docs(adr): ADR-0130 addendum — the permission matrix is outside the package boundary's payoff (#14487)

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code

[hotlong]

Fixes#14487
Part of #14122

Governed surface — maintainer merge. This PR edits docs/adr/**, so it stays draft and is merged by hand by the maintainer; Governed Surface Queue Guard marks it. Nothing here authorises implementation work, and the record it amends is still Proposed.

What this is

One addendum section appended to docs/adr/0130-release-artifact-as-co-ownership-boundary.md, in that repository's existing addendum format (## Addendum (date, #card) — title, as in ADR-0006, ADR-0085, ADR-0087), recording the maintainer's 2026-09-02 ruling — option B on item 3 of #14454, the item carried onto decision card #14457: permission sets stay whole in the type: app package, and the permission matrix ADR-0130 §1.3(a) measures is not part of the payoff §4 claims for the package boundary.

⛔ No decision text moved. D1–D8, §1 and §3's non-goal on grouping keys are unchanged; no owner / publisher field; no new decision. The only edit outside the new section is a one-sentence pointer appended to the Status line — the ADR-0006 / ADR-0085 precedent for a record whose scope an addendum bounds.

The added text

Heading:

Addendum (2026-09-02, #14487) — the permission matrix is outside this boundary's payoff; permission sets stay whole in the app package

The bound it places on §1.3(a) and §4:

§1.3(a) counts, among the three measurable consequences of having no boundary, "a permission matrix of 30 rows × 9 CRUD columns × 6 permission sets that interleaves 客户/联系人/商机 with 运费标准/等级政策/工厂成本", and §4 draws the payoff from that section: "Studio's scope is the package, so package boundaries are the grouping Studio has never had (§1.3a)". The payoff does not extend to the permission matrix. Splitting a product into co-owning packages leaves that matrix exactly as flat as §1.3(a) found it.

The measurement it rests on:

A permission set grants across domains by nature: it is authored per role, not per module, so no module owns it. hotcrm#1449 measured the standard HotCRM product against its six planned modules — core, sales, cpq, service, marketing, activity, all inside the one crm namespace D1 makes co-ownable, with the type: app package declaring no objects at all. Of its six permission sets, four span five or six of the six modules (sales_rep, sales_manager and system_admin at six; service_agent at five); the remaining two span four (marketing_user) and two (guest_portal). Not one is confined to a single module.

Where the sets live:

The six sets stay whole in the type: app package. That is not a new rule but the standing one: ADR-0086 D3 gives a permission set exactly one owning packageId [...] In Studio's Access pillar — the matrix of ADR-0084, reached per package through ADR-0086 D7's package door — the sets therefore appear under the app package only, and their matrix stays as wide as the product. Modules group Data, Automation and Interface; they do not group Access.

What was not decided:

Per-package composition of grants — a module contributing its own objects' grants into a role the app package owns, by analogy with navigationContributions — is the other half of hotcrm#1449's question. It is filed, not decided: #14488, for the phase in which a module ships on its own (the §1.3(c) CPQ case, where a module's objects would otherwise arrive with no grants at all). It is out of this release and carries no commitment — neither that it will be built, nor that the contribution shape is the one it will take.

The section then records three constraints that phase inherits, so they are not rediscovered: ADR-0086 D4 stands until amended ("A package never writes into a shared/foreign record.", so #14488 is an amendment to D4, not an addition beside it); D4's conflict-freedom argument assumes one namespace per package, which D1 relaxes for co-owners inside one artifact; and which Access door edits a split product's app-owned sets is unmeasured (D7 scopes the package door to "this package's own object slice", and after a split the app package owns the sets but no objects). All three are marked as inputs, not decisions.

Status line, appended:

Scope bounded by the 2026-09-02 addendum (#14487): the permission matrix §1.3(a) measures is not part of this boundary's payoff — permission sets stay whole in the type: app package.

Evidence

• Ruling: recorded 2026-09-02 on ADR-0130 跨包规则矩阵补全：9 类命名对象的元数据、navigationContributions[].group 语义、权限集的模块归属、dashboard/report → dataset 跨包绑定（hotcrm 分拆方案挖出的 4 个上游缺口） #14454 (comment 5507189677) and quoted in the words that record carries, marked as the PM seat's rather than a transcript of the maintainer's.
• Measurement: hotcrm#1449 docs/architecture/module-split-plan.md §上游缺口 / Upstream gaps item 3 and its generated module-split-inventory.json (unmeasured_edge_classes), per set: sales_rep 6, sales_manager 6, system_admin 6, service_agent 5, marketing_user 4, guest_portal 2, of six planned modules.
• Quotes: every verbatim quote in the section (ADR-0130 §1.3(a) and §4; ADR-0086 D4 twice, D7 once; hotcrm#1449's "Ask") was checked whitespace-normalised against its source file rather than retyped from memory. The [ADR-0086 D3] anchor is real in packages/spec/src/security/permission.zod.ts; it is cited by tag, not line number, per this record's own §7 discipline.

