docs(adr-0131): the D14 execution-plan note — one cutover, the C7 split, C12 on 18.x, and the D2/D3 reading

[objectstack-fleet]

Fixes #22619
Clause-②: no

Records the maintainer's 2026-10-10 rulings in ADR-0131 as one dated execution-plan note at the end of D14. No decision changes. D6 stays, D14's fence stays, and every §8 table row stays as written.

What the diff does

One file: docs/adr/0131-total-organization-ownership-no-null-organization-id.md (+39 / −2).

• D14, end of section: a new paragraph, Execution-plan note (2026-10-10, docs(adr-0131): §8/D14 execution-plan note — C2's remainder and C3 land as one cutover, C7 splits into C7a/C7b, and C12 moves to the 18.x line (rulings 6094045326, 6094175435, 6094183024) #22619), with four numbered items. Each item cites its record id:
  1. The cutover. [Decision] ADR-0131 剩余部分（C2 余下阶段 + C3）：继续分段、合并成一次切换，还是改成「registry 支撑的对象」 #22601 B, 「同意」, record 6094045326. C2's remaining reader switch (S8a, S8b, S9) and C3 land as one cutover batch: a sequence of PRs merged in a short window, each one green and leaving main usable, with no transition piece. The batch still lands before C7. Under single, a position name is unique per deployment (sub-question Q (a)). The migration reports an existing same-name pair as conflicting (D10 fate 4).
  2. The C7 split. feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, batch Release version 0.4.0 #310 item 2, 「cloud 冻结在 v17 没问题，其他同意你的建议。」, record 6094175435. C7a (inventory, read-only --plan, completion-marker design) does not wait for the cutover. C7b (--apply, post-check, boot refusal) keeps the dependency on the cutover, C4 and C5.
  3. The C12 move. feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213, batch Release version 0.4.0 #310 item 5, record 6094183024. D6's template install mode leaves the v18.0 release-blocking set and lands on the 18.x line. D6 itself is unchanged.
  4. The D2/D3 reading. [Decision] 切换后谁能在 Setup 里新建/编辑岗位和权限集：保持今天的权限（持 manage_metadata 者），还是放开给组织管理员（安全边界） #22621 A, 「同意」, record 6094985249, per ruling pointer 6095030570. The organization admin's authority over the catalog is read-only (the anti-escalation rule). Setup authoring under single requires manage_metadata, which the platform administrator holds through admin_full_access. D7's wording is the accurate one, and D3's "no Studio capability is required" is withdrawn.
• §8, under the intro line: a one-line pointer to the note. The rows stand as written.
• D2 and D3: a one-line pointer at each of the two sentences item 4 corrects. Their text is kept. D3's clause is marked withdrawn 2026-10-10 in place and is not deleted.

The note names three code symbols. Each one is written as a checked symbol or file anchor, so check-adr-symbol-anchors turns red if it rots:

• packages/plugins/plugin-security/src/objects/default-permission-sets.ts
• packages/metadata-core/src/meta-write-capability.ts#metaWriteCapabilityVerdict
• packages/spec/src/identity/eval-user.zod.ts#ADMIN_FULL_ACCESS_CAPABILITIES

Gates (run at ee140c18, the PR head)

dispatch-gates --repo objectstack-ai/objectstack was re-derived with no paths against this change and derived 19 commands, the same set the dispatch named. All 19 exited 0. Reconciliation: --ran reports 19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3).

Command	Exit	The gate's own verdict line
node scripts/check-adr-links.mjs (+ --self-test)	0 / 0	715 relative link destination(s) under docs/adr/ resolve
node scripts/check-adr-symbol-anchors.mjs (+ --self-test)	0 / 0	2252 anchors across 141 records resolve … 0 line anchors survive
pnpm check:adr-anchors	0	OK (64 anchored file(s), every governing ADR still referenced …)
pnpm check:doc-authoring	0	18069 customer-facing string(s) across 1326 spec sources clean
pnpm check:nul-bytes	0	OK (scanned 10645 text file(s) … no raw ASCII control bytes)
node scripts/check-closing-keyword-parity.mjs (+ --self-test)	0 / 0	OK (3 parsers agree on all 9 keywords …)
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	22 record-scoped formula example(s) … judged clean
node scripts/check-ci-filter-parity.mjs, node scripts/check-comment-mask-corpus.mjs, pnpm check:cross-package-test-inputs, check:driver-memory-census, check:gitlink-declared, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal	0 each	each printed OK / ✓

check:doc-formula-expressions first exited 3 with PREREQUISITE NOT MET: @objectstack/formula and @objectstack/lint were not built. That run measured nothing, so it is not counted as a result. I built both under the verify lock (VERDICT command-exit 0) and re-ran the gate, which exited 0.

Acceptance notes

• Two pointers beyond the suggested route. The dispatch suggested one paragraph plus a §8 pointer. I also added a one-line pointer at D2 and at D3, beside the exact sentences item 4 corrects. Without them, D3 read on its own still says "no Studio capability is required". Ruling 6094985249 records that this same sentence misled a seat record before. No D2/D3 text is deleted and no decision changes. If you want the note alone, drop those two hunks.
• Mechanism checks (measured at cc305a3c, which is origin/main and the base).
  • Before this change: execution-plan had 0 hits and each of the four record ids had 0. After: 6094045326 ×1, 6094175435 ×1, 6094183024 ×1, 6094985249 ×3 (the note plus the two pointers).
  • D2's phrase, D3's "no Studio capability is required" and D7's "as an editor under single for capability holders" each occur once, verbatim. Two of them span a line wrap. The note quotes them as the ADR has them.
  • The positive control Amendment (2026-09-17 answered 2, not 1: the status line and the heading.
  • :669 (D14) and :878 (§8) were as stated. The file had not changed since 8c5aa502.
• Observation, not filed (a read-only inference, not measured at a door).
  • organization_admin's anti-escalation entries name sys_position, sys_permission_set, sys_position_permission_set and the two assignment tables. They do not name sys_capability.
  • That set's '*' wildcard grants create, edit and delete, and sys_capability declares no requiredPermissions. Reading the code, an organization admin could create a non-curated capability row today. Such a row is a catalog flag with no authorization effect, and the curated-name gate refuses platform names.
  • Item 4 keeps the ruling's "read-only" wording as ruled.
  • carrier: the cutover batch (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204), which retires sys_capability. Raised as an open question in the dev report.
• What happened since the rulings. C7a (ADR-0131 D10, split from #15211): the migration inventory file, the read-only os migrate --plan, and the design of the ceremony's completion marker #22617 (C7a) has since landed via feat(cli): os migrate organization-ownership — the ADR-0131 D10 inventory and the read-only ceremony plan (C7a) #22643 at cc305a3c. The note records the ruling ("starts at once"), not progress.
• Left for triage. The card's second done-when (moving feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213's target:v18 to the 18.x target once this lands) belongs to triage and is not part of this PR.

维护者速读(草稿)

改了什么:在 ADR-0131 的 D14 末尾加了一段带日期的「执行计划注记」,把 10 月 10 日的四份裁决记录写进 ADR:

• C2 剩余部分和 C3 合成一次切换,分几个 PR 在短时间内合入;
• C7 拆成 C7a(盘点和只读计划,现在就做)和 C7b(真正执行迁移,仍排在切换之后);
• C12(模板安装模式)从 v18.0 的发版阻塞清单移到 18.x;
• 组织管理员在 Setup 里对岗位、权限集只有只读权限,只有持 manage_metadata 的平台管理员才能新建和编辑。

§8 开头加了一行指针。D2、D3 被纠正的那两句旁边各加了一行指针。没有改任何决定,也没有动 §8 表格的任何一行。

为什么改:这几份裁决都要求在 ADR 里留下说明。不写的话,照 ADR 干活的人(包括 AI)仍会让 C7 整块等切换、让 C12 卡住 v18.0。他们还会以为「组织管理员不需要 Studio 能力就能在 Setup 编辑目录」,而这已经被证实与代码不符,并且误导过一次排期。

风险与代价(含回滚):纯文档改动,不影响运行时,也不影响发版。回滚只需 revert 这一个提交。需要您留意的一点:D2、D3 旁边的两处指针超出了派发建议的「一段注记加 §8 一行」。如果您只要那一段,删掉这两处即可。

席位意见:

你要做的:审阅本 PR,同意就点 Approve。这是 Tier H 治理面,需要您批准才能落地。

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ee140c1863db34686fb9acf49cd8f1af68ca3b5c
Local-runs: none

Skills seat 1 (seat post #7623), session_01RdnZdPZH9ByduzPRWuH9tN, read at 2026-10-10T09:10Z. Inputs: the PR diff and file list at this head; card #22619 (claim 6095798943, dev report 6095960772); the four ruling records (6094045326 on #22601, 6094175435 on #15211, 6094183024 on #15213, 6094985249 on #22621) and the ruling pointer 6095030570, each read verbatim this act; origin/main at 3d0eeefa4; the head's check-runs.

