[PM seat] repo:cloud · seat 2 — 🟢 os-zhuang · session_01Cbdek8SKSHxddGqTPZXdqX #24145

This post is the registration of repo:cloud seat 2 (Seat: repo:cloud#2). Seat 1's post is #6026 (⏳ vacant since its brief 6229798294); it carries the lane's platform facts, the standing bans and the permanent notes, and this post does not copy them. Seat-post protocol: index = label:pm:seat; only the sitting PM edits this body; takeover or handover = body edit + audit comment; re-fetch before editing, first stamp wins, read back after writing.

当前 PM

🟢 os-zhuang · session session_01Cbdek8SKSHxddGqTPZXdqX · seat repo:cloud#2 · R4 seated 2026-10-17T13:49Z (body refreshed 2026-10-19T01:06Z) on the maintainer's word in chat, 「你可以继续上班了」, after this session's own stand-down brief (6232113230). Batch 3, mode:subagent; lane rules, the maintainer's words in chat to this session: 2026-10-17T14:10Z 「当前任务处理完，后续并发降到1」 (batch 1, serial, until the next word); then, after the cloud#2920 close, 「并发加到3」 — batch 3 in force; then, at about 04:12Z, 「2986 优先」, 「现在可以派发」 (cloud#2986 dispatched first); then 2026-10-18T07:10Z 「objectui #12724 和 #12725 你也负责派发。」 — two objectstack-ai/objectui cards join this seat's queue, ahead of the lane's own. Since the last refresh: 「2986 怎么还没搞定，这个是最高优先级」 (cloud#2986 re-dispatched at once, landed as PR #3015); the domain:spec seat's hand-off of cloud#2774's control-plane half, relayed in chat (filed as cloud#3014, now a decision); 「你没有设置自己的定时吗」 (the patrol Routine's prompt now runs four steps every fire: collect, a pm:blocked sweep of every card's Blocked-by: lines, dispatch while fewer than 3 are in flight, and the decision box); and 「上游已全部关闭的 5 张卡(#2914、#2910、#2869、#2776、#1979)都分给了 hotlong，hotlong的任务你都接手」 — every open cloud card assigned to hotlong is this seat's. Then 「当前任务处理完，后续并发降到2，优先 p1 p2 任务」 — batch 2 in force, p1/p2 first, a p3 only when no p1/p2 card is dispatchable; and, on the director-format batch this seat presented, 「2917 B 12725 B」. Then, 2026-10-19T01:05Z, 「后续只处理 p1 p2 的任务」 — p1/p2 only: a p3 card is no longer dispatched even when no p1/p2 card is dispatchable; it stays in pm:queue untouched. The patrol Routine is re-created; its id is in the opening marker below this body.

• Round-open mutex: reading one is this session's brief; no opening marker after it; no Claim: by another session on a lane card since it (every cloud comment since the brief read); reading four is this session's cloud#2923 / feat(plugin-security): 内置行写护栏 — sys_position / sys_capability 平台/应用托管行不可删改 #2930.
• Charter: SKILL.md touched at bd4276a (one line: a chat message that lists options and waits is the popup 「卡先于弹窗」 forbids), re-read; references/** at f7e836da1, os-dev.md at 6db53acd6, unchanged since R3. check-harness-current: STALE on .claude/skills/pm-dispatch/SKILL.md (shared HEAD 9ffe8af behind origin/main bd4276a); scripts/pm/** identical to origin/main. Picked up at the next natural shift boundary, ⛔ not a batch interruption.
• Carried from R1–R3 (pointers; the detail is on each card): decision box cloud#2774 (Q2 / Q3; Q1 seat-ruled A), cloud#2924 (the draft posture versus cloud#2656's backfill), cloud#2948 (stored rows: backfill, record 6236726201) and cloud#2925 (a relation object's composed title: formula one hop through a reference, record 6237099727); 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916 pm:blocked on feat(security)!: enforce book audience at the REST read layer; finish the ADR-0090 D2/D3 cleanup the P1 wave missed #2774, ci(create-objectstack): scaffold-E2E gate + registry canary + release-time template dep sync #2912 on cloud#2928 (re-derived 6244927180: App pages: a record:related_list bound through parentDataSource draws its rows but no toolbar and no row action — its authored actions are spec-legal and silently dropped (PageView's record navigator resolves no related-list handlers) objectui#12870 landed as 15b1065, not in the pin); owed readings — the next deploy-staging run for cloud#2958, docs(adr): ADR-0080 — AI-authored UI pages via JSX source (parse ≠ execute) #2435, chore(app-showcase): remove test-evidence artifacts from docs/test #2923, and census 4 for cloud#2887 at the 20:47Z forced battery; parked pm:awaiting-maintainer cloud#2274, feat(approvals): actionable approval links — single-use tokens + session-less confirm page (ADR-0043) #1765, chore(console): refresh vendored objectui SPA to 09e1b261 #2549.
• Half-states read, not this seat's to touch: cloud#2822 pm:dispatched with no assignee (the maintainer's direct round, PR feat(auth): 身份表写守卫 — managedBy:'better-auth' 引擎级强制（ADR-0092 D2/D3/D6，closes #2816） #2828). cloud#2950 left the list: it is this seat's since the hotlong takeover.
