feat(objectql,plugin-sharing): an organization authors its own assignment rules as sys_assignment_rule records - #30760

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/cli, @objectstack/objectql, @objectstack/platform-objects, @objectstack/plugin-sharing, @objectstack/spec, touching 65 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/objectql/src/index.ts, packages/plugins/plugin-sharing/src/index.ts, packages/plugins/plugin-sharing/src/objects/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

90 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json adf6ee0948d8dd8e747678e6d5107e0c4a86bb31.

⛔ 17 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32b206b3533a5f855b82fde15dd717ca31b9019a && git checkout 32b206b3533a5f855b82fde15dd717ca31b9019a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin adf6ee0948d8dd8e747678e6d5107e0c4a86bb31 ac7e06d99504da19669bc6ce16643ee99c41a29d && git checkout -B drift-repro adf6ee0948d8dd8e747678e6d5107e0c4a86bb31 && git merge --no-ff ac7e06d99504da19669bc6ce16643ee99c41a29d

node scripts/docs-audit/affected-docs.mjs --json adf6ee0948d8dd8e747678e6d5107e0c4a86bb31

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs adf6ee0948d8dd8e747678e6d5107e0c4a86bb31 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ac7e06d99504da19669bc6ce16643ee99c41a29d
Local-runs: none
Scope: packages/spec/src/automation/assignment-rule.zod.ts, packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/system/constants/platform-object-names.ts + packages/spec/scripts/liveness/empty-state-registry.mts (hunk 4, consented 6674042568), packages/objectql/src/assignment-rules.ts, packages/objectql/src/engine.ts, packages/objectql/src/index.ts, packages/plugins/plugin-sharing/src/assignment-rule-hooks.ts, packages/plugins/plugin-sharing/src/objects/sys-assignment-rule.object.ts, packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/cli/src/utils/organization-ownership-inventory.ts, scripts/platform-object-tenancy-census.json, the four platform-objects translation files, .changeset/30066-organization-assignment-rules.md (widened to the whole non-prose diff; the cited code on main — engine-insert.ts InsertFacet.assignment, engine-hook-dispatch.ts, queue-hooks.ts, plugin-security grant-holder-membership-refusal.ts and security-plugin-write-tenant-wall.ts, sys-member.object.ts, sys-queue.object.ts, core/security/user-ban.ts, scripts/pm/clause2-line.mjs, scripts/check-changeset-no-major.mjs, packages/spec/liveness/* — was read, not reviewed)

Governing text: ruling A 6631036940; execution parameters 6670178869 (items 1–8); claim 6672306838 with amendments 6672490095, 6673262187, 6674205693, 6674382817; dev report 6673979825; spec#3 consents 6672529419 (hunks 1–3, terms) and 6674042568 (hunk 4) on #30558; ADR-0142 D5 and merge question 11; the PR body. Read-only shape held: git diff origin/main...head, files via git show, the card and every comment, the head's check-runs through the API. PR user.login is objectstack-fleet[bot].

Check-runs on this head (API, at review time): 64 runs, 55 success, 9 skipped, 0 red, 0 running — Check Changeset, Governed Surface Queue Guard, PR-body guards, Spec property liveness, Type Check · consumer gates (the check:app-nav-i18n that was red at ab98c3b8), Lint · repo & tooling gates (census), every Test Core shard, the UI jobs. Landing precondition ② is met as read.

The four packages/spec hunks against the consent terms, line by line.

