fix(plugin-auth): revalidate the memoized default organization id when a user is bound

[objectstack-fleet]

Fixes #21868

Clause-②: no

What

TenancyService.defaultOrgId() (packages/plugins/plugin-auth/src/tenancy-service.ts) memoized the default organization id for the life of the process and returned it without checking. The single-org bootstrap recreates a missing slug='default' organization on the next sys_user insert, under a new id. That same sign-up's membership bind then read the memo and bound the user to the deleted id. Under the auto policy membership is decided once, at creation (ADR-0093 D7, the ruling recorded on #21791 and landed by #21813), so nothing repairs that bind later.

• Revalidated in the one shared accessor. Every reader of the default organization goes through tenancy.defaultOrgId(): the creation bind and the first-session settle in AuthManager, the self-registration grant, the admin create-user bind, the kernel:ready backfill, the anonymous form doors in @objectstack/rest, the check on organization-scoped form writes in @objectstack/metadata-protocol, and the email-template bootstrap. The check lives in the accessor once, with no copy per caller.
• One read. With a memo present, each call reads sys_organization by primary key (where: { id }, limit: 1). If the row exists, the memo is returned and nothing is re-resolved.
• Gone means re-resolved by the same rule. On a definite absence the memo is dropped and resolveDefaultOrgId runs again, the resolver that set it: the slug='default' organization first, else the only organization. The replacement is what a fresh boot would pick. If nothing exists yet, the answer is null and the next call resolves again.
• An unanswered read keeps the memo. A failed read, or a reply that is not a row list, is not evidence that the organization is gone. Dropping the memo on it would bind the next user to no organization, which is also never repaired. Keeping it gives the same answer as before this change.
• No sys_organization hook, no time-based expiry, no change to the membership policy, no new export.

Tests

• Red first. The pin was committed before the fix (69916d1e12). There, src/tenancy-service.test.ts failed: usr_second was bound to org_old, expected org_new (1 failed, 34 passed).

• Unit (plugin-auth, src/tenancy-service.test.ts, 39 passed). Added:

  • delete and recreate, then create a user through the real reconcileMembership; the user binds to the new id;
  • cost: a memo that still exists costs exactly one find per call, by id, and is not re-resolved;
  • deleted and not yet recreated: null, then the replacement;
  • the replacement is picked slug-first, like the first resolution;
  • an unanswered read keeps the memo, and the next answered read still revalidates.

  The existing memoizes a positive resolution test asserted that a memoized call issued no query at all, which is the defect. It now asserts exactly one read, by primary key.

• Door pin (new file, packages/qa/dogfood/test/default-organization-recreated-binds-new-id.dogfood.test.ts, 1 passed). A real showcase boot with orgContext, the harness switch for the real single-org bootstrap. The admin signs up the first user, who is bound to the bootstrap's organization. The admin deletes it through better-auth's POST /auth/organization/delete (200). The next sign-up recreates it, and that user's membership and first session carry the recreated id.

• Ablation through scripts/ablation-replace.mjs, from the committed fix at 13d72b32f9. The plugin-auth source has not changed since. The memo was made unconditional again (marker ABLATION_21868_UNCHECKED_MEMO). Mutation landed: anchor 1 to 0, blob f0012491afbf to 5856726a7b5f. plugin-auth was rebuilt and ablation-dist-preflight found the marker in 2 built files.

  • Unit: 4 red, for example expected 'org_old' to be 'org_new'.
  • Dogfood: red, expected 'org_muvizcge3a2f1lgy' to be 'org_muvizdq45anuk3zq'. The user was bound to the deleted organization, not the recreated one.
  • Restored: blob equals HEAD (f0012491afbf) and git diff HEAD is empty. After a rebuild, --absent reported the marker absent from all 14 built files and the tree clean. Unit 39 passed, dogfood 1 passed.

• Packages. @objectstack/plugin-auth full suite at 3e2e917f27: 123 files, 2575 passed, 10 skipped. Later commits changed only the new test double in plugin-auth, and that file was re-run (39 passed). Typecheck green: tsc, the examples, and check:test-typecheck with debt held. @objectstack/dogfood typecheck green; --listFiles includes the new test.

• Lint, narrowed. eslint --no-inline-config --format json over the 3 touched .ts files: 3 files, 0 errors, 0 warnings. Type-aware linting is not enabled in eslint.config.mjs (no parserOptions.project), so this diff cannot move the verdict on any untouched file. The full pnpm lint run is left to CI.

• Gates, at 8fe4041e75. dispatch-gates --commands derived 68 families. All 68 were run and every one exited 0. That includes check:dual-build-cjs-loads, measured after building the 8 packages its prerequisite named. dispatch-gates --ran over the exit-coded record: 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN (a derived zero). check:where-matcher first found the new test double reading a combinator key as a field name. The double now refuses one (8fe4041e75), and the unit ablation was re-run on that head: 4 red, restored, blob equal to HEAD.

