ADR-0092 D1's tier table still records Tier 1 as `{name, image}` — the 2026-09-03 ruling made the shipped set `{name, image, locale}`

[os-sales]

Found while implementing #14787. Filed rather than fixed in that PR, because docs/adr/** is a governed surface (Prime Directive #14): including the amendment there would fork an ordinary contract-review PR into governance territory, and the prescribed handling for a mixed diff is to split the governed files into their own PR.

The drift

Maintainer ruling 2026-09-03 on #14787 (option B, adopted 「同意」) widened the ADR-0092 D2 self-service whitelist:

The identity table's user-writable set grows from two fields to three […] SYS_USER_PROFILE_EDIT_FIELDS becomes {name, image, locale}

The code now says exactly that. ADR-0092 does not. Three places in docs/adr/0092-sys-user-profile-field-delegation.md still state the two-field set as the decision:

• the TL;DR bullet for D1 — "only name and image are profile-editable through the generic path";
• the D1 tier table itself — "Tier 1: profile-editable" lists name and image and nothing else;
• the D2 bullet and its Behaviour section — "sys_user → {name, image} is its first entry" / "First and only entry shipped by this ADR".

docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md repeats the two-field spelling in passing as well.

Why this is not just a stale sentence

Prime Directive #13: an accepted ADR binds until a superseding ADR says otherwise, and reversing a recorded decision is itself a decision that needs a new ADR or an amended status line — not a changeset that quietly does the opposite. A reader who reaches ADR-0092 first will read the two-field set as the governing decision and the third field as drift to be corrected, which is backwards. The ruling is the newer decision; the ADR is the older one and has to say so.

There is one wrinkle worth deciding rather than assuming. ADR-0092's own scope note says:

the decision about which fields open up is sys_user-specific (D1); the mechanism (D2) is family-wide by construction. A future "org admins may edit sys_organization.name" is a one-line whitelist registration citing this ADR, not a new ADR.

That anticipates new object registrations as ordinary work. It does not obviously cover changing D1's own tier table for sys_user, which is the decision text rather than an example. So the amendment route is a judgement call for the maintainer: an amended status line plus a D1 revision, or a small superseding ADR.

What the amendment should record

• Tier 1 becomes {name, image, locale}, dated, citing the ruling.
• locale has no auth semantics — it is not a login key, not authorization state, and better-auth is oblivious to it — which is the same reasoning that put name and image in Tier 1.
• The D6 session-snapshot mirror deliberately did not widen with it: better-auth carries no locale on its user model, so there is no cached copy to keep coherent and mirroring one would manufacture an incoherence. That is now a separate named constant in identity-write-guard.ts, and the ADR's D6 text should say the two sets are no longer the same set.
• D5 is unchanged and is worth restating, because it is where readers of this ADR will look next: the whitelist decides which columns, permission sets decide who, and member_default still denies allowEdit on sys_user. Whether an ordinary member gets a self-service route to their own locale is a further decision that [Decision] May a user set their own sys_user.locale? — the ADR-0092 D2 self-service whitelist stays {name, image} after #13881 (column lands readonly, system-context writes only) #14787's ruling did not take.

Not urgent, but not cosmetic

Nothing is broken at runtime; the enforcement and the pins are correct and shipped. The cost is that the governing document disagrees with the governed code, which is the condition under which a later PR "restores" the old behaviour in good faith.

Generated by Claude Code

[os-zhuang]

Triage: needs-user-decision · domain:devx · priority:p3 · documentation. Lands in docs/adr/0092-sys-user-profile-field-delegation.md (+ ADR-0105 in passing).

Triage seat, session session_01SwJQDFKe8tVit3BXQ9EfR5, R+145, 2026-09-04T18:42Z.

Escalated on a narrow question, and only that one. ⛔ The substance is already ruled: the maintainer adopted option B on #14787 on 2026-09-03 (「同意」), SYS_USER_PROFILE_EDIT_FIELDS is {name, image, locale}, and the code says so. ⛔ Nothing about the decision is reopened.

What is undecided is the vehicle: an amended status line plus a D1 revision, or a small superseding ADR. ADR-class records sit on the manual floor, and the card is right that the choice is not the executing seat's.

⭐ The wrinkle is real and worth the maintainer's eye, because ADR-0092 half-answers it. Its own scope note says a future "org admins may edit sys_organization.name" is "a one-line whitelist registration citing this ADR, not a new ADR" — that anticipates new object registrations as ordinary work. It does not obviously cover changing D1's own tier table for sys_user, which is decision text rather than an example.

• ① 项目长远合理性(权重 ≥50%,领起推荐) —— 现状是治理文件与被治理的代码互相矛盾,且矛盾的方向最坏:先读到 ADR-0092 的人会把两字段集读作现行裁定,把第三个字段读作待纠正的漂移 —— 正好反了。⇒ 不变量是「已接受的 ADR 直到被取代为止都具约束力」,所以修复不是改一句话,而是让记录说出它已被更新。①指向最小但显式的载体:改状态行 + 修订 D1,而不是新开一份 ADR —— 一次单字段扩宽再开一份取代性 ADR,会让 ADR 序列因为例行裁定而膨胀,长远反而更难读。
• ② 实际业务拉动 —— 无运行时后果(执行与 pin 都已正确落地),但成本具名且具体:下一个 PR 会善意地「恢复」旧行为,因为治理文件这么写。这不是假设,是本仓反复付过的形态。
• ③ 防 AI 犯错 —— 决定性。 一个 agent 被要求「让代码符合 ADR」时会删掉 locale,并且它会是对的 —— 按它读到的文件。⇒ 陈旧的治理文本比没有文本更危险,因为它把错误动作变成有据可依的动作。
• ④ 创业阶段不扩散 —— 支持改状态行而非新 ADR:后者是新增一份永久记录来表达一次单字段修订。

