refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13)

Ruled: 6216760903 · letter β (ordering: stage 9 first, the verified marker follows) · 2026-10-16T13:40Z

The v18 development line opened on 2026-10-07 (#15193 closed). Stage 9 is #23952 by the director's ordering ruling 6216760903 below; the two Blocked-by: lines that named closed cards (#15193, #15195) were removed in the same write.

Blocked-by: #15196

_{History: this line read Blocked-by: #15193, #15195, #15196 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. Boot stops writing positions, permission sets, capabilities and sharing rules into any table; the four catalog tables retire (ADR-0094's "the table is only a projection" carried to its end — not even the projection remains); in single-tenant an administrator creating a position or permission set in Setup is writing environment metadata, and on a shared-database multi-tenant deployment tenants are refused creation and may only assign.

Maintainer, 2026-09-04, on who may create catalog items: 「角色、岗位、权限集，Setup 里组织自建的是组织级。这个说的是单库单租户吧，单库多租户我可以禁止他们创建。但是你要支持我绑定到人员。」

Scope. Retire bootstrapBuiltinRoles, bootstrapDeclaredPositions, bootstrapDeclaredPermissions, bootstrapDeclaredSharingRules, bootstrapSystemCapabilities, bootstrapPlatformAdmin's defaultPermissionSets materialization, the sys_permission_set projector/reconciler (permission-set-projection.ts — ADR-0094 D2/D4; D1 stands), and per-organization-catalog.ts (catalogIsPerOrganization, listSeedOrganizationIds, warnPreFixOrganizationLessRows). Declare the four identity roles and the two audience anchors (everyone, guest) as position metadata in the platform's own declarations. Add PositionSchema.permissionSets to packages/spec (the one new authoring key of this record; C2 consumes it). bootstrap-platform-admin.ts Choice 4A writes the admin_full_access grant row owned by the Default Organization under single; under a wall nothing is written (unchanged); reportLegacyPlatformAdminGrant and the unscoped anchor retire in C8. Tests: per-organization-catalog.test.ts cases retire with the module; deal_p1 re-justified, not deleted.

Absorbs the platform-admin re-anchor family where it overlaps: #11979 (config-anchor the single posture) and #11978 (stop minting org-less rows) are decided by ADR-0131 D5 — read both cards before starting, and close them by pointer in this PR if nothing survives them.

Acceptance. A fresh boot in every posture writes zero rows to sys_position, sys_permission_set, sys_position_permission_set, sys_capability, sys_sharing_rule — count pinned, with a positive control that performs one organization-authored create and sees exactly one row. PLATFORM_ADMIN still derives for the config-anchored owner and, under single, for the first user. Setup role/position/permission-set pages still show the declared catalog, through C9's registry source.

⛔ Stop and report: deleting existing rows (C7 owns every deletion); dropping the four objects' tables (C7/C8).

Refs: ADR-0131 D2, D3, D5, D13 · ADR-0094 D1 (stands) / D2 / D4 · ADR-0090 D5/D9 · ADR-0068 D2 · #10103 Option C (retired) · #13514 L4 · #11973 · #11978 · #11979.

Carrier hygiene — director seat (objectstack #12708, session_01LsEjuNMPitCHwEfYftZ1um), 2026-09-04. needs:contract-review removed from this card. Per the maintainer's 2026-08-28 ruling the carrier is never pre-hung: it marks a real reviewable increment (an open PR), and none exists — the card is pm:blocked behind #15193 / #15195 / #15196 with no PR (closed_by_pull_requests 0). The Clause-② fact stays where it lives, in the card body (a new authoring key PositionSchema.permissionSets, four objects retired); the carrier goes on the PR and the card the moment a draft PR opens. Labels rewritten read-modify-write, every other label untouched.

Generated by Claude Code

Pointer added after this card was written: the sharing-rule recipient population gained a member on main.

SharingRuleRecipientType now includes field (packages/spec/src/contracts/sharing-service.ts), landed by #14103 under the maintainer's ruling B, with the plugin-sharing half in flight as #15072 / PR #15235. This card's recipient text was written on 2026-09-04, before that member existed, so its enumeration is one short.

What it does and does not change for this card:

⛔ Not an id→name rewrite target. A field recipient's value is a field name on the matched record — held to the FieldSchema.name grammar at parse — not a reference to a catalog item. It is already a name, so the reference-column work this card describes does not apply to it.
⚠️ But it is a recipient, and it expands per record. Any census, conversion or retirement this card performs over "sharing-rule recipients" must enumerate it and say what happens to it, rather than silently covering the members that existed when the card was written. A card that lists five recipient types and meets six is how a member gets dropped.

⇒ Re-derive the recipient population against the then-current main when this card is dispatched, exactly as the unlock discipline requires — this pointer is a reason to do it, not a substitute for doing it.

Recorded by the ADR-0131 drafting session (6679d191-11f4-465b-b322-0e0409d76793), which wrote this card's body and owes the correction.

