Repository navigation
upgrade-impact comparison after v18: report the non-access classes to the administrator, and retire the zero-consumer package-upgrade.zod.ts #24447
Description
Filing gate ③: a task the maintainer directed. Decision #24443 was ruled A (6259332195; the maintainer said 「其他同意」), and items 2–4 put this half after v18.
- Reader who acts: the epic seat, or whichever lane holds this card after v18.
- Dedupe: none was found; this card carries [Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443's after-v18 half.
Blocked-by: #24446
What the ruling binds (items 2–4 of 6259332195)
- The other classes are reported. That means the O overlays (views, dashboards, reports, translations, email templates), the C behavioural types (flows and actions; validations and scheduled jobs, which have no switch today), the E extensions (objects and apps) and settings. They use the same comparison upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 builds. Each finding goes to the administrator, not only to the server log; none is refused.
- Retire
packages/spec/src/kernel/package-upgrade.zod.ts(plan, diff, conflict, snapshot, rollback; zero runtime consumers), with its ADR-0087 conversion. - No rename spelling is added to the spec (item 5).
Measured silent cases (origin/main e22defb13c; seat measurement behind #24443)
| class | silent case | evidence |
|---|---|---|
| Flow, action | A rename re-enables a disabled item, with a double fire beside a clone. A removal orphans the ledger row. One action row disables every same-named action on every object. | service-automation/src/engine.ts:5244; objectql/src/action-activation.ts:49 |
| O overlays | A removal leaves an orphan that keeps serving. View diagnostics check only userFilters, filterableFields and kanban. | metadata-protocol/src/metadata-diagnostics.ts:207-250 |
| E extensions | A same-named vendor field is silently overridden by the extension's. A vendor object named like a customer object drops the customer's row at cold boot. | objectql/src/registry.ts:262; metadata-protocol/src/protocol.ts:31206 |
| Settings | A renamed key orphans the stored value, and the default applies. | platform-objects/src/system/sys-setting.object.ts:242 |
Activity
objectstack-fleet commentedon Oct 23, 2026
Unlocked · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-23T07:55ZBlocked-by: #24446: closedcompleted. Its ADR notes landed with PR docs(adr): ADR-0126 wall 3 holds for the access class; ADR-0131 D5 records the single-posture re-slug rule (#24446) #25384, merged at 2026-10-23T07:08Z.6259332195, items 2–4): 18.0.0 is published, and 18.x is the current line with no v19 planned. So the after-v18 half is now in scope.pm:blocked→pm:queue. The grade is unchanged at p2,domain:services.packages/spec/src/kernel/package-upgrade.zod.tsis a metadata-protocol change. Under the maintainer's standing order it is handled directly in 18.x, with no retirement stage, and its PR declares it (Metadata-protocol:line, ADR-0087 conversion). The reporting half (non-access classes reach the administrator) is runtime work, and the split into PRs is the seat's.Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Claim: card thread ·
domain:servicesseat 1 (seat post #6021, project run by the Sales account) · p2 · the services half (the non-access upgrade report); the spec half (retiringpackages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion) is left to the spec lane, asked for in a separate comment on this card · 2026-10-23T15:01ZSession:
session_01XHebWJmL3ZgbVpjM6JERNAAccount:
os-sales(the seat's linked user; the card's assignee)Branch:
claude/project-thread-mfvys8(the harness-pinned branch for this session; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record). #25413 (claimed by this session, comment 6367880115) lands first on it; this card's PR opens on the same branch after that PR merges, because this report hands its findings to the delivery helper #25413 adds.Worktree:
objectstack-issue-24447Domain:
domain:servicesSeat:
domain:services#1(seat post #6021)File surface (read on
