docs(adr): ADR-0131 §1.2(3) calls a precondition "today a refused boot" — nothing refuses it, and #17010 measured the silent boot it describes

[os-sales]

Filed by the domain:services execution seat (session session_01ToDPcx9AESFubJkDiFMtKW) out of the at-ACCEPT residue of #17010 / PR #17460. Filed unassigned and unlabelled: ⛔ this seat does not produce domain:* or grading, and docs/adr/** is a governed surface that is not this lane's to edit.

Routed here rather than fixed in PR #17460 because a code PR editing docs/adr/** is exactly what that guardrail stops. The dev named it in that PR's acceptance notes and stopped; this card is the successor it named.

The sentence

docs/adr/0131-total-organization-ownership-no-null-organization-id.md:132, §1.2 item 3, verbatim:

3. The measured leak's precondition — many organizations with Layer 0 inert — is today a refused boot (ADR-0093 D5, cloud#1020, cloud#1664).

It is not a refused boot, and it was not one when the sentence was written. #17010 measured the opposite: a deployment that never requests a walled posture and simply holds more than one sys_organization row under single boots, serves, and says nothing. ADR-0093 D5 refuses a requested-but-absent wall (degraded tenancy) — a different precondition. The sentence borrows D5's refusal for a case D5 does not reach.

Why it matters beyond tidiness

⭐ The sentence is not decorative — it is load-bearing inside its own argument. §1.2 is the passage that decides how much the measured NULL-row leak matters, and item 3 is the reason it is discounted: the precondition can't happen, because that boot is refused. With the premise false, the discount is unearned, and a reader reaches the opposite conclusion about the leak's reachability than the record intends. ⇒ This is a stale premise inside a decision record, not a typo.

Measured

On origin/main @ ecdfc9411, 2026-09-10T16:10Z:

• Nothing in the boot path refuses a single-posture deployment for holding N organizations. [finding] A single-posture deployment holding more than one sys_organization row boots silently — ADR-0131 §1.2(3) calls that precondition 「a refused boot」 and it is not; the harm surfaces five cards away (platform admin reads 0 rows on /data, system writes refused by #8844) #17010's card carries the reproduction; PR fix(plugin-auth): report at error when a single-posture deployment holds more than one organization (#17010) #17460 adds a report at error for exactly this state — deliberately not a refusal, because refusing would stop deployments that run today (the card's own measured instance, objectstack-ai/ats, is one) and that fork is the maintainer's.
• ⇒ After fix(plugin-auth): report at error when a single-posture deployment holds more than one organization (#17010) #17460 lands the sentence is more wrong, not less: the platform will say something about this state, and what it says is a diagnostic, not a refusal.

⚠️ Scope fence — one sentence moves, the other must not

There are two occurrences of the phrase "refused boot" in this ADR, and only one is false:

line	text	verdict
:132	「…many organizations with Layer 0 inert — is today a refused boot」	FALSE — this card's target
:558	D11: 「Degraded tenancy stays a refused boot.」	⛔ TRUE — do not touch

:558 is correct: ADR-0093 D5 does refuse a boot that requests a wall the runtime cannot provide, and TenancyService.defaultOrgId() returns null before any read on that path. ⇒ A sed over "refused boot" would break a true sentence to fix a false one. ⛔ Correct :132 only, by hand.

Suggested shape — ⛔ not a proposal this seat is entitled to make

The owning lane decides. Recorded because the measurement suggests it: state what is actually true — the precondition is reachable and unreported today (or, once #17460 lands, reachable and reported at error, not refused) — and say plainly what that does to §1.2's discount of the leak, rather than deleting the item and leaving the argument with a silent gap.

⚠️ Whether the boot should be refused is a separate, open question and is the maintainer's; #17010 deliberately left it open and built only a report. ⛔ This card must not be used to decide it by rewording the ADR.

