This post is the single authoritative registry for the domain:services seat (seat-post protocol; index label:pm:seat). Single writer: the incumbent only. Read side: this body plus every comment newer than the body's last edit . ⛔ Shift narrative does not belong in the body — this post carries current values only .
Body set to vacant at the sign-off of session_011K3zqE8Pv1Evw5hc8tZCnN at 2026-10-06T05:38Z. The closing brief is the last comment on this post. §4 and §5 carry forward; §1–§3 are the hand-off ledger.
1. Current PM — ⏳ vacant
Signed off: session_011K3zqE8Pv1Evw5hc8tZCnN (os-steve) at 2026-10-06T05:38Z, on the maintainer's order 「当前任务处理完，合并后就下班」 (2026-10-06T04:20Z). It was seated 2026-10-04T13:44Z. Its last act is the closing brief, the newest comment on this post, which is the release marker for a successor.Wake Routine trig_01HbFWv6NfhwrUgxzEJWpamL is deleted at sign-off. No timer of this seat remains.No dev agent of this seat is in flight, and no tail is left: the last PR (fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940 Successor: /pm-dispatch services 1 (接手); read this post first. Seat 2 ([PM seat] domain:services · seat 2 — 🟢 os-warren #21118 by os-warren (session_01WMQprn46CND82KmY8sZWBu, seated 2026-10-06T04:28Z) and draws on the same queue.Write identity: the fleet relay (objectstack-fleet[bot]) via scripts/pm/*.
2. Ledger — current values
Landed this shift (round 1) , each closed completed by Fixes, with pm:dispatched and the assignee cleared and a landing note on the card:
Landed (round 2) , each closed completed by Fixes, with pm:dispatched and the assignee cleared and a landing note on the card:
Concurrency: the maintainer raised it to three in-flight subagents (「任务很多，并发加到3」, 2026-10-05T06:36Z). The seat keeps three in flight and reserves no slot ahead of time.Landed (round 3) , each closed completed by Fixes, with pm:dispatched and the assignee cleared and a landing note on the card:
security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 security): PR fix(plugin-security)!: on the write doors, a row the caller cannot read answers what a nonexistent id answers #21812 53021e3a), after an at-tier contract review PASS (5989209782). Landing note 5989739239. The objectui console census leg was measured afterwards (5992106372): no class (a) dependency. The console's 404 friendly-copy gap is handed to the repo:objectui seat ([PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #6025 5992123734).plugin-email: an email template edited through PUT /meta/email_template reverts to the package wording on the next boot (the overlay is stamped customized:false, the boot sweep overwrites it) #21785 fix(plugin-email): a metadata-door email template edit survives the next boot #21818 08adfeade8). Landing note 5989754110.service-datasource: importing an external table under a name that differs from its remoteName creates an object that answers 500 "no such table" — and the import does not survive a restart #21788 area:api): PR fix(service-datasource)!: Import as Object saves through the metadata door's save #21837 07e933be), minor with !. Landing note 5992355595.plugin-security: permission sets an org owns (or that live in a writable runtime package) are reported and enforced as "locked by the code package" — the lock reads the package id without the row's provenance #21789 area:access): PR fix(plugin-security): the permission-set lock reads the row's provenance, so org-owned sets, clones and runtime-package sets edit again #21857 c9be1f17), patch. Landing note 5992832603.plugin-auth: phone-number send-otp with no SMS provider answers 500 with an empty body in production instead of a 4xx naming NOT_SUPPORTED #21793 area:identity): PR fix(plugin-auth): phone send-otp with no deliverable SMS service answers 400 SMS_SERVICE_REQUIRED instead of a bare 500 #21858 a43d90ab), after an at-tier contract review PASS (5992404330). Landing note 5993014615.plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860 area:access): PR fix(plugin-security): Discard Overlay refuses every permission set no code package ships, so a runtime-package set's only stored row is no longer deleted #21873 5e0b489b), patch. Seat verdict 5994739292, landing note 5995692964.service-datasource: a re-import the metadata door refuses as DESTRUCTIVE_CHANGE prescribes ?force=true, which the import route never reads — a third face of #11095's class (reachable once #21788 lands) #21841 area:api): PR fix(service-datasource): a destructive re-import's refusal names the remedies that work from the import route #21874 e864db56), after an at-tier contract review PASS (5995209979). Landing note 5996057194.plugin-security: a data-door edit of a permission set saved into a writable runtime package forks it — the write-through's update leg saves without the row's package, leaving two active sys_metadata rows for one name #21861 area:access): PR fix(plugin-security): a data-door edit of a permission set saved into a writable runtime package updates its own row instead of forking it #21881 07c842df). Landing note 5997267561.service-datasource: on objectstack start the federation service reads a metadata service it captured at init, before that service registers — external/validate answers no rows and the boot gate checks zero federated objects #21876 area:api, a seat-owned sub-issue of service-datasource: POST /external/validate does not see a federated object saved at runtime (through PUT /meta/object or the import) until the next restart #21842 fix(service-datasource)!: on objectstack start, read the metadata service when it is used, so validate and the boot gate compare every federated object #21887 bc7747cb), minor with !. Landing note 5998069253.approvals: every approval notification reaches the recipient with an empty body — the service puts its text in payload.message, messaging reads payload.body (comment and request-info text are lost) #21847 area:workflow): PR fix(plugin-approvals): approval notifications reach their recipient with their text, sent as body, the field messaging reads #21888 255a7775). Landing note 5998517648.service-datasource: POST /external/validate does not see a federated object saved at runtime (through PUT /meta/object or the import) until the next restart #21842 area:api): PR fix(service-datasource): external validate sees a federated object saved at runtime, with no restart #21875 25eb7de8), after option C (5995103062) and a merge patch round. Landing note 6000150043.plugin-audit's recordLabel guesses from a fixed key list instead of the ADR-0079 resolver, so an object titled by company_name shows its record id on every activity row #21878 area:records): PR fix(plugin-audit): the activity record label is the record's ADR-0079 title, with the id as the floor #21896 b2388563), re-queued once after an infra timeout (5999675966). Landing note 6000331112.security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829 security, ruling B): PR fix(plugin-security)!: a predicate-scoped update or delete matches only the rows the caller can read #21900 cab63967), after an at-tier contract review PASS (5999880609). The residual class the review asked for is recorded at class level (5999863939). Landing note 6000715360.automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848 area:workflow): PR fix(service-automation)!: a flow the kernel:ready cold-boot bind refuses is withdrawn, not left registered and active from the boot pull #21897 54fb60ac). The cold-boot withdraw shipped; the value judge is feat(spec)!: the build doors judge an approval node config against its declared contract, whole — an undeclared key or a refused value is refused with a location #21893 FlowSchema. service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 pm:retriage).tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868 area:identity): PR fix(plugin-auth): revalidate the memoized default organization id when a user is bound #21905 dcb11c2e), route B. The door scenario moved to finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910 fix(objectql): the cascade skips a federated object's injected tenant anchor #21917 plugin-security: the packaged-permission-set lock refusal carries no userMessage, so the console replaces it with "You don't have permission to save this record" and the "Clone it instead" guidance never reaches the admin #21794 area:access): PR fix(plugin-security): the packaged-permission-set lock refusal carries its guidance as userMessage #21902 833d57c9). The contract review PASS (6003307825) carried across a clean base merge.security(metadata-protocol, objectql, core): platform store reads and writes reach the engine with no principal and no system opt-in — the engine-lane producers of #21908's closure #21911 security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 fix(metadata-protocol, objectql, core): platform store reads and writes carry the explicit system opt-in #21938 d16b9fbf).security(plugin-auth, runtime): raw-engine reads and writes outside the adapter's system context reach the engine principal-less, two of them behind a fail-open catch — the identity and runtime producers of #21908's closure #21912 security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 fix(plugin-auth, runtime): four principal-less producers take the explicit system opt-in #21939 131b937a).security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913 security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940 76fec88b). Clause-②: yes (widening); at-tier contract review PASS (6009643000).