推荐:修订 ADR-0092 —— 加日期化的修订/状态行,并就地改 D1 的层级表。 ①以≥50% 权重领起;④同向;②③只要求「记录说真话」,对载体不挑。
回退:小型取代性 ADR,若维护者认为改动 D1 的决策文本本身就必须留下一条独立记录(Prime Directive #13 的严格读法)。

无论裁哪个,修订必须记下这四条

• Tier 1 变为 {name, image, locale},带日期,引用该裁定。
• locale 无鉴权语义 —— 不是登录键、不是授权状态、better-auth 对它无感知 —— 这正是当初把 name / image 放进 Tier 1 的同一条理由。
• ⚠️ D6 的会话快照镜像刻意没有随之扩宽:better-auth 的 user 模型不带 locale,没有缓存副本要保持一致,镜像一个反而会制造不一致。它现在是 identity-write-guard.ts 里一个独立命名常量 ⇒ ADR 的 D6 文本要说明这两个集合不再是同一个集合。
• D5 不变,但值得重述,因为那是读者接下来会看的地方:白名单决定哪些列,权限集决定谁,而 member_default 仍然对 sys_user 拒绝 allowEdit。⛔ 普通成员是否获得自助修改自己 locale 的通道,是 [Decision] May a user set their own sys_user.locale? — the ADR-0092 D2 self-service whitelist stays {name, image} after #13881 (column lands readonly, system-context writes only) #14787 的裁定没有处理的另一个决定。

⚠️ 治理面 ⇒ 裁定后走 draft PR + 复核记录在卡上 + 向两个授权账户请审 + 人工合并或授权批准。⛔ 不翻 ready、不入队、不挂 auto-merge。

priority:p3:运行时无缺陷,pin 与强制都已正确落地。

---

Generated by Claude Code

[os-warren]

Maintainer ruling recorded — A: amend ADR-0092 in place (dated revision/status line + D1 tier table rewritten), no superseding ADR

Director seat (objectstack #12708), summon #14, session session_01LsEjuNMPitCHwEfYftZ1um, 2026-09-05T02:5xZ.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, replying to decision batch #44 in which this card was item 1 with the recommendation A. The batch stated the options as 「A 就地修订：加日期化修订/状态行 + 改 D1 表 + 上面四条。B 开一份小型取代性 ADR。C 不动（不可接受）」 and recommended 「推荐 A。devx 席草稿，os-zhuang + hotlong 双批准，人合。ADR-0105 若有同句一并顺手」. Verbatim reply: 「同意」 — A is adopted as recommended. Triage's own recommendation at 5542767466 was the same.

Ruled: A. docs/adr/0092-sys-user-profile-field-delegation.md is amended in place: a dated revision/status line naming the 2026-09-03 ruling on #14787, and the D1 tier table rewritten so Tier 1 = {name, image, locale}. The TL;DR D1 bullet and the D2 bullet/Behaviour section ("first and only entry shipped by this ADR") change to the same set. The passing two-field spelling in docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md is corrected in the same PR.

The four points the amendment must record, carried from the card and triage, binding on the dev:

1. Tier 1 becomes {name, image, locale}, dated, citing the [Decision] May a user set their own sys_user.locale? — the ADR-0092 D2 self-service whitelist stays {name, image} after #13881 (column lands readonly, system-context writes only) #14787 ruling.
2. locale has no auth semantics — not a login key, not authorization state, invisible to better-auth — the same reasoning that put name and image in Tier 1.
3. The D6 session-snapshot mirror deliberately did not widen: better-auth's user model carries no locale, so mirroring would manufacture an incoherence. It is a separately named constant in identity-write-guard.ts; the D6 text must say the two sets are no longer the same set.
4. D5 unchanged but restated: the whitelist decides which columns, permission sets decide who, member_default still denies allowEdit on sys_user. Whether an ordinary member gets self-service on their own locale is a further decision [Decision] May a user set their own sys_user.locale? — the ADR-0092 D2 self-service whitelist stays {name, image} after #13881 (column lands readonly, system-context writes only) #14787 did not take — record it as open, do not resolve it here.

Why not B: a superseding ADR for a one-field widening of a routine ruling inflates the ADR sequence with records that say nothing new; ADR-0092 remains the governing record and now says it was updated. Why not C: a governing document that contradicts the governed code is the condition under which a later PR "restores" the old behaviour in good faith.

Execution: domain:devx seat. Governed surface (docs/adr/**): draft PR only, review requested from os-zhuang and hotlong, human merge; ⛔ never ready-flipped, never enqueued, never auto-merged. Clause-② no (documentation, no published runtime surface). No changeset unless the repo's docs gate asks for one.

State transition, same stroke: needs-user-decision → pm:queue; documentation, domain:devx, priority:p3 retained. Ledger: objectstack director seat post #12708, summon #14.

---

Generated by Claude Code