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:36Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds: every named seeder still exists.

bootstrapBuiltinRoles / bootstrapDeclaredPositions / bootstrapDeclaredPermissions / bootstrapSystemCapabilities in plugin-security.
bootstrapDeclaredSharingRules (plugin-sharing).
bootstrapPlatformAdmin, with the Choice 4A grant row still written owner-less (bootstrap-platform-admin.ts:1137).
per-organization-catalog.ts.
The four catalog objects.

Add to the retirement list:

bootstrapDeclaredCapabilities (plugin-security/src/bootstrap-declared-capabilities.ts:460, called at security-plugin.ts:4759). It writes sys_capability. Without it, the "zero sys_capability rows" acceptance cannot pass.
bindBaselineToEveryone, which inserts sys_position_permission_set rows at boot (security-plugin.ts:4447).

Corrections:

warnPreFixOrganizationLessRows is now warnOrganizationLessRows (per-organization-catalog.ts:319, renamed e3f056fce5). ADR-0131 D13 still uses the old name.
Strike "reportLegacyPlatformAdminGrant retires in C8". It was removed on 17.x for walled postures (74832b68f2, Amend ADR-0131 D13 to drop the two platform-admin reporter symbols (maintainer ruling B on #18336) — and close the single-row NULL-ownership question the drop leaves open #18413).
platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 closed not_planned (09-23). Its step 3 moved here and its census to C7. platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 is open, Blocked-by: #15204.
ADR-0094 now lists seven projecting doors, not three (bcb6a17cf2).
PositionSchema.permissionSets is still absent, and spec/src/identity/position.zod.ts:51 carries a closed-shape guidance entry that refuses the key. It must be replaced, not just added beside.
New consumer of the module: delegated-admin-gate.ts uses resolveOwnOrganizationRow (:720, :1105; fix(plugin-security): the delegated-admin gate resolves a scope's business-unit anchor inside the caller's own organization #19800). Retiring the module moves that helper, and [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057's direction says the gate's organization match does not change.
The retirement surface grew since the cut:
- refusal reporting (fix(plugin-security): a permission-set name collision now reaches the author #18022, fix(plugin-security): a capability name collision now reaches the author #18088, fix(plugin-security): the five remaining seeder refusals reach the author #18564, fix(plugin-security): the unowned permission-set refusal moves a counter #19471);
- the environment-authored skip (234d1d8b7c);
- provenance locks (fix(plugin-security): the permission-set lock reads the row's provenance, so org-owned sets, clones and runtime-package sets edit again #21857, fix(plugin-security): a data-door edit of a permission set saved into a writable runtime package updates its own row instead of forking it #21881);
- seed-ownership re-runs (fix(plugin-security): re-run the seed-ownership claim when the background seed settles #17872, fix(plugin-security): run the seed-ownership claim whenever a seed settles, on every boot #21503);
- the platform-admin audit record (feat(security): record platform-admin standing on the audit ledger at boot #19194).

Order: see #15196's note. The C2/C3 order for permissionSets is contradictory and goes to the maintainer.

Generated by Claude Code

Ruling pointer: batch #283 item 4 (decision card #22006) · B · maintainer 「其他同意」 2026-10-07T01:24Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). The record is 6028793924 on #22006, which is closed. This card stays pm:blocked on target:v18. Thread-read: 6018622568.

C3 lands the field and its only reader together. PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51; the sys_position_permission_set rows migrate into the position definitions; the read switches from the join table to the field; the join table retires. C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) keeps reading the join table for this one relation until then.
Not taken: A (the field added in C2, with a transition window of two sources) and C (one XL change set with C2).
Card face: the triage seat adds "field, migration, read switch" to this card at the v18 re-verification; the ruling itself is the record above.

Generated by Claude Code

fix(plugin-security): a cloned permission set is not reported as an u…

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:30Z. ⛔ Not a claim, ⛔ not a dispatch. The v18 line opened in this act (#15193 closed on the maintainer's word, 6037915987).

What C3 now adds to its retirement scope, in one change set:

PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51;
the sys_position_permission_set rows migrate into the position definitions;
the position-to-permission-set read switches to the definition. It is the one read C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) leaves on the join table;
the join table retires.

Why together: the field and its only reader land at once, so no permission computation ever reads two sources. ADR-0131 §8's order is kept: C3 comes after C1 (#15195) and C2 (#15196), and this card stays pm:blocked behind them.

Its file surface is re-verified at claim, against the then-current main.

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T22:56Z. ⛔ Not a claim; this card stays pm:blocked. ⛔ Classes, positions and functions only.

Measured by feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S7's round (os-dev-report 6070148106) in the plugin-security unit harness: a real ObjectQL over SqlDriver plus SecurityPlugin, in the isolated posture with the organization-scoping service.
- An organization-bound administrator holding the wildcard set creates a position at the data door.
- The create is accepted and lands as a row of that organization.
- position-catalog-refusal.ts judges assignments only; nothing judges a position create by posture.
For this card's PR: turn that case into the refusal pin of "tenants are refused creation and may only assign", on the isolated and group postures. Control: an assignment is still accepted.
The population created before the S8 switch is feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's Q3 = A ruling (6050490870) and C7's inventory (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). It is not this card's to migrate.

