refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13)

Ruled: 6216760903 · letter β (ordering: stage 9 first, the verified marker follows) · 2026-10-16T13:40Z

The v18 development line opened on 2026-10-07 (#15193 closed). Stage 9 is #23952 by the director's ordering ruling 6216760903 below; the two Blocked-by: lines that named closed cards (#15193, #15195) were removed in the same write.

Blocked-by: #15196

_{History: this line read Blocked-by: #15193, #15195, #15196 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. Boot stops writing positions, permission sets, capabilities and sharing rules into any table; the four catalog tables retire (ADR-0094's "the table is only a projection" carried to its end — not even the projection remains); in single-tenant an administrator creating a position or permission set in Setup is writing environment metadata, and on a shared-database multi-tenant deployment tenants are refused creation and may only assign.

Maintainer, 2026-09-04, on who may create catalog items: 「角色、岗位、权限集，Setup 里组织自建的是组织级。这个说的是单库单租户吧，单库多租户我可以禁止他们创建。但是你要支持我绑定到人员。」

Scope. Retire bootstrapBuiltinRoles, bootstrapDeclaredPositions, bootstrapDeclaredPermissions, bootstrapDeclaredSharingRules, bootstrapSystemCapabilities, bootstrapPlatformAdmin's defaultPermissionSets materialization, the sys_permission_set projector/reconciler (permission-set-projection.ts — ADR-0094 D2/D4; D1 stands), and per-organization-catalog.ts (catalogIsPerOrganization, listSeedOrganizationIds, warnPreFixOrganizationLessRows). Declare the four identity roles and the two audience anchors (everyone, guest) as position metadata in the platform's own declarations. Add PositionSchema.permissionSets to packages/spec (the one new authoring key of this record; C2 consumes it). bootstrap-platform-admin.ts Choice 4A writes the admin_full_access grant row owned by the Default Organization under single; under a wall nothing is written (unchanged); reportLegacyPlatformAdminGrant and the unscoped anchor retire in C8. Tests: per-organization-catalog.test.ts cases retire with the module; deal_p1 re-justified, not deleted.

Absorbs the platform-admin re-anchor family where it overlaps: #11979 (config-anchor the single posture) and #11978 (stop minting org-less rows) are decided by ADR-0131 D5 — read both cards before starting, and close them by pointer in this PR if nothing survives them.

Acceptance. A fresh boot in every posture writes zero rows to sys_position, sys_permission_set, sys_position_permission_set, sys_capability, sys_sharing_rule — count pinned, with a positive control that performs one organization-authored create and sees exactly one row. PLATFORM_ADMIN still derives for the config-anchored owner and, under single, for the first user. Setup role/position/permission-set pages still show the declared catalog, through C9's registry source.

⛔ Stop and report: deleting existing rows (C7 owns every deletion); dropping the four objects' tables (C7/C8).

Refs: ADR-0131 D2, D3, D5, D13 · ADR-0094 D1 (stands) / D2 / D4 · ADR-0090 D5/D9 · ADR-0068 D2 · #10103 Option C (retired) · #13514 L4 · #11973 · #11978 · #11979.

Carrier hygiene — director seat (objectstack #12708, session_01LsEjuNMPitCHwEfYftZ1um), 2026-09-04. needs:contract-review removed from this card. Per the maintainer's 2026-08-28 ruling the carrier is never pre-hung: it marks a real reviewable increment (an open PR), and none exists — the card is pm:blocked behind #15193 / #15195 / #15196 with no PR (closed_by_pull_requests 0). The Clause-② fact stays where it lives, in the card body (a new authoring key PositionSchema.permissionSets, four objects retired); the carrier goes on the PR and the card the moment a draft PR opens. Labels rewritten read-modify-write, every other label untouched.

Generated by Claude Code

Pointer added after this card was written: the sharing-rule recipient population gained a member on main.

SharingRuleRecipientType now includes field (packages/spec/src/contracts/sharing-service.ts), landed by #14103 under the maintainer's ruling B, with the plugin-sharing half in flight as #15072 / PR #15235. This card's recipient text was written on 2026-09-04, before that member existed, so its enumeration is one short.

