Merge remote-tracking branch 'origin/claude/issue-24583-7b0-tenant-not-null-ddl' into claude/issue-24583-7b12-index-plain-form

# Conflicts:
#	packages/drivers/driver-sql/src/sql-driver-tenant-scope-read-doors.test.ts
#	packages/drivers/driver-sql/src/sql-driver-tenant-scope.test.ts

Author: claude

packages/cli/src/commands/migrate/data-commands.absent-database.integration.test.ts

@@ -146,7 +146,9 @@ for (const plugin of stack.plugins) await kernel.use(plugin);
 await kernel.use(new PlatformObjectsPlugin());
 await runtime.start();
 const ql = kernel.getService('objectql');
-const SYSTEM = { context: { isSystem: true } };
+// The fixture's rows name an organization: a fresh tenant column is NOT NULL
+// (ADR-0131 D1), and this stack composes no authentication to derive one.
+const SYSTEM = { context: { isSystem: true, tenantId: 'org_fixture' } };
 await ql.insert('sys_metadata_history', {
   id: 'h_21529', event_seq: 1, name: 'os21529_note', type: 'object', version: 1,
   operation_type: 'create', recorded_by: 'system', recorded_at: new Date().toISOString(),
@@ -405,7 +407,9 @@ await kernel.use(new SettingsServicePlugin({
 await kernel.use(new StorageServicePlugin({ registerRoutes: false }));
 await runtime.start();
 const ql = kernel.getService('objectql');
-const SYSTEM = { context: { isSystem: true } };
+// The fixture's rows name an organization: a fresh tenant column is NOT NULL
+// (ADR-0131 D1), and this stack composes no authentication to derive one.
+const SYSTEM = { context: { isSystem: true, tenantId: 'org_fixture' } };
 await ql.insert('sys_metadata', {
   type: 'object', name: 'os21552_note', state: 'active',
   metadata: JSON.stringify({ name: 'os21552_note', fields: { title: { type: 'text' } } }),
@@ -414,6 +418,8 @@ await kernel.shutdown();
 
 const raw = new SqlDriver({ client: 'better-sqlite3', connection: { filename: process.env.FIXTURE_DB }, useNullAsDefault: true });
 const k = raw.knex;
+// Rows planted below the writer name the fixture's organization: every table
+// this release created has a NOT NULL tenant column (ADR-0131 D1).
 await k.raw('CREATE TABLE sys_account (id text primary key, provider_id text, account_id text, issuer text, user_id text)');
 await k('sys_account').insert([
   { id: 'acc_1', provider_id: 'github', account_id: 'g-1', issuer: 'github', user_id: 'u1' },
@@ -429,7 +435,7 @@ await k('sys_audit_log').insert({
 const shard = (await k.raw("select name from sqlite_master where type = 'table' and name glob 'sys_activity__r*'"))[0];
 if (!shard) throw new Error('the control has no sys_activity shard: the rotation did not run');
 await k(shard.name).insert({
-  id: 'act_21552', timestamp: new Date().toISOString(), type: 'create', summary: 'created', object_name: 'sys_metadata', record_id: 'm_21552',
+  organization_id: 'org_fixture', id: 'act_21552', timestamp: new Date().toISOString(), type: 'create', summary: 'created', object_name: 'sys_metadata', record_id: 'm_21552',
   metadata: JSON.stringify({
     old: null,
     new: {
@@ -446,23 +452,23 @@ await k('sys_audit_log').insert({
   new_value: JSON.stringify({ id: 'em_24693', subject: 's', body_text: 'mail-body-sentinel-24693', body_html: null }),
 });
 await k(shard.name).insert({
-  id: 'act_24693', timestamp: new Date().toISOString(), type: 'create', summary: 'created', object_name: 'sys_email', record_id: 'em_24693',
+  organization_id: 'org_fixture', id: 'act_24693', timestamp: new Date().toISOString(), type: 'create', summary: 'created', object_name: 'sys_email', record_id: 'em_24693',
   changed_fields: '[]',
   metadata: JSON.stringify({ old: null, new: { id: 'em_24693', subject: 's', body_text: 'mail-body-sentinel-24693', body_html: null } }),
 });
 await k('sys_comment').insert({
-  id: 'cmt_23857', thread_id: 'sys_metadata:m_21552', body: 'planted below the writer', author_id: 'u1',
+  organization_id: 'org_fixture', id: 'cmt_23857', thread_id: 'sys_metadata:m_21552', body: 'planted below the writer', author_id: 'u1',
   created_at: new Date().toISOString(),
 });
 await k('sys_secret').insert({
   id: 'sec_21552', namespace: 'os21552', key: 'orphan', kms_key_id: 'local', alg: 'aes-256-gcm', version: 1, ciphertext: 'not-a-real-ciphertext',
 });
 await k('sys_file').insert({
-  id: 'file_21552', key: 'attachments/os21552.txt', name: 'os21552.txt', size: 12, scope: 'attachments', status: 'committed',
+  organization_id: 'org_fixture', id: 'file_21552', key: 'attachments/os21552.txt', name: 'os21552.txt', size: 12, scope: 'attachments', status: 'committed',
 });
 // A retired field's column: in the table, in no metadata, holding a value.
 await k.raw('ALTER TABLE os21529_contact ADD COLUMN legacy_note text');
-await k('os21529_contact').insert({ id: 'con_21573', name: 'Ann', legacy_note: 'kept-21573' });
+await k('os21529_contact').insert({ id: 'con_21573', name: 'Ann', legacy_note: 'kept-21573', organization_id: 'org_fixture' });
 await raw.disconnect();
 process.stderr.write('[fixture] seeded\\n');
 process.exit(0);

