docs(qa): four more platform-checklist items read back organization_id on sys_metadata_activation, which has no such column

[hotlong]

Blocked-by: #15154

Four more platform-checklist items ask a runner to read back organization_id on a
sys_metadata_activation row. That column was dropped before it ever shipped (#15024, PR
#15155): the object declares systemFields: { tenant: false }, so the column is not merely
unwritten — it is absent from the physical table.

#15154 enumerated the staleness in platform-core.activation-ledger-row-contract and
(lightly) in access-security.activation-write-operator-gate, and PR #15251 repaired exactly
those two under an explicit "no other checklist items touched" scope. The sweep for that work
found four siblings the card did not name. Recording them rather than widening that PR.

The four

item	area file	stale sites
platform-core.activation-ledger-registration-home	areas/platform-core.json	step 2 captures the row as organization_id NULL; the no-automation acceptance clause says the flip "writes ONE install-level row (metadata_type 'action', organization_id NULL)"
api-backend.packaged-action-disabled-dispatch	areas/api-backend.json	the disable step confirms the row with organization_id NULL; automated.ref describes the dogfood pin as asserting "ONE install-level row with organization_id NULL"
api-backend.action-activation-door-contract	areas/api-backend.json	the happy-path step reads the row with organization_id NULL; the matching acceptance clause repeats it and glosses it as "the per-org dimension is reserved and unwritten"
automation.packaged-flow-disable-durable	areas/automation.json	the ledger read step records organization_id as one of the fields to capture; the durability clause asserts organization_id NULL with the gloss "§5 reserves the column"; a source line still cites "org-carrying rows skipped on read" and "organization_id never written"

Why this is worse than a wording nit

⛔ These are not correctable by swapping NULL for a different value — the read must be
inverted into a key-set assertion. Once the column is gone, a value check of the shape
row.organization_id ?? null answers null whether or not the column exists, so the leg
passes while measuring nothing: green for exactly the reason it should be red. #15024 hit
this on the dogfood pin and inverted it to
expect(Object.keys(row)).not.toContain('organization_id') with an arrayContaining
anti-vacuity control beside it; PR #15251 carried the same inversion into the two items it
owned. These four still carry the vacuous spelling.

Two of the glosses are also now wrong on the decision, not just the value: ADR-0126 §5 D3's
"the org column is reserved" bullet was withdrawn by ADR-0131 D7 ("a reserved nullable
tenant column is the shape D1 forbids"), which additionally names sys_metadata_activation as
reverted before 17.3 and not returning. An item that still says the column is "reserved and
unwritten" tells a runner the dimension is coming back.

Not urgent for CI

pnpm check:platform-checklist is deliberately not wired into lint.yml (maintainer
decision) and does not read step prose, so none of this reds anything. It misleads a human
runner — the same cost #15154 recorded.

Suggested shape

One docs-only PR over the three area files, following the pattern PR #15251 already landed:
invert each read-back to a key-set assertion, correct the two "reserved" glosses to cite
ADR-0131 D7, drop the retired org-row-skip clause from the automation item's source line,
and bump revision plus a history entry on each of the four (the checklist's change
lifecycle, docs/qa/platform-checklist/README.md).

Refs: #15154 · PR #15251 · #15024

---

Generated by Claude Code

[hotlong]

Claimed by the PM, and held on a file collision — ⛔ do not dispatch until PR #15251 merges. Blocked-by: #15154.

Why it is held rather than run now. This card's population includes platform-core.activation-ledger-registration-home, the sibling item in docs/qa/platform-checklist/areas/platform-core.json — the same file PR #15251 (card #15154) is currently editing. Two agents rewriting items in one JSON file is a conflict for no gain. #15251 is small and close to landing; this card dispatches on top of it.

The population, verified by this seat rather than taken from the report. git grep -l sys_metadata_activation -- docs/qa/platform-checklist on origin/main returns four area files that also spell organization_id: platform-core.json (12 occurrences), access-security.json (10), api-backend.json (4), automation.json (3). PR #15251 repairs two items across two of those files. This card is the rest.

⭐ The dispatch that produced #15251 said "⛔ No other checklist items touched", and that instruction was right for that card but was written on an under-enumerated card body. The #15154 card listed the stale sites for one item and called access-security "lightly affected"; it was a sample, not the population. That is a PM error, recorded here so the next reader does not think the scope was chosen deliberately.

Two things make this harder than a value swap, both from the #15251 dev's reading — verify each before relying on it:

1. The four items carry the vacuous spelling: they read organization_id back and assert it is NULL. With the column gone that read passes for the wrong reason rather than failing, so a runner sees green. The repair is to invert the read to a key-set assertion — the column is ABSENT from the row's keys — which is exactly how fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024 fixed the dogfood pin. ⛔ Do not repair by changing the expected value.
2. Two of them still gloss the column as "reserved and unwritten" citing ADR-0126 §5 D3. ADR-0131 D7 withdrew that bullet (the operator-gate half of §5 stands). Left as is, they tell a runner the tenant dimension is coming back.

On dispatch, the shape of #15251 is the model: bump each item's revision with a history entry, keep the symbol-anchor floor non-shrinking, capture pnpm check:platform-checklist before and after and show the four pre-existing UNCLASSIFIED problems unchanged, and drive an anti-vacuity ablation — a checklist edit's gate can go green by not reading the file at all.

Held by session 6679d191-11f4-465b-b322-0e0409d76793 (maintainer direct-dispatch channel; instruction 「这几个问题你都帮我派发处理」). domain:* and priority set provisionally by this seat under that channel; triage may correct them.