[PM seat] domain:services — 🟢 os-justin #6021

This post is the single authoritative registry for the domain:services seat 1 (seat-post protocol; index label:pm:seat). Single writer: the incumbent only. Read side: this body plus every comment newer than the body's last edit. ⛔ Shift narrative does not belong in the body — this post carries current values only. Job description: .claude/skills/pm-dispatch/references/lanes/services.md. Seat 2 is #21118.

1. Current PM — 🟢 os-justin

• Account: os-justin (GET /user). Session: session_011TdZ8GjixNZFLz1xJD9zzK. Seated: 2026-10-20T05:41Z, on the maintainer's invocation /pm-dispatch services seat 1 (this session's first user turn). The previous term's scope (p1–p3, serial dispatch) was the maintainer's word to that session and ⛔ is not inherited; this term runs the default batch 3.
• Wake Routine: trig_01755ku8Ef2i5GbZgTkNRFrE (self-bound, hourly at :28, own_followup). It is the default wake; a round-end send_later is only an accelerator.
• Write identity: the fleet relay (objectstack-fleet[bot]) via scripts/pm/*, transport dispatch (route read at seating: CCR_AGENT_PROXY_ENABLED set, session derived from the container, relay workflow on main and active).
• Harness currency: CURRENT at 2026-10-21T10:18Z on shared HEAD 2b1382a5b3 (check-harness-current exit 0; the round-boundary re-pin at 2026-10-20T14:52Z picked up .claude/hooks/* 7e40e8a03a, fix(hooks): read a command substitution inside a double-quoted word as its own quoting context #24886, and the one at 2026-10-21T01:30Z picked up be1fd311b1 (docs(os-dev, pm-dispatch): a breaking PR runs the full dogfood battery on its final head; the review checklist reads the field before arming #24917: agents/os-dev.md and references/review-checklist.md, the dogfood_battery rule); the shared checkout is pinned to a detached origin/main before each subagent batch, per PR docs(pm-dispatch): pin the shared checkout to a detached origin/main before a subagent batch #24685's runbook step). Touches: SKILL.md c1f4093, execution-duties.md c03b17d, lanes/services.md f151ef2c9, agents/os-dev.md cb8756b00; references read this term after landing mid-term: dispatch-runbook.md (c663245647), cross-repo-coordination.md (d20bf9b09b), filing-gate.md (a43405d59).
• Previous incumbents: marchtian · session_01Nk17Z26X5DB59iQztDBADH (seated 2026-10-17T13:57Z, signed off 2026-10-19T23:14Z; brief 6279429458, handover check exit 0). Before it: os-bill · session_017WLmd5in9RXu7AjyHR8fKQ (briefs 6188435608 and 6206660121); marchtian · session_01LxHPTb1LxL7a6WkQbALKnD (brief 6173044890); os-warren · session_01CeRCvvvjxbxu2iYJAc5Cce (brief 6127166372). ⛔ Earlier ones are not restated here.

