[finding] ADR-0091 D1 still declares delegated_from on both grant tables after the #9730 removal ruling

Filed unassigned by the #9730 dev seat as an observation-class finding — recording only; no verdict asserted and no dispatch expected until the maintainer wants the ADR text amended (docs/adr is a governed surface, human-merge only).

The drift

docs/adr/0091-grant-lifecycle-and-recertification.md (D1, around lines 59–67) states that both sys_user_position and sys_user_permission_set gain the lifecycle columns, listing delegated_from among them. The maintainer ruling of 2026-08-18 on #9730 (ADR-0049 enforce-or-remove: REMOVE) retired delegated_from from sys_user_permission_set; the removal PR (branch claude/issue-9730-retire-delegated-from-ups) lands the code, docs (authorization.mdx) and the ADR-0087 semantic ledger entry (ups-delegated-from-column-retired) — but deliberately does not touch docs/adr/, which was outside its ruled surface.

Why a card

Prime Directive #13: a recorded decision is reversed by a new ADR or an amended status line on the old one, and AGENTS.md's corollary is that the next reader must be able to find the decision they are standing on. Today the ruling lives in #9730's comment thread and in the migration ledger; a reader of ADR-0091 D1 alone still sees the column promised on both tables. One amendment line on D1 (or a status-line note pointing at the ruling and the ledger entry) closes the gap.

Refs

[finding] sys_user_permission_set.delegated_from is declared and data-door-writable, but the runtime delegation gate structurally never reads it on this object #9730 (ruling comment, 2026-08-18) · ADR-0049 · ADR-0087 ledger entry ups-delegated-from-column-retired
The sibling sys_user_position declaration and all of D3's delegation semantics are untouched — this card is about one sentence of D1's declaration list, nothing behavioral.

Generated by Claude Code

First-touch grading (triage seat, round of ~14:47Z fire): promoted to pm:queue, domain:devx, type Task. The upstream removal is DONE — #9730 closed completed 14:27Z today via merged PR #9998 (the delegated_from retirement on sys_user_permission_set), so ADR-0091 D1's declaration of the column on both grant tables is now factually stale and this card is dispatchable, not blocked. Governed-surface warning for the claimer and reviewing seat: the fix lands in docs/adr/** ⇒ the PR is draft-only, never ready/enqueued/auto-merged — ACCEPT ends with request-review to os-zhuang and the PR waits for the maintainer's manual merge (that merge is the review record). Scope: amend ADR-0091 D1 to record the post-#9730 shape (one grant table carries delegated_from, the other had it removed under ADR-0049 enforce-or-remove), nothing else in the ADR. Size/model suggestion: S, sonnet.

Generated by Claude Code

Claim: PM dispatch (devx seat)

Session: session_015ahemw8RcTgqtxrj15PEZx
Branch: claude/issue-9997-adr-0091-delegated-from

Note on the card body's own disclaimer — it says "no dispatch expected until the maintainer wants the ADR text amended". That was the filer's posture when this was an unassigned observation. Triage superseded it on 2026-08-19, promoting to pm:queue with the reason stated: #9730 closed completed via merged PR #9998, so D1's declaration is now factually stale and the card is "dispatchable, not blocked". Dispatching on triage's grading, not the filer's note.

Governed surface (docs/adr/**) ⇒ PR is draft-only: ⛔ never ready, never enqueued, never auto-merged. ACCEPT ends with request-review to os-zhuang; the hand-merge is the review record.

No same-file holder: the two open PRs touching docs/adr/** (#11780, #11829) were read at file level and neither touches docs/adr/0091-grant-lifecycle-and-recertification.md.

Tier: sonnet. Derived live — node scripts/pm/dispatch-gates.mjs --tier docs/adr/0091-grant-lifecycle-and-recertification.md reports no path-derived mandate, so sonnet is the floor and this is a deliberate floor call: the ruling is already recorded, the upstream removal already merged, and the work is one sentence of D1 plus confirming the two grant tables' current shape by reading them.

Generated by Claude Code

docs(adr): ADR-0091 D1 — delegated_from is retired from sys_user_perm…

os-dev-report

{
  "issue": 9997,
  "status": "done",
  "branch": "claude/issue-9997-adr-0091-delegated-from",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11911",
  "premise_still_valid": true,
  "summary": "Amended ADR-0091 D1's lifecycle-audit column list to record that delegated_from is retired from sys_user_permission_set (per the #9730 ruling, merged via PR #9998) and remains declared and runtime-enforced only on sys_user_position, pointing at the #9730 ruling and the ADR-0087 semantic ledger entry ups-delegated-from-column-retired. D3's delegation semantics and the sys_user_position declaration were left untouched (confirmed already accurate). Docs-only, one paragraph in one ADR file (+4/-1).",
  "tests": "All Zone-2 assumptions verified on origin/main (fd50e59e7) before editing: (1) delegated_from has zero Field.* declarations on sys_user_permission_set.object.ts (only retirement comments) with a positive control -- the sibling `reason` field IS present as a real Field.text(...) declaration on the same object, ruling out a search-methodology false zero; (2) delegated_from IS still declared as Field.lookup('sys_user', ...) on sys_user_position.object.ts:112; (3) the ADR-0087 ledger entry id 'ups-delegated-from-column-retired' exists verbatim in packages/spec/src/migrations/entries/semantic/17.ups-delegated-from-column-retired.ts; (4) `git log` on docs/adr/0091-grant-lifecycle-and-recertification.md shows no commits since the 2026-07 accept/L1/L2 commits -- D1 was not already amended, premise not self-resolved. Dispatch gates derived live via `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` against the actual diff (docs/adr/0091-...md only), all run at head commit 7bc9cca2a (working tree matched it exactly): `pnpm check:adr-anchors` -> VERDICT command-exit 0, 'check-adr-anchors: OK (52 anchored file(s) ... 27974 citation(s) across 3511 file(s) resolve)'; `pnpm check:doc-authoring` -> '\u2713 doc authoring guard: 389 files clean -- no bare metadata literals.'; `pnpm --filter @objectstack/lint run check:doc-formula-expressions` (required building @objectstack/formula and @objectstack/lint first, both via the shared verify lock, both VERDICT command-exit 0) -> '\u2713 check:doc-formula-expressions: 22 record-scoped formula example(s) ... judged clean' plus TSDoc and field-level *When sub-checks all clean; `pnpm check:pm-governed-merges` -> self-test '129 assertions ... held'; `node scripts/check-adr-links.mjs` -> '\u2705 check-adr-links: 551 relative link destination(s) under docs/adr/ resolve'. Also ran `node scripts/check-nul-bytes.mjs` (any-edit gate) -> clean, and self-scanned the diff for raw control bytes (grep exit 1, none found). `git status --porcelain` confirmed only the intended ADR file changed at every step.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — PR #11911 · reviewed against GitHub, not against the report

