Repository navigation
Commit c8a9783
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
Part of #15204
Clause-②: yes (narrowing)
Stage **6b-2**: no seeder or materializer writes a `sys_permission_set`
row, and the boot seeds no row for a declared set. The
declared-permission seeder, the platform-default materialization, the
`permission` publish materializer, the `metadata:reloaded` re-seed and
the organization-creation hook are deleted, with drift, the seed refusal
diagnostics and the `managed_by` normalizer ("only delete, never fix",
batch #310 item 4). An uninstall still revokes every grant of the
package's sets, now by name (option 1, the maintainer's ruling
6123311533; mechanism B, the seat's choice under option 1). Until stage
7 (7a, #22975) retires the ADR-0094 projector, a permission-set publish
still has it write a transitional `admin` projection row (see "The
ADR-0094 projector until stage 7" below). This PR leaves #15204 open:
stages 7a, 7b, 8, 8-post, C7b and 6c remain.
## Landing — draft until the seat marks it ready
- **Prerequisites are on `main`**, last #22939 (grant-name pickers) and
#22967 (the console pin), with CD (#22881) and 6b-2a (#22899) before
them. `main` (`df7a137923`) is merged into this branch.
- **Then land back to back: T1 (#22897) → T2 (#22898) → this PR.** T1
and T2 stay drafts until then, so the seeders are never live on `main`
with their pins gone. If `main` moves first, it is merged into all three
again just before landing.
- **Size: Tier H.** Measured on its own once T1 and T2 are on `main`
(simulated: `main` `df7a137923` + T1 `bb7b4cef36` + T2 `a38b54f6f2`,
then this head): **3,601 changed lines** (48 files, +945 / −2,656). The
uninstall revoke and its pins (mechanism B) took it over 3,000. This
diff touches no governed path. Until T1 and T2 land, GitHub shows the
whole branch.
- **Merge notes, for when `main` is merged in after T1 and T2:**
- `scripts/engine-double-contract.pinned.json`: regenerate with `node
scripts/check-engine-double-contract.mjs --write` (measured: the
regeneration produces no change against this branch).
- The two `*.baseline.json` ledgers: T1 and T2 conflict with each other
there; drop every entry for a deleted suite.
## What changes
| Surface | Before | Now |
|:--|:--|:--|
| `bootstrap-declared-permissions.ts` (522 lines) | seeded every
declared set as a `managed_by:'package'` row, once per organization
under a wall | deleted |
| `bootstrap-platform-admin.ts` | seeded the platform defaults
insert-once; `resync` reconciled them | writes no catalog row. It reads
the legacy `admin_full_access` row only for leg C (a grant written
before the name column; restrict-only). A refused read withholds the
promotion and says so once. No `resync` option, no `seeded` / `resynced`
/ `resyncSkipped` |
| `permission` publish materializer (SP) | upserted a package-door
publish into a row; ran the suggestion reconcile and `everyone`'s
re-derivation only when it materialized and the body carried `isDefault`
| deleted. The reconcile and the re-derivation hang off
`onMetadataMutation`: every landed `permission` publish, direct save or
delete, unconditionally. Drafts and other types do nothing (closes U2
contract flag A, 6109964380). The ADR-0094 projector still writes an
`admin` projection row on the publish until stage 7 (next section) |
| `metadata:reloaded` re-seed, organization-creation hook (SP) |
re-seeded rows after a hot install and per new organization | deleted |
| `permission-set-drift.ts`, `normalize-managed-by.ts`,
`seed-refusal-diagnostics.ts` | boot diagnostics over the seeded rows |
deleted; their public exports go (listed in the changeset) |
| `warnOrganizationLessRows`, `catalogIsPerOrganization`,
`listSeedOrganizationIds` (`organization-scope.ts`, internal) | the
per-organization sweep and the organization-less row guard; the seeder
was their one caller | deleted (re-measured: no live caller, no test) |
| `sys_permission_set.drift_status` / `drift_detail` and the **Needs
Attention** view | written by drift | removed with their writer
(translations regenerated). The packaged-overlay report still names a
shadowed set at boot |
| `readDeclared` | exported by the seeder | re-homed into
`declared-capability-context.ts` (its two readers: the capability