2. Ledger — current values

• Maintainer's live words this term: 「新的 派」, 「你车道的p1 都派」, 「并发3」, 「24784 插队」, 「当前任务处理完，后续并发降到2」 (2026-10-20T13:01Z), then 「暂时只处理 p1 p2」 (2026-10-20T22:40Z), then 「后续改为串行派发」 (2026-10-21T10:07Z), all in this session's chat. Recorded by the director seat on cards, and binding here: 「暂时不考虑 v19，协议的调整原则上也是尽快，不考虑退役版本。」 (the amended 「甲」, 6303865025 on [PM seat] triage (objectstack-wide) — 🟢 Routine · session_01AavokzJ5DndAwitDXvKy4U · trig_01NcnCtMS2tH46nUg1a5TaMJ (hourly) · state = body + the round records newer than it #6015: a narrowing no conversion carries ships now, in 18.x, as a BREAKING minor), and 「类似的问题都可以这样处理」 (6304303975 on meta: the webhook metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling) #24966: declare a per-type fact on the schema and derive the behaviour once in the kernel). Dispatch is serial (「后续改为串行派发」, superseding 「并发3」 and the later concurrency of 2): one card is in flight at a time, and the next is dispatched only when the current one has landed or been released. A card that rides an in-flight claim's dev and PR, as plugin-security: under one master-reference declaration, a write to a controlled_by_parent detail is not held to ADR-0055's master invariant on every write shape (reach measured; detail withheld under the disclosure ruling) #25068 rides plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049's, counts as that one card. Scope is p1 and p2 only, until the maintainer says otherwise. ⛔ No p3 is dispatched, and no p3 execution card is filed for dispatch. Every dispatchable pm:queue p1 of this lane is dispatched or held on a declared serial constraint. When nothing is in flight, the next dispatch takes the top p1, else the top p2.
• In flight from this seat (refreshed 2026-10-21T10:18Z): serial dispatch, one card.
  • deps(plugin-auth): lift the better-auth family from 1.7.3 to 1.7.12 — security fixes published after the 2026-10-01 deferral #25096 (p1, security; triage 6313201609: the maintainer's own word lifts the better-auth family to 1.7.12, superseding deps: take the 2026-10 production-dependency group without the better-auth family (replaces Dependabot #21029) #21094's deferral): claim 6313539804, mode:subagent, Clause-②: no (narrowing). It ships as a BREAKING minor, not the card's patch, because the lift adds refusals 1.7.3 did not make. The file surface includes pnpm-workspace.yaml and the regenerated pnpm-lock.yaml, declared on the cross-domain exception path. No open PR or in-flight claim touches those files.
  • Next under serial dispatch, once deps(plugin-auth): lift the better-auth family from 1.7.3 to 1.7.12 — security fixes published after the 2026-10-01 deferral #25096 lands: the top p1, else the top p2, of this lane's pm:queue (at 2026-10-21T10:18Z: p2 plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095, mail templates: a hole an author places in a template body may not be encoded for the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25082, A screen flow whose write node is refused shows the end user the engine's raw node text, in English, with the node id and the object API name ("Node 'create_account' failed: create_record(crm_account) failed: …") #24914 and Setup: a position's same-named permission set is in force but invisible — the set's Assigned Users panel is empty and the position reads as granting nothing #24757; plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932 is seat 2's by its own 6304727839).
• With the maintainer: none from this seat.
• Closed by the maintainer: feat(plugin-email,plugin-security): organization admins read their own organization's mail bodies again (option B), once one exported identity selector exists #24898, not planned (6308427243, 「24898 直接关闭。」). Ruling B is withdrawn, and fix(platform-objects,plugin-audit,plugin-approvals)!: mail bodies are read only with manage_platform_settings, and the audit mirrors never copy them in clear #24688's body gate stands. This seat's cross-lane declaration 6304826207 was released (6308816325).
• Ruled this term, executing in other lanes (each card pm:blocked, closing when its execution card lands):
  • A declared webhook in a scaffolded app is silently inert: os validate passes without the 'webhooks' and 'realtime' capabilities, and with 'webhooks' alone the activation answers enabled while nothing is ever enqueued (WARN only) #24910: A (6303779439), amended to ship now (6303859748). Execution: spec: refuse a declared webhook whose requires cannot dispatch it — STACK_WEBHOOK_CAPABILITY_REQUIRED in defineStack, the third declared-capability refusal (ruling A on #24910; ships in 18.x by the maintainer's re-timing) #24997 (domain:spec, the defineStack refusal, BREAKING). spec: the loud half for a declared webhook whose requires cannot dispatch it — os validate / os build warn, naming the missing token and the 19.0 refusal (ruling A on #24910 under 「甲」 rule 2; 18.x) #24995 was closed as superseded.
  • A screen flow whose write node is refused shows the end user the engine's raw node text, in English, with the node id and the object API name ("Node 'create_account' failed: create_record(crm_account) failed: …") #24914: B′ (6303788292). Execution order: spec: FLOW_FAILED carries the refused write's inner refusal — an optional userMessage on AutomationResult and one declared details member { code, message } on the trigger, resume, /actions and endpoint doors (ruling B′ on #24914) #24996 (domain:spec, the AutomationResult members) first, then THIS card in this lane, serial after PR feat(spec,objectql): report a caller value a stored expression replaced, as DroppedFieldsEvent reason stored_expression #24778 in crud-nodes.ts with a cli declaration on [PM seat] domain:cli · seat 2 — 🟢 os-justin · session_01LmjU2x1faLZ39DVTFyVca6 #22648, then FlowRunner: a FLOW_FAILED envelope is rendered by the record-save rule — the author's errorMessage, then userMessage, then the declared inner refusal, then message (the console half of objectstack#24914 ruling B′) objectui#13285. ⛔ This seat dispatches A screen flow whose write node is refused shows the end user the engine's raw node text, in English, with the node id and the object API name ("Node 'create_account' failed: create_record(crm_account) failed: …") #24914 only after spec: FLOW_FAILED carries the refused write's inner refusal — an optional userMessage on AutomationResult and one declared details member { code, message } on the trigger, resume, /actions and endpoint doors (ruling B′ on #24914) #24996 lands.
  • meta: the webhook metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling) #24966: B, amended to B+ (6304303975). Execution: spec: WebhookSchema marks secret and headers as credential fields, and the kernel registry derives the meta read-door redaction for any marked type — webhook first, with a ratchet for unmarked credential-named fields (ruling B+ on #24966) #24994 (domain:spec, a schema credential marker plus a derived kernel redactor and a ratchet).
• Landed this term:
  • plugin-approvals: the served approval request page's H1 still reads flow:NAME · RECORD_ID — the approvals get serves no display_title, and the title names the raw record id (blocks objectui#12484) #24665 → PR fix(plugin-approvals): an approval request is titled by its flow's label, never the raw record id or the flow's machine name #24708 (b9d0c48a5d).
  • security(explain): explain's record-grained update verdict refuses a row an app-authored update policy admits, while the PATCH of that row is admitted (ADR-0105 D3 deferral missing on explain's record path) #24647 → PR fix(plugin-security): explain's record-grained write verdict composes the by-id write gate's authored-row-write deferral #24713 (71a8b5eed6).
  • plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2) #24709 → PR fix(plugin-security): the platform-admin promotion WITHHELD warning says what 18.0 supports for a v17 database #24718 (d0514e6863).
  • plugin-security: organisation admins assign positions and permission sets to their own members inside the D12 boundary — gate branch, overrides, explain and my-delegable-scope, three-posture acceptance (ruling B on #23960) #24136 → PR feat(plugin-security): organization administrators assign positions and permission sets inside the D12 organization boundary #24732 (b27f8ded5c; cloud session archived).
  • Decision needed: should the sys_attachment / sys_comment parent gates drop their own-depth sharing step now that they ask the parent's by-id update judgement (#7144 revisited)? #24646 → PR feat(service-storage, plugin-audit): the parent gates ask the parent's by-id update alone; explain composes the on-behalf-of write #24745 (1f949daeda). Contract review of record 6283270561 (CONTRACT_REVIEW_TIER, PASS).
  • plugin-security: the shipped permission sets stop copying the identity objects' row-scope literals once those objects declare them as their default row scope (#24340 follow-up, ruling E′ item 3) #24484 → PR fix(plugin-security): the shipped sets stop copying the identity objects' declared row scopes #24761 (7d45c8e29a), carrying Check Changeset's designed red.
  • plugin-security: an on-behalf-of by-id write can admit a row the delegator's own by-id write refuses, where an app-authored row-level write policy narrows the delegator (ADR-0090 D10) #24746 → PR fix(plugin-security): an on-behalf-of by-id write never admits a row its delegator's own by-id write refuses (ADR-0090 D10) #24792 (605b3e28b7). The reproduction stays in this session's scratchpad.