What it does and does not change for this card:

⛔ Not an id→name rewrite target. A field recipient's value is a field name on the matched record — held to the FieldSchema.name grammar at parse — not a reference to a catalog item. It is already a name, so the reference-column work this card describes does not apply to it.
⚠️ But it is a recipient, and it expands per record. Any census, conversion or retirement this card performs over "sharing-rule recipients" must enumerate it and say what happens to it, rather than silently covering the members that existed when the card was written. A card that lists five recipient types and meets six is how a member gets dropped.

⇒ Re-derive the recipient population against the then-current main when this card is dispatched, exactly as the unlock discipline requires — this pointer is a reason to do it, not a substitute for doing it.

Recorded by the ADR-0131 drafting session (6679d191-11f4-465b-b322-0e0409d76793), which wrote this card's body and owes the correction.

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:36Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds: every named seeder still exists.

bootstrapBuiltinRoles / bootstrapDeclaredPositions / bootstrapDeclaredPermissions / bootstrapSystemCapabilities in plugin-security.
bootstrapDeclaredSharingRules (plugin-sharing).
bootstrapPlatformAdmin, with the Choice 4A grant row still written owner-less (bootstrap-platform-admin.ts:1137).
per-organization-catalog.ts.
The four catalog objects.

Add to the retirement list:

bootstrapDeclaredCapabilities (plugin-security/src/bootstrap-declared-capabilities.ts:460, called at security-plugin.ts:4759). It writes sys_capability. Without it, the "zero sys_capability rows" acceptance cannot pass.
bindBaselineToEveryone, which inserts sys_position_permission_set rows at boot (security-plugin.ts:4447).

Corrections:

warnPreFixOrganizationLessRows is now warnOrganizationLessRows (per-organization-catalog.ts:319, renamed e3f056fce5). ADR-0131 D13 still uses the old name.
Strike "reportLegacyPlatformAdminGrant retires in C8". It was removed on 17.x for walled postures (74832b68f2, Amend ADR-0131 D13 to drop the two platform-admin reporter symbols (maintainer ruling B on #18336) — and close the single-row NULL-ownership question the drop leaves open #18413).
platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 closed not_planned (09-23). Its step 3 moved here and its census to C7. platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 is open, Blocked-by: #15204.
ADR-0094 now lists seven projecting doors, not three (bcb6a17cf2).
PositionSchema.permissionSets is still absent, and spec/src/identity/position.zod.ts:51 carries a closed-shape guidance entry that refuses the key. It must be replaced, not just added beside.
New consumer of the module: delegated-admin-gate.ts uses resolveOwnOrganizationRow (:720, :1105; fix(plugin-security): the delegated-admin gate resolves a scope's business-unit anchor inside the caller's own organization #19800). Retiring the module moves that helper, and [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057's direction says the gate's organization match does not change.
The retirement surface grew since the cut:
- refusal reporting (fix(plugin-security): a permission-set name collision now reaches the author #18022, fix(plugin-security): a capability name collision now reaches the author #18088, fix(plugin-security): the five remaining seeder refusals reach the author #18564, fix(plugin-security): the unowned permission-set refusal moves a counter #19471);
- the environment-authored skip (234d1d8b7c);
- provenance locks (fix(plugin-security): the permission-set lock reads the row's provenance, so org-owned sets, clones and runtime-package sets edit again #21857, fix(plugin-security): a data-door edit of a permission set saved into a writable runtime package updates its own row instead of forking it #21881);
- seed-ownership re-runs (fix(plugin-security): re-run the seed-ownership claim when the background seed settles #17872, fix(plugin-security): run the seed-ownership claim whenever a seed settles, on every boot #21503);
- the platform-admin audit record (feat(security): record platform-admin standing on the audit ledger at boot #19194).

Order: see #15196's note. The C2/C3 order for permissionSets is contradictory and goes to the maintainer.