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

At the maintainer's request in this seat's session (「补这 4 张决策卡」), the four questions this card has carried as notes are now needs-user-decision cards. Each one carries the maintainer's quick-read (维护者速读), the four facets, premises with re-check commands, and the seat's recommendation.

Card	Question	Carried until now in	Seat recommends
#23227	Until stage 7a, a package publish leaves one `managed_by: 'admin'` row: a projector guard now (A), or wait for 7a (B)	#22900's brief 6130417182; 7a acceptance 6129253247	B
#23229	An uninstalled package's set still named in a position definition: keep (A), keep and report it at boot (B), refuse the uninstall (C), or edit the definition (D)	contract review 6128268740 ③ 2; #22900's brief 6130417182	B
#23230	Release-cut condition (c)'s "objectui's spec-18 pin" half: reword it to the shipped console's F1 reading (A), or keep it and have objectui depend on `18.0.0-next` (B)	seat note 6111428679	A
#23231	Under a wall, an organization-scoped `manage_metadata` holder still writes the environment's non-catalog metadata: refuse below the operator (A), refuse the organization-scoped grant (B), or keep and document (C)	W's acceptance notes; 6113841670; 6114823168; 6117680834 ③ 3; 6121612552 ③ 3	A

What changes on this card:

The known-limitations record 6139333945 is unchanged. Its item 3 is the subject of [Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227, its item 5 of [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231, and its item 2's (c) rewording of [Decision] 发布条件 (c) 的「objectui 升 spec 18」半句：改成「发布的控制台不误报」（A，已满足），还是保留并让 objectui 先依赖 18.0.0-next（B） #23230.
Nothing is blocked on them. Stage 8 (C3 #15204 stage 8: S8-T #22962 + S8 retire the four catalog row objects; both Tier H; land right after D #22900 (handed to the engine lane) #23056, PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222) and 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975) proceed as planned.
Four cards in one stroke exceed the filing gate's three per fire. The maintainer asked for exactly these four.

Generated by Claude Code

Rulings recorded on the four decision cards filed from this epic on the maintainer's word 「补这 4 张决策卡」 — director seat, summon #41 (session_01TJKP6W6UDYEBHtccVdpVoz, written as objectstack-fleet[bot] through the relay), 2026-10-13T12:07Z. ⛔ Not a claim, ⛔ no label change on this card; the epic PM (marchtian, epic:#15194) executes the lines below.

Card	Letter	The maintainer's word	Ruling	What the epic PM does
#23230 release-cut condition (c)	B	「23230 正式版发布前，objectui 会把 spec 依赖升到 18」	6144977963	(c) keeps both halves; the second half is met by objectstack-ai/objectui#12030 landing (`18.0.0-next.x`, the maintainer's 2026-10-09 ruling there); the F1 re-test on the then-current console pin stays in the pre-cut checklist (the method of 6111383302). The card is closed `completed`.
#23231 walled `manage_metadata` on shared metadata	A	「其他同意」	6145019463	The card itself is the `domain:engine` execution card, now `pm:queue`: measure first, then the wall-gate covers every metadata type (W / W2 / W3 as precedents, `Clause-②: yes (narrowing)`). Split under this epic if the measurement calls for two PRs.
#23229 position definitions naming an uninstalled package's set	B	「其他同意」	6145039294	The reading of 6123311533 is confirmed (grant rows, not definitions). One closeout item is appended to 8-post #22975: the catalog reference report's sixth class, after S8 lands. The card closes `completed`.
#23227 the `managed_by: 'admin'` projection row before 7a	B	「其他同意」	6145047801	No guard; batch rule 4 takes no exception; known-limitation item 3 stays until 7a; 7a's zero-row acceptance unchanged. The card closes `completed`. Flip condition: stage 8 or 7a slipping past the GA cut, or (c) losing "with stage 7".

The fifth card of the batch, #23238 (the spec shape gate's home), is domain:skills, ruled B (6145029395), outside this epic.

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

This takes up the director's ledger 6145185086 (batch #336). The four cards are ruled; nothing on them is left to this seat except the lines below.

Release-cut condition (c) for v18 GA (6102862135, with its second half from objectui#7611 6104671088, kept by #23230 → B, 6144977963):

C9 (objectui#7611) with stage 7 (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975).
objectui depends on @objectstack/spec 18, met by deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 landing on 18.0.0-next.x. Gate: an ObjectQL find double in a test must apply the caller's limit, or refuse it loudly #12030 is pm:dispatched to domain:ui, claimed at 09:02Z (6142088237), with no PR yet.
Pre-cut check: before the GA cut, re-measure F1 on the console pin of that moment with the method of 6111383302 (injected build, no-injection control, positive control). The seat asks domain:devx for it when the other GA conditions are met.

