[objectstack-fleet]

Part of #26553 (the carrier for the four ADR ruling batches under #26076 ruling A)

Clause-②: no
Metadata-protocol: none
Ruling-ref: #26553 (comment)

Contract review tier: H — four status lines in docs/adr/** plus the regenerated docs/adr/README.md, a governed surface; it lands by the maintainer's approval (AGENTS.md Prime Directive 14), never by a seat's click.

维护者速读

• 改了什么： 按你对 ADR 第 2 批的裁决（docs(adr): the 19 stale Proposed records (status date before 2026-07-26) are ruled by the maintainer in four batches of five — carrier for the rulings and the status-line PRs #26553，评论 6458958232，「其他同意」）改四行状态：ADR-0038 → Accepted（L1 图检、L3 运行探针、L4 自纠、L5 黄金提示评测已实现；L2 可渲染合约待办）；ADR-0046 → Accepted（P1–P3b 已实现；P3c Studio 拖拽改序 / 匿名文档库、P3d 标签待办）；ADR-0051 → Accepted（P1–P3 已实现，删掉过时的「无运行时渲染」句）；ADR-0052 → Accepted 收窄（§5b 声明式动态、P0b 归位、P1 收敛已实现；P2 事件脊与 sys_activity/sys_comment 迁出 plugin-audit 待办）。ADR-0050 按你的话单独立卡 [Decision] ADR-0050 form layout vs presentation — the maintainer's own call: schedule the spec-major narrowing of FormView.type to layout only, defer it, or withdraw the record (set aside from ADR batch 2 on #26553) #27032 交你裁，本 PR 不动它。docs/adr/README.md 由 scripts/adr-index.mjs 重新生成（Accepted 112 → 116，Proposed 18 → 14）。
• 为什么： [Decision] docs/adr: 143 ADRs with no index, four numbers used twice, 19 Proposed older than three months, three status-line spellings — how the registry gets put in order #26076 裁决 A：19 份旧 Proposed 不由席位改标、由你逐批裁；这是第 2 批的落地。
• 风险与回滚： 只有文字；回滚 = revert。
• 你要做的： 批准（Tier H）。本席账号在 GOVERNED_APPROVERS，不投审核。

席位核对

Director seat, session_01KrKXQVvgYk2AJ4VkqMobyb (ledger objectstack#12708). Each line keeps the keyword as the first word after **Status**: (the spelling scripts/adr-index.mjs reads) in the batch 1 form (Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed …)) and keeps the record's own implementation reading after it, re-verified on origin/main a90163d477 and cloud ce05c91. Gates run on this tree: node scripts/adr-index.mjs --check and --self-test green; check-adr-anchors, check-adr-links, check-adr-symbol-anchors exit 0. No changeset (docs only, skip-changeset). Batch 3 (ADR-0063 · 0064 · 0071 · 0072 · 0073) is presented at the maintainer's next summon.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KrKXQVvgYk2AJ4VkqMobyb

