docs(adr): qualify the pre-repo ADR-0081 citations as cloud ADR-0081, letter-checked per site - #15612

Fixes #9072

⚠️ Governed surface (docs/adr/**): draft for human merge — review recorded on the issue.

What this settles

The cloud-side reading delivered on 2026-08-20 (issue comment 5350230356, objectstack-ai/cloud origin/main @ 5f1bf23f) identified the pre-repo ADR-0081 as cloud ADR-0081 — Organization Management — Open Basics, Enterprise @objectstack/organizations, Accepted 2026-07-09 — with D1 = the default-org bootstrap (ensureDefaultOrganization, slug='default' reuse-or-create, owner binding, kernel:ready, the !resolveMultiOrgEnabled() gate) and D2 = the multi-org machinery closing into cloud/packages/organizations. The 2026-09-04 re-triage ruled: requalify, letter-check every site, do not prefix blind, and record the identification in ADR-0093's Relates to line.

This PR does exactly that. It changes citations only — no decision text, no behaviour, no test assertion, no changeset-bearing surface.

Why no gate could have caught this. This repo owns its own docs/adr/0081-trusted-react-page-tier.md (the kind:'react' page tier), so a bare ADR-0081 here resolves — to the wrong record. check-adr-anchors.mjs only fails a number that names no record; a number that names the wrong record is invisible to it. That gate does, however, already recognise cloud ADR-0081 structurally (CROSS_REPO_QUALIFIERS), so the repaired spelling is the one the tooling was built for.

No site carried D4. D4 is the SCOPE_RULES.sys_member change from {field:'user_id', from:'user'} to {field:'organization_id', from:'org'}. git grep -n "SCOPE_RULES" -- packages returns nothing in this repo — the surface left with plugin-org-scoping under D2 — so there was no D4 site to mislabel. Likewise the kernel service name 'org-scoping' is untouched (setup-nav.contributions.ts still spells requiresService: 'org-scoping').

Per-site classification

Every one of the 72 non-CHANGELOG ADR-0081 occurrences on origin/main was classified before anything was edited.

cloud D1 — 18 citations requalified (letter kept, verified)

cloud D3 — 7 citations requalified (nav deep-link; 6 were bare on main)

D3 is the nav deep-link, per the reading's own bounds note. Each of these describes the active-org record page reached from nav_organization with recordId: '{current_org_id}', or that token's resolution.

wrong letter — 1 site corrected

docs/adr/0093-tenancy-mode-and-membership-lifecycle.md:388 (D8 non-goal 2) called the features.organization vs features.multiOrgEnabled split "a deliberate ADR-0081-D1 distinction". Only the open half is D1's ("basic add-a-teammate stays OPEN"); the enterprise half — org management available — is squarely D2's ("multi-org machinery closes into @objectstack/organizations"). Corrected to cloud ADR-0081 D1/D2, with one clause naming which letter draws which half. The decision itself is untouched.

cloud D2 — 0 live sites

No live citation in this tree carried a D2 label. ADR-0105's Builds on line at :5 already spelled it cloud ADR-0081 (@objectstack/organizations) — that was the clue the finding was filed on — and its :345 citation note quotes "ADR-0081 D2" only as the superseded label it is describing.

identification prose — 5 blocks (they name the record rather than carrying a live label)

react (ours, untouched) — 39 occurrences across 20 files

docs/adr/0081-trusted-react-page-tier.md, docs/adr/0082:5,:8, docs/adr/0084:5, the two react-tier links inside the ADRs edited above (0093:409, 0105:352), content/docs/protocol/objectui/layout-dsl.mdx, content/docs/references/ui/page.mdx, content/docs/ui/pages.mdx, docs/audits/2026-06-react-tier-authoring-dogfood.md (x5), docs/audits/2026-07-unknown-key-strictness-ledger.md:676, docs/qa/platform-checklist/areas/studio-authoring.json:1052,:1088, the three examples/app-showcase react pages, packages/lint (x7), packages/spec/scripts (x3), packages/spec/src/ui/chart.zod.ts (x2), page.zod.ts:685, react-blocks.ts:3, scripts/gen-sdui-manifest.sh:650, scripts/regen-artifacts.mjs:327, skills/objectstack-ui/references/react-blocks.md (x2). None touched — see the control below.

left verbatim and reported — 5 occurrences

Not ambiguous: each is deliberate, and each is why the branch's "unqualified org-meaning" count is 5 rather than 0.