Released at sign-off: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 security, the closure of the principal-less hand-off) went to pm:blocked (release 6009663942). It waits on the maintainer's ruling on open question 1 (the request-door producers acting on the caller's own rows: rows 15 and 16, the inbox unread count, mark-read) and on two rows held off-thread with the maintainer. The census rows still to route before the deny are 22, 23 and 24 onward (named in the release). The deny is decided: 403 PERMISSION_DENIED on isPrincipalLessContext && !isSystem, landing last.Filed this round: security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829 service-datasource: a re-import the metadata door refuses as DESTRUCTIVE_CHANGE prescribes ?force=true, which the import route never reads — a third face of #11095's class (reachable once #21788 lands) #21841 service-datasource: POST /external/validate does not see a federated object saved at runtime (through PUT /meta/object or the import) until the next restart #21842 service-datasource: importing an external table under a name that differs from its remoteName creates an object that answers 500 "no such table" — and the import does not survive a restart #21788 plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860 plugin-security: a data-door edit of a permission set saved into a writable runtime package forks it — the write-through's update leg saves without the row's package, leaving two active sys_metadata rows for one name #21861 plugin-security: permission sets an org owns (or that live in a writable runtime package) are reported and enforced as "locked by the code package" — the lock reads the package id without the row's provenance #21789 service-datasource: on objectstack start the federation service reads a metadata service it captured at init, before that service registers — external/validate answers no rows and the boot gate checks zero federated objects #21876 service-datasource: POST /external/validate does not see a federated object saved at runtime (through PUT /meta/object or the import) until the next restart #21842 service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 pm:blocked, the built-in node types of automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848 FlowSchema judge, 5998950686). Findings for triage: [finding] A code-defined datasource is registered without its package's provenance, so the external import never applies the ADR-0028 namespace rule to it — an import names an unprefixed object and is accepted #21889 finding(pm tooling): label-write falls back to a direct write under the seat's personal login when an accepted relay dispatch shows no run within 90 s — the identity exchange #19774 forbade, on a second branch #21892 label-write falls back to a direct write under the seat's own login when the relay is slow) finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910 500 once a federated object is provisioned; fixed by fix(objectql): the cascade skips a federated object's injected tenant anchor #21917 finding(runtime, plugin-auth): two access guards fail open when their own read faults — the environment-membership gate and the organization slug guard #21941 security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 security(metadata-protocol, objectql, core): platform store reads and writes reach the engine with no principal and no system opt-in — the engine-lane producers of #21908's closure #21911 security(plugin-auth, runtime): raw-engine reads and writes outside the adapter's system context reach the engine principal-less, two of them behind a fail-open catch — the identity and runtime producers of #21908's closure #21912 security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913 The objectui legs are measured. approvals: retire the role: arm of the position-address equivalence once the pinned console sends position: (ADR-0090 D3; split from #21379 item 5) #21387 position: only) is closed (5992115138). security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 5992106372); the console's 404 friendly-copy gap is handed to the repo:objectui seat ([PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #6025 5992123734).Seat 2 signed off at 2026-10-04T16:06Z (5981913912) and left both cards above to this seat. This seat now holds the lane's whole queue.Lane queue at sign-off (read fresh at every pick, never from here):
pm:queue: auth: /api/v1/auth/config reports disableSignUp: false under the default invite_only audience posture — the console offers Sign up, then the form is refused 403 objectui#11691 finding(runtime,metadata-protocol): the metadata door still saves an edit to the host default datasource, which the admin door refuses as code-defined; its code set is not readable from metadata-protocol (the named gap of #21899) #21944 finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 service-datasource/src/datasource-admin-plugin.ts, so they are serial with each other. service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 pm:queue with pm:retriage (triage re-grading its domain; no dispatch).Decision box: the maintainer's open question 1 on security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908
pm:blocked: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 plugin-sharing: after the #15030 revert, 17.x still cannot reach a NULL-org-seeded business unit from an org-stamped rule — and #14547, its only tracker, is closed #15086 feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205 feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 pm:on-hold: automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645 finding(service-automation,lint): the resume door evaluates a screen field's visibleWhen over the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring #20178 [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757 权限设置应该可以配置实效性，权限在一个时间段之内生效 #9272 service: inbound mail + calendar sync (open-core scope) — plugin-email is outbound-only, so email-to-record is impossible in any app #8998 Design: does approver routing imply record read visibility? (#7345 model half) #7497 [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883
Carried, not filed (each in its PR's Acceptance notes or on its card's landing note): auth(2fa): TOTP enrollment names the issuer "Better Auth" (otpauth label and issuer) instead of the deployment's app name #21731 AuthPluginOptions.appName undeclared; the better-auth cookie-prefix re-check at the next bump); security(explain): /security/explain reports decidedBy "sharing" ("0 share(s) attached; access is granted") for a read granted by read depth #21726 decidedBy share-plus-rls / share-plus-vama_bypass precedence divergence, which becomes a code-alignment card in this lane if door-measured); security(storage): the attachment gate's delete and update refusals name the parent record to a caller outside the floor's domain who cannot read it #21755 approvals: retire the role: arm of the position-address equivalence once the pinned console sends position: (ADR-0090 D3; split from #21379 item 5) #21387 role: drift at six sites in packages/lint, packages/rest and the spec approvals contract; the unreleased approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally #21350 approvals: a holder of a position whose slot reads position:<p> can see the request but cannot decide it with the default actor (can_act false, approve 403), and loses sight of it after deciding (404) #21379 storage: a file field's accept / maxSize refusal (FileConstraintError) answers 500 INTERNAL_ERROR instead of a 4xx naming the field and constraint #21730 [REST] Unhandled error log noise; the QA checklist clause that predicts the old 500 is routed to the next run).Triage gaps seen (not this seat's to fix): Epic: packaged-metadata customization (ADR-0126) — flows first, v17 line #12150 service-storage: IStorageService.list(prefix) means two different things on the two shipped adapters (local: one level, directories as files; S3: recursive, silently capped at 1000) #5266 domain:services and no pm:* state.
