docs(tenancy): 18.0 states the three ownership rules and its fresh-install, single-only scope; the operator messages say so too

[objectstack-fleet]

Part of #15214
Clause-②: no — docs, a driver docblock and three operator-facing message strings (one a new os doctor warning row); no API, schema, rule, permission or exit-code face

The open-source docs half of C11. It runs in parallel to the 18.0 release and never holds it (ruling record 6261853191 on #15194). The ADR-0131 D14 dated note is a separate PR on claude/issue-15214-c11-d14-note, because docs/adr/** is Tier H. Card close-outs stay with the epic seat: #13564, #13636, PR #14923, #11611 and #10103 remain open from this PR.

What changes

Docs: the three sentences (ADR-0131 D1–D7), stated as 18.0 delivers them.

• content/docs/deployment/tenancy-modes.mdx gets a new section, "Who owns a row", with the three rules:
  • a managed package's metadata is not in the database;
  • a row in a table with an organization column was written by that organization, and NULL is not an owner;
  • a table with no organization column is deployment-level or code-level, protected by permissions.
• The same section states the 18.0 single behaviour of 8b's ruling: a system write that names no organization is stamped with the Default Organization, or refused loudly when there are zero or two or more organizations.
• A callout answers the platform-tables question of multi-org: platform/system tables (logs, messaging, config) never carry organization_id — by design, or planned? #11611. A platform table has one of the two shapes and never a third. Organization-less rows a v17 install left are what the 18.x ceremony resolves, so until then the database stays on 17.x.
• The posture table's "organization_id filled in on write" cell for single read "no". It now reads "yes — the Default Organization" (ADR-0131 D11: single is never a reason for a row to be organization-less).

Docs: the 18.0 scope. The existing "18.0: single only" callout on the tenancy page is where an operator chooses a posture. It gains two facts:

• a database an 18.0 install creates takes the same 18.x upgrade path;
• the walled refusal covers the os boot path only. The one-shot os migrate / os verify / os secret / os storage boots and embedded hosts (createStandaloneStack, @objectstack/adapter-hono) are not refused, and are not a supported walled deployment in 18.0.

The six sentences #24480 added (cli.mdx ×3, environment-variables.mdx:101, self-hosting.mdx:470, tenancy-modes.mdx:20-21) agree with this text and are not repeated.

Docs: the replaced mechanism. Wording that read NULL as a global or platform-wide row is gone from the tenancy and permissions pages:

• sharing-rules.mdx: the scope was "this organization ∪ the platform-global rows". It is now the rule rows that organization wrote.
• sharing-rules.mdx, permissions-matrix.mdx, rls.mdx: tenancy.enabled: false was called "platform-global". It is now "deployment-level: no organization column".
• system-context.mdx row 23d: "a row stored with no organization is a global grant". It now says such a row is not judged, and that under single 18.0 stamps a new grant.

SQL driver docblock. The applyTenantScope comment called the IS NULL arm "a GLOBAL/platform row". It now names that as the v17 reading and states the three rules. It says the arm matches nothing on a fresh 18.0 single install, and is removed on the 18.x line (ADR-0131 D14). The comment is the only change; the code is not touched.

Riders (review 6261404044 ③, ruling record 6261853191 item 2):

1. Boot guard (packages/runtime/src/organization-ownership-boot-guard.ts, organizationOwnershipRefusalMessage). One sentence goes ahead of the ceremony command on a v17-shaped database: "18.0 does not upgrade a v17 database: keep this one on a 17.x release until the 18.x release that carries the upgrade path, and run these steps there." The operator no longer follows two hops.
2. TENANCY_POSTURE_FIX_HINTS (packages/cli/src/utils/tenancy-posture-hints.ts). This was the smaller truthful change. group and isolated stay listed, because they are the vocabulary, with a suffix ; refused at boot in 18.0, which supports single only (WALLED_POSTURE_RELEASE_NOTE, which the 18.x restore deletes). os serve and os doctor both render it.
3. os doctor. A valid posture used to print nothing. Under group / isolated it now prints a Tenancy posture warning: 18.0 supports single only, so the next os serve (and so os dev / os start) refuses it at boot. The row is a warning, not an error, so doctor's exit code is unchanged. The one-shot commands doctor also fronts still boot under a walled posture.

