Five more instances of the #8323 class: admin- and user-authored names on tenant-scoped objects still carry installation-wide unique indexes

[os-zhuang]

Found while implementing #8468 (the third instance), running the real lint rule over every platform object rather than reading declarations by eye. Not fixed there — #8468's scope is sys_position alone. Filed unassigned.

Per the maintainer ruling of 2026-08-13 on #8468, an instance of this shape inherits that answer and goes straight to the lane queue rather than back to the decision box. None of the five below carries a semantic argument for an installation-wide namespace; where one might exist I have filed separately instead (see "Related").

Why this contradicts the "closed set" claim on #8468

The #8468 triage comment stated that the sweep behind it had bounded the rest of the platform's objects, so "whatever is ruled here closes the class for the platform's own metadata rather than leaving a tail." That is not the case. The original sweep was a source read; this one executes lintUnscopedDeclaredIndexes from packages/lint/src/data-model-rules.ts over all 76 loadable *.object.ts definitions and cross-references each finding against resolveInjectedSystemColumns — i.e. the rule's own verdict, filtered by whether organization_id is actually injected.

The rule fires on the spelling alone and deliberately does no tenancy inference, so its raw output includes many legitimately-global better-auth objects. The tenancy filter is what separates them.

The five instances

All are tenant-scoped (organization_id injected, no tenancy opt-out) and declare a bare unique: true on a declared index over authored content — the positional spelling of 'global', i.e. the listed columns verbatim.

object	package	declared index	managedBy	authored by
sys_permission_set	plugin-security	{ fields: ['name'], unique: true }	config	admins, in Setup
sys_sharing_rule	plugin-sharing	{ fields: ['name'], unique: true }	config	admins, via the Studio criteria builder
sys_webhook	plugin-webhooks	{ fields: ['name'], unique: true }	config	admins, from the UI
sys_email_template	platform-objects	{ fields: ['name', 'locale'], unique: true }	config	admins
sys_notification_preference	service-messaging	{ fields: ['user_id', 'topic', 'channel'], unique: true }	system-data	per-user toggles

sys_permission_set is the strongest case and the most awkward one: it sits in the same directory as the two objects already fixed, and together with sys_capability and sys_position it is the third leg of the ADR-0090 RBAC triad. Its own header comment reads "tenants may add custom rows (created via UI / API) but the schema itself is locked" — the same sentence that made sys_position a defect. Two organizations cannot both have a permission set named sales_readonly.

sys_notification_preference is the near-exact analogue of the already-ruled sys_user_preference: same archetype (a per-user K/V row), same defect shape. Note that sys_user_preference is managedBy: 'system-data' too, so managedBy is not the discriminator — the ruling's phrase is admin-authored content, which is about provenance of the rows, not the management mode of the object.

Expected consequence

The same one measured on #8468 and #8323: a per-value 409 on a row the caller cannot read (a cross-tenant existence oracle over another organization's naming), plus a functional dead end — the second organization simply cannot use the name and the refusal does not say why. For sys_notification_preference the shape matches sys_user_preference's measured symptom instead: a user in two organizations cannot hold independent per-topic toggles.

⚠️ Not yet measured live per object. #8468 established that the static read is reliable for this shape by reproducing the oracle on a real engine, but the ruling's own discipline is that the probe comes first. Whoever takes this should run the 409/201 probe per object before migrating, exactly as #8468 did.

Fix shape (unchanged from #8461 / #8468, and free)

1. Respell each to unique: 'organization'.
2. The replace_unique_index migration arm generalized to declared indexes by fix(platform-objects,plugin-security,driver-sql): scope sys_user_preference and sys_capability uniqueness per organization (#8323) #8461 covers these unchanged — verified on sys_position in sys_position.name is the third instance of the #8323 class: an admin-authored name on a tenant-scoped RBAC object carries an installation-wide unique index #8468 with no modification to schema-drift.ts.
3. Check each object's published text for a uniqueness claim, as sys_position.name is the third instance of the #8323 class: an admin-authored name on a tenant-scoped RBAC object carries an installation-wide unique index #8468 had to (describe() plus the generated reference page).
4. ⚠️ The pin must exercise the deployed-installation migration path, not only a fresh database. Respelling changes the index's generated name, so on a deployed database drift otherwise reads as two findings — composite missing (safe) and old global index orphaned (destructive) — and an operator applying only the safe half keeps the defect while the plan reads as applied.

