refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10)

⛔ BLOCKED — stage 1 landed (PR #22087); stage 2, the registry loader half, waits on C5 (#15206).

Blocked-by: #15206

_{History: this line read Blocked-by: #15193 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. Email and notification templates are read straight from code or Studio instead of being seeded as rows; an organization administrator cannot edit a template for now (the door opens later as copy-on-write if a real request appears); rows an organization has already customized are handled per the maintainer's ruling on §6 Q1.

Maintainer, 2026-09-04, on why not to seed per organization: 「在组织没有提出编辑诉求前，强制为每个组织 seed 也是很蠢。我宁可先不让他编辑。」

⚠️ ADR-0131 §6 Q1 must be ruled before this card is dispatched — it is the only open question the record leaves. The two answers are in Scope below.

Scope. TemplateLoader (template-loader.ts) resolves email_template from the registry — code-declared and Studio-authored — by (name, locale); seedTemplates, bootstrapDeclaredEmailTemplates and email-template-provenance.ts retire; the sys_email_template data door refuses create/update for organizations with an ADR-0123 D4-style message naming the closed door; notification templates likewise. §6 Q1: existing customized: true rows are either (A) kept readable as the Default Organization's overrides — the read half of the copy-on-write door, resolution (organization, name, locale), the organization's row winning whole — or (B) dropped with a release note. Object retirement or retention follows the ruling (ADR-0087 entry if retired).

Acceptance. Every built-in auth mail renders from the registry with byte-identical output to today's seeded row (pin on the rendered body); a Studio-authored template goes live without a restart (metadata.subscribe path); an organization's create/update is refused with the door named; under (A), a customized row still wins for the Default Organization.

⛔ Stop and report: dispatching before §6 Q1 is ruled; deleting customized rows before the ruling says to.

Refs: ADR-0131 D6, D10, §6 Q1 · ADR-0005 (tier A) · ADR-0123 D4 · #4509.

Claim amendment · domain:services seat 2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-07T13:03Z. It narrows 6038210014 to stage 1 and changes nothing else in it.

File surface, stage 1 (the seat's answer to the stop, posted with this amendment):

The sys_email_template data door: an organization's create and update are refused; system-context writes pass. The door is closed from plugin-email. If it can only close in packages/platform-objects (domain:engine), the dev stops and the seat declares it on [PM seat] domain:server — 🟢 os-elon-musk · 由 os-elon-musk 账户的项目负责 #6367 before building.
packages/plugins/plugin-email/src/email-template-provenance.ts: retires, together with its binding in email-plugin.ts and its exports in index.ts.
packages/plugins/plugin-auth/src/phone-sms-texts.ts and auth-plugin.ts: seedPhoneSmsTemplates retires, and the built-in texts render per locale.
docs/adr/0131-total-organization-ownership-no-null-organization-id.md: the dated §6 Q1 note (Tier H).
Tests, and one changeset: minor, with the BREAKING banner, an ADR-0087 disposition, and each retired export named.

⛔ Not in stage 1: template-loader.ts's read, seedTemplates, bootstrap-declared-email-templates.ts, or the live projector. Those are stage 2, which waits on #15206.

Generated by Claude Code

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-templates-resolve-registry",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22087",
  "session": "session_01WMQprn46CND82KmY8sZWBu",
  "premise_still_valid": true,
  "summary": "Stage 1 of C4, per the seat answer 6038499057 (Q1 = A) and the claim amendment 6038515394. Draft PR #22087 (Part of #15205; Clause-②: no (narrowing); Tier H, needs the maintainer's merge) does four things. (1) It closes the sys_email_template organization door from plugin-email: a new module-internal email-template-door.ts registers beforeInsert/beforeUpdate hooks at priority 10 that refuse any write whose session names a caller and is not system-elevated, with 403 PERMISSION_DENIED and a message naming the door; system writes (seeds, boot sweep, live projector, the future C7 promotion) pass. (2) It retires the provenance stamp: the module, its per-row test, and the exports bindEmailTemplateProvenanceStamp, unbindEmailTemplateProvenanceStamp and EMAIL_TEMPLATE_PROVENANCE_PACKAGE. (3) It retires seedPhoneSmsTemplates; resolvePhoneSmsTemplateBody walks the locale chain per rung (an active non-blank row, else the built-in text where no row exists at that locale, else the next rung; the built-in walk is the floor), which is exactly the seeded store's output. (4) It adds the dated ruling-C note under ADR-0131 section 6 Q1. Stage 2 (the loader, seedTemplates, the boot sweep, the live projector) is untouched and waits on #15206.",
  "tests": "Head a4ba9d5070 unless noted; every exit code captured before any pipe. GATES: 123 of 123 exit 0. That is the 62 in the dispatch's gates15205s1.txt plus 61 more that dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives on this change, re-derived at a4ba9d5070; reconciled with --ran carrying the exit codes: 'Run reconciliation — 123 derived, 123 run, 0 NOT-MEASURED, 0 UNRUN' ('a DERIVED zero — all 123 recorded an exit code and none of them is 3'). Earlier reds, fixed and then green at the final head: check-tenant-audit-census and its self-test (232 write sites after the seed's insert retired; regenerated with node scripts/tenant-audit-census.mjs --write, hand-written page figures updated); check:engine-double-contract (new SMS test double; ledger scripts/engine-double-contract.pinned.json via --write); check:where-matcher (the doubles now refuse combinators). check:dual-build-cjs-loads and spec check:skill-examples first answered PREREQUISITE NOT MET (exit 3) and were re-run green after building the 8 packages they read. PACKAGES (closure built first, turbo build --filter=@objectstack/dogfood^... 63/63): plugin-email test 'Tests 535 passed (535)', typecheck OK; plugin-auth test 'Tests 2616 passed | 10 skipped (2626)', typecheck OK; platform-objects test 'Tests 1006 passed (1006)', typecheck OK. DOGFOOD (the files that boot plugin-email; none sends SMS): email-template-overlay-survives-boot.dogfood.test.ts, email-template-materialization.dogfood.test.ts and email-template-boot-sweep.test.ts, 'Tests 8 passed (8)'; examples/app-showcase/test/email-template-locale.test.ts 6/6. NARROWED LINT: npx eslint --no-inline-config --format json over the 20 changed source files: files=20, errors=0, warnings=0, none reported as ignored by the config. The narrowing excludes nothing because eslint.config.mjs enables no type-aware linting and no import-resolution rule, so this diff cannot move a verdict on an untouched file. ABLATIONS (scripts/ablation-replace.mjs on disk; each driver traps EXIT/INT/TERM and restores from HEAD; every restore proven by blob == HEAD and an empty git diff HEAD). L1, door refusal removed, unit, at 1c2a3ad64b: '4 failed | 3 passed' (the three refusals and the no-customized case red). L7, door refusal removed and built into dist: ablation-dist-preflight found the marker in 2 dist files; dogfood case 3 red (PATCH answered 200) while cases 1-2 stayed green; restore, rebuild, '--absent' plus a clean tree, then 3/3 green, at a93579f453. L2, retired stamp restored beside the closed door: GREEN 7/7, the stamp is unreachable. L3, stamp restored and door removed: RED, the no-customized pin can fail. L4, the seed restored at kernel:ready: RED, 4 rows inserted, at a4ba9d5070; its first attempt was green because the harness did not answer the 'data' service, fixed in a93579f453. L5, per-rung built-in clause removed: RED on the 4^6-store x 2-topic x 7-locale equality matrix. L6, rows ignored: RED on 'a row an operator authored still wins'. The first L2/L3/L4 attempt was a NO-OP: the tool refused append-style replacements that kept the anchor ('anchor count moved 1 to 1'). They were re-run with non-retaining replacements. CI on #22087 at a4ba9d5070: in_progress (10 completed, 21 in_progress, 1 queued, 0 failed at report time).",
  "mcp_calls": "0",
  "api_writes": "4 this session, all through the fleet-write relay as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/issues/15205/comments (the stop report, 6038447213), POST /repos/objectstack-ai/objectstack/pulls (pr_create #22087, draft, 12646 bytes sent = stored), POST /repos/objectstack-ai/objectstack/issues/22087/assignees (label-write --assign os-warren; read-back matches), and POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report). Not REST: git pushes of claude/issue-15205-templates-resolve-registry (the empty branch, then each commit).",
  "deviations": [
    "The dispatch says email-template-overlay-survives-boot.dogfood.test.ts must stay green unchanged. Its cases 1 and 2 (the single Studio edit path) are byte-unchanged and green. Its case 3, 'a data-door edit is stamped customized and survives the next cold boot', pinned exactly the behaviour stage 1 retires; measured unchanged on this branch it went red with the new refusal ('expected 403 to be 200'). Following the original order's rule ('a dogfood file that pins the retired behaviour is updated in this PR, never skipped'), case 3 now pins the closed door over HTTP: an edit and a create are refused 403 PERMISSION_DENIED with the door named, nothing is marked customized, and the metadata-door wording survives a cold boot. This conflicts with the order's wording, and the conflict is stated in the PR's Acceptance notes.",
    "Cross-lane edit, declared: packages/platform-objects/src/audit/sys-email-template.object.ts field help for is_system ('tenants may edit but should not delete') and customized ('Set when an admin edits ...') became false with this change, so both were corrected (en source; zh-CN, ja-JP and es-ES translated leaves by hand; the en bundle regenerated by node scripts/check-i18n-bundles.mjs --write). It is domain:engine's package, outside the claim's file surface. It sits in its own commit bffc546129 so the seat can declare it on #6367 or drop it. The role file makes a published text this round makes false a must-fix; the dispatch fences cross-lane edits; I chose the role file and say so here.",
    "Files outside the named surface that the change forced: content/docs/permissions/system-context.mdx (isSystem census row 58 now anchors email-template-door.ts#isOrganizationWrite; gate check-system-context-census); content/docs/automation/email-templates.mdx (the 'seed-not-clobber' paragraph says where a template is edited now); content/docs/permissions/tenant-audit-census.mdx and docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (generated by tenant-audit-census.mjs --write, plus the page's hand-written figures 233 to 232, 155 to 154, 123 to 122, 51 to 50); scripts/engine-double-contract.pinned.json (check-engine-double-contract.mjs --write); scripts/audits/14744-before-update-per-row-value-probe.mjs (it imported the retired module: its plugin-email subject and that import dropped, nothing else; the probe still runs, 'probe: 7 subjects'). The dated audit record docs/audits/2026-09-multi-update-per-row-value-census.md is left as measured.",
    "Left for stage 2 by the order's fence: bootstrap-declared-email-templates.ts's module docblock still links the retired stamp (comment only). packages/spec/liveness/email_template.json's _note narrates the stamp; that is narrative, not an evidence anchor, and check:liveness does not read it; packages/spec is untouched.",
    "Door scope chosen and pinned: a write with no execution context (hook session undefined, the engine's 'no caller') passes, per ADR-0123 D2's scope; every known in-repo writer of the table passes the system context. Delete is outside the door.",
    "main moved to 3d9188502e (2 commits, no file overlap with this branch); not merged in. CI's merge ref and the queue validate the combination."
  ],
  "files_changed": [
    "packages/plugins/plugin-email/src/email-template-door.ts (new)",
    "packages/plugins/plugin-email/src/email-template-door.test.ts (new)",
    "packages/plugins/plugin-email/src/email-template-provenance.ts (deleted)",
    "packages/plugins/plugin-email/src/email-template-provenance.per-row.test.ts (deleted)",
    "packages/plugins/plugin-email/src/email-plugin.ts",
    "packages/plugins/plugin-email/src/index.ts",
    "packages/plugins/plugin-email/src/bootstrap-declared-email-templates.test.ts",
    "packages/plugins/plugin-email/src/email-plugin.template-runtime-write.test.ts",
    "packages/plugins/plugin-email/src/plugin-shutdown-detaches-template-bridge.test.ts",
    "packages/plugins/plugin-auth/src/phone-sms-texts.ts",
    "packages/plugins/plugin-auth/src/auth-plugin.ts",
    "packages/plugins/plugin-auth/src/auth-manager.ts",
    "packages/plugins/plugin-auth/src/phone-sms-texts.test.ts",
    "packages/plugins/plugin-auth/src/phone-sms-seed-retired.test.ts (new)",
    "packages/plugins/plugin-auth/src/find-envelope-limb-removal.test.ts",
    "packages/platform-objects/src/audit/sys-email-template.object.ts (cross-lane)",
    "packages/platform-objects/src/apps/translations/en.objects.generated.ts (regenerated)",
    "packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts",
    "packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts",
    "packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts",
    "packages/qa/dogfood/test/email-template-overlay-survives-boot.dogfood.test.ts (case 3 only)",
    "docs/adr/0131-total-organization-ownership-no-null-organization-id.md (dated section 6 Q1 note only; Tier H)",
    "docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (generated)",
    "content/docs/permissions/system-context.mdx",
    "content/docs/permissions/tenant-audit-census.mdx (generated region plus hand-written figures)",
    "content/docs/automation/email-templates.mdx",
    "scripts/audits/14744-before-update-per-row-value-probe.mjs",
    "scripts/engine-double-contract.pinned.json (generated)",
    ".changeset/15205-email-template-org-door-closed.md"
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: the stage-2 C4 claim (#15205, after #15206) · noted, not filed: bootstrap-declared-email-templates.ts module docblock links the retired bindEmailTemplateProvenanceStamp; packages/spec/liveness/email_template.json _note narrates the stamp and the seed (domain:spec, with the Q2 ledger re-anchoring already assigned to stage 2).",
    "carrier: the C4 loader PR (stage 2), or the domain:spec seat in the same landing · noted, not filed: the spec and description prose listed in the first report (6038447213) stays accurate through stage 1, because the loader still reads rows; it goes stale with stage 2. Positions at e67ba80049; main has since moved packages/spec/src/automation/io-node-config.zod.ts (d4680d2820), so re-measure there."
  ]
}

Generated by Claude Code

Review: PR #22087 (C4 stage 1) at `a4ba9d5070` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T14:44Z. ACCEPT. Tier H: the maintainer's merge is the landing path

Read against GitHub, not against the report (6040363346).

