@@ -0,0 +1,12 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): the organization-ownership ceremony's not-null step runs again on a resumed apply, so a table it left nullable receives NOT NULL once that is possible
+
+Clause-②: no
+Metadata-protocol: none
+
+`os migrate organization-ownership --apply` recorded its not-null step as done even when it left tables nullable: tables the booted composition declared no object for (`notDeclared`), and tables still holding a NULL row the operator had to resolve by hand. A later apply then read the checkpoint and skipped the step. Re-running under a composition that declares those tables, or after fixing the rows (apply, fix rows, plan, apply), certified the database with `organization_id` still nullable on them, although the step's own advice said such a re-run applies it.
+
+On a resumed apply that has a schema door, the step now runs again. A table that is declared and has no NULL row receives NOT NULL. A column that is already NOT NULL is answered `already-not-null`, read from the database's catalog, and is never rebuilt. A re-run with nothing left to tighten stays `checkpointed`, exactly as before. A re-run whose NOT NULL fails blocks the run and is no longer recorded as done, the same as on a first run. A first run is unchanged.
@@ -881,15 +881,24 @@ export default class OrganizationOwnershipCeremony extends Command {
                 .filter((name): name is string => typeof name === 'string' && name.length > 0)
                 .map((name) => StorageNameMapping.resolveTableName({ name })),
             );
+            const nullability = new Map<string, ReturnType<typeof readColumnNullability>>();
             return applyNotNullThroughDrift(
               {
                 isDeclared: (table) => declared.has(rotationBaseOf(table) ?? table),
                 shardBaseOf: (table) => rotationBaseOf(table) ?? null,
-                // [ADR-0131 D1] A shard the driver created NOT NULL is reported
-                // so, never as one the ceremony could not tighten.
+                // [ADR-0131 D1] A column already NOT NULL — a shard the driver
+                // created so, or a table an earlier run tightened — is reported
+                // so, never handed to the door again. One catalog read per
+                // database per call: each table is read before it is tightened.
                 isNotNull: async (table, column, database) => {
-                  const read = await readColumnNullability(driverFor(database), [column], normalizeRows);
-                  return 'detail' in read ? null : read.tables.get(table)?.get(column) ?? null;
+                  const key = `${database ?? ''}|${column}`;
+                  let read = nullability.get(key);
+                  if (!read) {
+                    read = readColumnNullability(driverFor(database), [column], normalizeRows);
+                    nullability.set(key, read);
+                  }
+                  const answer = await read;
+                  return 'detail' in answer ? null : answer.tables.get(table)?.get(column) ?? null;
                 },
                 driverFor: (database) => driverFor(database) as never,
               },
 
@@ -0,0 +1,264 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The ceremony's `not-null` step (18.x step 5d, ADR-0131 8e) on a run that
+ * resumes from its checkpoint, over a REAL SQLite driver: the NOT NULL is the
+ * driver's own drift apply door (the table rebuild), read back from the
+ * database's own catalog.
+ *
+ * The step leaves a table nullable for one of two reasons it states: the
+ * composition the run booted declares no object for it (`not-declared`, "re-run
+ * the ceremony where the deployment's composition is declared to apply it"), or
+ * the table still holds a NULL row the operator must resolve by hand
+ * (`UNATTRIBUTABLE_REMEDY`, "then re-run --apply"). Either way the step itself
+ * finished, so it is checkpointed. The re-run each advice line names must then
+ * apply the NOT NULL it left, not read the checkpoint and skip the step:
+ *
+ *  - (1) certified with two tables `not-declared`, re-run under a composition
+ *    that declares them: both end NOT NULL;
+ *  - (2) the walled recovery path — apply, fix the held rows by hand, plan,
+ *    apply — ends with NOT NULL on the fixed table, and certifies;
+ *  - (3) control: a first run with nothing pending checkpoints exactly as
+ *    before, and a re-run of it stays `checkpointed` and rebuilds nothing;
+ *  - (4) a re-run whose NOT NULL fails blocks and does not certify, as the
+ *    same failure does on a first run.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import Database from 'better-sqlite3';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { buildOrganizationOwnershipPlan, inventoryDigest } from './organization-ownership-plan.js';
+import {
+  applyOrganizationOwnership,
+  reviewedConflictsOf,
+  type ApplyExecutor,
+  type CeremonyCheckpoint,
+  type CeremonyLedgerPort,
+  type NotNullPort,
+  type OrganizationOwnershipApplyReport,
+} from './organization-ownership-apply.js';
+import { applyNotNullThroughDrift } from './organization-ownership-not-null.js';
+
+// The dynamic imports the plan's module graph reaches, loaded at collection,
+// never inside a case's clocked window (`check:test-source-alias`).
