docs(adr): ADR-0128 Status is Accepted — the maintainer's reply of 2026-09-07 is the acceptance act (ruling A, third record)

[os-musk]

Fixes #15453

Ruling A's third and last record. ADR-0130 landed in PR #15704 and ADR-0131 in PR #16590; this one was held back since 2026-09-05 because the earlier ruling's precondition did not hold for it, and the director seat has now recorded the maintainer's acceptance directly.

The ruling being executed

Director seat, summon #17, decision batch #1, comment 5572010837, 2026-09-07T14:22Z. Provenance in that comment: maintainer, live PM chat with the director seat, batch #1 item 4, verbatim and untranslated reply 「同意」. Quoted:

Ruled. docs/adr/0128-producer-discriminated-aad-for-cryptocontext.md's Status line changes to Accepted (2026-09-07) — accepted by the maintainer's reply of 2026-09-07 (objectstack#15453, decision batch #1 of director summon #17), in ADR-0125's spelling, dated to this ruling rather than to the 2026-08-28 landing — because that landing PR (#12839) was merged by the seat account os-sales, which ruling A of 2026-09-05 (5548576472) explicitly does not cover. Options B (keep Proposed) and C (treat the seat merge as acceptance) are refused.

The change — one field on one file

docs/adr/0128-producer-discriminated-aad-for-cryptocontext.md, source line 3, +1 / −1.

Before (one source line, 663 bytes — the field is not soft-wrapped here, unlike both sibling records):

**Status**: Proposed (2026-08-28) — awaiting the maintainer's hand-merge, which is itself the acceptance act for a governed surface (Prime Directive #14). The **direction** below was already ruled on [#12599](...) (maintainer, 2026-08-27, decision-inbox batch 6, verbatim and untranslated: 「其他同意」, accepting the seat recommendation "A now, with B recorded as the intended direction in its own ADR"). ⛔ **Nothing here is implemented, and this record changes no behaviour.** The prose half of that ruling shipped separately; see [Consequences](#consequences) for what is built and what is not.

After (one line):

**Status**: Accepted (2026-09-07) — accepted by the maintainer's reply of 2026-09-07 (objectstack#15453, decision batch #1 of director summon #17)

Nothing else moved: ADR-0126's **Original status**: history line untouched, no other record touched, content/docs/releases/** untouched, no changeset (skip-changeset).

Why this line does not carry the siblings' merge clause

ADR-0130 and ADR-0131 both end with "accepted by the merge that landed it on main (…), which is itself the acceptance act for a governed surface (Prime Directive #14)". That clause is deliberately absent here, on the ruling's own words. This record's landing PR #12839 (commit bbf88be85, 2026-08-28) has merged_by = os-sales, a seat account. Ruling A of 2026-09-05 (5548576472) says a seat merge is exactly the case it does not cover, which is why this record sat outstanding while its two siblings landed. The 2026-09-07 ruling supplies a different acceptance act — the maintainer's reply — and dates the line to it. So merged_by is not re-run here as a gate: it is the reason the clause and the date differ, and it is recorded rather than tested.

The 2026-08-28 seat merge itself is recorded by the ruling as a governed-merge audit row for the maintainer's recognition list, not as a new finding card, so nothing is filed from this PR.

Judgment calls — a reviewer can reject either

1. The whole field is replaced, so three still-true trailing sentences are dropped. The two precedent flights each dropped a trailing sentence with the field, and in both cases that sentence had become false on acceptance (「Nothing below is settled until this record merges」). That is not true here: all three of this field's trailing sentences remain true. What is dropped, and where each survives:

dropped clause	still true?	survives at
the #12599 direction ruling, 2026-08-27, decision-inbox batch 6	yes	line 4 **Deciders**, line 8 **Surfaced by** (which links the ruling comment 5434987411 directly), line 130 References
the verbatim 「其他同意」 of that 2026-08-27 ruling	yes	nowhere else in this record, and nowhere else in the repo for this ruling — only the pointer to comment 5434987411 survives
⛔ Nothing here is implemented, and this record changes no behaviour. plus the pointer to Consequences	yes	§Consequences, lines 118–124: "What is built: the prose, and nothing else … What is not built: all of D1–D3" and "No behaviour changes because this record exists, and no ciphertext is affected." Also line 7, **Consumers** (at implementation time; none today)

The middle row is the real cost, and it is the reason this is flagged rather than assumed: a verbatim maintainer quotation leaves the record. The case for dropping it anyway is the precedent's stated principle — the Status field carries the state and the act, and nothing else — plus the fact that the ruled replacement text is complete on its own and the ruling instructs no appendix. If a reviewer prefers the quotation kept, the minimal alternative is to replace only the first sentence and leave the rest of the field standing; say so and it will be re-flown.