  • plugin-security: the delegated-administration gate's position walk does not count the permission set a position grants by its own name, so a delegate's allowlist check judges fewer sets than the assignment grants #24736 → PR fix(plugin-security): the delegated walk counts the permission set of the position's own name #24793 (21301a3406).
  • security: the auth IP allow-list does not resolve the client IP the way the runtime's trust-proxy rule does, and admits an undetermined IP (detail withheld under the disclosure ruling) #24739 → PR fix(plugin-auth): the auth IP allow-list judges the client address the server established #24795 (25e16ab00c).
  • plugin-approvals: the submitter is never notified of the final decision — approving or rejecting a request emits no notification to them #24753 → PR fix(plugin-approvals): the decision that ends an approval tells its submitter the outcome #24816 (7282a950b1).
  • group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784 → PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819 (8a058d85a3), the 18.0 queue-jump.
  • plugin-security: my-delegable-scope offers a platform administrator the built-in identity positions that sys_user_position refuses from every writer #24737 → PR fix(plugin-security): every delegable-scope branch leaves out the built-in identity positions #24826 (1366740c6c).
  • Setup → Authentication: controls that contradict the system — self-service registration ON while the audience is invitation only; Google login ON with no client id or secret #24776 → PR fix(service-settings): Setup → Authentication says what the sign-up and Google toggles do #24842 (4be7281311).
  • Setup → Email and SMS: Send test has nowhere to enter a recipient, and Email saves with its required fields empty #24767 → PR fix(plugin-email, service-sms): Send test goes to the signed-in admin when the request names no recipient #24848 (abd5acdaf7, half A). Half B by seat ruling 6289437546: the server keeps the TOUCH gate, and the renderer half is Settings pages: Save is accepted while a visible required field is empty — the console draws the required asterisk but never checks it, though the spec declares required as "renderer + server-side validation" objectui#13239. The card is closed; a veto reopens it.
  • plugin-auth: invite-member refuses an unknown role with no code — the spec docstring and auth docs promise ROLE_NOT_FOUND, so an ADR-0112 client cannot recognise the refusal #24750 → PR fix(plugin-auth): invite-member refuses an unknown role with code ROLE_NOT_FOUND #24846 (de9cd1f17f). Contract review of record 6289177621 (CONTRACT_REVIEW_TIER, PASS, isolated reviewer); cloud session archived.
  • approvals: remind() reports notified per slot, not per person — an approver listed twice on a per-group slate counts as two while one reminder is delivered #24751 → PR fix(plugin-approvals): a reminder's notified counts each approver address once, not once per slate slot #24855 (9a06f0be0f).
  • plugin-approvals: on a multi-step approval, every later step records the previous step's decider as its submitter, so submitter-only actions and submitter notices go to the wrong person (an unreleased regression of #24527) #24817 → PR fix(plugin-approvals): every step of a multi-step approval names the run's submitter, not the previous step's approver #24860 (28ff8a9ed8), before the unreleased feat(automation)!: an approval decision resumes a flow as the person who decided #24527 regression shipped.
  • Impersonating a user who must change their password strands the admin on that user's change-password screen #24762 → PR fix(plugin-auth): a credential-scope posture does not hold an impersonation session (#24762) #24866 (c2d4072281), B1 of ruling 6288774214. C is console: the password-change overlay covers the impersonation banner, so an admin impersonating a held user can only sign out — "Stop impersonating" is hidden behind it objectui#13208.
  • On PostgreSQL every webhook delivery is dropped at enqueue — "[webhook-auto-enqueuer] enqueue failed … Converting circular structure to JSON (Timeout)" — and the loss is logged at WARN #24835 round 1 → PR fix(plugin-webhooks): report a webhook delivery the outbox could not record at error, once per webhook #24862 (3fbef41b4a, Part of).
  • service-settings: on a deployment whose Google credentials come from GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, saving "Enable Google login" ON is refused as missing the client id and secret, while the login page offers Google #24844 → PR fix(service-settings): Google login saves ON when its credentials come from the server #24874 (fcb40ad673).
  • On PostgreSQL every webhook delivery is dropped at enqueue — "[webhook-auto-enqueuer] enqueue failed … Converting circular structure to JSON (Timeout)" — and the loss is logged at WARN #24835 round 2 → PR fix(driver-sql): update() stamps updated_at into a fresh object, never the caller's data #24906 (eee65afc89), the producer fix in driver-sql (cross-lane, declared 6289887999, landed note 6293740758). The card is closed.
  • A scaffolded app pointed at PostgreSQL is refused with "Run pnpm install && pnpm build", which does not fix it: the missing optional peer pg is reported as a build precondition #24909 → PR fix(service-datasource): a missing database client (pg, mysql2, better-sqlite3) is refused with its install, not the unbuilt-workspace build advice #24933 (ea08ce584c), the missing database client's install, plus the getting-started docs (round 2).
  • A declared webhook in a scaffolded app is silently inert: os validate passes without the 'webhooks' and 'realtime' capabilities, and with 'webhooks' alone the activation answers enabled while nothing is ever enqueued (WARN only) #24910 part (c) → PR fix(plugin-webhooks,runtime): a declared webhook the deployment can never deliver is reported at error and refused at the activation door #24946 (19e5338cc8, Part of): the boot error for an undeliverable declared webhook. Its squash title's "refused at the activation door" is stale; the door is unchanged.
  • fix(cli,service-datasource): under bin/run-dev.js (NODE_ENV=development) an unopenable SQLite datasource steps down to an in-memory engine, so a dev-mode os migrate audit-mail-bodies reports an unreachable archive as examined and clean #24950 → PR fix(service-datasource): in development, a SQLite file that cannot be opened or created fails its connect instead of stepping down to an in-memory engine #24955 (5d27d326c2): a development SQLite file-open failure no longer steps down to in-memory.
  • Setup: Notification Preferences and permission-set assignments are titled by raw user ids, not the person's name #24775 → PR fix(plugin-security): a permission-set assignment is titled by the person's name, not the raw user id #24885 (6440cf1633): permission-set assignments are titled by the person. The prelude stays at 8 reads in 4 round trips.
  • service-datasource: a missing optional @objectstack/driver-* package (turso, mongodb, sqlite-wasm) is refused with two contradictory fixes, the factory's install and the appended 'build precondition ... Run pnpm install && pnpm build' #24937 → PR fix(service-datasource): a missing optional driver package (turso, mongodb, sqlite-wasm) is refused with the factory's install alone, not the unbuilt-workspace build advice #24971 (b811c73696): a missing optional driver package ends on its install alone. It carried Check Changeset's DELIBERATE CORRECTION red under SKILL.md's three conditions, and corrected A scaffolded app pointed at PostgreSQL is refused with "Run pnpm install && pnpm build", which does not fix it: the missing optional peer pg is reported as a build precondition #24909's pending note.
  • Approvals show their flow and step names in the authoring language only: the request snapshots Flow.label / node.label at open, and the translation contract has no key for an approval step #24863 → PR fix(plugin-approvals): serve the approval flow, step and object labels in the reader's locale #24977 (ba69b168be): the approval flow, step and object labels in the reader's locale.
  • plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling) #24962 → PR fix(plugin-security): a controlled_by_parent detail's read scope requires object-level read on its master #24985 (9532e27886): a controlled_by_parent detail's read scope asks object-level read on its master first. The evidence is private, in this session's scratchpad.
  • plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling) #24986 → PR fix(plugin-security): the controlled_by_parent master-edit leg asks the master's own write-door question #25008 (aaee0840be): the master-edit leg asks the master door's object-level update question. Reach was measured privately; the unfixed path is plugin-security: one write path to a controlled_by_parent detail does not ask for edit access on its master, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25012.
  • plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply #24978 → PR feat(service-messaging,plugin-approvals): keyed notification text, rendered per recipient at delivery, so approval notifications reach each recipient in their own language #25014 (58cd58fa6c): keyed notification text, rendered per recipient at delivery. The seat ruled the snapshot-reservation question A; the maintainer's veto toward C stays open.
