[objectstack-fleet]

Part of #24897

Clause-②: no
Metadata-protocol: none

A follow-up to #25149 (merged as 37ccd5f2cf). ADR text only, in one file: docs/adr/0131-total-organization-ownership-no-null-organization-id.md. Tier H (docs/adr/**).

Both citations this PR waited on have merged, and the PR cites them (B4). It is complete and ready for the maintainer's one approval.

What changes

These are the non-blocking findings of the accuracy review of #25149 (contract review record 6329955338, PASS):

• B1, D6 regime C note. "plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds; it has not shipped" was stale. A dated correction now records that the decision shipped in 18.0.0: plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 (964a23700f) added the sharing_rule activation type and the same-name refusal, fix(spec,metadata-protocol)!: the /meta door no longer authors sharing rules; Setup lists declared sharing rules #24599 (1e8b6284c0) closed the /meta door, and the D10 ceremony's clone migration is in packages/cli/src/utils/organization-ownership-apply.ts.
• B2, D8 residue note.
  • It names the four doors that ask requireStartingOrganization: commit, chunk and chunked-completion before their first write, and progress when its expiry stamp is due (storage-routes.ts:992, :1166, :1308, :1416 on origin/main).
  • It names the refused class precisely. A v17 or pre-release store is refused at boot until the ceremony has run. An 18.0.0-born store is served, but such a row cannot reach those doors through os serve, because they ride the HTTP server that the production no-auth / no-secret refusals gate.
• B3, release-scope item 4. The parts after the GA "are each held to" the 18.0.0-born boot. The pin is test(dogfood): fixture-18.0.0 — the upgrade harness boots a database the published 18.0.0 created #24911's fixture-18.0.0 harness leg (81e6edd463), which held on every step-7 merge (record 6323222024).
• B4, the two in-flight citations, now cited.
  • D9 note, boundary 2: fix(cli)!: refuse a production os serve that composes no organization object, --server or not #25155 (ab488d9b7d, the fix for [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133) shipped the production refusal. A production os serve / os start that composes no organization object is refused whether or not --server, before any plugin starts.
  • D1 Amended note, item 2: feat(cli): os migrate plan lists the tenant columns still nullable, naming the voluntary ownership ceremony; the ceremony reports a NOT NULL shard truthfully #25179 (6251f59051, the execution of [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134) shipped the os migrate plan advisory. Each listed column is marked tightens or leaves, with the reason, and --json carries it as nullableTenantColumns. The ceremony now reports a shard the driver created NOT NULL as already-not-null. Item 3 (Order) cites fix(cli)!: refuse a production os serve that composes no organization object, --server or not #25155 too.
  • No "in flight" remains anywhere in the ADR.
• B6. The maintainer's words are quoted where the ADR cites the rulings, as the earlier amendments do: 「25134 … 同意」 (6328195425) in the Status-line entry and in the D1 Amended note, and 「同意」 (6328987873) in the D9 note.

Verification

• check-adr-links, check-adr-anchors and check-adr-symbol-anchors each exit 0.
• dispatch-gates --ran: 20 derived, 20 run, 0 NOT-MEASURED, every command exit 0.
• node scripts/pm/check-governed-merges.mjs --branch origin/claude/issue-24897-adr-0131-dated-notes: GOVERNED, Tier H, docs/adr/** ×1, 53 changed lines (+32 / −21) against main at 6251f59051, at head fdfbe4965d.

Acceptance notes

• The branch was restarted from origin/main after docs(adr): ADR-0131 dated notes for the 18.x line — release scope, D1 as ruled, the D9 lean-embedding exception and its boundaries (Tier H) #25149 merged, keeping the same name. The old head had been deleted, so nothing was force-pushed.
• main was merged in twice with merge commits (cd6eb02236, eb6b796657), so the cited commits are ancestors of this head. There was no rebase and no force-push.
• No changeset: this diff publishes nothing (skip-changeset).