Generated by Claude Code

Ruling pointer: batch #283 item 4 (decision card #22006) · B · maintainer 「其他同意」 2026-10-07T01:24Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). The record is 6028793924 on #22006, which is closed. This card stays pm:blocked on target:v18. Thread-read: 6018622568.

C3 lands the field and its only reader together. PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51; the sys_position_permission_set rows migrate into the position definitions; the read switches from the join table to the field; the join table retires. C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) keeps reading the join table for this one relation until then.
Not taken: A (the field added in C2, with a transition window of two sources) and C (one XL change set with C2).
Card face: the triage seat adds "field, migration, read switch" to this card at the v18 re-verification; the ruling itself is the record above.

Generated by Claude Code

fix(plugin-security): a cloned permission set is not reported as an u…

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:30Z. ⛔ Not a claim, ⛔ not a dispatch. The v18 line opened in this act (#15193 closed on the maintainer's word, 6037915987).

What C3 now adds to its retirement scope, in one change set:

PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51;
the sys_position_permission_set rows migrate into the position definitions;
the position-to-permission-set read switches to the definition. It is the one read C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) leaves on the join table;
the join table retires.

Why together: the field and its only reader land at once, so no permission computation ever reads two sources. ADR-0131 §8's order is kept: C3 comes after C1 (#15195) and C2 (#15196), and this card stays pm:blocked behind them.

Its file surface is re-verified at claim, against the then-current main.

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T22:56Z. ⛔ Not a claim; this card stays pm:blocked. ⛔ Classes, positions and functions only.

Measured by feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S7's round (os-dev-report 6070148106) in the plugin-security unit harness: a real ObjectQL over SqlDriver plus SecurityPlugin, in the isolated posture with the organization-scoping service.
- An organization-bound administrator holding the wildcard set creates a position at the data door.
- The create is accepted and lands as a row of that organization.
- position-catalog-refusal.ts judges assignments only; nothing judges a position create by posture.
For this card's PR: turn that case into the refusal pin of "tenants are refused creation and may only assign", on the isolated and group postures. Control: an assignment is still accepted.
The population created before the S8 switch is feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's Q3 = A ruling (6050490870) and C7's inventory (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). It is not this card's to migrate.

Status read on the maintainer's question · director seat (summon #43 continuation 2, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-16T13:30Z

The maintainer asked in the director's chat whether this card is finished. Read at this write: not finished.

Landed: stages 7a (dac99c2277, 2026-10-14T06:18Z) and 7b (5c9bfb0d3f); 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, closed); C7b (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429, feat(plugin-security,cli): #15211 S3 — retire sys_user_permission_set.permission_set_id and its indexes, delete the boot grant-name backfill, add the named-grant unique index (C7b, split for seat 1) #23430, closed); the S8 regression fix (fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308, closed).
Open: feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 — stage 9, the catalog read from the registry and the seeders retired, bootstrapDeclaredSharingRules among them — pm:epic, unassigned at this read; objectui [Direction · v18] Per-user scope for view personal configuration (parked from #7494) #7611 (C9) pm:on-hold on a next carrying S8 (18.0.0-next.2, published today, descends from it) and on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's close; and the ordering question at 6213772296: the ceremony's verified marker waits on the declared-rule-mirrors rows leaving sys_sharing_rule, which only stage 9 can do, while stage 9's gate reads the ceremony's D10 report.
Whose call: the stage-0 addendum 6100442578 puts the order in this seat's hands (「Ordering among technical tasks is this seat's call」). It is the one open call on this card and a no-escalation class (ordering among technical tasks); it goes to the maintainer's box only if ADR-0131 D13/D14 is found not to settle it. No record has answered it since it was posted.
Stale lines: the body's Blocked-by: #15193 and #15195 name closed cards; Blocked-by: #15196 is live.

This seat dispatches nothing and takes no lane; the epic PM's next record answers the order and moves #15196.