• R4, first wave settled: cloud#2915 → PR feat(protocol): complete ADR-0087 — load-seam handshake, chain backfill 12–15, release artifacts #2972 MERGED 38d7bda (LANDED 6235184151; objectui halves filed: Page element blocks draw English or bare-glyph placeholders while they load: element:repeater prints a hard-coded "Loading…" (no i18n key) and element:number prints "…" — a zh-CN control-plane home shows both on every load objectui#12889, docs(agents): os-dev applies skip-changeset at PR-open time, with the releases-nothing test stated once #12890, [finding] 8 residual #12081-class soft breaks remain in .claude/agents/os-dev.md — each renders as a stray mid-sentence space in the file every dispatched dev reads #12891). cloud#2699 → no PR: the split is still reachable through objectui's boot preflight → pm:blocked on Console boot preflight renews the session but drops the cookie: auth-preflight.ts calls get-session with credentials 'omit', so past updateAge every returning user's first load re-creates the cookie / bearer split objectui#12892 (review 6235041905); filed cloud#2973 (bearer-only reads not renewed). cloud#2924 → PR CI: validate-deps 的 pnpm audit 因 npm audit 端点退役(410)全线失败 #2974 (ACCEPT 6235155463) went red in the merge queue (apps/objectos e2e: the draft posture skips cloud#2656's boolean backfill; an overlay on a code package drafted) → PR back to draft (6235294804), card in the decision box (6235308564: land the posture first + publish-time backfill cards, recommended A); filed Studio copilot card: draw the draft posture the tool now sends — 存为草稿 as the primary action, the applied card's lines, and 撤销 through discard-drafts (cloud#2924) objectui#12894 (copilot card fields) and cloud#2975 (extend mode sweeps drafts). cloud#2920 skipped (no reachable Chromium reading of cloud's console build).
• R4, serial (batch 1): cloud#2962 → PR feat(mcp): aggregate_records 工具 — GROUP BY 聚合走 engine 读路径（RLS/D10/FLS 全继承） #2976 MERGED bd83beb (ACCEPT 6235600821, LANDED 6236135966). cloud#2913 re-derived before dispatch → pm:blocked on cloud#2774 (6236148992). cloud#2948 → PR gen:schema silently drops PageTabsProps since #2967 — references regen would delete real docs #2978 MERGED 5e782309 (Part of; LANDED 6236886792) → decision box (6236726201). Re-derived before dispatch, none dispatched: cloud#2634 → pm:awaiting-maintainer (6236970047: item 2's remaining act is a staging reading only the maintainer's signed-in session can take); cloud#2917 → pm:blocked on cloud#2774 (6236992436: where the ruled 🔒 facts line goes is a feat(security)!: enforce book audience at the REST read layer; finish the ADR-0090 D2/D3 cleanup the P1 wave missed #2774 Q2 option); cloud#2925 → decision box (6237099727: at the pin a formula reads only its own row's columns, and record.book.title passes validation and reads null; filed A formula field that reads through a reference (record.book.title) passes validateExpression, then reads null on every row: the read path projects only the row's own columns #24197); cloud#2926 → pm:blocked on spec(ai): the blueprint's select options declare their lifecycle kind and a blueprint object names its stageField, so an AI-built status field ships the kinds the object schema already requires #24198 (6237200125: the blueprint has no slot for an option's kind or stageField; the stage-path reader is record path: a derived stage drops its option's declared lifecycle kind, so terminal stages are still guessed from spelling (deriveStages maps value and label only; spec 18 declares kind) objectui#12907, filed). cloud#2927 → PR feat(create-objectstack): scaffolded projects ship container-ready #2979 MERGED 69632617 (Part of; ACCEPT 6238051893, LANDED 6238239778) → pm:blocked on cloud#2925, docs(adr): ADR-0095 — authz kernel chain: tenant isolation as Layer 0, posture ladder, capability-derived posture (B0 of #2920) #2924 and spec(ai): the blueprint's select options declare their lifecycle kind and a blueprint object names its stageField, so an AI-built status field ships the kinds the object schema already requires #24198 (its three remaining rows; Target 3, step names, folded into AI build chat: plan card v2 and result card v2 per the AiBuild artboard, a collapsed progress line, no automatic navigation to Studio after a build, and a placeholder without the agent's name objectui#12724 6238035669). cloud#2928 re-derived → pm:blocked on cloud#2868 (6238269683: the objectui pin bump waits for the production v18 window; the pin moved 8 times in 13 days). cloud#2919 → PR Security: Reports surface ignores caller identity — cross-user/cross-tenant IDOR (read/delete any report) + scheduled reports bypass owner RLS #2980 MERGED 7a31c249 (Part of; ACCEPT 6238659316, LANDED 6238894176) → pm:blocked