Personal views, first version: a reader saves a list as 「我的视图」, a user-owned row only they see, then renames, deletes or sets it as their default (#28971 ruling C)

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

立卡门类别: ③ 维护者直派 — the first-version execution card the #28971 ruling orders. Maintainer, on option C 「做个人视图，第一版排在四张卫生卡之后，范围按卡上写的」: 「同意」 (ruling 6570568131, 2026-11-02T06:21Z). Relative dates sub-ruling: 「三点都按 A：相对日期立独立卡，在 #28971 第一版立卡前合入…」 (6572083158).
Refs #28971

Filing preconditions (ruling execution step 4), re-checked at `origin/main` `a6441636` (2026-11-02T15:02Z)

Check	Reading
The four hygiene cards #28949, #28948, #28950 and #28912	all closed, completed
Relative dates in the list filter panel, #29115	closed, completed
ADR-0131 D13 "user-owned D3 object"	holds (L910)
ADR-0017 `personal` is "visible only to its `owner`"	holds (L71)
`view.zod.ts`: per-user view scoping is "a parked direction"	holds (L5866)
View creation is admin-only (`saveAsViewButton = isAdmin`)	holds (`ObjectDataPage.tsx` L579)
The metadata write gate has no user dimension (`metaSaveVerdict`)	holds
Favorites carry no filter state (`href:` names the view only)	holds (`listViewFavorites.ts` L132)
A query on an unreadable field is refused server-side	holds (`predicate-guard.ts` L159)
`this_week` preset (`{week_start}`, `{week_end}`)	holds (`date-range-presets.ts` L44/L125)

#29037 (retire the inert personal declarations) and #29038 (ADR note) are still open. The ruling does not order them before this card, and this card touches neither file.

What the first version is

A named personal view is a row of user data. It is not view metadata.

It is a user-owned platform object, modelled on sys_user_preference (packages/platform-objects/src/identity/sys-user-preference.object.ts). Row scope is the owner only. It is never exported with a package and never written through /meta.
Its configuration is spec's ListView shape and is validated against it on save, so a bad value is refused loudly. A filter on a field the reader cannot read is already refused by the server.
Its id does not use the object.key view syntax, so it cannot collide with a package view name. No unnamed preference layer sits on top of a personal view.

In: save the current list as my view; a 「我的视图」 group in the view switcher; rename; delete; set as my default (reuse the existing pin).
Not in (不包含): sharing and team views; admin management and transfer on leaving; a field picker; packaging, import and export. Sharing waits until this version has landed and usage is measured, and it then needs a ruling on whether non-admins may produce environment metadata.

Steps (two lanes, two PRs, in this order)

domain:server: the platform object, its row scope (owner only, organization-scoped per ADR-0131), and the save-time ListView validation, plus tests that pin each of these:
- another member cannot read, list, update or delete the row;
- an admin is not given a back door, because the first version has no admin management;
- an invalid ListView body is refused;
- an unreadable field in the filter is refused at query time.
  No new author-writable protocol key and no packages/spec/** schema key. If a spec key turns out to be needed, stop with needs_decision. The object's name is chosen in the PR and stated in its body.
ui lane (Blocked-by step 1's PR): the switcher's 「我的视图」 group, save-as-my-view available to any reader, rename, delete, and set as my default. It reads the merged set (package views, environment views, my views). Precedents: feat(console): the list title switches views from a dropdown, a pinned view opens by default, and a starred view joins the sidebar favorites #27943 for the switcher, objectui#12471 for user-owned list state.

业务理由

A salesperson keeps two to four working sets on one list, such as 「我的本周跟进」. Today a reader has one unnamed setting per view, so a new filter overwrites the last one, and a second set lives only in a browser bookmark. Creating a view is admin-only and visible to everyone. Without this card the end state that ADR-0017, #7611 and ADR-0131 D13 all name stays empty, and an author or the assistant keeps writing scope: 'personal', which saves but is visible to everyone.

动手的读者

Step 1: domain:server seat 1, which claims it on this card next. Step 2: a ui-lane seat once step 1's PR lands. While ui seats are vacant, the coordinator routes it.

