The obligation reminders are still the administrator talking to themselves: clm_obligation.owner is the dev admin on all 200 seeded rows

Found while measuring #47, which fixed the same shape on clm_contract.legal_owner. Seed-data quality, ⛔ not a defect in F10 — obligation_due does exactly what card 09 built it to do.

Measured

On claude/issue-47-seed-legal-owner, clean database, README operator setup performed, one run of each scheduled job, read from the driver's own SQLite file:

200 obligations -> owner = Dev Admin      (all of them)

receipts by topic:
  clm_legal_review_over_30_days  ->  Legal Counsel 1 x2, Legal Counsel 2 x3    (fixed by #47)
  clm_obligation_due_soon        ->  Dev Admin x2                              (this card)

Once #47 lands, F10's are the only notification receipts still addressed to the dev admin, and they are addressed to it for exactly the reason legal_owner was: the fixture names DEMO_USER because that is the one account that exists while the seed runs.

Why it is worth a card

The dev admin holds no clm_* permission set. An obligation reminder that lands there lands on the one account that cannot open 我的合同 to act on it — the argument src/data/keys.ts already makes for owner_id and #47 extended to legal_owner.

DESIGN.md §03 says an obligation's owner may be unassigned, not defaulted to the contract owner, and _daily-sweep.ts names that explicitly: this field is allowed to be empty. So there are two honest routes and the card has to pick a split between them:

A. Name accounts, the The demo opens on an empty screen: owner_id is NULL on all 120 seeded contracts, so 我的合同 › Launched by Me is blank for every audience #26 way. owner is optional, so it may name the operator's accounts and land NULL until they exist. The obvious deal is the contract's own business owner, or the business owner for delivery obligations and the finance controller for the payment ones.
B. Leave a deliberate unassigned set, the way The demo makes M3's reminder layer look broken: 54 of 120 contracts have no legal_owner, so four of six scheduled jobs notify nobody #47 left one contract in review with no legal owner, so F10's own "nobody to tell" edge keeps being exercised. F10 is one of only two jobs whose recipients can legitimately resolve empty, so this is real coverage.

Constraints

⛔ DESIGN.md §10 forbids seeding users. The fixture references accounts; it does not create them.
If the deal names a person the operator must create, README.md's exact-name table gains them — The demo makes M3's reminder layer look broken: 54 of 120 contracts have no legal_owner, so four of six scheduled jobs notify nobody #47 added that table, so there is now one place for it.
The 820-row total and both locales' row-for-row identity must not change.

Unblocked as of now. Both PRs this card was waiting behind have merged: PR #51 (#49) as 2807b3b and PR #55 (#47) as d34b225. src/data/ is unheld. Branch off current origin/main, which is 2d63324 — later than the d34b225 the card's measurements were taken on, but the two commits since are src/dashboards/ + translations (#57) and README.md (#56), neither of which touches the fixture.

Dispatch notes on top of the card body:

Re-measure before you deal. The card's 200 obligations -> owner = Dev Admin reading was taken on a branch, not on main. Confirm it on your own tree first; if it no longer reproduces, stop and say so rather than dealing a fix for a premise that moved.
The A/B split is yours to choose and to argue, not to ask about. The card names both honest routes; pick one, state the deal in the PR body, and say what F10's "nobody to tell" edge still exercises after your change. If you leave a deliberate unassigned set, say how many and why that number.
If your deal names accounts the operator must create, README.md's exact-name table is where they go — The demo makes M3's reminder layer look broken: 54 of 120 contracts have no legal_owner, so four of six scheduled jobs notify nobody #55 built that table for exactly this. Note that docs: the position census disagrees with itself in three places — README says seven over a table of six, DESIGN.md §11 says both 7 and 8 #58 is queued against the other README table (the position census); it is not dispatched and will rebase on you, so you are free to touch README.md.
The invariants the card lists are hard: 820 rows, both locales row-for-row identical, ⛔ no seeded users (DESIGN.md §10).
Gates all four, exit codes captured before any pipe. A browser or database reading is the point of this card — the deliverable is receipts addressed to accounts that can act on them, and that is measured from the running system, not inferred from the fixture source.