  • os migrate apply's account-issuer pre-flight report labels every colliding row's issuer (none): probeAccountIdentityCollisions reads issuer through the engine, which no longer projects the undeclared column #25030 → PR fix(plugin-auth): os migrate apply's account-issuer pre-flight names each colliding row's stored issuer #25056 (4bf079c693): os migrate apply's issuer pre-flight names each colliding row's stored issuer, and both CLI doors read through one reader. Clause-②: yes (widening), with plugin-auth as a minor. The optional retirement of the handed-find path was pointed to the cli seat (6309482297).
  • plugin-security: one more write to a controlled_by_parent detail is decided without asking for edit access on every master it involves, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25044 → PR fix(plugin-security)!: an update of a controlled_by_parent detail also asks for edit access on the master its body names (ADR-0055 §3) #25066 (f46ef4d70e): an update of a controlled_by_parent detail also asks for edit access on the master its body names. It is a verdict through the one chain walk, not a scope, and a BREAKING minor. Contract review of record: 6310100720 (PASS). Patch round 1 narrowed the headline before the queue.
  • outlets: every outlet that renders a text field into HTML escapes it by context (mail templates by default, HTML exports, integration payloads), pinned by an outlet list; sys_user.name maxLength held at the write seam (ruling 3C, #25040) #25061 → PR fix(service-messaging)!: an html or mjml notification template escapes every hole for markup, and each outlet package pins its outlet list (ruling 3C) #25076 (a39389eb51): an html or mjml sys_notification_template body escapes every hole's value for markup (ruling 3C), and each package that holds an outlet pins its outlet list. A BREAKING minor (Clause-②: no (narrowing) by claim amendment 6310385063), with the full dogfood battery green on its final head. Contract review of record: 6310965376 (PASS).
  • plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049 + plugin-security: under one master-reference declaration, a write to a controlled_by_parent detail is not held to ADR-0055's master invariant on every write shape (reach measured; detail withheld under the disclosure ruling) #25068 → PR fix(plugin-security)!: a batch create of a controlled_by_parent detail asks for edit access on every row's master, and an update no longer empties the master reference (ADR-0055 §1, §3) #25090 (3782b2df6e): a batch create of a controlled_by_parent detail asks for edit access on every row's master, and an update no longer empties the master reference. Both are verdicts through the one chain walk, shipped as a BREAKING minor. Contract review of record: 6312751822 (PASS). The seat redacted two clauses of it, and four passages of the dev's report, where they pointed at an unfixed path.
  • plugin-security: one write path to a controlled_by_parent detail does not ask for edit access on its master, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25012 → PR fix(plugin-security)!: an update or delete of a controlled_by_parent detail asks for edit access to its master on every write shape (ADR-0055 §3) #25042 (b2890909aa): an update or delete of a controlled_by_parent detail asks for edit access to its master on every write shape. It is a per-master verdict, not a scope, and a BREAKING minor. Contract review of record: 6308053259 (PASS). The changeset headline was narrowed to the verbs measured before the CHANGELOG published.
  • service-messaging: refuse sys_notification_template rows for a channel other than email or sms (the 19.0 half of ruling D) #24983 → PR fix(service-messaging)!: sys_notification_template refuses a channel other than email or sms, stored rows included #25028 (d68aab6fde): sys_notification_template refuses a channel other than email or sms, stored rows included (BREAKING minor). The contract review of record is 6306621951 (CONTRACT_REVIEW_TIER, PASS). It carried the DELIBERATE CORRECTION red for the pending service-messaging: sys_notification_template takes only the channels that read it (email, sms), by the maintainer's ruling D on #24770 #24924 note it corrected (6306367946), and the full dogfood battery ran green on its final code.
• Filed this term:
  • From plugin-security: organisation admins assign positions and permission sets to their own members inside the D12 boundary — gate branch, overrides, explain and my-delegable-scope, three-posture acceptance (ruling B on #23960) #24136: plugin-security: the delegated-administration gate's position walk does not count the permission set a position grants by its own name, so a delegate's allowlist check judges fewer sets than the assignment grants #24736 (landed), plugin-security: my-delegable-scope offers a platform administrator the built-in identity positions that sys_user_position refuses from every writer #24737 (landed), app-shell: the published README and the Setup holder sections still say objectstack's organization administrator is read-only on the assignment objects — objectstack#24732 gave it create and delete objectui#13119.
  • From Decision needed: should the sys_attachment / sys_comment parent gates drop their own-depth sharing step now that they ask the parent's by-id update judgement (#7144 revisited)? #24646: plugin-security: an on-behalf-of by-id write can admit a row the delegator's own by-id write refuses, where an app-authored row-level write policy narrows the delegator (ADR-0090 D10) #24746 (landed). Abstract only.
  • From security: the auth IP allow-list does not resolve the client IP the way the runtime's trust-proxy rule does, and admits an undetermined IP (detail withheld under the disclosure ruling) #24739: plugin-auth: the vendored auth library's own client-address reader does not follow server.trustProxy, so the addresses it records and keys on are not the ones the server established (detail withheld under the disclosure ruling) #24799 (abstract only) and spec + ADR-0069 D5: server.trustProxy's describe names only the rate limiter, and ADR-0069 D5's mechanism cell names the old header list; since PR #24795 the auth IP allow-list and the login audit consume the same rule #24818.
  • From plugin-approvals: the submitter is never notified of the final decision — approving or rejecting a request emits no notification to them #24753: plugin-approvals: on a multi-step approval, every later step records the previous step's decider as its submitter, so submitter-only actions and submitter notices go to the wrong person (an unreleased regression of #24527) #24817 (landed).
  • From group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784: a platform operator whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on an insert into a posture-permitting tenant object, under group and isolated alike #24821 (seat 2), group posture: a member's insert whose organization_id names another organization of its membership set is silently stored in the active organization (the engine's read-only strip), where #21666 ruled an explicit value meets the wall and is never rewritten #24822 and ADR-0123 D2 says "under group, no organization scope means an empty membership set"; since PR #24819 a union-scope insert with no active organization is refused too, so the ADR under-describes the runtime #24823.
  • From Setup → Authentication: controls that contradict the system — self-service registration ON while the audience is invitation only; Google login ON with no client id or secret #24776: service-settings: on a deployment whose Google credentials come from GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, saving "Enable Google login" ON is refused as missing the client id and secret, while the login page offers Google #24844 (landed).
  • From Setup: Notification Preferences and permission-set assignments are titled by raw user ids, not the person's name #24775: service-messaging: sys_notification_preference.user_id is a text column holding a user id or the sentinel '*', so the preference's title can only show the raw id; naming the person means re-typing it as a user reference (an accept-set narrowing) #24895 (the sys_notification_preference.user_id retype, breaking, the maintainer's) and core: the authz prelude reads sys_user_permission_set with no projection, so every formula on it runs per request; PR #24885's one-hop display title would add a sys_user read and a round trip for each principal with a direct grant #24896 (the engine lane: project the authz prelude's grant read).
  • From Setup → Email and SMS: Send test has nowhere to enter a recipient, and Email saves with its required fields empty #24767: Settings pages: Save is accepted while a visible required field is empty — the console draws the required asterisk but never checks it, though the spec declares required as "renderer + server-side validation" objectui#13239.
  • From A scaffolded app pointed at PostgreSQL is refused with "Run pnpm install && pnpm build", which does not fix it: the missing optional peer pg is reported as a build precondition #24909: service-datasource: a missing optional @objectstack/driver-* package (turso, mongodb, sqlite-wasm) is refused with two contradictory fixes, the factory's install and the appended 'build precondition ... Run pnpm install && pnpm build' #24937 (landed).
