Post-hoc spec review: 29 PRs merged since 2026-11-06 changed packages/spec/src from a non-spec lane with no spec-seat review (spec red line)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ③ a task on the maintainer's word: 「该补审核的都要补」 (2026-11-08, triage's session), after the Fable review of #31424 found that #31334 (routed by triage to domain:devx) landed a packages/spec hunk as PR #31358 with no spec seat review. ⛔ Not a claim.

维护者速读

问题： 规则规定「触 packages/spec 的卡一律归 spec 席」（lanes/server.md L6；lanes/spec.md L9、L12），但实际执行中，server、skills、devx、ui、cloud 车道的 PR 常常顺手改 spec，没有经过 spec 席。
查了什么： 11-06 以来合入 main、改动 packages/spec/src 的 PR 共 56 个，其中 29 个的卡不在 spec 车道，而且 PR 和卡上都没有 spec 席的记录。另有 1 个（PR feat(spec): RestrictionProfileSchema, the closed shape of what a target environment does not let metadata do #31191）有 spec 席记录，已排除。
为什么是 p1： 这些协议改动已在 main 上，下次发版就会发布（「发版本优先的都p1」）。
要做的： spec 席逐个补审每个 PR 的 spec 改动部分。没问题的写一行「审过」；有问题的立修复卡。
根因不在本卡： 红线没有机械执行，分诊在定车道时也没有执行它。这一点已记在 [Decision] Keep domain:devx and domain:server as separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 的修正第 2 条下。

The list (spec hunk size from `git show --numstat`, `packages/spec/src` only)

Tier A, shape or contract changes (review first):

PR feat(spec,driver-sql,service-datasource): Oracle Database as a federation dialect — read live, write behind both opt-ins, never managed #31351 (driver-sql: Oracle as a federation dialect — an external datasource over Oracle Database reads (and, double opt-in, writes) live, with type-compat and the predicate emitters modelling oracle #31328, Oracle federation): 7 files +629 −15, data/datasource, data/config-registry
PR feat(spec,security): a controlled_by_parent object may declare an optional master #30940 (controlled_by_parent admits an optional master (1/3): spec, lint and the read owner branch: a null-master detail row is readable by its owner only #30905, controlled_by_parent optional master): 12 files +524 −128, conversions/*, data/*
PR feat(spec): a field group's requiresFeature hides the group where a deployment feature is off; Edit organization hides Parent Organization and Sort Order on one organization #30810 (Edit organization: hide Parent Organization and Sort Order on a single-organization deployment with a field-group requiresFeature #30692, field group requiresFeature): 5 files +232 −31, data/object.zod.ts, data/object.form.ts
PR feat(spec): a map settings specifier; the lifecycle retention overrides and quotas use it #31386 (Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208, map settings specifier): 2 files +175 −3, system/settings-manifest.zod.ts
PR feat(service-push)!: push sends through the hosted push relay, authenticated by the server's cloud binding #30749 (service-push: send through the hosted relay transport (push-relay.zod.ts wire, cloud binding credential) #29920, hosted push relay): 8 files +151 −48, api/push-relay.zod.ts, contracts/cloud-binding-service.ts
PR fix(i18n): a Traditional Chinese session reads and edits the Traditional entry of an inline label map #31068 (A Traditional Chinese console reads and writes the Simplified entry of an inline label map #30910, zh-Hant label resolver): 2 files +137 −24, ui/i18n-label-resolver.ts
PR feat(audit): record the administrator on writes made while impersonating a user #30800 ([Decision] Actions taken while impersonating a user are recorded only under that user #30213, impersonating administrator): 3 files +53 −2, kernel/execution-context.zod.ts, data/hook.zod.ts
PR feat(objectql): restore a recycle-bin entry under its original ids and emit data.record.restored (#30237 PR 3) #31220 (engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237, recycle-bin restore): 7 files +50 −24, api/events.zod.ts, error-code ledger
PR feat(messaging): store a push device's origin at registration and carry it in every push to the device #30705 (notifications: store the push device's origin on sys_user_device and copy it into push data (ruling B on #29642, server half) #29768, push device origin): 4 files +39 −17, system/push-device.zod.ts, api/protocol.zod.ts

Tier B, ledger, registry and contract-doc entries:

