[objectstack-fleet]

Requested by Elon · project thread

Fixes #25244
Clause-②: no
Metadata-protocol: none

Summary

One line of .claude/skills/pm-dispatch/references/platform-readings.md (line 403) still said the D9 system-write stamp only recognised the PLATFORM_OBJECT_TENANCY ledger's tenant-scoped class. That ledger retired with ADR-0131 D13, and the stamp's scope is decided by the object's schema alone, as Engine.buildDriverOptions in packages/objectql reads it through resolveTenantFieldName: a tenant column and not federated ⇒ in scope; no tenant column (tenancy.enabled: false, systemFields.tenant: false, no tenant field) or federated ⇒ auto-muted. The line now states that rule and cites ADR-0131 D9 / D13 by name; reach: in still only says a tenant column exists.

• Edited in place: 1 line, 119 bytes (cap 120), file stays 460 lines at its 460 ceiling, no ceiling moved.
• git grep -n PLATFORM_OBJECT_TENANCY -- .claude is empty afterwards.
• Verified against origin/main e58bd0e: packages/objectql/src/engine.ts buildDriverOptions (isTenantAuditInScope = resolveTenantFieldName(objectSchema) !== null && !isFederated), and docs/adr/0131-*.md carries ### D9 and ### D13.

Gates (local, head 67003ee)

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 20 commands; all 20 ran with exit 0 (pnpm check:pm-skill-ratchet and pnpm check:pm-skill-id-lint among them; check:doc-formula-expressions first answered exit 3 PREREQUISITE NOT MET, re-run after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint → exit 0). --ran reconciliation: 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN. Ratchet verdict line: platform-readings.md is 460 lines (ceiling 460; headroom 0).

Diff touches .claude/** only (Tier S governed surface); no published package moves, so skip-changeset is declared with this create.

维护者速读(草稿)

改了什么: platform-readings.md 第 403 行一行改写:D9 盖章按 schema 裁(有租户列且非联邦才在范围),引 ADR-0131 D9/D13,不再点名已删除的 PLATFORM_OBJECT_TENANCY 账本。行数与字节上限都未动。

为什么改: 该账本随 #25201 退役后,这行读起来会把席位引去找一个已不存在的符号;引擎里 buildDriverOptions 早已只按 schema 判定。

风险与代价(含回滚): 仅文档一行,无代码、无发布面;回滚即 revert 本 commit。

席位意见: (留空)

你要做的: 席位内 CONTRACT_REVIEW_TIER 达档复核 PASS 记录后由席位入队落地;无需维护者批准(Tier S)。

🤖 Generated with Claude Code

https://claude.ai/code/session_01REMuzhz6MWRjg8uohedMnM

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 67003eee01190ce1f70fb2118337d317aecf5d4a
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/platform-readings.md + packages/objectql/src/engine.ts (buildDriverOptions L7707–7800, resolveSystemInsertOrganization L8020–8046), packages/objectql/src/tenancy/system-write-organization.ts (resolveTenantFieldName L219), docs/adr/0131-total-organization-ownership-no-null-organization-id.md (D9 L698, D13 L870), .changeset/25201-platform-object-tenancy-ledger-retired.md

Inputs read: card #25244 body and both comments (claim 6345416988, os-dev-report 6345762541), PR #25254 body, file list (1 file, +1/−1), git diff origin/main...67003eee (merge-base e58bd0e), the head's check-runs via the API. Cited code read at origin/main e58bd0e, which the diff does not touch.

① Derived judgments

1. Rule stated correctly — right. New clause 「D9 盖章按 schema(ADR-0131 D9/D13):有租户列且非联邦才在内」 matches the engine on both D9 paths: engine.ts L7757 isTenantAuditInScope = resolveTenantFieldName(objectSchema) !== null && !isFederated (the elevated-write audit mute at L7791 fills bypassTenantAudit: true only when that is false), and resolveSystemInsertOrganization L8043 (isFederatedObject ⇒ return) + L8045 (!tenantField ⇒ return). resolveTenantFieldName L219–235 answers null on tenancy.enabled: false, no fields, or no declared/organization_id column — the three "no tenant column" cases the card names. Tenant column AND not federated ⇒ in scope; no tenant column OR federated ⇒ auto-muted. The line says this.
2. ADR citation by name — right. ADR-0131 D9 (L698–705): 「design: isSystem 写入是否在租户审计控制范围内?——#13178 类级装置(A/B/C)的共同前置,从未被裁过 #13491 classification … becomes structural — column ⇒ in scope — and its ledger retires (D13)」; D13 (L870–880) lists platform-object-tenancy.ts and isPlatformObjectOutOfTenantAuditScope among the retirements. The citation names the sections that carry the rule and the retirement.
3. No retired symbol — right. git grep -n PLATFORM_OBJECT_TENANCY 67003eee -- .claude exits 1 (empty). The symbol's remaining mentions in the tree are the refactor(objectql)!: retire the PLATFORM_OBJECT_TENANCY ledger (ADR-0131 D13) — the bypassTenantAudit mute becomes structural, and the [tenant-audit] warning stops telling a wall-exempt write to pass a tenantId #25201 changeset, CHANGELOGs and a dated audit — history, not rules; out of the card's ask.
4. First clause preserved byte-for-byte — right. 「租户普查 reach: in 只说有租户列;」 is unchanged; reach: in still only says a tenant column exists.
5. Meaning dropped from the old line — none that matters. The qualifier 「系统写」 (「D9 系统写盖章」 → 「D9 盖章」) is gone. ADR-0131 D9 IS the system-insert stamp rule (resolveSystemInsertOrganization), so with the section named the referent is unambiguous; and the same schema predicate also decides the elevated-write audit mute in buildDriverOptions, so the wider wording is the more accurate one. Accepted.
6. Direction of 「才」 — a reading note, not a defect. 「有租户列且非联邦才在内」 literally states the necessary arm (in scope ONLY IF column ∧ ¬federated); the sufficient arm (column ∧ ¬federated ⇒ in scope) is the conventional reading and is what the engine implements (an iff). At 119 of 120 bytes there is no room for a second arm; the card asked for one line at the same byte cap and got it.
7. Ratchet facts re-measured from the committed tree, not the dev report — right. File 460 lines at head and at origin/main; line 403 is 119 bytes at head (120 at main; cap 120); longest line in the file 120 bytes. No ceiling moved; the diff is one hunk, +1/−1; nothing else on the page moves.
8. Public surface — none. .claude/** only. No package, export, schema, type or error code changes; accept-set of every published package unchanged.

