docs(adr): ADR-0131 D6 charts sharing_rule under regime C; D7 ledger reading and lines for #24377 and #24435; D14 records the 18.0 scope

[objectstack-fleet]

Fixes #24420
Part of #24343
Part of #15212
Clause-②: no

What this changes

The PR adds seven dated notes to docs/adr/0131-total-organization-ownership-no-null-organization-id.md (+73 / −0). It rewrites no ruled sentence.

• Note 1 carries out ruling A on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378, recorded at comment 6258883445, items 1–4 (the maintainer's 「24378 同意 A」). Ruling A supersedes ruling B′ (6257388265).
• Note 2 is the ledger reading that B′ item 1 ordered. A keeps it, and sharing rules are added as a fifth reader.
• Notes 3–5 are the three D7 lines for ruling 6257510973 on [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 (Q2 A, Q4 A).
• Note 6 carries out ruling Q1 A on [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435, recorded at comment 6259141885 (「同意」).
• Note 7 records the 18.0 release scope from ruling records 6259608309 and 6259698357 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 (「同意」, twice).

1. D6, after the install-mode bullets: sharing_rule is charted under regime C.
   • Declared rules are read-only and clonable.
   • Switch-off is the active bit of a sys_metadata_activation row of type sharing_rule. The switch is deployment-level and operator-gated under a wall, and there is no per-organization switch-off. Organizations author their own rules (D3).
   • Customising is a clone under a new name, plus switching the base off.
   • Same-name shadowing is retired. Every same-name row, new or renamed, is refused. A declaration that arrives over an authored row is reported loudly at load.
   • The ceremony migrates customised copies and deletes uncustomised mirrors (D10 fate 2).
   • The ruling is built by plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421. PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 landed the switch, the refusals and the load-time report on 2026-10-19. The ceremony step lands with the 18.x upgrade path.
2. D7, after its first paragraph: the activation ledger reads one way. D7's "reverted before 17.3" clause is read the way D6, D13, D14 and C0 hold it. The note now names sharing rules as a fifth reader.
3. D7, after the writer-membership paragraph: three dated notes for ruling 6257510973 on [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377. Each is stated as ruled, not shipped.
   • Identity mail goes to a deployment-level sibling of sys_email.
   • sys_secret has no organization column.
   • sys_setting_audit's global rung goes to a deployment-level sibling.
4. D7, after the [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 lines: sys_flow_credential is deployment-level (ruling 6259141885, Q1 A).
   • It is to declare systemFields: { tenant: false }. A credential's ownership follows its flow, which is environment metadata (D2/D6). This matches the sys_secret note.
   • It is ruled, not shipped.
   • [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q2 orders no line, because D2 already says no seeder writes declared items into any table.
5. D14, after the 2026-10-10 execution-plan note: a release-scope note (ruling records 6259608309 and 6259698357).
   • 18.0 ships for fresh installs on single only. In 18.0, os migrate organization-ownership and the walled postures are refused.
   • Stage 8b ships in 18.0.
   • The upgrade path, the walled postures, 8b-0d / 8b-0e / 8b-0g, 8c, 8d and 8e ship in 18.x.
   • The v18 line, the fence and §8 stand.

Why this reading, and not a new decision

The contradiction needed no new decision, because the record and the code agree on one side. Measured on origin/main 71fa166e:

• packages/platform-objects/src/system/sys-metadata-activation.object.ts declares sys_metadata_activation with systemFields: { tenant: false }. This is C0, shipped by fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024, which is closed.
• Flows read the ledger (service-automation FlowActivationStore), and so do actions (objectql/src/action-activation.ts) and positions and permission sets (core/src/security/resolve-authz-context.ts, runtime/src/domains/catalog-activation.ts).
• The C7 inventory (packages/cli/src/utils/organization-ownership-inventory.ts) cites "D7, D6, D14 (C0): the tenant-less activation ledger".

Nothing in the tree reverts the ledger.

Verification

Docs only. No package, no content/docs/releases/. Gates were derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack against merge base 71fa166e9. They ran on commit 7b9b0c0. The pushed head a41ddd96 has the same tree; only the commit trailer was reworded so the pre-push trailer check would pass. The D7 commit 2261458d re-derived the same 74 commands on that head: 19/19 derived families exit 0, 50/55 roster rows exit 0, and the other five are NOT MEASURED for want of PR context or a whole-tree build (os-dev-report 6257947772).

• 19 derived families: 19 run, all exit 0. --ran reports "19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero)". The families include check-adr-links, check-adr-symbol-anchors, check:adr-anchors, check:doc-authoring, check:nul-bytes, check:pm-governed-merges and check:pm-prior-rulings.
  • check:doc-formula-expressions first exited 3 with PREREQUISITE NOT MET, because @objectstack/formula had no dist/. After turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under the verify lock, it exited 0.
• Artifact-roster block (55 rows): 49 exit 0. The other 6 are NOT MEASURED, and none is a finding.
  • check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths (exit 2), and check-governed-queue-guard (exit 1, no GITHUB_EVENT_PATH), had no PR context. CI runs them.
  • check:dts-closure and check:published-readme-exports (exit 3) need a whole-tree build. CI runs them.

The rework commits b1e9de61 (regime C), 371b98ae (#24435 Q1) and 3d9490fa (D14 scope) each re-derived the same 74 commands: 19/19 derived families exit 0, and 50/55 roster rows exit 0. The same five are NOT MEASURED. Source: the final os-dev-report on #24420 for 3d9490fa.

Changeset

None. The diff publishes nothing: docs/adr/** is a fast-lane, unpublished path, so the PR carries skip-changeset.

Landing

This is a governed surface (docs/adr/**), so the PR is Tier H. It needs an at-tier ## Contract review record, and then the maintainer merges it. No seat readies, queues or merges it.

