[finding] ~10 comments date the #3290 `session.tenantId` removal to "v11", but it shipped in v16 — and there is no v11 release page at all

[os-steve]

Found while working #9809 (narrowing check-org-identifier's stated reason for excluding test files). Reported, not fixed — out of scope for that card, which is about the gate's exclusion, not this factual error. Unassigned. Not a claim.

Measured on 83f8267f5.

The contradiction

Production comments, tests, and the gate script consistently say the ctx.session.tenantId alias was removed in v11:

scripts/check-org-identifier.mjs:11 #3290 REMOVED it ... (v11 major)
packages/objectql/src/engine.ts:2909 was removed here in v11 (#3290)
packages/objectql/src/plugin.ts:945 alias was removed in v11, #3290
packages/runtime/src/domains/actions.ts:323 was removed in v11 (#3290)
packages/objectql/src/engine.test.ts:538 removed in v11 (#3290)
packages/runtime/src/http-dispatcher.test.ts:3966
packages/runtime/src/action-session-shape-contract.test.ts:88
skills/objectstack-ui/SKILL.md:1934 removed in v11 (#3290)

One file disagrees:

skills/objectstack-data/references/data-hooks.md:627 removed in v16 (#3290)

Which is right: v16

Three independent reasons, all checkable:

1. content/docs/releases/ is the authority on which major shipped a removal, and the only page that mentions Remove the deprecated hook/action ctx.session.tenantId alias in the next major (converge on organizationId) #3290 is v16.mdx (line 132: "Remove the deprecated hook/action ctx.session.tenantId alias in the next major (converge on organizationId) #3290 then removed the deprecated tenantId alias from the hook ctx.session ...").
2. That page's Upgrade checklist → 16.0.0 lists the migration as a v16 step: "rename ctx.session.tenantId / ctx.user.tenantId to organizationId in every *.hook.ts / *.action.ts body".
3. There is no v11.mdx. The release pages are v9, v12, v13, v14, v15, v16, v17 — so "v11" names a major that has no release page in the tree at all.

So the majority spelling is the wrong one: a single mis-dated comment appears to have been copied outward, and data-hooks.md is the one site that has it right.

Why it is worth fixing rather than ignoring

These comments are the migration note an author or AI lands on when they hit the removed name — several of them sit directly above the blessed-name replacement. Pointing a reader at the wrong major sends them to a release page that does not exist, and check-org-identifier's own header is one of the sites, so the gate that teaches the migration mis-dates it.

Note the fix is to the comments, not to content/docs/releases/ — the release notes are already correct and are not to be edited in a code PR.

Suggested shape

Mechanical: retarget every "v11" in a #3290 / session.tenantId context to "v16". Worth one pass so the tree is self-consistent, rather than one file at a time. Whether the repo also wants a guard against a removal being dated to a major with no release page is a separate judgement, not proposed here.

Related

• [finding] check-org-identifier excludes test files wholesale, so a fixture that CONSTRUCTS the removed session dialect reads the same as one asserting its absence #9809 — the card this was found under (check-org-identifier's test exclusion).
• Unify the developer-facing org identifier: hooks expose session.tenantId while RLS/seed/columns use organizationId (add organizationId as the blessed name) #3280 / Remove the deprecated hook/action ctx.session.tenantId alias in the next major (converge on organizationId) #3290 — the rename and the removal.

[claude]

Claim: PM loop round 15
Session: session_01XqDQYVU5smx29ts9pAErja
Branch: claude/issue-9872-v11-v16-provenance
Worktree: objectstack-issue-9872
Domain: domain:devx
File surface: the ~10 comment sites dating #3290 (production code, tests, and scripts/check-org-identifier.mjs's header) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (node scripts/pm/dispatch-gates.mjs --tier scripts/check-org-identifier.mjs run this round: "no path-derived mandate … This line is a FLOOR, never a clearance"; content limb judged no — comment text only)
Clause-②: no
Serial constraints cleared: swept all open PRs for any touching check-org-identifier, hook.test, or audit-writers — none. The predecessor on the gate file, PR #9874 (#9809), is MERGED.