  • From A screen flow whose write node is refused shows the end user the engine's raw node text, in English, with the node id and the object API name ("Node 'create_account' failed: create_record(crm_account) failed: …") #24914: objectql: a unique refusal's user-facing sentence names the object by its API name ("Duplicate record refused on 'crm_account': …"), which a screen-flow user and a record-save user both read verbatim #24951 (domain:engine, a unique refusal names the object's API name).
  • From fix(cli,service-datasource): under bin/run-dev.js (NODE_ENV=development) an unopenable SQLite datasource steps down to an in-memory engine, so a dev-mode os migrate audit-mail-bodies reports an unreachable archive as examined and clean #24950: driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected #24960 (SQLITE_NOTADB, ruled A, the producer side) and driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist #24961 (the read-only probe reads an unopenable path as absent), both domain:engine.
  • From Approvals show their flow and step names in the authoring language only: the request snapshots Flow.label / node.label at open, and the translation contract has no key for an approval step #24863: plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply #24978 (the approval notifications' locale, landed) and spec: the translation liveness row flows.approvals still reads planned and ApprovalRequestRow's label docblocks still name the authored label, although PR #24977 is the reader that serves them in the reader's locale #24979 (the spec liveness flip and docblocks, domain:spec).
  • From plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling) #24962: plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling) #24986 (landed). Abstract only.
  • From plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling) #24986: plugin-security: one write path to a controlled_by_parent detail does not ask for edit access on its master, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25012 (landed). Abstract only.
  • From plugin-security: one write path to a controlled_by_parent detail does not ask for edit access on its master, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25012: plugin-security: one more write to a controlled_by_parent detail is decided without asking for edit access on every master it involves, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25044 (graded p1 by triage R553, landed) and plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049 (graded p1 by triage R555, in flight).
  • From plugin-security: one more write to a controlled_by_parent detail is decided without asking for edit access on every master it involves, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25044: plugin-security: under one master-reference declaration, a write to a controlled_by_parent detail is not held to ADR-0055's master invariant on every write shape (reach measured; detail withheld under the disclosure ruling) #25068 (measured; graded p1 by triage R557 and folded into plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049; landed with it).
  • From plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049: controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling) #25092 (the defect outside the detail write gate, measured; triage routed it to domain:spec, pm:awaiting-maintainer). From PR fix(plugin-security)!: a batch create of a controlled_by_parent detail asks for edit access on every row's master, and an update no longer empties the master reference (ADR-0055 §1, §3) #25090's contract review: plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095 (graded p2 by triage; this lane, the same gate region).
  • From outlets: every outlet that renders a text field into HTML escapes it by context (mail templates by default, HTML exports, integration payloads), pinned by an outlet list; sys_user.name maxLength held at the write seam (ruling 3C, #25040) #25061: rest: one server-rendered response may not escape a value by the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25077 and rest: one record export format may not neutralize a stored value for the context its consumer reads it in (reach not measured; detail withheld under the disclosure ruling) #25078 (packages/rest; graded p1 domain:cli by triage and dispatched in that lane). From PR fix(service-messaging)!: an html or mjml notification template escapes every hole for markup, and each outlet package pins its outlet list (ruling 3C) #25076's contract review: mail templates: a hole an author places in a template body may not be encoded for the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25082 (the two mail template renderers, unmeasured outside the tree; for triage).
  • All of these are abstract only. The first revisions of plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049, plugin-security: one more write to a controlled_by_parent detail is decided without asking for edit access on every master it involves, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25044 and plugin-security: under one master-reference declaration, a write to a controlled_by_parent detail is not held to ADR-0055's master invariant on every write shape (reach measured; detail withheld under the disclosure ruling) #25068 quoted dedupe query terms that name a shape. They were redacted within minutes, but their edit history keeps them, and removing that history needs a repo admin.
  • From plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply #24978: service-messaging: a notification digest of two or more items is headed "You have N notifications", an English literal, for every recipient whatever their language #25015 (the digest heading is an English literal for every recipient; graded p3 by triage, outside this term's p1–p2 scope).
• Queue snapshot (2026-10-21T10:18Z; domain:services; ⛔ re-read before acting):
  • pm:queue, unclaimed, not this seat's to dispatch now (p1 group posture: a member's insert whose organization_id names another organization of its membership set is silently stored in the active organization (the engine's read-only strip), where #21666 ruled an explicit value meets the wall and is never rewritten #24822 and p1 plugin-security / objectql: an on-behalf-of insert by a crossing platform operator that names no organization may be stamped outside the delegator's organization set (source reading only; measure reach first) #25063 are seat 2's, pm:dispatched; service-messaging: retire sys_notification_subscription (no runtime reader), by the maintainer's ruling D on #24770 #24923 is closed):
    • p3 service-messaging: sys_notification_preference.user_id is a text column holding a user id or the sentinel '*', so the preference's title can only show the raw id; naming the person means re-typing it as a user reference (an accept-set narrowing) #24895 is ruled A (6304380498, seat 2's decision), and out of this term's p1–p2 scope.
    • p3 service-datasource: Sync (remote-tables, object draft, import) answers on a managed datasource, though ADR-0015 §4.2 reserves federation for datasources whose schemaMode is not managed #24837's timing is the maintainer's, and out of this term's p1–p2 scope.
  • Seat 2 ([PM seat] domain:services · seat 2 — ⏳ vacant #21118) reads 🟢 os-support-ai (session_01UmqzD97e14iws6hmVhgZ5y). In flight there, by label at 2026-10-21T10:18Z: group posture: a member's insert whose organization_id names another organization of its membership set is silently stored in the active organization (the engine's read-only strip), where #21666 ruled an explicit value meets the wall and is never rewritten #24822 and plugin-security / objectql: an on-behalf-of insert by a crossing platform operator that names no organization may be stamped outside the delegator's organization set (source reading only; measure reach first) #25063. Setup: a position's same-named permission set is in force but invisible — the set's Assigned Users panel is empty and the position reads as granting nothing #24757's PR fix(plugin-security): the position-name fold warning says the same-name grant is removed in the next major #24988, Setup → Branding saves, but the workspace name, accent colour and logo change nothing in the app #24766, service-messaging: sys_notification_template takes only the channels that read it (email, sms), by the maintainer's ruling D on #24770 #24924 and OAuth app registration rejects http://localhost and http://127.0.0.1 redirect URIs as "non-loopback", with HTTP 500 #24773 have landed, and plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932 is pm:blocked.
  • pm:blocked: upgrade-impact comparison after v18: report the non-access classes to the administrator, and retire the zero-consumer package-upgrade.zod.ts #24447 (on upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446).
  • pm:on-hold: automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645, finding(service-automation,lint): the resume door evaluates a screen field's visibleWhen over the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring #20178, [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883.
  • tracking: service-storage: IStorageService.list(prefix) means two different things on the two shipped adapters (local: one level, directories as files; S3: recursive, silently capped at 1000) #5266.
• Previous term (marchtian, session_01Nk17Z26X5DB59iQztDBADH): its record is in the body revision of 2026-10-19T23:12Z and the sign-off brief 6279429458. ⛔ Not restated here.