Generated by Claude Code

os-dev-report

{
  "issue": 52,
  "status": "done",
  "branch": "claude/issue-52-obligation-owner",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/65",
  "premise_still_valid": true,
  "summary": "Re-measured the premise on origin/main @ 2d63324 before changing anything and it reproduces exactly: all 200 seeded obligations carried the dev admin, and clm_obligation_due_soon -> Dev Admin x2 were the only notification receipts in the book still addressed to it after #26 and #47. Dealt clm_obligation.owner by what the obligation IS: the 56 compliance filings to the lawyer who knows that counterparty (Legal Counsel 1/2, 29/27 - DESIGN.md 04 gives clm_legal the only non-admin RCU on the object and all four seeded compliance titles are legal work), the 143 deliverable and report rows to the requester who launched the contract (Business Requester 1/2/3, 50/53/40 - 04 gives clm_requester RU-own and 05 puts the list in the everyone group). Both halves deal by the counterparty relationship, the same rule ownerOf and legalOwnerOf already use, so the two locales deal identically and NO new account is named: all five are already in README's exact-name table. Deliberately not a copy of the contract's owner_id, because 03 declines to default this column to the contract owner and putting all 200 on the launching requester would assert by construction what 03 refuses to assert by default. Route B is one row: UNASSIGNED_OBLIGATIONS = 1, placed at T+7 and proved reachable by F10's week stage, which is the only stage that selects anything on a freshly seeded database (today and arrears both select 0, structurally). Also updated README's exact-name table and scripts/demo.mjs, whose comment and failure text still named columns that stopped naming the dev admin at #47.",
  "tests": "GATES, each redirected with $? read immediately after and no pipe between command and exit code: pnpm validate -> 0 ('Validation passed (1009ms)'); pnpm lint -> 0 ('21 warning(s), 5 suggestion(s)'); pnpm typecheck -> 0 (tsc --noEmit, no output); pnpm lint:i18n-gate -> 0 ('0 missing keys across 2 locale(s)'). The 21 warnings are not new: pnpm lint and pnpm validate were re-run on a detached worktree at 2d63324 and the warning set diffs clean against this branch, the only differing line being the config path. Control-character self-scan over the five changed files (grep -naP for the C0 set): clean. No changeset (repo has no changeset gate). RUNNING-SYSTEM MEASUREMENT, identical protocol both sides: clean .objectstack/data, pnpm demo on port 3152, README operator setup (3 requesters + all 7 positions + dev admin into clm_admin + the clm_requester grant issue #11 is about), re-seed so the upserts hand rows over, one trigger of each of the six daily jobs via POST /api/v1/automation/NAME/trigger, receipts read from the driver's own SQLite file with node:sqlite read-only. BEFORE: clm_obligation.owner = Dev Admin x200; 45 receipts / 27 notifications; clm_obligation_due_soon -> Dev Admin x2; F10 stage census week 2 selected -> 2 notified, today 0, arrears 0. AFTER: owner = BR2 53, BR1 50, BR3 40, LC1 29, LC2 27, unassigned 1; 45 receipts / 27 notifications, ZERO carrying the dev admin; clm_obligation_due_soon -> Legal Counsel 2 x1, Business Requester 3 x1; F10 week 3 selected -> 2 notified (one quiet by design), today 0, arrears 0, failed=0 - so the sweep did not die on the unowned row, which is the edge being kept alive. Every other topic byte-identical; all six jobs failed=0 both sides. INVARIANTS: 820 rows in each locale with per-object counts identical, and clm_obligation compared positionally across the two compiled artifacts gives owner mismatches = 0 and structural mismatches = 0; no user row is written, and on a first boot with the named accounts ABSENT all 200 land owner = NULL while every one of the 820 rows survives; legal_owner still 68 (34/34) before and after, which is the check on the counselFor extraction. BROWSER (Chromium at /opt/pw-browsers/chromium-1194/chrome-linux/chrome, no playwright install run): signed in and clicked through to My Contracts > My Obligations - Legal Counsel 2 sees 14 rows (all Compliance, soonest first, footer reads '14 records', nav groups My Contracts / Legal Desk / Analytics), Business Requester 3 sees 18, Dev Admin sees 0; no clm_* console errors on any of the three. The action the reminder asks for was driven: Legal Counsel 2 PATCHed one of its own obligations to in_progress -> 200. NOT MEASURED: the before-side stage census for F3, F4, F11, F12 and F13 (only their receipts were read on that run); CI, which had not been triggered when this report was written.",
  "mcp_calls": "0 - every GitHub read and write went through repo-scoped REST from this container (issue body, comments, open-issue list for the duplicate check, issue creation, PR creation, PR read-back)",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #64: DESIGN.md 04 gives clm_requester U on its own obligations and controlled_by_parent refuses it for all 200 - the requester owns the obligation AND its parent contract, security/explain answers allowed:true, and the PATCH is still 403 'requires edit access to its master record'; clm_requester's contract edit window is draft/submitted and every obligation hangs off an executed contract, so the two windows are disjoint by construction. Not introduced here and deliberately not dodged: the wall stands whoever owns the row.",
    "already filed as #11 (needs-user-decision, not re-filed): a position-less account resolves member_default only, so the three business requesters do not hold clm_requester by existing and explain read clm_obligation answers allowed:false until the sys_user_permission_set grant requester.profile.ts names is applied. Measured both ways; every measurement above was taken with the grant applied.",
    "noted, not filed: only three of clm_obligation.kind's six option values are ever seeded - deliverable 72, report 72, compliance 56, while payment, renewal and other never occur, because planObligations rotates kind once per round-robin round over 72 parents and 200 rows reach exactly three rounds. Breaks no declared contract (10 pins only 200/40/10), but it is why this deal could not use the card's own suggestion of 'the finance controller for the payment ones': there are no payment obligations. Successor: whoever next touches the 10 obligation spread or bands a dashboard on kind - no queued card does.",
    "noted, not filed: a non-admin console session logs GET /api/v1/data/sys_activity -> 403 PERMISSION_DENIED on the home page. Platform surface, unrelated to clm_*; report-never-patch. Successor: none queued."
  ]
}

