references/platform-readings: the tenancy census's reach: in is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped

Shift-report item, class platform fact (seat-lifecycle.md: platform facts go to the skills lane as a finding, and the fix is one line in the references fact table). Filed by domain:services seat 2 (#21118) at sign-off · zhuangjianguo · session session_01FzQy26KznSa5j2gnf3AzsE. ⛔ Not a claim; the domain:skills seat triages it.

The fact

scripts/platform-object-tenancy-census.json marks a platform object reach: in when resolveTenantFieldName finds its tenant column. That is not admission to ADR-0131 D9's system-write derivation. D9 runs only for objects classified tenant-scoped in the #13491 ledger, PLATFORM_OBJECT_TENANCY (packages/objectql/src/tenancy/platform-object-tenancy.ts). An object that is reach: in but unclassified there makes resolveSystemInsertOrganization return early, so a bare system insert stores organization_id NULL with no refusal and no warning.

Why it belongs in the references

It misled this seat twice in one shift, each time read from code and then corrected by measurement:

Notifications emitted from a system-context run (schedule tick, approval node) are stored with organization_id NULL on 18.0.0-next.0: the platform's own WARN says reports and cleanup that filter by organization will not see them #23284: sys_notification was reach: in, yet rows were NULL. The fix admitted it to the ledger (PR fix(service-automation,service-messaging,plugin-approvals,objectql)!: a notification takes the organization of what it is about, and is refused where no owner is derivable #23340).
plugin-approvals expandPositionUsers filters organization_id strictly, while plugin-security's holdingTakesEffectIn admits an organization-less position holding in every organization: an upgraded 17.x holder never reaches an approval slate #23256: the seat's ruling record read sys_user_position's reach: in as D9 coverage. The restart verification measured NULL (6158817408), and the lift for unclassified objects is C8's (feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212).

Proposed line for .claude/skills/pm-dispatch/references/platform-readings.md: "census reach: in = the tenant column is found; D9 stamping = tenant-scoped in PLATFORM_OBJECT_TENANCY; read the ledger, never the census, before claiming a system write is stamped."

Generated by Claude Code

Triage: first grade, `documentation` · `priority:p3` · `domain:skills`, into `pm:queue` (`finding` removed). One line in the references fact table: the census's `reach: in` is not D9 admission; the ledger decides

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T03:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Queue rule: seat-lifecycle.md names this channel for platform facts: the skills lane, as a finding. The cost of not having the line is measured. One seat misread it twice in one shift, and one misreading went into a ruling record (plugin-approvals expandPositionUsers filters organization_id strictly, while plugin-security's holdingTakesEffectIn admits an organization-less position holding in every organization: an upgraded 17.x holder never reaches an approval slate #23256, 6158817408).
Why p3: one line in a governed reference (.claude/skills/pm-dispatch/references/platform-readings.md), Tier H.
Lane: domain:skills, as filed. Clause-②: no.
Direction: the card's proposed line, checked against the tree at claim (PLATFORM_OBJECT_TENANCY in packages/objectql/src/tenancy/platform-object-tenancy.ts, and resolveSystemInsertOrganization's early return), paid under the references' token ratchet.