+import '@objectstack/driver-turso';
+import '@objectstack/metadata-protocol';
+import '@objectstack/platform-objects/plugin';
+import '@objectstack/plugin-security';
+import '@objectstack/rest';
+import '@objectstack/runtime';
+import '@objectstack/service-datasource';
+
+const ORG = 'org_default';
+const TABLES = ['crm_deal', 'crm_note', 'crm_task'] as const;
+
+let dir: string;
+let file: string;
+let db: Database.Database;
+let driver: SqlDriver;
+/** Tables the drift apply door rebuilt, in order. */
+let rebuilt: string[];
+
+function executor(): ApplyExecutor {
+  return {
+    dialect: 'sqlite',
+    client: 'better-sqlite3',
+    async query(sql, params = []) {
+      return db.prepare(sql).all(...(params as unknown[])) as Record<string, unknown>[];
+    },
+    async execute(sql, params = []) {
+      db.prepare(sql).run(...(params as unknown[]));
+    },
+  };
+}
+
+function ledger(): CeremonyLedgerPort & { stored: () => CeremonyCheckpoint | null } {
+  let stored: CeremonyCheckpoint | null = null;
+  return {
+    stored: () => stored,
+    async read() {
+      return stored ? (JSON.parse(JSON.stringify(stored)) as CeremonyCheckpoint) : null;
+    },
+    async write(checkpoint) {
+      stored = JSON.parse(JSON.stringify(checkpoint)) as CeremonyCheckpoint;
+    },
+  };
+}
+
+/** Whether the table's tenant column is NOT NULL, read from the database's own catalog. */
+const isNotNull = (table: string): boolean =>
+  (db.prepare(`SELECT "notnull" AS nn FROM pragma_table_info('${table}') WHERE name = 'organization_id'`).get() as { nn: number }).nn === 1;
+
+/**
+ * The command's `notNull` port, as `os migrate organization-ownership` wires
+ * it: the drift apply door of the driver, for the tables `declared` (the
+ * composition this run booted), the column's nullability read from the catalog.
+ */
+function schemaDoor(declared: ReadonlySet<string>, opts: { failOn?: string } = {}): NotNullPort {
+  return {
+    apply: (columns) =>
+      applyNotNullThroughDrift(
+        {
+          isDeclared: (table) => declared.has(table),
+          isNotNull: async (table) => isNotNull(table),
+          driverFor: () => ({
+            applyMigrationEntries: async (entries: never[], options: never) => {
+              const table = (entries[0] as { table: string }).table;
+              if (table === opts.failOn) throw new Error(`SQLITE_BUSY: ${table} is locked`);
+              rebuilt.push(table);
+              return driver.applyMigrationEntries(entries, options);
+            },
+          }) as never,
+        },
+        columns,
+      ),
+  };
+}
+
+async function apply(
+  l: CeremonyLedgerPort,
+  notNull: NotNullPort,
+  posture = 'single',
+): Promise<OrganizationOwnershipApplyReport> {
+  const reviewed = await buildOrganizationOwnershipPlan({ reader: executor(), posture, database: file });
+  return applyOrganizationOwnership({
+    executor: executor(),
+    posture,
+    database: file,
+    reviewedPlan: {
+      file: 'plan.json',
+      generatedAt: reviewed.generatedAt,
+      database: file,
+      inventoryDigest: inventoryDigest(),
+      posture,
+      conflicts: reviewedConflictsOf(reviewed),
+    },
+    catalog: { async resolve() { return undefined; } },
+    notNull,
+    door: {
+      async save(type, name) {
+        throw new Error(`no environment save is expected here (${type} ${name})`);
+      },
+    },
