Found while implementing #5876 (PR #5934). Out of scope there — that PR's file surface was deliberately limited to the seeder, its two test files and a changeset, and an ADR text change is a governed edit that deserves its own review (Prime Directive #13). Filed for triage.
What
docs/adr/0094-sys-permission-set-pure-projection.md, the per-type decisions table in the 2026-07-14 addendum, sys_capability row:
Resolved (#2909 T3): seed-not-clobber holds — label/description are platform-owned and refresh each boot; managed_by/active were already preserved; scope is an admin-editable classification face and is now seed-once (insert only).
After #5876 that sentence describes only half of what bootstrapSystemCapabilities does:
Why it is worth a line and not a shrug
The row's headline claim — "seed-not-clobber holds" — was in fact false for derived names before #5876 (that is the defect #5876 fixed), and the addendum's own general invariant one screen above states the rule correctly and unambiguously:
the seeder must not clobber an environment-edited record
So this is not a decision reversal — the code now matches the ADR's stated invariant more closely than before. What is left is a parenthetical in the summary table that reads, on its own, as licence to refresh display fields on any row. That is exactly the shape Prime Directive #13 warns about: the next author reads the table row, not the invariant, and "fixes" the guard back out.
Suggested amendment (one row, no decision content)
Split the display-field clause by half, e.g.:
label/description refresh each boot for the curated platform definitions (platform-authored copy); the back-compat derived placeholders (humanize(name)) reconcile only rows the derivation itself owns (managed_by:'platform') and never an admin/package-authored row (#5876). managed_by/active preserved; scope seed-once (insert only).
Class
Observation — documentation precision on an accepted ADR. Nothing a user hits today; the runtime behaviour is already correct and pinned (bootstrap-system-capabilities.test.ts, derived defaults never clobber an authored row (#5876)). No pm:queue requested.
Not blocked by anything; #5934 can merge independently.
Found while implementing #5876 (PR #5934). Out of scope there — that PR's file surface was deliberately limited to the seeder, its two test files and a changeset, and an ADR text change is a governed edit that deserves its own review (Prime Directive #13). Filed for triage.
What
docs/adr/0094-sys-permission-set-pure-projection.md, the per-type decisions table in the 2026-07-14 addendum,sys_capabilityrow:After #5876 that sentence describes only half of what
bootstrapSystemCapabilitiesdoes:PLATFORM_CAPABILITIES) — unchanged:label/descriptiongenuinely are platform-authored, and a new platform version legitimately ships new copy, so the row is refreshed each boot;systemPermissions[]that nothing declared) —labelishumanize(name)anddescriptionis a generatedCapabilitysentence. Nothing about them is "platform-owned" copy, and as of The back-compat capability derivation refreshes label/description on ANY existing sys_capability row, including admin-authored ones — the comment above it says the opposite #5876 the derived half refreshes them only on rows it owns (managed_by:'platform'), never onadmin/package-authored rows.Why it is worth a line and not a shrug
The row's headline claim — "seed-not-clobber holds" — was in fact false for derived names before #5876 (that is the defect #5876 fixed), and the addendum's own general invariant one screen above states the rule correctly and unambiguously:
So this is not a decision reversal — the code now matches the ADR's stated invariant more closely than before. What is left is a parenthetical in the summary table that reads, on its own, as licence to refresh display fields on any row. That is exactly the shape Prime Directive #13 warns about: the next author reads the table row, not the invariant, and "fixes" the guard back out.
Suggested amendment (one row, no decision content)
Split the display-field clause by half, e.g.:
Class
Observation — documentation precision on an accepted ADR. Nothing a user hits today; the runtime behaviour is already correct and pinned (
bootstrap-system-capabilities.test.ts,derived defaults never clobber an authored row (#5876)). Nopm:queuerequested.Not blocked by anything; #5934 can merge independently.