Uh oh!
There was an error while loading. Please reload this page.
fix(engine-core): a system-context insert resolves the install's organization, or is refused — the runtime producer of the autonumber fork (#8844) - #8930
Merged
Conversation
… inserts, or refuse (#8844) The runtime twin of #8686's ruling, one layer up. A system-context write — a hook, a scheduled job, a custom endpoint, a `runAs: system` flow — carried no organization, so the tenant column landed NULL and the SQL driver's autonumber counter filed the row under the `__global__` pseudo-tenant. One object then ran two counters that could not see each other, and the partitioned unique index `(COALESCE(organization_id, '__global__'), <field>)` could not see across the two partitions either: a field declared `unique` held the same value twice, with no error and no warning. Measured on 17.0.0 GA across five objects on one single-tenant install. Per the 2026-08-15 maintainer ruling (Option 1), the engine's stamp resolution now answers the same question a session write answers: - single-tenant with exactly one organization: derive and stamp it, by threading `DriverOptions.tenantId` — the same knob a session write sets, so no driver changed (`fillAutoNumberFields` is duplicated in driver-sql and driver-turso); - multi-organization (a walled posture, or a `single` posture whose data holds several organizations): refuse loudly with ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (500, registered in the ADR-0112 ledger) rather than silently default to `__global__`; - already-minted duplicates are reported, never rewritten — the #8686 posture, ruled again here. Nothing renumbers anything. Three populations are outside the rule by construction so the refusal cannot break automation that was never at risk: objects with no organization column, `tenancy.enabled: false` objects and federated objects; the `sys_`/`cloud_`/ `ai_` platform namespaces (#8672's reasoning, which does not generalize to application objects); and any write already carrying an organization. Before any organization exists there is nothing to derive and no partition to fork from, so first boot is untouched and #8686's handoff still adopts those rows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
…8844) `check:query-options-erasure` counted the new `this.find(sys_organization, {...} as any)` as a ninth erasing site in engine.ts, which is grandfathered for its EXISTING sites only. The literal type-checks against `EngineQueryOptions` unmodified, so the cast was never needed — removed at the source rather than laundered through `as unknown as`, and the ratchet is back at its baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 109 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
hotlong
marked this pull request as ready for review
August 15, 2026 20:22
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#8844
The runtime twin of #8686, one layer up. That card fixed one producer of untenanted rows — the seed loader — and shipped a one-shot backfill for what it had already written. This is the other producer, which is still running: an ordinary application write made under a system execution context (a hook, a scheduled job, a custom endpoint, a
runAs: systemflow). A backfill cannot reach it, because it mints a fresh duplicate on every tick — which is what makes #8686's repair self-undoing on any install with server-side automation.Implements the maintainer ruling in comment 5302919977 — Option 1, all five binding points, not re-adjudicated.
Premises re-verified on today's tree (
main@8664a2c99, not the escalation's6b6b606)The escalation's line references were dated evidence; each was re-located by content and re-checked:
packages/objectql/src/registry.ts:555,additions.organization_id = { ...TENANT_SCOPE_FIELD_DEF }(same line, re-checked by content)engine.tsdocuments thebeforeInsertstamp pathpackages/objectql/src/engine.ts:8158SqlDriver.createcallsinjectTenantOnInsertatsql-driver.ts:4402andfillAutoNumberFieldsat:4421, so the counter reads an already-stamped row. The direction of causation holds; the fix site does not move.fillAutoNumberFieldsis duplicated across driversdriver-tursoreaches it by inheritingSqlDriver.create. Relevant to the tests, not the fix site: no driver changed.What changed
packages/objectql/src/tenancy/system-write-organization.ts(new) — the ruling as one pure, directly-testable decision, plus the refusal class.engine.tssupplies the measured facts and resolves the answer intoDriverOptions.tenantId— the same knob a session write sets, soinjectTenantOnInsertstamps the column and the counter scopes by the real organization. That is why no driver had to change, on either of the two that carryfillAutoNumberFields.__global__fork stops being minted by hooks, cron and system endpoints.group/isolated), or asingleposture whose data holds several organizations, raisesERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED(status 500, registered in the ADR-0112 ledger) before anything reaches the driver. Never silently defaulted to__global__.The refusal is the dangerous half — how it was kept narrow
A refusal that is too broad breaks every system write on a walled install, including unattended automation. Four populations are outside the rule by construction, not by exemption:
tenancy.enabled: false(ADR-0066), federated (ADR-0015)tenancy: { enabled: false }is the declared way to hold org-less rows — stated once on the object and checkable — rather than a per-write bypass flag, which is the lenient-consumer accommodation PD #12 forbids.sys_/cloud_/ai_platform namespacesbeforeInserthook (the resolution runs after the hooks for exactly this reason). That IS "carrying an explicit organization".sys_organization-insert handoff adopts exactly these rows. Refusing here would refuse first boot itself.Topology buckets, as measured (Zone 2 point 3): posture read live per call, service first (
tenancyPostureProvider, what is ENFORCED) then env (resolveTenancyPosture, what was ASKED for) — the same two-stepapp-plugin.organizationWallActiveuses, and never the demotedresolveMultiOrgEnabled().single+ 1 org: derive.single+ 0 orgs: leave untenanted.single+ 2 or more orgs: refuse (ambiguous).group/isolated: refuse (walled, without probing the database at all). An unreadableOS_TENANCY_POSTURE: degrades to the walled reading and refuses, because a typo'd posture is exactly where guessingsinglewould be worst.Scoped to INSERT, deliberately. The ruling's yardstick is "the way a session write does", and stamping the organization is an insert-side mechanism — an update neither stamps it nor can fork a counter. Extending it would not be following the session write, it would be inventing a second rule.