---

Generated by Claude Code

[os-steve]

{
 "issue": 9872,
 "status": "done",
 "branch": "claude/issue-9872-v11-v16-provenance",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9990",
 "premise_still_valid": true,
 "summary": "The card's conclusion (v16) is correct and 20 comment sites now say so, but one of its three legs is FALSIFIED and I replaced it with two stronger ones. Leg 3 ('there is no v11.mdx, so v11 names a major that does not exist') is wrong: v11 is a real major (CHANGELOG.md '## [11.0.0] - 2026-06-27', docs/upgrading-to-11.md, @objectstack/*@11.0.0 in example changelogs). The page is absent by POLICY - scripts/check-release-notes.mjs carries `const KNOWN_MISSING = new Set([10, 11]);` with the comment 'Curated release pages started at v9; v10/v11 were never backfilled'. Legs 1 and 2 hold. Replacement legs: (a) the entry '6c270a6: **BREAKING: remove the deprecated ctx.session.tenantId ...' sits under '## 16.0.0' (first under '## 16.0.0-rc.0') in packages/spec, packages/runtime AND packages/objectql CHANGELOGs; (b) docs/upgrading-to-11.md, the complete 10.x->11.x breaking-change guide, contains no tenantId, no #3280 and no #3290 at all. skills/objectstack-data/references/data-hooks.md:627 (governed, read not edited) corroborates. Fixed 20 of 26 wrong sites; the 6 residual are non-comment or governed surfaces listed below and need PM triage, so the PR says 'Part of #9872', NOT a closing keyword.",
 "tests": "All on final commit d9e01627ab (worktree removed after; PR head sha d9e01627ab78ab773a74f8bc1bec0ec89d7da77b). Gate set re-derived mechanically with `node scripts/pm/dispatch-gates.mjs` (NO paths passed) on the committed head: 17 paths, 35 matched families, exit 0. LOCAL SET DELIBERATELY NARROWED and declared as such - the diff is comment-only, CI runs the full farm. Gates, each quoting its own verdict line: `pnpm check:org-identifier` -> 'check-org-identifier: OK (2060 author-facing source file(s), 13 session binding(s) resolved, no removed session.tenantId alias).' plus 'check-org-identifier self-test: 31 cases pass.'; `pnpm check:nul-bytes` -> 'check-nul-bytes: OK (scanned 6322 text file(s) -- 6322 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).'; `pnpm check:doc-anchors` -> 'check-doc-anchors: 251 internal #fragment link(s) across 398 source file(s) all resolve to a real heading'; `pnpm check:role-word` -> 'check-role-word: OK, no new occurrences of the reserved word.' Exit codes captured by redirecting to a file BEFORE tail, never through a pipe. Build: `pnpm --filter '<pkg>^...' build` over the five touched packages' dependency closures, exit 0, under `flock -E 99 -w 540 /tmp/os-heavy-verify.lock`. Typecheck: five touched packages green (spec, objectql, runtime, plugin-audit, trigger-record-change) - 5 scripts echoed in the output, so NOT a zero-match silent pass; spec additionally ran check:scripts-typecheck and check:test-typecheck ('OK - @objectstack/spec's test layer compiles ... 55 file(s) / 263 error(s) held in test-typecheck-debt.json'). Tests, all six touched test files: hook.test.ts + action-params.test.ts = 'Test Files 2 passed (2) / Tests 102 passed (102)'; engine.test.ts = '1 passed (1) / 135 passed (135)'; http-dispatcher.test.ts + action-session-shape-contract.test.ts = '2 passed (2) / 257 passed (257)'; audit-writers.test.ts = '1 passed (1) / 67 passed (67)'. Total 561 tests, 0 failures. No ablation was run - the change is comment text only, so there is no guard whose failability needed demonstrating; saying otherwise would be a fabricated artifact.",
 "open_questions": [
 {
 "question": "H1 counts: 26 sites date the #3290 removal to v11, not '~10'. 20 are comment text and are fixed. The other 6 are wrong but are NOT comment text, so ruling 4 forbids me touching them. How should they land?",
 "options": [
 "A - leave them; the tree stays 6 sites inconsistent, but Clause-2 stays 'no' and no queue gate is bound",
 "B - one follow-up card, split by surface: a GOVERNED-only PR for skills/objectstack-ui/SKILL.md:1934 (skills/** - a mixed diff forks the whole PR under AGENTS.md #14), and a spec-surface PR for the .describe() strings at action-params.zod.ts:376,409 plus the migration rationale at migrations/registry.ts:1555 and entries/semantic/17.action-session-roles-to-positions.ts:23 (these are RUNTIME DATA that regenerate content/docs/references/ui/action-params.mdx:58,59 - marked AUTO-GENERATED DO NOT EDIT - and spec-changes.json + docs/protocol-upgrade-guide.md:317, and would owe a changeset that ruling 6 forbids here)",
