upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446

Filing gate ③: a task the maintainer directed. Decision #24443 was ruled A, with the access class in v18 (ruling of record 6259332195; the maintainer's 「其他同意」 on the line 「推荐:A,访问类进 v18,其余 v18 后」).

• Reader who acts: the epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3). It dispatches the stages below to cloud devs, access first, measured first.
• Dedupe: [Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443's search found no carrier among the 105 open issues. This card and its post-v18 sibling (linked below) are the carriers.

Blocked-by: #24421 (PR #24428 adds the sharing_rule activation type that U1 reads)

What the ruling binds (verbatim, items 1–2, 4–5 of 6259332195)

1. The comparison. One comparison of the customer's state (activation-ledger rows, overlays, clones, assignments) against the new registry runs at boot after a code-package change and at marketplace upgrade. It lists orphans, suspected re-enablements (the old name gone and a new name arrived in the same package, the old name carrying a switch-off or a clone), same-name collisions, and references broken inside clones and overlays.
2. The access class (sharing rules, permission sets, positions, capabilities) is refused at marketplace upgrade until an administrator confirms, and raised as an administrator-visible warning at boot; operator-gated under a wall. Every other class is reported to the administrator, not only to the server log.
3. Release: the access class (items 1–2 for the four access types) targets v18; the remaining classes and the retirement follow after v18.
4. Record: ADR-0126 wall 3 (「no upgrade merges into or un-makes」 the customer's choices) becomes true in practice through this comparison; the stage that lands it says so in a dated note on ADR-0126 (Tier H, the maintainer merges). No rename spelling is added to the spec.

Measured starting points (origin/main e22defb13c; the seat's read-only measurement behind #24443)

• Keys are bare names.
  • The activation ledger is unique on (metadata_type, name) (packages/platform-objects/src/system/sys-metadata-activation.object.ts:189). It is read for positions and permission sets in packages/core/src/security/resolve-authz-context.ts:945, :986-1006. package_id is stored but never compared.
  • Sharing rules get a ledger type under ruling A on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 (PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428).
• Existing fragments to reuse:
  • packages/plugins/plugin-security/src/catalog-reference-report.ts: dangling catalog references, failing closed and reported at boot;
  • objectql/src/security-catalog-namespace.ts:38-52: catalog name collisions refused at the package door;
  • the sharing orphan-grant sweep (plugin-sharing/src/sharing-rule-service.ts, sweepOrphanedRuleGrants).
• The marketplace upgrade is a re-install over an existing ledger entry (packages/cloud-connection/src/marketplace-install-local-plugin.ts:2577, answer at :1698). It withdraws nothing (:1975), and both the old manifest (in the ledger) and the new one are in hand.
• A clone permission set's body is never checked against objects or fields. Unlisted fields are visible (plugin-security/src/explain-engine.ts:886).
• Every existing report is a server log line; none reaches the customer's administrator.

Stages (the seat cuts them; each measured first; each under 3,000 lines)

• U1: the comparison core, plus the boot report for the access class.
  • It compares the customer's state against the registry after boot, for the four access types:
    • activation rows whose name the registry no longer resolves;
    • suspected re-enablements: the old name has gone and a new name has arrived in the same package, and the old name carries a switch-off or a clone;
    • collisions;
    • clone bodies naming an object or field the registry lacks;
    • managed-set field denies that a same-object clone lacks.
  • It raises an administrator-visible warning. Measure the existing channel, for example an administrator notification or a Setup health surface, and add no new surface without a stop-and-report. Under a wall, it is operator-gated.
  • It carries the ADR-0126 dated note as a separate Tier H docs PR, or rides a docs-only PR the seat cuts beside it.
• U2: the marketplace refusal.
  • Before the install door writes anything, it runs the comparison against the incoming manifest.
  • If an access-class finding exists, it refuses with an ADR-0112 code naming each finding, until an administrator confirms (an explicit confirm flag or token on the same call).
  • Before U2, the repo:cloud seat reads cloud's remote-environment install path, which was not measured.
• Order and serial constraints.
  • U1 runs after PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428, which adds the sharing-rule ledger type.
  • U1 and U2 meet C8 on resolve-authz-context.ts (8c-2) and sharing-rule-service.ts (8c-3). The seat serializes them by file, and never builds ahead of an unmerged predecessor.

Acceptance

• A permission set the customer switched off. The vendor renames it in an upgrade, and its own position binds the new name.
  • At boot, an administrator-visible warning names the old name, the new name and the affected positions.
  • At marketplace upgrade, the install is refused with that finding, until it is confirmed.
• A sharing rule the customer switched off (ledger) or cloned. The vendor renames it. The same two outcomes apply.
• A clone set that names a field the new version removed, or that lacks a field deny the managed set gained, is reported.
• No finding: the upgrade proceeds unchanged.
• Pins, at both doors, for each of the four types:
  • walled: operator-gated;
  • single: the administrator.

The post-v18 remainder (the other classes, and retiring packages/spec/src/kernel/package-upgrade.zod.ts) is a separate card.