[objectstack-fleet]

Fixes #24897

Clause-②: no
Metadata-protocol: none

ADR text only. It records shipped behaviour and the rulings of record; no code moves. One file: docs/adr/0131-total-organization-ownership-no-null-organization-id.md. Tier H (docs/adr/**): the maintainer approves. This PR stays a draft, and is not enqueued, until #25133's fix and #25134's os migrate plan advisory have merged. Their notes then cite the merge commits.

What the ADR now records

#	Where	What	Source
1	D14, release-scope note	Replaced. 18.0.0 (06cab4849a) carries steps 1–6, including the walled lift (#24667) and the open ceremony (#24681), plus step 7 parts 7a-1, 7a-3, 7b-3 and 7c. 7a-2, 7b-0, 7b-1+7b-2 and 7z landed after the GA. 18.0.0-born stores are birth-marked at generation 1. One line tells the reader how to take the 2026-10-19 scope note's items 1–3 now.	6291577585 on #15194; 6323222024 on #24583 (its table)
2	D9, dated note	The lean-embedding exception (no-organization-object stores NULL; the counter keys __global__) and its three boundaries: 7b-0's NOT NULL at CREATE TABLE; every production os serve/os start that composes no organization object is refused, whether or not --server (#25133, in flight); so only programmatic embedding and --dev keep it.	6284717698, 6288405082 on #24583; ruling 6328987873 on #25133 (A); #24940 5e9b100743; #24845 df8bb40a03
3	D1	Amended text: the paragraph under 「A 让 D1 变成的样子」, with the 2026-09-04 text quoted in an Amended note that also records the ruling's three bindings. One of them is that os migrate plan lists the still-nullable tenant columns as an advisory (#25134's execution, in flight). A dated note records the tenant column NOT NULL at CREATE TABLE from 7b-0 on.	ruling 6328195425 on #25134 (A); measurement 6323585273 on #24919; 6285122667; #24940
4	D2, dated note	Declared sharing rules are deployment-wide through the typed deploymentWide marker.	6285122667 item 2; #24828 7cacad5348; #25140
5	D8, dated note	The gate is implemented: check-tenant-chokepoint refuses an IS NULL arm, and #25140 aligned it for where(col, 'is not', null).	#24880 0091d845e2; #25140 60b42cd0b7; review 6287357347 R1
6	D7, dated note	sys_audit_log.tenant_id keeps its NULL arm in the retention pass, by design.	#24825 contract review 6287357347, judgment 3
7	D5, dated note	The last-admin guard counts only the Default Organization's admin_full_access grant. The organization-less anchor, the guard's only fail-open, is retired.	#25141 abc25a3536 (#24883, seat decision 6324268472)
8	D8, dated note	Residue on an uncertified database: organizationOutOfWriteReach answers "in reach" for an organization-less row that D8 makes unreachable.	seat ACCEPT 6325596117 on #25140, Q1 A
9	D1, dated note	The organization delete under ruling B is refused while the organization owns records, and the engine never sets a tenant column to NULL.	ruling 6303358360 on #24948; #25016 688052e147

The status line gains one Amended (2026-10-22) entry naming the D1 change and the notes.

Verification

• dispatch-gates --commands, then each command run with its exit code captured before any pipe. --ran reconciled 20 derived, 20 run, 0 NOT-MEASURED. The first run found one real finding: check-adr-symbol-anchors refused a storage-routes.ts:761 line anchor, and it now cites symbols. check:doc-formula-expressions first exited 3 because @objectstack/formula was not built; it passed after the build.
• node scripts/pm/check-governed-merges.mjs --branch origin/claude/issue-24897-adr-0131-dated-notes: GOVERNED, Tier H, docs/adr/** ×1, 202 changed lines.
• Each note was checked against origin/main 459afea1f6: every PR it cites is merged with the stated merge commit. The code facts were read in the tree: the gate's spellings, deploymentWide, ATTRIBUTION_PARTITION_COLUMNS, the driver's NOT NULL, and organizationOutOfWriteReach. The four D7-note objects (sys_identity_email, sys_platform_setting_audit, sys_secret, sys_flow_credential) declare tenant: false at 06cab4849a.

