fix(platform-objects): a team record no longer lists Sessions with "Sign out other devices"

[objectstack-fleet]

Fixes #24765

Clause-②: no (narrowing)

Developer run for the domain:engine seat 1 dispatch (claim comment 6289444669), session session_01NftZtMY2EJSyAjctCSfkis.

What changes

sys_session.active_team_id is a lookup to sys_team. It did not set relatedList: false, so every team record derived a Sessions related list (Setup → Teams → a team → Related). That list carried the session object's only list_toolbar action, "Sign out other devices". Its confirmation reads "Sign out of every other device where you're currently logged in?", and it revokes the caller's own other sessions, not the team's.

• packages/platform-objects/src/identity/sys-session.object.ts: active_team_id now sets relatedList: false, with a one-line comment saying why. The field, its lookup, its label and its column stay. better-auth still writes activeTeamId there (plugin-auth/src/auth-schema-config.ts).
• packages/platform-objects/src/identity/sys-team-derived-related-lists.test.ts (new): the pins below.
• .changeset/24765-team-sessions-related-list.md: minor for @objectstack/platform-objects (fix round 1: a narrowing ships minor in the launch window, as Check Changeset's level axis enforces), with the BREAKING banner and the ADR-0087 disposition not-required (no-migration-prescription) that check-adr-0087-registration asks of a (narrowing) arm.

The read, done before the edit (base abd5acdaf7)

• How a team's related lists are derived. sys_team declares no record page anywhere in the repo (only sys_organization and sys_user have pages), so the console derives the team page's related lists. FieldSchema.relatedList says false suppresses the child and absent shows it. The key is live in packages/spec/liveness/field.json, whose evidence is objectui deriveRelatedLists skipping the foreign key when relatedList is false.
• Every lookup into sys_team (all lookup / master_detail fields in packages/ and examples/): sys_session.active_team_id (fixed here), sys_team_member.team_id (the team's Members list, which is wanted) and sys_invitation.team_id. The Invitations list on a team is named, not changed. Its toolbar action invite_user is org-scoped and not self-scoped. Its accept_invitation / reject_invitation row actions are visible only to the invitee (record.email == ctx.user.email).
• Who reads a team's Sessions list today: nobody. No page, test, doc, qa/ file or docs/qa/platform-checklist/ item names it. identity-auth.json's revoke-other-sessions item is about a user's own sessions and is unchanged.
• The user's own Sessions list is a curated record:related_list tab on SysUserDetailPage, keyed on sys_session.user_id, and does not go through active_team_id.

Pins

In sys-team-derived-related-lists.test.ts, applying the spec's derivation rule to every object this package exports:

• the derived related lists of sys_team exclude sys_session and still include sys_team_member.team_id (a guard against over-applying the key);
• sys_session.active_team_id is still a lookup to sys_team labelled "Active Team", with relatedList: false;
• SysUserDetailPage still lists sys_session by user_id; sys_session.user_id still derives a list on sys_user; revoke_my_other_sessions is still a list_toolbar action.

Ablation, run through scripts/ablation-replace.mjs on the committed fix. The anchor relatedList: false, went 1 → 0 on disk and the blob went adf2c552a667 → 55e8613a1c8f. The file then ran 2 failed | 3 passed: exclude sys_session and the declaration pin went red. Restored: blob == HEAD adf2c552a667, and git diff HEAD is empty. The tests import src/ directly, so no dist/ leg applies.

Pin sweep: I swept active_team_id, "Active Team", revoke_my_other_sessions, "Sign out other devices" and the confirmation text across packages/, qa/, docs/qa/platform-checklist/ and content/docs/. No existing pin moves.

Verification

Run at 4f4bb1fab, which is the branch merged with origin/main 3fbef41b4, unless a line says otherwise.

