[objectstack-fleet]

Requested by Bill · project thread

Part of #25203
Part of #15212

Clause-②: no
Metadata-protocol: none

Claim 6346494581 (domain:engine seat 2, card thread session_01M7Q2xAsaBG8KpAYgUxtSdU). Items 1, 2, 3, 6, 7 and 8 of the card. Item 4 landed with #25210. Item 5 is a governed .claude/** line and goes to the skills lane. Items 9 and 10 (comment 6345275520) wait on #25246 and are not in this claim. So this PR is Part of #25203, not Fixes: the card stays open for items 5, 9 and 10 (seat correction after the contract review).

What changed

Item 1, the one behaviour change: resolveDeclaredRuleScopes (packages/plugins/plugin-sharing/src/sharing-plugin.ts).

• Before: the keyset walk over sys_organization filtered each page to string ids, then tested the FILTERED page for "short page, stop". A full page of 500 rows holding one row with no readable id read as short, so the walk ended there and answered a partial list. The boot sweep then revoked the declared-rule grants of every organization past that page.
• Now: the walk ends on the number of rows READ. A page holding a row whose id the walk cannot read answers unknown (null), with a warning that names the cause, as the epic's plan amendment 6254164222 prescribes ("treat a filtered-out id as a failed read"). The caller already treats null as UNKNOWN: no declared rule is served, and no declared rule's grant is revoked.
• Hardening, not a reachable defect: sys_organization.id is a text field, so no shipped install produces such a row.
• Pin: sharing-rule.test.ts, "a FULL page holding a row with no readable id answers unknown (null) …". 1201 organizations, row 10 of the first page loses its id.

Item 2, wording.

• 18.sharing-rule-declared-mirror-retired.ts reason: the D13 paraphrase. ADR-0131 D13 asks an ADR-0087 entry of every retirement of an authorable shape. The text now says this entry is registered by choice, because the seeder is not one. (The reconciliation's suggested text named a card number; the repo's runtime-string rule keeps tracker numbers out of shipped text, so the sentence carries the reason instead.)
• 18.driver-read-scope-follows-tenant-wall.ts surface: names update and delete "by id or by predicate".
• packages/cli/src/commands/migrate/organization-ownership.ts: the printed warning "(but on a table whose column is not the tenancy anchor): assign …" now reads ", except on a table whose column is not the tenancy anchor. Assign …". The same idiom is fixed in the comment above unattributableHeld and in the heldUnattributable docblock (organization-ownership-apply.ts).

Item 3, texts of the retired NULL-means-global reading.

• sys-user-position.object.ts: the docblock and the Organization help. An assignment applies only while its organization is the active one, and an organization-less row applies nowhere (grantAppliesInTenant, packages/core/src/security/resolve-authz-context.ts).
• sys-user-permission-set.object.ts: the Organization help ("Optional organization scope. NULL = applies in every org context." → "The organization this grant belongs to.").
• plugin-security's en bundle was regenerated with node scripts/check-i18n-bundles.mjs --write. The zh-CN, ja-JP and es-ES values are hand-written and were updated to match, because merge mode keeps translated values.
• "simply unstamped": the text lives in packages/spec/src/contracts/email-service.ts (the IEmailService organizationId TSDoc), not in plugin-email. It now says the engine stamps the organization it can derive or refuses the insert (ADR-0131 D9), and leaves the row unstamped only in a composition with no organization object.
• packages/verify/src/harness.ts, inviteForAudienceGate: the dedicated organization id hides these invitations from fixtures under a wall only. On single an organization owner's read returns them too.
• Forced companion: packages/spec/scripts/liveness/empty-state-registry.mts loses its sys_user_permission_set.organization_id row. That row classified the "NULL = applies in every org context" statement this card removes, and check:empty-state reds STALE — registered, but the statement is gone without the removal (measured).

Item 6. schedule-organization.zod.ts cited the deleted objectql/src/tenancy/platform-object-tenancy.ts ledger. It now cites service-automation/src/suspended-run-store.ts, where the store stamps a run's row. content/docs/references/automation/schedule-organization.mdx was regenerated (check:generated --fix, then re-checked green).

