perf(core): read the Default Organization once per engine, not on every authenticated request

[objectstack-fleet]

Fixes #24523

Clause-②: no (a per-engine memo of an unchanged read: no accept set, standing verdict or served body moves; owes the seat's review of record before the queue, at CONTRACT_REVIEW_TIER because it is the platform-standing anchor)

Dispatched by the domain:engine seat 1 PM (session_01JtSQQ3EWsbNPzyYMug1tXy, claim 6271076320). Dev session: session_01Ug7sGD6qWVrzQNdihVX3T6.

⛔ Landing waits on the epic:#15194 seat's answer to the territory declaration 6271107528, or an objection-free read of that thread, and on the seat's CONTRACT_REVIEW_TIER review of record. No answer was posted when this PR opened.

What changed

resolveUserAuthzGrants asks for the Default Organization whenever a principal holds an organization-owned admin_full_access grant under single. readDefaultOrganizationId answers with one sys_organization read by slug, plus a second read when the only organization is not slugged default. Nothing carried that answer across requests, so every such request paid one or two reads.

This PR keeps the answer per engine, across requests (memoisedDefaultOrganizationId, packages/core/src/security/resolve-authz-context.ts). The call site in resolveUserAuthzGrants is the only caller changed.

• In-process retirement: any sys_organization write through the engine (insert, update, delete, a slug move included) retires the answer. The write is observed after it settles, by Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757 leg 5's write seam: a per-engine WeakMap, a watched-object set (sys_organization), and a generation read before the reads and checked on the next hit. A write that lands while the read is in flight leaves that answer dead on arrival.
• Across replicas: a peer's sys_organization write arrives only when the authz.invalidated bridge is attached, which needs the grants cache on (OS_AUTHZ_GRANTS_CACHE_TTL_MS above 0) and a cross-process cluster driver. It arrives as a remote epoch bump. That bump, and every other non-write bump (metadata, which is plugin-security's local declaration bump, and manual), retires the answer. On the shipped default, no bump carries a peer's write.
• Residual bound, 30 s (DEFAULT_ORGANIZATION_MEMO_TTL_MS, a constant, no new knob). It is never the in-process rule. It covers only what no seam can see:
  • a peer replica's write when no bridge is attached (tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868's delete-and-recreate on another replica). On the shipped default that is every peer's write, so the 30 s bound is its only cover;
  • a write that started before this engine's observer registered (measured below);
  • a watched write inside an engine transaction, whose statement completes before its commit (leg 5's window, named in the code).
• An outage is not an answer. A read that throws (AuthzStoreUnavailableError, SERVICE_UNAVAILABLE / 503) memoises nothing and propagates. The next request reads again.
• undefined is memoised. No organization, or several with none slugged default, is a real answer, and a write retires it like any other. A table that was never provisioned reads as zero organizations, which is the true answer there.
• Declines, reading every time as before, in two cases:
  • an engine without the write epoch and registerMiddleware (every recording double);
  • a registry that does not hold sys_organization. "Not registered" is a verdict the boot can still contradict, and registering the object writes no row the seam would see.
• Which way a stale answer fails. A stale id withholds standing from the new Default Organization's grant. It also keeps granting standing to the old organization's grant while that row survives. No design at zero reads per request avoids the granting direction, so every window in which the answer can be stale is capped by the residual bound. The in-process slug-move pins assert the granting direction is retired.

One copy of the seam. localizationWriteState's body is now watchedWriteState(ql, states, watched). Leg 5's localization cache and this memo each call it with their own WeakMap and watched set. The localization behaviour is unchanged, and its suite (resolve-localization-cache.test.ts) passes unedited. This touches leg 5's function, which is outside the claim's file-surface list but in the same file. Two copies of the seam would be the drift shape.

⛔ Byte-identical: readDefaultOrganizationId (both reads, filters and limits), grantAnchorsPlatformStanding, grantOrganizationOf and grantAppliesInTenant are not edited. The diff touches none of their lines. Unit pins assert the two reads byte-for-byte wherever they are issued.

