approvals: retire the `role:` arm of the position-address equivalence once the pinned console sends `position:` (ADR-0090 D3; split from #21379 item 5)

[objectstack-fleet]

Ruled: 5979854058 · letter A2 — retire the role: arm and normalize the fallback literal to org_membership_level:; supersedes ruling A 5978658250 · 2026-10-04T12:20Z

Ruled: 5978658250 · letter A — retire the role: arm in one edit; stored 15.x role:<p> slots go to the admin rescue, named in the changeset · 2026-10-04T09:49Z

Split from #21379 (item 5) by the triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U. ⛔ Not a claim.

Restart-when: the objectui commit named by objectstack main's .objectui-sha contains the merge of objectstack-ai/objectui#11455, and #21379 is closed.

The hold. It was set at filing by triage, on 2026-10-02. Two things must be true first. Until the pinned console sends position:<p>, retiring the arm breaks the stock console's "My Pending". And this card edits the equivalence that #21379's readers will share.

What changes

• PR fix(plugin-approvals): My Pending lists a position-routed request under either address spelling #21378 (approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally #21350) keeps role: in POSITION_ADDRESS_PREFIXES (packages/plugins/plugin-approvals/src/approver-address.ts), because the pinned console sends role:<p>. That is sharedUserFeeds.ts approverIdentities() at objectui 31971ff1e.
• ADR-0090 D3 retires role as a word, with no alias window. Once the console is pinned, the arm comes out in one edit. The literal compare in approval-service.ts (named === role:…) goes with it, so no reader keeps a second spelling.

The cost to state before the edit

A 15.x-era slot stored as role:<p> becomes decidable only through the admin rescue. The claim states how such stored slots are treated:

• converted by an existing upgrade path, or
• left to the rescue, with that named in the changeset.

If neither the ADR nor an existing upgrade path covers this, the choice goes to the decision box before the edit. ⛔ No alias window is reopened.

Pins

• A position:<p> slot is listed, decidable, and can_act for its holder, with the default actor.
• role:<p> is no longer an address of that slot.
• An enumeration pin shows that no reader in plugin-approvals compares a role: literal.

Grade: tech-debt · priority:p3 · domain:services · area:workflow · pm:on-hold. Why p3: once #21379 lands, nothing is wrong for any user; this retires a deprecated spelling.

---

Generated by Claude Code

[objectstack-fleet]

Hold released · pm:on-hold → pm:queue · seat domain:services#2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-04T02:37Z. ⛔ Not a claim, ⛔ not a dispatch.

The Restart-when: line in this card's body is met. Read-only probes:

• objectstack main at be55fd2934 pins .objectui-sha = ab18797215. objectui's fix for app-shell: approverIdentities() sends role:<position>, but the server stores a position slot as position:<position>; the sharedUserFeeds.ts docblock says the opposite objectui#11455 (d93e53f5de, fix(approvals): the console names a position approver position:NAME, the spelling the server stores (objectui#11455) objectui#11461) is an ancestor of that commit (git merge-base --is-ancestor exits 0).
• At the pinned commit, packages/app-shell/src/hooks/sharedUserFeeds.ts approverIdentities() sends position:<p> for each position and no role:<p> beside it (line 521). Its docblock names this card as the next step.
• approvals: a holder of a position whose slot reads position:<p> can see the request but cannot decide it with the default actor (can_act false, approve 403), and loses sight of it after deciding (404) #21379 is closed.

Release double check. The only hold transition on this card is the one set at filing (2026-10-02). No merged PR references the card after it.

The card goes back to the queue as triage graded it: tech-debt, priority:p3, area:workflow. The body's "cost to state before the edit" stays a precondition of the claim. The dev measures how stored role:<p> slots are treated before any edit. If neither ADR-0090 nor an existing upgrade path covers them, the choice goes to the decision box first, and ⛔ no alias window is reopened.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

决策请求 · 15.x 遗留的 role:<p> 未决审批槽位怎么处置 · 2026-10-04T02:42Z

席位 domain:services#2(#21118)· session_01DiCSbmJrkzNhuEAier4VoJ。⛔ 不是认领,⛔ 不是派发。本卡正文「The cost to state before the edit」要求:若 ADR 与既有升级路径都不覆盖存量 role:<p> 槽位,编辑前先进决策箱。席位在认领前实测,两者都不覆盖,本卡 pm:queue → needs-user-decision。

一句话问题. 退掉审批里 role: 旧写法以后,升级前(15.x)开启、至今未决、槽位写成 role:<岗位> 的请求,岗位持有人在自己的待办里再也看不到、也批不了,只剩特权管理员能代为处理。是接受这一点,还是给这些旧请求写一次性改写?

背景.

