L1: `sys_metadata_activation` platform object — the activation ledger (ADR-0126 §4)

[os-support-ai]

Part of #12150 (Epic: ADR-0126 implementation, v17 line — ships as a 17.x minor, maintainer-ruled). Cut on maintainer instruction 2026-08-25 「现在可以创建相关的子issue吗？」 by PM session session_01KWRU3s15AJz7PGW7a7wdCh. Contract: ADR-0126 §4 (merged 28b47a93) — consume, do not re-litigate.

Deliverable

Declare the platform object sys_metadata_activation in packages/platform-objects, beside its data-plane siblings (sys_metadata_history, sys_automation_run, sys_flow_dispatch). ⛔ Zero packages/spec surface — it is an ordinary platform object, not a metadata type.

Columns, exactly (§4): metadata_type (string) · name (string) · package_id (string) · organization_id (string, nullable — reserved, always NULL in this line) · active (boolean). ⛔ No replaced_by, no cloned_from — amendment ruling 2 removed designation linkage; do not re-add.

Uniqueness: one row per (metadata_type, name, organization_id NULL-collapsed). Absence of a row = packaged default = active.

Acceptance

• Object declared with the five columns and the uniqueness rule; pin test on the schema identity (columns by name, so drift is loud).
• An empty ledger changes nothing anywhere — no runtime consults it yet (consumers arrive in the sibling legs); prove no behavior change on a stock boot.
• No packages/spec diff in the PR.

Refs: ADR-0126 §4 · #11513 (sys_permission_set.active row-state precedent, #4669 carve-out) · #12049 (survey)

[os-support-ai]

Claim: maintainer direct-dispatch (#12150 program — dispatched at creation, anti-preemption per maintainer instruction 2026-08-25)
Session: session_01KWRU3s15AJz7PGW7a7wdCh
Branch: claude/issue-12155-metadata-activation-ledger
Domain: domain:services
File surface: packages/platform-objects/** (+its tests); ⛔ no packages/spec, no runtime consumers (those are L2/L3)
Container & model: mode:subagent, model: opus (implementation leg, default-judgment tier per the 2026-08-10 three-tier ruling)
Clause-②: no — a new platform object with no runtime consumer in this leg; the refusal-behavior legs (L2/L3) carry their own declarations
Serial constraints cleared: new file surface; no in-flight claim touches the platform-objects activation area

---

Generated by Claude Code

[claude]

{
 "issue": 12155,
 "status": "done",
 "branch": "claude/issue-12155-metadata-activation-ledger",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/12185",
 "premise_still_valid": true,
 "summary": "Declared sys_metadata_activation in packages/platform-objects/src/system/ per ADR-0126 §4 (D2): exactly the five ADR columns (metadata_type, name, package_id, organization_id nullable-reserved, active) plus the primary key id every data-plane sibling declares. No replaced_by / cloned_from — amendment ruling 2 removed the designation linkage, and the pin test asserts the column set by EQUALITY and additionally names both removed columns. Row identity (metadata_type, name, organization_id NULL-collapsed) is spelled as a declared index with unique: 'organization' (ADR-0120 D1), NOT a hand-written composite naming organization_id: that spelling is NULL-DISTINCT in SQL and this line's organization_id is NULL on every row by construction, so it would enforce nothing (#5030) and one artifact could carry two contradictory active rows. 'organization' makes the driver prepend COALESCE(organization_id, '__global__') at registration (ADR-0120 D3) — the 'NULL-collapsed' of §4. No lifecycle block on purpose (a row is durable configuration, not telemetry; reaping one would silently re-arm a disabled artifact). Zero packages/spec diff. No runtime consumers in this leg. Premise note: the card's three named siblings have relocated off main — sys_metadata_history to @objectstack/metadata-core, sys_automation_run / sys_flow_dispatch to service-automation, and src/metadata/ is now a back-compat re-export shim — but the deliverable location was unambiguous (packages/platform-objects, per both card and ADR), so the premise holds and the idiom was matched against all three plus in-package sys_setting.",
 "files_changed": [
 "packages/platform-objects/src/system/sys-metadata-activation.object.ts (new)",
 "packages/platform-objects/src/system/sys-metadata-activation.object.test.ts (new, 15 assertions)",
 "packages/platform-objects/src/system/index.ts (export + dir docblock roster)",
 ".changeset/sys-metadata-activation-ledger.md (minor, @objectstack/platform-objects)"
 ],
 "gates_run": "Union re-run AFTER the final commit, at 99590074 — 22/22 green, exit codes captured before any pipe, families derived mechanically via scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (not recalled): build, test, typecheck, check:changeset-gate-self-tests, check:objectui-changeset, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-plugin-teardown-shape, release-rehearsal-clone --self-test, check:i18n, check:i18n-stale-fill, check:engine-double-contract, check:where-matcher, check:cross-package-test-inputs, check:query-options-erasure, check:type-check-coverage, check:nul-bytes. All heavy steps serialized through scripts/pm/os-verify-lock.sh (VERDICT command-exit 0 on every acquisition).",
 "tests": "Package suite: 'Test Files 31 passed (31) · Tests 490 passed (490)'. The new file was proven to actually execute rather than trusted — the package test script carries --passWithNoTests, so a zero-match run reads green: targeted --reporter=verbose gave 'Test Files 1 passed (1) · Tests 15 passed (15)' with all 15 named. check:i18n's FIRST run was not a verdict — it printed 'PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was checked'; after building @objectstack/cli it renders a real one: 'check-i18n-bundles: OK (9 package(s) — all bundles in sync, no undeclared authoring keys)'. REVERSE-VERIFICATION (pin is not vacuous): the mutated module is imported RELATIVELY by the test, so vitest resolves it from SOURCE — no dependency exports hop, no dist, so no rebuild leg applies; restore was trapped on EXIT INT TERM, and each mutation was confirmed on disk by an anchored count before its reading was accepted. (1) regrow replaced_by — anchor 'replaced_by: Field' 0->1 — 2 failed / 13 passed (set-equality AND named-linkage). (2) downgrade to unique: true — declared-index line 1->0, bare-true line ->1 — 1 failed / 14 passed (scope-equality). Both restore legs: 15 passed (15). Both matched the direction predicted before the run.",
 "deviations": [
 "check:i18n needed its prerequisite built (@objectstack/cli) before it could render a verdict at all; built it and re-ran to green. The first exit-1 is recorded as 'not measured', never as a red gate.",
 "check:type-check-debt --re-measure NOT run locally (declared narrowing): it needs the whole workspace closure built, and platform-objects declares its own typecheck script with no debt-ledger entry in the package, so this change has no entry to re-measure. Its cheap structural half, check:type-check-coverage, ran green. CI runs the ratchet regardless.",
 "Repo-wide `pnpm lint` not run locally (declared narrowing) — CI owns that run; the affected package's own typecheck and suite ran green.",
 "The card said to declare the object 'beside' sys_metadata_history / sys_automation_run / sys_flow_dispatch; on main those three no longer share a package, so it landed in packages/platform-objects/src/system/ (the package's home for cross-cutting system objects; src/metadata/ is a re-export shim with nothing declared in it). Location still exactly as the card and ADR specify: packages/platform-objects."
 ],
 "open_questions": [],
 "out_of_scope_findings": []
}

Generated by Claude Code

---

Generated by Claude Code