Tests, and the ablation that proves they can fail
packages/objectql/src/system-write-organization.test.ts— 20 cases: the decision function's branches, then the engine seam (DriverOptions.tenantId), each with its discriminating control.packages/runtime/src/system-write-tenancy-autonumber-split.integration.test.ts— 4 cases on a realObjectQL+SqlDriverover better-sqlite3, asserting on the database:_objectstack_sequences, the stored rows, the duplicate count.Two ablation legs, disjoint red sets — each half of the fix is independently pinned. Directions were predicted before running; one prediction was wrong and the measured direction is reported:
__global__)expected undefined to be 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED'[binding point 2]) / 3 greenexpected undefined to be 'org_msokm9oaz0cal87q'[binding point 1]expected 5 to be 10,[#8686 regression]the__global__row reappears beside the organization'sCorrection to a prediction. Leg B was predicted to leave
[first boot]green; it went RED (expected 2 to be 1). The case's second half asserts that once the organization exists the runtime producer is stamped, so it pins the derive branch too — the test is stronger than predicted, and this reports what was observed rather than what was expected.packages/runtimeresolves@objectstack/objectqlfromdist/, so every ablation leg was rebuilt and proved live in the artifact withnode scripts/ablation-dist-preflight.mjs @objectstack/objectql '__OS_ABLATION_*__'(and proved absent again after restore). Without that, leg A's first runtime run was a false green — measured here, not hypothesised.Verification — union re-run at final HEAD
445359f0bEdited packages:
spec10644,objectql3695,runtime2456 tests, all passing;typecheckgreen acrossobjectqland its 43 DOWNSTREAM consumers (prefix filter...@objectstack/objectql).Downstream test sweep (consumers, not dependencies):
rest1948,plugin-security1235,plugin-auth1238,plugin-sharing599,plugin-approvals484,plugin-audit239,driver-turso994,driver-mongodb384,service-datasource426,service-settings456,service-messaging229,service-queue53,trigger-record-change78,trigger-schedule46,cli1358,dogfood779,http-conformance72,verify28 — all green. #8686's ownseed-tenancy-autonumber-split.integration.test.tsruns green beside the new file.Gates: every family
scripts/pm/dispatch-gates.mjsderives from the final changed paths, pluscheck:error-code-casing,check:nul-bytes,check:engine-double-contract,check:tenant-chokepoint,check:type-check-coverage,check:type-check-debt --re-measure(on the built workspace),check:query-options-erasure,pnpm lint, andpnpm --filter @objectstack/spec check:generated(13/13 current).One ratchet moved and was fixed at the source, not raised:
check:query-options-erasurecounted the newthis.find(sys_organization, {…} as any)as a ninth erasing site inengine.ts(grandfathered for its existing eight only). The literal type-checks againstEngineQueryOptionsunmodified, so the cast came out — commit445359f0b. Ratchet back at baseline, no ceiling touched.Not done here, deliberately
No driver change (Option 2 is off the table). No renumbering of already-minted identifiers — reported instead, via #8928. #8672 remains open and untouched; this PR is the evidence its on-hold reasoning does not generalize, not a change to it.
The issue body was self-checked for sanitizer truncation: intact — its escaped arrow spans survived as entities and no prose is cut.
Generated by Claude Code