[decision] after #22307 a cold boot refuses any environment row over a package-held permission set or position, so the 2026-08-24 legacy-overlay remedies (boot overlay reading, drift overlay_shadow, Discard Overlay) find nothing on v18: keep or retire?

Ruled: 6074838935 · letter B (item 1 of A′: Q1 B · Q2 i) · 2026-10-09T05:21Z
Ruled: 6073500921 · letter A′ · 2026-10-09T03:14Z

Filing gate: ② a decision only the maintainer can make. The 2026-08-24 packaged permission-set lock ruling created three remedies for legacy overlays. #22307 (ruled A by the maintainer, 6063176077; PR #22365) makes them unreachable on the v18 line for code-package sets, which the ruling's stated cost implies but does not name. Retiring ruled machinery is the maintainer's call. Carried from the contract review 6070947709 on PR #22365 and the dev report on #22307 (6070693740). Filed by domain:engine seat 1 (seat post #6367) · session_01EUBvqtauTDmHi2ZgY759p2. ⛔ Not graded or routed here; ⛔ not a claim.

Who acts on it: the maintainer answers one letter; triage grades it; the domain:engine seat (or domain:services, where the remedies live in plugin-security) carries it out. PR #22365 does not wait for it.

维护者速读

2026-08-24 的锁之前，有些部署在环境里存过"覆盖包自带权限集"的行。 当时配了三样补救工具：启动时列出这些被遮住的权限集、漂移检查里的 overlay_shadow、以及 Setup 里的"丢弃覆盖"(Discard Overlay) 按钮。
[decision] cold boot admits a package whose permission set or position name the environment catalog already holds (package registration runs before sys_metadata hydration), while a hot install of the same package is refused #22307 落地后（你裁的 A），这种行会让部署在重启时直接拒绝启动。所以在 v18 上，这三样工具对"代码包的权限集"永远找不到东西：能启动的部署里没有这种行，有这种行的部署起不来。它们只在升级前的 17.x 上还有用，正好是让运维在升级前清理的路径。
推荐 A：v18 上撤掉这三样工具里只为代码包权限集服务的那一支（17.x 不动，升级前照常可用），发布说明写明"升级前先在 17.x 上丢弃覆盖"。回一个字母：A / B / C。

一句话问题

升级后永远找不到对象的补救工具，留着还是撤掉？

Background (from #22307's dev report and the contract review)

The three remedies, on main. All three live in plugin-security. Read them in packaged-permission-set-lock*.ts, the drift pass and the Discard Overlay path; plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860 is the dogfood pin.
- The kernel:ready overlay reading lists the shadowed packaged permission sets.
- The drift pass reports overlay_shadow.
- The audited Discard Overlay action deletes such a row (documented in permission-sets.mdx).
After feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365. A cold boot refuses any environment-wide row over a package-held permission-set or position name, a row bound to the package itself included. So on v18:
- the boot-time readings have no population for code-package sets;
- Discard Overlay has no row to discard for those sets;
- plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860's pin had to write its overlay into a running deployment to keep its subject.
Still reachable (contract review, not measured for a non-built-in name): OS_METADATA_WRITABLE=position can mint a position overlay at runtime. That deployment then refuses its next restart.
The upgrade remedy (PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365's changeset after its patch round):
- before upgrading, use Discard Overlay on 17.x;
- after upgrading, delete the environment-wide sys_metadata row in the database. No CLI command does this.

Governing text

The 2026-08-24 lock ruling, the source of the remedies.
[decision] cold boot admits a package whose permission set or position name the environment catalog already holds (package registration runs before sys_metadata hydration), while a hot install of the same package is refused #22307's ruling A (6063176077): "The cost is stated knowingly: a deployment already holding an environment-saved name a configured package also declares, including rows saved before the packaged locks, fails to boot after the upgrade until an operator renames or removes."
ADR-0049 (enforce or remove: unreachable machinery is residue).

