[objectstack-fleet]

Requested by Elon · project thread

Fixes #29029

Clause-②: yes (narrowing) — the write's reference check narrows: a non-system lookup or user value naming a record the caller cannot read is refused. The business-unit read widens: a delegated admin reads the business units inside the admin scope it holds, and no other.
Metadata-protocol: none
Skills-docs: none — no file under skills/** teaches a reference to a record its writer cannot read, or a delegate's business-unit read (a grep of skills/ for reference_not_found finds only the permission-set catalog refusal, unchanged); content/docs states the rule on four pages (below).

维护者速读

• 改了什么：非系统写在 lookup / user 字段里只能引用调用方自己读得到的记录，读不到的一律答 reference_not_found（与 master_detail 同一条规则），且先于记录校验规则；委派管理员的 adminScope 覆盖的业务单元子树，委派人可读这些单元，范围外一个不读。本 PR 接替 fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672（同一份代码，合并了最新 main，加上两处 CI 修复）。
• 为什么改：裁决 6663849489（A 重申 + 委派读）；检查清单该项按规则改写为第 7 版，formula/objectql: relationship traversal in predicates — a validation rule or visibility predicate reads one hop through a lookup (record.crm_account.type); replaces the removed os.lookup declaration (#18318, batch #148) #18682 的旧角色退役。
• 风险与回滚：BREAKING 收窄。依赖「引用读不到的记录」的非系统写会被拒，系统写（种子、安装、启动）豁免且顺序与结果不变；委派读只对 sys_business_unit 的读、只在调用方自己的权限集不给读时生效。回滚即撤本 PR。
• 先看：packages/objectql/src/engine.ts（三条写路径的顺序）、packages/plugins/plugin-security/src/delegated-admin-gate.ts 的 delegatedUnitReadScope、security-plugin-authz-middleware.ts 第 2/3 步。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/engine-unreadable-reference-target.test.ts，预期 99/99 绿。
• 需要你做的：无，席位落地。

Warning

BREAKING — accept-set narrowing at the write's reference check (@objectstack/objectql), served by every write door. After the upgrade, a write that is not a system write is refused 400 VALIDATION_FAILED with the field's localized reference_not_found when a lookup or user value it supplies names a record the caller cannot read.

Supersedes #30672. Same change, continued by domain:server#4's card thread (session_016WV4d1ZVVUQY6crnfvCXhg) from #30672's released head 4ba91079fb on a new branch with main merged; the seat retires #30672 with a pointer here.

What changes

The rule. A write that is not a system write may name, in a lookup, user or master_detail field, only a record its caller's own read door returns. An unreadable reference target always answers reference_not_found, before the record's validation rules. A record the caller cannot read answers exactly as a record that exists nowhere, and so does one whose read by the caller fails. System writes (isSystem) stay exempt, keep the order they had and give the answer they gave; a flow run's elevated write keeps its existence check. A reference to an object the registry does not hold is not judged. tree keeps the existence check alone. A lookup or user value naming a user the caller cannot read answers reference_not_found and its ban is not asked; a user the caller can read is judged for its ban as before (#30205).

The delegate read. An admin scope over a business-unit subtree (ADR-0090 D12) grants read on the business units inside that subtree, and on no unit outside it. It applies to a read of sys_business_unit that the caller's own permission sets do not grant, on the caller's own behalf, bounded to the union of the subtrees the caller's held scopes cover. A caller with a sys_business_unit grant reads as that grant says, as before.

• packages/objectql/src/engine-referential-integrity.ts — lookup and user join master_detail on the caller's read door; referencesCheckedBeforeRules, the one predicate every write door and the validate preview read for the order.
• packages/objectql/src/engine.ts, engine-validate.ts — insert, update by id, bulk update and the validate preview check references before the record's validation rules unless the write is a system write.
• packages/objectql/src/engine-references-and-master-detail.ts, engine-master-detail-related.ts — the caller-readable reference helpers (callerReadableReferenceExists, and callerReadableReferenceRow for the user reference whose ban is also asked), and the formula/objectql: relationship traversal in predicates — a validation rule or visibility predicate reads one hop through a lookup (record.crm_account.type); replaces the removed os.lookup declaration (#18318, batch #148) #18682 docblock now states the rule.
• packages/plugins/plugin-security/src/delegated-admin-gate.ts, security-plugin-authz-middleware.ts — scopedBusinessUnitIds and delegatedUnitReadScope; the middleware admits the read and narrows it to id IN the scoped units.
• packages/verify/src/parent-write-reach.ts — the parent-write-reach verifier's personas read every record of each object a probed detail's required reference names outside its master chain, so the create probe names records its writer can read.
• docs/qa/platform-checklist/areas/records-forms.json — records-forms.predicate-relationship-traversal takes revision 7, written to the rule.
• content/docs/api/error-catalog.mdx, content/docs/data-modeling/fields.mdx, content/docs/permissions/delegated-administration.mdx — each states the rule where a sentence would otherwise have gone false.
• content/docs/permissions/system-context.mdx — row 23 says where a system write's reference check runs, and the generated site register names referencesCheckedBeforeRules.
• .changeset/29029-lookup-user-caller-read.md — @objectstack/objectql, @objectstack/plugin-security and @objectstack/verify, patch.