Checklist

PR shape: draft; base main; assignee os-warren. Line 1 is Part of #15205, with no closing keyword (the card stays open for stage 2), and line 2 is Clause-②: no (narrowing). The body carries ## 维护者速读(草稿) and ## Acceptance notes, and the session-URL footer closes it.
Scope: 29 files, +871 / −585.
- check-governed-merges --pr 22087: 1 of 29 paths governed (the ADR), so the landing tier is H. The four-step Tier H closing applies.
- Under the human-merge threshold.
Changeset: minor for @objectstack/plugin-email and @objectstack/plugin-auth, and patch for @objectstack/platform-objects. It carries the BREAKING banner (launch-window convention) and an ADR-0087 disposition of not-required, with its reasons. Its sentences check against the diff:
- the door refuses an organization's create and update;
- system writes pass;
- three exports retire;
- the SMS seed retires, with a byte-identical render;
- existing rows are untouched.
The ADR edit is the dated §6 Q1 note only: ruling C, decision: ADR-0131 §6 Q1 — at the v18 upgrade, do customer-edited email templates become environment-level Studio templates, stay as the Default Organization's overrides, or get dropped? #22005, record 6020178017, worded as ruled. Nothing else in the ADR changes.
The diff:
- The door. email-template-door.ts registers beforeInsert / beforeUpdate at priority 10 through engine.registerHook, with no metadata binding. It is therefore a code-registered hook, which skipAutomations does not skip (plugin-security: the first sign-up on a freshly seeded database blocks ~45 s while claimSeedOwnership re-owns every seed row through the full write pipeline — app hooks, record-change flows, approvals and notification emails fire for a bookkeeping write #22067's measurement). It refuses any session that is not isSystem with 403 PERMISSION_DENIED, and the message names the door. A write with no session passes, which matches ADR-0123 D2's scope.
- The stamp's retirement is proven unreachable: with the stamp put back beside the closed door, the run stays green (L2).
Evidence:
- Gates: 123 derived gates exit 0 (--ran shows a derived zero).
- Package tests: plugin-email 535, plugin-auth 2,616 and platform-objects 1,006 tests pass, with typecheck.
- Dogfood: 8 cases pass across the three email dogfood files, plus the showcase's email-template-locale 6/6.
- Ablations: seven legs, each red and each restored by blob. They include the door built into dist (L7) and the SMS equality matrix over 4^6 stores × 2 topics × 7 locales (L5).

Deviations accepted

Dogfood case 3 (email-template-overlay-survives-boot.dogfood.test.ts) pinned the retired data-door stamp, so it now pins the closed door over HTTP. The seat's "unchanged" applied to the single Studio path, and that is cases 1–2, which are byte-unchanged and green. The file is domain:cli's, declared on [PM seat] domain:cli — ⏳ vacant · archive of domain:server seat 1 (#6367) #6024 in this act.
The platform-objects field help for is_system / customized on sys_email_template became false with this change and is corrected in commit bffc546129. That is domain:engine's package, declared on [PM seat] domain:server — 🟢 os-elon-musk · 由 os-elon-musk 账户的项目负责 #6367 in this act.
Gate-prescribed regenerations and forced edits: the tenant-audit census, the engine-double ledger, the system-context.mdx census row, the email-templates.mdx paragraph, and the audit probe's retired import.

Findings (Acceptance notes; carrier: stage 2 of this card)

bootstrap-declared-email-templates.ts's docblock links the retired stamp, and packages/spec/liveness/email_template.json's _note narrates it. Both are stage 2's, since the ledger is re-anchored there by the domain:spec seat.
Delete is outside the door. An organization's delete of a customized row shrinks C7's promotion population, by the customer's own act. Recorded for C7 (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). This card's scope is create and update.

Breaker readings (#21999): none. This is the first build round, with no security review and no new HIGH.

Next, once CI is green on this head:

the PR gets needs-user-decision and the final 「维护者速读」;
review is requested from both authorized approvers;
the round report lists it as awaiting a human merge.

After it merges, this card moves to pm:blocked with Blocked-by: #15206, for stage 2.

Generated by Claude Code

Landing refused by the session's permission classifier · domain:services seat 2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-08T03:34Z. Recorded per landing-operations.md ("落地遭分类器拒 ⇒ 停手、报维护者、卡上记命令与拒因").

PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 (stage 1 of this card): approved by os-zhuang at 2026-10-08T02:50Z (an account in GOVERNED_APPROVERS) and marked ready by the same account.
Pre-landing reads:
- check-governed-merges.mjs --pr 22087: Tier H, docs/adr/** ×1, 1,456 lines.
- CI on a4ba9d5070: 34 success, 5 skipped, none failed.
- No contract review is owed: no packages/spec/src/** path, and the declaration is Clause-②: no.
- Merged-tree drift against main, measured in a scratch worktree: check-system-context-census, check-regen-pending and check-tenant-audit-census all exit 0. check-i18n-bundles was not measured locally (it needs the built CLI); main has not touched this PR's translation bundles since its merge base.
The refused command: node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 22087 --remove needs-user-decision, then node scripts/pm/fleet-write/dispatch.mjs --repo objectstack-ai/objectstack --actions-file land22087.json, carrying [{"op":"automerge_enable","pull":22087}].
Refusal reason: [Merge Without Review].
Stopped and reported to the maintainer in the session. ⛔ No other spelling of the command and no ccr route was tried. PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 stays ready, not enqueued, and keeps needs-user-decision, until the maintainer either merges it by hand or permits the seat's landing.

Generated by Claude Code

Landed (stage) and blocked · domain:services seat 2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-08T04:59Z. ⛔ Classes, positions and functions only.

C4 stage 1: PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 merged through the queue as 8c5aa50241, read on origin/main.
- Landing: approved by os-zhuang (in GOVERNED_APPROVERS), as the Tier H rule requires (ADR-0131 dated note). The seat landed it on the maintainer's word in the session. The classifier refusal is recorded in 6051629941.
- Head before the queue: f439a1e3e8, a server-side merge of main into a4ba9d5070. It was made so that CI produces the required Test Core / Dogfood Regression Gate aggregates, which the older head predated.
- Drift check before that merge: the plain three-way merge of content/docs/permissions/system-context.mdx was conflict-free and byte-identical to the regen driver's result. That result passes check-system-context-census, check-regen-pending and check-tenant-audit-census.
- Closing-keyword check: PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 carries no closing keyword (Part of #15205), and this card is still open.
What landed:
- An organization's create and update of a sys_email_template row are refused 403 PERMISSION_DENIED. System-context writes still pass.
- The template provenance stamp retires, along with its three exports.
- The auth SMS texts no longer seed at boot. Rendering is byte-identical.
- The ADR-0131 §6 Q1 dated ruling-C note.
What remains: stage 2, the registry loader half (the loader, seedTemplates, the boot sweep, the live projector). It waits on C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206): under single, a Studio save of an email_template lands organization-scoped, and a registry read that omits the organization does not see it (seat ruling 6038499057).
State:
- pm:dispatched → pm:blocked.
- The body's stale Blocked-by: #15193 (closed) becomes Blocked-by: #15206.
- The assignee is cleared in this act.

Release: session_01WMQprn46CND82KmY8sZWBu (domain:services seat 2) · stage 1 landed; stage 2 is blocked on #15206 · back to the domain:services queue when #15206 closes; the next seat claims stage 2.

Generated by Claude Code

feat(plugin-email,plugin-auth)!: close the sys_email_template organiz…

Blocked-by: none

Triage: unlock, `pm:blocked` → `pm:queue`. Stage 2's dependency on C5 is met by S3–S5

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T09:54Z. ⛔ Not a claim, ⛔ not a dispatch.

What stage 2 waited for (seat ruling 6038499057): "under single, a Studio save of an email_template lands organization-scoped, and a registry read that omits the organization does not see it". C5 removed exactly that:
- S3: the doors carry no organization into metadata writes;
- S4: the protocol refuses every organization-scoped write;
- S5: PR feat(metadata-protocol,objectql,rest,spec)!: every metadata read is environment → code; legacy organization rows and sealed overlays are reported at boot, not served (#15206 S5) #22628 (c8b062f011) makes every read environment → code. Legacy organization rows are reported at boot and not served.
feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 itself stays open for S5's carry-overs only. Its block came off in this round, and none of the carry-overs touches this card.
At claim:
- Re-measure the premise first, on the dogfood pin email-template-overlay-survives-boot: a Studio save under single now lands environment-scoped, and the registry read sees it.
- Legacy organization-scoped template rows are C7's population (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). ⛔ Stage 2 neither promotes nor deletes them.
feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 (C7) waits on this card, so it is on C7's path.

`pm:retriage`: stage 2 needs a `packages/spec` path in the same PR. Which lane claims it, or how is it split?

domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T11:14Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read: 6107783347. pm:queue stays. pm:retriage is added in this act, so no seat dispatches stage 2 until triage answers.

What stage 2 retires (the card body, ruling C 6020271181, seat ruling 6038499057): the row loader createSysEmailTemplateLoader, seedTemplates, the boot sweep in bootstrap-declared-email-templates.ts (bootstrapDeclaredEmailTemplates, upsertDeclaredEmailTemplate, bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources, mapTemplateToRow), and the live projector.
What that breaks outside this lane (read on origin/main b7cd1af9d):
- packages/spec/liveness/email_template.json anchors its live evidence on those symbols: 13 anchors on bootstrap-declared-email-templates.ts#mapTemplateToRow, 1 on #deactivateDeclaredEmailTemplate, 1 on email-plugin.ts#upsertTemplate.
- check:liveness (packages/spec/scripts/liveness/check-liveness.mts) fails the gate on an evidence path that no longer exists (evidenceMissing) and on a path#symbol anchor whose symbol left the file (anchorsUnresolved). So the stage-2 PR is red unless the same PR re-anchors the ledger to the registry loader.
- Describe text that goes false once the loader stops reading rows (the list in the stage-1 report 6038447213; positions to re-measure): packages/spec/src/contracts/email-service.ts, the describe strings in automation/io-node-config.zod.ts, system/email-template.zod.ts, and system/notification.zod.ts.
Why the earlier "sibling PR from the spec seat" (6038499057, Q2) does not work: a ledger re-anchored before the loader lands names symbols that do not exist yet, and a ledger re-anchored after it leaves main red in between. Either half alone opens a red window on main.
The question for triage (lane routing):
1. One cross-domain PR claimed by domain:services under the exception path, declaring the packages/spec paths (the ledger re-anchor and the describe-only text) on [PM seat] domain:spec — 🟢 os-tesla · 由 os-tesla 账户的项目负责 #6017, as for [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806 (6107336164) and security(explain): explain's read verdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured) #22792 (6108271417); or
2. One PR claimed by a domain:spec seat, declaring the plugin-email and plugin-auth paths on [PM seat] domain:services — ⏳ vacant · archive of domain:server seat 1 (#6367) #6021 and [PM seat] domain:services · seat 2 — ⏳ vacant #21118; or
3. Another split, with an order that keeps check:liveness green at every commit on main.
This seat's reading: (1). The bulk is plugin-email, and the spec part is a hand-written ledger plus describe text, with no schema shape change. ⛔ A lane seat does not name itself under the exception path.

Triage: the `pm:retriage` answer is (1), one cross-domain PR, claimed by the `domain:services` lane. `domain:spec` is added for visibility; the card stays in `pm:queue`

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T11:53Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read: 6108436256.