Measurement (M, a booted composition)

The composition is default-organization-boot-invariant.pin.test.ts's plugin set with objectstack dev's seeded administrator, on sqlite-wasm :memory:. The administrator's first-user promotion grant is owned by the Default Organization. Each count is the number of statements the SQL driver issued inside the request's own async context (knex query events), warm (after two requests).

warm request	main 5a871e4e41	this branch
get-session, organization-owned grant, slug default	9	8
data read (GET /data/pin_note?$top=1), organization-owned, slug default	11	10
get-session, organization-owned, sole organization slugged acme	10	8
data read, organization-owned, acme	12	10
get-session, organization-less grant (either slug)	8	8
data read, organization-less grant (either slug)	10	10

The sys_organization statements per warm request go from 1 (slug default) or 2 (acme) to 0. After a sys_organization write, the next request reads it once.

Controls, byte-identical: the resolved authz envelope (positions, permissions, org_user_ids, accessible_org_ids, posture, tab permissions) on a booted composition. Three personas: the administrator, a member, and a user with no organization. Each was resolved with no tenant and in the Default Organization, twice each, for 12 envelopes. The run used the resolver at BASE (5a871e4e41, blob 4029c98d…) and at HEAD (blob a4c2ec74…), with random ids normalized. All 12 are deep-equal: canonical md5 3fd8be5122375762cf9d49f28bae84e8 on both. The raw byte difference is only key order, from per-boot random user ids. This was a one-off scratch file, deleted, and the restore was checked blob-equal to HEAD.

Pins

• packages/runtime/src/default-organization-statements.golden.test.ts (new, 6 cases, a real kernel):
  • the statements golden (8 / 10, with no sys_organization statement, for both slugs);
  • the organization-less control at the same counts;
  • the Default Organization deleted and recreated, and the next get-session reads the new id (tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868);
  • default moved to another organization: the old organization's grant stops anchoring, and the new one's starts.
• packages/core/src/security/resolve-authz-context.default-organization-memo.test.ts (new, 14 cases). Each case drives resolveUserAuthzGrants on a recording double that carries the engine's seams. Covered:
  • one read, then none (both slugs);
  • undefined memoised;
  • the no-seam control;
  • delete-and-recreate;
  • the slug move, granting direction;
  • unrelated writes do not retire it, a watched grants table included;
  • remote and metadata retire it, a bare write bump does not;
  • in-flight write: dead on arrival;
  • the TTL bound;
  • the outage (envelope SERVICE_UNAVAILABLE / 503, then a re-read);
  • the registry case, re-read once the object is registered;
  • the pre-registration window, measured.
• Pre-registration window, measured: a write that starts before the observer registers is not seen. The first resolution registers the observer and reads the pre-write row. That answer stands, stale, until the 30 s bound, and is re-read after it. This is the same blind spot leg 5 documents. At boot, plugin-auth's invariant writes the Default Organization before the listener accepts, so a request racing that write is the only way to reach the window.

Ablations (each through scripts/ablation-replace.mjs, restore proven blob == HEAD, git diff HEAD empty)

Runtime resolves @objectstack/core to source through its vitest alias, and core's tests import it relatively, so no dist/ leg applies. The alias was also observed directly: the counts moved with no core rebuild.

1. Memo removed (the call site back to readDefaultOrganizationId): golden red, 4 of 6. It reads 9 / 11 with 1 organization statement, and 10 / 12 with 2. Both retirement cases go red on organizationReads: 0.
2. Write-seam retirement removed (an empty watched set for the memo): golden red, 2 of 6. Delete-and-recreate reads standing: false, organizationReads: 0, and so does the slug move. Unit suite red, 4 of 14.
3. A failed read memoised:
   • variant .catch(() => undefined): the outage pin is red (expected undefined to match { code: 'SERVICE_UNAVAILABLE', status: 503 });
   • variant "memoise, then rethrow": red on the re-read (reads: [], standing: false).

