docs(changeset): five pending notes state what the next 18.0.0 prerelease ships, amended in place (Hono currentRecord; organization_id drop gate) by objectstack-fleet[bot] · Pull Request #23707 · objectstack-ai/objectstack

objectstack-fleet · 2026-10-15T17:30:04Z

Fixes #23703
Clause-②: no

Release text only. This PR amends eight pending changesets in place, so each says what the next 18.0.0 prerelease actually ships. Later PRs in the same release made some of their sentences false:

Rows 1 and 2. Two notes said a Hono door's 409 CONCURRENT_UPDATE holds currentRecord back. Since PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667 (5bb9a83bd0), both Hono doors forward it: the caller's own read of the row.
Row 3. The v18 boot-refusal note said os migrate apply --allow-destructive refuses the organization_id drop only on the ceremony's inventory tables. Since PR fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699 (6074eafb63, merged: true), it holds back every such drop.
Patch round 1, same family. The seat's review folded two more notes into this PR:
- @objectstack/hono's "Known gap" paragraph. PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentVersion (#23531) #23582 and PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667 close that gap.
- The sys_metadata family note's trail-door admission. PR fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail #23674 narrows it.
Patch round 2. 23587-hono-structured-arm-fields.md, already amended here (row 4), is now left fully true.
- Its DELETE_RESTRICTED FROM and its "unchanged" sentence get the per-door treatment of rows 13-15.
- Its duplicate-insert example now states what PR fix(plugin-hono-server): a Hono door answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (#23587) #23682 ships (rows 19-21).
The later notes that pointed at these are amended only where the amendment makes them false.

No new changeset, no erratum sentence, and no code, test, docs page or CHANGELOG.md.

A correction to round 1, made in this round. Round 1 said the later #23531 note's new FROM was "the body 18.0.0-next.1 answered: code and message only". That holds for a route mounted on HonoHttpServer only. In 18.0.0-next.1, createHonoApp answered a stale If-Match with 500 INTERNAL_ERROR. The evidence:

At 0c52e43075, packages/adapters/hono/src/index.ts:793-794 answers a throw with errorJson(c, err.message …, err.statusCode || 500).
ConcurrentUpdateError declares status = 409 and no statusCode (packages/metadata-protocol/src/protocol.ts at 0c52e43075, the class at :2867-2869).
@objectstack/hono's own entry for hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 states it in its FROM (23365-hono-declared-envelope.md:14-17).

Both #23531 notes now name each door's last-published answer (rows 3, 5-7 and 13-15 below).

Has any of this shipped? (measured, per file)

Changeset	Added on `main`	Shipped in a published `18.0.0-next.N`?
`23531-hono-conflict-body.md`	`19c554ddc1`, 2026-10-15 02:52Z	No
`23587-hono-structured-arm-fields.md`	`f7cd580bff`, 2026-10-15 07:22Z	No
`23531-hono-conflict-current-record.md`	`5bb9a83bd0`, 2026-10-15 11:55Z	No
`23429-v18-boot-refusal.md`	`dd29bbe60d`, 2026-10-15 06:17Z	No
`23684-drop-gate-host-tables.md`	`6074eafb63`, 2026-10-15 16:55Z	No
`23365-hono-declared-envelope.md`	`e1cefa58e3`, 2026-10-14 19:11Z	No
`23429-sys-metadata-family-organization-column-retired.md`	`dd29bbe60d`, 2026-10-15 06:17Z	No
`23546-trail-doors-setup-access.md`	`c2635881e0`, 2026-10-15 14:27Z	No

Readings:

.changeset/pre.json is {"mode":"pre","tag":"next"} and has no changesets key, so it records no consumed changeset.
The newest version cut is 0c52e43075 (chore: version packages (next), 2026-10-14 10:19Z, 18.0.0-next.1).
- git merge-base --is-ancestor 0c52e43075 ADDED_AT exits 0 for every row above.
None of the eight files is in .changeset/pre/, the archive of the 582 notes earlier cuts consumed.
- The control git merge-base --is-ancestor a87d8be299 0c52e43075 also exits 0.
npm dist-tags.next is 18.0.0-next.1.
The published 18.0.0-next.1 tarballs were checked against origin/main. For @objectstack/plugin-hono-server, @objectstack/hono, @objectstack/cli, @objectstack/rest and @objectstack/runtime, the tarball's CHANGELOG.md is byte-identical (cmp) to the one on origin/main.
- Hono: currentRecord counts 0, currentVersion 0 and Known gap 0.
- CLI: the drop-gate refusal terms count 0.
- REST and runtime: the trail-door terms count 0.
- Positive control: ## 18.0.0-next.1 counts 1 in each.
At 0c52e43075, apply.ts has 0 organization references, and the drop-gate file is absent.
The trail doors at 0c52e43075:
- history, audit and diff admitted studio.access, setup.access or manage_metadata (rest-server.ts:1824-1829, through mayReadPendingDrafts);
- commits admitted studio.access or setup.access (packages.ts:1887, requireReadCapability);
- sys-metadata-audit.object.ts carried no requiredPermissions.

