docs(changeset): the admin-audit changeset notes that rows written before the release keep their metadata (#21198)

[objectstack-fleet]

Refs #21198
Clause-②: no

This PR edits a pending changeset it did not add, on the maintainer's confirmation (ruling 5942375063, 「同意264」), so Check Changeset is red by design under #17712. That job is not a required context (the seven in scripts/check-required-contexts.mjs REQUIRED_CONTEXTS, line 368, do not name it; AGENTS.md:518-522 lists the same seven) and it does not run on merge_group (.github/workflows/pr-automation.yml:41-43 triggers on pull_request only; the file has zero merge_group occurrences). The job's own text says the red is the point (pr-automation.yml:728-730). No label and no changeset of this PR's own is added to turn it green.

The change

One sentence, appended to the last paragraph of .changeset/21174-admin-audit-metadata.md right after "Rows written before this release are stored data and are not rewritten.":

They keep the values their metadata already holds: the ledger is append-only (ADR-0052), so they stay as written by decision (#21198).

1 file, +1/-1. No other line of that file and no other file changes.

Why

Ruling 甲 on #21198 (comment 5942375063), Execution section:

No code. The note owed: if #21174's changeset (PR #21195) has not shipped yet, the domain:services seat adds one sentence to it saying that rows written before this release keep their metadata (ruling 甲 here). This record is the maintainer's word for that edit of a pending changeset. If it has shipped, this record is the note.

Premise checked on origin/main at 4e6dc2338: the changeset is still on main and packages/plugins/plugin-auth/CHANGELOG.md has no 21174 hit, so no release has consumed it. PR #21195 merged as 55012df30. None of the 16 open PRs at the time of the check (the Version Packages PR #20639 included) lists the file. The card stays shut as not_planned; this PR carries no closing keyword for it.

Wording check

• "the ledger is append-only (ADR-0052)": docs/adr/0052-audit-is-not-the-activity-feed.md:36 reads "sys_audit_log (immutable, append-only, retained, security-gated)", and :80 reads "immutable, compliance-grade". The code declares it too: packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:22 has managedBy: 'append-only'.
• "stay as written by decision (decision(plugin-auth): sys_audit_log rows the admin identity endpoints wrote before #21174's fix still carry user-field values in free metadata. Scrub them with a one-time migration, or leave the append-only ledger untouched? #21198)": the ruling's headline is that the sys_audit_log rows written before the security(plugin-auth): the compliance-ledger row an admin create-user writes carries a withheld user field's value in its decision metadata, which a ledger reader withheld that field is served #21174 change stay as they are, and that no one-time migration rewrites them.
• The sentence says nothing about who is served those rows; the read-side gates are changing in other PRs.

Gates

Run at head 98cd8b924, from node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (19 commands, no paths):

• 18 of 19 exit 0 (the ADR-0087 registration and no-major gates, the closing-keyword parity gate, check:nul-bytes, check:published-files, check:changeset-gate-self-tests among them).
• node scripts/check-empty-changeset.mjs --base origin/main exits 1: it prints "This PR changes a changeset it did not add" for .changeset/21174-admin-audit-metadata.md. That is the by-design red above and the only red.
• Reconciliation: "Run reconciliation — 19 derived, 19 run, 0 NOT-MEASURED, 0 UNRUN."
• Outside the derivation, also run and green: the changeset roster gate check-changeset-fixed.mjs (its roster lives under .changeset) and pnpm check:required-contexts ("7 required context name(s) pinned").
• Not run locally: repo-wide scans and the type-check lanes, which CI owns; this diff touches no TypeScript.

Acceptance notes

• ADR-0052's own status line (docs/adr/0052-audit-is-not-the-activity-feed.md:3) reads "Proposed (2026-06-16) — partially implemented", while the ruling calls it accepted. The sentence cites the ADR only for the property it declares (the ledger is append-only), not for the ADR's status, so it stays true either way. Noted, not edited: docs/adr/** is a governed surface and outside this card.
• If a release consumes the changeset before this lands, the ruling record is the note and this PR is dropped unmerged.

---

Generated by Claude Code

[objectstack-fleet]

Record for the landing rule: Check Changeset is red on this PR by design.

• Gate: Check Changeset (job changeset-check in .github/workflows/pr-automation.yml).
• Cause: this PR deliberately edits a pending changeset it did not add, .changeset/21174-admin-audit-metadata.md (one sentence appended). The foreign-changeset gate refuses that by construction (finding: random changeset filenames collide silently across parallel agents — a round overwrote a sibling PR's minor changeset and every gate stayed green #17712); its route 0 says to leave the check red and put the confirmation on the PR (pr-automation.yml:728-730). The skip-changeset label is not applied and no changeset of this PR's own is added.
• Confirmation: ruling 5942375063 on decision(plugin-auth): sys_audit_log rows the admin identity endpoints wrote before #21174's fix still carry user-field values in free metadata. Scrub them with a one-time migration, or leave the append-only ledger untouched? #21198, maintainer 「同意264」: "This record is the maintainer's word for that edit of a pending changeset."
• Why the red does not block: Check Changeset is not among the seven required contexts (scripts/check-required-contexts.mjs, REQUIRED_CONTEXTS), and pr-automation.yml triggers on pull_request only, so the job does not run on merge_group.
• Anything else red is not covered by this note and would be a defect of this PR to diagnose.

---

Generated by Claude Code

[objectstack-fleet]

Closing unmerged: the changeset this PR edits has shipped. · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-02T02:46Z

.changeset/21174-admin-audit-metadata.md was consumed by the version commit 617f25f8a ("chore: version packages (#20639)"). It is gone from origin/main, and its entry now sits in packages/plugins/plugin-auth/CHANGELOG.md:81. That entry ends "Rows written before this release are stored data and are not rewritten.", which is true, so no correction is owed. This PR's one sentence has nowhere to land.

Ruling 5942375063 on #21198 named this case: "If it has shipped, this record is the note." The execution claim 5944467576 said "this PR closes unmerged". Release notes are release-owned and are not edited from here.

Also recorded: no CI ever ran on this PR (its opened event was lost; zero workflow runs on 98cd8b924). It never needed to run.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