packages/cli/src/commands/migrate/object-scope.integration.test.ts

@@ -109,7 +109,9 @@ for (const plugin of stack.plugins) await kernel.use(plugin);
 await kernel.use(new PlatformObjectsPlugin());
 await runtime.start();
 const ql = kernel.getService('objectql');
-const SYSTEM = { context: { isSystem: true } };
+// The fixture's rows name an organization: a fresh tenant column is NOT NULL
+// (ADR-0131 D1), and this stack composes no authentication to derive one.
+const SYSTEM = { context: { isSystem: true, tenantId: 'org_fixture' } };
 await ql.insert('os21644_account', { id: 'a1', name: 'Acme' }, SYSTEM);
 await ql.insert('os21644_site', { id: 's1', name: 'HQ', geo: { lat: 1, lng: 2 } }, SYSTEM);
 await ql.insert('os21644_product', { id: 'p1', name: 'Widget' }, SYSTEM);

packages/cli/src/commands/migrate/organization-ownership.declared-rule-mirrors.integration.test.ts

@@ -56,6 +56,7 @@ import { DECLARED_SHARING_RULE_SEEDER_RUNS } from '../../utils/organization-owne
 // through dynamic `import()`s at MODULE LOAD, not inside a clocked case.
 import '@objectstack/objectql';
 import '@objectstack/metadata-protocol';
+import { relaxTenantColumnsOnFile } from '../../utils/pre-18-store.testkit.js';
 
 type Command = (typeof import('./organization-ownership.js'))['default'];
 let MigrateOrganizationOwnership: Command;
@@ -173,6 +174,10 @@ describe('os migrate organization-ownership on a database whose packages declare
       await stack.stop();
     }
     seeded = sql('SELECT name, managed_by, customized, organization_id FROM sys_sharing_rule ORDER BY name');
+    // The rows planted below are an earlier release's, organization-less: its
+    // tenant columns were nullable, which a table this release creates never is
+    // (ADR-0131 D1). The file is relaxed to that release's shape first.
+    await relaxTenantColumnsOnFile(file);
 
     // What a 17.x runtime left beside it.
     const [{ id: organization }] = sql(`SELECT id FROM sys_organization WHERE slug = 'default'`) as Array<{ id: string }>;

packages/cli/src/commands/migrate/organization-ownership.no-organization.integration.test.ts