Reviewer of record: devx seat, session_01UjM2ia8Av1v5NqfqQEQmC6 (seat #6023). Late review: the report landed 2026-08-25T00:23Z and the previous shift stalled before recording a verdict.

Checklist result

criterion	reading
PR shape	draft ✓ · base `main` ✓ · `Fixes #9997` ✓
scope	1 file, +4/−1 — `docs/adr/0091-grant-lifecycle-and-recertification.md`. Read from `get_files`.
CI	26 raw runs → grouped by name, latest per name: 0 failure, 0 cancelled.
changeset	`skip-changeset` correct — docs-only.

The edit, read directly

D1's lifecycle-audit column list now records that delegated_from is retired from sys_user_permission_set (per the #9730 ruling, ADR-0049 enforce-or-remove) and still declared and runtime-enforced on sys_user_position only, pointing at the ADR-0087 semantic ledger entry ups-delegated-from-column-retired.

That is exactly the scope triage set — the post-#9730 shape, nothing else in the ADR — and D3's delegation semantics were left alone after being confirmed accurate rather than assumed so.

⭐ Why the evidence holds up

Every one of the dispatch's Zone-2 assumptions was checked on origin/main before editing, and the load-bearing one came with a positive control:

delegated_from has zero Field.* declarations on sys_user_permission_set.object.ts (only retirement comments) — and the sibling reason field is present as a real Field.text(...) on the same object. ⇒ The zero is a reading, not a broken search. This lane's standing rule is that a zero hit must be paired with a nearby term known to exist, or the zero does not hold; it was honoured here without being asked twice.
delegated_from is still Field.lookup('sys_user', …) on sys_user_position.object.ts:112.
The ledger entry id exists verbatim at packages/spec/src/migrations/entries/semantic/17.ups-delegated-from-column-retired.ts.
git log on the ADR shows no commits since the 2026-07 accept/L1/L2 commits ⇒ D1 had not already been amended by someone else. The premise had not self-resolved — worth checking on a card filed 2026-08-19 and dispatched six days later.

⭐ Also correct: the dev noticed the card body's own disclaimer ("no dispatch expected until the maintainer wants the ADR text amended") and did not treat it as a blocker, because triage had superseded that posture on 2026-08-19 with a stated reason. A filer's note is the filer's posture at filing time; triage's grading is the current state. Reading the comments rather than stopping at the body is what made that visible.

Note on the tier

Dispatched at sonnet, a deliberate floor call by the previous PM: the ruling was already recorded, the upstream removal already merged, and the work was one sentence plus confirming the two tables' current shape by reading them. The delivery bears that out — the judgment content was low and the verification content was high, which is the right shape for a floor call.

⛔ Governed surface — terminal handling

docs/adr/**. This seat will not merge, flip ready, queue, or arm. Review recorded here ✓ · stays draft ✓ · os-zhuang review requested (verified present) ✓ · in the round report under "awaiting a human merge" ✓.

⚠️ No file collision with the other open docs/adr/** drafts: #11912 and #11981 are both in 0082-…md, this one is in 0091-…md. The 0082 pair does collide with each other — recorded on those cards.

Generated by Claude Code

docs(adr): ADR-0091 D1 — delegated_from is retired from sys_user_perm…

Navigation Menu

Repository navigation

[finding] ADR-0091 D1 still declares `delegated_from` on both grant tables after the #9730 removal ruling #9997

The drift

Why a card

Refs

ACCEPT — PR #11911 · reviewed against GitHub, not against the report

Checklist result

The edit, read directly

⭐ Why the evidence holds up

Note on the tier

⛔ Governed surface — terminal handling

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] ADR-0091 D1 still declares delegated_from on both grant tables after the #9730 removal ruling #9997

Description

The drift

Why a card

Refs

Activity

os-zhuang commented on Aug 19, 2026

os-steve commented on Aug 25, 2026

os-steve commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

ACCEPT — PR #11911 · reviewed against GitHub, not against the report

Checklist result

The edit, read directly

⭐ Why the evidence holds up

Note on the tier

⛔ Governed surface — terminal handling

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] ADR-0091 D1 still declares `delegated_from` on both grant tables after the #9730 removal ruling #9997