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: da5cf79ddc2cb344f2ec74cc86df9340405b3fb3
Local-runs: none
Scope: docs/adr/0038-build-verification-loop.md, docs/adr/0046-package-docs-as-metadata.md, docs/adr/0051-inline-metadata-views-in-docs.md, docs/adr/0052-audit-is-not-the-activity-feed.md, docs/adr/README.md + scripts/adr-index.mjs, .github/workflows/lint.yml, packages/metadata-protocol/src/build-probes.ts, packages/spec/src/api/protocol.zod.ts, cloud packages/service-ai-studio/src/verify/graph-lint.ts, cloud packages/service-ai-studio/src/plugin.ts, cloud packages/service-ai-studio/src/tools/verify-build.tool.ts, cloud packages/service-ai-studio/src/verify/plan-conformance.ts, cloud .github/workflows/eval-golden-prompts.yml, cloud .changeset/eval-golden-prompts-schedule-off.md, cloud packages/service-ai/src/eval/eval-runner.ts, packages/spec/src/system/doc.zod.ts, packages/spec/src/system/book.zod.ts, packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/kernel/metadata-type-schemas.ts, packages/cli/src/utils/collect-docs.ts, packages/rest/src/meta-item-read-gate.ts, ui/apps/console/src/App.tsx, ui/apps/console/src/pages/AppDocsIndex.tsx, ui/packages/app-shell/src/layout/AppHeader.tsx, ui/packages/app-shell/src/views/metadata-admin/previews/DocPreview.tsx, ui/packages/app-shell/src/views/metadata-admin/previews/BookPreview.tsx, packages/spec/src/ui/component.zod.ts, ui/packages/components/src/renderers/basic/metadata-viewer.tsx, ui/packages/plugin-markdown/src/MarkdownImpl.tsx, packages/plugins/plugin-audit/src/audit-plugin.ts, packages/plugins/plugin-audit/src/audit-writers.ts, packages/plugins/plugin-audit/src/objects/sys-comment.object.ts, packages/plugins/plugin-audit/src/objects/sys-comment-reaction.object.ts, packages/spec/src/data/object.zod.ts, packages/services/service-storage/src/storage-service-plugin.ts, packages/services/service-messaging/src/messaging-service-plugin.ts, ui/packages/plugin-detail/src/renderers/record-chatter.tsx, hotcrm src/sales/actions/activity-actions.ts

① Derived judgments

• Diff shape. The net diff against main (three-dot, byte-identical to the fetched net.diff) touches exactly the five hits files: four **Status**: lines and the regenerated index — 10 additions, 10 deletions, nothing else. No accept-set, no published schema, no runtime surface changes. Right.
• Keyword column. Each new line keeps the keyword as the first word after **Status**: (Accepted ×4); statusKeywordOf reads the earliest STATUS_KEYWORDS entry within 80 chars and the lowercase implemented / proposed / revised later in each value do not match (case-sensitive indexOf), so no line drifts to Implemented, Proposed or Revised. Summary table Accepted 112 → 116, Proposed 18 → 14, Total 144 unchanged. Right.
• Status cells. statusCell = keyword + — + cell(detail, 64); detail strips the keyword and leading dashes, and cell cuts at 63 chars + …. All four values share the 63-char prefix 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2, which is what the four README rows carry. Right.
• Date column. None of the four records has a **Date**: header field, so date falls back to the first ISO date in the status value — 2026-10-28 on all four rows (was the proposal date). Identical to the batch-1 rows already on main (ADR-0022/0026/0027 → 2026-10-27). Right by the generator's rule; the proposal date survives in the status prose.
• Supersession cells. ADR-0038's cloud ADR-0025 comes from the header blockquote arm (> **🔶 Cloud-owned — superseded in part by cloud ADR-0025), untouched. ADR-0046's · **Superseded in part (2026-06-13, ADR-0048)** bullet is neither a **Key**: field nor a > line, so it yields no reference — —, unchanged from before. Right.
• Index currency on the head. pnpm check:adr-index is --self-test && --report and REPORT-ONLY (exit 0 on a stale index), so a green check proves nothing by itself. The ADR index is current (report-only …) step ran in Lint · repo & tooling gates (check-run 122595143324) on da5cf79… and its annotations carry no ::warning:: (only the runner-image notice) — so on the head tree the committed README equals the rendering and every record parsed. Right.
• Index currency after merge. origin/main has advanced four commits past the PR's merge-base a90163d477 (to cb8988ee); git diff a90163d477 origin/main -- docs/adr/ ui/docs/adr/ scripts/adr-index.mjs is empty, so the regenerated README stays current when this lands. Right.
• ADR-0050. git diff origin/main prr-27034 -- docs/adr/0050-form-layout-vs-presentation.md is empty; its README row still reads Proposed — 2026-06-15 · Amended (2026-10-20 …), as the ruling's item 3 requires. Right.

② Semver level

Clause-②: no on the PR body; skip-changeset label present; Check Changeset skipped by the label; the diff publishes nothing (docs/adr only). No narrowing is declared and none exists in the diff. Right.