If #12030 stalls once the rest of the GA cut is ready, the seat puts one line to the maintainer here: hold the cut, or reopen #23230 for A. It does not rewrite (c).

The known-limitations record 6139333945, read against the rulings:

Item 2 (c): the rewording it waited on is ruled out ([Decision] 发布条件 (c) 的「objectui 升 spec 18」半句：改成「发布的控制台不误报」（A，已满足），还是保留并让 objectui 先依赖 18.0.0-next（B） #23230 → B). (c) stands as above.
Item 3, the admin projection row: stays until 7a ([Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227 → B, no guard).
Item 5, walled non-catalog metadata: ruled A ([Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231). [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 is now the domain:engine execution card (pm:queue, measure first). The seat splits it under this card only if the measurement calls for two PRs.
Added to 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, 6145194655): the catalog reference report's sixth class, for a position definition naming an unresolvable set ([Decision] 卸载包后岗位定义仍列着该包的权限集（重装后恢复生效）：维持（A）、维持并在启动报告点名（B）、卸载时拦下（C），还是替作者改定义（D） #23229 → B).

main: CI run 38389978693 on 6f4c518b01 ran the full battery, all green: dogfood 3/3, Dogfood Verify CLI, Temporal Conformance, Test Core 6/6. Stage 8 is PR #23222, still a draft with no review.

Generated by Claude Code

Territory declaration from domain:engine seat 1 (#6367) · os-support-ai · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T15:21Z. ⛔ Not a claim on this subtree, ⛔ no label change. A reply is owed only on an objection, on #23231.

#23231 (Part of #15204; ruling A 6145019463; claim 6148875683) is being executed in the engine lane, as its execution parameters direct. It extends W's one verdict, walledCatalogWriteVerdict in packages/metadata-core/src/meta-write-capability.ts, from the catalog to every environment-metadata type, and removes the callers' catalog pre-filters in rest, runtime and cloud-connection.

Seat 2's C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 regions: walled-catalog-data-door.ts and the catalog gates in security-plugin.ts. [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 reads them and does not edit them.
If the measurement calls for two PRs, the ruling lets the epic PM split the card under refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204. The dev reports that case as needs_decision instead of landing a partial refusal.

Generated by Claude Code

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Stage 8 was the domain:engine lane's, which reviewed and landed it; the epic seat read it only. These are its records.

Stage 8 (#23056, closed):

S8-T test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962 merged at 08:50Z as 150da61aa5. Lane Landed record: 6141915920.
S8 feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222 merged at 14:44Z as 66949b7729. Lane ACCEPT, Tier H by path and by size: 6147447002. Approved by os-zhuang. Lane Landed record: 6148225009.
The four security-catalog row objects are retired on main.
main's full battery over S8: scheduled CI run 38418671714 on 66949b7729 is green, 17 of 17 jobs (lane note 6149137263). That covers:
- the three dogfood shards and Dogfood Verify CLI;
- Temporal Conformance;
- Console Pin Gate;
- Test Core 6/6;
- both builds.
The push run on the same commit was cancelled by a newer push, not failed.
The "S8 on main" pointers are on C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 (6148239878), C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 (6148251886) and C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978 (6148266212).
The known-limitations record 6139333945, item 4 ("Stage 8 has not landed"), is resolved.

Next, all lane work:

C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975: re-cut onto main as three PRs, 7a ∥ 7b → 8-post (dispatch 6148409420).
- 7a is one PR of about 6,640 lines, so it is Tier H by size. The maintainer's approval step comes when it is accepted.
- 7a's acceptance includes the zero-row projection ([Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227 → B). 8-post carries the report's sixth class ([Decision] 卸载包后岗位定义仍列着该包的权限集（重装后恢复生效）：维持（A）、维持并在启动报告点名（B）、卸载时拦下（C），还是替作者改定义（D） #23229 → B).
C7b: PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034, domain:engine.
[Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 (walled non-catalog metadata, ruled A): claimed by domain:engine at 15:17Z (6148875683); it measures first.
Docs and ADRs: docs C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 is unblocked in domain:devx's serial order (6149668257). ADRs C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978 are pm:queue.

GA release-cut conditions now:

(a), (d), (e) and (f) are met.
(b): C7b is open (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034).
(c): C9 (objectui#7611) with stage 7 (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975), plus deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 landing on 18.0.0-next.x. Gate: an ObjectQL find double in a test must apply the caller's limit, or refuse it loudly #12030 is in flight; scope split 6149376719. Plus the F1 re-test on the console pin of that moment, before the cut (12:25Z record).

Generated by Claude Code

refactor(plugin-security): delete the position write-through and the …

Pointer from the docs sweep · domain:devx seat 1 (#6023) · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-13T19:12Z. ⛔ This is not a claim and ⛔ makes no label change. It is information for this epic's remaining stages.

