After ADR-0132 the open tree still calls `@objectstack/organizations` enterprise/closed-source in 65 places — including `tenancy-service.ts`, the file that decides the posture

[hotlong]

Found while implementing #16137 (the open-only wall acceptance for the #16130 migration). Not a rider on that PR: it is a 45-file prose sweep across seven packages, and the acceptance PR is a test-only diff.

The measurement

ADR-0132 moved the org-scoping registrar into the open core: packages/plugins/organizations is Apache-2.0, on main since PR #16215, and its own header states the boundary — "This package carries NO licence check of any kind". #16137 measures that an open-only composition really does raise the wall, and it does.

The open tree's own prose has not followed. Measured at 2e6a2ea4c:

git grep -c -E "enterprise (`?@objectstack/organizations|multi-org|organizations)|closed-source `?@objectstack/organizations|cloud-private `?@objectstack/organizations" -- 'packages/**/*.ts' \
  | grep -v '^packages/plugins/organizations/'

65 occurrences across 45 files, seven packages. The heaviest, by count:

file	hits
packages/verify/src/harness.ts	6
packages/cli/src/commands/serve-organizations-message-spelling.test.ts	5
packages/plugins/plugin-dev/src/dev-plugin.ts	3
packages/plugins/plugin-auth/src/ensure-default-organization.ts	3
packages/cli/test/serve-organizations-host-resolution.e2e.test.ts	3
packages/cli/src/commands/serve.ts	3
packages/plugins/plugin-auth/src/tenancy-service.ts	2

Why this is not cosmetic

The single worst site is packages/plugins/plugin-auth/src/tenancy-service.ts — open core's own source of truth for "what tenancy posture is this deployment in?". Its header still reads:

Both walled postures require the enterprise @objectstack/organizations package (the org-scoping service) to ACTIVATE ... multi-organization operation is a commercial capability (ADR-0105 D12).

and isolationActive's docblock still argues "Open code, entitled activation ... ENABLING a multi-organization posture is an entitlement". ADR-0132 settled that the other way for the open package: an open install is entitled to both walled postures by construction, which is exactly what the open OrganizationsPlugin.supportedPostures now declares.

So the maintainer's stated goal for #16130 — 「迁移之后的效果应该是开源版就可以把元数据应用使用单库多租户的方式运行。」 — is now true in code and denied in the comments an open-source reader meets first. Someone reading tenancy-service.ts to answer "can my open install run isolated?" is told no, by the file that decides it.

packages/cli/src/commands/serve.ts is the same shape one layer out: the block that mounts the package still says the multi-org runtime "lives in the closed-source @objectstack/organizations package".

Scope, and what should NOT be swept

Not every hit is wrong, and a blanket rewrite would break real facts. Three populations, and they need separating before anything is edited:

1. Now false — prose describing the open registrar as commercial/closed-source/cloud-private. tenancy-service.ts and serve.ts lead this one.
2. Still true, about the OTHER package — the commercial repo genuinely ships a private package of the same name that subclasses this one and calls its own licence gate. Text about that is correct and must stay, in no-framework-dependents.pin.test.ts's terms.
3. True but stale as a reason — packages/verify/src/harness.ts skips its cross-tenant proofs because "the enterprise package is not installable in this workspace". It is installable now, which is a live capability question rather than a wording one, and probably its own card.

Refs: #16130 (the move) · PR #16215 (the open package landing) · #16137 (the acceptance that measures the claim, and where this was found) · #16539 (a dogfood control whose premise died from the same move — adjacent, narrower) · ADR-0132 · ADR-0105 D12 (the passage several of these sites cite, as amended).

[hotlong]

Graded out of finding into pm:queue, domain:services.

Verified the load-bearing part rather than the count: packages/plugins/plugin-auth/src/tenancy-service.ts — the open core's own authority for resolving the posture — still says at :31 that "Both walled postures require the enterprise @objectstack/organizations package" and at :36 that "operation is a commercial capability (ADR-0105 D12)". Five occurrences in that one file.

Both statements are now false. ADR-0132 made the package Apache-2.0 open core, and #16137's acceptance (PR #16719) has just proven an open-only composition raises the isolated wall with no licence check reachable — measured twice, each with a positive control.

This is not cosmetic drift. It sits in the file that decides the posture, so the next reader looking for "can open source do multi-org?" finds the answer no in the source of truth, next to code that now does it. Grading it as queue work rather than an observation for that reason.

⛔ Keep the card's three-population split when fixing: statements that are still correct (cloud's licence gate really is commercial; group posture management really is an EE product surface) must not be swept along with the ones ADR-0132 falsified.

[hotlong]

Claim: PM session 6679d191-11f4-465b-b322-0e0409d76793 (seat hotlong), branch claude/organizations-is-open-core-prose-16718.

Dispatched on the maintainer's direct instruction 2026-09-08: 「ADR-0132 之后,开源树里仍有 65 处、45 个文件把 @objectstack/organizations 称作企业版/闭源/cloud-private。这个也要处理」

The card's three-population split is carried into the dispatch as a hard constraint, not a suggestion — population 2 is genuinely true and must survive, and population 3 (verify/src/harness.ts skipping its cross-tenant proofs because the package "is not installable in this workspace") is dispatched as report-only: the card is right that it is a live capability question rather than a wording one, and turning those proofs back on is a different change with a different risk profile.

[hotlong]

Dead-claim recovery — re-dispatching

The first dev stalled (no progress for 600s; the stream watchdog did not recover) after getting as far as "reading the issue and setting up the worktree". That is a normal agent death, ⛔ not a maintainer abort and ⛔ not a signal about the card.

Checked before re-dispatching rather than assuming zero progress, because it had in fact pushed something:

refs/heads/claude/organizations-is-open-core-prose-16718  6ba0db4e0
origin/main                                              05374bee6
git merge-base --is-ancestor 6ba0db4e0 origin/main  → yes

So the branch exists but is empty — its tip is an ancestor of main, no commits, an empty diff. Nothing to salvage and nothing to collide with. main has also moved since it was cut, so the replacement branches fresh.

Claim stands with the same PM session; re-dispatched now.