fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id (#15024)

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+ no longer declares the column. Both halves are needed: the tenant anchor is
+ INJECTED at registration, so deleting the field alone would have left the
+ column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+ — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+ `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+ column and needs the wall over it stood down). Here there is no column to
+ wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+ required rather than incidental: a Layer 0 wall composing an equality on a
+ column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+ `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+ is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+ only when the table HAS a tenant column, so `'organization'` already degraded
+ to exactly these two columns. What changes is that the declaration now states
+ the boundary it actually gets, rather than claiming a per-organization one
+ that does not exist. Still explicit rather than bare `unique: true`, which
+ lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+ org-row skip.** `list()` is now every activation row of its type, scoped by
+ the `metadata_type` discriminator alone, and `setActive` takes the single row
+ its keyed read returns instead of picking the NULL-organization one out of
+ the result. Both guarded a column that no longer exists; the declared unique
+ index over the two columns the lookup keys on is what makes that read
+ single-valued. `ObjectStoreFlowActivationStore` and
+ `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/ledger-convergence-registration-and-one-store.md

@@ -79,13 +79,12 @@ one-argument constructor and its own docs, and fixes the discriminator.
 `ObjectStoreActionActivationStore` / `InMemoryActionActivationStore` /
 `ActionActivationRow` / `ActionActivationStore` / `ActionActivationStoreEngine`
 / `ACTION_ACTIVATION_TABLE` are exported from the same modules with the same
-shapes. Row semantics are byte-equivalent: install-level rows only
-(`organization_id` never written), org-carrying rows skipped on read and
-ignored when deciding insert-vs-update, a driver `0` read as false,
-read-then-write rather than a blind upsert, and no `delete` in the engine slice
-because re-enabling rewrites the row.
+shapes. Row semantics are byte-equivalent: deployment-level rows scoped only by
+the `metadata_type` discriminator, a driver `0` read as false, read-then-write
+rather than a blind upsert, and no `delete` in the engine slice because
+re-enabling rewrites the row.
 
 Both existing pin suites stay green **unchanged**, which is what makes them the
-proof the consolidation lost nothing — verified by ablation: removing the
-org-row skip from the one shared implementation turns both of them red on their
-own org-skip assertion, so both really reach it.
+proof the consolidation lost nothing — verified by ablation: mutating the one
+shared implementation turns both of them red on their own assertions, so both
+really reach it.

.changeset/sys-metadata-activation-ledger.md

@@ -11,30 +11,24 @@ it needs **zero `packages/spec` schema or contract surface** — it is an ordina
 platform object, not a metadata type. (The one spec file touched is the
 mechanical name census described below, not protocol surface.)
 
-The whole schema, per §4: `metadata_type` · `name` · `package_id` ·
-`organization_id` (nullable, **reserved** — NULL on this entire line; the
-per-org dimension is an additive column later, never a redesign) · `active`.
+The whole schema, per §4: `metadata_type` · `name` · `package_id` · `active`.
+There is **no tenant column**: a row records that THIS ENVIRONMENT switched a
+packaged artifact off, which is deployment-level state owned by no
+organization. (An earlier revision of this line declared a nullable
+`organization_id` marked "reserved"; it was removed before release — see the
+sibling changeset for that removal.)
 An earlier ADR draft carried designation columns (`replaced_by`, `cloned_from`);
 amendment ruling 2 removed them — there is **no recorded linkage** between a
 clone and its base, matching the landed #11513 posture ("an ordinary org-owned
 set with no upgrade linkage"). The pin test asserts the column set by EQUALITY
 and names both removed columns separately, so re-growing the linkage is loud.
 
-Row identity is `(metadata_type, name, organization_id NULL-collapsed)`, spelled
-as a declared index with **`unique: 'organization'`** (ADR-0120 D1). That
-spelling is load-bearing, and the two obvious alternatives are both wrong here:
-
-- bare `unique: true` on a declared index is the positional spelling of
- `'global'` — installation-wide over exactly the listed columns — and is
- already warned by lint `unique/unscoped-declared-index` in 17.x;
-- a hand-written `['metadata_type', 'name', 'organization_id']` composite is
- NULL-DISTINCT in SQL, and this line's `organization_id` is NULL on every row
- by construction, so that index would enforce **nothing at all** (#5030,
- measured) and one artifact could carry two contradictory `active` rows.
-
-`'organization'` is the arm that closes exactly that hole: the driver prepends
-`COALESCE(organization_id, '__global__')` at registration (ADR-0120 D3), which
-is what §4's "NULL-collapsed" names.
+Row identity is `(metadata_type, name)`, spelled as a declared index with
+**`unique: 'global'`** (ADR-0120 D1) — installation-wide over exactly those two
+columns, which is the whole of the identity now that the table carries no
+tenant column. Stated explicitly rather than as bare `unique: true`: the bare
+spelling materializes the same index but leaves the scope unstated, which lint
+`unique/unscoped-declared-index` warns on in 17.x and protocol 18 rejects.
 
