@@ -10,7 +10,7 @@ export const entry: SemanticMigration = {
     + 'and ship it through `publishPackage`',
   reason:
     'The `api` registry entry declared `allowRuntimeCreate: true` and the runtime never '
-    + 'honoured it. Measured on a real showcase boot (#5488): `PUT /api/v1/meta/api/'
+    + 'honoured it. Measured on a real showcase boot: `PUT /api/v1/meta/api/'
     + 'e8_backdoor` answered 200 with `{"success":true,…,"message":"Saved …"}`, and the '
     + 'declared route then answered 404 forever — with NO `[EndpointMatcher] … EXCLUDED` '
     + 'line, because the endpoint was never in the index to be excluded from. The serving '
@@ -24,19 +24,22 @@ export const entry: SemanticMigration = {
     + 'making the matcher read `sys_metadata` re-opens cache, invalidation, tenancy and '
     + "the ADR-0110 D3 miss-vs-outage distinction on a new read path, and there is no "
     + 'business pull for Studio-authored endpoints today (zero `.api.*` artifacts author '
-    + 'them at runtime; showcase uses the artifact route, #5040 E8 LIVE). '
+    + 'them at runtime; showcase uses the artifact route, and its declared endpoints serve '
+    + 'live). '
     + 'There is NO D2 conversion, for the reason this list exists: nothing in an authored '
     + 'source spells this key. `allowRuntimeCreate` is a PLATFORM registry value, not an '
     + 'authorable one, and the artifact route it points authors toward is untouched — a '
     + '`**/*.api.ts` file valid before this change is valid after it, byte for byte. What '
     + 'changed is a runtime HTTP verdict, so it is one semantic TODO for operators and '
     + 'Studio callers rather than a stack conversion — the same disposition '
-    + '`BatchOptions.validateOnly` (#4052) takes. Consequently `gateApiDraftsForPublish` '
-    + '(PR #5279) is retired with it: it gated a promotion into a state the matcher can '
+    + '`BatchOptions.validateOnly` takes. Consequently `gateApiDraftsForPublish` '
+    + 'is retired with it: it gated a promotion into a state the matcher can '
     + 'never read, and with the inlet closed no `api` draft can exist for it to judge. '
-    + 'Re-entry is recorded in the ruling: if #2657 Part B promotes `apis` to a registered '
-    + 'type WITH A REAL CONSUMPTION PATH, the flag flips back then — implementation first, '
-    + 'declaration second. ADR-0049 / ADR-0121, #5488 (subsumes #5311).',
+    + 'Re-entry is recorded in the ruling: if the Studio metadata-coverage work promotes `apis` '
+    + 'to a registered type WITH A REAL CONSUMPTION PATH, the flag flips back then — '
+    + 'implementation first, '
+    + 'declaration second. The same refusal closes the direct-active write too, which had been a '
+    + 'third path past the endpoint namespace and duplicate-path gates. ADR-0049 / ADR-0121.',
   acceptanceCriteria:
     'No caller creates or updates an `api` item through the runtime metadata API. '
     + '`PUT /api/v1/meta/api/{name}` answers 403 with `code: "NOT_CREATABLE"` and a body '
@@ -45,8 +48,8 @@ export const entry: SemanticMigration = {
     + 'as well as direct-active, because the gate runs before the draft/publish branch and '
     + 'does not read `mode`. ⚠️ Verify the artifact route is UNAFFECTED, which is the whole '
     + 'point of the change: a stack declaring `apis:` still compiles, still passes '
-    + '`validateApiEndpointDeclarations` at publish (`publishPackage`, #5189) and at load '
-    + '(`buildEndpointIndex`, PR #5203), and its endpoints still SERVE — that route was '
+    + '`validateApiEndpointDeclarations` at publish (`publishPackage`) and at load '
+    + '(`buildEndpointIndex`), and its endpoints still SERVE — that route was '
     + 'always the only one that served. An operator who genuinely needs the runtime door '
     + 'back on one deployment sets `OS_METADATA_WRITABLE=api`, the same single escape '
     + 'hatch `job` / `agent` / `capability` use; note that this unlocks the WRITE only, and '
 