③ Boundary flags

• "ADR-0050 … 本 PR 不动它" — answered: untouched (①). The ruling's item 3 (set aside → [Decision] ADR-0050 form layout vs presentation — the maintainer's own call: schedule the spec-major narrowing of FormView.type to layout only, defer it, or withdraw the record (set aside from ADR batch 2 on #26553) #27032) is honoured.
• "re-verified on origin/main a90163d477 and cloud ce05c91" — main moved to cb8988ee and the local cloud clone is at ce2ed267 (2026-10-28); every claim below was re-read against those, not the PR body's shas. Nothing in the four moved main commits touches the cited code.
• Governed Surface Queue Guard shows two runs on the head: cancelled (02:27:49–02:28:05) superseded by success (02:28:08–02:28:26). The later run governs; not a red.
• ADR-0052 §6 P0b body still says sys_notification is deferred and flags the move as "a call for this record's owner". Answered by the tree: plugin-audit registers [SysAuditLog, SysActivity, SysComment, SysCommentReaction] only (audit-plugin.ts), service-messaging registers SysNotification (messaging-service-plugin.ts:322,579), service-storage registers SysAttachment (storage-service-plugin.ts:436). The status line is right; the body paragraph is stale (④, should-fix, out of this PR's status-line-only scope).
• open_questions: none declared on the PR or the card. Pending checks: none — all 40 check-runs are completed.

④ Design judgment

Each line judged against ruling 6458958232 (letter and parentheticals) and against origin/main (cb8988ee) / cloud ce2ed267.

docs/adr/0038-build-verification-loop.md — Accepted (ruling item 1: A). Letter matches.

• L1 graph lint: cloud service-ai-studio/src/verify/graph-lint.ts ("ADR-0038 L1 — graph lint: cross-artifact reference resolution"). True.
• L3 runtime probes: packages/metadata-protocol/src/build-probes.ts (RuntimeBuildIssue, "ADR-0038 L3"); probe report packages/spec/src/api/protocol.zod.ts:1578; probes ride publishPackageDrafts (objectql/src/build-probes.test.ts). True.
• L4 verify_build self-correction: cloud tools/verify-build.tool.ts (name: 'verify_build'), plugin.ts:1109 ("ADR-0038 L1/L4 … verifies-fixes-reverifies"), auto-publish posture gate; build-health line in ui/packages/plugin-chatbot/src/ChatbotEnhanced.tsx:1948. The ADR's LLM "intent review" is not built — verify/plan-conformance.ts emits deterministic layer: 'intent' issues instead — but the line scopes L4 to verify_build, as the ruling does. True as written.
• L5 golden-prompt evals "implemented": the harness exists (scripts/eval/golden-prompts.mjs, scripts/eval/cases.json, service-ai/src/eval/eval-runner.ts on ai_eval_cases/ai_eval_runs), but the cited .github/workflows/eval-golden-prompts.yml opens with: "THE NIGHTLY SCHEDULE IS DISABLED (2026-08-04, cloud#1119) … THIS SUITE NOW RUNS ONLY WHEN A HUMAN CLICKS 'Run workflow'. NOTHING WATCHES THE GOLDEN PROMPTS ON ITS OWN. This is ABANDONED COVERAGE, not a fix — the bug it was reporting (no eval environment) is still open"; the three EVAL_* secrets "have never been provisioned"; .changeset/eval-golden-prompts-meta-singular.md: "this suite doesn't actually run today". ADR-0038 defines L5 as the suite that "runs headlessly against an ephemeral environment per cloud deploy (and nightly), recording to ai_eval_runs". On the tree L5 is built and unarmed; the line calls it implemented and names no pending half. The card's own rule for an A is that the line 写明待办. must-fix — keep Accepted, move the arming to pending, e.g. L5 golden-prompt harness built (cloud eval-golden-prompts.yml, scripts/eval/golden-prompts.mjs on ai_eval_cases / ai_eval_runs) but unarmed — nightly schedule off since 2026-08-04 and no eval environment (cloud#1119); pending: L2 renderability contract (dataset compile only today), L5 arming. The ruling's letter (A) is unchanged by this; only the implementation reading is corrected. FAIL.
• L2 pending: no renderability layer found in framework or cloud (graph-lint.ts emits no layer: 'render'); "dataset compile only" is the conservative reading. True.

docs/adr/0046-package-docs-as-metadata.md — Accepted (ruling item 2: A). Letter matches.

