[finding] `SendTemplateInput.org` is declared ("Tenant id for org-overlay resolution (when supported)") but no implementation reads it

[os-warren]

Found while executing #11741 (widening SendEmailInput/SendTemplateInput with organizationId).

Observation

packages/spec/src/contracts/email-service.ts declares on SendTemplateInput:

/** Tenant id for org-overlay resolution (when supported). */
org?: string;

Measured on claude/issue-11741-sendemail-organization-id (base dce6a019f): zero readers. @objectstack/plugin-email — the only IEmailService implementation in this repo — never consults input.org anywhere (email-service.ts, template-loader.ts, email-plugin.ts; grep for a bare org read comes back empty apart from a prose comment in template-loader.ts:69 about overlay rows). Template resolution keys on (name, locale) only.

Declared ≠ enforced (Prime Directive #10): a caller passing org today gets no org-overlay resolution and no error — the key is silently inert. The "(when supported)" hedge in the TSDoc is the declaration admitting it.

Why it matters slightly more after #11741

#11741 adds organizationId (the sys_email.organization_id delivery stamp, pass-through) beside the inert org (declared as template resolution overlay). Two org-shaped keys on one input, one of which does nothing, is exactly the shape that invites an AI author to pick the wrong one. The #11741 TSDoc cross-references the distinction, but the long-term fix is for org to be either implemented (org-overlay template rows, if there is measured pull) or retired.

Disposition options for triage

• Retire org (ADR-0049 enforce-or-remove; it is a contracts interface key, not an authorable metadata key, so the retirement kit is lighter — no liveness ledger surface).
• Implement org-overlay template resolution and make the declaration true (only with a real business pull; startup scope discipline argues against building it speculatively).

Not verified here: whether anything outside this repo (e.g. cloud) passes or reads org.

Refs: #11741 · #11303

[claude]

Concentrated triage batch: finding → pm:queue + domain:spec, Task — SendTemplateInput.org is declared with a "(when supported)" hedge and has zero readers (re-verified: no bare org read in plugin-email beyond a prose comment), while #11741 establishes organizationId as the read channel. Retire org via the spec-property-retirement / enforce-or-remove route (the playbook governs tombstones, forms, docs and pins). Clause-②: yes at claim (an input-contract member is removed) — contract-review tier per spec-lane rules; if the retirement route's ledger check finds a reader the grep missed, stop and report.

---

Generated by Claude Code

[os-litant]

Claim: PM loop round R6
Session: session_01NDGG54XF5gbTLdQzCtnaVV
Branch: claude/issue-11832-retire-sendtemplate-org
Worktree: objectstack-issue-11832
Domain: domain:spec
File surface: packages/spec/src/contracts/email-service.ts (SendTemplateInput.org region ONLY — organizationId member untouched) + email-service tests + regenerated api-surface artifacts if moved + consumer call-site cleanup (examples) + changeset; conditional migrations tail-append only if the ADR-0087 gate demands it (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — dispatch-gates 2026-08-25 @0b04839: "no path-derived mandate … floor sonnet · default opus · ceiling fable … a card changing contract accept/reject behaviour or widening the public surface is claude-fable-5"; clause-② content leg (published contract member removal) ⇒ fable mandatory
Clause-②: yes
Serial constraints cleared: sole writer of contracts/email-service.ts this batch (prior writer PR #11839 for #11741 MERGED; #11741 CLOSED — verified). Conditional registry.ts tail-append shared with #11842/#12039 under the maintainer's parallel waiver (2026-08-25, chat, verbatim: 「并行5个子任务，加快进度」) + 4-point substitute discipline. Route: retire per ADR-0049 enforce-or-remove; premise (zero readers of input.org) is falsifiable — a found reader forks back as needs_decision, never a silent implement. No pin assertions on sibling behavior.

---

Generated by Claude Code