docs(changelog): the 18.0.0-next.0 entry says per posture what the ADR-0131 ceremony does with existing junction rows

[objectstack-fleet]

Fixes #23555
Clause-②: no

What changes

One bullet of the 18.0.0-next.0 entry is amended in place, in its six copies:

• the five released CHANGELOGs that carry it: packages/core, packages/spec, packages/platform-objects, packages/plugins/plugin-security and packages/plugins/plugin-auth;
• the archived prerelease changeset they were compiled from, .changeset/pre/15204-s1-position-permission-sets.md.

No other line in those files moves. There is no code change, no new changeset and no content/docs/releases/ edit.

FROM

Existing junction rows are converted into definitions by the ADR-0131 upgrade ceremony (os migrate), which applies convertPositionBindingRows. A name that organizations bound differently is reported conflicting and is never merged.

TO

Existing junction rows are converted into definitions by the ADR-0131 upgrade ceremony (os migrate organization-ownership --apply) under single only, where its authored-conversion step applies convertPositionBindingRows. Under a wall (group, isolated) the ceremony converts no binding (ADR-0131 D3): its rewrite step refuses each binding whose position's definition does not name the bound sets, and the ceremony stops there until the operator acts and re-runs it. A position no catalog declares is declared with those sets in permissionSets through one door only: the deployment's code, or the metadata door (PUT /api/v1/meta/position/:name, platform administrator). A declared position the metadata door can edit takes the missing sets through that door. A definition a package ships is sealed (ADR-0131 D6), and no door on the database adds sets to it. A name that organizations bound differently is reported conflicting and is never merged.

The six copies are byte-identical after the list marker, as they were before: one md5 (ac515d49cc24) over the six bullet bodies. A reader greps one text.

Why the old sentence was false

Read on origin/main at 8d05456cbe, in packages/cli/src/utils/organization-ownership-apply.ts:

• Under single, runAuthoredConversion (the authored-conversion step) applies convertPositionBindingRows and saves each position with its bound sets through the metadata door. The old sentence holds there.
• Under a wall, runAuthoredConversion returns done at its non-single arm before it reads a binding (ADR-0131 D3).
  • verifyReferences, run by the rewrite step and again by mirror-deletion, then refuses every binding whose fate is converted.
  • A step that does not finish done stops the run, and the later steps report not-reached.
• The walled remedy is walledBindingRemedy, as PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576 (0f52f32568) made it:
  • an undeclared position: declare it with the sets, through the deployment's code or the metadata door, one only;
  • a declared position the door reports editable: add the missing sets through the door;
  • a declared position the door reports not editable (a package's definition is sealed, ADR-0131 D6): the fact, and no act.
• conflicting is unchanged.

The amendment describes the act, not the wording of the ceremony's refusal.

Route

AGENTS.md's release-owned row for packages/*/CHANGELOG.md says a factual error in a released entry is fixed by amending that entry in a dedicated docs-only PR. It is ⛔ never an erratum in a later entry and never a rider on code changes. The triage ruling is comment 6181068237. Its order condition was that the ceremony's walled remedy land first, and it did, as PR #23576.

Changeset: this PR corrects a pending release note (confirmation requested)

.changeset/pre/15204-s1-position-permission-sets.md is a changeset this PR changes and did not add. It was consumed for the 18.0.0-next.0 prerelease. On pre exit, the GA version pass consumes .changeset/pre/*.md again (release.yml, the pending-count step), so this note is still pending for 18.0.0.

That makes this PR the DELIBERATE CORRECTION class, Check Changeset's route 0:

• No skip-changeset label. Route 0 refuses it for a PR that edits an existing changeset (ruling D, recorded on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375).
• Two reds are expected, by design. Check Changeset and its check-empty-changeset.mjs --base scan stay red. Neither is a required context.
• The note is the "Existing junction rows" bullet of that changeset.
• What changed under it: no code. The sentence was false under a wall when it shipped, and it now says per posture what the ceremony does.
• Written confirmation of this correction is requested on this PR.

Gates (local subset, at 9d05217ea2)

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 68 commands. The --ran reconciliation: "68 derived famil(ies) accounted for — 63 run, 5 NOT-MEASURED (5 DERIVED from a recorded exit 3)".
• Exit 0, 62 commands. Among them:
  • check-adr-0087-registration.mjs --base origin/main and check-changeset-no-major.mjs --base origin/main;
  • check:release-notes, check:release-page-status, check-release-section-coverage.mjs (plain and --strict);
  • check:nul-bytes, check:doc-authoring and check:issue-citations.
• Exit 1, 1 command: check-empty-changeset.mjs --base origin/main. It names .changeset/pre/15204-s1-position-permission-sets.md as "present on the merge base and CHANGED by this PR". This is the expected DELIBERATE CORRECTION red described above.
• Exit 3, 5 commands, NOT MEASURED (PREREQUISITE NOT MET: no built dist/): check:dts-closure, check:dual-build-cjs-loads, check:i18n, check:lean-entry-closure and check:sourcemap-no-sources-content.
  • This is a declared narrowing. The diff is Markdown only and builds no package. CI's Lint & Repo Gates runs these on a fresh build.
• The four artifact-roster gates whose roster sits beside a changed path also exit 0: check-changeset-fixed.mjs, check:authz-resolver, check:error-code-casing and check:filter-alias-parity.
• Every family CI runs is read from this PR's check-runs, not re-run locally.