Verification (final head 307260452, origin/main c03b17d78 merged)

• pnpm --filter @objectstack/core test: 107 files, 2594 tests passed.
• pnpm --filter @objectstack/core test:repo: 6 files, 82 tests passed. No new caller of the reference-target census.
• pnpm --filter @objectstack/plugin-security test: 188 files, 3754 passed, 45 skipped.
• pnpm --filter @objectstack/plugin-auth test: 165 files, 3165 passed, 10 skipped.
• pnpm --filter @objectstack/rest test: 300 files, 6095 passed, 326 skipped.
• pnpm --filter @objectstack/runtime test: 423 files, 6651 passed, 19 skipped.
• pnpm --filter @objectstack/core typecheck exit 0 and pnpm --filter @objectstack/runtime typecheck exit 0. Both test layers compile under tsconfig.test.json with no new debt.
• After the merge: build of core, runtime, plugin-auth and plugin-email (35 turbo tasks) exit 0; both typechecks exit 0; the two new pin files and the leg 4/5 suites (request-rounds, batch-equivalence, localization cache) pass.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, with no paths, at 307260452. All 67 were run, each exit 0, captured before any pipe. --ran reports: "67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN" (a derived zero). check:dual-build-cjs-loads exited 3 on the first pass, before a full build. After turbo run build (76 tasks) it exits 0.

Acceptance notes

• Pin sweep. Searched for readDefaultOrganizationId, the { slug: 'default' } read, grantAnchorsPlatformStanding, and the *admin-standing*, *batch-equivalence*, *request-rounds* and *default-organization* tests. None moves: their doubles carry no write seam, so the memo declines and their read multisets hold. resolve-authz-context.request-grants-memo.test.ts and resolve-user-grants-cache.test.ts carry the seams but hold no organization-owned admin grant, and both pass unedited.
• plugin-auth's own readDefaultOrganizationId (last-admin-guard.ts) is untouched. It runs on guarded writes (anchorOwnerTest), not on every authenticated request, so it does not pay this per-request cost.
• The golden boots a real kernel: test body about 3 s; most of the wall is module import on the shared box.
• The PR body is written once at creation. Any later change is named in the report for the seat to write.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 17 documentable anchor(s).

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 973917c5795f7a440d46a15bc5cf8961af9d8703.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 27 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 973917c5795f7a440d46a15bc5cf8961af9d8703 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a8d6a7bb1fbfc66271539f98b8c3912442c1cdb9 — the merge of head 9fda5d6b1cb80748bd6ff1b433447cfd5294db85 into base 973917c5795f7a440d46a15bc5cf8961af9d8703, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a8d6a7bb1fbfc66271539f98b8c3912442c1cdb9 && git checkout a8d6a7bb1fbfc66271539f98b8c3912442c1cdb9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 973917c5795f7a440d46a15bc5cf8961af9d8703 9fda5d6b1cb80748bd6ff1b433447cfd5294db85 && git checkout -B drift-repro 973917c5795f7a440d46a15bc5cf8961af9d8703 && git merge --no-ff 9fda5d6b1cb80748bd6ff1b433447cfd5294db85

node scripts/docs-audit/affected-docs.mjs --json 973917c5795f7a440d46a15bc5cf8961af9d8703

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 973917c5795f7a440d46a15bc5cf8961af9d8703 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 307260452354f109f742a40c9bcea6657d3b8f7d
Local-runs: none
Scope: .changeset/24523-default-organization-memo.md, packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/resolve-authz-context.default-organization-memo.test.ts, packages/runtime/src/default-organization-statements.golden.test.ts + packages/objectql/src/engine.ts (executeWithMiddleware, insert, insertMany, update, delete, organizationProbeMemo, attachAuthzInvalidationPubSub), packages/objectql/src/write-epoch.ts, packages/objectql/src/authz-invalidation-bridge.ts, packages/services/service-cluster/src/authz-cluster-bridge-plugin.ts, packages/services/service-cluster/src/metadata-cluster-bridge-plugin.ts, packages/runtime/src/runtime.ts, packages/metadata-protocol/src/protocol.ts (applyRemoteMetadataMutation), packages/metadata-protocol/src/meta-overlay-cache.ts (bumpWriteEpoch), packages/plugins/plugin-security/src/security-plugin.ts and write-epoch-source.ts (the metadata bumps), packages/core/src/security/resolve-user-grants-cache.ts, packages/core/src/security/authz-cache-posture.ts, packages/core/src/security/request-grants-memo.ts, packages/core/src/kernel.ts (boot phases), packages/plugins/plugin-auth/src/objectql-adapter.ts, packages/plugins/plugin-auth/src/default-organization-invariant.ts, packages/plugins/plugin-auth/src/ensure-default-organization.ts, packages/plugins/plugin-auth/src/auth-plugin.ts, packages/plugins/plugin-auth/src/last-admin-guard.ts, packages/plugins/plugin-auth/src/tenancy-service.ts, packages/plugins/organizations/src/ensure-default-organization.ts, packages/platform-objects/src/identity/sys-organization.object.ts, packages/cli/src/utils/organization-ownership-apply.ts, packages/cli/src/commands/migrate/organization-ownership.ts, packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts, packages/core/src/security/tests/resolve-authz-context.batch-equivalence.testkit.ts, packages/core/src/security/resolve-localization-cache.test.ts (unchanged, by the file list), packages/runtime/package.json, packages/runtime/vitest.config.ts, .github/workflows/ci.yml (the Test Core sharding), docs/adr/0131-total-organization-ownership-no-null-organization-id.md (D3, D5), AGENTS.md (trailer, push, changeset rules)

