From a41ddd963e329fad96bc9579fd5ddb15b2f6e1e8 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 01:18:37 +0000 Subject: [PATCH 1/5] =?UTF-8?q?docs(adr):=20ADR-0131=20D6=20charts=20shari?= =?UTF-8?q?ng=5Frule=20under=20regime=20O,=20guarded;=20D7=20reads=20the?= =?UTF-8?q?=20activation=20ledger=20one=20way=20(ruling=20B=E2=80=B2)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two dated notes, no ruled sentence rewritten: - D6: sharing_rule under regime O — a same-name sys_sharing_rule row in its scope replaces the declared rule whole, active: false is the switch-off, the ceremony deletes only uncustomised mirrors; the guard and the immediate reconcile named. - D7: the "reverted before 17.3" clause is a pre-reversal remnant; the record and the code read sys_metadata_activation as the kept, tenant-less activation ledger (D6, D13, D14, C0). Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01TvNEqnkE9Lfbp3N2zvaqHQ --- ...ation-ownership-no-null-organization-id.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index d1c5f18f87e..05cce22a73a 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -431,6 +431,19 @@ spelling moves: the copy-once import, full editability, no upgrade channel and t naming the posture: a template import would hand every tenant an editable shared schema. Under `single` it is how a customer takes an app and makes it theirs wholesale — Salesforce's unmanaged package. +> **Note (2026-10-19, ruling of record `6257388265` on #24378, letter B′) — `sharing_rule` is charted +> under regime O, guarded.** A stored `sys_sharing_rule` row carrying a declared rule's name, in its +> scope, replaces the declared rule **whole**; `active: false` on that row is the switch-off; D10's +> ownership ceremony deletes only uncustomised mirrors. The row is made by editing the declared rule's +> projected row in Setup. A sharing rule an organization writes stays its row (D3), so under a wall an +> organization's overlay is its own and under `single` the one overlay answers everywhere (ruling item 4). +> Two rules guard the regime. **The guard:** a write that creates a `sys_sharing_rule` row, or renames +> one, to a declared rule's name in that scope, and is not an edit of the projected row, is refused at +> the write door with the vendor rule named. **The immediate reconcile:** a same-name write (the +> customised copy's creation, or its `active` change) reconciles the shadowed declaration's name-keyed +> grants at once, not at the next boot's `sweepOrphanedRuleGrants`. Both are built by #24421. ⛔ Sharing +> rules get no activation-ledger type, and same-name rows are not refused as a class. + Creating one's own item — a new permission set, position, view, flow — is environment authoring (Studio, or Setup acting as a metadata editor under `single`), gated as D2/D3 describe and refused to tenants of a shared-DB deployment. It is not customization of a managed item; pre-filling the form from a @@ -499,6 +512,17 @@ settings — `sys_setting`'s global rung leaves the tenant-scoped table: infrast configuration; a tenant-less object holds only values an operator must change without a restart (ruled 2026-09-04). Such objects are governed by object permission, not by the wall. +> **Note (2026-10-19, ruling of record `6257388265` on #24378, letter B′) — the activation ledger reads +> one way.** The clause above saying `sys_metadata_activation` "is reverted before 17.3 and does not +> return" is left over from the draft before the standard-package reversal, which re-scoped its card +> (#15024) from a revert to a column drop (§7). D6, D13, D14 and C0 hold the reading: the object +> stays as the tenant-less activation ledger and carries regime C's disable bit. It is off D13's +> retirement list, and its reserved organization column was dropped before 17.3. It is a member of this +> paragraph's family. The code follows this reading: the object is declared with +> `systemFields: { tenant: false }` (`packages/platform-objects/src/system/sys-metadata-activation.object.ts`), +> and flows, actions, positions and permission sets read it. The clause stays as written, and this note +> governs how it is read. + ⚠️ **Membership in this list is decided by the writer, not by the object's name.