[objectstack-fleet]

Fixes #24273

Clause-②: no (provisional: copy only; if the measurement forces another shape, the dev reports before building it; owes the seat's review of record at TIER_DEFAULT before the queue)

What changed

sys_member.transfer_ownership sends better-auth's POST /organization/update-member-role with role: 'owner'. better-auth 1.7.3's updateMemberRole writes the target's role and nothing else, so the caller stays an owner. The action used to promise "You will be demoted to admin". Shape B (honest copy) from the claim: the action now promises what the door does.

• packages/platform-objects/src/identity/sys-member.object.ts, transfer_ownership:
  • label FROM "Transfer Ownership" TO "Make Owner";
  • confirmText TO "Make the selected member an owner of this organization? They get every owner privilege, including deleting the organization. You stay an owner too; to step down, use Change Role on your own membership.";
  • successMessage FROM "Ownership transferred" TO "Member is now an owner" (the old one claimed a transfer as well);
  • the comment now states the vendor behavior, the step-down, and the vendor's last-owner guard. It points at the dogfood test that measures them.
  • Unchanged: name, target, recordIdParam, bodyExtra, visible, requiresFeature, requiresMembershipReach, variant, icon.
• Bundles: en.objects.generated.ts was regenerated by node scripts/check-i18n-bundles.mjs --write. The zh-CN / ja-JP / es-ES values are hand-written translations, and merge mode keeps them, so each one would have kept the false promise. I translated them again to the same honest copy. Each confirm names that locale's own Change Role label (更改角色 / ロールを変更 / Cambiar rol).
• Pins:
  • packages/platform-objects/src/identity/transfer-ownership-action-copy.test.ts checks four things on the declared copy and every locale bundle: no demotion or transfer is promised, the confirm names the locale's update_member_role label, en equals the declared copy, and the request and identity are unchanged.
  • packages/qa/dogfood/test/member-transfer-ownership-step-down.dogfood.test.ts is the booted measurement below.
• Changeset .changeset/24273-transfer-ownership-honest.md (@objectstack/platform-objects: patch).

Measurement (booted stack, before the copy changed)

The dogfood file boots the showcase, makes two organizations with two signed-up non-platform-admin principals, and activates the organization under test. It reads both sys_member rows after each write.

1. Owner runs the action's request on a plain member: 200, rows read { owner: 'owner', target: 'owner' }, so the organization has two owners. This reproduces the card.
2. The served update_member_role predicate, evaluated with celEngine against the caller's own row and the caller's served session (org_owner in positions), returns true: Change Role is offered on one's own row.
3. The previous owner sends update-member-role on their OWN row with role: 'admin': 200, rows read { owner: 'admin', target: 'owner' }. The step-down works through a declared action.
4. The new sole owner tries the same: 400 YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER, and the rows are unchanged. This is the vendor's last-owner guard (crud-members.mjs, updateMemberRole).
5. The second organization's rows are unchanged.

So B holds: the previous owner can step down through a declared action, and nothing calls for shape A.

Pre-fix run (2ba4d44d): 4 behavior cases pass and the served-copy case is red (expected 'Transfer Ownership | Transfer ownersh…' not to match /demot/i). Post-fix: 5/5 pass.

Verification (final head f31e05504, after merging origin/main 31e7d0ba2)

• pnpm --filter '@objectstack/dogfood^...' build: exit 0
• pnpm --filter @objectstack/platform-objects typecheck: exit 0. pnpm --filter @objectstack/dogfood typecheck: exit 0
• pnpm --filter @objectstack/platform-objects test: 77 files, 1184 tests passed
• pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/member-transfer-ownership-step-down.dogfood.test.ts test/org-admin-affordance-reach.dogfood.test.ts: 2 files, 19 tests passed
• Reverse leg: with sys-member.object.ts and the four bundles restored to 2a1e48a1c1 (tree only, restored with git checkout HEAD, then git diff HEAD empty), transfer-ownership-action-copy.test.ts fails 6 of 8. It passes 8 of 8 on the fix.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gave 69 families on ccac32c44. 68 exited 0. pnpm check:dual-build-cjs-loads exited 3 with PREREQUISITE NOT MET, because unrelated packages had no dist/, so it is NOT MEASURED locally and left to CI. --ran reconciliation: "69 derived famil(ies) accounted for — 68 run, 1 NOT-MEASURED".
• After the merge, these were re-run on f31e05504, all exit 0: check:i18n, check:i18n-stale-fill, check:type-check-coverage, check:type-check-debt, check-adr-0087-registration --base origin/main, check-empty-changeset --base origin/main, check-changeset-no-major --base origin/main, check:nul-bytes, check:cross-package-test-inputs, check:test-source-alias.

Downstream (cloud)

cloud#2912's booted test (cloud PR #3003) expects the caller's sys_member.role to be admin right after transfer_ownership. Under this PR that expectation is owner. The admin reading belongs only after the caller's own update-member-role on their own row with role: 'admin'. If that test asserts the copy, it should also expect the new label "Make Owner".