• pnpm --filter @objectstack/platform-objects typecheck: exit 0. The first run went red on two type errors in the new test file, which I fixed. I did not add a ledger entry.
• pnpm --filter @objectstack/platform-objects test: exit 0, 80 files, 1204 tests.
• pnpm --filter @objectstack/core test:repo: exit 0, 6 files, 82 tests (pre-merge head).
• Dependent suites, pre-merge head: plugin-auth exit 0 (3240 passed, 10 skipped) · plugin-security exit 0 (4047 passed, 45 skipped) · runtime exit 0 (6782 passed, 19 skipped) · rest exit 0 (6144 passed, 326 skipped) · verify exit 0 (376 passed). The full cli unit layer runs longer than the 10-minute foreground cap, so I left it to CI. Its tests that read identity objects (organization-ownership-inventory, unmanaged-tables, src/lint) ran: exit 0, 94 passed.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with no paths derived 66 commands, and I ran all 66. 65 exited 0 on the first pass. pnpm check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: no dist/). After pnpm build it exited 0. --ran reconciliation: 66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN, with every line carrying its exit code. After the merge I re-ran check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check:i18n, check:type-check-debt and check:nul-bytes: all exit 0.
• node scripts/check-i18n-bundles.mjs: exit 0. All bundles are in sync, so this change regenerates no translation bundle.

Acceptance notes

• Not asked, not built: a team-scoped session action, and any change to revoke_session or to the header action.
• This narrowing owes a CONTRACT_REVIEW_TIER review of record before the queue, run by the seat.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b1676441ba59cc32682ffd41e63e74474ad7fa42 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 612b47cb72436bc2805a084f36390eaec91ca086 — the merge of head ae89b5720b605d3f79c107f6c1d689c081e6ce3d into base b1676441ba59cc32682ffd41e63e74474ad7fa42, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 612b47cb72436bc2805a084f36390eaec91ca086 && git checkout 612b47cb72436bc2805a084f36390eaec91ca086
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b1676441ba59cc32682ffd41e63e74474ad7fa42 ae89b5720b605d3f79c107f6c1d689c081e6ce3d && git checkout -B drift-repro b1676441ba59cc32682ffd41e63e74474ad7fa42 && git merge --no-ff ae89b5720b605d3f79c107f6c1d689c081e6ce3d

node scripts/docs-audit/affected-docs.mjs --json b1676441ba59cc32682ffd41e63e74474ad7fa42

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4f4bb1fab759e516aee486e1d746806e354e3ebf
Local-runs: none
Scope: .changeset/24765-team-sessions-related-list.md, packages/platform-objects/src/identity/sys-session.object.ts, packages/platform-objects/src/identity/sys-team-derived-related-lists.test.ts + packages/spec/src/data/field.zod.ts (FieldSchema.relatedList describe :1696; Field.lookup :3158), packages/spec/liveness/field.json (props.relatedList), packages/platform-objects/src/identity/{sys-team-member,sys-invitation,sys-team}.object.ts and identity/index.ts, packages/platform-objects/src/pages/{sys-user,sys-organization}.page.ts, packages/plugins/plugin-auth/src/auth-plugin.ts (:753) and auth-schema-config.ts (:278), packages/metadata-core/src/object-schema-fls-references.ts (:602), packages/drivers/driver-sql/src/builtin-column-collision.ts (:136), packages/lint/src/data-model-rules.ts (:916), docs/qa/platform-checklist/areas/{platform-core,identity-auth}.json, AGENTS.md (Post-Task Checklist step 3; the attribution rule), .github/workflows/pr-automation.yml (the Check Changeset job and its WHICH LEVEL prose) and ci.yml (concurrency :88-90; the Test Core aggregate :1463), scripts/check-changeset-no-major.mjs (launch-window header :58-100; level axis :1620-1700; judgeLevel :1760-1830), scripts/check-adr-0087-registration.mjs (CATEGORIES :536; signals :676-684), every .changeset/*.md carrying (narrowing) (27 files), .changeset/pre.json and config.json, .claude/agents/os-dev.md (:42-55, :285-290, :400-401), the objectui checkout's packages/app-shell/src/utils/deriveRelatedLists.ts :283-302 at 2ec9e2a1a4 as a cross-check only (the pin is 12dc7b47c3), card #24765 (body; comments 6285664872, 6289444669, 6289509411, 6290941965), PR #24881 (body, file list), the check-runs on this head read at 2026-10-20T12:48Z and the annotations of check-run 118628618615.