Acceptance notes

• In flight, cited by card, to update on merge: the D9 note's boundary 2 ([Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133) and the D1 amendment's item 2 ([Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's advisory).
• Not touched, outside the nine items: the D6 note of 2026-10-19 on sharing_rule regime C still ends "it has not shipped". It was not checked against main.
• No changeset: this diff publishes nothing (skip-changeset).

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9b6e4da77eda73a8ad2b784c4a01522c49574e34
Local-runs: none
Scope: docs/adr/0131-total-organization-ownership-no-null-organization-id.md, plus files read to judge it

Read-only. Fetched origin/claude/issue-24897-adr-0131-dated-notes (head 9b6e4da77e, merge-base = origin/main 459afea1f6) and its diff against main (one file, +176/-26, two commits 9b2ae461e8 and 9b6e4da77e). Read the ADR whole on both sides. Read every cited record from the GitHub API: the two in-flight rulings 6328195425 (#25134) and 6328987873 (#25133), the #25134 card body, the #24583 close record 6323222024, execution record 6285122667, reports 6284717698 and 6288405082, the 7b-3 claim amendment 6284744613, the publish record 6291577585 (#15194), the #24948 ruling 6303358360, the #24883 seat decision 6324268472, the #25140 seat ACCEPT 6325596117, the #24825 contract review 6287357347, the #24919 measurement 6323585273, the step-4 ruling 6278609968, the #24378 ruling 6258883445, the 7a-2 landing record 6294524149, the #24897 card, claim 6329368843 and dev report 6329720915, the live PR body, and the PR records for #24524, #24667, #24681, #24825, #24828, #24836, #24845, #24872, #24880, #24893, #24911, #24940, #25016, #25140, #25141, #24428, #24599. Checked every cited merge commit for existence on origin/main and for ancestry against the 18.0.0 version commit 06cab4849a. Read the code the notes name on origin/main with git show and git grep (core, objectql, driver-sql, driver-turso, driver-memory, plugin-sharing, plugin-auth, plugin-audit, service-storage, cli serve, the chokepoint gate, the ceremony's not-null step, the spec contract and migration constants), and the four D7-note objects at 06cab4849a. Ran the governed-merge check and three node-builtin ADR gates in a detached scratchpad worktree of the head (removed afterwards). Built nothing, posted nothing.

① Derived judgments

Item 1, the nine notes, each sentence against origin/main and its record:

• Note 1, release scope (D14, replaces the 2026-10-19 note): TRUE. 06cab4849a is chore: version packages (chore: version packages #24524), the @objectstack/*@18.0.0 tags point at it, and 6291577585 records the maintainer's publish. Ancestry against 06cab4849a: feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667 fc34d000fc (step 4), feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 12d14765c7 (steps 5+6), 7a-1 7c2eab929c, 7a-3 7cacad5348, 7b-3 df8bb40a03, 7c bd6dab0091 are IN 18.0.0; 7a-2 94842bad2a, 7b-0 5e9b100743, 7b-1+7b-2 d5d8146012, 7z 0091d845e2 are AFTER it, exactly as items 1 and 2 say. 6323222024 (2026-10-21T18:15Z) is the close record whose table lists every part with PR and merge commit, and it states the four invariants the note repeats. Item 3: at 06cab4849a, packages/platform-objects/src/audit/sys-identity-email.object.ts:46, packages/platform-objects/src/system/sys-platform-setting-audit.object.ts:48, packages/platform-objects/src/system/sys-secret.object.ts:49 and packages/services/service-automation/src/sys-flow-credential.object.ts:54 each declare systemFields: { tenant: false }, and packages/plugins/plugin-webhooks/src/auto-enqueuer.ts:573-574 marks declared subscriptions deploymentWide. Item 4: ORGANIZATION_OWNERSHIP_SHAPE_GENERATION = 1 at packages/spec/src/system/migration.zod.ts:215; 6291577585 sets the no-bump constraint and the pin requirement. The pin sentence is TRUE for 7b-0 and 7b-1+7b-2 (their PR bodies show the fixture-18.0.0 leg green and the live boot measured); for 7a-2 the pin is test(dogfood): fixture-18.0.0 — the upgrade harness boots a database the published 18.0.0 created #24911's harness leg (81e6edd463, an ancestor of 94842bad2a, merged 37 minutes before it), not one 7a-2 added or reported running (its body reports the 12-test harness on a62067ad4, before test(dogfood): fixture-18.0.0 — the upgrade harness boots a database the published 18.0.0 created #24911); 6323222024 records that the leg held on every merge. See B3. The closing paragraph reading scope-note items 1 to 3 against items 1 and 4 is TRUE (step 4 carried the walled half of 8b and the walled lift; an 18.0.0-born store is certified at birth per organization-ownership-boot-guard.ts:545 as 6323585273 reports).
• Note 2, D9 lean-embedding exception: TRUE, with boundary 2 correctly marked in flight. resolveSystemWriteOrganization answers { kind: 'no-organization-object' } when the organization object is not registered (packages/core/src/security/system-write-organization.ts:119-123); Engine.resolveSystemInsertOrganization returns undefined on that kind (packages/objectql/src/engine.ts:7784), so nothing is stamped. The counter keeps GLOBAL_TENANT (__global__) only while organizationObjectRegistered is false and otherwise throws OrganizationlessCounterRefusal (packages/drivers/driver-sql/src/sql-driver.ts:7970-7973; code ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED at organizationless-counter-refusal.ts:41), which is 7b-3 (feat(cli,driver-sql)!: a tenant table's organization-less row no longer reaches the __global__ counter, and a production server boot with no auth secret is refused (18.x step 7, part 7b-3) #24845 df8bb40a03) and matches 6284744613 ("A lean embedding with no organization object keeps __global__ as its bucket"). Boundary 1: 7b-0's diff passes tenantColumn only at the two CREATE TABLE sites (initObjects create branch, ensureShardTable) and the Turso remote buildCreateTableSQL, never ADD COLUMN. Boundary 2: 7b-3's no-secret refusal is serve.ts:4688 and A1's no-auth refusal is serve.ts:4666, both gated on flags.server, both offering --no-server (:4672, :4696); host-kernel warns only (serve.ts:4160). The note's statement of what ruling 6328987873 letter A binds (every production boot without --dev, tier off with no AuthPlugin or tier on with no secret, refused whether or not --server; the texts drop --no-server; host-kernel keeps warn-only; migrate-and-exit is such a boot; B and C not taken) matches the ruling word for word in substance. 6284744613 is on refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583 and applies rule A1 of 把 public 从"全局开关的副产品"升级为声明式能力,然后删掉 api.requireAuth 开关 #3963 as cited; 6284717698 and 6288405082 are refactor(drivers,objectql,plugin-security)!: 18.x step 7: retire the organization-less readers (8c), COALESCE and __global__ (8d), and steps 1–3's dual reads #24583's 7b-3 reports.
• Note 3, D1: TRUE. See item 2 below for the amendment. The 7b-0 note: 5e9b100743 makes the tenant column NOT NULL at CREATE TABLE in driver-sql and the Turso remote face with no metadata change (6285122667 item 1; the PR's own body); the in-memory driver declares no NOT NULL (packages/drivers/driver-memory/src/memory-driver.ts:476; fix(plugin-auth)!: the last-admin guard and the default-org bootstrap count only the Default Organization's admin_full_access grant #25141's body says the same); the ceremony reports a pre-7b-0 shard and the Turso remote face as unsupported (packages/cli/src/utils/organization-ownership-not-null.ts:27-31, :45-57; turso-driver.ts driftApplyLimit). The measurement sentences match 6323585273 section 1 exactly: 65 of 66, 4, 4, 1 of 64 (sys_sso_provider), 0 NULL rows, on d5d8146012, the same under all three postures. sys_sso_provider declares tenancy: { enabled: false } and a plain organization_id: Field.text (packages/platform-objects/src/identity/sys-sso-provider.object.ts:59, :331), so it is not a tenant column.
