docs(adr): ADR-0130 — the release artifact is the co-ownership boundary (one artifact, N packages)

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

Fixes#14144
Part of #14122 (epic)

Adds docs/adr/0130-release-artifact-as-co-ownership-boundary.md, Status: Proposed. Prose only — one new file, nothing outside docs/adr/**, no implementation code, no schema edits.

What it decides

Compile per package, ship one JSON, keep N manifests inside it, register N packages in dependency-topological order at load time. Eight decision letters:

• D1 — the release artifact is the co-ownership declaration; the install gate's criterion moves from "same package id" to "co-owners within one artifact".
• D2 — the ADR-0019 consumer model does not move a letter; the artifact stops at the control plane and must never become the suite D3 removed.
• D3 — the §5.4 gate relaxation and the §5.6 install-time per-object-name uniqueness check are mechanically inseparable: same PR, plus a gate test asserting the pair, asserting the error code and status (ADR-0112 envelope) rather than a bare throw.
• D4 — artifact schema gains an optional packages: [...]; manifest is retained and both shapes are read. Forward compatibility rides manifest.engines.protocol. The segmented-loading key position is reserved at schema time, deliberately unimplemented.
• D5 — topological ordering is a machine acceptance criterion, by reuse of resolvePluginOrder; no second sorter. The pin is behavioural (extension-before-base installs and the extension is in effect), because a permutation assertion passes on an implementation that computes the order and never uses it.
• D6 — one artifact, one version, with the "no per-module hot-fix" cost stated plainly.
• D7 — existing single-manifest artifacts register bit-identically through the new path, as an automated test rather than a review judgement.
• D8 — no manifest owner/publisher field; deferred with a named trigger, aligned to the ADR-0048 2026-08-08 addendum D2.

⛔ No original text of ADR-0019 or ADR-0048 is edited. The boundary is recorded here by cross-reference, per the additive-addendum convention 0048 itself uses.

Governed surface — this PR stays draft

node scripts/pm/check-governed-merges.mjs --test docs/adr/0130-release-artifact-as-co-ownership-boundary.md

governed-surface predicate: 1 of 1 path(s) hit the register (5 surfaces, repo-agnostic).
GOVERNED — a human merge is the review record for this PR (#9495 regime).
docs/adr/** x1 — architecture decision records

Verdict: GOVERNED. This PR awaits the maintainer: it stays draft, is never flipped ready, never enqueued, and never has auto-merge armed. The hand-merge is itself the acceptance act for the ADR — Status stays Proposed until then.

Changeset

skip-changeset label applied — no changeset file. The diff publishes nothing from any package: one file, docs/adr/** only. pr-automation.yml reads the label live rather than from the event payload, and the label is applied additively (POST) with a read-back, per that workflow's own recorded size-labeler race.

Verification — all on the final commit 341b9e9

Derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 5 families) — all green:

gate	verdict
pnpm check:adr-anchors	OK (52 anchored file(s) ... 128 decision number(s), each naming one decision or an allowlisted pair; 30918 citation(s) across 3981 file(s) resolve)
pnpm check:doc-authoring	395 files clean · 48 published skill files clean · 14317 customer-facing string(s) ... clean
pnpm --filter @objectstack/lint run check:doc-formula-expressions	exit 0
pnpm check:pm-governed-merges	243 assertions self-test pass
node scripts/check-adr-links.mjs	598 relative link destination(s) under docs/adr/ resolve

check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET (@objectstack/formula then @objectstack/lint not built) — not a finding and not a measurement. Both packages were built and the gate re-run to a real exit 0.

Full Lint & Repo Gates job, not just the derived family. The job's 138 steps were harvested from lint.yml and each runnable one executed locally against this commit: 4 are uses: actions (checkout / setup-node / setup-pnpm / cache), 134 are run:, and zero carry an if: — so CI runs every one of them on every PR. 132 of the 134 ran green; the 2 not run are pure CI setup with no local meaning (Get pnpm store directory, which writes $GITHUB_ENV, and Install dependencies / pnpm install --frozen-lockfile, already satisfied in the worktree). That includes ESLint (pnpm lint, repo-wide, exit 0 under the shared verify lock) — no narrowing was taken and none is claimed.

Exit codes were captured before any pipe (redirect, then $?); each verdict above quotes the gate's own printed line, never a bare $?.

Where the proposal's citations did not survive re-verification

Recorded in the ADR's §7 rather than quietly corrected:

• engine.ts:4745 is off by one — registerApp(manifest: any) is at :4746 (4745 is the closing */). The claim it supports holds.
• scripts/check-source-token-ratchet.mjsdoes not exist in this repository — the token ratchet One artifact, N packages: let a release bundle carry co-owning packages so a product can be split into modules without renaming objects #14122 §1.3b cites is a downstream application repo's script. Its measurement is downstream evidence, not a gate here. The platform-side fact (no grouping key on the object document) was verified independently: the only group spelling in packages/spec/src/data/object.zod.ts:1779 is rejection guidance.

Every other anchor was found exactly as described: registry.ts:1456, the installPackage gate at :3575/:3583/:3595, getNamespaceOwners at :1540, unregisterObjectsByPackage at :2679, plugin.ts:405, stack.zod.ts:240/:854/:1759, RESERVED_NAMESPACES at registry.ts:45 with isShareableNamespace at :1116, and ADR-0048's rename-on-install non-goal in all three recorded places.

Open for the maintainer's merge decision

Listed in the ADR's §6: (1) D8's deferral of the owner field — #14122 待决策 ⑤ asked explicitly whether it should land with ADR-0048 addendum D2 instead; (2) whether the ADR-0019 boundary should additionally get a one-line Related entry on 0019 (0019's own text is not rewritten either way); (3) acceptance of D6's "no per-module hot-fix" cost.

Follow-up implementation cards are cut after this record merges, not before — including the Studio package-picker row, which is objectui-side and gets a cross-repo card against that repository linked to the #14122 epic.

Generated by Claude Code

---

Generated by Claude Code