@@ -60,6 +60,7 @@ import { isExitSignal } from '../../utils/format.js';
 import '@objectstack/objectql';
 import '@objectstack/metadata-protocol';
 import '@objectstack/plugin-auth';
+import { relaxTenantColumnsOnFile } from '../../utils/pre-18-store.testkit.js';
 
 type Command = (typeof import('./organization-ownership.js'))['default'];
 let MigrateOrganizationOwnership: Command;
@@ -168,6 +169,10 @@ describe('os migrate organization-ownership on a single-posture database that ho
 
     const stack = await bootStack(stackConfig(), { databaseFile: file });
     await stack.stop();
+    // The rows planted below are an earlier release's, organization-less: its
+    // tenant columns were nullable, which a table this release creates never is
+    // (ADR-0131 D1). The file is relaxed to that release's shape first.
+    await relaxTenantColumnsOnFile(file);
     expect(sql('SELECT COUNT(*) AS n FROM crm_event')).toEqual([{ n: SUBJECTS.length }]);
 
     // What a 17.x install whose seed ran before any organization existed left.

packages/cli/src/commands/migrate/unmapped-columns.integration.test.ts

@@ -122,7 +122,9 @@ const kernel = runtime.getKernel();
 for (const plugin of stack.plugins) await kernel.use(plugin);
 await runtime.start();
 const ql = kernel.getService('objectql');
-const SYSTEM = { context: { isSystem: true } };
+// The fixture's rows name an organization: a fresh tenant column is NOT NULL
+// (ADR-0131 D1), and this stack composes no authentication to derive one.
+const SYSTEM = { context: { isSystem: true, tenantId: 'org_fixture' } };
 await ql.insert('um_contact', { id: 'c1', name: 'Ann', mailing_street: '1 Retired Way', mailing_city: 'Oldtown' }, SYSTEM);
 await ql.insert('um_contact', { id: 'c2', name: 'Bob', mailing_street: '2 Retired Way', mailing_city: 'Newtown' }, SYSTEM);
 await ql.insert('um_contact', { id: 'c3', name: 'Cy' }, SYSTEM);

packages/cli/src/commands/secret/orphans.driver-contract.test.ts

@@ -151,7 +151,8 @@ describe('os secret orphans — the concrete driver behind both reads (#14843)',
     }
 
     await secretDriver.create('sys_secret', { ...SEEDED_SECRET });
-    await settingDriver.create('sys_setting', { ...SEEDED_SETTING });
+    // The row names an organization: a fresh tenant column is NOT NULL (ADR-0131 D1).
+    await settingDriver.create('sys_setting', { ...SEEDED_SETTING, organization_id: 'org_fixture' });
   }, 180_000);
 
   afterAll(async () => {

packages/cli/src/commands/secret/rewrap.driver-contract.test.ts

@@ -117,7 +117,8 @@ describe('os secret rewrap — the concrete driver and the command, end to end (
     for (const row of [SETTINGS_ROW, DATASOURCE_ROW, ORPHAN_ROW, PROBE_ROW]) {
       await secretDriver.create('sys_secret', { ...row });
     }
-    await settingDriver.create('sys_setting', { namespace: 'smtp', key: 'password', value_enc: SETTINGS_ROW.id });
+    // The row names an organization: a fresh tenant column is NOT NULL (ADR-0131 D1).
+    await settingDriver.create('sys_setting', { namespace: 'smtp', key: 'password', value_enc: SETTINGS_ROW.id, organization_id: 'org_fixture' });
     writeFileSync(declaredFile, JSON.stringify([
       { name: 'warehouse', external: { credentialsRef: `sys_secret:${String(DATASOURCE_ROW.id)}` } },
     ]));