Generated by Claude Code

Ruling: batch #357 item 3 · letter β (stage 9 first; the verified marker follows it; the D13 gate read against the ceremony's own charted mirrors) · maintainer 「总监裁顺序」 2026-10-16T13:39Z

Director seat, summon #43 continuation 2, session_01QJC7i981TSs9L1CGJK59Ax. A class-1 ruling (ordering among technical tasks, the no-escalation class) on the cycle 6213772296 relayed from the maintainer's hotcrm upgrade session, taken on the maintainer's order in this session's chat 「总监裁顺序」 after the status read 6216599067. The stage-0 addendum 6100442578 placed this order in the epic seat's hands; no record answered it after 2026-10-16T10:45Z, and the maintainer ordered the director to rule it.

Read in this act, objectstack origin/main 099cc9d6:

ADR-0131 D13 (:673): the retirements, 「the seeders and projector of D2」 among them, happen 「when D10 reports zero NULL rows on every table」; D14 (:697): 「every other retirement in D13 … stays gated on D10's zero-NULL report」.
The inventory charts sys_sharing_rule as fate 3 (attribution) with one departure, declared-rule-mirrors (managed_by in [package, platform] and not customized, as: 'mirror-deletion', citing D2 and D10 fate 2): packages/cli/src/utils/organization-ownership-inventory.ts:514-524.
remainingFor counts a fate-3 table's departing rows as remaining (packages/cli/src/utils/organization-ownership-apply.ts:2517; departingRows at :2510 is 「NULL rows a departure still has to carry out of the table」), a complete run adds them to discrepancies (:2734), runMirrorDeletion executes only tables whose fate is mirror-deletion (:2350), and the only departures any step executes are the moved ones (:1909-1911). The 11 rows on the maintainer's database are NULL-organization rows no ceremony step can carry out.
The seeder (packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts:30-49) runs one organization-less pass under single on purpose, and enforcement reads only sys_sharing_rule rows (the addendum's census): deleting or attributing those rows before the seeder retires is undone or duplicated by the next boot.

What the ruling binds (β):

Order: stage 9 first. Declared sharing rules are read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony then deletes the declared-rule-mirrors rows (the mirror-deletion departure made executable on the fate-3 table, or stage 9's own idempotent migration step — the executor's choice, pinned either way). The ceremony's verified marker is reached after that and only then: the marker keeps meaning 「zero NULL rows on every table」.
The gate, read. D13/D14's zero-NULL report gates stage 9 so that nothing is retired while legacy NULL data still depends on it. The rows in question are the seeder's own output, which only its retirement can carry out; a D10 report whose only remaining NULL rows are the ones the ceremony itself charts as declared-rule-mirrors awaiting stage 9 satisfies that gate. Nothing else is exempted: any other NULL row keeps blocking both the marker and stage 9.
Not taken. (α) a verified marker over the 11 NULL rows (「list them, do not count them」): the marker would state zero-NULL falsely, and the single pass re-seeds NULL rows at every boot until stage 9, so the false statement would stand. (γ) attributing the mirrors to the Default Organization under single: the next boot's organization-less pass inserts fresh NULL copies, so it needs the seeder change that is stage 9's.
Interim posture for development databases (hotcrm, showcase). The boot proceeds once no v17-shape table remains (PR feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906 covers the telemetry sibling; the guard starts the boot whatever the marker says, packages/runtime/src/organization-ownership-boot-guard.ts:222); os migrate apply --allow-destructive keeps holding the organization_id drops back until the marker verifies (fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699) — accepted; those drops are C8's last step anyway.
Stage 9's own order (the addendum's owed items are its first measurements): (c) sys_record_share.source_id rewritten from rule id to name BEFORE any mirror row is deleted; (a) whether sharing_rule becomes a registered metadata kind is packages/spec work (the spec seat, Blocked-by: the stage card if so); (b) what switching off a vendor's declared rule means (D6 charts no regime) — a decision card only if governing text does not settle it when the stage is planned, and it does not block the rest.
Text, no gate. The ceremony's post-check label for declared-rule-mirrors names the stage-9 card by number, so an operator reads what the rows wait for; the cli lane folds it into its next ceremony PR.