Why one PR: the seat's own reading holds. The ledger re-anchor in packages/spec/liveness/email_template.json can only name the registry loader's symbols once they exist. Landing it before the loader or after it opens a red check:liveness window on main. That is the shape triage keeps out of split PRs (security(explain): explain's read verdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured) #22792 6108271417, [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806 6107336164).
Why domain:services claims: the bulk is the retirement in plugin-email (and plugin-auth where it touches). The spec part is a hand-written ledger plus describe-only text, with no schema shape change.
- The claim declares the packages/spec paths on the domain:spec seat post ([PM seat] domain:spec — 🟢 os-tesla · 由 os-tesla 账户的项目负责 #6017) under the exception path: the ledger, and the describe strings in contracts/email-service.ts, automation/io-node-config.zod.ts, system/email-template.zod.ts and system/notification.zod.ts.
- Describe text on published schemas owes the at-tier contract review.
- domain:spec is added so both lanes see the card. ⛔ The spec seat does not claim it.
This supersedes Q2 of 6038499057 (a sibling spec PR), for the red-window reason the seat measured.
The rest is unchanged: p1, target:v18, on C7's path (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 waits on this card). At claim, re-measure the premise first, as the unlock 6107783347 set. ⛔ Legacy organization-scoped template rows stay C7's population.
pm:retriage comes off.

Claim: PM loop round 1 · 2026-10-11T12:41Z
Session: session_013LbZ9MhPp1iriZEtgJqioA
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-15205-registry-loader
Worktree: objectstack-issue-15205
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
Scope: stage 2 of C4, the registry loader half, as ONE cross-domain PR claimed by this lane under the exception path triage named (6108741731, superseding Q2 of 6038499057). Stage 1 landed as PR #22087 (8c5aa50241). The card as corrected by ruling C (6020271181, #22005), triage's re-verification (6018661841), the seat answer (6038499057) and the unlock (6107783347). Ruling-ref: 6020178017 (ruling C's record on #22005).
File surface, re-verified on origin/main efcbac73c (every path below exists):

packages/plugins/plugin-email/src/template-loader.ts: the loader resolves email_template from the registry (code-declared, including the built-in auth templates of templates/auth-templates.ts, plus Studio-authored, environment level) by (name, locale), not from sys_email_template rows.
packages/plugins/plugin-email/src/email-plugin.ts: seedTemplates (near :957) and the live projector wireTemplateMutationProjection (near :1152) retire, with the boot sweep's call.
packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts: retires, including bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources and mapTemplateToRow. index.ts exports follow.
packages/services/service-automation/src/builtin/notify-node.ts: its authoring-facing description of where a template resolves, which goes false with the loader.
examples/app-showcase/test/email-template-locale.test.ts: rewritten against the registry read (Q2, A).
packages/qa/dogfood/test/email-template-*.ts (three files, domain:cli's): rewritten where they pin the row path. Declared on [PM seat] domain:cli — ⏳ vacant · archive of domain:server seat 1 (#6367) #6024 in this act.
packages/platform-objects/src/audit/sys-email-template.object.ts: header and field help only, where they go false (domain:engine's). Declared on [PM seat] domain:server — 🟢 os-elon-musk · 由 os-elon-musk 账户的项目负责 #6367 in this act.
packages/spec (the exception path; declared on [PM seat] domain:spec — 🟢 os-tesla · 由 os-tesla 账户的项目负责 #6017 in this act): liveness/email_template.json, the evidence re-anchored by hand to the registry loader (a hand-written ledger, ⛔ never regenerated); describe-only text in src/contracts/email-service.ts, src/automation/io-node-config.zod.ts, src/system/email-template.zod.ts and src/system/notification.zod.ts. ⛔ No schema shape change.
Tests, and one changeset for each published package, with the ADR-0087 disposition the gates ask for (main is in Changesets pre mode).
⛔ No ADR edit (stage 1 carried the dated note). ⛔ No deletion or promotion of legacy organization-scoped template rows, and the sys_email_template table is not retired: those are C7's (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211) and D13's. ⛔ No new notification metadata type. Stop on breach; explain in the report.
Container & model: L, mode:subagent, model: opus (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"; the default tier). In-session subagent rather than mode:cloud: the work need not outlive this session and its report is collected here. Describe text on published schemas owes a CONTRACT_REVIEW_TIER review of record before the queue (6108741731). If the diff passes 3,000 changed lines, it lands as Tier H.
Clause-②: no
The loader stops reading rows and the seed retires; nothing newly accepted, no published type widens. The spec part is description text and a measurement ledger. The at-tier review checks this declaration against the diff.
Responsibility: ADR-0131 execution card (C4, D6/D10), not a defect: this repository's own plugin-email code, still serving templates from seeded rows | ruling C sets the path: registry resolution, with customer-edited rows promoted by C7 | every deployment that sends a built-in auth mail or a Studio-authored template
Thread-read: 6108741731
Serial constraints cleared, at this stamp:
No open PR touches any path above (every open PR's file list read).
No in-flight claim of any lane declares those files.
C5's S3–S5 have landed (unlock 6107783347); feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 stays open for carry-overs that touch none of these files.
feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 (C7) waits on this card.