• 本卡的前提今天已满足(放行评论 5975844577):钉住的控制台只发 position:<p>,approvals: a holder of a position whose slot reads position:<p> can see the request but cannot decide it with the default actor (can_act false, approve 403), and loses sight of it after deciding (404) #21379 已关。
• 现在每个读者都把 position:<p> 与 role:<p> 读成同一个岗位(plugin-approvals approver-address.ts 的 POSITION_ADDRESS_PREFIXES)。退臂后,岗位地址只剩 position:<p> 一种。
• 17.x 不再写出 role:<p> 槽位。resolveApproverSpec 先经 canonicalApproverType 规范化类型(approval-service.ts 约 :1804)。废弃的 type: 'role' 映射到 org_membership_level,不是岗位。所以 role:<p> 槽位只可能来自 15.x 时期开启、至今未决的请求。
• 这类槽位退臂后,岗位持有人的「我的待办」不再列出它,can_act 为假,决定被拒。请求本身仍在,可由特权管理员越权处理(#3424 admin_rescue 路径,approval-service.ts 约 :2974 的注释:"a privileged admin can override it, and legacy 15.x literal slots stay queryable")。

Governing text.

• ADR-0090 D3:"One-step renames (no aliases — supersedes ADR-0057 D7's alias clause for these)"。
• ADR-0090 forcing fact 1:"Aliases and one-release deprecation ladders written now become permanent migration debt."
• ADR-0090 D4(类比,不直接覆盖审批槽位):"The grandfathering pass in D1 rewrites any stored alias to its canonical value."
• 检索:git grep -n -E "role:" -- 'packages/cli/src/commands/migrate*' packages/plugins/plugin-approvals/src ':!*.test.ts'。没有任何路径把存量 role:<p> 槽位改写成 position:<p>。approvals-plugin.ts 在 kernel:ready 的回填(perf(approvals): server-side pagination + pushdown filtering for listRequests #1745)只重建索引,不改写拼写。ADR-0090 全文没有审批槽位条款。

协议声明. 不改协议,packages/spec 不动。ApproverType 的 role 别名(映射到 org_membership_level)是另一件事,不在本卡。

前提(各带 re-check).

1. 钉住的控制台只发 position:<p>:git -C ../objectui show "$(cat .objectui-sha)":packages/app-shell/src/hooks/sharedUserFeeds.ts | grep -n 'position:${position}'
2. 17.x 不写 role:<p> 槽位:git grep -n "canonicalApproverType(String(a.type))" -- packages/plugins/plugin-approvals/src/approval-service.ts(resolveApproverSpec 里先规范化)
3. 没有既有升级路径改写存量槽位:上面「Governing text」的检索式,零命中。

选项 × 真实代价.

选项	做什么	客户可感知的后果
A 交给管理员救援	一次删掉 role: 臂和 approval-service.ts 里的字面比较;changeset 写明:升级前开启、至今未决、槽位写成 role:<p> 的请求只能由特权管理员处理,并给一行处置法	极少数陈年未决请求从岗位持有人的待办里消失,需要管理员代批;新请求零影响
B 一次性改写	同 A,另在审批插件启动回填(#1745 那条)里把存量 role:<p> 槽位改写成 position:<p>,带枚举 pin	旧请求无感延续;多一段永久的存量迁移代码及其测试
C 不退	保留 role: 臂,本卡关 not planned	无变化;平台留着 ADR-0090 D3 禁止的第二种拼写

业务含义直译.

• A:换了工号格式之后,旧格式的待办单由主管代签,员工自己那边不再显示。
• B:系统升级时把旧工号批量刷成新工号,旧单照常流转。
• C:两套工号永久并存。

四轴(业务立场).

• 项目长远合理性. A 让岗位地址只剩一种拼写,没有迁移尾巴。B 也收敛到一种拼写,但多出一段只服务存量的改写代码,正是 ADR-0090 forcing fact 1 说的「permanent migration debt」。C 扩大特例。
• 实际业务需求. 今天谁撞上:只有升级前开启、至今仍未决的 15.x 请求。席位读不到任何部署的数据,数不出有几条。平台尚未正式上线(ADR-0090 forcing fact 1),预计拉动接近零,未实测。
• 防 AI 犯错. A 和 B 都让 AI 只能写一种岗位地址,写 role: 的决定会被响亮拒绝。C 让第二种拼写继续被静默接受。出错时谁看到什么:A 下,旧请求的持有人看到的是「列表里没有」,这是静默的,但有管理员兜底和 changeset 说明;B 下无人看到问题。
• 创业阶段不扩散. A 最小。B 为可能为零的存量付永久代码。C 维持已声明废弃的面。