on console app bar: a host can ask for no app switcher when the viewer is served one app — the cloud control plane draws 「云 ▾」 with 「所有应用」 linking to the app the user is already in objectui#12913 (filed: a host setting for no switcher when one app is served). cloud#2940 → PR Security: Knowledge/RAG retrieval fall-opens to unfiltered corpus when ExecutionContext is missing or system — agent data ceiling escape #2981 MERGED d50b0b83, closed completed (ACCEPT 6239391759; the Home button's 打开 waits on cloud#2928's pin move, rider 6239410691). cloud#2960 → PR Security: bulk (multi) update/delete skips OWD owner scoping on private objects — members can modify others' rows #2982 MERGED 927bf775, closed completed (ACCEPT 6239979629). cloud#2966 → PR fix(security/sharing/rest/app-showcase): #2926 复测缺陷 + #2909 两存储审计 #2983 MERGED f0ffea72, closed completed (ACCEPT 6240638290). console app bar: a host can ask for no app switcher when the viewer is served one app — the cloud control plane draws 「云 ▾」 with 「所有应用」 linking to the app the user is already in objectui#12913 landed as d15ad87 (hideSingleAppSwitcher) → cloud#2919's runtime-config half (claim 6243580352) → PR refactor(security): converge anonymous-deny into one shared function + source-enumerating ratchet (#2567 Phase 2) #2987 MERGED 8986b65a (Part of; ACCEPT 6244807222, LANDED 6244940669; the control plane serves hideSingleAppSwitcher: true) → pm:blocked on cloud#2928 (rider 6244948267 lists the three readings that move unlocks). cloud#2699 re-derived on Console boot preflight renews the session but drops the cookie: auth-preflight.ts calls get-session with credentials 'omit', so past updateAge every returning user's first load re-creates the cookie / bearer split objectui#12892's close (285ddb22, not in the pin) → pm:blocked on cloud#2928 (6244931747). cloud#2920 (claim 6244973452): measured first, a Chromium AX-tree dump on a stack booted at the pins with scripts/dev-local/run-stack.sh --with-ui. Every listed control has a name; 0 unnamed interactive nodes in any view → no PR, closed not_planned (review 6245158858). Standby ended on the maintainer's batch-3 word. record path: a derived stage drops its option's declared lifecycle kind, so terminal stages are still guessed from spelling (deriveStages maps value and label only; spec 18 declares kind) objectui#12907 (the stage path reads kind) also landed; cloud#2926's stage-path reading rides the same pin move.
• R4, batch 3: the lane's own finding first touch (a single-lane repo:* seat grades its findings): cloud#2758 closed completed (PR 问题（Showcase）：Capability Map 的项目链接被解析到页面路由下 #2823's heap fix, five nightly builds green since, 6245481014); cloud#2835 closed duplicate of it (6245485547); cloud#2760 closed not_planned (zero pull since objectui#12096, 6245488763); cloud#2771 → pm:awaiting-maintainer p2 (6245513153: which bucket the control plane's OS_STORAGE_S3_BUCKET names); cloud#2975 → pm:blocked p2 on cloud#2924 (6245510621); cloud#2973 → pm:queue p3 (6245538146). cloud#2868 closed (production's v18 move complete) and generic SDUI blocks for product pages — stat, usage-bar, checklist — and the renderer half of the api element data source (re-scoped from cloud:home by maintainer ruling 2026-10-12; cloud#2777 part B moves to cloud metadata) objectui#12197 landed (c4dd7078ed). The director's batch Fix lychee exclude-path regex patterns in link checker workflow #362 ruled cloud#2774 (Q2 B, Q3 B), cloud#2924 (A: PR CI: validate-deps 的 pnpm audit 因 npm audit 端点退役(410)全线失败 #2974 lands after one patch round, this seat's), cloud#2925 (A) and cloud#2948 (A: backfill cloud#2990 before .objectstack-sha reaches f3174efc). Landed since batch 3: cloud#2989 → PR Security: AI ToolExecutionContext contract documents system-level as the missing-actor default — a contract-level fall-open across all data tools #2991 (9124e133, Tier H, approved and merged by os-zhuang); cloud#2924's patch round → PR CI: validate-deps 的 pnpm audit 因 npm audit 端点退役(410)全线失败 #2974 (f9e45145; back to pm:blocked on objectui#12894, objectstack#24253, objectui#12929); cloud#2986 → PR docs(security): document requireAuth anonymous-deny across all HTTP surfaces (#2567) #2993 (46e81055, Part of; .objectui-sha → c4dd7078ed4a, carrying objectui#12197 / d15ad87 / 15b1065 / 285ddb22 / 473e5a0; LANDED 6246622558, pm:blocked on objectui#12936); cloud#2973 → PR fix(packages): register PATCH /packages/:id so edit-manifest reaches the handler #2995 (f80ce61b, closed; LANDED 6246644054); cloud#2994 → PR refactor(security): migrate handleSecurity admin gate to shouldDenyAnonymous (#2567 follow-up) #2997 (a4dbd85f, closed; LANDED 6246631918). Rulings executed: cloud#2782 A (6245935783) dispatched; cloud#2984 A — the two lines