origin/mainb2c07529; stop on a breach and explain it in the report):packages/plugins/plugin-security/src/upgrade-impact-report.ts(new): the non-access boot comparison, beside the access one upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 built, reading the registry and the stored rows only. C:sys_metadata_activationflow/action/webhook rows whose package no longer ships the name, an action row whose name more than one object ships, a stored flow or webhook row a packaged one of the same name now shadows or withholds. O: activesys_metadataoverlay rows of view, dashboard, report, translation and email_template bound to a package that no longer ships the item. E: an extension field that collides with the owning object's field, an environment-authored object row a packaged object now owns. Settings: a stored value whose namespace and key no registered manifest declares. Findings go to the administrator through the feat(plugin-security): under a walled posture, deliver the access upgrade report in-app into the organization OS_PLATFORM_OWNER_ORGANIZATION names, instead of the operator log line only #25413 helper under their own topic and dedupKey; nothing is refused.packages/plugins/plugin-security/src/security-plugin.ts: one call in thekernel:bootstrappedhook, besidereportAccessUpgrade. Serial with the [maintainer] refactor(plugin-security): splitsrc/security-plugin.ts(10,746 lines, +2,803 in 30 days) along itsSecurityPluginseams, one move-only slice per PR #25223 split series (draft refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts (#25223 cut 9) #25456 edits this file): rebased onto whatever cut is onmainwhen this PR opens.packages/plugins/plugin-security.patchchangeset for@objectstack/plugin-security.packages/spec, not the engine lane (objectql,metadata-*,platform-objects,core; read through their public surface only), notservice-automation,plugin-webhooksorservice-settingssources.Container & model:
L, card thread (in-session executor),model: default tier(dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: yes (widening)
Metadata-protocol: none
Basis for the Clause-② line: a new report at boot; no write, refusal or behaviour change on any path (item 2 of 6259332195: none is refused).
Responsibility:
n/a — not a defect cardThread-read: 6360244800
Serial constraints cleared: feat(plugin-security): under a walled posture, deliver the access upgrade report in-app into the organization OS_PLATFORM_OWNER_ORGANIZATION names, instead of the operator log line only #25413 (same session) lands first on the same branch; refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts (#25223 cut 9) #25456 ([maintainer] refactor(plugin-security): split
src/security-plugin.ts(10,746 lines, +2,803 in 30 days) along itsSecurityPluginseams, one move-only slice per PR #25223 cut 9, draft) editssecurity-plugin.ts, so this PR rebases onto it if it lands first; no open PR or in-flight claim declaresupgrade-impact-report.ts.Resume-from: none
Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Spec half: left to the spec lane ·
domain:servicesseat 1 (#6021) · 2026-10-23T15:04ZThe claim above (6367925751) takes the services half of this card: the non-access upgrade report. The other half is item 3 of 6259332195: retiring
packages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion. That is apackages/specchange, and the services lane holds no spec files, so it is asked of the spec lane in one pointer on seat post #18549.No ordering between the halves. The services report reads none of these schemas. Neither half is
Blocked-bythe other.Measured on
origin/mainb2c07529, for whoever takes the spec half:packages/spec: none.git grep -n "package-upgrade\|UpgradePlanSchema\|planUpgrade\|UpgradePackageResponse\|UpgradeSnapshot" -- ':!packages/spec'hits only docs and one ADR sentence.kernel/index.ts:59contracts/package-service.ts:29(IPackageService.planUpgrade()andupgrade()) and its testapi/package-api.zod.ts:7,598(UpgradePlanSchemaas an optionalplanfield)kernel/package-upgrade.test.tsmigrations/entries/semantic/18.kernel-package-lifecycle-durations-unit-in-key.tstype-alias-convention.pin.test.ts:165,1022export-origins/kernel.json(about 30 names)scripts/build-docs.ts:658content/docs/references/kernel/package-upgrade.mdx, with its rows inreferences/index.mdx:224,references/kernel/index.mdx:29andmeta.json:21content/docs/upgrading.mdx:603, which points at that pagedocs/adr/0126-packaged-metadata-customization-model.md:321names the file.How this card closes. If the spec half has its own card by the time the services PR lands, that PR says
Fixes #24447and names the spec card. If it does not, the PR saysRefs #24447and this card stays open for the spec half.Generated by Claude Code