packages/cli/src/utils/organization-ownership-not-null.test.ts

@@ -33,6 +33,16 @@ beforeEach(async () => {
   await driver.initObjects([
     { name: 'crm_deal', fields: { name: { type: 'text' }, organization_id: { type: 'lookup', reference: 'sys_organization', required: false } } },
   ] as never);
+  // The ceremony tightens a table an earlier release built: its tenant column
+  // is nullable, which a table this release creates never is (ADR-0131 D1).
+  // Relaxed through the driver's own drift apply door, the shape of that store.
+  const { applied } = await driver.applyMigrationEntries([
+    {
+      kind: 'nullability_mismatch', remoteName: 'crm_deal', table: 'crm_deal', column: 'organization_id', category: 'needs_confirm',
+      op: { type: 'relax_not_null', table: 'crm_deal', column: 'organization_id' },
+    } as never,
+  ]);
+  if (applied.length !== 1) throw new Error('crm_deal was not returned to its pre-18 shape');
   await knex('crm_deal').insert([
     { id: 'deal_1', name: 'Acme', organization_id: 'org_default' },
     { id: 'deal_2', name: 'Globex', organization_id: 'org_default' },

packages/cli/src/utils/organization-ownership-platform-global-column-drop.integration.test.ts

@@ -73,6 +73,7 @@ import MigrateOrganizationOwnership from '../commands/migrate/organization-owner
 import '@objectstack/runtime';
 import '@objectstack/objectql';
 import { PlatformObjectsPlugin } from '@objectstack/platform-objects/plugin';
+import { relaxTenantColumnsOnFile } from './pre-18-store.testkit.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const CLI_ROOT = resolve(HERE, '..', '..');
@@ -368,6 +369,9 @@ beforeAll(async () => {
 
   templateDb = join(dir, 'template.db');
   await bootV17(templateDb);
+  // A v17 database's tenant columns are nullable, which a table this release
+  // creates never is (ADR-0131 D1): the template is relaxed to that shape first.
+  await relaxTenantColumnsOnFile(templateDb);
   const db = new Database(templateDb);
   try {
     for (const table of HOST_OBJECTS) {

packages/cli/src/utils/pre-18-store.testkit.ts

@@ -0,0 +1,38 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Return a SQLite file this release built to the shape an EARLIER release's
+ * database has: every tenant column (`organization_id`) nullable.
+ *
+ * ADR-0131 D1: since 18.x the SQL driver creates a table's tenant column NOT
+ * NULL. A v17 or 18.0 database still holds the nullable column, and the
+ * organization-ownership ceremony is what tightens it. A suite that boots this
+ * release over a file and then plants that earlier release's organization-less
+ * rows calls this between the two, so the file is the store the ceremony
+ * meets. Each column is relaxed through the driver's own drift apply door
+ * (`relax_not_null`, the SQLite table rebuild), never a hand `ALTER`.
+ */
+export async function relaxTenantColumnsOnFile(file: string, column = 'organization_id'): Promise<string[]> {
+  // A dynamic import: this file lives under `src/`, where a static driver import
+  // is refused (`schema-migrate.lazy-driver-import.test.ts`).
+  const { SqlDriver } = await import('@objectstack/driver-sql');
+  const driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: file }, useNullAsDefault: true });
+  const relaxed: string[] = [];
+  try {
+    const knex = (driver as any).knex;
+    const tables = (await knex.raw(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'`)) as Array<{ name: string }>;
+    for (const { name } of tables) {
+      const info = (await knex.raw(`SELECT name, "notnull" AS nn FROM pragma_table_info(?)`, [name])) as Array<{ name: string; nn: number }>;
+      if (!info.some((c) => c.name === column && Number(c.nn) === 1)) continue;
+      const op = { type: 'relax_not_null', table: name, column };
+      const { applied } = await driver.applyMigrationEntries([
+        { kind: 'nullability_mismatch', remoteName: name, table: name, column, category: 'needs_confirm', op } as never,
+      ]);
+      if (applied.length !== 1) throw new Error(`relaxTenantColumnsOnFile: ${name}.${column} was not relaxed`);
+      relaxed.push(name);
+    }
+  } finally {
+    await driver.disconnect();
+  }
+  return relaxed;
+}