查重

Searches, with hit counts including closed issues:

personal view user-owned: 8
我的视图: 142
save as my view: 361
personal views first version: 7

None of the hits is an execution card for this version. The nearest are #28971 (the ruling), #29037 and #29038 (the ruling's side cards), and #27943 (switcher precedent).

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Claim: PM loop round 8 · 2026-11-02T15:06Z
Session: session_01ADHkmQjPiXgNoSaEpqeGvY (seat). The dev is the card thread, and its first report names its session.
Account: os-steve
Branch: the card thread's harness-pinned branch, named in its first report. The branch names no issue, so this claim is the identity record.
Worktree: the card thread's own
Domain: domain:server
Seat: domain:server#1
Ruling-ref: #28971 ruling C, 6570568131 (maintainer 「同意」), plus the relative-dates sub-ruling 6572083158
File surface: a new user-owned platform object beside packages/platform-objects/src/identity/sys-user-preference.object.ts, its row scope and save validation, roster/census rows a gate derives for a new platform object, tests, and a changeset. ⛔ No packages/spec/** and no new author-writable protocol key. ⛔ No ui/**, which is step 2 of #29443. ⛔ Not #29037's ViewScopeSchema.personal / sharing.type.
Container & model: M, mode:thread, model as the thread was opened, effort: high
Clause-②: yes (widening) (expected: a new data object and routes appear and nothing accepted today is refused; the dev measures)
Metadata-protocol: none (expected: a platform object, not an author key; the dev measures)
Responsibility: the code is a platform object plus its row scope · a reader can't keep a second named list without a bookmark, and creating a view is admin-only and visible to everyone · reached by every reader of every list
Thread-read: none
Premise: re-checked on origin/main a6441636 in the card body
Serial constraints cleared: no in-flight card of this seat touches packages/platform-objects/**

Orders: the seat's standard order plus the card delta, both in the project's shared folder (server-seat1/standard-order.md and server-seat1/29443-delta.md).

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Claim: PM loop round 8 (revised: branch and dev session named) · 2026-11-02T15:07Z (supersedes 6580528136)
Session: session_01ADHkmQjPiXgNoSaEpqeGvY (seat). The dev is the card thread, session_01ADHkmNjCFNPZLkGxdFdgAq.
Account: os-steve
Branch: claude/project-thread-xtjloc (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own
Domain: domain:server
Seat: domain:server#1
Ruling-ref: #28971 ruling C, 6570568131 (maintainer 「同意」), plus the relative-dates sub-ruling 6572083158
File surface: a new user-owned platform object beside packages/platform-objects/src/identity/sys-user-preference.object.ts, its row scope and save validation, roster/census rows a gate derives for a new platform object, tests, and a changeset. ⛔ No packages/spec/** and no new author-writable protocol key. ⛔ No ui/**, which is step 2 of #29443. ⛔ Not #29037's ViewScopeSchema.personal / sharing.type.
Container & model: M, mode:thread, model as the thread was opened, effort: high
Clause-②: yes (widening) (expected: a new data object and routes appear and nothing accepted today is refused; the dev measures)
Metadata-protocol: none (expected: a platform object, not an author key; the dev measures)
Responsibility: the code is a platform object plus its row scope · a reader can't keep a second named list without a bookmark, and creating a view is admin-only and visible to everyone · reached by every reader of every list
Thread-read: none
Premise: re-checked on origin/main a6441636 in the card body
Serial constraints cleared: no in-flight card of this seat touches packages/platform-objects/**

Orders: the seat's standard order plus the card delta, both in the project's shared folder (server-seat1/standard-order.md and server-seat1/29443-delta.md).

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Needs decision · #29443 · how an owner deletes their personal view · 2026-11-02T15:13Z

The first version that ruling C (#28971) defined includes delete. The card thread's step 0 on origin/main a6441636 found that no shipped door can give it. member_default is bound to the everyone anchor, so under ADR-0090 D5 it cannot carry delete, and no shipped permission set gives members delete on any platform object. The same wall came up for sys_comment_reaction, and ruling 6422861164 (#26161, letter A) solved it with an own-row door.

The question (maintainer):

A (seat recommends): an own-row delete door for personal views. A server verb removes only the caller's own row. Its authorization is structural: owner must equal caller, and a foreign row is refused loudly. It needs no object-level delete grant, and member_default and the D5 anchor rule stay exactly as they are. It follows the security: a member with no position can add a comment reaction but never remove it — the console removes by delete, and delete may not ride an everyone-anchored set #26161 precedent. Cost: server S (the route plus its ledger row, and tests for own row and foreign row). The ui step calls this door.
B: no delete in the first version. A user can rename a view or stop using it, but the row stays. That drops one item from the ruled scope.
C: a soft-delete flag written through the existing update grant. The seat advises against it: it is a workaround that leaves rows in place and adds a filter to every read.

Why A: delete is in the ruled scope, the anchor wall is the one #26161 already met, and A reuses that answer without touching any shipped baseline.

Meanwhile: the server PR now being built ships the object, its owner-only row scope, ListView validation on save, read, create, update and set-as-default. It says Part of #29443, not Fixes. The delete door follows as its own PR once this is ruled.

State: the card stays pm:dispatched, because the rest of the server step is being built, and it also carries needs-user-decision for this one question (--allow-two-states; both claims are true).

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

席位裁定 · #29443 delete · A · 2026-11-02T17:07Z (withdraws the question in 6580701789)

The seat withdraws its needs-decision 6580701789 and rules A itself. No maintainer ruling is owed:

Delete is already in the ruled first-version scope ([Decision] Named personal list views: can a reader save their own named list, and what is the end state? #28971 ruling C, 6570568131).
The mechanism for a member removing their own row past the D5 anchor wall is already ruled. security: a member with no position can add a comment reaction but never remove it — the console removes by delete, and delete may not ride an everyone-anchored set #26161 letter A (6422861164) set it: an own-row door, whose authorization is structural (owner == caller, a foreign row refused loudly), with no object-level delete grant and member_default unchanged.
What remains is the route's name and its ledger row. That is a naming choice, so it is the seat's call.

Build: the own-row delete door for personal views on the #26161 shape, with its ledger row. Pin four cases: own row removed; foreign row refused; an org admin's foreign row refused; and the generic DELETE /api/v1/data/<object>/:id still refused for a member. The door goes in the server PR now being built, so that PR can say Fixes #29443 for the server step. If the PR is already open, add it there and keep Part of #29443 only until it lands.

needs-user-decision is removed. The card stays pm:dispatched.

domain:server#1 · os-steve · session_01ADHkmNjCFNPZLkGxdFdgAq
os-dev-report

{
 "issue": 29443,
 "status": "done",
 "branch": "claude/project-thread-xtjloc",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/29575",
 "session": "session_01ADHkmNjCFNPZLkGxdFdgAq",
 "premise_still_valid": true,
 "summary": "Server step of #28971 ruling C, now Fixes #29443. Adds the platform object sys_personal_view (owner, object_name, label, ListView config, is_default, timestamps), registered by plugin-auth's identity manifest beside sys_user_preference. It is owner-only through defaultRowScope inside the Layer 0 organization wall, with private access. A save is validated against spec ListViewSchema: 400 VALIDATION_FAILED, an existing code, with paths under config. A new default clears the owner's other default for the same object. Per seat ruling 6583289013, the owner's delete door DELETE /api/v1/personal-views/:id (#26161 shape) has a structural check (owner == caller). It reads the row as the caller (404 for another member or an org admin), refuses a readable foreign row 403, and removes as the system, attributed to the caller. It has its ledger row, route-envelope entry and authz-resolver delegator row. member_default grants r/c/e with no delete, unchanged by the door. organization_admin and its no-bypass variant name the object without the bypass bits. Route name /api/v1/personal-views/:id is left for the seat's review.",
 "tests": "plugin-auth src/personal-view-hooks.test.ts 21/21 (real ObjectQL + SqlDriver + SecurityPlugin, includes 7 door-core pins); src/personal-view-routes.test.ts 8/8 (door shell); src/personal-view-route-ledger.conformance.test.ts 3/3. dogfood test/personal-view-row-scope.dogfood.test.ts 14/14, through REST. Ablations, each red then restored with git diff HEAD empty: (1) org-admin entry removed: the org-admin test red; (2) defaultRowScope removed (dist rebuilt, preflight absent): 4 red; (3) ListView check removed: 3 red; (4) predicate guard forced off in dist: dogfood [predicate] red; (5) door owner check dropped: the platform-admin pin red; (6) door reads as the system: 3 red (member, both org-admin sets, 403 vs 404); (7) door not mounted (plugin-auth dist rebuilt, preflight marker present): 5 dogfood [door] red, generic-delete control green. Consumer suites on 805f0481: spec platform-object-names.test.ts 12/12; platform-objects 109 files, 1507 tests; plugin-auth 215 files, 3687 passed / 10 skipped; plugin-security 241 files, 5201 passed / 45 skipped; cli organization-ownership-inventory.test.ts 26/26. Typecheck exit 0 for platform-objects, plugin-auth, plugin-security and cli.",
 "gates": "dispatch-gates --commands on 805f0481 listed 133 commands. All exited 0, including check:type-check-debt run under os-verify-lock after the battery (exit codes captured before any pipe). --ran reconciliation: '133 derived, 133 run, 0 NOT-MEASURED, 0 UNRUN'. pnpm lint (root eslint --no-inline-config) on every changed file: exit 0. check-nul-bytes: OK. Earlier heads needed the fixes they surfaced: platform-object tenancy census regenerated; tenant-audit census regenerated with hand figures; cross-package-test-inputs + turbo.json input. The build prerequisites (dts-closure, dual-build-cjs-loads, plugin-teardown fixture) were rebuilt or fetched. CI check-runs: not yet, PR just opened.",
 "dogfood_battery": "805f0481 · os-verify-lock: VERDICT command-exit 0 · held the lock 1780s (shared box) · Test Files 398 passed | 3 skipped (401) · Tests 3291 passed | 28 skipped (3319) · no failures",
 "mcp_calls": "0",
 "api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/pulls via fleet-write dispatch); this comment (post-stamped, POST /repos/objectstack-ai/objectstack/issues/29443/comments)",
 "open_questions": [
  {
   "question": "Should a platform admin (admin_full_access bare wildcard) still READ every member's personal views? It does today, exactly as it reads sys_user_preference. The set's pins (zero per-object entries, no local fork) forbid closing it there. The delete door already refuses its delete with 403.",
   "options": [
    "A — keep it (recorded boundary, pinned by a test); revisit with sys_user_preference as one decision",
    "B — close it for both user-owned objects with a narrow engine-level exception for the platform admin, which needs the pins amended"
   ],
   "recommendation": "A for this card: the rescue path depends on the bare wildcard, and the same question applies to sys_user_preference, so it belongs in one decision for both."
  }
 ],
 "security_findings": "none",
 "out_of_scope_findings": [],
 "files_changed": "32 files (incl. the 4 i18n bundles, 2 census artefacts, census page, turbo.json, 3 scripts)",
 "line_budget": "+1841 -37 vs main: tests +926 -9; generated/census/docs/changeset/turbo +206 -28; source and scripts +709",
 "deviations": [
  "Changeset includes @objectstack/spec (patch). The seat said 'only if gates require it'. I included it because spec publishes the changed PLATFORM_OBJECTS_BY_PACKAGE constant, and AGENTS.md asks every publishing change to carry a changeset. Drop the line if the seat disagrees.",
  "Four forced test edits, each named in the PR body: default-row-scope-declarations.test.ts (DECLARED_AT_BIRTH beside the unchanged 23 DECLARERS), bundle-ownership.test.ts (OWNED_OBJECTS), durability-swallow-repair.test.ts (the SCIM-stamp fake selects its hook by packageId), and route-ledger-live-mount-parity.dogfood.test.ts. The last one's ledger union reads the door's ledger; the battery on 3eb04941 found it, and the dogfood task now declares the input in cross-package-test-inputs.mjs and turbo.json.",
  "The door's route name, /api/v1/personal-views/:id, is my pick by the unreact door's convention. It is stated in the PR body for the seat to rule in review. Its ledger disposition is 'gap', because the Console consumer and an SDK method don't exist yet.",
  "Base Clause-② reading for the door: no registrar mounts the route on base. This was read from source, not driven over HTTP on base.",
  "The /meta pin is structural, so it has no code path to ablate. The organization_admin_no_bypass pin doesn't react to ablation 1, because that variant strips the bypass itself.",
  "Dist ablations (2) and (4) were rebuilt with OS_SKIP_DTS=1, and the closure was rebuilt with DTS before the final runs. Ablation (7) used a full plugin-auth build. A bare deletion of the mount call failed the DTS build (unused private method), so the mutation guards the registerPersonalViewRoutes call instead.",
  "The first full battery on e54cd7ce had 4 reds in flow-runas and declarative-endpoint-anonymous-guest. They were base-red on a6441636, fixed on main by #29451. The battery on 3eb04941 had 1 red, live-mount parity, fixed in 4cc5a577. main was merged three times (no conflicts), and the final battery ran on the final merge head.",
  "Fork 2 moved from B to A by seat ruling 6583289013 mid-card. The PR is Fixes #29443 and posts no separate needs-decision comment."
 ]
}

Stamped 2026-11-02T19:29Z.

Generated by Claude Code

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

席位裁定 · #29443 round 2 · 2026-11-02T19:54Z

Rulings on contract review 6586971553 (PR #29575, head 805f0481, FAIL) and the dev report 6586486609. They bind the round-2 head.

Spec allowance, recorded now. The single PLATFORM_OBJECTS_BY_PACKAGE line in packages/spec/src/system/constants/platform-object-names.ts is allowed. It is a roster constant, not the author-writable protocol key or schema key the card's step 1 excludes, and a new platform object cannot land without it. Nothing else in packages/spec/** is allowed. This line was in the card thread's orders but was never recorded on this card. The record is here now. @objectstack/spec: patch stays in the changeset (ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123 / platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185 precedent).
M1, one default store. The card says "set as my default (reuse the existing pin)". That is the Console's per-object LIST_PINNED_VIEW_PREFERENCE (Console lists: the list-view switcher becomes a dropdown on the list title (search, pinned default, recent), the flat view-tab row retires, and a starred view appears in the sidebar's 收藏 group #27594), which holds a view id. Drop the is_default column and the one-default-per-owner-and-object hook. The ui lane points the existing pin at a personal view's id. If that pin cannot hold a personal view's id, the server half reports it, and no second store is added.
M2 and the open question, platform admin. Keep admin_full_access as it is for this first version. It is the rescue path, and it is the posture sys_user_preference already has; any change is decided for both objects together. The boundary must be stated as it is: through the generic /api/v1/data/sys_personal_view/:id, a platform admin can read, edit and delete a member's view. Pin generic GET, PATCH and DELETE as admin_full_access. Correct the PR body, the changeset bullet and the open question. The sentence that he cannot delete it (403) is false and is removed.
S1. Correct the object comment: a wildcard carrying viewAllRecords / modifyAllRecords still reaches a private object (ADR-0066 D2). Only a plain wildcard does not.
S2, external members: out of scope for this version. external_default gets no sys_personal_view grant in this PR. Say so in the PR body and the changeset, and name it as an open question for the ui half. Widening an external posture is a separate decision.
Route name accepted: DELETE /api/v1/personal-views/:id (plural kebab-case, /api/v1/share-links precedent; it cannot live under /api/v1/data/).
S3 (one shared own-row door instead of the copy of comment-reaction-routes.ts) is a follow-up. The seat files it after this lands; it is not in this PR. Nits: pin the owner's user_id change being refused on update. The config.data.object vs object_name check is a one-line refusal if it is cheap, otherwise an open question.
Review tier. reviewFace reads the spec roster line as a schema hit, so round 2 is reviewed at CONTRACT_REVIEW_TIER over that path, and the rest at TIER_DEFAULT.