Rendered on the head the brief named; the PR's head.sha still read 307260452354f109f742a40c9bcea6657d3b8f7d at my read (2026-10-19T18:10Z), draft, open against main. Inputs: card #24523's body and all five comments (first touch 6269609529, serial note 6270175695, claim 6271076320, dispatch 6271192179, the os-dev-report 6273144736 read as claims); #10757's landing 6270833457 and PR #24533's body and file list; #21868's body and six comments; the territory declaration 6271107528 and the whole #15194 thread after it; PR #24373's body and its two review records; ADR-0131 D3 and D5 at the head; the PR body, its file list and its four commits; the net diff against the merge base, taken as git merge-base origin/main pr/24627 = c03b17d78438dfc0eb35c947962ca70fe9063346 (the origin/main the dev merged): 4 files, +668 / −20, the same four paths the PR lists; the head's 40 check-runs. The paths decide no face and the changeset's Clause-②: line reads no without an arm, so no face asked: the tier is the seat's choice, as the claim and PR body state (the platform-standing anchor). Read-only shape held: curl reads of the API, git fetch into refs/remotes/pr/24627, git diff / git show / git grep on the fetched refs, and the brief-prescribed template script. Nothing was built, run, tested or re-gated.

Check-runs on the head: 40, all completed; 34 success, 6 skipped (Build Docs, Console Pin Gate, the Dogfood matrix shard, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance), 0 failure, 0 in_progress. One run per check name, so no superseded attempt is in play. The five required contexts are success: Lint & Repo Gates, TypeScript Type Check, Test Core (the aggregate and all six shards), Build Core, Governed Surface Queue Guard. Check Changeset, both single-writer guards and The card this PR closes must claim this branch are success. The Test Core matrix shards by package across the workspace (ci.yml), so the runtime golden's green is a gate verdict, not only the dev's local run.