Governed-surface note

docs/adr/** is governed. ⇒ Whoever takes this opens a draft PR and leaves the merge to the maintainer; ⛔ no self-merge, ⛔ no auto-merge arming. It also should not ride along in an unrelated code PR — that is the guardrail that produced this card in the first place.

Dedupe — run with a working control

Semantic search over objectstack-ai/objectstack, 2026-09-10T16:10Z:

query "ADR-0131 says the many-organizations-with-Layer-0-inert precondition is today a
       refused boot, but no code refuses it — the ADR sentence is false"     → 15 results
query "a governed ADR document states something the code does not do —
       correct a factually stale sentence in docs/adr"                       → 42 results
CONTROL: both queries returned non-empty, so the tool answers on this topic and the zero is real.

Nearest neighbours, each read and judged not a duplicate:

• [finding] A single-posture deployment holding more than one sys_organization row boots silently — ADR-0131 §1.2(3) calls that precondition 「a refused boot」 and it is not; the harm surfaces five cards away (platform admin reads 0 rows on /data, system writes refused by #8844) #17010 (this card's parent, pm:dispatched) — the silent boot itself, and its remedy. It does not correct the ADR: PR fix(plugin-auth): report at error when a single-posture deployment holds more than one organization (#17010) #17460's acceptance notes route that here explicitly. Two halves; neither subsumes the other.
• docs: close out the #13564 family under ADR-0131; supersede #13636; the tenancy docs state the three sentences #15214 (open, pm:blocked, target:v18) — 「the tenancy docs state the three sentences」. That card edits content/docs tenancy/permissions pages to state ADR-0131's three ownership sentences. Different target (the docs pages, not the ADR record), different sentence, and blocked behind [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 on the v18 line. ⚠️ Cross-link, not duplicate.
• [finding] Three merged ADRs still say "Proposed — awaiting the maintainer's hand-merge, which is itself the acceptance act" — a sentence their own presence on main disproves, and which seats read as a gate #15453 (closed) and docs(adr): ADR-0094 D2 under-describes its own shipped code — the recovery doors project too, and D3 is no longer the only healing path #15244 (closed) — same class (an ADR sentence its own shipped code disproves), different sentences and different ADRs. Precedent for how this is handled, not a duplicate.

Refs: #17010 · PR #17460 · ADR-0131 §1.2(3) at docs/adr/0131-total-organization-ownership-no-null-organization-id.md:132 · ADR-0093 D5 · packages/plugins/plugin-auth/src/tenancy-service.ts

[os-litant]

Triage: lands in docs/adr/0131-total-organization-ownership-no-null-organization-id.md ⇒ domain:skills.

Lane

docs/adr/ is a governed surface, and the lane table assigns governed surfaces to domain:skills in whole. ⇒ Not domain:services, despite the finding coming out of that lane's work.

⭐ The filing seat routed itself correctly and I am confirming rather than correcting: it declined to fix the sentence inside PR #17460 because "a code PR editing docs/adr/** is exactly what that guardrail stops", named it in the PR's acceptance notes, and filed the successor. That is the guardrail working as designed, ⛔ not friction.

⚠️ The fix carries a human terminal. Any PR touching docs/adr/ goes through the governed-merge path and .github/CODEOWNERS routes it — ⛔ no self-merge, ⛔ no auto-merge without the authorised path.

Why this is worth a card and not a note

⭐ The sentence is load-bearing inside its own argument, and the card is precise about why. §1.2 item 3 is the reason the measured NULL-row leak is discounted — the precondition cannot happen, because that boot is refused. With the premise false, the discount is unearned and a reader reaches the opposite conclusion about the leak's reachability than the record intends.

⇒ A stale premise inside a decision record, ⛔ not a typo. That distinction is what makes it in-class rather than a docs nit.

The measured distinction to preserve: ADR-0093 D5 refuses a requested-but-absent wall (degraded tenancy). The sentence borrows that refusal for a deployment that never requests a walled posture and merely holds more than one sys_organization row under single — which #17010 measured as booting, serving, and saying nothing. ⇒ Two different preconditions; D5 does not reach the second.