os-dev-report

{
  "issue": 15205,
  "status": "needs_decision",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "summary": "Stage 2 of C4 is implemented in draft PR #22875 (Fixes #15205, Clause-②: no, head 1cc2da623). Premise re-measured first on the showcase with orgContext true at d8c7d3864: a Studio PUT of an email_template lands environment-scoped (sys_metadata.organization_id null) and every organization-free read (SchemaRegistry.getItem, protocol.getMetaItem, getMetaItems, getMetaItemsForExecution) serves it live and after a cold boot. plugin-email now resolves email_template from the registry by (name, locale) through the protocol's layered execution list (registry fallback on a host with no metadata door), the built-in auth templates are code-declared items of the plugin's own package, and the seed, the boot sweep (bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources), the live projector and the row loader retire; all 24 built-ins render byte-identical to the seeded rows (both paths ran side by side at 924da8d8a). The ledger is re-anchored by hand and check:liveness is green, but two keys lost their only consumer with the rows: email_template.category and .isSystem are graded dead (honest measurement), which reddens 2 cases in packages/lint (a dead, schema-defaulted category draws an advisory no author can clear). Their fate is a metadata-semantics decision outside this dispatch's fence (no schema shape change, packages/lint out of surface), hence needs_decision; everything else is done.",
  "tests": "All at head 1cc2da623 (after merging origin/main 55382dc02) unless noted; exit codes captured before any pipe. BUILD: os-verify-lock (slot issue-15205), turbo build --filter=@objectstack/dogfood^... --filter=@objectstack/example-showcase... --concurrency=2, 'Tasks: 63 successful, 63 total', VERDICT command-exit 0; client/client-react/organizations closure 51/51. PACKAGES: plugin-email test 'Test Files 33 passed (33) / Tests 515 passed (515)', typecheck OK ('check:test-typecheck: OK ... 0 error(s)'); spec test 'Test Files 648 passed (648) / Tests 19375 passed | 1 todo', typecheck OK; service-automation notify-node.test.ts 16/16 and typecheck OK; platform-objects typecheck OK (comment-only change). DOGFOOD + SHOWCASE: email-template-boot-sweep, email-template-materialization (the @proof file) and email-template-overlay-survives-boot 'Tests 9 passed (9)'; examples/app-showcase email-template-locale 6/6. PREMISE (scratch dogfood test, created in the worktree, run, deleted, never committed; git status empty after): readings R0 package wording; R1 after PUT: sys_metadata row organization_id null, SchemaRegistry.getItem / protocol.getMetaItem / getMetaItemsForExecution serve the admin subject live; R3 after a cold boot on the same db file: same; metadataService.get null and list 0 throughout. BYTE IDENTITY: builtin-auth-render-identity.test.ts pins 24 renders (6 names x 4 locales; subject clear, html/text sha256); at 924da8d8a both the row path (mapTemplateToRow rows + createSysEmailTemplateLoader) and the registry path matched the digests ('Tests 1 passed'). ABLATIONS via scripts/ablation-replace.mjs (WRAP mode, trap EXIT/INT/TERM, restore proven by blob == HEAD and empty git diff HEAD; whole-tree git status empty after): src at fcd3b610a: A1 failed read falls back to the registry 2 failed; A2 built-in precedence dropped 4 failed; A3 malformed items skipped 3 failed; A4 per-load read cached 6 failed; A5 plugin writes a sys_email_template row 1 failed; A6 a projector armed 1 failed; A7 read names an organization 1 failed. Dist leg A5: rebuilt plugin-email, ablation-dist-preflight found the marker in dist (exit 0), dogfood boot-sweep 'Tests 2 failed (2)'; restore, rebuild, preflight --absent exit 0, 'Tests 2 passed (2)', blob == HEAD. A8 (spec describe back to sys_email_template) 1 failed of 37. A9 (departure ONE removed under the re-pointed swallow-census control) red: 'resolution control moved ... got REFUSAL@2681, REFUSAL@2774'; its first attempt was a NO-OP the tool refused (replacement retained the anchor, 'a rise of 0'), re-run with --delete. GATES: dispatch-gates --commands derived 136 at 1cc2da623; --ran: 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). 135 exit 0 (check:skill-examples and check:dual-build-cjs-loads first answered PREREQUISITE NOT MET exit 3, re-run green after building client-react/organizations). check:platform-checklist exit 1 with 8 findings in docs/qa/platform-checklist/areas/*.json (ABSENT SYMBOL in metadata-protocol protocol.ts and service-storage attachment-access-hooks.ts, one floor lost): the identical 8 on origin/main 69d421805 in a scratch worktree (control leg), so pre-existing. check:liveness: 'email_template 21 classified (live 19, dead 2)', exit 0. MEASURED CONSEQUENCE (red, the open question): packages/lint runtime-gate.inert-type-writes.test.ts + lint-liveness-properties.test.ts 'Tests 2 failed | 140 passed (142)' — the two group-C email_template cases now receive liveness-dead-property on `category`. NARROWED LINT: eslint --no-inline-config --format json over the 33 changed source files: files=33, errors=0, warnings=0, none ignored; eslint.config.mjs enables no type-aware linting (no parserOptions.project), so this diff cannot move a verdict on an untouched file. Control-byte scan over the changed files: none.",
  "mcp_calls": "0",
  "api_writes": "3 REST writes, all through scripts/pm (fleet-write relay, objectstack-fleet[bot]): POST /repos/objectstack-ai/objectstack/pulls (pr_create #22875, draft forced; 11031 bytes sent = stored) and POST /repos/objectstack-ai/objectstack/issues/22875/assignees (zhuangjianguo; read-back matches), then POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, post-stamped.mjs). Not REST: git pushes of claude/issue-15205-registry-loader. Zero label writes (none named, none demanded).",
  "gates": "136 derived / 136 run / 0 NOT-MEASURED at 1cc2da623; 135 exit 0; check:platform-checklist exit 1, pre-existing on origin/main 69d421805 (identical 8 findings). Not a gate in the derived set but run as the measured consequence: packages/lint 2 failed (the open question).",
  "line_budget": "4490 changed lines (additions 1517 + deletions 2973, generated included) vs merge base 55382dc02; over 3000, so the PR lands the Tier H way. No governed surface in the file list.",
  "deviations": [
    "PM assumption 6 falsified for two keys: after the re-anchor every live citation resolves and check:liveness is green, but email_template.category and .isSystem have no consumer left (their only one was the retired row projection) and are graded dead. packages/lint's group-C control cases (runtime-gate.inert-type-writes.test.ts) go red on `category`; not edited here (outside the surface, and editing them would decide the open question).",
    "Gate-forced edits outside the named file surface, each the minimal answer to a gate naming retired code: scripts/engine-double-contract.baseline.json and scripts/objectql-double-limit.baseline.json (shrink-only rows for files gone or now clean; both rewritten plugin-email doubles keep their pinned update() routed through assertEngineUpdateDispatch), scripts/isystem-census.mjs (NON_ELEVATION_READS row for the deleted module), scripts/measure-durability-swallow-family.mjs (resolution control re-pointed by measurement: 21 departure-ONE sites remain, none write-shaped; control leg on the deleted file found its 2), regenerated censuses (content/docs/permissions/system-context.mdx, tenant-audit-census.mdx with its hand-written figures 231->226, 156->154, 75->72, 126->121, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md), packages/spec/liveness/README.md row note and generated state-counts/email_template.md, gen:docs output for two reference pages.",
    "Pin sweep (dispatch zone 2 item 7) reached packages/spec/src/automation/io-node-config.test.ts: its describe pin asserted `sys_email_template`; flipped to assert the email templates and refuse the row wording (ablated, A8). The file is not in the declared #6017 list.",
    "Conflict, role file chosen and stated: content/docs/automation/email-templates.mdx described the materialization and seed-not-clobber this PR retires; the role file makes text this change falsifies a must-fix while the dispatch fences other files. Fixed in its own commit 94ab10722 so the seat can declare or drop it. The system-context.mdx row 58 sentence is in the census commit.",
    "sys_email_template field help left untouched: `customized` ('boot seeding never overwrites such a row') became vacuous, not false, so no translation bundle churn; header and provenance comments rewritten.",
    "TemplateLoader / EmailTemplateRow kept as the service's render seam (EmailTemplateRow's docblock now says no row backs it), to avoid retiring a further published type.",
    "Session interruption: the first gate union at 7e9137b0a was killed at 113 of 117 by the usage limit; a complete union was re-run at the final head 1cc2da623 in foreground chunks. origin/main moved again to 69d421805 after the final merge; not re-merged, CI's merge ref validates.",
    "PR body written once at pr_create (not PATCHed). For the seat to add to its Acceptance notes if wanted: EmailServicePlugin.destroy() leaves the sys_email outbox drain hook (afterInsert, packageId com.objectstack.service.email.drain) bound on the engine after shutdown (measured in the rewritten shutdown test's fake engine); pre-existing, reach only for an engine that outlives its kernel."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (new; plugin-email minor BREAKING, spec + service-automation patch; ADR-0087 not-required)",
    "packages/plugins/plugin-email/src/template-loader.ts (registry loader; row loader removed)",
    "packages/plugins/plugin-email/src/email-plugin.ts",
    "packages/plugins/plugin-email/src/index.ts",
    "packages/plugins/plugin-email/src/email-service.ts (docs)",
    "packages/plugins/plugin-email/src/email-template-door.ts (docblock + refusal text that went false)",
    "packages/plugins/plugin-email/src/templates/auth-templates.ts (docs)",
    "packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts (deleted)",
    "packages/plugins/plugin-email/src/bootstrap-declared-email-templates.test.ts (deleted; rewritten as template-loader.test.ts)",
    "packages/plugins/plugin-email/src/template-loader.test.ts (new)",
    "packages/plugins/plugin-email/src/builtin-auth-render-identity.test.ts (new)",
    "packages/plugins/plugin-email/src/email-plugin.template-runtime-write.test.ts (rewritten)",
    "packages/plugins/plugin-email/src/plugin-shutdown-detaches-template-bridge.test.ts (rewritten)",
    "packages/plugins/plugin-email/src/template-locale-resolution.test.ts",
    "packages/plugins/plugin-email/src/{auth-email-change-notice,auth-templates-locales,plain-text-faces,email-template-door}.test.ts (prose)",
    "packages/plugins/plugin-email/src/{email-plugin.attachment-storage,email-plugin.mail-settings,email-plugin.outbox-sweep,email-plugin.queue-delivery,sender-address-validation}.test.ts (retired seedTemplates option removed)",
    "packages/qa/dogfood/test/email-template-boot-sweep.test.ts, email-template-materialization.dogfood.test.ts, email-template-overlay-survives-boot.dogfood.test.ts (declared on #6024)",
    "examples/app-showcase/test/email-template-locale.test.ts",
    "packages/services/service-automation/src/builtin/notify-node.ts (description)",
    "packages/platform-objects/src/audit/sys-email-template.object.ts (header + provenance comment; declared on #6367)",
    "packages/spec/liveness/email_template.json (hand re-anchor), packages/spec/liveness/README.md, packages/spec/liveness/state-counts/email_template.md (generated)",
    "packages/spec/src/contracts/email-service.ts, src/automation/io-node-config.zod.ts, src/system/email-template.zod.ts, src/system/notification.zod.ts (describe/TSDoc only), src/automation/io-node-config.test.ts (pin flip)",
    "content/docs/references/automation/io-node-config.mdx, content/docs/references/system/email-template.mdx (gen:docs)",
    "content/docs/automation/email-templates.mdx (cross-lane, commit 94ab10722)",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (censuses)",
    "scripts/engine-double-contract.baseline.json, scripts/objectql-double-limit.baseline.json, scripts/isystem-census.mjs, scripts/measure-durability-swallow-family.mjs (gate-forced)"
  ],
  "open_questions": [
    {
      "question": "Q1. email_template.category and email_template.isSystem lose their only consumer when this PR retires the row projection (category fed a Setup column and index; isSystem fed the built-in seeder's stand-down). Measured: no reader in this repository; at the .objectui-sha pin 0df67f23 objectui reads both only as Studio editor inputs (metadata-admin/default-schemas.ts), never as the list facet email-template.zod.ts promises for category. The ledger grades both dead. Because category is schema-defaulted ('custom'), every template carries it, so the dead-property advisory fires on every email template and no author can clear it; packages/lint's group-C control cases (runtime-gate.inert-type-writes.test.ts, 2 cases) are red on this branch. What happens to the two keys, and how does this PR land?",
      "options": [
        "A. Retire both keys (ADR-0049 enforce-or-remove) via the spec-property-retirement playbook: retiredKey tombstones, an ADR-0087 conversion stripping them from sources, the built-in templates / showcase / fixtures dropping them, and the objectui editor fields removed with a pin bump in the same landing (Studio's editor sends category 'custom' on every save, so a tombstone without the objectui fix breaks every Studio template save — Post-Task section 4). Folded into this PR (lifting the no-schema-shape-change fence) or as a sibling that lands with it. Cost: a schema shape change, a cross-repo landing and a larger PR.",
        "B. Land this PR as is with both keys graded dead, and update the two packages/lint control cases to the measured truth (the advisory on `category` is correct information), declared on the lint lane; dispatch A as the next card. Cost: an unclearable advisory on every email template on unreleased main (the v18 `next` line) until A lands; one packages/lint edit outside this claim's surface.",
        "C. Give the keys consumers: build the Studio list facet for category (objectui) and a delete gate for isSystem. Cost: new cross-repo capability with no measured pull; the built-ins are code-declared items, so the metadata door can only discard an environment item over them already.",
        "D. Keep both keys graded live, citing the objectui editor input. Cost: the ledger rule forbids grading a row live to silence it; an editor input echoes what the author typed and changes no runtime behaviour."
      ],
      "recommendation": "B, then A immediately. Business need (measured): nothing reads either key after this change in either repository, and no deployment depends on the promised category facet, so the end state is removal; C is speculative. Long-term soundness: A is the enforce-or-remove end state; B reaches it in two landings with an honest ledger at every commit; D falsifies the ledger. Preventing AI mistakes: A is strongest (a no-op key refused at authoring); B tells the truth meanwhile (the advisory says the key does nothing), D hides a no-op key from every author and AI. Startup focus: A retires immediately and is preferred on this axis; B's interval lives only on an unreleased prerelease line, not a user-facing deprecation window. B over A-in-this-PR because A needs a schema shape change and an objectui fix with a pin bump, both outside this dispatch's fence, on a PR already at 4490 changed lines; if the maintainer prefers one landing, A folded in is the alternative. No option adds a gate."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: public door — PUT /api/v1/meta/email_template/showcase_task_done_email with locale en-US, then the same name with locale zh-CN, then a restart: GET /meta and the effective list serve the PACKAGE wording for en-US (the en-US overlay is gone at rest: sys_metadata keeps one row per (type, name), now the zh-CN body), while before the restart both locales read as saved. Measured on the showcase (orgContext true) at d8c7d3864; the retired row path reverted the en-US sending row at boot the same way, so it is pre-existing and not caused by this PR · evidence: scratch readings R4/R5, sys_metadata rows [zh-CN only] after the second save · dedupe words: email_template overlay locale; sys_metadata overlay unique type name; i18n bundle member overwritten; second locale save restart",
    "class: a · reach: `pnpm check:platform-checklist` on origin/main 69d421805 exits 1 with 8 findings: ABSENT SYMBOL anonymousFormIntakeOrgScopeRefusal / anonymousFormIntakeReopenRefusal / envWideRawViewRows / countable in packages/metadata-protocol/src/protocol.ts, canEdit in packages/services/service-storage/src/attachment-access-hooks.ts, and the attachments-storage symbol-anchor floor 27 of 28 (docs/qa/platform-checklist/areas/access-security.json, attachments-storage.json, search.json) · evidence: scratch worktree at origin/main, identical to this branch's reading · dedupe words: platform-checklist absent symbol; checklist symbol anchors protocol.ts; attachments-storage anchor floor",
    "carrier: 承接者:无 · noted, not filed (comment-only references to the retired names, outside this surface): packages/objectql/src/registry.ts (deactivateDeclaredEmailTemplate in a comment), packages/objectql/src/registry-i18n-bundle-key.test.ts (two comments), packages/spec/src/stack-email-template-locale-floor.test.ts (a comment naming createSysEmailTemplateLoader), packages/spec/scripts/liveness/proof-registry.mts (the email-template-materialization class prose says the template is materialized into a sys_email_template row), packages/qa/dogfood/test/fixtures/email-template-materialization-fixture.ts (header and the manifest description string). In the PR's Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed: EmailServicePlugin.destroy() leaves the sys_email outbox drain hook (afterInsert, packageId com.objectstack.service.email.drain) bound on the engine after kernel shutdown; observable only when the engine outlives its kernel. Not in the PR body (written once); the seat may add it to Acceptance notes."
  ]
}

Generated by Claude Code

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

Why the seat can answer it: NORTH-STAR 阶段姿态 already says how a declared-but-unenforced key leaves: 「声明了但不兑现的键按发布批量退役,不一键一卡」. Stage 2 makes email_template.category and email_template.isSystem exactly that, so they join the next enforce-or-remove batch, and this PR is not where they retire. What is left is sequencing between technical tasks, which the seat answers without escalating. The maintainer sees it in the Tier H 维护者速读 this PR needs anyway (4,490 changed lines), and may veto.

Not A here: retiring the keys is a schema shape change plus an objectui editor change and a console pin bump (Studio sends category: 'custom' on every save). That is the batch's landing, outside this PR's fence and its lanes.
Not C: consumers with no measured demand. Not D: the ledger rule forbids grading an echo-only key live.
The two packages/lint cases are the design working: lint-liveness-properties.test.ts says so itself ("a future regression that re-deadens a prop starts warning again on its own"). They are updated in this PR to pin the measured truth, and they cite [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876.

Filed in this act: #22876 (finding, Blocked-by: #15205: both keys into the retirement batch) and #22877 (finding: a second locale's Studio save replaces the first at the next boot; pre-existing, from the report's out-of-scope list).

Claim amendment (file surface, same round): beyond 6109130514, the PR also writes, each the minimum a gate or a now-false text required: the two packages/lint group-C cases (runtime-gate.inert-type-writes.test.ts, lint-liveness-properties.test.ts) and packages/spec/src/automation/io-node-config.test.ts (declared on #6017 in this act); content/docs/automation/email-templates.mdx (it described the retired materialization path; declared on #6023 in this act); the regenerated censuses and reference pages; scripts/{engine-double-contract.baseline.json,objectql-double-limit.baseline.json,isystem-census.mjs,measure-durability-swallow-family.mjs} (shrink-only rows and one re-pointed control, each named in the PR).

Next: a patch round on PR #22875 (the two lint cases, then the gates on the final head), the seat review, the CONTRACT_REVIEW_TIER review of record, and the Tier H closing (ACCEPT, needs-user-decision on the PR, the final 维护者速读, review requested from the authorized approvers).

