refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10)

⛔ BLOCKED — stage 1 landed (PR #22087); stage 2, the registry loader half, waits on C5 (#15206).

Blocked-by: #15206

_{History: this line read Blocked-by: #15193 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. Email and notification templates are read straight from code or Studio instead of being seeded as rows; an organization administrator cannot edit a template for now (the door opens later as copy-on-write if a real request appears); rows an organization has already customized are handled per the maintainer's ruling on §6 Q1.

Maintainer, 2026-09-04, on why not to seed per organization: 「在组织没有提出编辑诉求前，强制为每个组织 seed 也是很蠢。我宁可先不让他编辑。」

⚠️ ADR-0131 §6 Q1 must be ruled before this card is dispatched — it is the only open question the record leaves. The two answers are in Scope below.

Scope. TemplateLoader (template-loader.ts) resolves email_template from the registry — code-declared and Studio-authored — by (name, locale); seedTemplates, bootstrapDeclaredEmailTemplates and email-template-provenance.ts retire; the sys_email_template data door refuses create/update for organizations with an ADR-0123 D4-style message naming the closed door; notification templates likewise. §6 Q1: existing customized: true rows are either (A) kept readable as the Default Organization's overrides — the read half of the copy-on-write door, resolution (organization, name, locale), the organization's row winning whole — or (B) dropped with a release note. Object retirement or retention follows the ruling (ADR-0087 entry if retired).

Acceptance. Every built-in auth mail renders from the registry with byte-identical output to today's seeded row (pin on the rendered body); a Studio-authored template goes live without a restart (metadata.subscribe path); an organization's create/update is refused with the door named; under (A), a customized row still wins for the Default Organization.

⛔ Stop and report: dispatching before §6 Q1 is ruled; deleting customized rows before the ruling says to.

Refs: ADR-0131 D6, D10, §6 Q1 · ADR-0005 (tier A) · ADR-0123 D4 · #4509.

v18 pre-opening re-verification (C4): DRIFTED. #21818 widened what §6 Q1 covers. Still waiting on that ruling

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:38Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds:

The loader reads rows: createSysEmailTemplateLoader (plugin-email/src/template-loader.ts:98), with no organization filter.
seedTemplates (email-plugin.ts:960-972), bootstrapDeclaredEmailTemplates (bootstrap-declared-email-templates.ts:374) and email-template-provenance.ts are live.
The organization door is still open (sys_email_template, unique:'organization'; email_template allowOrgOverride: true).
§6 Q1 is unruled.

Drift:

fix(plugin-email): a metadata-door email template edit survives the next boot #21818 (08adfeade8, 10-05) changed what the seed reads. bootstrapEffectiveEmailTemplates (bootstrap-declared-email-templates.ts:399) reads metadata in the Default Organization. Under single, every Studio save of a template is an org-scoped sys_metadata overlay, projected into the sending row with customized:false.
- So Q1's population is larger than "customized: true rows": it includes those overlays, whose axis is C5's to retire.
- bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources join the retirement list.
- "Byte-identical to today's seeded row" is ambiguous under single.
Notification templates have no registry source. No notification_template metadata type exists; sys_notification_template is rows only (service-messaging/src/objects/notification-template.object.ts:20, seeded from plugin-auth/src/phone-sms-texts.ts:193).
- "Notification templates likewise" therefore means retiring the seed only. A new metadata type is new surface and defaults to no, so it is not this card's.
Inferred, not run: the loader tie-breaks by id across organizations (template-loader.ts:72-79), so one organization's data-door row could win for all. The "behaviour-neutral" premise assumes no organization ever edited a template.

Still blocked on: the maintainer's §6 Q1, now asked with the widened population.

Generated by Claude Code

Ruling pointer: batch #282 item 5 (decision card #22005) · ADR-0131 §6 Q1 → C · maintainer 「同意」 2026-10-06T16:01Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). Record: 6020178017 on #22005, closed. This card stays pm:blocked on #15193; §6 Q1 is no longer open. Thread-read: 6018661841.

C. At the v18 upgrade the migration ceremony (C7, feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211) promotes every customer-edited email template to an environment-level Studio template: both populations, the sys_email_template rows stamped customized: true and the organization-scoped email_template overlays Studio saved under single (fix(plugin-email): a metadata-door email template edit survives the next boot #21818). Under single the meaning is unchanged; a name conflict on a multi-organization deployment is listed and the operator chooses per row (D10 fate 4). After a verified promotion the customized rows are mirrors (D10 fate 2) and the row table retires under D13 with an ADR-0087 entry.
Not taken: A (the kept (organization, name, locale) resolution, the door D6 closed); B (deleting customer rows, unsanctioned by D10).
Scope: email templates only; notification templates have no metadata type (6018661841), their seed retires, no new type.
This card's corrections: the retirement list is rewritten for "promote to environment level" and gains bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources; the acceptance "byte-identical to today's seeded row" is read against the promoted template; a dated note under ADR-0131 §6 Q1 naming this ruling rides this card's PR (Tier H, the maintainer's approval), the ADR text otherwise unchanged.

Generated by Claude Code

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C4, dispatchable first

Blocked-by: none

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:35Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released:

[gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 closed completed in this act (6037915987), on the maintainer's words in the triage seat's chat: 「我建议直接启动 v18 开发吧」, 「你应该先解锁 v18 所有的卡片」, 「同意」.
The ruling record is decision: open v18 now and ship it in stages — release the last 17.x from main first without waiting for #21908's deny (A), skip the last 17.x (B), or keep #22009's order (C)? #22050 6037890422 (B: v18 develops on main, with no last 17.x).
This card's Blocked-by: named [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 alone.

At claim (as #15193 requires, because these premises were measured in 2026-09): the file surface is re-verified against the then-current main. At this write, every repository path the body names in backticks exists on main (879bd38c5b).

Re-verify against the newest plugin-email shape: plugin-email: the boot sweep rewrites every effective email template on every boot (4 serial statements and a full sys_email_template scan each); since 08adfeade the default org's overlays are in that loop #22062 changed packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts (PR fix(plugin-email): the boot sweep reads stored templates in bulk and no longer rewrites an unchanged row #22065 → 56bf27affb): a bulk read, and compare-before-write in the boot sweep. C4 retires that seed path, so its claim reads the landed shape, not the 2026-09 one.

The release state:

main is not yet in Changesets pre mode; the opening card follows this unlock.
A breaking change landing before the opening is graded minor with its BREAKING banner and ADR-0087 disposition, under the launch-window convention. Once pre mode is in, major is open.
⛔ chore: version packages #21988 is not merged.

Claim: PM loop round 8 · 2026-10-07T12:46Z
Session: session_01WMQprn46CND82KmY8sZWBu
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-15205-templates-resolve-registry
Worktree: objectstack-issue-15205
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface (re-verified at claim against origin/main e67ba80049, as #15193 requires; every path below exists). Scope is the card as corrected by the unlock 6038028392, triage's re-verification 6018661841 and the §6 Q1 ruling C (6020271181, #22005):

packages/plugins/plugin-email/src/template-loader.ts: createSysEmailTemplateLoader (near :98) resolves email_template from the registry (code-declared plus Studio-authored, environment level) by (name, locale), not from rows.
packages/plugins/plugin-email/src/email-plugin.ts: seedTemplates (near :960) retires, along with the boot sweep's call into bootstrap-declared-email-templates.ts.
packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts: retires, including bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources. It is read in its landed shape (PR fix(plugin-email): the boot sweep reads stored templates in bulk and no longer rewrites an unchanged row #22065, 56bf27affb), not the 2026-09 one.
packages/plugins/plugin-email/src/email-template-provenance.ts: retires.
The sys_email_template data door: refuses an organization's create and update, with an ADR-0123 D4-style message that names the closed door.
packages/plugins/plugin-auth/src/phone-sms-texts.ts: seedPhoneSmsTemplates (near :193, called from auth-plugin.ts near :970) retires. Email templates only get the registry: no new notification metadata type.
docs/adr/0131-total-organization-ownership-no-null-organization-id.md: a dated note under §6 Q1 naming ruling C. The ADR text is otherwise unchanged. Tier H: the PR needs the maintainer's approval to merge.
The packages' tests, and one changeset. The changeset is minor with the BREAKING banner and an ADR-0087 disposition (launch-window convention, 6038028392), and covers each retired published export of @objectstack/plugin-email.

⛔ No packages/spec. Spec prose that still says delivery resolves sys_email_template rows goes to the domain:spec seat as a finding. ⛔ No deletion of customized rows: promotion is C7's (#15211). ⛔ The row table is not retired: that is D13's, after C7. ⛔ The org-scoped email_template overlay axis is C5's. Stop on breach; explain in the report.
Container & model: L, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default-tier build).
Clause-②: no (narrowing)
Responsibility: ADR-0131 execution card (C4, D6/D10), not a defect: this repository's own code in plugin-email and plugin-auth | the ruling sets the path: registry resolution, with customized rows promoted by C7 | every deployment that sends a built-in auth mail or a Studio-authored template
Thread-read: 6038028392
Serial constraints cleared: at 2026-10-07T12:46Z:

No open PR touches packages/plugins/plugin-email/, phone-sms-texts.ts or the notification-template object (every open PR's file list was read).
No in-flight claim of any lane declares those files.
plugin-email: the boot sweep rewrites every effective email template on every boot (4 serial statements and a full sys_email_template scan each); since 08adfeade the default org's overlays are in that loop #22062 (the last plugin-email card) has landed.

Clause-②: no (narrowing): the sys_email_template door stops accepting an organization's create and update, and published exports of the retired seed path leave @objectstack/plugin-email. Nothing is newly accepted.