2. No terminal period. The ruled text is quoted in the ruling as ending at ). Both sibling lines end with .. This PR keeps the ruled bytes exactly, no period added. Purely a punctuation call.

3. objectstack#15453 is kept as ruled — the cross-repo spelling rather than a bare #15453 or a full link. It is the ruling's own byte, and check:adr-links / check:adr-anchors / check:adr-symbol-anchors all pass over it.

Mechanism assumptions, as measured

#	assumption	result
K1	current field reads Proposed (2026-08-28) — awaiting the maintainer's hand-merge…, may be soft-wrapped	Text holds; soft-wrap does not — it is a single 663-byte source line (line 3), so "replace the whole field" and "replace line 3" coincide here. Line 2 is blank, line 4 is **Deciders**.
K2	git log origin/main -- docs/adr/0128-* shows the landing bbf88be85 and no later Status change	Holds, after a declared deepen. The checkout was shallow with its horizon at 2026-08-31, so the first run showed only the graft boundary and not the 2026-08-28 landing. Re-fetched --shallow-since=2026-08-25 (1905 commits), after which the path's log is exactly one commit: bbf88be85 2026-08-28. git diff bbf88be85 origin/main scoped to that one path is empty, so the file is byte-identical to its landing state and no Status change ever followed. Ancestry git merge-base --is-ancestor bbf88be85 origin/main exits 0 (a positive reading, self-proving); control leg a7c14cdf3 also exits 0.
K3	no open PR and no remote branch touches the file	Holds. git ls-remote --heads origin = 1059 heads, zero naming 0128 or 15453. Open-PR search is:pr is:open 0128 in:title = 0 results, with a control leg on the same channel: the same query without is:open returns PR #12839, so the empty result is a reading and not a broken channel. The dispatch's own open-PR list at 14:5xZ agrees (none of the 14 open PRs is on docs/adr/**).
K4	the ruling dates to 2026-09-07 and the reply is the act, so merged_by is not a precondition	Holds, and is not re-run as a gate. #12839's merged_by is os-sales, recorded above with why it no longer decides this line.

Gates — 17 derived, 17 run, 0 NOT MEASURED

Derived from the real change set, never a hand list: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, stderr: "gate list derived from the tree of 'objectstack-ai/objectstack' at commit 8bf8a03", "change set derived from git — 1 path(s) vs merge base 4d72868 of 'origin/main' and HEAD (three-dot semantics)". Reconciled with --ran: "✓ dispatch-gates --ran: 17 derived famil(ies) accounted for — 17 run, 0 NOT-MEASURED." Every exit captured by redirect-then-capture, before any pipe. All at HEAD=8bf8a032e, the final commit.

#	command	exit
1	node scripts/check-adr-links.mjs	0
2	node scripts/check-adr-links.mjs --self-test	0
3	node scripts/check-adr-symbol-anchors.mjs	0
4	node scripts/check-adr-symbol-anchors.mjs --self-test	0
5	node scripts/check-ci-filter-parity.mjs	0
6	node scripts/check-closing-keyword-parity.mjs	0
7	node scripts/check-closing-keyword-parity.mjs --self-test	0
8	node scripts/check-comment-mask-corpus.mjs	0
9	pnpm --filter @objectstack/lint run check:doc-formula-expressions	3 → 0 on re-run
10	pnpm check:adr-anchors	0
11	pnpm check:cross-package-test-inputs	0
12	pnpm check:doc-authoring	0
13	pnpm check:driver-memory-census	0
14	pnpm check:nul-bytes	0
15	pnpm check:pm-governed-merges	0
16	pnpm check:refd-timer-probe	0
17	pnpm check:watch-hint-literal	0

Row 9's first exit 3 was PREREQUISITE NOT MET (@objectstack/formula and @objectstack/lint not built) — not a measurement. The prerequisite was built under the shared lock (OS_VERIFY_LOCK_SLOT=issue-15453; "os-verify-lock: VERDICT command-exit 0 · held the lock 17s · waited 0s") and the gate re-run; the table reports the re-run.

