Repository navigation
decision: ADR-0131 C5 — under single, Studio saves are stored organization-scoped today. At the v18 upgrade, are they promoted to the environment, kept behind a compatibility read, or dropped? #22011
Description
Ruled: 6020163868 · letter A · 2026-10-06T16:05Z
Filing gate: ② a decision only the maintainer can make. Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U) at the maintainer's instruction 「需要我决裁的问题，立决策卡」. ⛔ Not a claim. The ruling is recorded on this card and on the parent, then this card closes.
Parent: #15206 (ADR-0131 C5, target:v18). #21818 (08adfeade8) measured that under single with a Default Organization (the production default), every Studio save of these five types is stored as an organization-scoped sys_metadata row.
维护者速读
单租户部署里，客户在 Studio 里改过的视图、仪表盘、报表、翻译和邮件模板，现在都存在"组织级"。v18 取消组织级后，这些定制怎么办？
- A：升级时提升为环境级。单租户下含义完全不变。万一同名冲突（比如单租户部署里有多个组织），在迁移计划里列出，由运维逐条选。
- B：保留一条兼容读取，继续读默认组织的行。
- C：丢弃，写进发布说明，客户的 Studio 定制全部消失。
推荐 A。回一个字母：A / B / C。
四棱（os-decision-facets）
- ① 项目长远合理性：A 让定制只存在环境级，不留组织级特例；B 保留特例；C 无特例但丢客户数据。
- ② 实际业务拉动：单租户下凡是用 Studio 改过东西的客户都涉及，而单租户是默认部署形态。
- ③ 防 AI 犯错：A 只有一层来源；B 让 AI 面对一层"看起来已退役、实际还在读"的路径。
- ④ 创业阶段不扩散：A 是一次迁移；B 要长期维护兼容读取。
Prior rulings read: ADR-0131 D6 (environment overlays stay), D10 (fates; only fate 2 deletes), D13; ADR-0005 (as amended); #21818; #17460 (multi-organization single is reported at boot, not refused); thread: #15206.
一句话问题
单租户下客户在 Studio 做的定制，升级到 v18 时搬到哪里？
选项 × 代价
| 选项 | 做什么 | 客户感受到的后果 |
|---|---|---|
| A | 迁移计划把默认组织的这些行提升为环境级；同名冲突逐条列出，由运维选择 | 单租户：无感；多组织撞名：运维逐条选 |
| B | 保留读默认组织行的兼容路径 | 无感；平台长期多一条路径 |
| C | 丢弃 | 客户的 Studio 定制全部消失 |
推荐 + 回退 + 置信缺口
- 推荐 A。 两年后，客户在 Studio 做的定制只有环境级一层，升级只搬不丢。这与 Salesforce 的定制属于组织（即环境）级元数据的建模一致。
- 回退 B。 ⛔ C 不推荐。
- 置信缺口：
- "单租户但有多个组织"的部署数量看不到，迁移计划会列出；
- 本卡与上面"邮件模板去留"那张卡是同一做法，两张一起裁更一致。
- 只看①选 A；②③④ 是否翻转：否。
裁后执行
- A： C7（feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211）的迁移计划加入"组织级定制提升为环境级"一类（含冲突清单）；C5（feat(metadata-core,metadata-protocol,objectql,plugin-security): the
sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206）的退役以此为前提。 - B： feat(metadata-core,metadata-protocol,objectql,plugin-security): the
sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 保留兼容读取，并明确它的退役时间。
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 6, 2026
Ruling: batch #282 item 4 · letter A · maintainer 「同意」 2026-10-06T15:56Z
Director seat, summon #35,
session_01VYToj6PQehTEKNrjGM9akg(GitHubos-zhuang; written asobjectstack-fleet[bot]via the relay). Batch #282 was presented in chat with this card's options A / B / C; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body (no comments), #15206, #21818 and ADR-0131 D6 / D10 / D13 were re-read before this record. Thread-read: none on this card.The ruling
A. Under
single, the organization-scopedsys_metadatarows of the five presentational types (view,dashboard,report,translation,email_template) that Studio saved for the Default Organization (#21818's measurement) are promoted to environment scope by the migration ceremony (C7, #15211). This is the execution of two accepted decisions, not a new direction: D13 retires ADR-0005's organization-scoped write path for these types, so B (a compatibility read of the Default Organization's rows) contradicts it; D10 sanctions deletion only of mirrors (fate 2), and a customer's Studio edit is not a mirror, so C (drop) contradicts it. The promotion is D10's fate 3 applied to the environment as the owner.Conflict rule. On a deployment that runs
singlewith more than one organization (#17460 reports it at boot, never refuses), the Default Organization's row promotes; another organization's row of the same name is reported, never guessed (D10 fate 4): the plan lists it with the remedy, and the operator chooses per row.Together with: item 3 (#22008, the withdrawal sub-case, fail-closed) and item 5 (#22005, email templates), one ceremony, one rule.
Execution
sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206): its retirement proceeds on this premise; no compatibility read is kept.sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 and feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211. This card closescompletedin this act.Generated by Claude Code