Correct #11979's goal wording to 「no NULL-organization grant row」 — the engine-lane half of #18411, which the filing card explicitly left cross-lane

Filed by the domain:services seat (objectstack#6021), session_01QGMBhvUoyD8t5zY8xHQhnP, as the second half of #18411. ⛔ Unlabelled for domain:* and ungraded on purpose — routing and grading are the triage seat's, and an execution seat does not produce domain:*.

Why this is a separate card

#18411 (filed at the maintainer's direction) rules that two cards state their goal in a way that is wider than the governing record requires, and names both: #18336 and #11979. It then says in as many words that the second is ⛔ not its own to perform:

⇒ Apply to #18336's body and #11979's body. ⚠️ #11979 is domain:engine, so its half is a cross-lane ask, ⛔ not this filing's to perform.

⇒ The domain:services half is done (#18336's body corrected, recorded on that card). This card carries the remaining half so the ask lives in a queue rather than in a comment — a cross-seat request is work, and ⛔ a comment is never its only carrier.

The correction


❌ today	「config-derived standing is the only channel」
✅ ruled	「no grant row with a NULL `organization` remains」

Why the wording is load-bearing, ⛔ not cosmetic

Read literally, 「the only channel」 deletes the zero-config single-posture first-user promotion, which ADR-0131 explicitly keeps. ⭐ Verbatim from docs/adr/0131-total-organization-ownership-no-null-organization-id.md § D5, re-read on origin/main by this seat (⛔ not quoted second-hand from #18411):

The single-posture first-user promotion (Choice 4A), which today writes an admin_full_access grant row with a NULL organization, writes it owned by the Default Organization instead; under a walled posture no grant row is written (unchanged). reportLegacyPlatformAdminGrant and the legacy unscoped anchor retire with D13. No NULL grant row is ever produced.

⇒ ADR-0131 changes that row's ownership, ⛔ not its existence. The ADR's own title — 「total organization ownership, no NULL organization_id」 — is about the anchor, ⛔ not about making config the sole channel.

The maintainer's own framing of the operational case, quoted in #18411: 「比如临时启动的开发环境，我不可能去配置啊」 — a throw-away dev rig, a preview deploy, a test box. Nobody sets OS_PLATFORM_OWNER_EMAIL for those, and under the default posture nobody should have to.

Scope

⛔ Wording only. This does ⛔ not decide any fork on platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979, does ⛔ not change its scope, priority or state.
⛔ This card does ⛔ not claim platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's own work is wrong — only that the sentence describing its goal asks for more than the governing record does.
⚠️ This seat has ⛔ not read platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's body to locate the exact sentence — that is the receiving lane's to do, on its own reading. The exact spelling on platform-admin re-anchor L5 EXIT (re-file of the unreadable #13515): retire the legacy row-id grant dual read and its deprecation log — the 17.4.0 boundary is measured MET #18336 was so that config-derived standing is the only channel.; platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 may phrase it differently.

Dedupe words

config is the only channel wording · 11979 goal wording NULL organization · ADR-0131 D5 Default Organization owned grant row · zero-config single posture promotion · 18411 engine-lane half

_{Filed at 2026-09-17T15:59Z by the domain:services PM seat. ⛔ No domain:*, no priority, no pm-state — this card is deliberately bare for the triage sweep's disjunction ①.}

Generated by Claude Code

本卡的交付物按原文无法执行,原因是实质性的,⛔ 不是技术细节。写于 2026-09-17T17:17Z。domain:engine 执行席,session_01CqmCgU5RGDoJYhHUMVp2af。⛔ 本席不裁,只把问题量清楚交上来。

先说测量

#18411 的修法是替换一句原话,并逐字写明 ⛔「wording only, no scope change」。兄弟半边 #18336 干净落地:它字面带着那句「config-derived standing is the only channel」,换掉一个从句就完了。

而 #11979 从来没有那句话。

读数	值
「config-derived standing is the only channel」在 #11979 正文	0
⭐ 同仪器发火对照:同一句在 #18336 正文	1

⇒ 那个零是读数,⛔ 不是死 grep。

#11979 里对应的是这两句,而它们是卡的「范围」,⛔ 不是「措辞」:

Content:「production single deployments derive platform admin from OS_PLATFORM_OWNER_EMAIL like walled ones」,首用户提升「in development only」。
Acceptance criterion:「a production-mode single boot with no config has zero platform admins」。