Generated by Claude Code

os-dev-report

{
  "issue": 15205,
  "status": "needs_decision",
  "branch": "claude/issue-15205-templates-resolve-registry",
  "pr": null,
  "session": "session_01WMQprn46CND82KmY8sZWBu",
  "premise_still_valid": true,
  "summary": "Mechanism hypothesis 1's stop condition fired, measured at origin/main e67ba80049: under the real-deployment shape (Default Organization bootstrapped, bootStack orgContext:true) a Studio PUT /meta/email_template save lands as an ORGANIZATION-SCOPED sys_metadata overlay, and every organization-free registry read (ObjectQL SchemaRegistry getItem/listItems, protocol.getMetaItem with no organizationId) keeps answering the package wording, both live and after a cold boot. Today that edit still reaches the mail only because the live projector writes it into the sys_email_template row the loader reads (pinned green by email-template-overlay-survives-boot.dogfood.test.ts). So an organization-free registry loader landed before C5 (#15206) would silently stop every Studio template edit under single from reaching the mail; per the dispatch I stopped, wrote no code and opened no PR, and the sequencing goes to the maintainer as open question 1 with the four-axis frame. A second stop (hypothesis 4: retired exports have consumers outside the file surface, one of them in packages/spec) is open question 2. The card premise itself holds (the loader reads rows; the seed, sweep and stamp are live); the defect is the sequencing against C5.",
  "tests": "Head: no commit, the branch equals BASE e67ba80049 (diff empty). (1) Dependency closure: os-verify-lock.sh -c 'NODE_OPTIONS=--max-old-space-size=4096 pnpm turbo run build --filter=@objectstack/dogfood^... --concurrency=2' -- 'Tasks: 63 successful, 63 total / Cached: 22 cached', 'VERDICT command-exit 0'. (2) Hypothesis-1 measurement, at e67ba80049: a scratch dogfood file (packages/qa/dogfood/test, created for the run, deleted after, never committed; git status --porcelain empty afterwards) booted the showcase with EmailServicePlugin twice (orgContext false and true), read before a Studio save, after PUT /meta/email_template/showcase_task_done_email, and after a cold boot on the same database file; run together with email-template-overlay-survives-boot.dogfood.test.ts under os-verify-lock: 'Test Files 2 passed (2) / Tests 5 passed (5)', 'VERDICT command-exit 0'. Readings: code-declared only, both postures: SchemaRegistry getItem = package wording, protocol.getMetaItem(no org) = package wording, metadataService.get = undefined, metadataService.list = 0 items. Environment-level overlay (orgContext false): sys_metadata row organization_id null; SchemaRegistry getItem and protocol.getMetaItem(no org) = the saved wording LIVE (no restart) and after the cold boot. Organization-scoped overlay (orgContext true): sys_metadata row organization_id = the Default Organization's id; SchemaRegistry getItem, listItems and protocol.getMetaItem(no org) = PACKAGE wording live AND after the cold boot. Code reading agrees: metadata-protocol protocol.ts hydrateOverlayIntoRegistry returns before registerItem when organizationId is set ([#6602] 'a per-org overlay is served on demand, never grafted into the registry'). (3) Gates: NOT MEASURED, all 59 dispatch-derived commands and the plugin-email / plugin-auth test+typecheck, reason: the stop condition fired before the first edit, so there is no change to measure. (4) Ablation: NOT MEASURED, reason: no pin was written.",
  "mcp_calls": "0",
  "api_writes": "1 -- POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report) via scripts/pm/post-stamped.mjs. Not REST: one git push of the empty branch claude/issue-15205-templates-resolve-registry (the claim's landing marker and write-route probe). No pr_create, no label-write: no PR exists.",
  "deviations": [
    "No PR, no changeset, no ADR dated note: the dispatch's hypothesis-1 stop condition fired, and the ADR note rides the C4 PR that does not exist yet.",
    "Mechanism correction (hypothesis 1 and the 'live without a restart' pin): Studio saves do not announce on metadata.subscribe; that seam is the package-ingest door (MetadataManager.register to notifyWatchers). Studio saves announce on the protocol mutation projector. With a registry read, an environment-level save is live through saveMetaItem's registry write-through (measured live without a restart); no subscription is needed for it. metadataService.get/list answered nothing for the showcase-declared template; the ObjectQL SchemaRegistry and protocol.getMetaItem hold it.",
    "Built-in auth templates (BUILTIN_AUTH_TEMPLATES) are in no registry today: they are code constants seeded straight into rows by seedTemplates. A registry loader must register them as code-declared email_template items or read them as a code layer; the dispatch's 'code-declared' population does not include them yet."
  ],
  "files_changed": [],
  "open_questions": [
    {
      "question": "Q1. Under single, a Studio save of an email_template lands organization-scoped and no organization-free registry read sees it (measured, live and after a cold boot). Switching the loader to an organization-free registry read now stops every Studio template edit under single from reaching the mail until C5 (#15206, blocked on C1 #15195) moves those saves to environment scope. How is C4 sequenced? Measured basis: SchemaRegistry and protocol.getMetaItem without an organization answer the package wording for an org-scoped overlay; the environment-level overlay is visible live; email-template-overlay-survives-boot.dogfood.test.ts pins today's behaviour green at e67ba80049. ADR-0131 section 8 lists C4 as not blocked by C5.",
      "options": [
        "A. Split. Land now, as one PR (Part of #15205), the half that does not depend on the read path: the sys_email_template data door refuses an organization's create and update (403 PERMISSION_DENIED, the existing ADR-0112 catalog code, message naming the closed door; system-context writes such as C7's promotion pass); the provenance stamp retires (once the door is closed no non-system update reaches it); the sys_notification_template SMS seed retires (built-in texts render through a per-rung walk, row at that locale else built-in at that locale, which is byte-identical to the seeded world); the dated ADR-0131 section 6 Q1 note. Add Blocked-by #15206 for the loader, the seedTemplates seed, the boot sweep (bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources) and the live projector. Cost: two PRs; the boot sweep and the row projection live until C5.",
        "B. Re-block the whole card on C5 (#15206). Cost: nothing lands now; the customized-row population keeps growing until then, which lengthens C7's conflict list.",
        "C. Interim organization-aware read: the loader resolves through protocol.getMetaItem in tenancy.defaultOrgId()'s organization (the seam the boot sweep already reads through since #21785), and C5 deletes it. Cost: a temporary read with a scheduled deletion; an organization-keyed template read, the shape section 6 Q1 option A was rejected for; the dispatch forbids improvising it.",
        "D. Land C4 as dispatched, organization-free, and accept the regression on main until C5 and C7. Cost: main stops delivering Studio template edits under single for an unbounded window (C5 is XL and blocked on C1); the dogfood pin has to be rewritten to pin the regression; the card's acceptance 'a Studio-authored template goes live without a restart' is unmet for the default posture.",
        "E. Pull C5's slice for this one type into C4: allowOrgOverride false for email_template in DEFAULT_METADATA_TYPE_REGISTRY (packages/spec), so Studio saves land environment-wide and the write-through makes them visible; organizationIdForMetaRead then reads environment-wide too. Cost: a packages/spec change this dispatch forbids; pre-empts C5's #22007 rename ruling for one type; existing org-scoped overlays go unread on main until C7 promotes them."
      ],
      "recommendation": "A, fallback B. Business need (measured): Studio template editing under single is shipped and pinned (showcase dogfood, #21785 / #21818 landed 2026-10-05), and every single deployment with the Default Organization saves org-scoped; D breaks it, A/B/C/E keep it, and the door closure has a measured pull (ruling C, 「我宁可先不让他编辑」). Long-term soundness: A and B keep one read path and add no interim code; C is a workaround with a scheduled deletion; E does C5's work piecemeal against a pending rename; D leaves main advertising an edit path that delivers nothing. Preventing AI mistakes: A and B keep one template source at every commit; C hands an AI two read paths, one organization-keyed, to copy; D is declared-but-not-enforced on the authoring surface; E is contract-first but belongs to C5. Startup focus: A adds no surface and costs one extra PR; B adds nothing; C adds interim code; E widens the card into spec; no option adds a gate. A over B because closing the organization door now stops the customized population C7 has to promote from growing, at no cost to the single-posture edit path."
    },
    {
      "question": "Q2. Hypothesis-4 stop: the retirement list has consumers outside the file surface. examples/app-showcase/test/email-template-locale.test.ts imports createSysEmailTemplateLoader, mapTemplateToRow and EMAIL_TEMPLATE_OBJECT from @objectstack/plugin-email. packages/spec/liveness/email_template.json, a hand-maintained ledger that @objectstack/spec publishes, anchors the evidence of its live verdicts on bootstrapDeclaredEmailTemplates, upsertDeclaredEmailTemplate and mapTemplateToRow, and its _note narrates the seed and provenance design. The other hits (objectql registry.ts and registry-i18n-bundle-key.test.ts, platform-objects sys-email-template.object.ts, packages/spec/src/stack-email-template-locale-floor.test.ts) are comments only. When the loader half lands, how are these two handled?",
      "options": [
        "A. The resumed dispatch names both in its file surface: the showcase test is rewritten against the registry read, and the ledger's evidence is re-anchored by hand to the registry loader (the ledger is hand-written measurement and must never be regenerated).",
        "B. Keep mapTemplateToRow, EMAIL_TEMPLATE_OBJECT and createSysEmailTemplateLoader exported (not retired) so the consumers stand; the ledger is re-anchored by the domain:spec seat in a sibling PR that lands together."
      ],
      "recommendation": "A. Business need: both consumers exist only to pin the row path being retired, so neither carries a pull of its own. Long-term soundness: retiring the row path while exporting its projection keeps a dead surface (B). Preventing AI mistakes: a liveness ledger citing retired symbols is exactly the evidence-rot the ledger warns about, and a kept row loader invites an AI to read rows. Startup focus: retire immediately, no staged window. One landing, one surface."
    }
  ],
  "out_of_scope_findings": [
    "carrier: the C4 loader PR, or the domain:spec seat in the same landing · noted, not filed (accurate TODAY, stale the day the loader stops reading rows): packages/spec/src/contracts/email-service.ts:147 (row from sys_email_template), :152 and :231 (matches sys_email_template.name), :253 and :262 (resolved sys_email_template row, body_html), :284 and :298 (Resolve a named template from sys_email_template); packages/spec/src/automation/io-node-config.zod.ts:133, :198, :215 (the describe string: resolves (name, locale) against sys_email_template at delivery), :278, :300; packages/spec/src/system/email-template.zod.ts:13 (Persisted as rows of sys_email_template); packages/spec/src/system/notification.zod.ts:53. All at e67ba80049.",
    "carrier: the C4 loader PR · noted, not filed (accurate today, stale with the loader): packages/services/service-automation/src/builtin/notify-node.ts:197, the authoring-facing node description 'Email template name (sys_email_template.name) ... resolved by (name, locale) at delivery'; packages/platform-objects/src/audit/sys-email-template.object.ts header ('built-in templates are seeded ... tenants may overlay specific rows').",
    "carrier: the C4 loader PR · noted, not filed. Hypothesis 6 answer for C7 (#15211): after the loader half, no reader of sys_email_template rows remains in this repository (every sender goes through IEmailService sendTemplate / renderTemplate: service-messaging email and inbox channels, the service-automation notify node, plugin-auth). C7's promotion needs, per row with customized true: (name, locale) plus every column mapTemplateToRow projects (subject, body_html, body_text, from_name, from_address, reply_to, active, is_system, description, variables_json, label, category), that is the inverse projection back to an email_template document; and, for the second population, the org-scoped sys_metadata email_template rows themselves."
  ]
}

Generated by Claude Code

Seat answer to the stop (`6038447213`) · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T13:03Z

The stop was correct, and the seat answers Q1 with A: split the card. This is sequencing between technical tasks, a class the PM rules without escalating. The maintainer may veto, and the stage-1 PR needs the maintainer's merge in any case (its ADR note is Tier H).

What the measurement shows (e67ba80049, the real-deployment shape with the Default Organization bootstrapped):

Under single, a Studio save of an email_template lands as an organization-scoped overlay.
No registry read that omits the organization sees it, live or after a cold boot (hydrateOverlayIntoRegistry returns before registering an org-scoped item).
Today the edit reaches the mail only through the live projector's row, which email-template-overlay-survives-boot.dogfood.test.ts pins.
So a registry-only loader landed before C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) would silently stop every Studio template edit under single from reaching the mail. ADR-0131 §8 does not list C5 before C4; the measurement adds that dependency for the loader half.

Why A

D (land as dispatched) breaks a shipped, pinned edit path for an unbounded window. C (an interim org-aware read) is the organization-keyed read that ruling C declined. E is C5's work, in packages/spec, ahead of decision: ADR-0131 C5 — allowOrgOverride also decides environment overlays of packaged items. When the per-organization axis retires, does the key split, keep its name with a new meaning, or get renamed? #22007's rename.
A beats B (re-block everything): closing the organization door now stops the customized population from growing before C7 has to promote it. It costs the single edit path nothing, because the live projector writes in system context and still passes.

Stage 1, the next PR (Part of #15205, Clause-②: no (narrowing)):

The sys_email_template data door refuses an organization's create and update, using an existing catalog code and a message that names the closed door. System-context writes (the live projector, C7's promotion) still pass.
The provenance stamp retires (email-template-provenance.ts and its published exports). With the door closed, no non-system update can reach it.
seedPhoneSmsTemplates retires. The built-in SMS texts render by a per-locale walk (the row at that locale, else the built-in text), byte for byte what the seeded world renders.
The dated note under ADR-0131 §6 Q1 naming ruling C (decision: ADR-0131 §6 Q1 — at the v18 upgrade, do customer-edited email templates become environment-level Studio templates, stay as the Default Organization's overrides, or get dropped? #22005), as ruled. This makes the PR Tier H.

Stage 2, the loader half, waits on #15206 (C5): the registry loader, seedTemplates, the boot sweep (bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources) and the live projector.

When stage 1 lands, this card moves to pm:blocked with Blocked-by: #15206 and a Release: line.
Q2 (the retired exports' consumers: examples/app-showcase/test/email-template-locale.test.ts, and the packages/spec liveness ledger email_template.json) is answered at stage 2's dispatch. The ledger is domain:spec's, so it lands in a sibling PR from that seat.

Recorded for the stage-2 claim and for C7 (#15211):

The built-in auth templates (BUILTIN_AUTH_TEMPLATES) are in no registry today. A registry loader must register them as code-declared items.
Once the loader half lands, nothing in this repository reads sys_email_template rows. C7's promotion needs (name, locale) and every projected column (the inverse projection back to an email_template document), plus the org-scoped sys_metadata rows for the second population.
The stale spec and description prose the report lists goes to the domain:spec seat at stage 2.