• Note 4, D2 deploymentWide: TRUE. SharingRuleRow.deploymentWide?: true on the spec contract (packages/spec/src/contracts/sharing-service.ts:481-507), read by isDeploymentWideSharingRule (packages/plugins/plugin-sharing/src/sharing-rule-service.ts:178-179); 6285122667 item 2 records the shape and the Default-Organization projection not taken; 6278609968 is step 4's ruling A (on feat(objectql,cli)!: 18.x step 4: the walled lift (8b walled half plus the walled part of #24489) #24580); 7a-3 is feat(plugin-sharing,plugin-approvals,metadata-protocol)!: 18.x step 7 part 7a-3 — the organization-less readers of sharing rules, approval units and the seed loader retire #24828 7cacad5348 (the criteriaContext part per 6323222024's table); fix(spec,plugin-sharing,scripts): retire the organization-less text step 7 left behind; check-tenant-chokepoint accepts where(tenant, 'is not', null) #25140 60b42cd0b7 retired the "null = global" help in four locales (6325596117).
• Note 5, D8 gate: TRUE. 7z is feat(scripts): check-tenant-chokepoint refuses an IS NULL arm on a tenant column, and shipped texts stop describing the retired arm (18.x step 7, part 7z) #24880 0091d845e2; scripts/check-tenant-chokepoint.mjs:129-137 lists the refused spellings and the IS NOT NULL exemption, NULL_CALLS at :309, the literal-'is not' test at :318-323; the self-test region carries cases for whereNull, orWhereNull, andWhereNull, where/orWhere/andWhere with a null comparand, the object form (orWhere({ [f]: null })), raw IS NULL, and the 'is not' exemption. fix(spec,plugin-sharing,scripts): retire the organization-less text step 7 left behind; check-tenant-chokepoint accepts where(tenant, 'is not', null) #25140 60b42cd0b7 is the 'is not' alignment; R1 of 6287357347 is the missing refusal as cited.
• Note 6, D7 sys_audit_log.tenant_id: TRUE. packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:31 (systemFields: { tenant: false }), :420 (tenant_id lookup); ATTRIBUTION_PARTITION_COLUMNS = { sys_audit_log: 'tenant_id' } at packages/objectql/src/lifecycle/lifecycle-service.ts:240, nullIsLive: true only on the attribution partition and false on organization_id (:1628-1637); judgment 3 of 6287357347 says exactly this; 7a-1 is feat(driver-sql,objectql)!: a tenant-scoped read no longer answers a row with no organization (18.x step 7, part 7a-1) #24825 7c2eab929c.
• Note 7, D5 last-admin guard: TRUE. grantAnchorsPlatformStanding (packages/core/src/security/resolve-authz-context.ts:943-949) returns false under a wall or with no Default Organization and otherwise requires the grant's owner to be the Default Organization; 7a-2 is feat(core,plugin-security)!: 18.x step 7 part 7a-2 — a grant applies only in its own organization; the organization-less grant readers retire #24872 94842bad2a; fix(plugin-auth)!: the last-admin guard and the default-org bootstrap count only the Default Organization's admin_full_access grant #25141 abc25a3536 brought anchorOwnerTest (packages/plugins/plugin-auth/src/last-admin-guard.ts:1054-1067) and the bootstrap's grant read (ensure-default-organization.ts:508) to that rule; the two fail-open compositions and "only fail-open" are 6324268472's measured findings and fix(plugin-auth)!: the last-admin guard and the default-org bootstrap count only the Default Organization's admin_full_access grant #25141's body.
• Note 8, organizationOutOfWriteReach residue: TRUE in substance. The function is at packages/services/service-storage/src/metadata-store.ts:797-808 and answers null ("in reach") for a row with no organization; the comment "a row stamped with no organization stays in reach" sits at storage-routes.ts:761, above requireStartingOrganization (:772); 6325596117 Q1 letter A kept it. Two precision points, see B2.
• Note 9, organization delete under ruling B: TRUE. 6303358360 is letter B on [Decision] Deleting an organization once organization_id is NOT NULL: refuse while it still owns records, or delete them with it #24948 (「24948 同意」); fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016 688052e147 adds organizationPredicateDeleteRefusal and refuseOrganizationDeleteWhileOwned in engine.ts (409 DELETE_RESTRICTED, per-table counts, before the walk cascades or clears; a predicate delete refused outright), the auth door's hooks.before refusal ahead of the vendor handler, ORGANIZATION_AUTH_STRUCTURE (sys_member, sys_invitation, sys_team, sys_team_member, organization_admin grants), outlivesOrganization for append-only and engine-owned rows kept with their reference and not counted, and pointers (sys_session.active_organization_id, sys_api_key.active_organization_id, sys_organization.parent_organization_id) keeping set_null. Each sentence of the note is in that PR's body and diff.

