Remove the deprecated hook/action `ctx.session.tenantId` alias in the next major (converge on `organizationId`)

[os-zhuang]

Background

#3280 converged the developer-facing org identifier onto organizationId across the JS authoring surface:

• Hooks — ctx.user.organizationId / ctx.session.organizationId (Unify the developer-facing org identifier: hooks expose session.tenantId while RLS/seed/columns use organizationId (add organizationId as the blessed name) #3280, merged in feat(spec,objectql): unify developer-facing org identifier in hooks — organizationId is blessed (#3280) #3284).
• Actions — ctx.user.organizationId / ctx.session.organizationId (feat(runtime): expose organizationId to action-body ctx (user + session) — follow-up to #3280 #3288).
• Build-time guard keeping our reference apps off the deprecated name (chore(lint): org-identifier authoring guard for deprecated session.tenantId (#3280 follow-up) #3289).

ctx.session.tenantId was kept as a deprecated alias carrying the identical value, marked @deprecated in TSDoc. This issue tracks its eventual removal from the hook/action ctx.session surface, once a deprecation window has passed.

Scope of the removal (when it happens)

• Drop session.tenantId from HookContextSchema.session (spec) — keep only organizationId.
• Drop the tenantId alias emitted by the engine's buildSession() and the runtime's buildActionSession() / action ctx.user.
• Flip scripts/check-org-identifier.mjs from a hard-fail authoring guard to also covering packages/** where those are authoring-example bodies (leave the driver layer alone).
• Changeset as a breaking change for @objectstack/spec + @objectstack/objectql (+ @objectstack/runtime).

Explicit non-goals (do NOT remove/rename)

The generic driver-layer tenancy abstraction stays as-is — it is not "org", the isolation column is configurable, and it legitimately carries an environment id in database-per-tenant kernels:

• ExecutionContext.tenantId, DriverOptions.tenantId
• SqlDriver.applyTenantScope / tenantFieldByTable, TenancyConfig.tenantField
• ExecutionLog.tenantId (flow-execution audit isolation field)

Timing

Schedule for the next major (v11/v12 train). Do not land before a real deprecation window — the alias must stay green for at least one minor cycle so third-party .hook.ts / .action.ts authors can migrate. The @deprecated TSDoc + the #3289 guard are the migration aids in the meantime.

Related

• Unify the developer-facing org identifier: hooks expose session.tenantId while RLS/seed/columns use organizationId (add organizationId as the blessed name) #3280 (the convergence), feat(spec,objectql): unify developer-facing org identifier in hooks — organizationId is blessed (#3280) #3284, feat(runtime): expose organizationId to action-body ctx (user + session) — follow-up to #3280 #3288, chore(lint): org-identifier authoring guard for deprecated session.tenantId (#3280 follow-up) #3289.
• Distinct from Driver-native tenant scope hides platform-global (NULL-org) rows from an org-context read (sys_license: admin sees 0, anon sees row) #3249 (a standalone driver-native tenant-scope correctness bug — same layer name, different problem).