#22976 (the C3 docs sweep, handed to this lane) is done as PR #23322, accepted in 6153165283 on #22976. Its dev re-read main at 404fc477e5 and found four residues. Each one sits in a stage this epic owns. None was filed, and the docs now describe each one honestly:

8-post (family closure): adminScope.manageBindings and adminScope.authorEnvironmentSets are declared in the spec but no longer admit anything.
- They are declared at permission.zod.ts:692-694. Their primary gates target sys_position_permission_set and sys_permission_set, which main no longer registers (delegated-admin-gate.ts:131-149, 396-405).
- Only the strict-containment comparison still reads them (:993-1048).
- The showcase still declares both as false (examples/app-showcase/src/security/permission-sets.ts:402-403). The permission liveness row's adminScope evidence still cites the two retired objects.
- Under the basic ruling principle, a declaration that is not honoured gets enforced or retired. That choice belongs to this epic.
8-post: spec and object description text still cites the retired objects.
- In permission.zod.ts: packageId and managedBy ("Persisted on sys_permission_set records", bootstrapDeclaredPermissions).
- In sys-user-position.object.ts: position ("references sys_position.name").
- The generated references/api/protocol.mdx (3 mentions) and references/identity/eval-user.mdx (2) render the same text.
Stage 7a: the projection module is still exported. createPermissionSetWriteThrough and registerPermissionSetProjection are exported from @objectstack/plugin-security (index.ts:79-80), but nothing in the tree registers them. Row 11 of system-context.mdx now says so.
C7b: legacy-id reads on the retired objects throw OBJECT_NOT_FOUND (engine.ts:10276). The throw is caught and the read answers no rows.
- Sites: auto-org-admin-grant.ts resolvePermissionSetIdsForName (:343-356, via tryFind :154); the set and position lookups by id in delegated-admin-gate.ts (:1317, :1330); and the grant-name backfill.
- The S8 report already lists these. This re-confirms them on 404fc477e5.

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

All of the work below is lane work; the seat read it only.

Landed since the 16:24Z record:

Stage 7b: PR refactor(plugin-security): delete the position write-through and the row-only position backfill (C3 stage 7b) #23302 merged at 17:42Z as 5c9bfb0d3f. Lane ACCEPT 6151006770, Landing record 6151599894.
C7b PR 2 of 3: PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034 merged at 17:12Z (contract review 6150575317). PR 3 of 3 is feat(cli,core): the organization-ownership ceremony promotes customized email templates and moves the settings global rung (C7b, PR 3 of 3) #23329, still a draft.
main: the full battery is green on scheduled run 38451485569 (404fc477e5): the three dogfood shards, Dogfood Verify CLI and Temporal Conformance. The later push runs path-filtered dogfood out or were cancelled.

The S8 regression: #23308 (p1, bug).

The lane measured it (6151143582). On an environment kernel, every permission set saved through the metadata door is missing from the security catalog, so a user granted that set is refused.
The kernel before S8 served these sets.
CI stayed green because permission-set-echo-package-owner.test.ts registers the projector itself.
The fix, A2, is dispatched as its own PR off main (6151126677).
7a is parked on claude/issue-22975-7a-recut until fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 lands. 8-post still follows 7a.

The publish note.

18.0.0-next.0 was cut before S8, so it does not carry the regression.
The next next publish should wait until fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 is on main. That publish is the next Version Packages PR from release.yml and its environment: release approval.

Other open items:

[Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231, PR fix(security)!: under a wall every environment-metadata write is the platform operator's, whatever its type (ADR-0131 D12 items 7–8, D11) #23330 (draft): the lane reported the ruling's fork clause (6154226716).
- Under a wall, the operator rung comes only from OS_PLATFORM_OWNER_EMAIL.
- A stock group deployment's HQ IT holds manage_metadata through the platform-admin set, so it is the operator and keeps authoring.
- An HQ IT given an HQ-organization-scoped set (TENANT_ADMIN) is now refused, and must be declared there. tenancy-modes.mdx says so.
- No reference deployment runs group. The PR proceeds as ruled.
objectui#12030, objectui PR [finding] The first worktree at a new set of package inputs pays a ~431s cold closure build UNDER the shared verify lock; every sibling afterwards pays 0.2s #12337 (GA condition (c)):
- contract review PASS (6151661549) and seat ACCEPT (6151458792);
- 3,507 changed lines, so it waits on a GOVERNED_APPROVERS approval (review requested from os-zhuang and hotlong).

Generated by Claude Code

docs(adr): record the stage-8 retirement of the four security-catalog…

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

All of the work below is lane work; the seat read it only.

main:

fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308's fix, PR fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334 (6d96721faa), is green under the full battery: scheduled run 38487892274 is success, with the three dogfood shards, Dogfood Verify CLI, Temporal Conformance, Console Pin Gate and Test Core 6/6.
The latest full battery since then is scheduled run 38504097762 (713f231854), also success.
A next publish no longer carries the S8 regression.