So every pair compiles into one release. Following the ruling, each pair now tells one story: the earlier note states the final behaviour, and no FROM / TO describes a state that no release shipped.

How each pair was made one story

The two #23531 notes.

The earlier note (23531-hono-conflict-body.md) states the final body.
- Its TO carries currentRecord beside currentVersion, and :15 states what currentRecord is.
- Its FROM (:8, :10) and its "unchanged" sentence (:13) name each door's 18.0.0-next.1 answer: a HonoHttpServer route answered 409 with code and message, and createHonoApp answered 500 INTERNAL_ERROR.
- Its :17 no longer points at the #23365 "Known gap", which is gone.
The later note (23531-hono-conflict-current-record.md) carries the same per-door FROM and the same TO.
- Its "This supersedes the earlier note …" sentence is deleted.
23587-hono-structured-arm-fields.md (patch round 2).
- :14 loses its hold-back sentence.
- :7 and :9 name each door's 18.0.0-next.1 answer to DELETE_RESTRICTED: a HonoHttpServer route answered 409 with code and message, and createHonoApp answered 500 INTERNAL_ERROR.
- :12's "unchanged" clause is per door.
- :12's duplicate-insert example now says these doors answer the engine's DUPLICATE_RECORD as 409 UNIQUE_VIOLATION, so the classification agrees and its fields ride details. That matches 23587-hono-unique-violation.md (:5, :14), which is not edited.

@objectstack/hono's #23365 note (23365-hono-declared-envelope.md:51-56). The "Known gap" paragraph is replaced by what ships: the 409 carries currentVersion and currentRecord in error.details. Its FROM (:14-17, 500 on createHonoApp) was already the 18.0.0-next.1 behaviour and is unchanged.

The organization_id drop-gate pair.

23429-v18-boot-refusal.md says any table (:20, :27).
23684-drop-gate-host-tables.md's FROM names the 18.0.0-next.1 behaviour (no drop held back), and its TO loses "As before,".
Kept as true: its title ("… not only the platform inventory's"), "with the existing refusal" (the refusal the boot-refusal note introduces in this same release), and its measurement sentence.

The trail-door pair.

23429-sys-metadata-family-organization-column-retired.md:49 states the merged admission:
- history, audit and diff admit studio.access or manage_metadata;
- commits admits studio.access alone;
- setup.access alone is refused at all four.
Its "only manage_metadata" clause now covers the history and audit rows, not the commit rows.
23546-trail-doors-setup-access.md's FROM / TO bullets (:18-23) are the 18.0.0-next.1 → final pair as written: "was 200" for a setup.access caller is what 0c52e43075 answered.
Its :14 said the data door "already refused them". The data door's requiredPermissions gate ships in this same release (dd29bbe60d), so :14 now says it "refuses them".

Before / after: every amended sentence

Before is the text on origin/main; after is the text at this head. Code was read on origin/main 6074eafb63, except [H] and [I], which were read at 0c52e43075 (18.0.0-next.1):

[A] plugin-hono-server/src/adapter.ts:367: declaredEnvelopeForThrow merges declaredArmContext(...) into details.
[B] adapter.ts:462-475: every arm key but error and code is forwarded; nothing is held back by name.
[C] types/src/data-error-classification.ts:1046-1053: the CONCURRENT_UPDATE arm carries currentVersion and currentRecord.
[D] metadata-protocol/src/protocol.ts:15027-15031: a version mismatch re-reads the row with readAsCaller, and throws ConcurrentUpdateError with currentRecord: visible.
[E] adapters/hono/src/index.ts:554: createHonoApp renders through declaredEnvelopeForThrow.
[F] cli/src/utils/organization-ownership-drop-gate.ts:47-55: every intended drop_column organization_id, no table filter.
[G] cli/src/commands/migrate/apply.ts:494-523: the refusal, before flushSchemaDdl (:558).
[H] At 0c52e43075:
- apply.ts has no organization reference, and there is no drop-gate file;
- adapters/hono/src/index.ts:793-794 answers err.statusCode || 500;
- ConcurrentUpdateError declares status only;
- spec/src/api/errors.zod.ts:192 maps 500 to INTERNAL_ERROR;
- the direct-mount route's declaredEnvelopeForThrow (plugin-hono-server/src/adapter.ts:284) had no arm context.
[I] The trail doors at 0c52e43075, as listed in the readings above.
[J] rest/src/rest-server.ts:1868: AUTHORING_TRAIL_READ_CAPABILITIES = ['studio.access', 'manage_metadata'].
- :1886-1892: mayReadAuthoringTrail admits isSystem or one of those.
- It is asked by refuseNonAuthoringCaller (:1920-1921) at history :7629, audit :7766 and diff :8239.
[K] runtime/src/domains/packages.ts:381-395: requireCommitTrailReadCapability admits isSystem or studio.access only. It is asked at GET /packages/:id/commits (:1972).
[L] metadata-core/src/objects/sys-metadata-audit.object.ts:238: requiredPermissions: ['studio.access'], added by dd29bbe60d.
[M] The DELETE_RESTRICTED producer:
- at 0c52e43075, objectql/src/engine.ts:18664-18666 sets code, status = 409 and httpStatus = 409. The file has no statusCode at all, so next.1 createHonoApp ([H], index.ts:793-794) answered 500;
- spec/src/api/errors.zod.ts:97 registers DELETE_RESTRICTED, so the next.1 direct-mount declaredEnvelopeForThrow (adapter.ts:284) answered 409;
- on this base the same lines are engine.ts:18728-18730.
[N] plugin-hono-server/src/adapter.ts:362: const code = isEngineDuplicateRecordEnvelope(thrown) ? 'UNIQUE_VIOLATION' : resolved.code;, decided before the arm is asked.
- The docblock :289-308 ("One wire spelling") explains the ordering.
- The arm must then agree on status and code (:466-468), which it does for UNIQUE_VIOLATION.