Related

• tenant-scoped objects get GLOBAL unique indexes: 409-vs-201 enumerates other tenants' values, and a user's preferences silently stop persisting in their second org #8323 / fix(platform-objects,plugin-security,driver-sql): scope sys_user_preference and sys_capability uniqueness per organization (#8323) #8461 — the class, ruled and fixed for sys_user_preference and sys_capability.
• sys_position.name is the third instance of the #8323 class: an admin-authored name on a tenant-scoped RBAC object carries an installation-wide unique index #8468 — the third instance (sys_position), where the ruling's standing consequence was recorded.
• ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082 — parked v18 D2 (bare true becomes 'global' plus a loud refusal).
• publish-time advisory: bare unique: true on a tenant-scoped object under group/isolated postures — point authors at the explicit 'organization' | 'global' choice #8379 — the publish-time advisory that would catch this at authoring time.

Found by session session_012WMpuAfA2KSdDjGF6tm1bH.

---

Generated by Claude Code

[hotlong]

Triage (triage seat Routine, 2026-08-13 ~20:10Z): confirmed as filed — pm:queue + type Bug set (the shape inherits the maintainer's 2026-08-13 ruling on #8468: it violates the declared tenancy contract, no fresh decision needed).

Routing — cross-domain exception path. The five objects span four packages in three lanes: plugin-security + plugin-sharing (identity), plugin-webhooks + service-messaging (services), platform-objects (metadata). Splitting five identical one-line respellings plus one shared migration-pin discipline into three lane cards would triple the overhead of a mechanical batch, so this stays one card under the sweep-batch rules. Designated claiming lane: domain:metadata — it holds the class lineage (#8323 → #8461 → #8468), the replace_unique_index arm knowledge, and the probe discipline. Conditions of the exception path apply: the claim comment must declare the full file surface (all four packages), and the claimer runs the targeted in-flight check against the identity and services lanes' open claims before starting.

Serial constraints for whoever claims:

• sys_setting's unique key is installation-wide on a tenant-scoped object — but unlike the #8323 class it has a real argument for staying that way #8555 touches platform-objects too (sys-setting.object.ts) — not the same batch as this card.
• sys_position.name is the third instance of the #8323 class: an admin-authored name on a tenant-scoped RBAC object carries an installation-wide unique index #8468 / PR fix(plugin-security,spec): scope sys_position.name uniqueness per organization (#8468) #8556 is in flight in the same directory family (plugin-security); clear it (merged or file-disjoint confirmed) before claiming, especially for sys_permission_set and any shared migration-pin fixtures.

Correction accepted, on the record: the #8468 triage comment claimed the sweep behind it had closed the class for the platform's own metadata. This card's executed-lint sweep (rule verdict × tenancy filter over all 76 loadable objects) proves that claim wrong — the earlier sweep was a source read, not a rule execution. The closed-set assertion is retracted; this card plus #8555's explicitly-triaged negative list is now the bounded set, and it is measurement-backed.

Dispatch expectations carry over from the ruling unchanged: live 409/201 probe per object first; the deployed-installation migration path is the load-bearing pin (per this card's ⚠️ on the orphaned-index split-plan hazard); check each object's published text for uniqueness claims.

---

Generated by Claude Code

[os-zhuang]

Claim

Claiming this card for implementation, under the cross-domain exception path the triage attached.

• Session: session_012WMpuAfA2KSdDjGF6tm1bH
• Branch: claude/issue-8554-unscoped-unique-indexes
• Worktree: ../objectstack-issue-8554, branched from origin/main @ bf1ea923e5 (which carries 6b441a84, PR fix(plugin-security,spec): scope sys_position.name uniqueness per organization (#8468) #8556)

Full file surface — all four packages, as the exception path requires

package	file	declared index today
plugin-security	packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts	{ fields: ['name'], unique: true }
plugin-sharing	packages/plugins/plugin-sharing/src/objects/sys-sharing-rule.object.ts	{ fields: ['name'], unique: true }
plugin-webhooks	packages/plugins/plugin-webhooks/src/sys-webhook.object.ts	{ fields: ['name'], unique: true }
platform-objects	packages/platform-objects/src/audit/sys-email-template.object.ts	{ fields: ['name', 'locale'], unique: true }
service-messaging	packages/services/service-messaging/src/objects/notification-preference.object.ts	{ fields: ['user_id', 'topic', 'channel'], unique: true }

Plus, expected but not yet certain: per-package declaration pins beside each object, one driver-level suite in packages/drivers/driver-sql/ for the live probe and the deployed-installation migration, published-text sources whose describe() / description / helpText carry a uniqueness claim (A3, to be surveyed per object), any content/docs/references/** page regenerated from those sources, and a changeset.

