fix(seed-loader): keep the per-org tenant stamp instead of resolving it as a natural key

[os-zhuang]

What was broken

In a multi-org deployment the per-organization seed replay landed every row org-less. A freshly created organization therefore booted with a database full of data that nobody could see: the tenant wall (organization_id = <active org>) hides a NULL-org row from all members, including that organization's own owner.

The seed summary reads clean while this happens — a dropped reference is counted separately from rejected rows — so there is no signal at boot.

Root cause

The stamp and the reference pass disagree about what organization_id holds.

SeedLoaderService writes config.organizationId — the replay target's id — into the record. The reference pass then sees a field declared as a lookup → sys_organization, treats the value as a natural key, and probes sys_organization.name for it. That misses, and a missed reference is dropped rather than kept, taking the tenant attribution with it.

The id fallback probe cannot rescue it either: under per-tenant replay every probe is AND-scoped with organization_id = <target org>, and sys_organization — being the tenant table itself — carries no such column, so that probe matches nothing by construction.

Why it stayed hidden

The id shape. looksLikeInternalId recognises UUID and Mongo ObjectId and short-circuits resolution for both, so any fixture minting UUID organization ids passed. Every organization better-auth actually creates is org_<base36> — including the default organization ensureDefaultOrganization bootstraps on first boot — and that shape is not recognised.

So the defect fired on real deployments and on nothing else.

The fix

The loader now remembers that it wrote the stamp itself and skips resolution for that one field. A seed that authors organization_id explicitly still goes through resolution, so naming an organization by its natural key keeps working.

Narrow on purpose: widening looksLikeInternalId to accept org_* would be the runtime-side "accept another dialect" fallback the repo's contract-first doctrine rules out. The loader second-guessing a value it just wrote itself is the actual defect, so that is what changed.

Verification

• packages/objectql/src/seed-loader-org-stamp.test.ts — 3 new cases: the better-auth id shape survives (fails without the fix), the UUID shape still survives, and a seed-authored natural key still resolves.
• End-to-end: apps/ee-tenant-crm-showcase in the cloud repo (companion PR) boots two organizations over one database through @objectstack/verify. 10/10 pass with this fix; the two seed-attribution cases fail against the unfixed framework — confirmed by rebuilding at the pre-fix commit and re-running.

🤖 Generated with Claude Code

https://claude.ai/code/session_019TYoxKa8yFLiDDh7tkBqtu

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 2, 2026 1:59pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol.

3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via @objectstack/metadata-protocol)
• content/docs/kernel/services-checklist.mdx (via @objectstack/metadata-protocol)
• content/docs/releases/v9.mdx (via @objectstack/metadata-protocol)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.