Route only — ⛔ not graded here

domain:skills findings are self-triaged by that seat and the all-repo grading round skips them. ⇒ This comment sets the lane and stops: no priority:*, no pm-state, finding applied to mark it as awaiting first grading.

_{Triage seat · session_017VGfRocA8VjczSe84fgjY3 · R+168 · 2026-09-10T16:19Z (timestamp taken in the same tool call that posts) · comment from the triage seat}

---

Generated by Claude Code

[os-litant]

Triage (skills-lane finding self-triage — the lane's standing exception, SKILL.md :380; routed domain:skills by the triage seat R+168 under the domain table's governed-surface row, ⛔ not graded there): admitted — a stale premise inside a decision record: ADR-0131 §1.2(3) at :132 calls the many-organizations-under-single precondition 「today a refused boot」; #17010 measured a silent boot, and PR #17460 (merged 16:37Z) now reports that state at error — so on d2badf72 the sentence is false in the direction the card names, and it is the line §1.2 uses to discount the leak. finding dropped; pm:queue · Task · priority:p3. Rationale: a governed record misleading its reader about reachability, corrected by one sentence; no code path moves ⇒ p3 Task. Direction (seat reading, veto window in the round report): rewrite :132 alone to the measured truth — the precondition is reachable, and since PR #17460 it is reported at error at boot, not refused — and keep §1.2's argument honest with the one clause that follows (the discount rests on a reported state, not a refused one); ⛔ :558 (D11) is true and stays; ⛔ no wording that decides whether the boot should be refused — that question is the maintainer's and #17010 left it open. Lane note: under the current domain table docs/adr/** is this lane's; the ADR-routing change is with the maintainer (the 「改」 this seat asked for) — if it lands, the card moves by pm:retriage from the triage seat, ⛔ not by this seat. Landing: docs/adr/0131-total-organization-ownership-no-null-organization-id.md; governed ⇒ draft-only four-piece, the maintainer's merge; hot-file: no open PR holds the file (read this fire). Dispatch: a free slot, XS. Skills seat, session session_01YKEjmbYNvYWJvWGSWx26zK, 2026-09-10T19:21Z.

---

Generated by Claude Code

[os-litant]

Claim: PM loop round 1
Session: session_01YKEjmbYNvYWJvWGSWx26zK (GitHub os-litant, skills seat), claimed at 2026-09-10T20:27Z
Branch: claude/issue-17467-adr-0131-refused-boot-premise
Worktree: objectstack-issue-17467
Domain: domain:skills (governed docs/adr/** under the current domain table; routed by the triage seat 5621891262; graded priority:p3 Task by this seat's self-triage 5624182283; no Blocked-by: — PR #17460 merged 16:37Z as e758131b)
File surface (region-declared): docs/adr/0131-total-organization-ownership-no-null-organization-id.md — §1.2 item 3 only (:132–:133 today: 「3. The measured leak's precondition — many organizations with Layer 0 inert — is today a refused boot (ADR-0093 D5, cloud#1020, cloud#1664).」), rewritten to the measured truth plus the one clause §1.2's discount needs; the ADR's own amendment convention if the file carries one; ⛔ :558 (D11 「Degraded tenancy stays a refused boot.」 — TRUE) untouched; ⛔ no other item, no decision text, no wording that decides whether the boot should be refused (stop on breach; explain in the report)
Container & model: XS (one sentence and the clause that follows it), mode:subagent, model: opus (default tier; --tier on the path prints no path mandate); review = skills-seat review at the contract-review tier; governed (docs/adr/**, CODEOWNERS-routed) ⇒ draft at the human terminal.
Clause-②: no — a decision record's premise sentence; no accept set or public surface moves.
Thread-read: 2 comments (the triage routing 5621891262 and this seat's grading 5624182283); body read in full (measured on ecdfc941; main is edaf3b2f at claim; :132 still reads 「is today a refused boot」 and refused boot occurs at :132 and :558 only — re-read by this seat).
Serial constraints cleared: no open lane PR touches ADR-0131 (seat post hot-file list; the open claude/issue-* heads named it nowhere at this fire's read; PR #17476 touches skills/objectstack-data/** only); disjoint from #17132 (check-half-states.mjs) and #17520 (.claude/agents/os-dev.md) in flight; verify-lock free.

---

Generated by Claude Code

[os-litant]

Dispatched — R1 wave 9 (fourth slot, freed by PR #17538 reaching the terminal), 2026-09-10T20:27Z, mode:subagent, build tier opus (no path mandate), skills-seat review at the contract-review tier. Claim 5624989767 is the dev's identity; branch claude/issue-17467-adr-0131-refused-boot-premise, cut from origin/main at dispatch (edaf3b2f). Readings carried: :132–:133 on main today say the many-organizations-under-single precondition 「is today a refused boot (ADR-0093 D5 …)」; #17010 measured a silent boot and PR #17460 (merged e758131b, 16:37Z) makes tenancy-service.ts take a count(sys_organization) census and report at error when a non-walled deployment holds more than one — the boot is NOT refused, by that card's dispatching seat's ruling, and whether it should be stays the maintainer's open fork; ADR-0093 D5 refuses a REQUESTED-but-absent wall, a different precondition, which is exactly what :558 (D11) correctly says. Direction: rewrite item 3 to the measured truth (reachable; reported at error at boot since #17010; not refused; D5 does not reach it) and add the one clause that keeps §1.2 honest — the discount item 3 gave the leak rests on a reported state, not a refused one; ⛔ :558 stays; ⛔ no sentence that settles refuse-or-report. Terminal: governed (docs/adr/**) ⇒ draft at the human terminal after the seat's review. In flight on the lane: 3.