#	File:line	Before	After	Read from
1	`23531-hono-conflict-body.md:15` (row 1)	`currentRecord` is held on these two doors until #23586 settles how the protocol reads that row, and the REST server's answer is unchanged.	`currentRecord` rides beside it, as on the REST server: the row as the caller reads it, which the protocol re-reads under the caller's own context on a version mismatch (#23586).	[A] [B] [C] [D] [E]
2	`23531-hono-conflict-body.md:11` (TO)	TO `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…","details":{"currentVersion":"…"}}}`	TO `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…","details":{"currentVersion":"…","currentRecord":{…}}}}`	[A] [B] [C]
3	`23531-hono-conflict-body.md:17` (revised this round)	The `@objectstack/hono` entry for #23365 names this as a known gap. This change closes the gap's `currentVersion` half. Nothing changes in …	Nothing changes in …	the `#23365` "Known gap" paragraph no longer exists (row 16)
4	`23587-hono-structured-arm-fields.md:14` (row 2)	Two fields stay off these doors. `object` on … these doors answer without a route. `CONCURRENT_UPDATE`'s `currentRecord` stays held until #23586 settles how the protocol reads that row. The REST server's answer is unchanged.	One field stays off these doors: `object` on … these doors answer without a route. The REST server's answer is unchanged.	[B]; `adapter.ts:466` asks the arm with no route object
5	`23531-hono-conflict-current-record.md:8` (revised this round)	… carried the server's `currentVersion` in `error.details`, and held `currentRecord` back while the protocol read that row with a system context. … and these doors forward it.	… carried neither field: the route answered it with `code` and `message` only, and `createHonoApp` answered it `500 INTERNAL_ERROR`, which the `@objectstack/hono` entry for #23365 makes a `409`. … and these doors forward it beside the server's `currentVersion`.	[D] [A] [C] [H]
6	`23531-hono-conflict-current-record.md:10` (FROM, revised this round)	FROM `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…","details":{"currentVersion":"…"}}}`	FROM `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…"}}` on a `HonoHttpServer` route, and `500` `{"success":false,"error":{"code":"INTERNAL_ERROR","message":"…"}}` on `createHonoApp`	[H]
7	`23531-hono-conflict-current-record.md:13` (revised this round)	… Status, `code`, `message` and `currentVersion` are unchanged, and no other answer changes.	… On a `HonoHttpServer` route, status, `code` and `message` are unchanged; on `createHonoApp` they are the `409` the `@objectstack/hono` entry for #23365 states. No other answer changes.	[H]
8	`23531-hono-conflict-current-record.md:15`	This supersedes the earlier note that `currentRecord` stays held on these two doors. Nothing changes in …	Nothing changes in …	rows 1, 4
9	`23429-v18-boot-refusal.md:20` (row 3)	… refuses to drop `organization_id` from any table in the ceremony's inventory (the D7 tables and the `sys_metadata` family) while …	… refuses to drop `organization_id` from any table (the D7 tables and the `sys_metadata` family among them) while …	[F] [G]
10	`23429-v18-boot-refusal.md:27` (row 3)	… that would drop an inventory table's `organization_id` is refused, as above.	… that would drop an `organization_id` column is refused, as above.	[F] [G]
11	`23684-drop-gate-host-tables.md:15` (FROM)	FROM. The gate held back only the tables of the platform inventory. Every other `organization_id` drop the schema-drift report offered was applied by `os migrate apply --allow-destructive` with no ceremony marker on the database: on the objects …, and on any host or application object …	FROM. `os migrate apply --allow-destructive` held back no `organization_id` drop. Every one the schema-drift report offered was applied with no ceremony marker on the database, among them those on the objects … and on any host or application object …	[H]
12	`23684-drop-gate-host-tables.md:17`	… As before, the refusal holds the whole `--allow-destructive` run …	… The refusal holds the whole `--allow-destructive` run …	[G]
13	`23531-hono-conflict-body.md:8` (new)	… The two Hono doors answered the same refusal with `code` and `message` only. They are `@objectstack/hono`'s `createHonoApp` and a route mounted on `@objectstack/plugin-hono-server`'s `HonoHttpServer`.	… The two Hono doors answered the same refusal without it. They are `@objectstack/hono`'s `createHonoApp`, which answered it `500 INTERNAL_ERROR` (the `@objectstack/hono` entry for #23365 makes it a `409`), and a route mounted on `@objectstack/plugin-hono-server`'s `HonoHttpServer`, which answered it with `code` and `message` only.	[H]; `23365-hono-declared-envelope.md:14-17`