** The read-side ledger grouped `sys_http_delivery`, `sys_inbox_message`, `sys_notification*` and `sys_email` as "plumbing"; the tree has since decided otherwise for each — #13565 stamps `sys_http_delivery` from the webhook's From 2261458d18b17ff10c39e3e509112cb87f913c25 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 01:39:01 +0000 Subject: [PATCH 2/5] docs(adr): ADR-0131 D7 lines for identity mail, sys_secret and the settings audit's global rung (ruling Q2 A, Q4 A) Three dated notes under D7, each citing ruling of record 6257510973: identity mail goes to a deployment-level sibling of sys_email while tenant mail stays stamped; sys_secret has no organization column and follows its referencing row; sys_setting_audit's global rung moves to a deployment-level sibling. Recorded as ruled, not as shipped. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01TvNEqnkE9Lfbp3N2zvaqHQ --- ...ation-ownership-no-null-organization-id.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index 05cce22a73a..034a3576b05 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -533,6 +533,26 @@ column (NOT NULL, D3); an object no writer attributes is deployment-level and lo inventory records the verdict per object with the writer fact as its citation — this record names only the objects whose verdict the tree already states. +> **Note (2026-10-19, ruling of record `6257510973` on #24377, letter Q2 A) — identity mail is +> deployment-level.** Some mail goes to a person before any organization is theirs to stamp: verify, +> reset, magic link, email change, and an account invitation to a person with no organization. That +> mail is written to a sibling of `sys_email` that has no organization column and the same row shape. +> The same outbox, status and attachment pipeline serves it. Tenant mail stays in `sys_email` with +> its organization NOT NULL, and #11303 decision 2 keeps it stamped at its producers. ⛔ Neither a +> nullable column nor unpersisted mail. This is a ruled decision that a C8 stage builds; it has not +> shipped. + +> **Note (2026-10-19, ruling of record `6257510973` on #24377, letter Q4 A) — `sys_secret` has no +> organization column.** A secret's ownership follows the row that references it: `sys_setting` / +> `sys_platform_setting`, the webhook, the flow credential, the field's record, or the datasource. +> Every read stays by id under privilege. This is a ruled decision that a C8 stage builds; it has not +> shipped. + +> **Note (2026-10-19, ruling of record `6257510973` on #24377, letter Q4 A) — `sys_setting_audit`'s +> global rung moves to a deployment-level sibling.** This is the same departure `sys_setting`'s global +> rung already makes. The settings audit's tenant and user rows stay in `sys_setting_audit` with the +> organization NOT NULL. This is a ruled decision that a C8 stage builds; it has not shipped. + The #12699 deployment declaration becomes **total**: an object a deployment declares platform-global gets **no organization column on that deployment** (the injected-columns plan reads the declaration), so Layer 0 and the driver agree by having nothing to scope. This is how the cloud control plane From b1e9de61d1524809f7efe524152bc11044e1e1f5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 03:28:10 +0000 Subject: [PATCH 3/5] =?UTF-8?q?docs(adr):=20ADR-0131=20D6=20charts=20shari?= =?UTF-8?q?ng=5Frule=20under=20regime=20C=20(ruling=20A=20supersedes=20B?= =?UTF-8?q?=E2=80=B2);=20D7=20ledger=20note=20names=20sharing=20rules=20as?= =?UTF-8?q?=20a=20fifth=20reader?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The D6 note is rewritten from regime O to regime C per ruling of record 6258883445, which supersedes 6257388265: declared rules read-only and clonable, switch-off through a sys_metadata_activation row of type sharing_rule (deployment-level, operator-gated under a wall), customising by clone plus base-off, same-name shadowing retired, and the ceremony migrating customised copies. The D7 activation-ledger reading note gains sharing rules as a ruled, not-yet-shipped fifth reader. The three D7 lines for the identity-mail/secret/settings-audit ruling are unchanged. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01TvNEqnkE9Lfbp3N2zvaqHQ --- ...ation-ownership-no-null-organization-id.md | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index 034a3576b05..0d5240e136d 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -431,18 +431,19 @@ spelling moves: the copy-once import, full editability, no upgrade channel and t naming the posture: a template import would hand every tenant an editable shared schema. Under `single` it is how a customer takes an app and makes it theirs wholesale — Salesforce's unmanaged package. -> **Note (2026-10-19, ruling of record `6257388265` on #24378, letter B′) — `sharing_rule` is charted -> under regime O, guarded.** A stored `sys_sharing_rule` row carrying a declared rule's name, in its -> scope, replaces the declared rule **whole**; `active: false` on that row is the switch-off; D10's -> ownership ceremony deletes only uncustomised mirrors. The row is made by editing the declared rule's -> projected row in Setup. A sharing rule an organization writes stays its row (D3), so under a wall an -> organization's overlay is its own and under `single` the one overlay answers everywhere (ruling item 4). -> Two rules guard the regime. **The guard:** a write that creates a `sys_sharing_rule` row, or renames -> one, to a declared rule's name in that scope, and is not an edit of the projected row, is refused at -> the write door with the vendor rule named. **The immediate reconcile:** a same-name write (the -> customised copy's creation, or its `active` change) reconciles the shadowed declaration's name-keyed -> grants at once, not at the next boot's `sweepOrphanedRuleGrants`. Both are built by #24421. ⛔ Sharing -> rules get no activation-ledger type, and same-name rows are not refused as a class. +> **Note (2026-10-19, ruling of record `6258883445` on #24378, letter A, which supersedes ruling +> `6257388265`, letter B′) — `sharing_rule` is charted under regime C.** A managed declared sharing rule +> is read-only and clonable. **Switching it off** is the `active` bit of a `sys_metadata_activation` row +> of type `sharing_rule`. Like the bit for flows and actions, it is deployment-level and operator-gated +> under a wall. There is no per-organization switch-off, and organizations still author their own rules +> (D3). **Customising** is a clone under a new name, plus the base switched off. **Same-name shadowing is +> retired.** A `sys_sharing_rule` row that takes a declared rule's name in its scope is refused, whether +> it is new or renamed. A declaration that arrives over an authored row, as in a package upgrade, is +> reported loudly at load and never becomes an overlay. **D10's ownership ceremony** migrates each +> existing customised copy to a clone plus the base switched off, and deletes the uncustomised mirrors +> (fate 2). The promise that a customised copy keeps answering and a switch-off survives redeploys is +> kept by that migration and the ledger, not by shadowing. This is a ruled decision that #24421 builds; +> it has not shipped. Creating one's own item — a new permission set, position, view, flow — is environment authoring (Studio, or Setup acting as a metadata editor under `single`), gated as D2/D3 describe and refused to @@ -520,8 +521,9 @@ configuration; a tenant-less object holds only values an operator must change wi > retirement list, and its reserved organization column was dropped before 17.3. It is a member of this > paragraph's family. The code follows this reading: the object is declared with > `systemFields: { tenant: false }` (`packages/platform-objects/src/system/sys-metadata-activation.object.ts`), -> and flows, actions, positions and permission sets read it. The clause stays as written, and this note -> governs how it is read. +> and flows, actions, positions and permission sets read it. Sharing rules join them as a fifth reader by +> ruling `6258883445` on #24378, which is ruled and not yet shipped (the D6 note above). The clause stays +> as written, and this note governs how it is read. ⚠️ **Membership in this list is decided by the writer, not by the object's name.** The read-side ledger grouped `sys_http_delivery`, `sys_inbox_message`, `sys_notification*` and `sys_email` as "plumbing"; the From 371b98aecec95c6904f8db16a42a537c43e263ed Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 03:44:58 +0000 Subject: [PATCH 4/5] =?UTF-8?q?docs(adr):=20ADR-0131=20D7=20note=20?