decision: ADR-0131 C5 — under `single`, Studio saves are stored organization-scoped today. At the v18 upgrade, are they promoted to the environment, kept behind a compatibility read, or dropped?

[objectstack-fleet]

Ruled: 6020163868 · letter A · 2026-10-06T16:05Z

Filing gate: ② a decision only the maintainer can make. Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U) at the maintainer's instruction 「需要我决裁的问题，立决策卡」. ⛔ Not a claim. The ruling is recorded on this card and on the parent, then this card closes.

Parent: #15206 (ADR-0131 C5, target:v18). #21818 (08adfeade8) measured that under single with a Default Organization (the production default), every Studio save of these five types is stored as an organization-scoped sys_metadata row.

维护者速读

单租户部署里，客户在 Studio 里改过的视图、仪表盘、报表、翻译和邮件模板，现在都存在"组织级"。v18 取消组织级后，这些定制怎么办？

• A：升级时提升为环境级。单租户下含义完全不变。万一同名冲突（比如单租户部署里有多个组织），在迁移计划里列出，由运维逐条选。
• B：保留一条兼容读取，继续读默认组织的行。
• C：丢弃，写进发布说明，客户的 Studio 定制全部消失。

推荐 A。回一个字母：A / B / C。

四棱（os-decision-facets）

• ① 项目长远合理性：A 让定制只存在环境级，不留组织级特例；B 保留特例；C 无特例但丢客户数据。
• ② 实际业务拉动：单租户下凡是用 Studio 改过东西的客户都涉及，而单租户是默认部署形态。
• ③ 防 AI 犯错：A 只有一层来源；B 让 AI 面对一层"看起来已退役、实际还在读"的路径。
• ④ 创业阶段不扩散：A 是一次迁移；B 要长期维护兼容读取。

Prior rulings read: ADR-0131 D6 (environment overlays stay), D10 (fates; only fate 2 deletes), D13; ADR-0005 (as amended); #21818; #17460 (multi-organization single is reported at boot, not refused); thread: #15206.

一句话问题

单租户下客户在 Studio 做的定制，升级到 v18 时搬到哪里？

选项 × 代价

选项	做什么	客户感受到的后果
A	迁移计划把默认组织的这些行提升为环境级；同名冲突逐条列出，由运维选择	单租户：无感；多组织撞名：运维逐条选
B	保留读默认组织行的兼容路径	无感；平台长期多一条路径
C	丢弃	客户的 Studio 定制全部消失

推荐 + 回退 + 置信缺口

• 推荐 A。 两年后，客户在 Studio 做的定制只有环境级一层，升级只搬不丢。这与 Salesforce 的定制属于组织（即环境）级元数据的建模一致。
• 回退 B。 ⛔ C 不推荐。
• 置信缺口：
  • "单租户但有多个组织"的部署数量看不到，迁移计划会列出；
  • 本卡与上面"邮件模板去留"那张卡是同一做法，两张一起裁更一致。
• 只看①选 A；②③④ 是否翻转：否。

裁后执行

• A： C7（feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211）的迁移计划加入"组织级定制提升为环境级"一类（含冲突清单）；C5（feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206）的退役以此为前提。
• B： feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 保留兼容读取，并明确它的退役时间。

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #282 item 4 · letter A · maintainer 「同意」 2026-10-06T15:56Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Batch #282 was presented in chat with this card's options A / B / C; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body (no comments), #15206, #21818 and ADR-0131 D6 / D10 / D13 were re-read before this record. Thread-read: none on this card.

The ruling

A. Under single, the organization-scoped sys_metadata rows of the five presentational types (view, dashboard, report, translation, email_template) that Studio saved for the Default Organization (#21818's measurement) are promoted to environment scope by the migration ceremony (C7, #15211). This is the execution of two accepted decisions, not a new direction: D13 retires ADR-0005's organization-scoped write path for these types, so B (a compatibility read of the Default Organization's rows) contradicts it; D10 sanctions deletion only of mirrors (fate 2), and a customer's Studio edit is not a mirror, so C (drop) contradicts it. The promotion is D10's fate 3 applied to the environment as the owner.

Conflict rule. On a deployment that runs single with more than one organization (#17460 reports it at boot, never refuses), the Default Organization's row promotes; another organization's row of the same name is reported, never guessed (D10 fate 4): the plan lists it with the remedy, and the operator chooses per row.

Together with: item 3 (#22008, the withdrawal sub-case, fail-closed) and item 5 (#22005, email templates), one ceremony, one rule.

Execution

• C7 (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211): the migration plan gains the "organization-scoped customization promotion" category with the conflict list.
• C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206): its retirement proceeds on this premise; no compatibility read is kept.
• Pointers recorded on feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 and feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211. This card closes completed in this act.

---

Generated by Claude Code