1. Hunk 1, kernel/metadata-plugin.zod.ts (+3 −2, comment lines only). The [ADR-0142 D5] comment above the assignment_rule entry changes exactly the clause "and declared only: organization-authored routing is deferred (merge question 11)" into "an organization authors its own as sys_assignment_rule rows, which the engine evaluates before these and which may not take a declared rule's name"; the loadOrder: 17 sentence, the ledger sentence and "customized by a clone under a new name, never by an overlay" are kept. The entry line itself is diff context: description: 'A rule a package declares to route new records to a queue or a person', allowRuntimeCreate: false, supportsOverlay: false, allowEnvironmentOverlay: false, supportsVersioning: false, executionPinned: false, loadOrder: 17, domain: 'security' — all untouched, as the consent requires (organization rules are rows, not items of this type). Holds.
2. Hunk 2, system/constants/platform-object-names.ts (+1). 'sys_assignment_rule' under PLATFORM_OBJECTS_BY_PACKAGE['plugin-sharing'], between 'sys_assignment_cursor' and 'sys_queue': sorted position, one line. Same-commit term, verified on the commit API, not the body: 4b6296e8 holds the object, objects/index.ts, sharing-plugin.ts, the hooks, the objectql seam and tests (10 files, no roster line); d86cdc3e holds the roster line, the inventory row, the census row and the changeset (4 files). The term's purpose — the line never lands ahead of the object — holds in this PR because 4b6296e8 precedes d86cdc3e on the branch and both merge together. Cost of the deviation: the three intermediate commits 4b6296e8, b0458ed8 and the pre-roster tree are not bisect-clean for platform-object-names.test.ts (the dev measured 1 failed / 13 passed without the line); a squash merge makes that moot. The seat accepted the split rather than a rewrite of pushed history; judged acceptable, named here as the consent asks.
3. Hunk 3, automation/assignment-rule.zod.ts (+14 −4, all inside the AssignmentRuleSchema docblock; the lazySchema opening line and every key, .describe() and refinement are diff context). The rewritten sentences checked one by one against packages/objectql/src/assignment-rules.ts at this head: "that organization's active rows first, ascending by sort_order and then by name" = authoredRules sorts sortOrderOf(a) - sortOrderOf(b) || localeCompare(name) and skips active === false; "the declared rules after them, in registry order" = rules = [...own, ...fallback], fallback from rulesFor in listRules() order filtered by switchedOn; "across both, the first entry whose criteria match decides, and its target stands even when it does not resolve" = assignOne returns after the first matches, and route / routeToUser return on an unresolved queue, an empty pool or a lapsed user without trying the next rule; "When the organization's rows cannot be read, the row is written as it stood rather than routed by the declared rules alone" = own === null → continue; "may not take a declared rule's name" = the declaredNames skip with warnOnce('shadowed::…') plus the save guard; "A user target owns the row only while the user is an active member … logged once" = routeToUser on answer === 'member', else warnOnce('lapsed-user::rule::user::org'); "an organization's row by its own active" = the active skip, the ledger read is declared-only. Every sentence is what the code does, in the order the code does it. Generated output: nothing under packages/spec/generated, packages/spec/scripts or scripts/ renders this docblock (the only other carriers of the old sentence on main are the hand-written liveness ledger, see ③, and ADR-0142), so "regenerate, never hand-edit" has nothing to regenerate; the body's "gen:schema / gen:docs no diff" is consistent with that.
4. Hunk 4, scripts/liveness/empty-state-registry.mts (+8 −0, one object literal inserted directly after the assignment-rule.zod.ts / criteria entry). file names the object module, property: 'criteria', semantics: 'scope', the rationale carries the five points the consent listed (catch-all at the end of the organization's order; selects, grants nothing; only an ownerless, queue-less row; the author's target and the active-member rule for a user; failure direction is mis-routing among the author's own targets), evidence names assignment-rules.ts and the hooks file. Zero deletions, so every existing entry is byte-identical. The description it classifies ("leave it empty to take every new record that no earlier rule took") is what matches does for an absent criteria. "Spec property liveness" is green on this head. Holds.
5. Nothing else under packages/spec: the diff's file list has exactly these four paths there.