Breaker readings (#21999): none. This is the first round, it is not a security review, and no new HIGH was found.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-11T12:41Z
Session: session_013LbZ9MhPp1iriZEtgJqioA
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-15205-registry-loader
Worktree: objectstack-issue-15205
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
Scope: stage 2 of C4, the registry loader half, as ONE cross-domain PR claimed by this lane under the exception path triage named (6108741731, superseding Q2 of 6038499057). Stage 1 landed as PR #22087 (8c5aa50241). The card as corrected by ruling C (6020271181, #22005), triage's re-verification (6018661841), the seat answer (6038499057) and the unlock (6107783347). Ruling-ref: 6020178017 (ruling C's record on #22005).
File surface, re-verified on origin/main efcbac73c (every path below exists):

packages/plugins/plugin-email/src/template-loader.ts: the loader resolves email_template from the registry (code-declared, including the built-in auth templates of templates/auth-templates.ts, plus Studio-authored, environment level) by (name, locale), not from sys_email_template rows.
packages/plugins/plugin-email/src/email-plugin.ts: seedTemplates (near :957) and the live projector wireTemplateMutationProjection (near :1152) retire, with the boot sweep's call.
packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts: retires, including bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources and mapTemplateToRow. index.ts exports follow.
packages/services/service-automation/src/builtin/notify-node.ts: its authoring-facing description of where a template resolves, which goes false with the loader.
examples/app-showcase/test/email-template-locale.test.ts: rewritten against the registry read (Q2, A).
packages/qa/dogfood/test/email-template-*.ts (three files, domain:cli's): rewritten where they pin the row path. Declared on [PM seat] domain:cli — ⏳ vacant #6024 in this act.
packages/platform-objects/src/audit/sys-email-template.object.ts: header and field help only, where they go false (domain:engine's). Declared on [PM seat] domain:engine — ⏳ vacant #6367 in this act.
packages/spec (the exception path; declared on [PM seat] domain:spec — 🟢 os-warren · session_019G5ZnRrTMiwcHG6iZM19zf #6017 in this act): liveness/email_template.json, the evidence re-anchored by hand to the registry loader (a hand-written ledger, ⛔ never regenerated); describe-only text in src/contracts/email-service.ts, src/automation/io-node-config.zod.ts, src/system/email-template.zod.ts and src/system/notification.zod.ts. ⛔ No schema shape change.
Tests, and one changeset for each published package, with the ADR-0087 disposition the gates ask for (main is in Changesets pre mode).
⛔ No ADR edit (stage 1 carried the dated note). ⛔ No deletion or promotion of legacy organization-scoped template rows, and the sys_email_template table is not retired: those are C7's (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211) and D13's. ⛔ No new notification metadata type. Stop on breach; explain in the report.
Container & model: L, mode:subagent, model: opus (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"; the default tier). In-session subagent rather than mode:cloud: the work need not outlive this session and its report is collected here. Describe text on published schemas owes a CONTRACT_REVIEW_TIER review of record before the queue (6108741731). If the diff passes 3,000 changed lines, it lands as Tier H.
Clause-②: no
The loader stops reading rows and the seed retires; nothing newly accepted, no published type widens. The spec part is description text and a measurement ledger. The at-tier review checks this declaration against the diff.
Responsibility: ADR-0131 execution card (C4, D6/D10), not a defect: this repository's own plugin-email code, still serving templates from seeded rows | ruling C sets the path: registry resolution, with customer-edited rows promoted by C7 | every deployment that sends a built-in auth mail or a Studio-authored template
Thread-read: 6108741731
Serial constraints cleared, at this stamp:
No open PR touches any path above (every open PR's file list read).
No in-flight claim of any lane declares those files.
C5's S3–S5 have landed (unlock 6107783347); feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 stays open for carry-overs that touch none of these files.
feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 (C7) waits on this card.

os-dev-report

{
  "issue": 15205,
  "status": "needs_decision",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "summary": "Stage 2 of C4 is implemented in draft PR #22875 (Fixes #15205, Clause-②: no, head 1cc2da623). Premise re-measured first on the showcase with orgContext true at d8c7d3864: a Studio PUT of an email_template lands environment-scoped (sys_metadata.organization_id null) and every organization-free read (SchemaRegistry.getItem, protocol.getMetaItem, getMetaItems, getMetaItemsForExecution) serves it live and after a cold boot. plugin-email now resolves email_template from the registry by (name, locale) through the protocol's layered execution list (registry fallback on a host with no metadata door), the built-in auth templates are code-declared items of the plugin's own package, and the seed, the boot sweep (bootstrapEffectiveEmailTemplates / EffectiveEmailTemplateSources), the live projector and the row loader retire; all 24 built-ins render byte-identical to the seeded rows (both paths ran side by side at 924da8d8a). The ledger is re-anchored by hand and check:liveness is green, but two keys lost their only consumer with the rows: email_template.category and .isSystem are graded dead (honest measurement), which reddens 2 cases in packages/lint (a dead, schema-defaulted category draws an advisory no author can clear). Their fate is a metadata-semantics decision outside this dispatch's fence (no schema shape change, packages/lint out of surface), hence needs_decision; everything else is done.",
  "tests": "All at head 1cc2da623 (after merging origin/main 55382dc02) unless noted; exit codes captured before any pipe. BUILD: os-verify-lock (slot issue-15205), turbo build --filter=@objectstack/dogfood^... --filter=@objectstack/example-showcase... --concurrency=2, 'Tasks: 63 successful, 63 total', VERDICT command-exit 0; client/client-react/organizations closure 51/51. PACKAGES: plugin-email test 'Test Files 33 passed (33) / Tests 515 passed (515)', typecheck OK ('check:test-typecheck: OK ... 0 error(s)'); spec test 'Test Files 648 passed (648) / Tests 19375 passed | 1 todo', typecheck OK; service-automation notify-node.test.ts 16/16 and typecheck OK; platform-objects typecheck OK (comment-only change). DOGFOOD + SHOWCASE: email-template-boot-sweep, email-template-materialization (the @proof file) and email-template-overlay-survives-boot 'Tests 9 passed (9)'; examples/app-showcase email-template-locale 6/6. PREMISE (scratch dogfood test, created in the worktree, run, deleted, never committed; git status empty after): readings R0 package wording; R1 after PUT: sys_metadata row organization_id null, SchemaRegistry.getItem / protocol.getMetaItem / getMetaItemsForExecution serve the admin subject live; R3 after a cold boot on the same db file: same; metadataService.get null and list 0 throughout. BYTE IDENTITY: builtin-auth-render-identity.test.ts pins 24 renders (6 names x 4 locales; subject clear, html/text sha256); at 924da8d8a both the row path (mapTemplateToRow rows + createSysEmailTemplateLoader) and the registry path matched the digests ('Tests 1 passed'). ABLATIONS via scripts/ablation-replace.mjs (WRAP mode, trap EXIT/INT/TERM, restore proven by blob == HEAD and empty git diff HEAD; whole-tree git status empty after): src at fcd3b610a: A1 failed read falls back to the registry 2 failed; A2 built-in precedence dropped 4 failed; A3 malformed items skipped 3 failed; A4 per-load read cached 6 failed; A5 plugin writes a sys_email_template row 1 failed; A6 a projector armed 1 failed; A7 read names an organization 1 failed. Dist leg A5: rebuilt plugin-email, ablation-dist-preflight found the marker in dist (exit 0), dogfood boot-sweep 'Tests 2 failed (2)'; restore, rebuild, preflight --absent exit 0, 'Tests 2 passed (2)', blob == HEAD. A8 (spec describe back to sys_email_template) 1 failed of 37. A9 (departure ONE removed under the re-pointed swallow-census control) red: 'resolution control moved ... got REFUSAL@2681, REFUSAL@2774'; its first attempt was a NO-OP the tool refused (replacement retained the anchor, 'a rise of 0'), re-run with --delete. GATES: dispatch-gates --commands derived 136 at 1cc2da623; --ran: 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). 135 exit 0 (check:skill-examples and check:dual-build-cjs-loads first answered PREREQUISITE NOT MET exit 3, re-run green after building client-react/organizations). check:platform-checklist exit 1 with 8 findings in docs/qa/platform-checklist/areas/*.json (ABSENT SYMBOL in metadata-protocol protocol.ts and service-storage attachment-access-hooks.ts, one floor lost): the identical 8 on origin/main 69d421805 in a scratch worktree (control leg), so pre-existing. check:liveness: 'email_template 21 classified (live 19, dead 2)', exit 0. MEASURED CONSEQUENCE (red, the open question): packages/lint runtime-gate.inert-type-writes.test.ts + lint-liveness-properties.test.ts 'Tests 2 failed | 140 passed (142)' — the two group-C email_template cases now receive liveness-dead-property on `category`. NARROWED LINT: eslint --no-inline-config --format json over the 33 changed source files: files=33, errors=0, warnings=0, none ignored; eslint.config.mjs enables no type-aware linting (no parserOptions.project), so this diff cannot move a verdict on an untouched file. Control-byte scan over the changed files: none.",
  "mcp_calls": "0",
  "api_writes": "3 REST writes, all through scripts/pm (fleet-write relay, objectstack-fleet[bot]): POST /repos/objectstack-ai/objectstack/pulls (pr_create #22875, draft forced; 11031 bytes sent = stored) and POST /repos/objectstack-ai/objectstack/issues/22875/assignees (zhuangjianguo; read-back matches), then POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, post-stamped.mjs). Not REST: git pushes of claude/issue-15205-registry-loader. Zero label writes (none named, none demanded).",
  "gates": "136 derived / 136 run / 0 NOT-MEASURED at 1cc2da623; 135 exit 0; check:platform-checklist exit 1, pre-existing on origin/main 69d421805 (identical 8 findings). Not a gate in the derived set but run as the measured consequence: packages/lint 2 failed (the open question).",
  "line_budget": "4490 changed lines (additions 1517 + deletions 2973, generated included) vs merge base 55382dc02; over 3000, so the PR lands the Tier H way. No governed surface in the file list.",
  "deviations": [
    "PM assumption 6 falsified for two keys: after the re-anchor every live citation resolves and check:liveness is green, but email_template.category and .isSystem have no consumer left (their only one was the retired row projection) and are graded dead. packages/lint's group-C control cases (runtime-gate.inert-type-writes.test.ts) go red on `category`; not edited here (outside the surface, and editing them would decide the open question).",
    "Gate-forced edits outside the named file surface, each the minimal answer to a gate naming retired code: scripts/engine-double-contract.baseline.json and scripts/objectql-double-limit.baseline.json (shrink-only rows for files gone or now clean; both rewritten plugin-email doubles keep their pinned update() routed through assertEngineUpdateDispatch), scripts/isystem-census.mjs (NON_ELEVATION_READS row for the deleted module), scripts/measure-durability-swallow-family.mjs (resolution control re-pointed by measurement: 21 departure-ONE sites remain, none write-shaped; control leg on the deleted file found its 2), regenerated censuses (content/docs/permissions/system-context.mdx, tenant-audit-census.mdx with its hand-written figures 231->226, 156->154, 75->72, 126->121, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md), packages/spec/liveness/README.md row note and generated state-counts/email_template.md, gen:docs output for two reference pages.",
    "Pin sweep (dispatch zone 2 item 7) reached packages/spec/src/automation/io-node-config.test.ts: its describe pin asserted `sys_email_template`; flipped to assert the email templates and refuse the row wording (ablated, A8). The file is not in the declared #6017 list.",
    "Conflict, role file chosen and stated: content/docs/automation/email-templates.mdx described the materialization and seed-not-clobber this PR retires; the role file makes text this change falsifies a must-fix while the dispatch fences other files. Fixed in its own commit 94ab10722 so the seat can declare or drop it. The system-context.mdx row 58 sentence is in the census commit.",
    "sys_email_template field help left untouched: `customized` ('boot seeding never overwrites such a row') became vacuous, not false, so no translation bundle churn; header and provenance comments rewritten.",
    "TemplateLoader / EmailTemplateRow kept as the service's render seam (EmailTemplateRow's docblock now says no row backs it), to avoid retiring a further published type.",
    "Session interruption: the first gate union at 7e9137b0a was killed at 113 of 117 by the usage limit; a complete union was re-run at the final head 1cc2da623 in foreground chunks. origin/main moved again to 69d421805 after the final merge; not re-merged, CI's merge ref validates.",
    "PR body written once at pr_create (not PATCHed). For the seat to add to its Acceptance notes if wanted: EmailServicePlugin.destroy() leaves the sys_email outbox drain hook (afterInsert, packageId com.objectstack.service.email.drain) bound on the engine after shutdown (measured in the rewritten shutdown test's fake engine); pre-existing, reach only for an engine that outlives its kernel."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (new; plugin-email minor BREAKING, spec + service-automation patch; ADR-0087 not-required)",
    "packages/plugins/plugin-email/src/template-loader.ts (registry loader; row loader removed)",
    "packages/plugins/plugin-email/src/email-plugin.ts",
    "packages/plugins/plugin-email/src/index.ts",
    "packages/plugins/plugin-email/src/email-service.ts (docs)",
    "packages/plugins/plugin-email/src/email-template-door.ts (docblock + refusal text that went false)",
    "packages/plugins/plugin-email/src/templates/auth-templates.ts (docs)",
    "packages/plugins/plugin-email/src/bootstrap-declared-email-templates.ts (deleted)",
    "packages/plugins/plugin-email/src/bootstrap-declared-email-templates.test.ts (deleted; rewritten as template-loader.test.ts)",
    "packages/plugins/plugin-email/src/template-loader.test.ts (new)",
    "packages/plugins/plugin-email/src/builtin-auth-render-identity.test.ts (new)",
    "packages/plugins/plugin-email/src/email-plugin.template-runtime-write.test.ts (rewritten)",
    "packages/plugins/plugin-email/src/plugin-shutdown-detaches-template-bridge.test.ts (rewritten)",
    "packages/plugins/plugin-email/src/template-locale-resolution.test.ts",
    "packages/plugins/plugin-email/src/{auth-email-change-notice,auth-templates-locales,plain-text-faces,email-template-door}.test.ts (prose)",
    "packages/plugins/plugin-email/src/{email-plugin.attachment-storage,email-plugin.mail-settings,email-plugin.outbox-sweep,email-plugin.queue-delivery,sender-address-validation}.test.ts (retired seedTemplates option removed)",
    "packages/qa/dogfood/test/email-template-boot-sweep.test.ts, email-template-materialization.dogfood.test.ts, email-template-overlay-survives-boot.dogfood.test.ts (declared on #6024)",
    "examples/app-showcase/test/email-template-locale.test.ts",
    "packages/services/service-automation/src/builtin/notify-node.ts (description)",
    "packages/platform-objects/src/audit/sys-email-template.object.ts (header + provenance comment; declared on #6367)",
    "packages/spec/liveness/email_template.json (hand re-anchor), packages/spec/liveness/README.md, packages/spec/liveness/state-counts/email_template.md (generated)",
    "packages/spec/src/contracts/email-service.ts, src/automation/io-node-config.zod.ts, src/system/email-template.zod.ts, src/system/notification.zod.ts (describe/TSDoc only), src/automation/io-node-config.test.ts (pin flip)",
    "content/docs/references/automation/io-node-config.mdx, content/docs/references/system/email-template.mdx (gen:docs)",
    "content/docs/automation/email-templates.mdx (cross-lane, commit 94ab10722)",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (censuses)",
    "scripts/engine-double-contract.baseline.json, scripts/objectql-double-limit.baseline.json, scripts/isystem-census.mjs, scripts/measure-durability-swallow-family.mjs (gate-forced)"
  ],
  "open_questions": [
    {
      "question": "Q1. email_template.category and email_template.isSystem lose their only consumer when this PR retires the row projection (category fed a Setup column and index; isSystem fed the built-in seeder's stand-down). Measured: no reader in this repository; at the .objectui-sha pin 0df67f23 objectui reads both only as Studio editor inputs (metadata-admin/default-schemas.ts), never as the list facet email-template.zod.ts promises for category. The ledger grades both dead. Because category is schema-defaulted ('custom'), every template carries it, so the dead-property advisory fires on every email template and no author can clear it; packages/lint's group-C control cases (runtime-gate.inert-type-writes.test.ts, 2 cases) are red on this branch. What happens to the two keys, and how does this PR land?",
      "options": [
        "A. Retire both keys (ADR-0049 enforce-or-remove) via the spec-property-retirement playbook: retiredKey tombstones, an ADR-0087 conversion stripping them from sources, the built-in templates / showcase / fixtures dropping them, and the objectui editor fields removed with a pin bump in the same landing (Studio's editor sends category 'custom' on every save, so a tombstone without the objectui fix breaks every Studio template save — Post-Task section 4). Folded into this PR (lifting the no-schema-shape-change fence) or as a sibling that lands with it. Cost: a schema shape change, a cross-repo landing and a larger PR.",
        "B. Land this PR as is with both keys graded dead, and update the two packages/lint control cases to the measured truth (the advisory on `category` is correct information), declared on the lint lane; dispatch A as the next card. Cost: an unclearable advisory on every email template on unreleased main (the v18 `next` line) until A lands; one packages/lint edit outside this claim's surface.",
        "C. Give the keys consumers: build the Studio list facet for category (objectui) and a delete gate for isSystem. Cost: new cross-repo capability with no measured pull; the built-ins are code-declared items, so the metadata door can only discard an environment item over them already.",
        "D. Keep both keys graded live, citing the objectui editor input. Cost: the ledger rule forbids grading a row live to silence it; an editor input echoes what the author typed and changes no runtime behaviour."
      ],
      "recommendation": "B, then A immediately. Business need (measured): nothing reads either key after this change in either repository, and no deployment depends on the promised category facet, so the end state is removal; C is speculative. Long-term soundness: A is the enforce-or-remove end state; B reaches it in two landings with an honest ledger at every commit; D falsifies the ledger. Preventing AI mistakes: A is strongest (a no-op key refused at authoring); B tells the truth meanwhile (the advisory says the key does nothing), D hides a no-op key from every author and AI. Startup focus: A retires immediately and is preferred on this axis; B's interval lives only on an unreleased prerelease line, not a user-facing deprecation window. B over A-in-this-PR because A needs a schema shape change and an objectui fix with a pin bump, both outside this dispatch's fence, on a PR already at 4490 changed lines; if the maintainer prefers one landing, A folded in is the alternative. No option adds a gate."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: public door — PUT /api/v1/meta/email_template/showcase_task_done_email with locale en-US, then the same name with locale zh-CN, then a restart: GET /meta and the effective list serve the PACKAGE wording for en-US (the en-US overlay is gone at rest: sys_metadata keeps one row per (type, name), now the zh-CN body), while before the restart both locales read as saved. Measured on the showcase (orgContext true) at d8c7d3864; the retired row path reverted the en-US sending row at boot the same way, so it is pre-existing and not caused by this PR · evidence: scratch readings R4/R5, sys_metadata rows [zh-CN only] after the second save · dedupe words: email_template overlay locale; sys_metadata overlay unique type name; i18n bundle member overwritten; second locale save restart",
    "class: a · reach: `pnpm check:platform-checklist` on origin/main 69d421805 exits 1 with 8 findings: ABSENT SYMBOL anonymousFormIntakeOrgScopeRefusal / anonymousFormIntakeReopenRefusal / envWideRawViewRows / countable in packages/metadata-protocol/src/protocol.ts, canEdit in packages/services/service-storage/src/attachment-access-hooks.ts, and the attachments-storage symbol-anchor floor 27 of 28 (docs/qa/platform-checklist/areas/access-security.json, attachments-storage.json, search.json) · evidence: scratch worktree at origin/main, identical to this branch's reading · dedupe words: platform-checklist absent symbol; checklist symbol anchors protocol.ts; attachments-storage anchor floor",
    "carrier: 承接者:无 · noted, not filed (comment-only references to the retired names, outside this surface): packages/objectql/src/registry.ts (deactivateDeclaredEmailTemplate in a comment), packages/objectql/src/registry-i18n-bundle-key.test.ts (two comments), packages/spec/src/stack-email-template-locale-floor.test.ts (a comment naming createSysEmailTemplateLoader), packages/spec/scripts/liveness/proof-registry.mts (the email-template-materialization class prose says the template is materialized into a sys_email_template row), packages/qa/dogfood/test/fixtures/email-template-materialization-fixture.ts (header and the manifest description string). In the PR's Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed: EmailServicePlugin.destroy() leaves the sys_email outbox drain hook (afterInsert, packageId com.objectstack.service.email.drain) bound on the engine after kernel shutdown; observable only when the engine outlives its kernel. Not in the PR body (written once); the seat may add it to Acceptance notes."
  ]
}