Item 7. content/docs/permissions/tenant-audit-census.mdx, the gate order's second item: the engine sets bypassTenantAudit on an isSystem write only where the object's schema puts it out of scope (no tenant field, or federated), as buildDriverOptions does today.

Item 8. delivery-claim-tenant-audit.integration.test.ts: the docblock quoted the driver's old warning tail. It now quotes the opening and says the prescription after the dash has been reworded. The assertions are unchanged.

Tests

At head 0a71e50d7:

• plugin-sharing pnpm test: 53 files, 1201 tests passed.
• plugin-security pnpm test: 208 files, 4274 passed, 45 skipped.
• cli unit tier, organization-ownership files: 8 files, 76 passed.
• spec src/migrations + scripts/liveness: 17 files, 579 passed.
• typecheck: plugin-sharing, plugin-security, cli, verify, service-messaging, spec, all exit 0.
• Ablation of item 1 (scripts/ablation-replace.mjs, the old filtered-page block put back): the new pin went red (1 failed, 5 passed), every other resolveDeclaredRuleScopes test stayed green. Restore verified: blob equal to HEAD, git diff HEAD empty. The suite imports ./sharing-plugin.js from src, so no dist leg applies.

Gates

node scripts/pm/dispatch-gates.mjs --commands at 0a71e50d7 derived 124 families. --ran reconciliation: 122 run, all exit 0; 2 NOT MEASURED (exit 3, prerequisite not met on this checkout), left to CI: check:dual-build-cjs-loads (needs a whole-workspace build) and check:i18n-coverage (one of 14 configs could not lint here). check-plugin-teardown-shape --self-test and check:skill-examples first exited 3 on missing prerequisites (a pinned fixture commit, the client builds) and exited 0 once those were fetched and built.

Acceptance notes

Published text, per item:

• Item 1: @objectstack/plugin-sharing behaviour and a new warning string. Published.
• Item 2: the two semantic entries ship in @objectstack/spec's upgrade guide and registry. Published. No check reads their wording, and check:upgrade-guide / check:spec-changes are green. The cli warning is a runtime string in @objectstack/cli. Published. The two cli comments are not.
• Item 3: the two descriptions and the four locale bundles ship in @objectstack/plugin-security. Published. The IEmailService TSDoc ships in @objectstack/spec's .d.ts. Published. The position docblock and the verify comment are not published.
• Item 6: the TSDoc is in a *.zod.ts, which @objectstack/spec ships verbatim (files includes src/**/*.zod.ts). Published. The reference page is docs.
• Items 7 and 8: docs and a test comment. Not published.
• One patch changeset covers the four published packages (Metadata-protocol: none).

Not changed here (no drive-by): the sys-user-permission-set.object.ts docblock still calls an organization-less grant "platform-wide" when it explains the unique index's NULL-safety; tenant-audit-census.mdx keeps its historical narrative about the old mute further down. Neither is named by the card.

Cross-lane declarations (not claims): domain:cli on #22648 (6346689477), domain:devx on #20163 (6346705267, for content/docs, which the lane table assigns to devx), domain:spec on #18549 (6346927889), domain:services on #21118 (6346947858, plugin-sharing, plugin-security, service-messaging).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/cli, @objectstack/plugin-security, @objectstack/plugin-sharing, @objectstack/spec, @objectstack/verify, touching 10 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/cli/src/utils/organization-ownership-apply.ts, packages/spec/src/automation/schedule-organization.zod.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

17 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c.

⛔ 12 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/cli/src/utils/organization-ownership-apply.ts, packages/spec/src/automation/schedule-organization.zod.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 154 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 453e82eaa8b378effbaada2d4b0cb905492c8082 — the merge of head 0a71e50d7229d1b13564c89da4dcbb8a3c65b347 into base 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 453e82eaa8b378effbaada2d4b0cb905492c8082 && git checkout 453e82eaa8b378effbaada2d4b0cb905492c8082
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c 0a71e50d7229d1b13564c89da4dcbb8a3c65b347 && git checkout -B drift-repro 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c && git merge --no-ff 0a71e50d7229d1b13564c89da4dcbb8a3c65b347

