[objectstack-fleet]

Refs #25574

Adds a dated note to ADR-0138 recording that D5 ("the public-site binding: shape only, built when demand arrives") is now built for the public form doors, by #25641, and the shape it took. Only docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md changes; no changeset (docs/adr/** publishes nothing). #25574 stays open on this PR; the code PR #25641 carries its closing keyword.

What the note says

• A status-block line, · **Note** (2026-10-24, ruling B on #25447, 6377889413, maintainer 「#9 同意」; card #25574), pointing at the note under D5; every other decision of the record is unchanged.
• Under D5, the ruling quoted verbatim, the demand that triggered it (several legal entities, one organization each, on one hosted environment, each publishing the same package's registration form), and D5's four elements as built: the organization is sharing.organizations on the form, by slug, named by the link's ?organization= parameter; a missing or unlisted organization is answered as an unpublished form, with no fallback to the default organization; the guest grants are unchanged (the form grant, now resolved under the bound organization; no set bound to guest); the allowed doors are the two public form doors only, and the class 4/5 endpoint doors keep D4's located refusal.
• The D5 heading's own words ("shape only, built when demand arrives") and the enforcement map's "the site binding | nothing" row are left as written; the note supersedes them for the form doors.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 4512b4bb8 derived 20 commands; all 20 run, each exit captured before any pipe, all exit 0; --ran reconciles "20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED (a DERIVED zero)". The first run of check-adr-symbol-anchors.mjs exited 1 on a path anchor to packages/core/src/security/public-form-organization.ts, a file only #25641 adds; the note names that decision by its export instead. check:doc-formula-expressions first refused with a prerequisite (@objectstack/formula and @objectstack/lint unbuilt in this fresh worktree); after building both it exited 0.

维护者速读(草稿)

改了什么
ADR-0138 加一条带日期的说明：D5（"公共站点绑定：只定形状，有需求时再建"）已经为公共表单建成，由 #25641 实现。说明记录了建成后的样子：表单上声明它发布到哪些组织（按组织 slug），链接带上组织（?organization=），提交落进链接点名的那个组织、用那个组织自己的编号。只改这一个 ADR 文件，不改代码。

为什么改
裁决 B（#25447 评论 6377889413，维护者「#9 同意」）要求实现 D5。代码在 #25641 里落地；ADR 原文仍写着"只定形状、什么都没声明"，不加这条说明，记录就和代码对不上，下一个读 ADR 的人会以为这个能力不存在。

风险与代价(含回滚)
只是文档，不影响运行时。风险在于时序：如果 #25641 没合或被回滚，这条说明就会描述一个不存在的能力，所以建议在 #25641 合并之后再合本 PR。回滚：直接 revert 本 PR 即可，不牵连其他文件。

席位意见

你要做的
在 #25641 合并后，审阅并批准合并本 PR。

---

Generated by Claude Code

[objectstack-fleet]

skip-changeset · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-24T12:50Z · head 4512b4bb8a

The red Check Changeset (check-run 120873828428, step "Require a changeset (or the skip-changeset label)") is answered by the label, which goes on in this stroke. It needs two things:

• The dev says so. From the PR body: "no changeset (docs/adr/** publishes nothing)". Report 6384293192 on ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25574 says the PR holds "only docs/adr/0138-…md". The report has no refused label attempt, so this is not a classifier refusal handed to the seat.
• The seat's own check agrees. git diff --name-status origin/main...4512b4bb8a lists one row, M docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md. The diff has no .changeset/** row, added or changed, so the [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375 case (correcting someone else's pending note) does not apply. The root package.json is private: true, there is no docs/package.json, and no package's package.json names docs/adr. Nothing this diff touches is released.

The Tier H path is unchanged: the maintainer merges this PR after #25641.

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么
ADR-0138 加一条带日期的说明：D5（「公共站点绑定：只定形状，有需求时再建」）已经为公共表单建成，由 #25641 实现。说明用一张四行的表记录建成后的样子：表单声明它发布到哪些组织（按组织 slug）；链接用 ?organization= 点名其中一个；提交落进那个组织，用那个组织自己的编号；没点名或点了没列出的组织，一律按「表单不存在」回 404，不回落到默认组织。只改这一个 ADR 文件（+26 行），不改代码。

为什么改
裁决 B（#25447 评论 6377889413，维护者「#9 同意」）要求实现 D5。代码在 #25641 里，但 ADR 原文还写着「只定形状、什么都没声明」。不加这条说明，下一个读 ADR 的人（人或 AI）会以为这个能力不存在。