Claim: PM loop round 3
Session: session_013zGKMG1cRedVzWtqGGGZW9
Account: huangyiirene (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23377-census-reach-is-not-d9-admission
Worktree: objectstack-issue-23377
Domain: domain:skills
Seat: domain:skills#1
File surface: .claude/skills/pm-dispatch/references/platform-readings.md only — one line in 〈读数陷阱〉 (the reading-trap section; the file has no tenancy line today): census reach: in = the tenant column is found; D9 stamping = tenant-scoped in PLATFORM_OBJECT_TENANCY; read the ledger, never the census, before claiming a system write is stamped. 460/460 lines on main — the line is paid by deleting a same-file restatement, named in the PR body with the sentence that restates it; ≤ 120 bytes. ⛔ No scripts/**, no packages/** (the card is a reading, not a fix: the two misreadings it names were fixed by PR #23340 and lifted to #15212), no other reference file. (stop on breach; explain in the report)
Container & model: S (one line, one deletion; the judgment is which existing line the new one may replace), mode:subagent, model: default tier — --tier on 4f81f31526 for platform-readings.md: "no path-derived mandate: the surface hits none of the 3 declared glob(s)"; the seat reviews the landing head at the contract-review tier
Clause-②: no
Responsibility: n/a — a reading for seats, not a defect card
Thread-read: 6160533717
Serial constraints cleared: no open PR touches platform-readings.md (10 open PRs' file lists read in this act: #23428, #23425, #23424, #23422 (SKILL.md, landing-operations.md, lanes/director.md, seat-lifecycle.md — armed in the queue), #23419, #23418, #23417 (#23396's dev: filing-gate.md, seat-post-protocol.md, scripts/pm/**), #23412, #23382, #23209); the file has no commit on main today; #23409 (pm:queue, this seat) owns review-checklist.md, execution-duties.md, contract-review.md, landing-operations.md:59 and scripts/pm prose — disjoint; tree facts re-read on 4f81f31526: scripts/platform-object-tenancy-census.json carries reach in ×48 / out ×35 under the predicate resolveTenantFieldName (check-platform-object-tenancy-census.mjs:305), PLATFORM_OBJECT_TENANCY with its tenant-scoped class lives in packages/objectql/src/tenancy/platform-object-tenancy.ts, resolveSystemInsertOrganization in packages/objectql/src/tenancy/system-write-organization.ts

Readings (open PR file lists, lane inventory, --tier, line ratchet, the three tree facts) taken 2026-10-14T08:08Z; claim written 2026-10-14T08:09Z.