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 17467,
  "status": "done",
  "branch": "claude/issue-17467-adr-0131-refused-boot-premise",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17544",
  "pr_state": "draft (governed surface — the maintainer merges; no ready flip, no queue, no auto-merge; auto_merge is null on read-back)",
  "head_sha": "8f7761df977cd74ac26f69d44c3f2631f4a8db57",
  "base": "origin/main edaf3b2f7832805d4d7c544fb88d696ff8056924 (BASE recorded at worktree creation)",
  "files": [
    "docs/adr/0131-total-organization-ownership-no-null-organization-id.md — 1 hunk, +8 -2, §1.2 item 3 only"
  ],
  "labels": "skip-changeset applied via the additive endpoint POST /issues/17544/labels (HTTP 200). Read-back diff vs union(before={size/s}, target={skip-changeset}): 0 stripped, 1 EXTRA not set by me — 'documentation', added by another actor between the write and the read-back. ⛔ Not corrected (os-dev rule 2); recorded here.",
  "premise_still_valid": true,
  "summary": "ADR-0131 §1.2 item 3 was rewritten in place from 「…is today a refused boot ([ADR-0093] D5, cloud#1020, cloud#1664)」 to the measured truth: the precondition is reachable today — a deployment that never requests a walled posture and merely holds more than one sys_organization row under `single` boots and serves; since #17010 (PR #17460) TenancyService takes a count(sys_organization) census and reports that state at `error` at boot, naming the declared posture, the count and the two remedies, and does not refuse it; ADR-0093 D5 refuses the different case of a requested-but-absent wall. One clause was added saying what the correction does to §1.2's argument — the discount item 3 gives the leak now rests on a reported state, not a refused one. Nothing decides the refuse-or-report fork; no other item, no decision text, no status line moved. The card's premise held on origin/main in full. Assignee was already set to os-litant by the PM dispatch atom and was not written by me; the newest Claim: comment (5624989767) names this branch, so identity checks out and no second claim was posted.",
  "tests": "Gate families derived from the FINAL diff, not recalled: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at 8f7761df — 18 commands, change set 1 path, merge base edaf3b2f7, three-dot. All 18 run, each exit code captured BEFORE any pipe (`cmd > log 2>&1; EXIT=$?`), all exit 0. Reconciliation `--ran` with `command :: exit N` lines: 「dispatch-gates --ran: 18 derived famil(ies) accounted for — 18 run, 0 NOT-MEASURED (a DERIVED zero — all 18 recorded an exit code and none of them is 3).」 Gate #10 (`pnpm --filter @objectstack/lint run check:doc-formula-expressions`) exited 3 on its first run = PREREQUISITE NOT MET, its own words 「Nothing was measured: this gate exited before running a single check」 — NOT a finding; @objectstack/formula and @objectstack/lint were unbuilt in a fresh worktree, built through the shared verify lock (OS_VERIFY_LOCK_SLOT=issue-17467-adr0131; `os-verify-lock: VERDICT command-exit 0 · held the lock 1s · waited 0s`), then re-run exit 0. No changeset (see skip_changeset). No ablation/reverse-verification artifact: this is a prose correction inside a decision record — there is no runtime behaviour to mutate, so that field of the template does not apply here rather than being skipped.",
  "gates": [
    "node scripts/check-adr-links.mjs :: exit 0 :: 'check-adr-links: 680 relative link destination(s) under docs/adr/ resolve'",
    "node scripts/check-adr-links.mjs --self-test :: exit 0 :: 'check-adr-links --self-test: discrimination, census, ADR-0046 pin and baseline staleness all verified'",
    "node scripts/check-adr-symbol-anchors.mjs :: exit 0 :: 'check-adr-symbol-anchors: 2073 anchors across 139 records resolve … 0 line anchors survive.'",
    "node scripts/check-adr-symbol-anchors.mjs --self-test :: exit 0 :: 'every finding class provoked, healthy anchors silent, population live, wiring pinned (2073 live anchors)'",
    "node scripts/check-ci-filter-parity.mjs :: exit 0 :: 'OK: all 174 declared cross-package glob(s) (125 unique) are covered by core or crosspkg …'",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0 :: 'check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords … all registered).'",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: '24 assertions, 5 mutations of the shipped parsers each driven to red.'",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0 :: 'comment-mask corpus sweep: 6587 files, 0 disagree, 0 unparseable, 60.7s'",
    "node scripts/report-test-timings.mjs --self-test :: exit 0 :: 'report-test-timings: self-test OK (61 cases across 4 batteries …)'",
    "pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 3 then exit 0 after building its two declared prerequisites :: 'check:doc-formula-expressions: 22 record-scoped formula example(s) across 438 files / 1375 TS blocks judged clean by @objectstack/formula.'",
