autonumber 业务标识字段默认不唯一,可铸重号 —— 裁定:默认唯一(租户复合形状),显式退出才不唯一

[huangyiirene]

按维护者裁定上行立卡(2026-08-31,hotcrm#1301 决裁批 #19-hotcrm ②,批复「其他同意」采纳呈报「定性业务标识符 + 平台路线」)。

平台级 declared ≠ enforced(实测)

• 平台自己相信 autonumber = 唯一:启动日志把自动编号标识符统称 "unique"(hotcrm#1292 正是被这句措辞误导 —— 以为字段声明过 unique 而实际从未声明);
• 但不默认强制:hotcrm 九个自动编号业务标识字段(合同号/报价号/客户号/产品码/工单号…)只有 crm_case.case_number 显式声明了 unique: true 并获得租户复合唯一索引(COALESCE(organization_id,'__global__'), case_number),其余八个可铸重号;
• 重号路径是实测的,不是假想:objectstack#12394 —— 烧号后 ACC-000009 被发出两次,受害字段正在那八个之列;相关计数器分裂另见 Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686 / The #8686 boot warning asserts an active duplicate-minting hazard for the benign zero-organization first boot, and its object list is a mid-seed race snapshot — it has now generated three consumer cards #12395;
• 逐应用逐字段补声明 + 迁移是重复付税(2026-08-31 应用仓三原则 [ruled] 应用仓基本原则落编:阻塞是平台缺陷时,应用侧等待平台修复 —— ⛔ 不绕行、不半边落地(维护者 2026-08-31,判例 hotcrm#549) #13848):一个「自动编号」若允许重复,它就不是标识符 —— 这该是平台默认。

裁定方向

autonumber 字段默认 unique,租户复合形状照 case_number 既有样板;显式声明退出才不唯一。

设计约束(实现 + 复审判断)

1. 退出通道的拼写与 docblock(何时合法退出:纯展示序号等),⛔ 不发明超出需要的配置面;
2. 存量重号处理必须响亮:默认翻转时,已有数据含重号的表建索引会失败 —— 迁移/启动路径要检测并点名重号行 + 修复指引,⛔ 不静默跳过、⛔ 不静默降级为不唯一;
3. 与 The #8686 tenancy backfill destroys the autonumber high-water mark: the merge targets a row that does not exist yet, the __global__ row is deleted unconditionally, and an already-allocated business identifier is re-issued #12394(烧号重发)/Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686(计数器分裂)的修复交互写进 PR —— 默认唯一会把那两类缺陷从「静默重号」变「响亮拒绝」,这是意图的一部分;
4. 条款②:YES(路径肢 packages/spec/src/** 预期命中 + 内容肢:已发布 autonumber 契约行为变化),契约复审档位,changeset 标行为变化;
5. 首个消费者/验收:hotcrm 八字段在平台默认下获得唯一性、零应用侧声明(hotcrm#1301 已改挂本卡)。

Refs: hotcrm#1301(九字段测量)· hotcrm#1292(被措辞误导的前卡)· #12394 · #12395 · #8686 · #13848。

[os-sam]

Claim: domain:spec execution seat.

• Session: session_017RbbUMnxkUnWhE4j94v8FE
• Branch: claude/issue-13894-autonumber-default-unique
• Worktree: cloud session (mode:cloud, created at dispatch; outcome branch above)
• Domain: domain:spec (the contract flip lands in packages/spec; enforcement already keys off the declared unique — see serial constraints for what this card does NOT edit)
• File surface: packages/spec/src/data/field.zod.ts — unique: UniqueScopeSchema.default(false) (:939) becomes type-conditional: an autonumber field with no explicit unique resolves to the organization-composite scope ('organization', the case_number template), every other type keeps false; the explicit opt-out spelling (unique: false written by the author) and its docblock (when opting out is legitimate — display-only sequence numbers); the autonumber block (:1620–:1650) and RUNTIME_OWNED_FIELD_TYPES (:187) docblocks; pins (default resolves, explicit opt-out honoured, other types unchanged, generated JSON Schema); changeset minor with the BREAKING banner + ADR-0087 disposition; generated artifacts regenerated. Measurement-only surfaces (read, report; ⛔ not edited here): packages/drivers/driver-sql/src/sql-driver.ts (:11854 unique-index creation — what happens today when the index cannot be created over existing duplicate rows: loud failure naming rows, generic failure, or silent skip/degrade), packages/cli/src/commands/migrate/duplicates.ts (already treats type: 'autonumber' as an identifier for the duplicate scan), packages/objectql/src/tenancy/system-write-organization.ts.
• Container & model: cloud session, claude-fable-5-1.
• Clause-②: yes — path limb packages/spec/src/**; content limb: the published autonumber contract's default changes (accept set unchanged, emitted shape changes; a declared unique now materialises where none did). Contract review at CONTRACT_REVIEW_TIER; PR stays draft with needs:contract-review on both carriers.
• Serial constraints: field.zod.ts shared with requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879 (this seat, same round) on a region split — requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879 writes the requiredWhen / bounds describe texts; this card writes unique (:939) + the autonumber block only; requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879 lands first, this branch rebases before its final push. PR docs(driver-sql): pool docblocks name the factory's max 5, not knex's max 10 #14773 (draft) is open on sql-driver.ts ⇒ that file is measurement-only here; any engine/driver/cli change the measurement calls for is a stop-and-report branch (this seat files the engine-lane card and blocks this one on it), never a rider.
• Premise re-read on origin/main 2263ca4d6: unique defaults to false for every field type including autonumber (:939); duplicates.ts:428 and seed-tenancy-backfill.ts:1276 both call autonumber values "unique" identifiers while nothing makes them so by default. Premise holds. Refs The #8686 tenancy backfill destroys the autonumber high-water mark: the merge targets a row that does not exist yet, the __global__ row is deleted unconditionally, and an already-allocated business identifier is re-issued #12394 (closed, PR fix(metadata-protocol): write the merged autonumber high-water mark before retiring the __global__ counter #12554 merged) and Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686 (closed) are landed fixes — the PR body records the interaction as the card asks. H17 on-hold trigger-file index ([Half-state patrol] check-half-states live sweep — generated view (please pin) #9857, 01:59Z) names none of these files.