written on cloud#2887 (6246198762) and cloud#2806 (6246221751); cloud#2948 A → cloud#2990's backfill gates cloud#2985. Filed: objectui#12936 (locale-map holes), cloud#2994 (ruling A residuals, landed), cloud#2998 (objectos-runtime hand-built session reads, pm:blocked on PR plugin-auth: 后台溢出的种子用户可能错过一次性 membership backfill(单组织 auto 模式,重启自愈) #2996); family evidence on objectstack#23585. cloud#2990 → PR plugin-auth: 后台溢出的种子用户可能错过一次性 membership backfill(单组织 auto 模式,重启自愈) #2996 (aa300077, Part of) → pm:awaiting-maintainer (run on staging then production, post tenant-verdicts' per-plane count; it gates cloud#2985). cloud#2782 → PR fix(storage): abort backend multipart when reaping abandoned sys_upload_session (#2970) #2999 (f9497a53, closed completed; ACCEPT 6246851558; the maintainer's one reading: no no-trusted-ip warning in the production logs after the deploys). Filed on the maintainer's chat questions (2026-10-18): platform-objects sys_organization: a record page has no door to rename an organization — update_organization is list_item only and bundles slug, which the cloud's change_slug orchestrates #24271 (platform first: a record-page door to rename an organization) and its cloud half cloud#3000 (pm:blocked on it); decision cards cloud#3001 (the environment page's 23 management actions move into a settings tab; a sub-question of cloud#2916 Target 2; recommended A) and cloud#3002 (keep 组织 / 环境, keep 「环境」 out of a single-production owner's way; recommended A). Landed since: cloud#2975 → PR 安全:owner_id(属主锚点)客户端可写、服务端无守卫 → 非属主可伪造/转移记录属主 #3004 (1e3e04f8, closed); cloud#2912 → PR 安全:静态字段 readonly: true 仅 UI 层生效、服务端不强制 → 审批/状态/金额字段可被直接 PATCH 绕过写入(FLS 缺口) #3003 (24ff557f, closed; titled 成员 under cloud#2773); cloud#2998 → PR feat(client): pass overwrite through packages.install for upgrade flows #3007 (4e42a5be, closed); cloud#2917 → PR docs(permissions): Attachments Access page + ADR-0057 sys_upload_session guard note #3009 (5bd28853, Part of, the ruled 🔒 line; back to pm:blocked on cloud#2916); AI build chat: plan card v2 and result card v2 per the AiBuild artboard, a collapsed progress line, no automatic navigation to Studio after a build, and a placeholder without the agent's name objectui#12724 phase 2 → PR feat(spec): boolean aggregand column in the aggregation conformance fixture — ruled numeric min/max on every face #12947 (44cb469d, Part of; claim amended to Clause-②: yes, contract review 6247454451 PASS; pm:blocked on cloud#2925 / app-showcase 权限模型复测清单(07-15 对照 main 重评):1 项回归级重大缺陷(#2930 锚点写护栏被 A4 词表打穿)+ 2 项部分修复 + 3 项未修 + 1 项建议降级 + 2 项观察 #2926 / docs(adr): ADR-0095 — authz kernel chain: tenant isolation as Layer 0, posture ladder, capability-derived posture (B0 of #2920) #2924). Ruled: cloud#3001 A (director 6247273688, the maintainer's 「这个设计OK」; the 设置 tab is bound to cloud#2916 Target 2; platform half [Decision] Objects with many actions: a platform-default 「设置」 tab composed from record_section actions (spec group key + objectui default record page) and a record_header count lint #24277). Filed: cloud#3005 (no-app build sweeps com.workspace drafts, p3), cloud#3006 (invite dialog titled 「操作参数」, p3), cloud#3008 (the publish fence never identifies the publisher, p2), platform-objects sys_member.transfer_ownership promises the previous owner is demoted to admin; better-auth's update-member-role writes only the target, so the organization ends with two owners #24273 (transfer_ownership leaves two owners). Re-derived on the triage pointer 6247318965: cloud#2888, chore: version packages #2877, fix(platform-objects): sys_sso_provider resultDialog paths address the inner data payload #2842 closed completed (their fixes rode PR feat(security): ADR-0090 D5/D9 suggested-audience-binding surface + confirm/dismiss API #2746); cloud#2801 unlocked (6247523636); cloud#2869, Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776, fix(plugin-security,plugin-hono-server): ADR-0090 live-test fixes + permission-model test suite #2910, feat(cli): surface migration guide when specVersion trails the installed platform #2914 are hotlong's and untouched. In flight: Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 phase 5 (claim 6247127663, the 变更 badge and the draft marks), Studio copilot card: draw the draft posture the tool now sends — 存为草稿 as the primary action, the applied card's lines, and 撤销 through discard-drafts (cloud#2924) objectui#12894 (claim 6247753055, with fix(plugin-approvals): render the non-submitter recall refusal through the operation-message catalog #12725 item 4: the change card and the applied card), cloud#2801 (claim 6247972323, home v2: retire cloud:onboarding-next / cloud:plan-status). Operational: the relay's 40-writes/hour budget is paced in background scripts.