@@ -39,8 +39,10 @@ export const entry: SemanticMigration = {
     + 'and `false` is authoring intent rather than a veto, because permission sets are '
     + 'additive capability containers (ADR-0090). The super-user bits no longer confer it: '
     + '`viewAllRecords` / `modifyAllRecords` are "may see all data", not "may take a bulk '
-    + 'copy". Registered by the #6350 stock reconciliation; #3544 / #3710 predate the #6148 '
-    + 'completeness gate. ADR-0087, #3544 / #3710 (backfilled #6350).',
+    + 'copy". Registered (backfilled) by the stock reconciliation that compared the breaking '
+    + 'changesets already on the v17 release train against this ledger: the export axis, and its '
+    + 'extension to the CSV attachments scheduled reports mail out, both predate the gate that makes '
+    + 'a breaking changeset state its ADR-0087 disposition. ADR-0087.',
   acceptanceCriteria:
     'Every environment-authored permission set has been READ and decided, not just parsed: '
     + 'each object entry whose holders should keep exporting carries `allowExport: true`, and '
 
@@ -19,7 +19,9 @@ export const entry: SemanticMigration = {
     + 'passed in, so the map carried a second copy of facts the caller already held. '
     + "They existed for exactly one consumer — the import dry run's hand-copied "
     + 'pre-check mirror (`firstMissingRequiredField` / `firstConstraintViolation`, '
-    + 'framework#3956) — and #4633 ruling D retired that mirror (PR #6532): the dry run '
+    + 'added when the dry run was found skipping the field-level validation the real write ran) '
+    + '— and the maintainer\'s 2026-08-06 ruling D (a validate-only protocol operation, so the '
+    + 'dry run\'s prediction is the engine\'s verdict by construction) retired that mirror: the dry run '
     + "now asks `DataProtocol.validateData` for the engine's verdict, which reads the "
     + "object's own schema. That left all eight computed on every import and read by "
     + 'NOTHING, which is the declared-and-unread shape ADR-0049 exists for; a constraint '
@@ -30,8 +32,8 @@ export const entry: SemanticMigration = {
     + "verify, plugin-auth, plugin-dev) and the `objectui` sibling; plugin-auth's "
     + 'identity import forwards `prepared.metaMap` into `runImport` but reads only the '
     + 'presentation keys through `coerceRow`. '
-    + 'Why this needs a ledger entry despite that sweep: it is the `findStream` (#4484) / '
-    + '`IStorageService.list` (#5540) / `actor-user-roles-to-positions` (#6011) '
+    + 'Why this needs a ledger entry despite that sweep: it is the `findStream` / '
+    + '`IStorageService.list` / `actor-user-roles-to-positions` '
     + 'disposition — a published TS surface with NO spec schema, so there is no '
     + '`retiredKey()` tombstone and no parse rejection that could carry a prescription, '
     + 'and the ledger is the only channel that reaches an upgrader. It is if anything '
@@ -45,7 +47,8 @@ export const entry: SemanticMigration = {
     + 'remain fully authorable on a field definition and fully enforced by the engine, '
     + 'which is where they always lived. The only place these eight are ever spelled is '
     + "inside a consumer's own TypeScript, so no `objectstack migrate meta` transform can "
-    + 'reach them. ADR-0049 / ADR-0087, #6536 (the sweep PR #6532 deliberately deferred).',
+    + 'reach them. ADR-0049 / ADR-0087; this is the removal the dry-run change deliberately '
+    + 'deferred to a sweep of its own.',
   acceptanceCriteria:
     'No code of yours reads any of the eight off a `buildFieldMetaMap` / '
     + '`prepareImportRequest` result. Grep your sources for `.required` / `.hasDefault` / '
 
@@ -12,7 +12,7 @@ export const entry: SemanticMigration = {
   reason:
     'The `field` registry entry declared `allowRuntimeCreate: true` and the platform never '
     + 'built a read path for it. Measured end-to-end through the real HttpDispatcher -> '