= =?UTF-8?q?=E2=80=94=20sys=5Fflow=5Fcredential=20is=20deployment-level=20(?= =?UTF-8?q?ruling=20Q1=20A=20on=20flow=20credentials)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One dated D7 note citing ruling of record 6259141885: sys_flow_credential is to declare systemFields { tenant: false }, so it carries no organization column; a credential's ownership follows its flow, which is environment metadata (D2, D6). Recorded as ruled, not shipped. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01TvNEqnkE9Lfbp3N2zvaqHQ --- ...-total-organization-ownership-no-null-organization-id.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index 0d5240e136d..f64dcf72359 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -555,6 +555,12 @@ the objects whose verdict the tree already states. > rung already makes. The settings audit's tenant and user rows stay in `sys_setting_audit` with the > organization NOT NULL. This is a ruled decision that a C8 stage builds; it has not shipped. +> **Note (2026-10-19, ruling of record `6259141885` on #24435, letter Q1 A) — `sys_flow_credential` is +> deployment-level.** The object is to declare `systemFields: { tenant: false }`, so it has no +> organization column. A credential's ownership follows the flow it belongs to, and a flow is +> environment metadata (D2, D6). This matches the `sys_secret` note above. This is a ruled decision that +> a C8 stage builds; it has not shipped. + The #12699 deployment declaration becomes **total**: an object a deployment declares platform-global gets **no organization column on that deployment** (the injected-columns plan reads the declaration), so Layer 0 and the driver agree by having nothing to scope. This is how the cloud control plane From 3d9490faf48b99d4a800f99e090429718ab01ccd Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 04:45:17 +0000 Subject: [PATCH 5/5] =?UTF-8?q?docs(adr):=20ADR-0131=20D14=20release-scope?= =?UTF-8?q?=20note=20=E2=80=94=2018.0=20ships=20fresh=20installs=20on=20si?= =?UTF-8?q?ngle=20only;=20the=20upgrade=20path,=20walled=20postures=20and?= =?UTF-8?q?=20later=20C8=20stages=20ship=20in=2018.x?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One dated D14 note citing ruling records 6259608309 and 6259698357: 18.0 is fresh installs on the single posture, with the ownership migration and walled postures refused; stage 8b ships in 18.0; the upgrade path, walled postures, 8b-0d/8b-0e/8b-0g, 8c, 8d and 8e ship in 18.x. No ruled sentence or earlier note is changed. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01TvNEqnkE9Lfbp3N2zvaqHQ --- ...ation-ownership-no-null-organization-id.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index f64dcf72359..c745cf7df25 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -814,6 +814,27 @@ sits beside them. under `single` for capability holders" is the accurate wording, and D3's "no Studio capability is required" is withdrawn by this ruling. +**Release-scope note (2026-10-19, ruling records `6259608309` and `6259698357` on #15194).** Two ruling +records of the maintainer (「同意」, twice) split the v18 line between 18.0 and later 18.x releases. +⛔ Neither changes a decision of this record: the line, the fence above and §8's order stand, and this +note sits beside them. + +1. **18.0 ships for fresh installs, on the `single` posture only.** A v17 database stays on 17.x + until the 18.x release that carries the upgrade path. In 18.0, `os migrate organization-ownership` + refuses to run, and the walled postures (`group`, `isolated`) are refused at the operator's boot + path. Both refusals name the 18.x release that will carry the missing piece. +2. **Stage 8b ships in 18.0.** Every system insert is stamped or refused; under `single` it is stamped + with the Default Organization. +3. **These ship in 18.x:** + - the v17 → v18 upgrade path, which is the ceremony's deferred fates and moves; + - the walled postures; + - C8 stages 8b-0d, 8b-0e and 8b-0g: the identity-mail and settings-audit siblings, the column-less + `sys_secret` and `sys_flow_credential`, and declared webhooks served from the registry (the D7 + notes above); + - 8c, the organization-less read branches; + - 8d, `COALESCE` and `__global__`; + - 8e, the NOT NULL constraint. + --- ## 3. Non-goals