维护者速读

• 改了什么: ADR-0131 加七段带日期的 Note(+73 行),不改任何已裁决原文。
  • ① D6: 按裁决 A(「24378 同意 A」,取代 B′)把 sharing_rule 归入 C(停用 + 克隆)制度。
    • 声明的规则只读、可克隆。
    • 停用是 sys_metadata_activation 中 sharing_rule 类型行的 active 位:部署级,隔离部署下由运维把关,没有组织级停用。
    • 定制 = 新名克隆 + 停用原规则。
    • 同名覆盖退役:同名行一律拒绝;升级带来的同名声明在加载时响亮报告。
    • 仪式把已定制副本迁成克隆 + 停用,并删除未定制镜像(仪式部分随 18.x 升级路径)。
  • ② D7: 启用账本统一读作「保留」;共享规则成为第五个读者。
  • ③ D7: [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 的三行(身份邮件、sys_secret、全局设置审计)。
  • ④ D7: 按 [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q1 A(「同意」),sys_flow_credential 不设组织列,凭据归属随所属 flow。
  • ⑤ D14: 记下 18.0 范围。
    • 18.0 只面向新装、只支持 single;os migrate organization-ownership 与隔离部署在 18.0 拒绝。
    • 8b 进 18.0;升级路径、隔离部署、8b-0d/8b-0e/8b-0g、8c、8d、8e 进 18.x。
• 为什么改: 执行以下裁决,让 ADR 与 18.0 范围只有一种读法:
  • [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 的裁决 A 第 1–4 项;
  • [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q1;
  • [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 Q2、Q4;
  • [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 上的 18.0 范围裁决记录。
• 风险与代价(含回滚): 纯文档,73 行,零运行时影响;回滚即 revert 本 PR。
• 席位意见: 最终契约评审 PASS(记录见本 PR 评论,head 3d9490fa)。
  • 评审提示两点,可接受为「按发版口径」的日期状态:
    • D6、D7 两段写「尚未发布」,而 plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 已于 05:27Z 合入 main,但 18.x 尚未发版;
    • D14 未写「18.0 新装库以后也走 18.x 升级路径」和「8b 在 18.0 只对 single 撤豁免」。
  • 席位建议照现文合并,这两句随 18.0 发版说明或下一条 D14 日期行补上。
• 你要做的: 读七段 Note;PR 仍是草稿,请转 ready 并合并(Tier H)。

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2261458d18b17ff10c39e3e509112cb87f913c25
Local-runs: none
Scope: docs/adr/0131-total-organization-ownership-no-null-organization-id.md + packages/platform-objects/src/system/sys-metadata-activation.object.ts, packages/cli/src/utils/organization-ownership-inventory.ts, packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/plugins/plugin-sharing/src/sharing-rule-service.ts, packages/plugins/plugin-sharing/src/sharing-rule-provenance.ts, packages/platform-objects/src/system/sys-platform-setting.object.ts, packages/platform-objects/src/system/sys-setting.object.ts, packages/platform-objects/src/system/sys-secret.object.ts, packages/platform-objects/src/system/sys-setting-audit.object.ts, packages/platform-objects/src/audit/sys-email.object.ts, packages/services/service-automation/src/engine.ts, packages/services/service-automation/src/flow-activation-store.ts, packages/objectql/src/action-activation.ts, packages/core/src/security/resolve-authz-context.ts, packages/runtime/src/domains/catalog-activation.ts (cited code read on origin/main e22defb1, which is byte-identical to the merge base 71fa166e on the ADR)

Rendered by an isolated at-tier reviewer subagent of the adopting seat (session_01Y5583bs2RDd53MH6kM1ca3), on these inputs and nothing else: card #24420 (body; claim 6257558991; amendment 6257685312; reports 6257808694 and 6257947772, the second superseding the first), rulings 6257388265 (B′ on #24378) and 6257510973 (Q1–Q4 A on #24377) verbatim, PR #24422's body, file list and comments (none), the net diff git diff origin/main...2261458d, the whole ADR at the head, the cited code, and the head's 46 check-runs. The head was re-resolved first and has not moved.

① Derived judgments

The diff is one file, +44/−0, a pure insertion of five dated blockquote notes; no existing line is changed, so no ruled sentence is rewritten — the PR's claim holds. Each note copies the record's existing Note (YYYY-MM-DD, ruling of record …) form and is dated 2026-10-19, the date of both rulings.

(a) The D6 note (head :434–:445) against B′ 6257388265 — right, no binding added, dropped or softened.

• Item 1 (the chart): stated whole — a stored sys_sharing_rule row carrying a declared rule's name, in its scope, replaces the declared rule whole; active: false on that row is the switch-off; D10's ownership ceremony deletes only uncustomised mirrors. The Audit sibling declared-metadata↔record two-store types (sys_position, sys_sharing_rule, sys_capability) per ADR-0094 addendum #2909 promise is carried as content rather than as the ruling's line citation (sharing-plugin.ts:852–:857); that is right, since the ADR symbol-anchor gate forbids line numbers in ADR text, and the code at those lines on main says exactly that ("the ownership ceremony deletes only uncustomized copies", the bindRuleProvenanceStamp hook).
• Item 2 (the guard): "a write that creates a sys_sharing_rule row, or renames one, to a declared rule's name in that scope, and is not an edit of the projected row, is refused at the write door with the vendor rule named." The ruling's "through Setup's New (or any write that is not an edit of the projected declared row)" is carried whole by the general clause; the second sentence of item 2 is carried as "The row is made by editing the declared rule's projected row in Setup."
• Item 3 (the reconcile): the ruling's sentence verbatim; sweepOrphanedRuleGrants() exists in sharing-rule-service.ts and is the boot call in sharing-plugin.ts.
• Item 4 (scope): stated with D3 as its ground; the code backs it — the holder key in sharing-rule-service.ts is name under single and name::organization_id otherwise.
• Item 5: A and C are stated as exclusions ("⛔ Sharing rules get no activation-ledger type, and same-name rows are not refused as a class"); D ("nothing left as is") is not spelled but is negated by construction — the guard and the reconcile are named as plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421's build. Not a dropped binding.
• Nothing beyond the ruling binds: "(D3)", "D10's" and "(ruling item 4)" are cross-references to text that already says what they cite (D3 :326–:328; D10 fate 2).

