# Scope Floor

Status: v0, architecture-owned.

The platform scope floor is the closed set of named metamodel concepts that may
be treated as platform vocabulary. A floor entry admits only the concept name.
It does not decide package ownership, service ownership, wire shape ownership,
seed ownership, or whether a behavior belongs in L0 or L1.

Consequences:

- A concept on this floor still faces the L0/L1 tests in
  `docs/design/l0-l1-standard.md`.
- Salesforce API URL grammar, envelopes, payload layouts, and documented v63
  DTOs remain L1 dialect shape even when they mention a floor concept.
- CRM business objects such as Account, Lead, Opportunity, Contract, Campaign,
  and Order are not floor entries. They are L1 application-pack facts under the
  pure-platform target.
- The `Table*` constants are the namespace this document points into. They are
  not allowed to amend the floor by generation side effect.

Amendment procedure:

1. Open an architecture issue that names the proposed concept and the generic
   engine or metamodel rule that needs it.
2. Cite the affected L0/L1 standard tests, especially T2 and T3.
3. Update this file and the generated table inventory in the same PR.
4. Keep app-pack payload and product wire grammar out of the floor entry.

## Entries

| Entry | Scope |
|---|---|
| `AppMenuItem` | Managed setup concept for app navigation metadata. |
| `Dashboard` | Managed analytics resource concept. |
| `DashboardComponent` | Managed analytics resource concept. |
| `FieldPermissions` | Managed security metadata concept. |
| `Flow` | Managed automation metadata concept. |
| `FlowDefinition` | Managed automation metadata concept. |
| `FlowInterview` | Managed automation runtime concept. |
| `FolderShare` | Managed resource sharing concept. |
| `Group` | Managed identity and sharing concept. |
| `GroupMember` | Managed identity and sharing concept. |
| `MutingPermissionSet` | Managed permission metadata concept. |
| `Notification` | Managed notification concept. |
| `ObjectPermissions` | Managed security metadata concept. |
| `PermissionSet` | Managed permission metadata concept. |
| `PermissionSetAppVisibility` | Managed permission metadata concept. |
| `PermissionSetAssignment` | Managed permission metadata concept. |
| `PermissionSetCustomPermission` | Managed permission metadata concept. |
| `PermissionSetRecordTypeVisibility` | Managed permission metadata concept. |
| `PermissionSetGroup` | Managed permission metadata concept. |
| `PermissionSetGroupAssignment` | Managed permission metadata concept. |
| `PermissionSetGroupComponent` | Managed permission metadata concept. |
| `PermissionSetTabSetting` | Managed permission metadata concept. |
| `ProcessAction` | Managed approval/process metadata concept. |
| `ProcessDefinition` | Managed approval/process metadata concept. |
| `ProcessInstance` | Managed approval/process runtime concept. |
| `ProcessInstanceHistory` | Managed approval/process runtime concept. |
| `ProcessInstanceNode` | Managed approval/process runtime concept. |
| `ProcessInstanceWorkitem` | Managed approval/process runtime concept. |
| `ProcessNode` | Managed approval/process metadata concept. |
| `Profile` | Managed permission metadata concept. |
| `ProfileAppVisibility` | Managed permission metadata concept. |
| `ProfileCustomPermission` | Managed permission metadata concept. |
| `ProfileLayout` | Managed permission and layout assignment concept. |
| `ProfileTabSetting` | Managed permission metadata concept. |
| `QueueSobject` | Managed queue assignment concept. |
| `Report` | Managed analytics resource concept. |
| `ReportFolder` | Managed analytics folder concept. |
| `SharingRule` | Managed sharing metadata concept. |
| `User` | Managed identity concept. |
| `User.Password` | Managed identity credential field; create-time placeholder defaulting is platform identity-floor substrate for reset-flow bootstrap. |
| `UserRole` | Managed identity and sharing concept. |
| `_System_Action` | Platform action metadata table. |
| `_System_ActionFieldDefault` | Platform action metadata table. |
| `_System_ActionInputGuard` | Platform action metadata table. |
| `_System_ActionSchema` | Platform action metadata table. |
| `_System_ApiToken` | Platform personal access token table. |
| `_System_App` | Platform app metadata table. |
| `_System_ApplicationNavigationReceipt` | Runtime-owned exact-replay receipts for current application navigation, committed atomically with the document revision. |
| `_System_ApprovalPageLayout` | Platform approval layout metadata table. |
| `_System_ApprovalProcess` | Platform approval metadata table. |
| `_System_ApprovalWorkItem` | Platform approval runtime table. |
| `_System_AuditLog` | Platform audit table. |
| `_System_AuditOutbox` | Platform audit delivery table. |
| `_System_AutoNumberCounter` | Platform autonumber state table. |
| `_System_BulkBatch` | Platform bulk execution table. |
| `_System_BulkJob` | Platform bulk execution table. |
| `_System_BulkWorkGeneration` | Platform bulk-worker wake cursor; it is not work authority. |
| `_System_Comment` | Platform collaboration table. |
| `_System_Config` | Platform configuration table. |
| `_System_ConnectedApp` | Platform OAuth application table. |
| `_System_ConnectedAppAccess` | Platform OAuth application access table. |
| `_System_ConnectedAuthorizationRequest` | Platform per-user connector authorization state table. |
| `_System_ConnectedDeliveryJob` | Platform fenced one-shot external delivery job table. |
| `_System_ConnectedDeliveryPayload` | Platform insert-only connector payload snapshot table. |
| `_System_ConnectedPrincipal` | Platform per-user connected principal table. |
| `_System_ConnectedPrincipalToken` | Platform encrypted connected-principal token table. |
| `_System_ConnectorIngressControl` | Platform connector ingress admission control table. |
| `_System_ConnectorProjectionProtocol` | Controlplane-recorded immutable per-installation execution-protocol handoff and legacy-input admission cutoff; it does not certify historical execution success. [Architecture decision #4775](https://github.com/pingcap-inc/NexusCRM/issues/4775) (T2/T3). |
| `_System_ConnectorSchedulerLease` | Platform connector scheduler lease table. |
| `_System_ConnectorWorkItem` | Platform connector executable work queue table. |
| `_System_CustomPermission` | Platform permission metadata table. |
| `_System_EmailTemplate` | Platform notification template table. |
| `_System_ExternalDeliveryAttempt` | Platform external delivery audit table. |
| `_System_FeedItem` | Platform feed table. |
| `_System_Field` | Platform field metadata table. |
| `_System_FieldHistorySequence` | Platform field-history serialization authority table. |
| `_System_FieldHistoryTrackingInterval` | Platform field-history temporal eligibility ledger. |
| `_System_FieldDependency` | Platform field dependency metadata table. |
| `_System_File` | Platform file metadata table. |
| `_System_FileUploadOperation` | Platform file upload state table. |
| `_System_FlowActionCallHandler` | Platform flow action registry table. |
| `_System_FolderType` | Platform folder type metadata table. |
| `_System_GroupMembershipClosure` | Platform sharing closure table. |
| `_System_LayoutAssignment` | Platform layout assignment table. |
| `_System_ListView` | Platform list-view metadata table. |
| `_System_Log` | Platform log table. |
| `_System_LoginHistory` | Platform identity audit table. |
| `_System_Migration` | Platform migration state table. |
| `_System_MutingPermissionSetPermission` | Platform permission metadata table. |
| `_System_OAuthAuthorizeRequest` | Platform OAuth authorization table. |
| `_System_OAuthCode` | Platform OAuth authorization table. |
| `_System_OAuthConsent` | Platform OAuth consent table. |
| `_System_OAuthCustomScope` | Platform OAuth scope table. |
| `_System_OAuthDynamicClientRegistration` | Platform L2 administrator authorization registry for dynamic OAuth clients. |
| `_System_OAuthRefreshToken` | Platform OAuth refresh token table. |
| `_System_Object` | Platform object metadata table. |
| `_System_ObjectFieldMapping` | Platform object mapping metadata table. |
| `_System_OutboxEvent` | Platform outbox table. |
| `_System_PageLayout` | Platform layout metadata table. |
| `_System_PageLayoutHistory` | Platform layout history table. |
| `_System_Permission` | Platform permission catalog table. |
| `_System_PermissionAuthoringCommand` | Permissions-owned durable identity, canonical PermissionSet binding, and terminal outcome for one atomic authoring command. |
| `_System_PermissionAuthoringConvergence` | Permissions-owned pending work queue for durable post-commit authoring convergence; successful delivery removes the work item. |
| `_System_PermissionStateVersion` | Platform permission-state lineage, revision, and activation authority table. |
| `_System_PermissionSetPermission` | Platform permission metadata table. |
| `_System_ProfilePermission` | Platform permission metadata table. |
| `_System_Recent` | Platform recents table. |
| `_System_RecordShare` | Platform record sharing table. |
| `_System_RecordType` | Platform record-type metadata table. |
| `_System_RecordTypePicklistValue` | Platform record-type picklist metadata table. |
| `_System_RecycleBin` | Platform deleted-record state table. |
| `_System_Relationship` | Platform relationship metadata table. |
| `_System_RequestCapture` | Platform request capture table. |
| `_System_IntegrationOutboundCommand` | Integration-owned durable command, provider-delivery, and Runtime writeback lifecycle table. |
| `_System_RuntimeApprovalInvocation` | Runtime Approval invocation idempotency, exact serving binding, and same-transaction terminal business-result table. |
| `_System_RuntimeDelegationRevocation` | Runtime delegation revocation tombstones. |
| `_System_RuntimeFlowInvocation` | Runtime bounded Flow invocation idempotency, exact serving binding, and same-transaction terminal-result table. |
| `_System_RuntimeMailboxAuthorizationHandle` | Runtime-owned short-lived callback reauthorization authority bound to an exact session, Permission State floor, App installation, Catalog revision, and security epoch. |
| `_System_RuntimeOutboundIntent` | Runtime-owned neutral outbound-intent handoff and acknowledgement table. |
| `_System_RuntimeOutboundIntentGeneration` | Runtime-owned durable wake generation for outbound-intent consumers; work rows remain authoritative. |
| `_System_RuntimePlatformCommand` | Platform durable neutral command acceptance, idempotency, and terminal-result table. |
| `_System_RuntimeRecordCommand` | Platform durable record-mutation command identity and terminal-outcome table. |
| `_System_RuntimeRecordCommandOperation` | Platform per-operation record-mutation outcome table. |
| `_System_RuntimeSecurityBinding` | Runtime serving projection of workload and AppInstallation grants. |
| `_System_RuntimeSecurityLease` | Runtime replica security-epoch leases. |
| `_System_RuntimeSecurityState` | Runtime active per-Org security epoch. |
| `_System_RuntimeWorkFence` | Fixed keyed effect-fence slots drained atomically during Runtime work-family ownership transfer. |
| `_System_RuntimeWorkOwnership` | Platform durable work-family ownership epoch and fencing table. |
| `_System_Session` | Platform session table. |
| `_System_SetupAuditTrail` | Platform setup audit table. |
| `_System_SetupPage` | Platform setup navigation table. |
| `_System_StandardAction` | Platform action registry table. |
| `_System_StandardActionInternalAccessScope` | Platform action registry table. |
| `_System_SystemLog` | Platform system log table. |
| `_System_Table` | Platform physical table metadata table. |
| `_System_TeamMember` | Platform team membership table. |
| `_System_Theme` | Platform theme metadata table. |
| `_System_UIComponent` | Platform UI component metadata table. |
| `_System_UserObjectInteraction` | Platform user interaction table. |
| `_System_UserRecentItem` | Platform user recents table. |
| `_System_ValidationRule` | Platform validation metadata table. |
| `_System_Webhook` | Platform webhook metadata table. |
| `_System_WorkflowAlert` | Platform workflow notification metadata table. |
| `_System_ApprovalActionOutbox` | Platform approval action outbox table. |
| `_System_ApprovalActionLog` | Platform approval action terminal-outcome log table. |
| `_System_ApprovalSubmitLineage` | Platform approval submission lineage table. |
| `_System_ConnectedAppDeclaration` | Platform connected-app declaration table. |
| `_System_ConnectedAppStage` | Platform connected-app staging table. |
| `_System_ConnectorAccountServingGate` | Connector V2 per-account protocol-mode and monotonic-fence authority. |
| `_System_ConnectorCalloutProfile` | Platform connector callout profile table. |
| `_System_ConnectorCapabilityDeclaration` | Platform connector capability declaration table. |
| `_System_ConnectorCredentialGeneration` | Connector V2 immutable credential metadata, exact secret-backend version reference, canonical non-secret transport configuration, and deterministic owner receipt. |
| `_System_ConnectorCredentialGenerationDispatchGate` | Connector V2 per-generation dispatch eligibility and monotonic-fence authority. |
| `_System_ConnectorEvent` | Platform connector event table. |
| `_System_ConnectorInboundHandlerConfig` | Platform connector inbound handler config table. |
| `_System_ConnectorInboundProjectionSnapshot` | Platform connector inbound projection snapshot table. |
| `_System_ConnectorInboundRemoteIDEvidence` | Platform connector inbound remote-id evidence table. |
| `_System_ConnectorInboundRoute` | Platform connector inbound route table. |
| `_System_ConnectorIngressReceipt` | Platform connector ingress receipt table. |
| `_System_ConnectorPushAttempt` | Platform connector push attempt table. |
| `_System_ConnectorPushLinkRevalidationReceipt` | Platform append-only evidence for explicitly approved finalized-link mapping/body generation transitions; never a PATCH authority read path. |
| `_System_ConnectorRateLimit` | Platform connector rate-limit table. |
| `_System_ConnectorRemoteIdentityLane` | Platform serialization guard shared by connector remote-identity register, finalize, and recovery paths; never remote-identity authority. |
| `_System_ConnectorRemoteLink` | Platform connector remote-link table. |
| `_System_ConnectorRuntimeHandoffReceipt` | Integration-owned durable receipt for exact Runtime command handoff; Runtime never reads or writes it. |
| `_System_ConnectorServiceConfigurationAccount` | Connector V2 immutable whole-service configuration account member and exact source revisions. |
| `_System_ConnectorServiceConfigurationBinding` | Connector V2 immutable enabled binding configuration selected by exact Catalog-view ordinal. |
| `_System_ConnectorServiceConfigurationCredentialSelection` | Connector V2 immutable Catalog CredentialRef to exact credential-generation relation. |
| `_System_ConnectorServiceConfigurationGeneration` | Connector V2 immutable exhaustive whole-service configuration owner generation and deterministic receipt. |
| `_System_ConnectorServingEpoch` | Connector V2 exact verified execution-generation authority. |
| `_System_ConnectorServingEpochBinding` | Immutable exact Catalog binding-reference membership for one Connector V2 serving epoch. |
| `_System_ConnectorServingEpochReproducibility` | Connector V2 immutable one-to-one reproducibility header selecting the explicit digest profile and the service-configuration generation and receipt protocols that interpret one exact serving epoch's existing L2 owner fields. |
| `_System_ConnectorServingEpochBindingOwner` | Connector V2 immutable exact target-local PackGeneration coordinate and deterministic binding-definition owner receipt for one serving-epoch binding. |
| `_System_ConnectorServingEpochCredentialGeneration` | Connector V2 exhaustive per-epoch set of distinct exact credential-generation identities, protocols, transport digests, and deterministic owner receipts; contains no secret bytes. |
| `_System_ConnectorV2Execution` | Connector V2 immutable dependency-free execution generation, fenced claim authority, byte-stable Runtime resubmission input, and Runtime-result correlation receipt; contains no Runtime-owned outcome or result payload and grants no production claimant by itself. |
| `_System_ConnectorV2ExecutionAttempt` | Connector V2 append-only evidence for one execution claim ordinal, fence, holder, and lease; owns no semantic execution state, dependency, Runtime outcome, or provider-I/O fact. |
| `_System_ConnectorV2Receipt` | Connector V2 immutable encrypted admission receipt bound to one exact account-gate fence, active ServingEpoch, admission authority, payload digest, and component count; owns no claim or execution state. |
| `_System_ConnectorV2ReceiptAdmissionKey` | Connector V2 sole transport-idempotency authority mapping one exact connector-account/channel/transport key across serving-scope changes either to an immutable V2 Receipt or to a non-executable retained V1 acceptance tombstone. |
| `_System_ConnectorV2ReceiptComponent` | Connector V2 immutable encrypted deterministic component member, complete and ordinally ordered under the exact count committed by its parent Receipt; owns no event or execution state. |
| `_System_ConnectorWorkAttempt` | Platform append-only connector work-attempt outcome and typed-cause provenance table; blocked from direct access. |
| `_System_FlowAuditLog` | Platform flow audit log table. |
| `_System_InstalledPack` | Platform installed-pack registry table. |
| `_System_InstalledPackDependency` | Platform installed-pack dependency table. |
| `_System_PackActivation` | Platform single active-generation pointer for a named installed pack; it is the runtime activation read path, not a second metadata authority. |
| `_System_PackGeneration` | Platform immutable prepared/active/draining pack-generation registry addressed by `PackInstallId`. |
| `_System_PackGenerationConnectorBindingDefinition` | Platform immutable canonical Connector binding-definition member owned by one PackGeneration definition set. |
| `_System_PackGenerationConnectorBindingDefinitionSet` | Platform immutable completeness commitment for one PackGeneration-owned Connector binding-definition set. |
| `_System_ManagedComponentOperationEvidence` | Platform transaction-bound managed-component operation evidence table. |
| `_System_ManagedComponentTargetLock` | Platform permanent serialization targets for managed-component physical resource families; neither ownership nor commit evidence. |
| `_System_NamedCredential` | Platform named-credential table. |
| `_System_NamedCredentialSecret` | Platform named-credential secret table. |
| `_System_ParentLane` | Platform parent-key admission lane table. |
| `_System_PermissionSetAssignmentPolicyClaim` | Platform exclusive continuous assignment-policy authority for a Permission Set target. |
| `_System_PermissionSetAssignmentPolicyReleaseReceipt` | Deprecated, non-authoritative pre-activation receipt shape retained only for additive schema compatibility; no policy authority reads it. |
| `_System_PermissionSetAssignmentPolicySelector` | Platform normalized Profile selector table for continuous assignment policies. |
| `_System_PermissionSetAssignmentPolicyTargetReleaseReceipt` | Platform bounded proof that one logical assignment policy reconciled one exact physical target to exact-empty before releasing authority; identity is source plus target. |
| `_System_PermissionSetAssignmentPolicyTargetState` | Platform durable target-scoped generation, retry, resolution, and suspension state retained across assignment-policy release; eligible assignees share this state and remain separate Assignment rows. |
| `_System_PermissionSetAssignmentPolicyTombstoneReceipt` | Platform positive provenance binding an exact Assignment row and `(PermissionSetId, AssigneeId)` pair to a policy-authority soft delete. |
| `_System_RecordEventOutbox` | Platform record-event outbox table. |
| `_System_ReportType` | Platform report-type metadata table. |
| `_System_RollupDelta` | Platform rollup delta table. |
| `_System_ScheduledRunReservation` | Platform scheduled-run reservation table. |
| `_System_SyncState` | Platform connector sync-state table. |
| `_System_TriggerSubscription` | Platform trigger subscription table. |
| `_System_WebhookSecret` | Platform webhook secret table. |
| `_System_WebhookSecretValue` | Platform webhook secret value table. |
| `push_topic` | Platform push topic table. |

Connector remote-identity recovery owns its complete pessimistic transaction,
and protected conversion transfer is admitted only inside a complete Flow
pessimistic-retry owner. Recovery locks installed generation before source
records while conversion may already hold records before reading installed
generation; TiDB 1205 lock-wait or 1213 deadlock contention therefore rolls
back and replays the whole owning callback. Other errors are not covered by
this retry promise. Durable writeback finalization and transfer both lock a
remote link before its attempt row.