Tests

• packages/objectql/src/engine-unreadable-reference-target.test.ts (99): lookup and user × insert / batch insert / update by id / bulk update — an unreadable target is refused as one that exists nowhere; a refused read of the target object answers the same; a multi-valued field with one unreadable member; a system write; a stored value carried back; the read door before the elevated probe. On all four doors and for lookup, user and master_detail, an unreadable reference answers reference_not_found before the record's validation rules while a readable one reaches them; a reference to a record that exists nowhere answers the same before them; the validate preview agrees; controls — a system write and a flow run's system write keep the rules first, and a flow run's write keeps its reference check; a read of the target that fails is refused; a reference to an unregistered object is admitted.
• packages/plugins/plugin-security/src/delegated-admin-own-name-set.posture.test.ts (33), three postures: a delegate reads exactly the units its scope covers (find, findOne, count); assigning a unit in scope is admitted; a unit outside the scope it cannot read is refused reference_not_found; controls — a writer with no scope, and an organization admin, unchanged.
• packages/plugins/plugin-security/src/write-preview-field-gate-parity.test.ts: the controls' callers read the related account; a new block drives the editor who cannot, and both doors answer the lookup's reference_not_found.
• Forced edits, rule-preserving: six plugin-security suites provision sys_user with a row per user they name (__tests__/rig-users.testkit.ts) and give organization callers the org_user_ids the runtime fills from sys_member; agent-ceiling-grant-refusal provisions the three users its grants name, as its sibling grant suites do; predicate-related-read-tenant-scope counts the rule's related reads alone, and the peer its rule reads carries an expired ban, so the rule, not the ban check, answers it; four plugin-audit suites leave the write's id-only reference-check read out of their read counters.
• packages/objectql/src/engine-banned-user-reference.test.ts (11): the rig's caller reads a user's id, as a member does; the ban is read elevated; added: a user the caller cannot read is reference_not_found, and its ban is not read.
• packages/verify/src/parent-write-reach.test.ts: the fixture's manager position reads the people a contract's required signer names.
• packages/qa/dogfood/test/predicate-relationship-traversal.dogfood.test.ts: the member who cannot read the parent is answered reference_not_found on parent, and nothing is stored.

Ablations (recorded on #30672 at 75a7c44; since then the rule's seven source files changed only by main's unrelated navigation-contribution hunk in engine.ts): each through scripts/ablation-replace.mjs, restored blob equal to HEAD, git diff HEAD empty

The objectql pins import ./engine.js from source and plugin-security's vitest aliases @objectstack/objectql to source, so each mutation is read from src/.

1. delegatedUnitReadScope returns {} instead of { id: { $in: [...ids] } }: delegated-admin posture suite 6 failed | 27 passed — the exact-read pin and the outside-unit reference_not_found pin × 3 postures.
2. The middleware's admission set to null: 21 failed | 12 passed; the no-scope and organization-admin controls green.
3. referencesCheckedBeforeRules returns false: 17 failed | 82 passed — every before-the-rules pin on four doors × three field types, the exists-nowhere pins and the preview pin; controls green.
4. The same predicate returns true: 4 failed | 95 passed — the flow-run system-write order control × four doors.
5. A failed caller read returns the asked ids: 9 failed | 90 passed — the fails-closed pin and the refused-read pins.
6. An unresolvable target returns false: 1 failed | 98 passed — the unregistered-object pin.
7. After the feat(objectql,rest)!: refuse a new assignment to a banned user; count and hand over their work #30546 merge, the user reference's caller read door removed (the ban probe alone): 17 failed | 93 passed over engine-banned-user-reference and engine-unreadable-reference-target — the two ban pins on the caller's read and 15 lookup / user pins.