Generated by Claude Code

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

Why the seat can answer it: NORTH-STAR 阶段姿态 already says how a declared-but-unenforced key leaves: 「声明了但不兑现的键按发布批量退役,不一键一卡」. Stage 2 makes email_template.category and email_template.isSystem exactly that, so they join the next enforce-or-remove batch, and this PR is not where they retire. What is left is sequencing between technical tasks, which the seat answers without escalating. The maintainer sees it in the Tier H 维护者速读 this PR needs anyway (4,490 changed lines), and may veto.

Not A here: retiring the keys is a schema shape change plus an objectui editor change and a console pin bump (Studio sends category: 'custom' on every save). That is the batch's landing, outside this PR's fence and its lanes.
Not C: consumers with no measured demand. Not D: the ledger rule forbids grading an echo-only key live.
The two packages/lint cases are the design working: lint-liveness-properties.test.ts says so itself ("a future regression that re-deadens a prop starts warning again on its own"). They are updated in this PR to pin the measured truth, and they cite [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876.

Filed in this act: #22876 (finding, Blocked-by: #15205: both keys into the retirement batch) and #22877 (finding: a second locale's Studio save replaces the first at the next boot; pre-existing, from the report's out-of-scope list).

Claim amendment (file surface, same round): beyond 6109130514, the PR also writes, each the minimum a gate or a now-false text required: the two packages/lint group-C cases (runtime-gate.inert-type-writes.test.ts, lint-liveness-properties.test.ts) and packages/spec/src/automation/io-node-config.test.ts (declared on #6017 in this act); content/docs/automation/email-templates.mdx (it described the retired materialization path; declared on #6023 in this act); the regenerated censuses and reference pages; scripts/{engine-double-contract.baseline.json,objectql-double-limit.baseline.json,isystem-census.mjs,measure-durability-swallow-family.mjs} (shrink-only rows and one re-pointed control, each named in the PR).

Next: a patch round on PR #22875 (the two lint cases, then the gates on the final head), the seat review, the CONTRACT_REVIEW_TIER review of record, and the Tier H closing (ACCEPT, needs-user-decision on the PR, the final 维护者速读, review requested from the authorized approvers).

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "summary": "This is the patch round after the seat answered Q1 with B. The branch keeps email_template.category and .isSystem graded dead (#22876 retires them). packages/lint now pins the measured advisory instead of silence, and its suite passes. In runtime-gate.inert-type-writes.test.ts, the group-C case is split: the mapping row is unchanged under its old title, and the email_template case asserts exactly one liveness-dead-property advisory, on category. The shipped-corpus control asserts the same single advisory. In lint-liveness-properties.test.ts, a template that sets neither key still warns about nothing, while category and a truthy isSystem each draw one dead-property advisory. All comments cite #22876. Each flipped expectation was ablated once and went red. origin/main 0253192f7 was merged and the censuses regenerated. On the final head 33641fe78 the gates reconcile 136 of 136.",
  "tests": "All at head 33641fe78. The worktree was re-created from origin/claude/issue-15205-registry-loader at 1cc2da623. Exit codes were captured before any pipe. Every build and test went through os-verify-lock (slot issue-15205) in the foreground. BUILD: spec 1/1 (VERDICT command-exit 0). The dogfood, showcase and lint closures 'Tasks: 63 successful, 63 total' (VERDICT command-exit 0). Gate prerequisites: the client, client-react and organizations closures 51/51; studio, embedder-openai, knowledge-memory, knowledge-ragflow, service-cluster-redis and service-knowledge 22/22. LINT: the two flipped files 'Test Files 2 passed (2) / Tests 142 passed (142)'. Full suite 'Test Files 137 passed (137) / Tests 6461 passed (6461)'. Typecheck OK; the test-layer debt (2 files) belongs to other files and is unchanged. PLUGIN-EMAIL: 'Test Files 33 passed (33) / Tests 515 passed (515)'. DOGFOOD: email-template-boot-sweep, email-template-materialization and email-template-overlay-survives-boot 'Tests 9 passed (9)'. ABLATIONS via scripts/ablation-replace.mjs, in WRAP mode, each restored with blob == HEAD and an empty git diff HEAD; the whole-tree status was empty after all four. L1: the group-C email_template case put back to advisories toEqual([]), '1 failed | 141 passed'. L2: the corpus control put back to email.advisories toEqual([]), '1 failed | 141 passed'. L3: the category template put back to toEqual([]), '1 failed | 141 passed'. L4: the isSystem: true template put back to toEqual([]), '1 failed | 141 passed'. GATES: dispatch-gates --commands at 33641fe78 derived 136, the same list as the previous round. --ran gives 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). 135 exited 0. check:skill-examples and check:dual-build-cjs-loads first answered exit 3 (PREREQUISITE NOT MET in this fresh worktree) and passed on re-run after the builds above. check:platform-checklist exits 1 with 8 findings, the identical 8 as origin/main 69d421805 (diff of the finding lines is empty), so they are pre-existing.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git pushes are not REST writes. Zero label writes. No PR body write: the round's description is under the seat-append heading below, for the seat to append.",
  "gates": "136 derived, 136 run, 0 NOT-MEASURED at 33641fe78. 135 exited 0. check:platform-checklist exited 1; it is pre-existing on origin/main 69d421805 with the identical 8 findings.",
  "line_budget": "4575 changed lines (additions 1581 + deletions 2994, generated included) against merge base 0253192f7, across 49 files. That is over 3000, so it lands the Tier H way. No governed surface is touched.",
  "deviations": [
    "The order named lint-liveness-properties.test.ts's 'does not warn on a well-formed email_template' as a case to flip, but that case was green on this branch: its template sets neither dead key. The two measured reds were both in runtime-gate.inert-type-writes.test.ts: the group-C email_template case, and the shipped-corpus control, which the order did not name. I flipped both reds. I also re-pinned the liveness case to the measured truth: silence without the keys, and one dead-property advisory each for category and a truthy isSystem.",
    "To keep the mapping group-C row byte-unchanged in its assertions and title, the it.each(GROUP_C) case was split into a mapping `it` and an email_template `it`. The total test count is unchanged (142 across the two files).",
    "The advisory's property path is read from the 'sets `X`' token in its message, because no structured field carries it. That is the identity convention the file's own ruleOf helper uses. The message wording is not asserted.",
    "origin/main moved on to f9ebb7dd3 after the merge of 0253192f7. dispatch-gates reported that none of those commits touched what it derives from; I did not merge again, and CI's merge ref validates."
  ],
  "files_changed": [
    "packages/lint/src/runtime-gate.inert-type-writes.test.ts",
    "packages/lint/src/lint-liveness-properties.test.ts",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (censuses regenerated on the merged tree; hand-written figures 232->227, 157->155, 75->72, 127->122)",
    "merge commit 81ec7792b (origin/main 0253192f7)"
  ],
  "seat_append": "## Patch round: the seat's answer B to Q1\n\nThe seat answered Q1 with B (seat answer on #15205): email_template.category and .isSystem land graded dead. #22876 retires them in the next enforce-or-remove batch.\n\n- `packages/lint/src/runtime-gate.inert-type-writes.test.ts`: the group-C case is split. `mapping` keeps its assertions under its old title. The `email_template` case now pins exactly one advisory: rule `liveness-dead-property` on property `category`. The shipped-corpus control pins the same single advisory for the showcase template; its `isSystem: false` draws nothing. Identity is read as the rule id plus the property token in `sets` + backtick path, the convention `lint-liveness-properties.test.ts`'s `ruleOf` already uses. The message wording is not asserted.\n- `packages/lint/src/lint-liveness-properties.test.ts`: a template that sets neither key still warns about nothing. Setting `category` draws one dead-property advisory, and so does `isSystem: true`. Both comments cite #22876 as the retirement that will remove these advisories.\n- The lint rule, the ledger grading and the schema are not edited.\n- Ablations through `scripts/ablation-replace.mjs` put the old expectation back in each flipped case, one at a time. All four went red (L1 group-C, L2 corpus control, L3 category, L4 isSystem: 1 failed of 142 each). Each was restored with blob == HEAD and an empty `git diff HEAD`.\n- `origin/main` `0253192f7` merged as `81ec7792b`. The census conflicts were resolved to main's side, my row-58 sentence was re-applied, and the censuses were regenerated in `33641fe78`.\n- Evidence at `33641fe78`:\n  - `packages/lint`: 137 files / 6,461 tests pass; typecheck OK.\n  - `plugin-email`: 515/515.\n  - The three dogfood email-template files: 9/9.\n  - `dispatch-gates`: 136 derived, 136 run, 0 NOT-MEASURED. 135 exit 0. `check:platform-checklist` exits 1 with the same 8 findings as `origin/main` `69d421805`, so they are pre-existing.\n- Changed lines are now 4,575 (+1,581 / −2,994) against merge base `0253192f7`.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Claim amendment (Clause-②) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T19:10Z