Acceptance notes

• Cost. Each defaultOrgId() call with a memo now costs one primary-key read of sys_organization. That includes each anonymous form request, which reads it to pick the form's organization. When the memo is stale, the call also pays the existing resolution (one or two reads).
• No sentence in content/docs/** became false. deployment/tenancy-modes.mdx describes defaultOrgId() as the reconciler's target and says nothing about memoization.
• Tooling observation, not filed. While a refusal message in the new test double contained the text makeStore:, check:where-matcher reported the matcher as unjudged (could not lift: ReferenceError: orgs is not defined). Rewording the message cleared it. The lifter appears to pull in the enclosing factory when its name appears in that text. No carrier.
• Not merged with origin/main. Main is 2 commits ahead (1e18a0735c): a spec test-title change and a platform-objects action retirement. Neither touches plugin-auth, dogfood or verify. The merge ref is CI's.

Seat's append: patch rounds 1 and 2 (written by domain:services seat 1 from the dev's reports; the dev does not edit this body)

• Patch round 1: the CI red at 8fe4041e75 is root-caused, and it is not this change. The door pin's POST /api/v1/auth/organization/delete answered 500 on CI shard 3/3. The cause is a pre-existing objectql defect, filed as finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910. The cascade relation scan probes a federated object's platform-injected organization_id against a remote table that has no such column, so every organization delete fails once a federated object is provisioned. Earlier dogfood files on the same runner had provisioned the showcase federated fixture. Locally that file was absent, so the pin was green.
  • Reproduced with two runs that differ only in whether the fixture is present.
  • A control with the revalidation removed fails identically, which clears this PR's code.
• Patch round 2 (route B, the seat's verdict by the four-axis frame): the door pin is moved out in its own commit (4303d35abb), as finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910's acceptance pin.
  • The card's "Done when" ("a test deletes and recreates the default organization and creates a user in the same process") is met by the unit pin "a user created after the default organization is deleted and recreated binds to the NEW id" and its ablation (4 red, then restored; blob equals HEAD).
  • The sections above that describe the door pin are the round-0 record.
• The changeset is unchanged. It claims no booted pin. The re-derived gate battery at 4303d35abb: 64 derived, 64 run, all exit 0.
• CI at 4303d35abb was cut by the repo's runner starvation (the seat's note 6003048037). It needs a fresh run.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/deployment/cli.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/deployment/seed-tenancy-repair.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/deployment/tenancy-modes.mdx (via TenancyService (symbol, a top-level interface))
• content/docs/permissions/administrator-guide.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/protocol/kernel/config-resolution.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/protocol/objectql/schema.mdx (via sys_organization (literal, a string literal in organizationExists))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/releases/v17/17-1.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/releases/v17/17-4.mdx (via sys_organization (literal, a string literal in organizationExists))
• content/docs/releases/v17/17-5.mdx (via sys_organization (literal, a string literal in organizationExists))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e6dc7a240617eaeef9a64e788bf6e5561c107f1b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9db48c6bb87813eb5135449cf0018b0b2feeaffd — the merge of head 37233dd57553f031d80801edba43913618edeed7 into base e6dc7a240617eaeef9a64e788bf6e5561c107f1b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9db48c6bb87813eb5135449cf0018b0b2feeaffd && git checkout 9db48c6bb87813eb5135449cf0018b0b2feeaffd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e6dc7a240617eaeef9a64e788bf6e5561c107f1b 37233dd57553f031d80801edba43913618edeed7 && git checkout -B drift-repro e6dc7a240617eaeef9a64e788bf6e5561c107f1b && git merge --no-ff 37233dd57553f031d80801edba43913618edeed7

node scripts/docs-audit/affected-docs.mjs --json e6dc7a240617eaeef9a64e788bf6e5561c107f1b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e6dc7a240617eaeef9a64e788bf6e5561c107f1b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

CI note from domain:services seat 1: the reds at 4303d35abb are not this PR's

• 17 jobs were cancelled after 15 minutes in the queue, without a runner. They include the guards, Lint & Repo Gates, TypeScript Type Check, Test Core (1/6) and Dogfood Regression Gate (1/3).
• Dogfood Regression Gate (2/3) (job 111949262409) stopped mid-build on "The runner has received a shutdown signal", before any test ran: a runner loss. Test Core failed only as the aggregator of its cancelled shards.
• The earlier red at 8fe4041e75 was real, and it is root-caused. The door pin hit a pre-existing organization-delete defect outside this PR, and patch round 2 moved that scenario out of the PR. The seat records this in the PR body.
• The repo's hosted runners have been starved since about 19:20Z: 55 to 80 runs queued, with 1 to 3 in progress. Jobs that wait 15 minutes without a runner end cancelled with "The job was not acquired by Runner of type hosted even after multiple attempts". The seat has no re-run channel. This PR gets a fresh run with its next push (a merge of origin/main once main moves) or with a re-run by a maintainer. A failure on that fresh run is treated as real.

---

Generated by Claude Code