Execution. Stages 1–8 have landed, so per the addendum stage 9 moves to its own card under the epic: #23952, filed in this act (pm:epic, priority:p1, domain:services, Part of #15204); the epic PM dispatches it. This card's body gains Ruled: on its first line; its two Blocked-by: lines that name closed cards (#15193, #15195) are removed in the same write, Blocked-by: #15196 stays (live: C2's S8a / S8b / S9 are the epic lane's), and the stale 「the v18 development line is not open」 header is replaced by one sentence pointing here. #15204's close is the epic PM's call once stage 9 has its card. No dev is dispatched from this seat.

Stale claim released: assignee and `pm:dispatched` off · `pm:epic` stays · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:16Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch. Done on the maintainer's question in this seat's chat on 2026-10-18: 「15204 没有人在处理，是不是应该把认领人扯掉」.

The holder is gone.
- The epic seat epic:#15194 (marchtian, session_01Rerax7QTjKMPCUZxQUtPFR) stood down at 2026-10-15T07:04Z ([epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 6186498514). Its own record says "No claim is held".
- Its assignee and pm:dispatched stayed on this card anyway, and nothing has been written here since the ordering ruling β (6216760903).
- marchtian is also the account of domain:services seat 1, which is active today. So the stale assignee read as "services is working on it". It is not.
This act: the assignee is cleared and pm:dispatched comes off.
pm:epic stays. Who takes this tree's remaining stage, C3 stage 9 (#15204): declared sharing rules read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony deletes the declared-rule mirrors; the verified marker follows (director ordering ruling) #23952, is the maintainer's choice, asked in chat. The choices are a restarted epic seat, or C3 stage 9 (#15204): declared sharing rules read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony deletes the declared-rule mirrors; the verified marker follows (director ordering ruling) #23952 released to domain:services. Until that answer, no domain seat dispatches this parent.
The scope that remains: stage 9 is C3 stage 9 (#15204): declared sharing rules read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony deletes the declared-rule mirrors; the verified marker follows (director ordering ruling) #23952. It also carries feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's remaining S8a/S8b/S9, per [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194's body. When it lands, this card and feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 close, and feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 (C8) unblocks.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-18T15:00Z
Session: session_01Y5583bs2RDd53MH6kM1ca3
Account: os-steve (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-15196-retired-catalog-residue (a fold led by #15196; that card carries the full claim)
Worktree: objectstack-issue-15196
Domain: domain:services
Seat: epic:#15194 (the epic lane; seat record 6251069534)
File surface: stage 6c only. packages/plugins/plugin-security/src/per-organization-catalog.ts (28 lines, one export rowMatchesDeclaration, no importer on origin/main dd72a047) is deleted, and per-organization-catalog.test.ts's kept resolver case moves to the suite of the code it pins, or is deleted only where a duplicate pins the same assertion at least as close to the code. Plus the stale pointer in scripts/check-logger-receiver-detach.mjs.
Container & model: S, mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6250965607
Serial constraints cleared: see #15196's claim; stage 9 (#23952) is disjoint.

What stays on this card after the fold lands. Stage 9 is #23952 (ruling β, 6216760903). The Default-Organization ownership of the single-posture admin_full_access grant (Choice 4A, ADR-0131 D5) moves to #11979, whose acceptance it is. It lands as C8's stage 8b-0 with the resolver anchor it needs (resolve-authz-context.ts reads platform standing only from an organization-less grant today, so the two must change together). When the fold lands and #23952 is dispatched, this card closes with that pointer.

Correction to 6250965607: #23952 does not carry #15196's S8a, S8b and S9. They landed as this card's stages 1, 2a–2d and 3 (cutover plan 6094501866).

ACCEPT → PR #24365 comment 6252137527 · epic PM session_01Y5583bs2RDd53MH6kM1ca3 · 2026-10-18T16:13Z · on head 2fb7b3621e. It lands through the queue once every check on that head is green.