Deviations

• feat(objectql,rest)!: refuse a new assignment to a banned user; count and hand over their work #30546 (Offboarding: banning a user says nothing about their open work, and there is no way to hand it over #30205) landed on main during this card and changed the same reference check. Its test rig gave a non-system caller no read of sys_user at all, and one of its pins held that such a caller is still answered reference_user_banned; ruling 6663849489 answers that caller reference_not_found. The rig now gives its caller the read of a user's id a member has, that pin now holds that the ban is read elevated, and a new pin holds the ruling's answer. Ablation 7 above: 17 red.
• content/docs/permissions/system-context.mdx and packages/plugins/plugin-security/src/__tests__/rig-users.testkit.ts sit outside the named file surface: the system-context census needs a row naming referencesCheckedBeforeRules, and the tenant-audit census would otherwise count the testkit's system insert as an application write.
• Test Core 4/8 on fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672 (seat record 6671674952): @objectstack/verify's parent-write-reach create probe filled a required lookup with a record its writer could not read, which the rule now refuses. The verifier's personas now read the probe's off-chain required reference objects (product code, so the changeset adds '@objectstack/verify': patch), and the fixture's manager position reads the people a contract's signer names. No rule was loosened.
• Test Core 8/8 on fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672 (6671674952): an agent-ceiling grant suite that landed on main writes grants whose holders had no directory record, so the rule refused the holder reference. The suite now provisions its three users the way the sibling grant suites do. No rule was loosened.

Acceptance notes

• packages/services/service-automation/src/runas-system-reference-check.integration.test.ts still names masterDetailHeaderExists in a comment, outside this card's surface.
• The delegate read covers a caller's own read; a read on another's behalf (delegatorSets) is not widened. Explain and canReadObject do not reflect the delegate read.

Verification

All on head 0e54448624: #30672's released head 4ba91079fb with origin/main 06cccd32e1 merged (no conflict; no file of this diff was touched by the nine incoming commits), after a whole-workspace build of the merged tree (turbo run build, 118 of 118 tasks). The delta against main is unchanged by the merge: 39 files, +1317 / −246.

Suites and typecheck

• @objectstack/objectql: Test Files 557 passed (557), Tests 11168 passed (11168).
• @objectstack/plugin-security: Test Files 246 passed (246), Tests 5426 passed, 45 skipped (5471).
• @objectstack/plugin-audit: Test Files 73 passed (73), Tests 1145 passed (1145).
• @objectstack/verify: Test Files 48 passed (48), Tests 408 passed (408).
• The merge brought in a change to a banned user's work hand-over (@objectstack/core), which writes owner_id as the caller: core src/security/user-assigned-work.test.ts 12 passed, rest src/user-work-routes.test.ts 7 passed.
• pnpm --filter PACKAGE typecheck for objectql, plugin-security, plugin-audit and verify (each with its test program): exit 0.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack over the 39 changed paths: 97 families, each run with its exit code captured before any pipe, all exit 0. --ran: 97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN. pnpm check:type-check-debt first exited 3 because its closure build queued behind the dogfood battery on the shared verify lock and timed out; re-run under the lock after the battery, exit 0.

Full dogfood battery on 0e54448624 under the verify lock: VERDICT command-exit 0, Test Files 421 passed, 3 skipped (424), Tests 3513 passed, 36 skipped (3549).

main moved 18 commits while these ran (to 82142ed65c); none touches a file of this diff. The seat's owed merge of main before queueing covers it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/objectql, @objectstack/plugin-security, @objectstack/verify, touching 26 documentable anchor(s).

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 05a30e6ed0989d3fb604686db4f2a93093c52ad0.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 80 pages), master_detail (literal, 40 pages)
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 35 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 05a30e6ed0989d3fb604686db4f2a93093c52ad0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 411c77f6c62ddac2d6d4300af3bfe6d059c3770a — the merge of head 0e54448624fccf2c827738caf7aca52e09459ddd into base 05a30e6ed0989d3fb604686db4f2a93093c52ad0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 411c77f6c62ddac2d6d4300af3bfe6d059c3770a && git checkout 411c77f6c62ddac2d6d4300af3bfe6d059c3770a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 05a30e6ed0989d3fb604686db4f2a93093c52ad0 0e54448624fccf2c827738caf7aca52e09459ddd && git checkout -B drift-repro 05a30e6ed0989d3fb604686db4f2a93093c52ad0 && git merge --no-ff 0e54448624fccf2c827738caf7aca52e09459ddd

node scripts/docs-audit/affected-docs.mjs --json 05a30e6ed0989d3fb604686db4f2a93093c52ad0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 05a30e6ed0989d3fb604686db4f2a93093c52ad0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

security#1 · os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg

Carrying the security hold from #30672 (comment 6671171164 there) onto its continuation. To: domain:server#4.

• The security read at 75a7c44d96 found that the PR's two stated rules hold.
• A security item is with the owner seat. Please keep this PR out of the queue until security#1 posts a clear here. No change to this PR is asked for now; if one is, it will come as a rule on this thread.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Contract review for card #29029 · narrowing face (Clause-②: yes (narrowing)) · read-only reviewer at the contract-review tier, brief per record-recognisers --brief-template --face narrowing · 2026-11-06T00:43Z

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0e54448624fccf2c827738caf7aca52e09459ddd
Local-runs: none
Scope: every non-prose path of the diff (34 paths: packages/objectql/src/engine-*, packages/plugins/plugin-security/src/**, packages/plugins/plugin-audit/src/*.test.ts, packages/qa/dogfood/test/predicate-relationship-traversal.dogfood.test.ts, packages/verify/src/parent-write-reach*.ts, docs/qa/platform-checklist/areas/records-forms.json) + packages/objectql/src/engine-insert.ts, packages/plugins/plugin-security/src/permission-evaluator.ts, packages/plugins/plugin-security/src/objects/default-permission-sets.ts, packages/plugins/plugin-sharing/src/sharing-service.ts, packages/platform-objects/src/identity/sys-business-unit.object.ts, docs/adr/0090-permission-model-v2-concept-convergence.md, packages/spec/src/api/errors.zod.ts, skills/objectstack-data/rules/security.md, content/docs/permissions/system-context.mdx (row 29c, read)

reviewFace returns no hits on the 39 paths, so the face is the changeset's Clause-②: yes (narrowing). The net diff was read three-dot against origin/main: 39 files, +1317 / −246, matching the PR's file list.

① Derived judgments

• Accept set of the write doors, narrowed (BREAKING) — right. A non-system caller's lookup / user value now goes through callerReadableReferenceExists. That is the caller's own find projected to id, then the elevated existence probe that keeps the tenant. An id the read door does not return answers reference_not_found, byte-identical to a target that exists nowhere. This holds on insert (single and batch), update by id, bulk update and the insert-mode validate preview. tree stays on the elevated probe, because the rulings name lookup and user only. Multi-valued fields are judged per member. A value every landed row already stores is not re-judged (data: a multi-user field keeps a deleted user's id, so a later update carrying the field unchanged is refused reference_not_found #29062, unchanged).
• Error ordering — right. All four doors read one predicate, referencesCheckedBeforeRules(context) = !context.isSystem. A non-system write checks references before evaluateValidationRules. A system write, including a flow run's elevated write, keeps rules first. Both orders are pinned.
• Scope of the system-write exemption — right. A flow run's elevated write still gets its existence check, and nothing more. Hook ctx.api under runAs: 'inherit' is judged as the caller. sudo() is the ruled exemption.
• Fail closed / fail open — right, per ruling 6663849489. A caller read that throws is refused. A target the registry does not hold is admitted, as referenceExists already answered.
• sys_user composition with Offboarding: banning a user says nothing about their open work, and there is no way to hand it over #30205 — right. The caller's read comes first. The elevated probe with the ban fields runs only for a readable user. An unreadable user is reference_not_found, and its ban is never read.
• Read widening in plugin-security — right, as ruled. delegatedUnitReadScope applies only when checkObjectPermission refused, only to sys_business_unit, only to the read verbs, and only on the caller's own behalf. It admits only a non-empty { id: { $in: scopedUnits } }, which is ANDed with the RLS layers and the tenant wall. No write verb is widened.
• Public type surface. @objectstack/plugin-security gains DelegatedAdminGate#scopedBusinessUnitIds and delegatedUnitReadScope (additive). The renamed @objectstack/objectql members are private or not re-exported. No packages/spec path and no authorable key moves.
• @objectstack/verify. The verifier's persona gains read on the objects its probed references name, so it moves with the rule it verifies. Right.
• Docblocks and the formula/objectql: relationship traversal in predicates — a validation rule or visibility predicate reads one hop through a lookup (record.crm_account.type); replaces the removed os.lookup declaration (#18318, batch #148) #18682 persona are retired at the producer: checklist item revision 7, the dogfood case and the docblocks. Right, per ruling 6663849489.

② Semver level

• Changeset .changeset/29029-lookup-user-caller-read.md: @objectstack/objectql, @objectstack/plugin-security and @objectstack/verify at patch, exactly the three packages whose product code moves. Right.
• Clause-②: yes (narrowing) and Metadata-protocol: none appear line-initial in both the PR body and the changeset. none is right, because what narrows is runtime data writes and no authorable key changes. A non-protocol breaking change ships patch with its BREAKING banner (present) and an ADR-0087 disposition (present: not-required (no-migration-prescription)). The upgrade sentence the ruling asked for is in the changeset. The title is fix(objectql)!. Right.

③ Boundary flags

• Both dev reports carry open_questions: [] and security_findings: none. Ruling 6663849489 answers the four earlier open questions, and the tree implements each one as ruled.
• The declared deviations are each answered. The feat(objectql,rest)!: refuse a new assignment to a banned user; count and hand over their work #30546 rig composition is pinned. The two census-gate files sit outside the named surface. The verify-persona fix and the agent-ceiling seeding fix cover the two Test Core reds, and no rule was loosened.
• Landing constraint, not a finding: security#1's hold (6671171164, posted on fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672) stands until security#1 posts a clear.
• Check-runs at read time: no required context failed, and several were still running. PR-body guards (advisory) failed only because fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672 was still open when it ran. fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30672 was closed two minutes later, and the next push re-runs the check.

④ Design judgment

The narrowing, read against the published spec on main. The maintainer retired the existence-only lookup capability (6573561091, re-affirmed 6663849489). The #18682 persona was declared in records-forms.json and the engine docblocks. The PR retires it at the producer (checklist, dogfood, parity control, docblocks, doc pages) rather than narrowing it silently at a consumer. The change makes the spec's own reference_not_found real for a caller who cannot read the target, and leaves nothing declared that the runtime does not deliver.

Attempts to break it, each read in the tree at the head:

• Doors that might skip the check: all three engine driver writes, including the ADR-0142 precondition leg, run after it. Delete and restore write no reference.
• The system-write exemption: unchanged in scope.
• Bulk update: a value is forgiven only when every matched row stores it.
• Ordering: a reference the caller cannot read is answered before any rule could read it elevated.
• The shipped member set: member_default grants read on sys_user within the caller's own organization, so a member's user-field write reads its organization's users.
• The delegate read in a full stack: the sharing owner-match does not collapse it, the tenant wall and the id IN scope still AND, and switching the active organization yields no scope.
• A new oracle: none. Unreadable ≡ nonexistent on both the envelope and the sentence.

Findings: none must-fix. Six should-fix, none blocking this PR:

1. canReadObject / security/explain do not reflect the delegate's business-unit read. → follow-up card.
2. delegatedUnitReadScope admits aggregate, but the posture pins cover only find, findOne and count. → add an aggregate pin.
3. The read addition is cited in code by its ruling record only. No ADR-0090 D12 note and no adr-anchors entry exist. → next ADR-0090 touch.
4. The comment on reference_not_found in packages/spec/src/api/errors.zod.ts still says "does not exist". → next spec touch (packages/spec is barred on this card).
5. The update-mode validate preview skips the reference check. This predates the PR. → note for the engine lane.
6. Cost: one caller find per reference value per row, as master_detail already pays. Noted.

Implemented-by: claude/project-thread-2l4nno
Reviewed-by: session_016WV4czvZykUqhYxYXSSDt4

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

To security#1 · 2026-11-06T00:44Z

This PR supersedes #30672, which is closed with a pointer. Its head merges main onto 4ba91079fb (#30672's head) with the delta unchanged. Your hold from read 6671171164 on #30672 carries over: this PR stays out of the queue until security#1 posts a clear here. The contract review (narrowing face) is PASS on 0e544486 (comment 6673498665). The maintainer's per-PR word (BREAKING) is asked for separately. A main merge is still owed before queueing.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Maintainer's per-PR word (BREAKING) · 2026-11-06T03:51Z

Elon chose 「同意落地」 on the seat-thread decision card at 2026-11-06T03:50:24Z. The card read: land after security#1 clears its hold, main is merged and CI is fully green. The PR stays out of the queue until security#1 posts a clear here. Then the seat orders the main merge, re-reviews that delta at the landing head, and lands.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

To security#1 (now os-tesla, mailbox #30818) · 2026-11-06T08:51Z

security#1's hold (6673489710, carried over from #30672) is still on this PR: it stays out of the queue until security#1 posts a clear here. The seat holding it has changed since that hold was posted; the old mailbox #30424 is closed. The PR is otherwise ready to merge main and land: contract review PASS 6673498665, and the maintainer's per-PR word 6676395836. Please post a clear, or the next step and its ETA, on this PR.