+    templates: { async find() { return undefined; } },
+    views: { async list() { return []; } },
+    lock: { async verdict() { return { editable: true }; } },
+    columnDrops: { async drop(columns) { return columns.map((c) => ({ ...c, outcome: 'dropped' as const })); } },
+    ledger: l,
+    now: () => new Date('2026-11-08T00:00:00Z'),
+  });
+}
+
+const step = (report: OrganizationOwnershipApplyReport) => report.steps.find((s) => s.step === 'not-null')!;
+const certified = (report: OrganizationOwnershipApplyReport): boolean => report.complete && report.blocking === 0;
+
+beforeEach(async () => {
+  dir = mkdtempSync(join(tmpdir(), 'os-d10-not-null-resume-'));
+  file = join(dir, 'db.sqlite');
+  rebuilt = [];
+  driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: file }, useNullAsDefault: true });
+  (driver as any).logger = { warn: () => {}, info: () => {}, error: () => {}, debug: () => {} };
+  await driver.initObjects(
+    TABLES.map((name) => ({
+      name,
+      fields: { name: { type: 'text' }, organization_id: { type: 'lookup', reference: 'sys_organization', required: false } },
+    })) as never,
+  );
+  // The tables an earlier release built: their tenant column nullable, which a
+  // table this release creates never is (ADR-0131 D1). Relaxed through the
+  // driver's own drift apply door, the shape of that store.
+  for (const table of TABLES) {
+    const { applied } = await driver.applyMigrationEntries([
+      {
+        kind: 'nullability_mismatch', remoteName: table, table, column: 'organization_id', category: 'needs_confirm',
+        op: { type: 'relax_not_null', table, column: 'organization_id' },
+      } as never,
+    ]);
+    if (applied.length !== 1) throw new Error(`${table} was not returned to its pre-18 shape`);
+  }
+  db = new Database(file);
+  db.exec(`
+    CREATE TABLE sys_organization (id TEXT PRIMARY KEY, slug TEXT);
+    INSERT INTO sys_organization VALUES ('${ORG}', 'default');
+    INSERT INTO crm_deal (id, name, organization_id) VALUES ('deal_1', 'Acme', '${ORG}');
+    INSERT INTO crm_note (id, name, organization_id) VALUES ('note_1', 'Call back', '${ORG}');
+    INSERT INTO crm_task (id, name, organization_id) VALUES ('task_1', 'Send quote', '${ORG}');
+  `);
+  for (const table of TABLES) expect(isNotNull(table)).toBe(false);
+});
+
+afterEach(async () => {
+  db.close();
+  await driver.disconnect?.();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('the not-null step on a resumed ceremony', () => {
+  it('⭐ (1) certified with tables not-declared, re-run under a composition that declares them: they receive NOT NULL', async () => {
+    const l = ledger();
+    const first = await apply(l, schemaDoor(new Set(['crm_deal'])));
+    expect(step(first)).toMatchObject({ status: 'done', summary: { due: 3, applied: 1, notDeclared: 2 } });
+    expect(step(first).notes.filter((n) => /re-run the ceremony where the deployment's composition is declared/.test(n))).toHaveLength(2);
+    expect(certified(first)).toBe(true);
+    expect(TABLES.map(isNotNull)).toEqual([true, false, false]);
+
+    const again = await apply(l, schemaDoor(new Set(TABLES)));
+    expect(step(again)).toMatchObject({ status: 'done', summary: { due: 3, applied: 2, alreadyNotNull: 1, notDeclared: 0 } });
+    expect(TABLES.map(isNotNull)).toEqual([true, true, true]);
+    // The table tightened by the first run is not rebuilt again.