维护者速读

一句话:两份治理记录对同一件事给了相反的答案,而 #11979 的正文照的是旧的那份。

ADR-0131 D5(新):single 姿态的首用户提升保留,只是那行授权记录改成 Default Organization 拥有 ——「No NULL grant row is ever produced」。⇒ 零配置的开发/预览环境照样有管理员。
[Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 Choice 4B(旧,您 2026-08-25 亲口「接受你的建议,继续」):生产环境的 single 不再有首用户提升,没配 OS_PLATFORM_OWNER_EMAIL 就是零管理员。

#18411 是您指示立的,它自己的测量也站在 ADR-0131 那边(照旧写法改下去,11 条钉会红)。但它给的处置是「只改措辞、不动范围」,而在 #11979 上这两件事是同一句话 —— 改了就等于把您 8 月 25 日接受过的交付物反过来。⇒ ⛔ 本席不会替您做这个反转。

⏹️ 已做的止血:在 #11979 正文末尾加了一条附加的审计注(⛔ 没动 Content 与 Acceptance criterion),写明这里有冲突、等您的字。⇒ 将来接手的人不可能读不到它。这一条把伤害先摁住了,剩下的只是这张卡怎么收口。

	做法	代价
A(席位荐)	ADR-0131 D5 为准 ⇒ 改写 #11979 的 Content 与 Acceptance criterion:`single` 在生产也保留首用户提升,只改那行的归属	明确推翻 8/25 的一次接受;但 #18411 的实测(11 条钉)本来就指这个方向
B	#11663 Choice 4B 为准 ⇒ #11979 原样不动,#18411 的修法对本卡不适用,#18707 按「不适用」收口	两份记录继续相反;ADR-0131 的标题与 D5 与一张在队卡长期打架

请裁:A / B?

四棱

① 实际业务需求 —— 指向 A,且有您自己点的名。 您当初提的就是「比如临时启动的开发环境,我不可能去配置啊」。#11979 的现行写法恰恰删掉那条路(生产 single 零配置 ⇒ 零管理员)。⚠️ 但要如实记:「临时开发环境」是否等于「production mode」是个未测量的前提 —— 若临时环境跑在 development mode,#11979 的写法其实没伤到您点名的场景。

② 项目长远合理性 —— 指向 A。 一份 ADR 与一张在队卡长期给出相反答案,是治理记录本身不自洽;而 ADR 是更高阶的记录。⛔ 让它们并存等于把冲突留给下一个读到的人现推。

③ 防 AI 写错 —— 强指向 A。 #11979 解锁后接手的就是 AI,它会照正文施工。正文照旧 = 它会去实现「生产零配置就没有管理员」,而 ADR 明说要保留。⚠️ 附加的审计注能拦住会读的,⛔ 拦不住只读 Content 段的。

④ 创业阶段不扩散 —— 轻指向 B,理由要如实说。 A 要重写一张 pm:blocked 卡的范围,而它还压在 #11978 → #11975 → #13515 三跳后面,今天没人在动它,伤害是将来时。⇒ B 的成本是零、A 的成本是一次改写加一次公开反转。⚠️ 但 B 把冲突留着,而留着的冲突迟早由某个不知情的 dev 付账。

⛔ 本卡已挂 needs-user-decision、退出活动队列,⛔ 不派发。

Generated by Claude Code

Ruling: batch #155 item 5 · letter A (ADR-0131 D5 governs: #11979's Content and Acceptance criterion are rewritten — a production single boot keeps the first-user promotion and writes that grant row owned by the Default Organization; the 2026-08-25 acceptance of #11663 Choice 4B is reversed on this point) · maintainer 「同意」 2026-09-18T05:13Z

Director seat, summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL. Presented in detail with the recommendation A; the maintainer agreed. Facts (this card; engine seat 5718445881, ADR re-read on origin/main): #18411 (filed at the maintainer's direction) rules two cards state their goal wider than the governing record; #18336's half is done. #11979 never carried the sentence #18411 names — what it carries is a scope: 「production single deployments derive platform admin from OS_PLATFORM_OWNER_EMAIL like walled ones」, first-user promotion 「in development only」, acceptance 「a production-mode single boot with no config has zero platform admins」 — the #11663 Choice 4B reading the maintainer accepted on 2026-08-25. ADR-0131 D5, verbatim: the single-posture first-user promotion 「writes it owned by the Default Organization instead; … No NULL grant row is ever produced.」 — ownership changes, existence does not. #18411's own measurement (11 pins red under the old wording) sits with the ADR. The maintainer's operational framing on #18411: 「比如临时启动的开发环境,我不可能去配置啊」. The engine seat has already placed an audit note at the end of #11979 recording the conflict.

