A `sys_audit_log` write refused by the system-write organization rule is swallowed by plugin-audit's best-effort catch, so the audit row about a defective record is LOST silently — surfaced by #13636's admission

[os-musk]

Filed unassigned and ungraded by the domain:engine execution seat, carrying an open question #13636's dev raised and deliberately did not implement. ⛔ domain:*, priority and type are triage's. The fix面 is plugin-audit, which is the domain:services lane — ⛔ never repaired from this lane.

Filed as a card, not left in a dispatch report, because a cross-seat request that lives only in a report is invisible to that lane's candidate query, sweep and ageing alarms.

How it surfaced

PR #14923 (#13636) admits sys_audit_log into the #8844 derive-or-refuse machinery under the new conditional verdict. Admission makes the object stricter, which is the ruled intent. Its writers now declare their legitimately org-less cases explicitly.

One population is deliberately left undeclared, and that is correct on the merits: case 2 of audit-writers.ts's own enumeration — an audit row whose subject has an organization column whose value is NULL, written under a system context on a walled install. It is left to refuse because at that call site it is indistinguishable from the missing-stamp defect; #9516 was exactly that bug, on those exact lines.

The consequence, which is the actual subject of this card

That refusal (SystemWriteOrganizationRequiredError) lands inside plugin-audit's best-effort swallow-and-report catch.

⇒ ⭐ The outcome is a lost audit row, not a visible failure — and the row that is lost is precisely the audit record about a defective row. The control gets sharper and the evidence disappears at the same moment.

⚠️ Not speculative: reachable today on any walled install holding a record whose organization column is NULL.

Three directions, as the dev costed them

• A — leave it refusing (what PR feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923 ships). design: isSystem 写入是否在租户审计控制范围内?——#13178 类级装置(A/B/C)的共同前置,从未被裁过 #13491's execution point 3 says what is added can only be a refusal or a warning, and a NULL organization column on a walled install is itself the defect class that ruling exists to find. Cost: the audit row is silently lost, because the refusal is swallowed.
• B — adjudicate case 2 as legitimate and declare it. Restores today's behaviour exactly for those rows. Cost: indistinguishable at the call site from the missing-stamp defect, so it hands the platform's largest write population back the blindness design: a THIRD tenancy state the 批 #9 re-ruling cannot express — objects that are CONDITIONALLY tenant-scoped, where org-less is a property of the ROW, not the object #13636 removed.
• C — keep the refusal, stop it being silent. Make a SystemWriteOrganizationRequiredError on an audit write report through the durability-degradation channel plugin-audit already owns — persistAuditTrailRow is registered in DURABILITY_CRITICAL_CALLEES for exactly this class of loss — rather than being caught as an ordinary write failure.

四棱分析(维护者裁决用)

• 实际业务需求 —— ⭐ 拉动是实测的:case 2 在任何 walled 安装上、只要存在 organization 列为 NULL 的记录就可达,不是构造出来的边角。丢的还偏偏是关于那条缺陷记录的审计行,即最该留下的那一条。
• 项目长远合理性 —— ⭐ A 与 B 是在同两个好处之间对换:A 保住控制的锐度、静默丢行;B 保住行、致盲控制。C 拒绝承认这个交换是被迫的 —— A 的损失并非由拒绝造成,而是由拒绝不可见造成,而 plugin-audit 早已持有让这类丢失变响的通道。
• 防 AI 写代码犯错 —— ⭐ 本棱指向 C:C 让申报词表保持封闭,任何未来的写入方都无法伸手拿一个 case-2 理由去安抚一条它没读懂的拒绝。B 恰恰相反 —— 它新开一个最容易被误用的申报理由。
• 创业阶段不扩散需求 —— C 不新增能力、不新增面,只是在一条已经在上报的路径上改日志级别/通道。B 才是扩大接受集。

⚠️ 四棱同向指向 C,但 C 改的是 p1 security 路径上的失败上报行为,⇒ 仍应走独立评审卡,⛔ 不适合作为 #13636 的搭车修改 —— 这也正是该 dev ⛔ 未实施的理由。

Re-check

git grep -n "DURABILITY_CRITICAL_CALLEES" origin/main
git grep -n "persistAuditTrailRow" origin/main -- packages/plugins/plugin-audit/src
git show origin/main:packages/plugins/plugin-audit/src/audit-writers.ts | grep -n "organization"

Dedup — declared WEAK

⚠️ search_issues free-text is recorded in #14743 as returning 0 for terms present in open issue titles with incomplete_results: false, so ⛔ a zero from it supports no negative. Whoever grades this should re-run with a keyword pass.