Amends the claim 6109130514. Thread-read: 6112531099.

Clause-②: no (narrowing)

The claim's line read no and named no direction. It is corrected, and the error was the seat's own. PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 retires published exports of @objectstack/plugin-email: createSysEmailTemplateLoader and its two types, bootstrapDeclaredEmailTemplates, upsertDeclaredEmailTemplate, deactivateDeclaredEmailTemplate, mapTemplateToRow, EMAIL_TEMPLATE_OBJECT, BootstrapDeclaredEmailTemplatesResult, and the seedTemplates / templates plugin options. That is a BREAKING narrowing of the package's public face, and it widens nothing.
The changeset already says BREAKING and grades minor for the launch window, which is the grade the narrowing arm owes. Only the declaration line changes: on this claim, on the PR body's second line, and in the changeset.
File surface, scope and serial constraints: unchanged.

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "4aa656e7a2f67d213e01a885960d281937483c03 (was 33641fe78; git ls-remote confirms the branch head after the push)",
  "summary": "Patch round 3. In .changeset/15205-email-templates-resolve-registry.md the line 'Clause-②: no' now reads 'Clause-②: no (narrowing)', matching the claim amendment 6112650531. No other byte of the changeset changed: the BREAKING banner, the minor grade and the ADR-0087 disposition stay. It landed as one commit, 4aa656e7a 'chore(changeset): the 15205 changeset declares Clause-②: no (narrowing)', with the model-free trailer pair, and was pushed to claude/issue-15205-registry-loader. Every gate whose family covers the changeset path was run at 4aa656e7a and exited 0. The ADR-0087 gate now counts the narrowing arm as a breaking signal and accepts the unchanged disposition. The PR body was not edited: the seat edits line 2 and appends the round text.",
  "tests": "All runs are at head 4aa656e7a, in the foreground. Each exit code was captured right after the command, with output redirected to a file and no pipe. The worktree was re-created at 33641fe78, the remote head. origin/main was not merged. pnpm install --frozen-lockfile exited 0. It was needed because the first check-adr-0087-registration run exited 1 on a missing prerequisite: 'the witness generator's runner tsx is not installed', fix 'run pnpm install first'. That is a prerequisite miss, not a red gate. Both ADR-0087 commands were re-run after the install. CHANGESET GATES: node scripts/check-changeset-no-major.mjs --base origin/main: exit 0, 'This diff introduces no major bump.' With no payload in a local run, the level axis printed NOT APPLICABLE. The same gate in CI mode, GITHUB_EVENT_NAME=pull_request and --base 0253192f7 (the merge base) --event with a payload built from PR 22875's live body and labels: with body line 2 set to 'Clause-②: no (narrowing)', exit 0, 'LEVEL AXIS: this PR declares clause-② no (narrowing) ... the declared narrowing is accounted for: @objectstack/plugin-email: minor'; with the current body line 2 'Clause-②: no', exit 0, 'direction arm: none declared'. node scripts/check-adr-0087-registration.mjs --base origin/main: exit 0, '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. .changeset/15205-email-templates-resolve-registry.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. node scripts/check-empty-changeset.mjs --base origin/main: exit 0, '1 declaring changeset(s) added'. DERIVATION: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with no path derives 136 commands for the whole PR change set (49 files against merge base 0253192f7). The same command with the single path .changeset/15205-email-templates-resolve-registry.md derives 20 commands. All 20 were run, each with exit 0: check-adr-0087-registration (--base origin/main, --self-test 463 assertions), check-changeset-no-major (--base origin/main, --self-test 401 assertions), check-empty-changeset (--base origin/main, --self-test 170 assertions), check-closing-keyword-parity and its --self-test, check-comment-mask-corpus (8795 files, 0 disagree), release-rehearsal-clone --self-test, release-pending-publish --self-test, and the pnpm checks changeset-gate-self-tests, objectui-changeset, pm-changeset-deadline-census, driver-memory-census, gitlink-declared, nul-bytes (10916 files, no raw control bytes), published-files, refd-timer-probe and watch-hint-literal. RECONCILE: dispatch-gates --ran with the changeset path gives 'Run reconciliation — 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0, a derived zero). Without a path it gives '136 derived, 20 run, 0 NOT-MEASURED, 116 UNRUN' (exit 1). Those 116 families read the other 48 files, which this round did not touch. They reconciled 136 of 136 at 33641fe78 last round, and this order owed only the changeset families. No package build or test was run, and none was owed.",
  "gates": "Changeset path at 4aa656e7a: 20 derived, 20 run, 20 exit 0, 0 NOT-MEASURED, 0 UNRUN. The disposition was not changed, because no gate named a reason to change it.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits. One REST read: GET /repos/objectstack-ai/objectstack/pulls/22875 (body and labels for the CI-mode payload).",
  "line_budget": "Still 4575 changed lines (+1581 / -2994) across 49 files against merge base 0253192f7. The edited line sits in a file this PR adds, so the count did not move.",
  "deviations": [
    "dispatch-gates printed STALE TREE: the tree is at least 6 commits behind origin/main 72b26ed4f, and one derivation input changed in that range, scripts/engine-double-contract.pinned.json. That file belongs to the engine-double-contract family, not to any family covering .changeset/. The order said not to merge unless a gate named a reason, and no changeset gate did, so origin/main was not merged. CI's merge ref reads the current main.",
    "The 'mode CI uses' was exercised beyond the derived '--base origin/main' form. pr-automation.yml runs '--base \"$MERGE_BASE\"' with GITHUB_EVENT_PATH, so I re-ran the gate with --event on a synthetic payload: the live PR body and labels, and a variant with line 2 as the seat will edit it. The level axis reads the PR body's declaration, not the changeset's. The changeset's Clause-② line is read by check-adr-0087-registration, which counts the narrowing arm as a breaking signal.",
    "pnpm install was run in the worktree (not through the lock, per the role file) because the ADR-0087 gate needs tsx. The worktree was then removed: rm -rf node_modules, then git worktree remove without --force. It exited 0 on a clean tree."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (one line: 'Clause-②: no' to 'Clause-②: no (narrowing)')"
  ],
  "seat_append": "## Patch round 3: the changeset's Clause-② line carries the narrowing arm\n\nOne commit, `4aa656e7a` on top of `33641fe78`, changes one line of `.changeset/15205-email-templates-resolve-registry.md`: `Clause-②: no` is now `Clause-②: no (narrowing)`. That matches the claim amendment 6112650531: the PR retires published exports and options of `@objectstack/plugin-email`, which is a breaking narrowing that widens nothing. No other byte of the changeset moved. The BREAKING banner, the `minor` grade for `@objectstack/plugin-email`, the two `patch` rows and the ADR-0087 marker `not-required (no-migration-prescription)` are all as before. `check-adr-0087-registration --base origin/main` exits 0. It now reads the changeset as `[BREAKING+bang+clause-②-narrowing]` and accepts the unchanged disposition, so no gate asked for the disposition to change. `check-changeset-no-major --base origin/main` exits 0. In the mode CI uses, I passed `--base` the merge base `0253192f7` and `--event` a `pull_request` payload built from the PR's live body and labels, with line 2 as the seat will set it. That run also exits 0 and reports: LEVEL AXIS: this PR declares clause-② `no (narrowing)`… the declared narrowing is accounted for: `@objectstack/plugin-email: minor`. That axis reads the PR body, so it reads the arm only once line 2 of the body is edited. Against the current body (`Clause-②: no`) it also exits 0, with no arm declared. `check-empty-changeset --base origin/main` exits 0. `dispatch-gates --commands` for the changeset path derives 20 commands. All 20 were run at `4aa656e7a`, and all 20 exited 0. `--ran` gives `20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN`. Changed lines are unchanged at 4,575, because the changeset is a file this PR adds. No package build or test was owed, and none was run.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Patch round 3: the changeset's Clause-② line carries the narrowing arm

One commit, 4aa656e7a on top of 33641fe78, changes one line of .changeset/15205-email-templates-resolve-registry.md: Clause-②: no is now Clause-②: no (narrowing). That matches the claim amendment 6112650531: the PR retires published exports and options of @objectstack/plugin-email, which is a breaking narrowing that widens nothing. No other byte of the changeset moved. The BREAKING banner, the minor grade for @objectstack/plugin-email, the two patch rows and the ADR-0087 marker not-required (no-migration-prescription) are all as before. check-adr-0087-registration --base origin/main exits 0. It now reads the changeset as [BREAKING+bang+clause-②-narrowing] and accepts the unchanged disposition, so no gate asked for the disposition to change. check-changeset-no-major --base origin/main exits 0. In the mode CI uses, I passed --base the merge base 0253192f7 and --event a pull_request payload built from the PR's live body and labels, with line 2 as the seat will set it. That run also exits 0 and reports: LEVEL AXIS: this PR declares clause-② no (narrowing)… the declared narrowing is accounted for: @objectstack/plugin-email: minor. That axis reads the PR body, so it reads the arm only once line 2 of the body is edited. Against the current body (Clause-②: no) it also exits 0, with no arm declared. check-empty-changeset --base origin/main exits 0. dispatch-gates --commands for the changeset path derives 20 commands. All 20 were run at 4aa656e7a, and all 20 exited 0. --ran gives 20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN. Changed lines are unchanged at 4,575, because the changeset is a file this PR adds. No package build or test was owed, and none was run.

Generated by Claude Code

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

Claim 6109130514, amended 6112650531 (Clause-②: no (narrowing)). Reports checked against GitHub, ⛔ not taken on trust: 6112531099 (the seat's answer B to Q1, 6111829211) and 6112807145 (the changeset line). Both rounds' text is appended to the PR body, and its second line carries the arm (relay read-back: every byte stored).