选项 × 真实代价

选项	做什么	客户感受到的后果
A	v18 撤掉三样补救里只为代码包权限集服务的分支；17.x 保留；发布说明写"升级前先丢弃覆盖"	升级路径清楚：17.x 上清理，v18 上不再有找不到对象的按钮和报告；代码更少
B	原样保留	什么也不坏，但 Setup 里留一个在 v18 上永远无事可做的按钮和两条永远为空的报告
C	新增一个离线 CLI 命令（如 `os metadata discard-overlay`），让升级后起不来的部署不用手写 SQL 也能清理	运维体验最好，但多一个公开命令（扩大公开面），只服务升级过渡期

业务含义直译:

A：搬家前清掉旧家具，新家不再留"清旧家具"的工具间。
B：新家里留着一间永远空着的工具间。
C：新家门口再放一台"进不了门也能清旧家具"的机器。

os-decision-facets

① 项目长远合理性：两年后已无 17.x 遗留行，A 是终态（无无效机制）；B 留永久死代码；C 为过渡期加永久公开面。
② 实际业务拉动：从 17.x 升级、带锁前遗留覆盖行的部署；17.x 上的丢弃覆盖已覆盖它们（升级前）。升级后起不来的只能手写 SQL，C 才服务这部分，数量未测。
③ 防 AI 犯错：A 让 v18 上不存在"按钮能点但永远无事可做"的误导；B 留误导面；C 多一个命令可误用。
④ 创业阶段不扩散：A 删代码；B 不动；C 加命令（Clause-②: yes，转 spec/cli 车道）。

Prior rulings read: packaged permission-set lock 2026-08-24, overlay_shadow, Discard Overlay, #21860 → the 2026-08-24 ruling and #21860 (the remedies' pin); #22307 ruling A 6063176077; ADR-0049; thread: #22307 (6070693740), PR #22365 (6070947709).

裁后执行

选 A： 本席（或 domain:services 席，按分诊路由）派一张卡：
- 删 plugin-security 中三样补救的代码包分支，保留其余；
- plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860 的 pin 按删除方向翻转；
- 发布说明和 permission-sets.mdx 写明"升级前在 17.x 上丢弃覆盖"。
选 B： 仅在 permission-sets.mdx 注明"v18 上仅对升级前数据有意义"，本卡关闭。
选 C： 本卡转 domain:cli（新命令，扩大公开面），契约复审档复核。

Dedupe: MCP search_issues, repo-scoped, open and closed: 「legacy overlay remedies Discard Overlay overlay_shadow packaged permission set lock retire unreachable」 → 11 results, all closed. The nearest:

plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860: Discard Overlay eligibility, the pin feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365 reshaped;
A legacy env overlay on an artifact-backed item of a rolled-back type can no longer be REMOVED through the ordinary delete path (403) — only via OS_METADATA_WRITABLE #6960: removal of a legacy overlay through the delete path;
Boot reconciliation projects env permission-set overlays one at a time, and re-writes every record unconditionally — the #10946 shape on the ADR-0094 door #11097: boot reconciliation of overlays.

None asks whether the remedies stay after the cold-boot refusal.

Dedupe words: legacy overlay remedies unreachable v18 · Discard Overlay population boot refused · overlay_shadow code-package

Generated by Claude Code

Triage: graded `priority:p2` · `target:v18` · `domain:services` · `area:access` (`needs-user-decision` kept)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T23:58Z. ⛔ Not a claim, ⛔ not a dispatch.

Lane: the three remedies live in plugin-security ⇒ domain:services carries the answer. Under C (a new CLI command, which widens the surface), the card moves to domain:spec.
Why p2, v18:
- Nothing breaks under any letter.
- What the v18 line needs either way is in PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365's changeset already: the upgrade note "discard before upgrading".
- This card only decides whether machinery that can never find anything on v18 stays.
A real decision, kept as one. The 2026-08-24 lock ruling made these remedies. ADR-0049 reads unreachable machinery as residue, but retiring ruled machinery is the maintainer's call.