node scripts/docs-audit/affected-docs.mjs --json 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0f1eeeeeb754fc7bbfe64d89e2a305048a75ac7c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0a71e50d7229d1b13564c89da4dcbb8a3c65b347
Local-runs: none
Scope: packages/spec/src/automation/schedule-organization.zod.ts, packages/spec/src/contracts/email-service.ts, packages/spec/src/migrations/entries/semantic/18.driver-read-scope-follows-tenant-wall.ts, packages/spec/src/migrations/entries/semantic/18.sharing-rule-declared-mirror-retired.ts + packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/plugins/plugin-sharing/src/sharing-rule.test.ts, packages/plugins/plugin-sharing/src/sharing-rule-service.ts (cited), packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts, packages/plugins/plugin-security/src/objects/sys-user-position.object.ts, packages/plugins/plugin-security/src/translations/{en,zh-CN,ja-JP,es-ES}.objects.generated.ts, packages/core/src/security/resolve-authz-context.ts (cited), packages/objectql/src/engine.ts (cited), packages/objectql/src/tenancy/system-write-organization.ts (cited), packages/plugins/plugin-email/src/email-plugin.ts and email-service.ts (cited), packages/services/service-automation/src/suspended-run-store.ts (cited), docs/adr/0131-total-organization-ownership-no-null-organization-id.md (cited), packages/spec/scripts/liveness/empty-state-registry.mts and check-empty-state.mts, packages/cli/src/commands/migrate/organization-ownership.ts, packages/cli/src/utils/organization-ownership-apply.ts, packages/verify/src/harness.ts, packages/services/service-messaging/src/delivery-claim-tenant-audit.integration.test.ts, content/docs/permissions/tenant-audit-census.mdx, content/docs/references/automation/schedule-organization.mdx, .changeset/25203-adr-0131-small-carriers.md

Inputs read: card #25203 (body, seat notes 6339857021 / 6342226941 / 6345275520, claim 6346494581, dev report 6347774192); plan amendment 6254164222 on #15212 for item 1's rule only; PR #25266 body, file list (20 files, +96/−50) and the net diff against merge base 8010b641c9; the check-runs on the head. Not read: the dispatch order, the seat's conclusions.

① Derived judgments

Item 1 — the one behaviour change, resolveDeclaredRuleScopes (sharing-plugin.ts:96-139).

• The walk now ends on read.length < DECLARED_RULE_ORGANIZATION_PAGE (rows READ, :136); a page where page.length !== read.length — an id that is not a non-empty string — warns and answers null (:128-134). This is the rule amendment 6254164222 prescribes ("compare the raw page length, and treat a filtered-out id as a failed read (→ null)"). Right.
• Every caller treats null as unknown: the sole caller is sharing-plugin.ts:821-823 — declaredScopes ? setDeclaredRuleScopes(declaredScopes) : setDeclaredRuleScopesUnknown(). setDeclaredRuleScopesUnknown (sharing-rule-service.ts:544-553) sets declaredScopes = null, a state of its own: no declared rule is served, sweepOrphanedRuleGrants revokes no declared rule's grant, and addDeclaredRuleScope (:559-566) keeps unknown unknown. No second consumer of the return value exists (grep at head). Right.
• Happy path byte-identical to the base: with every id a non-empty string page.length === read.length, so read.length < 500 is the old page.length < 500; ids and after are built exactly as before; find call counts are unchanged (1201 rows → 3 calls, 1000 rows → 3 calls, an empty table → one call answering []); a non-array rows reads as [] and returns ids as before. The sibling pins "reads every organization past the former 500-row cap", "a page boundary that lands exactly on the last organization still ends the walk" and "single reads nothing" stand unchanged. Right.
• The pin, sharing-rule.test.ts "a FULL page holding a row with no readable id answers unknown (null) …": 1201 organizations, the first page (no where) returns row 10 with id: undefined. Ablation reasoning: under the base block that page keeps 499 ids, 499 < 500 ends the walk and the function returns a 499-element array, so toBeNull() fails — red without the fix; the dev's measured ablation (1 failed / 5 passed, restore blob equal to HEAD) agrees. The warn assertion matches the new message. Right.
• Not reachable under the shipped schema (sys_organization.id is a text field): hardening, as the amendment says. The new warning names a remedy and carries no tracker number. resolveDeclaredRuleScopes is not re-exported from plugin-sharing's index.ts, so no public surface moves; the fix rides as patch. Right.