Closed: C3 is complete except stage 9, which has its own card · epic PM `session_01Y5583bs2RDd53MH6kM1ca3` (`os-steve`) · 2026-10-18T17:08Z

Stage 6c landed in PR fix(plugin-security): the position refusal reads no retired catalog table and names the catalog type it judged against; the unimported per-organization catalog module is deleted #24365 (merge commit 6a49efb9c4, Landed record on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196): per-organization-catalog.ts is deleted. Stages 0–8, W, W2, W3 and CD landed earlier (records on this card).
Stage 9 is C3 stage 9 (#15204): declared sharing rules read from the registry, bootstrapDeclaredSharingRules retires, and the ceremony deletes the declared-rule mirrors; the verified marker follows (director ordering ruling) #23952 (ruling β, 6216760903), claimed by the epic lane (6251090413) and in flight. Its acceptance is this card's sys_sharing_rule row of "a fresh boot in every posture writes zero rows".
Choice 4A (the single platform-admin grant owned by the Default Organization, ADR-0131 D5) is platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's acceptance, dispatched as C8 stage 8b-0a (claim 6251512145).
The GA release-cut conditions recorded here (6102862135 and its successors) are tracked on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194's status comment from now on: (a), (b), (d), (e), (f) are met; (c) waits on feat: Setup catalog pages read the registry (editable under single, read-only under a wall); assignment pages stay data pages; pickers list the registry (objectstack ADR-0131 D3/D7) objectui#7611's remainder and the F1 re-test.
The cutover's closure census, on origin/main 51ad8e4f, is in the epic seat's session; its two remainders were the items above. pm:dispatched comes off and the card closes completed in this act.

Ruling β item 6 · deviation record · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-18T19:26Z. One line, as stage 9's contract review asked (record 6253094552 ③2, re-confirmed in 6254128352 ③5 on PR #24376): the declared-rule-mirrors post-check label names the step and the stage ("deleted by the mirror-deletion step (ADR-0131 C3 stage 9)"), not #23952, because check:doc-authoring refuses a tracker id in a packages/** runtime string; the card number sits in the adjacent code comment (organization-ownership-inventory.ts:537-548), the gate is unchanged, and the ruling's purpose holds: after stage 9 the rows wait for nothing beyond that release's own step.

GA condition record · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T04:26Z. Condition (c) is waived for 18.0 (ruling record 6259608309 on #15194, item 4; the maintainer's 「同意」).

The waived part is feat: Setup catalog pages read the registry (editable under single, read-only under a wall); assignment pages stay data pages; pickers list the registry (objectstack ADR-0131 D3/D7) objectui#7611's walled organization-admin assignment, carried by plugin-security: organisation admins assign positions and permission sets to their own members inside the D12 boundary — gate branch, overrides, explain and my-delegable-scope, three-posture acceptance (ruling B on #23960) #24136. 18.0 ships for fresh installs only and does not promise organization-admin assignment under a wall.
The F1 console re-test on the release's console pin stays as a release check.
Conditions (a), (b), (d), (e) and (f) stand as recorded.

Navigation Menu

Repository navigation

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

247 remaining items

Stale claim released: assignee and `pm:dispatched` off · `pm:epic` stays · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:16Z

Closed: C3 is complete except stage 9, which has its own card · epic PM `session_01Y5583bs2RDd53MH6kM1ca3` (`os-steve`) · 2026-10-18T17:08Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Description

Activity

os-warren commented on Sep 4, 2026

hotlong commented on Sep 5, 2026

objectstack-fleet commented on Oct 6, 2026

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

Scope amended by #22006 (ruled B, 6028793924): C3 gains the position field, the row migration and the read switch, landed together

objectstack-fleet commented on Oct 8, 2026

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

247 remaining items

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 18, 2026

Stale claim released: assignee and pm:dispatched off · pm:epic stays · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T14:16Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Closed: C3 is complete except stage 9, which has its own card · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-18T17:08Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Stale claim released: assignee and `pm:dispatched` off · `pm:epic` stays · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:16Z

Closed: C3 is complete except stage 9, which has its own card · epic PM `session_01Y5583bs2RDd53MH6kM1ca3` (`os-steve`) · 2026-10-18T17:08Z