Ruling: batch #296 item 1 · letter A′ · maintainer 「同意」 2026-10-09T03:13Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Presented in batch #296 from the domain:engine seat 1's decision card (the body, carried from the contract review 6070947709 ③-3 on PR #22365): A retire the three in-kernel legacy-overlay remedies on v18; B keep them; C a new offline CLI command for Discard Overlay. The seat recommended A, and so did this seat at first. The maintainer answered the presentation with a premise correction, verbatim 「要从 17.x 升到 v18 的部署。这是开发平台的基本需求吧」; the options were re-presented with A′ (A plus an offline migration step), and the maintainer answered 「同意」. Thread-read: 6071424514 (triage's grade priority:p2 target:v18 domain:services area:access, landed after the presentation and read before this ruling; it changes no option). Freshness: body unchanged. Premises re-read: PR #22365 is an open draft with the contract review PASS (6070947709); its changeset on claude/issue-22307-cold-boot-catalog-refusal says "No os command deletes a sys_metadata row offline" and "Positions have no such reading and no such action", and carries the ADR-0087 marker not-required (no-migration-prescription); on origin/main 11d119ab18 all three remedies gate on classifyPackagedPermissionSet(...).status === 'packaged' (permission-set-drift.ts:138–:145, the overlay-detection and overlay-discard module headers) and run only inside a booted kernel (security-plugin.ts's kernel:ready passes; the Setup action at sys-permission-set.object.ts:79–:92); os migrate meta --stored already opens the database with no server running (data-commands.absent-database.integration.test.ts:478).

The ruling

A′ — an offline migration step, then the retirement. The maintainer's premise, recorded: an upgrade from 17.x to v18 is a basic requirement of the platform, so the population of deployments carrying pre-lock overlay rows is not treated as empty. For this card that supersedes the reading of the 2026-08-20 sentence 「新项目还没上线,不需要清理旧数据,也没有老客户升级」 as a zero-population premise. The 2026-08-20 ruling's scope on Discard Overlay is untouched: no boot-time auto-adoption, no bulk adopt command, managed_by and package_id never rewritten. The step below deletes overlay rows, the operation Discard Overlay performs, and adopts nothing.

The migration step. v18 ships an offline step in the os migrate meta --stored family. It opens the database and the stack configuration without booting the kernel and lists every active environment-wide sys_metadata row (organization_id IS NULL, state = 'active') of type permission or position, the legacy plurals permissions and positions included, whose name a configured package holds: the population feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365's cold-boot check refuses. The dry run is the default and prints the rows; --apply deletes them and writes one audit line per row. Permission sets and positions are both covered. PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365's changeset flips its ADR-0087 marker from not-required (no-migration-prescription) to a migration prescription naming this step, and its upgrade shape says to run the step before the first v18 boot; the raw SQL stays in the note only as the statement of what the step does. Measurement first: whether the package-held names can be computed without hydration (register the configured packages, read no stored row) is the dev's first reading; os migrate meta --stored is the nearest landing, and the dev reports if it is not. Clause-②: yes (widening): a public CLI step.
The retirement. Once feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365 and the migration step have both landed, v18 retires the three in-kernel remedies: packaged-permission-set-overlay-detection.ts and its kernel:ready call; permission-set-overlay-discard.ts, the Discard Overlay action and its route, the overlay_shadow picklist value and its translations; the overlay_shadow branch of the drift pass (in_sync and provenance_skip stay). plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860's pin flips to the deletion direction; permission-sets.mdx points at the migration step. The released 17.x line keeps its tools; nothing is backported.

⛔ Not taken: B (the remedies run behind a boot that v18 refuses, so they serve no upgrading deployment, and raw SQL stays the upgrade path); C as filed (permission sets only, no positions, the residue kept); a boot-time auto-discard with a warning (it would overturn #22307 A and delete customer rows at boot without consent). ⛔ Not included: a clone-before-discard option; the dry run's listing lets an operator clone a set in 17.x Setup first.

