docs(adr): record the stage-8 retirement of the four security-catalog row objects in the ADRs that name them

[objectstack-fleet]

Fixes #22978
Clause-②: no

docs only — no package ships docs/adr/**. This diff touches only docs/adr/**, a Tier H governed surface: the PR stays a draft and lands on the maintainer's approval.

What this changes

ADR-0131 D2/D3/D13, carried out by #15204 stage 8 (66949b7729, PR #23222, merged 2026-10-13), stopped registering sys_position, sys_permission_set, sys_position_permission_set and sys_capability, and unwired the ADR-0094 permission projector, its boot reconcile and the data-door write-throughs. The tables and their rows stay until the ADR-0131 D10 migration. Nine of the eleven ADR files on this card still named those objects or that machinery as live. Each now records the retirement in the form AGENTS.md rule 13 names, an amended status line, plus a dated note at each section that names them:

• · **Amended** (2026-10-14, ADR-0131 …) on the status line. ADR-0017 used this form for ADR-0131 D13's sys_view_definition retirement.
• > **RETIRED 2026-10-13 (#15204 stage 8, by execution of ADR-0131 …)** where a mechanism the ADR itself decided is gone. ADR-0006 v4's D1 is the precedent.
• > **Note (2026-10-14) — …** where the decision stands and only the stored object it names is gone. ADR-0061 D5 is the precedent.

No decision is rewritten: every edit is a pure insertion. Each file was compared with difflib.SequenceMatcher against the merge base 18cd410dc4: 36 insert opcodes, 0 replace, 0 delete. No heading changes (the diff has no +# or -# line), so no anchor that other files cite moves. ADR-0131 is linked with the sibling spelling ./0131-total-organization-ownership-no-null-organization-id.md, without a fragment, as all 25 existing links to it in the corpus are written.

This is a leaf of the #15194 epic subtree. content/docs/** (the devx lane's own card) and packages/** are untouched.

Per-file record

File	Passage	Note written	Why
0029-kernel-object-ownership-…	D1 ownership table, plugin-sharing row: sys_permission_set, sys_*_permission_set	status segment; Note under D1	the row names two retired row objects; D1's ownership rule stands
0057-erp-authorization-core-…	status line: "realizes them as flat sys_position"; the path note's sys-position.object.ts	status segment	the status line itself names the retired object, and stage 8 deleted that file
0057-system-data-lifecycle-…	none	nothing	git grep -c -E 'sys_position|sys_permission_set|sys_capability|permission-set-projection' -- docs/adr/0057-system-data-lifecycle-and-retention.md exits 1 (zero hits). The control is the same grep on the ERP 0057, which counts 2
0066-unified-authorization-model	principle item 2 (records edited in Setup); D1 "Landed" (materialized into sys_capability); D5 (sets land as sys_permission_set) with "What stays unchanged"; refinement ⑨ (the sys_capability seed row)	status segment; 4 Notes	each passage names a retired row object as a live store; the three-way separation stands
0086-authz-metadata-config-…	Re-evaluation: the status table's D5/P1 seeder rows; ⚠️ item 1 (projection and write-through); the restated D1 table's Assignment row (sys_position_permission_set)	status segment; 2 Notes; 1 RETIRED inside item 1	this ADR's status line sends readers to the Re-evaluation for "the current, code-grounded status of every decision", so the notes go there
0090-permission-model-v2-…	D3 rename table (sys_position, sys_position_permission_set); D5 (everyone bound through sys_position_permission_set; sys_capability); D8 (sys_position_permission_set-like tables)	status line; 3 Notes	the renames and rules stand, but the tables they name are retired
0091-grant-lifecycle-…	D1 (binding table left undated); Non-goals bullet 1; Phasing L2 (sys_position.delegatable)	status segment; 3 Notes	the reasoning stands; the table and the column are gone
0094-sys-permission-set-pure-projection	TL;DR, D1, D2, D3, D4, Consequences (the open question), the 2026-07-14 addendum's per-type table and the scope tradeoff, the 2026-09-04 amendment's "one major left to live"	status segment; RETIRED under the TL;DR, D2, D3, D4 and at the end of the 2026-09-04 amendment; Notes under D1, the Consequences and the addendum	ADR-0131 D2/D3 retires the record's whole projection; D1 stands, generalized by ADR-0131 D3
0103-managedby-write-policy-…	Context item 2 and its "Not to be confused with" block (provenance-column objects); the v16 addendum's writable-set list; the #4671 addendum's three link tables	status segment; 3 Notes	the policy stands; one link table and two provenance-column objects are retired
0126-packaged-metadata-customization-model	§4 (D2): "the permission projection keeps its own row-state door"; §8 (D5) item 3: how sys_permission_set.active and the ledger relate	status segment; 2 Notes	the projection and its row are gone; ADR-0131 §4 moves active into the definition's lifecycle
0131-total-organization-ownership-…	none written	nothing	this is the deciding record. D2, D3, D13 and §4 already describe these objects as retiring, §1 and §7 are dated context, and §8's C3 row is the plan. Its status line says execution state lives on the epic, not on that line

