Observation-class finding, recorded while implementing #7082 (PR #7346). Filed unassigned, no domain:* label — routing is the triage seat's call. Prose only; no behaviour is wrong and no assertion is affected.
Context
ADR-0094 D5-R (2026-08-09, #6858 / PR #6962) retired the 2026-07-14 direction that "an env-scope overlay is the platform's standard ADR-0005 customization of a packaged permission set, and deleting the overlay resets the row to the shipped declaration". #6483 / PR #6608 rolled permission back to allowOrgOverride: false, so the write 403s; #6960 measures the delete refusing too.
#7082 caught the copy in permission-set-projection.ts's function JSDoc. PR #7346 fixes that one plus four more inside packages/plugins/plugin-security. Sweeping the direction's phrasings across the repo (2026-07-14, standard customization, standard ADR-0005, delete = reset, resets the row, refuse-the-env-door) turned up two more outside that package, which #7346 deliberately did not widen into.
Measured on origin/main @ f3f855ac154f202fa9f1497abd3e0dff60436e1a.
1. packages/qa/dogfood/test/two-doors-permission.dogfood.test.ts:12-17 — the strong one
The file header states both retired halves verbatim, as current:
// 块2 — the ADMIN door (evolved by ADR-0094, direction 2026-07-14): a
// data-plane edit of a package-managed row is TRANSLATED into an
// env-scope metadata OVERLAY (the standard ADR-0005 customization) —
// the record projects the effective body while the package keeps
// owning the row, and "delete" resets to the shipped declaration.
Its own test body, ~60 lines down, already asserts the opposite and is correctly annotated:
:74 // ── 块2 — admin door: artifact-backed rows now REFUSE the overlay (#6483) ─
:75 it('块2: an admin edit of a package-managed set is refused — no env overlay is minted (#6483)', …
:76 // Pre-#6483 this edit became an env-scope overlay (ADR-0094's 2026-07-14
:77 // direction). `permission` has since rolled back to `allowOrgOverride: false` …
This is exactly #7082's shape — a corrected body under an uncorrected header — one file over, and it is the same silent-by-construction class as #6696 / #6842 / #6947.
2. docs/adr/0094-sys-permission-set-pure-projection.md:109 — the weak one
Inside the D2 section, describing the projector:
- upserts the record …; a PACKAGE-OWNED record's facets follow the effective
body too, with its `managed_by:'package'` + `package_id` provenance preserved
(see D5 — an env overlay is the standard customization of a packaged set);
D5's own heading is marked RETIRED 2026-08-09 — see D5-R, and the D5 body is history preserved on purpose. This line, however, restates the direction as a live parenthetical in a section a reader reaches first, with no retirement marker. Low harm (the pointer lands on a section that says RETIRED in its title), but it is the ADR contradicting itself in one document.
Lesser instance, listed for completeness, probably fine as-is: packages/qa/dogfood/test/showcase-permission-projection.dogfood.test.ts:21-23 header item 3 says "deleting an artifact-backed set RESETS it to the declared body". Its corresponding case at :122-125 already carries the #6483 annotation ("with the edit above refused, there is no overlay to lift — the delete is a no-op reset"), so the body is honest; only the header summary is loose.
What is NOT wrong
No behaviour, no assertion, no gate. Both dogfood suites pin the post-#6483 refusal correctly and would go red if it regressed. check:adr-anchors is green and stays green — measured under a deliberate mutation in PR #7346: it is a presence check (the file exists, each registered ADR id resolves to a record, each id still appears in the file) and by construction has no opinion about whether what a file says about an ADR is current. That gap is #7082's disposition B (a #6628-idiom currency pin), which was not dispatched and is not proposed here.
Refs: #7082 / PR #7346, #6858 / PR #6962 (D5-R), #6483 / PR #6608 (the rollback), #6609 (ruling A), #6960 (the delete measurement), ADR-0005, ADR-0094, #6628 (pin idiom), #6696 / #6842 / #6947 (same drift class).
Observation-class finding, recorded while implementing #7082 (PR #7346). Filed unassigned, no
domain:*label — routing is the triage seat's call. Prose only; no behaviour is wrong and no assertion is affected.Context
ADR-0094 D5-R (2026-08-09, #6858 / PR #6962) retired the 2026-07-14 direction that "an env-scope overlay is the platform's standard ADR-0005 customization of a packaged permission set, and deleting the overlay resets the row to the shipped declaration". #6483 / PR #6608 rolled
permissionback toallowOrgOverride: false, so the write 403s; #6960 measures the delete refusing too.#7082 caught the copy in
permission-set-projection.ts's function JSDoc. PR #7346 fixes that one plus four more insidepackages/plugins/plugin-security. Sweeping the direction's phrasings across the repo (2026-07-14,standard customization,standard ADR-0005,delete = reset,resets the row,refuse-the-env-door) turned up two more outside that package, which #7346 deliberately did not widen into.Measured on
origin/main@f3f855ac154f202fa9f1497abd3e0dff60436e1a.1.
packages/qa/dogfood/test/two-doors-permission.dogfood.test.ts:12-17— the strong oneThe file header states both retired halves verbatim, as current:
Its own test body, ~60 lines down, already asserts the opposite and is correctly annotated:
This is exactly #7082's shape — a corrected body under an uncorrected header — one file over, and it is the same silent-by-construction class as #6696 / #6842 / #6947.
2.
docs/adr/0094-sys-permission-set-pure-projection.md:109— the weak oneInside the D2 section, describing the projector:
D5's own heading is marked
RETIRED 2026-08-09 — see D5-R, and the D5 body is history preserved on purpose. This line, however, restates the direction as a live parenthetical in a section a reader reaches first, with no retirement marker. Low harm (the pointer lands on a section that says RETIRED in its title), but it is the ADR contradicting itself in one document.Lesser instance, listed for completeness, probably fine as-is:
packages/qa/dogfood/test/showcase-permission-projection.dogfood.test.ts:21-23header item 3 says "deleting an artifact-backed set RESETS it to the declared body". Its corresponding case at:122-125already carries the#6483annotation ("with the edit above refused, there is no overlay to lift — the delete is a no-op reset"), so the body is honest; only the header summary is loose.What is NOT wrong
No behaviour, no assertion, no gate. Both dogfood suites pin the post-#6483 refusal correctly and would go red if it regressed.
check:adr-anchorsis green and stays green — measured under a deliberate mutation in PR #7346: it is a presence check (the file exists, each registered ADR id resolves to a record, each id still appears in the file) and by construction has no opinion about whether what a file says about an ADR is current. That gap is #7082's disposition B (a #6628-idiom currency pin), which was not dispatched and is not proposed here.Refs: #7082 / PR #7346, #6858 / PR #6962 (D5-R), #6483 / PR #6608 (the rollback), #6609 (ruling A), #6960 (the delete measurement), ADR-0005, ADR-0094, #6628 (pin idiom), #6696 / #6842 / #6947 (same drift class).