• P1: DocSchema (spec/src/system/doc.zod.ts:31), kernel doc (metadata-plugin.zod.ts:1164, supportsOverlay: false; metadata-type-schemas.ts:164), os build collection + publish lint (cli/src/utils/collect-docs.ts, "Package documentation collection + lint (ADR-0046)"). True.
• P2: console documentation portal (ui/apps/console/src/App.tsx:296-314 — /docs, DocPage; pages/AppDocsIndex.tsx), help menu loading doc metadata (ui/packages/app-shell/src/layout/AppHeader.tsx:488,625), Studio doc editor (DocPreview.tsx, ResourceEditPage.docEditor-10188.test.tsx). True.
• P3a/P3b: BookSchema + defineBook() (book.zod.ts:139,190), orphan pass (book.zod.ts:312-397), book registered (metadata-plugin.zod.ts:1181), GET /meta/book/:name/tree (rest/src/index.ts:121, meta-item-read-gate.ts:370-398), §6.7 docs-audience arm — 401 UNAUTHENTICATED to anonymous (meta-item-read-gate.ts:237). True.
• P3c pending: no drag/reorder in DocPreview.tsx; apps/docs does not read /meta/doc or /meta/book. True. (Studio's BookPreview.tsx:171 already consumes the tree — the line names only the still-missing P3c parts, which is accurate.)
• P3d pending "§5 tags": DocSchema.tags exists and collect-docs.ts:88-97 reads frontmatter tags: as the operand of a book group's include: { tag } rule — that is the §6 navigation axis, which §6.3 separates from §5 tags (faceted discovery/search). The pending claim holds for §5's discovery surface, but a reader who greps tags will find it live. should-fix (wording): §5 tag-based discovery or add (DocSchema.tags exists as the book-include operand).

docs/adr/0051-inline-metadata-views-in-docs.md — Accepted (ruling item 4: A). Letter matches; the stale "no runtime rendering" sentence is gone as the ruling requires.

• Fence lift: ui/packages/plugin-markdown/src/MarkdownImpl.tsx:120-166 (parseMetadataFence, MetadataFence → ComponentRegistry.get("element:metadata_viewer"), graceful raw-code fallback). True.
• Viewer: ui/packages/components/src/renderers/basic/metadata-viewer.tsx — state_machine (:177), flow with the §3.4 detail: business altitude projection (:362-430, TECHNICAL_NODE_TYPES folded), permission matrix (:439+). Spec entry ElementMetadataViewerPropsSchema → 'element:metadata_viewer' in ComponentPropsMap (component.zod.ts:2934,8472, "embeddableInDoc"). True.
• Publish lint: collect-docs.ts lintMetadataEmbeds with liveness checks (collect-docs.test.ts:11 "lintMetadataEmbeds (ADR-0051)"). True.
• P3 nuance (observation, no fix): the viewer draws the declared matrix and states that the graph is "read from the rule, not from who is looking"; the per-reader projection §3.5 places "at the resolver" is the item-level /meta read gate (meta-item-read-gate.ts: anonymous deny, ADR-0049 gated audiences deny), which the viewer degrades on (failed / notFound placeholders). That matches §3.3's placeholder posture; P3's "ships only once the §6.7 gate is in place" holds.
• Deferred list (object, objectui fence) unchanged (§5). True.

docs/adr/0052-audit-is-not-the-activity-feed.md — Accepted, narrowed (ruling item 5: A narrowed). Letter matches.

