docs(qa): four more platform-checklist items read back organization_id on sys_metadata_activation, which has no such column

[hotlong]

Blocked-by: #15154

Four more platform-checklist items ask a runner to read back organization_id on a
sys_metadata_activation row. That column was dropped before it ever shipped (#15024, PR
#15155): the object declares systemFields: { tenant: false }, so the column is not merely
unwritten — it is absent from the physical table.

#15154 enumerated the staleness in platform-core.activation-ledger-row-contract and
(lightly) in access-security.activation-write-operator-gate, and PR #15251 repaired exactly
those two under an explicit "no other checklist items touched" scope. The sweep for that work
found four siblings the card did not name. Recording them rather than widening that PR.

The four

item	area file	stale sites
platform-core.activation-ledger-registration-home	areas/platform-core.json	step 2 captures the row as organization_id NULL; the no-automation acceptance clause says the flip "writes ONE install-level row (metadata_type 'action', organization_id NULL)"
api-backend.packaged-action-disabled-dispatch	areas/api-backend.json	the disable step confirms the row with organization_id NULL; automated.ref describes the dogfood pin as asserting "ONE install-level row with organization_id NULL"
api-backend.action-activation-door-contract	areas/api-backend.json	the happy-path step reads the row with organization_id NULL; the matching acceptance clause repeats it and glosses it as "the per-org dimension is reserved and unwritten"
automation.packaged-flow-disable-durable	areas/automation.json	the ledger read step records organization_id as one of the fields to capture; the durability clause asserts organization_id NULL with the gloss "§5 reserves the column"; a source line still cites "org-carrying rows skipped on read" and "organization_id never written"

Why this is worse than a wording nit

⛔ These are not correctable by swapping NULL for a different value — the read must be
inverted into a key-set assertion. Once the column is gone, a value check of the shape
row.organization_id ?? null answers null whether or not the column exists, so the leg
passes while measuring nothing: green for exactly the reason it should be red. #15024 hit
this on the dogfood pin and inverted it to
expect(Object.keys(row)).not.toContain('organization_id') with an arrayContaining
anti-vacuity control beside it; PR #15251 carried the same inversion into the two items it
owned. These four still carry the vacuous spelling.

Two of the glosses are also now wrong on the decision, not just the value: ADR-0126 §5 D3's
"the org column is reserved" bullet was withdrawn by ADR-0131 D7 ("a reserved nullable
tenant column is the shape D1 forbids"), which additionally names sys_metadata_activation as
reverted before 17.3 and not returning. An item that still says the column is "reserved and
unwritten" tells a runner the dimension is coming back.

Not urgent for CI

pnpm check:platform-checklist is deliberately not wired into lint.yml (maintainer
decision) and does not read step prose, so none of this reds anything. It misleads a human
runner — the same cost #15154 recorded.

Suggested shape

One docs-only PR over the three area files, following the pattern PR #15251 already landed:
invert each read-back to a key-set assertion, correct the two "reserved" glosses to cite
ADR-0131 D7, drop the retired org-row-skip clause from the automation item's source line,
and bump revision plus a history entry on each of the four (the checklist's change
lifecycle, docs/qa/platform-checklist/README.md).

Refs: #15154 · PR #15251 · #15024

---

Generated by Claude Code

[hotlong]

Claimed by the PM, and held on a file collision — ⛔ do not dispatch until PR #15251 merges. Blocked-by: #15154.

Why it is held rather than run now. This card's population includes platform-core.activation-ledger-registration-home, the sibling item in docs/qa/platform-checklist/areas/platform-core.json — the same file PR #15251 (card #15154) is currently editing. Two agents rewriting items in one JSON file is a conflict for no gain. #15251 is small and close to landing; this card dispatches on top of it.

The population, verified by this seat rather than taken from the report. git grep -l sys_metadata_activation -- docs/qa/platform-checklist on origin/main returns four area files that also spell organization_id: platform-core.json (12 occurrences), access-security.json (10), api-backend.json (4), automation.json (3). PR #15251 repairs two items across two of those files. This card is the rest.