14	`23531-hono-conflict-body.md:10` (FROM, new)	FROM `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…"}}`	FROM `{"success":false,"error":{"code":"CONCURRENT_UPDATE","message":"…"}}` on a `HonoHttpServer` route, and `500` `{"success":false,"error":{"code":"INTERNAL_ERROR","message":"…"}}` on `createHonoApp`	[H]
15	`23531-hono-conflict-body.md:13` (new)	… Status, `code` and `message` are unchanged, and no other answer changes.	… On a `HonoHttpServer` route, status, `code` and `message` are unchanged; on `createHonoApp` they are the `409` the `@objectstack/hono` entry for #23365 states. No other answer changes.	[H]
16	`23365-hono-declared-envelope.md:51-56` → `:51-53` (new)	⚠️ Known gap, stated rather than left silent. The `409 CONCURRENT_UPDATE` this host now answers carries `code` and `message`, but not the `currentVersion` and `currentRecord` that the standalone REST server's `409` carries. The recogniser forwards only the `details` a producer declares, and those two fields are own properties of the error. That gap is outside this change.	The `409 CONCURRENT_UPDATE` this host now answers carries `currentVersion` and `currentRecord` in `error.details`, the two fields the standalone REST server's `409` carries; `currentRecord` is the row as the caller reads it.	[A] [B] [C] [D] [E]
17	`23429-sys-metadata-family-organization-column-retired.md:49` (new)	… `/meta/:type/:name/history` and `/audit` admit `studio.access`, `setup.access` or `manage_metadata`; `/packages/:id/commits` admits `studio.access` or `setup.access`. … A caller holding only `setup.access` or only `manage_metadata` therefore still reads these rows through `/meta`, but not through the data door.	… `/meta/:type/:name/history`, `/audit` and `/diff` admit `studio.access` or `manage_metadata`, and `/packages/:id/commits` admits `studio.access` alone; `setup.access` alone is refused at all four. … A caller holding only `manage_metadata` therefore still reads the history and audit rows through `/meta`, but not the commit rows, and none of them through the data door.	[J] [K] [L]
18	`23546-trail-doors-setup-access.md:14` (new)	… The data door on the same three tables (…) already refused them (`requiredPermissions: ['studio.access']`, ADR-0131 D7). The doors now follow the same rule. …	… The data door on the same three tables (…) refuses them (`requiredPermissions: ['studio.access']`, ADR-0131 D7), and the doors now follow the same rule. …	[L]; [I]: `0c52e43075` carried no such gate
19	`23587-hono-structured-arm-fields.md:7` (round 2)	… The two Hono doors answered the same refusal with `code` and `message` only. They are `@objectstack/hono`'s `createHonoApp` and a route mounted on `@objectstack/plugin-hono-server`'s `HonoHttpServer`.	… The two Hono doors answered the same refusal without them. They are `@objectstack/hono`'s `createHonoApp`, which answered it `500 INTERNAL_ERROR` (the `@objectstack/hono` entry for #23365 makes it a `409`), and a route mounted on `@objectstack/plugin-hono-server`'s `HonoHttpServer`, which answered it with `code` and `message` only.	[M] [H]; `23365-hono-declared-envelope.md:14-17`
20	`23587-hono-structured-arm-fields.md:9` (FROM, round 2)	FROM `{"success":false,"error":{"code":"DELETE_RESTRICTED","message":"…"}}`	FROM `{"success":false,"error":{"code":"DELETE_RESTRICTED","message":"…"}}` on a `HonoHttpServer` route, and `500` `{"success":false,"error":{"code":"INTERNAL_ERROR","message":"…"}}` on `createHonoApp`	[M] [H]
21	`23587-hono-structured-arm-fields.md:12` (round 2)	… Status, `code` and `message` are unchanged, and a refusal whose classification answers a different status or code (a duplicate insert's `DUPLICATE_RECORD`, which the REST server answers as `UNIQUE_VIOLATION`) gains nothing.	… On a `HonoHttpServer` route, status, `code` and `message` are unchanged; on `createHonoApp` they are the declared envelope the `@objectstack/hono` entry for #23365 states. A refusal whose classification answers a different status or code gains nothing. The engine's duplicate insert is the one envelope these doors translate first: its `DUPLICATE_RECORD` is answered `409 UNIQUE_VIOLATION`, the REST server's code, so the classification agrees and its fields ride `details`, as this package's `UNIQUE_VIOLATION` entry states.	[N] [M] [H]; consistent with `23587-hono-unique-violation.md:5`, `:14`

