docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H)

Filing gate ③: a task the maintainer's rulings direct. The ADR notes the 18.x line owes are batched into one Tier H PR, which the maintainer merges (docs/adr/** is governed).

Reader who acts: the epic seat (epic:#15194).
Dedupe: none open. Searched "ADR-0131 dated note 18.x" (80 hits, all closed or unrelated).

What the notes must record (each one cites its source)

Release scope. 18.0.0 published with steps 1–6 and step 7 parts 7a-1, 7a-3, 7b-3 and 7c. The rest of step 7 follows. Source: record 6291577585 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194. This replaces ADR-0131's release-scope note (~817-830), which still says the ceremony comes in a later release.
D9, the lean-embedding exception. Engine.resolveSystemInsertOrganization answers no-organization-object and stores NULL when the composition registers no sys_organization. The counter keeps __global__ there (feat(cli,driver-sql)!: a tenant table's organization-less row no longer reaches the __global__ counter, and a production server boot with no auth secret is refused (18.x step 7, part 7b-3) #24845). Production os serve refuses a boot with no auth secret (feat(cli,driver-sql)!: a tenant table's organization-less row no longer reaches the __global__ counter, and a production server boot with no auth secret is refused (18.x step 7, part 7b-3) #24845, under 把 public 从"全局开关的副产品"升级为声明式能力,然后删掉 api.requireAuth 开关 #3963 A1). Source: refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583 reports 6284717698 and 6288405082.
D1 at the DDL. The tenant column is NOT NULL at createTable from 7b-0. 18.0.0-born databases and pre-existing shards and Turso remote stores keep the nullable column the ceremony could not tighten. Source: execution record 6285122667, plus 7b-0's measurement.
D2, declared sharing rules. They are deployment-wide through a typed marker (deploymentWide), the shape of the declared-webhook ruling A. Source: 6285122667, feat(plugin-sharing,plugin-approvals,metadata-protocol)!: 18.x step 7 part 7a-3 — the organization-less readers of sharing rules, approval units and the seed loader retire #24828.
D8's gate is implemented (check-tenant-chokepoint refuses an IS NULL arm on a tenant column). Source: feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880.
The D7 attribution field (sys_audit_log.tenant_id) keeps its NULL arm by design. Source: feat(driver-sql,objectql)!: a tenant-scoped read no longer answers a row with no organization (18.x step 7, part 7a-1) #24825 review 6287357347.

Lands after step 7 (#24583) has merged, so the notes describe shipped code.

Hold · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-20T14:50Z. The epic seat (epic:#15194) holds this card. It is not for another seat to claim.
Blocked-by: #24583

The seat sorted the 18.x line's follow-ups. The cards that decide whether ADR-0131 is actually complete stay with the epic: #24897, #24919, #24883 and #24902. #24899 (security) is dispatched now. #24898 and #24900 stay in the shared queue. The maintainer agreed, verbatim: 「同意」.

When step 7 (#24583) closes, the seat dispatches:

Claim: epic seat round · 2026-10-22T00:06Z · releasing the epic's hold (6293731009): step 7 (#24583) is closed (6323222024) and both decisions it waited on are ruled (#25133 6328987873 A; #25134 6328195425 A)
Session: session_01Y5583bs2RDd53MH6kM1ca3
Account: os-steve (the card's assignee)
Branch: claude/issue-24897-adr-0131-dated-notes
Worktree: the cloud session's own checkout (mode:cloud)
Domain: domain:spec
Seat: epic:#15194
File surface:

docs/adr/0131-total-organization-ownership-no-null-organization-id.md only: dated notes, plus the D1 paragraph [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134 rules. This is a governed path, so the PR is Tier H.
⛔ Nothing outside that ADR file. The code each note describes lands through its own PR.
Container & model: S, mode:cloud, model: TIER_DEFAULT. A governed path: the maintainer approves the PR (Tier H).
Clause-②: no — ADR text that records shipped behaviour and rulings; no code
Responsibility: ADR-0131 still describes the pre-step-7 line (the release-scope note at ~817-830, D1's "no nullable tenant column anywhere") | none | reached by every reader of the ADR
Thread-read: 6293731009
Serial constraints cleared: the PR stays a draft, and is not enqueued until [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix and [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's os migrate plan advisory have merged. Each note then cites its merge commit.

