docs(adr): record the #28971 personal-view ruling at ADR-0131 D13 and ADR-0017 - #29321

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Head-sha: 29c1fd16 · read 2026-11-02T12:19Z

维护者速读

• 改了什么：在 ADR-0131 D13 段后、ADR-0017 第 2 节 personal 条下，各追加一条 2026-11-02 的日期注，记录 [Decision] Named personal list views: can a reader save their own named list, and what is the end state? #28971 的裁决 C:有名字的个人视图是用户所有的数据对象(D3),不是视图项，也不复用 scope: 'personal'。
• 为什么改：两份 ADR 仍把"个人视图"写成搁置方向，和你的裁决不一致(docs(adr): record the #28971 ruling at ADR-0131 D13 and in ADR-0017 — named personal views are a user-owned data object #29038)。
• 风险与回滚：纯文档，只增不改，不发布任何包。回滚即撤销本 PR。
• 先看:docs/adr/0131-total-organization-ownership-no-null-organization-id.md D13 后的注,docs/adr/0017-object-has-many-view.md personal 条下的注。
• 两分钟验证：看 PR 的 Files 页，只有两个文件、+22/−0。
• 需要你做的：契约复审 PASS 后，在 GitHub 上批准本 PR(docs/adr 是受管面 Tier H,席位不能代批)。

席位意见：可落地，等契约复审，之后等你批准。

席位核对 — ACCEPT · domain:spec#1 · head 29c1fd16

1. Shape: draft, base main, Fixes #29038, label skip-changeset (docs only, no package), Clause-②: no / Metadata-protocol: none. Within claim 6576236867's surface. Governed: check-governed-merges.mjs --pr 29321 reads Tier H (docs/adr/**, both files). It stays draft, with no ready and no queue, until a GOVERNED_APPROVERS approval is on the head.
2. Diff, read on the head: two append-only blockquote notes, +22/−0. Each cites ruling of record 6570568131 on [Decision] Named personal list views: can a reader save their own named list, and what is the end state? #28971 (letter C, 「同意」). Each says the named personal view is a row of a user-owned D3 object, is not a view item, and does not reuse scope: 'personal'. Each says the first version follows List personalization: a stored sort or filter on a deleted or unreadable field is dropped when the list opens, as the URL route already does #28949, List personalization: 「恢复视图默认」 clears the reader's stored setting instead of copying the default into it — today the reader stays on the old value after the view changes #28948, List personalization: one visible 「已个性化」 marker and one reset that restores the whole list — today two reset entries cover different parts and neither says what changed #28950 and List views: readers can hide and show columns by default — flip the userActions.hideFields default, so a generated app has the control without having to declare it #28912, and that the retirement of the inert declarations is spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037's. No existing sentence is edited.
3. Dev open question, answered no: neither Status line gets an Amended entry. The card's acceptance says no other text changes, and the notes say they govern how the Status lines are read.
4. Readings: 21/21 derived gates exit 0 (dev); the adr-index README is current. Check-runs on 29c1fd16 at this reading: 26 success, 20 skipped, 0 failure, 0 running.
5. Landing: one CONTRACT_REVIEW_TIER review (the governed rules face), which the seat runs itself (claim line follows). Then a GOVERNED_APPROVERS approval from the maintainer. After that the seat readies and queues.

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Contract-review-claim: session_01ADHkmPi25XXKx92Xmg4viS · head 29c1fd1 · 2026-11-02T12:31Z

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 29c1fd16cce91f6664119bc44d6f7c94755df499
Local-runs: none
Scope: docs/adr/0017-object-has-many-view.md, docs/adr/0131-total-organization-ownership-no-null-organization-id.md + packages/spec/src/ui/view.zod.ts (ViewScopeSchema, ViewSharingSchema.type, VIEW_ITEM_OWNER_RETIRED, read on origin/main), ui/packages/plugin-list/src/ListView.tsx (the sharing.type badge read), docs/adr/README.md (generated index, unchanged), card #29038 (body, triage, dispatch, dev report), ruling of record 6570568131 on #28971 (and #28971's body), the cited cards #28949, #28948, #28950, #28912, #29037

Inputs read: the card and every comment on it, the ruling comment and its card, the PR body, its file list, the net diff against origin/main (merge-base 31826d3318, +22 / −0, two files, one commit) and the check-runs on this head. The dispatch order and the dispatching seat's own conclusions were not used as evidence. Nothing was built, run or re-run; the read-only shape held.