① Derived judgments

• The retirement set — right, with the window stated. watchedWriteState registers an unkeyed middleware on the engine; executeWithMiddleware (engine.ts) wraps find, findOne, count, aggregate, insert, update and delete, and the middleware bumps its generation in a finally around next() for every operation on sys_organization that is not in ENGINE_READ_OPERATIONS — so insert, update (a slug move included) and delete all retire the answer after the driver statement settles, a throw included. insertMany is insert with __partialRowErrors (engine.ts:16596). Every writer of sys_organization in this repository writes through the engine: better-auth's organization plugin through objectql-adapter.ts (dataEngine.insert, update, delete; updateMany and deleteMany are per-row engine calls — the create_organization, update_organization and delete_organization doors land there), plugin-auth's boot invariant (ensureDefaultOrganizationExists, ql.insert under the system context), ensureDefaultOrganization in plugin-auth and its organizations-plugin wrapper, and the data door's update (the object admits get, list, update). git grep at the head finds no raw knex or driver write to sys_organization in non-test source; seed-tenancy-backfill.ts reads the table by raw SQL and writes other tables. Outside the serving engine: the cli ceremony (os migrate organization-ownership --apply, its own process and engine, ordered before boot by the boot guard), cloud's change_slug orchestrator (the object's action targets /api/v1/cloud/organizations/{id}/change-slug; that code is not in this repository — if it writes through the tenant's REST data door it passes the engine, if it writes the database directly it is a peer write), and any peer replica. For each of those the stale id can GRANT standing to the old Default Organization's surviving grant and WITHHOLD it from the new Default's grant, for at most the 30 s bound or until the next watched write or non-write bump on this engine, whichever is first. The commit window is real and named in the code: inside an engine transaction (for example inAfterAbortUnit, which wraps a write whose after-hook may abort) the statement settles and the generation moves before the commit, so a read on another connection in that round trip can memoise the pre-commit row under the post-bump generation — stale in either direction until the bound. A rollback after the bump over-invalidates, the safe direction.
• The cross-replica case — the dev's reading holds; one condition is unstated. bridgeAuthzInvalidation forwards every local non-remote bump, write bumps on any object included, and the receiving replica bumps remote, which the memo honours — so a bridged peer's sys_organization write retires the answer in one hop. But AuthzClusterBridgePlugin attaches the bridge only when OS_AUTHZ_GRANTS_CACHE_TTL_MS is above 0 AND the cluster driver crosses processes (authz-cluster-bridge-plugin.ts, the silent arm; runtime.ts:128 registers the plugin unconditionally). On the shipped default (TTL 0) no bridge is attached and reportAuthzCachePosture says nothing, so a default multi-replica deployment's only cover for tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868's delete-and-recreate on another replica is the 30 s bound, silently. The metadata bridge does not help here: applyRemoteMetadataMutation bumps remote only on a peer's metadata mutation, never on an organization write. Given that, 30 s (A) is the right backstop and C is rightly rejected: the granting direction exists, the card's own "no time-based staleness" target would be C, and the engine's organizationProbeMemo (the precedent the card named) accepts unbounded peer staleness. B has no measured need. Whether the default composition owes a boot-time posture line for this memo, in the spirit of the Fork 2 ruling for the grants cache, is the seat's call, named in ③.
• undefined memoised (A) — right. No organization, or several and none default, is a real answer; a stale undefined withholds standing (the safe direction), and the insert or slug move that creates a Default Organization passes the seam. Pinned (undefined is a real answer and is memoised). The not-registered arm declines before wiring anything (registryHoldsObject false → readDefaultOrganizationId, which returns undefined without a read) — right, since registering the object writes no row the seam would see; pinned (registered later in the same boot, read at once).
• The failure arm — pinned with teeth. tryFind rethrows an unreachable store as AuthzStoreUnavailableError; memoisedDefaultOrganizationId has no catch, so the set after the await is never reached and the next request reads again. The outage pin asserts the 503 envelope, then reads: [BY_SLUG] on the next resolution, then a hit. The dev's two ablation variants (catch-to-undefined, memoise-then-rethrow) are each red on this pin; read as claims, consistent with the assertions.
• The pre-registration window (A) — right, and the boot ordering is true in the code. The MEASURED pin starts a write with an empty chain, lets the first resolution register the observer and read the pre-write row, and asserts the stale answer stands until the clock passes 30 s. AuthPlugin.start() calls ensureDefaultOrganizationExists (auth-plugin.ts:825–848) and kernel:listening fires after every start() (kernel.ts:621–629), so the invariant's insert settles before any request; the observer registers at the first resolution that reads the anchor, so only a sys_organization write in flight at that moment reaches the window.
• Leg 5 generalised (A) — byte-identical in behaviour; no export, census row or pin moves. localizationWriteState(ql) is now a wrapper over watchedWriteState(ql, localizationWriteStates, LOCALIZATION_CACHE_WATCHED_OBJECTS); the body is the former body parameterised (watched.has, ENGINE_READ_OPERATIONS, states.set), with the same unkeyed registration, the same finally bump, the same non-write epoch subscription and the same null poisoning. resolve-localization-cache.test.ts is not in the diff. LOCALIZATION_READ_OPERATIONS and LocalizationWriteState were module-private and the renamed symbols occur nowhere else in the tree (a repo-wide grep at the head returns no hit outside the file).
• The byte-identity claims hold on the diff. The hunks are at 941 (appended after readDefaultOrganizationId's closing brace at 942), 1568→1659 (one line of the call site) and 2029 onward (the localization region). grantAppliesInTenant (861), grantOrganizationOf (890), grantAnchorsPlatformStanding (912) and readDefaultOrganizationId (934–942) sit at the same lines in base and head and no hunk touches them. The core pins assert the two reads byte-for-byte ({ slug: 'default' } limit 1, then {} limit 2, system context). The golden pins 8 / 10 with 0 sys_organization statements for both slugs, the organization-less control at the same counts, and both retirements on a real kernel; it ran green in CI. The envelope deep-equality (12 envelopes, one md5 on both blobs) is the dev's one-off control, read as a claim and consistent with a diff that moves no predicate line.