Generated by Claude Code

REWORK — PR #65, one sentence in `README.md`

The conflict resolution is correct and I verified it independently rather than taking the PR body's word: scripts/demo.mjs on 79f0da74 carries exactly one copy of each of the two passages, clm_review.reviewer alone, the cost sentence and the rm -rf recovery intact; OPERATOR_SETUP_NOTE item 1 appears once and the pre-#60 wording zero times; no conflict markers in any of the five files. CI green, mergeable_state: clean. Everything else in this PR is accepted — see below.

But the merged README.md now asserts something this same PR proves false.

The sentence

README.md:121:

clm_review.reviewer is now the only user reference in the fixture that still points at the dev admin, and it has to: it is required: true, …

What contradicts it — your own `keys.ts` hunk, in this diff

 * What still spells this constant besides `reviewer` is `clm_deviation.decided_by`
 * (the administrator did decide those, on this database) and the `our`-side entry
 * of `clm_signature.signers`, which is a JSON string rather than a reference and
 * resolves against nothing at all.

clm_deviation.decided_by is a user reference — src/objects/deviation.object.ts:93 is Field.user — and it does still point at the dev admin: src/data/negotiation.seed.ts:79 seeds decided_by: deviation.status === 'open' ? null : DEMO_USER. I confirmed both readings myself. So the fixture has two user references naming the dev admin, and the README says one.

You drew the distinguishing line yourself on #54, and it cuts the other way here:

an omitted member is incompleteness, not a false statement

Right — and that is why leaving decided_by out of scripts/demo.mjs's list was correct there. "The only" is not an omission. It is a universal claim, and one counterexample is enough. This is the same defect class #46 was REWORKed for a _id-suffix "the one field" that its own object falsified three times, and the same class #54 existed to remove.

Note that scripts/demo.mjs's doc block is fine and needs no change: "It is the ONLY reference this boot has to satisfy" is scoped to what the priming boot must resolve, and decided_by is optional, so the boot does not have to satisfy it. The README sentence dropped that scope.

The fix

One sentence. Keep the mechanism — the required: true argument is the reason this paragraph exists and it is correct. Make the claim the sentence actually supports: reviewer is the reference that still has to name the dev admin, not the only one that does. If naming decided_by beside it reads well, do that; if it distracts the operator (it is an audit stamp, nothing is routed to it, and there is nothing for them to reassign), scope the sentence instead and leave decided_by unnamed.