-    + 'ObjectStackProtocolImplementation -> SysMetadataRepository (#7893): '
+    + 'ObjectStackProtocolImplementation -> SysMetadataRepository: '
     + "`PUT /api/v1/meta/field/showcase_task.zz_probe` answered 200 with "
     + '{"success":true,"state":"active","message":"Saved field …"}, the row persisted, and '
     + '`GET /api/v1/meta/object/showcase_task` then listed fields = [title, status] with '
@@ -29,7 +29,8 @@ export const entry: SemanticMigration = {
     + '(a composition step that does not exist, ~20 `gate.fields` call sites, physical '
     + 'schema/migrations, and cold boot via `loadMetaFromDb`); if ever wanted it is a '
     + 'separate card — implementation first, declaration second. '
-    + '⚠️ This is NOT the #5488 (`api`) rationale reused: that ruling rested on "zero '
+    + '⚠️ This is NOT the `api` withdrawal\'s rationale reused (`api-runtime-create-withdrawn`): '
+    + 'that ruling rested on "zero '
     + 'business pull", and "add a field" is the opposite — a core Studio/CRM operation. The '
     + 'justification here is that the operation REMAINS AVAILABLE on the route that actually '
     + 'composes: `object` keeps `allowRuntimeCreate: true`, so what is withdrawn is a second, '
@@ -39,30 +40,30 @@ export const entry: SemanticMigration = {
     + 'authorable one, and no authored source changes — an `**/*.object.ts` file valid before '
     + 'this change is valid after it, byte for byte. What changed is a runtime HTTP verdict, '
     + 'so it is one semantic TODO for operators and Studio callers rather than a stack '
-    + 'conversion — the same disposition `api` (#5488) and `BatchOptions.validateOnly` '
-    + '(#4052) take. ADR-0049 / ADR-0087, #7893 (split from #7743).',
+    + 'conversion — the same disposition `api` and `BatchOptions.validateOnly` take. '
+    + 'ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No caller creates a standalone `field` item through the runtime metadata API. '
     + '`PUT /api/v1/meta/field/{object}.{name}` answers 403 with `code: "NOT_CREATABLE"` and '
     + 'a body naming both flags (`allowRuntimeCreate=false, allowOrgOverride=false`) and the '
     + 'prescription `PUT /api/v1/meta/object/:object with the new field in `fields``. The '
     + 'plural spelling `PUT /api/v1/meta/fields/{object}.{name}` folds onto the singular '
-    + '(#7894) and earns the same refusal — verify it, because it was a separate door until '
+    + 'and earns the same refusal — verify it, because it was a separate door until '
     + '2026-08-12. ⚠️ Verify the OBJECT route is UNAFFECTED, which is the whole point of the '
     + 'change: `PUT /api/v1/meta/object/{name}` with a new entry in `fields` still answers '
     + '200, and `GET /api/v1/meta/object/{name}` READS THE NEW FIELD BACK (assert on '
     + '`body.data.item.fields`, not `body.item`, which is undefined and makes an empty read '
     + 'look like a pass). Assert a DECLARED field is present in the same response, so a dead '
     + 'read cannot be what makes the check pass. '
-    + '⚠️ #7743\'s overlay refusal is untouched and must stay: overwriting a field a code '
+    + '⚠️ The field overlay refusal is untouched and must stay: overwriting a field a code '
     + 'package ships is still 403 `NOT_OVERRIDABLE`, a different gate for a different '
     + 'question — making field OVERRIDES legal was never part of this decision. '
     + 'DISPOSITION OF EXISTING ROWS: `field` rows already written through the retired channel '
     + 'stay in `sys_metadata` and are INERT — they were inert before this change too, since '
     + 'no read path ever composed them into an object, so nothing that used to work stops '
     + 'working and no data is silently reinterpreted. They remain self-readable by name and '
     + 'still report `_diagnostics.valid: true`, which asserts only that the isolated document '