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "summary": "This is the patch round after the seat answered Q1 with B. The branch keeps email_template.category and .isSystem graded dead (#22876 retires them). packages/lint now pins the measured advisory instead of silence, and its suite passes. In runtime-gate.inert-type-writes.test.ts, the group-C case is split: the mapping row is unchanged under its old title, and the email_template case asserts exactly one liveness-dead-property advisory, on category. The shipped-corpus control asserts the same single advisory. In lint-liveness-properties.test.ts, a template that sets neither key still warns about nothing, while category and a truthy isSystem each draw one dead-property advisory. All comments cite #22876. Each flipped expectation was ablated once and went red. origin/main 0253192f7 was merged and the censuses regenerated. On the final head 33641fe78 the gates reconcile 136 of 136.",
  "tests": "All at head 33641fe78. The worktree was re-created from origin/claude/issue-15205-registry-loader at 1cc2da623. Exit codes were captured before any pipe. Every build and test went through os-verify-lock (slot issue-15205) in the foreground. BUILD: spec 1/1 (VERDICT command-exit 0). The dogfood, showcase and lint closures 'Tasks: 63 successful, 63 total' (VERDICT command-exit 0). Gate prerequisites: the client, client-react and organizations closures 51/51; studio, embedder-openai, knowledge-memory, knowledge-ragflow, service-cluster-redis and service-knowledge 22/22. LINT: the two flipped files 'Test Files 2 passed (2) / Tests 142 passed (142)'. Full suite 'Test Files 137 passed (137) / Tests 6461 passed (6461)'. Typecheck OK; the test-layer debt (2 files) belongs to other files and is unchanged. PLUGIN-EMAIL: 'Test Files 33 passed (33) / Tests 515 passed (515)'. DOGFOOD: email-template-boot-sweep, email-template-materialization and email-template-overlay-survives-boot 'Tests 9 passed (9)'. ABLATIONS via scripts/ablation-replace.mjs, in WRAP mode, each restored with blob == HEAD and an empty git diff HEAD; the whole-tree status was empty after all four. L1: the group-C email_template case put back to advisories toEqual([]), '1 failed | 141 passed'. L2: the corpus control put back to email.advisories toEqual([]), '1 failed | 141 passed'. L3: the category template put back to toEqual([]), '1 failed | 141 passed'. L4: the isSystem: true template put back to toEqual([]), '1 failed | 141 passed'. GATES: dispatch-gates --commands at 33641fe78 derived 136, the same list as the previous round. --ran gives 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). 135 exited 0. check:skill-examples and check:dual-build-cjs-loads first answered exit 3 (PREREQUISITE NOT MET in this fresh worktree) and passed on re-run after the builds above. check:platform-checklist exits 1 with 8 findings, the identical 8 as origin/main 69d421805 (diff of the finding lines is empty), so they are pre-existing.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git pushes are not REST writes. Zero label writes. No PR body write: the round's description is under the seat-append heading below, for the seat to append.",
  "gates": "136 derived, 136 run, 0 NOT-MEASURED at 33641fe78. 135 exited 0. check:platform-checklist exited 1; it is pre-existing on origin/main 69d421805 with the identical 8 findings.",
  "line_budget": "4575 changed lines (additions 1581 + deletions 2994, generated included) against merge base 0253192f7, across 49 files. That is over 3000, so it lands the Tier H way. No governed surface is touched.",
  "deviations": [
    "The order named lint-liveness-properties.test.ts's 'does not warn on a well-formed email_template' as a case to flip, but that case was green on this branch: its template sets neither dead key. The two measured reds were both in runtime-gate.inert-type-writes.test.ts: the group-C email_template case, and the shipped-corpus control, which the order did not name. I flipped both reds. I also re-pinned the liveness case to the measured truth: silence without the keys, and one dead-property advisory each for category and a truthy isSystem.",
    "To keep the mapping group-C row byte-unchanged in its assertions and title, the it.each(GROUP_C) case was split into a mapping `it` and an email_template `it`. The total test count is unchanged (142 across the two files).",
    "The advisory's property path is read from the 'sets `X`' token in its message, because no structured field carries it. That is the identity convention the file's own ruleOf helper uses. The message wording is not asserted.",
    "origin/main moved on to f9ebb7dd3 after the merge of 0253192f7. dispatch-gates reported that none of those commits touched what it derives from; I did not merge again, and CI's merge ref validates."
  ],
  "files_changed": [
    "packages/lint/src/runtime-gate.inert-type-writes.test.ts",
    "packages/lint/src/lint-liveness-properties.test.ts",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (censuses regenerated on the merged tree; hand-written figures 232->227, 157->155, 75->72, 127->122)",
    "merge commit 81ec7792b (origin/main 0253192f7)"
  ],
  "seat_append": "## Patch round: the seat's answer B to Q1\n\nThe seat answered Q1 with B (seat answer on #15205): email_template.category and .isSystem land graded dead. #22876 retires them in the next enforce-or-remove batch.\n\n- `packages/lint/src/runtime-gate.inert-type-writes.test.ts`: the group-C case is split. `mapping` keeps its assertions under its old title. The `email_template` case now pins exactly one advisory: rule `liveness-dead-property` on property `category`. The shipped-corpus control pins the same single advisory for the showcase template; its `isSystem: false` draws nothing. Identity is read as the rule id plus the property token in `sets` + backtick path, the convention `lint-liveness-properties.test.ts`'s `ruleOf` already uses. The message wording is not asserted.\n- `packages/lint/src/lint-liveness-properties.test.ts`: a template that sets neither key still warns about nothing. Setting `category` draws one dead-property advisory, and so does `isSystem: true`. Both comments cite #22876 as the retirement that will remove these advisories.\n- The lint rule, the ledger grading and the schema are not edited.\n- Ablations through `scripts/ablation-replace.mjs` put the old expectation back in each flipped case, one at a time. All four went red (L1 group-C, L2 corpus control, L3 category, L4 isSystem: 1 failed of 142 each). Each was restored with blob == HEAD and an empty `git diff HEAD`.\n- `origin/main` `0253192f7` merged as `81ec7792b`. The census conflicts were resolved to main's side, my row-58 sentence was re-applied, and the censuses were regenerated in `33641fe78`.\n- Evidence at `33641fe78`:\n  - `packages/lint`: 137 files / 6,461 tests pass; typecheck OK.\n  - `plugin-email`: 515/515.\n  - The three dogfood email-template files: 9/9.\n  - `dispatch-gates`: 136 derived, 136 run, 0 NOT-MEASURED. 135 exit 0. `check:platform-checklist` exits 1 with the same 8 findings as `origin/main` `69d421805`, so they are pre-existing.\n- Changed lines are now 4,575 (+1,581 / −2,994) against merge base `0253192f7`.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Claim amendment (Clause-②) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T19:10Z

Amends the claim 6109130514. Thread-read: 6112531099.

Clause-②: no (narrowing)

The claim's line read no and named no direction. It is corrected, and the error was the seat's own. PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 retires published exports of @objectstack/plugin-email: createSysEmailTemplateLoader and its two types, bootstrapDeclaredEmailTemplates, upsertDeclaredEmailTemplate, deactivateDeclaredEmailTemplate, mapTemplateToRow, EMAIL_TEMPLATE_OBJECT, BootstrapDeclaredEmailTemplatesResult, and the seedTemplates / templates plugin options. That is a BREAKING narrowing of the package's public face, and it widens nothing.
The changeset already says BREAKING and grades minor for the launch window, which is the grade the narrowing arm owes. Only the declaration line changes: on this claim, on the PR body's second line, and in the changeset.
File surface, scope and serial constraints: unchanged.

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "4aa656e7a2f67d213e01a885960d281937483c03 (was 33641fe78; git ls-remote confirms the branch head after the push)",
  "summary": "Patch round 3. In .changeset/15205-email-templates-resolve-registry.md the line 'Clause-②: no' now reads 'Clause-②: no (narrowing)', matching the claim amendment 6112650531. No other byte of the changeset changed: the BREAKING banner, the minor grade and the ADR-0087 disposition stay. It landed as one commit, 4aa656e7a 'chore(changeset): the 15205 changeset declares Clause-②: no (narrowing)', with the model-free trailer pair, and was pushed to claude/issue-15205-registry-loader. Every gate whose family covers the changeset path was run at 4aa656e7a and exited 0. The ADR-0087 gate now counts the narrowing arm as a breaking signal and accepts the unchanged disposition. The PR body was not edited: the seat edits line 2 and appends the round text.",
  "tests": "All runs are at head 4aa656e7a, in the foreground. Each exit code was captured right after the command, with output redirected to a file and no pipe. The worktree was re-created at 33641fe78, the remote head. origin/main was not merged. pnpm install --frozen-lockfile exited 0. It was needed because the first check-adr-0087-registration run exited 1 on a missing prerequisite: 'the witness generator's runner tsx is not installed', fix 'run pnpm install first'. That is a prerequisite miss, not a red gate. Both ADR-0087 commands were re-run after the install. CHANGESET GATES: node scripts/check-changeset-no-major.mjs --base origin/main: exit 0, 'This diff introduces no major bump.' With no payload in a local run, the level axis printed NOT APPLICABLE. The same gate in CI mode, GITHUB_EVENT_NAME=pull_request and --base 0253192f7 (the merge base) --event with a payload built from PR 22875's live body and labels: with body line 2 set to 'Clause-②: no (narrowing)', exit 0, 'LEVEL AXIS: this PR declares clause-② no (narrowing) ... the declared narrowing is accounted for: @objectstack/plugin-email: minor'; with the current body line 2 'Clause-②: no', exit 0, 'direction arm: none declared'. node scripts/check-adr-0087-registration.mjs --base origin/main: exit 0, '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. .changeset/15205-email-templates-resolve-registry.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. node scripts/check-empty-changeset.mjs --base origin/main: exit 0, '1 declaring changeset(s) added'. DERIVATION: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with no path derives 136 commands for the whole PR change set (49 files against merge base 0253192f7). The same command with the single path .changeset/15205-email-templates-resolve-registry.md derives 20 commands. All 20 were run, each with exit 0: check-adr-0087-registration (--base origin/main, --self-test 463 assertions), check-changeset-no-major (--base origin/main, --self-test 401 assertions), check-empty-changeset (--base origin/main, --self-test 170 assertions), check-closing-keyword-parity and its --self-test, check-comment-mask-corpus (8795 files, 0 disagree), release-rehearsal-clone --self-test, release-pending-publish --self-test, and the pnpm checks changeset-gate-self-tests, objectui-changeset, pm-changeset-deadline-census, driver-memory-census, gitlink-declared, nul-bytes (10916 files, no raw control bytes), published-files, refd-timer-probe and watch-hint-literal. RECONCILE: dispatch-gates --ran with the changeset path gives 'Run reconciliation — 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0, a derived zero). Without a path it gives '136 derived, 20 run, 0 NOT-MEASURED, 116 UNRUN' (exit 1). Those 116 families read the other 48 files, which this round did not touch. They reconciled 136 of 136 at 33641fe78 last round, and this order owed only the changeset families. No package build or test was run, and none was owed.",
  "gates": "Changeset path at 4aa656e7a: 20 derived, 20 run, 20 exit 0, 0 NOT-MEASURED, 0 UNRUN. The disposition was not changed, because no gate named a reason to change it.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits. One REST read: GET /repos/objectstack-ai/objectstack/pulls/22875 (body and labels for the CI-mode payload).",
  "line_budget": "Still 4575 changed lines (+1581 / -2994) across 49 files against merge base 0253192f7. The edited line sits in a file this PR adds, so the count did not move.",
  "deviations": [
    "dispatch-gates printed STALE TREE: the tree is at least 6 commits behind origin/main 72b26ed4f, and one derivation input changed in that range, scripts/engine-double-contract.pinned.json. That file belongs to the engine-double-contract family, not to any family covering .changeset/. The order said not to merge unless a gate named a reason, and no changeset gate did, so origin/main was not merged. CI's merge ref reads the current main.",
    "The 'mode CI uses' was exercised beyond the derived '--base origin/main' form. pr-automation.yml runs '--base \"$MERGE_BASE\"' with GITHUB_EVENT_PATH, so I re-ran the gate with --event on a synthetic payload: the live PR body and labels, and a variant with line 2 as the seat will edit it. The level axis reads the PR body's declaration, not the changeset's. The changeset's Clause-② line is read by check-adr-0087-registration, which counts the narrowing arm as a breaking signal.",
    "pnpm install was run in the worktree (not through the lock, per the role file) because the ADR-0087 gate needs tsx. The worktree was then removed: rm -rf node_modules, then git worktree remove without --force. It exited 0 on a clean tree."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (one line: 'Clause-②: no' to 'Clause-②: no (narrowing)')"
  ],
  "seat_append": "## Patch round 3: the changeset's Clause-② line carries the narrowing arm\n\nOne commit, `4aa656e7a` on top of `33641fe78`, changes one line of `.changeset/15205-email-templates-resolve-registry.md`: `Clause-②: no` is now `Clause-②: no (narrowing)`. That matches the claim amendment 6112650531: the PR retires published exports and options of `@objectstack/plugin-email`, which is a breaking narrowing that widens nothing. No other byte of the changeset moved. The BREAKING banner, the `minor` grade for `@objectstack/plugin-email`, the two `patch` rows and the ADR-0087 marker `not-required (no-migration-prescription)` are all as before. `check-adr-0087-registration --base origin/main` exits 0. It now reads the changeset as `[BREAKING+bang+clause-②-narrowing]` and accepts the unchanged disposition, so no gate asked for the disposition to change. `check-changeset-no-major --base origin/main` exits 0. In the mode CI uses, I passed `--base` the merge base `0253192f7` and `--event` a `pull_request` payload built from the PR's live body and labels, with line 2 as the seat will set it. That run also exits 0 and reports: LEVEL AXIS: this PR declares clause-② `no (narrowing)`… the declared narrowing is accounted for: `@objectstack/plugin-email: minor`. That axis reads the PR body, so it reads the arm only once line 2 of the body is edited. Against the current body (`Clause-②: no`) it also exits 0, with no arm declared. `check-empty-changeset --base origin/main` exits 0. `dispatch-gates --commands` for the changeset path derives 20 commands. All 20 were run at `4aa656e7a`, and all 20 exited 0. `--ran` gives `20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN`. Changed lines are unchanged at 4,575, because the changeset is a file this PR adds. No package build or test was owed, and none was run.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Patch round 3: the changeset's Clause-② line carries the narrowing arm

One commit, 4aa656e7a on top of 33641fe78, changes one line of .changeset/15205-email-templates-resolve-registry.md: Clause-②: no is now Clause-②: no (narrowing). That matches the claim amendment 6112650531: the PR retires published exports and options of @objectstack/plugin-email, which is a breaking narrowing that widens nothing. No other byte of the changeset moved. The BREAKING banner, the minor grade for @objectstack/plugin-email, the two patch rows and the ADR-0087 marker not-required (no-migration-prescription) are all as before. check-adr-0087-registration --base origin/main exits 0. It now reads the changeset as [BREAKING+bang+clause-②-narrowing] and accepts the unchanged disposition, so no gate asked for the disposition to change. check-changeset-no-major --base origin/main exits 0. In the mode CI uses, I passed --base the merge base 0253192f7 and --event a pull_request payload built from the PR's live body and labels, with line 2 as the seat will set it. That run also exits 0 and reports: LEVEL AXIS: this PR declares clause-② no (narrowing)… the declared narrowing is accounted for: @objectstack/plugin-email: minor. That axis reads the PR body, so it reads the arm only once line 2 of the body is edited. Against the current body (Clause-②: no) it also exits 0, with no arm declared. check-empty-changeset --base origin/main exits 0. dispatch-gates --commands for the changeset path derives 20 commands. All 20 were run at 4aa656e7a, and all 20 exited 0. --ran gives 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN. Changed lines are unchanged at 4,575, because the changeset is a file this PR adds. No package build or test was owed, and none was run.