Changeset — precedent followed

No changeset; the skip-changeset label carries it. Precedent, checked over the last 30 commits touching docs/adr: every ADR-only commit carries no changeset at all — including ADR-0130's own landing commit 682d03ba7 (#14151) and abeb5665e (#12867). scripts/check-empty-changeset.mjs rejects a newly added empty-frontmatter changeset, so in this repository the label is the mechanism and an empty file is not; the label is applied on this PR.

Gates

Family derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (1 path in the change set, 5 commands). All re-run at commit 018270546 under scripts/pm/os-verify-lock.sh, exit codes captured into a file before any pipe:

Gate	Exit	Verdict line
node scripts/check-adr-links.mjs	0	✅ check-adr-links: 600 relative link destination(s) under docs/adr/ resolve
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 427 files / 1398 TS blocks judged clean
pnpm check:adr-anchors	0	check-adr-anchors: OK (52 anchored file(s) [...] 31335 citation(s) across 4067 file(s) resolve)
pnpm check:doc-authoring	0	✓ doc authoring guard: 394 files clean — no bare metadata literals.
pnpm check:pm-governed-merges	0	✓ check-governed-merges --self-test: 243 assertions
pnpm check:nul-bytes (not derived; run on every edit)	0	check-nul-bytes: OK (scanned 7914 text file(s) [...] no raw ASCII control bytes)

check:doc-formula-expressions first exited 3 — PREREQUISITE NOT MET (@objectstack/formula, then @objectstack/lint, not built), which is "nothing was measured", not a finding; both packages were built and the gate then ran green. The 9 further families dispatch-gates names apply only once a changeset path exists, which by the precedent above this PR does not create.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

---

Generated by Claude Code

[hotlong]

PM 复审：PASS（内容与格式）—— 受管面，留 draft，请维护者手合

复审会话 session_01UHvF5hyiZjnCyExFnfQB8m（与派发 dev 同一会话身份、不同 agent 实例；维护者授权 PM 自审）。对象：全 diff（1 文件 +93）与它引用的每一处原文。

对树核实

项	实测
裁定表述	✅ 与 #14454 评论 5507189677 及 #14457 关闭记录一致：本次 B；A 立 #14488 不承诺；来源标明是 PM 席的转述而非维护者原话
不动决定正文	✅ D1–D8、§1、§3 未改；仅 Status 行追加一句范围限定 + 末尾一节补记
五处引文	✅ 空白归一后逐字在源文件命中：ADR-0130 §1.3(a)「30 rows × 9 CRUD columns × 6 permission sets」、§4「the grouping Studio has never had」、ADR-0086 D4「A package never writes into a shared/foreign record.」与「because each set only grants」、D7「this package's own object slice」
[ADR-0086 D3] 锚	✅ 存在于 packages/spec/src/security/permission.zod.ts
测量数字	✅ 与 hotcrm#1449 module-split-inventory.json 一致（6 套：6/6/6/5/4/2）
补记标题体例	✅ 与 ADR-0085「## Addendum (2026-08-28): …」、ADR-0087「## Addendum (2026-07-15) — as-built true-up」同族
三条给 #14488 的前置	✅ 都标为输入而非决定；「A 是对 ADR-0086 D4 的修订而非并列新增」这一句是本补记最有价值的发现，已同步进 #14457 的关闭记录
changeset	✅ 遵循 ADR-only 提交零 changeset 的先例（含 ADR-0130 自己的落地提交 682d03b），挂 skip-changeset；Check Changeset 绿

CI（018270546）

Governed Surface Queue Guard ✅（标记受管）、Check Changeset ✅、Check Documentation Links ✅、Part-of PR must not also close its card ✅；Lint & Repo Gates 与 Type Check 四项在跑（docs-only，预期绿）。

收口

按 Prime Directive #14，本 PR 不进队列、不 arm，保持 draft 由维护者手合。合并即关 #14487。

---

Generated by Claude Code

[hotlong]

Maintainer ruling, 2026-09-03, given in chat to the director seat (session_01WXyGTWPbbreqXow7Z2pZCk) on decision batch 1, item 2 (this PR, option A: merge as-is). Verbatim: 「以上都同意，你帮我合并pr」.

Executing on that instruction: marking ready and merging directly (squash) from the maintainer's own account. No approving review is submitted by any seat; under the governed-surface regime the human merge is the review record (see the header of scripts/pm/check-governed-queue-guard.mjs, "the direct merge stays the fallback path"). Governed path in this PR: docs/adr/0130-release-artifact-as-co-ownership-boundary.md.

---

Generated by Claude Code