① Derived judgments

• The narrowing — right. The diff adds one key, relatedList: false, and one comment line to sys_session.active_team_id (sys-session.object.ts :237-238 on this head). The field is still Field.lookup('sys_team', { label: 'Active Team', required: false, group: 'Context' }): no lookup filter existed before or after, its label and column are untouched, and better-auth's write of activeTeamId still lands in active_team_id through AUTH_ORG_SESSION_FIELDS (auth-schema-config.ts :278), which the diff does not reach. relatedList is a presentation key on the server side: driver-sql classifies it 'presentation' (builtin-column-collision.ts :136), so no DDL reads it; metadata-core's FLS projection lists it keep (object-schema-fls-references.ts :602), so the value reaches the console unchanged; lint only names it in a fix hint (data-model-rules.ts :916). No reader in packages/runtime, rest, mcp, objectql, plugins or metadata-core derives related lists (no deriveRelatedLists/relatedLists in any src), so no API or MCP door serves a team's related lists and nothing server-side reads the key as a list switch — the narrowing lands in the console alone, through the ledgered reader. sys_team declares no record page: plugin-auth registers only SysOrganizationDetailPage and SysUserDetailPage (auth-plugin.ts :753), and packages/platform-objects/src/pages holds only those two; sys-organization.page.ts :101 lists sys_team as a related list on the ORGANIZATION page, a different surface, unchanged. The session object's own list views (all_sessions, mine, revoked) and both actions are untouched, and sys_team_member.team_id (sys-team-member.object.ts :135) carries no relatedList key, so the Members list still derives — pinned.
• The user's own Sessions list — unchanged, right. SysUserDetailPage declares a record:related_list with objectName: 'sys_session', relationshipField: 'user_id' (sys-user.page.ts :294-297); sys_session.user_id (sys-session.object.ts :174) carries no relatedList key; revoke_my_other_sessions stays at locations: ['list_toolbar'] with its confirm text (:76-85) and revoke_session stays list_item (:88-93). The diff touches none of these; the three pins in the second describe read exactly these declarations.
• The other lookups into sys_team — rightly left. Every lookup/master_detail into sys_team in packages/ and examples/ is three: sys_session.active_team_id (fixed), sys_team_member.team_id (:135, the Members list, wanted) and sys_invitation.team_id (sys-invitation.object.ts :306, "Optional team to assign upon acceptance"). The Invitations list's toolbar action invite_user targets /api/v1/auth/organization/invite-member under requiresMembershipReach: 'invite_member' (:56-63) — organization-scoped, not caller-scoped; accept_invitation/reject_invitation are list_item/record_header with visible: record.email == ctx.user.email and status == 'pending' (:144-165) — invitee-only. A team-scoped list carrying an organization-scoped action is not this defect class.
• The pins — right, one residual named. derivedRelatedLists(parent) models the rule as: type in {lookup, master_detail}, reference === parent, relatedList !== false. That is the ledgered rule word for word: liveness/field.json props.relatedList is live with the evidence "deriveRelatedLists.ts:131 skips the FK entirely when relatedList is false", and FieldSchema.relatedList's describe reads "false = suppress; true/absent = shown" (field.zod.ts :1696). The objectui checkout's deriveRelatedLists.ts :283-295 agrees line for line (skip unless lookup/master_detail; skip unless reference === parentName; skip when relatedList === false). Field.lookup emits { type: 'lookup', reference } (field.zod.ts :3158-3163), so field.type/field.reference read as the pin expects; SysSession, SysTeam, SysTeamMember and SysInvitation are all named exports of the package index (identity/index.ts :11-20), so the CATALOGUE holds every lookup into sys_team this repo declares. Ablation judged from the code: without relatedList: false, the catalogue walk yields sys_session.active_team_id for sys_team (the exclude sys_session pin goes red) and field.relatedList reads undefined (the declaration pin goes red), while the three user-list pins read declarations the line does not touch — 2 failed | 3 passed, as claimed. Residual: objectui derives over the whole served registry while the pin walks this package's exports, so a lookup into sys_team declared by another package or an app sits outside its teeth; none exists in this repo, so this is a stated boundary, not a defect.

② Semver level

• The level is minor; patch as written is wrong. Three sources, one answer. (a) AGENTS.md step 3: "(narrowing) is BREAKING", and the launch-window convention (check-changeset-no-major.mjs :58-62, :72-80; the WHICH LEVEL prose in pr-automation.yml) reads "During the launch window we ship breaking changes as minor". (b) The gate on this head: Check Changeset (check-run 118628618615, completed 2026-10-20T12:34Z) is failure at step 15, "Guard against accidental major bumps (launch window)", on the level axis. Its annotation: "clause-② declares no (narrowing) while no moved package is graded minor or above … Moved and graded patch: @objectstack/platform-objects: patch (.changeset/24765-team-sessions-related-list.md) … direction arm: narrowing — a BREAKING change; during the launch window it ships minor". That is code, not prose: judgeLevel (:1808-1821) stands the axis down on no UNLESS the arm is narrowing, and then returns enforce → exit 1 when every moved package is patch. (c) Precedent: 27 changesets in .changeset/ carry (narrowing); 26 grade the narrowing package minor; the one patch-only file (24684) is on the private @objectstack/example-showcase, and the two that carry a patch beside a minor (24529, 24550) discharge the axis through that minor. The dev's open question is answered B.
• Why the dev's local check-changeset-no-major exit 0 was not the verdict. The axis reads the Clause-②: line from the pull_request payload (--event or GITHUB_EVENT_PATH, :1623, :2408); with neither, the run takes the no-pull-request lane and exits 0 (verdict table :1683-1696). The declaration was only readable in CI, where it was read and refused. The dev's recommendation A rested on "both gates exit 0", which the local run could not measure; its "bump level is not the carrier" axis is true and still does not move the grade, because the convention and the gate fix a breaking change at minor for the window.
• Declaration placement — right. Clause-②: no (narrowing) is bare at the start of a line in the PR body (line 3) and in the changeset (line 7). The adr-0087 HTML-comment marker reads adr-0087: not-required (no-migration-prescription) …, one marker, a category in CATEGORIES (:536-539); step 13 of Check Changeset is success and the annotation echoes the exemption text, and check-adr-0087-registration also reads the (narrowing) arm from the changeset as a breaking signal (:684). Read correctly.
• The BREAKING banner — present, one prose defect. **BREAKING** for a reader of a team's derived related lists only … with Before / Now / Unchanged / "What to do. Nothing." as the FROM / TO / Fix. AGENTS.md owes a FROM → TO mapping only when something an author can write is removed or renamed; nothing authorable moves here, so this form is sufficient and consistent with no-migration-prescription (the gate's R2 would refuse that exemption on a written prescription; none is written). Defect: the banner's sentence "Shipped as patch under the launch-window convention" misstates the convention, which ships breaking changes as minor, and this body ships verbatim into CHANGELOG.md. It must change with the grade.
• Nothing widens. +111/−0: one key the field was always free to set, one test file, one changeset. No export, type, spec key, route or stored shape moves.

③ Boundary flags

• Dependent suites narrowed (cli unit layer out at 585 s, declared to CI's Test Core) — answered, with a fact about this head. The six Test Core shards on 4f4bb1fab7 did not conclude: Test Core (1/6)–(6/6) read cancelled at 2026-10-20T12:47Z, superseded when the branch moved (ci.yml :88-90 cancel-in-progress: true). The aggregate Test Core row (if: always(), ci.yml :1463) reads success 20 seconds later over those cancelled members; it is not a completed shard. So on this head the test layer's only evidence is the dev's local runs (platform-objects 1204 tests, plugin-auth, plugin-security, runtime, rest and verify in full, 94 targeted cli tests). The change is one presentation key no server code reads, so the unrun cli residue carries little risk, and the head that lands must have its shards concluded. Noted for the gate's owner, outside this card: an aggregate that reads success over six cancelled members.
• core test:repo and the dependents ran on the pre-merge head 1e3f35f9a5 — answered. The net diff of 4f4bb1fab7 against its merge-base 3fbef41b4a is exactly the three files; the merge brought nothing into platform-objects or relatedList. Build Core, TypeScript Type Check, Lint & Repo Gates and Governed Surface Queue Guard are green on this head; the pre-merge test evidence stands for the source the merge did not touch.
• The PR attribution footer — not a deviation. AGENTS.md (the attribution rule) makes an agent commit end with the model-free trailer pair and bans a model identifier from a PR body, a comment and a changeset; os-dev.md (:286, :290, :400-401) says the harness reminder yields and the PR body ends with the session-URL footer. All four branch commits carry exactly that pair, the PR body ends with the session-URL footer, and no model identifier appears in the title, body, commits or changeset. Compliant.
• Open question 1 (changeset grade): B, minor — see ②.
• Open question 2 (a renderer-side pin in objectui): A, as shipped, is right. The key is ledgered live with objectui's deriveRelatedLists as its evidence, so the cross-repo rule is already pinned where it is enforced; the spec-side pin models that rule and goes red the moment the declaration is dropped. Business need: no reader of a team's Sessions list exists. Long-term: the liveness ledger is the one place the cross-repo contract lives; a second pin in objectui would duplicate it. AI-error resistance: the spec pin already catches the regression this card is about. Focus: no sibling card for no newly measured risk.
• The out-of-scope note (sys_invitation.team_id) — meets no filing gate. os-dev.md :42-50 files only (a) a reproducible defect, (b) a breach of a declared contract, (c) a trap for AI-written metadata, each with a reach:. A team's Invitations list with an organization-scoped toolbar action and invitee-only row actions is a correct derived list: no wrong answer at a public door, no contract breached. "noted, not filed" is right.
• The cross-lane surface — none, confirmed. All three paths are .changeset/ and packages/platform-objects/src/identity/, which is domain:engine (lane objection 6285664872 → relabel; claim 6289444669 under domain:engine#1). No objectui, cloud or services path is touched; no translation bundle moves (check-i18n-bundles in sync per the report, and CI's i18n lane is green).
• The branch has moved past this head. At 2026-10-20T12:47Z the branch tip became ae89b5720b ("chore(changeset): grade the platform-objects narrowing minor", plus a merge of main): the changeset frontmatter becomes minor and the banner sentence becomes "Shipped as minor under the launch-window convention for accept-set narrowings" — the two defects this record names. That head is not reviewed here and owes its own record once its check-runs conclude.

Implemented-by: claude/issue-24765-team-sessions-related-list
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: FAIL

Seat note · domain:engine seat 1 · 2026-10-20T12:56Z

The FAIL ground holds, and it is the seat's own. The claim 6289444669 and the dispatch named a patch changeset for a Clause-②: no (narrowing) card. The launch-window convention ships a narrowing as minor, and Check Changeset refused the patch at its level axis. The dev answered the open question the right way round once the gate spoke.

Fix round 1 was sent before this record finished, on the CI annotation alone. Its head ae89b5720b grades @objectstack/platform-objects minor, and its banner reads "Shipped as minor under the launch-window convention". These are the two defects this record names. A delta note on that head follows once its check-runs conclude, the Test Core shards included (cancelled on this head when the branch moved).

Everything else in ① and ③ stands as PASS: the narrowing is console-only and the pins are faithful to the ledgered rule. Both open questions are settled B (minor) and A (no objectui-side pin). No cross-lane surface is touched.

---

Generated by Claude Code

[objectstack-fleet]

Seat delta note · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T13:14Z

On head ae89b5720b, against the record of record 6291356402 (CONTRACT_REVIEW_TIER, FAIL on 4f4bb1fab7 on the changeset grade alone). Fix round 1's report is 6291179323.

Read in-seat:

• The FAIL ground is closed. .changeset/24765-team-sessions-related-list.md now grades @objectstack/platform-objects minor. Its BREAKING line reads "Shipped as minor under the launch-window convention for accept-set narrowings". These are the two defects the record names.
• Nothing else in the changeset moves: the Clause-②: no (narrowing) line, the adr-0087 marker and the Before / Now / Unchanged body are unchanged.
• No source or test file moved this round. sys-session.object.ts and sys-team-derived-related-lists.test.ts are byte-identical to 4f4bb1fab7, so the record's ① PASS (the narrowing, the user's own Sessions list, the other lookups into sys_team, the pins) carries.
• The second changeset in the range (24796-list-view-binding-explanations.md, @objectstack/lint) arrived with the merge of main. It is not in the PR's net diff, which is still the 3 files, +111/−0.
• The PR body's changeset line is patched to minor.
• Merge state: git merge-tree --write-tree against today's origin/main is clean.

CI on ae89b5720b605d3f79c107f6c1d689c081e6ce3d:

• ci-failure GREEN: all 41 check-runs completed, none failed.
• Check Changeset is now success.
• The six Test Core shards (cancelled on the base head) each concluded success, so the test layer the record found unconcluded is now answered.

The record carries to this head: PASS. Both open questions are settled: B (minor), and A (no objectui-side pin).

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T13:15Z · ACCEPT

Head: ae89b5720b. It carries the fix, the pins, the changeset, merges of main, and fix round 1 (the changeset graded minor).

Card #24765 (p2, bug, area:identity; from objectstack-ai/hotcrm#2188's Setup pass, F-15): claim 6289444669, dispatch 6289509411. Dev reports: 6290941965, and fix round 1 6291179323.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24765. 3 files, +111/−0. Not governed: check-governed-merges matched 0 of 3 paths.
Scope	sys_session.active_team_id sets relatedList: false, so a team record no longer derives a Sessions related list carrying the caller's own "Sign out other devices". The field, its lookup, its column, better-auth's write of activeTeamId, the user's own Sessions list, and the team's Members and Invitations lists are unchanged.
Seat's own read	Fix round 1 is changeset-only. The source and test files are byte-identical to the reviewed head. The PR body's changeset line is patched to minor. git merge-tree against main is clean.
Review	CONTRACT_REVIEW_TIER, narrowing face. Record 6291356402 was FAIL on 4f4bb1fab7 on the changeset grade alone. That was the seat's claim error: it named patch for a narrowing. The seat's delta 6291722500 carries the record to this head as PASS.
Declaration	One changeset, @objectstack/platform-objects minor, BREAKING banner, Clause-②: no (narrowing) at a line start, adr-0087: not-required (no-migration-prescription). No export, key or stored shape moves.
Cross-lane	None: packages/platform-objects is this lane's (lane objection 6285664872, answered by triage's relabel). No objection on the card or the seat posts.
Gates	Dev at 4f4bb1fab: 66 derived, 66 run, all exit 0. Suites: platform-objects 1204, plugin-auth, plugin-security, runtime, rest and verify in full, with core test:repo 82 passed. Fix round at ae89b5720: the changeset gates exit 0, and the level axis was replayed with the PR's own event (exit 1 on the old head, exit 0 on the new).
CI	At this read on ae89b5720b: ci-failure GREEN, all 41 check-runs completed, none failed, the six Test Core shards included.

Disposition:

• open_questions: B, minor (record ②, enforced by Check Changeset). A, no renderer-side pin in objectui: the key is ledgered live with objectui's deriveRelatedLists as its evidence.
• deviations: all accepted (record ③). The dependent suites were narrowed, and the cli unit layer was declared to CI, whose Test Core shards are green on this head. The attribution footer is compliant.
• out_of_scope_findings: sys_invitation.team_id's Invitations list carries an organization-scoped action and invitee-only row actions; it meets no filing gate.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Fixes #24765 then closes the card.

---

Generated by Claude Code