Generated by Claude Code

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

Claim 6109130514, amended 6112650531 (Clause-②: no (narrowing)). Reports checked against GitHub, ⛔ not taken on trust: 6112531099 (the seat's answer B to Q1, 6111829211) and 6112807145 (the changeset line). Both rounds' text is appended to the PR body, and its second line carries the arm (relay read-back: every byte stored).

Checklist, as checked:

PR shape: draft, base main, assignee zhuangjianguo. Line 1 Fixes #15205, line 2 Clause-②: no (narrowing); no other closing keyword.
Scope and size: 49 files (+1,581 / −2,994), 4,575 changed lines. check-governed-merges: 0 of 49 paths governed, and over 3,000 lines, so this is the human-merge terminal (Tier H).
The loader, read in full (template-loader.ts):
- createRegistryEmailTemplateLoader reads email_template at every load from the protocol's layered execution list, falling back to the ObjectQL registry only on a host with no protocol service.
- Within one (name, locale) slot, any item not under com.objectstack.service.email wins over the built-in. stripReadDecorations removes only _diagnostics / _draft, so _packageId survives the strip.
- The locale ladder is the row loader's. A failed read propagates. A malformed item throws the schema's message instead of falling through to the built-in.
The plugin (email-plugin.ts): the built-ins are registered through the plugin's own manifest as code-declared items. No row is read or written on boot or send. The organization door on sys_email_template stays closed. The projector, its listener and its subscription are gone, so an email_template save carries no projectionApplied receipt.
Byte identity: builtin-auth-render-identity.test.ts holds all 24 built-ins (6 names × 4 locales) to the digests the seeded-row path produced. The two paths were run side by side at 924da8d8a before the row path was deleted.
Pins and ablations: the pins are rewritten against the loader, not deleted. The dogfood statement pin shows no sys_email_template statement on boot or send. Ablations A1–A9 and L1–L4 were each red as predicted and restored by blob.
Q1, as answered (B): category and isSystem land graded dead. packages/lint pins the one dead-property advisory they draw (rule id and property path, not wording), and [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876 carries their retirement.
packages/spec: describe text and the liveness ledger only, with no schema shape change. Spec property liveness is green on CI.
Prose surfaces, sentence by sentence against the diff:
- The changeset's "What changes" bullets match the loader, the manifest registration, the removed projector and the closed door. Its FROM → TO list matches the src/index.ts diff export by export, including the two plugin options. "A deployment observes" states the transitional cost ruling C accepts.
- content/docs/automation/email-templates.mdx (its own droppable commit 94ab10722) and the regenerated references/system/email-template.mdx now describe registry resolution.
- The seat re-read every other hand-written page that names email templates: automation/index.mdx, kernel/runtime-services/email-service.mdx, getting-started/quick-start.mdx, concepts/metadata-lifecycle.mdx, automation/jobs.mdx, automation/flows.mdx and deployment/environment-variables.mdx. None says a template is seeded into, projected into or read from rows. metadata-lifecycle.mdx's email_template row marks per-org override as allowed. The type's registry entry is unchanged here, and that org-overlay axis is C5's (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206), as triage placed it in 6018661841.
Gate-forced edits outside the surface: the shrink-only baseline rows, the isystem-census row for the deleted module, the re-pointed swallow-family control and the regenerated censuses. Each is the minimal answer to a gate naming retired code, and each is declared in the body. Accepted.
CI: 33641fe78 was all green: 33 success, 2 skipped. On 4aa656e7a2 (one changeset line) 23 success, 4 skipped and 12 in progress at this stamp, none failed. Landing waits for that run.

Out of scope, dispositions:

The built-in auth templates still declare category: 'auth' and isSystem: true, which now draw the advisory. Carrier: [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876, which removes both keys.
One locale's Studio save replaces another locale's overlay at rest (sys_metadata keeps one row per type and name). Filed as [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877.
check:platform-checklist fails locally with the same 8 findings on main 69d421805. That is pre-existing and not this PR's.

Landing: a CONTRACT_REVIEW_TIER record is owed. The diff changes published schema files (describe text), and the PR declares a breaking narrowing. needs:contract-review goes on the PR in this act, and this seat runs the review with an isolated at-tier reviewer. On PASS with green CI, this goes to the human-merge terminal: needs-user-decision on the PR, the final 维护者速读, and review requested from os-zhuang and hotlong. ⛔ No seat flips it ready or enqueues it before an authorized approval.

Generated by Claude Code

Claim amendment (Clause-②, second) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T21:20Z

Amends the claim 6109130514 and supersedes the first amendment 6112650531. Thread-read: 6112901622. The at-tier review FAIL 6113872462 on PR #22875 is answered here for the declaration line.

Clause-②: yes (narrowing)

The first amendment read only half the diff, and that error was again the seat's own. PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 narrows @objectstack/plugin-email's public face: nine exports and two plugin options retire. It also widens it: createRegistryEmailTemplateLoader and the type EmailTemplateRegistrySources are new names reachable from the package's single exports entry. A diff that widens one surface and narrows another is declared yes (narrowing), the spelling scripts/pm/clause2-line.mjs reserves for it.
The level owed is unchanged. @objectstack/plugin-email already ships minor with the BREAKING banner, which is what a widening owes as a minimum and what a narrowing ships during the launch window. The line changes on three carriers: this claim, the PR body's second line and the changeset.
File surface, scope and serial constraints: unchanged.

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "0f1906217a83ce3381bc90bab6db5dee15d5ebf5 (was 4aa656e7a; 2c11a7675 changeset, 0f1906217 ledger; git ls-remote confirms the branch head after the push)",
  "summary": "Patch round 4, answering the at-tier review FAIL 6113872462 with the three dev edits the seat named. The changeset's Clause-② line now reads 'yes (narrowing)', matching claim amendment 6113893432. Its ADR-0087 marker keeps not-required (no-migration-prescription) and gains one why sentence naming the FROM → TO block as a compiler-carried code change and the vocabulary gap the maintainer is asked to rule. The email_template liveness ledger's objectui evidence (label, description) and dead notes (category, isSystem) are re-measured at the tree's .objectui-sha pin 4997995022f8 and restated there with file:line. No reading changed from 0df67f23, so no grade moves. The PR body, the claim, the drain-hook carrier and the platform-checklist note are the seat's and were not touched.",
  "tests": "Worktree re-created at 4aa656e7a, the remote head. origin/main was not merged: dispatch-gates printed STALE TREE (12 commits behind, scripts/check-route-envelope.mjs and scripts/engine-double-contract.pinned.json changed), but neither file is in the derived families for these paths, and no gate named a reason to merge. pnpm install --frozen-lockfile exited 0. Every gate run below is at the committed head 0f1906217, in the foreground. Each exit code was captured right after the command, with output redirected to a file and no pipe. DERIVATION: dispatch-gates --commands --repo objectstack-ai/objectstack with the two changed paths derives 60 commands, the same list before and after the commits. RESULTS: 57 exited 0. That includes pnpm --filter @objectstack/spec run check:liveness ('every governed-type property ... is classified'; 'state-counts/ is current ... the same 41 row(s) as the README'). It also includes node scripts/check-adr-0087-registration.mjs --base origin/main: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. .changeset/15205-email-templates-resolve-registry.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)', with the reason ending in the new sentence, so the gate did not object. The others at exit 0 are check-changeset-no-major and check-empty-changeset (--base origin/main and --self-test), changeset-gate-self-tests, objectui-changeset, published-files, nul-bytes, strictness-ledger, variant-docs, empty-state, cross-package-test-inputs, test-source-alias, comment-mask-corpus (8795 files, 0 disagree), and the rest of the list. check:dts-closure ('14 built package(s) swept - 75/75 declared declaration file(s) present'), check:sourcemap-no-sources-content ('105 map(s), none embed source text') and check:lean-entry-closure ('Admitted set held exactly (15 packages)') exited 0 after the objectql closure was built: os-verify-lock slot issue-15205, 'pnpm turbo run build --filter=@objectstack/objectql --concurrency=2', 'Tasks: 14 successful, 14 total', 'VERDICT command-exit 0 · held the lock 189s · waited 0s' (shared-box seconds). git status was clean after the build. check:platform-checklist exited 1 with 8 findings: ABSENT SYMBOL anchors in areas/access-security.json, attachments-storage.json and search.json, plus the attachments-storage symbol-anchor floor. The same gate run in a detached control worktree at origin/main 45e206e49 exited 1 with the identical 8 lines (diff empty), so they are pre-existing and not this PR's. check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET ('some package has no dist/', 107 entry points): NOT MEASURED, reason below. CI MODE: check-changeset-no-major with GITHUB_EVENT_NAME=pull_request, --base 0253192f7 (the merge base) and --event a payload built from PR 22875's live body and labels, with line 2 set to 'Clause-②: yes (narrowing)': exit 0, 'LEVEL AXIS: this PR declares clause-② yes (narrowing) ... the declared narrowing is accounted for: @objectstack/plugin-email: minor'. RECONCILE: dispatch-gates --ran with the two paths gives 'Run reconciliation — 60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN' ('1 DERIVED from a recorded exit 3', exit 0). Without paths it gives '136 derived, 59 run, 1 NOT-MEASURED, 76 UNRUN' (exit 1). Those 76 families read the PR's other 47 files, which this round did not touch, and they reconciled 136 of 136 at 33641fe78 two rounds ago. OBJECTUI RE-MEASUREMENT: an anonymous blobless clone (credential helper off) checked out at 4997995022f8e65946f6362b7434685539cc72b7. 0df67f23 is an ancestor of it: merge-base --is-ancestor exit 0, which is self-proving. git diff 0df67f23..4997995022f8 covers 7 commits and 80 files; none of the cited files appears, and 0 changed lines match category, isSystem, is_system, email.?template, listColumns or defaultColumns (case-insensitive). No package test was owed: the edits are a changeset and a ledger JSON that no build or test source compiles in.",
  "gates": "Two changed paths at 0f1906217: 60 derived, 59 run, 1 NOT-MEASURED (check:dual-build-cjs-loads, exit 3), 0 UNRUN. 57 exit 0. check:platform-checklist exit 1 is pre-existing, with the identical 8 findings on origin/main 45e206e49.",
  "not_measured": [
    "NOT MEASURED: check:dual-build-cjs-loads, reason: it needs every workspace package's dist/ (107 entry points), and only the 14-task objectql closure was built. This is a declared narrowing. The diff changes no build input of any package: the ledger JSON is shipped raw through spec's files[] 'liveness' entry, @objectstack/lint reads it at runtime (lint-liveness-properties.ts joins the spec package dir with 'liveness'), only statuses feed lint and none moved, and the changeset feeds no build. So this gate's verdict is the same as on 4aa656e7a, where the head's check-runs read 0 failed (review record 6113872462). CI runs it in full."
  ],
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits, zero claim or card writes. REST reads only: GET issues/comments/6113872462 (the review), GET issues/comments/6113893432 (the claim amendment), GET pulls/22875 (body line 2 and labels for the CI-mode payload), and a GET read-back of this comment. The objectui clone was an anonymous git fetch, not a REST call.",
  "line_budget": "Still 4575 changed lines (+1581 / -2994) across 49 files against merge base 0253192f7. The changeset is a file this PR adds, and the ledger lines edited were already PR-changed lines, so the net count did not move.",
  "deviations": [
    "The first gate pass ran before the commits, and it read the committed HEAD 4aa656e7a, not the working tree: the ADR-0087 reason printed without the new sentence. That pass is superseded and not counted. Everything was re-derived and re-run from scratch at 0f1906217, the committed head, and those are the results reported.",
    "Two commits instead of one: chore(changeset) for the Clause-② line and the marker sentence, and fix(spec) for the ledger re-measurement. Both carry the model-free trailer pair; the pre-push check:commit-card-trailers passed for both.",
    "The label and description evidence each gained a second objectui citation, default-schemas.ts#registerDefaultMetadataSchemas:336. It is the file:line behind the existing 'registers no listColumns of its own' claim, re-attributed with its own 'objectui @4997995022f8:' realm marker after the first clause, so the liveness evidence scanner keeps it foreign. The notes use the historical spelling 'measured at the .objectui-sha pin 4997995022f8'.",
    "The built objectql closure's dist/ was removed together with the worktree (rm -rf node_modules, then git worktree remove without --force, exit 0 on a clean tree). The objectui clone and the control worktree were removed too."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (Clause-② line to 'yes (narrowing)'; one sentence appended to the ADR-0087 marker's why)",
    "packages/spec/liveness/email_template.json (label and description evidence and notes, category and isSystem dead notes, restated at objectui 4997995022f8 with file:line)"
  ],
  "seat_append": "## Patch round 4: the review FAIL 6113872462, the three dev edits\n\nTwo commits on `4aa656e7a`, now at `0f1906217`. (1) `2c11a7675` changes `.changeset/15205-email-templates-resolve-registry.md` from `Clause-②: no (narrowing)` to `Clause-②: yes (narrowing)`, matching the claim amendment 6113893432. The `minor` grade and the BREAKING banner stay. In the same commit, the ADR-0087 marker keeps `not-required (no-migration-prescription)` and its why gains one sentence: the body's FROM → TO block for the retired runtime exports and plugin options is a code change the compiler carries, not a metadata migration for `objectstack migrate meta`, and ADR-0087's disposition vocabulary has no category that fits this shape exactly, so the maintainer is asked to rule the reading. `check-adr-0087-registration --base origin/main` exits 0 on the commit and prints that sentence inside its reason, so it did not object. (2) `0f1906217` restates the `email_template` ledger's cross-repo evidence at the tree's `.objectui-sha` pin `4997995022f8`. It covers the `label` and `description` evidence and notes, and the `category` and `isSystem` dead notes. Each read was re-measured in an anonymous blobless clone of objectui at `4997995022f8e65946f6362b7434685539cc72b7`, with these file:line readings:\n\n- `ResourceListPage.tsx#defaultColumns` at :835, rendering `label` at :838 and `description` at :839.\n- The fallback at :421, `config.listColumns ?? defaultColumns(...)`.\n- The cell read at :687, `row.item[c.key]`.\n- `default-schemas.ts#registerDefaultMetadataSchemas:336`. `email_template` is registered with `defaultSchema` and `fieldOrder` only. No `listColumns` site or registration names it: the sites are `builtinComponents.tsx`, which covers object, field, permission, view, dashboard, page and book, and `anchors.ts`, which covers object.\n- `category` at `default-schemas.ts:310` and `isSystem` at `:324`, both editor inputs only. The repo-wide `isSystem` reads are about objects, fields and chat messages. No `category` read touches an `email_template` item outside the editor schema.\n\nNo reading changed between `0df67f23` and `4997995022f8`. The 7 commits between them touch 80 files, but none of the cited files. Not one changed line across the whole diff mentions `category`, `isSystem`, `is_system`, `email_template`, `listColumns` or `defaultColumns`. No grade moves.\n\n`dispatch-gates --commands` for the two changed paths derives 60 commands. `--ran` gives `60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN`. 57 of them exit 0, including `check:liveness`.\n\n- `check:platform-checklist` exits 1 with 8 findings. They are identical, line for line, to a control run on `origin/main` `45e206e49`, so they are pre-existing and not this PR's.\n- `check:dual-build-cjs-loads` is NOT MEASURED (exit 3). It needs every package's `dist/`, and this diff changes no build input: the ledger JSON ships raw, and `@objectstack/lint` reads it at runtime.\n- The objectql closure (14 tasks) was built under the verify lock, so `check:dts-closure`, `check:sourcemap-no-sources-content` and `check:lean-entry-closure` are measured green.\n\nWith body line 2 as `Clause-②: yes (narrowing)`, `check-changeset-no-major` in CI mode (`--event`) exits 0 and reports the declared narrowing accounted for by `@objectstack/plugin-email: minor`. Changed lines stay at 4,575.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Patch round 4: the review FAIL 6113872462, the three dev edits