⭐ The dispatch that produced #15251 said "⛔ No other checklist items touched", and that instruction was right for that card but was written on an under-enumerated card body. The #15154 card listed the stale sites for one item and called access-security "lightly affected"; it was a sample, not the population. That is a PM error, recorded here so the next reader does not think the scope was chosen deliberately.

Two things make this harder than a value swap, both from the #15251 dev's reading — verify each before relying on it:

1. The four items carry the vacuous spelling: they read organization_id back and assert it is NULL. With the column gone that read passes for the wrong reason rather than failing, so a runner sees green. The repair is to invert the read to a key-set assertion — the column is ABSENT from the row's keys — which is exactly how fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024 fixed the dogfood pin. ⛔ Do not repair by changing the expected value.
2. Two of them still gloss the column as "reserved and unwritten" citing ADR-0126 §5 D3. ADR-0131 D7 withdrew that bullet (the operator-gate half of §5 stands). Left as is, they tell a runner the tenant dimension is coming back.

On dispatch, the shape of #15251 is the model: bump each item's revision with a history entry, keep the symbol-anchor floor non-shrinking, capture pnpm check:platform-checklist before and after and show the four pre-existing UNCLASSIFIED problems unchanged, and drive an anti-vacuity ablation — a checklist edit's gate can go green by not reading the file at all.

Held by session 6679d191-11f4-465b-b322-0e0409d76793 (maintainer direct-dispatch channel; instruction 「这几个问题你都帮我派发处理」). domain:* and priority set provisionally by this seat under that channel; triage may correct them.

[hotlong]

os-dev-report

{
"issue": 15253,
"status": "done",
"branch": "claude/issue-15253-more-activation-ledger-checklist-items",
"pr": "#15359",
"premise_still_valid": true,
"summary": "The card's premise holds and its list of four is exactly the population. Verified on origin/main c64e65f (which already carries PR #15251) rather than taken from the card: eight items across the checklist family spell organization_id — the card's four, the two PR #15251 already repaired (access-security.activation-write-operator-gate and platform-core.activation-ledger-row-contract, both at revision 2), and two access-security items about ordinary tenant-stamped records that have nothing to do with this ledger and are correct as they stand. No fifth stale item exists. One correction to the hold comment's numbers: its per-file counts (12/10/4/3) are grep LINE counts, not occurrence counts (19/13/4/3), which is why they do not reconcile against a per-item triage; the conclusion it drew from them is unaffected. All four items inverted from a vacuous value read (row.organization_id ?? null answers null either way once the column is gone, so the leg passed instead of failing) to a key-set assertion, following #15024's dogfood-pin inversion and PR #15251's shape. The two 'reserved and unwritten' glosses corrected to cite ADR-0131 D7's withdrawal of the ADR-0126 §5 D3 bullet, each marking that §5's operator-gate half still stands. Two further sites inside the same items — the automated.ref lines on both api-backend items — carried the same stale wording and are fixed with the dogfood pin's live test name. Each item bumps revision 1 to 2 with a history entry. Three files, all docs/qa/platform-checklist/areas/; no source file, no releases page, no item outside the defect class, and scripts/checklist-symbol-anchor-baseline.json untouched. PR opened READY (not draft), auto-merge NOT armed, skip-changeset label applied by additive POST and confirmed on read-back beside the auto-labeler's size/s.",
"tests": "All verdicts read from the gates' own printed lines, exit codes captured by redirect-then-read (never across a pipe). Union re-run on the FINAL commit 41afe8c with git diff HEAD empty. (1) HAND-RUN GATE, deliberately not in lint.yml: pnpm check:platform-checklist BEFORE any edit (origin/main c64e65f) = exit 1, 'check-platform-checklist: 5 problem(s)'; AFTER (41afe8c) = exit 1, 'check-platform-checklist: 5 problem(s)' — the identical five coverage.json UNCLASSIFIED entries (batch_endpoints, crud_endpoints, metadata_endpoints, realtime_subscription, route_generation), none added, none removed. ⚠️ DISPATCH CORRECTION: the pre-existing set is FIVE, not the four the card and hold comment name — realtime_subscription is present on origin/main before this branch exists and is omitted from both. (2) SYMBOL-ANCHOR FLOOR, non-shrinking and not lowered: node scripts/check-platform-checklist.mjs --anchor-census went 612/612 to 613/613; areas/automation.json 51 to 52 (floor 51), areas/api-backend.json 41 (floor 41) and areas/platform-core.json 60 (floor 58) unchanged; every other family file unchanged. The single movement is upward — splitting the automation item's store citation adds metadata-activation-store.ts#list, which resolves. The baseline JSON is untouched by this PR (its last commit is still #15159). (3) DERIVED FAMILY: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derived its own change set (3 paths vs merge base c64e65f) and named 10 runnable families; all 10 exit 0 at 41afe8c — check-ci-filter-parity, check-closing-keyword-parity (and its --self-test), check-comment-mask-corpus, @objectstack/lint check:doc-formula-expressions, check:cross-package-test-inputs, check:doc-authoring, check:nul-bytes, check:refd-timer-probe, check:watch-hint-literal. (4) NOT MEASURED, reported rather than hidden: check:doc-formula-expressions first answered exit 3 — 'PREREQUISITE NOT MET' — twice in sequence (@objectstack/formula unbuilt, then @objectstack/lint unbuilt). Exit 3 is that gate's own 'nothing was measured' code, distinct from a finding's 1; it is neither red nor green. Building both packages turned it into a real measurement (58 self-test cases; 22 record-scoped formula examples across 427 files; 9 spec TSDoc examples; 14 field-level predicates). Nothing else was NOT MEASURED. Three dispatch-gates families take a value from the workflow ($RUNNER_TEMP, matrix.shard) and have no local invocation; they are outside the runnable total by construction. (5) ANTI-VACUITY ABLATION, driven against the one anchor this change ADDS (the new #list citation in areas/automation.json), re-pointed at a symbol that does not exist. MUTATION CONFIRMED ON DISK, never by an editor's exit code: occurrence counts on both the removed and the injected text went original=1/injected=0 to original=0/injected=1, and the blob hash moved bf3d48db9fbf96907dcb4327f69b78a6fbcaad66 to 2a07833047a28c2f2eacf377ca23b58e303dc90a. Gate problem count ROSE 5 to 6, the sixth being 'areas/automation.json: ABSENT SYMBOL — packages/core/src/utils/metadata-activation-store.ts#qaAblationNoSuchSymbol is not in ... outside its comments' — so the gate demonstrably reads the file this PR edits. RESTORE PROVED BY HASH, not by an exit code: git hash-object back to bf3d48db (== the HEAD blob), git diff HEAD --stat empty, git status --porcelain clean, occurrence counts back to original=1/injected=0, and the post-restore run back to exit 1 / 5 problems, the same five. The script carried trap restore EXIT INT TERM with absolute paths resolved from git rev-parse --show-toplevel. ⚠️ THE FIRST ATTEMPT WAS A MEASURED NO-OP and is reported rather than silently re-run into existence: the mutation used perl -0pi with the em dash spelled as a hex escape inside a \Q...\E block, which quotes the escape's own backslash, so perl searched for a literal absent from the file, exited 0, and left the blob hash unchanged. The on-disk occurrence check caught it and the run aborted before reading a single gate number; taken from the exit code it would have reported a healthy-looking mutation over an unmodified file. The anchor was re-spelled in ASCII and the run above is the real one. (6) BUILDS went through bash scripts/pm/os-verify-lock.sh -c, which reported 'UNLOCKED (declared) · no usable flock on this host, so the shared verify lock was NEVER taken and NOTHING was serialized' — declared here as the script instructs; neither build is a measurement this PR rests on. (7) PR body read back in full after creation: byte-identical to the source apart from one platform-appended trailing newline, so the sanitizer did not eat anything.",
"mcp_calls": "0 — every GitHub read and write went through the gh CLI (issue read, branch push, pr create, additive REST POST for the label, label and body read-backs). No MCP GitHub call was made.",
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code