Note the card's table says sys_webhook is in plugin-webhooks, and it is — packages/plugins/plugin-webhooks/src/sys-webhook.object.ts. There is no platform-objects/src/system/sys-webhook.object.ts on current main; an older serial note (#8081, 2026-08-12) referenced that path.

Serial checks, run at claim time

• sys_position.name is the third instance of the #8323 class: an admin-authored name on a tenant-scoped RBAC object carries an installation-wide unique index #8468 / PR fix(plugin-security,spec): scope sys_position.name uniqueness per organization (#8468) #8556 — CLEAR. 6b441a842c verified present on origin/main by ancestry, not by the merged flag alone.
• Identity and services lanes' open claims — no overlap. All 9 open PRs enumerated and their changed files read where they could plausibly collide: feat(objectql,runtime,lint): tighten views: to the container-only contract; assembled manifests travel non-container view artifacts in viewItems: #8572 (objectql/runtime/lint — touches lint/src/validate-view-containers.ts, not data-model-rules.ts), fix(driver-sql): envelope the unbacked-conflict-target upsert refusal #8571 (driver-sql — touches sql-driver.ts + a new sql-driver-upsert-conflict-target-envelope.test.ts; I add a differently-named new test file and expect to touch neither sql-driver.ts nor schema-drift.ts), fix(metadata-protocol): gate a batch row's errors[].message on a declared client refusal #8569 (metadata-protocol), docs(adr): anchor the default-active-org session hook to ADR-0093 D9 (#8474) #8529/docs(pm-dispatch): fable quota-exhaustion exemption in Model tiering #8492/docs(pm-dispatch): references platform-facts sweep — seven measured reading rules #8490 (docs), fix(mcp): stdio bridge throws the shared RECORD_NOT_FOUND envelope #8507 (mcp), feat(gates): name the runtime-interface-only ADR-0087 disposition and check it (#8299) #8456 (gates), chore: version packages (rc) #6208 (release). None touches any of the four packages above. The services-lane card [services half of #7990] Close the datasource/connector credential write/read paths: scrub getDatasource().config, fix the false "credential-stripped" claim, and write the stored-cleartext-rows migration story #8081 landed as PR fix(service-datasource): stop serving stored credentials on the datasource read path, and fix the false "credential-stripped" claim (#8081) #8126 on 2026-08-12 and its follow-ups (turso: the bound secret is never read, so post-#8078 a new turso datasource cannot be authenticated by any supported route #8152–Migration story for stored cleartext datasource credentials: operator-initiated re-homing into sys_secret (blocked by the managed-schemaMode refusal) #8155) are service-datasource, disjoint.
• ⛔ sys_setting's unique key is installation-wide on a tenant-scoped object — but unlike the #8323 class it has a real argument for staying that way #8555 / sys-setting.object.ts — not touched. Not this batch.
• ⛔ packages/metadata-protocol/src/protocol.ts — not touched. Held by a sibling card.

Order of work

Per R2 the probe comes first, per object, with the prediction recorded before each run — the ruling's premise was established for sys_position, not for these five. If any object's probe contradicts the static read I will stop and report the fork here rather than migrating it or switching spelling.

⚠️ One thing already measured, before any edit, because it bears on the PM's assumption A1: sys_notification_preference's replacement index name would be uniq_sys_notification_preference_organization_id_user_id_topic_channel — 70 characters, past INDEX_NAME_MAX = 60 — so buildIndexName hash-suffixes it while the 54-character legacy name is emitted verbatim. The two composite cases are exactly where a single-column assumption would hide, and this one also lands on the name-truncation path. Reporting the measured behaviour of the replace_unique_index arm per object.

---

Generated by Claude Code