docs(adr): ADR-0090 D11 — external visibility is the EXTERNAL rung; externalSharingModel retired (#23268) (#23443)

Refs #23268
Clause-②: no

The ADR-0090 D11 sentence of ruling of record `6159300530` on #23268,
letter A, item 2 (the maintainer's 「23268 同意」), drafted for the
maintainer's hand. This PR touches
`docs/adr/0090-permission-model-v2-concept-convergence.md` and one row
of `skills/objectstack-data/references/lint-rules.md`, both governed, so
it is Tier H: it lands by an authorized approval, never by a seat on
green.

## What changes

Two ADR additions, the shape the ADR's earlier amendments already use,
and one published-skill deletion:

1. **The status block** gains one `Amended` line (2026-10-14): D11's
external org-wide default is retired, and external visibility is the
ADR-0095 `EXTERNAL` rung, explicitly shared rows only. It points at the
note under D11.
2. **Under the D11 heading**, one amendment note, quoting the ruling's
sentence: external visibility is ADR-0095 / ADR-0099's `EXTERNAL` rung
(explicitly shared rows only, never OWD-derived); `externalSharingModel`
is retired (ADR-0049); when a portal or partner line is built, external
principals reach rows through explicit shares, relationship-based grants
(a sharing set: the records related to the principal's account or
contact — Salesforce's sharing sets, Power Pages' table-permission
scopes) and share links, from an identity pool separate from members.
D11's identity-pool text is kept, and the note says to read the bullets'
`externalSharingModel` and external-OWD clauses as superseded.
3. **`skills/objectstack-data/references/lint-rules.md`** loses its
`security-external-wider-than-internal` row (one line deleted): the
implementation PR removes that rule, and the skill ships with `npx
skills add`. A grep of the whole `skills/` tree for
`externalSharingModel`, `SECURITY_EXTERNAL_WIDER` and the rule id finds
no other line.

Not edited, on purpose: the D11 bullets themselves (the decision as
taken stays readable), the D11 summary line in the decision list near
the top, and the P1 phasing bullet that names `externalSharingModel`
among the pre-launch shapes. The amendment line and the note govern
both; if you prefer those two lines struck through as well, that is a
two-line follow-up in this same PR.

The implementation is the separate draft PR for #23268 (branch
`claude/issue-23268-retire-external-sharing-model`), which touches no
governed surface.

## 维护者速读(草稿)

**改了什么**
ADR-0090 的 D11 加了一条修订:状态栏新增一行"已修订",D11
标题下新增一段说明。内容是:外部用户(门户、合作伙伴)能看到哪些记录,由 ADR-0095/0099 已实施的 `EXTERNAL`
档决定,只认明确共享给他的记录,不看任何组织级默认;`externalSharingModel`
退役;将来真做门户或伙伴产品线时,外部用户通过显式共享、关系授权(共享集:与其客户或联系人相关的记录)和分享链接拿到记录,身份池与内部成员分开(D11
原有的身份池表述保留)。原 D11 条目不删,只标明被这段说明取代。
另外,对外发布的技能包 `skills/objectstack-data/references/lint-rules.md`
删掉了已随代码退役的 `security-external-wider-than-internal` 规则那一行,避免 AI
作者照着一条不存在的规则写元数据。

**为什么改**
您 10 月 14 日对 #23268 裁了 A(「23268 同意」):这个"外部可见性开关"作者能设、Studio
能显示,但从来不影响任何人的访问结果。D11 原文还写着"外部可见性 = 自己的记录 + 显式共享 + 外部 OWD",和已实施、有测试锁住的
ADR-0095 直接矛盾。代码侧的退役在另一个 PR 里;这份修订让决策记录和实际一致,消掉两份记录之间的矛盾。

**风险与代价(含回滚)**
纯文档改动,不改任何代码或运行行为,零运行风险。代价是 D11 的原文保留、加注取代说明,读者要读到那段说明才知道外部 OWD
已退役。回滚:撤销这个 PR 的提交即可,ADR 回到原状;但代码侧退役一旦落地,回滚这段文字会让记录重新和实现不一致。

**席位意见**


**你要做的(一个动作)**
读一遍 D11 下新增的那段说明,措辞同意就批准这个 PR。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/23268-skills-lint-rules-row.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the `objectstack-data` lint-rule reference drops `security-external-wider-than-internal`, retired with `externalSharingModel` (#23268)
+
+Clause-②: no
+
+The row named a rule `@objectstack/lint` 18 no longer has, and nothing an author writes changes.

docs/adr/0090-permission-model-v2-concept-convergence.md

@@ -3,6 +3,7 @@
 **Status**: Accepted (2026-07-09)
 · **Amended** (2026-10-13, ADR-0138 D3/D4) — D9's `guest` anchor bindings resolve for anonymous requests, in the organization ADR-0138 D4 resolves; an empty set denies all.
 · **Amended** (2026-10-14, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3/D13) — two of the row objects D3 renames into, `sys_position` and `sys_position_permission_set`, and the `sys_capability` D5 names, are retired by #15204 stage 8 (`66949b7729`, 2026-10-13): a position is a metadata-registry definition that names its sets in `PositionSchema.permissionSets`; `sys_user_position` stays. See the notes under D3, D5 and D8.
+· **Amended** (2026-10-14, ruling of record 6159300530 on #23268, letter A) — D11's external org-wide default is retired: external visibility is the [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) `EXTERNAL` rung, explicitly shared rows only. See the note under D11.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove),
 [ADR-0056](./0056-permission-model-landing-verification.md) (permission-model landing verification),
@@ -478,6 +479,17 @@ alias tax on every API.
 
 ### D11 — OWD gains an external dimension (`externalSharingModel`)
 
+> **Amended 2026-10-14 (ruling of record 6159300530 on #23268, letter A — the maintainer's 「23268
+> 同意」).** External visibility is [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md)
+> / [ADR-0099](./0099-posture-adjudicated-tiering-and-external-rung.md)'s `EXTERNAL` rung —
+> explicitly shared rows only, never OWD-derived — so `externalSharingModel` is retired (ADR-0049
+> enforce-or-remove; the schema refuses it with "delete the key"), and when a portal or partner
+> line is built, external principals reach rows through explicit shares, relationship-based grants
+> (a sharing set: the records related to the principal's account or contact — Salesforce's
+> sharing sets, Power Pages' table-permission scopes) and share links, drawn from an identity pool
+> separate from members (the pool below is kept). The bullets that follow record the decision as
+> taken; read their `externalSharingModel` and external-OWD clauses as superseded by this note.
+
 Portal and partner scenarios need the Salesforce insight: internal and external record baselines
 are **two different dials, and external must never be wider**. Decision:
 

skills/objectstack-data/references/lint-rules.md

@@ -20,7 +20,6 @@ Data-model rules (in addition to naming/label/i18n):
 | `object/missing-name-field` | suggestion | an object with no `nameField` (ADR-0079's canonical title pointer) and no name-like field (`name`/`title`/`subject`/`label`/`full_name`/`display_name`/`code`) |
 | `security-owd-unset` | error | an object published with no authored `sharingModel` (422 lint envelope; absence is not a decision) |
 | `security-owd-alias` | error | a legacy OWD spelling instead of the canonical four (ADR-0090 D4) |
-| `security-external-wider-than-internal` | error | `externalSharingModel` wider than `sharingModel` (ADR-0090 D11) |
 | `security-master-detail-ungranted` | warning | a `master_detail` child whose master carries no matching grant |
 
 > **`code` counts for R9, but is NOT a title-derivation key.** R9's name-like