fix(platform-objects,core): sys_metadata_activation ships tenant-less — drop the reserved organization_id before 17.3 is cut (ADR-0126 amended by ADR-0131 D6/D7)

[hotlong]

Re-scoped on the maintainer's ruling (2026-09-04, live chat: 「所以 ADR-0126 不能简单的关掉」「hotcrm 是标准的软件包，客户安装之后能根据业务需求实现具体的定制」「同意」). ADR-0126 is amended, not superseded (PR #14976, ADR-0131 D6): its regimes stand at environment scope and the packaged-flow / packaged-action disable + clone machinery ships in 17.3. What does NOT ship is a nullable tenant column on a new table. ⚠️ Must land before the 17.3 tag.

业务一句话

ADR-0126 的活化账本 sys_metadata_activation 是「本环境把哪个受管流程关掉了」这种部署级状态，不属于任何组织。它今天带着一个「预留、先写 NULL」的 organization_id 列，正是 ADR-0131 要消灭的形状。发版前把这列去掉，让这张表以无组织列的部署级状态表出厂。

Scope

1. sys_metadata_activation (packages/platform-objects, declared by feat(platform-objects): declare sys_metadata_activation, the ADR-0126 §4 activation ledger #12185) declares systemFields.tenant: false; the store (packages/core/src/utils/metadata-activation-store.ts, Ledger convergence: registration home + one store implementation (ADR-0126 §4/§8, maintainer-ruled) #12419) drops its organization_id == null filter and the "RESERVED, never written" docblock — there is no column to reserve.
2. The ADR-0126 D3 per-organization pre-chart ("per-org disable for record-change-triggered flows only, when a customer asks") is not implemented here and is recorded in ADR-0131 D6 as returning, if ever, as a separate org-owned object — never as a column on this ledger.
3. Any migration or index that names the column on this table is removed (the table never shipped: plain removal, ADR-0087 entry noting "unreleased").
4. Tests that pinned the NULL filter or the reserved column are rewritten to pin the column's absence; the operator gate under walled postures (ADR-0126 D3) and the execute()-time consult (feat(automation): durable packaged-flow disable — activation ledger, execute() consult, operator gate #12296) are untouched and stay pinned.

⛔ Do not revert #12185 / #12190 / #12296 / #12348 / #12419 / #12491 — that was this card's first scope and is withdrawn. ⛔ Do not touch sys_metadata, ADR-0005's overlay path or the permission-set write-through — v18, ADR-0131.

Acceptance

git grep -n organization_id -- packages/core/src/utils/metadata-activation-store.ts packages/platform-objects/src/**/sys-metadata-activation* returns nothing; the DDL for sys_metadata_activation has no organization_id; automation / core / platform-objects suites green; disabling a packaged flow on an isolated rig still requires the operator capability and still refuses at execute(); the fix commit is confirmed NOT an ancestor of @objectstack/account@17.2.0 (positive control: one 17.2.0 commit IS).

Refs: ADR-0131 (PR #14976) D6 / D7 / D14 · ADR-0126 D2 / D3 · #12155 · #12419 · #13564.

[claude]

Blocked-by: #15023

Unlock-action: re-check card #15024

pm:queue → pm:blocked — the card's own blocker is not yet satisfied

domain:services execution seat, session session_01AUF1NoViznQK32gqpK8wS8. Read-modify-write with the read immediately before the write; comparative read-back against union(current, target) = {priority:p1, domain:services, target:v17, pm:blocked} — matched.

⛔ Not a disagreement with the ruling, and not a re-grading. priority:p1, target:v17 and the 17.3 deadline all stand exactly as filed. This is only the state label catching up with what the body already says.

Measured just now: the body carries Blocked-by: PR #15023 (ADR-0126 Superseded), and PR #15023 is state: open, draft: true — unmerged. ADR-0126 is therefore not yet marked Superseded on main.

That matters because this card's own acceptance depends on it:

pnpm check:adr-anchors green (ADR-0126 is Superseded, so its code anchors are no longer required)

⇒ Dispatching before #15023 lands would send a dev at a gate that is supposed to be red, on a premise that is not yet true. pm:queue also advertises the card as dispatchable to every other reader of the queue, which it is not.

⚠️ This does not slow the 17.3 work down. The two revert cards are independent: #15030 (the plugin-sharing NULL-inclusive unit screen) has no blocker, its premise was verified on origin/main, and it is dispatched now — claim comment on that card. This one starts the moment #15023 merges, and the Blocked-by: line above puts it in the mechanical unlock scan's reverse index so it is not left to memory.

⚠️ One thing for whoever picks it up, measured here so it is not re-derived: my own grep for an adr-0126 file on origin/main returned nothing, but ⛔ do not read that as "the ADR does not exist" — my pattern may simply not match the repo's ADR filename convention, and a zero with no positive control is not a reading. Confirm the ADR's actual path and status directly before relying on it.

---

Generated by Claude Code

[hotlong]

⏸ On hold — do not start. The maintainer is reconsidering whether ADR-0126 is superseded or amended (2026-09-04, live chat: 「所以 ADR-0126 不能简单的关掉」). The disable half of the packaged-flow machinery may be kept as environment-level operational state (tenant-less activation ledger, consistent with the proposed ADR-0131 D7) rather than reverted. This card is re-scoped or closed once that ruling lands; until then pm:queue is withdrawn.

🤖 Generated with Claude Code