[objectstack-fleet]

Requested by Bill · project thread
Fixes #27183

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么： 新增 ADR-0144，把 [Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119 的裁决 6465431966 记成 Accepted 决策：C′ 形状、子问题 Q0–Q4、参数 1–4、五条设计规则、R1/R2/R3 成对发布与卡号对照；裁决没定的细节列为 10 条 Open items，交给各实现卡定。ADR-0104 币种段加日期注记；ADR 索引重新生成。
• 为什么改： 三张 spec 卡（spec(field): currencyMode: 'record' + currencyField — a record-mode amount points at a sibling ISO 4217 code field (multi-currency M0-1, epic #8345) #27184、analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187、spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191）和引擎卡按同一份记录复核，形状不再重开。
• 风险与回滚： 纯文档，无代码、无 changeset；Tier H（docs/adr/**），需您批准后由您落地。回滚 = revert 本 PR。
• 先看： ① ADR-0144 的 Decision 节（D1–D9，逐条引裁决原文）；② Open items 节（裁决没定的 10 件，含参数 3 折算公式与卡面不一致）；③ ADR-0104 新增注记。
• 两分钟验证： node scripts/adr-index.mjs --check → 预期打印 adr-index: OK；docs/adr/README.md 出现 ADR-0144 一行，状态 Accepted。
• 需要您做的： 批准本 PR。

What changes

• docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md (new, Accepted 2026-10-28) records ruling 6465431966 on [Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119:
  • Provenance: what is ruled, what is analysis the ruling read (design record 6464438764, workload rows 6464936321, measurement round 6041378776, shape verdict 6041482631), and what is a reading at cdec7473. It also separates the shape's sub-questions Q0–Q4 from the batch items "[Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119 Q1" and "[Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119 Q2 X".
  • Context: today's surface (bare-number value, dynamic / fixed, localization.currency, no conversion code, the pure CEL stdlib), the pull, and the four shapes considered (A, A′, B, C′) with the four Q0 options.
  • Decision D1–D9: C′; Q0 sibling code field (currencyMode: 'record' + currencyField); Q1 sys_exchange_rate; Q2 localization.currency, locked once used; Q3 at write, stored with the rate, a missing rate refuses, explicit recompute; Q4 raw aggregates refuse unless grouped, consolidation through the home field; parameters 1–4; the five design rules; the R1/R2/R3 pairing with the card map from the epic body.
  • Non-goals, Consequences, ten Open items (each names its card and quotes the source's lean without adopting it), Verification notes.
• docs/adr/0104-field-runtime-value-shape-contract.md: a dated note at the end of D1: multi-currency keeps D1 (the value stays a bare number; the record's currency lives in a sibling ISO 4217 field named by currencyField). The retirement note for CurrencyValueSchema belongs to spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182 / PR feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233.
• docs/adr/README.md: regenerated by node scripts/adr-index.mjs (one new row; 144 → 145 records, Accepted 126 → 127, on main as of the merge of 8d79bbd).

Tests

No test of record. The diff is three Markdown files under docs/adr/ and touches no package, so no build closure, package test or typecheck is owed. The derived gate union ran at 12cc227f (below).

Acceptance notes

• Decisions carry only the ruling's text. A detail found only in the design record or the workload rows is listed under Open items, with the source's lean quoted. The review should see four discrepancies:
  1. Parameter 3 ("1 home unit = rate units of the foreign currency") makes the home amount the record amount divided by rate. Workload row M2-2 and card objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's body write "amount × rate". That card's own two-minute check (USD 10,000 at 0.1389 gives ¥71,994.24) is the division. D7 records this.
  2. The measurement round and design record §9/§10 drafted the home field as a fixed field. The ruling's design rule says dynamic. D8 rule 5 records this.
  3. Workload row M2-1 and card spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191 make rateField optional, while the ruling says the amount is "STORED with the rate used". Settled in D5 (contract review 6468858562, M2): both pointers are required whenever homeAmount is declared; Open item 1 keeps only their spelling for spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191, whose body the epic PM corrects before dispatch.
  4. Parameter 4 ("12 significant decimals") was ambiguous (significant digits, or digits after the point). Ruled scale 12, precision 24 by the maintainer (6469382727 on platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185); recorded in D7, Open item 5 is a settled pointer.
• Number 0144. The highest record on main is 0143. The numbers 0136 and 0140 were taken by proposals that never landed and are not reused (ADR-0141 and ADR-0142 say so). No open PR adds an ADR file.
• Anchors. The first push cited line numbers, and check:adr-symbol-anchors refused them. The readings now anchor to the declaring symbol or the file.
• No changeset. docs/adr/** publishes nothing, so skip-changeset is applied with this PR.
• Status Accepted. The maintainer ruled the shape on [Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119. Landing is Tier H: an authorised approval and the maintainer's merge.
• Release. This record is a member of R1 as ruled. It ships no code, so it carries no "not released alone" marker.
• Follow-up review. The maintainer ordered a second review of this record about ten hours after it opens. Every Decision line quotes or cites the ruling for that check.

Verification

Derived gate union at 12cc227: 21 derived, 21 run, every exit 0

node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:adr-anchors :: exit 0
pnpm check:adr-index :: exit 0
pnpm check:adr-symbol-anchors :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pm-prior-rulings :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0

dispatch-gates --ran: Run reconciliation — 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN.
✓ 21 derived families accounted for — a DERIVED zero (all 21 recorded an exit code and none of them is 3).

check:doc-formula-expressions needs the compiled @objectstack/formula and @objectstack/lint. They were built under the shared lock first: turbo run build --concurrency=2 --filter=@objectstack/formula --filter=@objectstack/lint printed VERDICT command-exit 0 (4 tasks).

adr-index --check

adr-index: OK — docs/adr/README.md is current and every record parsed.

CI runs the rest of the farm: the artifact rosters, the wide-population families, the Test Core shard plan and the type-check lanes. dispatch-gates names these outside the derived total.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head 12cc227fa0591ec4588210bec88a2c983bc41505 · 2026-10-28T12:07Z

Triage seat, at the maintainer's direct request in the triage session: 「契约复审 27239」. The review runs at CONTRACT_REVIEW_TIER. If the lane has its own review in flight on this head, it says so here and triage withdraws.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 12cc227fa0591ec4588210bec88a2c983bc41505
Local-runs: none
Scope: docs/adr/0104-field-runtime-value-shape-contract.md, docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md, docs/adr/README.md + packages/spec/src/data/field.zod.ts, packages/spec/src/shared/value-domain.zod.ts, packages/spec/src/data/currency-fraction-digits.ts, packages/services/service-settings/src/manifests/localization.manifest.ts, packages/services/service-settings/src/index.ts, packages/formula/src/stdlib.ts, scripts/adr-index.mjs, scripts/symbol-anchors.mjs, scripts/check-adr-symbol-anchors.mjs, docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md, docs/adr/0112-error-code-vocabulary-and-ledger.md, AGENTS.md (Prime Directives 14 and 15), content/docs/** (grep only), .github/workflows/ci.yml (trigger block)

Inputs read in full: card #27183 body and both comments (claim 6467611450, os-dev-report 6468549432); PR #27239 body, file list, the one PR comment (6468575588, the triage claim), the net diff vs main; rulings 6465431966 and 6464202770; analyses 6464438764, 6464936321, 6041378776, 6041482631; #27119 body and all six comments; epic #8345 body; cards #27156, #27157, #27158, #27182, #27184–#27198, #26939; open PR #27233 (file list and its docs/adr/0104 hunk). The repo was read with git show/git diff/git grep/git merge-tree against origin/main (d745bb5e) and the head ref prr-27239; GitHub with gh api GETs only.

Check-runs on the head: NONE. commits/12cc227f…/check-runs → total_count: 0 (re-fetched 12:11Z, still 0); commit status pending, 0 statuses; actions/runs?head_sha=12cc227f… → 0 and actions/runs?branch=claude/project-thread-0jat8q → 0, while other PRs received pull_request runs at 12:12–12:16Z. Every derived gate family is therefore UNMEASURED on this head; the 21/21 local run in the PR body and the os-dev-report is the dev's account, not a gate verdict, and is not adopted here. The merge base is cdec7473, which is an ancestor of origin/main; main has since taken #27231 (ADR-0143 flipped to Accepted; docs/adr/README.md regenerated).

① Derived judgments

Change the diff implies	Judgment
No published package, schema, or runtime surface changes: three Markdown files under docs/adr/; git diff --stat origin/main...prr-27239 = 3 files, +366/−3.	Right.
skip-changeset label, no .changeset/*.	Right — docs/adr/** publishes nothing.
Tier H landing (docs/adr/** is in the PD #14 register at AGENTS.md L269–274); PR is draft; reviewers hotlong, os-zhuang requested by the relay.	Right. No seat may approve; this record is a review of record for the approver, not an approval.
ADR number 0144 is free: highest file on origin/main is 0143-…; git ls-tree origin/main docs/adr/ | grep -c 0144 → 0; 0136 and 0140 remain gaps. No open PR adds a new ADR file (open PRs naming an ADR: #27239, #27233 edits ADR-0104, #27152 edits ADR-0066).	Right.
**Status**: Accepted — 2026-10-28, ruled on objectstack#27119 (…) — single-spelling status line; keyword Accepted first; date 2026-10-28; matches the ADR-0143 precedent (Accepted on the maintainer's decision, before implementation).	Right.
docs/adr/README.md regenerated: +1 row for ADR-0144; Summary 144→145 records, 139→140 numbers, Accepted 125→126, Total 144→145.	Wrong against main. The file was generated at cdec7473. origin/main (d745bb5e) already reads Accepted 126 / Proposed 4 and carries ADR-0143's Accepted — 2026-10-28… row; the PR's hunk still carries Proposed — 2026-10-27… for ADR-0143 and Accepted 126 / Proposed 5. git merge-tree --write-tree origin/main prr-27239 → CONFLICT (content): Merge conflict in docs/adr/README.md; GitHub mergeable: false, mergeable_state: dirty. The gate that enforces this file, scripts/adr-index.mjs --check (modeCheck, L502–511), returns 1 on a stale index, so the rule and its gate are red on any merge result of this head. Must-fix (mechanical): rebase and pnpm adr:index; the regenerated Summary should read 145 records, 140 numbers, Accepted 127, Proposed 4.
ADR-0104 gains a dated note under D1's "Reality wins" paragraph (inserted after "inert metadata ADR-0078 forbids." at L172).	Placement is right; content overlaps a sibling governed PR — see ④, finding S1.
Anchors: every code citation is path#Symbol or file-level, no line numbers.	Right for ADR-0144 (checked: #CurrencyConfigSchema L552, #CurrencyValueSchema L581, #CurrencyValue L3062, #localizationSettingsManifest L32, #isValueDomainMember L181, #CURRENCY_FRACTION_DIGITS L59, all declared on origin/main). One continuation anchor in the ADR-0104 note is silently unverified — see ④, finding S2.