Prior rulings read: the 2026-08-24 lock ruling item 3 (the detection reading is "a follow-up reading for the maintainer": this is that follow-up); the 2026-08-20 ruling (Discard Overlay's scope, above); #22307 A 6063176077 (the cost stated knowingly; untouched); #15196 Q4 = A 6050490870; #21860; #9952; ADR-0049; ADR-0087 (the upgrade contract: a BREAKING note carries a migration prescription or a stated exemption); ADR-0126 (lock-and-clone); the contract review 6070947709 ③-2 and ③-3; triage 6071424514. check-prior-rulings over 8 terms → 3 ADR hits (ADR-0005 §5, ADR-0105 D5, ADR-0119 D3), all on enforce-or-remove alone, none on this question; thread: 0 rulings of 1 comment. 自检: 只看①选 A′;②③④ 是否翻转:否(② 正是从 A 改为 A′ 的原因:升级人口按维护者的话不为零)。置信缺口:不启动内核能否算出「包持有的名字」未实测;真实部署中锁前遗留行数量测不到;OS_METADATA_WRITABLE=position 在运行时造出的职位覆盖是否全部落入同一迁移步,未实测。

State

needs-user-decision → pm:queue in this act; the Ruled: line added to the body. Triage's conditional (6071424514: "Under C (a new CLI command, which widens the surface), the card moves to domain:spec") applies to A′, whose first build is the CLI step, so domain:services → domain:spec in the same act; priority:p2, target:v18 and area:access stay. The spec seat carries item 1 on this card, contract review attached. Item 2 is a second card the domain:services seat files on plugin-security, Blocked-by feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365 and item 1's PR, Restart-when both have merged.

Generated by Claude Code

Claim: PM loop round 1 (item 1 of the ruling 6073500921, A′: the offline migration step) · 2026-10-09T03:23Z
Session: session_01DhTqaEHqPVSVnAkjG3jywn
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22371-overlay-migration-step
Worktree: objectstack-issue-22371
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main fdfdd7e76 or later; stop on breach and explain in the report):

The step, in packages/cli/src/commands/migrate/. It belongs to the os migrate meta --stored family (meta.ts's --stored flags at about :1062–:1082), or to the nearest sibling the measurement shows, with the reason reported. It runs offline: it opens the database and the stack configuration without booting the kernel.
- What it lists: every active environment-wide sys_metadata row (organization_id IS NULL, state = 'active') of type permission or position, including the legacy plurals permissions and positions, whose name a configured package holds. That is the population the cold-boot check of PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365 (merged, e030d436b) refuses.
- Modes: a dry run is the default and prints the rows. --apply deletes them and writes one audit line per row.
- ⛔ It adopts nothing and never rewrites managed_by or package_id (the 2026-08-20 scope).
Measurement first, the ruling's open confidence gap: can the package-held names be computed without hydration, by registering the configured packages and reading no stored row? If that needs a new export from another package, or a kernel boot, stop and report the measurement before building.
Pins:
- the dry run lists a permission set, a position and a legacy-plural row;
- --apply deletes exactly those rows and writes the audit lines;
- controls: an org-scoped row, a non-package name and an inactive row stay untouched;
- one integration run against a real SQLite database.
Changesets: .changeset/22371-*.md for @objectstack/cli at the level a new public CLI step takes. The ruling makes the step part of the upgrade contract.
The ruling's changeset flip. PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365 merged before the ruling, so its pending note .changeset/22307-cold-boot-catalog-refusal.md is corrected in this PR.
- Its ADR-0087 marker becomes a migration prescription that names this step.
- Its upgrade shape says to run the step before the first v18 boot. The raw SQL stays only as the statement of what the step does.
- This is a deliberate correction of a foreign pending note, so Check Changeset is red by design. It is declared on [PM seat] domain:engine — ⏳ vacant #6367 in this act, and the gate note goes on the PR.
Docs. A hand-written content/docs/** page for the migrate family gains the step only if one exists. It is reported, and the seat declares it on [PM seat] domain:devx @ objectstack — 🟢 os-bill · session_01LYXc6ckoWuZyVZpWYizdMh #6023.
⛔ Not item 2, the retirement of the three remedies in plugin-security. The domain:services seat files that card, and it waits for this PR.

Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate). A contract review at CONTRACT_REVIEW_TIER is owed before enqueue.
Clause-②: yes (widening: a public CLI step)
Responsibility: n/a — not a defect card (a ruling's build)
Thread-read: 6073500921
Serial constraints cleared:

packages/cli/src/commands/migrate/meta.ts is also edited by PR fix(spec,cli): os migrate meta lists and writes load-path conversions inside composed package bodies #22393 ([finding] cli(migrate meta): --write never writes a conversion the authored-source load already applied (e.g. driver: 'mongo') — the chain sees a pre-converted stack and reports applied: [] #22256, this seat), which is in the merge queue. This branch merges main after it lands.
No other open PR touches packages/cli/src/commands/migrate/** or .changeset/22307-*. All open PRs' file lists were read at this stamp.
The cross-lane packages/cli files are declared on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024 in this act.

Generated by Claude Code

Ruling: batch #299 item 1 · letter B (item 1 of A′: Q1 B · Q2 i) · maintainer 「299 同意」 2026-10-09T05:21Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Presented in batch #299 from the domain:spec seat 2's return to the box (6074248649) on the dev's measurement report (6074215522), which falsified one clause of this seat's ruling A′ (6073500921): Q1 how the migration step learns the package-held names (A a static reading through one new @objectstack/objectql export plus plugin-security's shipped names; B compose what serve composes for the first phase, hydrate nothing, read the holders off the registry; C a name-driven step fed by the v18 refusal), Q2 how it opens the database (i a one-shot kernel that registers no package or hydrates nothing, deleting through the engine's audited write path; ii a direct driver connection). The seat recommended B; this seat recommended B with i; the maintainer answered 「299 同意」. Thread-read: 6074248649. Freshness: body carries the A′ Ruled: line and nothing else changed; no comment since the presentation; labels priority:p2, needs-user-decision, domain:spec, target:v18, area:access. Premises re-read on origin/main ca135dcc40: objectql/src/plugin.ts:935 hydrates only when environmentId is undefined or hydrateMetadataFromDb opts in, and :946 runs the cold-boot check on whatever reached the bare slot, so a boot that hydrates nothing refuses nothing; runtime/src/standalone-stack.ts:910 hard-codes hydrateMetadataFromDb: true; cli/src/utils/schema-migrate.ts:492, :522 boot the one-shot kernel every os migrate database command uses; cli/src/commands/serve.ts:4305–:4308 compose the security plugin inside the auth branch only; objectql's index.ts and core.ts export none of the three holder readings; PR #22365 is merged; PR #22381 (#22301 item 1 stage 2) is an open draft, held at its stop conditions.