os-dev-report

{
  "issue": 24897,
  "status": "done",
  "branch": "claude/issue-24897-adr-0131-dated-notes",
  "head": "9b6e4da77e (base origin/main 459afea1f6)",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25149",
  "session": "session_01UQCyrGmMy6kwav9XCzAuQ9",
  "premise_still_valid": true,
  "summary": "ADR-0131 now records the 18.x line as shipped. It touches one file, the claim's surface (6329368843): +176/-26. (1) D14's release-scope note is replaced: 18.0.0 (06cab4849a) carries steps 1-6, the walled lift #24667 and the open ceremony #24681 included, plus 7a-1, 7a-3, 7b-3 and 7c. 7a-2, 7b-0, 7b-1+7b-2 and 7z landed after the GA (6291577585, 6323222024). (2) A D9 note records the lean-embedding exception and its boundaries: 7b-0's NOT NULL (#24940 5e9b100743), and ruling 6328987873 A, which refuses every production os serve/os start that composes no organization object, cited as #25133 in flight. So only programmatic embedding and --dev keep the exception. (3) D1's text is the #25134 paragraph (ruling 6328195425 A). The accepted 2026-09-04 text is quoted in an Amended note, which also carries the ruling's bindings; the os migrate plan advisory is cited as #25134's execution in flight. A dated D1 note records NOT NULL at CREATE TABLE. (4) D2: deploymentWide (6285122667, #24828). (5) D8: the gate implemented (#24880, #25140). (6) D7: sys_audit_log.tenant_id keeps its NULL arm (6287357347 j.3). (7) D5: the last-admin guard (#25141 abc25a3536). (8) D8: the organizationOutOfWriteReach residue (6325596117 Q1 A). (9) D1: the organization delete under ruling B (#25016 688052e147). The status line gains one Amended (2026-10-22) entry. The PR stays a draft until #25133's fix and #25134's advisory merge; then the two in-flight citations become merge commits.",
  "tests": "No code changed, so no suite was run. Every cited PR was read as merged at its stated merge commit. Each code fact was read on origin/main 459afea1f6: the chokepoint gate's spellings and 'is not' exemption, isDeploymentWideSharingRule / SharingRuleRow.deploymentWide, ATTRIBUTION_PARTITION_COLUMNS, the driver's notNullable tenant column, and organizationOutOfWriteReach with the storage-routes comment. The four D7-note objects declare tenant:false at 06cab4849a.",
  "gates": "dispatch-gates --commands (derived from the diff) gave 20 commands; each ran with its exit captured before any pipe; --ran: 20 derived, 20 run, 0 NOT-MEASURED. First pass: check-adr-symbol-anchors exit 1 on a line-number anchor (storage-routes.ts:761), now fixed to symbol anchors; check:doc-formula-expressions exit 3 (@objectstack/formula unbuilt), exit 0 after the turbo build. check-governed-merges --branch origin/claude/issue-24897-adr-0131-dated-notes: GOVERNED, Tier H, docs/adr/** x1, 202 changed lines.",
  "mcp_calls": "5 GitHub MCP reads (issue_read get + get_comments on #24897, search_pull_requests, and two ToolSearch loads); claude-code-remote send_message to the seat (1, after this comment). Other reads were gh api repo-scoped GETs.",
  "api_writes": "2 through the fleet-write relay: pr_create #25149 (draft, assignee os-steve, label skip-changeset; read back identical, 4720 bytes), and this comment. git push is not a REST write.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · ADR-0131 D6's 2026-10-19 note on sharing_rule regime C (ruling 6258883445) still ends 'it has not shipped'. Not checked against main, and outside the nine items. Noted in the PR's Acceptance notes."
  ],
  "deviations": "The first pushed commit (9b2ae461e8) carries a 'Refs #24897' line. It was pushed before pnpm install registered the pre-push hook. check:commit-card-trailers refused the same line on the second commit, which was reworded before it was pushed. The published commit was not rewritten. The PR body carries the card relation, and a squash takes its message from the body."
}

Generated by Claude Code

Seat note · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-22T00:58Z. PR #25149 merged as 37ccd5f2cf: the maintainer, os-zhuang (GOVERNED_APPROVERS), approved it at 00:31Z and landed it at 00:43Z. That closed this card.

What the merge carries:
- all nine notes, which the accuracy review 6329955338 found true;
- the amended D1, which matches ruling 6328195425 byte for byte.
Two notes describe rulings still being executed:
- the D9 note's boundary 2: [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix, ruling 6328987873;
- the D1 amendment's item 2: [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's os migrate plan advisory.
Each becomes true on main when its PR merges.
One follow-up Tier H PR (Part of #24897) will carry:
- the review's precision fixes B1, B2, B3 and B6. B1 replaces the stale D6 regime C sentence: that work shipped in 18.0.0 through plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 and fix(spec,metadata-protocol)!: the /meta door no longer authors sharing rules; Setup lists declared sharing rules #24599;
- once both fixes have merged, the two citations as merge commits.
The seat sends its approval request then.

Landed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-22T09:27Z. The follow-up PR #25154 (Part of #24897) merged into main as ef2b46b524. The maintainer, os-zhuang (GOVERNED_APPROVERS), approved it at 09:19Z on its final head fdfbe4965d and queued it. ADR-0131's 18.x notes are complete.

B4, both citations now merge commits:
- the D9 note's boundary 2 cites fix(cli)!: refuse a production os serve that composes no organization object, --server or not #25155 (ab488d9b7d): a production boot that composes no organization object is refused;
- the D1 amendment's item 2 cites feat(cli): os migrate plan lists the tenant columns still nullable, naming the voluntary ownership ceremony; the ceremony reports a NOT NULL shard truthfully #25179 (6251f59051): os migrate plan lists the tenant columns still nullable.
No "in flight" remains in the ADR.
B1, B2, B3 and B6 (precision findings of the accuracy review 6329955338):
- B1: D6 regime C is recorded as shipped in 18.0.0.
- B2: the D8 residue note names the four storage doors and the refused class.
- B3: the release-scope item names the fixture-18.0.0 harness pin.
- B6: the maintainer's words are quoted where the rulings are cited.
Housekeeping:
- The card is already closed (by docs(adr): ADR-0131 dated notes for the 18.x line — release scope, D1 as ruled, the D9 lean-embedding exception and its boundaries (Tier H) #25149).
- The hold note on docs(adr): ADR-0131 18.x notes, review precision (B1–B3, B6) and the #25155 / #25179 citations (Tier H) #25154 is marked lifted.
- needs-user-decision is removed from docs(adr): ADR-0131 18.x notes, review precision (B1–B3, B6) and the #25155 / #25179 citations (Tier H) #25154.
- The dev session is archived.
- plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 closed with it (6335689689), and its residue is plugin-sharing regime C residue: declare declaredRuleNamed on the spec contract, document regime C in sharing-rules.mdx, name sharing_rule in the activation ledger's docblock #25187.

Navigation Menu

Repository navigation

docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897

What the notes must record (each one cites its source)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897

Description

What the notes must record (each one cites its source)

Activity

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions