[PM seat] domain:services — ⏳ vacant #6021

This post is the single authoritative registry for the domain:services seat 1 (seat-post protocol; index label:pm:seat). Single writer: the incumbent only. Read side: this body plus every comment newer than the body's last edit. ⛔ Shift narrative does not belong in the body — this post carries current values only. Job description: .claude/skills/pm-dispatch/references/lanes/services.md. Seat 2 is #21118.

1. Current PM — ⏳ vacant

• Signed off 2026-10-16T02:24Z: os-bill · session_017WLmd5in9RXu7AjyHR8fKQ, on the maintainer's words in this session, verbatim: 「当前任务处理完，合并完成就下班」. The session first sat 2026-10-14T23:32Z (6180807500) and was re-seated at 6189513843. Its sign-off brief is the newest comment on this post, written right after this body. A successor takes the seat on it: /pm-dispatch 接手, after reading this post.
• Placement: nothing in flight and nothing waiting to land. No timer is left: the wake Routine trig_01Tt59Mb7xy7oaKUBd331h7S is deleted at sign-off. No stay-behind tail.
• ⛔ The departing session's scope (「只处理 p1 p2 任务」, 「p3 卡片可以串行派」, 「并发恢复3」) was that session's, and it is not inherited.
• Scope: the domain:services lane queue. Seat 2 ([PM seat] domain:services · seat 2 — 🟢 os-elon-musk · session_018VqJPGA1NDNSCZsnecsChP #21118) read ⏳ vacant at this seat's last read.
• Write identity: the fleet relay (objectstack-fleet[bot]) via scripts/pm/*, transport dispatch.
• Previous incumbents: os-bill · session_017WLmd5in9RXu7AjyHR8fKQ (this sign-off; its earlier brief is 6188435608). Before it: marchtian · session_01LxHPTb1LxL7a6WkQbALKnD (brief 6173044890), and os-warren · session_01CeRCvvvjxbxu2iYJAc5Cce (brief 6127166372). ⛔ Earlier ones are not restated here.

2. Ledger — current values

• In flight from this seat: none.
• The successor's first pick, from the departing seat: ADR-0139 E6: sys_activity gains a writer-stamped changed_fields column with an idempotent backfill, and the withheld-update rule becomes a predicate with no SYSTEM pre-scan (D4) #23731 (p2, ADR-0139 E6), ruled B at 6205262047, is back in pm:queue and unclaimed.
  • The dispatch must name four things: the letter B (a second writer-stamped column, a sorted key of the fired milestone's watched fields); Q2 = b (a sys_activity before-insert stamp from the backfill's own planner); the changeset 口径 of item 3; and Clause-②: yes.
  • The door's spelling is read by objectstack-ai/cloud#2900 (pointer 6205429823), so keep it as os migrate activity-changed-fields, dry run by default.
  • The possible migrate subcommand is declared to domain:cli at 6204194217 on [PM seat] domain:cli — 🟢 marchtian · session_01PFB9ZGRWYvjhTXsd8i6KBp · finishing 3, then serial (maintainer) #6024.
  • The previous dev's readings are 6204491058. Its branch claude/issue-23731-activity-changed-fields has no commits of its own: it points at an old main, so the next dev fast-forwards it.
  • One CONTRACT_REVIEW_TIER review is owed before the queue.
• Landed by this seat (17 PRs, 10 cards closed by it, plus plugin-approvals: an approval request's notification names the record by its raw id (crm_opportunity/<id>), and opening one on an empty slot logs "cannot advance" just before routing to the administrators #23556's half, four test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 slices and ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732's attachment half; landing notes on the cards):
  • runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347 → PR fix(service-i18n)!: retire I18nServicePlugin's own /api/v1/i18n/* mounts; the dispatcher bridge is the one owner (#23347) #23569 as 249130fb39 (contract record 6182052704 PASS; ACCEPT 6182072761; landing note 6182797363). Its ADR-0076 OQ#9 line → PR docs(adr-0076): OQ#9 — correct the partition's i18n and storage entries against a boot (refs #23347) #23570 as f3fd209b34 (Tier H; contract record 6182100635 PASS; APPROVED and queued by os-zhuang).
  • plugin-sharing: the two mounts of the share-link messages door disagree for a signed-in caller of a signed_in conversation link — the plugin mount answers 404, the dispatcher 200 — because the plugin mount passes no signed-in user to resolveToken #23371 → PR fix(plugin-sharing, runtime): a shared conversation's messages open for exactly the callers its share link opens for, on both mounts #23572 as c980d114d3 (ACCEPT 6182018833; landing note 6182822550).
  • security(approvals): the inbox's subject record_title is resolved under the system context and served to every approver without their field-level security, against payload-redaction's serve-time contract and #7497's ruling C #23594 → PR fix(plugin-approvals): a request's subject title is served only from fields its reader may read #23614 as 9f81260487 (contract record 6185049769 PASS; ACCEPT 6185083701; landing note 6185398152).
  • plugin-auth: a user import reports an invitation as delivered when the email transport fails — better-auth swallows what sendResetPassword throws, so INVITE_EMAIL_FAILED is never reached #23598 → PR fix(plugin-auth): a user import reports an invitation the email transport did not deliver #23627 as e611e2bdae (ACCEPT 6186093677; landing note 6186725621). It rode plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy #23343's server-only marker (fc1a55a212).
  • security(approvals): two more approval-path titles are read under the system context without the reader's field-level security (lookup-target payload_display titles; the RECORD_LOCKED refusal) — #23594's family, measure first #23618 → PR fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read #23629 as b513343ac1 (contract record 6187371379 PASS; ACCEPT 6187408616; landing note 6188325433). Its first queue group sat on fix(metadata-protocol)!: an uninstall that would drop a table another stored row still serves is refused 409 before anything is removed #23504's queue commit and went red on fix(metadata-protocol)!: an uninstall that would drop a table another stored row still serves is refused 409 before anything is removed #23504's own test (anchor Queue-flake anchor: src/package-uninstall-shared-object.integration.test.ts #23641, row correction 6187954753); the queue rebuilt it on main and it merged.
  • Every console page load by a non-admin logs ~16 "[Security] Access denied" WARN lines: the header activity feed's GET /api/v1/data/sys_activity fans out to objects the caller cannot read and logs each refusal #23279 → PR fix(plugin-audit): the parent-record read gates skip an object the caller cannot read without reading it, so no denial is logged for the skip #23663 as 94924e01c1 (ACCEPT 6190910856; landing note 6191773617). The parent-record gates ask canReadObject before reading a parent as the caller.
  • security(approvals): a lookup target's title in the approvals inbox (payload_display) is read under the system context without asking whether the reader may read that target record (row-level, sharing), unlike $expand and dataset labels; measure first #23637 (regraded p1 on triage's stated stop: it measured served) → PR fix(plugin-approvals): a payload_display lookup target is titled only for a target record the reader may read #23672 as 7e6e4e1da6 (contract record 6191970854 PASS; ACCEPT 6191993021; landing note 6192506705).
  • plugin-sharing: the record-share grant refuses a group recipient by naming sharing rules as its route, and the rule vocabulary has no group #23325 → PR fix(plugin-sharing): the record-share grant names each non-user value's sharing-rule recipient, so group is sent to team #23678 as c24598658d (ACCEPT 6193167834; landing note 6194290386).
  • test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184's plugin-auth slice (two rows) → PR test(plugin-auth): the SCIM deactivation and last-admin-guard suites run under 10 s (two #23184 rows) #23697 as f1e21c4f45, Refs (ACCEPT 6196862646; landed-and-release 6197769143).
  • test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184's service-datasource slice (two rows) → PR test(service-datasource): the pool-support and driver-factory suites run under 10 s (two #23184 rows) #23711 as 43d75ef274, Refs (ACCEPT 6199450416; landed-and-release 6200338428). The cause was a module first-load inside a clocked case, moved to module top per AGENTS.md.
  • test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184's organizations slice (two rows) → PR test(organizations): the two upload-wall suites run under 10 s (two #23184 rows) #23721 as f40d877f81, Refs (ACCEPT 6201621924; landed-and-release 6202120788, back to pm:queue). The cause was the first boot in the process, paid inside a clocked beforeAll. A test-only throwaway boot now pays it at module scope.
  • ADR-0139 E5: plugin-audit's parent-record read gate emits one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (D4, D5) #23673 (ADR-0139 E5) → PR feat(plugin-audit): the parent-record read gates write one ReadableIds leaf per parent object, with no pre-scan; D5's three classes keep the bounded probe (ADR-0139 E5) #23693 as 69351e985a (contract record 6196593905 PASS; ACCEPT 6196619416, held, then lifted at 6197716696 on the owner's answer 6197459693; landing note 6198499725). Its two end-to-end activity pins are E6's, on ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788.
  • ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732's attachment half (ADR-0139 E7) → PR feat(service-storage): the sys_attachment read gate writes one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (ADR-0139 E7, attachments) #23767 as 0b1179f332, Part of.
    • Contract record round 1 6205698995 FAIL: a false Clause-②: no. The claim was amended at 6205720011.
    • Round 2 6206226603 PASS at 39991560cd. ACCEPT 6206250712.
    • The gate writes one ReadableIds leaf per parent object. D5's classes keep the probe.
  • test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184's plugin-security slice → PR test(plugin-security): the explain/enforce parity table shares a read-only principal rig per posture source #23748 as c6c84d3175, Refs (ACCEPT 6204766686; landed-and-release 6205357235, back to pm:queue). The read-only principal rows share one rig per posture source, and each teardown disables its AsyncLocalStorage instances. position-write-through.test.ts left main in 150da61aa5 (test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962). This seat's claim had named refactor(plugin-security): delete the position write-through and the row-only position backfill (C3 stage 7b) #23302; the correction is in the ACCEPT and at 6204773298.
  • verify family split (#15953), services rows: service-automation regression tests that replace hotcrm's platform-semantics pins (rows 8, 11) #23604 (verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 rows 8 and 11) → PR test(service-automation): pin the flow runAs and filter-date semantics hotcrm pins (two #15953 rows) #23728 as 534ca13eb5 (ACCEPT 6203106870; landing note 6203733007). Both rows are carried in the existing crud-runas.test.ts and crud-filter-guard.test.ts, with one ablation each. Row 11 is pinned in today's dialect: interpolateFilter is retired ([v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939).
  • All ten cards closed completed; pm:dispatched and the assignee cleared.
  • plugin-approvals: an approval request's notification names the record by its raw id (crm_opportunity/<id>), and opening one on an empty slot logs "cannot advance" just before routing to the administrators #23556 (round 2) → PR fix(plugin-approvals): approval.requested names the record by label and title; the empty-slot warning states the slot, not the request's fate #23592 as a6d0715535, Part of #23556 (ACCEPT 6183796644; seat decision 6183426689). It landed the empty-slot WARN and the label-and-id notification body. Released at 6184159174 to pm:blocked with Blocked-by: #23594; unlock re-derived at 6185422730 to a fork. Triage closed it completed on option B (6185594767): the notification stays label-and-id. ⚠️ The squash commit's subject is stale ("label and title"): the PR title was not updated at the re-scope. This is a seat miss, recorded on the card.
• In the maintainer's decision box from this seat: ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732 (p2, ADR-0139 E7), needs-user-decision since this seat's release at landing.
  • Q1, the maintainer's (6205516105): the comment-thread gate has no pointer pair (thread_id is one text column). The seat recommends A: a writer-stamped object_name + record_id pair with a backfill, cut as its own card after E6. B, the fallback, records a limit and amends ADR-0139.
  • Q2, seat-ruled (open to veto): D5.2 binds, so the reaction gate keeps its probe.
  • Carried on the card: the round-2 record's two precision notes on the checklist item attachments-storage.read-inherits-parent-rls, for its next revision.
• Ruled from this seat's decision box: ADR-0139 E6: sys_activity gains a writer-stamped changed_fields column with an idempotent backfill, and the withheld-update rule becomes a predicate with no SYSTEM pre-scan (D4) #23731 (E6), letter B at 6205262047 (the maintainer's 「B (推荐)」, via the director). It is the successor's first pick above.
• Released by this seat (2), both since re-routed by triage to domain:spec: plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy #23343 (Release: 6181089253; retriage 6182029999, option A) and plugin-security: the seed-ownership claim hands every unowned row to the platform admin on each app:seeded — guest-written and public-form rows included — contradicting ADR-0138 D1's "the owner stays unset" #23354 (Release: 6181230118; now priority:p1, claimed by another session).
• Filed by this seat: cli/serve: a production objectstack serve with no OS_DATABASE_URL registers no driver in silence, then fails at AuthPlugin.start with "No driver available for object 'sys_organization'" and a remedy naming a datasource nobody declared #23573 (objectstack serve in production with no storage registers no driver in silence; from runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347's dev report). security(approvals): the inbox's subject record_title is resolved under the system context and served to every approver without their field-level security, against payload-redaction's serve-time contract and #7497's ruling C #23594 (security: the approvals inbox's subject record_title is not narrowed by reader FLS; from plugin-approvals: an approval request's notification names the record by its raw id (crm_opportunity/<id>), and opening one on an empty slot logs "cannot advance" just before routing to the administrators #23556's dev report; landed). security(approvals): two more approval-path titles are read under the system context without the reader's field-level security (lookup-target payload_display titles; the RECORD_LOCKED refusal) — #23594's family, measure first #23618 (security: the family's two remaining title locations; from PR fix(plugin-approvals): a request's subject title is served only from fields its reader may read #23614's contract record; triage graded it p2 into this lane, 6185528133). security(approvals): a lookup target's title in the approvals inbox (payload_display) is read under the system context without asking whether the reader may read that target record (row-level, sharing), unlike $expand and dataset labels; measure first #23637 (security, measure first: a lookup target's title in the inbox is not narrowed by the reader's access to the target ROW; from PR fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read #23629's Acceptance notes; triage graded it p2 into this lane, 6188373141; in flight).
• Closed by this seat on an unlock re-derivation: plugin-sharing: after the #15030 revert, 17.x still cannot reach a NULL-org-seeded business unit from an org-stamped rule — and #14547, its only tracker, is closed #15086, after feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195 (C1) and feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 (C7) closed (6186870083, closed completed). Its unowned residual, the NULL arm in adminOrgScope, was carried to C8 as pointer 6186855916 on feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212.
• Seat misses this shift, both recorded where they happened:
  • The squash title on PR fix(plugin-approvals): approval.requested names the record by label and title; the empty-slot warning states the slot, not the request's fate #23592 was left stale: the PR title was not updated at the re-scope.
  • On PR fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read #23629 this seat re-armed auto-merge from the auto_merge field reading off, while the timeline showed no removed_from_merge_queue. That is what §4's "never re-arm on that field" forbids. It was most likely a no-op and is corrected at 6187987847.
• Round 1 stop condition: 2 of 4 dispatches came back as forks (≥ half), so round 1 dispatched nothing further. Round 2 opened at 6182335431.
• Cross-lane declarations this seat made: [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 6180887156 (for plugin-security: the seed-ownership claim hands every unowned row to the platform admin on each app:seeded — guest-written and public-form rows included — contradicting ADR-0138 D1's "the owner stays unset" #23354 and plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy #23343) and 6203801019 (for test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184's plugin-security slice); [PM seat] domain:cli — 🟢 marchtian · session_01PFB9ZGRWYvjhTXsd8i6KBp · finishing 3, then serial (maintainer) #6024 6181130880 (for plugin-sharing: the two mounts of the share-link messages door disagree for a signed-in caller of a signed_in conversation link — the plugin mount answers 404, the dispatcher 200 — because the plugin mount passes no signed-in user to resolveToken #23371) and 6204194217 (for ADR-0139 E6: sys_activity gains a writer-stamped changed_fields column with an idempotent backfill, and the withheld-update rule becomes a predicate with no SYSTEM pre-scan (D4) #23731's possible migrate subcommand).
• Carried forward, open (read fresh at every pick, never from here):
  • p1: plugin-approvals expandPositionUsers filters organization_id strictly, while plugin-security's holdingTakesEffectIn admits an organization-less position holding in every organization: an upgraded 17.x holder never reaches an approval slate #23256 (pm:blocked, feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 open; its Blocked-by: line was only in a comment and was migrated to the body at 6186905775). automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645 (pm:on-hold). refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 and feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 are pm:epic and ⛔ not a lane seat's.
  • pm:queue p2: service: inbound mail + calendar sync (open-core scope) — plugin-email is outbound-only, so email-to-record is impossible in any app #8998, the inbound-mail coordination node, never dispatched whole. Its Phase 1 children spec + service-mailbox: sys_mail_message (the inbound mirror object) and the association seam — phase 1 of #8998 inbound mail, spec seat #22870 and connector-imap + minimal service-mailbox: shared-mailbox (forward/BCC) ingest into sys_mail_message, associated at ingest through the seam — phase 1 of #8998 inbound mail #22871 are both closed completed, and no further lane child is filed, so nothing under it is dispatchable.
  • pm:queue p3: test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 keeps only its three plugin-auth rows (org-create-posture-gate, implicit-account-linking, dev-admin-seed-credential-gate). Seat 2's answer A stands for them: the next refresh judges them, so they are ⛔ not dispatchable now. No other p3 card is in this lane's queue.
  • pm:blocked: runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590 (ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788 open; E6 ADR-0139 E6: sys_activity gains a writer-stamped changed_fields column with an idempotent backfill, and the withheld-update rule becomes a predicate with no SYSTEM pre-scan (D4) #23731 is ruled and queued, and E7 ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732 waits in the decision box) and plugin-approvals: sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (objectui#12489 letter A) #23736 (p3, Blocked-by: #23735). pm:on-hold: print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269, finding(service-automation,lint): the resume door evaluates a screen field's visibleWhen over the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring #20178, Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757, [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883. pm:blocking: Design: cross-request caching for the authenticated request path (tranche 2 of #10757) — write-invalidation-first, short-TTL fallback, configurable staleness window #11633. No pm:* state: Epic: packaged-metadata customization (ADR-0126) — flows first, v17 line #12150, service-storage: IStorageService.list(prefix) means two different things on the two shipped adapters (local: one level, directories as files; S3: recursive, silently capped at 1000) #5266.
• Notes carried in earlier revisions, ⛔ not restated: the email-audience note and the previous incumbents' §2 notes (the datasource-connect reading under OS_SKIP_SCHEMA_SYNC, the two undeclared cross-package seams for the spec seat, security(plugin-audit): a fired milestone's activity row is served with its type and summary to a reader withheld the field the milestone watches — the #21081 text-provenance declaration names the summary's tokens, not the watched field #22786's residual A).

3. Hot-file serial queue

• packages/services/service-i18n/**: free. runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347 landed as 249130fb39.
• plugin-sharing/src/share-link-routes.ts and runtime/src/domains/share-links.ts: free. plugin-sharing: the two mounts of the share-link messages door disagree for a signed-in caller of a signed_in conversation link — the plugin mount answers 404, the dispatcher 200 — because the plugin mount passes no signed-in user to resolveToken #23371 landed as c980d114d3 (the /messages arms).
• plugin-approvals/src/approval-service.ts, lifecycle-hooks.ts and action-link-pages.ts: free. The title family has landed: security(approvals): the inbox's subject record_title is resolved under the system context and served to every approver without their field-level security, against payload-redaction's serve-time contract and #7497's ruling C #23594 as 9f81260487, security(approvals): two more approval-path titles are read under the system context without the reader's field-level security (lookup-target payload_display titles; the RECORD_LOCKED refusal) — #23594's family, measure first #23618 as b513343ac1, and security(approvals): a lookup target's title in the approvals inbox (payload_display) is read under the system context without asking whether the reader may read that target record (row-level, sharing), unlike $expand and dataset labels; measure first #23637 as 7e6e4e1da6 (canReadObject, then resolveReadableParentIds as the reader).
• The rest of plugin-sharing/src/share-link-routes.ts and runtime/src/domains/share-links.ts: plugin-sharing: a share link with a password and an email audience answers an anonymous caller who sends the correct password with the wrong-password code; reordering needs a decision (allowlist-membership oracle) #23372 landed as 0ecac961 (the resolve probe). Draft PR feat(spec,core,plugin-auth)!: an API key answers as its owner's session does when the ADR-0069 policy holds the account (#23287) #23440 (auth-gate parity: a request carrying an API key beside a session cookie held by ADR-0069 is refused at REST but admitted by the five raw-host route families — one cross-seam answer is owed (session versus user) #23287, another lane) touches only share-link-routes.ts's refuseHeldSession docblock. share-link-service.ts's resolveToken is free; security(sharing): the share-link resolve gate may answer an email-audience refusal at a cost that depends on caller input — detail withheld pending maintainer #23474 landed there as d1e28411.
• service-messaging/src/messaging-service-plugin.ts provisionSystemTables, service-datasource/src/datasource-connection-service.ts (connect's bound-object loop), service-package (init() / start()): free. plugin-audit: provisionSystemTables creates tables under OS_SKIP_SCHEMA_SYNC=1, while objectql's boot says it registered every schema WITHOUT DDL #22984, durability log level: schema-sync DDL refusals in four paths log below error, and check:durability-log-level cannot see them (no syncObjectSchema entry; sync.call reads as callee "call") #22985 and service-package: sys_packages is created by raw boot DDL that ignores OS_SKIP_SCHEMA_SYNC=1, and os migrate apply (the flag's documented path) does not create it #23022 have landed; none is held.
• plugin-approvals: PR feat(plugin-approvals): ApprovalService.handleActionPage serves the ADR-0043 action page from a Request (segment 4 of #22438) #22641 landed as 3d0eeefa4a; runtime + hono: an exact /approvals/act dispatcher domain that forwards to the approvals service member, and a catch-all that stops consuming non-JSON bodies (segment 2 of ruling A on #22438) #22576 closed through PR fix(runtime,hono): an exact /approvals/act dispatcher domain for kernels with no raw app, and a catch-all that leaves the raw request readable #22693. In flight from other lanes: security(approvals, audit): a lookup target's title is resolved into the approvals inbox payload and the activity summary without asking the target's exposure (census rows 5-6 of #22661) #22738 (domain:engine, 6104538486) on approval-service.ts's enrichRows and plugin-audit/src/audit-writers.ts's resolveLookupTitles; approvals: a request opened under onEmptyApprovers: 'admin_rescue' is in no one's pending queue — listRequests / countRequests have no arm that returns it to the callers who can decide it #22725 (now domain:spec) on the listRequests / countRequests queue arm and the REST approvals filter.
• plugin-audit, ADR-0139 E6 and E7, held by this seat on disjoint files:
  • ADR-0139 E6: sys_activity gains a writer-stamped changed_fields column with an idempotent backfill, and the withheld-update rule becomes a predicate with no SYSTEM pre-scan (D4) #23731 (E6) holds nothing while it waits in the decision box (claim 6204160151 released at 6204549006). Its files stay unclaimed until the ruling and a new claim.
  • service-storage/src/attachment-access-hooks.ts and storage-service-plugin.ts: free. E7's attachment half landed as 0b1179f332. comment-access-hooks.ts is free and waits on ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732's Q1.
  • activity-read-visibility.ts and audit-log-read-visibility.ts are free. Every console page load by a non-admin logs ~16 "[Security] Access denied" WARN lines: the header activity feed's GET /api/v1/data/sys_activity fans out to objects the caller cannot read and logs each refusal #23279 landed there as 94924e01c1, and E5 (ADR-0139 E5: plugin-audit's parent-record read gate emits one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (D4, D5) #23673) as 69351e985a. ⛔ packages/core's resolveReadableParentIds is domain:engine's; this seat declares cross-lane before any card touches it.
• plugin-sharing/src/sharing-service.ts: free. plugin-sharing: the record-share grant refuses a group recipient by naming sharing rules as its route, and the rule vocabulary has no group #23325 landed as c24598658d.
• plugin-auth/src/scim-deactivation-reconcile-user.test.ts and last-admin-guard.test.ts: free. Landed as f1e21c4f45.
• services/service-datasource/src/__tests__/ pool-support and driver-factory tests: free. Landed as 43d75ef274.
• plugins/organizations/src/storage-upload-organization-change.wall.test.ts and storage-upload-door-ownership.wall.test.ts: free. Landed as f40d877f81, with the helper src/__tests__/upload-wall-warm-up.testkit.ts.
• plugin-audit: plugin-audit: a failed DDL for an audit table at boot is logged at warn and the boot stays green #22913 and plugin-audit: a user's own sys_user_preference writes (ui.recent) come back to them as "Updated User Preference 'ui.recent'" inbox notifications — the console bell shows six of them and nothing else #22961 landed (6a40a09ed, 8e4a2302a). runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590 item 3's interim C would touch parent-record-read-gate.ts and activity-field-redaction.ts, after objectui#12081 item 8.
• plugin-security, plugin-sharing, plugin-auth: the C2/C3 cutover epic ([epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194's delegation record) declares the seeders, position-write-through.ts, per-organization-catalog.ts, delegated-admin-gate.ts, explain-engine, the four catalog object files, manifest.ts, the boot regions of security-plugin.ts, sharing-rule-service.ts's position read and plugin-auth's catalog reads. Open PRs on the territory change by the hour, so read them at each pick. ⛔ A lane card whose fix lands in that territory serialises behind the epic or declares to it first.
• service-analytics: security(analytics): the ad-hoc analytics query serves objects that declare apiEnabled: false and columns declared internal: true, which every other generic exit refuses or withholds #22634 landed as 156ddfaee4, and analytics: a configured cube or dataset over an apiEnabled: false object registers silently and lists in GET /analytics/meta, then every query of it answers 404 — an authoring trap with no registration-time signal #22663 as 73990802d3.
• service-automation: PR fix(service-automation)!: flow CEL record is the record the run was handed, or unbound #22674 (automation: with no record variable bound, flow CEL record is the variables map itself, so record.KEY silently reads a variable named KEY #22642) landed as 243dd3c625. The lint twin for record is lint(flow CEL roots): record is still in ENGINE_BOUND_ROOTS, so objectstack validate passes a record.X read in a flow with no record entrance, which faults at run time once #22642 lands; and two texts describe record as always bound #22677. builtin/crud-runas.test.ts and crud-filter-guard.test.ts are free; verify family split (#15953), services rows: service-automation regression tests that replace hotcrm's platform-semantics pins (rows 8, 11) #23604 landed there as 534ca13eb5.
• plugins/plugin-security/src/explain-enforce-parity.test.ts: free. Landed as c6c84d3175.
• Known stale code comments, as read at the earlier sign-off (a record of fact; no card carries them, and the filing gate keeps them off cards):
  • more are listed in the body revision before zhuangjianguo's (§3, last bullet), ⛔ not restated here;
  • plugin-audit/src/comment-access-hooks.ts's header says the default member sets "grant wildcard CRUD" (none since member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491);
  • plugin-approvals/src/sys-approval-token.object.ts's #21197 comment still names "this object's get/list doors" (closed by 86da194919);
  • objectql's reconcileFederatedBindings docblock (§2, noted above).
• Cross-lane declarations this seat made (all their PRs have landed): engine 6122553488, 6123484760, addendum 6125629272; cli 6119163312, 6123490458, 6126310337; devx 6123496167, addendum 6125641818.
• plugin-auth/src/admin-import-users.ts, account-invitation-marker.ts and the sendResetPassword region of plugin-auth/src/auth-manager.ts: free. plugin-auth: a user import reports an invitation as delivered when the email transport fails — better-auth swallows what sendResetPassword throws, so INVITE_EMAIL_FAILED is never reached #23598 landed as e611e2bdae, after plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy #23343's fc1a55a212.
• Cross-lane declarations into this lane: plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy #23343 (landed as fc1a55a212) (domain:spec seat 1, 6182586030; claimed there on option A) on plugin-email/src/templates/auth-templates.ts (one new built-in key), plugin-auth/src/auth-manager.ts's sendResetPassword region and plugin-auth/src/admin-import-users.ts. No objection: this seat holds none of those files. Earlier declarations are in the previous body revisions.

4. Standing facts measured in this lane — ⛔ re-measure before relying, but do not re-discover

• 🔴 The agent roster is fixed at SESSION CREATION. A seat spawned without a repo source can attach the repo mid-session and gain its skills, but ⛔ never its agents. A successor must carry the repo in session_context.sources at creation and confirm os-dev before claiming. The confirming reading is an accepted Agent call.

• ⭐ The account's 5-hour usage wall can stop every in-session subagent at once (measured this shift: a 429 at about 12:5xZ, reset at 13:00Z). After the reset, each dev was resumed with SendMessage on its own context. ⛔ No order was re-run, and ⛔ no branch was re-cut. Read each dev's worktree and branch before trusting a resume note: this seat's own note for service-package: sys_packages is created by raw boot DDL that ignores OS_SKIP_SCHEMA_SYNC=1, and os migrate apply (the flag's documented path) does not create it #23022 described a stale state (owned in ACCEPT 6126299942).

• CI must be read latest-run-per-check-name (platform-readings.md).

• ⭐ A check_run.completed failure event can name a superseded head. A push mid-run cancels the old head's legs, and the aggregator reports the cancellation as a failure. Read the PR's current head before diagnosing.

• mergeable_state: blocked right after a ready-flip is a transient. The ready-flip re-runs Governed Surface Queue Guard. ⛔ Do not diagnose it at the one-minute mark. Queue entry typically follows within 2–5 minutes.

• ⭐ The CI job-log download is refused from this container (403 from the blob host). MCP get_job_logs reads it.

• ⭐ The footer behaviour of a body write depends on the CHANNEL. The fleet relay's issue_patch stores a body VERBATIM. ⇒ Send the footer you want stored, and read back after every write.

• ⭐ post-stamped enforces the stamp contract. A body carrying {{NOW}} refuses any other bare stamp. Write a quoted instant as {{WAS:…}}. A backticked token is left verbatim.

• ⭐ A comment POST normalises whitespace ⇒ read-back checks compare fragments, not bytes.

• The REST /search/* path is refused in this container. Run dedupe searches through the MCP search_issues READ tool. ⛔ It is never a write channel.

• ccr/auto_merge echoes merge_method back wrongly, and right after queue entry auto_merge can read null or false ⇒ the landing criterion is the timeline's added_to_merge_queue and delivery on origin/main, ⛔ never the PR-closed event.

• A closing keyword does NOT clean the board. After every Fixes landing, read the card, then clear pm:* and the assignee with a note. All six Fixes landings this shift closed their cards completed, and the labels still needed clearing every time.

• ⭐ Auto-merge can sit un-queued with an idle queue. One relay automerge_disable + automerge_enable pair queues it at once (no CI re-run, not a kick).

• ⭐ scripts/pm/fleet-write/dispatch.mjs needs --repo objectstack-ai/objectstack with --actions-file. Without it, it prints usage and writes nothing.

• ⭐ This session cannot write to objectstack-ai/cloud. A cloud follow-up goes to the repo:cloud seat on its post ([PM seat] repo:cloud#1 — 🟢 hotlong · session_01WVbr5J6u8BHh8EyFtcWciH #6026), with the declaration line and the unlock condition. ⛔ Not a claim.

• ⭐ A dev's public report can carry a security reproduction. Read every report and PR body for disclosure before anything else. Security orders say: push nothing until the fix sits on the red pins.

• ⭐ Whole-machine restarts come under parallel heavy dev work. Every order puts every build, test run, typecheck and gate run under scripts/pm/os-verify-lock.sh (3 GB heap, turbo --concurrency=1, vitest --maxWorkers=2) with a checkpoint log whose path is set in the same shell invocation. An unset variable once wrote to /checkpoint.log.

• ⭐ Hosted runners can starve for hours; a relay write can exit 6 having written nothing. Read the run and the target before a resend.

• ⭐ issue-create can report UNVERIFIED although the issue exists. Read the board; ⛔ never retry blind.

• check-expected-skips.mjs / check-half-states.mjs will not run without pnpm install (yaml not found, re-measured this shift). A skip is then judged row by row against the script's roster and recorded as such ⇒ their exit is NOT MEASURED, ⛔ never a clean board. The roster this shift: Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), Temporal Conformance, Dogfood Verify CLI and the Dogfood Regression Gate matrix.

• The dev writes a PR body once and ⛔ never PATCHes it ⇒ on a patch round the seat appends the dev's markdown, marked as the seat's append.

• ⭐ git-history.mjs touch REFUSES rather than guessing, and that refusal is load-bearing on a shallow clone.

• ⭐ Token grep answers 「does this string appear」, ⛔ not 「is it declared / executed」. A positive control licenses a zero only on the same subject.

• Publication layer for this repo: a merge to main does ⛔ not publish ⇒ the landing criterion is MERGED, except a fix whose consumer is another repo, judged on installability.

• ⛔ cloud and hotcrm are not reachable from this session. objectstack-ai/objectui is readable, and the fleet relay writes to it: issue-create --repo objectstack-ai/objectui created objectui#12212 as objectstack-fleet[bot].

• ⭐ MCP search_issues is semantic and can lag or go blank. At this seat's first probe it returned a pre-regrade snapshot (it showed plugin-sharing: a share link with a password and an email audience answers an anonymous caller who sends the correct password with the wrong-password code; reordering needs a decision (allowlist-membership oracle) #23372 as p3 after its 08:18Z regrade), and an hour later it returned 0 for queries that must hit. ⇒ For lane and label reads use list_issues with labels: (a true AND; compare against totalCount). For dedupe, include a positive control (a card that must come back); a zero without one is not a reading.

• ⭐ post-stamped refuses a bare stamp beside {{NOW}}, even inside backticks or a table cell. Write a quoted instant as {{WAS:…}} in the prose; it then renders the digits.

• ⭐ post-stamped also refuses a Thread-read: line with anything after its value. The value is ONE comment id or none, with nothing after it (H50 compares it for equality). Measured on this seat's verify family split (#15953), services rows: service-automation regression tests that replace hotcrm's platform-semantics pins (rows 8, 11) #23604 claim: the first post was refused and nothing was written.

• ⭐ The contract-review tier constant is CONTRACT_REVIEW_TIER in scripts/pm/dispatch-gates.mjs (read it there, ⛔ not from memory). dispatch-gates --tier says a card that only narrows owes one such review before the queue. contract-review.md scopes the owed review by face (declaration, schema or governed path). Where the two disagree, the stricter rule was run.

• ⭐ Merge-queue timing measured this shift: pr_ready + automerge_enable via the relay at 12:11Z → added_to_merge_queue about 2 minutes later → merged about 30 minutes after entry. mergeable_state: blocked right after the flip was the transient the earlier fact describes.

• ⭐ A merge-queue kick can be infrastructure: this shift saw Build Core's Upload build artifacts fail with Failed to CreateArtifact: Unable to make request: ETIMEDOUT (queue run 38589026391) while every Test Core shard passed. The merge-queue-triage comment arrives only after the whole queue run concludes, which can be about 20 minutes after the dequeue. One re-queue on the three facts landed it.

5. Notes

• [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 (the v18 gate) is CLOSED. ADR-0131 cards no longer need the per-card authorisation issuecomment-5740746890 recorded.
• 🔴 refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 belongs to the C2/C3 cutover's epic PM (batch Release version 0.4.0 #310, 6094179271, rule 1); the delegation record is in [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194's body. feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's remaining stages S8a / S8b / S9 sit in the epic's delegated batch. ⛔ This seat claims neither.
• ⚠️ Patrol anchor [Half-state patrol] check-half-states live sweep — generated view (please pin) #9857 is TRIMMED: the absence of a row naming this lane is not a clean board.

Generated by Claude Code