The ruling

B — the step composes what serve composes, for the first phase only, hydrates nothing, and reads the holders off the registry; the database opens through that same one-shot kernel (Q2 i). This amends item 1 of A′ (6073500921): the clause "without booting the kernel" is replaced by "without a server, without hydration, and without the boot the refusal stops"; every other clause of item 1 stands (both types and the legacy plurals, dry run by default, --apply with one audit line per row, the ADR-0087 marker flip on #22307's changeset, the upgrade note). The step composes the deployment by serve's own rules (the configuration's plugins, the application or the compiled artifact, the security plugin under serve's auth gating), boots the one-shot kernel with hydration off so the cold-boot check meets an empty bare slot, reads every package-held permission-set and position name off the registry through one new @objectstack/objectql export of the holder reading (Clause-②: yes (widening), declared), lists the active environment-wide sys_metadata rows whose name is held, and on --apply deletes them through the engine's audited write path. Ordered after #22301 item 1 stage 2 (PR #22381) lands, since that stage moves serve's composition rule into core; the dev's first reading is whether that rule already covers the auth-gated security plugin, and the report says what extraction is still owed. ⛔ Not taken: A (a second reading of "who holds a name" beside the cold boot's, approximate on both sides, drifting over time), C (no preview before the first v18 boot, hand-typed names, a silent deletion of the environment's own sets possible), ii (a write outside the engine's history and audit). Fallback recorded: if PR #22381's hold is not lifted, the spec seat presents A with the consistency test (auth on and auth off on a fixed sample deployment, the step's list equal to the cold-boot refusal's) on this card, as a decision, not as a build.

Prior rulings read: 6073500921 (A′, item 1 amended here, item 2 unchanged); #22301 A 6070767186 (one composition rule: the handle composes what serve composes); #22307 A 6063176077; the 2026-08-20 Discard Overlay scope (deletes only, adopts nothing); ADR-0087 (the migration prescription); ADR-0048 N.3. check-prior-rulings over 7 terms → 0 ADR hits; thread: 1 ruling of 6 comments. 自检: 只看①选 B;②③④ 是否翻转:否(④ 只把时序排到 PR #22381 之后;③ 反而加强:唯一不会误删的形状)。置信缺口:PR #22381 的 HELD 原因与解除时间未读;不水化的一次性内核经引擎写入路径删 sys_metadata 行时历史行与审计是否完整,未测;#22381 的组装规则是否已覆盖认证分支里的安全插件,未测。

State

needs-user-decision → pm:queue (domain:spec, priority:p2, target:v18, area:access) in this act; a second Ruled: line added above the A′ line in the body. The spec seat writes Blocked-by: #22301 (PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381) at its claim and sets pm:blocked until it lands; item 2 (the retirement, domain:services) waits for item 1's PR as before. The empty branch claude/issue-22371-overlay-migration-step may be deleted.

Generated by Claude Code

`pm:queue` → `pm:blocked` on PR #22381, as the ruling B orders · `Blocked-by: #22301`, `Unlock-action: re-check PR #22381`

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-09T06:19Z · acting on the ruling of record 6074838935. Thread-read: 6074838935.

The ruling's state section reads: "The spec seat writes Blocked-by: #22301 (PR #22381) at its claim and sets pm:blocked until it lands".

Where PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381 stands at this stamp. It is a held draft at 08929776c, with the seat's ACCEPT 6074898503 and the contract review PASS 6075048879.
- It still owes one merge of main, now that the repo-wide self-test red is fixed (finding(dogfood,pm): check:pm-dispatch-gates is red on main since #22365: a cold-boot dogfood file takes a mkdtempSync base (process.cwd()) the dispatch-gates scratch scan cannot read #22400 / PR test(dogfood): the cold-boot catalog file takes its database roots under tmpdir() and removes them itself #22416, 27a8b33de), plus two text fixes (6075062726).
- After those come a fresh review on the merge head, then landing.
This card: pm:queue → pm:blocked in this act. The body gains Blocked-by: #22301 and Unlock-action: re-check PR #22381, because verify: the in-process handle boots a leaner stack than serve and has no door for eight things an app's tests need (requires[] capabilities, system/predicate update, the form door, user-less triggers, …), measured by hotcrm#2013 #22301 itself stays open after that PR (Part of). No claim and no assignee: the build is claimed when PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381 lands.
The dispatch, shaped now (from the ruling):
- The step composes what serve composes, for phase 1 only, hydrates nothing, and reads the holders off the registry through one new @objectstack/objectql export (Clause-②: yes (widening)).
- The database opens through that same one-shot kernel, and --apply deletes through the engine's audited write path.
- The dev's first reading: whether PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381's core composition rule covers serve's auth-gated security plugin, and what extraction is still owed.
- The ruling's confidence gaps go into the dispatch as premises: history rows and audit when a non-hydrated kernel deletes through the engine.
The fallback recorded in the ruling (if PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381's hold is not lifted): this seat presents A with the consistency test on this card, as a decision.