The bounded sweep (the seat's four behaviours, every pending `.changeset/*.md`)

The sweep covered 113 pending files: the 111 top-level .md under .changeset/ on this branch (excluding README.md; the consumed archive .changeset/pre/ is not pending), plus 2 more on main. pre.json lists none of them.

105 were added after 0c52e43075.
The 2 on main, 23630-promote-doors-d99.md and 23686-dispatcher-unique-violation.md, landed after this branch's base and were read from origin/main 395ca21cc7. 23630 hits ?package= at :19 and :22; both describe the server's publish door in its own note and are true. 23686 hits nothing.
6 were added on 2026-10-14 before the cut and were never consumed (23268-external-sharing-model-retired, 23268-skills-lint-rules-row, 23357-page-component-view-data-api-refused, 23387-two-master-names-release, 23397-ceremony-builtin-positions, 23399-ceremony-not-declared-column-drop). They were grepped too and hit nothing.

currentRecord / currentVersion.

Amended: rows 1-3, 5-8 and 13-16.
Judged still true:
- 23531-hono-conflict-body.md:6 and 23531-hono-conflict-current-record.md:6 (the titles), and both notes' :11 (TO).
- 23406-sealed-first-draft-remedy.md:15 and 23577-sealed-write-one-sentence.md:21: the /meta conflict and spec schemas, not a Hono door.
- 23586-occ-conflict-caller-visibility.md:9, :13, :14: the protocol. Its :16 says the Hono hosts get the narrowed answer, which they do ([B] [D]).
23587-hono-structured-arm-fields.md:12: its currentVersion clauses are true ([B] [C]). Its other two clauses were amended in patch round 2 (row 21).

setup.access at the trail doors.

Amended: rows 17 and 18.
Judged still true: 23546-trail-doors-setup-access.md:6, :18-22 (each "was 200" matches [I]; "now 403" matches [J] [K]), :27-29 (who is still admitted: [J] [K]), :33 (draft switches), :34 (package reads, requireReadCapability) and :37. Its :10 is the ADR-0087 disposition marker and is unchanged.

"inventory" at the drop gate.

Amended: rows 9-12.
Judged still true:
- 23684-drop-gate-host-tables.md:5 (title), :9 (disposition: "a table outside the platform inventory is refused", which is still a subset of every table) and :17 ("read without a copy of its inventory").
- 15211-cli-apply-reviewed-plan.md:16: the ceremony plan's inventory digest, not the drop gate.

publishItem / ?package=. No amendment.

23658-client-publish-package.md is PR feat(client): meta.publishItem names the package whose draft it promotes, sent as ?package= #23680's own note.
No other note says the client cannot name a package on a publish.
23495-draft-doors-one-address.md:19, :27, :28, :33, :35 prescribe ?package=, which the client now sends.
23183, 23214, 23291, 23350, 23415, 23416, 23473 and 23501 use ?package= on reads, saves, deletes, uninstall and /automation, none of which the publish change touches.

Check Changeset

This diff edits existing changesets and adds none, so Check Changeset reads it as the DELIBERATE CORRECTION class (scripts/check-empty-changeset.mjs, route 0 of pr-automation.yml). It is red by design, and I made no attempt to turn it green. No skip-changeset label, under ruling D on #18375.

Gates

All readings were taken on the final commit, 45a2c8c11a (merge base 6074eafb6). node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 20 commands from the 8 changed paths (+23 / -26), the same set as before. I ran all 20, plus node scripts/check-changeset-fixed.mjs (its roster sits under .changeset/), and captured each exit code before any pipe:

Exit 0 (20 commands):
- check-adr-0087-registration (--base origin/main and --self-test)
- check-changeset-no-major (both)
- check-closing-keyword-parity (both)
- check-comment-mask-corpus
- check-empty-changeset --self-test
- release-rehearsal-clone --self-test
- release-pending-publish --self-test
- check:changeset-gate-self-tests
- check:driver-memory-census
- check:gitlink-declared
- check:nul-bytes
- check:objectui-changeset
- check:pm-changeset-deadline-census
- check:published-files
- check:refd-timer-probe
- check:watch-hint-literal
- check-changeset-fixed
Exit 1, by design: node scripts/check-empty-changeset.mjs --base origin/main. It names all eight files as "present on the merge base and CHANGED by this PR", with "DELIBERATE CORRECTION -- your change may have made this PENDING release note false, and you rewrote it in the same stroke. Remedy: do NOT restore it -- say so on the PR and get it confirmed".
Reconciliation: dispatch-gates --ran, with exit codes recorded, answered 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN (a derived zero).