domain:server#1 · os-steve · session_01ADHkmNjCFNPZLkGxdFdgAq
os-dev-report

{
 "issue": 29443,
 "round": 2,
 "status": "done",
 "branch": "claude/project-thread-xtjloc",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/29575",
 "head": "deedb538",
 "session": "session_01ADHkmNjCFNPZLkGxdFdgAq",
 "premise_still_valid": true,
 "summary": "Round 2 per seat ruling issuecomment-6587007982. M1: is_default and the one-default hook are removed. The default view is the existing Console pin LIST_PINNED_VIEW_PREFERENCE (#27594); finding: the pin holds a personal view's id as it is (any non-empty string; resolveViewId exact-matches first), once the ui half lists personal views in `views`. No second store. M2: admin_full_access keeps its wildcard; its generic GET/PATCH/DELETE of a member's view are pinned as a recorded boundary (engine + REST). The body and changeset no longer claim its delete is refused; only the door refuses it. S1: object comment corrected (ADR-0066 D2). S2: external_default gets no grant (open question for the ui half). Nits: config.data.object != object_name is refused 400 VALIDATION_FAILED on config.data.object (create + update, fills from ctx.previous). A user_id change is refused 403 PERMISSION_DENIED. NEW FINDING while pinning it over REST: for an org member, member_default's '*' update floor (created_by == current_user.id) is a held update policy, so the object's defaultRowScope does not apply to UPDATE, and PATCH user_id answered 200 on ee23b8ea. Fixed by a save rule: a non-system update whose user_id differs from the stored owner is refused 403 for every caller, platform admins included; system-context census row 26c owns its isSystem skip. Also: round 1's durability-swallow-repair.test.ts edit is reverted (no longer forced), and titleFormat is dropped (#29007, arrived with main). Body for the seat to apply: /mnt/project-files/server-seat1/29575-body-r2.md.",
 "tests": "plugin-auth personal-view-hooks.test.ts 27/27, personal-view-routes.test.ts 8/8, ledger conformance 3/3; dogfood personal-view-row-scope.dogfood.test.ts 16/16 (in the battery). New round-2 pins: listed-object refusal x3 + control; owner re-parent refused (member, and platform admin by the rule alone) + echo control; admin_full_access data-door GET/PATCH/DELETE boundary (engine + REST). Ablations, each red then restored with git diff HEAD empty: (8) mismatch check off: 3 red, control green; (9) fixed-owner rule off: the platform-admin re-parent test red; over REST the pre-rule head ee23b8ea is the red ([owner] cannot hand their view answered 200). Round-1 ablations 1-7 stand. Consumer suites on deedb538 under os-verify-lock: spec platform-object-names 12/12; platform-objects 110 files 1512; plugin-auth 215 files 3693 passed / 10 skipped; plugin-security 241 files 5203 passed / 45 skipped; cli inventory 26/26; typecheck exit 0 x4.",
 "gates": "dispatch-gates --commands on deedb538: 133. All exit 0, check:type-check-debt under os-verify-lock after the battery. --ran: 133 derived, 133 run, 0 NOT-MEASURED. Root eslint --no-inline-config over the 26 changed code files: exit 0. check-nul-bytes OK; check-i18n-bundles OK; check:system-context-census OK (166 sites); check:doc-anchors OK. CI: two reds on intermediate heads were mine and are fixed (lint-repo-tooling: system-context census row, 9f7adf09; Test Core 4/8: retired titleFormat, d4773b47). Other reds were rollups of runs cancelled by the next push. On deedb538 every check suite completed with nothing failed.",
 "dogfood_battery": "deedb538 · os-verify-lock: VERDICT command-exit 0 · held the lock 1583s (shared box) · Test Files 399 passed | 3 skipped (402) · Tests 3296 passed | 28 skipped (3324) · no failures",
 "mcp_calls": "reads only, 0 writes: mcp__github__issue_read get_comments on #29575 (1); mcp__github__get_job_logs on 6 check runs; one read-only subagent read job 125553329063's log (get_job_logs plus one gh api GET of the job log)",
 "api_writes": "1: this comment (post-stamped, POST /repos/objectstack-ai/objectstack/issues/29443/comments). Pushes to the branch are git, not API. The PR body is not written by me; it is the seat's to apply from the body file.",
 "open_questions": [
  {
   "question": "Platform administrator's reach: admin_full_access reads, edits and deletes members' personal views through the data API (pinned boundary), as for sys_user_preference.",
   "options": [
    "A: keep it; decide with sys_user_preference as one question",
    "B: close it for both user-owned objects with a narrow engine-level exception (pins amended)"
   ],
   "recommendation": "A for this card."
  },
  {
   "question": "External members: external_default grants nothing on sys_personal_view. Should they save views?",
   "options": [
    "Decide in the Console half"
   ],
   "recommendation": "Leave it to the ui half."
  }
 ],
 "security_findings": "One in scope, fixed: a member could re-parent their own view to another member over REST (see summary). A planted view could appear in the other member's list. Its data reads stay behind the predicate guard and FLS.",
 "out_of_scope_findings": [
  "sys_user_preference shares the template: by reading the source (not driven), its user_id is not readonly and no hook guards it, so for an org member member_default's created_by update floor likely lets a preference row be re-parented the same way. Platform-wide reading: any object whose owner column is not created_by and whose defaultRowScope is meant to hold UPDATE is replaced by that floor for org members."
 ],
 "files_changed": "32 files vs main",
 "line_budget": "+1931 -34 vs main",
 "deviations": [
  "The fixed-owner rule is a save rule (beforeUpdate hook), not a row-scope change: the created_by floor is member_default's and platform-wide, out of this card's reach.",
  "Three forced test edits now (default-row-scope-declarations, bundle-ownership, route-ledger live-mount parity); the durability-swallow-repair edit is reverted.",
  "One docs page gained a row: content/docs/permissions/system-context.mdx (26c) plus its generated register (CI gate).",
  "The intermediate battery on 35fd3165 was stopped mid-run after CI found titleFormat; the final battery ran on deedb538. Two orphaned processes from it (one gate, one vitest worker) were left to exit on their own and have exited."
 ]
}

