feat/sites-1n

newSite-null guard is safe: decision rejects before existingSuc is inspected

domains/utility/src/site-utility-contract/site-utility-contract.shells.ts:300

When newSite is null, decideLinkSiteToContract returns SiteNotFound before reaching the MoveLinkedSite/FirstClaim branch. Outcome identical to old code. No silent failure introduced.

Ordering improvement: findSitesForContractInOrg adds deterministic ORDER BY

domains/utility/src/site-utility-contract/site-utility-contract.queries.ts:130

Old findByContractId had no ORDER BY — existingLinks[0] was nondeterministic. New query orders by createdAt ascending, making [0] the oldest org-scoped SUC. Correctness improvement.

DELETE site at member-level with no SUC dependency guard enables data orphaning

domains/core/src/site/site.queries.ts:152

getDependencies is a stub returning {assets:0}; no FK on site_utility_contracts.site_id→sites.id. Any org member can delete a site with active SUC rows, silently breaking contract bindings and cascade-deleting monitoring subscriptions. Pre-existing bug amplified by the member-level RBAC change.

No FK on site_utility_contracts.site_id creates a TOCTOU race window

domains/utility/src/site-utility-contract/site-utility-contract.shells.ts:300

A concurrent site deletion between the handler read and shell write would produce a dangling site_id. Pre-existing structural gap made more reachable at member-level. Fix: add FK with ON DELETE RESTRICT or extend getDependencies to count SUCs.

Branch name in JSDoc RBAC comments will rot (3 occurrences)

apps/platform/src/api/contracts/sites.contract.ts:52

'— see feat/sites-1n RBAC audit' appears in 3 comment blocks. CLAUDE.md prohibits referencing the current task/fix/branch in comments. Drop the trailing clause; the preceding sentence conveys the policy without the volatile reference.

Null-guard short-circuit semantics are implicit

domains/utility/src/site-utility-contract/site-utility-contract.shells.ts:300

contract && newSite guard returns [] when either is null; the decision errors on the missing entity anyway. The fallback to [] never has semantic meaning — a reader must trace the decision to see why it is safe.

updateLocation RBAC comment wording diverges from 3 sibling endpoints

apps/platform/src/api/contracts/sites.contract.ts:230

Uses 'Any member of the organization, checked via site lookup' vs the template 'Any member of the organization (handlers enforce member-level; ...)' used by create/update/delete. Minor inconsistency, no correctness issue.

No integration test for the cross-org SUC isolation fix in linkSiteToContractShell

domains/utility/src/site-utility-contract/__tests__/site-utility-contract.decisions.test.ts:1

Behavioral change lives in the shell fetch-step, not the decision. Missing scenario: Org A has SUC for contract C; Org B member moves C to a different Org B site — should move only Org B's SUC, leave Org A's untouched. No shells integration test file exists at all.

FirstClaim path for cross-org contract sharing is untested

domains/utility/src/site-utility-contract/__tests__/site-utility-contract.decisions.test.ts:1

When Org A has a SUC for contract C and Org B calls linkSiteToContractShell, the shell routes to FirstClaimLinkedSite (insert new SUC). No test verifies this path — a future global-dedup change would collapse two org claims silently.

resolveVersionServerSide OCC path is untested

domains/utility/src/site-utility-contract/__tests__/site-utility-contract.decisions.test.ts:79

Server-side version resolution now uses the org-scoped existingSuc. No test verifies in-transaction version threading or that a concurrent move surfaces as a 409 via reassignSiteWithVersion.

findSitesForContractInOrg query has no integration test

domains/utility/src/site-utility-contract/site-utility-contract.queries.ts:110

Load-bearing primitive for the cross-org fix. Should verify: (1) returns only org-scoped SUCs when contract has multi-org links; (2) returns [] for no match in org; (3) ORDER BY createdAt makes [0] deterministic.

No shell-level test for null contract/site early-exit path

domains/utility/src/site-utility-contract/site-utility-contract.shells.ts:300

The contract && newSite guard now skips the DB query when either is null. Decision tests cover the not-found errors at the decision layer but no test verifies the shell propagates them end-to-end.