① Derived judgments

1. What the notes change in how the ADRs are read — right. ADR-0131 D13 on main says a per-user "personal view" scope "stays the parked v18 direction … if pulled, it returns as a user-owned D3 object, not as this table". ADR-0017's Status line says "a per-user view scope is a parked v18 direction", and its §2 personal bullet still describes the layer as "visible only to its owner". After the diff, each place carries one dated blockquote saying the direction is ruled, not parked: a reader's named personal view is a row of a user-owned data object (ADR-0131 D3), not a ViewItem, and does not reuse scope: 'personal'. The existing sentences stay byte-identical and the note states that it governs how they are read. That is the right reading of ruling 6570568131: the maintainer's 「同意」 to option C pulls exactly the branch D13 anticipated, so nothing in either ADR is reversed and no superseding record is owed (Prime Directive [WIP] Add Chinese version of the documentation #13 reserves the new-ADR / amended-status route for a reversal).

2. The ruling is quoted faithfully — right. Both notes name the record id 6570568131, the card [Decision] Named personal list views: can a reader save their own named list, and what is the end state? #28971, letter C and the maintainer's word 「同意」, untranslated. The ruling's first bullet ("Named personal views are a user-owned data object. They are not view items and do not reuse scope: 'personal'") and its third ("It follows List personalization: a stored sort or filter on a deleted or unreadable field is dropped when the list opens, as the URL route already does #28949, List personalization: 「恢复视图默认」 clears the reader's stored setting instead of copying the default into it — today the reader stays on the old value after the view changes #28948, List personalization: one visible 「已个性化」 marker and one reset that restores the whole list — today two reset entries cover different parts and neither says what changed #28950 and List views: readers can hide and show columns by default — flip the userActions.hideFields default, so a generated app has the control without having to declare it #28912") are carried verbatim in substance. The ruling's "Executed now" list assigns the retirement to spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037 and the record to docs(adr): record the #28971 ruling at ADR-0131 D13 and in ADR-0017 — named personal views are a user-owned data object #29038; each note says the retirement "is spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037's, not this note's", which matches.

3. The notes say less than the ruling, by the card's design — right as scoped, with one should-fix below. The ruling also fixes the first version's scope (save as my view, a 「我的视图」 group, rename, delete, set as my default; no sharing, admin management, field picker, packaging or export), decouples Record open: the drawer is the default and the split pane retires — the list keeps its full width, and a record opens only as the drawer or the page #28915, and rules two design constraints: a personal view's id does not use the object.key view syntax, and no unnamed preference layer sits on top of a personal view. Card docs(adr): record the #28971 ruling at ADR-0131 D13 and in ADR-0017 — named personal views are a user-owned data object #29038's Target asks for three statements only, and its Acceptance forbids other text changes, so the omission is what the card ordered. The two design constraints bear on how ADR-0017 §3.1 (ViewItemNameSchema) and its personalization-overlay text are read, though, so a pointer is owed — ④ item 3.

4. The retirement stays where the ruling put it — right. The diff touches no packages/**; ViewScopeSchema on origin/main still lists personal, ViewSharingSchema.type still admits 'personal', VIEW_ITEM_OWNER_RETIRED and the overlay docblock still say "parked direction". Card spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037 (open, pm:queue, domain:spec) owns all of that: its Target items 1 and 2 retire the two values and item 3 updates "the docblocks that call this a parked direction, pointing at [Decision] Named personal list views: can a reader save their own named list, and what is the end state? #28971". So the ADR text and the code docblocks disagree for the gap between the two cards, and the gap has an owner. Not a finding on this PR.

② Semver level

skip-changeset is correct: docs/adr/** publishes nothing from any released package, and the diff touches no package. The PR body carries Clause-②: no and Metadata-protocol: none as line-initial declarations; both are right — no authorable key, value or meaning moves, and no public export moves. No changeset file exists and none is owed. Check Changeset on this head concluded success.

③ Boundary flags

1. The dev's open question — should either Status line gain an Amended entry? Answered: no, and the reasoning differs from "the card said so". Prime Directive [WIP] Add Chinese version of the documentation #13 reserves a new ADR or an amended status line for reversing a recorded decision; D13's own text anticipated this exact outcome and ADR-0017's Status line already records the per-user scope as parked, so these notes confirm a branch rather than reverse one. The repository's observed convention is the same: ADR-0131 carries dated notes of 2026-10-14, 2026-10-17 and 2026-10-19 beside paragraphs with no Status-line entry, and ADR-0066's 2026-10-30 note says of itself that it "changes no decision". docs/adr/README.md is generated from the Status line alone, so leaving it untouched keeps the index current — the dev's adr-index --report reading and the green Lint & Repo Gates run on this head agree. Option A stands; nothing to escalate. If the maintainer prefers a Status-line pointer, it is a one-line follow-up and does not block.

2. Governed path, Tier H. Both files are docs/adr/**; Governed Surface Queue Guard concluded success on this head. The PR is a draft, head repo equals base repo (not a fork), no review is submitted, no auto-merge is armed. The landing is the maintainer's hand or a GOVERNED_APPROVERS approval; this record is the contract-tier review, not an approval, and lifts nothing on Tier H.

3. Deviations declared by the dev: none. The file surface the dispatch allowed (the two ADRs, the generated index only if a gate names it, no packages/**) was held. Diff is +22 / −0, two files, one commit 29c1fd16.

4. Check-runs on 29c1fd16 as the gate verdicts. Lint & Repo Gates success; TypeScript Type Check success; Test Core success (shard 1/8 success); Governed Surface Queue Guard success; Check Changeset success; Check PR Size success; Check Documentation Links success; PR-body guards success; Test UI and Dogfood Regression Gate aggregate jobs success with their shards skipped by the paths filter; Build Core, Lint UI, Type Check UI, Build & E2E UI, Live E2E UI, Build Docs skipped by the paths filter (docs-only diff). No failure, no in_progress. The combined commit status reads pending with zero statuses, which is the absence of legacy statuses, not a red.

④ Design judgment

ADR-0131 (D13 note). Says what the ruling says on the three points the card orders, and nothing contrary. Every factual claim checked against the live tree and the cited cards:

• "sys_view_definition stays retired" — true on origin/main: no platform object declares name: 'sys_view_definition' under packages/ or ui/; the only live references are the retired-table inventory (packages/cli/src/utils/organization-ownership-inventory.ts), tests pinning its absence (duplicates.contract.test.ts, organization-ownership-plan.integration.test.ts), CHANGELOGs and ADR prose.
• "The first version follows List personalization: a stored sort or filter on a deleted or unreadable field is dropped when the list opens, as the URL route already does #28949, List personalization: 「恢复视图默认」 clears the reader's stored setting instead of copying the default into it — today the reader stays on the old value after the view changes #28948, List personalization: one visible 「已个性化」 marker and one reset that restores the whole list — today two reset entries cover different parts and neither says what changed #28950 and List views: readers can hide and show columns by default — flip the userActions.hideFields default, so a generated app has the control without having to declare it #28912" — matches the ruling's third bullet; the four cards exist and are the list-personalization hygiene cards the ruling names. All four are now closed.
• "Retiring the inert scope: 'personal' and sharing.type: 'personal' declarations is spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037's" — true: spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037 is open, and its Target items 1–3 are exactly those two values plus the "parked direction" docblocks; its "Not in this card" names the ADR note as docs(adr): record the #28971 ruling at ADR-0131 D13 and in ADR-0017 — named personal views are a user-owned data object #29038's.
• "The paragraph stays as written" — true: the diff adds eleven lines after the paragraph and before ### D14, deletes nothing.
• Amendment form: an appended, dated blockquote lead with the ruling id, card, letter and the maintainer's word, in the shape every other dated note in this record uses (Note (date, ruling of record ID on #N, letter X, 「…」) — claim.). Append-only; no existing text moved.

Findings:

• should-fix (wording) — "The first version … is filed as its own execution card" reads as a present fact. The ruling says the card is filed when the four blockers are closed; they are closed now and a search of the tracker finds no first-version execution card yet. Reword to "gets its own execution card once the four cards above have landed" (the card body's own phrasing), so a reader does not go looking for a card that does not exist.

ADR-0017 (§2 personal bullet note). Says what the ruling says on the three points, points at ADR-0131 D13 and at #29037, and reads the Status line's "a parked v18 direction" through the note without editing it. Factual claims checked:

• The Status line does say "a per-user view scope is a parked v18 direction" — quoted correctly.
• The note sits inside the personal list item (4-space indented blockquote under a 2-space bullet), so it renders as part of that bullet and the "Dual-read loader" bullet that follows is unaffected; the list structure is intact.
• "Retiring the inert personal declarations is spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037's" — true, as above.
• The §2 sys_view_definition bullet and §3.4 / §3.6 are left as the 2026-09-04 Status amendment already governs them; this note adds nothing contradictory.