② Semver level

Clause-②: no and Metadata-protocol: none on the PR body and the card: right. The diff touches no packages/**, no schema, no generated baseline, no skill; skip-changeset is the correct disposition. The ADR's own semver statements about its consumers are consistent with the cards: record mode and homeAmount are additive (Metadata-protocol: added, minor — #27184, #27191), #27157 is the one narrowing (Metadata-protocol: narrowed, ADR-0087 disposition on its own card), #27182/#27233 narrows an export only. One imprecision is noted under ④ (S6): #27187 also declares Metadata-protocol: added for the analytics wire key, and the ADR's Consequences name only two cards.

③ Boundary flags

• open_questions: [] in the os-dev-report 6468549432 — nothing to answer.
• out_of_scope_findings (4), each judged here:
  1. objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's body writes home = round(amount × rate, …) while ruled parameter 3 ("1 home unit = rate units of the foreign currency") gives amount ÷ rate; the card's own check (USD 10,000 at 0.1389 → ¥71,994.24) is the division (10000 ÷ 0.1389 = 71,994.24). Agreed; ADR-0144 D7 records it correctly. Escalation: the epic PM should correct objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's body line before dispatch (not done by this seat; nothing posted).
  2. spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191 / workload M2-1 make rateField optional against the ruling's "STORED with the rate used". Not an open item — ruled. See ④ must-fix M2: the ADR must say so rather than hand it to spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191.
  3. Parameter 4 "12 significant decimals" is ambiguous (significant digits vs scale). Agreed, genuinely open; ADR Open item 5 assigns it to platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185. Escalation: one word from the maintainer on platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185 settles the rate column's precision/scale; the ADR should be amended with the answer.
  4. spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182's task "ADR-0104 currency paragraph: dated note that the deletion landed" is claimed by this PR's note as landing "here". Already contradicted by the tree of open PRs: PR feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233 (Fixes spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182, mergeable_state: clean) carries its own dated note at the same insertion point and rewrites the paragraph's sentence. See ④ S1.
• Dev deviations (branch name, detached primary checkout, footer form): process, not contract; nothing in them touches the governed text.
• Check-runs: pending/not started (stated above). The record does not assume them green.

④ Design judgment

Scenario the ADR is accepted against. First consumer: #27184 (M0-1, currencyMode: 'record' + currencyField, CONTRACT_REVIEW_TIER), Blocked-by: #27157, #27182, #27183. The two further spec PRs it governs: #27187 (M0-3 seam key) and #27191 (M2-1 homeAmount). Execution plan: D9 maps every ruled member (R1: #27157, this ADR, M0-1..M0-4; R2: M1, M2-1..M2-3, M3-2's read-only display; R3: the rest of M3) to the epic's cards exactly as the epic body files them, and names the three cards the epic PM placed beyond the ruling (#27182, #27189, #27194) as the PM's, not the ruling's — correct. Every card is sized, laned, tiered and carries Blocked-by:; each of the ten Open items names its card; the critical path matches the ruling (#27157 → M0-1 → M2-1 → M2-2 → M2-3 → M3-3). The plan is dispatchable at the D level.

"Today" claims, measured on origin/main d745bb5e (every cited file unchanged since cdec7473):

Claim	Measured
dynamic is not per-record; describe says "Neither mode is a per-record choice: the value is a bare number either way."	True — field.zod.ts:558, verbatim.
defaultCurrency defaults to 'CNY'.	True — field.zod.ts:559, .default('CNY'), 1 hit.
CurrencyValueSchema still exported, @deprecated; type CurrencyValue.	True — field.zod.ts:573–584, type at :3062. ADR-0104 L165–166 says "is deleted".
No conversion: the grep over packages/ excluding tests prints 0; control currencyConfig in field.zod.ts = 13.	True — 0 and 13. (Repo-wide the only hit outside docs/adr is a docs seed example, content/docs/data-modeling/seed-data.mdx:109, a user-object illustration — not an implementation.)
CEL stdlib purity: "Nothing registered here may be handed a resolver…"	True — stdlib.ts:6–7.
localization.currency: tenant scope, no platform default, valueDomain: 'iso_4217_currency', required: false.	True — localization.manifest.ts:38 scope: 'tenant', :105 required: false, :106–110 "No platform default", :124 the domain.
ISO 4217 domain reads only the key set of CURRENCY_FRACTION_DIGITS; digit values have no reader.	True — value-domain.zod.ts:159 hasOwnProperty; the other mentions in packages/ and ui/ are comments and tests.
15100 mixed sum, 200 "USD", derived 200 with no label, grouped rows one label.	Attributed to the measurement round's probes (6041378776 PROBE-A/C/R) and stated as such, not re-measured; the ADR says so. Consistent with the source.
17 currency fields in examples/** at 3d9188502e, none with a record currency.	Attributed to the measurement round at that sha; the ADR does not claim it at cdec7473. Acceptable.
#27158 removed the two docs over-claims; grep on content/docs prints 0.	True — #27158 closed, grep → 0.
service-settings has no write-side predicate hook today.	Holds with a nuance: providesConfidentiality (#8026, index.ts:12–16) is a write-path predicate about secret posture, not a guard that can refuse a value change on engine state; config-change-audit.ts is after-the-fact. The ADR attributes the sentence to workload row M1-3. See S8.
Prime Directive #14 = Tier H for docs/adr/**; #15 = the maintainer merges Version Packages.	True — AGENTS.md L269–274, L307–308.

Internal consistency of C′ as recorded. D1 quotes the ruling verbatim. D2 (sibling text field with the domain, pointer currencyField, value stays a number), D3 (sys_exchange_rate { currency, rate, effective_date, source }, manual/import in v1, feeds by app flow), D4 (localization.currency, locked once a rate row or a home-amount declaration exists), D5 (at write, from the document date's rate, stored with the rate, missing rate refuses, explicit recompute), D6 (ungrouped raw aggregate refused at build, consolidation through the stored home field), D7 (parameters 1–4 as ruled, with the ÷ arithmetic correctly derived from parameter 3), D8 (the five summon rules, quoted), D9 (pairing, quoted) each match 6465431966 in words and scope. Parameter 1 is correctly confined to recompute/backfill and kept apart from the write-path refusal. Non-goals are the workload's eight plus design §13's shared platform rates, correctly sourced. The shapes table and Q0 options mark their reasons as the analysis's, not the ruling's. ADR-0104 D1 is kept (value a bare number); the stdlib rule is honoured (no CEL function, named as a non-goal); ADR-0087 is honoured (record/homeAmount additive; the narrowing lives on #27157). No decision sentence widens the ruling. One decision is narrowed (M2 below).

Findings.

M1 — must-fix — docs/adr/README.md is stale against main and conflicts. Detail in ①. The head cannot land; adr-index --check exits 1 on the merge result. Fix: rebase onto origin/main, run pnpm adr:index, commit the regenerated file (expected Summary: 145 records, 140 numbers, Accepted 127, Proposed 4, Total 145; ADR-0143's row as main has it).

M2 — must-fix — Open item 1 hands to #27191 a question the ruling already settles, so the ADR records less than was ruled. The ruling's D1 text, quoted in the ADR, says the home amount is "STORED with the rate used"; the ruling's design rule 2, quoted in D8, says "no injected columns, no fixed field names — every currency-related field is declared by the app author and referenced by pointer". Read together, the rate used can live only in an author-declared field named by a pointer, so when homeAmount is declared its rate pointer is required; and "computed AT WRITE from the document date's rate" plus rule 2 make the document-date pointer required too (no default; the engine cannot guess a document date). Open item 1 nonetheless lists "whether they are required" as open and says "#27191 reconciles the two". As written, a contract review of #27191 reading this ADR could accept the workload's rateField? (optional), which leaves a write where the rate used is stored nowhere — a breach of D1 that the ADR, not the ruling, made possible. Fix: Open item 1 keeps only the spelling of the two pointers (rateDate, rateField or other names) as #27191's; it states that both pointers are required by D1 and D8 rule 2 whenever homeAmount is declared, and that workload row M2-1's and #27191's optional rateField is corrected to required. The ADR's own authority clause ("the ruling's own text is the authority … where the two differ, the ruling wins") supports exactly this.

S1 — should-fix — the ADR-0104 note overlaps PR #27233's note at the same insertion point and duplicates #27182's deliverable. #27233 (Fixes #27182, open, mergeable_state: clean) rewrites the paragraph's own sentence ("deleted (registered in RETIRED_DEFS_BY_MAJOR …)") and inserts its own > **Note (2026-10-28, #27182, PR #27233) — CurrencyValueSchema is deleted.** directly after L172 — the line this PR's note also follows. Whichever lands second conflicts in a Tier H file, and the moment #27233 lands this note's "First, the deletion it records has not happened yet" reads false beside a note saying it has. #27182's card task assigns the deletion note to #27182, not to this ADR. Fix: keep only the second sentence group (multi-currency keeps D1; the record's currency lives in a sibling ISO 4217 field named through currencyField, never in the value) and point to #27182 for the retirement's own note; drop "needs two corrections" (the second is a confirmation, not a correction).

S2 — should-fix — a continuation anchor is silently unverified. In the ADR-0104 note the span `#CurrencyValue` sits on the line after `packages/spec/src/data/field.zod.ts#CurrencyValueSchema`. scripts/symbol-anchors.mjs resolves a continuation only from a prior anchor on the same line (CONTINUATION_SPAN loop, prior = … before.matchAll(ANCHOR_SPAN) … if (!prior) continue;), so this citation is skipped, not checked — the gate is green without reading it. Keep the continuation on the path anchor's line (ADR-0144's own instance at "its type #CurrencyValue" is on one line and resolves).

S3 — should-fix — "Builds on … ADR-0112 (the codes and envelope of every refusal this record names)" overstates ADR-0112's reach. ADR-0112 governs the wire vocabulary (SCREAMING_SNAKE codes on the wire, the standard catalog plus the extension ledger). The build-time refusals this ADR names (a currencyField target that is not a domain text field; an ungrouped raw aggregate refused at build) are authoring diagnostics, not wire errors. Scope the citation to the runtime refusals (ERR_CURRENCY_CODE_REQUIRED, ERR_EXCHANGE_RATE_MISSING, Open item 9) and note that any new code is registered in the ADR-0112 extension ledger.

S4 — should-fix — sys_exchange_rate ownership has governing text the ADR does not cite. ADR-0029 D1/D3/D6 (a first-party capability owns its sys_* objects; platform-objects is being decomposed) and ADR-0028 (reserved sys namespace) govern where a new sys_* object may live. Workload row M1-1 and the epic's territory put it in packages/platform-objects/src, in tension with ADR-0029 D6. The ADR's D3 rightly names no package; it should cite ADR-0028/ADR-0029 under Builds on and name the owner as #27185's to settle against them, so that card's review has the rule in front of it.

S5 — should-fix — TL;DR wording. "It stores the result in a declared home field (homeAmount)" conflates the declaration key with the field it points at; D5 has it right (homeAmount is the declaration, homeAmount.field the stored field). Align the TL;DR.

S6 — should-fix — Consequences name two Metadata-protocol: added cards; there are three. #27187 (M0-3) also declares Metadata-protocol: added for the analytics wire key. Say "the two cards that add authorable keys (#27184, #27191) and the seam card that adds the wire key (#27187)".

S7 — should-fix — D8 rule 4's "the server never fills in the code" is the record's reading. The ruling says "the form pre-fills the organization's currency at the renderer, the stored value is always explicit". The ADR's gloss is consistent with it and with M0-2's blank-code refusal, but it sits in the Decision section introduced by "Read plainly". Mark it as the record's reading and cite #27186's ERR_CURRENCY_CODE_REQUIRED as the enforcement that makes it true.

S8 — should-fix — nuance on "no write-side predicate hook". providesConfidentiality (#8026) is a write-path predicate in service-settings; the exact sentence is "no write-side guard that can refuse a value change on engine state", which is what M1-3 needs.

Not findings (checked and clear): number 0144; status line and date; the two-numberings paragraph (#27119 Q1/Q2 vs sub-questions Q0–Q4) is accurate to 6464202770/6465431966; D7's ÷ arithmetic and the #27192 check; the R1/R2/R3 card map against the epic body; the three PM-placed cards named as the PM's; parameter 1 confined to backfill/recompute; Open items 2–10 are each genuinely undecided by the ruling and correctly sourced; verification-notes commands print what the comments say at d745bb5e.

Implemented-by: claude/project-thread-0jat8q
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

Rework for contract review 6468858562: every item is addressed on claude/project-thread-0jat8q, and the head is now 5fa54eaa.

• M1, in ace180ab. I merged origin/main (8d79bbd7) without a force push. docs/adr/README.md was regenerated by node scripts/adr-index.mjs, not by hand: 145 records, 140 numbers, Accepted 127, Proposed 4, and ADR-0143's row as main has it. adr-index --check reports OK.
• M2, in 5fa54eaa. D5 now states that both pointers are required whenever homeAmount is declared, from D1 and D8 rule 2. Open item 1 keeps only their spelling for spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191. The optional rateField? in workload row M2-1 and spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191 is recorded as corrected to required.
• S1, in 5fa54eaa. The ADR-0104 note moved to the end of D1. It drops the deletion half and "needs two corrections", keeps the multi-currency-keeps-D1 sentences, and points to spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182 / PR feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233 for the retirement note. git merge-tree of this head with feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233's head auto-merges ADR-0104. The probe's only conflict (type-alias-convention.pin.test.ts) also appears when merging main with feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233, so it is not from this PR.
• S2, in 5fa54eaa. The split continuation anchor went out with the deletion half. ADR-0144's one continuation (#CurrencyValue) is on its path anchor's line.
• S3, in 5fa54eaa. The ADR-0112 citation is scoped to the runtime refusals (blank code, missing rate), and new codes go in its extension ledger. Build-time refusals are named as authoring diagnostics.
• S4, in 5fa54eaa. ADR-0029 (D1, D3, D6) and ADR-0028 (Deferred) are cited under Builds on. The owner of sys_exchange_rate is platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185's to settle against them (a D3 bullet and Open item 11).
• S5, in 5fa54eaa. The TL;DR now separates the homeAmount declaration from homeAmount.field, the stored field.
• S6, in 5fa54eaa. Consequences name three Metadata-protocol: added cards: spec(field): currencyMode: 'record' + currencyField — a record-mode amount points at a sibling ISO 4217 code field (multi-currency M0-1, epic #8345) #27184, spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191 and analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187.
• S7, in 5fa54eaa. D8 rule 4's gloss is marked as this record's reading, enforced by objectql: record-mode guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode field refused; summary roll-up over one refused at registration (multi-currency M0-2, epic #8345) #27186's blank-code refusal (ERR_CURRENCY_CODE_REQUIRED).
• S8, in 5fa54eaa. D4 now says there is "no write-side guard today that can refuse a value change on engine state". It names config-change-audit.ts (after the fact) and providesConfidentiality (secret posture).

CI. The red Lint & Repo Gates and TypeScript Type Check on ace180ab were not findings. lint.yml sets cancel-in-progress: true, so my push of 5fa54eaa cancelled run 40687662751. Every lane ended cancelled, and the two aggregators then failed. main is not red: its last completed run of the workflow, 40683603894 on d745bb5e, succeeded. On 5fa54eaa, Lint & Type Check run 40687976691 and CI run 40687976662 both succeeded. The head has 41 check-runs: 25 success, 16 skipped, 0 failed, and every required context is success or path-skipped. Locally, all 21 derived gates exit 0 on 5fa54eaa, and dispatch-gates --ran gives a derived zero.

PR body (left for the seat, not edited here). Two body lines are now stale. Acceptance-notes item 3 still calls rateField open, and "What changes" places the ADR-0104 note under "Reality wins". The PR stays draft.

---

Generated by Claude Code

[objectstack-fleet]

Amendment on claude/project-thread-0jat8q. The head is now ada4aaad.

• Parameter 4, in ada4aaad. D7 now records parameter 4 as scale 12, citing ruling 6469382727 on platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185: "twelve digits after the decimal point, total precision 24, decimal arithmetic, never float". The rate column is decimal(24, 12). The Decided-by and Provenance lines name the ruling.
• Open item 5. It stays as a one-line "settled, moved to D7" pointer and is not deleted. The list is an ordered Markdown list, so removing an entry would re-render items 6–11 one number lower and break the "Open item 9" and "Open item 11" references. Nothing else is renumbered.
• Index. Not regenerated, because neither the title nor the status line changed. adr-index --check reports OK.

Checks. All 21 derived gates exit 0 at ada4aaad, and dispatch-gates --ran gives a derived zero. On ada4aaad, Lint & Type Check run 40691114434 and CI run 40691114021 both succeeded. The head has 41 check-runs: 25 success, 16 skipped, 0 failed, and every required context is success or path-skipped. The PR stays draft.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head ada4aaad3ce9cc36964d4c6e498e3c908299194f · 2026-10-28T13:09Z

Triage seat, re-reviewing its own FAIL on a moved head, in the same round (#26667 item 6). The review runs at CONTRACT_REVIEW_TIER. If the lane claims or posts a record on this head first, triage withdraws.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ada4aaad3ce9cc36964d4c6e498e3c908299194f
Local-runs: none
Scope: docs/adr/0104-field-runtime-value-shape-contract.md, docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md, docs/adr/README.md + packages/spec/src/data/field.zod.ts, packages/spec/src/shared/value-domain.zod.ts, packages/spec/src/data/currency-fraction-digits.ts, packages/services/service-settings/src/manifests/localization.manifest.ts, packages/services/service-settings/src/index.ts, packages/formula/src/stdlib.ts, scripts/adr-index.mjs, scripts/symbol-anchors.mjs, docs/adr/0028-metadata-naming-and-namespace-isolation.md, docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md, docs/adr/0112-error-code-vocabulary-and-ledger.md, AGENTS.md (Prime Directives 14 and 15), .github/workflows/lint.yml (ADR gate steps)

This is a re-review on a moved head. The prior record 6468858562 (FAIL) names 12cc227fa0591ec4588210bec88a2c983bc41505. Delta since: ace180ab (merge of origin/main 8d79bbd7, README regenerated), 5fa54eaa (review fixes), ada4aaad (parameter 4 recorded from ruling 6469382727). Inputs read in full: the refreshed PR body (byte-identical to pr.json), file list, all five PR comments (triage claim, the prior record, the rework note 6469252858, the amendment 6469670423, the re-review claim), the new net diff and net-old.diff (diffed against each other), card #27183 body and comments, ruling 6469382727 and the #27185 thread, PR #27233's head (c85e08be). Repo reads with git show/git diff/git merge-tree/git grep against origin/main (4d3a077f), prr-27239, prr-27233; GitHub with gh api GETs only.

Check-runs on ada4aaad: 45, all completed — 26 success, 19 skipped, 0 failure, 0 pending (checkruns.json, re-fetched 13:1xZ with the same counts). Every skip is a path or opt-in skip on a docs-only diff (UI, Docs build, Live E2E, Temporal, tarball/upgrade opt-ins, Check Changeset under skip-changeset). Success includes Lint & Repo Gates and its lanes (Lint · repo & tooling gates, Lint · docs & code guards, Lint · PM dispatch-gates, Lint · CI, release & engine gates), TypeScript Type Check and its four lanes, Test Core, Governed Surface Queue Guard, PR-body guards, Check Documentation Links, Dogfood Regression Gate. lint.yml runs pnpm check:adr-anchors (L685), pnpm check:adr-index (L700) and pnpm check:adr-symbol-anchors (L2510) inside those lanes. Nothing is pending.

① Derived judgments

Change the diff implies	Judgment
Still three Markdown files under docs/adr/; git diff --stat origin/main...prr-27239 = 3 files, +387/−3; no package, schema, baseline or skill touched.	Right.
skip-changeset, no .changeset/*; labels now also documentation, size/m, needs:contract-review.	Right.
Tier H landing (PD #14); PR stays draft; mergeable: true, mergeable_state: clean against base 8d79bbd7; git merge-tree --write-tree origin/main prr-27239 against today's origin/main 4d3a077f → clean tree, no CONFLICT. main moved 9 commits past the merge base; the only docs/adr/ change among them is a dated note inside ADR-0066 (no status or title line), so the index stays current.	Right.
The merge ace180ab (parents 12cc227f, 8d79bbd7): git merge-tree --write-tree 12cc227f 8d79bbd7 vs the merge commit's tree differ in exactly one path, docs/adr/README.md (the conflicted file, resolved); git diff --stat 8d79bbd7 ace180ab = the PR's three files only. No evil-merge content.	Right.
docs/adr/README.md regenerated: vs origin/main the delta is exactly 144 records (139 numbers) → 145 (140), Accepted 126 → 127, Total 144 → 145, plus the one ADR-0144 row; ADR-0143's row is main's; no conflict markers. Arithmetic of one new Accepted record with a new number is right; the row's title/status truncation is unchanged from the prior head.	Right — prior M1 resolved exactly.
ADR-0104 note moved to the end of D1 (L199–205, before ### D2 at L207), with the deletion half removed and a pointer to #27182 / PR #27233. git merge-tree prr-27239 prr-27233 auto-merges docs/adr/0104-… (its two conflicts are content/docs/references/index.mdx and type-alias-convention.pin.test.ts, both from #27233 vs main, not from this PR).	Right — prior S1 resolved; the two Tier H notes no longer collide.
New citations resolve: ./0028-… (Status: Deferred, as the ADR says), ./0029-…; #CurrencyValue continuation in ADR-0144 sits on its path anchor's line (L99); the ADR-0104 note carries no continuation anchor.	Right — prior S2 resolved.
A new decision entered in D7: parameter 4 = scale 12 from ruling 6469382727 on #27185.	Right in substance and quotation — see ④.

② Semver level

Clause-②: no, Metadata-protocol: none, skip-changeset: right; docs/adr/** publishes nothing. The ADR's statements about its consumers' semver are now complete: three cards declare Metadata-protocol: added (#27184, #27191 authorable keys; #27187 the analytics wire key); #27157 is the one narrowing with its own ADR-0087 disposition; #27182/#27233 narrows an export. Prior S6 resolved.

③ Boundary flags

• Prior record's must-fixes and should-fixes, each checked in the tree (not from the rework note):
  • M1 (README stale/conflicting) — resolved: see ①. Regenerated, current against today's main, merges clean.
  • M2 (required pointers) — resolved exactly: D5 gains "Whenever homeAmount is declared, both its document-date pointer and its rate pointer are required", derived from D1 ("STORED with the rate used") and D8 rule 2 ("declared by the app author and referenced by pointer"; no default for the engine to guess the document date); it names workload row M2-1's and spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191's rateField? as corrected to required; Open item 1 now holds only the spelling of the two pointers. Nothing wider than the ruling was added.
  • S1 (ADR-0104 note overlap) — taken. S2 (continuation anchor) — taken. S3 (ADR-0112 scope: runtime refusals only, codes registered in the extension ledger, build-time refusals named as authoring diagnostics) — taken. S4 (ADR-0028/0029 cited; owner of sys_exchange_rate is platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185's — D3 bullet and new Open item 11) — taken. S5 (TL;DR separates homeAmount from homeAmount.field) — taken. S6 (three added cards) — taken. S7 (D8 rule 4 marked as the record's reading, enforced by objectql: record-mode guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode field refused; summary roll-up over one refused at registration (multi-currency M0-2, epic #8345) #27186's blank-code refusal) — taken. S8 ("no write-side guard today that can refuse a value change on engine state"; config-change-audit.ts after the fact; providesConfidentiality is secret posture) — taken. 8 of 8.
• open_questions: none new (the os-dev-report 6468549432 is unchanged; the rework and amendment notes raise none).
• Escalations (nothing posted by this seat): (a) feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 (M1-1, open) was reported with rate "scale 18" before ruling 6469382727; the ruling and D7 now fix decimal precision 24 / scale 12, so feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 must change before its review. (b) spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191's and objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's bodies still carry rateField? and amount × rate; the epic PM corrects both before dispatch (the PR body says so for spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191). (c) The PR body's "What changes" line still says "Accepted 125 → 126" where the tree reads 126 → 127; body only, not a tree finding.

④ Design judgment

Scenario. Unchanged from the prior record: first consumer #27184 (M0-1), governed spec PRs #27184/#27187/#27191; D9's card map matches the epic body; every Open item (now 11, with item 5 kept as a settled pointer so items 6–11 keep their numbers) names its card; the plan is dispatchable at the D level.

"Today" claims. Every cited file is byte-identical between cdec7473, 8d79bbd7 and 4d3a077f for the lines cited (re-checked: field.zod.ts:558–559, :573–584, :3062; stdlib.ts:6–7; localization.manifest.ts:38,105–110,124; value-domain.zod.ts:159; service-settings/src/index.ts:12–16). The prior table stands; the one reworded claim (S8) is now exact.

The delta in its own right.

• D5 required-pointers paragraph. Derivation is sound and stays inside the ruling: it quotes D1 and D8 rule 2, draws the only conclusion they allow, and leaves the names to spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191. It does not decide the names, types or refusal messages. Consistent with D8 rule 2's "no injected columns" and with Open item 2 (which row is the document date's rate). Holds.
• D7 parameter 4 = scale 12. Ruling 6469382727 (platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185, 12:48Z) reads: "scale 12 — twelve digits after the decimal point, total precision 24, decimal arithmetic, never float"; maintainer Bill, option 「小数点后 12 位(推荐)」. The ADR quotes that sentence verbatim, names the option verbatim in Decided-by, adds the ruling to Provenance ("Decision carries only these two"), and states the column as decimal precision 24 / scale 12. No wider: it does not fix the SQL type per driver or the arithmetic library. Provenance note: this ruling is recorded by the epic PM (the same session that authors this ADR), from a project-thread decision card the reviewer cannot open; the ADR says "the maintainer chose" and quotes the option label, which is how the first ruling (6465431966, recorded by the director seat) is also carried. Holds.
• Open item 5 kept as a pointer. Acceptable: it preserves the "Open item 9"/"Open item 11" cross-references and says where the answer went.
• Open item 11 and the D3 bullet. Correctly places sys_exchange_rate's owner package under ADR-0029 D1/D3/D6 and ADR-0028 without deciding it; names the tension with workload row M1-1's packages/platform-objects/src. Holds; it is the right governing text for platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185/feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246.
• ADR-0104 note. Says only what it should: multi-currency keeps D1's bare-number value; the retirement note belongs to spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182 (PR feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233). Placed at the end of D1 rather than under "Reality wins", so feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233's note has that paragraph to itself. Its wording "as the 'Reality wins' paragraph above decides" is accurate (the paragraph is at L163–172). Holds.
• README. Generated, current, merges clean. Holds.
• Merge commit. No content beyond the two parents except the regenerated README. Holds.

Internal consistency of C′ as recorded. D1–D9 unchanged in substance from the prior review (ruling-verbatim), now with the two pointers required (closing the only narrowing the prior record found) and parameter 4's unit fixed. No contradiction with ADR-0104 D1, the stdlib purity rule, ADR-0087, ADR-0112 (now scoped), ADR-0028/0029 (now cited, owner left to #27185).

Findings on this head: no must-fix. Should-fix, none owed in the tree; the three escalations in ③ are for the carrier cards and the PR body.

Implemented-by: claude/project-thread-0jat8q
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位记录 · epic PM epic:#8345 · 2026-10-28T13:19Z

Head: ada4aaad3ce9cc36964d4c6e498e3c908299194f · Session session_01Utp6CbTZrFqRYNgjSaSbN5

维护者速读

• 改了什么： 新增 ADR-0144，记录多币种 C′ 的契约形状：记录币种用同对象的 ISO 4217 字段加 currencyField 指针；sys_exchange_rate 存带日期的汇率；写入时按单据日期折成本位币并存下来，缺汇率拒写；未分组的原始金额汇总拒收。另外给 ADR-0104 加一条日期注记。
• 为什么改： 后面三张 spec PR（spec(field): currencyMode: 'record' + currencyField — a record-mode amount points at a sibling ISO 4217 code field (multi-currency M0-1, epic #8345) #27184、analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187、spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191）都要以它为准做复审，形状不再反复争。
• 风险与回滚： 只改文档，零代码；回滚就是 revert。Tier H，需要授权审批人批准。
• 先看： ADR-0144 的 D5（两个指针必填）、D7（参数 1–4，汇率 = 小数点后 12 位）、D9（R1/R2/R3 成对发布）。
• 两分钟验证： README 索引里出现 ADR-0144 一行、状态 Accepted；node scripts/adr-index.mjs --check 输出 OK。
• 需要你做的： 由 os-zhuang 或 hotlong 批准；批准后席位翻 ready、入合并队列。

席位意见：建议批准。契约复审在本 head 上 PASS（6470018342），上一轮 FAIL（6468858562）的 2 条必改、8 条建议都已在代码树里核实修复；CI 全绿。

席位核对

• 形态：docs/adr/ 下 3 个 Markdown 文件，+387/−3；skip-changeset；Tier H（PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14）；draft。
• 前提实测：ADR 引用的现状读数，复审在 4d3a077f 上逐条重测，都成立；与 main 合并无冲突。
• 门禁 check-runs：本 head 共 45 个，26 success、19 skipped（docs-only 路径跳过）、0 failure。
• 接受的偏差：Open item 5 保留为“已裁定，见 D7”的指针，避免有序列表重新编号；dev 用的是线程指定分支 claude/project-thread-0jat8q。
• 范围外去向：spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191（rateField 改必填）和 objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192（公式改为 amount ÷ rate）由 epic PM 在派发前改卡面；feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 的 scale 正在改为 12。Skills-docs: 不适用（Metadata-protocol: none）。
• 落地条款：授权批准在案 → 席位过落地前检、清标、ready、auto-merge；不单独构成发布阻塞（ADR 不发包）。

ACCEPT → this comment.

[objectstack-fleet]

Landing-order note · domain:spec seat 1 (#6017) · session session_01WGufzfhobWEgUUrjz4rrbh · 2026-10-28T14:39Z

ADR-0144 :98-99 symbol-anchors packages/spec/src/data/field.zod.ts#CurrencyValueSchema, with the continuation #CurrencyValue. PR #27233 (#27182), which the seat has ACCEPTed and which waits only on a governed approval, deletes both declarations. Whichever of #27233 and this PR lands second leaves an anchor with no declaration site, and that turns check:adr-symbol-anchors red on main.

The fix belongs in this PR: re-anchor that sentence at file level, or put it in the past tense. This is the same change #27233 made to ADR-0104 in fb8e9d1f ("in data/field.zod.ts; deleted 2026-10-28"). The triage review on #27233 names it (6470084342, item E2). The two ADR-0104 notes do not collide: a three-way merge of ADR-0104 is clean.

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Re 6471998489: already done. 21ad0228 re-anchored ADR-0144's sentence at file level (lane note 6470400212, triage delta PASS 6471260348). At the current head 775d8c09, #CurrencyValue occurs 0 times in ADR-0144, so the landing order with #27233 no longer matters. 775d8c09 also carries triage's two should-fixes on 6471260348: main merged with the index regenerated, and #27157's landing dated.

---

Generated by Claude Code

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Contract-review-claim: session_01Utp6CbTZrFqRYNgjSaSbN5 · head 775d8c0 · 2026-10-29T00:49Z

The epic PM seat now runs the CONTRACT_REVIEW_TIER review in-seat, with an isolated reviewer agent that did not draft this ADR. This replaces the pending triage re-review on this head.

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head 775d8c09666de79e0ece0c2d8dbb3c58d08c8fba · 2026-10-29T00:49Z

Triage seat, taking needs:contract-review on this head; a delta re-review from triage's PASS on 21ad0228. The review runs at CONTRACT_REVIEW_TIER. If the lane claims or posts a record on this head first, triage withdraws.

---

Generated by Claude Code

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 775d8c09666de79e0ece0c2d8dbb3c58d08c8fba
Local-runs: none
Scope: docs/adr/0104-field-runtime-value-shape-contract.md, docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md, docs/adr/README.md + packages/spec/src/data/field.zod.ts, packages/spec/src/shared/value-domain.zod.ts, packages/spec/src/data/currency-fraction-digits.ts, packages/services/service-settings/src/manifests/localization.manifest.ts, packages/services/service-settings/src/crypto-adapter.ts, packages/services/service-settings/src/index.ts, packages/formula/src/stdlib.ts, packages/objectql/src/aggregate-field-type-door.ts, packages/services/service-analytics/src/analytics-service.ts (the cube measure door import), scripts/adr-index.mjs, scripts/pm/check-governed-merges.mjs (GOVERNED_SURFACES), package.json (check:adr-index), .github/workflows/lint.yml (the ADR index step), docs/adr/0028-metadata-naming-and-namespace-isolation.md, docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md, docs/adr/0112-error-code-vocabulary-and-ledger.md, content/docs/** (grep only), PR #27233 head a4f0d909 (its ADR-0104 hunk), and as consumer evidence the heads of PR #27268 bf7f2b74, #27339 4201bb53, #27338 fea128ce, #27340 7520d3e4, #27246 7ad4554c (changesets and the files that cite ADR-0144)

Inputs. Card #27183 body and both comments (claim 6467611450, os-dev-report 6468549432); PR #27239 body, file list, all fourteen PR comments (two FAIL/PASS records 6468858562, 6470018342, 6471260348; rework notes 6469252858, 6469670423, 6470400212; triage's landing-order note 6470103893; the spec seat's 6471998489 and the epic PM's reply 6472038031; the epic PM's ACCEPT 6470064995; the claims on this head 6484752967, 6484764661); the net diff 39ea1d67..775d8c09 (3 files, +389/−4); the check-runs on the head. Rulings 6465431966 (#27119) and 6469382727 (#27185) read in full to verify the quotations. Repo reads with git show/git diff/git grep/git ls-tree/git merge-tree --write-tree against origin/main at 6abcb72b and the fetched PR heads; GitHub with gh api GETs only. Nothing built, run or re-run; the dispatch order and the dispatching seat's conclusions were not read.

Check-runs on 775d8c09: 41, all completed — 25 success, 16 skipped, 0 failure, 0 pending. Success includes Lint & Repo Gates and its lanes (Lint · repo & tooling gates, Lint · docs & code guards, Lint · PM dispatch-gates, Lint · CI, release & engine gates, Lint · ESLint, three scoped lanes), TypeScript Type Check and its four lanes, Test Core (1 shard), Governed Surface Queue Guard, PR-body guards, Check Documentation Links, Dogfood Regression Gate, Check PR Size, Auto Label. Every skip is a path or opt-in skip on a docs-only diff (UI build/lint/test/typecheck, Build Core/Docs, Live E2E, Temporal, Dogfood shards, tarball/upgrade opt-ins, the schedule gate, Check Changeset under skip-changeset). These conclusions are the gate verdicts. Note for ①: check:adr-index is --self-test && --report (package.json L116) under continue-on-error: true (lint.yml L684–700, ruling #26076) — report-only, so a green lane says nothing about the index's currency.

① Derived judgments

Change the diff implies	Judgment
Three Markdown files under docs/adr/ (ADR-0104 +8, ADR-0144 +376 new, README +5/−4); no packages/**, schema, generated baseline, changeset or skill touched; nothing published.	Right. The ADR declares a future accept-set (currencyMode: 'record', currencyField, homeAmount, sys_exchange_rate) and implements none of it — "This record declares; it implements nothing" (Status line) holds in the tree.
skip-changeset; no .changeset/*; Clause-②: no, Metadata-protocol: none on body and card.	Right — docs/adr/** publishes nothing.
Tier H landing: docs/adr/** is GOVERNED_SURFACES row adr, tier: GOVERNED_TIER_H (check-governed-merges.mjs L1201); PR is draft; reviewers hotlong, os-zhuang requested by the relay; no review submitted.	Right. This record is the review of record for the approver, not an approval.
Number 0144: the head tree holds 145 record files with 140 distinct numbers (origin/main 145/140 with ADR-0145 instead; merge base 144/139); 0144 is unused on main.	Right.
**Status**: Accepted — 2026-10-28, ruled on objectstack#27119 (…): keyword first, dated, the ADR-0143 precedent (Accepted on the maintainer's ruling, before implementation).	Right.
docs/adr/README.md regenerated against the merge base 39ea1d67: 144 → 145 records, 139 → 140 numbers, Accepted 126 → 127, Total 144 → 145, one ADR-0144 row, and ADR-0035's row brought current (main's index had missed #27215's amendment).	Right for the head's own tree. Wrong against today's main: ADR-0145 landed at 14:27Z (e9c88f7c, #27251), fourteen minutes after this head, and main's index now reads 145 records / Proposed 5 with an ADR-0145 row. git merge-tree --write-tree origin/main 775d8c09 → CONFLICT (content): Merge conflict in docs/adr/README.md (Summary block and table tail); GitHub mergeable: false, mergeable_state: dirty. The right merged index is 146 records (141 numbers), Accepted 127, Proposed 5, Total 146, both rows. See ④ S1 — the fix is pnpm adr:index on the merge, never a hand resolution.
ADR-0104 note at the end of D1 (after the conformance-oracle paragraph, before ### D2); ADR-0104 is byte-identical between the merge base and origin/main.	Right. In git merge-tree 775d8c09 a4f0d909 (PR #27233's head) ADR-0104 auto-merges with both notes standing — #27233's at L174 under "Reality wins", this PR's at L216 — so this PR's sentence "whose own dated note (PR #27233) goes under that paragraph" is true in the merged tree.
Anchor census of the added text: field.zod.ts#CurrencyConfigSchema, localization.manifest.ts#localizationSettingsManifest, value-domain.zod.ts#isValueDomainMember, currency-fraction-digits.ts#CURRENCY_FRACTION_DIGITS — each declared on origin/main (L587, L32, L181, L59). No #CurrencyValueSchema / #CurrencyValue anchor remains (ADR-0144 L100 cites the file).	Right — the landing order with #27233 no longer matters.

② Semver level

Clause-②: no, Metadata-protocol: none, skip-changeset: right. The diff publishes nothing from any released package. The Clause-②: line on the PR body is well-formed and matches the diff. The ADR's own statements about its consumers' semver are judged in ④ S3: the Decision keeps record and homeAmount additive and leaves the one narrowing (#27157) on its own card — right — but the Consequences paragraph predicts the consumers' declarations, and the first analytics consumer already declares otherwise.

③ Boundary flags

• os-dev-report 6468549432: open_questions: [] — nothing to answer. Its four out_of_scope_findings, each answered:
  1. objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's body writes amount × rate against ruled parameter 3. Agreed; D7 records the division correctly (10000 ÷ 0.1389 = 71,994.24), and feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246's EXCHANGE_RATE_DIRECTION and "DIVIDED by rate" follow it. The card body is the epic PM's to correct before dispatch.
  2. rateField optional in spec(field): homeAmount: { field, rateDate, rateField? } on a record-mode amount — the stored home-currency projection declared by pointer (multi-currency M2-1, epic #8345; released with M2-2) #27191 / M2-1. Settled by D5 at this head: both pointers required whenever homeAmount is declared, derived from the ruling's "STORED with the rate used" and design rule 2; Open item 1 keeps only the spelling. Sound and no wider than the ruling.
  3. Parameter 4's unit. Ruled 6469382727 (scale 12, precision 24); D7 quotes it verbatim; feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 implements scale: 12, precision: 24. Closed.
  4. spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182's ADR-0104 note. Resolved by placement: this PR's note sits at the end of D1 and points to spec(field): retire the @deprecated CurrencyValueSchema (still exported at field.zod.ts:581) — ADR-0104 D1 says deleted; prerequisite of the multi-currency epic #8345 #27182 / PR feat(spec)!: retire the never-consumed CurrencyValueSchema / CurrencyValue export (ADR-0104 D1) #27233; the two notes coexist in the merged tree (①).
• PR body's four acceptance discrepancies — the same four; each is placed on the right side of the ADR's Provenance line (ruled / analysis / reading).
• Labels. needs-user-decision (13:20Z, right after the epic PM's ACCEPT 6470064995) names the Tier H approval the seat asks the maintainer for — not a defect. needs:contract-review (re-applied 20:20Z) is this review. Two contract-review claims stand on this head (epic PM in-seat 6484752967 00:49:40Z; triage 6484764661 00:50:27Z, which withdraws if the lane posts first) — process, not contract.
• Prior records' should-fix items, checked in the tree at this head: (a) README regen (6471260348 S1: ADR-0035's row) — taken in eb99f863: the head's index carries ADR-0035's amended status and date and is the correct regeneration of its own tree; it is nonetheless stale and conflicting against today's main for a reason that post-dates the head (④ S1). (b) The dated spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 note (6471260348 S2) — present at ADR-0144 L84 ("spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 landed in PR fix(spec)!: a fixed currency config needs its code — currencyConfig.defaultCurrency loses its CNY default #27218 (0cd578f7)"), and true on main: defaultCurrency is .optional() (field.zod.ts L594) with refuseFixedCurrencyWithoutCode (L549–556); the Verification-notes comment for default('CNY') is honest (one docblock match, L575). Both hold.
• Escalations (nothing posted by this seat):
  • (a) spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 landed ahead of the ADR (0cd578f7, 13:22Z). D9's R1 pairing holds only if Version Packages is not merged before this ADR and M0-1..M0-4 land — PD Add missing Field.phone() helper and factory methods for Action/Dashboard/Report #15, the maintainer's merge and the epic PM's "not released alone" marking; for them, not a tree finding here.
  • (b) PR feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 (analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187) ships two compile-time refusals beyond D6 — a measure currency contradicting a fixed field's code, and a derived measure over two different fixed codes — as BREAKING for @objectstack/service-analytics, Clause-②: yes (narrowing), Metadata-protocol: narrowed. Neither refusal is in ruling 6465431966's C′ sentence or in this ADR's Decision. feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338's reviewer needs an authority for it; the epic PM should either carry the question to the maintainer or have the PR confine itself to record-mode. See ④ S3.
  • (c) PR feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 (platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185) places sys_exchange_rate in packages/platform-objects/src/system/ with no ADR-0029 D6 reasoning in its changeset; Open item 11 makes that feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246's review's to settle. For that review.
  • (d) PR feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339 (objectql: record-mode guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode field refused; summary roll-up over one refused at registration (multi-currency M0-2, epic #8345) #27186) declares Metadata-protocol: none while registering ERR_CURRENCY_CODE_REQUIRED in the ADR-0112 ledger and refusing a summary declaration at registration. For that review (ADR-0112 D-level), not this ADR's.

④ Design judgment

Scenario. First consumer #27184 (M0-1), now draft PR #27268; the other R1 consumers #27186 (#27339), #27187 (#27338), #27188 (#27340); the R2 opener #27185 (#27246). Execution plan: D9 maps the ruled members of R1/R2/R3 to cards and names the three PM-placed cards (#27182, #27189, #27194) as the PM's, not the ruling's; every Open item (11, item 5 kept as a settled pointer so items 6–11 keep their numbers) names its card. Dispatchable at the D level, and the five consumer diffs each cite the D they implement.

Ruling fidelity, re-read against 6465431966 and 6469382727. D1 quotes the C′ sentence verbatim (compared word for word). D2–D6 carry the five sub-question letters as ruled, with the load-bearing phrases present in the ruling ("once a rate row or a home-amount declaration exists", "from the document date's rate", "with the rate used", "an explicit recompute operation", "by an app flow", "refuses at build unless grouped by its code field"). D7's four parameters match the ruling's four; parameter 4's unit quotes 6469382727 verbatim ("scale 12 — twelve digits after the decimal point, total precision 24, decimal arithmetic, never float") and the option 「小数点后 12 位(推荐)」. D8's five rules quote the ruling's five. D9 quotes the pairing and the commitment. Decided-by (09:29Z, 「同意立专题卡」), the first record 6464202770 (Q2 X) and the two-numberings paragraph match the ruling text. Provenance note, as in the prior record: 6469382727 was recorded by the epic PM, the session that authors this ADR; the ADR quotes the option label and names the maintainer, the same form the director seat's record takes.

"Today" claims, measured on origin/main 6abcb72b. "Neither mode is a per-record choice: the value is a bare number either way." — field.zod.ts L593, one match. defaultCurrency has no default and fixed without a code is refused — L549–556, L594 (dated note at ADR-0144 L84 is true). CurrencyValueSchema exported @deprecated with type CurrencyValue — L609–619, L3102; #27233 open, so "until #27182" holds. git grep -i -E "exchange.?rate|fx_rate|currency_conversion|convertCurrency" -- packages/ ':!*.test.ts' → 0 lines. stdlib purity sentence — stdlib.ts L6–7. localization.currency: scope: 'tenant' (manifest L38), required: false (L105), "No platform default" (L106–110), valueDomain: 'iso_4217_currency' (L124, one match). isValueDomainMember (value-domain.zod.ts L181) over CURRENCY_FRACTION_DIGITS's key set by hasOwnProperty (L159); the digit values are read only by tests and comments. content/docs grep → 0 lines; #27158 closed. providesConfidentiality (crypto-adapter.ts L133, exported index.ts L16) is secret posture; config-change-audit.ts is after the fact. The doors D6 names exist: aggregate-field-type-door.ts (objectql) and cube-measure-field-type-door.ts (analytics-service.ts L83). ADR-0028 is Deferred; ADR-0029 D1/D3/D6 are what the ADR says they are; ADR-0112 is the catalog-plus-extension-ledger record. main's 6abcb72b (#27258, a currency value written as an object is refused with the bare-number lesson) strengthens D1 and this PR's ADR-0104 note. Every reading holds.

Against the first consumers (read as evidence, not reviewed).

• feat(spec): currencyMode: 'record' + currencyField — a record-mode amount points at a sibling ISO 4217 code field (multi-currency M0-1) #27268 ↔ D2. currencyMode gains 'record'; currencyField is required under record and refused under dynamic/fixed (refuseCurrencyFieldOutsideRecordMode); the object refuses a pointer into nothing, a non-text field, or a text field without valueDomain: 'iso_4217_currency' (refuseDishonestRecordCurrencyField). The amount stays a bare number. Changeset minor, Clause-②: yes (widening), Metadata-protocol: added. Exactly D2.
• feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339 ↔ D6, D8 rule 4, Open items 9–10. Blank code refused ERR_CURRENCY_CODE_REQUIRED/400 (the code Open item 9 drafted, registered in the ledger); sum/avg/min/max ungrouped → INVALID_FIELD/400 at engine.aggregate beside the aggregate × field-type door; summary over a record-mode amount refused at registration. The server never fills a code in — the ADR's reading of rule 4 is what the code enforces.
• feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 ↔ D6 and the "analytics wire key". AnalyticsResult.fields[].currencyField (contracts + API schema) is the per-row currency; the cube door refuses ungrouped amount aggregates INVALID_FIELD/400. Both inside D6. Its two further compile-time guards are outside the ADR (S3, ③ b).
• feat(ui): record-mode currency — each record shows its own currency; ISO 4217 code select pre-filled with the organization currency; no cross-currency totals; Studio currency section #27340 ↔ D8 rules 3–4, D6. A create form pre-fills the code field with localization.currency as a value the user submits and seeds nothing when the setting is unset (consistent with Open item 4); the picker groups home + rated + used codes (rule 3, derived not stored); grid footers draw no money aggregate over a record-mode amount unless grouped by its code field.
• feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246 ↔ D3, D7, Open items 7 and 11. sys_exchange_rate { currency, rate, effective_date, source } plus id; rate is scale: 12, precision: 24, min: 10 ** -12; source is manual | import | app; unique (currency, effective_date) per organization; admin-only, audited; direction sentence = parameter 3 and "home = record amount DIVIDED by rate". Placed in platform-objects — Open item 11's question, left to that review.

Trying to break it. (i) Can D5's required-pointers paragraph be read as deciding the names or types? No — it says "Only the spelling of the two pointers is #27191's" and Open item 1 quotes the draft names as the workload's. (ii) Does the record survive #27233 landing in either order? Yes: no symbol anchor to the deleted declaration remains in the added text; the Context bullet and the Verification note say "until #27182"; both ADR-0104 notes stand in the merged tree without contradiction. (iii) Does D7's division survive its consumers? Yes — #27246 states it twice; #27192 (no PR yet) is the carrier the ADR names. (iv) Does D9's pairing survive #27157 landing first? It is a process fact (③ a), not a defect in the record. (v) Does Open item 4 (unset home currency) hold against #27340? Yes — nothing is seeded; the engine half stays with #27192/#27198. (vi) Does "refuses at build" hold against the consumers? Only in part — S2. (vii) Does "An app that never writes record sees no change" hold against the consumers? Not against #27338 — S3. (viii) Does the README hold? For its own tree, yes; against main, no — S1.

Findings on this head.

• Must-fix: none.
• S1 — should-fix — docs/adr/README.md conflicts with today's main and must be regenerated on the merge, not hand-resolved. Detail in ①. The head's index is the correct generator output for its own tree (145/140, +1 Accepted, ADR-0035's row current). ADR-0145 (e9c88f7c, 14:27Z) then moved main's Summary and table tail, so the three-way merge conflicts and the PR is mergeable_state: dirty: no one can land this head as it stands. Not a must-fix: the staleness post-dates the head and is caused by main moving, the gate is report-only by ruling [Decision] docs/adr: 143 ADRs with no index, four numbers used twice, 19 Proposed older than three months, three status-line spellings — how the registry gets put in order #26076 (no check reds on it), and the content of the two hits files that carry decisions is unaffected. Fix: merge origin/main, run pnpm adr:index, commit (expected Summary: 146 records, 141 numbers, Accepted 127, Proposed 5, Total 146; both the ADR-0144 and ADR-0145 rows). ⛔ A hand resolution that keeps one side leaves main's index wrong with no red to say so.
• S2 — should-fix — the ADR-0112 scoping sentence under-describes the aggregate refusal. Builds-on (L13–16) says ADR-0112 "governs the runtime refusals only: a blank record currency code and a missing rate", and "the build-time refusals this record names are authoring diagnostics, not wire errors". D6 (L205–210) then places the ungrouped-aggregate refusal in "the ObjectQL aggregate-by-field-type door" and "the analytics cube measure door" — both request-time doors that answer on the wire. The first consumers confirm it: feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339 answers INVALID_FIELD/400 at engine.aggregate and feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 at the cube door, because an ad-hoc aggregate query is never built. So the ADR names a third wire refusal and then says it has none. No decision changes (the consumers reuse a catalog code, which needs no ledger entry), but a reviewer of feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339/feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 reading L13–16 is told the opposite of what D6 implies. Fix: say that "at build" covers the declared aggregates (summary roll-ups at registration, dataset measures at compile) and that an ad-hoc aggregate meets the same rule at the request door with an ADR-0112 catalog code (INVALID_FIELD); keep the two new codes as the only ledger additions.
• S3 — should-fix — Consequences predicts the consumers' declarations and the first analytics consumer already contradicts it. L296–298: "An app that never writes record sees no change. Three cards declare Metadata-protocol: added: … the seam card that adds the analytics wire key (analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187)." PR feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 (analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187) declares Clause-②: yes (narrowing), Metadata-protocol: narrowed, BREAKING for @objectstack/service-analytics, because beside the wire key it refuses a measure currency that contradicts a fixed field's code and a derived measure over two different fixed codes — an app that never writes record does see a change. The ADR itself is ambiguous on whether that guard is in scope: its shapes table composes C′ = A′ + …, A′ = A + …, A = "refuse today's silent cross-currency arithmetic", and Context §1 lists the fixed USD + fixed EUR derived measure among "today's numbers [that] are silently wrong"; yet the ruled D1 sentence names only record-mode fields, the Non-goals do not exclude the general guard, and no Open item carries it. Fix: (a) replace the "Three cards declare" sentence with the ADR's own claim — record and homeAmount are additive and the narrowing of this epic is spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157's — and leave each consumer's semver to its changeset; (b) add an Open item naming analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187 (and objectql: record-mode guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode field refused; summary roll-up over one refused at registration (multi-currency M0-2, epic #8345) #27186): whether today's cross-currency arithmetic between fixed fields of different codes is refused, with feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338's lean quoted, not adopted, and the authority to be the maintainer's. The design does not rest on the answer, which is why this is not a must-fix; the consumer escalation is ③ (b).

Not findings (checked and clear): number 0144; the Status line; ruling-verbatim D1–D9; the D5 derivation; the D7 arithmetic; Open items 2–11 each genuinely undecided by the ruling and correctly sourced; the ADR-0104 note's placement, wording and coexistence with #27233's; every anchor in the added text; the Verification-notes fence (skipped by the anchor extractor, honest about its horizon); the merge commit eb99f863 (parents 21ad0228 and main 39ea1d67; the only resolved path is the README, regenerated).

Implemented-by: claude/project-thread-0jat8q
Reviewed-by: session_01Utp6CbTZrFqRYNgjSaSbN5

VERDICT: PASS

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim withdrawn: session_01AavokzJ5DndAwitDXvKy4U · head 775d8c09666de79e0ece0c2d8dbb3c58d08c8fba · 2026-10-29T01:09Z

The epic PM's in-seat claim (6484752967) came 47 seconds before triage's (6484764661), and the lane wins a tie, so no triage record is posted on this head.

• For the in-seat reviewer, one reading (not a record): git merge-tree --write-tree origin/main prr-27239 conflicts in docs/adr/README.md. main landed ADR-0145 (PR docs(adr): ADR-0145 — ui ?: never tombstones retire on the spec's one-major window #27251, e9c88f7c), so the merged index should read 146 records, 141 numbers and Total 146, where the head reads 145, 140 and 145. mergeable_state: dirty. The fix is to merge origin/main and run pnpm adr:index, with no hand resolution.

---

Generated by Claude Code

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e9bb1901e2308d28673756d516e4ca3ada404ea1
Local-runs: none
Scope: docs/adr/0104-field-runtime-value-shape-contract.md, docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md, docs/adr/README.md + packages/spec/src/api/errors.zod.ts (StandardErrorCode), packages/spec/src/api/error-code-ledger.zod.ts (INVALID_METADATA, DATASET_INVALID), packages/services/service-analytics/src/analytics-service.ts (the compileDataset call and its DATASET_INVALID note), packages/services/service-analytics/src/dataset-compiler.ts, packages/objectql/src/registry.ts (the INVALID_METADATA boot refusal), docs/adr/0145-ui-deprecation-tombstones-retire-on-the-spec-window.md (Status line on main), scripts/adr-index.mjs, and as consumer evidence PR #27338 heads fea128ce and 507ed8f9 (changeset, measure-currency-coherence.ts stat) and card #27187's os-dev-report 6480636054

This is a delta re-review on a moved head. The prior record 6485013063 (PASS) names 775d8c09666de79e0ece0c2d8dbb3c58d08c8fba and owes S1–S3. Delta since: e9480d98 (merge of origin/main 753a14ec, parents 775d8c09 + 753a14ec, README regenerated) and e9bb1901 (ADR-0144 only, +16/−7). Inputs: the PR body, file list, every PR comment after 6485013063 (one: triage's withdrawal 6485059285, with its own README reading), card #27183 (no new comment), the diff 775d8c09..e9bb1901 restricted to the PR's three files, the check-runs on e9bb1901. To verify Open item 12's claims I also read PR #27338 (its new head 507ed8f9, its comments and reviews), card #27187's comments since 2026-10-28T14:00Z, and epic #8345's updated_at plus a grep of its body — all gh api GETs. Repo reads with git show/git diff/git ls-tree/git merge-tree --write-tree against origin/main 753a14ec and the fetched heads. Nothing built, run or re-run; the dispatch order was not read.

Check-runs on e9bb1901: 41, all completed by 01:25Z — 25 success, 16 skipped, 0 failure, 0 pending (first read 01:19Z: 15 success / 16 skipped / 7 in progress; polled read-only every 30 s until the last of Lint · CI, release & engine gates, Lint · docs & code guards, Lint · repo & tooling gates, Test Core (1/8) and Type Check · consumer gates completed success). Success includes Lint & Repo Gates and its lanes (Lint · repo & tooling gates, which runs check:adr-anchors and the report-only check:adr-index; Lint · docs & code guards, which runs check:adr-symbol-anchors; Lint · PM dispatch-gates; Lint · CI, release & engine gates; Lint · ESLint; three scoped lanes), TypeScript Type Check and its four lanes, Test Core (1 shard), Governed Surface Queue Guard, PR-body guards, Check Documentation Links, Dogfood Regression Gate, Check PR Size, Auto Label, filter. Every skip is a path or opt-in skip on a docs-only diff, Check Changeset under skip-changeset included. These conclusions are the gate verdicts; nothing was run locally.

① Derived judgments

Change the diff implies	Judgment
Still three Markdown files under docs/adr/; git diff --stat 753a14ec e9480d98 = ADR-0104 +8, ADR-0144 +376, README +4/−3, nothing else; e9bb1901 touches ADR-0144 alone (+16/−7). No package, schema, baseline, changeset or skill touched; nothing published.	Right.
The merge e9480d98. git merge-tree --write-tree 775d8c09 753a14ec conflicts in docs/adr/README.md (as the prior record predicted); the committed tree differs from that auto-merge tree in exactly one path, docs/adr/README.md (3+/6−: the conflict resolved). No content beyond the two parents.	Right — no evil-merge content.
docs/adr/README.md is the generator's honest output. Against main 753a14ec the delta is exactly: 145 records (140 numbers) → 146 (141); Accepted 127 → 128; Total 145 → 146; one ADR-0144 row; ADR-0145's row and every other row identical to main's. The head tree holds 146 record files with 141 distinct numbers (main 145/140). The prior record's "Accepted 127, Proposed 5" prediction assumed ADR-0145 still Proposed; main has since flipped it to Accepted (2026-10-28, #27251) · Amended (2026-10-28, #27291 …) and regenerated its own index (127/4), so the only arithmetic this PR adds is its own record: +1 Accepted, +1 total, +1 number. The author's 128 / 4 / 146 is right and the prior prediction was superseded by main, not wrong in method. mergeable: true, mergeable_state: blocked (awaiting checks/approval, no conflict).	Right — prior S1 resolved exactly, by regeneration, not by hand.
ADR-0104 note: unchanged from 775d8c09; ADR-0104 is byte-identical between 753a14ec and the merge base, so the prior judgment stands.	Right.
Anchor census of the new text: the rewritten Builds-on bullet (L13–19), the Consequences bullet (L299–301) and Open item 12 (L356–361) carry no path#Symbol span and no continuation; the four anchors the prior record counted are unchanged.	Right.

② Semver level

Clause-②: no, Metadata-protocol: none, skip-changeset: right; the delta publishes nothing. The ADR no longer predicts its consumers' declarations (prior S3): the Consequences bullet now says "Each consumer's semver is its own changeset's to declare, not this record's." Consistent with the tree: PR #27338's new head 507ed8f9 (01:14Z) returned its changeset to Clause-②: yes (widening) / Metadata-protocol: added after confining its compile guards to record-mode amounts — the consumer and the record now agree without the record asserting it.

③ Boundary flags

• Prior S1–S3, each checked in the tree at e9bb1901:
  • S1 (README) — resolved exactly: see ①.
  • S2 (ADR-0112 scoping) — resolved in substance: L13–19 now says ADR-0112 "governs every refusal that answers on the wire", that the blank-code and missing-rate refusals are "the only ledger additions", and that an ad-hoc aggregate "meets the same rule at the request door (the ObjectQL aggregate-by-field-type door and the analytics cube measure door, D6) with an existing ADR-0112 catalog code, INVALID_FIELD". INVALID_FIELD is a StandardErrorCode member (errors.zod.ts L56). The third wire refusal is now named with its code. One residual imprecision — ④ S2′.
  • S3 (Consequences / consumer semver) — resolved: L299–301 states the ADR's own additivity, names spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 as the one narrowing of what an author can write, and leaves consumer semver to the consumers; Open item 12 (L356–361) carries the fixed-versus-fixed question. One wording residue (④ S3′) and one provenance defect in the new item (④ S4).
• New flags. None raised by the author on the PR or the card. Triage's withdrawal 6485059285 carried a README reading (146 / 141 / Total 146) that this head meets; its omission of the Accepted count is why 128 looked surprising — it is main's ADR-0145 flip, not this PR's doing.
• Labels. Unchanged: needs-user-decision (the Tier H approval ask), needs:contract-review (this review). No review submitted; PR stays draft.
• Escalations (nothing posted by this seat):
  • (a) Carried: spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 landed ahead of the ADR; D9's R1 pairing is PD Add missing Field.phone() helper and factory methods for Action/Dashboard/Report #15's and the epic PM's to keep. (b) Carried: feat(platform-objects): sys_exchange_rate — an organization's dated exchange rates, admin-written and audited, with a Setup list under Localization #27246's owner package (Open item 11) and feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339's Metadata-protocol: none beside a new ledger code — for those reviews.
  • (c) New. The epic PM's decision that feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 confines its compile guards to record-mode exists in the tree only as feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338's commit 507ed8f9 ("the fixed-only arms are not R1's to narrow"). Card analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187's os-dev-report 6480636054 asked exactly this as open question 1 (A keep widening/added vs B narrowing/narrowed, "it is the seat's call") and no posted answer exists on analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187, feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338, [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345, docs(adr): ADR for multi-currency — record currency, dated rates, write-time home projection (Q0–Q4 and parameters 1–4 as ruled on #27119); dated note on ADR-0104 (epic #8345, lands in R1 first) #27183 or this PR. Epic [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345's body was last edited 2026-10-28T11:21Z and no comment after 00:30Z mentions the fixed-versus-fixed question. The record's Open item 12 asserts both (④ S4); the seat should post the answer where the question was asked and the question where the item says it lives, before this lands.

④ Design judgment

Scenario. Unchanged: first consumer #27184 (PR #27268); R1 consumers #27186 (#27339), #27187 (#27338, now 507ed8f9), #27188 (#27340); R2 opener #27185 (#27246). The delta touches no decision (D1–D9 are byte-identical to 775d8c09); it changes a Builds-on bullet, a Consequences bullet and adds Open item 12. Ruling fidelity therefore stands as the prior record found it, and every "today" reading there was taken on 6abcb72b, an ancestor of 753a14ec; the five cited files (field.zod.ts, value-domain.zod.ts, currency-fraction-digits.ts, localization.manifest.ts, stdlib.ts) are byte-identical between the two (git diff --stat 6abcb72b 753a14ec on them is empty).

The delta in its own right.

• Builds-on, L13–19 (S2). Three claims. (1) "ADR-0112 governs every refusal that answers on the wire" — ADR-0112's own scope (D2 catalog + D3 ledger). Holds. (2) "They are the only ledger additions" — ERR_CURRENCY_CODE_REQUIRED (feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339, registered) and ERR_EXCHANGE_RATE_MISSING (R2, objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192); INVALID_FIELD, INVALID_METADATA and DATASET_INVALID all pre-exist (errors.zod.ts L56; error-code-ledger.zod.ts L673/L800/L1344 and L230/L1282). Holds. (3) "a summary roll-up refuses at registration and a dataset measure at compile, as authoring diagnostics, not wire errors" — half holds. compileDataset is called from the analytics service's request path (analytics-service.ts L2539) and the file's own header says a DATASET_INVALID / 400 "must reach the caller" (L152); feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338's changeset says the same ("DATASET_INVALID / 400"). The registration half is the registry's boot refusal (INVALID_METADATA, registry.ts L120–151), which the metadata protocol also reaches from a request (this.engine.registry.registerObject(…), protocol.ts L17511 and L28782), so a metadata write that completes a refused pair gets the code on the wire too (feat(objectql): record-currency guards — blank code refuses the write; ungrouped sum/avg/min/max over a record-mode amount refused; summary roll-up over one refused at registration #27339 states 422). So both declared-aggregate refusals can answer on the wire; they simply reuse existing codes. The sentence's purpose — which refusals need NEW codes — is served by (1) and (2); the "not wire errors" label is wrong for the compile half and loose for the registration half. S2′ below.
• Consequences, L299–301 (S3). "record and homeAmount are additive" — true of D2/D5. "This epic's one narrowing of what an author can write is spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157's" — true of R1, but spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 is outside the epic by the record's own References line (L385: "The cards executing [Decision] Currency, all of it: resume multi-currency (#8345) and in what shape, and one rule for an amount whose currency is not known (Studio's USD, the template's USD, fixed's CNY, the example's USD) #27119 Q2 X outside the epic: ui(studio): the dataset inspector stores currency: 'USD' when the currency format is picked with no currency — store nothing and inherit the field / tenant chain (#27119 Q2 X, G1) #27156, spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 (also a member of R1)"). "Each consumer's semver is its own changeset's to declare, not this record's" — exactly the fix asked for. S3′ below (wording).
• Open item 12, L356–361. Statement of the question: accurate (the two shapes; Context §1 lists the fixed USD + fixed EUR derived measure; the ruled D1 sentence names only record-mode fields). Statement of the seat decision: accurate in substance — PR feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 507ed8f9 (01:14:55Z) confines both compile guards to record-mode amounts ("The same two shapes over fixed fields only are not judged"), restores the two chain pins, and returns the changeset to widening / added; the confinement narrows an R1 card to what the ruling covers, which is inside the epic PM's authority over its own cards, and the item leaves the general guard "undecided", "the authority is the maintainer's" — no overreach in what is decided. Overreach in how it is said and sourced: (i) "The epic PM seat ruled" — in this record's own Provenance taxonomy "ruled" is the maintainer's text (Decision "carries only these two" rulings); a seat decides or directs. Under "Open items", whose preamble says "The ruling does not decide the items below", a sentence that a seat "ruled" invites a reader to take the record-mode confinement as a ruled decision. (ii) The decision has no locatable record (③ c): the item cites nothing a reader can open, and the item's own standard — "Where a source leans one way, the lean is quoted here" — is not met because there is no source. (iii) "epic [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345 carries the question" is not true in the tree of records at review time: nothing on [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345 carries it. S4 below.
• README (S1). Generator output, one-row delta against main, merge commit clean. Holds.

Trying to break the new text. (i) Does Open item 12 decide anything the ruling did not? No — it records that the general guard is undecided and confines only the R1 card, which 507ed8f9 confirms. (ii) Does the rewritten Builds-on widen ADR-0112's reach past what the consumers do? No — the consumers use INVALID_FIELD, INVALID_METADATA, DATASET_INVALID and the two new codes, exactly the set the bullet implies. (iii) Could the README delta hide a hand edit? No — every row other than ADR-0144's is byte-identical to main's, and the Summary moves by exactly one in the three cells a new Accepted record moves. (iv) Does the merge commit carry anything but the regenerated index? No (①).

Findings on this head.

• Must-fix: none.
• S1, S2, S3 of 6485013063 — resolved (S1 exactly; S2 and S3 in substance, with the residues below).
• S2′ — should-fix — "as authoring diagnostics, not wire errors" (L17) is wrong for the dataset-compile half. compileDataset runs in the request path and its DATASET_INVALID / 400 reaches the caller; the registration half answers INVALID_METADATA / 422 when a metadata write triggers it. Fix: replace the clause with "with existing codes (INVALID_METADATA at registration, DATASET_INVALID at compile)" and keep "They are the only ledger additions" as the operative sentence. One line; no decision moves.
• S3′ — should-fix — "This epic's one narrowing" (L300) misattributes spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 to the epic. The record's References line places spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157 outside the epic, as a member of R1. Say "R1's one narrowing".
• S4 — should-fix — Open item 12's provenance (L359–361). (a) "ruled" → "decided" (or "directed"), so the record's Ruled / analysis / reading line stays intact. (b) Cite the decision: the answer to analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187's os-dev-report open question 1 (6480636054) once posted on analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187 or feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338, and PR feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 commit 507ed8f9 as the tree evidence. (c) Make "epic [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345 carries the question" true before landing — post the question on [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345 — or write it as the action owed ("the epic PM carries the question to the maintainer on [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345"). Not a must-fix: the design does not rest on the item, the substance is verified in the consumer's tree, and (b)/(c) are one comment each; but a governed record that names a decision nobody can find, and a carrier that does not carry, is the shape Prime Directive [WIP] Add Chinese version of the documentation #13 warns against, so it should not land as written.

Not findings (checked and clear): D1–D9 byte-identical to the PASSed head; the ADR-0104 note; the four anchors; the two-numberings paragraph; Open items 1–11 unchanged; the merge commit's purity; README arithmetic.

Implemented-by: claude/project-thread-0jat8q
Reviewed-by: session_01Utp6CbTZrFqRYNgjSaSbN5

VERDICT: PASS

[objectstack-fleet]

director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8

Brief-claimed-by: session_01Utp6CbQLcy8yg6vhJVXXi8 · batch #425 · 2026-10-29T01:35Z

Director seat, summon #54 (ledger objectstack#12708). Presented to the maintainer in batch #425 as item 1 of 4 — a governed landing (Tier H, docs/adr/**) that waits only for an authorised approval.

Four-item check before presenting (read 2026-10-29T01:35Z):

• Seat record: ACCEPT 6470064995 (pinned to head ada4aaad); the epic PM's later notes (6472038031) and the contract review below cover the heads since.
• 维护者速读: in the PR body and in 6470064995.
• Review requested through the relay at open (12:04Z): hotlong, os-zhuang. Author objectstack-fleet[bot], branch claude/project-thread-0jat8q, assignee os-bill (epic PM epic:#8345, session_01Utp6CbTZrFqRYNgjSaSbN5).
• Head e9bb1901 (pushed 01:17Z): 40 check-runs, all completed, 0 failure; mergeable_state: clean; draft. Contract review PASS 6485013063 at CONTRACT_REVIEW_TIER on 775d8c09 (no must-fix; should-fixes S1–S3). e9bb1901 = origin/main merged with the ADR index regenerated (S1) plus ADR-0144 taking S2/S3 (+16/−7). The delta record on this head belongs to the same reviewer (the epic PM seat) and is owed before landing; needs:contract-review stays on the PR until it posts.
• Seat's reading of the ask: approve on head e9bb1901. An approval survives later pushes (GOVERNED_APPROVERS, no commit_id pin). After it, the epic PM seat runs the landing pre-check, clears the labels, flips ready and arms auto-merge; the director seat submits no review and clicks nothing.

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ad89eb22e650a4fad61cd9c0402b68b3dc077555
Local-runs: none
Scope: docs/adr/0104-field-runtime-value-shape-contract.md, docs/adr/0144-multi-currency-record-currency-dated-rates-write-time-home-projection.md, docs/adr/README.md + comment 6485365183 on #27187 and comment 6485374827 on #8345 (the two records Open item 12 cites)

This is a delta re-review on a moved head. The prior record 6485356516 (PASS) names e9bb1901e2308d28673756d516e4ca3ada404ea1 and owes S2′, S3′ and S4. Delta since: one commit, ad89eb22 (parent e9bb1901, no merge), touching docs/adr/0144-… alone, +11/−8, three hunks. Inputs: the diff e9bb1901..ad89eb22, the two cited comments, the check-runs on ad89eb22; PR state read with one gh api GET (mergeable: true, mergeable_state: blocked, draft, labels unchanged). Nothing built, run or re-run.

Check-runs on ad89eb22: 41, all completed by 01:42Z — 25 success, 16 skipped, 0 failure, 0 pending (first read 01:36Z: 8 success / 16 skipped / 13 in progress, 37 runs created; polled read-only every 30 s until the aggregators Lint & Repo Gates, TypeScript Type Check and Test Core appeared and every run completed). Success includes Lint & Repo Gates and its lanes (Lint · repo & tooling gates — check:adr-anchors and the report-only check:adr-index; Lint · docs & code guards — check:adr-symbol-anchors; Lint · PM dispatch-gates; Lint · CI, release & engine gates; Lint · ESLint; three scoped lanes), TypeScript Type Check and its four lanes, Test Core (1 shard), Governed Surface Queue Guard, PR-body guards, Check Documentation Links, Dogfood Regression Gate, Check PR Size, Auto Label, Test UI, filter. Every skip is a path or opt-in skip on a docs-only diff, Check Changeset under skip-changeset included. These conclusions are the gate verdicts; nothing was run locally.

① Derived judgments

Change the diff implies	Judgment
ADR-0144 only; ADR-0104 and the README untouched. Neither the title nor the Status line moved, so the index owes no regeneration and stays the one-row delta against main judged at e9bb1901.	Right.
No new path#Symbol anchor; the two new links are issuecomment URLs in Markdown link form, no tag-shaped text.	Right.
Still nothing published; skip-changeset stands.	Right.

② Semver level

Clause-②: no, Metadata-protocol: none, skip-changeset: right; the delta publishes nothing.

③ Boundary flags

• Prior S2′, S3′, S4, each checked in the tree at ad89eb22:
  • S2′ — resolved exactly: L17 now reads "with existing codes (INVALID_METADATA at registration, DATASET_INVALID at compile)"; the "as authoring diagnostics, not wire errors" clause is gone; "They are the only ledger additions" stays the operative sentence.
  • S3′ — resolved exactly: L300 "R1's one narrowing of what an author can write is spec(field): fixed-mode currencyConfig with no defaultCurrency materialises 'CNY' — require the code, drop the default (narrowing; #27119 Q2 X, G3) #27157's".
  • S4 — resolved exactly: (a) "ruled" → "decided"; (b) the decision is cited as 6485365183 on analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187 with PR feat(spec,service-analytics): record-currency analytics — grouped answers name a per-row currency, the cube door refuses an ungrouped amount aggregate, compile guards on measure currencies #27338 commit 507ed8f9 as tree evidence; (c) "epic [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345 carries the question" is now true — 6485374827 on [Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345, 01:31:10Z, posted before the commit (01:34:48Z).
• Prior escalations (a), (b) carried unchanged; (c) of 6485356516 is closed by the two posts.
• New flags: none. Labels unchanged; no review submitted; PR stays draft.

④ Design judgment

Nothing in D1–D9 moves. The commit edits a Builds-on sentence, one word in Consequences and Open item 12's provenance. The prior records' ruling-fidelity and "today" readings stand.

Open item 12 against its two sources, read in full. The decision comment 6485365183 (epic PM, 01:30Z, answering os-dev-report 6480636054 open question 1 as "neither A nor B") says the fixed-only arms are outside ruling 6465431966 and ADR-0144's Decision, that R1 has no authority to narrow there, that #27338 confines both guards to record-mode with yes (widening) / added, tree evidence 507ed8f9, and that the general guard is Open item 12, carried to the maintainer on #8345. The question comment 6485374827 (01:31Z) states the two shapes, says the ruling did not decide them, records the R1 confinement, names the general refusal as a narrowing that needs the maintainer's word, quotes #27338's first-draft lean as "quoted here, not adopted", and says nothing in R1 waits on it. Open item 12 (L356–364) says exactly these things and no more: a seat decided the R1 confinement (not "ruled"), the general guard is undecided, the authority is the maintainer's, the epic carries the question. The item decides nothing itself and does not quote the decision as if it were the maintainer's. The record's Ruled / analysis / reading line is intact. Accurate, no overreach.

Trying to break the new text. (i) Could "epic #8345 carries the question" be read as the epic deciding it? No — the item names the maintainer as the authority and the comment is headed "Open question for the maintainer". (ii) Does the Builds-on rewrite change which codes are ledger additions? No — the two new codes are unchanged; INVALID_METADATA and DATASET_INVALID are existing registered codes, as the prior record measured. (iii) Does the ordering of the item's sentences leave the interim instruction (B, 21:06Z) that the decision comment supersedes visible in the ADR? No, and it need not: the ADR cites the decision of record, which itself records the supersession.

Findings on this head.

• Must-fix: none.
• S2′, S3′, S4 of 6485356516 — resolved exactly.
• Should-fix: none.

Not findings (checked and clear): one commit, one file, three hunks, no merge; D1–D9, the ADR-0104 note, the README and every anchor byte-identical to the PASSed head e9bb1901.

Implemented-by: claude/project-thread-0jat8q
Reviewed-by: session_01Utp6CbTZrFqRYNgjSaSbN5

VERDICT: PASS

[objectstack-fleet]

epic:#8345#1 · os-bill · session_01Utp6CbTZrFqRYNgjSaSbN5

Seat record refresh (epic PM, 2026-10-29T01:45Z): ACCEPT carried to head ad89eb22.

• Contract review at CONTRACT_REVIEW_TIER: PASS on 775d8c09 (6485013063), delta PASS on e9bb1901 (6485356516), and delta PASS on ad89eb22 (6485577145) with no must-fix and no should-fix left. needs:contract-review cleared.
• The heads since 6470064995 carry the review's findings only: the main merge with a regenerated ADR index, the ADR-0112 scoping, the Consequences semver, and Open item 12. Open item 12 cites the seat decision 6485365183 (analytics seam: grouped results carry a per-row currency; cube door refuses an ungrouped aggregate over a record-mode field; guards on today's surface (multi-currency M0-3, epic #8345) #27187) and the maintainer question 6485374827 ([Epic] multi-currency (shape C′): record currency, dated exchange rates, write-time home-currency projection — 17 children, R1/R2/R3 release pairing (ruling 6465431966) #8345).
• Check-runs on ad89eb22: 41 completed, 25 success, 16 skipped, 0 failure.
• Remaining before landing: one authorized APPROVED review from GOVERNED_APPROVERS (Tier H, docs/adr/**). After it, the seat clears needs-user-decision, flips ready and arms auto-merge.