Refs: #13636 / PR #14923 (where it surfaced) · #13491 (execution point 3) · #9516 (the missing-stamp bug on these exact lines) · #8844 (the derive-or-refuse machinery).

[os-musk]

⛔ Escalated to needs-user-decision — this is no longer a follow-up. It blocks PR #14923, and the loss is measured, not predicted.

When I filed this card an hour ago I carried it as the dev's deferred question and called option C "a small follow-up rather than a re-opening of anything". The contract reviewer overturned that, and it built a probe rather than reasoning about it.

needs-user-decision applied under the standing rule for this exact situation: a ruling's mandated action, when implementation measures a fact pointing the other way, is executed literally, the conflict is filed as a decision, and ⛔ the PR is not armed, leaving the objection window open. PR #14923 is unarmed and stays that way.

What the probe showed — end-to-end, memory driver, isolated posture, real SysAuditLog, writers installed

• An env-level sys_metadata write, declared exactly as PR feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923 declares it, landed org-less (correct) — and its audit row was refused and lost. The logger received:
  ["error", "Audit write FAILED — the compliance trail is now INCOMPLETE…", "ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED", {object:"sys_metadata"}]
• A following NULL-org sys_permission_set system write lost its audit row at debug.
• Only the case-1 (sys_user) audit row reached the driver.

⇒ ⭐⭐ The lost population is not "the defect class" I described when filing. It includes the audit trail of the very population PR #14923 adjudicates legitimate, and of global-verdict rows the ledger itself calls legitimate (sys_permission_set, platform-object-tenancy.ts:287-295).

Before that PR those rows landed. After it they vanish on every walled install, behind one misdiagnosed once-per-process error that tells the operator to "confirm sys_audit_log is reachable… telemetry datasource" — pointing at the datasource when the cause is the tenancy refusal. My filing said the loss was silent; it is worse than silent, it is misdirected.

A contradiction that has to be settled either way

• orgless-write-declaration.ts:96-101 — "…or one whose organization column is itself NULL. The enumeration is the audit writer's own"
• platform-object-tenancy.ts:273-278 — "…or a record whose own column is NULL. Those rows declare themselves ('audit-of-untenanted-record')"
• audit-writers.ts:1402-1408 — deliberately does not declare that case.

The conditional admission bar is "a writer that demonstrably produces BOTH populations", so the cited writer fact for sys_audit_log misstates what the writer does — and evidence is a runtime string that reaches operators. The text half is in the domain:engine lane and is in PR #14923's fix round; ⛔ the behaviour half is not, and is the subject of this card.

The decision, unchanged in shape but no longer deferrable

A (leave it refusing, as shipped) · B (adjudicate case 2 legitimate and declare it) · C (keep the refusal, report it distinctly at error every time through the DURABILITY_CRITICAL_CALLEES channel persistAuditTrailRow is already registered in).

The 四棱分析 in the card body stands and points 同向 C. What has changed is only its urgency: the reviewer's required remedy is "implement option C in this PR — or escalate case 2 as needs-user-decision before sys_audit_log is admitted." ⛔ This seat cannot take the first: C changes plugin-audit's failure reporting (the domain:services lane) on a p1 security path. So it takes the second.

⚠️ ⛔ The seat is not narrowing PR #14923's admission to route around this. Constraint 3 of 决裁批 #17 admits both specimens, and a ruling is executed as written — the honest response to a measured counter-fact is a decision card and an unarmed PR, ⛔ not a quiet rescoping.

Refs: PR #14923 (blocked by this) · #13636 comment 5524621965 (the full verdict) · #13491 execution point 3 · #9516.

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling recorded — E with C as its failure channel: the audit row inherits the subject write's org-less declaration; the undeclared remainder stays refused and is reported loudly (2026-09-03)

Provenance. Ruled by the maintainer (pm@objectstack.ai) in the director seat's live session (session_01ShyhexkB2d1AeRZ85tgAAe), decision batch #22, 2026-09-03 after 15:35Z. Verbatim reply: 「同意」. The batch was presented with this card's recommendation as E + C (E primary, C as E's failure channel, C alone if E proves unreachable; B refused), so 「同意」 adopts that. Ledger: objectstack#12708, batch #22 ledger comment.

What was ruled.