(b) The D7 activation-ledger note (head :515–:524) — within B′ item 1, a reading note, right.

• B′ item 1 orders this PR to resolve "ADR-0131's own contradiction on the activation ledger (D7 :491 against D6 :419–:420 and D13 :699–:700) so the record reads one way"; the card forbids resolving it by rewriting the ruled text. The three citations map onto the merge base exactly: :491 is the "reverted before 17.3 and does not return" clause (head :504), :419–:420 is unchanged (above the insertions), :699–:700 is "sys_metadata_activation is not on this list" (head :743–:744).
• The note picks the side the rest of the record already holds: D6 :419–:420 and :492, D13 :743–:744, D14 :751–:752, §1.7 :224–:226, §7 :955–:957 ("card fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024, re-scoped from a revert after the standard-package reversal") and the C0 row :996. Only the D7 clause was the outlier, so no decision was open; the note settles how a stray sentence is read and leaves it in place.
• The code supports the reading it picks: sys-metadata-activation.object.ts declares systemFields: { tenant: false } on main and at tag @objectstack/platform-objects@17.3.0 (so "its reserved organization column was dropped before 17.3" is true — fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024 closed completed via PR fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id (#15024) #15155, merged 2026-09-04); the readers the note names exist as named — FlowActivationStore (service-automation/src/engine.ts, flow-activation-store.ts), objectql/src/action-activation.ts, core/src/security/resolve-authz-context.ts, runtime/src/domains/catalog-activation.ts; the C7 inventory row reads "D7, D6, D14 (C0): the tenant-less activation ledger". "A member of this paragraph's family" matches D7 :503–:504, where the object is already listed inside the sys_metadata family.

(c) The three D7 notes (head :536–:554) against 6257510973 items 2 and 4 — right.

• Identity-mail list: verify, reset, magic link, email change, an account invitation to a person with no organization — the ruling's five, no more and no fewer.
• Tenant mail stays in sys_email with its organization NOT NULL and [finding] sys_inbox_message/sys_notification/sys_email 等平台表从不写 organization_id(存量与新增行 100% null)——请确认多组织语义是否设计如此 #11303 decision 2 keeps it stamped at its producers — exactly the content item 2 orders into the dated line, and it matches D7 :529–:530.
• "⛔ Neither a nullable column nor unpersisted mail" carries "Not a nullable column; not 「no persistence」".
• sys_secret is column-less; ownership follows the referencing row with the ruling's own list (sys_setting / sys_platform_setting, the webhook, the flow credential, the field's record, the datasource); every read stays by id under privilege.
• sys_setting_audit's global rung goes to a deployment-level sibling; its tenant and user rows stay NOT NULL.
• Each ends "This is a ruled decision that a C8 stage builds; it has not shipped." That qualifier is load-bearing and present on all three: on main sys_secret still carries the injected column (inventory fate attribution) and sys_setting_audit still holds scope: 'global' rows.
• The present-tense claim "the same departure sys_setting's global rung already makes" is TRUE on main: sys-platform-setting.object.ts is declared systemFields: { tenant: false } with the docblock "the global rung leaves the tenant-scoped table"; sys-setting.object.ts says "the deployment-level rung left this tenant-scoped table (ADR-0131 D7)"; the inventory names sys_platform_setting as "the settings global rung's tenant-less holder (C6, record 6051723395)".
• Stage-level clauses the notes leave on the ruling record (cited by id) rather than restating: Q2's ceremony sentence and "one more table for plugin-email's by-id and by-status reads"; Q4's access: { default: 'private' } stays, encryptSecretFields keeps writing, the fix: framework producers on tenant-column objects name the organization they can derive (ADR-0131 D9, C8 stage 8b-0b) #24369 premise correction, and the audit-row ceremony. None is what the ruling ordered into the dated line (item 2 names the line's content; item 4 orders "a dated line" and the note carries its decision), and D10 governs ceremonies generally — not dropped bindings. One the maintainer may want spelled: access: { default: 'private' }, whose only carrier in the note is "under privilege".

(d) Internal consistency, anchors and links — consistent; all resolve.

• D3: the D6 note's "a sharing rule an organization writes stays its row (D3)" is D3 :326–:328 in substance.
• D7's tenant/deployment split: the identity-mail sibling is column-less (deployment-level) while sys_email keeps NOT NULL; sys_secret column-less under permission is the TL;DR's third shape, "governed by permission, not by a wall"; the sys_setting_audit split mirrors sys_setting/sys_platform_setting. Consistent.
• D9: identity mail is precisely the write D9 refuses under a wall (tenant-column object, no organization); the sibling is the answer, not an exemption. Consistent.
• D10: nothing contradicted; "deletes only uncustomised mirrors" is fate 2.
• D13: the ledger stays off the list (:743–:744) and the D6 note adds no ledger type for sharing rules. Consistent.
• Two tensions the notes record rather than create, both the rulings' own and neither blocking: (i) D6 :425–:426 ("every regime there is environment-wide and operator-gated — a plant admin neither overlays, switches nor clones") now has a ruled carve-out for sharing_rule under a wall (B′ item 4, "today's behaviour"); the note states the carve-out and its D3 ground but does not label it an exception to that sentence. (ii) D7 :532–:534 ("this record names only the objects whose verdict the tree already states") now precedes three notes naming objects whose verdict is ruled but not yet in the tree; the "has not shipped" qualifier is the reconciliation. Both are dated notes beside ruled text — the form the card ordered.
• Anchors and links: the notes carry no markdown links; §7, D3, D10, D13, D14, C0 resolve inside the record; #24421 (open, the companion code card), #15024 (closed completed), #11303, #24378, #24377 exist; the one cited file path exists on main and carries no line number. Gate verdicts on the head: Check ADR cross-links success (job Check Documentation Links); ADR anchors + number uniqueness success (job Lint · repo & tooling gates) and ADR symbol anchors resolve (no line numbers survive) success (job Lint · docs & code guards) — both of those steps are continue-on-error: true in lint.yml, so their STEP conclusions were read, not the jobs': both success.

