fix(platform-objects): state sys_job's uniqueness boundary as 'global' and correct its published claim (#8578)

[hotlong]

Fixes #8578

The reading, first — and it lands on 'global'

The card deliberately asserted no defect and named the one question that settles the direction:

does anything write sys_job rows per organization?

Nothing does. Five independent lines of evidence, all measured on origin/main:

1. The sole writer has no organization dimension. DbJobAdapter (services/service-job) is the only thing that writes this table — upsertJobRow on schedule(), setActive on cancel(), bumpJob after every run. All three write under SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] }, and all three locate their row with find('sys_job', { where: { name }, limit: 1 }) — keyed on name alone. The adapter already assumes the global key; a per-organization constraint would make that lookup ambiguous rather than fix anything.
2. The job metadata type is closed to tenants on all three flags — allowOrgOverride: false, allowRuntimeCreate: false, supportsOverlay: false. The registry comment states the deciding half in words: "no per-org job fork".
3. No generic write path exists at all. enable.apiMethods is ['get', 'list'] (ADR-0103 engine-owned) — reads stay open for the Setup grid, every write verb is absent, for every caller.
4. Every schedule() call site is registration-time and installation-scoped: AppPlugin on kernel:ready, JobServicePlugin replaying those registrations, the schedule / time-relative flow triggers (keyed on flowName, and flow is itself allowOrgOverride: false), the approvals and reports plugins' fixed names, and wait-node timers keyed flow-wait:{runId}:{nodeId} on a server-minted run id.
5. ADR-0120 already names this exact key. Its S5 row — "engine idempotency keys written by sudo (org NULL)" — lists sys_job.name first among the nine, with the After spelling 'global' and "zero drift". types/src/unique-scope-install-gate.ts names it twice more as platform-wide by construction.

So the card's first branch wins: sys_job is tenant-scoped only incidentally (organization_id is kernel-injected, never authored), the installation-wide constraint is correct, and the remedy is to state it explicitly plus correct the description that published the bare claim.

No third population turned up, so this did not need to go back to the decision box.

One thing worth flagging to the record

The card placed sys_job in category C (the defect class) as an open judgement case. ADR-0120's S5 inventory had already named sys_job.name as a platform-wide engine idempotency key — that is, the answer existed in an accepted ADR at filing time. This is not a criticism of the sweep (the lint rule fires on spelling alone and cannot see S5); it is a note that the next sweep of this class can cheaply pre-filter category C against ADR-0120 S5's nine-key list.

What changed

• packages/platform-objects/src/audit/sys-job.object.ts — declared index respelled unique: true → unique: 'global', and the name field's description corrected from the boundary-free "Unique job identifier (snake_case)" to text that names the installation-wide boundary. Both carry [#8578] comments with the reasoning.
• packages/platform-objects/src/apps/translations/*.objects.generated.ts — regenerated via node scripts/check-i18n-bundles.mjs --write. The en bundle is rewritten from source; the three translated locales still carried the old bare claim ("唯一任务标识" / "一意のジョブ識別子" / "Identificador único"), so their help values were updated to match the corrected meaning — the same shape as the sys_position locale fix. Values only; no key added or dropped.
• packages/platform-objects/src/audit/sys-job.global-unique.test.ts — new pin (10 cases).
• .changeset/sys-job-global-unique-scope.md.

Zero drift, no migration: 'global' is the semantics bare true already materialized, so the physical index stays (name) verbatim (ADR-0120 D2).

The pin guards the READING, not just the spelling

The card's bar asks for a test that fails if the opposite becomes true. Spelling assertions alone cannot do that — they would stay green on the day a per-organization write path opens, and the constraint would silently become wrong. So four of the ten cases pin the premises as doors that are currently shut: enable.apiMethods carries no write verb, job is closed on all three registry flags, flow is closed too (flow-derived job names would otherwise fork per org), and organization_id is genuinely injected (so the scope is a real choice, not an artifact of an absent column).

Reverse verification — direction predicted before each run

Leg 1 — ablate the spelling ('global' → bare true). Predicted: exactly 4 red (the three spelling assertions + the byte-identical shape), all four "doors" green. Observed, exactly:

× spells the scope 'global' — NOT bare `true`
× is not left as a positional default in EITHER direction (ADR-0120 D1)
× is a valid IndexSchema — the spec accepts the explicit vocabulary
× keeps the physical shape byte-identical (ADR-0120 D2 — zero drift)
Tests  4 failed | 6 passed (10)

Leg 2 — ablate the READING (flip job.allowOrgOverride to true in spec). This is the load-bearing leg. @objectstack/spec resolves through exports to built dist/ in this package's vitest config (only @objectstack/lint is aliased to src), so the ablation was rebuilt and the mutation proved in the artifact the test actually reads — dist/kernel/index.js showing allowOrgOverride: true — before running. Predicted: exactly 1 red, the reading pin. Observed:

× the `job` metadata type is closed to tenants on all three flags
AssertionError: expected true to be false
Tests  1 failed | 9 passed (10)

Both legs restored from the commit (git checkout HEAD -- with the path, never git stash), spec rebuilt, and the restore likewise proved in dist (allowOrgOverride: false) so no mutated artifact survives in the worktree.

Verification

All at final HEAD d474a66fb, after the last commit:

check	result
pnpm --filter @objectstack/platform-objects test	21 files, 390 passed
pnpm --filter @objectstack/platform-objects typecheck	clean
node scripts/check-i18n-bundles.mjs	OK — 9 packages, all bundles in sync
node scripts/check-nul-bytes.mjs	OK — 5796 files, no raw control bytes
pnpm check:changeset-gate-self-tests · check:objectui-changeset	pass
check-adr-0087-registration · check-changeset-no-major · check-empty-changeset	pass
pnpm check:query-options-erasure	ratchet holds, no files added
pnpm check:type-check-coverage	OK

Gate union re-derived with node scripts/pm/dispatch-gates.mjs $(git diff --name-only origin/main...HEAD) (three-dot). Beyond the prompt's predicted check:i18n it surfaced the five changeset-family gates plus check:query-options-erasure, check:type-check-coverage and check:type-check-debt — all run above.

check:type-check-debt deserves its own line. platform-objects excludes **/*.test.ts from its tsconfig, so pnpm typecheck never saw the new test file; the TEST_DEBT ratchet is frozen at 3 for this package. Re-measured with the exclusion lifted: exactly 3 errors, all pre-existing in feature-gate-guard.test.ts (TS2339 x2, TS7006 x1) — the new file contributes zero, so the ratchet does not move.

Deliberately not done

• sys_setting, and categories A and B are untouched — the card's three-category triage is its durable product and is not re-derived here.
• The nine category-B objects stay bare unique: true; they are correct today and owned by parked v18 ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082.
• No content/docs/releases/ edit.
• sys-account.object.ts and plugin-auth/** untouched ([security] sys_account.password and previous_password_hashes serialize on the generic data API — to admins cross-user, and to the user themselves #8676's surface). origin/main had not moved when this PR was opened, so the declared translation-bundle collision with [security] sys_account.password and previous_password_hashes serialize on the generic data API — to admins cross-user, and to the user themselves #8676 has not materialized; if that card lands first this branch will need a plain regeneration round.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 14, 2026 11:53pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects.

2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/plugins/packages.mdx (via @objectstack/platform-objects)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.