 The name is also registered in `@objectstack/spec`'s platform-object name census
 (`PLATFORM_OBJECTS_BY_PACKAGE`, the `platform-objects` group). That census is a

content/docs/permissions/system-context.mdx

@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 106 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:145`, `:178` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:139`, `:190` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:59`, `webhook-provenance.ts:50` |

packages/core/src/utils/metadata-activation-store.test.ts

@@ -17,18 +17,18 @@
 // that had quietly hard-coded the other one's.
 // 2. **Two bindings over one table do not see each other's rows** — in BOTH
 // directions, from the same store class. That is the drift the two copies
-// made possible (#12350's own argument: the org-row skip and the
+// made possible (#12350's own argument: the discriminator scoping and the
 // `0`-is-false read are what a copy loses quietly), and it can only be
 // measured where both types are constructed side by side.
 // 3. **A type nobody has written yet behaves the same.** ADR-0126 §8
 // pre-charts `tool` / `skill` / `position`; a third consumer must inherit
 // the semantics rather than re-derive them, and the cheapest proof is an
 // unknown discriminator asserted through the same battery.
 //
-// The four load-bearing row properties themselves (`organization_id` never
-// written, org-carrying rows skipped on read, absence means ACTIVE, a driver
-// `0` reads as false) are pinned here too — this is where they now live, so
-// this is where a change to them has to argue.
+// The load-bearing row properties themselves (the ledger is deployment-wide
+// and carries no tenant column, absence means ACTIVE, a driver `0` reads as
+// false) are pinned here too — this is where they now live, so this is where a
+// change to them has to argue.
 
 import { describe, it, expect, vi } from 'vitest';
 // The real engine's OWN update-dispatch predicate, so the double below cannot
@@ -151,9 +151,11 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
  expect(insert?.data).toEqual({
  metadata_type: 'action', name: 'mark_done', package_id: 'crm', active: false,
  });
- // ⛔ §5: `organization_id` is not written — asserted as an ABSENT key,
- // because writing it explicitly (even as null) would be a different row
- // shape, and the one the reserved per-org dimension is not.
+ // No tenant column is written, because the table has none. Kept from
+ // the era when the column existed-but-was-reserved (where it guarded
+ // against writing it even as an explicit null): it is now what makes a
+ // re-introduced tenant write loud at the payload, which is the one
+ // place the column could come back without touching the declaration.
  expect(Object.keys(insert?.data ?? {})).not.toContain('organization_id');
  });
 
@@ -190,18 +192,30 @@ describe('ObjectStoreMetadataActivationStore — the discriminator is a paramete
 });
 
 describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics, one home', () => {
- it('SKIPS a row carrying an organization rather than reading it install-level', async () => {
- const { engine } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'install_level', package_id: 'crm', active: false },
- { id: 'r2', metadata_type: 'flow', name: 'org_scoped', package_id: 'crm', active: false, organization_id: 'org_1' },
+ it('reads EVERY row of its type — the discriminator is the only scope', async () => {
+ const { engine, calls } = makeStoreEngine([
+ { id: 'r1', metadata_type: 'flow', name: 'first', package_id: 'crm', active: false },
+ { id: 'r2', metadata_type: 'flow', name: 'second', package_id: 'crm', active: false },
  ]);
 
- const rows = await new ObjectStoreMetadataActivationStore(engine, 'flow').list();
-
- // Skipped, not merged: reading it install-level would apply one
- // organization's choice to the whole installation — #10243 from the
- // read side.
- expect(rows.map((r) => r.name)).toEqual(['install_level']);
+ const store = new ObjectStoreMetadataActivationStore(engine, 'flow');
+ const rows = await store.list();
+
+ // ⚠️ This replaces a pin that asserted a SKIP: the store used to drop
+ // any row carrying an organization, because the table declared a
+ // reserved-but-never-written tenant column. The column was dropped
+ // before it ever shipped, so there is no second axis left — every row
+ // of this type is an answer, and a filter here would now be dead code
+ // that reads as if it guarded something.
+ expect(rows.map((r) => r.name)).toEqual(['first', 'second']);
+
+ // The read names the discriminator and NOTHING else. Asserted on the
+ // query rather than on the result, because a store that had kept a
+ // tenant predicate would still return both of these rows — the fake's
+ // rows carry no such column — and the skip would be invisible from the
+ // result side alone.
+ expect(calls.find((c) => c.op === 'find')?.options?.where)
+ .toEqual({ metadata_type: 'flow' });
  });
 
  it('reads a driver `0` as FALSE, and a missing column as the packaged default (true)', async () => {
@@ -237,20 +251,25 @@ describe('ObjectStoreMetadataActivationStore — the ADR-0126 §4 row semantics,
  .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
- it('ignores an org-carrying row when deciding insert-vs-update', async () => {
+ it('UPDATES the one row the keyed lookup returns — no tenant tie-break left to make', async () => {
  const { engine, calls } = makeStoreEngine([
- { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false, organization_id: 'org_1' },
+ { id: 'r1', metadata_type: 'flow', name: 'nightly_sync', package_id: 'crm', active: false },
  ]);
 
  await new ObjectStoreMetadataActivationStore(engine, 'flow').setActive({
- name: 'nightly_sync', packageId: 'crm', active: false,
+ name: 'nightly_sync', packageId: 'crm', active: true,
  });
 
- // The write side of the same wall: overwriting one organization's row
- // as if it were the install-level one is the #10243 leak with the
- // arrow reversed.
- expect(calls.some((c) => c.op === 'update')).toBe(false);
- expect(calls.find((c) => c.op === 'insert')?.data?.name).toBe('nightly_sync');
+ // ⚠️ This replaces a pin that asserted the store IGNORED an
+ // org-carrying row and inserted a second one instead. That choice
+ // existed only because a reserved tenant column could put more than one
+ // row behind the same `(metadata_type, name)` key; with the column gone
+ // the declared `unique: 'global'` index over exactly those two columns
+ // makes the keyed read single-valued, so taking the first match is
+ // taking the only one — and inserting a duplicate would now be the bug.
+ expect(calls.filter((c) => c.op === 'insert')).toHaveLength(0);
+ expect(calls.find((c) => c.op === 'update')?.data)
+ .toEqual({ id: 'r1', active: true, package_id: 'crm' });
  });
 
  it('probes the TABLE unscoped — the question is composition, not type', async () => {