• E. An audit row about a write that was itself declared legitimately org-less (via orgless-write-declaration.ts) carries the same declaration to sys_audit_log, so the declared populations — the env-level sys_metadata writes PR feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923 adjudicates, the global-verdict rows the ledger calls legitimate — keep their audit trail on walled installs. ⛔ No new declaration reason is added; the vocabulary stays closed. ⛔ Not B: an undeclared NULL-org subject is indistinguishable at the writer from the missing-stamp defect (audit: the tenant fallback in writeAudit reads session.tenantId, a key removed in v11 — the guard against NULL-tenant audit rows can never fire #9516) and stays refused.
• C, for the remainder. A refused audit row is reported every time, at error, through the DURABILITY_CRITICAL_CALLEES channel persistAuditTrailRow is already registered in, naming the tenancy refusal — never the "confirm the telemetry datasource" text the once-per-process catch prints today.
• ⚠️ E is unmeasured. The first task is to measure whether the subject write's declaration is reachable at the audit writer's call site. If it is not, the seat lands C alone and says so with the measurement; it does not invent a carrier for the declaration.

Execution. domain:services lane (plugin-audit), p1 security path, its own PR. Clause-②: yes — needs:contract-review carrier. Sequence: this lands first; PR #14923 stays unarmed until it does, then re-runs the reviewer's probe (memory driver, isolated, real SysAuditLog, writers installed) as its acceptance: the env-level sys_metadata audit row lands, the undeclared NULL-org sys_permission_set audit row is refused and reported at error. The text half (the sys_audit_log evidence string misstating the writer) stays in #14923's fix round as already planned.

State. needs-user-decision → pm:queue in the same stroke; lane and priority stamped (bug, priority:p1, domain:services) since the card arrived with the decision label alone; unassigned.

---

Generated by Claude Code

[claude]

Claim: domain:services execution seat, session session_01AUF1NoViznQK32gqpK8wS8, branch claude/issue-14927-audit-orgless-declaration-inherit.

Clause-②: no

Round R24b. pm:queue → pm:dispatched in one label write (read-modify-write, read immediately before the write, comparative read-back — matched).

Comments read to the last page before dispatch

2 comments, per_page=100, so the page is complete. Both matter and neither is skippable:

• 10:54:56Z, domain:engine seat — escalated to needs-user-decision on a built probe, not on reasoning. Its measurement is the reason this card is p1: an env-level sys_metadata write declared exactly as PR feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923 declares it landed org-less correctly and its audit row was refused and lost, with the logger receiving "Audit write FAILED — the compliance trail is now INCOMPLETE… ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED". A following NULL-org sys_permission_set write lost its audit row at debug.
• 15:53:47Z, director seat — the maintainer's ruling, verbatim 「同意」, decision batch chore(ci)(deps): bump actions/upload-artifact from 4 to 6 #22, ledger objectstack#12708.

The ruling this dispatch implements — E, with C as its failure channel

⛔ Adopted as written, not re-litigated:

• E. An audit row about a write that was itself declared legitimately org-less (via orgless-write-declaration.ts) carries the same declaration to sys_audit_log, so the declared populations — the env-level sys_metadata writes PR feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923 adjudicates, and the global-verdict rows the ledger calls legitimate — keep their audit trail on walled installs. ⛔ No new declaration reason is added; the vocabulary stays closed.
• C, for the remainder. A refused audit row is reported every time, at error, through the DURABILITY_CRITICAL_CALLEES channel that persistAuditTrailRow is already registered in — not swallowed as an ordinary write failure. The probe above found one such loss reported at debug; that is the specific defect C closes.
• ⛔ Not B. An undeclared NULL-org subject is indistinguishable at the writer from the missing-stamp defect (audit: the tenant fallback in writeAudit reads session.tenantId, a key removed in v11 — the guard against NULL-tenant audit rows can never fire #9516, which was that bug on those exact lines), so it stays refused. Do not adjudicate case 2 as legitimate.

Why this card is worth a p1 slot tonight

⭐ The failure is self-concealing: the row that goes missing is the audit record about a defective row, so the control gets sharper and the evidence disappears in the same moment. It is reachable today on any walled install holding a record whose organization column is NULL — measured, not predicted.

It also unblocks another lane: PR #14923 (#13636) is deliberately unarmed pending this, per the standing rule that a ruling's mandated action which measures a fact pointing the other way is executed literally, filed as a decision, and left unarmed to keep the objection window open. ⛔ That PR is domain:engine's — this seat does not touch it; landing here is what lets that seat proceed.

Clause-② is no: the declaration vocabulary is explicitly closed by the ruling, and the reporting change moves an existing failure onto an existing channel. The dev re-derives it from its own diff and flips it if it measures otherwise.

Size M, opus.

---

Generated by Claude Code