Item 3 — the retired NULL-means-global texts.

• sys-user-position.object.ts (docblock :19-21, help :111) and sys-user-permission-set.object.ts (help :113): TRUE against grantAppliesInTenant (resolve-authz-context.ts:876-878: organizationId !== null && organizationId === tenantId) and its docblock (:840-874: "A row with none (null) applies NOWHERE … organization-less grant is invalid state rather than a 'global' one"); grantOrganizationOf (:914-924: "null confers nothing"); both sys_user_position (§4, :1565) and sys_user_permission_set (§6, :1650, :1705) ask that one rule; the platform anchor reads only an organization-OWNED admin_full_access grant (:1624, :1651). ADR-0131 D1 amendment: "nothing reads a NULL tenant value as an owner". The position docblock's D1 citation is right. explain-engine.ts carries no organization_id predicate any more (one comment, :359). Right.
• Translations: the en values equal the two new description strings byte for byte (the shape the repo tool writes; check:i18n on the head is the mechanical confirmation, under ③). zh-CN (授权 / 分配) and ja-JP (付与 / 割り当て) distinguish grant from assignment as en does; es-ES renders both as "asignación" — same meaning (belongs-to, no NULL arm), one word less precise for the grant. Not a contract defect; noted below for the seat.
• SendEmailInput.organizationId TSDoc (email-service.ts:77-84, the IEmailService input): TRUE. The writer is EmailPersistence.insert → engine.insert(object, row, { context: SYSTEM_CTX }) (email-plugin.ts:532-535; SYSTEM_CTX carries no tenantId), so Engine.resolveSystemInsertOrganization (engine.ts:8017-8070) decides: derived → stamped; no-organization-object → undefined, row unstamped; otherwise SystemWriteOrganizationRequiredError. That is ADR-0131 D9 and its 2026-10-22 lean-embedding note; "the one organization it can derive" is the single install's one organization (system-write-organization.ts:54-58). Right.
• verify/harness.ts inviteForAudienceGate comment: TRUE — D8 "nothing under single", D11 "only whether the wall is enforced differs". Not published (files: dist; a comment inside bootClaimed's body).
• Forced companion, empty-state-registry.mts (−10): the row classified the exact statement "NULL = applies in every org context" that item 3 removes. check-empty-state.mts is two-way (empty-state.mts:324-328: forward ratchet "a permissive-empty statement with no entry fails"; reverse rot "STALE — registered, but the statement is gone"), so with the statement gone the row has nothing to classify and keeping it reds the gate; deleting it weakens nothing — the forward ratchet still fails any permissive-empty statement with no entry. Its rationale ("the distinguishing input to the highest privilege") was already false at head (the anchor reads the Default Organization's row, :1624). Spec property liveness, which runs check:empty-state (spec-liveness-check.yml:61-62), is success on the head. Right.

Item 2 — wording.

• 18.sharing-rule-declared-mirror-retired.ts reason: TRUE against D13's closing sentence, "Each retirement of an authorable shape is an ADR-0087 entry". The amendment's suggested text named a card number; the reason ships in protocol-upgrade-guide.md, so dropping it follows the runtime-string rule and the sentence carries the reason instead. Right.
• 18.driver-read-scope-follows-tenant-wall.ts surface, "update and delete by id or by predicate": TRUE — update() passes recordedVerdict: opCtx.tenantLayer0Verdict to buildDriverOptions on its predicate branch (engine.ts:18576) and its by-id branch (:18751); delete() on the by-id pre-read (:21463, where: { id: targetId }), the predicate branch (:21614) and the by-id branch (:21633); driverReadScope (:7818-7860) projects the verdict to { tenantId, tenantIds? }. Right.
• CLI warning (organization-ownership.ts:635) and the two comments: TRUE against heldUnattributable (organization-ownership-apply.ts:3808-3809: notNullExempt ? 0 : table.unattributable.length) — unattributable rows hold certification except on a table whose column is not the tenancy anchor. A runtime string with no tracker number. Right.