Findings:

• should-fix (clarity) — the bold lead says "a user-owned D3 object" before any ADR is named; "D3" has no referent inside ADR-0017 until the next sentence links ADR-0131 D13. Spell it "a user-owned object under ADR-0131 D3" in the lead, so the first sentence stands alone.
• should-fix (completeness, both notes or ADR-0017's alone) — the ruling's two design constraints — a personal view's id does not use the object.key view syntax, and no unnamed preference layer sits on top of a personal view — are the parts of the ruling that touch how this ADR's own text is read (§3.1 ViewItemNameSchema, the personalization overlay the Status line describes). One sentence carrying them, or an explicit "the first version's scope and its two design constraints are on the ruling record", keeps a reader of ADR-0017 from assuming a personal view is addressed in the qualified object-dot-viewKey form. The card's Acceptance ("no other text in either ADR changes") constrains the ADRs' existing text, not the note's content, so the sentence fits inside the note.

House rules for amending an Accepted ADR. docs/adr/README.md makes the Status line the single parsed fact and allows free prose after it; Prime Directive #13 requires a new ADR or an amended status line only to reverse a decision; the observed repository convention for a confirmation or clarification is an appended dated blockquote citing the ruling record, which both notes follow. No house rule is broken. Files are not moved, numbers are not touched, the generated index needs no regeneration.

Must-fix: none. The three should-fixes are wording and completeness; none makes a note say something false or contrary to the ruling of record, and none blocks the maintainer's approval.

Implemented-by: claude/project-thread-dm9b5s
Reviewed-by: session_01ADHkmPi25XXKx92Xmg4viS

VERDICT: PASS

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Contract-review-claim: session_01ADHkmPi25XXKx92Xmg4viS · head 968a13a · 2026-11-02T12:41Z

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 968a13a5f9c0f0e809859cae908fe4087634ebdd
Local-runs: none
Scope: docs/adr/0017-object-has-many-view.md, docs/adr/0131-total-organization-ownership-no-null-organization-id.md + packages/spec/src/ui/view.zod.ts (ViewScopeSchema, ViewSharingSchema.type, VIEW_ITEM_OWNER_RETIRED, read on origin/main), ui/packages/plugin-list/src/ListView.tsx (the sharing.type badge read), docs/adr/README.md (generated index, unchanged), card #29038 (body and every comment), ruling of record 6570568131 on #28971 (and #28971's body), the cited cards #28949, #28948, #28950, #28912, #29037

Delta review. This head is one commit (968a13a5, "apply the review's three wording fixes to the personal-view notes") over 29c1fd16cce91f6664119bc44d6f7c94755df499, which the previous record on this PR passed with three should-fixes and no must-fix. Read: the delta git diff 29c1fd16..968a13a5, the net diff against origin/main (+25 / −0, two files, both still append-only), the check-runs on the new head, and the ADR-0017 sections the new sentence names. The findings of the previous record stand where this one does not restate them; nothing was built, run or re-run.

① Derived judgments

1. The three should-fixes are applied as asked — right.

   • ADR-0131 D13 note: "and is filed as its own execution card" is now "and gets its own execution card once the four cards above have landed" — the card body's own phrasing; the sentence no longer asserts a card that the tracker does not hold.
   • ADR-0017 note lead: "a user-owned D3 object" is now "a user-owned ADR-0131 D3 object", so the first sentence stands alone before the D13 link that follows.
   • ADR-0017 note body gained two sentences: "The same ruling sets two design constraints: a personal view's id does not use the view-item name syntax of section 2, and no unnamed preference layer sits on top of a personal view. They bear on how §3.1's ViewItemNameSchema and section 3's overlay text are read; that text is unchanged." Both constraints are the ruling's fourth bullet, carried in substance; the pointers resolve — §3.1 is "Protocol — @objectstack/spec" and lists ViewItemNameSchema with the qualified name pattern, and section 3 carries the view overlay text at §3.4 (the blockquote "runtime views are data, not admin metadata customisation") and §3.6 (the switcher repointed from the legacy metadata view overlay).

2. What the notes change in how the ADRs are read is unchanged from the previous record — right. The direction D13 called parked is ruled; a named personal view is a row of a user-owned ADR-0131 D3 object, not a ViewItem, and does not reuse scope: 'personal'; the first version follows List personalization: a stored sort or filter on a deleted or unreadable field is dropped when the list opens, as the URL route already does #28949, List personalization: 「恢复视图默认」 clears the reader's stored setting instead of copying the default into it — today the reader stays on the old value after the view changes #28948, List personalization: one visible 「已个性化」 marker and one reset that restores the whole list — today two reset entries cover different parts and neither says what changed #28950 and List views: readers can hide and show columns by default — flip the userActions.hideFields default, so a generated app has the control without having to declare it #28912; the retirement of the two inert personal values and the "parked direction" docblocks is spec: retire the two inert personal declarations — a view marked personal is visible to everyone, and the docs promise personal views that do not exist #29037's. No existing sentence in either ADR is edited or moved; the Status lines are untouched.