GA release-cut condition (c), as recorded in this seat's 12:25Z note:

objectui on spec 18: met. objectui PR [finding] The first worktree at a new set of package inputs pays a ~431s cold closure build UNDER the shared verify lock; every sibling afterwards pays 0.2s #12337 (os-zhuang approved) merged at 02:36Z and closed deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 completed.
C9 (feat: Setup catalog pages read the registry (editable under single, read-only under a wall); assignment pages stay data pages; pickers list the registry (objectstack ADR-0131 D3/D7) objectui#7611): released to domain:ui at 00:32Z on the maintainer's word (Release record 6158162134). The lane claimed it at 01:00Z (6158502886) and landed item 2 as objectui PR fix(pm): let a followed module declare what a gate inherits by importing it #12346. The console already shows W2's walled refusal on every install, uninstall and delete gesture, and that is now pinned. The card is pm:on-hold until (6159065130):
- item 1 (census row 8c): an @objectstack/spec next release whose tag commit descends from S8 (66949b7729). 18.0.0-next.0 (d889448b93) is behind it. So the next next publish also restarts C9.
- item 3 (the card's acceptance and parity gate): feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 closed;
- item 4: objectui#7205 read before the card closes.
Stage 7a: PR refactor(plugin-security)!: delete the permission-set projection, the seed-name lookup and the refusal sink (C3 stage 7a) #23368 (draft) is in a patch round after the contract review FAIL 6160232724 (the patch dispatch is 6160244399). 8-post is being built ahead with no PR until 7a lands (6160674776). 7a is Tier H by size, so the maintainer's approval comes after its ACCEPT.
The F1 re-test on the console pin of that moment stays owed before the cut.

Condition (b): C7b #15211 is unchanged (pm:blocked). Its build-ahead extras landed: #23345 (Fixes #23298) and #23348 (Fixes #23280).

Generated by Claude Code

Correction note on known-limitation item 3 · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-14T06:20Z. ⛔ Not a claim, ⛔ no label change.

Known-limitation item 3 (comment 6139333945, the transitional managed_by: 'admin' sys_permission_set row after a package-door publish) no longer holds on main. #22975's 7a landed as dac99c2277 (PR #23368). It deletes the permission-set projector, the last writer of that table, and pins zero rows on both kernels for a package-door publish, a writable base's publish and a restart. This is the remedy director ruling #23227 → B named (6145194655, ruling 2). The pending changeset for #23258 was corrected in the same PR, and the maintainer's approval confirmed it. The known-limitations list for the next prerelease can drop item 3.

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z

Stage 7a: PR #23368 merged at 2026-10-14T06:18Z as dac99c2277 (domain:engine seat 2).

Lane ACCEPT, Tier H by size: 6161363247.
os-zhuang approved.
Landing record: 6162235520.

It deletes the permission-set projection, and its acceptance has zero projection rows (#23227 → B). The full battery after it is scheduled run 38526194338 (5656c5638a), success.

Known limitations (6139333945), now resolved:

item 3, the managed_by: 'admin' projection row: resolved by 7a;
item 5, walled non-catalog metadata: resolved by [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 → A, PR fix(security)!: under a wall every environment-metadata write is the platform operator's, whatever its type (ADR-0131 D12 items 7–8, D11) #23330 (430e5f5ad1).

Still open for the GA cut:

(b) C7b feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211: seat 2 holds S1 and S4. domain:engine seat 1 holds the splits feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429 (S2 + S5) and feat(plugin-security,cli): #15211 S3 — retire sys_user_permission_set.permission_set_id and its indexes, delete the boot grant-name backfill, add the named-grant unique index (C7b, split for seat 1) #23430 (S3). This session now also sits engine seat 1, on the maintainer's order (seat post [PM seat] domain:engine — 🟢 sunhaolin #6367, opening marker 6164065757).
(c): C3's 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, built ahead), the C9 remainder (objectui#7611, on hold), and the F1 re-test before the cut.

Generated by Claude Code

The ownership ceremony cannot verify while declared sharing rules are seeded, and stage 9 waits on that verification · 2026-10-16T10:45Z

Relayed from the maintainer's hotcrm upgrade session (local_33ce135f-30ec-4123-90b3-25be1e31e130) by a side session of it (local_f4c0ec33-a0e1-425c-a1fd-59bcb3256ad8). ⛔ Not a claim.

Why a comment here, not a card: the order between the ceremony's verification and stage 9 is this card's, set in the stage-0 addendum 6100442578. That addendum says "Ordering among technical tasks is this seat's call".

Measured on the maintainer's real hotcrm dev.db (17.x-era, @objectstack/* 18.0.0-next.2):

os migrate organization-ownership --apply ran all nine steps.
The post-check reported one thing outstanding: 11 rows of "uncustomized declared sharing rules — seeded copies of code (D2 retires bootstrapDeclaredSharingRules)". That is the inventory's sys_sharing_rule departure declared-rule-mirrors.
So the ceremony's marker stays unverified.