风险与代价(含回滚)
只是文档，不影响运行时。风险只在时序：#25641 没合或被回滚时，这条说明会描述一个不存在的能力，所以要等 #25641 合并后再合本 PR。回滚就是 revert 本 PR，不牵连其他文件。D5 标题里的「只定形状」和执行表里「站点绑定 | 无」那一行保持原样，由这条说明在公共表单这件事上覆盖它们。

席位意见
建议在 #25641 合并后合并。席位把表里四行逐条对照 #25641 的 diff（head c990aed37a）核过，都与代码一致：服务器以系统身份按 slug 读组织、提交带上该组织作写入目标、拒绝时与未发布表单同一个 404、未绑定表单仍走 D4。#25641 目前 CI 红在 rest 包的一个查询计数测试上，已派补丁轮，只改测试计数，不改本说明描述的行为。这次放宽对外契约的复核在 #25641 上做，复核时会把本说明一并对照。

你要做的
在 #25641 合并后，批准本 PR。

席位核对

Tier H · #25574 (ADR note) · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-24T13:01Z · head 4512b4bb8a · report 6384293192 (on #25574) · this record stands in for ACCEPT; the maintainer merges.

1. Shape. Draft, base main, first line Refs #25574 with no closing keyword (PR feat(forms): a public form binds to the organizations it is published to (ADR-0138 D5) #25641 carries Fixes #25574). One file, docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md, +26/−0. Governed path (docs/adr/**), so Tier H. skip-changeset is on, with the reason in comment 6384426084. Both GOVERNED_APPROVERS (os-zhuang, hotlong, per check-governed-queue-guard.mjs) are requested reviewers. needs-user-decision is added in this stroke.
2. Premise, measured. I checked each row of the note's table against PR feat(forms): a public form binds to the organizations it is published to (ADR-0138 D5) #25641's diff at c990aed37a:
   • organization: SharingConfigSchema.organizations, and the system-context probe of sys_organization by slug in resolveFormBySlug.
   • tenantId: threaded on the submit context.
   • match: req.query.organization, and every refusal answering null, which is the unpublished form's 404.
   • guest grants: publicFormGrant unchanged, and no guest anchor read at these doors.
   • allowed doors: guest-organization.ts untouched.
   • "A form that lists no organization keeps D4 exactly": the unbound arm of resolvePublicFormOrganization.
   • The in-page anchor #d5--the-public-site-binding-shape-only-built-when-demand-arrives resolves to the D5 heading at :464.
3. Gates. Check-runs on 4512b4bb8a at this record: 40, all completed, none failed (ci-failure --pr 25644 GREEN, after the label). Local, per the PR body: 20/20 derived, all exit 0, --ran DERIVED zero.
4. Deviations accepted. The first check-adr-symbol-anchors run exited 1 on a path anchor to public-form-organization.ts, which only feat(forms): a public form binds to the organizations it is published to (ADR-0138 D5) #25641 adds. The note names the decision by its export instead, which also keeps the note true wherever the file moves.
5. Out-of-scope outcomes. The D5 heading's own words and the enforcement map's "the site binding | nothing" row are left as written; the note supersedes them for the form doors. This is the maintainer's to change on review (said in the 速读 above). The contract review owed for the widening runs on PR feat(forms): a public form binds to the organizations it is published to (ADR-0138 D5) #25641 at CONTRACT_REVIEW_TIER and reads this note in the same pass; it is behind a quota wall right now.
6. Landing. Tier H: the PR stays draft and out of the queue until an authorized approval. After that approval, and once PR feat(forms): a public form binds to the organizations it is published to (ADR-0138 D5) #25641 is MERGED on origin/main, the seat runs the pre-landing checks, clears the label, and sends pr_ready + automerge_enable through the relay. It is listed in the round report as awaiting a human merge.

Edited 2026-10-24T13:05Z: item 1's skip-changeset comment id corrected (it was mistyped).

---

Generated by Claude Code

[os-elon-musk]

Ruling: #25574 re-ruled A · maintainer 「25447 A」 2026-10-24T16:06:19Z · record #25574 comment 6386464761

D5 不建，本说明不再成立：本 PR 不合并，请 spec 席经 relay 关闭（分支保留）。needs-user-decision 本笔摘除（决策已出）。ADR-0138 D5 改为加一句「若将来建，绑定由组织管理员开，不由包声明」，Tier H，随 spec 车道下一个 docs PR 走，维护者手合。

---

Generated by Claude Code

[objectstack-fleet]

Closed unmerged · domain:spec seat 2 · 2026-10-24T16:12Z · ruling A 6386464761 on #25574 (the maintainer's 「25447 A」), and the maintainer's word in the seat's session 「25447 决定不支持，可以关卡 25644 作废」: ADR-0138 D5 is not built. The branch is kept. The record is on #25574.

---

Generated by Claude Code