---

Generated by Claude Code

[objectstack-fleet]

已解除（Lifted）· epic 席 · 2026-10-22T07:50Z. 本 PR 已写完，请以 维护者速读 · 请批准 6335629478 为准；下面这条「请先不要批准」不再适用。

⛔ 请先不要批准 · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-22T04:51Z

Do not approve this PR yet. It is unfinished.

• Why approval is already requested: the relay asked for review from os-zhuang and hotlong automatically when the draft was opened (feat(pm): the relay requests review from every GOVERNED_APPROVERS account on a Tier H pull; CODEOWNERS routes every Tier H surface to both approvers #25064 requests review on every Tier H draft at creation). The seat did not ask.
• What is still missing (B4): the two in-flight citations. [Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere #25133's fix (fix(cli)!: refuse a production os serve that composes no organization object, --server or not #25155) and [Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump #25134's os migrate plan advisory must merge first; this PR then cites their merge commits.
• When to approve: the seat will post the Chinese 维护者速读 · 请批准 and send a push once the PR is complete. That comment is the signal to approve, not the automatic review request.

[objectstack-fleet]

维护者速读 · 请批准 · epic 席 session_01Y5583bs2RDd53MH6kM1ca3（os-steve）· 2026-10-22T07:49Z

需要你做的：在本 PR 点 Approve（Review changes → Approve）。 本 PR 只改 docs/adr/**，属于 Tier H，要你批准后才能合入。批准后由 epic 席开启自动合并，你不用再做别的。之前那条「请先不要批准」（6333006391）到此作废：本 PR 已经写完。

• 改了什么： 只改 ADR-0131 一个文件，+32 / −21，不改任何决定本身。
  • B4，补上两处引用：
    • D9 说明引用 fix(cli)!: refuse a production os serve that composes no organization object, --server or not #25155（ab488d9b7d）：生产环境启动时如果没有组织对象，不管带不带 --server 都拒绝启动。
    • D1 修订说明引用 feat(cli): os migrate plan lists the tenant columns still nullable, naming the voluntary ownership ceremony; the ceremony reports a NOT NULL shard truthfully #25179（6251f59051）：os migrate plan 列出仍允许为空的组织列，并提示运行升级仪式。
    • ADR 里不再有「进行中」的字样。
  • B1，D6 regime C 说明更正： 原文写着「plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 在做、还没发布」，已过时。改为：该决定已随 18.0.0 发布（plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428、fix(spec,metadata-protocol)!: the /meta door no longer authors sharing rules; Setup lists declared sharing rules #24599，以及升级仪式里的克隆迁移）。
  • B2，D8 存储遗留说明写准确：
    • 点名会做组织检查的四个上传入口：提交、分块、分块完成、进度。
    • 写清哪类库会被拒绝：v17 或预发布库在跑完仪式前一律拒绝启动；18.0.0 建的库能正常启动，但这类行到不了这四个入口。
  • B3，发布范围第 4 条： 写明 18.0.0 建的库能在每次合入后启动，靠的是 fixture-18.0.0 升级测试（test(dogfood): fixture-18.0.0 — the upgrade harness boots a database the published 18.0.0 created #24911），第 7 步每次合入都守住了。
  • B6，引用裁决时补上你的原话： 「25134 … 同意」、「同意」。
• 为什么改： B1–B3、B6 是 docs(adr): ADR-0131 dated notes for the 18.x line — release scope, D1 as ruled, the D9 lean-embedding exception and its boundaries (Tier H) #25149 复审（6329955338，PASS）提出的不阻塞的问题。B4 是当时还没合入的两处引用，现在两个 PR 都已合入。
• 验证：
  • 席位逐条核过：引用的提交（964a23700f、1e8b6284c0、81e6edd463、ab488d9b7d、6251f59051）都在 main 上；四个上传入口和代码对得上（storage-routes.ts:992、:1166、:1308、:1416）。
  • ADR 的链接和锚点检查都通过。
  • CI：本 PR 最新提交 fdfbe4965d 上 47 项检查全部通过或按设计跳过，没有失败。
• 风险与回滚： 只改文字，不发布任何包，不改代码。回滚即还原本 PR。