⛔ Do not touch anything else, and ⛔ do not fix decided_by itself — it is #61, queued deliberately so it adopts this card's route as precedent. Re-run the four gates and push; no re-seed, no re-measure, no browser run — a one-sentence prose change to README.md cannot move any of them, and say so rather than implying otherwise.

Everything else is accepted, and this is the precedent card

Recorded now so the rework round does not have to re-establish it:

The deal — route A for the book, route B for one row — is ACCEPTED as the fixture's convention, and In the demo, the administrator adjudicated every deviation legal ever raised: clm_deviation.decided_by is DEMO_USER on every decided row #61 will be dispatched to follow it. What makes it the precedent rather than just a choice is the argument against the obvious alternative: DESIGN.md §03 declines to default owner to the contract owner, so putting all 200 on the launching requester would assert by construction the very thing §03 refuses to assert by default, and a reader could no longer tell from the data that the two columns are independent. That is a reason a convention can be built on.
UNASSIGNED_OBLIGATIONS = 1, with "one is the minimum and therefore also the maximum, because every row beyond it is a reminder the demo does not send." That settles the route-B sizing question properly instead of sprinkling.
Constructing the unassigned row at F10_WEEK_DAY after measuring that today_select and arrears_select are structurally zero — every stage filters status IN (pending, in_progress) and the plan draws open rows from 1 + rng*29 or 35 + rng*460, so nothing is ever due today or already past due. Placing the row instead of hoping a draw lands in a one-day window is the difference between coverage and a coin flip, and leaveUnassigned re-proving both columns after the rewrite is what stops it decaying into a hole with a comment over it. Taking the row from the due_soon_pending band so §10's "40 due in the next 30 days" does not quietly become 41 is the kind of second-order check that usually gets missed.
The no-seeded-users invariant measured the hard way: a first boot with the accounts absent, all 200 owners land NULL, 820 rows, none refused. That is the check that matters, and it is not the one a fixture change usually gets.
DESIGN.md §04 gives clm_requester update on its own obligations, and controlled_by_parent refuses it for all 200 — 我负责的履约 is read-only for the audience it is built for #64 filed rather than dodged. Refusing to re-deal obligations away from the business desk to avoid the controlled_by_parent wall is the right call — that would have been shaping a consumer around an upstream defect. It is now labelled needs-user-decision; both its load-bearing readings are confirmed and the decision box stands at 9.
The kind-coverage finding (only three of six option values are ever seeded, which is why the card's own "finance controller for the payment ones" suggestion was unusable — there are no payment obligations) is a good catch, correctly not filed, and correctly reported with its successor named.