3. Hot-file serial queue
service-datasource/src/datasource-admin-plugin.ts:finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913
plugin-security/src/security-plugin.ts:security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908
Cross-lane declarations still open: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908 [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024 6003115545, not added). tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868 5999165777) was never added; its scenario moved to finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910
Cross-lane, read and settled: the domain:spec seat's pointer 6000345652 (feat(spec)!: the build doors judge an approval node config against its declared contract, whole — an undeclared key or a refused value is refused with a location #21893 fix(service-automation)!: a flow the kernel:ready cold-boot bind refuses is withdrawn, not left registered and active from the boot pull #21897 domain:cli seat's pointer 6000551571: fix(service-datasource): external validate sees a federated object saved at runtime, with no restart #21875 fix(runtime,service-datasource): an import over a code-defined datasource is held to its package's ADR-0028 namespace #21906 main merge drops "package" from the metadata() docblock sentence in service-datasource/src/plugin.ts. Nothing is owed by this seat. The domain:cli seat's pointer 6007104699: since test(dogfood): every test file runs in its own temporary working directory #21919 process.cwd().
Cross-lane into this lane: the domain:spec seat's platform gap: a plain member is offered "Invite User" (and other org-admin affordances) that the server then refuses with 403 — an action's visibility cannot be gated on the membership grade #21795 packages/plugins/plugin-auth, with no auth-manager.ts edit (5993842226). No claim of this seat touches plugin-auth, so there is no objection.
Stale comments to ride the next edit of their files (the spec seat's pointer 5986812680 on [PM seat] domain:services · seat 2 — 🟢 os-warren #21118 security-plugin.ts about :2109–:2137, the ownership-floor-alternates.ts header, and attachment-delete-floor-alternate.ts about :47. They are kept out of security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771
Lessons carried into every order:
⭐ Selection follows the full order at every pick, read fresh. Broken by this seat on 2026-10-05T12:41Z: plugin-security: the packaged-permission-set lock refusal carries no userMessage, so the console replaces it with "You don't have permission to save this record" and the "Clone it instead" guidance never reaches the admin #21794 security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829 security) had been back in pm:queue since its ruling. The claim was rolled back and security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829
⭐ An order that bounds a dev's options must include the option that keeps the ruling whole. Read the ruling's every clause into the order's candidates.
⭐ A Clause-② correction is ONE round. The claim amendment, the PR body line and the changeset move together.
⭐ Serial holds between seats cost hours. Before holding a reviewed PR behind another seat's PR, test-merge both onto main.
⭐ A ledger entry's step follows the registry's cut rule, not the nearest precedent. A narrowing that lands after v17.0.0 was cut goes in step 18 (the step18 docblock), where os migrate meta --from 17 lists it. A 17.* precedent older than the cut does not set the step. Measured on approvals: retire the role: arm of the position-address equivalence once the pinned console sends position: (ADR-0090 D3; split from #21379 item 5) #21387 17.* entries, and the contract review failed the placement.
⭐ Clause-② has four arms, and yes (narrowing) is one of them: a diff that widens one surface (for example a new member on an exported interface) and narrows another. scripts/pm/clause2-line.mjs defines them. Measured on automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848 no (narrowing).
⭐ A stop line names the thing it protects, not a file region. On service-datasource: on objectstack start the federation service reads a metadata service it captured at init, before that service registers — external/validate answers no rows and the boot gate checks zero federated objects #21876
Orders put every build, test run, typecheck and ablation under the verify lock. The check:* gate battery follows os-dev.md, which keeps it off the lock (a conflict a dev flagged on plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860
needs:contract-review is a waiting marker on the PR only (references/contract-review.md), ⛔ never a gate: added when a Clause-② limb hits and no PASS is on the head, removed by the act that posts the PASS, kept on a FAIL. Name the ⛔-marked roster families in every order.
4. Standing facts measured in this lane — ⛔ re-measure before relying, but do not re-discover
🔴 The agent roster is fixed at SESSION CREATION. A seat spawned without a repo source can attach the repo mid-session and gain its skills , but ⛔ never its agents — measured twice by session_018avjADnTGyuCcmmLWBxaNr with a register_repo_root in between. ⇒ a successor must carry the repo in session_context.sources at creation , and must confirm os-dev before claiming. ⚠️ The roster listing is only the declared surface; the confirming reading is an accepted Agent call.
CI must be read latest-run-per-check-name. A head carries several runs of one name and an earlier failure can be superseded by a later skipped/success. Already in platform-readings.md:301.mergeable_state: blocked right after a ready-flip is a transient⭐ The footer behaviour of a body write depends on the CHANNEL, not the surface. An earlier incumbent measured that an issue-body and a PR-body PATCH re-append the _Generated by_ footer. This session measured the opposite on the fleet relay's issue_patch op: the body is stored VERBATIM. That covers this post's body refreshes (zero footers sent, zero stored) and PR fix(service-analytics): judge each read scope with the engine's own admission before composing it #20232
⭐ post-stamped now enforces the stamp contractf415bcf1): a body carrying {{NOW}} REFUSES any other bare YYYY-MM-DDThh:mmZ stamp. Write a quoted instant as {{WAS:…}}.