Verdict lines quoted from the gates themselves — the three the ruling names:

• ✅ check-adr-links: 679 relative link destination(s) under docs/adr/ resolve
• ✅ check-adr-symbol-anchors: 2063 anchors across 139 records resolve — 277 symbol (251 declaration, 26 literal), 1761 file-level, 25 cross-repo, 6 exempt, 3 continuation. 0 line anchors survive.
• check-adr-anchors: OK (53 anchored file(s), every governing ADR still referenced; 133 decision number(s), each naming one decision or an allowlisted pair; 33780 citation(s) across 4292 file(s) resolve; 997 decision-letter citation(s) on the anchored surface name a decision the record makes).

and two more:

• check-nul-bytes: OK (scanned 8197 text file(s) -- 8197 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
• ✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1301 packages/spec/src files (the re-run)

Governed predicate, as the ruling asks: node scripts/pm/check-governed-merges.mjs --test docs/adr/0128-…md → exit 3, ⛔ GOVERNED — a human merge is the review record for this PR (#9495 regime)., docs/adr/** ×1.

pnpm lint is a MEASURED NARROWING, not a skip, all three evidences at the final commit:

1. Population, read from eslint's own config: eslint.config.mjs has zero markdown entries — grep -niE 'markdown|\.md|mdx' over it returns nothing.
2. File count, read from --format json: eslint --no-inline-config --format json on the one changed file returns 1 result, errorCount 0, single warning File ignored because no matching configuration was supplied.
3. Invariance over untouched files: the config never enables type-aware linting for any file — its own comment at line 328 reads "this repo runs one eslint.config.mjs, which never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file, test or not" — so a one-line change in a file eslint is not configured to read cannot move any untouched file's verdict.

No ablation and no reverse verification. A one-field docs edit has no behaviour to mutate, no build output, and no cross-package type surface; there is nothing whose removal could turn a diagnostic red. Stating that rather than manufacturing a ritual.

Serial probe before opening: git fetch origin main && git merge-tree --write-tree --name-only origin/main HEAD against origin/main bc0ac1d1f → exit 0, tree f825afe7d, no conflicted path.

Governance

docs/adr/** is a governed surface (Prime Directive #14). This PR is a draft: not readied, not enqueued, no auto-merge, no reviewers requested, no review submitted. The maintainer merges by hand. skip-changeset applies because the diff publishes nothing from any released package.

维护者速读(草稿)

改了什么 — 一份 ADR(docs/adr/0128-…)的状态行,一行换一行。原来写「Proposed(2026-08-28)—— 等维护者手动合并」,现在写「Accepted(2026-09-07)—— 接受行为是维护者 2026-09-07 的回复(objectstack#15453,总监召集 #17 决策批次 #1)」。除这一行外,整个仓库没有第二处改动。

为什么改 — 这是本卡三条状态行里最后一条。另外两条(ADR-0130、ADR-0131)已在 PR #15704、#16590 落地,靠的是「落到 main 的那次合并即接受」。ADR-0128 用不了这个理由:它 2026-08-28 那次合并的执行者是席位账号 os-sales,不是人;2026-09-05 的裁决明说这种情况不在它覆盖范围内,所以它被搁置了两天。9-07 你在 PM 对话里回的「同意」补上了这个缺口 —— 现在的接受行为是你那句回复本身,状态行也据此写成 9-07,而不是 8-28。姊妹记录那半句「由合并接受」在这里被有意去掉了。

风险与代价(含回滚) — 风险只有一个,已在正文表格里逐条列清:整个 Status 字段被换掉,连带删掉了三句仍然成立的尾句,其中一句是 2026-08-27 那次方向裁决的逐字原文「其他同意」。这句原话在本记录里、乃至全仓针对那次裁决,都没有第二份拷贝(只剩指向评论 5434987411 的指针)。另外两句(方向裁决的出处、以及「本记录未实现任何东西、不改变任何行为」)在第 4、7、8、118–124、130 行都还在。⛔ 这一条正是请你拍板的地方:若你认为那句原话必须留在状态行里,只需说一声,改成「只替换第一句、保留其余」重飞即可,成本是一次 XS 飞行。回滚成本接近零:单文件单行,git revert 即可,没有代码、没有生成物、没有发布面。

席位意见 — (留空,待席位 ACCEPT 时填写)

你要做的 — 一个动作:确认这条状态行的措辞可以接受(尤其是上一段那个删除),然后手动合并本 PR。⛔ 不要用合并队列、不要 arm auto-merge —— docs/adr/** 是受管面,手动合并本身就是评审记录。合并后本卡关闭,ruling A 的三条记录全部执行完毕。

---

Generated by Claude Code

[os-musk]

ACCEPT — flight K, PR #16647 at head 8bf8a032e (ADR-0128, ruling A's third and last record), contract-tier review on the seat's own readings, 2026-09-07T15:22Z.

