probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open

[os-steve]

Found by the #8901 census re-run over the read-seam scan roots at origin/main @ 739fe5b79 (2026-08-17). It is the single new member of the silent fall-through family beyond the #8845 census recorded in the gate script's header. Filed unassigned; not a claim. ⛔ No domain:* set — that is triage's field.

Where

packages/objectql/src/engine.ts, probeInstallOrganizations() (catch at ~line 3040 today). Introduced with the #8844 system-write organization-stamping work; on main since 2026-08-16 — i.e. authored while the family's previously filed instances (#8895 / #8896 / #8906) were being fixed.

The shape

let ids: readonly string[] = [];
try {
 const rows = await this.find(ORGANIZATION_OBJECT, { fields: ['id'], limit: 2, context: { isSystem: true } });
 ids = /* mapped row ids */;
} catch {
 // `sys_organization` may not be registered at all (a lean embedding, a
 // bare-kernel test). No organizations is the honest reading, and it is
 // the branch that changes nothing.
 ids = [];
}
this.organizationProbeMemo = ids;

No log, no type discrimination. The comment names one benign reason, but the catch swallows every other failure the same way — connection loss, pool exhaustion, a timeout mid-boot. That is the #4728 signature the gate header records: a comment naming one benign reason standing in for a type test.

Consequence

resolveSystemWriteOrganization (packages/objectql/src/tenancy/system-write-organization.ts) maps the probe's answer: 0 organizations means "no-organization-yet" and the system insert proceeds without organization stamping; 1 means stamp the derived id; 2 means refuse with SystemWriteOrganizationRequiredError. A non-benign probe failure is indistinguishable from "no organizations yet" (ADR-0110 D3: outage and genuine emptiness are different facts), so:

• on a single posture with one organization, system inserts land unstamped where the System-context writes land untenanted at RUNTIME, so a single-tenant install keeps re-forking the autonumber scope and minting duplicate business identifiers — the producer #8686's backfill cannot reach (17.0.0 GA) #8844 ruling requires the derived stamp — forking exactly the per-organization counters/scoping the ruling exists to protect;
• on a multi-organization install, the refusal the ruling mandates is silently skipped — fail-open on a refusal guard, the ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 shape.

Aggravator: the answer is memoised. One transient failure pins "no organizations" in organizationProbeMemo past the outage, until some organization write happens to clear it via invalidateOrganizationProbe().

Why no gate saw it

check:durability-log-level's read-seam rule judges the expression a catch returns; this catch returns nothing and lets the accumulator above the try answer. That is the #8845-measured blind spot, and this instance is what #8901 tracks — the disposition of the gate question lives there, not here. This seam is fixable without it.

Suggested direction

Discriminate rather than infer, per the worked #8895 pattern: return the empty probe only when the failure is the benign one, and rethrow — or at minimum refuse to memoise — everything else. Note the benign case here may be two distinct errors: the driver's unprovisioned-table failure (the declared isMissingTableError from @objectstack/metadata/errors) and whatever the engine throws for an object never registered in this kernel scope; worth checking which one a lean embedding actually produces before wiring the predicate.

Related

#8901 (census card this fell out of) · #8845 (the measurement) · #8895 (worked fix pattern) · #8844 (introducing change) · ADR-0110 D3.

---

Generated by Claude Code

[os-support-ai]

Triage — first-touch grading (concentrated round, triage seat, session session_0138jAR5jeREBpm4dhVvbWY7): promoted to pm:queue, type Bug, domain:engine-core.

Bug by the mechanical boundary test: the #8844 ruling declares the multi-organization refusal and the single-org stamp; the memoised catch-all makes both silently skippable on a transient probe failure — this fix pulls behavior back to the declared contract (fail-open → discriminate), no acceptance-set expansion. The card's suggested direction (#8895 worked pattern: return empty only for the benign missing-registration case, refuse to memoise everything else) is a route suggestion for the dispatching seat, not a ruling.

Release-board note (deliberate non-inclusion): this brushes blocker class ② (declared≠enforced on a ruling-mandated refusal), but it fires only when the boot-time probe fails transiently — not reachable on a healthy deploy, unlike #9391/#9390. Left off target:v17; if the maintainer reads the memoisation aggravator as data-shape damage (unstamped system rows persist past the outage), say so and I'll board it next round.

Dispatch note: file surface packages/objectql/src/engine.ts (~:3040) + tenancy/system-write-organization.ts; serial-check against any in-flight #8901 gate work before dispatch.

---

Generated by Claude Code

[os-elon]

⏸ Held out of round 1 — serialisation hold, not a blocker. Recording the reason at the moment of deferral.

domain:engine-core seat, session session_019yDEhPBC3tcGkW9bkce1HM (os-elon). This card stays pm:queue, unassigned — ⛔ deliberately not pm:blocked: a serialisation hold is not an upstream dependency, and mislabelling it would make it invisible to the unblock scan while inviting a later seat to "unblock" it on a reason that was never true.

Why it was deferred

#9719 was dispatched this round and edits the same file — packages/objectql/src/engine.ts. Same-file work serialises across rounds; that is a hard rule, and distance does not clear it.

⭐ The regions genuinely are disjoint, and I am recording that rather than the distance, because distance is the reading that has burned this lane before (a card that removes something has a range nobody can infer from the name of what it added). Measured on origin/main @ 6cb88d9:

card	region
this card	probeInstallOrganizations — declaration :3027, closing brace :3048; also referenced at :2038 and :3102
#9719	the delete() region :10480-10956; secondarily dispatchPerRowBeforeHooks :2554-2601

⇒ ~7,400 lines apart, and even #9719's unlikely secondary region ends 426 lines before this card's begins. Overlap is file-level only. The hold is therefore about ordinary textual-merge risk in one large file, ⛔ not shared-function contention — which is exactly why it is a serialisation hold and releases cleanly.

Release condition

When #9719 lands. Then this card is dispatchable with no further gate.

⚠️ At release, re-verify the file surface on the MERGED ref, ⛔ do not inherit today's reading. #9719 changes how unscoped multi-deletes reach hooks; that is unrelated to the organization probe, but "the upstream merge most likely to invalidate your card is the one that unblocks it" is the standing rule and it costs one grep.

Premise re-verified this round, so the next dispatcher does not re-derive it

✅ Still live on origin/main @ 6cb88d9: probeInstallOrganizations at :3027, organizationProbeMemo assigned at :3046 and cleared at :3052, consumed via probeOrganizations at :3102. The memoised catch-all the card describes is unchanged.

Carried forward for whoever dispatches it

• Triage's grading (5326764018) is complete: type Bug, domain:engine-core, deliberately off target:v17 — with an explicit invitation to board it next round if the maintainer reads the memoisation aggravator (unstamped system rows persisting past the outage) as data-shape damage. That invitation is still open and unanswered.
• File surface will be engine.ts (~:3027-3048) plus packages/objectql/src/tenancy/system-write-organization.ts.
• ⚠️ Gate note: check:durability-log-level cannot see this seam — the catch returns nothing and lets the accumulator above the try answer, which is the check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845-measured blind spot. ⇒ ⛔ A green durability gate is not evidence here. Separately, devx card check-durability-degradation-log-level: loggerLevel cannot see the (logger.error ?? logger.warn)(…) fallback, so a loud catch reads as silent-swallow — and the spelling it CAN see prints nothing #9657 is in flight changing that gate's detection.
• The #8901 disposition question is not this card's to settle — this seam is fixable without it.

---

Generated by Claude Code