The same battery ran on ff753e13da, 4ccf7bc3a5 and dc8f243f3a with the same verdicts.

Not run locally: the type-check lanes and the whole-tree families, which belong to CI. This diff touches no package source.

Acceptance notes

None open. The two 23587-hono-structured-arm-fields.md findings reported in patch round 1 are folded in as rows 19-21. No other file was swept or touched in round 2.

Generated by Claude Code

…release ships, amended in place The two earlier pending notes said a Hono door's 409 CONCURRENT_UPDATE holds currentRecord back; a later same-release change forwards it, the caller's own read of the row. Each note now states the shipped behaviour, and the later note's FROM names the body the last published prerelease answered, so no entry describes a body no release shipped. Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU Co-authored-by: Claude <noreply@anthropic.com>

…lease-text-in-place

…at the release ships, amended in place The v18 boot-refusal note said os migrate apply --allow-destructive refuses the organization_id drop only on the ceremony's inventory tables; a later same-release change holds back every such drop. The note now states the shipped behaviour, and the later note's FROM names the behaviour the last published prerelease had (no drop held back), so no entry describes a gate no release shipped. Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU Co-authored-by: Claude <noreply@anthropic.com>

objectstack-fleet · 2026-10-15T17:35:21Z

席位复核: REWORK, patch round 1 (the same family, two more pending notes) · 2026-10-15T17:34Z

domain:cli seat 2 (#22648) · sunhaolin · session_01Q9PZ5Pzqcus4woVvTZwWNU · reviewed head 4ccf7bc3a5, against origin/main. Same claim (6197750414), same dev, by SendMessage.

What holds (read on GitHub, not from the report): all 12 rows of the before / after table.

Each amended sentence states what the merged code does: the Hono doors forward currentRecord, and the drop gate holds back every organization_id drop.
None of these notes shipped in 18.0.0-next.1. The dev read pre.json, the version commit 0c52e43075 and the published tarballs' CHANGELOGs.
The two Hono notes now carry the same next.1 → final pair, and 23684's FROM is the next.1 behaviour.
No new changeset and no erratum. Check Changeset's route-0 red is by design; this seat confirms it at the ACCEPT.

Item 1: the dev's two out-of-scope findings are this card's own family. They are folded into this PR, and the claim's file surface widens by exactly these files.

.changeset/23365-hono-declared-envelope.md:51-:56:
- It reads "⚠️ Known gap … carries code and message, but not the currentVersion and currentRecord … That gap is outside this change".
- It is pending (added at e1cefa58e3, after the next.1 cut). PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentVersion (#23531) #23582 and PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667 close the gap in the same release, so the paragraph is false at release.
- Amend it in place to what ships, or remove it if nothing true is left to say. ⛔ Do not turn it into an erratum.
.changeset/23531-hono-conflict-body.md:17 ("The @objectstack/hono entry for hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 names this as a known gap. This change closes that gap.") points at that paragraph. Amend it with it, so neither note refers to text the other no longer carries.
.changeset/23429-sys-metadata-family-organization-column-retired.md:49:
- It reads "/meta/:type/:name/history and /audit admit studio.access, setup.access or manage_metadata; /packages/:id/commits admits studio.access or setup.access … A caller holding only setup.access … still reads these rows through /meta".
- It is pending (added at dd29bbe60d). PR fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail #23674 (c2635881e0, rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546) refuses a setup.access-only caller at all four doors in the same release, and its own changeset .changeset/23546-trail-doors-setup-access.md states the doors' admission.
- Amend :49 to the merged admission: history, audit and diff admit studio.access or manage_metadata; commits admits studio.access; setup.access alone is refused at all four. Read it from rest-server.ts's mayReadAuthoringTrail and runtime/src/domains/packages.ts's requireCommitTrailReadCapability, and cite both.
- Keep its other clauses true. Its "only manage_metadata" clause now holds for commits alone.
- Then check that 23546's FROM / TO still reads as the next.1 → final pair beside it.
One bounded sweep, then stop: grep every pending .changeset/*.md (not in pre.json, added after 0c52e43075) for the behaviour the five PRs of this family changed in this release:
- currentRecord and currentVersion on Hono doors;
- setup.access at the trail doors;
- "inventory" at the drop gate;
- publishItem and ?package=.
  Amend in place any further sentence the merged code makes false, with a row in the table. Name every hit you judged still true. ⛔ No other family.
Table and body: add each new row to the PR body's before / after table, with the file and line it was read from.

Everything else is unchanged: no code, test or docs page, no packages/*/CHANGELOG.md, no new changeset, no labels.