 "C - fold them into this PR now, accepting the fork and the changeset"
 ],
 "recommendation": "B. A is honest but leaves the exact copy-sources a future author will copy from - the .describe() strings are the published spec surface. C flips the Clause-2 declaration mid-flight, which the claim comment forbids. B keeps each surface with its own review path. Note the two remaining residues inside B's scope that are neither: audit-writers.test.ts:1653 is a TEST TITLE ('does not resolve the v11-removed tenantId alias'), and scripts/check-org-identifier.mjs:596,600,602,640 are the gate's own SELF-TEST FIXTURE CORPUS - changing either is behaviourally inert (the detector never reads version tokens; expected counts stay 0) but both sit inside ruling 4's stop-and-report boundary, so I did not touch them and they need an explicit yes/no from you."
 },
 {
 "question": "H4: nothing mechanical checks a version citation in a comment - confirmed, that is why this survived 26 times. Worth carding a guard? (I did NOT build one; a new gate is outside this card.)",
 "options": [
 "A - card a gate that cross-checks any 'v<N>' asserted next to an issue number against the release record",
 "B - card nothing; fix the ROOT CAUSE instead - the root CHANGELOG.md",
 "C - both"
 ],
 "recommendation": "B first, and it is the highest-value finding of this card. H3 traced all 26 sites to ONE origin, commit 6c270a607c - the removal PR itself - which wrote 'v11' 15 times in a single diff. The cause is not carelessness and it is STILL LIVE: the repo's root CHANGELOG.md still tops out at '## [11.10.0] - 2026-07-03'. It was never maintained past the 11 line while the packages moved to 15/16/17; at that very commit packages/spec/package.json read 15.1.1. An author sanity-checking 'what major are we on' against the repo's own root changelog reads 11 and is wrong by five majors - silently, today, for anyone. A gate (option A) would catch the symptom one comment at a time; retiring or fixing the root CHANGELOG.md retires the trap. I did not file this as an issue because it touches release-owned territory and the judgement is yours - say the word and I will card it."
 }
 ],
 "out_of_scope_findings": [
 "NOT filed as issues - reported here for your triage, because each is a direct consequence of a ruling on this card rather than an independent drive-by find, and filing them unassigned would have duplicated the card itself.",
 "H2 sweep result: CLEAN. Swept every v11 / 11.0.0 token and every #3290 token in the tree, plus the co-cited ids. v11 is the ONLY wrong provenance. #3280 is exactly what the comments claim ('Unify the developer-facing org identifier ... add organizationId as the blessed name'). ADR-0087/0090/0095/0099/0104 all resolve and ADR-0090 D3 really is the 'role becomes a reserved-forbidden word' decision. No widening from one wrong digit to a habit.",
 "H1 false-positive class, verified and deliberately NOT touched - two sites date a DIFFERENT removal to v11 CORRECTLY: content/docs/kernel/contracts/metadata-service.mdx:311 (IUIService removed in v11) and docs/audits/2026-07-security-props-liveness-recheck.md:26 (PolicySchema removed in v11.0). Both appear as their own items in docs/upgrading-to-11.md (lines 91 and 128). A mechanical v11->v16 sweep would have corrupted both.",
 "Second false-positive class: objectui#3290 is a DIFFERENT repo's issue (widget `required` state), at packages/spec/src/ui/widget.zod.ts:123 and content/docs/protocol/objectui/widget-contract.mdx:145. Not in the population; untouched.",
 "Historical records carrying 'v11', deliberately untouched: packages/spec/CHANGELOG.md:8746,8958,44246,44285 and packages/runtime/CHANGELOG.md:34,3493,11515,12359 (published release records), and the two pending changesets .changeset/org-identifier-session-provenance.md:10 and .changeset/audit-tenant-fallback-reads-organization-id.md:11 (inside the #9465 epic fence per ruling 6).",
 "content/docs/releases/** untouched throughout, per ruling 2 - used as evidence only. skills/objectstack-data/references/data-hooks.md untouched per ruling 3, and it is the one site that was already right.",
 "PR #9990 is DRAFT and stays draft; auto-merge NOT armed. skip-changeset label applied and CONFIRMED BY READ-BACK as the union with the bot's labels (documentation, ci/cd, size/s, tests, protocol:ui, protocol:data, skip-changeset) - this PR publishes nothing, and ruling 6 forbids a changeset.",
 "Report delivered at draft-PR time per the 2026-08-10 ruling; CI convergence is yours, not mine. I did not poll CI."
 ]
}

---

Generated by Claude Code