metadata: after #23469, the legacy-organization read seam's loose ends (ambient transaction, filter-after-limit, an unpinned by-name filter, DatabaseLoader._count, a 404 where a named refusal belongs) and the ceremony wording #23609

Blocked-by: #23469

Filing gate: (c) a read-only finding from a contract review, not run. The PASS record 6184549574 on PR #23469 (#23429, C7b S2 + S5) lists these as non-blocking.
Reader who acts: domain:engine triage, to grade and route.

Filed by domain:engine seat 1 · marchtian · session session_01Rerax7QTjKMPCUZxQUtPFR. ⛔ Not a claim.

⛔ Blocked on PR #23469. None of this code is on main until that PR merges. The seat flips this card to pm:queue on MERGED.

Why it is low priority

Every path below matters only on an unmigrated (v17-shape) database, where legacy organization rows still sit in the sys_metadata family. os serve refuses to boot such a database (S5's guard) until os migrate organization-ownership has verified. So no served door reaches these paths in a supported posture today. They are latent, and worth closing before anything else starts reading the family off the served boot.

What the review found (PR #23469 at e4811b67f2, read only)

1. findServedOverlayRow's filter has no pin of its own. In meta-stored-legacy-organization.integration.test.ts, the _lock case asserts only lock and editable. With that filter alone removed, getMetaItem would serve the organization's body as item, and no pin goes red.

   • Wanted: assert that read.item is not the organization's body.

2. The seam joins only an explicit context.transaction.

   • legacyOrganizationRowsOf's raw listPhysicalColumns / execute calls do not read ObjectQL's ambient transaction.
   • The protocol passes none: every call site passes { isSystem: true }.
   • Inside publishPackageDrafts' ambient engine.transaction, on a v17-shape SQLite file, the column read would wait on a second pool connection. The paths are promoteDraftForPublish's draft read, the active-row read, repo.get and repo.promoteDraft.
   • Wanted: take the engine's ambient transaction, or thread trxCtx into those reads.

3. The plural form filters after limit, so a page under-fills, or a single-row read misreads, when legacy rows sit in it:

   • auditMetaItem (orderBy plus limit);
   • listCommits (limit);
   • revertStoredPackage (limit: 1), which answers 409 "never been published" when its first active row is a legacy one;
   • the repository's list(filter.limit).
   • Wanted: filter before limiting, or page until the limit is met.

4. DatabaseLoader._count does not filter. So exists() answers true for an address that only a legacy row holds, while load() answers null, and the history total counts legacy rows. This is pre-existing: main's loader never filtered.

5. rollbackToPackageCommit answers COMMIT_NOT_FOUND (404) for a legacy commit, where revertCommit gives a named refusal. Wanted: the same named refusal.

6. Inert plumbing to remove, behaviour-neutral:

   • rowsRead;
   • ServedOverlayRowCandidate.scope / organizationId;
   • orgId / itemOrgId in protocol.ts.

   Every row that reaches them is now the environment's (the dev's report 6184164699; verified inert in 6184549574).

7. Wording:

   • The four ADR-0087 entries 18.sys-metadata{,-audit,-commit,-history}-organization-column-retired, and content/docs/concepts/metadata-lifecycle.mdx, name os migrate organization-ownership --apply without --plan-file. main's 18.cli-organization-ownership-apply-plan-file-required makes --plan-file required.
   • E1's refusal sentence in os migrate apply reads "which the organization-ownership ceremony owns that drop", which is garbled.

Not in this card

• The ceremony's dialectOf / config.client is cli: the organization-ownership ceremony resolves its SQL dialect from config.client as a string only (dialectOf, resolvePlannedDriverExec, the template-lookup guard), and falls back to sqlite on a client class or an unrecognised value #23558.
• The /meta trail doors admitting setup.access is rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546.
• The changeset gaps the review named are not here: S5's unnamed runtime exports, and the ApiError.code widening by ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED. Changesets are consumed at release, so these ride the release notes, not a code change.

Dedupe

The words legacyOrganizationRowsOf findEnvironmentRows ambient transaction rollbackToPackageCommit DatabaseLoader _count rowsRead itemOrgId match only PR #23469 and #23429.

Generated by Claude Code