Generated by Claude Code

os-dev-report

{
  "issue": 52,
  "status": "done",
  "branch": "claude/issue-52-obligation-owner",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/65",
  "premise_still_valid": true,
  "summary": "REWORK round addressed at 7645414, one sentence in README.md and nothing else. The claim 'clm_review.reviewer is the only user reference in the fixture that still points at the dev admin' was a universal, and clm_deviation.decided_by kills it: deviation.object.ts declares it Field.user and negotiation.seed.ts:79 still stamps it DEMO_USER on every decided deviation. Both readings confirmed against the tree rather than taken on trust. Scoped the sentence to necessity - reviewer is the reference that still HAS TO name the dev admin - and verified that claim too: of the six user references in the model (submitted_by, owner_id, legal_owner, decided_by, clm_obligation.owner, reviewer) only reviewer carries required: true. decided_by deliberately left unnamed rather than listed beside it: it is an audit stamp, nothing is routed to it, nothing for the operator to reassign, and #61 is queued to re-deal it, so naming it would cost that card a second README edit. decided_by itself untouched. scripts/demo.mjs untouched - its 'the ONLY reference this boot has to satisfy' is scoped to what the priming boot must resolve, and decided_by is optional, so it was already correct. EARLIER IN THIS PR, unchanged and accepted: premise re-measured on origin/main @ 2d63324 and reproduced exactly (200/200 on the dev admin, clm_obligation_due_soon -> Dev Admin x2 the last such receipts in the book); clm_obligation.owner dealt by kind - 56 compliance filings to the counterparty's lawyer (29/27), 143 deliverable and report rows to the requester who launched the contract (50/53/40), one row deliberately unassigned; no new account named; origin/main (b667fda) merged with the scripts/demo.mjs conflict resolved to this branch's wording on top of #60.",
  "tests": "REWORK ROUND, gates re-run on 7645414, each redirected with $? read immediately after and no pipe between command and exit code: pnpm validate -> 0 ('Validation passed (966ms)'); pnpm lint -> 0 ('21 warning(s), 5 suggestion(s) (978ms)' - the same 21 as every prior run and as the 2d63324 baseline); pnpm typecheck -> 0; pnpm lint:i18n-gate -> 0 ('0 missing keys across 2 locale(s)'). Control-character scan on README.md: clean. The two factual claims in the new sentence were checked directly: deviation.object.ts declares decided_by as Field.user with no required, negotiation.seed.ts:79 sets it to DEMO_USER for every non-open deviation, and a per-field sweep of all six user-reference declaration blocks returns required: true on reviewer alone. NOT RE-RUN, and deliberately: no re-seed, no re-measure, no browser run - a prose-only change to README.md cannot move a fixture measurement, so the receipt census, stage census, locale-identity check and browser readings in the PR body are the ones taken earlier in this PR and are stated there as unchanged rather than as re-verified against this commit. CARRIED FORWARD from the earlier rounds, all still describing this tree: BEFORE clm_obligation.owner = Dev Admin x200, 45 receipts / 27 notifications, clm_obligation_due_soon -> Dev Admin x2, F10 week 2 selected -> 2 notified, today 0, arrears 0. AFTER owner = BR2 53, BR1 50, BR3 40, LC1 29, LC2 27, unassigned 1; 45 receipts / 27 notifications with ZERO carrying the dev admin; clm_obligation_due_soon -> Legal Counsel 2 x1, Business Requester 3 x1; F10 week 3 selected -> 2 notified (one quiet by design), failed=0. Invariants re-verified post-merge: 820 rows per locale, clm_obligation positionally identical across the two compiled artifacts (owner mismatches 0, structural 0), no user row written, legal_owner still 68 (34/34). Browser (Chromium at /opt/pw-browsers/chromium-1194/chrome-linux/chrome): Legal Counsel 2 sees 14 rows in My Obligations, Business Requester 3 sees 18, Dev Admin sees 0, no clm_* console errors; Legal Counsel 2 PATCHed one of its own obligations to in_progress -> 200. CI was still pending at report time (PR mergeable: true).",
  "mcp_calls": "0 - every GitHub read and write went through repo-scoped REST from this container across all rounds",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #64: DESIGN.md 04 gives clm_requester U on its own obligations and controlled_by_parent refuses it for all 200 - the requester owns the obligation AND its parent contract, security/explain answers allowed:true, and the PATCH is still 403 'requires edit access to its master record'; clm_requester's contract edit window is draft/submitted and every obligation hangs off an executed contract, so the two windows are disjoint by construction. Not introduced here and deliberately not dodged: the wall stands whoever owns the row.",
    "already filed as #11 (needs-user-decision, not re-filed): a position-less account resolves member_default only, so the three business requesters do not hold clm_requester by existing and explain read clm_obligation answers allowed:false until the sys_user_permission_set grant requester.profile.ts names is applied. Measured both ways; every measurement in this PR was taken with the grant applied.",
    "noted, not filed: clm_deviation.decided_by still names the dev admin on every decided deviation - found while fixing the README universal this round, and NOT touched, because #61 is already queued for exactly that column and was deliberately held to adopt this card's route as precedent. Successor: #61.",
    "noted, not filed: only three of clm_obligation.kind's six option values are ever seeded - deliverable 72, report 72, compliance 56, while payment, renewal and other never occur, because planObligations rotates kind once per round-robin round over 72 parents and 200 rows reach exactly three rounds. Breaks no declared contract (10 pins only 200/40/10), but it is why this deal could not use the card's own suggestion of 'the finance controller for the payment ones': there are no payment obligations. Successor: whoever next touches the 10 obligation spread or bands a dashboard on kind - no queued card does.",
    "noted, not filed: a non-admin console session logs GET /api/v1/data/sys_activity -> 403 PERMISSION_DENIED on the home page. Platform surface, unrelated to clm_*; report-never-patch. Successor: none queued."
  ]
}

Generated by Claude Code

ACCEPT — PR #65

CI green on head 7645414b (two Validate runs, both success), mergeable_state: clean, five files, no governed surface, first REWORK round. Squash-merging.

