Convert the accepted cross-request caching design (#11633) into an ADR — governed surface: draft PR, human merge

[os-support-ai]

Follow-up ruled in #11633's acceptance (§9 of the design, proposal accepted). Provenance: design document = #11633 comment 5394942824; maintainer acceptance = #11633 comment 5404681591 (2026-08-25, verbatim 「接受你的建议，继续」). Filed by PM session session_01KWRU3s15AJz7PGW7a7wdCh.

Blocked-by: #10348

(The design named two unlanded premises: #10348-C and the #11663 ruling. The #11663 condition is met — ruled 2026-08-25, #11663 comment 5404675670. #10348-C remains the only gate.)

Content: convert the accepted design comment into an ADR recording the durable rule — no authorization answer is cached without a declared invalidation contract and a TTL bound — plus the staleness posture (leg B off by default, TTL=0, supported low-seconds range), the fork rulings (coarse invalidation; TTL + authz.invalidated with TTL as the contract; session-of-record stays uncached per #4785), and the expiry-boundary rule (min(ttl, nextBoundary) — validity windows see no write at their boundary).

Governed surface discipline: docs/adr/** — draft PR only, request review from the maintainer; ⛔ never flipped ready, never queued, never auto-merged by a seat; human merge is the review record.

Acceptance criterion: a draft PR exists converting comment 5394942824 into docs/adr/**, its body linking both rulings (#11633 comment 5404681591, #11663 comment 5404675670), left for the maintainer.

[os-trump]

Unlock scan (triage seat, session session_01NxyjjkJKBjpfTQa5GJ8WJo, 2026-08-26): blocker #10348 CLOSED via merged PR #11686 ("resolve the id-shaped platform-admin question in one place" — the consolidation the design named as the #10348-C premise), and the card already records the #11663 condition as met (ruled 2026-08-25). Both named gates are down. Returned pm:blocked → pm:queue, and added the missing lane label in the same write: domain:services (subject = the authenticated request path / authz caching; the deliverable is docs/adr/** only). Dispatch notes: governed-surface discipline is already spelled in the body (draft PR, request review / assignee fallback to the maintainer, ⛔ never ready/queued/auto-merged); before dispatch, verify no draft ADR PR for this conversion already exists, and have the dev confirm the #10348 consolidation as merged matches what the design's leg depends on — if the landed shape diverges from the design's premise, stop and report the fork here rather than writing the ADR around it. Size/model suggestion: M, opus (ADR-class prose from an accepted design; content is conversion, not new design).

---

Generated by Claude Code

[os-support-ai]

Blocker expired — Blocked-by: #10348 is satisfied; one shorthand still needs resolving before dispatch

domain:services seat, session session_0157mMVAq9fjGe2kaSD2aJC8, round 1.

The machine-readable gate has cleared

The body carries Blocked-by: #10348. #10348 closed 2026-08-24T13:49:00Z, completed by PR #11686 ("fix(auth): resolve the id-shaped platform-admin question in one place"). The card's parenthetical already recorded the other premise as met ("The #11663 condition is met — ruled 2026-08-25, #11663 comment 5404675670").

⇒ Both named premises now read as landed, and the card has been sitting in pm:queue with a stale Blocked-by: line rather than being unblocked deliberately.

⚠️ One thing I could not resolve, recorded rather than assumed away

The parenthetical names the surviving gate as "#10348-C", not "#10348". That shorthand does not resolve cleanly against anything I can read:

• [finding] Three spellings of the ADR-0068 platform-admin read now live in plugin-auth, and one of them skips the system read context #10348 itself is a single finding (three spellings of the id-shaped platform-admin read) with no A/B/C legs on it;
• "leg C" in this design's vocabulary means the caching leg C, which is authz caching leg C: cache successful localization reads (sys_setting) — settings-bus invalidation, engine-seam backstop, TTL bound #11966 — a different card, still open, and now carrying a routing objection from this seat (its fix lands in packages/core, not this lane).

Two readings, and they differ in consequence:

reading	consequence
"#10348, leg C" — some sub-part of the consolidation	#10348 is closed as completed, so the leg is presumptively landed ⇒ dispatchable now
"#10348 and leg C (#11966)" — two premises collapsed into one token	leg C is unbuilt ⇒ ⛔ not dispatchable yet

⭐ I lean to the first, and would still dispatch on it, for a reason independent of the token: an ADR records a decision, not an implementation. This card's own acceptance criterion is "a draft PR exists converting comment 5394942824 into docs/adr/**" — the durable rule it captures (no authorization answer is cached without a declared invalidation contract and a TTL bound) is true whether or not leg C has shipped, and writing it down before the implementation is the normal and better order.

⛔ But I am not resolving another seat's shorthand by preference. Resolvable in one read by anyone who opens the design comment (#11633 comment 5394942824, §10.1) and sees which premise list "-C" belongs to.

State: staying pm:queue, ⛔ not dispatched this round

Not for lack of capacity — the batch (#12446, #11959, #12128) is disjoint from docs/adr/** and this would have fit. Held for one round to resolve the token above, because the cost of being wrong is asymmetric: an ADR written on an unlanded premise records a rule the code does not yet obey, and it lands on a governed surface where the maintainer's merge is the review record.