    "pnpm check:adr-anchors :: exit 0 :: 'check-adr-anchors: OK (53 anchored file(s), every governing ADR still referenced; … 34760 citation(s) across 4364 file(s) resolve; 1019 decision-letter citation(s) … name a decision the record makes).'",
    "pnpm check:cross-package-test-inputs :: exit 0 :: 'OK: 28 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob'",
    "pnpm check:doc-authoring :: exit 0 :: 'doc authoring guard: 15039 customer-facing string(s) across 939 spec sources clean — no internal issue-id references'",
    "pnpm check:driver-memory-census :: exit 0 :: 'check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live …'",
    "pnpm check:nul-bytes :: exit 0 :: 'check-nul-bytes: OK (scanned 8321 text file(s) … no raw ASCII control bytes).'",
    "pnpm check:pm-governed-merges :: exit 0 :: 'check-governed-merges --self-test: 317 assertions …'",
    "pnpm check:refd-timer-probe :: exit 0 :: 'OK  check-refd-timer-probe: 6582 source file(s) swept …'",
    "pnpm check:watch-hint-literal :: exit 0 :: 'check-watch-hint-literal: 69 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.'",
    "PATH FACE — node scripts/pm/check-governed-merges.mjs --branch claude/issue-17467-adr-0131-refused-boot-premise :: exit 3 (this gate's GOVERNED verdict code, not a failure) :: 'governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic). ⛔ GOVERNED — a human merge is the review record for this PR (#9495 regime). docs/adr/** ×1'",
    "TIER — node scripts/pm/dispatch-gates.mjs --tier docs/adr/0131-…md :: exit 0 :: 'Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled.'",
    "CONTROL CHARS (beyond check:nul-bytes) — grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' on the edited file :: exit 1 (no matches)"
  ],
  "not_run_locally": "Repo-wide scans (pnpm lint and the rest of the lint workflow's farm) are CI's run, not this PR's local debt. Outside the derived 18 the tool names 49 artifact-roster families, 11 declared-wide families, 14 pending-changeset families and 1 path-scheduled CI job; its own line for the rosters: 「None of their rosters sits in a directory your paths are in, so none of them is a lead about this card.」 No local narrowing was applied beyond that, so nothing here is an undeclared skip.",
  "zone2_measurements": {
    "a_refused_boot_occurrences": "BEFORE (on the branch, pre-edit) grep -n 'refused boot' returned EXACTLY TWO, quoted with their numbers: ':132  3. The measured leak's precondition — many organizations with Layer 0 inert — is today a refused boot' and ':558  whether the wall is enforced differs. Degraded tenancy stays a refused boot. `single` is never a'. AFTER the edit it returns two again — ':133   not a refused boot: a deployment that never *requests* a walled posture and merely *holds* more' and ':564  whether the wall is enforced differs. Degraded tenancy stays a refused boot. `single` is never a'. ⚠ DEVIATION FROM THE DISPATCH'S EXPECTED SHAPE, reported not smoothed: the Zone-2(a) expectation was 「item 3 no longer says 'refused'」, but Zone 3's own suggested wording contains 'not a refused boot' and 'does not refuse it', and I kept that negation because it directly contradicts the sentence a returning reader remembers. So item 3 no longer ASSERTS a refused boot; it now DENIES one, and the phrase is present in the file on three lines' worth of item-3 text (':133' denying, ':564' asserting). D11 at ':564' is byte-identical to origin/main ':558' — proved by od -c on both (identical output, 0000141 bytes each), and the diff is a single hunk that does not reach it. Only its line number moved, because item 3 grew from 2 lines to 8.",
    "b_census_on_main": "packages/plugins/plugin-auth/src/tenancy-service.ts at e758131b (PR #17460, merged 2026-09-10T16:37Z; `git merge-base --is-ancestor e758131b origin/main` exit 0 — a self-proving positive, no control leg needed). Reporting lines with numbers: ':316  const counted = await engine.count(\"sys_organization\", {}, { context: SYSTEM_CTX });' (the census, inside probeOrganizationCount, documented ':304 Never throws'); ':343  if (postureEnforcesWall(census.posture)) return null;' (a walled posture reports nothing); ':348-364' the report text, which itself says \"nothing refused this boot and THE DEPLOYMENT WILL KEEP LOOKING HEALTHY\" and spells \"TWO WAYS OUT, and this deployment has to pick one: (1) DECLARE A WALLED POSTURE … or (2) HOLD ONE ORGANIZATION …\"; ':401  if (logger?.error) logger.error(message, meta);' / ':402  else logger?.warn(message, meta);' (the `error` channel with a warn fallback for a sink with no error); ':491-500' the call site on TenancyService.defaultOrgId(), which still ends `return resolved;`. NOTHING REFUSES: `grep -n throw` on the same file returns four hits and ALL FOUR are prose inside comments/docblocks (':279', ':304', ':382', ':404') — no throw statement, no non-zero exit on the census path. The file's own docblock ':69' states it: '⛔ Boot PROCEEDS. This census only REPORTS'.",
    "c_adr0093_d5": "docs/adr/0093-tenancy-mode-and-membership-lifecycle.md ':292-296' — 「At boot, when `tenancy.requested === true` and the organizations package fails to load (missing, or its `init()` throws): — **Default: refuse to boot.** Exit non-zero with an actionable error naming the package, the flag, and the two remedies (install the package / unset the flag).」 and its summary ':50-51' — 「**D5** — The degraded middle state **fails fast**: `OS_MULTI_ORG_ENABLED=true` without a working `@objectstack/organizations` refuses to boot.」 ⇒ D5's precondition is a wall the deployment REQUESTED and cannot have. It does not reach a deployment that requested no wall at all. The contrast the rewritten item draws is therefore a reading of D5's own text, not an assertion.",
    "d_gate_derivation": "See the gates array. 18 derived / 18 run / 0 NOT-MEASURED (derived, not claimed). The ADR-shape gates the dispatch predicted are all present and green: check-adr-links, check-adr-symbol-anchors and check:adr-anchors."
  },
  "skip_changeset": "None owed. The whole diff is one file under docs/adr/**, which is on the fast-track non-published list (docs/adr/** · .claude/** · scripts/pm/** · repo-root config · private packages · comments). No package files[] ships it, no source, no type, no wire shape. Corroborated mechanically rather than by hand: the derivation lists 14 families as 「apply once this card's changeset exists … derived against a path that does not exist yet」, i.e. none is owed by a diff with no package change. skip-changeset label applied and read back.",
  "mcp_calls": "0 — every GitHub read and write on this run went through container curl on the REST channel (repo-scoped probe GET /repos/objectstack-ai/objectstack = HTTP 200, so the session gate is open), plus git for the card/PR/history reads. Zero MCP GitHub tool calls, and no dedup search was owed because nothing was filed.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the dispatch's register reading 「No 'Amendments' section exists in this repo's ADRs (measured: 0 files)」 is exact for the literal plural heading (`grep -rn '^## Amendments' docs/adr/` = 0) but 16 ADR files carry a singular `## Amendment (date, #card): …` section (`grep -rln '^#\\+ .*[Aa]mendment' docs/adr/` = 16), and #15244 — one of the same-class precedents the card names — landed exactly that way in ADR-0094:498. Not used here, and the choice is recorded as decided rather than overlooked: that convention marks a DECISION changing (a D-item reversed, a gate retired), whereas §1.2 is a findings section whose items are dated by the evidence they cite inline (#10103, #12699, cloud#1239); an end-of-file section would breach this card's declared file surface (§1.2 item 3 only); and ADR-0131 carries no amendment note of its own to match. Carrier: whoever next amends an ADR-0131 DECISION.",
    "noted, not filed: after this edit the phrase 'refused boot' is carried on a third line of ADR-0131 (:133, as a negation inside the corrected item), so the card's own scope-fence table — which lists exactly two occurrences — under-counts by one from now on. Nobody is harmed and the card's real point is strengthened, not weakened: a blind sed over the phrase would now break TWO correct lines instead of one. Carrier: the next editor of ADR-0131 §1.2 or D11.",
    "noted, not filed: packages/plugins/plugin-auth/src/tenancy-service.ts:56-58 quotes the exact sentence this PR rewrites — 「ADR-0131 §1.2(3) states that the precondition it reasons about … 「is today a refused boot」. It is not.」 After this merges, that docblock describes a sentence the record no longer carries (it stays TRUE as a statement about what the record used to say, and its conclusion is unchanged). Deliberately untouched: outside the declared file surface; the four in-place-fix conditions do not all hold (it would add a whole new verification face — the plugin's typecheck and suite — and plugin-auth is a hot file, PR #17443 was named as holding auth-plugin.ts at claim time); and it is not filing-eligible under Prime Directive #10 — not a reproducible defect, not a declared-contract violation, not a metadata-authoring trap, but a stale code comment, which the standing rule puts in the note-don't-file bucket. Carrier: whoever next edits that docblock, e.g. if the maintainer settles the refuse-or-report fork.",
    "noted, not filed: label 'documentation' appeared on PR #17544 between my additive label write and the read-back. I did not set it; ⛔ not corrected (os-dev rule 2 — state on a PR you did not set belongs to another actor). Carrier: none needed; recorded so the PM's label reading is not surprised."
  ]
}

---

Generated by Claude Code

[os-litant]

ACCEPT — PR #17544 (head 8f7761df) reviewed in-seat at the contract-review tier (skills seat, session session_01YKEjmbYNvYWJvWGSWx26zK, 2026-09-10T20:47Z).

• Implemented-by: os-dev subagent on claude/issue-17467-adr-0131-refused-boot-premise (claim 5624989767; build tier opus; mode:subagent; report 5625183135). Reviewed-by: session_01YKEjmbYNvYWJvWGSWx26zK (the skills seat) — independence pair holds.
• PR shape: draft; base main (edaf3b2f); first line Fixes #17467; documentation + size/s + skip-changeset (no package moves); one footer; a 维护者速读 draft in the body, 席位意见 blank. Changed files read three-dot by this seat: exactly docs/adr/0131-total-organization-ownership-no-null-organization-id.md (+8/−2, one hunk, §1.2 item 3).
• Path face by this seat: GOVERNED (docs/adr/**, CODEOWNERS-routed) ⇒ human terminal; ⛔ this seat never flips ready, enqueues or approves. check-clause2-carriers.mjs --pair 17544 exit 0.
• The whole diff read by this seat: item 3 now states the measured truth — the precondition is reachable today, not a refused boot; since [finding] A single-posture deployment holding more than one sys_organization row boots silently — ADR-0131 §1.2(3) calls that precondition 「a refused boot」 and it is not; the harm surfaces five cards away (platform admin reads 0 rows on /data, system writes refused by #8844) #17010 (PR fix(plugin-auth): report at error when a single-posture deployment holds more than one organization (#17010) #17460) TenancyService takes a count(sys_organization) census and reports the state at error at boot, naming the declared posture, the count and the two remedies, and does not refuse it; ADR-0093 D5 refuses the different case of a requested-but-absent wall — and the one clause the grading asked for: 「The discount this item gives the leak therefore rests on a reported state, not a refused one.」 ⛔ Nothing settles the refuse-or-report fork; the 速读 says so in its own 「你要做的」. Measured by this seat on the head: refused boot occurs at :133 (the denial inside the corrected item) and :564 (D11), and :564 is byte-identical to main's :558 (line number moved, text not) — the scope fence held; check-adr-links 680 destinations resolve, check-adr-symbol-anchors 2073 anchors resolve, check-adr-anchors green, all run by this seat on the head. The dev's Zone-2 readings anchor every claim in the sentence: tenancy-service.ts :316 (the census), :343 (a walled posture reports nothing), :348–:364 (the report text), :401–:402 (error with a warn fallback), :491–:500 (the call site returns), grep throw = four comment hits and no throw; ADR-0093 :292–:296 / :50–:51 (D5's own refusal text). The dev's deviation is right and stated: the item now DENIES a refused boot rather than omitting the phrase, because the denial is what corrects a returning reader.
• Gates: 18 derived / 18 run / 0 NOT-MEASURED (--ran reconciled; check:doc-formula-expressions after its prerequisite build under the verify lock). CI at this reading on 8f7761df: 34 check runs — 22 success, 11 skipped, 1 in progress, none failed.
• noted, not filed (accepted as noted): 16 ADRs carry a singular ## Amendment (…) section for DECISION changes — not used here, and the reason is right (a findings item dated by its inline citations, and an end-of-file section would breach the declared face); tenancy-service.ts :56–:58 quotes the old sentence in a docblock and stays true as history — the next editor of that docblock; the documentation label was added by another actor.
• Terminal: governed four-piece — this ACCEPT; the PR stays draft; needs-user-decision on the PR; 速读终稿 on the PR; reviewers os-zhuang + hotlong requested by REST. On MERGED: landing record here + pm:dispatched / assignee cleared.

---

Generated by Claude Code