Check-runs on 2261458: 46, all completed; 0 failure, 0 in_progress. The five required contexts: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (shards 1–6 success), Governed Surface Queue Guard success, Build Core skipped (paths filter — docs-only; not a failure, and nothing for a docs diff to build). The four PR-body gates re-ran on the seat's 02:00Z body edit and are success, including "Part-of PR must not also close its card". Check Changeset skipped (the skip-changeset label honoured).

② Semver level

Docs-only edit of a governed ADR; no package path touched; nothing published from any released package. skip-changeset is right — the label is for a diff that publishes nothing, and Check Changeset honoured it. Clause-②: no is right — no authorable key, export or config field widens or narrows; the text records rulings. Body accuracy against the diff: +44 / −0 ✓, one file ✓, five notes at the stated places ✓ (after D6's install-mode bullets; after D7's first paragraph; after D7's writer-membership paragraph), lines 1–4 Fixes #24420 / Part of #24343 / Part of #15212 / Clause-②: no ✓; the live body equals the seat's body.new.md byte-for-byte plus one trailing newline. One imprecision, non-blocking: "Notes 1 and 2 carry out ruling B′ … items 1 and 5" — note 1 also records items 2, 3 and 4, as the body's own bullets then list. The 席位意见 slot in 维护者速读 is still empty — the seat's to fill before it asks for the word.

③ Boundary flags

1. Keep B′ item 4's scope in the D6 note — A, keep. It is the ruling's own item, grounded in D3 and in today's holder key; dropping it would leave D6's heading ("never per organization") and D3 (an organization's sharing rule is its row) reading two ways for this one type. Flagged for the maintainer: under a wall this is a ruled carve-out from D6 :425–:426, recorded here as the ruling's.
2. Settle the ledger by a reading note rather than escalate — A, accept. B′ item 1 ordered this PR to resolve the contradiction; the card forbade rewriting; D6, D13, D14, C0, §1.7, §7 and the shipped code (main and the 17.3.0 tag) already hold one side. No decision was open to escalate.
3. Three separate dated notes with no stage ids — A, keep. Each note cites its ruling record by id, the ADR's citation form; stage ids (8b-0d, 8b-0e) belong to the C8 plan on feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 and would bind plan numbering into governed text. The PR body's "它合并后 8b-0d、8b-0e 才能派发" is the right place for them.
4. Deviations the reports list. (i) Edits moved from the cloud checkout to a dedicated worktree after guard-main-checkout refused — that is Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11 holding; the claim's "Worktree: the cloud session's own checkout" was the deviation and the dev corrected it; nothing owed. (ii) Gates ran on 7b9b0c0 and were pushed as a41ddd96 with the trailer reworded — tree identity is unverifiable from here; CI on both pushed heads is the verdict and it is green. (iii) premise_still_valid: true holds: main is byte-identical to the merge base on the ADR, so the notes land where the rulings' line citations point.
5. This review made no GitHub write, no checkout, no build, no test and no gate re-run; git fetch into an owned ref refs/review/pr-24422 and the record-template print were its only local commands.

Implemented-by: claude/issue-24420-adr-0131-d6-sharing-rule-overlay
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS

Maintainer, before merging (Tier H — your approval, your ready-for-review flip and your click; the PR is still a draft): read the five notes at head :434–:445, :515–:524 and :536–:554 — the one thing to weigh is the D6 note's per-organization overlay for sharing_rule under a wall (B′ item 4), a ruled carve-out from D6 :425–:426 that the note records but does not label as such.

[os-zhuang]

还需讨论

[objectstack-fleet]

Ruling-pointer · the merge hold stands until the D6 note is rewritten · #24378 re-ruled A at 6258883445 (batch #368 item 1, the maintainer's 「24378 同意 A」; supersedes B′) · director seat (summon #43 continuation 5, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-19T03:19Z

The D6 note in this PR charts sharing_rule under regime O, guarded (ruling B′). Ruling A puts it under regime C: read-only, clonable, switched through sys_metadata_activation (deployment-level, operator-gated under a wall), every same-name row refused, the ceremony migrating customised copies to clone + base-off. The dev rewrites that note here before the merge; the three D7 notes for #24377 are unaffected. Not for the maintainer's Approve until the rewrite is pushed.

[objectstack-fleet]

Pointer · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T03:42Z. Please hold the merge of this PR. It is being reworked, and contract review record 6258201995 covers only the superseded head 2261458d.

Two rulings change it:

• [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378, re-ruled A (6258883445). The D6 note is rewritten from regime O, guarded, to regime C. Same-name shadowing is retired, the activation ledger becomes the switch, and customising means a clone. Claim amendment 6258989827.
• [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435, Q1 A (6259141885). One dated D7 line is added: sys_flow_credential is deployment-level. Claim amendment 6259150966.

The three D7 lines for #24377 and the activation-ledger reading note stay as they are. Once the dev pushes, the seat re-runs the at-tier contract review on the new head and corrects this body. Then the PR goes back to the maintainer, who merges it (Tier H).