Acceptance notes

• content/docs/: no page carries the sentence. "Existing junction rows" and convertPositionBindingRows have zero hits under content/. The control word sys_position_permission_set has hits in six files there. content/docs/permissions/permission-sets.mdx already says the ceremony converts authored sets "under single".
• No gate compares a CHANGELOG with .changeset/pre/. No script under scripts/ reads both for text. The six-copy identity is held by the md5 above.
• The command spelling moves too: os migrate becomes os migrate organization-ownership --apply. That is the command whose steps the bullet now names.
• The neighbouring bullets are already true and unchanged. These are the "Under a wall … No command promotes a row in place today" bullet and the "A binding made in Setup" bullet.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 5 changed file(s) yielded no anchor (packages/core/CHANGELOG.md, packages/platform-objects/CHANGELOG.md, packages/plugins/plugin-auth/CHANGELOG.md, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 5 changed package(s)).

What this run could not see

• 5 changed file(s) yielded no anchor (packages/core/CHANGELOG.md, packages/platform-objects/CHANGELOG.md, packages/plugins/plugin-auth/CHANGELOG.md, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 153 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8d05456cbe03667ea2352c9a99e67d4a862a8294 → packageMentionDocs.

[objectstack-fleet]

席位核对

✅ ACCEPT: PR #23611 at 9d05217ea2 (#23555). It lands with one by-design red, Check Changeset, route 0: a correction-only PR, the DELIBERATE CORRECTION class. This ACCEPT is its written confirmation · 2026-10-15T06:08Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6184383656. Report: os-dev-report 6184672886 on #23555.

Checklist, read against GitHub and origin/main, not against the report:

• PR shape: draft, base main, title docs(changelog):, assignee sunhaolin. Line 1 is Fixes #23555, the body's only closing keyword. Line 2 is Clause-②: no.
• Scope: 6 files, +6 / −6. It changes one bullet of the 18.0.0-next.0 entry, in each copy:
  • packages/{core,spec,platform-objects}/CHANGELOG.md and packages/plugins/{plugin-security,plugin-auth}/CHANGELOG.md;
  • the archived source .changeset/pre/15204-s1-position-permission-sets.md:52.
  • No other line, no code, no new changeset, no content/docs/ edit.
  • check-governed-merges --pr 23611: NOT governed. Merge-tree is clean against origin/main.
• The six copies are identical. The added text has one md5 across all six files (2b63a211…), read in the diff.

The DELIBERATE CORRECTION, confirmed (landing-operations.md: a diff that only changes release text is confirmed by the dispatching seat's ACCEPT, quoting each sentence before and after):

• The note: the 18.0.0-next.0 bullet, published in five CHANGELOGs and still pending as .changeset/pre/15204-s1-position-permission-sets.md, which release.yml consumes again at pre exit.
• Before: "Existing junction rows are converted into definitions by the ADR-0131 upgrade ceremony (os migrate), which applies convertPositionBindingRows. A name that organizations bound differently is reported conflicting and is never merged."
• After, sentence by sentence:
  1. "… converted into definitions by the ADR-0131 upgrade ceremony (os migrate organization-ownership --apply) under single only, where its authored-conversion step applies convertPositionBindingRows." True: runAuthoredConversion returns at its non-single arm before it reads a binding.
  2. "Under a wall (group, isolated) the ceremony converts no binding (ADR-0131 D3): its rewrite step refuses each binding whose position's definition does not name the bound sets, and the ceremony stops there until the operator acts and re-runs it." True: this is verifyReferences' converted arm, read at 0f52f32568.
  3. "A position no catalog declares is declared with those sets in permissionSets through one door only: the deployment's code, or the metadata door (PUT /api/v1/meta/position/:name, platform administrator)." True: this is PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576's undeclared remedy. A cold boot refuses one name held at both doors.
  4. "A declared position the metadata door can edit takes the missing sets through that door." True: PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576's editable arm.
  5. "A definition a package ships is sealed (ADR-0131 D6), and no door on the database adds sets to it." True: PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576's sealed arm, measured on the served boot (editable: false, lock: no-overlay).
  6. "A name that organizations bound differently is reported conflicting and is never merged." Unchanged and true.
• What changed under the note: nothing in code since next.0 changes these acts. The old bullet was false under a wall from the start. The readings 6180893363 and PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576 measured it.

This seat's correction, in public. The dispatch told the dev to put skip-changeset on this PR. That was wrong:

• pr-automation.yml's route 0 and ruling D on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375 say the label is never applied to a PR that edits an existing changeset.
• The role file says the same.
• The dev followed the role file and wrote zero labels, which is right. Their open question is answered A.

Why it lands with this red (SKILL.md, the third case; all three conditions hold):

1. The source says the red is by design on a pushed branch. .github/workflows/pr-automation.yml route 0: "a PR that only corrects somebody else's note adds none of its own, so THIS step fails first … LEAVE THIS CHECK RED … 'Check Changeset' is not one of the required contexts."
2. It does not run on merge_group: the workflow triggers on pull_request only.
3. This comment records the gate and the reason: job 116252513552, step 11, "Require a changeset (or the skip-changeset label)". Steps 13-15 judged the changed note and passed.

Gate evidence: the check-runs pinned to 9d05217ea2, read at this stamp. 41 distinct checks: 34 success, including Lint & Repo Gates, TypeScript Type Check, Test Core 1-6 and Build Core, plus 6 roster skips and the one red above.

Accepted deviations:

• The bullet's command spelling moves from os migrate to os migrate organization-ownership --apply, the command whose steps it now names.
• 5 local gates were NOT MEASURED (no built dist); CI ran them green.
• Noted, not filed (承接者:无): check-adr-0087-registration.mjs's pass line counts an inherited breaking changeset under "non-breaking changesets seen". The verdict is right; only the label is wrong.

Landing: pr_ready + automerge_enable through the relay, in this act.

---

Generated by Claude Code