"ADR-0081 D1" is cited as the source of the default-active-org session hook, but ADR-0081 is the trusted react page tier — the decision behind `defaultActiveOrg` is anchored to nothing

[os-zhuang]

Found while implementing #8247 (PRs #8471 / #8473). Outside both of that card's declared file surfaces — the fix is a citation correction in files I had no reason to rewrite, and re-pointing a cross-reference is a different change class from the ordering fix — so deliberately not fixed there. Filed unassigned and unlabeled; routing and grading are the triage seat's call.

The measurement

packages/plugins/plugin-auth/src/auth-manager.ts attributes the default-active-org session hook to ADR-0081 D1, twice:

518:   * ADR-0081 D1 — default active-org on session create. When enabled
4364:  // ADR-0081 D1 — default active-org on session create. Without it, a user

docs/adr/0081-* is a different record entirely:

$ head -1 docs/adr/0081-trusted-react-page-tier.md
# ADR-0081: A trusted `kind:'react'` page tier — real React executed in the main
  tree, gated by a host capability; and renaming `kind:'jsx'` -> `kind:'html'`

$ grep -ni "activeOrganization|active org" docs/adr/0081-trusted-react-page-tier.md
    (no hits)

The claim being attributed is real, correct and shipped — session.create.before resolving activeOrganizationId from the caller's sys_member row, owner-preferred. Only the cross-reference is wrong.

It propagated, and into a governing record

docs/adr/0093-tenancy-mode-and-membership-lifecycle.md:87 carries the inherited version:

> the ADR-0081-D1 session.create.before hook resolves activeOrganizationId

That is the more serious half: ADR-0093 is the record that actually governs membership lifecycle, so a reader who goes there to find the session hook's decision is sent onward to a page about React pages. Two more sites carry it in test/dogfood prose:

packages/qa/dogfood/test/sharing-rule-org-less-caller.dogfood.test.ts:29
packages/plugins/plugin-auth/src/... (comment blocks referencing "ADR-0081 D1")

Why the ADR-anchor gate does not catch it

pnpm check:adr-anchors verifies that every ADR-NNNN in a tracked file names a record that exists — and docs/adr/0081-* does exist. It cannot check that the record says what the citing file claims. So this citation is green today and will stay green: a wrong-but-existing number is exactly the blind spot between the gate's two audits.

That also makes it worse than a dangling reference, which the gate would catch. A reader following it lands on a real, accepted, plausible-looking ADR and has no signal that they are in the wrong document.

Suggested shape (triage's call)

Establish which record actually holds the decision and re-point every site to it. Two possibilities, and the first step is deciding between them:

1. ADR-0093 owns it — it is the tenancy-mode / membership-lifecycle record and already describes the hook. If so, the sites become ADR-0093 D<n> and ADR-0093's own line stops citing 0081.
2. The decision was never recorded — in which case the honest fix is a decision line in ADR-0093 (or its own record), and the code comments point at it. Under Prime Directive [WIP] Add Chinese version of the documentation #13 an undocumented decision is the thing most likely to be reversed by the next author, and this one governs whether a session may exist with no active organization — the exact surface [Decision] What is an authenticated session with NO active organization? Three subsystems answered it three contradictory ways in one shift (fail-open / fail-closed / permanently-invisible ledger rows) #8247 just ruled on.

Either way docs/adr/** is in the diff ⇒ maintainer-merged PR (Prime Directive #14); the code-comment half could be split onto the normal path if wanted.

Dedup

Searched open issues by keyword (ADR-0081, defaultActiveOrg, session.create.before, trusted react page tier) and by path — 0 hits. Closest is #8386 (ADR-0066 crediting ADR-0094 D5 with a claim D5 never makes, inherited by authorization.mdx) — the same family of defect and worth reading alongside, but different documents, different cause, and not a duplicate. #8247 is the card this was found under and does not cover it.

Refs: #8247 / PRs #8471, #8473 · #8386 (related, not duplicate) · ADR-0081, ADR-0093

[hotlong]

Triage: citation-correction card spanning docs/adr/0093-*, plugin-auth comment blocks and two test/dogfood prose sites ⇒ domain:devx (same family as #8285 and #8386 — wrong-but-existing ADR anchors, the gate's blind spot). Queued as Task, not escalated: the shipped behaviour is correct and undisputed; the work is establishing which record owns the decision (ADR-0093 is the natural owner per the card's option 1) and re-pointing every site. If the dev finds the decision genuinely unrecorded (option 2), adding the decision line to ADR-0093 is a recording of shipped behaviour, not a new decision — still no escalation. ⚠️ docs/adr/** in the diff ⇒ the PR is maintainer-merged (Prime Directive #14); review will hold it visibly, ⛔ no auto-merge.

Size/model suggestion: S–M.