Left alone and listed, not noted (dated context, or text that already reads as retired):

• 0057 ERP: the Context axis table ("ObjectStack today: sys_permission_set"), and D5's sys_role_permission_set, which the status line already marks superseded (D4–D7).
• 0086: the original body (Context "What is already true", D3, D5, P1, Consequences). The ADR keeps every decision's current status in its Re-evaluation, where the notes go. The Net assessment points back to ⚠️ item 1.
• 0094: Context (dated: "had two writable stores"), D5 (already RETIRED 2026-08-09), Alternatives considered, References.
• 0126: §1.1, "What exists today — measured" (dated context).
• 0131: §1.2 item 4, §1.3, §5 and §7 (dated); D2, D3, D13 and §4 (the retiring text); §8's C3 row.

Facts the notes state, and where each was read (main at 18cd410dc4)

• Stage 8 (66949b7729): its own message says the objects are "no longer registered" and "Tables and rows stay for the organization-ownership migration (ADR-0131 D10)". Of the unwired modules it says "The modules stay for 7a/7b to delete". The ADR-0087 entry is packages/spec/src/migrations/entries/semantic/18.catalog-row-objects-retired.ts.
• The projection module: permission-set-projection.ts is still in the tree. security-plugin.ts does not register it, and its deletion is refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 stage 7a (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, open). Stage 7b (5c9bfb0d3f, PR refactor(plugin-security): delete the position write-through and the row-only position backfill (C3 stage 7b) #23302) already deleted the position write-through and the row-only backfill. None of the eleven ADRs names those two.
• The projector seam stays. git grep -c "this.runMutationProjector(" -- packages/metadata-protocol/src/protocol.ts answers 7. security-catalog-echo.ts (PR fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334, 6d96721faa) registers the seam for permission and position and writes no row. ADR-0094's D2 note and its 2026-09-04 note both say this, so neither can be read as "the seam is gone".
• The seeder: bootstrap-declared-permissions.ts was deleted by stage 6b-2 (c8a9783eca, PR feat(plugin-security)!: no seeder or materializer writes a sys_permission_set row; the boot seeds no row for a declared set (#15204 stage 6b-2) #22900).
• PositionSchema has the keys name, label, description, permissionSets, delegatable and protection, and no team key. The ADR-0090 D8 note depends on this.
• The D12 gate reads delegatable "from the security catalog by name" (delegated-admin-gate.ts). The ADR-0091 L2 note depends on this.
• Outside the eleven: git grep -c -E 'sys_position|sys_permission_set|sys_capability' -- 'docs/adr/*.md' lists exactly the ten numbers on this card. No other ADR names the four objects.

Gates — head abc9f1aa3d (this branch merged with origin/main 18cd410dc4)

Every exit code was captured before any pipe.

• The five named gates, all exit 0: pnpm check:adr-anchors, pnpm check:adr-links (758 relative link destinations under docs/adr/, all found), pnpm check:adr-symbol-anchors (2336 anchors across 142 records, all found), pnpm check:nul-bytes and pnpm check:doc-authoring.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack lists 19 commands. 18 exit 0.
  • pnpm --filter @objectstack/lint run check:doc-formula-expressions exits 3 with PREREQUISITE NOT MET (@objectstack/formula is not built). That is NOT MEASURED, and it was not built for, because no package source is in this diff.
  • --ran reconciliation: "19 derived famil(ies) accounted for — 18 run, 1 NOT-MEASURED", exit 0.
• No build and no test suite ran: the diff holds no package source.

维护者速读(草稿)

改了什么

• 9 份 ADR 提到了岗位、权限集、岗位-权限集绑定、能力这四个“目录行对象”，或提到了 ADR-0094 的权限集投影机制。这些地方现在都标注了“已退役”：状态行追加一段 Amended 修订记录，受影响的章节下各加一段带日期的说明。
• 原文没有改动，全部是插入，标题也没动，其他文件引用这些 ADR 的锚点不受影响。
• 有两份没改：ADR-0131 是做出退役决定的那份，原文本来就写着“退役”；ADR-0057 的数据生命周期那份没有提到这四个对象。

为什么改

• 第 8 阶段（refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204）已在 10 月 13 日合并，这四个对象已经从系统中摘除，但上面这些 ADR 还把它们写成在用的数据表。按 AGENTS.md 第 13 条，被后来决定退役的内容，要在原 ADR 上留下修订记录。不留的话，人和 AI 读到旧 ADR，会以为这些表还在，照着写出错误的代码或元数据。

风险与代价(含回滚)

• 只改文档，不涉及任何发布的包，对运行时没有影响。回滚就是 revert 本 PR。
• 说明里的每条事实都对照当前 main 核实过：哪个提交退役了什么；表和数据保留到 D10 迁移；投影模块仍在代码树里，等 7a 阶段删除。7a 落地后，“模块仍在树上”这句会变成历史描述，但说明带了日期，不会误导读者。

席位意见

你要做的

• docs/adr/** 是受管路径（Tier H），需要你审阅后批准，或亲手合并。
• 一个可选决定：ADR-0131 是否也要在状态行记一笔“C3 第 8 阶段已执行”？本 PR 没有加，因为它的状态行明确写着执行进度由 epic 记录，不放在状态行。

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: abc9f1aa3d286375689d63d004f944f312194122
Local-runs: none

Reviewed in seat by the dispatching skills seat (served tier read from get_session last_served_model this act, equal to the constant's value), on the PR diff (nine files under docs/adr/, +163/−6, two commits — the edit and a merge of origin/main 18cd410dc4; check-governed-merges --pr 23362: docs/adr/**, Tier H, 169 changed lines), card #22978, the stage-8 landing (66949b7729) and the head's check-runs. The governed face is the ADR text; the judgment is whether each inserted note records the retirement the way AGENTS.md rule 13 asks and states only facts the tree carries. Written 2026-10-14T02:00Z.

① Derived judgments

• Form. Every one of the 440 diff lines is an insertion: the six − lines are the six **Status**: lines re-emitted with an appended · **Amended** (2026-10-14, ADR-0131 …) segment; grep -cE '^[-+]#' on the diff → 0, so no heading moves and no anchor another file cites changes (Lint & Repo Gates runs check:adr-anchors, check:adr-links, check:adr-symbol-anchors). The three note forms are the corpus's own: the status-line Amended segment (ADR-0005, ADR-0029 precedents), > **RETIRED 2026-10-13 (#15204 stage 8, by execution of ADR-0131 …)** where a mechanism the record decided is gone (ADR-0006 v4 precedent), > **Note (2026-10-14) — …** where the decision stands and only the stored object is gone. No decision sentence is rewritten; each note says what stands ("D1 stands", "the renames and the word ban stand", "the constraint stands"). Correct under rule 13 — an amended status line on the old record, never a quiet reversal.
• Facts the notes state, read on main 18cd410dc4 in this act: stage 8 is 66949b7729 (2026-10-13, PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222); stage 7b 5c9bfb0d3f deleted the position write-through and the row-only backfill (its subject says so); stage 6b-2 c8a9783eca is the "no seeder writes a sys_permission_set row" commit and bootstrap-declared-permissions has 0 paths on main; packages/plugins/plugin-security/src/permission-set-projection.ts is still in the tree (the notes say "stays until refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 stage 7a deletes it" — true today, and dated); registerMutationProjector is still called from protocol.ts, security-catalog-echo.ts, service-automation, service-datasource and the unwired projection module, so "the seam stays" is true; PR fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334 (6d96721faa) is the security-catalog echo serving metadata-door permission sets and positions, as the ADR-0094 notes say; PositionSchema.permissionSets is z.array(SnakeCaseIdentifierSchema).optional() (packages/spec/src/identity/position.zod.ts:106) and delegatable is a key of the same schema, so "a position names its sets in its own definition" and "sys_position.delegatable left with its object" are true; ADR-0131 D10 is the per-table migration the notes defer the rows to (0131…md:532). Every cited fact holds.
• Population. git grep -c -E 'sys_position|sys_permission_set|sys_capability' -- 'docs/adr/*.md' on the head lists exactly the ten card numbers (eleven files), so the sweep is complete and no ADR outside the card names the four objects; 0057-system-data-lifecycle has 0 hits (the positive control on the ERP 0057 counts 2) and is correctly left alone.
• ADR-0131 unchanged. Its D2/D3/D13 and §4 already read as retiring the four objects and its status line says execution state is carried by the epic [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193/refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, not by the line — leaving it is the reading that keeps the decision record and the execution ledger apart (the dev's open question; the seat takes A).
• Fixes #22978 is the body's only closing keyword (the body names [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204, feat(plugin-security)!: no seeder or materializer writes a sys_permission_set row; the boot seeds no row for a declared set (#15204 stage 6b-2) #22900, C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222, refactor(plugin-security): delete the position write-through and the row-only position backfill (C3 stage 7b) #23302, fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334, decide: system-data 默认 affordance 是否应包含 CSV import(RBAC 关联表批量绑定) #4671 with no closing verb); Clause-②: no is correct — no published surface, no spec path. content/docs/** and packages/** untouched, as the card requires.

② Semver level

None owed: no package ships docs/adr/** (the body's reading: 72 package.json files declare files[], 72 ship dist, 0 ship docs/adr). skip-changeset is the seat's label, written after this review's docs-only reading; Check Changeset re-reads under it.

③ Boundary flags

• Dev flag — the branch merged origin/main (18cd410dc4) before the gate run because dispatch-gates flagged a stale tree; the merge commit carries no conflict and the derived list was unchanged (19 commands). Accepted.
• Dev flag — ADR-0131 links carry no #fragment (all 25 existing links in the corpus are written that way; check-adr-links strips fragments). Accepted; the dispatch's #… spelling was a suggestion.
• Dev flag — RETIRED headings carry the execution date (2026-10-13) and Amended / Note headings the authoring date (2026-10-14), following ADR-0006 v4's form. Accepted and consistent.
• Dev flag — check:doc-formula-expressions NOT MEASURED locally (exit 3, @objectstack/formula not built; docs-only diff): Lint & Repo Gates on this head runs it. Accepted.
• Open question (should ADR-0131's status line also record that C3 stage 8 executed): A — leave it; the nine amended ADRs and the epic carry the execution record, and the line's own text says so. Seat decision; the 速读 shows the maintainer the alternative in one line.
• Out of scope: none to file; the "7a deletes the module" clause is dated and needs no edit when C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 lands.

Implemented-by: claude/issue-22978-adr-sweep-catalog-row-retirement
Reviewed-by: session_013zGKMG1cRedVzWtqGGGZW9

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

维护者速读(终稿)· PR #23362 · head abc9f1aa3d · Tier H(docs/adr/**)

skills 席 1(session_013zGKMG1cRedVzWtqGGGZW9,huangyiirene),写于 2026-10-14T02:01Z。席内契约复核 PASS 记录在本 PR,ACCEPT 在卡 #22978;本 PR 保持 draft,⛔ 席位不翻 ready、不入队。

改了什么

9 份 ADR 提到了岗位、权限集、岗位-权限集绑定、能力这四个「目录行对象」,或提到了 ADR-0094 的权限集投影机制;#15204 第 8 阶段(66949b7729,10 月 13 日合并)已把它们从系统里摘除,但这些 ADR 还把它们写成在用的数据表。本 PR 按 AGENTS.md 第 13 条在原 ADR 上留修订记录:状态行追加一段 Amended (2026-10-14, ADR-0131 D3/D13 …),受影响的章节下各加一段带日期的说明(机制本身被退役的写 RETIRED 2026-10-13 (#15204 stage 8 …),决定仍成立、只是所指的表没了的写 Note (2026-10-14))。全部是插入(+163/−6,减的 6 行是状态行原地加长),标题一个没动,其他文件引用这些 ADR 的锚点不受影响。ADR-0131(做出退役决定的那份)和 ADR-0057 数据生命周期(未提到这四个对象)没改。

为什么改

不留记录,人和 AI 读旧 ADR 会以为这些表还在,照着写出错误的代码或元数据;ADR 的约定是「被后来决定退役的内容,在原记录上留修订,不改写决定」。

风险与代价(含回滚)

• 只改文档,不碰任何发布的包,运行时零影响;回滚 = revert 本 PR(两个 commit)。
• 风险只有「说明里的事实写错」一种:席位在 main 上逐条核过——第 8 阶段提交、7b(5c9bfb0d3f)删了岗位写透与回填、6b-2(c8a9783eca)删了权限集播种器、投影模块仍在树上等 7a(C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975)删、registerMutationProjector 接缝仍被五个模块调用、PositionSchema.permissionSets 与 delegatable 在 spec 里、D10 迁移存在。7a 落地后「模块仍在树上」变成历史描述,但说明带了日期,不误导。

席位意见

同意落地。① 形式正确:只增不改、不动标题、三种写法都是语料库里已有的先例;② 事实全部对得上树;③ dev 的开放问题「ADR-0131 状态行要不要也记一笔第 8 阶段已执行」,席位取 A(不记):ADR-0131 自己的 D2/D3/D13 与 §4 本来就写着退役,它的状态行写明执行进度由 epic(#15193/#15204)记录,九份被修订的 ADR 已承担记录;若你想让执行可见于记录本身,B 是在同一 PR 的状态行上加一段,一行的事,在该行留评即可。

你要做的

一个动作:对本 PR Approve(docs/adr/** 是 Tier H,需要你一次授权批准;批准后席位经中继落地)。

---

Generated by Claude Code