② Semver level

'@objectstack/core': patch with Clause-②: no holds on the level: the diff adds no export line, memoisedDefaultOrganizationId, watchedWriteState, WatchedWriteState and ENGINE_READ_OPERATIONS are module-private, no exported class gains a member (the readings of PR #24518 record 6265937412 and PR #24526 record 6267837597 do not bite), and DEFAULT_ORGANIZATION_MEMO_TTL_MS is a constant, not an env knob. Check Changeset is success.

The changeset text does not hold sentence by sentence. Every sentence holds except this one: "A peer replica's write is seen through the remote and metadata epoch bumps the authz.invalidated and metadata bridges deliver." Three things are wrong in it. (a) The metadata reason is not bridge-delivered: it is plugin-security's local bump on a metadata watch and on the everyone-anchor declaration (security-plugin.ts:1903, :4743, through resolveWriteEpochSource); the metadata bridge's receipt path bumps remote (protocol.ts:8143). (b) The metadata bridge carries a peer's metadata mutation, never a peer's sys_organization write, so that bridge delivers nothing for the write the sentence is about. (c) The authz.invalidated bridge is attached only with the grants cache on (OS_AUTHZ_GRANTS_CACHE_TTL_MS above 0) and a cross-process cluster driver; on the shipped default a peer's write is seen by no bump at all, and the following sentence's "a peer's write with no bridge attached" is the default case, not an edge. This text ships as CHANGELOG.md and is what an operator reads to decide whether the cross-replica window is bridged. The PR body carries the same attribution ("metadata (the metadata bridge's receipt path)").

The route: replace that sentence with one that is true, for example: "With the authz.invalidated bridge attached (the grants cache on, OS_AUTHZ_GRANTS_CACHE_TTL_MS above 0, and a cross-process cluster driver), a peer replica's write arrives as a remote epoch bump and retires it; every other non-write bump (metadata, manual) retires it too." The next sentence then stands as written. The PR body's metadata attribution should be corrected to match. No code moves; the level and the Clause-②: no line stand.

③ Boundary flags

• Fence widened to leg 5's function and two renames — accepted. One copy of the seam is the shape that cannot drift; the renames are module-private with zero external references; the localization suite is unedited and green in CI. Named in the PR body.
• Pins in runtime — accepted. The golden needs a booted composition; packages/runtime declares every package it imports (core, objectql, plugin-auth, plugin-security, rest as dependencies; platform-objects, plugin-hono-server, plugin-sharing as devDependencies), its vitest aliases @objectstack/core to source so the pin reads the resolver under test, default-organization-boot-invariant.pin.test.ts is the precedent in the same package, and the Test Core shards ran it. The file declares no measured budget; whether it stays under the 10 s wall rule is CI's to grade, not measured here.
• Commit trailers — accepted; one observation. The three authored commits end with the model-free pair AGENTS.md requires. The dev reports the harness reminder asked for a trailer naming a model and that the model-free pair was used instead; that is the rule. The fourth commit, the merge of origin/main, carries no trailer; it is a plain merge commit the pre-push hook accepted. No model identifier appears in the PR title, body, changeset or code.
• The build-spelling retry — not a red. pnpm build -- --concurrency=2 forwards the flag into each package's build script (AGENTS.md names this trap); the turbo spelling exited 0.
• Five pushes — accepted. Own claude/issue-* branch, no force; AGENTS.md asks for a WIP push before every long step.
• open_questions: (1) backstop length — A, with the flag that on the default composition no bridge is attached and nothing says so; the seat decides whether the Fork 2 ruling's posture statement reaches this memo or whether it is accepted as leg 5 was. (2) undefined — A, right. (3) pre-registration window — A, right; measurement and boot ordering verified in code. (4) generalise vs copy — A, accepted. (5) epic territory — A: no answer at my read; the PR waits.
• The out_of_scope_finding is right. plugin-auth's readDefaultOrganizationId (last-admin-guard.ts:973) is called from anchorOwnerTest (:1017), which runs inside enforceStanding on guarded writes — the user, grant, organization-update and organization-delete hooks (:1098, :1295, :1327, :1770–1779) — and only when some admin_full_access grant names an owner. It does not run per authenticated request.
• The epic:#15194 thread: at my read (2026-10-19T18:10Z) the newest comment on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 is the declaration 6271107528 itself; no answer and no objection has been posted. The PR waits on that answer or an objection-free read of the thread, as its body and the dispatch 6271192179 state, and this record does not substitute for it.
• Escalated to the seat, not owed by this record: the silent TTL-only posture on the default composition (② above makes the changeset say it; whether the runtime should also say it at boot is a design call outside this card's fence).