① Derived judgments

1. Accept set and public surface: none. One governed text file (docs/adr/**); no package, no schema, no export, no error code. Right.
2. The governed text against the records, item by item. Item 1 (the cutover): B, 「同意」, S8a/S8b/S9 + C3 as one batch, each PR green and main usable, no transition piece, before C7, Q → (a), conflicting = D10 fate 4 — as 6094045326 has them; the gloss "before its apply half, C7b" follows from item 2 and changes nothing. Item 2 (the C7 split): C7a starts now (C7a (ADR-0131 D10, split from #15211): the migration inventory file, the read-only os migrate --plan, and the design of the ceremony's completion marker #22617), C7b keeps the cutover + C4 + C5, "nothing is applied before the data shape is final" — as 6094175435; the aside that C6 (feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207) is closed is true (closed, completed). Item 3 (the C12 move): leaves the v18.0 release-blocking set for the 18.x line, D6 unchanged — as 6094183024. Item 4 (the D2/D3 reading): read-only authority, manage_metadata through admin_full_access, D7's wording accurate, D3's clause withdrawn — as 6094985249 and 6095030570. The Chinese answers are quoted verbatim. Right: no decision changed, no §8 row rewritten, D6 and D14's fence intact.
3. The two D2/D3 pointer hunks. D2 gains one dated pointer sentence; D3's "no Studio capability is required" is kept and marked withdrawn in place with the record id. 6094985249 itself records that this sentence misled a seat record; left unmarked it would mislead the next reader. Judged a faithful marking of a ruled withdrawal, not a change to a decision. Accepted (flagged in the 速读 for the maintainer).
4. Symbol anchors: the three code anchors the note names are of the kind check-adr-symbol-anchors resolves (exit 0 at this head by the report; Lint & Repo Gates in progress at this read). Right.

② Semver level

Nothing publishes (docs/adr/** is on the no-publish fast lane); skip-changeset is right; Clause-②: no is right. Consistent.

③ Boundary flags

• Route beyond the suggestion (the D2/D3 pointers): accepted, ①.3.
• Placement at the end of D14 in the 2026-09-17 amendment's house form; the status line untouched: right.
• Base cc305a3c (four commits past the dispatch's 86da194919, none touching the ADR): right.
• The positive control counted 2, not 1: a counting detail, no bearing.
• open_questions 1 — whether item 4 should qualify "read-only" for sys_capability (the anti-escalation entries do not name it; by reading, an organization admin may create a non-curated capability row today, a flag with no authorization effect): answered A by the seat — a ruled sentence keeps the ruling's wording; the observation rides the PR's Acceptance notes with carrier refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 (the cutover retires sys_capability). Not escalated: neither option changes product semantics or a public contract.
• The target:v18 move on feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213 after this lands is triage's (6094183024): noted for the landing note.

Implemented-by: claude/issue-22619-adr-0131-execution-plan-note
Reviewed-by: session_01RdnZdPZH9ByduzPRWuH9tN

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

维护者速读(终稿)

skills 席 1(#7623)· session_01RdnZdPZH9ByduzPRWuH9tN · 2026-10-10T09:11Z · 席位对照自己读的 diff(head ee140c18)与四份裁决记录原文校正了草稿;维护者只读这一条。

改了什么:ADR-0131 一个文件,+39/−2。D14 末尾加一段带日期的「执行计划注记」,四项各引记录 id:① C2 余下的读端切换(S8a/S8b/S9)与 C3 合成一次切换批(短窗口内若干 PR,各自绿、main 可用,不造过渡件),仍在 C7 之前;② C7 拆成 C7a(盘点、只读 --plan、完成标记设计,现在就做)与 C7b(--apply、后检、启动拒绝,仍等切换、C4、C5);③ C12(模板安装模式)从 v18.0 发版阻塞集移到 18.x,D6 不变;④ 组织管理员对安全目录只有只读权限,Setup 里新建/编辑岗位、权限集、能力需 manage_metadata(平台管理员经 admin_full_access 持有),D3 的「不需要 Studio 能力」那句撤回。§8 表格上方加一行指针;D2、D3 被纠正的两句旁各加一行指针,D3 那句原文保留、原地标注「2026-10-10 撤回」。

为什么改:四份裁决(6094045326、6094175435、6094183024、6094985249)都要求把结论写进 ADR;不写,照 ADR 干活的人与 AI 仍会让 C7 整块等切换、让 C12 卡住 v18.0,并沿用 D3 那句已被代码证伪、且已误导过一次席位记录的话。

风险与代价(含回滚):纯文档,不碰运行时与发版;回滚 = revert 这一个提交。超出派发建议的只有 D2/D3 两处一行指针——席位判定保留:撤回的那句若不原地标注,下一位读者仍会被它带偏。三个代码锚点由 check-adr-symbol-anchors 守着。

席位意见:建议批准。席位逐句对照了四条记录与指针 6095030570:四项与记录一致、引文逐字,无任何决定被改,§8 各行字节不变;契约复审 PASS 已记在本 PR。CI 在 ee140c18 上收敛中(三个 job 仍在跑),落地前席位再核一次。

你要做的:在本 PR 上 Approve(Tier H 治理面)。批准后您自己 ready + 入队,或留给席位落地,都可。

---

Generated by Claude Code