+    expect(rebuilt).toEqual(['crm_deal', 'crm_note', 'crm_task']);
+    expect(l.stored()!.completed['not-null']!.summary).toMatchObject({ applied: 2, alreadyNotNull: 1, notDeclared: 0 });
+    expect(certified(again)).toBe(true);
+  });
+
+  it('⭐ (2) the walled recovery path — apply, fix the held rows, plan, apply — ends with NOT NULL on the fixed table', async () => {
+    db.exec(`INSERT INTO crm_note (id, name, organization_id) VALUES ('note_orphan', 'nobody', NULL)`);
+    const l = ledger();
+    const door = schemaDoor(new Set(TABLES));
+    const first = await apply(l, door, 'isolated');
+    expect(step(first)).toMatchObject({ status: 'done', summary: { due: 2, applied: 2 } });
+    expect(TABLES.map(isNotNull)).toEqual([true, false, true]);
+    // The held row stops certification, and names the remedy: resolve it by hand, re-run --apply.
+    expect(certified(first)).toBe(false);
+    expect(first.tables.find((t) => t.object === 'crm_note')!.held).toMatchObject({ rows: 1 });
+
+    db.exec(`UPDATE crm_note SET organization_id = '${ORG}' WHERE id = 'note_orphan'`);
+    const plan = await buildOrganizationOwnershipPlan({ reader: executor(), posture: 'isolated', database: file });
+    expect(plan.tables.find((t) => t.object === 'crm_note')!.notNull.willReceive).toBe(true);
+
+    const again = await apply(l, door, 'isolated');
+    expect(step(again)).toMatchObject({ status: 'done', summary: { due: 3, applied: 1, alreadyNotNull: 2 } });
+    expect(TABLES.map(isNotNull)).toEqual([true, true, true]);
+    expect(certified(again)).toBe(true);
+  });
+
+  it('(3) control — a first run with nothing pending checkpoints as before; its re-run stays checkpointed and rebuilds nothing', async () => {
+    const l = ledger();
+    const door = schemaDoor(new Set(TABLES));
+    const first = await apply(l, door);
+    const summary = { applied: 3, alreadyNotNull: 0, due: 3, notDeclared: 0, unsupported: 0 };
+    expect(step(first)).toEqual({ step: 'not-null', status: 'done', summary, blockers: [], notes: [] });
+    expect(l.stored()!.completed['not-null']).toEqual({ at: '2026-11-08T00:00:00.000Z', summary });
+    expect(certified(first)).toBe(true);
+    expect(rebuilt).toEqual([...TABLES]);
+
+    const again = await apply(l, door);
+    expect(step(again)).toEqual({ step: 'not-null', status: 'checkpointed', summary, blockers: [], notes: [] });
+    expect(l.stored()!.completed['not-null']).toEqual({ at: '2026-11-08T00:00:00.000Z', summary });
+    expect(rebuilt).toEqual([...TABLES]);
+    expect(certified(again)).toBe(true);
+  });
+
+  it('(4) a re-run whose NOT NULL fails blocks and does not certify, as the same failure does on a first run', async () => {
+    const l = ledger();
+    await apply(l, schemaDoor(new Set(['crm_deal'])));
+    const again = await apply(l, schemaDoor(new Set(TABLES), { failOn: 'crm_task' }));
+    expect(step(again)).toMatchObject({ status: 'blocked', blockers: [expect.stringMatching(/NOT NULL on crm_task\.organization_id failed: SQLITE_BUSY/)] });
+    expect(TABLES.map(isNotNull)).toEqual([true, true, false]);
+    expect(certified(again)).toBe(false);
+    expect(l.stored()!.completed['not-null']).toBeUndefined();
+  });
+});
@@ -182,11 +182,14 @@ import type { DeclaredSharingRuleSkip } from '@objectstack/plugin-sharing';
  * empty, a delete selects only mirrors — so a second run writes nothing the
  * first one wrote. On top of that, each step that finishes is recorded in the
  * ceremony's checkpoint ({@link CeremonyLedgerPort}) and is not run again: a
- * run interrupted inside step N resumes at step N. Two steps run again when
- * checkpointed: `history-renumber` (below), and `attribution` whenever the
+ * run interrupted inside step N resumes at step N. Steps that run again when
+ * checkpointed include `history-renumber` (below); `attribution` whenever the
  * plan derives an owner for rows still NULL — a row the operator made
  * attributable since, or one an earlier run found no Default Organization
- * for. A step that stops on a
+ * for; and `not-null` whenever the run has a schema door, so a table it left
+ * nullable (not declared by that run's composition, or held by a NULL row
+ * since resolved) receives NOT NULL, while a column already NOT NULL is never
+ * rebuilt. A step that stops on a
  * blocker stops the ceremony there — fate order is the contract — and the
  * report names the blocker and its remedy.