• docs/adr/0093:68, :403 and docs/adr/0105:344, :348 — these quote the superseded label ("ADR-0081 D1" / "ADR-0081 D2") inside the very sentence that identifies it. Requalifying a quotation would erase the thing the prose is about.
• docs/qa/platform-checklist/areas/identity-auth.json:833 — the append-only history row for revision 1, a record of what a past edit did. Item revision was deliberately not bumped and no history row added: a citation repair changes nothing a runner does, and bumping would invalidate run results pinned to revision 2. The gate's revision == last history revision invariant still holds (both 2).

ambiguous → left, reported — 0

Every site's letter was determinable from its own surrounding text.

Grep controls

Occurrence counts, git grep -o, excluding CHANGELOG.md at every depth.

React-tier byte-identity control. The sorted multiset of every ADR-0081-bearing line was taken on both sides. comm -23 (present on main, absent on the branch) is 31 lines, and grep -cE "react|REACT|kind:'react'|PageSchema|ObjectChart|OS_PAGE_REACT|trusted-react-page-tier" over those 31 rewritten lines returns 0 — no react-tier line was rewritten. The react-marker subset itself is 29 lines on both sides, diff empty, sha256sum identical on both:

03ed1c3c42640387f6ba685d357773f0f621c39b9d6ce49b7e440da836845170  (main)
03ed1c3c42640387f6ba685d357773f0f621c39b9d6ce49b7e440da836845170  (branch)

D4 control. git grep -n "SCOPE_RULES" -- packages → no output, exit 1. There is no sys_member scope-rule surface in this repo to have mislabelled.

Verification

Gate family derived mechanically, not from a hand-written list:

node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack

Derived at HEAD 6e019fa0a against merge base 900334a56 — 16 changed paths, 106 commands. The first derivation ran on a stale tree (it warned that scripts/pm/dispatch-gates.mjs itself had moved on origin/main); origin/main was merged into this branch and the family re-derived clean before anything was run. Exit codes were captured before any pipe, into per-command log files. Every run reported below — the gate union, the builds, the typechecks, the tests and the grep controls — was taken on that same tree: git rev-parse --short HEAD = 6e019fa0a, which is the tip this PR pushes.

The 11 that first refused for a missing build — 2 with exit 3, 6 with exit 1 whose text says "Build first, then re-run", 3 with PREREQUISITE NOT MET:

@objectstack/lint check:doc-formula-expressions, @objectstack/lint check:doc-security-posture, @objectstack/spec check:api-surface, check:browser-reachable-entries, check:dual-source-exports, check:entry-nameability, check:exported-any, check:skill-examples, check:dual-build-cjs-loads, check:i18n, check:type-check-debt.

Builds and every heavy run went through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-9072. One acquisition returned 99 (never got a turn, slot parked); the interval was spent on lock-free work and the same slot was resumed rather than re-queued.

check:platform-checklist is not CI-wired (#11730), so it was run by hand, as the ruling requires:

check-platform-checklist: OK — 15 areas, 264 items (264 active); coverage: 35 kinds mapped,
1 waived; traps: 19 documented, 19 in use; provisioning: 5 area recipes, 8 item references
resolved (1 area-qualified), 5/5 recipes referenced; meta-URL spelling: 19 `call` strings
scanned against 34 folded spellings; source citations: 20 family files carry no `file:line`
pin; symbol anchors: 624/624 resolved against 306 cited sources, 17 file floors held

Exit 0. Coverage derives inside this same gate — there is no separate check:platform-checklist-coverage script in this tree.

Declared narrowing — whole-repo pnpm lint. It is not in the derived family and CI runs it on this PR regardless. Locally, eslint was run over the 10 changed TypeScript files with the same flags CI uses: eslint --no-inline-config --format json, 10 files linted, 0 errors, 0 warnings (counts read from the JSON output, not from the console). The narrowing is safe to state as a measurement rather than a gap because this config is not type-aware — it declares no parserOptions.project and no projectService, and eslint.config.mjs:328 says so in its own words — so a file's verdict is a function of that file plus the config, and this diff can move no untouched file's result.

No test pins any of the edited comment strings. git grep -n "ADR-0081" -- "*.test.ts" returns 6 hits on main, all of them comments or describe() titles; none is an assertion argument. The two runtime strings that changed (ensure-default-organization.ts:354, harness.ts:337/:656) are matched by tests only on other substrings (/orgContext:true does not compose with multiTenant/, /walled posture/), which are unchanged.

Scope

• skip-changeset is right and is applied: the packages/** edits are comment and log-string text only, nothing is published or behavioural, and the rest is docs/adr/**, docs/qa/**, content/docs/** and one shell script comment.
• The pre-repo ADR-0081 label survives in 37 more citations across three unrelated claims — same collision #8474 fixed for the active-org stamp only #8531's remaining claims B and C are out of scope here and are untouched. This PR settles the identification they depend on: the mint-a-new-owning-record route those claims assumed is not needed, because the referent is recoverable and now written so a reader can follow it across repositories.

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Generated by Claude Code