# Shared Contract Plane Ledger

This ledger is the audit source for `shared/pkg/contract.Deps`. It is not a
permanent exemption list. A row means the plane is intentionally present in the
shared contract at this checkpoint, with its current ownership claim and the
next diet pressure point recorded.

Allowed verdicts:

- `keep`: the plane is a neutral seam today.
- `trim`: the plane is neutral enough to keep now, but its method set or
  consumers must be reduced as the remaining legacy callers disappear.
- `split-or-demote`: the plane is still transitional; preserve behavior, then
  move app-specific shape out or split the generic primitive from the L1 use.

When `contract.Deps` changes, update exactly one row in this table in the same
PR. Adding a plane without a row, deleting a plane without deleting its row, or
using a verdict outside the allowlist fails `shared/pkg/contract` tests.

| Plane | Verdict | Ownership note | Diet trigger |
|---|---|---|---|
| `Records` | keep | Generic CRUD and mutation over metadata-named records. | Split immediately if an app object branch appears. |
| `RecordMutationCoordinator` | keep | Generic coordinated mutation boundary for neutral record writes. | Fold into `Records` if the separate transaction seam stops carrying distinct behavior. |
| `RecycleBin` | keep | Generic deleted-record lifecycle and restore surface. | Keep only neutral record identifiers and timestamps. |
| `AuditLog` | keep | Generic audit-event read surface. | Move any product event envelope to L1 projection. |
| `Query` | keep | Neutral queryspec execution. SOQL syntax remains an L1 parser concern. | Reject wire pagination or SOQL carriers in this plane. |
| `BulkJobs` | trim | Neutral persisted bulk-job lifecycle. | Revisit with `BulkIngest` once legacy bulk doors are gone. |
| `BulkIngest` | trim | Neutral ingest job creation, upload, and execution. | Keep upload grammar and v63 job envelopes in L1 only. |
| `MetadataDeploy` | trim | Generic metadata apply/deploy substrate. | Split package grammar from deploy execution if non-CRM consumers cannot exercise it. |
| `Reports` | trim | Generic report execution and stored-definition access. Report wire/request adapters are L1-owned. | Continue shrinking after analytics legacy copies are deleted. |
| `FolderAccess` | trim | Generic resource-folder access checks used by report and dashboard resources. | Demote if folders remain CRM-only after app-pack extraction. |
| `ResourceAccess` | keep | Generic resource ACL grants and checks. | Product resource names must stay above the seam. |
| `UserSessions` | keep | Generic session and running-user lookup. | Keep route-specific auth envelopes out. |
| `Metadata` | keep | Generic metadata read model. | Product wire names and envelopes stay in L1. |
| `ListViewAuthoring` | keep | Generic private list-view authoring seam used by app packs without routing through generic `_System_ListView` CRUD. | Split immediately if app-specific list-view payloads or wire envelopes enter the shared contract. |
| `MetadataAuthoring` | trim | Generic metadata write model for objects, fields, layouts, rules, and actions. | Split oversized method groups after legacy authoring routes are gone. |
| `ApplicationNavigation` | trim | Generic navigation/app metadata authoring. | Move CRM app defaults to app-pack payload. |
| `MetadataMaintenance` | trim | Generic derived-metadata maintenance hooks. | Delete hooks that exist only for retired migration paths. |
| `RollupMaintenance` | keep | Generic rollup mutation plane that requires an exact server-serving attestation. | Keep transport syntax and product-specific error envelopes in L1. |
| `Policy` | keep | Single neutral access-decision read path. | Reject parallel permission read paths. |
| `Notifications` | trim | Generic notification send surface and host URL lookup. | Message templates and product actions must be metadata or L1. |
| `PermissionAdmin` | trim | Generic permission and assignment administration. | Split if setup-object CRUD becomes regular metadata authoring. |
| `ConnectorSyncStatus` | keep | Generic connector sync diagnostics. | Connector product shape remains in connector modules. |
| `ConnectorWebhookSecrets` | keep | Generic connector secret rotation and verification seam. | Keep provider-specific secret names above the seam. |
| `SearchScope` | trim | Generic search scope derived from metadata and policy. | Delete aliases that only serve v63 search grammar. |
| `Activity` | trim | Generic recent and relevant item surface. | Demote product activity semantics to app metadata. |
| `Files` | keep | Generic blob, version, and link substrate. | Keep v63 ContentVersion envelopes in L1. |
| `RecordAttachmentMetadata` | keep | Storage-free authorization and immutable metadata snapshot seam for record attachments selected before durable enqueue. | Fold into `Files` only if every enqueue owner can depend on the full file plane without constructing blob storage; keep product mail and file vocabulary above the seam. |
| `FlowExecutor` | keep | Generic flow runtime execution. | Flow wire syntax and product actions stay outside this plane. |
| `FlowCatalog` | keep | Generic flow discovery. | Keep product labels and route envelopes in L1. |
| `FlowInterviews` | keep | Generic flow interview lifecycle. | L1 owns v63 interview request and response shape. |
| `FlowAuthoring` | split-or-demote | Transitional Salesforce Tooling Flow authoring compatibility surface; `FlowCatalog`, `FlowExecutor`, and `FlowInterviews` remain the generic Flow planes. | Replace with a real neutral Flow authoring IR, then move Tooling sparse PATCH and `ProcessType`/`TriggerType` projection fully to the CRM dialect. |
| `Approvals` | keep | Generic approval runtime and pending-work surface. | Approval process facts remain metadata. |
| `StandardActions` | keep | Generic registry-backed standard-action resolution and invocation. | App-specific fallbacks stay in L1 dialects. |

The legacy `ResourceDocument` dependency was retired with REST discovery migration.
Authenticated document filtering and rate-limit inputs now cross the neutral
`runtime.identity.session-lifecycle.v1` read extension; AppService owns the document.