The rework is exactly the one sentence. Diffed 79f0da74..7645414b myself: README.md, +4/−4, nothing else.

clm_review.reviewer is the one reference that still has to name the dev admin: it is required: true, …

That is true and it is scoped to what the evidence supports — reviewer is the only required: true user reference, so it is the only one that has to resolve at seed time, while decided_by is optional and may name whatever the fixture likes. You kept the mechanism, dropped the universal, and left decided_by unnamed, which is the right call for a paragraph an operator reads: it is an audit stamp, nothing is routed to it, and there is nothing there for them to reassign.

Everything else was accepted in the REWORK comment and I am not repeating it — the deal, the UNASSIGNED_OBLIGATIONS = 1 argument, the F10_WEEK_DAY construction, the invariants and the browser readings all stand as recorded.

The route this card sets, for #61 to adopt

Stated once here so the next card inherits it rather than re-deriving it:

compliance → the lawyer who knows that counterparty (counselFor), because §04 gives clm_legal the only non-admin RCU on clm_obligation and every seeded compliance title is legal work.
deliverable · report → the requester who launched the contract (ownerOf), because §04 gives clm_requester RU（本人负责） and §05 puts 我负责的履约 in the group every employee reaches.
Dealt by structure, never by prose, so both locales deal identically.
Names no new account — only the five README.md's exact-name table already asks for.
A deliberate unassigned set sized at the minimum that keeps a "nobody to tell" edge alive, placed rather than hoped into the selecting window, and re-proved after the deal rather than assumed from it.

On the merge conflict

The scripts/demo.mjs collision was my dispatch error, not yours: I sent #52 and #54 out concurrently while my own hot-file table recorded that file as held by #54, and the note I gave you cleared you for README.md without mentioning it. You resolved it correctly — merge commit, no rebase, no force-push, this branch's wording on top of #60's — and, notably, you did not re-run the seed and the browser to pad the evidence: you checked that nothing merged in touches src/data/, src/flows/ or the objects, said so in the PR, and let the earlier measurements stand. Knowing which measurements a merge invalidates is worth more than re-running all of them.

Going into the R4 seat post as a serialization miss on the seat's side.

Generated by Claude Code

fix(data): deal clm_obligation.owner to the desk that performs it (#52)

fix(data): deal clm_deviation.decided_by to the counterparty's lawyer (…

Navigation Menu

Repository navigation

The obligation reminders are still the administrator talking to themselves: `clm_obligation.owner` is the dev admin on all 200 seeded rows #52

Measured

Why it is worth a card

Constraints

Related

REWORK — PR #65, one sentence in `README.md`

The sentence

What contradicts it — your own `keys.ts` hunk, in this diff

The fix

Everything else is accepted, and this is the precedent card

ACCEPT — PR #65

The route this card sets, for #61 to adopt

On the merge conflict

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The obligation reminders are still the administrator talking to themselves: clm_obligation.owner is the dev admin on all 200 seeded rows #52

Description

Measured

Why it is worth a card

Constraints

Related

Activity

zhuangjianguo commented on Sep 10, 2026

claude commented on Sep 10, 2026

zhuangjianguo commented on Sep 10, 2026

REWORK — PR #65, one sentence in README.md

The sentence

What contradicts it — your own keys.ts hunk, in this diff

The fix

Everything else is accepted, and this is the precedent card

claude commented on Sep 10, 2026

zhuangjianguo commented on Sep 10, 2026

ACCEPT — PR #65

The route this card sets, for #61 to adopt

On the merge conflict

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The obligation reminders are still the administrator talking to themselves: `clm_obligation.owner` is the dev admin on all 200 seeded rows #52

REWORK — PR #65, one sentence in `README.md`

What contradicts it — your own `keys.ts` hunk, in this diff