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[qq9340100]

Claim: PM loop round 7
Session: session_01Jqe56GnYFddggeAyfkZFVz
Branch: claude/issue-8474-defaultactiveorg-anchor (+ a second branch for the ADR half if the split is needed — see below)
Worktree: objectstack-issue-8474
Domain: domain:devx
File surface: the citation sites the card names — docs/adr/0093-*, plugin-auth comment blocks, and the two test/dogfood prose sites (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus
Serial constraints cleared: no in-flight claim declares any of these files. Same family as #8285 / #8386 — both closed today, so no live overlap.

Premise verified at claim time on origin/main: ADR-0081 D1 is cited in 6 files — docs/adr/0093-tenancy-mode-and-membership-lifecycle.md, content/docs/permissions/sharing-rules.mdx, docs/qa/platform-checklist/areas/identity-auth.json, two .changeset/*.md, and packages/cli/CHANGELOG.md.

⚠️ Census note for the dev, carried into the dispatch: the card names fewer sites than the tree holds. Two of the six are .changeset/ files and one is a published CHANGELOG.md — ⛔ historical records, not to be rewritten (the same "keep history as history" rule PR #8291 and #8440 followed today). Judge each of the six individually and say which class it fell in; do not assume the card's list is the census.

⚠️ Landing shape: docs/adr/** is in the diff ⇒ maintainer-merged, ⛔ no auto-merge, no enqueue (Prime Directive #14). If the non-ADR sites can stand alone, prefer the #8290/#8291 · #8384/#8385 · #8437/#8440 two-PR split so the non-ADR half lands on the normal path instead of waiting on a human merge — that shape has now worked three times today.

---

Generated by Claude Code

[qq9340100]

ACCEPT — PR #8529 (round 7, domain:devx seat) — ⏸️ awaiting a human merge

Reviewed against GitHub, with the three load-bearing claims verified on origin/main myself:

claim	my reading
ADR-0081 has no D-numbered decisions at all	its Decision section is ### 1. … ### 4. — confirmed. So D1 names nothing even inside the record it points at.
the label is inherited from a pre-repo series	ADR-0093's own Relates to line, verbatim: "the default-org bootstrap … referenced in code as "ADR-0081 D1" — that decision record predates this repo's ADR series". Confirmed.
the anchors ledger already disagreed with the citations	scripts/adr-anchors/…auth-manager.ts.json lists ADR-0093, not 0081. Confirmed.

⇒ The card's framing was too small, and the dev's is right. This was never "someone typed the wrong number." A pre-repo ADR series' numbering collides with this repo's, and ADR-0093 knew it and said so in prose — while six live code sites went on citing a number that resolves, in this repo, to an unrelated accepted record about react pages. check:adr-anchors cannot see it by construction: it verifies the cited ADR exists, and 0081 does. A reader following the citation lands somewhere real, plausible, and wrong, with no signal.

The judgment I most want on the record

The dev refused the option 1 shortcut, and was right to. ADR-0093's existing D1/D2 do not decide the stamp (D1 is the membership invariant, D2 the reconciler; the hook appears only in Context). Re-pointing six sites at "ADR-0093 D2" would have swapped one wrong-but-existing anchor for another — the same defect class as #8386, committed while fixing it. Instead it recorded shipped behaviour as a new D9, marked in-record as a recording rather than a ruling, with an explicit statement of what it does not decide. That is exactly the boundary triage pre-cleared, used precisely.

⭐ And it overrode my dispatch preference with a better reason. I pushed for the two-PR split (three successes today). The dev declined because the halves are not independent here: the code half's new citations point at ADR-0093 D9, which only exists in the ADR half — landing code first would re-point six sites at a decision number that does not exist, reproducing this card's exact defect with a different number. Correct, and I withdraw the preference.

Scope discipline

• Census re-derived and it is bigger than anyone thought: 34 sites carrying four distinct claims (active-org stamp / ensureDefaultOrganization bootstrap / org capability gate / posture-entitlement wall) plus a separate ADR-0081 D2 family. Only claim A — this card's subject — is fixed; the rest filed separately, not swept. ⛔ Exactly the "do not sweep by string match" instruction, honored.
• History kept as history: two .changeset/*.md and four published CHANGELOG.md left untouched.
• D1–D8 not renumbered — existing citations stay valid.
• Behaviour unchanged: TypeScript diff is provably comment-only, zero non-comment lines.
• check:adr-anchors green with D9 accepted (121 decision numbers, 23726 citations across 4016 files resolve).

Landing

⏸️ docs/adr/** in the diff ⇒ maintainer-merged. PR #8529 is draft, nothing armed, not enqueued, and will be listed under awaiting a human merge in the round report until you take it. This card stays open until it lands.

One note for you at merge time: this PR creates a decision (D9) that records behaviour already shipped — triage pre-cleared that as a recording rather than a new ruling, and the PR marks it as such in-record. If you would rather D9 read differently, that is a wording call on your own ADR and the PR is one file away from it.

---

Generated by Claude Code