docs(qa): platform-checklist activation-ledger-row-contract is written around the removed sys_metadata_activation tenant column

[hotlong]

The platform checklist item platform-core.activation-ledger-row-contract
(docs/qa/platform-checklist/areas/platform-core.json) is written around a column that
no longer exists, so several of its steps are now impossible to execute as written.

What changed underneath it

PR for #15024 drops the reserved organization_id column from sys_metadata_activation:
the object declares systemFields: { tenant: false }, the declared unique index states
unique: 'global' over (metadata_type, name), and
ObjectStoreMetadataActivationStore no longer filters reads to NULL-organization rows or
skips org-carrying ones. The table never shipped with the column (it landed after the
@objectstack/account@17.2.0 tag), so this is a plain removal.

What is now stale in the item

Measured against the item's own text:

• Step 2 tells the runner each row "carries the five declared columns (metadata_type,
  name, package_id, organization_id, active) and organization_id is NULL on every row" —
  there are now four columns and no tenant column.
• Step 6 (uniqueness probe) describes the refusal as coming from "the COALESCE'd unique
  index (ADR-0120 D3 NULL-collapse)". The index is now a plain 'global' unique over the two
  real key parts. The probe still works and should still refuse; only the stated mechanism is wrong.
• Step 7 (org-row-skip probe) instructs the runner to INSERT a row with
  organization_id set into the sqlite file. That INSERT can no longer succeed — there is no
  such column — so the leg cannot be run at all, and the clause it verifies
  ("org-carrying rows are SKIPPED on read, never merged") no longer describes the platform.
• The ref lines cite unique:'organization', "organization_id reserved-NULL" and
  "org-row skip on read (the wall)" in sys-metadata-activation.object.ts and
  metadata-activation-store.ts. None of those are in either file any more.
• access-security.activation-write-operator-gate is affected more lightly: it asks the runner
  to read the row back and see organization_id NULL. The operator gate itself is unchanged
  and its pins pass unchanged; only that one read-back detail is stale.

Why this was not fixed in the #15024 PR

Rewriting it is not mechanical. Step 7 does not have a drop-in replacement — the honest
question is whether the org-skip clause is replaced by a "the table has no tenant column"
probe, or simply retired along with the behaviour it tested — and that is a judgement about
what the checklist should assert, which belongs with the checklist's own authoring pass rather
than riding on a code PR.

⚠️ Not urgent for CI: pnpm check:platform-checklist is deliberately NOT wired into the lint
workflow (maintainer decision, noted in .github/workflows/lint.yml — it is run by hand), and it
already reports 4 unrelated UNCLASSIFIED coverage problems on origin/main today
(batch_endpoints, crud_endpoints, metadata_endpoints, route_generation), verified
byte-identical at fcc42e6c1 before any of this work. So this item's staleness blocks nothing
mechanically — it misleads a human runner, which is the whole cost.

Refs: #15024 · branch claude/issue-15024-activation-ledger-tenantless

🤖 Generated with Claude Code

[hotlong]

Claim: PM loop — maintainer direct-dispatch channel (2026-08-10 standing authorization)
Provenance: maintainer, 2026-09-04, live chat, verbatim 「这几个问题你都帮我派发处理」 — dispatching the loose ends this session surfaced on the 17.3 review.
Session: 6679d191-11f4-465b-b322-0e0409d76793
Branch: claude/issue-15154-platform-checklist-activation-ledger
Worktree: objectstack-issue-15154
Domain: domain:devx (the fix lands in docs/qa/**) — ⚠️ provisional, set by this seat under the direct-dispatch channel; triage may correct it
File surface: docs/qa/platform-checklist/areas/platform-core.json only
Container & model: S, mode:subagent, model: opus — one judgement call (what replaces step 7), spelled out in the dispatch
Clause-②: no
Serial constraints cleared: no open PR touches docs/qa/** (REST search 2026-09-04); #15024 is landed and closed, its branch is spent