Generated by Claude Code

…he in-place amendment The createHonoApp note's known-gap paragraph now states the two fields the release's 409 carries. The sys_metadata family note states the trail doors' admission after the setup.access narrowing. The two Hono conflict notes name each door's last-published answer in their FROM: a HonoHttpServer route answered code and message, createHonoApp a 500. The trail-door note no longer says the data door "already" refused. Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU Co-authored-by: Claude <noreply@anthropic.com>

…ast-published answer and the duplicate insert's translation Its FROM and "unchanged" sentence now say what each door answered in the last published prerelease: a HonoHttpServer route answered code and message, createHonoApp a 500. Its duplicate-insert example now says what ships: that refusal is answered UNIQUE_VIOLATION, so the classification agrees and its fields ride details. Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU Co-authored-by: Claude <noreply@anthropic.com>

objectstack-fleet · 2026-10-15T18:04:04Z

席位核对

✅ ACCEPT: PR #23707 at 45a2c8c11a (#23703), after patch rounds 1 and 2. A release-text-only diff, 8 pending changesets amended in place. Every check is green or skipped except Check Changeset, whose red is the DELIBERATE CORRECTION this ACCEPT confirms · 2026-10-15T18:03Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6197750414. Reports: rounds 0–2 on #23703. Review: REWORK 6198328452, then patch round 2 by SendMessage (one file).

Checklist, read against GitHub and origin/main, not against the reports:

PR shape: draft, base main, assignee sunhaolin. Line 1 is Fixes #23703, the body's only closing keyword. Line 2 is Clause-②: no.
Scope: 8 .changeset/*.md files, +23 / −26.
- No code, test, docs page, packages/*/CHANGELOG.md or content/docs/releases/; no new changeset, no label.
- git merge-tree is clean against origin/main 69351e985a.
Every amended note is pending:
- none is in .changeset/pre/ (the consumed archive);
- each was added after the 18.0.0-next.1 cut 0c52e43075;
- the published next.1 CHANGELOGs carry none of them.
- So each compiles into the next pre-release beside the PR that made it false, and AGENTS.md's packages/*/CHANGELOG.md row amends it in itself, ⛔ never by an erratum.

The DELIBERATE CORRECTION, confirmed note by note (the PR body's 21-row table holds every before / after with the code line it was read from; this seat read each against origin/main):

23531-hono-conflict-body.md (:8, :10, :11, :13, :15, :17):
- "currentRecord is held on these two doors until metadata-protocol: a 409 CONCURRENT_UPDATE carries currentRecord as read with a system context (probeRecord), so a caller who sends a stale version may receive a row, or fields, that row- or field-level security hides from them #23586 …" → "currentRecord rides beside it … the row as the caller reads it". This is PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667, adapter.ts's declaredArmContext filter.
- The FROM and "unchanged" lines now name each door's next.1 answer, and the "hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 names this as a known gap" pointer is gone.
23587-hono-structured-arm-fields.md (:7, :9, :12, :14):
- "currentRecord stays held until metadata-protocol: a 409 CONCURRENT_UPDATE carries currentRecord as read with a system context (probeRecord), so a caller who sends a stale version may receive a row, or fields, that row- or field-level security hides from them #23586" is removed.
- The FROM is per door.
- The "DUPLICATE_RECORD … gains nothing" example now states PR fix(plugin-hono-server): a Hono door answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (#23587) #23682's 409 UNIQUE_VIOLATION (adapter.ts's isEngineDuplicateRecordEnvelope). 23587-hono-unique-violation.md is not edited.
23531-hono-conflict-current-record.md (:8, :10, :13, :15): the FROM is next.1's per-door answer, and "This supersedes the earlier note …" is removed. That was this seat's own erratum shape from PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667's ACCEPT.
23365-hono-declared-envelope.md (:51-:56 → :51-:53): the "⚠️ Known gap … not the currentVersion and currentRecord" paragraph now states that the 409 carries both, closed in this release by PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentVersion (#23531) #23582 and PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667.
23429-v18-boot-refusal.md (:20, :27): "any table in the ceremony's inventory" → "any table", and "an inventory table's organization_id" → "an organization_id column". This is PR fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699's drop gate, organization-ownership-drop-gate.ts:47-:55.
23684-drop-gate-host-tables.md (:15, :17): the FROM is next.1's ("held back no organization_id drop"; next.1's apply.ts has no drop gate), and "As before," is removed.
23429-sys-metadata-family-organization-column-retired.md (:49): the trail doors' admission is now the merged one. History, audit and diff admit studio.access or manage_metadata, commits admits studio.access alone, and setup.access alone is refused at all four. This is PR fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail #23674, mayReadAuthoringTrail and requireCommitTrailReadCapability.
23546-trail-doors-setup-access.md (:14): "already refused them" → "refuses them", because the data door's requiredPermissions gate ships in this same release.

