[objectstack-fleet]

Part of #24446

This is the ADR text that ruling 6259332195 on #24443 (items 1–2, 4–5) owes now that U1 and U2 have landed, written under claim 6357802112. One Tier H docs PR also carries the ADR-0131 D5 line that #25286 owes (#15212 ledger 6352526831). It contains notes only: no decision text changes and no rename spelling is added to the spec. #24446 remains open for the seat to close.

Clause-②: no — expected: ADR notes only; no published surface moves.

What changed

docs/adr/0126-packaged-metadata-customization-model.md: one dated note (2026-10-23) inside §6 wall 3, which now holds in practice for the access class:

• The boot report: U1, plugin-security, plugin-sharing: at boot, the administrator is told when an upgrade renamed, removed or collided with an access choice (#24446 U1) #25311, 54df640b38. It lists orphans, suspected re-enablements, sharing-rule collisions, broken references and uncovered field denies, and writes and refuses nothing.
• The marketplace refusal: U2, cloud-connection, plugin-security: a marketplace upgrade that would un-make an access choice is refused until it is confirmed (#24446 U2) #25355, 448374d3f8. It refuses on the delta only, with 409 ACCESS_UPGRADE_CONFIRMATION_REQUIRED before the first write. A stopped check answers 503.
• The confirm token: findingSet, sent as confirmAccessUpgrade. It confirms exactly the findings it names, and a bare true confirms nothing. The confirmation is recorded in the install's own entry in the marketplace install ledger, not in the activation ledger. The CLI flag is --confirm-access-upgrade.
• Who is told:
  • under single, the administrator: the Default Organization's admin_full_access holders and OS_PLATFORM_OWNER_EMAIL for the report, and the installing administrator for the refusal;
  • under a wall, the operator: one error line in the operator's log (seat ruling 6353787407, option A), and only the operator reaches the refusal, because ADR-0131 D12 answers a tenant administrator 403 first.
• The two accepted limits under §9: a re-enablement is only suspected, and the field-deny check reads "grants the same object".
• The two doors still open: POST /api/v1/packages with overwrite (fix(runtime): POST /api/v1/packages with overwrite replaces an installed package without the access upgrade check the marketplace door runs — call security.accessUpgradeCheck before the first write #25382), and the catalog-name collision before the first write (fix(cloud-connection): a cloud-fetched marketplace install of a package shipping a catalog name an environment-authored item holds writes its ledger entry, and the next cold boot refuses; refuse it before the first write #25366).
• The other classes follow after v18 (ruling item 4).

docs/adr/0131-total-organization-ownership-no-null-organization-id.md: one dated note beside D5's 2026-10-22 note (#25286, 09e07c259a; landed record 6353078154 on #25271):

• Under single, a slug changed to default is admitted only on the current Default Organization. Every other context is refused 403 PERMISSION_DENIED.
• The removed move: moving the Default Organization among several organizations. To move the anchor, move the grant, not the slug.
• The stranding: after a re-slug away under several organizations, no organization can take default until the store holds one organization or declares a wall. The census already reports this shape as SINGLE_POSTURE_MANY_ORGANIZATIONS.

Proof (head 6cddca9)

• node scripts/pm/dispatch-gates.mjs --commands: 20 commands derived, all 20 exit 0, with each exit captured before any pipe.
  • check:doc-formula-expressions first exited 3 (prerequisite: formula and lint not built). After the build under os-verify-lock it exits 0.
  • --ran: "20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED (a DERIVED zero …)".
• node scripts/pm/check-governed-merges.mjs --branch claude/issue-24446-adr-0126-wall-3-note: GOVERNED, landing tier H, docs/adr/** ×2, 64 changed lines, as expected.
• Changeset: none. docs/adr/** publishes nothing and the claim allows no other file, so the PR carries skip-changeset.

维护者速读(草稿)

• 改了什么:两份 ADR 各加一条带日期的注记,不改任何决定文本。ADR-0126 墙 3 注明:访问类(共享规则、权限集、岗位、能力)升级保护已由 U1 启动报告与 U2 市场重装拒绝落地。ADR-0131 D5 注明:single 下只有当前默认组织能把 slug 改成 default。
• 为什么改:裁决 6259332195 第 5 条要求落地阶段在 ADR-0126 写注记;fix(plugin-auth)!: under single, no slug change makes another organization the Default Organization #25286 留下的 D5 文本欠账记在 feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 台账上。不写的话,读 ADR 的人分不清哪些升级入口已受保护、哪些还开着(fix(runtime): POST /api/v1/packages with overwrite replaces an installed package without the access upgrade check the marketplace door runs — call security.accessUpgradeCheck before the first write #25382、fix(cloud-connection): a cloud-fetched marketplace install of a package shipping a catalog name an environment-authored item holds writes its ledger entry, and the next cold boot refuses; refuse it before the first write #25366)。
• 风险与代价(含回滚):纯文档,不影响运行时;回滚就是 revert 这一个提交。
• 席位意见:
• 你要做的:审读两条注记,批准并合并。

---

Generated by Claude Code

[objectstack-fleet]

维护者速读·请批准 · epic PM session_01Y5583bs2RDd53MH6kM1ca3（os-steve）· 2026-10-23T05:18Z

这是什么： PR #25384，一个只改文档的 PR，属于受管路径（Tier H），需要你批准并合并。两份 ADR 只各追加一条带日期的注记，不改任何决策正文，也不改代码。共 +64/−0。

1. ADR-0126，第三道墙的注记（按你在 #24443 的裁决 6259332195 第 5 项，由落地阶段补写）

• 第三道墙"升级不得撤销客户的选择"，在访问类上已经落实。访问类指共享规则、权限集、岗位和能力，由两部分完成：
  • U1（plugin-security, plugin-sharing: at boot, the administrator is told when an upgrade renamed, removed or collided with an access choice (#24446 U1) #25311）：启动时报告；
  • U2（cloud-connection, plugin-security: a marketplace upgrade that would un-make an access choice is refused until it is confirmed (#24446 U2) #25355）：应用市场升级时拒绝安装，带令牌确认后才放行。
• 谁会收到提醒：
  • single 模式下是管理员；
  • 隔离模式下是运维，只写日志（席位裁决的方案 A）；
  • 租户管理员看不到这些发现，也不作为兜底收件人。
• 写明两处已接受的限制：
  • "疑似重新启用"可能列出多个候选；
  • 字段屏蔽检查按"授权了同一对象"判断。
• 写明两个还没堵上的入口，各有车道卡：
  • fix(runtime): POST /api/v1/packages with overwrite replaces an installed package without the access upgrade check the marketplace door runs — call security.accessUpgradeCheck before the first write #25382：/api/v1/packages 覆盖安装；
  • fix(cloud-connection): a cloud-fetched marketplace install of a package shipping a catalog name an environment-authored item holds writes its ledger entry, and the next cold boot refuses; refuse it before the first write #25366：安装时重名。
• 其余类别按裁决第 4 项放到 v18 之后。

2. ADR-0131 D5，改名规则的注记（#25286 已落地）

• single 模式下，只有已经是默认组织的那个组织，才能把 slug 改成 default；其他组织一律 403。
• 写明去掉的操作（在多组织之间挪默认组织）和它留下的后果：挪走后再也改不回来，只能合并成一个组织或改成隔离模式。

核对结果：

• 各项检查 20/20 通过；
• 受管路径检查结果为 GOVERNED，符合预期；
• 不需要 changeset（skip-changeset）。

需要你做的： 看一眼两段注记的措辞，批准并合并即可。合并后我关闭 #24446。