Two commits on 4aa656e7a, now at 0f1906217. (1) 2c11a7675 changes .changeset/15205-email-templates-resolve-registry.md from Clause-②: no (narrowing) to Clause-②: yes (narrowing), matching the claim amendment 6113893432. The minor grade and the BREAKING banner stay. In the same commit, the ADR-0087 marker keeps not-required (no-migration-prescription) and its why gains one sentence: the body's FROM → TO block for the retired runtime exports and plugin options is a code change the compiler carries, not a metadata migration for objectstack migrate meta, and ADR-0087's disposition vocabulary has no category that fits this shape exactly, so the maintainer is asked to rule the reading. check-adr-0087-registration --base origin/main exits 0 on the commit and prints that sentence inside its reason, so it did not object. (2) 0f1906217 restates the email_template ledger's cross-repo evidence at the tree's .objectui-sha pin 4997995022f8. It covers the label and description evidence and notes, and the category and isSystem dead notes. Each read was re-measured in an anonymous blobless clone of objectui at 4997995022f8e65946f6362b7434685539cc72b7, with these file:line readings:

ResourceListPage.tsx#defaultColumns at :835, rendering label at :838 and description at :839.
The fallback at :421, config.listColumns ?? defaultColumns(...).
The cell read at :687, row.item[c.key].
default-schemas.ts#registerDefaultMetadataSchemas:336. email_template is registered with defaultSchema and fieldOrder only. No listColumns site or registration names it: the sites are builtinComponents.tsx, which covers object, field, permission, view, dashboard, page and book, and anchors.ts, which covers object.
category at default-schemas.ts:310 and isSystem at :324, both editor inputs only. The repo-wide isSystem reads are about objects, fields and chat messages. No category read touches an email_template item outside the editor schema.

No reading changed between 0df67f23 and 4997995022f8. The 7 commits between them touch 80 files, but none of the cited files. Not one changed line across the whole diff mentions category, isSystem, is_system, email_template, listColumns or defaultColumns. No grade moves.

dispatch-gates --commands for the two changed paths derives 60 commands. --ran gives 60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN. 57 of them exit 0, including check:liveness.

check:platform-checklist exits 1 with 8 findings. They are identical, line for line, to a control run on origin/main 45e206e49, so they are pre-existing and not this PR's.
check:dual-build-cjs-loads is NOT MEASURED (exit 3). It needs every package's dist/, and this diff changes no build input: the ledger JSON ships raw, and @objectstack/lint reads it at runtime.
The objectql closure (14 tasks) was built under the verify lock, so check:dts-closure, check:sourcemap-no-sources-content and check:lean-entry-closure are measured green.

With body line 2 as Clause-②: yes (narrowing), check-changeset-no-major in CI mode (--event) exits 0 and reports the declared narrowing accounted for by @objectstack/plugin-email: minor. Changed lines stay at 4,575.

Generated by Claude Code

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

This answers the at-tier FAIL 6113872462 on 4aa656e7a2. Report 6114190447, checked against GitHub. The delta since the ACCEPT 6112901622 is two commits and two files, +8 / −8.

Clause-②: yes (narrowing) on all three carriers: the claim amendment 6113893432, the PR body's second line, and the changeset (2c11a7675). The diff widens (createRegistryEmailTemplateLoader, EmailTemplateRegistrySources, both reachable from the exports entry) and narrows (nine exports and two options retire). The seat's earlier no and no (narrowing) were its own errors. The grade stays minor with the BREAKING banner.
ADR-0087 marker: the category is unchanged, and the why gains one sentence naming the FROM → TO block and the vocabulary gap. The gate exits 0 and prints the sentence. The gap goes to the maintainer through the PR's acceptance notes and the 维护者速读, as the review asked.
Liveness ledger (0f1906217): the objectui evidence is restated at the tree's pin 4997995022f8 with file:line. The seat checked that no cited file is among the files changed between 0df67f23 and 4997995022f8, so no grade moves. check:liveness exits 0.
Drain-hook finding: carrier named in the PR's acceptance notes. Carrier: none, noted and not filed, because its only reach is an engine that outlives its kernel, measured on a test fake.
check:platform-checklist: the known main-side red, closed not_planned by triage twice (check:platform-checklist is red on main #22594, check:platform-checklist is red on main #22758) and kept out of per-PR CI by standing decision. This seat files nothing.

Landing: a fresh CONTRACT_REVIEW_TIER record is owed on 0f1906217a; this seat runs it now. On PASS with green CI, this goes to the human-merge terminal: needs-user-decision on the PR, the 维护者速读, and review requested from os-zhuang and hotlong.