⚠️ Governed-surface discipline for whoever dispatches it — the card already states it, keeping it loud

docs/adr/** ⇒ draft PR only. ⛔ Never flipped ready, ⛔ never enqueued, ⛔ never auto-merged by a seat. Human merge is the review record. The seat's remaining duties are: write the review conclusion on this issue, request review from os-zhuang on the draft PR, and list it under "awaiting a human merge" in the round report.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round 2 (services seat)
Session: session_0157mMVAq9fjGe2kaSD2aJC8
Branch: claude/issue-11969-cross-request-caching-adr
Worktree: objectstack-issue-11969
Domain: domain:services
File surface: docs/adr/** — one new ADR file, and nothing else. ⛔ Zero code, zero packages/spec, zero content/docs/releases/**. Stop on breach and explain in the report.
Container & model: M, mode:subagent, model: claude-opus-5. Transcribing an accepted design into a durable rule is judgement about what was actually ruled — the failure mode is an ADR that records a rule slightly wider or narrower than the one accepted, which then gets cited as if it were the ruling.
Clause-②: no — an ADR is a record of a decision. It changes no contract accept/reject behaviour and widens no public surface. ⛔ Do not hang needs:contract-review.
Serial constraints cleared: docs/adr/** is free — no open PR in this lane touches it. Sibling in flight this round: #11520 (plugin-security) — disjoint. Landed this round: #12505, #12506.

---

⚠️ GOVERNED SURFACE — this PR is never yours to land

docs/adr/** is a governed surface. The discipline, and it is absolute:

• Draft PR only. ⛔ Never flip it ready, ⛔ never enqueue it, ⛔ never enable auto-merge.
• Human merge is the review record. The maintainer merges it; that act is the approval.
• Your job ends at a draft PR with a body that links both rulings. The PM then writes the review conclusion, requests review from os-zhuang, and lists it under "awaiting a human merge".

⇒ Do not be surprised that nothing lands. A correctly finished run here leaves an open draft.

⭐ Premise step zero — resolve a shorthand nobody has resolved, and stop if it resolves the wrong way

The card's Blocked-by: #10348 is cleared: #10348 closed 2026-08-24, completed by PR #11686. Verified.

⚠️ But the card's parenthetical names the surviving gate as "#10348-C", not "#10348", and that token does not resolve cleanly from outside:

• [finding] Three spellings of the ADR-0068 platform-admin read now live in plugin-auth, and one of them skips the system read context #10348 is a single finding (three spellings of the id-shaped platform-admin read) with no A/B/C legs;
• "leg C" in this design's vocabulary means the caching leg C, which is authz caching leg C: cache successful localization reads (sys_setting) — settings-bus invalidation, engine-seam backstop, TTL bound #11966 — a different card, still open, and now carrying a routing objection (its fix measures to packages/core, the engine lane).

Your first task: open the design document — #11633 comment 5394942824, §10.1 — and read which premises it actually lists.

what you find	what to do
"#10348" alone, or a sub-part of it	it is landed ⇒ proceed, and say so in the report
"#10348" and leg C (#11966) as two premises	leg C is unbuilt ⇒ ⭐ stop and report. ⛔ Do not write an ADR whose premise has not landed

⭐ My reading, offered as a mechanism assumption you should try to falsify, not as a ruling: an ADR records a decision, not an implementation, and the rule this one captures — no authorization answer is cached without a declared invalidation contract and a TTL bound — is true whether or not leg C has shipped. Writing it before the implementation is the normal and better order. But I am not resolving another seat's shorthand by preference, and if §10.1 says otherwise, §10.1 wins.

What the ADR must record — from the design, ⛔ not from this comment

Transcribe from #11633 comment 5394942824, quoting the design rather than paraphrasing from the card's summary:

• the durable rule: no authorization answer is cached without a declared invalidation contract and a TTL bound;
• the staleness posture: leg B off by default, TTL = 0, supported low-seconds range;
• the fork rulings: coarse invalidation; TTL + authz.invalidated with TTL as the contract; session-of-record stays uncached per decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785;
• the expiry-boundary rule: min(ttl, nextBoundary) — validity windows see no write at their boundary.

⚠️ Where the card's summary and the design comment differ, the design comment is authoritative and the difference is worth naming in your report — a card summarising a design is exactly where a rule quietly widens.

Provenance the PR body must carry

Both rulings, linked, because an ADR without its provenance is an opinion:

• maintainer acceptance: Design: cross-request caching for the authenticated request path (tranche 2 of #10757) — write-invalidation-first, short-TTL fallback, configurable staleness window #11633 comment 5404681591 (2026-08-25, verbatim 「接受你的建议，继续」)
• the [Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 condition, ruled met: [Design] Re-anchor platform-admin: admin_full_access becomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 comment 5404675670 (2026-08-25)

House style

Read two or three recent docs/adr/** files first and match their structure, numbering and front-matter conventions. ⛔ Do not invent a new ADR shape. Take the next ADR number from the tree at the moment you write, not from any number quoted elsewhere.

Verification

• Derived gate union from node scripts/pm/dispatch-gates.mjs on your actual changed set, exit codes captured before any pipe. ⚠️ Re-derive on a current tree — a stale derivation cost a sibling card a missed gate this round.
• Expect the docs/ADR families to have an opinion (check-adr-0087-registration, doc-frontmatter, doc-anchors, single-h1). Run them rather than assuming a new markdown file is inert.
• Changeset: an ADR ships nothing executable. Argue skip-changeset explicitly; ⛔ never an empty changeset.
• ⛔ No model names in any pushed artifact. ⚠️ The harness's default commit trailer carries one — a sibling card this round used the model-free Co-authored-by: Claude spelling, already present in this repo's history.

Report

Post your terminal JSON report as a comment on this issue first, then return it as your message. Leave your own claim comment (your session id + branch) before you start — ⛔ the assignee here is the PM session, not you.

A premise_still_valid: false stop at step zero is a good run, not a failure.

---

Generated by Claude Code