3. Hot-file serial queue

• plugin-security/src/security-plugin.ts's assertControlledByParentWrite (the detail write gate): free since PR fix(plugin-security)!: a batch create of a controlled_by_parent detail asks for edit access on every row's master, and an update no longer empties the master reference (ADR-0055 §1, §3) #25090 landed (3782b2df6e). plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095 is its next card, in pm:queue. The read-scope region computeControlledByParentFilter belongs to plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932 (seat 2, pm:blocked on two engine cards).

• pnpm-workspace.yaml (the better-auth family overrides), pnpm-lock.yaml, and plugin-auth/package.json: deps(plugin-auth): lift the better-auth family from 1.7.3 to 1.7.12 — security fixes published after the 2026-10-01 deferral #25096 (cross-domain exception path, declared in its claim).

• The objectql engine's organization_id read-only strip: group posture: a member's insert whose organization_id names another organization of its membership set is silently stored in the active organization (the engine's read-only strip), where #21666 ruled an explicit value meets the wall and is never rewritten #24822, held (see 2).

• Free (landed this term):

  • service-messaging/src/template-renderer.ts and the three text-field-html-outlets.pin.test.ts pins (outlets: every outlet that renders a text field into HTML escapes it by context (mail templates by default, HTML exports, integration payloads), pinned by an outlet list; sys_user.name maxLength held at the write seam (ruling 3C, #25040) #25061);
  • service-storage/src/attachment-access-hooks.ts, plugin-audit/src/comment-access-hooks.ts, explain-enforce-parity.test.ts (Decision needed: should the sys_attachment / sys_comment parent gates drop their own-depth sharing step now that they ask the parent's by-id update judgement (#7144 revisited)? #24646);
  • invitation-placement.ts, auto-org-admin-grant.ts (plugin-security: organisation admins assign positions and permission sets to their own members inside the D12 boundary — gate branch, overrides, explain and my-delegable-scope, three-posture acceptance (ruling B on #23960) #24136);
  • bootstrap-platform-admin.ts (plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2) #24709);
  • sys-approval-request.object.ts (plugin-approvals: the served approval request page's H1 still reads flow:NAME · RECORD_ID — the approvals get serves no display_title, and the title names the raw record id (blocks objectui#12484) #24665);
  • default-permission-sets.ts (plugin-security: the shipped permission sets stop copying the identity objects' row-scope literals once those objects declare them as their default row scope (#24340 follow-up, ruling E′ item 3) #24484);
  • explain-engine.ts (plugin-security: an on-behalf-of by-id write can admit a row the delegator's own by-id write refuses, where an app-authored row-level write policy narrows the delegator (ADR-0090 D10) #24746);
  • delegated-admin-gate.ts (plugin-security: the delegated-administration gate's position walk does not count the permission set a position grants by its own name, so a delegate's allowlist check judges fewer sets than the assignment grants #24736, plugin-security: my-delegable-scope offers a platform administrator the built-in identity positions that sys_user_position refuses from every writer #24737);
  • security-plugin.ts step 3.7 (group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784);
  • client-address.ts and the D5 middleware (security: the auth IP allow-list does not resolve the client IP the way the runtime's trust-proxy rule does, and admits an undetermined IP (detail withheld under the disclosure ruling) #24739);
  • approval-service.ts decide() (plugin-approvals: the submitter is never notified of the final decision — approving or rejecting a request emits no notification to them #24753);
  • the auth manifest's sign-up and Google help (Setup → Authentication: controls that contradict the system — self-service registration ON while the audience is invitation only; Google login ON with no client id or secret #24776);
  • the mail and SMS test handlers (Setup → Email and SMS: Send test has nowhere to enter a recipient, and Email saves with its required fields empty #24767);
  • invite-role-not-found-code.ts and the ledger row (plugin-auth: invite-member refuses an unknown role with no code — the spec docstring and auth docs promise ROLE_NOT_FOUND, so an ADR-0112 client cannot recognise the refusal #24750);
  • approval-service.ts remind() (approvals: remind() reports notified per slot, not per person — an approver listed twice on a per-group slate counts as two while one reminder is delivered #24751), approval-node.ts and openNodeRequest (plugin-approvals: on a multi-step approval, every later step records the previous step's decider as its submitter, so submitter-only actions and submitter notices go to the wrong person (an unreleased regression of #24527) #24817);
  • auth-manager.ts customSession and computeAuthGate, and authentication.mdx (Impersonating a user who must change their password strands the admin on that user's change-password screen #24762);
  • auto-enqueuer.ts's lost-delivery report (On PostgreSQL every webhook delivery is dropped at enqueue — "[webhook-auto-enqueuer] enqueue failed … Converting circular structure to JSON (Timeout)" — and the loss is logged at WARN #24835 round 1);
  • the auth manifest's Google credential specifiers (service-settings: on a deployment whose Google credentials come from GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, saving "Enable Google login" ON is refused as missing the client id and secret, while the login page offers Google #24844);
  • driver-sql's update() and rotatedUpdateById() stamps (On PostgreSQL every webhook delivery is dropped at enqueue — "[webhook-auto-enqueuer] enqueue failed … Converting circular structure to JSON (Timeout)" — and the loss is logged at WARN #24835 round 2, the engine lane's file);
  • plugin-webhooks's auto-enqueuer gap report (A declared webhook in a scaffolded app is silently inert: os validate passes without the 'webhooks' and 'realtime' capabilities, and with 'webhooks' alone the activation answers enabled while nothing is ever enqueued (WARN only) #24910 part c);
  • sqlite-driver-fallback.ts's file-open re-throw (fix(cli,service-datasource): under bin/run-dev.js (NODE_ENV=development) an unopenable SQLite datasource steps down to an in-memory engine, so a dev-mode os migrate audit-mail-bodies reports an unreachable archive as examined and clean #24950);
  • sys-user-permission-set.object.ts's display_title (Setup: Notification Preferences and permission-set assignments are titled by raw user ids, not the person's name #24775);
  • connect-failure-remedy.ts's optional-package branch (service-datasource: a missing optional @objectstack/driver-* package (turso, mongodb, sqlite-wasm) is refused with two contradictory fixes, the factory's install and the appended 'build precondition ... Run pnpm install && pnpm build' #24937);
  • plugin-approvals's reader-locale-labels.ts (Approvals show their flow and step names in the authoring language only: the request snapshots Flow.label / node.label at open, and the translation contract has no key for an approval step #24863);
  • security-plugin.ts's computeControlledByParentFilter and its call sites (plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling) #24962), and assertMasterRowEditable's object-level leg (plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling) #24986);
  • service-messaging's notify / EmitInput contract, renderer and dispatcher, and plugin-approvals' emitters (plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply #24978);
  • service-messaging's notification-template.object.ts and its generated translations (service-messaging: refuse sys_notification_template rows for a channel other than email or sms (the 19.0 half of ruling D) #24983);
  • security-plugin.ts's predicate-write leg, controlledByParentPredicateWriteMasters and the extracted chain walk (plugin-security: one write path to a controlled_by_parent detail does not ask for edit access on its master, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25012).

• The 18.x epic ([epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194, body read in round 8) declares these regions:

  • stage 9: plugin-sharing's sharing-rule-service.ts, bootstrap-declared-sharing-rules.ts and the boot region of sharing-plugin.ts, plus the cli ownership inventory and apply files;
  • C8: the engine's tenant derivation, plugin-security/src/tenant-layer.ts, the driver tenant scope, and the NULL-organization readings feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 names, among them service-settings/src/settings-service.ts;
  • C9 and C11.

  18.0.0 is published (epic record 6291577585); ⛔ re-read [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 for step 7's remaining parts before relying on any. ⛔ A lane card whose fix lands in a declared region comments on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 first.

• Known stale code comments (a record of fact; no card carries them):

  • checkAuthoredRowWrite's docblock;
  • three future-tense 18.x ceremony comments;
  • auth-manager.ts above beforeCreateInvitation;
  • comment-access-hooks.ts's header;
  • sys-approval-token.object.ts's "get/list doors";
  • reconcileFederatedBindings' docblock;
  • docs/design/permission-model.md §10;
  • system-context.mdx row 9b;
  • the engine.ts post-image seam comment (PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819);
  • the DelegableScope.isTenantAdmin TSDoc and delegated-administration.mdx's "everything" (PR fix(plugin-security): every delegable-scope branch leaves out the built-in identity positions #24826);
  • the auth manifest's email_password and membership group descriptions, which still say "self-service registration" (PR fix(service-settings): Setup → Authentication says what the sign-up and Google toggles do #24842).

• Cross-lane declarations this term:

  • domain:devx 6281309676 (plugin-security: organisation admins assign positions and permission sets to their own members inside the D12 boundary — gate branch, overrides, explain and my-delegable-scope, three-posture acceptance (ruling B on #23960) #24136);
  • spec seat 6282098886 (Decision needed: should the sys_attachment / sys_comment parent gates drop their own-depth sharing step now that they ask the parent's by-id update judgement (#7144 revisited)? #24646);
  • domain:engine 6283774501 (plugin-security: the shipped permission sets stop copying the identity objects' row-scope literals once those objects declare them as their default row scope (#24340 follow-up, ruling E′ item 3) #24484);
  • domain:cli 6285254652 (security: the auth IP allow-list does not resolve the client IP the way the runtime's trust-proxy rule does, and admits an undetermined IP (detail withheld under the disclosure ruling) #24739);
  • the spec lane's pre-approved ledger append (plugin-auth: invite-member refuses an unknown role with no code — the spec docstring and auth docs promise ROLE_NOT_FOUND, so an ADR-0112 client cannot recognise the refusal #24750, claim 6286575652);
  • the epic 6289289257 (group posture: a member's insert whose organization_id names another organization of its membership set is silently stored in the active organization (the engine's read-only strip), where #21666 ruled an explicit value meets the wall and is never rewritten #24822, open);
  • domain:engine 6289887999 (On PostgreSQL every webhook delivery is dropped at enqueue — "[webhook-auto-enqueuer] enqueue failed … Converting circular structure to JSON (Timeout)" — and the loss is logged at WARN #24835 round 2, driver-sql), no objection, landed note 6293740758;
  • domain:cli 6295927555 on [PM seat] domain:cli · seat 2 — 🟢 os-justin · session_01LmjU2x1faLZ39DVTFyVca6 #22648 (A declared webhook in a scaffolded app is silently inert: os validate passes without the 'webhooks' and 'realtime' capabilities, and with 'webhooks' alone the activation answers enabled while nothing is ever enqueued (WARN only) #24910), released at landing: no cli file was touched.
  • Received: domain:engine 6296470031 (core: the authz prelude reads sys_user_permission_set with no projection, so every formula on it runs per request; PR #24885's one-hop display title would add a sys_user read and a round trip for each principal with a direct grant #24896's PR fix(core): the authz prelude's grant read projects the columns it decides on #24941, test-only in this lane). No objection; fix(plugin-security): a permission-set assignment is titled by the person's name, not the raw user id #24885's one-line change to that pin was told on [PM seat] domain:engine — 🟢 os-project-manager #6367.
  • Received: domain:engine 6302719803 (platform-objects: deleting a business unit that has children silently turns them into tenant roots — parent_business_unit_id declares no deleteBehavior and takes set_null #24939, test-only in plugin-sharing). No objection.
  • Received: seat 2's serial note 6301536287 (Setup: a position's same-named permission set is in force but invisible — the set's Assigned Users panel is empty and the position reads as granting nothing #24757, a disjoint region of security-plugin.ts). No objection.
  • domain:engine 6304826207 on [PM seat] domain:engine — 🟢 os-project-manager #6367 (feat(plugin-email,plugin-security): organization admins read their own organization's mail bodies again (option B), once one exported identity selector exists #24898), released 6308816325 after the maintainer closed the card.
  • domain:cli 6307316050 on [PM seat] domain:cli · seat 2 — 🟢 os-justin · session_01LmjU2x1faLZ39DVTFyVca6 #22648 (os migrate apply's account-issuer pre-flight report labels every colliding row's issuer (none): probeAccountIdentityCollisions reads issuer through the engine, which no longer projects the undeclared column #25030, account-issuer.ts, a shared-reader adoption only), released at landing (6309482297).
  • Received: domain:engine seat 2 6303712546 (driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected #24960, driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist #24961 in sqlite-driver-fallback.ts). This lane has no in-flight card on that file, so no objection.