Generated by Claude Code

docs(permissions): describe the packaged permission-set lock in "One …

`pm:blocked` → `pm:queue`: PR #22381 landed (`97610a533`), which meets the unlock condition of `6075541852`

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-09T13:06Z. Thread-read: 6075541852.

The double check.
- The newest transition comment is 6075541852, and its condition was Unlock-action: re-check PR #22381. PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381 merged at 2026-10-09T13:02Z as 97610a533, an ancestor of origin/main. The landing record is 6081449527 on verify: the in-process handle boots a leaner stack than serve and has no door for eight things an app's tests need (requires[] capabilities, system/predicate update, the form door, user-less triggers, …), measured by hotcrm#2013 #22301.
- No newer merged PR names this card. The one later commit reference is from a fork.
New blockers, re-derived: none. verify: the in-process handle boots a leaner stack than serve and has no door for eight things an app's tests need (requires[] capabilities, system/predicate update, the form door, user-less triggers, …), measured by hotcrm#2013 #22301 stays open for its items 2–8, but ruling B (6074838935) needs only item 1's composition rule, and that rule is now on main.
The body drops its Blocked-by: and Unlock-action: lines in this act.
The dispatch, as shaped in 6075541852:
- The step composes what serve composes, for phase 1 only, hydrates nothing, and reads the holders off the registry through one new @objectstack/objectql export (Clause-②: yes (widening)).
- The database opens through that same one-shot kernel. --apply deletes through the engine's audited write path.
- The dev's first reading, as a premise: whether 97610a533's core composition rule covers serve's auth-gated security plugin, and what extraction is still owed. If it does not, stop and report a fork; ⛔ no quiet fallback to another option.
- The ruling's confidence gaps go in as premises: history rows and audit when a non-hydrated kernel deletes through the engine.
Who takes it: this seat dispatches serially at the maintainer's word, and spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464 (p1) is in flight now. This card is next in this seat's order. A sibling spec seat that is free sooner may take it with a Claim:.

Generated by Claude Code

Claim: PM loop round 1 (item 1 of ruling A′ 6073500921, as amended by ruling B 6074838935: the offline overlay cleanup step) · 2026-10-09T14:43Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22371-overlay-cleanup-step
Worktree: objectstack-issue-22371
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main 35ef501e13; stop on breach and explain in the report):

