chore(objectql): changeset for #19837; keep the audit port's organization argument optional

A required third parameter would break a caller that invokes an exported
DanglingReferenceAuditPort.probe with two arguments; optional keeps every
existing port and caller well-typed, and the engine reads a missing value as
unscoped.

Claude-Session: https://claude.ai/code/session_01TEhopqrWQYBycZzyJHpAZr
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/19837-parent-binding-tenant-scope.md

@@ -0,0 +1,20 @@
+---
+"@objectstack/objectql": patch
+---
+
+fix(objectql): `parent.*` validation predicates no longer read another organization's header, and the dangling-reference audit reports cross-organization references
+
+**Master-detail `parent.*` predicates.** A detail object's `requiredWhen` and `readonlyWhen` can read the master-detail header as `parent` (for example `requiredWhen: "parent.status == 'locked'"`). The engine read that header without the caller's organization, so it found the header in any organization. A user in one organization who put another organization's header id on a detail record got an answer that depended on that header's fields: on create, a `locked` header answered "`note` is required" while an `open` one answered `reference_not_found`; on update, a `readonlyWhen` field was dropped or kept, and a strict write was refused or not. That leaked one bit of another organization's record per write.
+
+The header is now read only where the caller's organization can see, like the reference check. A header in another organization is treated exactly like a header that does not exist: `parent` is left unbound. On create and on repoint, the write gets the same `VALIDATION_FAILED` / `reference_not_found` answer whatever the header's state. A `readonlyWhen` that needs `parent` stays locked, as it already did for a header that cannot be read. A `requiredWhen` that needs `parent` is skipped, as it already was in that case.
+
+What does not change:
+
+- Headers in the caller's own organization bind as before, so their `requiredWhen` and `readonlyWhen` rules apply as before.
+- Headers of platform-global masters (`tenancy: { enabled: false }`), federated masters, and headers with no organization still bind from any organization.
+- The header read still ignores row-level security.
+- System-context writes with no organization (seed replay, provisioning) still read the header from any organization.
+
+One case to check: a detail record that already points at a header in **another** organization (written before this fix, or by a system-context write) now edits as if its header were missing. Its `parent`-scoped `readonlyWhen` fields stay locked, and its `parent`-scoped `requiredWhen` rules are not enforced. The dangling-reference audit below now reports such records, so you can find and fix them.
+
+**Dangling-reference audit.** `inspectDanglingReferences` (the read-only audit that runs with the lifecycle sweep) checked each stored reference across all organizations. A reference to a record in another organization therefore looked fine, even though the write path now refuses it. The audit now checks each record's references in that record's own organization. A cross-organization reference is reported in `dangling`, and records with no organization are still checked across all organizations. Under the `group` tenancy posture, a cross-organization reference written by a member of both organizations is reported too, because the stored record does not say which organizations its writer could see. Custom `DanglingReferenceAuditPort` implementations get the record's organization, or `null`, as a new third argument to `probe`. Implementations that ignore it keep working.

packages/objectql/src/engine.ts

@@ -7058,7 +7058,7 @@ export class ObjectQL implements IObjectQLEngine {
         objects: () => this._registry.getAllObjects() as unknown as AuditableObject[],
         find: (object, opts) => this.find(object, opts as any) as Promise<Array<Record<string, unknown>>>,
         probe: (target, id, organization) => this.referenceExists(
-          target, id, organization === null ? undefined : ({ tenantId: organization } as ExecutionContext),
+          target, id, organization == null ? undefined : ({ tenantId: organization } as ExecutionContext),
         ),
         warn: (msg, meta) => this.logger?.warn?.(msg, meta as any),
       },

packages/objectql/src/integrity/dangling-reference-audit.ts

@@ -326,9 +326,10 @@ export interface DanglingReferenceAuditPort {
    * its references were written under — or `null` when the row carries none (a
    * NULL-organization row, or an object with no tenant column). The engine
    * probes under that organization, as the write-path guard probes under its
-   * caller's; `null` probes unscoped.
+   * caller's; `null` probes unscoped. Optional so a port written before it, or
+   * a caller asking the unscoped question, stays well-typed.
    */
-  probe(target: string, id: unknown, organization: string | null): Promise<boolean | null>;
+  probe(target: string, id: unknown, organization?: string | null): Promise<boolean | null>;
   warn?(message: string, meta?: unknown): void;
 }