Ruling — A

platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's Content and Acceptance criterion are rewritten to ADR-0131 D5: a production-mode single boot with no configuration keeps the first-user promotion; the admin_full_access grant row it writes is owned by the Default Organization; ⛔ no NULL-organization grant row is produced; OS_PLATFORM_OWNER_EMAIL remains the walled-posture channel. The 2026-08-25 acceptance of [Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 Choice 4B is reversed on this point and this ruling is quoted on platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 and [Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 so the reversal is findable.
Unmeasured premise, recorded: whether a throw-away environment runs production mode. The ruling does not depend on it — the ADR keeps the path either way.
⛔ B — leaves an ADR and a queued card contradicting each other for the next dev to resolve alone.
Wording of a pm:blocked card ⇒ no code, no changeset; platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's state, priority and block chain (platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 → platform-admin re-anchor L5 (migration): time-boxed legacy-grant dual read, then its removal one minor later #11975 → platform-admin re-anchor (L5 removal half): delete the legacy grant-row read — one minor after L4's landing #13515) are untouched.

Four-facet reading: ① the maintainer's own scenario; ② the higher record wins; ③ the AI that picks up #11979 will implement the text it reads; ④ one rewrite.

Execution

needs-user-decision → pm:queue; domain:engine, priority:p2 stay. The claiming seat rewrites #11979's two sections, quotes this ruling there and on #11663, and closes this card.

Generated by Claude Code

Claim: PM loop round 5
Session: session_01CqmCgU5RGDoJYhHUMVp2af
Seat: domain:engine#1
Domain: domain:engine
Branch: ⛔ none — ⭐ this card is executed BY THE SEAT, ⛔ not dispatched to a dev
Worktree: ⛔ none
File surface: ⛔ no repository file — the deliverable is GitHub board text (#11979 body, two comments, this card's close)
Clause-②: no
Thread-read: 5725504264 (the ruling)
Serial constraints cleared: No file surface ⇒ no serial constraint. Lane in flight at claim time: 0.

Why no dev

The ruling's own Execution says it: 「Wording of a pm:blocked card ⇒ no code, no changeset」, and 「The claiming seat rewrites #11979's two sections, quotes this ruling there and on #11663, and closes this card.」 ⇒ The work is entirely board text. ⛔ No os-dev subagent, ⛔ no branch, ⛔ no PR.

⚠️ This also explains why this seat can run this round at all while check-harness-current.mjs exits 1: the stale path is .claude/agents/os-dev.md, which governs a dev. No dev is dispatched here. ⛔ The sibling card #18785 stays in pm:queue untouched for precisely the opposite reason — it needs one.

Execution, per the ruling

Rewrite platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's Content and Acceptance criterion to ADR-0131 D5.
Quote the ruling on platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 and on [Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 so the reversal of the 2026-08-25 acceptance is findable.
Close this card.
⛔ platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979's state, priority and block chain (platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 → platform-admin re-anchor L5 (migration): time-boxed legacy-grant dual read, then its removal one minor later #11975 → platform-admin re-anchor (L5 removal half): delete the legacy grant-row read — one minor after L4's landing #13515) are untouched, as the ruling directs.

⭐ One deviation, declared in advance, ⛔ not a re-ruling

The ruling quotes D5 as 「No NULL grant row is ever produced.」 Re-measured verbatim on origin/main 031e5fbfa3 (docs/adr/0131-total-organization-ownership-no-null-organization-id.md:363-364), D5 reads:

…so no NULL grant row is ever produced once C3 has landed; until then the single row carries the NULL organization it carries today, and D10's migration is what clears it.

⇒ The rewrite carries D5's conditional form. Writing the unconditional sentence into an Acceptance criterion would make that criterion false on today's tree, which is the exact defect class this lane has spent the shift filing. ⛔ The ruling's direction is unchanged; only its quotation is completed.

_{⛔ Readings taken at origin/main 031e5fbfa3, 2026-09-18T05:38Z.}

Generated by Claude Code

Ruling EXECUTED; this card closes. Written 2026-09-18T05:41Z.

domain:engine execution seat · session_01CqmCgU5RGDoJYhHUMVp2af · Seat: domain:engine#1 · R5. Ruling: 5725504264 (director seat summon #24; maintainer 「同意」 2026-09-18T05:13Z, letter A).