Checklist, as checked:

PR shape: draft, base main, assignee zhuangjianguo. Line 1 Fixes #15205, line 2 Clause-②: no (narrowing); no other closing keyword.
Scope and size: 49 files (+1,581 / −2,994), 4,575 changed lines. check-governed-merges: 0 of 49 paths governed, and over 3,000 lines, so this is the human-merge terminal (Tier H).
The loader, read in full (template-loader.ts):
- createRegistryEmailTemplateLoader reads email_template at every load from the protocol's layered execution list, falling back to the ObjectQL registry only on a host with no protocol service.
- Within one (name, locale) slot, any item not under com.objectstack.service.email wins over the built-in. stripReadDecorations removes only _diagnostics / _draft, so _packageId survives the strip.
- The locale ladder is the row loader's. A failed read propagates. A malformed item throws the schema's message instead of falling through to the built-in.
The plugin (email-plugin.ts): the built-ins are registered through the plugin's own manifest as code-declared items. No row is read or written on boot or send. The organization door on sys_email_template stays closed. The projector, its listener and its subscription are gone, so an email_template save carries no projectionApplied receipt.
Byte identity: builtin-auth-render-identity.test.ts holds all 24 built-ins (6 names × 4 locales) to the digests the seeded-row path produced. The two paths were run side by side at 924da8d8a before the row path was deleted.
Pins and ablations: the pins are rewritten against the loader, not deleted. The dogfood statement pin shows no sys_email_template statement on boot or send. Ablations A1–A9 and L1–L4 were each red as predicted and restored by blob.
Q1, as answered (B): category and isSystem land graded dead. packages/lint pins the one dead-property advisory they draw (rule id and property path, not wording), and [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876 carries their retirement.
packages/spec: describe text and the liveness ledger only, with no schema shape change. Spec property liveness is green on CI.
Prose surfaces, sentence by sentence against the diff:
- The changeset's "What changes" bullets match the loader, the manifest registration, the removed projector and the closed door. Its FROM → TO list matches the src/index.ts diff export by export, including the two plugin options. "A deployment observes" states the transitional cost ruling C accepts.
- content/docs/automation/email-templates.mdx (its own droppable commit 94ab10722) and the regenerated references/system/email-template.mdx now describe registry resolution.
- The seat re-read every other hand-written page that names email templates: automation/index.mdx, kernel/runtime-services/email-service.mdx, getting-started/quick-start.mdx, concepts/metadata-lifecycle.mdx, automation/jobs.mdx, automation/flows.mdx and deployment/environment-variables.mdx. None says a template is seeded into, projected into or read from rows. metadata-lifecycle.mdx's email_template row marks per-org override as allowed. The type's registry entry is unchanged here, and that org-overlay axis is C5's (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206), as triage placed it in 6018661841.
Gate-forced edits outside the surface: the shrink-only baseline rows, the isystem-census row for the deleted module, the re-pointed swallow-family control and the regenerated censuses. Each is the minimal answer to a gate naming retired code, and each is declared in the body. Accepted.
CI: 33641fe78 was all green: 33 success, 2 skipped. On 4aa656e7a2 (one changeset line) 23 success, 4 skipped and 12 in progress at this stamp, none failed. Landing waits for that run.

Out of scope, dispositions:

The built-in auth templates still declare category: 'auth' and isSystem: true, which now draw the advisory. Carrier: [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876, which removes both keys.
One locale's Studio save replaces another locale's overlay at rest (sys_metadata keeps one row per type and name). Filed as [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877.
check:platform-checklist fails locally with the same 8 findings on main 69d421805. That is pre-existing and not this PR's.

Landing: a CONTRACT_REVIEW_TIER record is owed. The diff changes published schema files (describe text), and the PR declares a breaking narrowing. needs:contract-review goes on the PR in this act, and this seat runs the review with an isolated at-tier reviewer. On PASS with green CI, this goes to the human-merge terminal: needs-user-decision on the PR, the final 维护者速读, and review requested from os-zhuang and hotlong. ⛔ No seat flips it ready or enqueues it before an authorized approval.

Generated by Claude Code

Claim amendment (Clause-②, second) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T21:20Z

Amends the claim 6109130514 and supersedes the first amendment 6112650531. Thread-read: 6112901622. The at-tier review FAIL 6113872462 on PR #22875 is answered here for the declaration line.

Clause-②: yes (narrowing)

The first amendment read only half the diff, and that error was again the seat's own. PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 narrows @objectstack/plugin-email's public face: nine exports and two plugin options retire. It also widens it: createRegistryEmailTemplateLoader and the type EmailTemplateRegistrySources are new names reachable from the package's single exports entry. A diff that widens one surface and narrows another is declared yes (narrowing), the spelling scripts/pm/clause2-line.mjs reserves for it.
The level owed is unchanged. @objectstack/plugin-email already ships minor with the BREAKING banner, which is what a widening owes as a minimum and what a narrowing ships during the launch window. The line changes on three carriers: this claim, the PR body's second line and the changeset.
File surface, scope and serial constraints: unchanged.

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "0f1906217a83ce3381bc90bab6db5dee15d5ebf5 (was 4aa656e7a; 2c11a7675 changeset, 0f1906217 ledger; git ls-remote confirms the branch head after the push)",
  "summary": "Patch round 4, answering the at-tier review FAIL 6113872462 with the three dev edits the seat named. The changeset's Clause-② line now reads 'yes (narrowing)', matching claim amendment 6113893432. Its ADR-0087 marker keeps not-required (no-migration-prescription) and gains one why sentence naming the FROM → TO block as a compiler-carried code change and the vocabulary gap the maintainer is asked to rule. The email_template liveness ledger's objectui evidence (label, description) and dead notes (category, isSystem) are re-measured at the tree's .objectui-sha pin 4997995022f8 and restated there with file:line. No reading changed from 0df67f23, so no grade moves. The PR body, the claim, the drain-hook carrier and the platform-checklist note are the seat's and were not touched.",
  "tests": "Worktree re-created at 4aa656e7a, the remote head. origin/main was not merged: dispatch-gates printed STALE TREE (12 commits behind, scripts/check-route-envelope.mjs and scripts/engine-double-contract.pinned.json changed), but neither file is in the derived families for these paths, and no gate named a reason to merge. pnpm install --frozen-lockfile exited 0. Every gate run below is at the committed head 0f1906217, in the foreground. Each exit code was captured right after the command, with output redirected to a file and no pipe. DERIVATION: dispatch-gates --commands --repo objectstack-ai/objectstack with the two changed paths derives 60 commands, the same list before and after the commits. RESULTS: 57 exited 0. That includes pnpm --filter @objectstack/spec run check:liveness ('every governed-type property ... is classified'; 'state-counts/ is current ... the same 41 row(s) as the README'). It also includes node scripts/check-adr-0087-registration.mjs --base origin/main: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. .changeset/15205-email-templates-resolve-registry.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)', with the reason ending in the new sentence, so the gate did not object. The others at exit 0 are check-changeset-no-major and check-empty-changeset (--base origin/main and --self-test), changeset-gate-self-tests, objectui-changeset, published-files, nul-bytes, strictness-ledger, variant-docs, empty-state, cross-package-test-inputs, test-source-alias, comment-mask-corpus (8795 files, 0 disagree), and the rest of the list. check:dts-closure ('14 built package(s) swept - 75/75 declared declaration file(s) present'), check:sourcemap-no-sources-content ('105 map(s), none embed source text') and check:lean-entry-closure ('Admitted set held exactly (15 packages)') exited 0 after the objectql closure was built: os-verify-lock slot issue-15205, 'pnpm turbo run build --filter=@objectstack/objectql --concurrency=2', 'Tasks: 14 successful, 14 total', 'VERDICT command-exit 0 · held the lock 189s · waited 0s' (shared-box seconds). git status was clean after the build. check:platform-checklist exited 1 with 8 findings: ABSENT SYMBOL anchors in areas/access-security.json, attachments-storage.json and search.json, plus the attachments-storage symbol-anchor floor. The same gate run in a detached control worktree at origin/main 45e206e49 exited 1 with the identical 8 lines (diff empty), so they are pre-existing and not this PR's. check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET ('some package has no dist/', 107 entry points): NOT MEASURED, reason below. CI MODE: check-changeset-no-major with GITHUB_EVENT_NAME=pull_request, --base 0253192f7 (the merge base) and --event a payload built from PR 22875's live body and labels, with line 2 set to 'Clause-②: yes (narrowing)': exit 0, 'LEVEL AXIS: this PR declares clause-② yes (narrowing) ... the declared narrowing is accounted for: @objectstack/plugin-email: minor'. RECONCILE: dispatch-gates --ran with the two paths gives 'Run reconciliation — 60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN' ('1 DERIVED from a recorded exit 3', exit 0). Without paths it gives '136 derived, 59 run, 1 NOT-MEASURED, 76 UNRUN' (exit 1). Those 76 families read the PR's other 47 files, which this round did not touch, and they reconciled 136 of 136 at 33641fe78 two rounds ago. OBJECTUI RE-MEASUREMENT: an anonymous blobless clone (credential helper off) checked out at 4997995022f8e65946f6362b7434685539cc72b7. 0df67f23 is an ancestor of it: merge-base --is-ancestor exit 0, which is self-proving. git diff 0df67f23..4997995022f8 covers 7 commits and 80 files; none of the cited files appears, and 0 changed lines match category, isSystem, is_system, email.?template, listColumns or defaultColumns (case-insensitive). No package test was owed: the edits are a changeset and a ledger JSON that no build or test source compiles in.",
  "gates": "Two changed paths at 0f1906217: 60 derived, 59 run, 1 NOT-MEASURED (check:dual-build-cjs-loads, exit 3), 0 UNRUN. 57 exit 0. check:platform-checklist exit 1 is pre-existing, with the identical 8 findings on origin/main 45e206e49.",
  "not_measured": [
    "NOT MEASURED: check:dual-build-cjs-loads, reason: it needs every workspace package's dist/ (107 entry points), and only the 14-task objectql closure was built. This is a declared narrowing. The diff changes no build input of any package: the ledger JSON is shipped raw through spec's files[] 'liveness' entry, @objectstack/lint reads it at runtime (lint-liveness-properties.ts joins the spec package dir with 'liveness'), only statuses feed lint and none moved, and the changeset feeds no build. So this gate's verdict is the same as on 4aa656e7a, where the head's check-runs read 0 failed (review record 6113872462). CI runs it in full."
  ],
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits, zero claim or card writes. REST reads only: GET issues/comments/6113872462 (the review), GET issues/comments/6113893432 (the claim amendment), GET pulls/22875 (body line 2 and labels for the CI-mode payload), and a GET read-back of this comment. The objectui clone was an anonymous git fetch, not a REST call.",
  "line_budget": "Still 4575 changed lines (+1581 / -2994) across 49 files against merge base 0253192f7. The changeset is a file this PR adds, and the ledger lines edited were already PR-changed lines, so the net count did not move.",
  "deviations": [
    "The first gate pass ran before the commits, and it read the committed HEAD 4aa656e7a, not the working tree: the ADR-0087 reason printed without the new sentence. That pass is superseded and not counted. Everything was re-derived and re-run from scratch at 0f1906217, the committed head, and those are the results reported.",
    "Two commits instead of one: chore(changeset) for the Clause-② line and the marker sentence, and fix(spec) for the ledger re-measurement. Both carry the model-free trailer pair; the pre-push check:commit-card-trailers passed for both.",
    "The label and description evidence each gained a second objectui citation, default-schemas.ts#registerDefaultMetadataSchemas:336. It is the file:line behind the existing 'registers no listColumns of its own' claim, re-attributed with its own 'objectui @4997995022f8:' realm marker after the first clause, so the liveness evidence scanner keeps it foreign. The notes use the historical spelling 'measured at the .objectui-sha pin 4997995022f8'.",
    "The built objectql closure's dist/ was removed together with the worktree (rm -rf node_modules, then git worktree remove without --force, exit 0 on a clean tree). The objectui clone and the control worktree were removed too."
  ],
  "files_changed": [
    ".changeset/15205-email-templates-resolve-registry.md (Clause-② line to 'yes (narrowing)'; one sentence appended to the ADR-0087 marker's why)",
    "packages/spec/liveness/email_template.json (label and description evidence and notes, category and isSystem dead notes, restated at objectui 4997995022f8 with file:line)"
  ],
  "seat_append": "## Patch round 4: the review FAIL 6113872462, the three dev edits\n\nTwo commits on `4aa656e7a`, now at `0f1906217`. (1) `2c11a7675` changes `.changeset/15205-email-templates-resolve-registry.md` from `Clause-②: no (narrowing)` to `Clause-②: yes (narrowing)`, matching the claim amendment 6113893432. The `minor` grade and the BREAKING banner stay. In the same commit, the ADR-0087 marker keeps `not-required (no-migration-prescription)` and its why gains one sentence: the body's FROM → TO block for the retired runtime exports and plugin options is a code change the compiler carries, not a metadata migration for `objectstack migrate meta`, and ADR-0087's disposition vocabulary has no category that fits this shape exactly, so the maintainer is asked to rule the reading. `check-adr-0087-registration --base origin/main` exits 0 on the commit and prints that sentence inside its reason, so it did not object. (2) `0f1906217` restates the `email_template` ledger's cross-repo evidence at the tree's `.objectui-sha` pin `4997995022f8`. It covers the `label` and `description` evidence and notes, and the `category` and `isSystem` dead notes. Each read was re-measured in an anonymous blobless clone of objectui at `4997995022f8e65946f6362b7434685539cc72b7`, with these file:line readings:\n\n- `ResourceListPage.tsx#defaultColumns` at :835, rendering `label` at :838 and `description` at :839.\n- The fallback at :421, `config.listColumns ?? defaultColumns(...)`.\n- The cell read at :687, `row.item[c.key]`.\n- `default-schemas.ts#registerDefaultMetadataSchemas:336`. `email_template` is registered with `defaultSchema` and `fieldOrder` only. No `listColumns` site or registration names it: the sites are `builtinComponents.tsx`, which covers object, field, permission, view, dashboard, page and book, and `anchors.ts`, which covers object.\n- `category` at `default-schemas.ts:310` and `isSystem` at `:324`, both editor inputs only. The repo-wide `isSystem` reads are about objects, fields and chat messages. No `category` read touches an `email_template` item outside the editor schema.\n\nNo reading changed between `0df67f23` and `4997995022f8`. The 7 commits between them touch 80 files, but none of the cited files. Not one changed line across the whole diff mentions `category`, `isSystem`, `is_system`, `email_template`, `listColumns` or `defaultColumns`. No grade moves.\n\n`dispatch-gates --commands` for the two changed paths derives 60 commands. `--ran` gives `60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN`. 57 of them exit 0, including `check:liveness`.\n\n- `check:platform-checklist` exits 1 with 8 findings. They are identical, line for line, to a control run on `origin/main` `45e206e49`, so they are pre-existing and not this PR's.\n- `check:dual-build-cjs-loads` is NOT MEASURED (exit 3). It needs every package's `dist/`, and this diff changes no build input: the ledger JSON ships raw, and `@objectstack/lint` reads it at runtime.\n- The objectql closure (14 tasks) was built under the verify lock, so `check:dts-closure`, `check:sourcemap-no-sources-content` and `check:lean-entry-closure` are measured green.\n\nWith body line 2 as `Clause-②: yes (narrowing)`, `check-changeset-no-major` in CI mode (`--event`) exits 0 and reports the declared narrowing accounted for by `@objectstack/plugin-email: minor`. Changed lines stay at 4,575.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Patch round 4: the review FAIL 6113872462, the three dev edits