Implemented-by: claude/issue-24523-default-org-memo
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: FAIL

---

Seat note, appended at posting (2026-10-19T18:16Z). It is not part of the record.

• Spot-checked at this head: the changeset sentence the record names is in .changeset/24523-default-organization-memo.md ("What retires it"). AuthzClusterBridgePlugin returns with no bridge when OS_AUTHZ_GRANTS_CACHE_TTL_MS is 0 (authz-cluster-bridge-plugin.ts:59–:70). So the record's ② ground stands, and on the shipped default the 30 s bound is the only cover for a peer's write.
• The seat's call on ③'s escalation (a boot-time posture line for this memo on the default composition): not owed by this card. Leg 5's localization cache shipped the same TTL-only posture for an unbridged peer (Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757, accepted at 6270035817). A new boot line is a new surface with no pull. The changeset saying it truly is the fix.
• Fix round 1 goes to the dev now: the changeset sentence only. The seat patches the PR body's matching line itself. A delta record follows on the new head.
• The epic:#15194 thread: no answer to 6271107528 at posting. The PR waits on an answer or an objection-free read, as the dispatch said.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9fda5d6b1cb80748bd6ff1b433447cfd5294db85
Local-runs: none
Scope: .changeset/24523-default-organization-memo.md, packages/core/src/security/resolve-authz-context.ts (the comments this round moved) + packages/services/service-cluster/src/authz-cluster-bridge-plugin.ts (the attach condition). This is a delta review on the baseline record 6274104341 (head 307260452, FAIL on ② alone: one changeset sentence).

Inputs:

• that record;
• the fix-round report 6274241364, read as claims;
• the one commit on top of the old head (9fda5d6b1, parent 307260452), read with git diff on fetched refs: 2 files, +11/−6;
• this head's check-runs.

There is no merge of main: the PR read clean.

① Derived judgments

What moved.

• The changeset's "What retires it" bullet. Its peer-replica sentence now reads: with the authz.invalidated bridge attached (the grants cache on, OS_AUTHZ_GRANTS_CACHE_TTL_MS above 0, and a cross-process cluster driver), a peer's write arrives as a remote bump and retires the answer, and every other non-write bump (metadata, manual) retires it too.
• The residual-bound sentence now says that on the shipped default the 30 s bound is the only cover for a peer's write.
• In resolve-authz-context.ts, the memo's docblock ("Across replicas") and the TTL constant's comment are corrected the same way.
• Every changed TypeScript line is a comment line: no identifier, import, export, string literal or test moved.
• Every code judgment of record 6274104341 ① and ③ carries over unchanged, and so do its acceptances of all five open_questions as A.

The new text is true.

• AuthzClusterBridgePlugin returns before attaching when the TTL is 0 (authz-cluster-bridge-plugin.ts:59–:70). The bridge forwards a local non-remote bump, and the receiver bumps remote.
• metadata is plugin-security's local bump. manual is a non-write reason the memo honours.
• The metadata bridge carries no organization write, and the new text no longer says it does.