• R4, late morning: landed cloud#2801 + feat(messaging/auth): 短信基建（SMS provider + messaging sms channel）+ 手机号 OTP 首登/重置 #2780 → PR Standalone authored action rows execute but are invisible to MCP list_actions/run_action (declaration-surfacing gap) #3010 (94704206, LANDED 6248576839); cloud#3008 → PR docs(adr-0086): re-evaluate authz metadata/config boundary against latest code (#2557) #3011 (b8b185e5, LANDED 6249364773); cloud#3005 → PR fix(spec): gen:schema io:'input' fallback + disappearance ratchet — restore PageTabsProps (#2978) #3012 (2c293a88, LANDED 6249546786); cloud#2986 → PR test(security): pin static-readonly server enforcement end-to-end + fix its declared contract (#3003) #3015 (6a360f51, LANDED 6249521529; .objectui-sha → 0707b4ae3712); Studio copilot card: draw the draft posture the tool now sends — 存为草稿 as the primary action, the applied card's lines, and 撤销 through discard-drafts (cloud#2924) objectui#12894's renderer half → PR fix(pm): render hour-scale durations in hours, so --report's calendar figures need no division #12951 (3da39ae4, 6248617250); Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 phase 5 → PR fix(cli): os migrate plan/apply compose the deployment's own object set #12952 (eee54ed7, 6248630164). Unlocked: cloud#2928 → pm:queue (6249538439), carrying the fix(plugin-security): #2937 — Layer 0 insert post-image 租户检查 #2940 / docs(adr): true up ADR-0093 to as-built (descope console banner, ratify migration scope) #2919 / ADR-0081 (cloud): open org-management basics + retire plugin-org-scoping to enterprise #2699 readings. Re-pointed to cloud#2985 (the framework pin bump): app-showcase 权限模型复测清单(07-15 对照 main 重评):1 项回归级重大缺陷(#2930 锚点写护栏被 A4 词表打穿)+ 2 项部分修复 + 3 项未修 + 1 项建议降级 + 2 项观察 #2926, security: 服务端 readonly 字段在 UPDATE 时未强制（可被用户上下文覆盖） #2948, 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916 (with objectui#12931 / fix: convert the five measured comment-mask ledger rows onto the shared mask #12932 and cloud#3014). Filed: cloud#3013 (decision: the publish fence, B vs C), cloud#3014 (decision: where the environment page reads plan and counts, 6249257725), cloud#3016 (ADR-0070 D3, com.workspace), metadata-protocol / spec: a draft carries no per-field provenance (which surface changed which key, and when), so Studio cannot mark a copilot's draft change with the ruled 草稿 chip and 来源 line #24298, spec page.zod.ts: ElementApiDataSourceSchema still describes itself as "[PLANNED — not yet rendered]" and visibleWhen says no renderer reads the binding, but the console renders both (objectui#12197) #24300, objectql: an objectExtensions entry on a better-auth-managed object (sys_organization) gets system columns injected (organization_id NULL on every row), and the tenant wall then hides every organisation from its own owner and members #24314, app-shell: retire CloudOnboardingNext and CloudPlanStatus (cloud:onboarding-next / cloud:plan-status), their cloudOnboarding.* / cloudPlanStatus.* keys and the cloud:plan-status type arm — cloud no longer draws them (cloud PR #3010) objectui#12954. The hotlong takeover (11 cards): closed completed cloud#2902 (6249822925), feat(spec): unify conditional-visibility predicate under visibleWhen (ADR-0089) #2900 (6249829394), fix(auth): single-source Console page-URL building; fix SMS + OAuth-callback landing paths #2869 (6249836417); unlocked to pm:queue Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 (6249842582) and ADR-0053 Phase 2 · Slice 2: thread context into applyFormulaPlan (read-time formula fields) #1979 (6249852701, a measurement round first); holds released to pm:queue 查询过滤器遇到"不认识的条件"时,应统一报错而不是悄悄放行(所有数据驱动) #2873 (6249886541, workflow half governed) and chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 7 updates #2861 (6249896658, re-measure, then a decision card); re-pointed to cloud#2985 feat(cli): surface migration guide when specVersion trails the installed platform #2914 (6249865276) and fix(plugin-security,plugin-hono-server): ADR-0090 live-test fixes + permission-model test suite #2910 (6249875765); chore(release): 破坏性授权变更 changeset 提级 major + v15 升级指南 #2950 stays pm:queue under ruling A (6249904191); feat(approvals): SLA escalateTo resolves positions via sys_user_position (ADR-0090 D3 follow-up) #2767 stays pm:awaiting-maintainer for step (c) (6249915440). In flight: Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 phase 6 with objectui#12894's console wiring (claims 6248871794 / 6248905066), cloud#3002 (claim 6249180936), cloud#2992 (claim 6249263972).
• R4, the afternoon (since the previous refresh): the hotlong takeover (11 cards): closed ADR-0089 D3a: flip .strict() on view/page schemas so mis-layered visibility keys are loud errors #2902, feat(spec): unify conditional-visibility predicate under visibleWhen (ADR-0089) #2900, fix(auth): single-source Console page-URL building; fix SMS + OAuth-callback landing paths #2869; the rest re-routed (records on each card). Landed: cloud#2992 → PR feat(connector-mcp): declarative provider — non-fatal / lazy boot for unreachable MCP servers (ADR-0096 follow-up) #3017 (7dd49736); cloud#3018 (p1 security, filed from Security (latent): GraphQL and realtime surfaces must satisfy identity admission before a client transport ships — both drop/lack the caller context today #2992's report) → PR fix(runtime): surface standalone authored action rows on the MCP action bridge (#3010) #3020 (9ec79489); cloud#3022 (p1 security, the door family) → PR 业务单元需要支持导入:列表页导入按钮 405(apiMethods 白名单缺 import/export) #3025 (cb987838, one patch round removing the pin's exception list); cloud#3002 → PR docs(spec): retire stale renderViaSchema comment + browser-verify ADR-0085 detail shapes (#2548) #3019 (0419a3f7, Part of; pm:blocked on 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916 and spec / objectui navigation: an app's navigation item cannot read data, so a label or a visible gate cannot follow a live count (the control plane's 「环境」 for a single-environment organization) #24332); cloud#1979 → PR fix(spec): keep lazySchema proxies identity-compatible with z.toJSONSchema (objectui#2561) #3021 (d79bcd18, Part of; line 3 pm:blocked on ADR-0131 D9 on a walled control plane: three framework writers land NULL organization_id rows on every sign-up (the self-registration grant, the verification mail, activity about org-less records) #24343); Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 phase 6 + [finding] The two artifact registrars' collection coverage is wrong in mirror-image ways: policies is a dead pointer in BOTH, and capabilities is declared but covered by only ONE #12894 → PR pnpm i18n:extract on an unbuilt worktree reports an oclif "command not found" instead of naming the missing spec dist #12964 (43efd078); objectui#12965 → PR The /data door ships the ADR-0111 CODE: prefix inside the user-facing error string, so a localized refusal renders as FORBIDDEN: … in a toast #12975 (in the queue). Measured, no PR: cloud#2928 (date picker met at the new pin; docs(adr): true up ADR-0093 to as-built (descope console banner, ratify migration scope) #2919 and ADR-0081 (cloud): open org-management basics + retire plugin-org-scoping to enterprise #2699 closed on its readings; Target 1 drafted for AGENTS.md, Target 2 filed as console: the help menu has no 「关于」 and the console shows no build version anywhere, so a reviewer cannot tell which objectui build a tenant serves objectui#12970). Rulings recorded: cloud#3013 C (premise test queued), cloud#3014 A + A (closed by the director), cloud#2917 B (6251325902), objectui#12725 B (6251335993). Pin bump cloud#2985 by the maintainer's executor (5d3c88d7: framework ec749fbb44b5, objectui 43efd078aaf9) → nine cards unlocked to pm:queue (feat(cli): surface migration guide when specVersion trails the installed platform #2914, Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776, fix(plugin-security,plugin-hono-server): ADR-0090 live-test fixes + permission-model test suite #2910, app-showcase 权限模型复测清单(07-15 对照 main 重评):1 项回归级重大缺陷(#2930 锚点写护栏被 A4 词表打穿)+ 2 项部分修复 + 3 项未修 + 1 项建议降级 + 2 项观察 #2926, ci: faster Test Core — affected-only PR tests, single spec suite run #2925, chore: version packages #2954, security: 服务端 readonly 字段在 UPDATE 时未强制（可被用户上下文覆盖） #2948, 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916 Target 2, fix(plugin-auth): re-run membership backfill when app seeding settles (#2996) #3000); cloud#2990 closed (the maintainer's counts). Filed: cloud#3018, 安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022; spec / objectui navigation: an app's navigation item cannot read data, so a label or a visible gate cannot follow a live count (the control plane's 「环境」 for a single-environment organization) #24332 (nav items read no data), ADR-0131 D9 on a walled control plane: three framework writers land NULL organization_id rows on every sign-up (the self-registration grant, the verification mail, activity about org-less records) #24343 (NULL organization_id writers); Studio copilot: the floating pending-drafts bar covers the copilot composer's input line in the right slot (objectui#12725's ruled artboard draws no bar there) objectui#12965, fix(security): make a refused RBAC catalog write boot-visible instead of a silent seed of zero #12967 (row-action confirm hole), plugin-security: two more swallowed tryUpdate refusals outside the catalog seed — drift diagnostics vanish silently, and the overlay-discard audit line reports an action whose write was refused #12970 (console 「关于」), service-messaging: 15 keyed text columns declare no maxLength — five sys_notification_* objects land registered-but-broken on MySQL #12978 (full-page chat bar). In flight (cap 2): cloud#2914 (p1, the console open at the new pins; the maintainer reports opening an environment as slow) and cloud#2776 (p1, the operator-guide link).
• R4, the evening (since the previous refresh, at the maintainer's cap of 2): landed:
  • cloud#2914, rounds 3 and 4, through PR i18n: console action-dialog param labels are untranslatable — os i18n extract skips actions[].params #3030 (1c92868b) and PR fix(auth)+feat(cli): Create User dialog — translatable action params (#3030) and explicit-password-wins semantics (#3031) #3033 (8be10321). /cloud/home runs 804 → 441 ms and sso-open 549 → 390 ms at 50 ms RTT, and platform-admin standing takes one round. The card is now pm:blocked on console open: page routes read the whole object registry (751 KB), the chrome's dashboard and report getters add a serial wave, and nine calls the page does not read run on open objectui#12980.
  • cloud#3029 (ruling C: the publish fence's carve-out retired) through PR auth: create-user 400s when a password is typed while generatePassword keeps its default (true) #3031 (c403d600). After one merge-queue dequeue, a harness race got its own fix round. Closed.
  • cloud#2917 ruling B item 1 through PR docs(adr): status-hygiene sweep — fix 0096 collision, flip implemented statuses, mark PRIORITIZATION stale #3032 (b7ac0bbe). Item 2 went to objectui as Environments list: on the free plan, draw the 「开发环境 · 团队版起」 lock mark only for a viewer the server sends an upgrade link to (ruling B on cloud#2917) objectui#12983. Closed completed (6254325465) after PR feat(spec): dashboard filter pairing — GlobalFilterSchema.name + DashboardWidgetSchema.filterBindings (#2501) #3035.
  • cloud#2910 through PR docs(search)+seed(showcase): 拼音搜索文档 + showcase 中文种子数据(#2486 收尾) #3034 (b8a0d089). Closed.
  • cloud#2916 Target 2 round 1, the 「概览」 / 「设置」 tabs under ruling A on cloud#3001, through PR feat(spec): dashboard filter pairing — GlobalFilterSchema.name + DashboardWidgetSchema.filterBindings (#2501) #3035 (bdb8ed81). The ACCEPT 6254215078 answers the dev's five artboard forks.