Own readings (review worktree detached at 8bf8a032e, origin/main = bc0ac1d1f):

• Diff: one file, +1/−1, docs/adr/0128-producer-discriminated-aad-for-cryptocontext.md line 3 only; one commit; no control bytes; git merge-tree --write-tree origin/main HEAD exit 0 (tree f825afe7d).
• Ruled text: the landed line after its **Status**: prefix is BYTE-EQUAL to the text inside the ruling's backticks (comment 5572010837 on [finding] Three merged ADRs still say "Proposed — awaiting the maintainer's hand-merge, which is itself the acceptance act" — a sentence their own presence on main disproves, and which seats read as a gate #15453), including the objectstack#15453 spelling and the absence of a terminal period.
• Gates re-run here: check-adr-links 679 destinations resolve; check-adr-symbol-anchors 2063 anchors across 139 records; check:adr-anchors OK; check-governed-merges.mjs --test exit 3 (docs/adr/** ×1).
• Premises: K2 holds (git log origin/main -- docs/adr/0128-* is exactly bbf88be85; the path diff bbf88be85..origin/main is empty); K3 holds (own git ls-remote --heads: the only head naming 0128 or 15453 is this flight's branch); K1's soft-wrap hedge fell as the report says (line 3 was one 663-byte source line, so "replace the field" and "replace line 3" coincide).
• Sibling form on origin/main: ADR-0125 / 0130 / 0131 all carry the merge clause; this record deliberately does not, on the ruling's own words (the 2026-08-28 landing was a seat merge by os-sales, which 5548576472 does not cover).
• CI at 15:21Z: 31 of 33 check runs completed success/skipped; Lint & Repo Gates and Type Check · workspace still in progress. Not a landing condition on this surface (human hand-merge is the review record); tracked on the seat post until they complete.

Review checklist:

• ① Derived judgments: the whole-field replacement (judgment call 1) follows the ruling literally — the ruling says "Status line" and line 3 IS the whole field — and matches the shape both siblings landed. The verbatim 「其他同意」 of the 2026-08-27 direction ruling survives only as the pointer to comment 5434987411; flagged for the maintainer in the 速读 below, not ruled by this seat. No terminal period and objectstack#15453: ruled bytes, kept.
• ② semver: none — docs record, skip-changeset, nothing published moves.
• ③ Boundary flags: governed surface (docs/adr/**). Draft kept; not readied, not enqueued, no auto-merge; reviewers os-zhuang + hotlong requested and needs-user-decision set on the PR in this same wake. The dev's out-of-scope note on the shallow-clone horizon is the hazard AGENTS.md already documents — 承接者:无.

Implemented-by: os-dev subagent abe0e3350f3dcd67d (container & tier as recorded on the claim 5572487083 on #15453)
Reviewed-by: domain:skills seat, session session_018dxq7YqsLDMeZDZ5AzsgJX, at CONTRACT_REVIEW_TIER (own get_session reading: session_context.model = last_served_model)

维护者速读

改了什么: 一份 ADR(docs/adr/0128-…)的状态行,一行换一行:「Proposed(2026-08-28)—— 等维护者手动合并」改为「Accepted(2026-09-07)—— 接受行为是维护者 2026-09-07 的回复(objectstack#15453,总监召集 #17 决策批次 #1)」。全仓只动这一行,措辞与你的裁决原文逐字节相同。

为什么改: 这是本卡三条状态行里的最后一条。ADR-0130、ADR-0131 靠「落到 main 的那次合并即接受」写好了;ADR-0128 那次合并是席位账号 os-sales 执行的,9-05 的裁决明说不算,所以搁到 9-07 你回「同意」补上了接受行为,状态行据此写 9-07 而不是 8-28。

风险与代价(含回滚): 唯一请你过目的点:整段 Status 被换成一行,顺带删掉了三句仍然成立的尾句;其中 2026-08-27 方向裁决的原话「其他同意」在本记录里没有第二份(只剩指向评论 5434987411 的链接),其余两句在第 4、7、8、118–124、130 行都还在。若你要把这句原话留在状态行里,回 B:改成只替换第一句、其余保留,一次 XS 重飞。回滚 = revert 这一行,无代码、无发布面。

席位意见: 席位复核通过,建议 A(照裁决整行替换,与两份姊妹记录同形;那句原话有链接可追)。

你要做的: 认可 A 就直接手动合并本 PR(受管面,⛔ 不走队列、不挂 auto-merge);合并即关卡,ruling A 的三条记录全部执行完毕。A 还是 B?

---

Generated by Claude Code