Two commits on 4aa656e7a, now at 0f1906217. (1) 2c11a7675 changes .changeset/15205-email-templates-resolve-registry.md from Clause-②: no (narrowing) to Clause-②: yes (narrowing), matching the claim amendment 6113893432. The minor grade and the BREAKING banner stay. In the same commit, the ADR-0087 marker keeps not-required (no-migration-prescription) and its why gains one sentence: the body's FROM → TO block for the retired runtime exports and plugin options is a code change the compiler carries, not a metadata migration for objectstack migrate meta, and ADR-0087's disposition vocabulary has no category that fits this shape exactly, so the maintainer is asked to rule the reading. check-adr-0087-registration --base origin/main exits 0 on the commit and prints that sentence inside its reason, so it did not object. (2) 0f1906217 restates the email_template ledger's cross-repo evidence at the tree's .objectui-sha pin 4997995022f8. It covers the label and description evidence and notes, and the category and isSystem dead notes. Each read was re-measured in an anonymous blobless clone of objectui at 4997995022f8e65946f6362b7434685539cc72b7, with these file:line readings:

ResourceListPage.tsx#defaultColumns at :835, rendering label at :838 and description at :839.
The fallback at :421, config.listColumns ?? defaultColumns(...).
The cell read at :687, row.item[c.key].
default-schemas.ts#registerDefaultMetadataSchemas:336. email_template is registered with defaultSchema and fieldOrder only. No listColumns site or registration names it: the sites are builtinComponents.tsx, which covers object, field, permission, view, dashboard, page and book, and anchors.ts, which covers object.
category at default-schemas.ts:310 and isSystem at :324, both editor inputs only. The repo-wide isSystem reads are about objects, fields and chat messages. No category read touches an email_template item outside the editor schema.

No reading changed between 0df67f23 and 4997995022f8. The 7 commits between them touch 80 files, but none of the cited files. Not one changed line across the whole diff mentions category, isSystem, is_system, email_template, listColumns or defaultColumns. No grade moves.

dispatch-gates --commands for the two changed paths derives 60 commands. --ran gives 60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN. 57 of them exit 0, including check:liveness.

check:platform-checklist exits 1 with 8 findings. They are identical, line for line, to a control run on origin/main 45e206e49, so they are pre-existing and not this PR's.
check:dual-build-cjs-loads is NOT MEASURED (exit 3). It needs every package's dist/, and this diff changes no build input: the ledger JSON ships raw, and @objectstack/lint reads it at runtime.
The objectql closure (14 tasks) was built under the verify lock, so check:dts-closure, check:sourcemap-no-sources-content and check:lean-entry-closure are measured green.

With body line 2 as Clause-②: yes (narrowing), check-changeset-no-major in CI mode (--event) exits 0 and reports the declared narrowing accounted for by @objectstack/plugin-email: minor. Changed lines stay at 4,575.

Generated by Claude Code

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

This answers the at-tier FAIL 6113872462 on 4aa656e7a2. Report 6114190447, checked against GitHub. The delta since the ACCEPT 6112901622 is two commits and two files, +8 / −8.

Clause-②: yes (narrowing) on all three carriers: the claim amendment 6113893432, the PR body's second line, and the changeset (2c11a7675). The diff widens (createRegistryEmailTemplateLoader, EmailTemplateRegistrySources, both reachable from the exports entry) and narrows (nine exports and two options retire). The seat's earlier no and no (narrowing) were its own errors. The grade stays minor with the BREAKING banner.
ADR-0087 marker: the category is unchanged, and the why gains one sentence naming the FROM → TO block and the vocabulary gap. The gate exits 0 and prints the sentence. The gap goes to the maintainer through the PR's acceptance notes and the 维护者速读, as the review asked.
Liveness ledger (0f1906217): the objectui evidence is restated at the tree's pin 4997995022f8 with file:line. The seat checked that no cited file is among the files changed between 0df67f23 and 4997995022f8, so no grade moves. check:liveness exits 0.
Drain-hook finding: carrier named in the PR's acceptance notes. Carrier: none, noted and not filed, because its only reach is an engine that outlives its kernel, measured on a test fake.
check:platform-checklist: the known main-side red, closed not_planned by triage twice (check:platform-checklist is red on main #22594, check:platform-checklist is red on main #22758) and kept out of per-PR CI by standing decision. This seat files nothing.

Landing: a fresh CONTRACT_REVIEW_TIER record is owed on 0f1906217a; this seat runs it now. On PASS with green CI, this goes to the human-merge terminal: needs-user-decision on the PR, the 维护者速读, and review requested from os-zhuang and hotlong.