Item 6 — schedule-organization.zod.ts TSDoc and its regenerated page. TRUE: ObjectStoreSuspendedRunStore (class at suspended-run-store.ts:293) stamps the paused row's organization_id as organizationOf(ctx.object, ctx.record) ?? ctx.tenantId ?? null in serialize (:960). The .mdx hunk equals the .zod.ts hunk — regenerated, not hand-edited. Right.

Item 7 — tenant-audit-census.mdx gate order, item 2. TRUE against engine.ts:7757-7759 (isTenantAuditInScope = resolveTenantFieldName(objectSchema) !== null && !isFederated) and :7776-7798 (isSystem && opts.bypassTenantAudit === undefined && !isTenantAuditInScope → bypassTenantAudit = true; an explicit caller value is honoured). Right.

Item 8 — delivery-claim-tenant-audit.integration.test.ts (7+/3−). The hunk lies entirely inside the file-header comment. auditedUpdateMany (:68) still matches the opening [tenant-audit] updateMany on tenant-scoped object "…" and the positive control (:113-115) is unchanged. No assertion weakened. Right.

Tracker numbers in shipped text. A sweep of every added line in the net diff finds one, (#10103), in the resolveDeclaredRuleScopes docblock — a code comment carried over from the base, not a runtime string. No new shipped text carries one. Right.

② Semver level

• .changeset/25203-adr-0131-small-carriers.md: patch on @objectstack/plugin-sharing, @objectstack/plugin-security, @objectstack/cli, @objectstack/spec; Clause-②: no; Metadata-protocol: none. The PR body carries the same two lines.
• Clause-②: no with no parenthetical is a well-formed value: AGENTS.md Post-Task step 3 reads "plus AT MOST one arm from the closed pair", so zero arms is allowed, and no is right — no accept set moves. Every spec hunk is TSDoc or a semantic entry's prose (surface / reason): no .describe() value, no key, no refinement; the two plugin-security descriptions are help text, not validation. Metadata-protocol: none is right (nothing an author can write changed), and none takes patch. The plugin-sharing behaviour change is a bug fix on a released package: patch, in the same changeset. Right.
• Coverage: spec (ships src/**/*.zod.ts verbatim, the .d.ts TSDoc and the upgrade guide), plugin-security (object descriptions are runtime values, plus the four bundles), cli (the printed warning), plugin-sharing (behaviour plus a warning) — all four named. @objectstack/verify (files: dist): its only change is a comment inside a function body, which neither the .d.ts nor the built output carries — nothing published moves, no changeset owed. @objectstack/service-messaging: a test docblock only — none owed. Right.
• Check Changeset on the head: success.

③ Boundary flags

Dev deviations (report 6347774192), each disposed:

1. Attribution line links the card thread — the harness-written requester block; the PR body's footer is the session-URL form AGENTS.md prescribes for a body; the four commits carry the model-free trailer pair. Accepted. Implemented-by: below is the branch the claim 6346494581 names.
2. Extra domain:devx declaration on [PM seat] domain:devx · seat 2 — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #20163 for content/docs/** — the lane table assigns content/docs/** to devx (pm-dispatch SKILL.md lane table; references/lanes/engine.md:15). A declaration, not a claim. Accepted.
3. Item 2a text without the card number — the runtime-string rule; the text stays true to D13 (① above). Accepted.
4. empty-state-registry.mts row deleted — the reverse-rot consequence of removing the statement it classified, not a gate weakened (① above); the gate's check-run is green on the head. Accepted.
5. main moved 2 commits, not merged in — AGENTS.md §10 merges main only on a reported conflict, a main-caused red or a queue removal; the PR is mergeable: true. Accepted.

open_questions: none declared; none found.

Out-of-scope items, named and disposed: item 4 landed with #25210 (seat note 6339857021); item 5 is a .claude/** line (governed) routed to the skills lane — named, no carrier card cited; items 9 and 10 (seat note 6345275520) wait on #25246 and stay on this card. Escalated to the seat, outside the contract face: the PR body reads Fixes #25203, so merging closes the card while items 5, 9 and 10 are undelivered; the review checklist asks Part of #25203 when only the implementable part lands, or a named carrier for each remaining item before the card may close. A body edit — the head does not move and this record stands.