① Derived judgments

1. Roster (the schema face) widens. PLATFORM_PROVIDED_OBJECT_NAMES / isPlatformProvidedObjectName answer true for one more real object; nothing accepted before is refused. platform-object-names.test.ts on main holds the roster to the declared *.object.ts set both ways, and the declaration is in this PR. Right: widening, as declared.
2. The object is what ruling A and the parameters bind. sys-assignment-rule.object.ts: isSystem: true, managedBy: 'config' (the sys_queue / sys_sharing_rule posture, compared on main), organization_id a required lookup to sys_organization (parameter 6: non-null, behind the wall), name unique per organization ({ fields: ['name'], unique: 'organization' }, the same index form sys_queue and sys_sharing_rule use), one entry per row (object_name, criteria, sort_order, recipient_type queue|user, recipient_id via the existing recipient-picker widget whose dependsOn sibling is literally recipient_type, strategy, load, active), a by_object list view sorted object → sort_order → name (the evaluation order). Census: reach: in, tenantField: organization_id, totals 93→94 registered, 47→48 in reach, out-of-reach unchanged. Inventory: fate: 'attribution', PMAIN, no anchors, the row shape of sys_assignment_cursor above it. Setup nav nav_assignment_rules beside nav_queue_members, requiresObject, requiredPermissions: ['manage_platform_settings'], opening the generic record list (the purpose-built page is the domain:ui card). Right.
3. Evaluation order (parameter 1). apply reads the organization's rows once per organization in the batch (authored map), orders them, then [...own, ...fallback], first match. The reason given in the code and the docblock — the activation ledger is one deployment-wide row with no organization column, so an organization cannot switch a package rule off for itself, and package-first would let it never win — matches switchedOn on main. Pinned by "an organization rule wins over a declared rule that also matches; an unmatched row falls back" and by the dev's ablation (order swapped → 3 failed). Right.
4. User target (parameter 2). Save: the guard asks organizationMemberStanding and refuses not_member / unconfirmable (reference_not_found) and banned (reference_user_banned); a membership read that throws refuses the save with the reason rather than storing an unjudged target. Insert: routeToUser writes owner_id only on member, otherwise ownerless with one warn per (rule, user, organization); the insert is never refused; a throwing read leaves the row as it stood. "Active member" = a sys_member row for (user, organization) and isUserBanInForce(user) false — sys_member on main has no status column (fields: id, display_title, created_at, organization_id, user_id, role), so there is no membership state the predicate overlooks; it agrees with plugin-security's holdsMembership (one sys_member find under { isSystem, tenantId: organizationId }) and adds core's one ban predicate (core/security/user-ban.ts). Right.
5. Lapsed queue (parameter 3) — route is unchanged from main for a queue target: unresolved → ownerless, no queue, warn once; empty pool → park, warn once; strategy read failure → park. Unchanged, as the parameter says.
6. Names (parameter 4). The guard refuses a name any declared rule holds (registry.listItems('assignment_rule'), switched on or off, any object), and the evaluator independently skips such a row with a warn and never evaluates it, so a declaration installed after the row was written also wins (ADR-0131 D4, one namespace) and the boot report says so at error, naming the organization. Cursor rows are keyed (rule, entry = rule, organization), so an authored rule's rotation can never share a cursor with a declared rule's. Right.
7. Criteria / load (parameter 5). assignmentExpressionRefusals compiles criteria by ExpressionEngine.compile (what matches evaluates with) and load by compileCelToFilter(load, { variables: {} }) (what leastLoaded lowers with); the guard adds whatever AssignmentRuleSchema.safeParse refuses for the one-entry shape (strategy on a user target, least_loaded without load, load without the strategy, a non-machine queue name, an unknown recipient type), mapped to the row's columns by columnOf. A rule the seam could not evaluate is refused when written. Right.
8. Tenancy (parameter 6). The row: organization_id required and indexed; the wall of security-plugin-write-tenant-wall.ts (ADR-0105 D5 / ADR-0123 D2) stamps an insert's organization from the active one and refuses a new row landing in an organization the caller lacks, so a tenant admin authors into their own organization and the guard's membership check runs against the organization the row actually lands in (present(row.organization_id) ?? session.organizationId). Reach: authoredRules reads { object_name, organization_id: the row's organization } under a context pinned to that organization; a queue target is resolved by resolveQueue(name, organizationId) in the row's organization; a user target must be that organization's member. A rule written in organization A cannot route a row of organization B, reach a queue authored in B, or hand a row to a user who is not a member of the row's organization; a platform administrator (wall-exempt) may author into any organization, which is the existing posture of sys_queue. Permission to author: the same as sys_queue / sys_sharing_rule on main (isSystem, managedBy: 'config', Setup behind manage_platform_settings); no new door. Cross-org pin: "routes … only for the organization that authored it" (other.queue and other.owner_id null).
9. The engine call site (engine.ts, one line + comment): evaluator.mayRoute(object) replaces the non-empty rulesFor(object) test. mayRoute = declared rule names the object, or (object !== 'sys_assignment_rule' and the table is registered and carriesQueueColumn(schema)) — registry reads only. The candidate's organization is the row's own column, else the active organization, else the derived one — unchanged. engine-insert.ts is untouched (the InsertFacet.assignment host adapter already exposes listRules, and a find whose limit the rule read leaves unset; engine-find.ts gives limit no default at the query layer, so an organization's rule list is read whole). Right.
10. Cost. For an object with the queue column while the table is registered: one sys_assignment_rule find per organization in the batch, plus for a user target one sys_member find and one sys_user find per (user, organization) memoised per pass. Without the table, or for an object without the column, nothing is read (pinned "the cheap path"). As the body states.
11. Boot report. reportShadowedAuthoredAssignmentRules is awaited at kernel:ready beside reportShadowedAuthoredQueues, same shape (engine.find with context: SYSTEM_CTX, which the engine honours through mergeReadContext(query.context, options.context)), logs at error when the logger has one, stands down with no declared rule or no table. Bound regardless of enforce, inside its own try/catch. Right.
12. @objectstack/objectql public surface. src/index.ts gains ASSIGNMENT_RULE_OBJECT, assignmentExpressionRefusals, organizationMemberStanding and the type OrganizationMemberStanding; nothing removed; OWNERSHIP_QUEUE_SOURCE_SLOT stays unexported. Widening, covered by the minor. @objectstack/plugin-sharing gains SysAssignmentRule and the five guard exports. Widening. @objectstack/platform-objects: four nav labels, no export change.
13. The declared-rule behaviour change — see ③.2; the accept set does not move.

② Semver level

• Changeset .changeset/30066-organization-assignment-rules.md: minor for @objectstack/spec, @objectstack/objectql, @objectstack/plugin-sharing, @objectstack/cli, @objectstack/platform-objects. No major (check-changeset-no-major.mjs, pre-GA). Level axis (ruling A as clause2-line.mjs states it): Metadata-protocol: added needs at least one package whose published source moves minor or above — spec (roster, docblock, registry comment) and objectql do; only a declared none forces patch, so the minor on platform-objects for four nav labels and on cli for an inventory row are admissible under added, and all five sit in the one fixed group, so the per-package level touches the CHANGELOG heading and nothing of the version. Check Changeset concluded success on this head.
• Clause-②: yes (widening) and Metadata-protocol: added are byte-identical in the PR body and the changeset, and match the claim's expectation and the consent's terms. Fixes #30066 is in the body.
• Skills-docs: grammar follow-up owed — FILES is the declared one; the body's line names the same two files as the changeset's (content/docs/automation/queues-and-assignment-rules.mdx, skills/objectstack-automation/SKILL.md) but adds a parenthetical after each, so the two lines are not byte-identical. No script reads the line (the only hit under scripts/ and .github/ is a comment), the seat rewrites owed — FILES to #N at ACCEPT anyway. Should-fix, prose. The grep term of the consent is met: skills/** on this head carries no "deferred" / "declared only" reading about assignment rules (re-run here, no hit).

③ Boundary flags

open_questions: [] in the dev report. The dev's eight deviations and the body's acceptance notes, each answered:

1. Placement in plugin-sharing, call site engine.ts — accepted in amendment 6672490095; the object sits beside sys_queue / sys_queue_member / sys_assignment_cursor whose model it follows (ADR-0142 names plugin-sharing the owner package of the queue tables), and the one-line call-site change is in the insert body engine.ts still hosts. Accepted.
2. Behaviour change for declared rules. On main a declared entry assignTo: { type: 'user', value } wrote owner_id = value unconditionally; at this head it assigns only where that user is a sys_member of the row's organization and not banned, else ownerless with one warn. The accept set is unchanged (the entry still parses, loads and is evaluated; nothing is refused at load or save), so this is not a no (narrowing) case on the schema face; it is a change in what an accepted input does at runtime. It is what execution parameter 2 says ("at insert time a target that no longer resolves is handled like a lapsed queue … Today the engine writes the owner without resolving it"), agreed by the maintainer, and the ADR already held a declared user id to resolution at load and os lint warns on it (assignment-rule-user-target). The changeset's Upgrading paragraph states it. Open question for the maintainer, does not block: a declared user-target rule in a deployment whose users carry no sys_member rows (a store seeded by hand, or admin-import-users without memberships) assigns nothing from this release; is Metadata-protocol: added the intended reading, or should the record carry semantic beside it? Both grade minor, so the gates are indifferent; the seat should name it at ACCEPT.
3. Commit split — ①/hunk 2 above. Accepted.
4. Translations held for i18n phase 3 (platform metadata and built-in emails): extraction and bundle checks read PLATFORM_LOCALES; backfill the seven missing locales #30512 — plugin-sharing's i18n-extract.config.ts lists its objects explicitly and does not name SysAssignmentRule, so check:i18n is green and the object's labels wait for the rebase; the four nav labels (amendment 6674382817) ride here because check:app-nav-i18n reads the nav id only after the runtime merge, and each sits under nav_queue_members in en, es-ES, ja-JP, zh-CN. Accepted.
5. Two checks beyond the ruling — an object that does not exist or has no queue column is refused at save (the seam's rulesFor would warn and route nothing; refusing at authoring time is the louder failure the card's 防错 axis asked for), and the boot report at error names a shadowed row an administrator has to rename. Both are mechanism around the ruled behaviour, neither widens or narrows a spec. Accepted.
6. Harness attribution line and the PR body's first line — reported, not a conflict. Noted.
7. Repo-wide pnpm lint run by the dev — reported, no conflict of substance. Noted.
8. Subscribed to the PR's activity — the harness default; landing stays the seat's. Noted.

Author note: PR user.login is objectstack-fleet[bot]; no outside author.

Transitional text. ADR-0142 merge question 11 and the D5 note still say "deferred" on main; execution parameter 7 puts that rewording in its own Tier H docs/adr PR, so the spec comment and the ADR disagree until it lands. Intended by the parameters; the seat tracks the ADR PR.

④ Design judgment

1. Hunk 1 against its consumer. The registry entry is read by the metadata API and Studio to refuse runtime creation of assignment_rule items (allowRuntimeCreate: false), and that refusal is still right: an organization's rule is a sys_assignment_rule row, not a registry item, so the measured 403 on PUT /api/v1/meta/assignment_rule/… stays and the comment now says where the other door is. Holds.
2. Hunk 2 against its consumer. The roster test and the object land together; the inventory test ("a platform object without a row reds here, by name") is satisfied by the row; the census check ran in the green "Lint · repo & tooling gates". No generated artifact derives from the roster. Holds.
3. Hunk 3 against the ruling and the code — ① hunk 3 above: every sentence names a branch of apply / authoredRules / assignOne / route / routeToUser at this head, in the order they run. The docblock is the one place an author of a declared rule learns that an organization's rows go first, so stating the order here is what the consent asked for and what the card's "Not measured" item deferred to execution. Holds.
4. Hunk 4 against its gate. check:empty-state walks the object's permissive empty states; the entry classifies the one criteria has and the gate is green on this head. The rationale's claims are true of the code: matches returns true on an absent criteria, the seam routes only a row with no owner and no queue, the save guard holds the user target to membership. Holds.
5. The guard against the engine's hook contract. beforeUpdate receives previous as the row's pre-image (engine-hook-dispatch.ts, the per-row dispatch), so the merged-row judgement is on real data; the patch-touches-a-judged-column test means an administrator can always flip active or relabel a rule whose target lapsed, which is the remedy the warn names. The guard's engine.find(o, { where, context, limit }) form is the one queue-hooks.ts and plugin-security's holdsMembership use, and the engine merges query.context with options.context, so the membership read runs as system pinned to the organization. Re-binding unregisters by package id first (pinned "re-binding replaces, never stacks"). Holds.
6. Pins are real. The three ablations (order swapped; member widened to !== 'unconfirmable'; the declared-name branch short-circuited) each red the suites that name the branch, with restore proven against HEAD. The remaining pins name distinct branches: unreadable rows → no fallback; a row that does not read as a rule → next rule, one warn; inactive skipped; cursor keyed by (rule, rule, organization); no membership table → none assigned, one warn; failed membership read → row as it stood (seam) / save refused (guard); boot report at error.
7. Tried to break it. An authored rule naming a queue authored in another organization: resolveQueue is pinned to the row's organization → unresolved → ownerless, no queue, one warn; no reach. An authored rule whose user target leaves the organization after save: insert finds not_member → ownerless, one warn per (rule, user, org); the administrator relabels or deactivates without re-judgement. A row with recipient_type patched from user to queue without changing recipient_id: the merged row is judged and the old user id fails the queue-name regex at recipient_id — correct, the admin must change both. Two organizations with a rule of the same name: per-organization unique index and per-organization cursor keys, no collision. A declared rule installed later under an authored row's name: the row is skipped at insert (warn once) and reported at boot (error). An organization with zero rules on an object that carries the column: one find per insert batch, the fallback decides, no behaviour change from main. A batch mixing organizations: the authored map reads each once; a row with no organization and no declared rule is the cheap case (no warn); with a declared rule it warns no-org as on main. sys_assignment_rule's own insert: excluded from authoredRulesPossible, and the object carries no queue column anyway. sort_order non-numeric or absent: sortOrderOf → 0, ties broken by name. active stored as 0 / '0' / 'false': skipped. A rule row whose recipient_type is neither value (written past the guard, e.g. by a migration): ruleOf returns null → one warn, next rule. Round-robin over a queue whose membership changed: nextMember by position, as on main. No must-fix found.