3. The delta adds nothing the ruling does not say — right. The two design constraints are quoted from the ruling's own bullet ("A personal view's id does not use the object.key view syntax. No unnamed preference layer sits on top of a personal view."). The ADR-0017 note spells the id syntax with the ADR's own §2 token for a qualified view-item name, which is the same referent. "That text is unchanged" is true on the tree.

② Semver level

Unchanged: skip-changeset is correct for a docs/adr/**-only diff that publishes nothing; the PR body still carries Clause-②: no and Metadata-protocol: none line-initial, and both are right. No changeset exists or is owed. On this head Check Changeset reports skipped on both of its runs (the label-aware step did not need to run); the first head's run concluded success and the label is unchanged.

③ Boundary flags

1. Status-line Amended entry. Still not owed — the reasoning of the previous record holds unchanged: Prime Directive [WIP] Add Chinese version of the documentation #13 reserves the amended-status route for a reversal, D13 anticipated this branch, the repository's dated-note convention carries confirmations without a Status entry, and the generated index parses the Status line alone, so docs/adr/README.md stays current (Lint & Repo Gates is green on this head). Nothing to escalate.

2. Governed path, Tier H. Same two docs/adr/** files; Governed Surface Queue Guard concluded success on this head. The PR is a draft, head repo equals base repo, no review submitted, no auto-merge armed; a needs:contract-review label was added since the first head and this record is that review. Landing stays the maintainer's hand or a GOVERNED_APPROVERS approval; this record lifts nothing on Tier H.

3. Deviations: none. The delta touches only the two ADR files already in scope; still no packages/**, no Status line, no generated index. Net diff +25 / −0.

4. Check-runs on 968a13a5 as the gate verdicts — all completed, none failed, none in progress. Lint & Repo Gates success (all seven Lint lanes success, including PM dispatch-gates and docs & code guards); TypeScript Type Check success (all four Type Check lanes success); Test Core success (shard 1/8 success; Plan Test Core shards success); Governed Surface Queue Guard success; Check PR Size success; Check Documentation Links success; PR-body guards success; Test UI and Dogfood Regression Gate aggregates success with their shards skipped by the paths filter. Build Core, Lint UI, Type Check UI, Build & E2E UI, Live E2E UI, Build Docs, Build UI Deps, UI Published Artifacts, Temporal Conformance, Dogfood Verify CLI and the opt-in harnesses skipped by the paths filter, as on the first head.

④ Design judgment

ADR-0131 (D13 note). One sentence changed. "gets its own execution card once the four cards above have landed" now matches the ruling ("When all four blockers are closed, the seat … files the first-version execution card") and the card body ("The first version gets its own execution card once all four blockers are closed"). Every other claim re-holds from the previous record: sys_view_definition has no live declaration on origin/main; #28949/#28948/#28950/#28912 are the four named hygiene cards; #29037 (open) owns the two personal values and the "parked direction" docblocks (its Target items 1–3); the D13 paragraph is byte-identical. The amended line runs to 138 characters where the file's blockquote wraps near 105; a cosmetic wrap, not a finding — no gate on this repo measures prose line length and every docs gate is green.

ADR-0017 (§2 personal bullet note). The lead now names ADR-0131 D3 before any other reference. The added sentences carry the ruling's two design constraints and point at the exact ADR text they bear on: §3.1's ViewItemNameSchema (the qualified name pattern a personal view will not use) and section 3's overlay text (§3.4, §3.6 — the per-user layer that the ruling says does not stack an unnamed preference layer on a personal view). The note stays inside the personal list item (4-space indented blockquote under the 2-space bullet); the following "Dual-read loader" bullet is unaffected. Append-only against origin/main; the Status line and every existing sentence stand.

House rules for amending an Accepted ADR. Unchanged and followed: appended dated blockquote citing the ruling record, card, letter and the maintainer's untranslated word; no text moved or reversed; numbers and files untouched; the generated index needs no regeneration.

Must-fix: none. Should-fix: none. The three should-fixes of the previous record are closed by this commit; no new finding.

Implemented-by: claude/project-thread-dm9b5s
Reviewed-by: session_01ADHkmPi25XXKx92Xmg4viS

VERDICT: PASS