⭐ A comment POST normalises whitespace : the stored body can differ from what was sent by an inserted newline before a trailing ---. ⇒ a read-back equality check on fragile comments should compare fragments , not byte-identity, or it will cry wolf.
The REST /search/* path is refused in this container (sessions are bound to their repositories). Run dedupe searches through the MCP search_issues READ tool. ⛔ It is never a write channel.ccr/auto_merge echoes merge_method back wronglyadded_to_merge_queue; the landing criterion is delivery on origin/mainA closing keyword does NOT clean the board. Auto-closed cards keep their pm:* state label and assignee ⇒ clear both on reading the merge event, with a note (⛔ never a silent assignee drop — the H47 shape).⭐ Auto-merge can sit un-queued. PR docs(service-job): re-anchor the dead tracker citation to the commit that decided it #20866 clean with auto-merge enabled for 17 minutes and no added_to_merge_queue, while a PR readied later was queued within two minutes. One relay automerge_disable + automerge_enable pair queued it at once. It re-runs no CI, so it is not a kick.
⭐ The contract-review tier can run out mid-shift. Measured on PR docs(service-automation): re-anchor the dead tracker citations to the commits and ADR that decided them #20816
⭐ A closing keyword can fail to close the card at all. Measured twice: on automation toggle door: switching a customer-authored flow off or on answers 400 VALIDATION_FAILED 'Package is required' — the activation ledger requires package_id and toggleFlow writes an empty one #20726 fix(service-automation)!: the toggle door switches packaged flows only; a customer flow is refused, naming its status switch (#20726) #20780 #5930 step 3: the shared filter lowering at the analytics seams (the analytics where / preview door, the read scope) and the memory cube face's door, with the F5 / F11 output vocabulary #20810 feat(service-analytics,driver-memory): the shared filter lowering at the analytics seams and the cube face's new door (#5930 step 3) #20857 Fixes #N left the card open, with no closed event. Both of those PRs had their body re-written through the relay's issue_patch. That is not the cause : security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917 fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931 Fixes landing, read the card's state; if it is still open, close it completed through the relay's issue_patch, and say so in the landing comment.
⭐ This session cannot write to objectstack-ai/cloud. When triage asks this seat for a cloud follow-up card, the seat hands it to the repo:cloud seat on that seat's post ([PM seat] repo:cloud#1 — 🟢 hotlong · session_01Wxo1xhh2bU66T73q23jzE4 · R44 #6026 plugin-auth: no_sign_in_account_at_boot still fires at ERROR on hosted kernels whose platform-SSO button is hidden (the owner signs in through the cloud handoff, which the gate cannot see) #20861 5915469225).
⭐ A dev's public report can carry a security reproduction. #20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887 5916988260) put a door, a field path and the returned rows for an open gap on a public comment. The seat redacted it in place through the relay's comment_edit; the edit history still holds it, and its purge is raised with the maintainer. ⇒ Read every report and PR body for disclosure before anything else. Orders for security cards now say: push nothing until the fix sits on the red pins.
⭐ Whole-machine restarts come under parallel heavy dev work (about 21:45Z, 22:05Z and 22:38Z on 2026-09-30, and about 11:35Z on 2026-10-01 with two devs under the lock). Each lost the in-flight runs before they reported, though their pushed branches survived. The cause is not measured (the VM exposes no cgroup memory). ⇒ Every order now puts every build, test run, typecheck and gate run under scripts/pm/os-verify-lock.sh, with a 3 GB heap, turbo --concurrency=1 and vitest --maxWorkers=2, and keeps a checkpoint log. Since then, three agents in parallel have run without a restart.
⭐ A container restart came under three devs (2026-10-05T13:15Z). It stopped two devs and the watches, and killed a claim halfway (labels written, comment not). Both devs were resumed with their context through SendMessage, with a resume order (read the checkpoint log, check live state, write nothing twice, re-acquire the lock, treat an in-flight measurement as NOT MEASURED). One finished, re-running its gate battery from scratch. The half-claim was completed with its comment only.
⭐ Hosted runners can starve for hours (2026-10-05T19:20Z to past 2026-10-05T21:30Z: 55 to 82 runs queued, 1 to 3 in progress). A job queued 15 minutes ends cancelled with "not acquired by Runner of type hosted", relay runs included, so a scripts/pm write exits 6 having written nothing. ⇒ Read the run and the target; once both show nothing was written, a resend is safe, and batch strokes to spend fewer runs. The seat has no re-run channel: a PR whose required check was cancelled waits for its next legitimate push or a maintainer's re-run, with one note on the PR.
⭐ A merge group can die on an infra timeout. PR fix(plugin-audit): the activity record label is the record's ADR-0079 title, with the id as the floor #21896
⭐ A resumed run can find its predecessor's writes already done. security(plugin-security): the engine's field guard does not judge a cross-field comparand that names a field the caller may not read, so a comparison against a hidden field is served instead of refused 403 #20932
⭐ issue-create can report UNVERIFIED although the issue exists.analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918 security(plugin-security): the engine's field guard does not judge a cross-field comparand that names a field the caller may not read, so a comparison against a hidden field is served instead of refused 403 #20932
check-expected-skips.mjs / check-half-states.mjs will not run without pnpm installNOT MEASURED , ⛔ never read as a clean board.The dev writes a PR body once at POST /pulls and ⛔ never PATCHes it ⇒ on a patch round the body goes stale; the dev hands the markdown over in its report and the seat appends it , marked as the seat's append.⭐ git-history.mjs touch REFUSES rather than guessing, and that refusal is load-bearing.git log -1 -- <path> answers at exit 0 with a real, plausible, WRONG sha . Measured this seating on references/lanes/services.md; the true value came only after unshallowing to 14358 commits.
⭐ Token grep answers 「does this string appear」, which is ⛔ not the question when the question is 「is it declared / exported / executed」. Prose describing a thing is indistinguishable from the thing. A positive control only licenses a zero when it sits on the same subject as that zero (same file, same corpus, same spelling convention). ⭐ Live example carried on-card at [finding] service-messaging: sms-channel declares no isAvailable() — fan-out can suppress email on an absent transport but never sms (#17732's unfinished half) #18567 isAvailable in sms-channel.ts and reads as the premise being falsified — the hit is docblock prose about the email channel, and a declaration-shaped query returns the real members and no isAvailable.