Acceptance notes

• The measurement runs on the single boot shape. @objectstack/organizations is not a dependency of @objectstack/dogfood, so the framework's multi-org gates skip here (enterprise-organizations.ts). The two organizations are rows written in system context, the shape org-admin-affordance-reach.dogfood.test.ts uses. The door under test is the vendor's own endpoint either way.
• packages/spec test fixtures (action.test.ts, action-requires-membership-reach.test.ts) use the label "Transfer Ownership" on standalone fixture actions. They are not the served copy and are outside this lane, so they are left as they are.
• packages/platform-objects/CHANGELOG.md holds an old entry that repeats the vendor claim ("auto-demotes the previous owner to admin"). It is release-owned and not edited in a code PR.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects, touching 1 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/environment-variables.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/deployment/tenancy-modes.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/authentication.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/delegated-administration.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/permission-sets.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/positions.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/system-context.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v16.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-0.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-1.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-3.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-6.mdx (via sys_member (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 44a5011fe623c8f210d13177bc2776d0bb0b0afa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9b0998f172db5c84199632708b1323387505940f — the merge of head f31e05504fd7445bde22cf5f95d704ddf7f821eb into base 44a5011fe623c8f210d13177bc2776d0bb0b0afa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9b0998f172db5c84199632708b1323387505940f && git checkout 9b0998f172db5c84199632708b1323387505940f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 44a5011fe623c8f210d13177bc2776d0bb0b0afa f31e05504fd7445bde22cf5f95d704ddf7f821eb && git checkout -B drift-repro 44a5011fe623c8f210d13177bc2776d0bb0b0afa && git merge --no-ff f31e05504fd7445bde22cf5f95d704ddf7f821eb

node scripts/docs-audit/affected-docs.mjs --json 44a5011fe623c8f210d13177bc2776d0bb0b0afa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 44a5011fe623c8f210d13177bc2776d0bb0b0afa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: f31e05504fd7445bde22cf5f95d704ddf7f821eb
Local-runs: none

What this record read:

• card platform-objects sys_member.transfer_ownership promises the previous owner is demoted to admin; better-auth's update-member-role writes only the target, so the organization ends with two owners #24273's body and comments: triage 6248074239, the lane correction 6249640783, domain:services seat 1's shape reading 6249941116, claim 6256263406, dispatch 6256291684, and os-dev-report 6256913211, read as claims;
• the PR body, and all 8 paths of the net diff against the merge base 31e7d0ba27, read with git diff / git show on fetched refs, nothing checked out;
• the 41 check-runs on this head;
• beyond the diff: the es-ES source-hash tables (es-ES.source-hashes.generated.ts, es-ES.source-hashes.ts) and their headers, and a git grep of the old copy over the head.

① Derived judgments

The shape: B, honest copy, right. The dev measured first, on a booted stack with two organisations. The B-breaker the claim named did not fire:

• the action's own request as an owner leaves both rows owner, which reproduces the card;
• the served update_member_role predicate offers Change Role on the caller's own row;
• the caller's own update-member-role to admin answers 200, leaving them admin and the new member owner;
• the same step by a sole owner is refused 400 YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER.

So a declared, honest step-down exists, and no part of A (a transfer door) was built.

The copy: true now, right. The confirm used to promise "You will be demoted to admin", and the vendor writes only the target. At the head:

• label reads "Make Owner";
• confirmText says the selected member becomes an owner with every owner privilege, including deleting the organisation, that the caller stays an owner, and that stepping down is Change Role on one's own membership;
• successMessage reads "Member is now an owner";
• the comment states the vendor's behaviour and names the dogfood test that measured it.

Every one of these is now a statement of what the door does.

Unchanged and right: name (transfer_ownership, which is the action's id and its MEMBERSHIP_REACH row key), target, the request body, recordIdParam, visible, requiresFeature, requiresMembershipReach and variant. A page or test that names the action keeps resolving it.

The bundles: right.

• en.objects.generated.ts was regenerated by the tool.
• The zh-CN, ja-JP and es-ES values were re-translated by hand. The extractor's merge mode keeps translated values, so regeneration alone would have kept the false promise in three locales.
• The es-ES generated source-hash table records an entry only for a leaf that is a byte copy of its source, and no entry names transfer_ownership. So the new translations are served as written and do not fall back to English. check:i18n and check:i18n-stale-fill exited 0 on the merged head.
• Each translation carries the same three facts as the English.

The pins: real controls.

• transfer-ownership-action-copy.test.ts forbids "demot" and "transfer" in the served copy per locale, and ties the confirm to update_member_role's own label in each locale. Restoring the five base files turned it red, 6 of 8. The tree was restored to HEAD.
• The dogfood file reads both sys_member rows after the action and after the step-down, and checks the served copy. Its copy case was red on the pre-fix build; the four behaviour cases pass on both, by design, because the door does not change.

