From 7f0c390035ae0d28a5fc6a9c27225e1448089a63 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 13:20:17 +0000 Subject: [PATCH 1/2] =?UTF-8?q?docs(adr-0131):=20D6's=20second=20install?= =?UTF-8?q?=20mode=20is=20spelled=20`unmanaged`=20=E2=80=94=20a=20dated=20?= =?UTF-8?q?spelling=20note=20executing=20ruling=20B=20on=20#15213?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `template` spelling of the second install mode becomes `unmanaged` at the positions the ruling names: D2's install-mode sentence, D6's "Two install modes" paragraph, its restatement in §6, and §8's C12 row. One dated note at D6 records the ruling and its reasons. Every other mention of "template" is kept as written; D6's substance is unchanged. Claude-Session: https://claude.ai/code/session_016njDy8ozy9B9Ns5Y8kAWEK Co-authored-by: Claude --- ...ation-ownership-no-null-organization-id.md | 21 +++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index 8bda39834ec..890214a0866 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -266,7 +266,7 @@ environment ledger exactly as ADR-0094 D3 already redirects it today. Setup authoring under `single` requires `manage_metadata` — D14's execution-plan note, item 4. A package reaches a deployment in one of **two install modes** (D6): **managed** — registered as code, -sealed, upgradeable; or **template** — copied once into the environment ledger as environment +sealed, upgradeable; or **unmanaged** — copied once into the environment ledger as environment metadata, fully editable, no upgrade channel, refused on shared-DB multi-tenant postures. This retires: `bootstrapBuiltinRoles`, `bootstrapDeclaredPositions`, `bootstrapDeclaredPermissions`, @@ -375,7 +375,20 @@ The `single` anchor's own disposition is #11979's (Choice 4B), which this record **Two install modes.** The package **declares** the modes it permits (`installModes`, default `['managed']`); the installer picks one at install time; a shared-DB multi-tenant deployment refuses -`template` whatever the package permits (ruled 2026-09-04). +`unmanaged` whatever the package permits (ruled 2026-09-04). + +**Spelling note (2026-10-11, #22831).** The second install mode is spelled `unmanaged`: the maintainer's +ruling **B** on [#15213](https://github.com/objectstack-ai/objectstack/issues/15213) (record `6108509158`, +「同意」, 2026-10-11). This record was accepted spelling it `template`; the value now reads `unmanaged` in +this paragraph, in D2's install-mode sentence, in §6's record of the accepted install-mode question and in +§8's C12 row. Why: it is the industry's name for this mode — Salesforce's unmanaged packages and Power +Platform's unmanaged solutions, both already in [ADR-0086](./0086-authz-metadata-config-boundary-and-cross-package-composition.md)'s +comparison; `managed` and `unmanaged` are the two states of one property, whether the package stays the +authority; and `template` already names other things in the code — the scaffold manifest +(`TemplateManifestSchema`), the `email_template` metadata type and the `os init` templates. ⛔ Only the +spelling moves: the copy-once import, full editability, no upgrade channel and the refusal on `group` / +`isolated` stand as decided. The rest of this record's prose — the **Template** bullet below, "template +package", "template import", "template install mode" — is kept as written and names this same mode. - **Managed** (default). The package is registered into the registry as code. **No door edits a managed definition** — not Setup, not Studio, not the data or metadata API; to change one, the vendor publishes a @@ -837,7 +850,7 @@ sits beside them. Four of the five questions this draft carried were **accepted as proposed** on 2026-09-04 (「接受你的建议」) and are now part of the decisions: the `single`-posture first-user grant row is owned by the Default Organization (D5); the package **declares** the install modes it permits (`installModes`, default -`['managed']`), the installer picks one, and a shared-DB multi-tenant deployment refuses `template` +`['managed']`), the installer picks one, and a shared-DB multi-tenant deployment refuses `unmanaged` whatever the package permits (D6); deployment-level settings go to configuration, with a tenant-less object only for values an operator must change without a restart (D7); ADR-0005's per-organization overlay axis is retired (D6). One remains: @@ -924,7 +937,7 @@ One epic tracks the family. C0 and #15030 land before 17.3; every other card is | C3 | Retire the seeders, the per-organization catalog machinery and the four catalog objects; `PositionSchema.permissionSets` added and `sys_position_permission_set` rows migrated into definitions; built-ins and audience anchors as declared metadata; Setup catalog creation = environment metadata write under `single`, refused under a wall; platform-admin grant row owned by the Default Organization | D2, D3, D5, D13 | C1, C2 | | C4 | Templates: `sendTemplate` resolves the registry; seed and provenance stamp retired; door closed; customized-rows ruling applied | D6, D10 | ADR merge (+ §6 Q1) | | C5 | `sys_metadata` family tenant-less (environment definitions, UI-editable by metadata authors); per-organization overlay axis retired (org-scoped writes of the five tier-A types refused); `sys_view_definition` and its two runtime index migrations retired as inert (ADR-0087 entry; ADR-0017 amended); ADR-0005 amended | D6, D7, D13 | C1 | -| C12 | Template install mode: manifest `installModes`, one-time import into the environment ledger with provenance, refusal on `group` / `isolated`, CLI + marketplace surfaces | D6 | C5 | +| C12 | Unmanaged install mode: manifest `installModes`, one-time import into the environment ledger with provenance, refusal on `group` / `isolated`, CLI + marketplace surfaces | D6 | C5 | | C6 | Deployment-level state has no column: settings global rung leaves `sys_setting`; plumbing objects drop the column; #12699 declaration made total | D7 | ADR merge (+ §6 Q3) | | C7 | Inventory + the manual migration ceremony (`os migrate` family: plan / apply / post-check, idempotent + resumable, per-table constraint gate) and the v18 boot refusal against an un-migrated database. First named fate-3 members (the #14096 census, ruled 2026-09-04): `sys_file`, `sys_upload_session`, `sys_approval_request`, `sys_approval_action`, `sys_approval_approver`, `sys_automation_run`, `sys_notification_delivery`, `sys_record_share` | D10 | C2, C3, C4, C5, C6 | | C8 | One predicate; NOT NULL per cleared table; every-posture refusal; both arms and the ledger retired — protocol 18 | D1, D8, D9, D13, D14 | C7 | From 3d9b4f245edb932a9cb4f45d7dfb36e6b043f207 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 11 Oct 2026 14:11:34 +0000 Subject: [PATCH 2/2] =?UTF-8?q?docs(adr-0131):=20D6's=20bullet=20label=20i?= =?UTF-8?q?s=20spelled=20Unmanaged=20too=20=E2=80=94=20the=20maintainer's?= =?UTF-8?q?=20decision=20B=20on=20the=20spelling=20note=20card?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The D6 bullet label "Template." becomes "Unmanaged."; its body is kept. The spelling note now names the bullet label among the sites that read `unmanaged`, cites decision record 6109891008 beside ruling B, and drops the bullet from its list of kept prose. No other mention moves. Claude-Session: https://claude.ai/code/session_016njDy8ozy9B9Ns5Y8kAWEK Co-authored-by: Claude --- ...ation-ownership-no-null-organization-id.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md index 890214a0866..ef20c974501 100644 --- a/docs/adr/0131-total-organization-ownership-no-null-organization-id.md +++ b/docs/adr/0131-total-organization-ownership-no-null-organization-id.md @@ -379,16 +379,18 @@ The `single` anchor's own disposition is #11979's (Choice 4B), which this record **Spelling note (2026-10-11, #22831).** The second install mode is spelled `unmanaged`: the maintainer's ruling **B** on [#15213](https://github.com/objectstack-ai/objectstack/issues/15213) (record `6108509158`, -「同意」, 2026-10-11). This record was accepted spelling it `template`; the value now reads `unmanaged` in -this paragraph, in D2's install-mode sentence, in §6's record of the accepted install-mode question and in -§8's C12 row. Why: it is the industry's name for this mode — Salesforce's unmanaged packages and Power -Platform's unmanaged solutions, both already in [ADR-0086](./0086-authz-metadata-config-boundary-and-cross-package-composition.md)'s -comparison; `managed` and `unmanaged` are the two states of one property, whether the package stays the -authority; and `template` already names other things in the code — the scaffold manifest +「同意」, 2026-10-11) and, for the bullet label below, the maintainer's decision **B** on #22831 (record +`6109891008`, 2026-10-11). This record was accepted spelling it `template`; the value now reads `unmanaged` +in this paragraph, in the **Unmanaged** bullet label below, in D2's install-mode sentence, in §6's record of +the accepted install-mode question and in §8's C12 row. Why: it is the industry's name for this mode — +Salesforce's unmanaged packages and Power Platform's unmanaged solutions, both already in +[ADR-0086](./0086-authz-metadata-config-boundary-and-cross-package-composition.md)'s comparison; +`managed` and `unmanaged` are the two states of one property, whether the package stays the authority; and +`template` already names other things in the code — the scaffold manifest (`TemplateManifestSchema`), the `email_template` metadata type and the `os init` templates. ⛔ Only the spelling moves: the copy-once import, full editability, no upgrade channel and the refusal on `group` / -`isolated` stand as decided. The rest of this record's prose — the **Template** bullet below, "template -package", "template import", "template install mode" — is kept as written and names this same mode. +`isolated` stand as decided. The rest of this record's prose — "template package", "template import", +"template install mode" — is kept as written and names this same mode. - **Managed** (default). The package is registered into the registry as code. **No door edits a managed definition** — not Setup, not Studio, not the data or metadata API; to change one, the vendor publishes a @@ -409,7 +411,7 @@ package", "template import", "template install mode" — is kept as written and - **E — extend** (`object`, `app`): fields, validations, navigation arrive as a package. Managed is the **only** mode a shared-DB multi-tenant deployment (`group` / `isolated`) accepts, and every regime there is environment-wide and operator-gated — a plant admin neither overlays, switches nor clones. -- **Template.** The package's metadata is copied **once** into the environment definition ledger as +- **Unmanaged.** The package's metadata is copied **once** into the environment definition ledger as environment-provenance items — from then on it is the environment's own metadata, editable in Studio like anything authored there, with no upgrade channel (a later version is a new import, refused where names collide; provenance recorded for information only). ⛔ **Refused on `group` / `isolated`** with a message