• §5b: trackHistory consumed in audit-writers.ts:768,832 ("ADR-0052 §5b — declarative activity"), activityMilestones on object.zod.ts:2868 ("ADR-0052 §5b.2"). True.
• P0b: audit-plugin.ts registers [SysAuditLog, SysActivity, SysComment, SysCommentReaction]; SysAttachment in service-storage, SysNotification in service-messaging. True.
• P1: service-feed has no files on main; sys_comment.parent_id (threads) live, reactions as the sys_comment_reaction object + reactions door (the sys_comment.reactions column retired under Retire sys_comment.reactions (ruling A amended on #22505): no aggregate, no data migration, after the console reads reaction records #22573 — the line says "with reactions and threads", which the object and the door satisfy); ChatterPanel enableReactions: true, enableThreading: true (record-chatter.tsx:173-174). HotCRM's opportunityActivityHook is gone (0 hits); trackHistory: true / activityMilestones declared across its objects. True.
• P2 pending: audit-writers.ts:1271,1274 still creates sys_audit_log then sys_activity; audit-writers.ts:229 names "event-spine (ADR-0052 §P2)" as future; HotCRM activity-actions.ts:357 still hand-inserts sys_activity (the §6 P2 retirement). True.
• should-fix (follow-up, outside this PR's status-line scope): §6 P0b body still reads "sys_notification is deferred … ⚠️ whether the move now proceeds is a call for this record's owner" while the status line records the move as done and the tree confirms it. Flip that paragraph to ✅ in a body-edit PR so the record does not contradict its own status line.

docs/adr/README.md — judged in ① against scripts/adr-index.mjs: keyword, cell cut, date fallback, supersession extraction and counts all follow the generator; the report-only step on the head emitted no stale/unparsed warning; main has not moved under it. No finding.

Implemented-by: claude/hopeful-heisenberg-x0vxac
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

Contract review 6459576746 answered · director seat · 2026-10-28T03:08Z

• must-fix (ADR-0038, L5) — fixed in 1584ae8c72: the line now reads "L5 golden-prompt harness built (cloud eval-golden-prompts.yml, scripts/eval/golden-prompts.mjs on ai_eval_cases / ai_eval_runs) but unarmed — nightly schedule off since 2026-08-04 and no eval environment (cloud#1119); pending: L2 renderability contract (dataset compile only today), L5 arming". Verified against cloud origin/main ce2ed26: the workflow header says the schedule is disabled and the three EVAL_* secrets were never provisioned. Letter A unchanged (ruling 6458958232).
• should-fix (ADR-0046, §5 tags wording) — fixed in the same commit: "§5 tag-based discovery — DocSchema.tags exists today only as the book-include operand".
• should-fix (ADR-0052 §6 P0b body paragraph) — out of this status-line PR's scope, as the review says; it rides the batch 3 docs PR on docs(adr): the 19 stale Proposed records (status date before 2026-07-26) are ruled by the maintainer in four batches of five — carrier for the rulings and the status-line PRs #26553 as a body edit (the paragraph flips to ✅ with the service-messaging registration cited).
• docs/adr/README.md is unchanged by the commit (the 63-char status cell is identical); adr-index --check / --self-test and the three ADR gates are green on the new head.

The push dismisses nothing by itself, but the queue entry was on da5cf79ddc; the maintainer's approval is needed again on 1584ae8c72 (Tier H). Review re-requested through the relay.

---

Generated by Claude Code

[objectstack-fleet]

Correction to the previous seat comment · director seat · 2026-10-28T03:09Z

The commit named there (1584ae8c72, the ADR-0038 L5 and ADR-0046 §5 wording fixes) is not on this PR: the push was rejected because the maintainer had already added this PR to the merge queue ("Branches that are queued for merging cannot be updated"). This seat's account is in GOVERNED_APPROVERS and does not dequeue, ready or merge governed PRs, so the PR lands as approved on da5cf79ddc.

The must-fix is held as a ready commit and lands right after this PR merges, as its own XS docs/adr/** follow-up PR (Tier H, the maintainer approves), with the ADR-0052 §6 P0b body paragraph flipped to ✅ in the same PR. The letters of ruling 6458958232 are unchanged by either edit. The review's should-fix and must-fix rows are therefore answered: fixed, pending the follow-up PR's landing; the contract review thread stays open until that PR is merged.

---

Generated by Claude Code