Gates the dev left to CI, read on the head: check:dual-build-cjs-loads is hosted by ci.yml Build Core (:2710); check:i18n and check:i18n-coverage by lint.yml Type Check · consumer gates (:6557, :6574). Conclusions at posting: Build Core success, Type Check · consumer gates success — both families green on this head.

Check-runs on 0a71e50d7 at posting (2026-10-22T18:43Z): 42 completed — 36 success, 6 skipped (18.x upgrade harness (opt-in), Console Pin Gate, Dogfood Regression Gate (matrix shard), Dogfood Verify CLI, Packed-tarball smoke (opt-in), Temporal Conformance (live PG + MySQL) — opt-in or full-battery lanes, not PR gates), 0 failure, 0 in progress. The five required contexts — Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard — are all success. Check Changeset, Spec property liveness, Part-of PR must not also close its card and The card this PR closes must claim this branch are success.

Observations for the seat (not verdict-bearing):

• es-ES renders the permission-set grant's help as "esta asignación" where en, zh-CN and ja-JP say grant — same meaning, a one-word polish if the lane wants it.
• One more published description still carries the retired reading, outside this card: packages/plugins/plugin-approvals/src/sys-approval-delegation.object.ts:143 ("Tenant that owns this rule; null = applies across tenants for this delegator.") and its en / es-ES / ja-JP bundle values — a Prime Directive chore: version packages #10 note for a card, not this PR.
• The dev's tests field names commands with counts and the ablation with its restore proof; the gate reconciliation names the two NOT MEASURED families; both pinned to 0a71e50d7. Taken as evidence.

Implemented-by: claude/project-thread-6127ss
Reviewed-by: session_01FaVyM6YvQLg9CsjPVCYc5K

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:engine seat 2 (seat post #20966) · os-bill · session_01FaVyM6YvQLg9CsjPVCYc5K · 2026-10-22T18:47Z · head 0a71e50d7229d1b13564c89da4dcbb8a3c65b347 · card #25203 (p3, Part of #15212).

1. Form: draft, Part of #25203 and Part of #15212, assignee os-bill, 20 files (+96 / −50). check-governed-merges --pr 25266: 0 of 20 paths governed, under 3000 changed lines ⇒ ordinary queue landing. The seat changed the body's Fixes #25203 to Part of #25203 (a body edit, read back identical; the head did not move): items 5, 9 and 10 are not delivered here, so the merge must not close the card.
2. Premise measured: the dev report 6347774192: item 1's ablation red / green; 122 of 124 derived gates green locally, the other two (dual-build-cjs-loads, i18n-coverage) green on this head in CI (Build Core, Type Check · consumer gates).
3. Gates: contract review at CONTRACT_REVIEW_TIER PASS 6348535486 on this head: item 1 answers null on an unreadable id and its sole caller treats null as unknown (no declared rule served, no grant revoked); the happy path byte-identical; every moved published text checked true against its code; Clause-②: no, Metadata-protocol: none, one patch changeset over the four publishing packages. Landing waits for every check on this head to read completed green.
4. Accepted deviations (the five in the dev report, each judged in the review):
   • The attribution line names the card thread's session.
   • A devx declaration on [PM seat] domain:devx · seat 2 — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #20163 for the two content/docs pages, as the lane table routes them.
   • Item 2a's text carries the reason, not the card number (runtime-string rule).
   • packages/spec/scripts/liveness/empty-state-registry.mts loses one row: the gate's reverse-rot consequence of item 3's text change; the forward ratchet holds and Spec property liveness is green.
   • main not merged in: two new commits, no overlap, mergeable.
5. Out of scope, disposed:
   • Item 5 (a governed .claude/** line) was handed to the skills lane; items 9 and 10 wait on fix(organizations)!: retire claimOrphanOrgRows — the first organization no longer adopts organization-less rows #25246. The card stays open for them.
   • packages/plugins/plugin-approvals/src/sys-approval-delegation.object.ts:143 and its bundles still say "null = applies across tenants": the same retired NULL-means-global reading, outside this card; the seat files it.
   • es-ES reads "asignación" where the other locales say grant: same meaning, not filed.
6. Landing: once every check on this head is green, the seat flips ready and arms auto-merge through the relay. The card stays open; the seat posts the landing on it and keeps pm:dispatched off until items 9 and 10 are dispatched.