② Semver level

No published package touched ⇒ no release and no changeset owed. PR body carries Clause-②: no; skip-changeset label is on the PR; Check Changeset concluded success. Consistent.

③ Boundary flags

• Commit trailer changed after the pre-push hook refused — accepted. The head commit carries the model-free pair (Co-authored-by: Claude at the noreply address, plus Claude-Session: URL), which is exactly AGENTS.md's rule (L460–461); the refusal was the hook doing its job. No published ref was rewritten (one commit on the branch).
• skip-changeset declared on the pr_create labels leg instead of a later label write — accepted; the label is on the PR on read-back, same end state, one fewer write.
• open_questions empty — nothing to answer.
• Worktree objectstack-issue-25244 left in place — housekeeping for the dispatching seat; outside this record.
• Check-runs on this head at review time (2026-10-22 ~16:35Z): 39 runs, 0 failed. Concluded success: Test Core, Check Changeset, Check PR Size, Check Documentation Links, Type Check · workspace, Type Check · debt ledger, Lint · CI/release/engine gates, three scoped lint jobs, the four single-writer/claim guards, Auto Label, filter, Dogfood Regression Gate. Skipped by path filter: Build Core, Build Docs, Test Core shards, Temporal Conformance, Console Pin Gate, Dogfood Verify CLI, opt-in harnesses. STILL RUNNING or queued: TypeScript Type Check (required, queued), Governed Surface Queue Guard (required, in_progress), Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · PM dispatch-gates, Type Check · consumer gates, Type Check · source gates; Lint & Repo Gates (required) had not reported yet. A pending required check is not a PASS of that check: landing precondition ② (all checks green) is the seat's read at enqueue time, not this record's.
• PR is a draft (draft: true, mergeable_state: blocked) — the seat marks it ready before enqueue.

Implemented-by: claude/project-thread-r6oa8t
Reviewed-by: session_01REMuzhz6MWRjg8uohedMnM

VERDICT: PASS

[objectstack-fleet]

席位核对

ACCEPT · domain:skills#2 · os-elon-musk · session_01REMuzhz6MWRjg8uohedMnM · 2026-10-23T06:18Z · head 67003eee01190ce1f70fb2118337d317aecf5d4a · Tier S (check-governed-merges.mjs --pr 25254: .claude/** ×1, no Tier H path, 2 changed lines)

Landing authority: the maintainer's own words in the seat thread of the Claude Code project "Objectstack" (os-elon-musk), 2026-10-23T06:16Z: 「#25348 #25254 #25386 可以落地」.

1. Shape: draft, base main, Fixes #25244 the only closing keyword, Clause-②: no, skip-changeset; one line of references/platform-readings.md.
2. Premise measured: the reviewer read buildDriverOptions / resolveSystemInsertOrganization / resolveTenantFieldName and ADR-0131 D9/D13 at e58bd0e3; the line states the schema rule they implement.
3. Gates (check-runs pinned to this head): 40 completed, none failed; Lint & Repo Gates, TypeScript Type Check, Test Core, Governed Surface Queue Guard success; path-filtered jobs skipped. Dev's 20 dispatch gates: 20 run, all exit 0.
4. Contract review: CONTRACT_REVIEW_TIER PASS on this head, record 6345852053.
5. Accepted deviations: 「系统写」 dropped from 「D9 系统写盖章」 (the wider wording matches both D9 paths); the 「才」 reading note (necessary arm stated, iff implemented) at 119/120 bytes.
6. Out of scope and landing: none. Base is older than main; the merge queue tests it against current main. This seat flips ready and arms auto-merge now.

---

Generated by Claude Code