[objectstack-fleet]

Ruling-pointer · one more D7 line rides this PR · #24435 ruled Q1 A · Q2 A at 6259141885 (batch #368 item 2, the maintainer's 「同意」) · director seat (summon #43 continuation 5, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-19T03:42Z

With the D6 rewrite for #24378 (6258883445), this PR also carries one dated D7 note: sys_flow_credential leaves the organisation-owned set — deployment-level, systemFields: { tenant: false }, ownership following the flow, built in C8 stage 8b-0de — so the maintainer approves one Tier H PR, not two.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3d9490faf48b99d4a800f99e090429718ab01ccd
Local-runs: none
Scope: docs/adr/0131-total-organization-ownership-no-null-organization-id.md + packages/platform-objects/src/system/sys-metadata-activation.object.ts, packages/services/service-automation/src/sys-flow-credential.object.ts, packages/runtime/src/organization-ownership-boot-guard.ts, packages/runtime/src/domains/catalog-activation.ts, packages/plugins/plugin-sharing/src/sharing-rule-service.ts, packages/plugins/plugin-sharing/src/declared-sharing-rules.ts, packages/services/service-automation/src/flow-activation-store.ts, packages/services/service-automation/src/engine.ts, packages/objectql/src/action-activation.ts, packages/core/src/security/resolve-authz-context.ts (cited code read on origin/main ec951e29, which carries PR #24428's merge 964a2370; the ADR on it is byte-identical to the merge base 71fa166e, so the diff lands where the rulings point)

Rendered by an isolated at-tier reviewer subagent of the adopting seat (session_01Y5583bs2RDd53MH6kM1ca3), on these inputs and nothing else: card #24420 (body; claim 6257558991; amendments 6257685312, 6258989827, 6259150966 and 6259844976; reports 6257808694, 6257947772, 6259173425, 6259323496 and 6260005736, the last superseding the rest); the rulings verbatim — A on #24378 (6258883445, superseding B′ 6257388265), Q1–Q4 A on #24377 (6257510973, items 2 and 4), Q1 A on #24435 (6259141885, item 1), and the #15194 ruling records 6259608309, 6259698357 and 6259899486; PR #24422's body, file list, every comment (6258201995, 6258912378, 6259164465, 6259167649) and its two reviews (both on the superseded head 2261458d); the net diff git diff origin/main...3d9490fa; the whole ADR at the head; the cited code on origin/main; and the head's 39 check-runs. The head was re-resolved first (gh api …/pulls/24422 → .head.sha) and has not moved. This review made no GitHub write, no worktree, no build, no test and no gate re-run; git fetch into the owned ref refs/review/pr-24422-r3, git show/git grep on origin/main, and the record-template print were its only local commands.

① Derived judgments

The diff. One file, +73/−0, five commits, a pure insertion of six blockquote notes and one D14 paragraph note; no existing line is changed, so no ruled sentence is rewritten — the PR's one claim that survives its stale body holds. The notes sit where the rulings and the amendments put them: D6 after the install-mode bullets (head :434–:446), D7 after its first paragraph (:516–:526), D7 after the writer-membership paragraph (:538–:562), D14 after the 2026-10-10 execution-plan note and before the section rule (:817–:836). The ADR on origin/main is byte-identical to the merge base, so every anchor the rulings cite by old line is where the notes expect it (:491 → head :505–:506; :419–:420 → :419–:420; :699–:700 → :751–:752).

(a) The D6 note (:434–:446) against ruling A 6258883445 — faithful; nothing added, dropped or softened.

• Header: cites A by id, letter and the fact that it supersedes 6257388265 B′ — as amendment 6258989827 ordered.
• Item 1 (the ledger): "the active bit of a sys_metadata_activation row of type sharing_rule… deployment-level and operator-gated under a wall… There is no per-organization switch-off, and organizations still author their own rules (D3)". The ruling's reader clause ("read by the resolver the way it already reads positions and permission sets") is carried by the D7 note's fifth-reader sentence (:524–:525), so the PR drops nothing. One generalisation, not a softening: the ruling says "no per-organisation switch-off under a wall"; the note says it unqualified. It is true in every posture because the ledger carries no organization column (D7 :420, :493; the object's systemFields: { tenant: false } on main), so the wider form binds nothing the record does not already bind.
• Item 2 (customising): "a clone under a new name, plus the base switched off. Same-name shadowing is retired. A sys_sharing_rule row that takes a declared rule's name in its scope is refused, whether it is new or renamed. A declaration that arrives over an authored row, as in a package upgrade, is reported loudly at load and never becomes an overlay." — the ruling's sentence, whole.
• Item 3 (the ceremony): "migrates each existing customised copy to a clone plus the base switched off, and deletes the uncustomised mirrors (fate 2). The promise that a customised copy keeps answering and a switch-off survives redeploys is kept by that migration and the ledger, not by shadowing." — the ruling's item 3; the Audit sibling declared-metadata↔record two-store types (sys_position, sys_sharing_rule, sys_capability) per ADR-0094 addendum #2909 promise is carried as content rather than as the number, the record's own habit.
• Item 4 (the record): the note IS item 4. Items 5 and 6 (the plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 rework; hole (ii) to the upgrade-impact card) are not ADR content; "plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds" names the companion card as item 5 does.
• Letter title: "read-only, clonable, switched through the activation ledger" → "A managed declared sharing rule is read-only and clonable. Switching it off is…". Faithful.
• The closing qualifier "This is a ruled decision that plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds; it has not shipped" — see ③ item 1: PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 merged at 05:27Z, after this head was pushed.

(b) The D7 activation-ledger reading note (:516–:526) — right as a reading, and the fifth reader is carried.

• The reading it picks is the one every other part of the record holds: D6 :419–:420 and :491–:496, D13 :751–:752 ("sys_metadata_activation is not on this list"), D14 :759–:760, §1.7 :224–:226, §7 :984–:986 ("card fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024, re-scoped from a revert after the standard-package reversal"), §8 C0 row :1025. Only the D7 clause at :505–:506 was the outlier; the note leaves it in place and governs how it is read — the card's "never by rewriting the ruled text" held.
• Code claims checked on main: sys-metadata-activation.object.ts declares systemFields: { tenant: false } (true); "flows, actions, positions and permission sets read it" — flow-activation-store.ts (10 ledger references) and engine.ts (9), action-activation.ts (18), resolve-authz-context.ts (5), catalog-activation.ts (8): true. fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024 is closed completed; the one file path carries no line number.
• "Sharing rules join them as a fifth reader by ruling 6258883445 on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378, which is ruled and not yet shipped (the D6 note above)" — the amendment's fifth reader is present and cites the live ruling. On origin/main as of 05:27Z sharing rules DO read the ledger (sharing-rule-service.ts :64 SHARING_RULE_ACTIVATION_TYPE = 'sharing_rule', :1062; catalog-activation.ts :79–:84 adds sharing_rule to the door's subjects): see ③ item 1.
• Header provenance: the note still names 6257388265 (B′) as its ruling of record. B′ item 1 is the ruling that ordered the contradiction resolved, and amendment 6258989827 item 2 said the note "stays"; A supersedes B′'s letter and says nothing against the ledger reading — A item 1 presupposes it. Accurate as provenance; a reader of this note alone is not told B′ was superseded. See ③ item 2.

