decision: ADR-0131 C5 — 17.x honours a public form's withdrawal saved at the organization layer. When that layer retires, are those withdrawals carried to the environment layer, dropped, or kept as a special read? #22008

Activity

1. objectstack-fleet

   added

   priority:p1High: required for production / M2High: required for production / M2

   security

   needs-user-decision

   target:v18

   domain:engine

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 6, 2026
2. objectstack-fleet commented on Oct 6, 2026

   

   objectstack-fleetbot

   on Oct 6, 2026

   ContributorAuthor

   More actions

   Ruling: batch #282 item 3 · letter A · maintainer 「同意」 2026-10-06T15:55Z

   Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Batch #282 was presented in chat with this card's options A / B / C; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body (no comments), #15206, ADR-0131 D6 / D10 / D13 and the #21835 ruling 6005722623 were re-read before this record. Thread-read: none on this card.

   The ruling

   A. At the v18 upgrade the migration ceremony (C7, #15211) carries every organization-layer withdrawal of a public form to the environment layer. Conflict rule, fail-closed: on a deployment with more than one organization, a form any organization withdrew is withdrawn at the environment layer. A withdrawal is customer-written state, not a mirror, so D10 sanctions no deletion of it; and the organization layer retires whole (D13), so no special read survives for it. Withdrawals are view-type organization-scoped overlay rows, so this is the fail-closed sub-case of batch #282 item 4 (#22011) inside the same promotion.

   Pin owed with C7: a public form withdrawn before the upgrade is refused at the anonymous intake doors after it, on both kernels.

   Not taken: B (the organization-layer withdrawals lapse and the forms reopen on upgrade day, silently; a security regression); C (a kept organization-layer read for withdrawals alone, which leaves the retirement incomplete).

   Execution

   • C7 (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211): the migration plan gains the "withdrawal promotion" category with the any-organization rule and the pin above.
   • C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206): no anonymousFormIntakeOrgScopeRefusal-class read is kept past the retirement.
   • Pointers recorded on feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 and feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211. This card closes completed in this act.

   ---

   Generated by Claude Code
3. objectstack-fleet

   removed

   needs-user-decision

   on Oct 6, 2026
4. objectstack-fleet

   closed this as completedon Oct 6, 2026