Stamped 2026-11-02T22:21Z.

Generated by Claude Code

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Landed · 2026-11-02T23:03Z

Probe	Reading
PR #29575	MERGED 2026-11-02T23:01Z, merge commit `4008e6290f`, through the merge queue
#29443	closed completed by `Fixes #29443` (step 1, the server half)

pm:dispatched is removed. Seat records: round 1 FAIL 6586971553, seat ruling 6587007982, round 2 PASS 6590198210 (CONTRACT_REVIEW_TIER), ACCEPT on deedb538.

Follow-ups filed: #29635, step 2 (the ui half), queued for a domain:ui seat; #29630, the same re-parent gap on sys_user_preference (security); and the shared own-row door card, which carries the two comment-only should-fixes.

Navigation Menu

Repository navigation

Personal views, first version: a reader saves a list as 「我的视图」, a user-owned row only they see, then renames, deletes or sets it as their default (#28971 ruling C) #29443

Filing preconditions (ruling execution step 4), re-checked at `origin/main` `a6441636` (2026-11-02T15:02Z)

What the first version is

Steps (two lanes, two PRs, in this order)

业务理由

动手的读者

查重

Needs decision · #29443 · how an owner deletes their personal view · 2026-11-02T15:13Z

席位裁定 · #29443 delete · A · 2026-11-02T17:07Z (withdraws the question in 6580701789)

席位裁定 · #29443 round 2 · 2026-11-02T19:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Personal views, first version: a reader saves a list as 「我的视图」, a user-owned row only they see, then renames, deletes or sets it as their default (#28971 ruling C) #29443

Description

Filing preconditions (ruling execution step 4), re-checked at origin/main a6441636 (2026-11-02T15:02Z)

What the first version is

Steps (two lanes, two PRs, in this order)

业务理由

动手的读者

查重

Activity

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Needs decision · #29443 · how an owner deletes their personal view · 2026-11-02T15:13Z

objectstack-fleet commented on Nov 2, 2026

席位裁定 · #29443 delete · A · 2026-11-02T17:07Z (withdraws the question in 6580701789)

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

席位裁定 · #29443 round 2 · 2026-11-02T19:54Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Filing preconditions (ruling execution step 4), re-checked at `origin/main` `a6441636` (2026-11-02T15:02Z)