Changeset .changeset/15214-c11-fresh-install-messages.md: patch for @objectstack/cli and @objectstack/runtime. driver-sql changes a comment only and publishes no string. Nothing is touched under content/docs/releases/ or any CHANGELOG.md.

File surface

• Measured against the claim 6261901354.
• 8b's branch (claude/issue-15212-8b-stamp-or-refuse, fetched at af977a6) touches 36 files under packages/objectql, packages/core/src/security, plugin-security, plugin-auth and others. None of them is in this diff, so no rider was dropped.
• None of the four files open PR fix(client,platform-objects,docs): in-system copy says "this system", not "this environment" (cloud#3002 ruling A) #24482 touches is in this diff.
• serve.ts and migrate/organization-ownership.ts are not touched.

Tests

Measured at 77a7a78ab; its tree is byte-identical to the tree the runs below read.

command	result
pnpm --filter '@objectstack/cli^...' build (lock)	VERDICT command-exit 0
pnpm --filter @objectstack/cli exec vitest run --project unit	308/312 files passed in the first run. The 4 others are unrelated to the diff: 2 timed out at 5 s while the gate sweep loaded the box, and 2 needed packages/cli/dist, which the first build did not make. After pnpm --filter @objectstack/cli build they were rerun: published-subpath-console and published-subpath-hook-body passed 2/2 files; boot-preparation-parity and hook-timeout-override-refusal passed 2/2 files, 41/41 tests, with the box idle
pnpm --filter @objectstack/cli typecheck	exit 0
pnpm --filter @objectstack/runtime test	421/421 files, 6643 passed, 19 skipped
pnpm --filter @objectstack/runtime typecheck	exit 0

Pins moved, and why:

• serve-organizations-message-spelling.test.ts site 6 and doctor-organizations-message-spelling.test.ts legs (i) and the CONTROL now carry the 18.0 suffix. The group legs read the shared table and move with it.
• doctor-tenancy-posture-report.test.ts and doctor-env-provenance.test.ts used isolated as the "a posture that can start" control. In 18.0 that premise is false, so the control is now single.
• New: a unit sweep of walledPostureFinding over the posture vocabulary, and an in-process os doctor run under group (warning row, exit 0).
• organization-ownership-boot-guard.test.ts asserts that the 18.0 / 17.x answer appears ahead of the command.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack named 102 families, plus 48 roster commands on stderr. All 150 were run, exit codes recorded before any pipe.

• --ran reconciliation: "102 derived famil(ies) accounted for — 102 run, 0 NOT-MEASURED (a DERIVED zero — all 102 recorded an exit code and none of them is 3)".
• Seven first answered PREREQUISITE NOT MET (exit 3): missing dist/, or a shallow-clone fixture. After building client-react, studio and the six packages check:published-readme-exports named, and fetching the fixture commit, all seven exit 0: check-plugin-teardown-shape --self-test, check:skill-examples, check:dual-build-cjs-loads, check:i18n, check:i18n-coverage, check:i18n-walk-parity, check:published-readme-exports.
• Four roster gates need a PR or workflow context and say so (NOT WIRED / NOT MEASURED, exit 2 or 1): check-closing-target-claim, check-partof-closing-keyword, check-single-claim-paths, check-governed-queue-guard. CI runs them on this PR.
• NOT MEASURED locally, CI's: Build Docs, Build Core, the Test Core shards, the type-check lanes.