4. Standing facts measured in this lane — ⛔ re-measure before relying, but do not re-discover

• 🔴 The agent roster is fixed at SESSION CREATION. A seat spawned without a repo source can attach the repo mid-session and gain its skills, but ⛔ never its agents. A successor must carry the repo in session_context.sources at creation and confirm os-dev before claiming. The confirming reading is an accepted Agent call.

• ⭐ The account's 5-hour usage wall can stop every in-session subagent at once. After the reset, each dev was resumed with SendMessage on its own context. ⛔ No order was re-run, and ⛔ no branch was re-cut. Read each dev's worktree and branch before trusting a resume note.

• CI must be read latest-run-per-check-name (platform-readings.md).

• ⭐ A check_run.completed failure event can name a superseded head. Read the PR's current head before diagnosing.

• mergeable_state: blocked right after a ready-flip is a transient. Queue entry typically follows within 2–5 minutes.

• ⭐ The CI job-log download is refused from this container (403 from the blob host). MCP get_job_logs reads it.

• ⭐ The footer behaviour of a body write depends on the CHANNEL. The fleet relay's issue_patch stores a body VERBATIM. Send the footer you want stored, and read back after every write.

• ⭐ post-stamped enforces the stamp contract. A body carrying {{NOW}} refuses any other bare stamp; write a quoted instant as {{WAS:…}}. A backticked token is left verbatim. It also refuses a Thread-read: line with anything after its value.

• ⭐ A comment POST normalises whitespace ⇒ read-back checks compare fragments, not bytes.

• The REST /search/* path is refused in this container. Dedupe searches run through the MCP search_issues READ tool, with a positive control. ⛔ It is never a write channel.

• ⭐ MCP search_issues is semantic and can lag or go blank. For lane and label reads use list_issues with labels: and compare against totalCount; ⛔ MCP list_issues with two labels is a UNION, not an intersection (re-measured at this seating: pm:queue + domain:services returned 26 cards spanning other lanes). Read the lane with one label and intersect locally.

• ccr/auto_merge echoes merge_method back wrongly, and right after queue entry auto_merge can read null or false ⇒ the landing criterion is the timeline's added_to_merge_queue and delivery on origin/main, ⛔ never the PR-closed event.

• A closing keyword does NOT clean the board. After every Fixes landing, read the card, then clear pm:* and the assignee with a note.

• ⭐ Auto-merge can sit un-queued with an idle queue. One relay automerge_disable + automerge_enable pair queues it at once (re-measured on PR fix(service-datasource): a missing database client (pg, mysql2, better-sqlite3) is refused with its install, not the unbuilt-workspace build advice #24933: 5 minutes un-queued, then queued within the minute).

• ⭐ scripts/pm/fleet-write/dispatch.mjs needs --repo objectstack-ai/objectstack with --actions-file.

• ⭐ This session cannot write to objectstack-ai/cloud. A cloud follow-up goes to the repo:cloud seat on its post ([PM seat] repo:cloud#1 — 🟢 baozhoutao · session_01FSg7JRUiTPo8GrgT38tAWP #6026).

• ⭐ A dev's public report can carry a security reproduction. Read every report and PR body for disclosure before anything else.

• ⭐ Whole-machine restarts come under parallel heavy dev work. Every order puts every build, test run, typecheck and gate run under scripts/pm/os-verify-lock.sh.

• ⭐ Hosted runners can starve for hours; a relay write can exit 6 having written nothing. Read the run and the target before a resend.

• ⭐ issue-create can report UNVERIFIED although the issue exists. Read the board; ⛔ never retry blind.

• check-expected-skips.mjs / check-half-states.mjs will not run without pnpm install (yaml not found). The shared checkout has no node_modules at this seating; post-stamped, label-write, dispatch-gates, git-history and check-harness-current run without it (self-tests green at seating).

• The dev writes a PR body once and ⛔ never PATCHes it ⇒ on a patch round the seat appends the dev's markdown, marked as the seat's append.

• ⭐ git-history.mjs touch REFUSES rather than guessing, and that refusal is load-bearing on a shallow clone.

• ⭐ Token grep answers 「does this string appear」, ⛔ not 「is it declared / executed」.

• Publication layer for this repo: a merge to main does ⛔ not publish ⇒ the landing criterion is MERGED, except a fix whose consumer is another repo, judged on installability (objectui pins by .objectstack-sha; plugin-approvals: the served approval request page's H1 still reads flow:NAME · RECORD_ID — the approvals get serves no display_title, and the title names the raw record id (blocks objectui#12484) #24665's unlock for objectui#12484 is the pin bump, not the close).

• ⛔ cloud and hotcrm are not reachable from this session. objectstack-ai/objectui is readable, and the fleet relay writes to it.

• ⭐ The contract-review tier constant is CONTRACT_REVIEW_TIER in scripts/pm/dispatch-gates.mjs (read it there). dispatch-gates --tier says a card that only narrows owes one such review before the queue. contract-review.md scopes the owed review by face.

• ⭐ Merge-queue timing: pr_ready + automerge_enable via the relay → added_to_merge_queue about 2 minutes later → merged about 30 minutes after entry.

• ⭐ A merge-queue kick can be infrastructure (artifact upload ETIMEDOUT); the merge-queue-triage comment arrives only after the whole queue run concludes.

• ⭐ post-stamped refuses an all-quoted stamp: a claim whose only stamp sits inside a code span is refused, nothing written. Put {{NOW}} on the opening line (Claim: PM loop round N · then the token). It also refuses a body rewrite whose opening line carries another act's stamp (a director Ruled: line): add the new line ABOVE and keep Ruled: verbatim beneath (measured on Decision needed: should the sys_attachment / sys_comment parent gates drop their own-depth sharing step now that they ask the parent's by-id update judgement (#7144 revisited)? #24646).

• ⭐ Write order for a claim: post the Claim: comment first, then the label pair, and gate the label write on the claim's exit. Labels first and a refused comment leave a live half-state. This was measured on plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2) #24709, and again on os migrate apply's account-issuer pre-flight report labels every colliding row's issuer (none): probeAccountIdentityCollisions reads issuer through the engine, which no longer projects the undeclared column #25030 at 2026-10-21T03:28Z: the claim was refused for a Thread-read: value that was neither an id nor none, the chained label write still ran, and the claim was reposted within the minute. A card with no comment takes Thread-read: none.

• ⭐ A cloud session spawned by create_session carries no mcp__github__* tools. Its dev reads and writes through REST and the fleet relay; the report arrives as an os-dev-report comment on the card. get_session's task_summary is the cheap liveness reading.

• ⭐ governedPathsIn (scripts/pm/check-governed-merges.mjs) takes the register id (objectstack, objectui, …), ⛔ not the owner/name slug: a slug is refused, never answered as clear. Measured at PR feat(plugin-security): organization administrators assign positions and permission sets inside the D12 organization boundary #24732's review.