(c) The three #24377 D7 lines (:538–:556) — unchanged from the head that passed (6258201995), re-read against 6257510973 items 2 and 4: faithful. Identity-mail list is the ruling's five, no more; tenant mail NOT NULL with #11303 decision 2 at the producers; "⛔ Neither a nullable column nor unpersisted mail"; sys_secret column-less with the ruling's own referencing-row list and "every read stays by id under privilege"; sys_setting_audit's global rung to a deployment-level sibling, tenant and user rows NOT NULL. Each closes "a C8 stage builds; it has not shipped", and each is still unshipped on main (no sibling object exists; sys-secret.object.ts and sys-setting-audit.object.ts are untouched by any merge since). The present-tense claim "the same departure sys_setting's global rung already makes" stays true (sys_platform_setting, C6).

(d) The #24435 Q1 line (:558–:562) against 6259141885 item 1 — faithful. "The object is to declare systemFields: { tenant: false }, so it has no organization column. A credential's ownership follows the flow it belongs to, and a flow is environment metadata (D2, D6). This matches the sys_secret note above." — the ruling's three clauses, with "in step with #24377 Q4" carried as the cross-reference. The dev's "is to declare" over the amendment's "declares" is right: on origin/main sys-flow-credential.object.ts declares neither systemFields nor tenancy (grep returns nothing), so a present tense would have asserted an unshipped fact; the docblock already calls the object "env-wide, like the engine's flow map… (ADR-0131 D6)", so the ruled direction matches the code's own account of itself. "Built inside 8b-0de" is left to the plan, as the three #24377 lines leave their stage ids; the D14 note names 8b-0e for it. Q2 A ordered no line and none was added, as amendment 6259150966 said.

(e) The D14 release-scope note (:817–:836) against 6259608309, 6259698357 and 6259899486. Form: the 2026-10-10 execution-plan note's exactly — bold dated header naming the records, the ⛔ "neither changes a decision of this record" sentence, a numbered list. Against the brief's checklist:

• fresh installs — stated (item 1); single only — stated (item 1); ceremony refused in 18.0 — stated, with "naming the 18.x release" (item 1); walled postures refused at the operator's boot path — stated, group / isolated named (item 1). The ruling's "refused loudly" loses its adverb; a boot refusal that names a release is loud by construction (D10 item 5's shape) — not a softening of a binding.
• 8b in 18.0 — stated (item 2, "Every system insert is stamped or refused; under single it is stamped with the Default Organization"). "Lifting under single only" — NOT stated. That is 6259899486 item 4, which post-dates amendment 6259844976 (04:43Z → 04:48Z) and which no ruling orders into the ADR; the note cites only the two records the amendment named. Item 1 + item 2 together imply it for a running 18.0 (only single boots), but the amendment to [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377's item 5 and its sentence "the 18.x end state is unchanged" are not carried. The note's ⛔ sentence ("the line, the fence above and §8's order stand") is the same idea for the record, not for [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377's item 5. See ③ item 3.
• 8b-0d/e/g, 8c, 8d and 8e in 18.x — stated (item 3), with the right unprimed names (the whole stages ship in 18.x: the primed no-ceremony halves per 6259698357 item 3 plus their ceremony halves per 6259608309 item 1) and the right contents in parentheses.
• upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 in 18.1 — NOT stated. 6259608309 item 3 re-targets a decision card; so do item 4 (GA condition (c) waived — refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204's, not this record's) and item 5 (objectui#12982, amended by 6259698357 to "only if ready, else 18.1"). The dev's reading that card re-targeting decides nothing for the ADR is sound for all three; the record's D14 stages this record's decisions. Not a dropped binding of the ADR; listed in ③ item 3 so the seat can decide.
• One consequence of the two cited records the note does not carry and that IS this record's: "18.0 databases join v17 databases on the 18.x upgrade path" (6259698357 item 3, last line; 6259608309 item 2's "index-definition migration for 18.0 databases later"). The note's item 1 says a v17 database waits for the upgrade path; it does not say an 18.0 install takes that path too. A self-hoster reading D14 could take a fresh 18.0 database for final-shape. See ③ item 3.
• "the v17 → v18 upgrade path, which is the ceremony's deferred fates and moves" is right (6259608309 item 1: "every ceremony half of a stage moves to 18.x", 9c among them).

Internal consistency.