[hotlong]

os-dev-report

{
  "issue": 15154,
  "status": "done",
  "branch": "claude/issue-15154-platform-checklist-activation-ledger",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15251",
  "premise_still_valid": true,
  "summary": "Verified the premise against origin/main rather than the card: sys-metadata-activation.object.ts declares systemFields { tenant: false }, the index is { fields: ['metadata_type','name'], unique: 'global' }, and ObjectStoreMetadataActivationStore.list() is scoped by metadata_type and nothing else. Rewrote platform-core.activation-ledger-row-contract (rev 1 to 2): step 2 now asserts organization_id is ABSENT from the row key set instead of present-and-NULL (the value spelling passes vacuously once the column is gone, which is why #15024 inverted the dogfood pin to a key-set assertion), step 6 keeps the uniqueness probe and corrects only its stated mechanism to the plain unique:'global' over two required key parts, and step 7 is REPLACED by a no-tenant-column probe per the PM's ruling. The probe is executable in the item's established idiom with no new checklist mechanism: PRAGMA table_info plus an INSERT naming organization_id that sqlite refuses, bracketed by an anti-vacuity control INSERT that lands once the column is dropped from the statement, over the same direct-sqlite fixture class steps 6 and 7 already required. access-security.activation-write-operator-gate (rev 1 to 2) changes only its two ledger read-backs; the gate and its pins are untouched, and the source citation now records that ADR-0126 §5's operator-gate half stands while only its 'org column is reserved' bullet was withdrawn by ADR-0131 D7. Both items bump revision and append a history entry. skip-changeset applied; PR opened ready, auto-merge NOT enabled.",
  "tests": "check:platform-checklist (deliberately not in lint.yml, run by hand): baseline captured at 1bc3c092a BEFORE any edit, re-run at 96fc81042 after -- output BYTE-IDENTICAL, diff empty; the 4 pre-existing UNCLASSIFIED coverage problems (batch_endpoints, crud_endpoints, metadata_endpoints, route_generation) unchanged, none added, none removed. ANTI-VACUITY ABLATION (a checklist edit's gate can go green by not reading the file at all): committed the fix first, then re-pointed one of the two anchors this change ADDS at a symbol that does not exist. Mutation confirmed ON DISK by grep counts before/after, not by the editor's exit code -- old anchor 1 to 0, injected anchor 0 to 1 -- with the script refusing to read a result had either count been wrong. NO REBUILD NEEDED and none was done: check-platform-checklist.mjs is a zero-dependency node script reading the JSON and the .ts sources directly, never a dist. Result: 4 problems to 5, naming sys-metadata-activation.object.ts#thisSymbolDoesNotExist as ABSENT SYMBOL -- the gate demonstrably reads the lines this change wrote. Restore leg: git checkout HEAD -- (absolute path, from a REPO_ROOT computed by git rev-parse --show-toplevel), proven by git hash-object equal to the HEAD blob 3cb88d94, plus zero residual mutation markers, git diff HEAD empty and git status --porcelain empty. Symbol-anchor floor (shrink-never): areas/platform-core.json 58 to 60 (two anchors added, the safe direction), areas/access-security.json 44 to 44 -- no floor lowered, scripts/checklist-symbol-anchor-baseline.json untouched. DERIVED FAMILY: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, letting it derive its own change set (2 committed paths vs merge base 1bc3c092a, three-dot; no hand-built list passed). Reconciles to 10 runnable families, harvested with --commands. ALL 10 GREEN at commit 96fc81042 (git rev-parse --short HEAD from the run itself), every exit code captured BEFORE any pipe as 'cmd > file 2>&1; EXIT=$?': check-ci-filter-parity 0 (143 declared globs covered) · check-closing-keyword-parity 0 and --self-test 0 (24 assertions, 5 mutations driven red) · check-comment-mask-corpus 0 (5875 files, 0 disagree) · check:doc-formula-expressions 0 · check:cross-package-test-inputs 0 (117 self-test cases, 26 packages declared) · check:doc-authoring 0 · check:nul-bytes 0 (8271 text files, no raw control bytes) · check:refd-timer-probe 0 · check:watch-hint-literal 0 (49 declarations, 4 rostered names). ONE NOT MEASURED, THEN MEASURED: check:doc-formula-expressions first exited 3 = PREREQUISITE NOT MET, in its own words 'Nothing was measured ... It is NOT a finding' -- it needed @objectstack/formula and then @objectstack/lint built. Both built through bash scripts/pm/os-verify-lock.sh -c with OS_VERIFY_LOCK_SLOT=issue-15154, gate re-run, exit 0. Recorded as NOT MEASURED then measured rather than as a red, since exit 3 says nothing about the tree. VERIFY-LOCK DECLARATION: both builds printed 'VERDICT command-exit 0 · UNLOCKED (declared) · no usable flock on this host, so the shared verify lock was NEVER taken and NOTHING was serialized' -- declared here and in the PR body as the entry point instructs; wall-clock numbers are shared-box readings. DECLARED NARROWING: the repo-wide pnpm lint sweep and the full test suite were NOT run. The diff is two JSON data files under docs/qa/ -- no package source, no test file, no gate script -- so dispatch-gates derived no test family for it, and CI runs the farm exactly once regardless.",
  "mcp_calls": "0 — the whole run used gh REST (gh api) and local git; no MCP GitHub call was made. gh pr create was attempted once and refused with a GraphQL rate-limit error, so PR creation was re-routed to REST POST /repos/.../pulls (declared channel switch); gh api rate_limit then read core 4578 remaining and graphql 5000 remaining, so the refusal was not reproduced from the reported buckets.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #15253: four MORE checklist items read back organization_id on sys_metadata_activation — platform-core.activation-ledger-registration-home (the sibling item in the same file), api-backend.packaged-action-disabled-dispatch, api-backend.action-activation-door-contract, automation.packaged-flow-disable-durable. Same defect class as this card, but the card enumerated only two items and the dispatch said '⛔ No other checklist items touched', so they were filed rather than fixed in place. ⚠️ Worth PM attention on two counts: (1) they carry the VACUOUS spelling, so they cannot be repaired by swapping a value — the read must be inverted to a key-set assertion the way #15024 fixed the dogfood pin; (2) two of them still gloss the column as 'reserved and unwritten' per ADR-0126 §5 D3, a bullet ADR-0131 D7 withdrew, so they tell a runner the dimension is coming back. Filed unassigned and unlabelled for triage.",
    "not filed, reported here as a PM-side observation: the #15154 card body enumerated the stale sites for one item and called access-security 'lightly affected', but a repo-wide sweep of docs/qa/platform-checklist for sys_metadata_activation + organization_id finds 6 items across 4 area files. The card's enumeration was a sample, not the population — worth knowing when the follow-up in #15253 is scoped."
  ]
}

[hotlong]

Landed. PR #15251 merged; this card closed by its Fixes line. pm:dispatched stripped in the same stroke; domain:devx, priority:p3, documentation retained.

Two checklist items repaired against the column #15024 removed: platform-core.activation-ledger-row-contract (step 2 now asserts organization_id is ABSENT from the row's key set rather than present-and-NULL — the value spelling passes vacuously once the column is gone; step 6 keeps the uniqueness probe and corrects only its stated mechanism; step 7 replaced by a no-tenant-column probe per the PM's ruling) and access-security.activation-write-operator-gate (its two ledger read-backs only — the gate and its pins untouched).

Verified before merge: check:platform-checklist output byte-identical before and after, with the four pre-existing UNCLASSIFIED problems unchanged; and an anti-vacuity ablation — one of the anchors this change adds re-pointed at a non-existent symbol took the gate from 4 problems to 5, proving it reads the lines this change wrote.

⚠️ The scope of this card was too narrow, and that is a PM error, not a dev one. The body enumerated the stale sites for one item and called access-security "lightly affected". A repo-wide sweep finds six items across four area files. The remaining four are #15253, now unblocked by this merge.