• ⭐ A console check that needs no objectui code can be measured by a read-only static subagent over /home/user/objectui: PR feat(plugin-security): organization administrators assign positions and permission sets inside the D12 organization boundary #24732's Add / Remove and invite-placement readings came from one, cited file:line in the ACCEPT.

• ⭐ A PR that corrects a PENDING release note it made false turns Check Changeset red by design (check-empty-changeset.mjs, the DELIBERATE CORRECTION class; only that one step fails). pr-automation.yml runs on pull_request only, so SKILL.md's three-condition rule lets the seat carry the red into the queue with the gate and the reason in its ACCEPT (measured on PR fix(plugin-security): the shipped sets stop copying the identity objects' declared row scopes #24761).

• ⭐ A security reproduction a dev reports goes to the seat by private channel (SendMessage to the dev, the reply kept in this session's scratchpad), and the filed card stays abstract. The fix dev gets the reproduction in its dispatch order (measured with plugin-security: an on-behalf-of by-id write can admit a row the delegator's own by-id write refuses, where an app-authored row-level write policy narrows the delegator (ADR-0090 D10) #24746).

• ⭐ check_suite.completed on a subscribed PR is a wake, never a release reading: read the check-runs on the head and trial-merge before the relay flip. A git merge-tree trial needs the PR head fetched into a NAMED ref: FETCH_HEAD after a two-ref fetch is the first ref, and merging main with itself reads clean (measured here).

• ⭐ 18.x upgrade harness (opt-in) reads skipped on every PR without the needs:upgrade-harness label. It is on check-expected-skips.mjs's roster, so it is an expected skip, not a gap (measured on PRs fix(plugin-approvals): the decision that ends an approval tells its submitter the outcome #24816 and fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819).

• ⭐ A merge notification can be missed (PR fix(plugin-auth): the auth IP allow-list judges the client address the server established #24795, landed with no event here). At every wake, read the PR state of everything in landing; ⛔ never wait on the event alone.

• ⭐ The relay's issue_patch op edits a PR body too ({op:'issue_patch', issue:N, body}). The seat used it for PR fix(plugin-approvals): the decision that ends an approval tells its submitter the outcome #24816's Clause-② line after a claim amendment. Read the body back first: a REST read may already show a bare #N expanded.

• ⭐ A QA pass files one card per defect with no per-fire quota (filing-gate.md a43405d59, docs(pm-dispatch): concentrated test runs file one card per defect, with no per-fire quota #24743). Its cards arrive in pm:queue, graded, with no triage comment. Open + queue label + no assignee is dispatchable (SKILL state table); the card's own ## Seat review names the landing.

• ⭐ The contract-tier review runs as an isolated Agent call on the tier's model. It gets the brief from record-recognisers.mjs --brief-template and posts its own record through post-stamped.mjs. The seat reads that record back and checks its Served-tier and Local-runs before the ACCEPT. Measured on PR fix(plugin-auth): invite-member refuses an unknown role with code ROLE_NOT_FOUND #24846 (record 6289177621, PASS).

• ⭐ A patch round that narrows a PR's scope must also fix the PR's TITLE before landing. The squash takes the title, and main's history cannot be rewritten afterwards (PR fix(plugin-webhooks,runtime): a declared webhook the deployment can never deliver is reported at error and refused at the activation door #24946's squash still says "refused at the activation door").

• ⭐ A PR body edit re-runs PR Automation. Auto Label and Check PR Size then read skipped on the head, which is an expected skip on check-expected-skips.mjs's roster. The claim-gate checks ("The card this PR closes must claim this branch" and its siblings) re-run too: read their LATEST run after a first-line flip (measured on PR fix(plugin-security): a permission-set assignment is titled by the person's name, not the raw user id #24885).

• ⭐ A merged PR's timeline also carries removed_from_merge_queue. A poll must read merged before it treats a queue removal as a kick (measured on PR fix(service-datasource): a missing optional driver package (turso, mongodb, sqlite-wasm) is refused with the factory's install alone, not the unbuilt-workspace build advice #24971).

• ⭐ A container restart mid-landing: the relay strokes already dispatched still complete. Read the PR's comments and timeline before re-running anything (measured on PR fix(plugin-approvals): serve the approval flow, step and object labels in the reader's locale #24977: the ACCEPT, the pointer, ready and auto-merge had all landed). Subagent devs are resumed with SendMessage after the seat reads each worktree and branch.

• ⭐ This seat's land-pair.sh now refuses when the ACCEPT's 40-hex head is not the PR's live head, or when MAIN_SHA is still a placeholder. A full sha is never typed from memory.

• ⭐ check-harness-current can read STALE mid-term on a .claude/hooks/* touch alone. Re-pinning the clean shared checkout to a detached origin/main at the round boundary reads CURRENT again (measured at 2026-10-20T14:52Z, 7e40e8a03a).

• ⭐ A dev can add a workspace devDependency without re-resolving the lockfile. A plain pnpm install rewrote unrelated peer strings; the dev hand-inserted only the 3-line importer entry, and pnpm install --frozen-lockfile plus CI's Validate Package Dependencies judged it (PR fix(driver-sql): update() stamps updated_at into a fresh object, never the caller's data #24906).

• ⭐ On a security-family card, dedupe is recorded as hit counts only. The query terms stay private, because a query names the shape it searches for (the slip measured on plugin-security: the controlled_by_parent detail write gate may not ask the master-edit question on one more write shape, where ADR-0055 §3 requires it (reach not measured; detail withheld under the disclosure ruling) #25049, plugin-security: one more write to a controlled_by_parent detail is decided without asking for edit access on every master it involves, where ADR-0055 §3 requires it (reach measured; detail withheld under the disclosure ruling) #25044 and plugin-security: under one master-reference declaration, a write to a controlled_by_parent detail is not held to ADR-0055's master invariant on every write shape (reach measured; detail withheld under the disclosure ruling) #25068). The same goes for a closed card whose public title names the shape ([finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964, A stripped master-detail repoint unlocks a parent-scoped readonlyWhen: a by-id update judges the lock against the parent it names, not the parent it stores #19853, Freeze note on assertControlledByParentWrite — the guard is the sole enforcement for three authorable master-reference shapes until the #8772 ramp completes #9137). A dev's public report and PR body are scanned for both before anything else.

• ⭐ A breaking PR owes the full dogfood battery on its final head (docs(os-dev, pm-dispatch): a breaking PR runs the full dogfood battery on its final head; the review checklist reads the field before arming #24917, be1fd311b1). That means a ! title or a (narrowing) arm, yes or no. The dev records it in dogfood_battery, and the seat reads that field before ready, auto-merge or queue; a missing or narrowed run is REWORK. A dev dispatched before a role-file change is told by SendMessage, because its base and its loaded definition predate the change.

• ⭐ close-cards.mjs skips a card that still has an assignee, and expects pm:queue by default. To close a card still under pm:dispatched, clear the label and the assignee with label-write first, then run close-cards --stateless. One relay stroke then carries the comment and the close. Measured on Setup → Email and SMS: Send test has nowhere to enter a recipient, and Email saves with its required fields empty #24767.

5. Notes

• [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 (the v18 gate) is CLOSED. ADR-0131 cards no longer need the per-card authorisation recorded.
• 🔴 refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 belongs to the C2/C3 cutover's epic PM (batch Release version 0.4.0 #310, 6094179271, rule 1); the delegation record is in [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194's body. ⛔ This seat claims neither refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 nor feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's stages.
• ⚠️ Patrol anchor [Half-state patrol] check-half-states live sweep — generated view (please pin) #9857 is TRIMMED: the absence of a row naming this lane is not a clean board.

Generated by Claude Code