PR feat(objectql,spec): purge and empty the recycle bin, and delete a record for good (ADR-0148) #30990 (engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237): 3 files +39 −5, data/data-engine.zod.ts, data/hook-api.ts
PR feat(mcp)!: delete_record refuses a call without confirm: true #30861 (MCP delete_record refuses a call without confirm: true (ACTION_CONFIRMATION_REQUIRED), the run_action confirmation gate widened to deletes #30813): 3 files +50 −6, error-code ledger, contracts/ai-service.ts
PR feat(mcp): delete_records deletes many records of one object in one confirmed call #31024 (MCP: delete records by filter in one confirmed call, with refusals grouped by reason, instead of one delete_record per row #30891): 2 files +24 −10, error-code ledger, contracts/ai-service.ts
PR fix(audit): name the impersonating administrator on identity writes and on an approval decided while impersonating #30874 (Impersonation attribution follow-ups after #30213: plugin-auth identity writes and the approval resume decider segment #30851): 1 file +23 −3, contracts/automation-service.ts
PR feat(objectql,plugin-sharing): an organization authors its own assignment rules as sys_assignment_rule records #30760 ([Decision] Can an organization author its own assignment rules, or do they stay package-declared only? #30066): 3 files +18 −6, automation/assignment-rule.zod.ts, kernel/metadata-plugin.zod.ts
PR fix(service-storage): a member attaches a file from the browser again — the upload's own completion attaches it as them, after #31031 #31072 (no card): 1 file +18 −1, api/storage.zod.ts
PR fix(mcp, runtime)!: MCP describe_object answers the same field-masked object schema the /meta door answers (ADR-0106) #31042 (no card): 1 file +16, error-code ledger
PR feat(cloud-connection)!: refuse a managed upgrade that renames or retypes a stored field until it is declared or confirmed #31243 (Package upgrade plan: one framework comparison of installed vs new version (fields, types, renames, seeds) as a dry run; declared renamedFrom is planned, an undeclared rename or type change is refused unless confirmed (epic cloud#3652 Q3) #30884): 1 file +14, error-code ledger
PR feat(metadata-protocol, cloud-connection): an unmanaged install can take a target namespace #30997 (An unmanaged install can take a target namespace: the copy is re-namespaced at install through the duplicate-package rename engine #30794): 1 file +12 −1, api/package-lifecycle.zod.ts
PR fix(cloud-connection): name the cloud-binding service in its contract, and read an empty controlPlaneUrl one way #30956 (cloud-binding: name the service in its spec contract, and give controlPlaneUrl one reading of an empty option (follow-up to #29920) #30762): 1 file +10 −1, contracts/cloud-binding-service.ts
PR feat(rest)!: serve ?names= on the /meta/:type list and close its query set #30709 (Metadata API: no batch by-names read, so the Console roster gate costs one /meta/object request per name #29236): 2 files +8 −16, api/protocol.zod.ts
PR feat(objectql,platform-objects): keep a by-id delete's rows in the recycle bin (ADR-0148) #30780 (engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237): 2 files +5 −4, data/recycle-bin.zod.ts, platform object names
PR feat(spec,i18n): register the delete_package platform tool and label it in every pack (cloud#3656) #31037 (spec: PLATFORM_TOOLS_BY_PACKAGE['service-ai-studio'] lists delete_package, with chatbot.tool.delete_package labels in every ui locale (blocks cloud#3656) #31020): 1 file +5 −1, system/platform-tool-names.ts
PR feat(rest, client): a tenant-admin REST door for the record-currency code backfill #30809 (rest + sdk: tenant-admin door for the record-currency backfill — a REST twin of os migrate record-currency-codes, scoped to the caller's organization (multi-currency, epic #8345, ruling C item B) #30675): 1 file +2 −1, api/rest-server.zod.ts
PR fix(metadata-protocol,runtime): a seed row a person deleted is no longer inserted again by the next seed replay (per-organization record of landed seed keys) #31083 (seed loader: a declared seed row a person deleted comes back under a new id at the next seed replay — record landed keys per organization and skip the ones now absent #31021): 1 file +1, platform object names
PR feat(scripts): codemod-split-protocol --members moves the bodies E1 refuses, unedited, and retires nineteen protocol.ts facade rows #30954 (Facade codemods: retire the codemod-limit exception rows in the facade gate registry (protocol.ts, engine.ts, sql-driver.ts) #30147): 1 test file +3 −1

Tier C, JSDoc examples and describe text only:

PR docs(spec): guard the nullable amount in the docs examples and the validation condition example #31358 (docs: nullable record.amount compared unguarded in gated positions on nine more docs pages and the validation spec example (after #31206) #31334): data/validation.zod.ts +3 −3, plus the regenerated reference. This is triage's routing miss.
PR docs(skills): name ignore as the seed mode default and the minimal-preset job/queue exception; correct three capability comments #31377 (Platform skill and nearby code still misstate the minimal preset, the seed mode default and two capability comments #31299): kernel/platform-capabilities.ts +8 −8
PR docs(skills,spec): the fieldPatches example patches options only on a field that declares them, so HotCRM accepts it #30995 (skills+spec: the taught fieldPatches example patches crm_account.industry's options, but HotCRM's industry is picklist-bound, so a copy is refused at install #30944): data/object.zod.ts +7 −3
PR docs(skills, spec): guard the nullable amount in the approval-flow and hook-condition examples #31322 (skills + spec: approval-flow edge conditions in state-machines-and-approvals.md and the HookSchema.condition example compare a nullable amount unguarded, which the publish-time null-guard rule refuses #31206): data/hook.zod.ts +2 −2