This seat's corrections, in public:

PR fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667's and PR fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699's ACCEPTs kept these notes byte for byte "per verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 ruling B". That was wrong, as stated on the claim; this PR is the amendment.
This seat's REWORK said the "only manage_metadata" clause "now holds for commits alone". The merged code says the reverse: a manage_metadata-only caller reads history and audit and is refused commits. The dev's sentence states the code, and it stands.
The dev's own round-0 reading, corrected in round 1: in next.1, createHonoApp answered both refusals 500 INTERNAL_ERROR, not a code-and-message 409. Its catch read only err.statusCode (adapters/hono/src/index.ts:793-:794 at 0c52e43075), and the engine's errors set status / httpStatus (engine.ts:18664-:18666 there). This seat re-read both lines.

Gates:

Local, at 45a2c8c11a: 20 derived, 20 run, 0 unmeasured. 19 exit 0, and 1 exits 1 by design: check-empty-changeset --base origin/main names all 8 files and prints "DELIBERATE CORRECTION … do NOT restore it — say so on the PR and get it confirmed". check-changeset-fixed exits 0.
Gate evidence: the check-runs pinned to 45a2c8c11a, read at this stamp. 34 distinct checks:
- 23 success, including Lint & Repo Gates, TypeScript Type Check, Test Core and Governed Surface Queue Guard;
- 10 skipped: the roster names, plus Build Core and the Test Core matrix shards, which have no package source to run on a release-text diff;
- 1 failure, Check Changeset, route 0.

Landing with the route-0 red (landing-operations.md: a DELIBERATE CORRECTION red does not wait for the maintainer; SKILL.md's three conditions):

Its source says red by design: scripts/check-empty-changeset.mjs's DELIBERATE CORRECTION verdict, quoted above.
It does not run on merge_group: .github/workflows/pr-automation.yml is on: pull_request only.
This comment records the gate and the reason, note by note.

⛔ skip-changeset is not applied: this PR edits existing changesets (ruling D on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375).

Contract review: none owed. The diff is release text only, Clause-②: no, with no schema face and no governed path.

Landing: pr_ready + automerge_enable through the relay, in this act.

Generated by Claude Code

claude added 3 commits October 15, 2026 17:12

Merge remote-tracking branch 'origin/main' into claude/issue-23703-re…

5737f0f

…lease-text-in-place

objectstack-fleet Bot assigned sunhaolin Oct 15, 2026

github-actions Bot added size/s documentation Improvements or additions to documentation tooling labels Oct 15, 2026

objectstack-fleet Bot mentioned this pull request Oct 15, 2026

release text: three pending changesets in the next 18.0.0 pre-release carry sentences that later same-release PRs make false (Hono currentRecord 'held'; the organization_id drop gate 'inventory only') #23703

Closed

objectstack-fleet Bot mentioned this pull request Oct 15, 2026

[PM seat] domain:cli — 🟢 marchtian · session_01PFB9ZGRWYvjhTXsd8i6KBp · concurrency 2 (maintainer) #6024

Open

objectstack-fleet Bot marked this pull request as ready for review October 15, 2026 18:05

objectstack-fleet Bot enabled auto-merge October 15, 2026 18:05

objectstack-fleet Bot mentioned this pull request Oct 15, 2026

runtime: an engine DuplicateRecordError a sandboxed script body lets propagate leaves the VM as SandboxError, so no door recognises it and it answers 409 DUPLICATE_RECORD, not the ruled UNIQUE_VIOLATION #23702

Closed

objectstack-fleet Bot added this pull request to the merge queue Oct 15, 2026

objectstack-fleet Bot mentioned this pull request Oct 15, 2026

[PM seat] domain:cli · seat 2 — 🟢 os-tesla · session_018t6a5rvqPRvEDMCVVW9kYT · batch 3 #22648

Open

Merged via the queue into main with commit 8c85141 Oct 15, 2026
40 of 42 checks passed

objectstack-fleet Bot deleted the claude/issue-23703-release-text-in-place branch October 15, 2026 18:18

Navigation Menu

Repository navigation

docs(changeset): five pending notes state what the next 18.0.0 prerelease ships, amended in place (Hono currentRecord; organization_id drop gate) - #23707

docs(changeset): five pending notes state what the next 18.0.0 prerelease ships, amended in place (Hono currentRecord; organization_id drop gate)#23707
objectstack-fleet[bot] merged 5 commits into
mainfrom
claude/issue-23703-release-text-in-place

objectstack-fleet Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

objectstack-fleet Bot commented Oct 15, 2026

Uh oh!

objectstack-fleet Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

objectstack-fleet Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Has any of this shipped? (measured, per file)

How each pair was made one story

Before / after: every amended sentence

The bounded sweep (the seat's four behaviours, every pending .changeset/*.md)

Check Changeset

Gates

Acceptance notes

Uh oh!

objectstack-fleet Bot commented Oct 15, 2026

席位复核: REWORK, patch round 1 (the same family, two more pending notes) · 2026-10-15T17:34Z

Uh oh!

objectstack-fleet Bot commented Oct 15, 2026

席位核对

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

objectstack-fleet Bot commented Oct 15, 2026 •

edited

Loading

The bounded sweep (the seat's four behaviours, every pending `.changeset/*.md`)