---

Generated by Claude Code

[os-sam]

Dispatch (2026-09-03T06:58Z) — domain:spec seat, session_017RbbUMnxkUnWhE4j94v8FE, seat post #6017. mode:cloud — cloud session session_017xqRv7A8HiJdKxsVm1UCuM (created 06:58:52Z, model: claude-fable-5-1, outcome branch claude/issue-13894-autonumber-default-unique, title "⚡ spec #13894 autonumber defaults to unique (organization-composite); explicit opt-out; measurement-first on duplicate rows"), size L, clause ② yes. The dev leaves its own Claim: comment below (its own session id + branch + Clause-②: yes); the assignee stays the PM's.

Dispatch text handed to the dev, in brief (the ruling direction and the five design constraints are quoted verbatim from the card body — filed per the maintainer's hotcrm#1301 ruling — and marked non-renegotiable):

• Scope fences: lands in packages/spec only (default flip, opt-out spelling, docblocks, pins, changeset minor + BREAKING banner + ADR-0087 disposition, regenerated artifacts). ⛔ No edits to drivers (PR docs(driver-sql): pool docblocks name the factory's max 5, not knex's max 10 #14773 is open on sql-driver.ts), cli, objectql or metadata-protocol — measurement surfaces here; ⛔ no configuration surface beyond the opt-out spelling (constraint 1); The #8686 tenancy backfill destroys the autonumber high-water mark: the merge targets a row that does not exist yet, the __global__ row is deleted unconditionally, and an already-allocated business identifier is re-issued #12394 / Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686 are landed fixes — constraint 3 is a PR-body paragraph plus any pin that flips.
• Measurement first, with a closed decision rule (constraint 2): M1 reproduce what an operator sees today when a declared unique cannot be materialised over existing duplicate rows (loud naming rows / loud naming the index / warning-and-continue / silent skip or downgrade); M2 what os migrate duplicates (packages/cli/src/commands/migrate/duplicates.ts, which already classifies autonumber as an identifier) reports for that table. Loud ⇒ implement the flip and record both readings verbatim in the PR (no rows/remedy in the message ⇒ an unassigned engine-lane finding). Warning-and-continue or silent ⇒ STOP on the flip, deliver the measurement as a blocked report with the reproduction pushed — this seat files the engine-lane card and blocks this one on it. ⛔ The driver is not "fixed" to make the flip landable.
• PM mechanism hypotheses to measure, evidence back to the PM: H1 the flip is type-conditional at parse time on unique: UniqueScopeSchema.default(false) (absent on an autonumber field ⇒ 'organization', other types unchanged), materialised where the driver's isUniqueScopeDeclared(f?.unique) reads — after reading why the autonumberFormat block deliberately avoids a parse-time default; H2 explicit unique: false is the opt-out (Zod default applies only when absent), docblock says when that is legitimate; H3 the case_number template is what the default resolves to; H4 generated artifacts (JSON Schema, authorable-surface baseline, references) regenerate with the tooling; H5 a consumer table for every reader of the parsed unique (objectui = PM's reading); H6 the corpus (examples, platform-objects, apps, dogfood fixtures) — every autonumber field the default now covers, fixtures seeding duplicates fixed in the data; H7 whole-repo pin sweep, flipped pins keep bearing weight; H8 the changeset's migration paragraph carries M1/M2 and the opt-out.
• Serial constraint: field.zod.ts is region-split with requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879 (same seat, same round) — this card writes unique (:939), the autonumber block and RUNTIME_OWNED_FIELD_TYPES only; requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879 lands first, this branch merges origin/main before its final push (regenerate after the merge commit).
• Gates: 42 commands derived at 2263ca4d6 handed as a clue; re-derived by the dev on the actual diff after the changeset exists; CI on the draft PR is the final reading. Board reading (485 open issues, 06:09Z) handed once.
• Clause ② landing: draft PR with Fixes #13894 + needs:contract-review in the same stroke (this seat mirrors the label onto the card and subscribes to the PR the moment it exists); never flipped to ready by the dev. Cloud self-drive clauses: legal turn endings are push + draft PR + report, or a blocked report with the evidence pushed; os-dev-report comment first, then the final JSON.

---

Generated by Claude Code

[os-sam]

Claim:

• Session: session_017xqRv7A8HiJdKxsVm1UCuM (os-dev, mode:cloud, dispatched by session_017RbbUMnxkUnWhE4j94v8FE)
• Branch: claude/issue-13894-autonumber-default-unique (pushed empty from origin/main 2263ca4d6 as the write-routing probe)
• Worktree: ../objectstack-issue-13894
• Clause-②: yes
• Order: M1/M2 measurement first (driver unique-index materialisation over existing duplicates; os migrate duplicates scan), then the decision rule, then the packages/spec flip per the ruling.

---

Generated by Claude Code