Should-fix (non-blocking, for the seat's ACCEPT note or a follow-up): (a) the Skills-docs: line's parentheticals (② above), prose; (b) the hand-written liveness ledger — packages/spec/liveness/assignment_rule.json _note and packages/spec/liveness/README.md row assignment_rule — still says "Declared only — organization-authored rules are deferred (ADR-0142 merge question 11)"; it is outside the four consented hunks ("a fifth hunk asks again"), no gate reads the prose, so it is a domain:spec follow-up to ask for on #30558, not this PR; (c) organizationMemberStanding passes the user and organization ids into where raw, where plugin-security's holdsMembership escapes a value that reads as a wrapped filter token — platform ids never match that regex, so this is a consistency nit for a later pass; (d) the docs follow-up the Skills-docs: line already owes.

Implemented-by: claude/project-thread-kl2al6
Reviewed-by: session_016WV4cytLmJxfAmgPVjUbbW

VERDICT: PASS

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · ACCEPT · 2026-11-06T02:21Z · #30066

Head-sha: ac7e06d

• Shape: an organization authors its own assignment rules in Setup as sys_assignment_rule records (new object in plugin-sharing, beside sys_queue), evaluated before the declared package rules, with a save guard and a boot report for shadowed rows. Four packages/spec hunks under domain:spec consent 6672529419 and 6674042568, plus four Setup nav labels in platform-objects. Inside claim 6672306838 and amendments 6672490095 / 6673262187 / 6674205693 / 6674382817. Ruling A 6631036940 with the execution parameters 6670178869.
• Review of record: CONTRACT_REVIEW_TIER PASS 6675095900 at this head, covering all four spec hunks and the assignment_rule registry entry left in place.
• Gates: every check-run on this head has concluded: 55 success, 9 skipped, 0 failure. Locally, the card thread reports 100 derived families run with 0 NOT-MEASURED, check:empty-state "all classified", check:app-nav-i18n OK, platform-objects translations 445/445.
• Accepted deviations:
  • The object (4b6296e8) and its roster line with the census and inventory rows (d86cdc3e) are adjacent commits of this PR rather than one, because 4b6296e8 was already pushed. Both land together, which is what the consent's condition protects.
  • Placement in plugin-sharing rather than platform-objects, following sys_queue / sys_sharing_rule.
  • Two checks beyond the ruling, as mechanism: the save guard also refuses an object that does not exist or has no queue column, and the boot report logs at error a stored row a later package's rule now shadows.
  • The four Setup nav labels (nav_assignment_rules, en / zh-CN / ja-JP / es-ES), so the app-nav i18n gate stays green; the other seven locales come with i18n phase 3 (platform metadata and built-in emails): extraction and bundle checks read PLATFORM_LOCALES; backfill the seven missing locales #30512.
• Declared behaviour change, named: a package-declared rule whose entry names a user id now assigns only where that user is an active member of the row's organization. Nothing is refused at load or save and the insert is never refused; it is execution parameter 2 of 6670178869 applied to the shared target resolver, and the changeset's Upgrading paragraph says so. Flagged for the maintainer's sight in the review's ③, not a blocker.
• Follow-ups owed (not this PR):
  • The ADR-0142 D5 / merge question 11 rewording is Tier H and comes as its own docs/adr PR on this branch after this one merges.
  • packages/spec/liveness/assignment_rule.json _note and the liveness README row still say organization rules are deferred. That is a fifth packages/spec path, outside the consent; it goes to the domain:spec seat on duty.
  • The docs page and the automation skill teach the new behaviour (the PR's Skills-docs: follow-up owed line).
  • Should-fix (consistency): organizationMemberStanding passes ids into where without the wrapped-filter-token escape holdsMembership uses. Platform ids never carry the token, so this is not a defect.
• Contract: Clause-②: yes (widening), Metadata-protocol: added, confirmed by the record.
• Landing: ready, then auto-merge, through the relay. Fixes #30066.