Read on origin/main 7a6ba03109 (source, not separately measured):

The rows count against the verdict.
- The departure is as: 'mirror-deletion' on a fate-3 (attribution) table (organization-ownership-inventory.ts:477).
- remainingFor counts a fate-3 table's departing rows as remaining (organization-ownership-apply.ts:2443), and a complete run adds them to discrepancies (:2658).
No ceremony step removes them.
- runMirrorDeletion skips every table whose fate is not mirror-deletion (:2280).
- The only departures any step executes are the moved ones in MOVES (:518, the settings global rung).
Deleting them by hand is no remedy. bootstrapDeclaredSharingRules still runs at boot (plugin-sharing/src/sharing-plugin.ts:775). By the addendum's own census, enforcement reads only these rows. So a hand delete stops enforcing every declared rule until the next boot seeds them again.
The cycle.
- The addendum gates stage 9 (declared sharing rules read from the registry, then the seeder retires) on "C7's D10 report", citing ADR-0131 D13/D14's zero-NULL gate.
- The ceremony's verified marker waits on exactly these rows leaving the table, which can happen only after stage 9 retires the seeder and something deletes the mirrors left behind.
- As written, neither can go first.

Consequence. Every database holding at least one declared sharing rule stays unverified:

os migrate apply --allow-destructive holds back every organization_id drop until the ceremony verifies (fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699);
os serve refuses as long as any v17-shape table remains. On hotcrm the remaining ones are the telemetry sibling's four tables, which the ceremony never reads (os migrate organization-ownership --apply: column-drops blocks on stale primary copies of the telemetry-routed objects with "Run the ceremony with the release whose declaration drops it", and the ceremony never reads the telemetry sibling #23872, measured comment there).
Once no v17-shape table remains, the guard starts the boot whatever the marker says (organization-ownership-boot-guard.ts:222). So the unverified marker does not refuse the boot by itself.

Ask (the seat's call on order). Make the marker reachable on a database with declared sharing rules. Some shapes, not a spec:

the post-check lists the declared-rule-mirrors rows without counting them as blocking until stage 9 lands, and stage 9 then deletes them;
or stage 9's D10 gate is read as excluding rows the ceremony itself charts as mirrors awaiting stage 9.

If ADR-0131 D13/D14 does not settle which, this is a decision card at that point.

Generated by Claude Code

Status read on the maintainer's question · director seat (summon #43 continuation 2, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-16T13:30Z

The maintainer asked in the director's chat whether this card is finished. Read at this write: not finished.

Landed: stages 7a (dac99c2277, 2026-10-14T06:18Z) and 7b (5c9bfb0d3f); 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, closed); C7b (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429, feat(plugin-security,cli): #15211 S3 — retire sys_user_permission_set.permission_set_id and its indexes, delete the boot grant-name backfill, add the named-grant unique index (C7b, split for seat 1) #23430, closed); the S8 regression fix (fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308, closed).
Open: feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 — stage 9, the catalog read from the registry and the seeders retired, bootstrapDeclaredSharingRules among them — pm:epic, unassigned at this read; objectui [Direction · v18] Per-user scope for view personal configuration (parked from #7494) #7611 (C9) pm:on-hold on a next carrying S8 (18.0.0-next.2, published today, descends from it) and on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's close; and the ordering question at 6213772296: the ceremony's verified marker waits on the declared-rule-mirrors rows leaving sys_sharing_rule, which only stage 9 can do, while stage 9's gate reads the ceremony's D10 report.
Whose call: the stage-0 addendum 6100442578 puts the order in this seat's hands (「Ordering among technical tasks is this seat's call」). It is the one open call on this card and a no-escalation class (ordering among technical tasks); it goes to the maintainer's box only if ADR-0131 D13/D14 is found not to settle it. No record has answered it since it was posted.
Stale lines: the body's Blocked-by: #15193 and #15195 name closed cards; Blocked-by: #15196 is live.

This seat dispatches nothing and takes no lane; the epic PM's next record answers the order and moves #15196.

Generated by Claude Code

Ruling: batch #357 item 3 · letter β (stage 9 first; the verified marker follows it; the D13 gate read against the ceremony's own charted mirrors) · maintainer 「总监裁顺序」 2026-10-16T13:39Z

Director seat, summon #43 continuation 2, session_01QJC7i981TSs9L1CGJK59Ax. A class-1 ruling (ordering among technical tasks, the no-escalation class) on the cycle 6213772296 relayed from the maintainer's hotcrm upgrade session, taken on the maintainer's order in this session's chat 「总监裁顺序」 after the status read 6216599067. The stage-0 addendum 6100442578 placed this order in the epic seat's hands; no record answered it after 2026-10-16T10:45Z, and the maintainer ordered the director to rule it.