context and the managed-object write denies). It is a read of the
registry, the catalog's one home, never of a row |
| **Uninstall** (`security.package-permissions`, both doors) | found a
package's grants through its `managed_by:'package'` rows | see the next
section |
## The ADR-0094 projector until stage 7 (measured)
With the `permission` materializer gone, the awaited ADR-0094 projector
(`projectPermissionMutation`, retired in stage 7 / 7a #22975) is the one
writer left on a publish. Measured on the CRM stack, fresh database,
this head against `main`:
| | this PR | `main` |
|:--|:--|:--|
| package-door publish (draft, then `publishPackageDrafts`) | 1 row:
`managed_by:'admin'`, no `package_id` | 1 row: `managed_by:'package'`,
`package_id` |
| writable base's direct `saveMetaItem` publish | 1 row: `admin`, no
`package_id` | the same (pre-existing) |
| admin data-door `PATCH` | accepted; written through into the base's
own `sys_metadata` row (no environment overlay); the catalog serves the
edit | the same |
| admin data-door `DELETE` | deletes the row, the base's `sys_metadata`
row and the served set | answers `success:false`; the row stays, the
`sys_metadata` row goes |
| `deletePackage` | the row is removed (the projector's delete leg) |
the row is removed |
| boot with a base-published set and no row (file-backed DB, re-boot) |
the boot reconcile re-creates one `admin` row | not measured |
No authorization path reads the row (the resolver reads set bodies from
the catalog). The one change from `main` is the provenance of a
package-door publish's row (`package` → `admin`) and what a data-door
delete of it does. Stage-plan rule: `permission-set-projection.ts`
retires in 7a, so it is not fixed here ("only delete, never fix"). The
seat carries "after 7a, a package-door publish writes no row" on 7a's
card. The alternative, a projector guard that creates no row for a
package-held name, is offered to the maintainer as (A).
## Uninstall: the grants naming the package's sets (ADR-0090 D5)
With no row standing for a package's set, the cleanup found no grant to
revoke: a grant naming the set survived the uninstall, inert while
nothing served the name, and **live again on reinstall**. Option 1 (the
maintainer's ruling on #15204, 6123311533): revoke by the package's
catalog set names, read before the package is withdrawn. Mechanism B
(the seat's choice under option 1): capture before the withdrawal and
hand the names to the cleanups; the lifecycle order is untouched.
- **One capture, both doors, the same point.**
`captureUninstallDeclared(registry, packageId, stored?)`
(`@objectstack/metadata-protocol`) runs just before
`registry.uninstallPackage`, in `deletePackage` and in install-local's
`DELETE /api/v1/marketplace/install-local/:id`. The withdrawal still
precedes the cleanups (#21576 / #21490 race guard unchanged); the
capture is synchronous, so install-local still has no `await` between
the ledger removal and the withdrawal.
- **Two sources, unioned:**
- the registry: `SchemaRegistry.securityCatalogNamesHeldBy(packageId,
'permission')` (new; the package's claims and `<packageId>:<name>` item
slots, unfiltered by disable, since a disabled package still holds its
names). This names an installed (artifact / install-local) package's
sets.
- on `deletePackage`, the `permission` rows of the package's
`sys_metadata` that the door already read before any delete. **A
base-authored item is held in the registry's bare slot with no
`_packageId` (provenance `org`)** (measured on the CRM stack:
`securityCatalogNamesHeldBy(base)` answers `[]`, while `sys_metadata`
holds `{ type: 'permission', name }`), so the registry alone cannot
attribute it to the base.
- **The hand-off is additive and optional:** `UninstallCleanup`'s args
gain `declared?: { permission?: string[] }`, passed by
`runUninstallCleanups` only when the capture named a set. A package that
declared none hands its cleanups exactly the request they had before.
`PACKAGE_JOBS_UNINSTALL_CLEANUP` is unchanged.
- **The cleanup** revokes every `sys_user_permission_set` grant naming a
captured set. A name has one holder (the registry refuses a second at
install), so each such grant was a grant of this package's set.
- **The legacy row path stays:** an already-seeded database keeps its
`managed_by:'package'` rows until C7b (this PR's changeset says so).
Grants written before the name column and `sys_position_permission_set`
bindings (which carry only `permission_set_id`, no name column) are
still reached through such a row.
- **Not touched:** a position declared in the catalog that lists the
uninstalled package's set is metadata an author wrote, not a grant row;
it stays as authored.
## Pins
- `builtin-positions.boot.test.ts` (real plugin boot, real SQLite, every
scenario): **zero `sys_permission_set` rows** after boot, with a
positive census control. The first platform administrator (`single`) and
the organization administrator are still granted. The grant golden is
unchanged, with no row at all.
- `grant-permission-set-name.writers.test.ts`: the promotion leaves zero
rows and the holder reads by name. The 6b-2-pre pins stay green.
- `everyone-rederivation-on-permission-mutation.test.ts`: one listener
even across a bootstrap re-run. Publish and delete of a `permission`
re-derive; a draft or another type does not.
- `showcase-permission-seeding.dogfood.test.ts` (the
`declarative-permission-seeding` authz row, rewritten): the showcase's
sets are served by the catalog with their package, and the boot writes
no row.
- `bootstrap-platform-admin-refused-existence-read.test.ts`: a refused
legacy read withholds the promotion and writes nothing.
- **Uninstall, each source with its own ablation:**
- **registry-held source (install-local door).**
`marketplace-install-local-uninstall-withdrawal.test.ts`: the order is
capture → withdraw → cleanups, and the cleanups get the names; control:
a registry that cannot say hands nothing. End to end,
`package-install-local-uninstall-cleanups.integration.test.ts` (CLI,
four orders of events, rewritten to the catalog): grant by name → DELETE
→ the grant is gone → after a restart, another package's hot install,
and a **reinstall of the same package**, the grant is not live again
("the grant revoked by the DELETE does not come back with the set").
Ablation: the capture answering nothing turned the door pin red (1 of
8); the controls stayed green.
- **base-authored source (`deletePackage` door).**
`package-uninstall-revokes-named-grants.dogfood.test.ts` (CRM stack): a
writable base publishes a set, a user is granted it by name,
`deletePackage` → the grant is gone; the base publishes the set again →
it is served, and the grant does not come back. Ablation: dropping the
capture in `deletePackage` turned 2 of 3 red. Before the stored-row
source existed, this pin was red with the registry-only capture.
- `protocol.uninstall-declared-capture.test.ts`: the helper (both
sources, the union, nothing when nothing names a set), the runner's
hand-off, and `deletePackage`'s order.
`protocol.uninstall-cleanups-runner.test.ts`'s control (a request with
no capture is passed through unchanged) stays green.
- `registry-security-catalog-names-held-by.test.ts`: the names a package
holds, a disabled package included, none after uninstall.
- `cleanup-package-permissions.test.ts`: the named grants go, with a
no-names control in which they survive.
## Tests this branch rewrites (they pinned the rows it removes)
- `standalone-stack-seeder-declaration-copy.test.ts` (runtime): asserts
no row for a declared set, as it already did for a capability.
- `package-install-local-boot-steps.integration.test.ts` (CLI, #21322):
the hot-installed set is read from `GET /meta/permission/…`. The flow
cases still pin #21322's defect; the permission-set case now pins the
current contract (the catalog served the set before #21322 too).
## Also in this PR
- **Liveness ledger.** `permission.packageId` re-points to its surviving
reader (the CLI's compile-time collision door). `permission.managedBy`
is corrected to `dead` (see Acceptance notes).
- **Tenant-audit census** regenerated after merging `main`: `main` has
227 write sites, and this branch's removal of the normalizer's and the
platform-admin bootstrap's `update` sites takes it to **225**. The
hand-written figures on `tenant-audit-census.mdx` follow.
- **Docs**: `permission-sets.mdx` (built-in sets, provenance, the drift
section reduced to overlay shadow) and `authorization.mdx`.
- **Gate ledgers**: the double-contract ledgers drop the retired suites
and pin the new one.
## Changeset
One file, `.changeset/15204-s6b2-declared-permission-seeders.md`:
- `@objectstack/plugin-security` **minor**, BREAKING, `Clause-②: yes
(narrowing)`, ADR-0087 `not-required (no-migration-prescription)`. The
level is unchanged by the uninstall work: nothing an author writes
moves.
- `@objectstack/metadata-protocol` **minor** and `@objectstack/objectql`
**minor**, additive: the optional `declared` argument of the exported
`UninstallCleanup` type and of `runUninstallCleanups`' request, the
`UninstallDeclared` type, `captureUninstallDeclared`, and
`SchemaRegistry.securityCatalogNamesHeldBy`.
`@objectstack/cloud-connection` **patch** (its door hands the names on).
`cleanupPackagePermissions` takes an optional fourth argument.
- `check:changeset-no-major` and `check:adr-0087-registration` exit 0.
## Verification (local, at this head)
At `ecfb54f8b8`, `main` `df7a137923` merged in (`c60e08810`). The merge
had two conflicts: install-local's imports, where both sides' imports
were kept, and the declaration-copy test's persisted-row case, which
#22994 had rewritten and which keeps this branch's "no row" side.
- Build: `turbo run build`, every task green. Typecheck green for the 21
packages below and dogfood.
- Suites (`turbo run test`, 21 packages: plugin-security,
platform-objects, runtime, metadata-protocol, cli (unit and
integration), objectql, cloud-connection, plugin-auth, organizations,
plugin-approvals, plugin-sharing, mcp, rest, hono, client,
http-conformance, core, example-crm, example-showcase, example-todo,
example-multi-package): **82 of 82 tasks green**. plugin-auth: 136
files, 2,780 passed. cloud-connection: 43 files, 519 passed (from
source; see below).
- Dogfood, **in full**: 258 files passed, 1 skipped; 2,117 tests passed,
9 skipped (the `deletePackage` door pin, the grant-name pickers and
`main`'s walled-catalog suites included).
- The rewritten suites (before this merge, on a fresh full build): (a)
runtime 13/13; (b) cli boot-steps 7/7; (c) cli uninstall-cleanups 17/17.
All three are inside the suite run above.
- `check-i18n-bundles`: green after the full build.
- `dispatch-gates --commands`: 117 derived families, all run and
reconciled by `--ran`, 0 not measured.
- `check:test-source-alias` went red on this diff earlier
(cloud-connection's new runtime import of
`@objectstack/metadata-protocol`). It is now aliased to source and
green.
- `check-engine-split-ratio` needs history covering its 90-day window;
the clone was deepened to it, exit 0.
- The one non-zero: `check:platform-checklist`, the same 8 absent-symbol
anchors on T1 (which touches no checklist file). That check is the
scheduled watchdog's (`checklist-status.yml`), not a per-PR gate, and
`main`'s checklist cites none of T1's deleted files.
- `check:changeset-no-major` and `check:adr-0087-registration`: exit 0.
`check-tenant-audit-census`: OK, 225 sites.
After `ecfb54f8b8`, three text rounds from the contract reviews:
`5cc2ef8629`, `70a42bf2f5` and `320ce20b74`. They change docs prose,
code comments, the changeset's wording, two `sys_permission_set` field
descriptions (with the English translation bundle regenerated) and two
install-local warn strings; no code path. At `320ce20b74`:
- plugin-security: 191 files, 3,973 passed;
- cloud-connection: 44 files, 538 passed;
- the protocol capture pins: 10/10;
- `check-i18n-bundles`, the docs checks, `check:changeset-no-major` and
`check:adr-0087-registration`: all 0;
- `dispatch-gates`: 119/119 run, the only non-zero being the checklist
watchdog.
## Acceptance notes
- **Data-door reach on a package-door-published set** (a writable base,
package installed; measured on the CRM stack, this PR vs `main`):
- a data-door `PATCH` is 200 on both and lands in the base's own
`sys_metadata` row, with no environment overlay;
- a data-door `DELETE` deletes end to end here (the row, the
`sys_metadata` row and the catalog entry), while `main` half-applies it
(`success:false`; `sys_metadata` gone, the row and the served body
kept);
- a grant naming the deleted set stays and goes dead, and is live again
if the base republishes that name, as it would be on `main` after a
reload;
- under `single` the wall is inert, so the door is open to any caller
with CRUD on `sys_permission_set` (the platform operator in practice);
under `group` / `isolated` the wall refuses everyone but the operator
(ADR-0131 D3);
- the provenance key: the row's `managed_by:'package'` is what the
projector's delete leg, the data-layer gate's `transfer` / `restore` /
`purge` refusals and the uninstall cleanup's legacy row path key on, and
a publish no longer stamps it here. The packaged-set lock
(`packaged-permission-set-lock.ts`) keys on the artifact, not the row,
and answers the same on both trees (delta review 6130075012 ①8);
- carrier: 7a retires the projector and both write-throughs (#22975,
seat note 6129253247).
- **Stale text left to its carriers:**
`packages/spec/src/security/permission.zod.ts:845` (`managedBy`'s JSDoc,
"seeded by `bootstrapDeclaredPermissions`, re-seeded on upgrade"): the
spec seat, with the `managedBy` enforce-or-remove item.
`seed-name-lookup.ts:9` and
`packages/objectql/src/engine-capability-provenance.test.ts:164–165`
(comments): C7b.
- **`permission.managedBy` is an authored key with no reader**
(pre-existing; the ledger now says `dead`). Retiring it is an
enforce-or-remove item for the spec seat. It is not done here.
- **The name-fold census instrument**
(`scripts/measure-position-name-fold-census.mjs`, not a CI gate) refuses
to report since 6b-2a deleted the binders. Carrier: whoever next runs it
re-aims its junction scan at `PositionSchema.permissionSets`.
- **Two dogfood suites** (`two-doors-permission`,
`showcase-permission-projection`) keep their data-door cases on an
existing database (the fixture writes the legacy row), because the gate
still guards such rows until 7a / stage 8.
- **plugin-auth's two grant-reader suites** read the legacy
platform-bucket rows; their fixture is T2's item (d) (#22898,
`a38b54f6f`), carried here byte-identical (`8e40fb06b`) as this branch
carries T2's other bytes, so it cancels out of the measured size.
## 维护者速读（草稿）
**改了什么**：不再有任何播种器或物化器向 `sys_permission_set` 表写行，启动时也不再为声明的权限集播种行（在阶段 7
删除 ADR-0094 投影器之前，发布权限集时投影器仍会写一条 `admin`
投影行，鉴权不读它，卸载包时会被删掉）。删除了：包声明权限集的播种器、平台默认权限集的物化、包发布时的物化器、热安装后的重播种、新建组织时的播种，以及基于这些行的漂移诊断、`managed_by`
归一化和播种拒绝诊断。`drift_status`/`drift_detail`
两个字段及「需要关注」视图随写入者一并删除。卸载包时仍会撤销所有指向该包权限集的授权：两个卸载入口在把包从注册表撤下之前，先记下该包持有的权限集名称（注册表中的名称，加上
`deletePackage` 已读到的该包已存储的权限集行），交给清理步骤按名称撤销授权（方案 1 是你的裁定 6123311533；机制 B
是席位在方案 1 之下的选择）。
**为什么改**：ADR-0131 D3
规定权限集只有一个家——注册表。鉴权解析器早已从注册表读定义，授权按名称写入，这些行已不再决定任何权限。卸载按名称撤销，是为了守住
ADR-0090 D5「不留幽灵授权」：否则授权会在卸载后残留，并在重新安装后重新生效。
**风险与代价（含回滚）**：已有数据库保留旧行（直到 C7b），旧行路径的撤销照旧。删除了若干公开导出和
`bootstrapPlatformAdmin` 的 `resync` 选项，changeset
已逐项列出；新增的卸载交接字段是可选的，不读它的清理步骤行为不变。本 PR 单独计 3,601 行（超过 3,000），因此为 Tier
H。回滚：直接 revert，无数据迁移。
**席位意见**：
**你要做的**：T1、T2、本 PR 依次合并；本 PR 因体量为 Tier H，需要你批准。
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49
---------
Co-authored-by: Claude <noreply@anthropic.com>
1 parent dfb3ba2 commit c8a9783
52 files changed
Lines changed: 1001 additions & 2696 deletions
File tree
- .changeset
- content/docs/permissions
- docs
- audits
- design
- packages
- cli
- src/utils
- test
- cloud-connection
- src
- metadata-protocol/src
- objectql/src
- plugins/plugin-security/src
- objects
- translations
- qa/dogfood/test
- runtime/src
- spec/liveness
- state-counts
- scripts
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
152 | 152 | | |
153 | 153 | | |
154 | 154 | | |
155 | | - | |
156 | | - | |
157 | | - | |
158 | | - | |
159 | | - | |
160 | | - | |
161 | | - | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
162 | 160 | | |
163 | 161 | | |
164 | 162 | | |
| |||
226 | 224 | | |
227 | 225 | | |
228 | 226 | | |
229 | | - | |
230 | | - | |
231 | | - | |
232 | | - | |
233 | | - | |
234 | | - | |
| 227 | + | |
| 228 | + | |
| 229 | + | |
| 230 | + | |
| 231 | + | |
| 232 | + | |
| 233 | + | |
| 234 | + | |
| 235 | + | |
| 236 | + | |
| 237 | + | |
235 | 238 | | |
236 | 239 | | |
237 | 240 | | |
| |||
242 | 245 | | |
243 | 246 | | |
244 | 247 | | |
245 | | - | |
| 248 | + | |
| 249 | + | |
| 250 | + | |
246 | 251 | | |
247 | 252 | | |
248 | 253 | | |
| |||
267 | 272 | | |
268 | 273 | | |
269 | 274 | | |
270 | | - | |
271 | | - | |
| 275 | + | |
| 276 | + | |
272 | 277 | | |
273 | 278 | | |
274 | 279 | | |
275 | 280 | | |
276 | 281 | | |
277 | 282 | | |
278 | 283 | | |
279 | | - | |
| 284 | + | |
280 | 285 | | |
281 | 286 | | |
282 | 287 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
161 | 161 | | |
162 | 162 | | |
163 | 163 | | |
164 | | - | |
165 | | - | |
| 164 | + | |
| 165 | + | |
| 166 | + | |
166 | 167 | | |
167 | 168 | | |
168 | 169 | | |
| |||
337 | 338 | | |
338 | 339 | | |
339 | 340 | | |
340 | | - | |
341 | | - | |
342 | | - | |
| 341 | + | |
| 342 | + | |
| 343 | + | |
| 344 | + | |
343 | 345 | | |
344 | 346 | | |
345 | 347 | | |
| |||
430 | 432 | | |
431 | 433 | | |
432 | 434 | | |
433 | | - | |
434 | | - | |
435 | | - | |
436 | | - | |
| 435 | + | |
| 436 | + | |
| 437 | + | |
437 | 438 | | |
438 | 439 | | |
439 | 440 | | |
440 | | - | |
441 | | - | |
442 | | - | |
443 | | - | |
444 | | - | |
445 | | - | |
446 | | - | |
447 | | - | |
448 | | - | |
449 | | - | |
450 | | - | |
451 | | - | |
452 | | - | |
453 | | - | |
454 | | - | |
455 | | - | |
456 | | - | |
457 | | - | |
458 | | - | |
459 | | - | |
460 | | - | |
461 | | - | |
462 | | - | |
463 | | - | |
464 | | - | |
465 | | - | |
466 | | - | |
467 | | - | |
468 | | - | |
469 | | - | |
470 | | - | |
471 | | - | |
472 | | - | |
473 | | - | |
| 441 | + | |
| 442 | + | |
| 443 | + | |
| 444 | + | |
| 445 | + | |
| 446 | + | |
| 447 | + | |
| 448 | + | |
| 449 | + | |
474 | 450 | | |
475 | 451 | | |
476 | 452 | | |
| |||
0 commit comments