os-decision-facets

• ① 项目长远合理性:A 缩小特例(一种拼写,零迁移代码);B 同样收敛拼写,但增加一段存量改写;C 扩大特例。
• ② 实际业务拉动:只有 15.x 时期开启、至今未决的请求撞上;未实测,预计接近零。
• ③ 防 AI 犯错:A、B 都闭合为一种拼写并响亮拒绝 role:;C 静默容忍第二种拼写。
• ④ 创业阶段不扩散:A 最小;B 为零拉动的存量付永久代码;C 维持已废弃的面。
  Prior rulings read: approver slot role: position spelling retire stored 15.x → 8 hits (approvals: a holder of a position whose slot reads position:<p> can see the request but cannot decide it with the default actor (can_act false, approve 403), and loses sight of it after deciding (404) #21379, approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally #21350, approvals: sys_approval_action.actor_id (a sys_user lookup) records the slot literal (position:<p>, or an email) instead of the deciding user, so the person who decided is on no column (ADR-0118 D1) #21411 and family; none rules the stored-slot treatment); ADR-0090 D3, D4; thread: 1 (5975844577)

推荐:A(交给管理员救援,changeset 写明)。终态句:两年后,审批里岗位只有 position:<p> 一种地址,没有兼容臂,也没有迁移代码。参照:Salesforce 的审批与队列只认当前的标识,改名前遗留的待办由管理员 Reassign。
只看①选 A;②③④ 是否翻转:否。
回退:B,若维护者知道有真实部署仍挂着 15.x 时期开启的未决审批。
置信缺口: 席位看不到任何部署的存量数据,数不出未决的 role:<p> 槽位有几条。「管理员可越权处理」引自代码注释与分诊正文,未做端到端实测。

裁后执行.

• 选 A:席位串行派发 os-dev。一个 PR 一次删掉臂与字面比较,带卡上三条 pin。changeset 声明 Clause-②: no (narrowing),写明 FROM role:<p> → TO position:<p> 与管理员处置的一行。
• 选 B:同 A,另加启动回填里的一次性改写及其 pin;派发令点名回填位置。
• 选 C:席位关卡 not planned,引本裁决。

相关:#21379(已关)、#21350 / PR #21378(保留臂的来由)、objectstack-ai/objectui#11455。

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

Ruling: batch #276 item 2 · letter A · maintainer 「同意」 2026-10-04T09:47Z

Director seat, summon #32, session_016tKoy8NJa35Yih1FdzrVmn. Written as objectstack-fleet[bot] through the relay. ⛔ Classes, doors and roles only.

• How it was ruled. Batch 🔗 Broken links detected in documentation #276 was presented in the live director chat, with the domain:services#2 seat's decision request 5975876640 (options A, B, C). The director recommended A, with B as the fallback. The maintainer answered the batch as presented: 「同意」.
• Freshness gate: no comment on this card since 5975876640.

The ruling

A: retire the role: arm in one edit. Stored 15.x-era role:<p> slots are left to the admin rescue, and the changeset says so.

• role comes out of POSITION_ADDRESS_PREFIXES (approver-address.ts), together with the literal role: compare in approval-service.ts. No reader keeps a second spelling.
• No one-time rewrite of stored slots: that would be the permanent migration debt ADR-0090's forcing fact 1 names. ⛔ No alias window is reopened.
• Not taken: B, a rewrite in the approvals boot backfill. C, keeping the arm.

四棱(本裁决新记录)

• ① 长远:岗位地址只剩 position:<p> 一种拼写,零迁移代码,ADR-0090 D3 原样执行。
• ② 拉动:只有 15.x 时期开启、至今未决的请求受影响;平台未正式上线,预计接近零,未实测。
• ③ 防 AI:只有一种写法,写 role: 的决定被响亮拒绝;旧请求的静默缺席由管理员兜底并在 changeset 写明。
• ④ 不扩散:不为可能为零的存量付永久代码。
• 只看①选 A;②③④ 是否翻转:否。

Execution

• This card: needs-user-decision → pm:queue in this act. domain:services, p3, tech-debt, area:workflow.
• One PR: removes the arm and the literal compare in one edit, and carries the card's three pins.
  • A position:<p> slot is listed, decidable, and can_act for its holder.
  • role:<p> is no longer an address of that slot.
  • An enumeration pin shows that no plugin-approvals reader compares a role: literal.
• The admin rescue is pinned end to end: a stored role:<p> slot can still be decided through the #3424 admin_rescue path. This was quoted from a code comment and is not yet measured. If the rescue cannot decide it, the slot goes back to the maintainer before landing.
• Changeset: the FROM role:<p> → TO position:<p> line, and one line on how a privileged admin decides an old pending request. Clause-② as the claim states it.

---

Generated by Claude Code