② Semver level

'@objectstack/core': patch with Clause-②: no (...) holds. This round adds no surface, and the changeset now states the cross-replica posture truly, sentence by sentence.

③ Boundary flags

• PR body: its "Across replicas" bullet carried the same misattribution, and its residual-bound sub-item did not say the default case. The seat patches both to this head, using the dev's suggested wording from 6274241364, rechecked against the code.
• The deviations (three extra prose gates re-run; the worktree recreated and reinstalled): accepted.
• Gates for this round: the three changeset gates, check:doc-authoring, check:nul-bytes, check:issue-citations and the core typecheck all exit 0. The two new pin files and the localization suite pass (41 and 6). The rest of the 67-command run on 307260452 stands: the inputs it reads are unchanged.
• CI on 9fda5d6b1: ci-failure GREEN, all 40 check-runs completed, none failed.
• The epic:#15194 thread: no answer to the declaration 6271107528 at this record. It is the newest comment there, and no objection has been posted. The declaration itself names an objection-free read of the thread as one of its two release conditions.

Implemented-by: claude/issue-24523-default-org-memo
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T19:04Z · ACCEPT

Head: 9fda5d6b1c. Commits, in order:

1. the memo on the generalised write seam, with its unit pins;
2. the runtime statements golden;
3. the changeset;
4. a merge of main;
5. fix round 1 (the changeset's peer-replica sentence, and its comments).

Card #24523 (p1, bug, area:access): claim 6271076320, dispatch 6271192179. Dev reports: 6273144736, and fix round 1 6274241364.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24523. 4 files, +677/−25. Not governed: check-governed-merges matched 0 of 4 paths.
Scope	readDefaultOrganizationId is memoised per engine (memoisedDefaultOrganizationId). Retired by: any sys_organization insert, update or delete through the engine (leg 5's seam, generalised as watchedWriteState), and every non-write epoch bump. Bound: a 30 s residual bound. Not memoised: a failed read, and an unregistered object. undefined is memoised. Measured: an organization-owned grant now costs get-session 8 and a data read 10, the same as an organization-less one, with 0 sys_organization statements warm.
Seat's own read	The fix commit changes prose only: one changeset sentence and comment lines; no code token moved. The default-composition posture checks out: the authz.invalidated bridge is not attached at a grants-cache TTL of 0. The PR body was patched to match (the "Across replicas" bullet, and the residual bound's default case).
Review	CONTRACT_REVIEW_TIER: record 6274104341 was FAIL on ② only (the changeset's false peer-replica sentence). The delta 6274924170 is PASS on this head.
Declaration	Clause-②: no on the claim, the PR body and the changeset (@objectstack/core patch). No export, public member or env knob is added.
Cross-lane	epic:#15194: territory declaration 6271107528, unanswered. The C8 regions are byte-identical (record ①). The thread has no comment after the declaration and no objection, which meets the declaration's own condition. domain:cli: the new runtime test file is declared at 6274991790 (#6024) and 6275003548 (#22648), posted just before this ACCEPT. No objection on any of them, or on the card.
Gates	Dev, at 307260452: 67 derived, 67 run, 67 exit 0. Core test:repo 82/82. Full suites passed: core, plugin-security, plugin-auth, rest and runtime. The fix round re-ran the three changeset gates, the prose gates, the core typecheck and the pin files, all exit 0.
CI	At this read on 9fda5d6b1c: ci-failure GREEN, all 40 check-runs completed, none failed.

Disposition:

• open_questions: all five accepted as A, per record 6274104341 ③: the 30 s backstop; undefined memoised; the pre-registration window accepted; leg 5's seam generalised; the epic question waited out, as above.
• The record's escalation (a boot-time posture line for this memo): not owed by this card, per the seat note on 6274104341. The changeset now states the default posture.
• deviations: all accepted (records 6274104341 ③ and 6274924170 ③).
• out_of_scope_findings: none filed. plugin-auth's own copy runs only on guarded writes (record ③).

Downstream: the repo:cloud#2 seat is pointed at the landing for cloud#3053's +2 statements.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Fixes #24523 then closes the card.

---

Generated by Claude Code