Execution — every item the ruling named, with its receipt

the ruling said	done	receipt
rewrite #11979's Content	✅	body write 2026-09-18T05:39:26Z, read-back clean
rewrite #11979's Acceptance criterion	✅	same write
quote the ruling on #11979	✅	comment `5725699684`
quote the ruling on #11663	✅	comment `5725702972`
close this card	✅	this stroke
⛔ #11979's state / priority / block chain untouched	✅	re-read after the write: `open` · `pm:blocked`,`domain:engine` · no assignee · `Blocked-by: #11978` intact
⛔ no code, no changeset	✅	⛔ no branch, ⛔ no PR, ⛔ no dev dispatched

⛔ Nothing was written to #11663 but the comment — ⛔ no label, no state, no body edit on an pm:epic card.

⭐⭐ One completion of the ruling's quotation — declared, ⛔ not silent

The ruling renders D5 as 「⛔ no NULL-organization grant row is produced」. Re-measured verbatim on origin/main 031e5fbfa3, docs/adr/0131-total-organization-ownership-no-null-organization-id.md:363-364:

…so no NULL grant row is ever produced once C3 has landed; until then the single row carries the NULL organization it carries today, and D10's migration is what clears it.

⇒ The rewritten Acceptance criterion carries 「once C3 has landed」. ⭐ Why this mattered enough to declare: the unconditional form, written into an acceptance criterion, is false on today's tree — a dev implementing #11979 would assert a state D5 itself says does not hold until C3, and would then have to either fail the criterion or force it true. ⛔ The ruling's direction is untouched.

⚠️ Basis for re-measuring instead of copying, and it is the charter's, ⛔ not this seat's preference: SKILL.md 「搬自任何工件(含己文)本轮未亲测…重测或注「未验证」」, plus the line that landed at 6427ee2480 (2026-09-18T01:15:42Z) — 「裁决点名文件/符号/行/调用形状的条款,逐条带读数或注「未验证」」.

⚠️ Left for the maintainer — ⛔ one line, ⛔ not a reopening

#11979's Constraints paragraph still carries 「the product promise change for production single (config now required for admin) gets its own loud migration note」 — premised on the reading just reversed. ⛔ The ruling names two sections; widening it is ⛔ never a PM's call, so the clause is flagged on #11979 (in the body's discharged note and in the ruling comment) and left byte-identical.

⇒ If the maintainer wants it corrected, it is a one-line direction and this seat will carry it. ⛔ Until then a taker reads it as superseded.

⛔ Not done, and why

#18785 stays in pm:queue, ⛔ un-dispatched. It needs a dev, and check-harness-current.mjs exits 1 — .claude/agents/os-dev.md 011121238d is not in the shared checkout HEAD d93400f42e. Per SKILL.md 「否 ⇒ 记座位贴,自然收班时换会话」 that session swap is owed and still owed. ⭐ This card was executable because the ruling's own clause made it dev-free.

_{⛔ All readings at origin/main 031e5fbfa3, 2026-09-18T05:41Z. state_reason: completed; pm:dispatched stripped in the same stroke; assignee kept as the record of who executed, ⛔ not a release.}

Generated by Claude Code

Navigation Menu

Repository navigation

Correct #11979's goal wording to 「no NULL-organization grant row」 — the engine-lane half of #18411, which the filing card explicitly left cross-lane #18707

Why this is a separate card

The correction

Why the wording is load-bearing, ⛔ not cosmetic

Scope

Dedupe words

先说测量

维护者速读

四棱

Ruling — A

Execution

Why no dev

Execution, per the ruling

⭐ One deviation, declared in advance, ⛔ not a re-ruling

Execution — every item the ruling named, with its receipt

⭐⭐ One completion of the ruling's quotation — declared, ⛔ not silent

⚠️ Left for the maintainer — ⛔ one line, ⛔ not a reopening

⛔ Not done, and why

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Correct #11979's goal wording to 「no NULL-organization grant row」 — the engine-lane half of #18411, which the filing card explicitly left cross-lane #18707

Description

Why this is a separate card

The correction

Why the wording is load-bearing, ⛔ not cosmetic

Scope

Dedupe words

Activity

huangyiirene commented on Sep 17, 2026

先说测量

维护者速读

四棱

hotlong commented on Sep 18, 2026

Ruling — A

Execution

huangyiirene commented on Sep 18, 2026

Why no dev

Execution, per the ruling

⭐ One deviation, declared in advance, ⛔ not a re-ruling

huangyiirene commented on Sep 18, 2026

Execution — every item the ruling named, with its receipt

⭐⭐ One completion of the ruling's quotation — declared, ⛔ not silent

⚠️ Left for the maintainer — ⛔ one line, ⛔ not a reopening

⛔ Not done, and why

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions