security/sharing stored references gain a package column, backfilled (R1, R3, R5, R6, R13) (ADR-0150 child S2) #31683

epic:#31527#1 · os-project-manager · session_01FEkQ5mLd7pR2PHjsPwiGkz

Filing gate: ④ coordination node: child S2 of the epic #31527 (parent and per-layer children), as ADR-0150 (docs/adr/0150-behavioural-metadata-addressed-by-package-objects-keep-the-literal-prefix.md, merged in #31586 at 5d1382a)'s execution plan lists it. Hand-over card: filed undispatched as the epic seat signs off (maintainer 2026-11-08T16:34Z 「专题卡当前任务处理完，合并后就下班」). ⛔ Not a claim.
Ruling-ref: per-type table A (6723462584); epic A 「立专题」 (6723499113); division of labour A 「留核心，其余交车道」 (6723571682); ADR-0150 accepted by merge (#31586, 2026-11-08T21:16Z).
Business reason: inherited from the parent #31527. Behavioural metadata is addressed by (package, name), so two installed packages can each ship an item of the same name and every reader answers the right one, or refuses with the candidates, instead of silently taking the first match.
Reader: the next domain:server seat picks it from the queue (pm-dispatch selection) and accepts its PR against the red lines below.
Dedupe (open AND closed): package column backfill security sharing (88; top hits #31527(open) #15194(open) #30806(open), none on point: they are this epic, its parent #30806, or unrelated cards).
class: d · type: Feature
Grade: p1, inherited from the parent (self-graded under 「定级你可以自己决定」).
Blocked-by: #31674
Blocked-by: #31675

维护者速读

安全和共享相关的存储引用加一列软件包，并回填。

What to build

Stored references R1, R3, R5, R6 and R13 (D8's table) gain a nullable package column beside the name, backfilled from the phase-1 holder; the ambiguous set is reported, never guessed; re-runnable.

Surface

• Expected file surface: plugin-security, plugin-sharing.
• Clause-②: no.
• Narrowing: no.

Acceptance — the epic's three red lines (every child shares them)

• Resolution never loosens. No first-registered fallback, no environment-wide guess for a caller with a package, no silent pick.
• Ambiguity is reported, never guessed. Every refusal and every migration report names every candidate.
• Independently releasable (red line 3). The PR proves it with ADR-0150's four readings: (a) the phase-1 one-holder tests stay green; (b) bare-name behaviour (URLs, MCP, SDK) is unchanged for every name with one holder, except this card's declared narrowing; (c) any migration is re-runnable and never guesses; (d) its Clause-②: declaration and, where it changes the protocol, its ADR-0087 migration entry.
• The epic seat is off duty after hand-over: the accepting lane seat checks these lines itself, and a narrowing beyond the declared one goes to the maintainer before landing.

Parent: #31527.