  • Filed: Environments list: on the free plan, draw the 「开发环境 · 团队版起」 lock mark only for a viewer the server sends an upgrade link to (ruling B on cloud#2917) objectui#12983, feat(spec): type IObjectQLEngine.getSchema and declare IDataEngine.syncObjectSchema (#12481, #12482) #12986, docs(skills): stop printing a refusal string the sharing gate no longer emits #12987; platform-objects sys_organization: rename_organization, update_organization, delete_organization and change_slug carry no membership-reach gate, so a plain member is offered organisation-admin buttons the doors refuse #24384; cloud#3036.
• R4, the night (since the previous refresh, cap 2): landed:
  • cloud#2926 through PR ADR-0076 D11 前置验证:HTTP 端口一致性门(packages/qa/http-conformance)+ OQ#9/10 结论 (#2462) #3037 (5a562dfc): the blueprint names a status field as stageField, with each option's kind. Closed. Filed cloud#3039 (the build summary claims sample data that was not written) and AI build plan card: draw a stage field's lifecycle (the field chip's 「借出 · 已还 ✓完成 · 逾期 ⚠」) from the plan card's new lifecycle key objectui#12994 (the plan card's lifecycle chip).
  • Environments list: on the free plan, draw the 「开发环境 · 团队版起」 lock mark only for a viewer the server sends an upgrade link to (ruling B on cloud#2917) objectui#12983 (the list's lock mark) through PR [finding] The SMTP port bound 1-65535 is hand-written three times across two packages — the enforcement, its own message text, and the settings form can drift apart #12993 (4dfdebdf). Closed.
  • cloud#2916's 「概览」 round 2 through PR feat(showcase): Revenue Pulse — interactive dashboard-level filters demo over two objects (#2501) #3038 (0d89ebb7). Target 2 is complete; the card is back on pm:blocked on record blocks bound to a dataSource that yields no row draw an authored empty state, not the renderer's raw placeholder (ruling B on cloud#2774) objectui#12932 for Target 1 (LANDED 6255749481).
  • cloud#2954 through PR security(objectql): readonlyWhen 在多行 UPDATE(options.multi / REST updateMany)路径上服务端不强制——与静态 readonly 不一致 #3041 (0f0ae8aa): propose_blueprint / apply_blueprint use the spec's own blueprint schemas, and the cloud-side .extend() is gone. Closed (LANDED 6256004182).
  • cloud#2873's code half through PR 安全/设计:静态 readonly 的 INSERT 豁免让审批/状态字段可在创建时被直接播种(比 #3003 少一步) #3043 (9099bd1e): migrate.ts boots walled (LANDED 6256326291).
• Awaiting a human merge (Tier H): cloud#2873's governed half, PR fix(plugin-audit): localize activity summaries to the workspace locale (#3039) #3045 (the four migrate-* workflows; record 6256250338; reviews requested from os-zhuang and hotlong; labelled needs-user-decision).
• Decision box: cloud#3036 (which 设置 rows hide by admin capability, 6255687899, recommended A); its PR [console] date 字段相对时间 humanize 硬编码英文,不随 locale 本地化(zh-CN 显示 Tomorrow/In 3 days) #3040 stays a draft.
• Filed: cloud#3046 (finding, security: a migrate boot of an empty control database seeds the framework's known-credential dev admin).
• Re-pointed: Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 → metadata-protocol: the draft save records draftChanges (per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395 (6255873403; metadata-protocol / spec: a draft carries no per-field provenance (which surface changed which key, and when), so Studio cannot mark a copilot's draft change with the ruled 草稿 chip and 来源 line #24298 was the spec half only, and objectui consumes published packages).
• In flight (cap 2): cloud#2928 (claim 6255895155: the objectui pin move carrying 「关于」 plus its build version, and the governed AGENTS.md cadence line) and cloud#2925 (claim 6256201020: a relation record's title is a one-hop formula, ruling A).
• Next in order (p1/p2 only, the maintainer's word of 2026-10-19): cloud#3048 (the seed key), after PR feat(security): enforce OWD posture on the runtime write path (#3050) + flip 10 verified ADR statuses #3052 on sample-data-tools.ts. The p3 cards fix(plugin-auth): re-run membership backfill when app seeding settles (#2996) #3000, feat(connector-openapi): declarative provider — resolve providerConfig.spec from a file path (ADR-0096 follow-up) #3016, test(app-showcase): B3 cascading-select fixture — server-enforced dynamic options (#2559) #3006, chore(release): 破坏性授权变更 changeset 提级 major + v15 升级指南 #2950 and fix(security): getReadFilter 对 on-behalf-of 读 fail-closed 哨兵（#2852 Gap 1 潜伏面） #2988 are not dispatched. Staging readings wait on the maintainer opening this container's network to *.objectos.app.

继承台账

Queue snapshot at this edit (REST, state=open, one read per label):

• pm:queue 7: cloud#3039, chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 7 updates #2861 (p2); feat(connector-openapi): declarative provider — resolve providerConfig.spec from a file path (ADR-0096 follow-up) #3016, test(app-showcase): B3 cascading-select fixture — server-enforced dynamic options (#2559) #3006, fix(plugin-auth): re-run membership backfill when app seeding settles (#2996) #3000, chore(release): 破坏性授权变更 changeset 提级 major + v15 升级指南 #2950, fix(security): getReadFilter 对 on-behalf-of 读 fail-closed 哨兵（#2852 Gap 1 潜伏面） #2988 (p3, fix(security): getReadFilter 对 on-behalf-of 读 fail-closed 哨兵（#2852 Gap 1 潜伏面） #2988 pm:retriage).
• needs-user-decision 1 card, cloud#3036, and 1 PR, cloud#3045 (Tier H, awaiting review).
• pm:blocked 9: 属主守卫与级联 set_null 冲突:非特权删除 sys_user 时 owner_id 级联置空被 #3004 守卫拦截(级联中途失败) #3023, deps: move better-auth family off the 1.7.0-rc.1 prerelease to a stable ^1.7.x line #3002, feat(platform-objects): A3 — 用户页 Permission Sets + Business Units 分配入口 (#2920) #2927, docs(adr): ADR-0095 — authz kernel chain: tenant isolation as Layer 0, posture ladder, capability-derived posture (B0 of #2920) #2924, 导出/导入文件名与多语言优化:显示名+视图名+时间戳命名、模板全中文、导出↔导入选项标签闭环 #2916, feat(plugin-security): customized flag on packaged permission sets — Setup badge (ADR-0094) #2913 (p2); feat(cli): surface migration guide when specVersion trails the installed platform #2914, feat(security)!: enforce book audience at the REST read layer; finish the ADR-0090 D2/D3 cleanup the P1 wave missed #2774, ADR-0053 Phase 2 · Slice 2: thread context into applyFormulaPlan (read-time formula fields) #1979 (p1).
• pm:awaiting-maintainer 6: feat(approvals): SLA escalateTo resolves positions via sys_user_position (ADR-0090 D3 follow-up) #2767, chore(console): refresh vendored objectui SPA to 09e1b261 #2549, [11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377, feat(ai): flow-authoring agent should emit the ADR-0044 revise-loop shape (revise + type:'back') #2274, feat(approvals): actionable approval links — single-use tokens + session-less confirm page (ADR-0043) #1765, chore: version packages #786.
• pm:dispatched 4: feat(spec): C2-α — explain 契约扩展到 record 粒度 (#2920) #2928, ci: faster Test Core — affected-only PR tests, single spec suite run #2925 and 查询过滤器遇到"不认识的条件"时,应统一报错而不是悄悄放行(所有数据驱动) #2873 (this seat's; 查询过滤器遇到"不认识的条件"时,应统一报错而不是悄悄放行(所有数据驱动) #2873 waits on PR fix(plugin-audit): localize activity summaries to the workspace locale (#3039) #3045), chore: version packages #2822 (the maintainer's).
• pm:on-hold 5: chore: version packages #2546, build-console.sh 打包 console 时应注入本仓库 client,否则新 UI + 旧 client 漂移(11.5.0 已发生) #2512, docs(adr): ADR-0075 — configurable, opt-out-able post-login landing #2367, chore: version packages #2310, chore(deps)(deps): bump the production-dependencies group across 1 directory with 3 updates #1288. In objectstack-ai/objectui this seat holds fix(plugin-approvals): render the non-submitter recall refusal through the operation-message catalog #12725 and fix(i18n): read the provenance companion at serving time in all nine bundle sets #12724 (pm:blocked); other objectui cards are left to the objectui seats. ⛔ This post lists no inherited rulings.

热文件串行队

Serial order:

• service-ai-studio (blueprint-tools.ts, propose-blueprint.tool.ts, solution-design-skill.ts): cloud#2925 is in flight, then cloud#3039.
• service-tenant sys-environment.object.ts: cloud#3036's PR [console] date 字段相对时间 humanize 硬编码英文,不随 locale 本地化(zh-CN 显示 Tomorrow/In 3 days) #3040, held until its ruling.
• The pin files and Dockerfiles: cloud#2928 is in flight on .objectui-sha.
• Riders: at the next framework pin move that carries fix(platform-objects): sys_member transfer_ownership says the target becomes an owner and the caller keeps their role #24412 (pointer 6257439197), cloud#2912's booted test expects the caller's role to read owner after transfer_ownership (not admin), and any copy it asserts reads 「Make Owner」; the stale lock-mark comment in environment-lifecycle.ts rides the next cloud PR that edits that file; .spec-changes-ack.json's four view-filter rows (they name the removed PlanBlueprintViewSchema) ride the next PR that edits them.

Every cloud dev materialises the pin tree ec749fbb only through ensure-pinned-framework.mjs, under the verify lock.

说明

• Scope: the objectstack-ai/cloud whole-repo queue, as seat 1's 范围 section states; ⛔ no domain:* is produced here. references/lanes/cloud.md still does not exist.
• ⚠️ Linked-user deviation, recorded: the linked user os-zhuang is in GOVERNED_APPROVERS; writes went through the relay as objectstack-fleet[bot], and no approving review was submitted from this seat.
• Mode deviation, recorded: every dispatch ran mode:subagent, including R3's L fold (the frozen pin tree and the verify lock were in the seat's container; the cloud backend's push path for this lane was not verified from it).
• Platform readings, this shift: post-stamped.mjs takes --repo=owner/name with an equals sign; a quoted stamp inside a stamped body is spelled {{WAS:…}}; a decision analysis is refused without its os-decision-facets block; close-cards.mjs refuses a card with an assignee and needs --expect-state naming the current state; the MCP semantic issue search on objectstack-ai/objectui answered zero even for a control naming objectui#12294 (use REST enumeration); the merge queue lands two PRs within a minute of each other; a body refresh on a card whose body carries no stamp is refused until --ack-through=ID names the newest comment.