  *
@@ -4154,6 +4157,33 @@ export async function applyOrganizationOwnership(opts: ApplyOptions): Promise<Or
       run.columns.clear();
       continue;
     }
+    // `not-null` runs again even when checkpointed, whenever the run has a
+    // schema door: a table the step left nullable — the composition an earlier
+    // run booted declared no object for it (`not-declared`), or a NULL row held
+    // it until the operator resolved it by hand — receives NOT NULL on the
+    // re-run each of those advice lines names. The door answers
+    // `already-not-null` for a column an earlier run tightened, so a run with
+    // nothing left to tighten stays `checkpointed`, exactly as before; one
+    // whose NOT NULL fails is no longer recorded as done, as on a first run.
+    if (done && step === 'not-null' && opts.notNull) {
+      const again = await RUNNERS[step](run);
+      if (again.status !== 'done') {
+        steps.push(again);
+        delete checkpoint.completed[step];
+        await opts.ledger.write(checkpoint, { complete: false, blocking: 0, advisory: 0 });
+        stopped = true;
+        continue;
+      }
+      if (Number(again.summary.applied ?? 0) > 0) {
+        steps.push(again);
+        checkpoint.completed[step] = { at: now().toISOString(), summary: again.summary };
+        await opts.ledger.write(checkpoint, { complete: false, blocking: 0, advisory: 0 });
+        run.columns.clear();
+        continue;
+      }
+      steps.push({ step, status: 'checkpointed', summary: done.summary, blockers: [], notes: again.notes });
+      continue;
+    }
     if (done) {
       // `history-renumber` runs again even when checkpointed: it is
       // idempotent, and an environment write made since the earlier run must
 
@@ -158,6 +158,28 @@ describe('organization_id NOT NULL through the drift apply door', () => {
     expect(attempted).toBe(0);
   });
 
+  it('⭐ a declared table an earlier run tightened is already-not-null, never rebuilt again', async () => {
+    const target = {
+      isDeclared: (t: string) => t === 'crm_deal',
+      isNotNull: async (table: string, column: string) => !(await nullable(table, column)),
+      driverFor: () => driver as never,
+    };
+    expect(await applyNotNullThroughDrift(target, [{ table: 'crm_deal', column: 'organization_id' }])).toEqual([
+      { table: 'crm_deal', column: 'organization_id', outcome: 'applied' },
+    ]);
+    let attempted = 0;
+    const outcomes = await applyNotNullThroughDrift(
+      {
+        ...target,
+        driverFor: () => ({ applyMigrationEntries: async () => { attempted++; return { applied: [], skipped: [] }; } }) as never,
+      },
+      [{ table: 'crm_deal', column: 'organization_id' }],
+    );
+    expect(outcomes).toEqual([{ table: 'crm_deal', column: 'organization_id', outcome: 'already-not-null' }]);
+    expect(attempted).toBe(0);
+    expect(await nullable('crm_deal', 'organization_id')).toBe(false);
+  });
+
   it('no driver for the table\'s database fails, naming the database', async () => {
     const [outcome] = await applyNotNullThroughDrift(
       { isDeclared: () => true, driverFor: () => undefined },