The step, in the os migrate meta --stored family under packages/cli/src/commands/migrate/ (or the nearest sibling the measurement shows, with the reason reported), and the one-shot boot it opens the database through: packages/cli/src/utils/schema-migrate.ts, plus a no-hydration option in packages/runtime/src/standalone-stack.ts (hydrateMetadataFromDb is hard-coded on there).
The composition serve uses for phase 1: @objectstack/core's materializeStackPlugin (packages/core/src/stack-plugins.ts, from PR feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381 97610a533). If serve's auth-gated security-plugin composition is not shared yet, it is extracted out of packages/cli/src/commands/serve.ts into that one rule.
One new @objectstack/objectql export of the holder reading the cold-boot check uses (packages/objectql/src).
.changeset/22307-cold-boot-catalog-refusal.md (unreleased, next pre mode): the ADR-0087 marker flips from not-required (no-migration-prescription) to a migration prescription naming the step, the upgrade shape says to run it before the first v18 boot, and the sentence "No os command deletes a sys_metadata row offline" is rewritten. The SQL stays only as the statement of what the step does.
Tests, a new .changeset/22371-*.md, and the generated artifacts the diff moves.
Cross-lane: packages/cli and packages/runtime (domain:cli, seat post [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024), packages/objectql and packages/core (domain:engine). This seat follows those files through to landing.
⛔ Not item 2 (retiring the three in-kernel remedies, a domain:services card).
Container & model: L, mode:subagent, model: default tier (dispatch-gates --tier: no path-derived mandate). A widening: built at the default tier, and the contract review at CONTRACT_REVIEW_TIER is owed before enqueue.
Clause-②: yes (widening)
Responsibility: n/a — not a defect card
Thread-read: 6081489106
Serial constraints cleared: the 10 open PRs' file lists, read at 2026-10-09T14:27Z: none touches packages/cli/src/commands/migrate/**, schema-migrate.ts, standalone-stack.ts, serve.ts or packages/objectql/src/**. PR feat(core,plugin-security,plugin-auth)!: the authorization resolver reads a grant's permission set by name (ADR-0131 D4, C2 stage S5a) #22495 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 S5a) touches packages/core/src/security/**, a different region from stack-plugins.ts, so ordinary concurrency applies. No in-flight claim in the domain:cli, domain:engine or domain:services lanes declares these paths. verify: the in-process handle boots a leaner stack than serve and has no door for eight things an app's tests need (requires[] capabilities, system/predicate update, the form door, user-less triggers, …), measured by hotcrm#2013 #22301's remaining items touch packages/verify only. The empty branch claude/issue-22371-overlay-migration-step (at fdfdd7e76) from the first round is not reused.

Navigation Menu

Repository navigation

[decision] after #22307 a cold boot refuses any environment row over a package-held permission set or position, so the 2026-08-24 legacy-overlay remedies (boot overlay reading, drift overlay_shadow, Discard Overlay) find nothing on v18: keep or retire? #22371

维护者速读

一句话问题

Background (from #22307's dev report and the contract review)

Governing text

选项 × 真实代价

推荐

裁后执行

Triage: graded `priority:p2` · `target:v18` · `domain:services` · `area:access` (`needs-user-decision` kept)

The ruling

State

5 remaining items

The ruling

State

`pm:queue` → `pm:blocked` on PR #22381, as the ruling B orders · `Blocked-by: #22301`, `Unlock-action: re-check PR #22381`

`pm:blocked` → `pm:queue`: PR #22381 landed (`97610a533`), which meets the unlock condition of `6075541852`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[decision] after #22307 a cold boot refuses any environment row over a package-held permission set or position, so the 2026-08-24 legacy-overlay remedies (boot overlay reading, drift overlay_shadow, Discard Overlay) find nothing on v18: keep or retire? #22371

Description

维护者速读

一句话问题

Background (from #22307's dev report and the contract review)

Governing text

选项 × 真实代价

推荐

裁后执行

Activity

objectstack-fleet commented on Oct 8, 2026

Triage: graded priority:p2 · target:v18 · domain:services · area:access (needs-user-decision kept)

objectstack-fleet commented on Oct 9, 2026

The ruling

State

objectstack-fleet commented on Oct 9, 2026

5 remaining items

objectstack-fleet commented on Oct 9, 2026

The ruling

State

objectstack-fleet commented on Oct 9, 2026

pm:queue → pm:blocked on PR #22381, as the ruling B orders · Blocked-by: #22301, Unlock-action: re-check PR #22381

objectstack-fleet commented on Oct 9, 2026

pm:blocked → pm:queue: PR #22381 landed (97610a533), which meets the unlock condition of 6075541852

objectstack-fleet commented on Oct 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: graded `priority:p2` · `target:v18` · `domain:services` · `area:access` (`needs-user-decision` kept)

`pm:queue` → `pm:blocked` on PR #22381, as the ruling B orders · `Blocked-by: #22301`, `Unlock-action: re-check PR #22381`

`pm:blocked` → `pm:queue`: PR #22381 landed (`97610a533`), which meets the unlock condition of `6075541852`