[finding] 79 of 82 dogfood fixtures boot org-less, and nothing has swept them for #8023's disarm now that a probe exists

[os-zhuang]

Found while implementing #8074 (PR #8407). Out of scope there — that card's deliverable was the guard mechanism, not the sweep. Filed unassigned; grading and routing are the triage seat's call.

The observation

#8074's own findings-round note said the census was probably incomplete ("two-in-one-shift suggests the census is not complete"). It still is, and #8074 closes on PR #8407 — so after that merge the residual sweep has no home.

Measured on 84c07c3 in packages/qa/dogfood/test/:

	count
files calling bootStack	82
files passing orgContext: true	3 (auth-session-audit-trail, org-scoped-sharing-rule-listing, owd-public-read-write-write-floor)
files mentioning org_member at all	1 (the #8023 fixture)
files carrying an [integrity]-style precondition block	3

So 79 fixtures boot with no organization. Every principal they resolve holds positions: ['everyone'], and any assertion any of them makes about a positions-gated row-level write verdict is in exactly #8023's position: the platform write floor never applies, and a refusal that a real deployment would produce is invisible.

Why this is not just "#8074 again"

#8074 delivered the mechanism (assertArmed / principalArmed) and retrofitted the five fixtures that already knew they had a precondition — the ones whose headers said so in prose. What it did not do, deliberately, is audit the other 79 for preconditions nobody has noticed yet. Those are the ones that would look exactly like #8023's first fixture: quiet, green, and wrong.

The sweep is cheap now in a way it was not before: principalArmed({ positions: ['org_member'] }) is one call, and a fixture that turns out not to need it costs one line of reasoning to rule out.

What would need deciding

Not obviously a mechanical fix, which is why this is a finding rather than a patch:

• the read axis is genuinely unaffected, so a blanket "every fixture must declare arming" would be noise on most of the 79;
• the discriminator is "does this file assert on a row-level write verdict", which is not reliably greppable — authored-row-write-scope, bulk-widener-probe and showcase-scope-depth-write are the obvious shapes, but the read/write split is a judgement per file;
• some fixtures deliberately boot org-less to prove the org-less path itself (sharing-rule-org-less-caller is named for it), so org-less is not by itself a defect signal.

A per-file triage pass over the write-asserting subset is probably the right shape, not a gate.

Related

• [finding] An org-less test fixture cannot observe the org_member-gated write floor, so a real 403 defect records as a PASSING cell #8074 — the class; PR test(qa): assertArmed — a fixture proves the control under test is engaged before it measures anything (#8074) #8407 is the mechanism and its retrofits.
• A public_read_write object is only writable by the row's creator — showcase_contributor gets 403 editing a showcase_project it can read, where the access matrix declares edit:true #8023 — the instance this projects onto the other 79.
• [finding] PINS_CHECKED detects only @ts-expect-error, so other compile-time pin idioms in a hidden test layer are invisible to it — measured on a live example #8113 — the compile-time half, separately held.

---

Generated by Claude Code

[hotlong]

Concentrated findings round (maintainer-directed, 2026-08-13): promoted finding → pm:queue (domain:cli unchanged — packages/qa). Type: Task.

Grading rationale: this is a sweep card in the sanctioned shape — same criterion across all members ("does this fixture assert on a row-level WRITE verdict while booting org-less"), cheap per-item remedy (principalArmed({ positions: ['org_member'] }) is one call), and the card itself correctly rejects the blanket-gate alternative. The deliverable is the itemized list: for each write-asserting fixture, either the arming call or a one-line rule-out; fixtures that are org-less on purpose (the org-less-path fixtures) recorded as such. PR body carries the per-file 落点 | before | after table per the sweep rules; zero changes outside the enumerated set.

Dispatch note: re-derive the 82/79/3 counts on the current main at dispatch time (the census was measured on 84c07c3 and PR #8407 has since merged its five retrofits).

Size/model suggestion: M (judgment per file, mechanical edit), mode:subagent, opus.

---

Generated by Claude Code