Item 2, amended D1: MATCHES. The paragraph under 「A 让 D1 变成的样子」 in #25134's card is a byte-exact prefix of the new D1; the only addition is the original's middle sentence ("An object whose rows belong to no organization declares … and has no column."), kept verbatim. Ruling 6328195425 item 3 adopts that paragraph for #24897. The Amended note quotes the 2026-09-04 text's head and tail exactly as origin/main holds them, eliding precisely the sentence that was kept; the decision is stated unchanged. Its bindings 1, 2 and 3 are ruling items 1, 2 and 5 without change of meaning (item 4, the shard sentences, is code and rightly omitted); item 2 is marked "#25134's execution, in flight", as the ruling dispatches it after #25133.

Item 3, D6 regime C: STALE on origin/main, in text this PR does not edit (non-blocking, see B1). The sentence "This is a ruled decision that #24421 builds; it has not shipped." is false now: PR #24428 964a23700f (merged 2026-10-19T05:27Z, an ancestor of 06cab4849a, so in 18.0.0) landed sharing_rule under regime C, with SHARING_RULE_ACTIVATION_TYPE = 'sharing_rule' (sharing-rule-service.ts:67), same-name shadowing retired (:242, :977), and the ceremony migrating a same-name copy to a clone (packages/cli/src/utils/organization-ownership-apply.ts:119); #24599 1e8b6284c0 (also in 18.0.0) closed the /meta authoring door. Card #24421 is still open, which is why the note still names it: it was filed for the superseded B′ shape. The true sentence: "This decision shipped in 18.0.0: #24428 (964a23700f) added the sharing_rule activation type and the same-name refusal, #24599 (1e8b6284c0) closed the /meta door, and the D10 ceremony's clone migration is in organization-ownership-apply.ts."

Item 4, consistency: NO CONTRADICTION introduced. "NULL on single-tenant", "later release" and "18.1" occur nowhere in the branch file. "nullable tenant column" occurs only in the new text and in the unchanged D5 amendment ("a reserved nullable tenant column is the shape D1 forbids"), which still agrees with the amended D1 (NULL is not a state). "it has not shipped" survives in the D6 regime C note (item 3) and in the four D7 notes, and release-scope item 3 now says in so many words that those four describe stages 18.0.0 carries. The 2026-10-19 scope note's items 1 to 3 are explicitly re-read by the new release-scope note. D9's main text and the new exception note, and D8's main text and the residue note, are framed as rule plus recorded exception, which is what rulings 6328987873 (B not taken) and 6325596117 (Q1 A) decided.

② Semver level

No package changes; docs-only ADR text. No changeset is owed and the PR carries skip-changeset; Clause-②: no, Metadata-protocol: none are correct for a record of shipped behaviour. The gate expectation is Tier H landing by the maintainer, not a version bump.