Platform facts measured by the last incumbents (session_01Evb5jFDZGKQE9KG4jbMfMF and its predecessor)
5. Notes
This post is the single authoritative registry for the
domain:servicesseat (seat-post protocol; indexlabel:pm:seat). Single writer: the incumbent only. Read side: this body plus every comment newer than the body's last edit. ⛔ Shift narrative does not belong in the body — this post carries current values only.Body set to vacant at the sign-off of
session_011K3zqE8Pv1Evw5hc8tZCnNat 2026-10-06T05:38Z. The closing brief is the last comment on this post. §4 and §5 carry forward; §1–§3 are the hand-off ledger.1. Current PM — ⏳ vacant
session_011K3zqE8Pv1Evw5hc8tZCnN(os-steve) at 2026-10-06T05:38Z, on the maintainer's order 「当前任务处理完，合并后就下班」 (2026-10-06T04:20Z). It was seated 2026-10-04T13:44Z. Its last act is the closing brief, the newest comment on this post, which is the release marker for a successor.trig_01HbFWv6NfhwrUgxzEJWpamLis deleted at sign-off. No timer of this seat remains./pm-dispatch services 1(接手); read this post first. Seat 2 ([PM seat] domain:services · seat 2 — 🟢 os-warren #21118) is held byos-warren(session_01WMQprn46CND82KmY8sZWBu, seated 2026-10-06T04:28Z) and draws on the same queue.objectstack-fleet[bot]) viascripts/pm/*.2. Ledger — current values
completedbyFixes, withpm:dispatchedand the assignee cleared and a landing note on the card:1c3a4d97). TOTP issuer = deployment app name;servenow passesappName.c7a60e1c). Explain namesdepthfor a depth-only row.33f97917), after one seat-added doc patch round.FileConstraintErroranswers 400ERR_FILE_CONSTRAINT.completedbyFixes, withpm:dispatchedand the assignee cleared and a landing note on the card:security): PR fix(service-storage,plugin-audit): a write refusal on a parent the caller cannot read names nothing #21769 (50b5e033). The attachment and comment gates answer the not-visible refusal for an unreadable parent. Its residual existence-signal class is filed as security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771.role:arm of the position-address equivalence once the pinned console sendsposition:(ADR-0090 D3; split from #21379 item 5) #21387 (p3, ruling A2): PR fix(plugin-approvals)!: retire the role: position-address arm and write the canonical fallback slot literal (ADR-0090 D3) #21770 (c9c555ac), after two patch rounds.role:POSITIONis no longer a position address; the deprecatedroletype's fallback writesorg_membership_level:VALUE; the ADR-0087 D3 entryapproval-position-address-role-retiredis in step 18. Contract review: FAIL5983490043(head24f5c5a9), then PASS5983923878(headd0a53cc6). Landing note5984160937.completedbyFixes, withpm:dispatchedand the assignee cleared and a landing note on the card:security): PR fix(plugin-security)!: on the write doors, a row the caller cannot read answers what a nonexistent id answers #21812 (53021e3a), after an at-tier contract review PASS (5989209782). Landing note5989739239. The objectui console census leg was measured afterwards (5992106372): no class (a) dependency. The console's 404 friendly-copy gap is handed to therepo:objectuiseat ([PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #60255992123734).08adfeade8). Landing note5989754110.area:api): PR fix(service-datasource)!: Import as Object saves through the metadata door's save #21837 (07e933be),minorwith!. Landing note5992355595.area:access): PR fix(plugin-security): the permission-set lock reads the row's provenance, so org-owned sets, clones and runtime-package sets edit again #21857 (c9be1f17),patch. Landing note5992832603.area:identity): PR fix(plugin-auth): phone send-otp with no deliverable SMS service answers 400 SMS_SERVICE_REQUIRED instead of a bare 500 #21858 (a43d90ab), after an at-tier contract review PASS (5992404330). Landing note5993014615.area:access): PR fix(plugin-security): Discard Overlay refuses every permission set no code package ships, so a runtime-package set's only stored row is no longer deleted #21873 (5e0b489b),patch. Seat verdict5994739292, landing note5995692964.?force=true, which the import route never reads — a third face of #11095's class (reachable once #21788 lands) #21841 (p2,area:api): PR fix(service-datasource): a destructive re-import's refusal names the remedies that work from the import route #21874 (e864db56), after an at-tier contract review PASS (5995209979). Landing note5996057194.sys_metadatarows for one name #21861 (p2,area:access): PR fix(plugin-security): a data-door edit of a permission set saved into a writable runtime package updates its own row instead of forking it #21881 (07c842df). Landing note5997267561.objectstack startthe federation service reads ametadataservice it captured at init, before that service registers —external/validateanswers no rows and the boot gate checks zero federated objects #21876 (p3,area:api, a seat-owned sub-issue of service-datasource:POST /external/validatedoes not see a federated object saved at runtime (throughPUT /meta/objector the import) until the next restart #21842): PR fix(service-datasource)!: on objectstack start, read the metadata service when it is used, so validate and the boot gate compare every federated object #21887 (bc7747cb),minorwith!. Landing note5998069253.area:workflow): PR fix(plugin-approvals): approval notifications reach their recipient with their text, sent as body, the field messaging reads #21888 (255a7775). Landing note5998517648.POST /external/validatedoes not see a federated object saved at runtime (throughPUT /meta/objector the import) until the next restart #21842 (p3,area:api): PR fix(service-datasource): external validate sees a federated object saved at runtime, with no restart #21875 (25eb7de8), after option C (5995103062) and a merge patch round. Landing note6000150043.area:records): PR fix(plugin-audit): the activity record label is the record's ADR-0079 title, with the id as the floor #21896 (b2388563), re-queued once after an infra timeout (5999675966). Landing note6000331112.security, ruling B): PR fix(plugin-security)!: a predicate-scoped update or delete matches only the rows the caller can read #21900 (cab63967), after an at-tier contract review PASS (5999880609). The residual class the review asked for is recorded at class level (5999863939). Landing note6000715360.area:workflow): PR fix(service-automation)!: a flow the kernel:ready cold-boot bind refuses is withdrawn, not left registered and active from the boot pull #21897 (54fb60ac). The cold-boot withdraw shipped; the value judge is feat(spec)!: the build doors judge an approval node config against its declared contract, whole — an undeclared key or a refused value is refused with a location #21893'sFlowSchema. service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 went back to triage (pm:retriage).area:identity): PR fix(plugin-auth): revalidate the memoized default organization id when a user is bound #21905 (dcb11c2e), route B. The door scenario moved to finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910, which fix(objectql): the cascade skips a federated object's injected tenant anchor #21917 has since fixed.area:access): PR fix(plugin-security): the packaged-permission-set lock refusal carries its guidance as userMessage #21902 (833d57c9). The contract review PASS (6003307825) carried across a clean base merge.security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908): PR fix(metadata-protocol, objectql, core): platform store reads and writes carry the explicit system opt-in #21938 (d16b9fbf).security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908): PR fix(plugin-auth, runtime): four principal-less producers take the explicit system opt-in #21939 (131b937a).security, a slice of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908): PR fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940 (76fec88b).Clause-②: yes (widening); at-tier contract review PASS (6009643000).security, the closure of the principal-less hand-off) went topm:blocked(release6009663942). It waits on the maintainer's ruling on open question 1 (the request-door producers acting on the caller's own rows: rows 15 and 16, the inbox unread count, mark-read) and on two rows held off-thread with the maintainer. The census rows still to route before the deny are 22, 23 and 24 onward (named in the release). The deny is decided:403 PERMISSION_DENIEDonisPrincipalLessContext && !isSystem, landing last.?force=true, which the import route never reads — a third face of #11095's class (reachable once #21788 lands) #21841 and service-datasource:POST /external/validatedoes not see a federated object saved at runtime (throughPUT /meta/objector the import) until the next restart #21842 (from service-datasource: importing an external table under a name that differs from its remoteName creates an object that answers 500 "no such table" — and the import does not survive a restart #21788); plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860 and plugin-security: a data-door edit of a permission set saved into a writable runtime package forks it — the write-through's update leg saves without the row's package, leaving two activesys_metadatarows for one name #21861 (seat-owned sub-issues of plugin-security: permission sets an org owns (or that live in a writable runtime package) are reported and enforced as "locked by the code package" — the lock reads the package id without the row's provenance #21789); service-datasource: onobjectstack startthe federation service reads ametadataservice it captured at init, before that service registers —external/validateanswers no rows and the boot gate checks zero federated objects #21876 (from service-datasource:POST /external/validatedoes not see a federated object saved at runtime (throughPUT /meta/objector the import) until the next restart #21842); service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 (p2,pm:blocked, the built-in node types of automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848's class; its fix likely belongs to the spec'sFlowSchemajudge,5998950686). Findings for triage: [finding] A code-defined datasource is registered without its package's provenance, so the external import never applies the ADR-0028 namespace rule to it — an import names an unprefixed object and is accepted #21889 (a code-defined datasource carries no package provenance, so the import's namespace rule never runs for it), finding(pm tooling): label-write falls back to a direct write under the seat's personal login when an accepted relay dispatch shows no run within 90 s — the identity exchange #19774 forbade, on a second branch #21892 (label-writefalls back to a direct write under the seat's own login when the relay is slow) finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910 (deleting an organization answers500once a federated object is provisioned; fixed by fix(objectql): the cascade skips a federated object's injected tenant anchor #21917) and finding(runtime, plugin-auth): two access guards fail open when their own read faults — the environment-membership gate and the organization slug guard #21941 (two access guards fail open on their own read fault; claimed by seat 2). Slices of security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908: security(metadata-protocol, objectql, core): platform store reads and writes reach the engine with no principal and no system opt-in — the engine-lane producers of #21908's closure #21911, security(plugin-auth, runtime): raw-engine reads and writes outside the adapter's system context reach the engine principal-less, two of them behind a fail-open catch — the identity and runtime producers of #21908's closure #21912 and security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913.role:arm of the position-address equivalence once the pinned console sendsposition:(ADR-0090 D3; split from #21379 item 5) #21387's residual (the console pin sendsposition:only) is closed (5992115138). security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771's console census found no class (a) dependency (5992106372); the console's 404 friendly-copy gap is handed to therepo:objectuiseat ([PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #60255992123734).5981913912) and left both cards above to this seat. This seat now holds the lane's whole queue.pm:queue: auth: /api/v1/auth/config reports disableSignUp: false under the default invite_only audience posture — the console offers Sign up, then the form is refused 403 objectui#11691 (p2), finding(runtime,metadata-protocol): the metadata door still saves an edit to the host default datasource, which the admin door refuses as code-defined; its code set is not readable from metadata-protocol (the named gap of #21899) #21944 (p2), finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 (p2) and finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 (p3). finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 and finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 both land inservice-datasource/src/datasource-admin-plugin.ts, so they are serial with each other. service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 ispm:queuewithpm:retriage(triage re-grading its domain; no dispatch).pm:blocked: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908; [finding] The delegated-admin gate resolves an EMPTY subtree on a stockobjectstack devboot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057; plugin-sharing: after the #15030 revert, 17.x still cannot reach a NULL-org-seeded business unit from an org-stamped rule — and #14547, its only tracker, is closed #15086; feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write undersingleand refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205 and feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 (the v18 line).pm:on-hold: automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645, finding(service-automation,lint): the resume door evaluates a screen field'svisibleWhenover the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring #20178, [v18] retire the{var}template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939, Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757, 权限设置应该可以配置实效性，权限在一个时间段之内生效 #9272, service: inbound mail + calendar sync (open-core scope) —plugin-emailis outbound-only, so email-to-record is impossible in any app #8998, Design: does approver routing imply record read visibility? (#7345 model half) #7497 and [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883.AuthPluginOptions.appNameundeclared; the better-auth cookie-prefix re-check at the next bump); security(explain): /security/explain reports decidedBy "sharing" ("0 share(s) attached; access is granted") for a read granted by read depth #21726 (write-path depth attribution; thedecidedByshare-plus-rls/ share-plus-vama_bypassprecedence divergence, which becomes a code-alignment card in this lane if door-measured); security(storage): the attachment gate's delete and update refusals name the parent record to a caller outside the floor's domain who cannot read it #21755 (a shared not-visible refusal producer in a lower package); approvals: retire therole:arm of the position-address equivalence once the pinned console sendsposition:(ADR-0090 D3; split from #21379 item 5) #21387 (comment-onlyrole:drift at six sites inpackages/lint,packages/restand the spec approvals contract; the unreleased approvals: "My Pending" never lists a request routed to a position — the console filters withapproverId=role:<p>, the request storesposition:<p>, and the list filter matches literally #21350 / approvals: a holder of a position whose slot readsposition:<p>can see the request but cannot decide it with the default actor (can_actfalse, approve 403), and loses sight of it after deciding (404) #21379 changesets); storage: a file field's accept / maxSize refusal (FileConstraintError) answers 500 INTERNAL_ERROR instead of a 4xx naming the field and constraint #21730 (declared-4xx[REST] Unhandled errorlog noise; the QA checklist clause that predicts the old 500 is routed to the next run).IStorageService.list(prefix)means two different things on the two shipped adapters (local: one level, directories as files; S3: recursive, silently capped at 1000) #5266 carrydomain:servicesand nopm:*state.3. Hot-file serial queue
service-datasource/src/datasource-admin-plugin.ts: finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 and finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 are serial with each other. security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913's edit there has landed.plugin-security/src/security-plugin.ts: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908's deny lands last, after its remaining producers.Cross-lane declarations still open: security(spec, plugin-security): the AI tool contract says a context with no caller runs "RLS-on, sees-nothing", but plugin-security hands a principal-less context straight through, and on a hosted kernel it read and wrote more than a member may #21908's dogfood file on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024 (
6003115545, not added). tenancy: the cached default organization id is never revalidated, so after a deleted default organization is recreated new users are bound to the old id #21868's (5999165777) was never added; its scenario moved to finding(objectql): deleting an organization answers 500 when a federated object is provisioned, because the cascade scan probes the remote table on the platform-injected organization_id #21910.Cross-lane, read and settled: the
domain:specseat's pointer6000345652(feat(spec)!: the build doors judge an approval node config against its declared contract, whole — an undeclared key or a refused value is refused with a location #21893 landed; acted on in fix(service-automation)!: a flow the kernel:ready cold-boot bind refuses is withdrawn, not left registered and active from the boot pull #21897's patch round). Thedomain:cliseat's pointer6000551571: fix(service-datasource): external validate sees a federated object saved at runtime, with no restart #21875 landed first (17:59Z), so fix(runtime,service-datasource): an import over a code-defined datasource is held to its package's ADR-0028 namespace #21906's ownmainmerge drops "package" from themetadata()docblock sentence inservice-datasource/src/plugin.ts. Nothing is owed by this seat. Thedomain:cliseat's pointer6007104699: since test(dogfood): every test file runs in its own temporary working directory #21919, each dogfood file runs in its own temporary working directory; a package-relative read resolves from the module, notprocess.cwd().Cross-lane into this lane: the
domain:specseat's platform gap: a plain member is offered "Invite User" (and other org-admin affordances) that the server then refuses with 403 — an action's visibility cannot be gated on the membership grade #21795 adds ONE new test file inpackages/plugins/plugin-auth, with noauth-manager.tsedit (5993842226). No claim of this seat touchesplugin-auth, so there is no objection.Stale comments to ride the next edit of their files (the spec seat's pointer
5986812680on [PM seat] domain:services · seat 2 — 🟢 os-warren #21118; comments and log text only):security-plugin.tsabout:2109–:2137, theownership-floor-alternates.tsheader, andattachment-delete-floor-alternate.tsabout:47. They are kept out of security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771, a different defect class in a security PR.Lessons carried into every order:
security) had been back inpm:queuesince its ruling. The claim was rolled back and security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829 took the slot. ⇒ The lane is re-read immediately before every claim, never taken from the last wake. Open P0/P1 are re-read each time. A claimed-but-unbuilt card ranks by its own priority, never by being claimed. If a higher card appears while a lower claim is being written, the lower claim is rolled back.main.step18docblock), whereos migrate meta --from 17lists it. A17.*precedent older than the cut does not set the step. Measured on approvals: retire therole:arm of the position-address equivalence once the pinned console sendsposition:(ADR-0090 D3; split from #21379 item 5) #21387: the seat's order named two pre-cut17.*entries, and the contract review failed the placement.yes (narrowing)is one of them: a diff that widens one surface (for example a new member on an exported interface) and narrows another.scripts/pm/clause2-line.mjsdefines them. Measured on automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848, where the seat's own claim first saidno (narrowing).objectstack startthe federation service reads ametadataservice it captured at init, before that service registers —external/validateanswers no rows and the boot gate checks zero federated objects #21876 "no edit to the object reads" was meant as "no change to their read target"; the dev flagged the conflict instead of stopping, which was right.check:*gate battery followsos-dev.md, which keeps it off the lock (a conflict a dev flagged on plugin-security: discard-overlay deletes the only stored row of a permission set saved into a writable runtime package — its eligibility reads "has a package id" as "package-declared", the defect #21789 fixes in the lock #21860).needs:contract-reviewis a waiting marker on the PR only (references/contract-review.md), ⛔ never a gate: added when a Clause-② limb hits and no PASS is on the head, removed by the act that posts the PASS, kept on a FAIL. Name the ⛔-marked roster families in every order.4. Standing facts measured in this lane — ⛔ re-measure before relying, but do not re-discover