What stays with the old wording, none of it served copy:

• the label "Transfer Ownership" on standalone fixtures in packages/spec tests (action.test.ts, action-requires-membership-reach.test.ts);
• a released platform-objects CHANGELOG entry;
• two new test comments quoting the old promise as history.

② Semver level

One patch changeset for @objectstack/platform-objects, Clause-②: no. That matches the claim and the PR body. The action's identity, door and gates are byte-identical; only its copy moves. A consumer test that asserted admin after the action asserted a demotion the door never performed (downstream, ③). Right.

③ Boundary flags

• Deviations, all accepted.
  • The multi-org measurement ran on the single boot shape with two organisations written in system context, because the dogfood suite cannot boot @objectstack/organizations. The door under test is the vendor's either way.
  • successMessage moved too. It made the same false claim and travels in the same bundles; this is within the claim's intent.
  • The three non-English values were edited by hand, which AGENTS.md allows for translated locales.
  • Other deviations accepted: the detached shared checkout with no edit made there; the session-URL PR footer; the pre-fix run cited is the one with organization/set-active.
  • check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET) locally. CI's Lint & Repo Gates is green on this head.
• open_questions: both accepted.
  • The label is "Make Owner": the short verb-noun form the object's other labels use, with no transfer connotation.
  • The name stays.
• out_of_scope_findings: the packages/spec fixtures and the released CHANGELOG are not served copy; noted, not filed.
• Downstream: cloud#2912's booted test (cloud PR 安全:静态字段 readonly: true 仅 UI 层生效、服务端不强制 → 审批/状态/金额字段可被直接 PATCH 绕过写入(FLS 缺口) #3003) expects the caller's role to be admin right after transfer_ownership. On a pin carrying this PR it reads owner, and reads admin only after the caller's own Change Role. The seat sends repo:cloud seat 2 ([PM seat] repo:cloud · seat 2 — ⏳ vacant #24145) a consumer pointer before the queue.
• CI: 41 check-runs on f31e055, 35 success, 6 skipped (the rostered path and opt-in skips), 0 failed.

Implemented-by: claude/issue-24273-transfer-ownership-honest
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T01:03Z · ACCEPT

Head: f31e05504f (the measurement test, the copy, the bundles and pins, then a merge of main). Card #24273 (p2, area:identity), claim 6256263406, dispatch 6256291684. Dev report: 6256913211.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24273. 8 files, +334 / −21. Not governed (check-governed-merges.mjs --pr 24412: 0 of 8 paths hit the register).
Scope	sys-member.object.ts: transfer_ownership's label, confirm, success message and comment. The four *.objects.generated.ts bundles carry the same copy (en regenerated; zh-CN, ja-JP, es-ES re-translated). A copy pin in platform-objects, and a dogfood file declared to domain:cli (6257430307, 6257435263). One patch changeset. No door, route or reach row.
Seat's own read	The record's own: only copy moves; name, target, body, visible, requiresFeature, requiresMembershipReach and variant are unchanged. No es-ES source-hash entry names the action, so the new translations are served.
Measured	On a booted stack with two organisations: the action leaves both rows owner (the card). The caller's own Change Role to admin answers 200, leaving them admin and the new member owner. A sole owner's same step is refused 400 YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER. Change Role is offered on one's own row. So the honest step-down exists, and the B-breaker did not fire.
Review	TIER_DEFAULT record of record 6257422660 on this head: PASS, in-seat.
Declaration	Clause-②: no on the claim, the PR body and the changeset. Copy only.
Pins	The copy pin forbids "demot" and "transfer" in the served copy per locale and ties the confirm to Change Role's own label. Restoring the base files turned it red, 6 of 8. The dogfood file reads both rows after each step and asserts the served copy; its copy case was red before the fix.
Gates	Dev: 69 derived, 68 run with exit 0, 1 NOT MEASURED. check:dual-build-cjs-loads locally exited 3, PREREQUISITE NOT MET; CI's Lint & Repo Gates is green on this head. Typecheck exit 0 for platform-objects and the dogfood package.
CI	41 check-runs on f31e05504f: 35 success, 6 skipped, 0 failed. The skips are the rostered path and opt-in skips.

Disposition:

• open_questions: both accepted. The label is "Make Owner", and the name stays transfer_ownership (its id and reach-row key).
• deviations: all accepted, as the record's ③ judges them:
  • two organisations on the single boot shape;
  • successMessage moved with the rest of the copy;
  • three locales translated by hand;
  • the detached shared checkout;
  • the footer;
  • the pre-fix run cited.
• out_of_scope_findings: the packages/spec fixture labels and the released CHANGELOG are not served copy; noted, not filed.
• Downstream: consumer pointer 6257439197 on [PM seat] repo:cloud · seat 2 — ⏳ vacant #24145 for cloud#2912. Its booted test's admin-after-action expectation reads owner on a pin carrying this, and admin only after the caller's own Change Role.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Fixes #24273 then closes the card.

---

Generated by Claude Code