/platform-objects minor, @objectstack/spec patch). Card and PR assignee: marchtian. Not governed: check-governed-merges reads 0 of 10 paths, and 342 changed lines ≤ 3000.
• The ruling (6248721024), each term met as dispatched:
  1. One new action, rename_organization. Its params are name (required) and logo, both defaultFromRow, with no slug. It sits at record_header and list_item, targets /api/v1/auth/organization/update with recordIdParam: 'organizationId' and bodyShape: { wrap: 'data' } exactly as update_organization does, and is gated requiresFeature: 'multiOrgEnabled'.
  2. update_organization and change_slug are unchanged. Two control cases in the new pin hold both, and the seat read the diff: neither declaration's lines move.
  3. One booking row in the spec, beside update_organization's row. This is the contract review's face.
  4. Header order. The action is declared before change_slug, so the inline row is invite_user, set_active_organization, rename_organization, and change_slug folds into the overflow. A pin holds the order, and the leave_organization comment says so.
• Premises P1 and P3, measured on a booted showcase. A name-only and a name+logo organization/update by the owner answered 200 and read the slug back unchanged. This is the source reading of better-auth 1.7.3 plus plugin-auth's beforeUpdateOrganization, which returns at once with no slug.
• Pins:
  • sys-organization-rename-action.test.ts has 8 cases. They cover the params, the locations, the target, the lowered gate, and that no record_header writer of organization/update collects a slug. They also cover the header order and the two controls.
  • The lowering matrix in platform-objects.test.ts gains the action.
  • The booted pin organization-rename-door.dogfood.test.ts renames, then reads the slug back from both the answer and the data door.
  • The dev's ablation (planting slug in the params) turned 2 cases red, and the restore is blob-equal to HEAD.
• Gates on this head: 35 checks succeeded and 6 were skipped by design (Build Docs, Console Pin Gate, Dogfood Regression Gate, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance: the roster set). There were no failures, and the required contexts are green. Locally the dev derived 88 families and ran 87, all exiting 0. check:dual-build-cjs-loads was NOT MEASURED locally (prerequisite unbuilt) and is green in CI's Lint & Repo Gates.
• Accepted deviations:
  • The translated values (zh-CN 重命名组织 / 组织已重命名, plus ja-JP and es-ES) were written by hand, after the extractor generated the keys and structure. AGENTS.md's Documentation Guardrails row allows that, and check:i18n and check:i18n-stale-fill are green.
  • The actions block's header comment now names both organization/update doors. It said update_organization was the only one, which this change made false.
• Out-of-scope findings, with their carriers:
  • filed platform-objects sys_organization: change_slug targets a cloud-only route, so on an open-source multi-organization composition the record page offers Change Slug and the click answers 404 #24318: change_slug's cloud-only target answers 404 ENDPOINT_NOT_FOUND on an open-source multi-org boot (measured).
  • objectstack-ai/cloud#3000: on cloud, better-auth organization/update still accepts data.slug, and beforeUpdateOrganization refuses it only while active environments exist. That is an API-level second slug door. The record page no longer reaches it.
  • Noted onto platform-objects sys_organization: change_slug targets a cloud-only route, so on an open-source multi-organization composition the record page offers Change Slug and the click answers 404 #24318 (now domain:engine, the same object): sys-organization.page.ts:14–:16 lists record-header actions that are list_item only. This is comment drift outside the claim, and the contract review's escalation (11) points it there.
• Owned by this lane after landing (the contract review's escalation (6)): organization-rename-door.dogfood.test.ts has no check-run on this head, because the dogfood job skips on pull_request and merge_group. Its first CI run is the post-merge push or the scheduled battery. A red there is this PR's, and this seat follows it.
• Lane (triage 6249653353): packages/platform-objects is domain:engine's. This card ran under domain:services on triage's routing, and the claim stands. The files were declared to the engine seat at 6248558152.

---

Generated by Claude Code