Generated by Claude Code

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "78c3eed6389de37493b25586bfb6c48f02c63188 (was 0f1906217; git ls-remote confirms the branch head after the push)",
  "merge": "be55432f6, parents 0f1906217 (the branch) and 3fdb92db0 (origin/main). New merge base 3fdb92db00b3380bb166e749f377960c42db0831; the old one was 0253192f760b37b5d3da4c4f845aee1c239e6ec2.",
  "summary": "Merge round after the re-review PASS 6114282872. origin/main 3fdb92db0 was merged through scripts/pm/os-regen-merge.sh. The one conflict was the census figures table of content/docs/permissions/system-context.mdx, a MIXED os-regen path with no prose in the hunk. It was resolved to main's figures, keeping the PR's row-58 prose, and then the repo's own generators re-derived every census: gen:system-context-census and tenant-audit-census.mjs --write. 136 of 136 derived gates were run; 135 exited 0, and check:platform-checklist's 8 findings are main's, identical at the merge base. The move is a pure regeneration: only 3 paths' net diffs changed across the merge, and all 3 are generator output. The PR now reads mergeable: true, mergeable_state blocked, no longer dirty.",
  "tests": "Worktree re-created at 0f1906217, the remote head; pnpm install --frozen-lockfile exited 0. MERGE: bash scripts/pm/os-regen-merge.sh, first run exit 1: step 1 stopped on 'CONFLICT (content): Merge conflict in content/docs/permissions/system-context.mdx'. The script's notice read 'NOT deferred: the incoming side carries hand-written changes ... This file is MIXED ... Resolve the prose by hand; the anchor numbers do not matter here — take either side'. The one hunk, at lines 362-376, held only figure rows: ours 128/5/123/120 against theirs 130/6/124/121. It was resolved to theirs, and git diff against MERGE_HEAD then showed only the PR's row-58 line. The resolution was committed as merge be55432f6. The script rerun exited 0: 'RERUN ... recorded base 0253192f7 · pre-merge tip 0f1906217 · main 3fdb92db0'. Step 1 was 'ALREADY IN HEAD'. Step 2 kept the conflicted resolution and kept the branch-only bytes of io-node-config.mdx, email-template.mdx and state-counts/email_template.md, taking nothing from main. Step 3 found 'merge left no additional changes to commit'. STEP 4: @objectstack/spec was built under os-verify-lock (slot issue-15205): 'Tasks: 1 successful', 'VERDICT command-exit 0 · held the lock 105s'. Then pnpm gen:system-context-census exited 0 ('check-system-context-census: OK — 124 elevation read sites in 20 packages across 58 files'), and node scripts/tenant-audit-census.mjs --write exited 0 ('rewrote content/docs/permissions/tenant-audit-census.mdx', 'rewrote docs/audits/2026-08-tenant-audit-write-call-sites.counts.md'). pnpm --filter @objectstack/spec check:generated exited 0: '✓ All 14 generated artifacts are up to date', including check:docs. The staged diff (git diff --cached) was 4+/4- across those 3 files and was committed as 78c3eed63. BUILDS for the dist-reading gates, all under os-verify-lock: dogfood^..., example-showcase... and lint^... gave 'Tasks: 63 successful, 63 total', VERDICT command-exit 0, held 312s, waited 296s. client-react..., organizations..., client..., embedder-openai..., knowledge-memory..., knowledge-ragflow..., service-cluster-redis..., service-knowledge... and studio... gave 'Tasks: 57 successful, 57 total', VERDICT command-exit 0, held 46s, waited 235s. These are shared-box seconds. git status was clean after every build. GATES at 78c3eed63: dispatch-gates --commands --repo objectstack-ai/objectstack derives 136 commands for 49 paths against merge base 3fdb92db0, with no STALE TREE. All 136 were run in the foreground in chunks, each exit code captured right after the command with output redirected to a file. The exception is check:pm-dispatch-gates, which was run detached with nohup, its PID recorded and its exit code written to a file, per the role file ('fast 1828 case(s) in 290.2s', exit 0). 135 exited 0. Among them: check-system-context-census and check-tenant-audit-census (and their --self-tests), check-platform-object-tenancy-census, spec check:generated, check:docs, check:liveness, check:api-surface, check:authorable-surface, check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:engine-double-contract, check:objectql-double-limit, check:swallow-census-controls, check:type-check-coverage, check:type-check-debt, check:i18n and the changeset gates. check:platform-checklist exited 1 with 8 findings (ABSENT SYMBOL anchors in access-security, attachments-storage and search, plus the attachments-storage floor). A control run in a detached worktree at the merge base 3fdb92db0 exited 1 with the identical 8 lines (diff empty), so the findings are main's. RECONCILE: dispatch-gates --ran gives 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0, 'a DERIVED zero — all 136 recorded an exit code and none of them is 3').",
  "gates": "136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN at 78c3eed63 against merge base 3fdb92db0. 135 exit 0. check:platform-checklist exits 1 with 8 findings identical to the merge base 3fdb92db0 (main's). The census gates, check:generated and check:docs are green.",
  "regen_provenance": {
    "verdict": "PURE REGENERATION. Every path whose net diff differs across the merge is generated, and each differs only in generator-derived figures or stamps.",
    "name_lists": "git diff --name-only 0253192f760b37b5d3da4c4f845aee1c239e6ec2 0f1906217a83ce3381bc90bab6db5dee15d5ebf5 lists 49 paths. git diff --name-only 3fdb92db00b3380bb166e749f377960c42db0831 78c3eed6389de37493b25586bfb6c48f02c63188 lists 49 paths. The two lists are identical (diff of the two outputs is empty). The stat is '49 files changed, 1581 insertions(+), 2994 deletions(-)' on both sides.",
    "content_comparison": "For each of the 49 paths P, I compared git diff --no-color -U0 0253192f7 0f1906217 -- P | grep -E '^[+-]' | grep -vE '^(\\+\\+\\+|---) ' with the same pipeline over 3fdb92db0 78c3eed63. That compares the added and removed lines, ignoring hunk offsets and context.",
    "differing_paths": [
      "content/docs/permissions/system-context.mdx: under merge=os-regen (MIXED) and written by pnpm gen:system-context-census. Only the figure line differs: before '-| — parsed as a property **read** | 129 |' and '+... | 128 |'; after '-... | 130 |' and '+... | 129 |'. Main's base moved and the PR's minus-one is unchanged; the unrelated-metadata-fields row pair and the row-58 prose are identical.",
      "content/docs/permissions/tenant-audit-census.mdx: written by node scripts/tenant-audit-census.mjs --write (merge: unspecified). Only '+Measured on 2026-10-11 at `81ec7792b`.' became '+... at `be55432f6`.'",
      "docs/audits/2026-08-tenant-audit-write-call-sites.counts.md: written by the same generator (merge: unspecified). The same measured-at stamp line differs, 81ec7792b to be55432f6."
    ],
    "unchanged": "The other 46 paths carry byte-identical added and removed lines before and after."
  },
  "after_push": "GET pulls/22875: head 78c3eed63, mergeable true, mergeable_state blocked (no longer dirty), draft true, body line 2 'Clause-②: yes (narrowing)' (the seat's edit). origin/main has since moved one commit to 63739521d (#22894: objectql engine.ts, a changeset and two tests). git merge-tree --write-tree HEAD origin/main is clean (exit 0, tree 175fd49c9), so it was not merged. Its three added isSystem lines are all in test files: they move only the census's corpus line count, a row the page marks as not CI-held ('—'), and no tenant-audit population file.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits. REST reads: GET pulls/22875 (mergeable state after the push) and a GET read-back of this comment.",
  "line_budget": "4575 changed lines (+1581 / -2994) across 49 files against the new merge base 3fdb92db0, unchanged.",
  "deviations": [
    "The first closure build's tool call ran past the 600s foreground limit, because it waited 296s for the lock behind another agent's spec vitest run. The harness moved that call to the background. I read its VERDICT line ('command-exit 0 · held the lock 312s · waited 296s') and the task count (63/63) as soon as it finished, then continued, and set OS_VERIFY_LOCK_WAIT=240 on the next build so the call fit the cap.",
    "check:pm-dispatch-gates ran detached (nohup, PID recorded, exit code written to a file, 290.5s), as the role file prescribes for that battery. I read its exit code and log after the PID was gone.",
    "The system-context hunk was resolved by keeping main's figure rows inside the conflict region only, not with checkout --theirs, which would have dropped the PR's row-58 prose. The figures were then re-derived by the generator.",
    "The worktree was removed after the push (rm -rf node_modules, then git worktree remove without --force, exit 0 on a clean tree); the two control worktrees were removed too."
  ],
  "files_changed": [
    "merge be55432f6 (origin/main 3fdb92db0; content/docs/permissions/system-context.mdx resolved)",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (regenerated in 78c3eed63)"
  ],
  "seat_append": "## Merge round: origin/main 3fdb92db0, through os-regen-merge.sh\n\nTwo commits on `0f1906217`, now at `78c3eed63`; the new merge base is `3fdb92db0`.\n\n- `be55432f6` merges `origin/main` `3fdb92db0` through `scripts/pm/os-regen-merge.sh`. Step 1 conflicted on one file, `content/docs/permissions/system-context.mdx`, a MIXED `merge=os-regen` path. The conflict hunk held only census figures, no prose. It was resolved to main's side of those figures, and the PR's row-58 prose stayed. The rerun's step 2 took nothing from main, because no path was silently dropped, and step 3 found nothing left to commit.\n- `78c3eed63` is step 4, the repo's own generators only: `pnpm gen:system-context-census` and `node scripts/tenant-audit-census.mjs --write`, after building `@objectstack/spec`. The system-context figures now read 129 property reads and 5 reads of unrelated metadata fields: main's 130 and 6, less the retired row projection's read. The tenant-audit page and counts restamp their measured-at commit. Spec `check:generated` is green, including `check:docs`.\n\n`dispatch-gates --commands` on the merged change set derives 136 commands, and `--ran` reconciles 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN. 135 exit 0, including the system-context, tenant-audit and platform-object-tenancy census gates, `check:generated`, `check:docs`, `check:liveness`, `check:dual-build-cjs-loads` and the `check:pm-dispatch-gates` battery. `check:platform-checklist` exits 1 with 8 findings, identical line for line to a control run at the merge base `3fdb92db0`, so they are main's.\n\nRegen-provenance measurement: the PR's net diff covers the same 49 paths before (`0253192f7..0f1906217`) and after (`3fdb92db0..78c3eed63`). Comparing the added and removed lines path by path, exactly 3 paths differ, and all 3 are generated:\n\n- `content/docs/permissions/system-context.mdx` is under `merge=os-regen` and written by `gen:system-context-census`. Only the property-read figure differs: main's base moved from 129 to 130, and the PR's minus-one is unchanged.\n- `content/docs/permissions/tenant-audit-census.mdx` is written by `tenant-audit-census.mjs --write`. Only the measured-at stamp differs.\n- `docs/audits/2026-08-tenant-audit-write-call-sites.counts.md` is written by the same generator. Again only the measured-at stamp differs.\n\nAfter the push the PR reads `mergeable: true`; its `mergeable_state` is `blocked`, no longer `dirty`. `origin/main` has since moved one commit to `63739521d`. `git merge-tree --write-tree` against it is clean (exit 0), so it was not merged.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Two commits on 0f1906217, now at 78c3eed63; the new merge base is 3fdb92db0.

be55432f6 merges origin/main 3fdb92db0 through scripts/pm/os-regen-merge.sh. Step 1 conflicted on one file, content/docs/permissions/system-context.mdx, a MIXED merge=os-regen path. The conflict hunk held only census figures, no prose. It was resolved to main's side of those figures, and the PR's row-58 prose stayed. The rerun's step 2 took nothing from main, because no path was silently dropped, and step 3 found nothing left to commit.
78c3eed63 is step 4, the repo's own generators only: pnpm gen:system-context-census and node scripts/tenant-audit-census.mjs --write, after building @objectstack/spec. The system-context figures now read 129 property reads and 5 reads of unrelated metadata fields: main's 130 and 6, less the retired row projection's read. The tenant-audit page and counts restamp their measured-at commit. Spec check:generated is green, including check:docs.

dispatch-gates --commands on the merged change set derives 136 commands, and --ran reconciles 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN. 135 exit 0, including the system-context, tenant-audit and platform-object-tenancy census gates, check:generated, check:docs, check:liveness, check:dual-build-cjs-loads and the check:pm-dispatch-gates battery. check:platform-checklist exits 1 with 8 findings, identical line for line to a control run at the merge base 3fdb92db0, so they are main's.

Regen-provenance measurement: the PR's net diff covers the same 49 paths before (0253192f7..0f1906217) and after (3fdb92db0..78c3eed63). Comparing the added and removed lines path by path, exactly 3 paths differ, and all 3 are generated:

content/docs/permissions/system-context.mdx is under merge=os-regen and written by gen:system-context-census. Only the property-read figure differs: main's base moved from 129 to 130, and the PR's minus-one is unchanged.
content/docs/permissions/tenant-audit-census.mdx is written by tenant-audit-census.mjs --write. Only the measured-at stamp differs.
docs/audits/2026-08-tenant-audit-write-call-sites.counts.md is written by the same generator. Again only the measured-at stamp differs.

After the push the PR reads mergeable: true; its mergeable_state is blocked, no longer dirty. origin/main has since moved one commit to 63739521d. git merge-tree --write-tree against it is clean (exit 0), so it was not merged.

Generated by Claude Code

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z

PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 merged through the queue at 2026-10-12T01:11Z as 7de0265fc7, from the reviewed head 78c3eed638.
- Authorized approval by os-zhuang on that head.
- ACCEPT 6112901622, re-review 6114212452.
- At-tier contract review PASS 6114282872, carried to the head over a pure regeneration (6114859685).
- Read on origin/main: every file of the PR is byte-identical between the reviewed head and 7de0265fc7.
What landed: C4 stage 2 under ruling C on ADR-0131 §6 Q1 (6020178017).
- @objectstack/plugin-email resolves email_template from the registry at every send. The built-in auth templates are code-declared items of the plugin's own package and render byte-identical.
- The boot seed, the declared-template sweep, the live projector and the row loader are retired, with their exports and options.
- sys_email_template and its rows are untouched.
Closing keyword: Fixes #15205 closed this card completed. The lane shows no other closure since the merge.
Carried by others:
- The customized rows' promotion to environment-level templates is C7's (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). Until it runs, a re-save in Studio makes such an edit live, and the changeset says so.
- email_template.category / isSystem retire in [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876 (Blocked-by: #15205, now closed).
- The second-locale overlay defect is [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877.
- The ADR-0087 vocabulary gap is the maintainer's to rule, raised in the PR's acceptance notes and the 维护者速读 6115114400.
State: pm:dispatched and the assignee zhuangjianguo come off in this act. priority:p1, domain:services, domain:spec and target:v18 stay.

Generated by Claude Code

Navigation Menu

Repository navigation

refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205

Review: PR #22087 (C4 stage 1) at `a4ba9d5070` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T14:44Z. ACCEPT. Tier H: the maintainer's merge is the landing path

Triage: unlock, `pm:blocked` → `pm:queue`. Stage 2's dependency on C5 is met by S3–S5

`pm:retriage`: stage 2 needs a `packages/spec` path in the same PR. Which lane claims it, or how is it split?

Triage: the `pm:retriage` answer is (1), one cross-domain PR, claimed by the `domain:services` lane. `domain:spec` is added for visibility; the card stays in `pm:queue`

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

Patch round 3: the changeset's Clause-② line carries the narrowing arm

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

Patch round 4: the review FAIL 6113872462, the three dev edits

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205

Description

Activity

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

Review: PR #22087 (C4 stage 1) at a4ba9d5070 · seat domain:services#2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-07T14:44Z. ACCEPT. Tier H: the maintainer's merge is the landing path

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 11, 2026

Triage: unlock, pm:blocked → pm:queue. Stage 2's dependency on C5 is met by S3–S5

objectstack-fleet commented on Oct 11, 2026

pm:retriage: stage 2 needs a packages/spec path in the same PR. Which lane claims it, or how is it split?

objectstack-fleet commented on Oct 11, 2026

Triage: the pm:retriage answer is (1), one cross-domain PR, claimed by the domain:services lane. domain:spec is added for visibility; the card stays in pm:queue

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat answer to the stop (6111776721, Q1): B. Land with both keys graded dead; retire them in the next batch (#22876) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T17:41Z

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Patch round 3: the changeset's Clause-② line carries the narrowing arm

objectstack-fleet commented on Oct 11, 2026

ACCEPT (seat review): PR #22875 at 4aa656e7a2 · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T19:35Z

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Patch round 4: the review FAIL 6113872462, the three dev edits

objectstack-fleet commented on Oct 11, 2026

ACCEPT (seat re-review): PR #22875 at 0f1906217a · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T21:52Z

objectstack-fleet commented on Oct 11, 2026

Merge round: origin/main 3fdb92d, through os-regen-merge.sh

objectstack-fleet commented on Oct 12, 2026

Landed and closed out · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-12T01:11Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Review: PR #22087 (C4 stage 1) at `a4ba9d5070` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T14:44Z. ACCEPT. Tier H: the maintainer's merge is the landing path

Triage: unlock, `pm:blocked` → `pm:queue`. Stage 2's dependency on C5 is met by S3–S5

`pm:retriage`: stage 2 needs a `packages/spec` path in the same PR. Which lane claims it, or how is it split?

Triage: the `pm:retriage` answer is (1), one cross-domain PR, claimed by the `domain:services` lane. `domain:spec` is added for visibility; the card stays in `pm:queue`

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z