③ Boundary flags

• B1 (not blocking; follow-up or fold-in): the D6 note of 2026-10-19 ("sharing_rule is charted under regime C … plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds; it has not shipped") is stale on origin/main; it shipped in 18.0.0 through plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 964a23700f and fix(spec,metadata-protocol)!: the /meta door no longer authors sharing rules; Setup lists declared sharing rules #24599 1e8b6284c0 (item 3 above). The PR leaves that paragraph untouched and its body says so. A one-sentence fold-in to this PR, or a follow-up docs card, is the remedy.
• B2 (not blocking; wording precision in the D8 residue note): (a) requireStartingOrganization is asked at four sites, the commit, chunk and chunked-completion doors before their first write (storage-routes.ts:992, :1166, :1308) and the progress door when its expiry stamp is due (:1416); "three upload doors" follows the seat decision's count and is defensible if the progress door is read as a read door, but "four askers" would be exact. (b) "a database that has not been through the D10 ceremony, which os serve refuses at boot" is true of a v17 or pre-release store; an 18.0.0-born store is also one the ceremony never touched yet is served (certified at birth, nullable columns). The row still cannot reach it through os serve, because the storage doors ride the HTTP server that the no-auth and no-secret refusals gate, so the heading's "uncertified database only" stands; naming the refused class precisely would remove the ambiguity.
• B3 (not blocking; attribution precision in release-scope item 4): "7a-2, 7b-0 and 7b-1+7b-2 each pin that such a database boots on their head" cites 6291577585, which states that requirement; the pin itself is test(dogfood): fixture-18.0.0 — the upgrade harness boots a database the published 18.0.0 created #24911's fixture-18.0.0 harness leg (81e6edd463), on 7a-2's merged head but not added or reported run by feat(core,plugin-security)!: 18.x step 7 part 7a-2 — a grant applies only in its own organization; the organization-less grant readers retire #24872. Citing 6323222024 ("held on every merge, fixture-18.0.0 leg included") beside it, or saying "is held to", would make the sentence exact.
• B4 (pre-landing to-do, not a text fault): the two in-flight citations must become merge commits before landing, as the PR body and claim 6329368843 already undertake: the D9 note's boundary 2 ([Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix, ruling 6328987873; its sentence "The refusal texts no longer offer --no-server as the remedy" describes the ruled state, and on origin/main today serve.ts:4672 and :4696 still offer it) and the D1 amendment's item 2 ([Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's os migrate plan advisory, ruling 6328195425).
• B5 (seat process, not blocking for the text): the live PR reads draft: false (mergeable_state blocked, awaiting the approval) while its body and the claim say it "stays a draft, and is not enqueued, until [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix and [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's advisory have merged". Either the body is updated or the PR is converted back to draft until B4 is done; Tier H landing remains the maintainer's hand either way.
• B6 (nit): the new Status-line entry and the D1 Amended note cite record 6328195425 and letter A but do not quote the maintainer's words (「25134 … 同意」, in 6328195425); the earlier amendments at D5 and in the two end-of-file sections quote them. Optional.
• Format: the seven new notes follow the file's Note (date, record on card, letter) — title blockquote convention of the 2026-10-19 notes; the D1 amendment follows the inline-amendment precedent at D5 (2026-10-16, plugin-security: under the walled posture, deployment-level audience-binding acceptance is host configuration (ADR-0131 D5) — the sync stops warning once declared; the refusal names that path, not "create the Default Organization" (cloud#2872 A′) #23385) with the original text quoted beside the replacement; the Status line's new Amended (2026-10-22, #24897 — …) entry follows the pattern of the two earlier entries (date, card, ruling letter and record, bold one-line effect) and, like the D5 precedent, has no end-of-file section to point at. The Status line's list of sections (D1, D2, D5, D7, D8, D9, D14) matches where the notes sit.
• Gates: node scripts/check-adr-links.mjs (770 links resolve), node scripts/check-adr-anchors.mjs and node scripts/check-adr-symbol-anchors.mjs (2380 anchors across 142 records resolve) each exit 0 on the head in a detached worktree; check-docs-single-h1 exited 3 on a prerequisite, not a verdict. CI on 9b6e4da77e: 30 check-runs succeeded and 10 skipped (latest per name), none failing or pending, including Governed Surface Queue Guard, Check Documentation Links, Lint · docs & code guards, Lint · repo & tooling gates, Lint · PM dispatch-gates, TypeScript Type Check and all six Test Core shards.
• Tier: node scripts/pm/check-governed-merges.mjs --branch origin/claude/issue-24897-adr-0131-dated-notes answers GOVERNED, landing tier H, docs/adr/** ×1, 202 changed lines (+176/-26), under the human-merge size threshold; head repo is objectstack-ai/objectstack (not a fork).

Implemented-by: claude/issue-24897-adr-0131-dated-notes
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS