[objectstack-fleet]

Requested by Bill · project thread
Fixes #27185

⛔ not released alone — pairs with #27192 (R2); merges in the R2 window

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么： 新系统对象 sys_exchange_rate（币种 ISO 4217、汇率精确小数（小数点后 12 位、总共 24 位，裁决 6469382727）、生效日期、来源 manual/import/app），同组织内 (币种, 生效日期) 唯一；Setup → Configuration 在 Localization 下面加「Exchange Rates」列表页，页面上写明一次汇率方向；文档一行讲财务怎么录一个月的汇率。
• 为什么改： 多币种 C′ 形状里写入时折算的唯一数据源（裁决 6465431966，参数 2/3 按默认；参数 4 由裁决 6469382727 定为 scale 12 / precision 24）。
• 风险与回滚： 只新增一张表和一个菜单项，不改任何已有对象（另有三处 CI 强制的登记：spec 平台对象名单、CLI 升级仪式的组织归属清单、CLI 的 Setup 菜单条数断言）；它唯一的读者是 objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192，⛔ 不单独发版，和 R2 同一次 Version Packages 合并。回滚 = revert 本 PR（新表无数据依赖）。
• 先看： packages/platform-objects/src/system/sys-exchange-rate.object.ts（唯一键的 'organization' 拼法、rate 的 scale/min 与方向句）；src/plugin.ts（注册进第一个 manifest，走项目库）；src/apps/setup-nav.contributions.ts（菜单位置）。
• 两分钟验证： pnpm --filter @objectstack/platform-objects exec vitest run src/system/sys-exchange-rate.object.test.ts，预期 15 个测试全绿。
• 需要你做的： 无，席位落地（R2 窗口里与 objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192 一起合）。

What changes

• sys_exchange_rate (packages/platform-objects/src/system/sys-exchange-rate.object.ts), managedBy: 'system-data':
  • currency — text, valueDomain: 'iso_4217_currency', required.
  • rate — number (the platform's exact-decimal column, never float), scale: 12, precision: 24, min = 10⁻¹² (strictly positive), required (ruling 6469382727).
  • effective_date — date, required. source — select manual / import / app, default manual.
  • Unique (currency, effective_date) spelled unique: 'organization' (ADR-0120 D1), so two organizations each hold their own EUR rate for a day.
  • No tenancy opt-out: organization_id is injected and the Layer 0 wall scopes it.
  • enable.trackHistory: true plus per-field trackHistory on the four ruled columns; the object is not on plugin-audit's skip list, so every write lands in sys_audit_log.
  • Who writes: organization_admin's '*' grant reaches it (not private, no requiredPermissions); member_default names no business object, so members neither read nor write it (ruling parameter 2).
• Rate direction stated once: EXCHANGE_RATE_DIRECTION (exported) is the rate field's description and the all_rates list view's description, which the console renders on the list page. EXCHANGE_RATE_SCALE (12) and EXCHANGE_RATE_PRECISION (24) exported beside it.
• Registration: PlatformObjectsPlugin registers it in its first manifest (project database, no routing triple), beside sys_migration / sys_migration_journal / sys_secret: its reader is the ObjectQL engine's write path, present in every composition.
• Registry (@objectstack/spec): PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'] lists sys_exchange_rate, so lint, the engine and the CLI treat it as a real platform object; the spec ratchet platform-object-names.test.ts requires it.
• Upgrade ceremony (@objectstack/cli): the ADR-0131 D10 organization-ownership inventory gives sys_exchange_rate fate 3 (attribution, no anchors: the Default Organization under single, otherwise reported), like the other organization-authored tables added since the first census; without the row os migrate organization-ownership refuses every plan as carrying an uninventoried platform table.
• Setup: nav_exchange_rates in group_configuration directly under nav_settings_localization, opening all_rates.
• Translations: object, fields, options, view, empty state and the nav label in en / zh-CN / ja-JP / es-ES (the three translated locales hand-written; bundles regenerated with check-i18n-bundles.mjs --write, extract config gains the object).
• Docs: content/docs/ui/apps.mdx (where main moved the Setup anchors when it retired ui/setup-app.mdx) — the group_configuration row and one paragraph saying how finance records a month's rates.
• Changeset: .changeset/27185-exchange-rate-table.md, @objectstack/platform-objects, @objectstack/spec and @objectstack/cli patch.

Why

Multi-currency shape C′ (ruling 6465431966 on #27119; epic #8345, M1-1): a record-mode amount is converted to the home currency at write from the rate in force on its document date. This is that rate table. Parameters 2 (admin-only) and 3 (1 home = rate foreign, so home = amount ÷ rate) are applied as ruled; parameter 4 as ruled in 6469382727 (scale 12, precision 24).

Tests

• New src/system/sys-exchange-rate.object.test.ts (15 cases) pins the declaration each enforcing mechanism reads, on the built value: one unique key on (currency, effective_date) equal to 'organization'; resolveInjectedSystemColumns plans organization_id; not private and no requiredPermissions (the org-admin wildcard reaches it); resolveCrudAffordances gives New/Edit/Delete and no import; trackHistory on object and columns; iso_4217_currency with the write predicate's member / non-member / lowercase answers; rate is number with scale 12, precision 24 and min 10⁻¹²; the direction sentence on field and view; the nav entry sits right after Localization and names a declared view.
• Updated: plugin.test.ts (registration roster), platform-objects.test.ts (nav target classified as owned and listable), bundle-ownership.test.ts (bundle roster); packages/cli/test/connect-agent-both-halves-wire.pin.test.ts (the Setup tree the platform admin is served: 31 → 32 entries, 22 → 23 contributions). The spec ratchet platform-object-names.test.ts and the CLI organization-ownership-inventory.test.ts pass unchanged with the two registry rows.

Acceptance notes

• Behavioural layer not exercised here. The card's four facts are enforced by mechanisms pinned in their own packages (driver-sql's tenant-scoped declared-unique suite; Layer 0; plugin-security default-permission-sets.ts; plugin-audit AUDIT_EXCLUDED_OBJECTS). platform-objects cannot import plugin-security or plugin-audit (they depend on it), and the claimed file surface stops at this package, so no live admin-201 / member-403 / duplicate-409 / cross-org-201 run is recorded: NOT MEASURED, carrier examples + QA: showcase invoice goes multi-currency (code field, record amount, home field, document date), seeded rates, a rate-sync flow template, a platform-checklist item and a browser dogfood run (multi-currency M3-3, epic #8345) #27197 (M3-3 dogfood seeds rates and drives the browser).
• CSV import stays off (system-data's default) until import: verify sys_import_job serves sys_exchange_rate (CSV of currency, rate, effective_date); add the importer only if it does not (multi-currency M1-2, epic #8345) #27190 verifies sys_import_job serves this object; turning it on is userActions: { import: true } there.
• Parameter 4 is ruled (6469382727 on platform-objects: sys_exchange_rate { currency, rate, effective_date, source } — tenant-scoped, admin-only, audited; Setup list view (multi-currency M1-1, epic #8345; released with M2) #27185): scale 12 (twelve digits after the decimal point), total precision 24, decimal arithmetic, never float. The write seam refuses a value beyond either bound rather than rounding it. The column is the platform's DECIMAL(65,30) (NUMERIC_COLUMN_REPRESENTATION), which holds both.
• Direction as arithmetic. With parameter 3 as ruled, a home amount is the record amount divided by rate (ADR-0144). Card objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192's body writes the projection as amount × rate; that card should follow the ruling.
• SQLite stores number as REAL (table.decimal compiles to float on SQLite), and every dialect reads a number back as a JS double (about 15–17 significant digits). A rate using all 24 digits is beyond that and is not round-tripped exactly; objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192 already owns pinning SQLite rounding.
• Paths outside the claimed file surface, each forced by a CI gate on the new object:
  • scripts/platform-object-tenancy-census.json, regenerated with node scripts/platform-object-tenancy-census.mjs --write because the new tenant-scoped object joins the census population (87 → 88 registered, 44 → 45 in reach). Derived artefact, no hand edit.
  • packages/spec/src/system/constants/platform-object-names.ts (one name in the registry list; the spec ratchet reds without it).
  • packages/cli/src/utils/organization-ownership-inventory.ts (one inventory row; the CLI inventory test and about 15 organization-ownership integration tests red without it).
  • packages/cli/test/connect-agent-both-halves-wire.pin.test.ts (the Setup nav count).
• Not here by design: a rate row whose currency equals the home currency (no refusal yet — the projection treats same-currency as rate 1 without a lookup, objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192), and the home-currency lock (service-settings: lock localization.currency once a sys_exchange_rate row or a homeAmount declaration exists; Setup shows what uses it (multi-currency M1-3, epic #8345) #27198).
• The ADR draft for docs(adr): ADR for multi-currency — record currency, dated rates, write-time home projection (Q0–Q4 and parameters 1–4 as ruled on #27119); dated note on ADR-0104 (epic #8345, lands in R1 first) #27183 (PR docs(adr): ADR-0144 multi-currency — record currency, dated rates, write-time home projection; dated note on ADR-0104 #27239, ADR-0144, not yet approved) was read: the direction sentence follows it; the scale follows ruling 6469382727.
• Owner package (ADR-0144 Open item 11, against ADR-0029 D1/D3/D6): platform-objects, because the table's one reader is the ObjectQL engine's write path, present in every composition that can write a record; it registers with the engine-facing infrastructure (sys_migration, sys_secret) and has no on/off capability boundary of its own (ADR-0029 D2). ADR-0144's M1-1 row names the same package.

Verification

Final head 7ad4554 (after merging main, fresh install and full build)

pnpm --filter @objectstack/platform-objects test            Test Files 98 passed · Tests 1381 passed
pnpm --filter @objectstack/spec exec vitest run src/system/constants/platform-object-names.test.ts   12 passed
pnpm --filter @objectstack/spec check:generated             all 14 generated artifacts up to date
pnpm --filter @objectstack/cli exec vitest run <inventory test, Setup-nav pin, 8 organization-ownership integration suites>   10 files · 164 passed
pnpm --filter @objectstack/{cli,platform-objects} typecheck  OK
48 scoped re-checks after the merge (docs, i18n, census, changeset, citation gates and the above) :: all exit 0
Before the merge, on 3e26252e6: pnpm --filter @objectstack/cli test  521 files · 6493 passed
dispatch-gates --commands: 115 families; the 3 added by the CLI paths (i18n-coverage, i18n-walk-parity,
  cli-test-child-env) :: exit 0; the list did not change across the merge.

Earlier heads: package test + typecheck (lock VERDICT)

head 86e39faf0 (final):
pnpm --filter @objectstack/platform-objects test
  Test Files  97 passed (97)
  Tests  1377 passed (1377)
  os-verify-lock: VERDICT command-exit 0
pnpm --filter @objectstack/platform-objects typecheck
  check:test-typecheck: OK; os-verify-lock: VERDICT command-exit 0
node scripts/check-i18n-bundles.mjs :: exit 0 (platform-objects in sync, 11 bundles)

Derived gates (dispatch-gates --commands, --ran reconciliation)

dispatch-gates --commands: 98 families (90 derived first, +8 after the census artefact joined the diff).
90 run on head faf1b6e3 (before the scale/census commit): 86 exit 0 at first run;
  4 refused/red, then resolved:
  - check-plugin-teardown-shape --self-test :: exit 3 (shallow clone) -> fetched pinned commit -> exit 0
  - spec check:skill-examples :: exit 3 (client-react unbuilt) -> built -> exit 0
  - check:dual-build-cjs-loads :: exit 3 (unbuilt packages) -> exit 0 after the build
  - check:platform-object-tenancy-census :: exit 1 (census drift, new object) -> --write -> exit 0
On head 86e39faf0: the 8 new families :: exit 0; re-run on the final tree, all exit 0:
  check:platform-object-tenancy-census, check:i18n (bundles), check:keyed-text-bounds,
  check-changeset-no-major, check-empty-changeset, check:nul-bytes, check:org-identifier,
  check:system-context-census, check:issue-citations, check:doc-authoring, check:i18n-stale-fill
dispatch-gates --ran: 98 derived famil(ies) accounted for - 98 run, 0 NOT-MEASURED
  (a DERIVED zero - all 98 recorded an exit code and none of them is 3).
Not run locally (CI's): pnpm lint, test:repo, the full farm.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (The spec change is one name in a constant list.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is CI's.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched only to list the new object in PLATFORM_OBJECTS_BY_PACKAGE, with its patch bump in the changeset.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/cli, @objectstack/platform-objects, @objectstack/spec, touching 29 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/platform-objects/src/system/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

52 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json ebfadb02c3a06153ff05af1cb620dfdc29bb6157.

⛔ 13 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/platform-objects/src/system/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: isSystem (5 routes)
• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 56 of 208 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 174 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ebfadb02c3a06153ff05af1cb620dfdc29bb6157 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from feca2c4fa92178393132e13ed9bb967886ead711 — the merge of head 7ad4554c39a4142810ebdcfab462967d638d6e49 into base ebfadb02c3a06153ff05af1cb620dfdc29bb6157, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin feca2c4fa92178393132e13ed9bb967886ead711 && git checkout feca2c4fa92178393132e13ed9bb967886ead711
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ebfadb02c3a06153ff05af1cb620dfdc29bb6157 7ad4554c39a4142810ebdcfab462967d638d6e49 && git checkout -B drift-repro ebfadb02c3a06153ff05af1cb620dfdc29bb6157 && git merge --no-ff 7ad4554c39a4142810ebdcfab462967d638d6e49

node scripts/docs-audit/affected-docs.mjs --json ebfadb02c3a06153ff05af1cb620dfdc29bb6157

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ebfadb02c3a06153ff05af1cb620dfdc29bb6157 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head 3e26252e655f21fb2e990efc111c16e383e38774 · 2026-10-28T14:58Z

Triage seat, under gap rule (b) (#27062): the PR has been open since 12:33Z with no record or claim on any head (named as due in R731). The review runs at CONTRACT_REVIEW_TIER. If the lane claims or posts a record on this head first, triage withdraws.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3e26252e655f21fb2e990efc111c16e383e38774
Local-runs: none
Scope: packages/spec/src/system/constants/platform-object-names.ts + packages/spec/src/system/constants/platform-object-names.test.ts, packages/platform-objects/src/system/sys-exchange-rate.object.ts, packages/platform-objects/src/plugin.ts, packages/platform-objects/src/plugin.test.ts, packages/cli/src/utils/organization-ownership-inventory.ts, packages/cli/src/utils/organization-ownership-inventory.test.ts, packages/objectql/src/engine-lifecycle-health.ts, packages/lint/src/validate-object-references.ts, packages/lint/src/validate-nav-access.ts, packages/spec/src/stack.zod.ts

Governing shape: ADR-0144 (PR #27239, head 775d8c09, not yet on main) D3, D7 and Open items 7 and 11; ruling 6465431966 (#27119) and ruling 6469382727 (#27185: rate column decimal scale 12, total precision 24, never float). The tree was judged, not the PR body; where the two differ it is said below.

① Derived judgments

• Registry entry — sys_exchange_rate added to PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'], sorted between sys_email_template and sys_identity_email. RIGHT, and forced: the spec ratchet (platform-object-names.test.ts) scans every packages/**/*.object.ts, derives the owner from the path segment before src (packages/platform-objects/src/system/sys-exchange-rate.object.ts → platform-objects) and asserts set equality per group; without this hunk the ratchet reds on the new object file.
• Accept-set widening at lint — isPlatformProvidedObjectName('sys_exchange_rate') now answers true, so a stack reference to it is admitted at rung ③ (validate-object-references.ts:238, validate-translation-references.ts:1848, stack.zod.ts:4581 action objectName) and validate-nav-access.ts:162 skips the grant check for a nav item naming it ("granted by its own package"). RIGHT: PlatformObjectsPlugin registers the object unconditionally in its first manifest (plugin.ts:198, pinned by plugin.test.ts), so what lint admits resolves at runtime wherever platform-objects composes; the nav skip is right because the object's own grant is the organization_admin wildcard (not access.default: 'private', no requiredPermissions), the same posture as the other object-type entries in group_configuration.
• Runtime consumer — engine-lifecycle-health.ts#resolvePrimaryDatasource iterates PLATFORM_PROVIDED_OBJECT_NAMES; sys_exchange_rate now votes as a witness when registered. RIGHT: it declares no lifecycle.class (not a system-ledger object) and rides the first manifest with no routing triple exactly like sys_migration / sys_migration_journal / sys_secret, so it lands on their datasource and cannot by itself produce system-objects-split.
• @objectstack/cli inventory — organization-ownership-inventory.test.ts:123 requires a row for every registered name; the diff adds sys_exchange_rate (census PMAIN, fate attribution, no anchors). RIGHT; the cli patch in the changeset follows from it.
• Tenancy census — scripts/platform-object-tenancy-census.json 87→88 registered, 44→45 in reach, tenantField: organization_id. RIGHT, derived artefact consistent with the hunk and with the object's no-opt-out tenancy.
• Cloud repo at the next pin move — service-cloud control-plane-fate-supplement.test.ts filters its supplement against the platform set (an added name changes nothing) and objectos-runtime tenant-v18-upgrade-retired-tables.test.ts only asserts retired names are absent. RIGHT: additive, neither breaks.
• No new spec export — api-surface/system.json and export-origins/system.json unchanged; dangling-reference-audit.ts reads only the plugin-security group. RIGHT, unaffected.
• Published surface outside hits (lane's ACCEPT) — @objectstack/platform-objects gains SysExchangeRate, EXCHANGE_RATE_DIRECTION, EXCHANGE_RATE_SCALE, EXCHANGE_RATE_PRECISION (system/index.ts), a Setup nav entry and four locales. Read for ②, not reviewed here.
• Wrong: none found in the hits hunk.

② Semver level

• Changeset .changeset/27185-exchange-rate-table.md: @objectstack/platform-objects: patch, @objectstack/spec: patch, @objectstack/cli: patch; body carries Clause-②: no and Metadata-protocol: none. Those three packages are exactly the released packages the diff moves (spec: registry membership; cli: inventory row; platform-objects: the object and its exports).
• Metadata-protocol: none is right: sys_exchange_rate is a system object an author cannot write (ADR-0029 D4), no authorable key, value or type changes. AGENTS.md Post-Task Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3: "none takes patch" — so patch on all three is the rule's level. Precedent in packages/spec/CHANGELOG.md is split (17.2.0 sys_flow_dispatch under Patch Changes; 17.7.0 sys_flow_credential and sys_comment_reaction under Minor), the written rule governs. Clause-②: no matches the card's own declaration (Clause-②: no · Metadata-protocol: none) and appears line-initial in both PR body and changeset. Clause-②: no — matches the diff.
• The PR body's "Changeset: @objectstack/platform-objects patch" names one of the three bumps; the changeset itself is complete. Body correction only (③).

③ Boundary flags

• open_questions: [] — nothing to answer.
• Out-of-scope finding 1 (objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192 writes amount × rate): ANSWERED by ADR-0144 D7 ("the home amount is the record amount divided by rate… objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192 follows parameter 3"). Nothing owed here.
• Out-of-scope finding 2 (parameter 4 unit): ANSWERED by ruling 6469382727 and APPLIED in the tree at c8d84fd70: EXCHANGE_RATE_SCALE = 12, EXCHANGE_RATE_PRECISION = 24, rate is Field.number with scale: 12, precision: 24, min: 1e-12; FieldSchema carries both keys (field.zod.ts:1335, :1359, ceiling MAX_RENDERABLE_SCALE = 100) and the write seam refuses by rejection, never rounding (record-validator.ts max_scale / max_precision). ⚠️ The PR body still says scale: 18, "Why 18, not 12", and "settling the open item later edits EXCHANGE_RATE_SCALE" — stale against the tree. ESCALATED to the dev: correct the body. Should-fix (account, not tree).
• Out-of-scope finding 3 (behavioural admin-201 / member-403 / duplicate-409 / cross-org-201 NOT MEASURED, carrier examples + QA: showcase invoice goes multi-currency (code field, record amount, home field, document date), seeded rates, a rate-sync flow template, a platform-checklist item and a browser dogfood run (multi-currency M3-3, epic #8345) #27197): accepted as stated; the declaration each mechanism reads is pinned on the built value in sys-exchange-rate.object.test.ts.
• Out-of-scope finding 4 (file-surface breach: census artefact): declared. ⚠️ Two further breaches are UNDECLARED: packages/spec (4bc2a793a) and packages/cli (c9ba0b689, 3e26252e6) landed after the os-dev-report, and the PR body's Human Minimum Add metamodel interfaces for ObjectQL/ObjectUI contract #1 "(No spec change.)" and Migrate from npm to pnpm #6 "packages/spec not touched" are false against the tree. Both edits are legitimate and forced (the spec ratchet and the cli inventory test red without them), so this is a body-account defect: ESCALATED to the dev to correct Add metamodel interfaces for ObjectQL/ObjectUI contract #1/Migrate from npm to pnpm #6 and name the breach. Should-fix.
• ADR-0144 Open item 11 (owner package, against ADR-0029 D1/D3/D6 and ADR-0028): SETTLED IN THE TREE by placement under platform-objects with the rationale in plugin.ts (its one reader is the engine's write path, present in every composition that can write a record; registered with the engine-facing infrastructure, like sys_migration / sys_secret). Defensible under ADR-0029 D2 (no on/off capability boundary) even though D6 wants platform-objects to shrink; ADR-0144's own M1-1 row names this package. NOT STATED in the PR body or on the card, and ADR-0144 says it is amended with each answer. ESCALATED: the dev states the ADR-0029 settlement on the card so docs(adr): ADR-0144 multi-currency — record currency, dated rates, write-time home projection; dated note on ADR-0104 #27239 can amend Open item 11. Should-fix.
• Gate verdicts: PENDING. check-runs on 3e26252e…: total_count: 0; check-suites: 5 queued (vercel, fly-io, claude, cloudflare-workers-and-pages, objectstack-fleet), none concluded; commit status pending. The lane's local dispatch-gates run was on faf1b6e3 / 86e39faf0, not this head. No derived gate is adopted as green here; the queue guard stays whole-PR.
• Merge state: mergeable: false (dirty). content/docs/ui/setup-app.mdx was deleted on main by docs(ui): generate the component reference for all 106 components from sdui.manifest.json; retire the Setup, Console and Studio pages into the metadata pages and rename the section User Interface #27179 (1287b2fa30, 2026-10-28; its Setup-group anchors moved to content/docs/ui/apps.mdx, the group_configuration row near line 800) while this PR edits it: the docs hunk would resurrect a retired page and cannot merge. Outside hits (lane's ACCEPT), ESCALATED to the lane seat: rebase onto main and move the Exchange Rates row and the "how finance records a month's rates" entry into ui/apps.mdx. Blocks landing; not a contract-face defect.
• Release pairing: body carries "⛔ not released alone — pairs with objectql: write-time home projection — rate lookup by document date, decimal arithmetic, minor-unit rounding, missing rate refuses, computed fields read-only (multi-currency M2-2, epic #8345) #27192 (R2)"; PR is a draft. Consistent with the claim and ADR-0144 D9.

④ Design judgment

packages/spec/src/system/constants/platform-object-names.ts (schema face: the curated platform object registry, read by lint, the engine and the cli).

• Against the code it cites. The file's own maintenance contract ("adding an object to a platform package means adding its name here; the owning package's conformance test fails otherwise") is enforced by platform-object-names.test.ts, which derives the owning group from the file path and compares sets. The hunk adds the one name that test now finds in packages/platform-objects/src/system/sys-exchange-rate.object.ts (ObjectSchema.create({ name: 'sys_exchange_rate' … })), under the group that path yields, in sorted position. HOLDS.
• Against its first consumer (lint rung ③ and the nav-access skip). Tried to break it: (i) a composition without platform-objects — then every name in that group is equally absent, which is the registry's stated contract ("registered by a package in this repo"), identical to sys_user; (ii) a composition with platform-objects — the object registers unconditionally in the first manifest, so a lint-admitted reference resolves; (iii) the engine's primary-datasource vote — the new witness lands with its three manifest siblings; (iv) the cloud repo's two registry readers — additive and tolerant. No reader is made wrong by the entry. HOLDS.
• Against the ADR it implements (ADR-0144 D3, Open items 7 and 11). D3 names sys_exchange_rate { currency, rate, effective_date, source } as a platform system object; the registry names it under the package ADR-0144's M1-1 row and the epic territory name. Open item 7 (uniqueness and audit) is answered in the object the entry points at: one unique key (currency, effective_date) spelled unique: 'organization' (ADR-0120 D1), trackHistory on object and the four columns, not on plugin-audit's skip list. Open item 11 is answered by placement, see ③. HOLDS; the settlement wants writing down (should-fix, ③).
• Against ruling 6469382727. The hits file carries no numeric claim; the object it names declares number / scale 12 / precision 24 / min 1e-12, and the engine refuses rather than rounds at both seams. The PR body's scale 18 account is the only disagreement, and it is the body that is wrong. HOLDS.
• Must-fix: none.
• Should-fix: (1) PR body stale against the tree — scale 18 → scale 12 / precision 24, Human Minimum Add metamodel interfaces for ObjectQL/ObjectUI contract #1/Migrate from npm to pnpm #6 and the changeset line must name the packages/spec and packages/cli edits; (2) the ADR-0029 D1/D3/D6 ownership settlement is stated nowhere the ADR can read it — state it on the card so docs(adr): ADR-0144 multi-currency — record currency, dated rates, write-time home projection; dated note on ADR-0104 #27239 amends Open item 11; (3) [lane seat] the setup-app.mdx hunk conflicts with main's deletion of that page — rebase and move the docs line to content/docs/ui/apps.mdx.

Implemented-by: claude/project-thread-ozmi9m
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: PASS

---

Generated by Claude Code