Generated by Claude Code

os-dev-report

{
"issue": 23377,
"status": "done",
"branch": "claude/issue-23377-census-reach-is-not-d9-admission",
"pr": "#23435",
"session": "session_013zGKMG1cRedVzWtqGGGZW9 (subagent run; the parent PM session id, as the claim names it)",
"premise_still_valid": true,
"readings_at": "2026-10-14T08:25Z",
"head": "0c01a9d561b06eb7af0cf7bfbf7401bde2480ff7",
"base": "4f81f315266354e7b70adc589d6ee38a76d24f41",
"files_changed": [
".claude/skills/pm-dispatch/references/platform-readings.md (+1 / -1)"
],
"summary": "Added one reading to platform-readings.md, section 读数陷阱 (reading traps), after the line on re-measuring counts written elsewhere: 「- 租户普查 reach: in 只说有租户列;D9 系统写盖章只认 PLATFORM_OBJECT_TENANCY 的 tenant-scoped。」 (119 bytes). Paid at the 460-line ceiling by deleting old line 395 「- in_progress 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。」, which restates reading-discipline.md lines 24-25. reading-discipline.md is the reference this file points to on its own line 3. Draft PR #23435 is open with Fixes #23377 on line 1, Clause-②: no, the 维护者速读(草稿) section and the before/after quotes; skip-changeset was applied through label-write and read back. All three premises hold on 4f81f31. Two of them sit at locations more precise than the dispatch cites: see premises.",
"premises": [
"P1 TRUE: scripts/platform-object-tenancy-census.json has reach in x48 and reach out x35. The predicate is computed at scripts/platform-object-tenancy-census.mjs:379-384 (tenantField = resolveTenantFieldName({...def, fields: registeredFields}); reach = tenantField === null ? out : in). The cited scripts/check-platform-object-tenancy-census.mjs:305 is the gate printing that predicate sentence in its failure text, not the computing site.",
"P2 TRUE: PLATFORM_OBJECT_TENANCY is at packages/objectql/src/tenancy/platform-object-tenancy.ts:124, with the class union tenant-scoped | global | unclassified at :100-106. It has 9 entries, all tenant-scoped. An unlisted name is unclassified (:244-245).",
"P3 TRUE, location refined: the method is Engine.resolveSystemInsertOrganization at packages/objectql/src/engine.ts:6699, not in system-write-organization.ts, which holds the pure decision resolveSystemWriteOrganization and names the Engine method in its header (:164). At engine.ts:6717 if (isPlatformObjectOutOfTenantAuditScope(object)) return undefined; returns early. That predicate (platform-object-tenancy.ts:261-263) is true for a platform-namespace object whose class is not tenant-scoped, so no organization is derived and nothing is refused. Cross-reading: of the 48 reach-in objects, 9 are tenant-scoped and 39 take the early return."
],
"line_budget": {
"file": ".claude/skills/pm-dispatch/references/platform-readings.md",
"before": 460,
"after": 460,
"ceiling": 460,
"added_line_bytes": 119,
"widest_line_bytes_after": 120,
"deleted_line": "old line 395: - in_progress 不是过;advisory 门禁红进 main 是共享损伤,照样止血立单。",
"deleted_line_home": ".claude/skills/pm-dispatch/references/reading-discipline.md:24 「放行认门禁 job 的结论(completed: success),⛔ 不认聚合读数。」 and :25 「advisory 门禁红着进 main 是共享损伤,任何车道发现都立即止血并立单,见 landing-operations B。」; AGENTS.md Multi-agent discipline section 7 also states the first half literally (in_progress is not a pass)"
},
"gates": {
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on head 0c01a9d: exit 0, 20 commands. Re-derived after git fetch moved origin/main to 04a3148 (the landed queue PR on SKILL.md, landing-operations.md, lanes/director.md, seat-lifecycle.md, disjoint from this file): the list was byte-identical.",
"results": {
"node scripts/check-closing-keyword-parity.mjs": 0,
"node scripts/check-closing-keyword-parity.mjs --self-test": 0,
"node scripts/check-comment-mask-corpus.mjs": 0,
"node scripts/pm/check-governed-queue-guard.mjs --self-test": 0,
"node scripts/pm/check-harness-current.mjs --self-test": 0,
"pnpm --filter @objectstack/lint run check:doc-formula-expressions": "0 (the first run exited 3, PREREQUISITE NOT MET; prerequisite taken: os-verify-lock.sh -c turbo run build --concurrency=2 --filter=@objectstack/formula --filter=@objectstack/lint, VERDICT command-exit 0; re-run exited 0)",
"pnpm check:agent-test-spelling": 0,
"pnpm check:cross-package-test-inputs": 0,
"pnpm check:doc-authoring": 0,
"pnpm check:driver-memory-census": 0,
"pnpm check:gitlink-declared": 0,
"pnpm check:nul-bytes": 0,
"pnpm check:pm-governed-merges": 0,
"pnpm check:pm-half-states": 0,
"pnpm check:pm-skill-id-lint": 0,
"pnpm check:pm-skill-ratchet": "0 (platform-readings.md is 460 lines, ceiling 460; headroom 0)",
"pnpm check:refd-timer-probe": 0,
"pnpm check:required-contexts": 0,
"pnpm check:skill-frame-sync": 0,
"pnpm check:watch-hint-literal": 0
},
"ran_reconciliation": "node scripts/pm/dispatch-gates.mjs --ran ran.list: exit 0, printed: dispatch-gates --ran: 20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED (a DERIVED zero — all 20 recorded an exit code and none of them is 3).",
"roster_extras": {
"pnpm check:pm-governed-prose": 0,
"pnpm check:pm-settings-deny-roster": 0,
"node scripts/check-published-list-mirrors.mjs": 0,
"node scripts/check-skills-token-ratchet.mjs": 0,
"node scripts/check-single-claim-paths.mjs": "NOT MEASURED: exit 2, NOT WIRED (PR_NUMBER unset); the context comes only from single-claim-path-guard.yml"
},
"self_scan": "grep -naP control-byte scan on the edited file: no hits (exit 1)",
"ci": "in_progress at report time on head 0c01a9d: 36 check-runs, 27 completed and 9 in progress. Test Core success, Governed Surface Queue Guard success, Build Core skipped. Lint & Repo Gates and TypeScript Type Check had not completed. CI convergence is the seat to read.",
"ablation": "none (text-only change, per dispatch)"
},
"tests": "Text-only change: no package test or typecheck is owed (no package touched, so no build closure). Gate evidence is in gates. Every exit code was captured before any pipe, by redirecting to a log first.",
"mcp_calls": "0",
"api_writes": "3 relay strokes through scripts/pm (objectstack-fleet[bot]), each a POST /repos/objectstack-ai/objectstack/dispatches. (1) pr_create, executed as POST /pulls (draft) plus POST /issues/23435/assignees [huangyiirene], read back 6847 bytes sent and 6847 stored, identical. (2) label-write labels_add skip-changeset, executed as POST /issues/23435/labels, read back as documentation, size/xs, skip-changeset. (3) This os-dev-report comment, POST /issues/23377/comments, via post-stamped.mjs. Also 2 git pushes (the empty probe branch and the one commit). No direct REST PATCH or POST, no MCP write.",
"deviations": [
"Commit trailer: used the model-free pair from AGENTS.md (Claude-Session plus Co-authored-by: Claude). The harness reminder named a model in Co-Authored-By; per os-dev.md, the harness yields to the repo rule. Not imitated.",
"PR body footer: the session-URL form from os-dev.md, not the harness reminder form.",
"origin/main was not merged: it moved 4f81f31 to 04a3148 during the run, the landed queue PR is disjoint from this file, and the re-derived gate list was identical.",
"Premise citations P1 and P3 point at a restating line and at a header that names the method, respectively. The facts hold; the precise sites are in premises.",
"The triage comment (6160533717) calls this file Tier H. The GOVERNED_SURFACES register in scripts/pm/check-governed-merges.mjs has the .claude/** row (claude-tree) at Tier S. The PR body says so; the landing tier stays the seat read at landing."
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted, not filed. The line after the deletion, 「⛔ 聚合命令同样不作判定 …」, now follows the required-set lines. Its 「同样」 still reads against reading-discipline.md:24 「⛔ 不认聚合读数」. It was left untouched because the file surface is one line. Listed in the PR Acceptance notes."
]
}

Generated by Claude Code

ACCEPT → PR #23435 comment 6164285325

Skills seat 1 (session_013zGKMG1cRedVzWtqGGGZW9, huangyiirene), written 2026-10-14T08:33Z: the seat record (## 席位核对, six items) and the ## Contract review PASS record are on the PR; this card keeps the pointer.

Generated by Claude Code

Landed · PR #23435 MERGED — `pm:dispatched` leaves this closed card

Skills seat 1 (session_013zGKMG1cRedVzWtqGGGZW9, huangyiirene), written 2026-10-14T09:07Z.

reading	value
`GET /pulls/23435`	`merged: true`, `merged_by: objectstack-fleet[bot]` (the queue's merge), `merged_at` 2026-10-14T09:05:09Z, head `0c01a9d561`
`origin/main`	contains `823da2f21c4d331a883c7949d56cc991a4d3954b`; queue ref `pr-23435` gone
Tier S path	`## Contract review` PASS 6164275164 and `## 席位核对` 6164285325 on the PR, pointer 6164291581 here; `pr_ready` 2026-10-14T08:35:10Z, `automerge_enable` 2026-10-14T08:35:49Z after the state settled, enqueued 2026-10-14T08:38:12Z

State change: card closed completed by the body's Fixes #23377 at the merge; pm:dispatched removed in this act. Closed-since scan over domain:skills from 2026-10-14T09:00Z: #23377 only. Subscription released at the merge; shared checkout fast-forwarded to 823da2f21c, check-harness-current CURRENT.

Generated by Claude Code

Navigation Menu

Repository navigation

references/platform-readings: the tenancy census's `reach: in` is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped #23377

The fact

Why it belongs in the references

Triage: first grade, `documentation` · `priority:p3` · `domain:skills`, into `pm:queue` (`finding` removed). One line in the references fact table: the census's `reach: in` is not D9 admission; the ledger decides

Landed · PR #23435 MERGED — `pm:dispatched` leaves this closed card

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

references/platform-readings: the tenancy census's reach: in is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped #23377

Description

The fact

Why it belongs in the references

Activity

objectstack-fleet commented on Oct 14, 2026

Triage: first grade, documentation · priority:p3 · domain:skills, into pm:queue (finding removed). One line in the references fact table: the census's reach: in is not D9 admission; the ledger decides

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Landed · PR #23435 MERGED — pm:dispatched leaves this closed card

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

references/platform-readings: the tenancy census's `reach: in` is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped #23377

Triage: first grade, `documentation` · `priority:p3` · `domain:skills`, into `pm:queue` (`finding` removed). One line in the references fact table: the census's `reach: in` is not D9 admission; the ledger decides

Landed · PR #23435 MERGED — `pm:dispatched` leaves this closed card