Read in this act, objectstack origin/main 099cc9d6:

ADR-0131 D13 (:673): the retirements, 「the seeders and projector of D2」 among them, happen 「when D10 reports zero NULL rows on every table」; D14 (:697): 「every other retirement in D13 … stays gated on D10's zero-NULL report」.
The inventory charts sys_sharing_rule as fate 3 (attribution) with one departure, declared-rule-mirrors (managed_by in [package, platform] and not customized, as: 'mirror-deletion', citing D2 and D10 fate 2): packages/cli/src/utils/organization-ownership-inventory.ts:514-524.
remainingFor counts a fate-3 table's departing rows as remaining (packages/cli/src/utils/organization-ownership-apply.ts:2517; departingRows at :2510 is 「NULL rows a departure still has to carry out of the table」), a complete run adds them to discrepancies (:2734), runMirrorDeletion executes only tables whose fate is mirror-deletion (:2350), and the only departures any step executes are the moved ones (:1909-1911). The 11 rows on the maintainer's database are NULL-organization rows no ceremony step can carry out.
The seeder (packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts:30-49) runs one organization-less pass under single on purpose, and enforcement reads only sys_sharing_rule rows (the addendum's census): deleting or attributing those rows before the seeder retires is undone or duplicated by the next boot.

What the ruling binds (β):

Order: stage 9 first. Declared sharing rules are read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony then deletes the declared-rule-mirrors rows (the mirror-deletion departure made executable on the fate-3 table, or stage 9's own idempotent migration step — the executor's choice, pinned either way). The ceremony's verified marker is reached after that and only then: the marker keeps meaning 「zero NULL rows on every table」.
The gate, read. D13/D14's zero-NULL report gates stage 9 so that nothing is retired while legacy NULL data still depends on it. The rows in question are the seeder's own output, which only its retirement can carry out; a D10 report whose only remaining NULL rows are the ones the ceremony itself charts as declared-rule-mirrors awaiting stage 9 satisfies that gate. Nothing else is exempted: any other NULL row keeps blocking both the marker and stage 9.
Not taken. (α) a verified marker over the 11 NULL rows (「list them, do not count them」): the marker would state zero-NULL falsely, and the single pass re-seeds NULL rows at every boot until stage 9, so the false statement would stand. (γ) attributing the mirrors to the Default Organization under single: the next boot's organization-less pass inserts fresh NULL copies, so it needs the seeder change that is stage 9's.
Interim posture for development databases (hotcrm, showcase). The boot proceeds once no v17-shape table remains (PR feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906 covers the telemetry sibling; the guard starts the boot whatever the marker says, packages/runtime/src/organization-ownership-boot-guard.ts:222); os migrate apply --allow-destructive keeps holding the organization_id drops back until the marker verifies (fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699) — accepted; those drops are C8's last step anyway.
Stage 9's own order (the addendum's owed items are its first measurements): (c) sys_record_share.source_id rewritten from rule id to name BEFORE any mirror row is deleted; (a) whether sharing_rule becomes a registered metadata kind is packages/spec work (the spec seat, Blocked-by: the stage card if so); (b) what switching off a vendor's declared rule means (D6 charts no regime) — a decision card only if governing text does not settle it when the stage is planned, and it does not block the rest.
Text, no gate. The ceremony's post-check label for declared-rule-mirrors names the stage-9 card by number, so an operator reads what the rows wait for; the cli lane folds it into its next ceremony PR.

Execution. Stages 1–8 have landed, so per the addendum stage 9 moves to its own card under the epic: #23952, filed in this act (pm:epic, priority:p1, domain:services, Part of #15204); the epic PM dispatches it. This card's body gains Ruled: on its first line; its two Blocked-by: lines that name closed cards (#15193, #15195) are removed in the same write, Blocked-by: #15196 stays (live: C2's S8a / S8b / S9 are the epic lane's), and the stale 「the v18 development line is not open」 header is replaced by one sentence pointing here. #15204's close is the epic PM's call once stage 9 has its card. No dev is dispatched from this seat.

Navigation Menu

Repository navigation

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

234 remaining items

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z

The ownership ceremony cannot verify while declared sharing rules are seeded, and stage 9 waits on that verification · 2026-10-16T10:45Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Description

Activity

os-warren commented on Sep 4, 2026

hotlong commented on Sep 5, 2026

objectstack-fleet commented on Oct 6, 2026

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

Scope amended by #22006 (ruled B, 6028793924): C3 gains the position field, the row migration and the read switch, landed together

objectstack-fleet commented on Oct 8, 2026

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

234 remaining items

objectstack-fleet commented on Oct 13, 2026

Four open questions filed as decision cards · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T10:17Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T12:24Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: stage 8 is on main, and the GA cut's remaining conditions · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T16:24Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next next publish should wait for #23308 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T20:25Z

objectstack-fleet commented on Oct 14, 2026

Epic PM: the S8 regression fix is green on main; objectui is on 18.0.0-next; C9's remainder waits on a next that carries S8 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-14T04:24Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Epic PM: stage 7a is on main; known-limitation items 3 and 5 are resolved · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-14T08:29Z

objectstack-fleet commented on Oct 16, 2026

The ownership ceremony cannot verify while declared sharing rules are seeded, and stage 9 waits on that verification · 2026-10-16T10:45Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z