-    + 'is well-formed (see #8169 — the envelope has no "in effect" axis). They may be deleted '
+    + 'is well-formed (the envelope has no "in effect" axis). They may be deleted '
     + 'at leisure: `deleteMetaItem` is deliberately NOT gated by this refusal, so repair stays '
     + 'possible. An operator who needs the write door back on one deployment sets '
     + '`OS_METADATA_WRITABLE=field`; note this unlocks the WRITE only — the field still will '
 
@@ -20,16 +20,18 @@ export const entry: SemanticMigration = {
     + 'different untyped object that does carry `roles`, tracked apart and unaffected). '
     + 'Both branches were therefore dead on '
     + 'every real engine path — an authorization decision in shape only, and a second admin '
-    + 'dialect competing with the one ADR-0090 D3 / ADR-0095 D3 sanction. #4839 (PR #5049) '
-    + 'removed the readers; this removes the declaration, per ADR-0049 enforce-or-remove. '
+    + 'dialect competing with the one ADR-0090 D3 / ADR-0095 D3 sanction. An earlier fix removed '
+    + 'both readers, returning the record lock and the delegation guard to the one permission '
+    + 'vocabulary; this removes the declaration, per ADR-0049 enforce-or-remove. '
     + 'This is a RUNTIME context, not stored metadata: the engine builds a HookContext per '
     + 'operation and nothing persists one, so no `sys_metadata` row, example or template '
     + 'can carry the key and there is no source for the D2 chain to rewrite — the '
-    + '`openApi31` (#4579) / `activationEvents` (#4657) shape, one semantic TODO rather '
+    + '`openApi31` / `activationEvents` shape, one semantic TODO rather '
     + 'than a stack conversion. The key IS tombstoned (`HookContextSchema` is deliberately '
-    + 'not `.strict()` — a plain delete would strip it silently, #3733 / ADR-0104), so a '
+    + 'not `.strict()` — a plain delete would strip it silently, as a removed field key was '
+    + 'measured to be, ADR-0104), so a '
     + 'consumer that parses a context it was handed still meets the prescription. '
-    + 'ADR-0049, #5050.',
+    + 'ADR-0049.',
   acceptanceCriteria:
     'No hook reads `ctx.session.roles`; caller gating uses `ctx.session.userId` / '
     + '`ctx.session.isSystem`, and privilege comes from the security service '
 
@@ -12,14 +12,16 @@ export const entry: SemanticMigration = {
     + "a global hook, `object: '*'` or no `object` key at all; for a cancelled scope, widen "
     + '`object` or drop the overlapping names from `excludeObjects`',
   reason:
-    '#4281 ruled that an empty hook target is not "no target" and closed the shape at the '
+    'An earlier breaking fix established that an empty hook target is not "no target" and '
+    + 'closed the shape at the '
     + "two METADATA doors — `HookSchema.object`'s refine and `hook-binder.ts`'s "
     + '`normalizeObjects`. `engine.registerHook`, the CODE door, goes through neither, so '
     + 'all three spellings still registered, each producing a defect the author did not '
     + "write: `''` is FALSY, so the allow face was skipped entirely and the entry became a "
-    + "GLOBAL hook (#4281's headline failure mode — blank intent taking the broadest "
+    + "GLOBAL hook (that fix's headline failure mode — blank intent taking the broadest "
     + "possible blast radius); `[]` and `['']` are truthy but admit no object name, so the "
-    + 'entry could never fire. #5928 then added the `excludeObjects` face, which brought a '
+    + 'entry could never fire. The later `excludeObjects` face (a hook global except for the '
+    + 'objects it names) then brought a '
     + 'fourth shape reached by arithmetic rather than by one bad name: an `object` list '
     + 'every member of which is also excluded admits nothing, so that entry can never fire '
     + 'either. All four are ADR-0078 silently-inert declarations, and all four are now '
@@ -31,7 +33,7 @@ export const entry: SemanticMigration = {
     + "the MATCHING read be changed instead: teaching the matcher that `''` is an "
     + 'unmatchable name would silently convert a hook firing on every object into one '
     + 'firing on none — the same class of defect pointing the other way, which is why '
-    + '#5928 declined to do it in passing.\n\n'
+    + 'the `excludeObjects` change declined to do it in passing.\n\n'
     + 'This is a RUNTIME registration API, not stored metadata, so — like '
     + '`hook-context-session-roles-retired` at this step — there is no `sys_metadata` row '
     + 'for the D2 chain to rewrite and the ledger entry is the notification channel. One '
@@ -41,8 +43,7 @@ export const entry: SemanticMigration = {
     + 'a blank `objectName` used to bind a trigger to EVERY object in the tenant. It now '
     + "fails to bind instead, loudly — the automation engine's per-flow bind guard warns "
     + 'and the `kernel:bootstrapped` binding audit re-reports it — which is the correct '
-    + 'end state, but it is an observable change for that flow. #6573, #4281, #4001, '
-    + '#5928, ADR-0078.',
+    + 'end state, but it is an observable change for that flow. ADR-0078.',
   acceptanceCriteria:
     'No `registerHook` call site passes an empty `object` target, and none passes an '
     + '`excludeObjects` list covering every name in its `object` list. Every `record-change` '
 
@@ -20,7 +20,8 @@ export const entry: SemanticMigration = {
     + 'the request schemas of both read doors, the install / uninstall / upgrade / rollback shapes, '
     + '`PackageApiErrorCode` — stays on `@objectstack/spec/api`.',
   reason:
-    'Maintainer ruling on #18576 (batch #145 item 1, letter B, 「同意,其他也同意」): split the API entry '
+    'Maintainer ruling of 2026-09-17, option B (narrow the entry, rather than add a bundle-weight '
+    + 'rule to the browser-reachability ledger or accept the weight as it stood): split the API entry '
     + 'so its browser-facing half no longer carries the assembled-package declarations. Those five embed '
     + 'the ASSEMBLED package body, which reaches the whole metadata vocabulary and, behind it, the '
     + 'datasource declaration and the driver-config validators; declared inside `@objectstack/spec/api`, '
 
@@ -7,7 +7,7 @@ export const entry: SemanticMigration = {
   surface: 'EnhancedApiError.retryAfter (api/errors.zod.ts) — the ADR-0112 error envelope on the wire',
   replacement: 'retryAfterSeconds — rename the key; the value (seconds) is unchanged',
   reason:
-    'Maintainer ruling B on #14478 (2026-09-02, decision batch #43): the unit of a duration-shaped z.number() lives in the key NAME or in a unit-carrying value, never only in the describe prose, and no existing offender is grandfathered. '
+    'Maintainer ruling B of 2026-09-02 on duration-shaped keys: the unit of a duration-shaped z.number() lives in the key NAME or in a unit-carrying value, never only in the describe prose, and no existing offender is grandfathered. '
     + 'BREAKING ON THE WIRE, and ruled in deliberately: the ruling puts the ~16 runtime-emitted '
     + 'measurements in scope because they are read by humans and agents even if nobody authors '
     + 'them, and names ApiError.retryAfter explicitly, with its own BREAKING note. The ambiguity '
@@ -21,7 +21,7 @@ export const entry: SemanticMigration = {
     + 'green grep for `retry-after` in transport code as leftover work. A SEMANTIC entry rather '
     + 'than a D2 conversion because an error envelope is emitted, never stored: it is not a stack '
     + 'collection member and never a sys_metadata row, so the conversion chain has no seam that '
-    + 'would see one. #15677, #14478, ADR-0087, ADR-0112.',
+    + 'would see one. ADR-0087, ADR-0112.',
   acceptanceCriteria:
     'No producer emits `retryAfter` on an ApiError envelope and no consumer reads it; the old '
     + 'spelling is a retiredKey() tombstone that fails tsc at the construction site and fails the '