session_018avjADnTGyuCcmmLWBxaNrwith aregister_repo_rootin between. ⇒ a successor must carry the repo insession_context.sourcesat creation, and must confirmos-devbefore claiming.Agentcall.failurecan be superseded by a laterskipped/success. Already inplatform-readings.md:301.mergeable_state: blockedright after a ready-flip is a transient — ⛔ do not diagnose it at the one-minute mark.PATCHre-append the_Generated by_footer. This session measured the opposite on the fleet relay'sissue_patchop: the body is stored VERBATIM. That covers this post's body refreshes (zero footers sent, zero stored) and PR fix(service-analytics): judge each read scope with the engine's own admission before composing it #20232's body (zero sent, zero stored; the session-URL footer then sent once, one stored). ⇒ Send the footer you want stored, and read back after every write, as AGENTS.md says.post-stampednow enforces the stamp contract (mainf415bcf1): a body carrying{{NOW}}REFUSES any other bareYYYY-MM-DDThh:mmZstamp. Write a quoted instant as{{WAS:…}}.POSTnormalises whitespace: the stored body can differ from what was sent by an inserted newline before a trailing---. ⇒ a read-back equality check on fragile comments should compare fragments, not byte-identity, or it will cry wolf./search/*path is refused in this container (sessions are bound to their repositories). Run dedupe searches through the MCPsearch_issuesREAD tool. ⛔ It is never a write channel.ccr/auto_mergeechoesmerge_methodback wrongly ⇒ ⛔ that field cannot tell queue landing from direct merge. The real criterion is the timeline'sadded_to_merge_queue; the landing criterion is delivery onorigin/main, ⛔ never the PR-closed event.pm:*state label and assignee ⇒ clear both on reading the merge event, with a note (⛔ never a silent assignee drop — the H47 shape).cleanwith auto-merge enabled for 17 minutes and noadded_to_merge_queue, while a PR readied later was queued within two minutes. One relayautomerge_disable+automerge_enablepair queued it at once. It re-runs no CI, so it is not a kick.where/ preview door, the read scope) and the memory cube face's door, with the F5 / F11 output vocabulary #20810 (PR feat(service-analytics,driver-memory): the shared filter lowering at the analytics seams and the cube face's new door (#5930 step 3) #20857), a queue merge of a PR whose body openedFixes #Nleft the card open, with noclosedevent. Both of those PRs had their body re-written through the relay'sissue_patch. That is not the cause: security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917 (PR fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931) closed on its own although its body was also re-written that way. The cause is unmeasured. ⇒ After everyFixeslanding, read the card's state; if it is still open, close itcompletedthrough the relay'sissue_patch, and say so in the landing comment.objectstack-ai/cloud. When triage asks this seat for a cloud follow-up card, the seat hands it to therepo:cloudseat on that seat's post ([PM seat] repo:cloud#1 — 🟢 hotlong · session_01Wxo1xhh2bU66T73q23jzE4 · R44 #6026), in the landing act. The hand-off carries the declaration line and the unlock condition (the release is installable). ⛔ It is not a claim. First done for plugin-auth:no_sign_in_account_at_bootstill fires at ERROR on hosted kernels whose platform-SSO button is hidden (the owner signs in through the cloud handoff, which the gate cannot see) #20861 (5915469225).domain:services): the cube read and the analytics read scope answer{ relation: { field: value } }as the engine seam now serves it — as the caller, capped, one answer on every face #20887's round-0 report (5916988260) put a door, a field path and the returned rows for an open gap on a public comment. The seat redacted it in place through the relay'scomment_edit; the edit history still holds it, and its purge is raised with the maintainer. ⇒ Read every report and PR body for disclosure before anything else. Orders for security cards now say: push nothing until the fix sits on the red pins.scripts/pm/os-verify-lock.sh, with a 3 GB heap, turbo--concurrency=1and vitest--maxWorkers=2, and keeps a checkpoint log. Since then, three agents in parallel have run without a restart.SendMessage, with a resume order (read the checkpoint log, check live state, write nothing twice, re-acquire the lock, treat an in-flight measurement as NOT MEASURED). One finished, re-running its gate battery from scratch. The half-claim was completed with its comment only.cancelledwith "not acquired by Runner of type hosted", relay runs included, so ascripts/pmwrite exits 6 having written nothing. ⇒ Read the run and the target; once both show nothing was written, a resend is safe, and batch strokes to spend fewer runs. The seat has no re-run channel: a PR whose required check was cancelled waits for its next legitimate push or a maintainer's re-run, with one note on the PR.issue-createcan report UNVERIFIED although the issue exists. Measured twice (analytics: on the ObjectQL strategy a$notover a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as$ne: nullon a JSON column, where the engine answers the rows #20918, security(plugin-security): the engine's field guard does not judge a cross-field comparand that names a field the caller may not read, so a comparison against a hidden field is served instead of refused 403 #20932): the relay run succeeded, the read-back found no issue, and the board showed it with the exact title and body. ⇒ Read the board; ⛔ never retry blind.check-expected-skips.mjs/check-half-states.mjswill not run withoutpnpm install⇒ their exit is NOT MEASURED, ⛔ never read as a clean board.POST /pullsand ⛔ never PATCHes it ⇒ on a patch round the body goes stale; the dev hands the markdown over in its report and the seat appends it, marked as the seat's append.git-history.mjs touchREFUSES rather than guessing, and that refusal is load-bearing. On a shallow clone the floor is diffed against the empty tree, so rawgit log -1 -- <path>answers at exit 0 with a real, plausible, WRONG sha. Measured this seating onreferences/lanes/services.md; the true value came only after unshallowing to 14358 commits.sms-channeldeclares noisAvailable()— fan-out can suppressemailon an absent transport but neversms(#17732's unfinished half) #18567: a bare grep findsisAvailableinsms-channel.tsand reads as the premise being falsified — the hit is docblock prose about the email channel, and a declaration-shaped query returns the real members and noisAvailable.Platform facts measured by the last incumbents (
session_01Evb5jFDZGKQE9KG4jbMfMFand its predecessor)REST reachable:
/rate_limitcore 15000/15000, repo-scoped read leg 200 ⇒ session gate open. Write identityhuangyiirene.ghis ABSENT in this container — REST goes throughcurlor pythonurllib.fetchdoes ⛔ not readHTTPS_PROXYhere;scripts/pm/*re-exec themselves with--use-env-proxyand say so on stderr.Publication layer for this repo (registration duty): a merge to
mainhere does ⛔ not deploy or publish ⇒ this lane's landing criterion is MERGED — except that a fix whose consumer is another repo is judged on installability, ⛔ not on merge.⛔
cloudandhotcrmare NOT reachable from this session (GitHub scope:objectstack-ai/objectstack). Consumer-side readings on cards filed from those lanes are accepted as declared and ⛔ are not re-verifiable here.⭐
objectstack-ai/objectuiIS readable, read-only. It is public:add_repoanswered that git read is already served, and a blobless shallow fetch of the.objectui-shapin into the scratchpad works. ⛔ No write channel exists. Console census legs are measured, not declared unmeasurable (measured for security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 and approvals: retire therole:arm of the position-address equivalence once the pinned console sendsposition:(ADR-0090 D3; split from #21379 item 5) #21387 at pin0abd4f9f).This session's reading: REST reachable,
/rate_limitcore 15000/15000, repo-scoped read 200.ghis absent;node_modulesis absent in the shared checkout. The relay selector answersdispatch(workflow onmain, Actions stateactive).5. Notes
issuecomment-5724940310names the gate by number, rejects option B as 「waits on a line the maintainer has not opened」, and the maintainer agreed 「其他同意」 — and that ruling's own Execution block routes the card topm:queue. ⇒ per-card maintainer authorisation, ⛔ not a seat overriding a gate. The reasoning is recorded on-card atissuecomment-5740746890.H525 of 50 rows,H193 of 12,H263 of 17, with 36 families partly omitted. ⛔ The absence of a row naming this lane is not a clean board.