• D3 :326–:328 (an organization's sharing rules are its NOT NULL rows) ↔ D6 note "organizations still author their own rules (D3)": consistent.
• D6's regime-C definition :418–:423 ("disable is one active bit… in the tenant-less activation ledger… clone is a whole-definition sibling under a new name… Operator-gated under a wall") ↔ the note: identical mechanics, one more type. D6 :425–:426 ("every regime there is environment-wide and operator-gated — a plant admin neither overlays, switches nor clones"): the B′ carve-out the first review flagged is gone; regime C puts sharing_rule squarely under that sentence. Consistent. The chart table :456–:465 gains no row; the "define their own roles" row's "managed sets read-only, clonable" is the same shape.
• D7 :503–:514 ↔ the ledger note: the object is "a member of this paragraph's family" (it is listed inside the sys_metadata family at :505). The [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 and [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 lines each name a column-less object or sibling governed by permission — the TL;DR's third shape (:104–:105). D7 :534–:536 ("this record names only the objects whose verdict the tree already states") now precedes four notes naming objects whose verdict is ruled, not in the tree; the "has not shipped" qualifier is the reconciliation, as before.
• D9 :588–:595 ↔ D14 item 2: "stamped or refused… under single stamped with the Default Organization" is D9's own sentence. 6259899486 leaves D9's every-posture end state for 18.x; nothing in the note amends D9.
• D10 ↔ D6 note: "deletes the uncustomised mirrors (fate 2)" is :604–:608; "migrates each existing customised copy to a clone plus the base switched off" is a ceremony step the ruling adds, which D14's item 3 (:829) defers with the rest of the upgrade path — so the D6 note's ceremony sentence describes 18.x work, consistent with its own "has not shipped". The 2026-10-16 amendment's os dev exception (:1231–:1237) runs the same ceremony command, so "os migrate organization-ownership refuses to run" in 18.0 reaches it too; no second path is opened. Consistent.
• D13 :751–:752 ↔ the ledger note and the D6 note: the ledger stays, gains a type, stays off the list. Consistent.
• D14 :764–:771 (the v18 line, the fence) ↔ the release-scope note's ⛔ sentence: the split is inside the line; §8's order (C1–C6, C7, C8) is untouched; 8b before 8e inside C8 is kept.
• Anchors and links: the seven notes carry no markdown links; §7, §8, D2, D3, D6, D7, D10, D13, D14, C0 resolve inside the record; every issue cited exists (plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 open, fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7) #15024 closed completed, [finding] sys_inbox_message/sys_notification/sys_email 等平台表从不写 organization_id(存量与新增行 100% null)——请确认多组织语义是否设计如此 #11303 closed completed, [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 / [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 / [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 closed completed, [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 open); every comment id cited is on the issue the note names (each fetched; issue_url matched); the one file path exists on main and carries no line number. Gate verdicts on the head, read at step level because both lint steps are continue-on-error: Check ADR cross-links success (job Check Documentation Links); ADR anchors + number uniqueness success (job Lint · repo & tooling gates); ADR symbol anchors resolve (no line numbers survive) success (job Lint · docs & code guards). The eight scripts/adr-anchors/*.json files naming ADR-0131 anchor source paths by symbol, not ADR lines, so the insertions move nothing they read.

Check-runs on 3d9490fa: 39, all completed; 0 failure, 0 in_progress. Required contexts: Lint & Repo Gates success; TypeScript Type Check success; Test Core success (shards 1–6 success); Governed Surface Queue Guard success; Build Core skipped (docs-only paths filter — nothing to build, not a failure). The four PR-body gates are success on this head ("Part-of PR must not also close its card", "The card this PR closes must claim this branch", both "No other open PR may claim…"). Check Changeset skipped — the skip-changeset label honoured. The commit-status API reports pending with zero statuses: no status context exists on this repo's heads, only check-runs; not a pending check.

② Semver level

Docs-only edit of a governed ADR; no package path; nothing published from any released package. skip-changeset is right and Check Changeset honoured it. Clause-②: no is right — no authorable key, export or config field widens or narrows; the text records rulings. The body's closing lines are its first four: Fixes #24420 / Part of #24343 / Part of #15212 / Clause-②: no — all four still right (the card is this PR's; #24343 and #15212 are the C8 parents the amendments named).

The body is the B′ body and describes a head three rewrites old. Lines now false on 3d9490fa (the dev's owed edits are in report 6260005736; the seat corrects the body, which moves no head):

1. The PR title: "D6 charts sharing_rule under regime O, guarded … (ruling B′)" — regime C, ruling A.
2. "Five dated notes … (+44 / −0)" — seven notes, +73 / −0.
3. "Notes 1 and 2 carry out ruling B′ on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378: the maintainer's 「同意」 then 「B′」, recorded at comment 6257388265. Note 1 records items 1–5, and note 2 is item 1's ledger clause." — note 1 carries A (6258883445, items 1–4), which supersedes B′; note 2 is B′ item 1's reading kept under A with a fifth reader.
4. Item 1 whole, every sub-bullet: "regime O, guarded"; "replaces the declared rule whole"; "active: false on that row is the switch-off"; "deletes only uncustomised mirrors, so the promise in sharing-plugin.ts … stands"; "under a wall an organization's overlay is its own, and under single the one overlay answers everywhere"; "the guard … unless the write edits the projected row"; "the immediate reconcile … not at the next boot's sweepOrphanedRuleGrants"; "sharing rules get no activation-ledger type, and same-name rows are not refused as a class" — every one is the retired B′ shape; under A same-name rows ARE refused as a class and sharing rules DO get the ledger type.
5. Item 2 is true but incomplete: no fifth reader named.
6. No item 4 (the [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q1 line) and no item 5 (the D14 release-scope note).
7. Verification: "They ran on commit 7b9b0c0… The D7 commit 2261458d re-derived…" names no later head; "49 exit 0. The other 6 are NOT MEASURED" is round 1's count (rounds 2–5: 50/55, five NOT MEASURED).
8. 维护者速读: "加五段带日期的 Note" → 七段; ① describes regime O (同名整条替换、active: false 即停用、守卫与立即回收) — false under C; "44 行" → 73 行; 为什么改 "裁决 B′(「同意」「B′」)第 1–5 项" — A 第 1–4 项, plus [Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q1 and the [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 scope records; 席位意见 "契约评审 PASS(记录 6258201995 …)" — that record covers 2261458d only, and its "隔离部署下每个组织的共享规则覆盖归它自己(B′ 第 4 项)" remark has no referent under regime C (there is no overlay); 你要做的 "读五段 Note" → 七段, and "8b-0d、8b-0e 合并前要等它先合" is stale as a release line — both stages are 18.x now (D14 note item 3).
9. Still true: "Why this reading…", "Changeset", "Landing" (Tier H, the maintainer merges), and the four closing lines.