Generated by Claude Code

os-dev-report

{
  "issue": 15205,
  "status": "done",
  "branch": "claude/issue-15205-registry-loader",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22875",
  "session": "session_013LbZ9MhPp1iriZEtgJqioA",
  "premise_still_valid": true,
  "head": "78c3eed6389de37493b25586bfb6c48f02c63188 (was 0f1906217; git ls-remote confirms the branch head after the push)",
  "merge": "be55432f6, parents 0f1906217 (the branch) and 3fdb92db0 (origin/main). New merge base 3fdb92db00b3380bb166e749f377960c42db0831; the old one was 0253192f760b37b5d3da4c4f845aee1c239e6ec2.",
  "summary": "Merge round after the re-review PASS 6114282872. origin/main 3fdb92db0 was merged through scripts/pm/os-regen-merge.sh. The one conflict was the census figures table of content/docs/permissions/system-context.mdx, a MIXED os-regen path with no prose in the hunk. It was resolved to main's figures, keeping the PR's row-58 prose, and then the repo's own generators re-derived every census: gen:system-context-census and tenant-audit-census.mjs --write. 136 of 136 derived gates were run; 135 exited 0, and check:platform-checklist's 8 findings are main's, identical at the merge base. The move is a pure regeneration: only 3 paths' net diffs changed across the merge, and all 3 are generator output. The PR now reads mergeable: true, mergeable_state blocked, no longer dirty.",
  "tests": "Worktree re-created at 0f1906217, the remote head; pnpm install --frozen-lockfile exited 0. MERGE: bash scripts/pm/os-regen-merge.sh, first run exit 1: step 1 stopped on 'CONFLICT (content): Merge conflict in content/docs/permissions/system-context.mdx'. The script's notice read 'NOT deferred: the incoming side carries hand-written changes ... This file is MIXED ... Resolve the prose by hand; the anchor numbers do not matter here — take either side'. The one hunk, at lines 362-376, held only figure rows: ours 128/5/123/120 against theirs 130/6/124/121. It was resolved to theirs, and git diff against MERGE_HEAD then showed only the PR's row-58 line. The resolution was committed as merge be55432f6. The script rerun exited 0: 'RERUN ... recorded base 0253192f7 · pre-merge tip 0f1906217 · main 3fdb92db0'. Step 1 was 'ALREADY IN HEAD'. Step 2 kept the conflicted resolution and kept the branch-only bytes of io-node-config.mdx, email-template.mdx and state-counts/email_template.md, taking nothing from main. Step 3 found 'merge left no additional changes to commit'. STEP 4: @objectstack/spec was built under os-verify-lock (slot issue-15205): 'Tasks: 1 successful', 'VERDICT command-exit 0 · held the lock 105s'. Then pnpm gen:system-context-census exited 0 ('check-system-context-census: OK — 124 elevation read sites in 20 packages across 58 files'), and node scripts/tenant-audit-census.mjs --write exited 0 ('rewrote content/docs/permissions/tenant-audit-census.mdx', 'rewrote docs/audits/2026-08-tenant-audit-write-call-sites.counts.md'). pnpm --filter @objectstack/spec check:generated exited 0: '✓ All 14 generated artifacts are up to date', including check:docs. The staged diff (git diff --cached) was 4+/4- across those 3 files and was committed as 78c3eed63. BUILDS for the dist-reading gates, all under os-verify-lock: dogfood^..., example-showcase... and lint^... gave 'Tasks: 63 successful, 63 total', VERDICT command-exit 0, held 312s, waited 296s. client-react..., organizations..., client..., embedder-openai..., knowledge-memory..., knowledge-ragflow..., service-cluster-redis..., service-knowledge... and studio... gave 'Tasks: 57 successful, 57 total', VERDICT command-exit 0, held 46s, waited 235s. These are shared-box seconds. git status was clean after every build. GATES at 78c3eed63: dispatch-gates --commands --repo objectstack-ai/objectstack derives 136 commands for 49 paths against merge base 3fdb92db0, with no STALE TREE. All 136 were run in the foreground in chunks, each exit code captured right after the command with output redirected to a file. The exception is check:pm-dispatch-gates, which was run detached with nohup, its PID recorded and its exit code written to a file, per the role file ('fast 1828 case(s) in 290.2s', exit 0). 135 exited 0. Among them: check-system-context-census and check-tenant-audit-census (and their --self-tests), check-platform-object-tenancy-census, spec check:generated, check:docs, check:liveness, check:api-surface, check:authorable-surface, check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:engine-double-contract, check:objectql-double-limit, check:swallow-census-controls, check:type-check-coverage, check:type-check-debt, check:i18n and the changeset gates. check:platform-checklist exited 1 with 8 findings (ABSENT SYMBOL anchors in access-security, attachments-storage and search, plus the attachments-storage floor). A control run in a detached worktree at the merge base 3fdb92db0 exited 1 with the identical 8 lines (diff empty), so the findings are main's. RECONCILE: dispatch-gates --ran gives 'Run reconciliation — 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0, 'a DERIVED zero — all 136 recorded an exit code and none of them is 3').",
  "gates": "136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN at 78c3eed63 against merge base 3fdb92db0. 135 exit 0. check:platform-checklist exits 1 with 8 findings identical to the merge base 3fdb92db0 (main's). The census gates, check:generated and check:docs are green.",
  "regen_provenance": {
    "verdict": "PURE REGENERATION. Every path whose net diff differs across the merge is generated, and each differs only in generator-derived figures or stamps.",
    "name_lists": "git diff --name-only 0253192f760b37b5d3da4c4f845aee1c239e6ec2 0f1906217a83ce3381bc90bab6db5dee15d5ebf5 lists 49 paths. git diff --name-only 3fdb92db00b3380bb166e749f377960c42db0831 78c3eed6389de37493b25586bfb6c48f02c63188 lists 49 paths. The two lists are identical (diff of the two outputs is empty). The stat is '49 files changed, 1581 insertions(+), 2994 deletions(-)' on both sides.",
    "content_comparison": "For each of the 49 paths P, I compared git diff --no-color -U0 0253192f7 0f1906217 -- P | grep -E '^[+-]' | grep -vE '^(\\+\\+\\+|---) ' with the same pipeline over 3fdb92db0 78c3eed63. That compares the added and removed lines, ignoring hunk offsets and context.",
    "differing_paths": [
      "content/docs/permissions/system-context.mdx: under merge=os-regen (MIXED) and written by pnpm gen:system-context-census. Only the figure line differs: before '-| — parsed as a property **read** | 129 |' and '+... | 128 |'; after '-... | 130 |' and '+... | 129 |'. Main's base moved and the PR's minus-one is unchanged; the unrelated-metadata-fields row pair and the row-58 prose are identical.",
      "content/docs/permissions/tenant-audit-census.mdx: written by node scripts/tenant-audit-census.mjs --write (merge: unspecified). Only '+Measured on 2026-10-11 at `81ec7792b`.' became '+... at `be55432f6`.'",
      "docs/audits/2026-08-tenant-audit-write-call-sites.counts.md: written by the same generator (merge: unspecified). The same measured-at stamp line differs, 81ec7792b to be55432f6."
    ],
    "unchanged": "The other 46 paths carry byte-identical added and removed lines before and after."
  },
  "after_push": "GET pulls/22875: head 78c3eed63, mergeable true, mergeable_state blocked (no longer dirty), draft true, body line 2 'Clause-②: yes (narrowing)' (the seat's edit). origin/main has since moved one commit to 63739521d (#22894: objectql engine.ts, a changeset and two tests). git merge-tree --write-tree HEAD origin/main is clean (exit 0, tree 175fd49c9), so it was not merged. Its three added isSystem lines are all in test files: they move only the census's corpus line count, a row the page marks as not CI-held ('—'), and no tenant-audit population file.",
  "mcp_calls": "0",
  "api_writes": "1 this round: POST /repos/objectstack-ai/objectstack/issues/15205/comments (this os-dev-report, sent through scripts/pm/post-stamped.mjs and the fleet-write relay). git push is not a REST write. Zero label writes, zero PR body edits. REST reads: GET pulls/22875 (mergeable state after the push) and a GET read-back of this comment.",
  "line_budget": "4575 changed lines (+1581 / -2994) across 49 files against the new merge base 3fdb92db0, unchanged.",
  "deviations": [
    "The first closure build's tool call ran past the 600s foreground limit, because it waited 296s for the lock behind another agent's spec vitest run. The harness moved that call to the background. I read its VERDICT line ('command-exit 0 · held the lock 312s · waited 296s') and the task count (63/63) as soon as it finished, then continued, and set OS_VERIFY_LOCK_WAIT=240 on the next build so the call fit the cap.",
    "check:pm-dispatch-gates ran detached (nohup, PID recorded, exit code written to a file, 290.5s), as the role file prescribes for that battery. I read its exit code and log after the PID was gone.",
    "The system-context hunk was resolved by keeping main's figure rows inside the conflict region only, not with checkout --theirs, which would have dropped the PR's row-58 prose. The figures were then re-derived by the generator.",
    "The worktree was removed after the push (rm -rf node_modules, then git worktree remove without --force, exit 0 on a clean tree); the two control worktrees were removed too."
  ],
  "files_changed": [
    "merge be55432f6 (origin/main 3fdb92db0; content/docs/permissions/system-context.mdx resolved)",
    "content/docs/permissions/system-context.mdx, content/docs/permissions/tenant-audit-census.mdx, docs/audits/2026-08-tenant-audit-write-call-sites.counts.md (regenerated in 78c3eed63)"
  ],
  "seat_append": "## Merge round: origin/main 3fdb92db0, through os-regen-merge.sh\n\nTwo commits on `0f1906217`, now at `78c3eed63`; the new merge base is `3fdb92db0`.\n\n- `be55432f6` merges `origin/main` `3fdb92db0` through `scripts/pm/os-regen-merge.sh`. Step 1 conflicted on one file, `content/docs/permissions/system-context.mdx`, a MIXED `merge=os-regen` path. The conflict hunk held only census figures, no prose. It was resolved to main's side of those figures, and the PR's row-58 prose stayed. The rerun's step 2 took nothing from main, because no path was silently dropped, and step 3 found nothing left to commit.\n- `78c3eed63` is step 4, the repo's own generators only: `pnpm gen:system-context-census` and `node scripts/tenant-audit-census.mjs --write`, after building `@objectstack/spec`. The system-context figures now read 129 property reads and 5 reads of unrelated metadata fields: main's 130 and 6, less the retired row projection's read. The tenant-audit page and counts restamp their measured-at commit. Spec `check:generated` is green, including `check:docs`.\n\n`dispatch-gates --commands` on the merged change set derives 136 commands, and `--ran` reconciles 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN. 135 exit 0, including the system-context, tenant-audit and platform-object-tenancy census gates, `check:generated`, `check:docs`, `check:liveness`, `check:dual-build-cjs-loads` and the `check:pm-dispatch-gates` battery. `check:platform-checklist` exits 1 with 8 findings, identical line for line to a control run at the merge base `3fdb92db0`, so they are main's.\n\nRegen-provenance measurement: the PR's net diff covers the same 49 paths before (`0253192f7..0f1906217`) and after (`3fdb92db0..78c3eed63`). Comparing the added and removed lines path by path, exactly 3 paths differ, and all 3 are generated:\n\n- `content/docs/permissions/system-context.mdx` is under `merge=os-regen` and written by `gen:system-context-census`. Only the property-read figure differs: main's base moved from 129 to 130, and the PR's minus-one is unchanged.\n- `content/docs/permissions/tenant-audit-census.mdx` is written by `tenant-audit-census.mjs --write`. Only the measured-at stamp differs.\n- `docs/audits/2026-08-tenant-audit-write-call-sites.counts.md` is written by the same generator. Again only the measured-at stamp differs.\n\nAfter the push the PR reads `mergeable: true`; its `mergeable_state` is `blocked`, no longer `dirty`. `origin/main` has since moved one commit to `63739521d`. `git merge-tree --write-tree` against it is clean (exit 0), so it was not merged.\n",
  "open_questions": [],
  "out_of_scope_findings": []
}

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Two commits on 0f1906217, now at 78c3eed63; the new merge base is 3fdb92db0.

be55432f6 merges origin/main 3fdb92db0 through scripts/pm/os-regen-merge.sh. Step 1 conflicted on one file, content/docs/permissions/system-context.mdx, a MIXED merge=os-regen path. The conflict hunk held only census figures, no prose. It was resolved to main's side of those figures, and the PR's row-58 prose stayed. The rerun's step 2 took nothing from main, because no path was silently dropped, and step 3 found nothing left to commit.
78c3eed63 is step 4, the repo's own generators only: pnpm gen:system-context-census and node scripts/tenant-audit-census.mjs --write, after building @objectstack/spec. The system-context figures now read 129 property reads and 5 reads of unrelated metadata fields: main's 130 and 6, less the retired row projection's read. The tenant-audit page and counts restamp their measured-at commit. Spec check:generated is green, including check:docs.

dispatch-gates --commands on the merged change set derives 136 commands, and --ran reconciles 136 derived, 136 run, 0 NOT-MEASURED, 0 UNRUN. 135 exit 0, including the system-context, tenant-audit and platform-object-tenancy census gates, check:generated, check:docs, check:liveness, check:dual-build-cjs-loads and the check:pm-dispatch-gates battery. check:platform-checklist exits 1 with 8 findings, identical line for line to a control run at the merge base 3fdb92db0, so they are main's.

Regen-provenance measurement: the PR's net diff covers the same 49 paths before (0253192f7..0f1906217) and after (3fdb92db0..78c3eed63). Comparing the added and removed lines path by path, exactly 3 paths differ, and all 3 are generated:

content/docs/permissions/system-context.mdx is under merge=os-regen and written by gen:system-context-census. Only the property-read figure differs: main's base moved from 129 to 130, and the PR's minus-one is unchanged.
content/docs/permissions/tenant-audit-census.mdx is written by tenant-audit-census.mjs --write. Only the measured-at stamp differs.
docs/audits/2026-08-tenant-audit-write-call-sites.counts.md is written by the same generator. Again only the measured-at stamp differs.

After the push the PR reads mergeable: true; its mergeable_state is blocked, no longer dirty. origin/main has since moved one commit to 63739521d. git merge-tree --write-tree against it is clean (exit 0), so it was not merged.

Generated by Claude Code

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z

PR feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 merged through the queue at 2026-10-12T01:11Z as 7de0265fc7, from the reviewed head 78c3eed638.
- Authorized approval by os-zhuang on that head.
- ACCEPT 6112901622, re-review 6114212452.
- At-tier contract review PASS 6114282872, carried to the head over a pure regeneration (6114859685).
- Read on origin/main: every file of the PR is byte-identical between the reviewed head and 7de0265fc7.
What landed: C4 stage 2 under ruling C on ADR-0131 §6 Q1 (6020178017).
- @objectstack/plugin-email resolves email_template from the registry at every send. The built-in auth templates are code-declared items of the plugin's own package and render byte-identical.
- The boot seed, the declared-template sweep, the live projector and the row loader are retired, with their exports and options.
- sys_email_template and its rows are untouched.
Closing keyword: Fixes #15205 closed this card completed. The lane shows no other closure since the merge.
Carried by others:
- The customized rows' promotion to environment-level templates is C7's (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). Until it runs, a re-save in Studio makes such an edit live, and the changeset says so.
- email_template.category / isSystem retire in [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876 (Blocked-by: #15205, now closed).
- The second-locale overlay defect is [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877.
- The ADR-0087 vocabulary gap is the maintainer's to rule, raised in the PR's acceptance notes and the 维护者速读 6115114400.
State: pm:dispatched and the assignee zhuangjianguo come off in this act. priority:p1, domain:services, domain:spec and target:v18 stay.

Generated by Claude Code

Navigation Menu

Repository navigation

refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205

v18 pre-opening re-verification (C4): DRIFTED. #21818 widened what §6 Q1 covers. Still waiting on that ruling

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C4, dispatchable first

Seat answer to the stop (`6038447213`) · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T13:03Z

20 remaining items

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

Patch round 3: the changeset's Clause-② line carries the narrowing arm

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

Patch round 4: the review FAIL 6113872462, the three dev edits

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205

Description

Activity

objectstack-fleet commented on Oct 6, 2026

v18 pre-opening re-verification (C4): DRIFTED. #21818 widened what §6 Q1 covers. Still waiting on that ruling

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 7, 2026

Triage: unlocked, pm:blocked → pm:queue. The v18 line is open: #15193 was closed on the maintainer's word. C4, dispatchable first

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

Seat answer to the stop (6038447213) · seat domain:services#2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-07T13:03Z

20 remaining items

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Seat answer to the stop (6111776721, Q1): B. Land with both keys graded dead; retire them in the next batch (#22876) · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T17:41Z

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Patch round 3: the changeset's Clause-② line carries the narrowing arm

objectstack-fleet commented on Oct 11, 2026

ACCEPT (seat review): PR #22875 at 4aa656e7a2 · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T19:35Z

objectstack-fleet commented on Oct 11, 2026

objectstack-fleet commented on Oct 11, 2026

Patch round 4: the review FAIL 6113872462, the three dev edits

objectstack-fleet commented on Oct 11, 2026

ACCEPT (seat re-review): PR #22875 at 0f1906217a · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-11T21:52Z

objectstack-fleet commented on Oct 11, 2026

Merge round: origin/main 3fdb92d, through os-regen-merge.sh

objectstack-fleet commented on Oct 12, 2026

Landed and closed out · domain:services seat 2 (#21118) · session_013LbZ9MhPp1iriZEtgJqioA · 2026-10-12T01:11Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: unlocked, `pm:blocked` → `pm:queue`. The v18 line is open: #15193 was closed on the maintainer's word. C4, dispatchable first

Seat answer to the stop (`6038447213`) · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-07T13:03Z

Seat answer to the stop (`6111776721`, Q1): B. Land with both keys graded `dead`; retire them in the next batch (#22876) · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T17:41Z

ACCEPT (seat review): PR #22875 at `4aa656e7a2` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T19:35Z

ACCEPT (seat re-review): PR #22875 at `0f1906217a` · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-11T21:52Z

Merge round: origin/main `3fdb92d`, through os-regen-merge.sh

Landed and closed out · `domain:services` seat 2 (#21118) · `session_013LbZ9MhPp1iriZEtgJqioA` · 2026-10-12T01:11Z