Acceptance notes

• The card's sentence 2 says "the column is NOT NULL". The docs say every row carries its organization and that NULL is not an owner. They do not claim the DDL constraint, because 8e (NOT NULL) moved to 18.x (ruling record 6259698357 item 3). An 18.0 database therefore has no such constraint, and a page claiming one would be false in 18.0.
• 8b has no PR yet. The single stamping is described as ruled (6259698357, 6259899486), not from its internals.
• Docs outside the tenancy and permissions pages still describe the COALESCE(organization_id, '__global__') index key and the NULL partition: data-modeling/indexing.mdx, protocol/objectql/schema.mdx, deployment/seed-tenancy-repair.mdx, deployment/cli.mdx. The mechanism is still live in 18.0 (8d moved to 18.x), so these pages are true today. They are this card's family for the 18.x docs pass. Successor: none.
• system-context.mdx row 62 describes the enterprise organizations plugin's elevated insert under a wall. It was not changed: 18.0 refuses walled boots at os serve, and the walled half is 18.x. Successor: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/cli, @objectstack/driver-sql, @objectstack/runtime, touching 5 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/automation/jobs.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/data-modeling/indexing.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/data-modeling/queries.mdx (via applyTenantScope (symbol, a method of class SqlDriver))
• content/docs/deployment/cli.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/deployment/environment-variables.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/deployment/production-readiness.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/protocol/backward-compatibility.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/protocol/kernel/config-resolution.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/protocol/kernel/http-protocol.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))
• content/docs/releases/v17/17-1.mdx (via applyTenantScope (symbol, a method of class SqlDriver))
• content/docs/releases/v17/17-5.mdx (via os doctor (command, read off packages/cli/src/commands/doctor.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 50 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7e58e0a27998194640c145344b7519f1ccc9fad4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cf170c92377aba2e4f5b3d7be008590f21f0dba7 — the merge of head 77a7a78abba9674fd9bef0b4d0f52069277362be into base 7e58e0a27998194640c145344b7519f1ccc9fad4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cf170c92377aba2e4f5b3d7be008590f21f0dba7 && git checkout cf170c92377aba2e4f5b3d7be008590f21f0dba7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7e58e0a27998194640c145344b7519f1ccc9fad4 77a7a78abba9674fd9bef0b4d0f52069277362be && git checkout -B drift-repro 7e58e0a27998194640c145344b7519f1ccc9fad4 && git merge --no-ff 77a7a78abba9674fd9bef0b4d0f52069277362be

node scripts/docs-audit/affected-docs.mjs --json 7e58e0a27998194640c145344b7519f1ccc9fad4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7e58e0a27998194640c145344b7519f1ccc9fad4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Seat review · TIER_DEFAULT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T09:18Z

Head 77a7a78ab. Report 6263677182 on #15214. check-governed-merges --pr 24506: not governed, +168/−28 over 15 files.

Verdict: ACCEPT. Landing is held until 8b (#15212) merges.

• Why the hold:
  • The new "Who owns a row" section and the posture-table cell (organization_id filled in on write under single: "yes — the Default Organization") describe 8b's stamp-or-refuse.
  • The applyTenantScope docblock's "the arm matches nothing on a fresh 18.0 single install" also depends on it.
  • Neither is true on main until 8b lands. Docs must be true against the code they ship with, so this PR goes ready the moment 8b merges.
  • This does not hold the 18.0 release (6261853191).
• Riders, read against the diff:
  • The boot-guard sentence puts the 17.x answer ahead of the command.
  • WALLED_POSTURE_RELEASE_NOTE suffixes the two walled hints.
  • walledPostureFinding adds a warning row that leaves doctor's exit code unchanged. Each is named for deletion by the 18.x restore, chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489, which will carry it.
• The dev's open questions, all accepted as taken:
  • doctor warning, not error;
  • "NULL is not an owner", without claiming the NOT NULL constraint that 8e adds in 18.x;
  • keep the walled hints, with the suffix.
• Clause-②: no: right. Message strings plus an advisory row, with no API, schema, rule or permission face. The changeset is patch for cli and runtime.
• Fences held: no file of 8b's branch, of fix(client,platform-objects,docs): in-system copy says "this system", not "this environment" (cloud#3002 ruling A) #24482, of serve.ts or of migrate/organization-ownership.ts is touched.
• CI on 77a7a78ab at review time: 27 success, 5 skipped, 7 in progress, 0 failed.

Carried to #24489: delete WALLED_POSTURE_RELEASE_NOTE, walledPostureFinding and the boot-guard 18.0 sentence with the rest of the guards.