③ Boundary flags

1. PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 merged at 2026-10-19T05:27:43Z (964a2370, now on origin/main), thirty minutes after this head was pushed — two "not shipped" qualifiers are stale in the code-landed sense. On main today: sys_metadata_activation serves type sharing_rule through the catalog door (catalog-activation.ts :79–:84, :226), a same-name create or rename is refused (sharing-rule-service.ts :189–:258, DeclaredSharingRuleNameConflictError), a declaration over an authored row is reported loudly once per name and scope (reportDeclarationOverAuthoredRow, :1035–:1050), and sharing rules read the ledger (:1062). What is NOT on main is ruling A item 3, the ceremony step — plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 carries Part of #24421, its body says the ceremony step "is a later stage, which carries the card's closing line", plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 is still open, and 6259608309 item 1 moves "9c, the sharing-rule copy migration" to 18.x. So the D6 note (:445–:446, "This is a ruled decision that plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds; it has not shipped") is half true — the ceremony half — and the D7 note's fifth-reader clause (:525, "which is ruled and not yet shipped") is false if "shipped" means landed. Why this is a flag and not a FAIL: in this record's own vocabulary "ships" means a release (:496, :759–:763, :817–:836 — "ships in 17.3", "18.0 ships for fresh installs"), and no 18.x release exists (latest release @objectstack/verify@17.7.0, 2026-10-06; zero tags matching 18); read that way both sentences are true until 18.0 is cut, like every staging sentence in D14 and §8. Neither misstates a ruling. Fix, if the seat spends one more round (a head change owes a fresh at-tier record): :445–:446 → "This is a ruled decision; plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 landed the switch, the refusals and the load-time report in PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 (2026-10-19), and the ceremony step lands with the 18.x upgrade path (D14's release-scope note)." and :525 → "which PR plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) #24428 landed on 2026-10-19 (the D6 note above)". The seat should weigh that against the maintainer's 「你推送给我我会尽快审批」.
2. The D7 ledger note's header names a superseded ruling (:516, "ruling of record 6257388265 on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378, letter B′") — the report's open question; answer: accurate provenance, non-blocking, B recommended if the seat re-pushes for item 1. B′ item 1 is the ruling that ordered the contradiction resolved; A superseded B′'s letter, presupposes the ledger (A item 1), and amendment 6258989827 item 2 kept the note. The reading rests on the record's own sections, not on either letter, and the fifth-reader sentence cites A. Weakness: a reader of this note alone sees a ruling that [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 now records as superseded and is not told so here. One-line fix: "ruling of record 6257388265 on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378, letter B′, item 1 — kept under ruling 6258883445, letter A, which supersedes B′'s letter".
3. The D14 note does not carry 6259899486, upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446's 18.1 target, or the sentence that an 18.0 database takes the 18.x upgrade path — answered, not escalated: none is ordered into the ADR; none contradicts it; one is worth a sentence. (i) 6259899486 item 4 (8b in 18.0 lifts the exemption under single only; the walled half lands in 18.x after 8b-0d′/0e′/0g′; "the 18.x end state is unchanged") amends [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377's item 5, which the ADR never carried, and post-dates the claim amendment by five minutes; items 1 + 2 of the note imply it for 18.0 (only single boots). (ii) upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 → 18.1, GA condition (c), objectui#12982 are card re-targeting; D14 stages this record's decisions, and the dev's omission of the hand-off list is the same judgment, rightly made. (iii) "18.0 databases join v17 databases on the 18.x upgrade path" (6259698357 item 3; 6259608309 item 2) IS this record's — it says a fresh 18.0 install is not final-shape — and the note's item 1 only says it of v17. Fix, one sentence each, in the same push as item 1 if there is one: item 2 → add "In 18.0 it lifts the exemption under single only; the walled half lands in 18.x after 8b-0d, 8b-0e and 8b-0g, and D9's every-posture end state is unchanged (ruling record 6259899486)." — and name 6259899486 in the header; item 3 → add "An 18.0 database takes this same path." Otherwise a later dated line; the record tolerates that.
4. The report's remaining open questions. "plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) #24421 builds" without a ceremony card number — A, keep (6258883445's Execution line says the seat cuts it; it has no number; 6259608309 names it 9c and defers it). "is to declare" — A, keep (verified on main). D14 in the paragraph form, without the hand-off list — A, keep (form matches :785–:788; the list decides nothing for the ADR). Scope of B′ item 4 and the ledger-by-reading-note questions from rounds 1–2 — moot under A and settled respectively; the first review's one flag (the per-organization overlay carve-out) has no referent under regime C.
5. Deviations. None new this round: the dev read every ruling and amendment on GitHub before editing, pushed four rework commits on the claimed branch, PATCHed nothing, and wrote the body edits into the report as a dev who writes the body once is told to. The worktree deviation of round 1 was Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11 holding. premise_still_valid: true holds: the ADR on origin/main is unchanged since 71fa166e.
6. Landing. Tier H: docs/adr/**. The two existing reviews (APPROVED then CHANGES_REQUESTED 「还需讨论」) are both on 2261458d and the PR is a draft; nothing on this head is an approval. The seat readies nothing: it corrects the body, posts this record, and hands the PR to the maintainer. The post-merge audit will list the maintainer as approver and merger.

Implemented-by: claude/issue-24420-adr-0131-d6-sharing-rule-overlay
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS

Maintainer, before merging (Tier H — your approval on this head, your draft flip, your click): read the seven notes at head :434–:446, :516–:526, :538–:562 and :817–:836; the one fact to weigh is that PR #24428 landed the regime-C switch and refusals on main at 05:27Z, so the D6 note's "it has not shipped" and the D7 note's "not yet shipped" are true only in this record's release sense (no 18.x exists) — accept as dated status lines, or have the seat push the three one-line edits in ③ items 1–3 and review once more.