@@ -8,7 +8,9 @@ export const entry: SemanticMigration = {
   replacement: 'bare AnalyticsQuery body (top-level cube/measures/dimensions/where/...)',
   reason:
     'The { cube, query: {...} } envelope was an HTTP-wire dialect of the retired degraded ' +
-    'analytics shim (#3891), never stored in stack metadata — there is no source for the ' +
+    'analytics shim (the fallback that answered /analytics/query when no analytics service ' +
+    'was installed, and dropped the caller\'s identity and its `where` filter at the door), ' +
+    'never stored in stack metadata — there is no source for the ' +
     'chain to rewrite. Callers of POST /analytics/query and /analytics/sql must move the ' +
     'query.* fields to the body top level themselves.',
   acceptanceCriteria:
 
@@ -23,8 +23,9 @@ export const entry: SemanticMigration = {
     + 'on every deployment, and still is — what changed is that the contract no longer '
     + 'promises otherwise',
   reason:
-    'Maintainer ruling 2026-08-12 (#7675), the retirement half of a two-half verdict: the '
-    + 'cheap writers get built (#8144 login/logout, #8145 config_change) and the enum '
+    'Maintainer ruling 2026-08-12 on the audit log\'s writerless actions, the retirement half '
+    + 'of a two-half verdict: the cheap writers get built (`login` / `logout` on the auth '
+    + 'session hooks, `config_change` from the settings service) and the enum '
     + 'values with no feature behind them are retired. 原则记录:空 widget + 永远查不到东西的'
     + '过滤器是可见产品缺陷;审计面宁窄勿谎. '
     + 'The defect was false compliance on a COMPLIANCE surface, which is the sharpest form '
@@ -54,7 +55,7 @@ export const entry: SemanticMigration = {
     + 'on this object at all (`validateRecord` skips `readonly` fields, and every field '
     + 'here is readonly), so nothing rejects stored history and no backfill is required or '
     + 'wanted. Deleting audit history to satisfy a schema narrowing would be the one '
-    + 'genuinely destructive reading of this change. ADR-0049 / ADR-0087, #8147.',
+    + 'genuinely destructive reading of this change. ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No consumer filters `sys_audit_log` on `action = "export"` or '
     + '`action = "permission_change"` expecting rows: both were empty everywhere before '
 
@@ -24,10 +24,11 @@ export const entry: SemanticMigration = {
     + '`sys_audit_log` on this value was reading an empty result set on every deployment, '
     + 'and still is — what changed is that the contract no longer promises otherwise. If '
     + 'you were counting on a restore trail, the capability itself is the missing piece '
-    + '(#1883, #3146), not this enum row',
+    + '(an undelete / purge permission lifecycle and a soft-delete recycle bin, neither built '
+    + 'yet), not this enum row',
   reason:
     'The same maintainer ruling as `audit-log-action-enum-retired`, carried to the one '
-    + "value #7675's own survey did not name (#8315, triage 2026-08-13). 原则记录:空 "
+    + "value that ruling's own survey did not name (triage 2026-08-13). 原则记录:空 "
     + 'widget + 永远查不到东西的过滤器是可见产品缺陷;审计面宁窄勿谎. '
     + '`restore` is the least ambiguous member of the family: the record-level writer '
     + "could not have produced it even by accident, because `actionFor()` in "
@@ -37,7 +38,8 @@ export const entry: SemanticMigration = {
     + 'asserted the opposite, so a declaration-reading audit scored the action as '
     + 'covered: the `writes_only` list view offered it as a filter value, and the module '
     + 'docblock of auth-event-audit.ts named it among the actions the writer emits. The '
-    + 'comment is the ADR-0049 declared-≠-enforced shape in its purest form (#8011) — a '
+    + 'comment is the ADR-0049 declared-≠-enforced shape in its purest form (the shape a '
+    + 'credential-storage audit had to settle by re-measuring two "hashed at rest" comments) — a '
     + 'sentence next to a mechanism, contradicted by the type signature of that very '
     + 'mechanism, with nothing in CI able to tell. Both declarations are corrected in one '
     + 'change, and the invariant behind the comment (every declared action has a writer) '
@@ -50,16 +52,16 @@ export const entry: SemanticMigration = {
     + 'field is `readonly: true`, so nobody authors an audit row and nobody authors this '
     + 'enum. '
     + '⚠️ This is a statement about the WRITER, not a product stance against undelete. '
-    + 'Soft delete/restore is parked, not rejected (#1883 pm:on-hold, #3146 '
-    + 'status:parked). If that capability lands, this value returns WITH its writer — the '
+    + 'Soft delete/restore is parked, not rejected: the undelete / purge lifecycle and the '
+    + 'recycle bin are both held open, not declined. If that capability lands, this value '
+    + 'returns WITH its writer — the '
     + 'emission point, its tests, and the view that surfaces it — never as a bare enum '
     + 'row again. '
     + '⚠️ Historical ROWS are deliberately untouched, exactly as for the sibling entry: '
     + 'the enum is not enforced on this object at all (`validateRecord` skips `readonly` '
     + 'fields), so any stored row keeps parsing and reading back, and no backfill is '
     + 'required or wanted. Deleting audit history to satisfy a schema narrowing would be '
-    + 'the one genuinely destructive reading of this change. ADR-0049 / ADR-0087, #8315, '
-    + '#7675, #8147.',
+    + 'the one genuinely destructive reading of this change. ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No consumer filters `sys_audit_log` on `action = "restore"` expecting rows: it was '
     + 'empty on every deployment before this change and behaves identically after it. '
 
@@ -19,7 +19,7 @@ export const entry: SemanticMigration = {
   reason:
     'maxRetries had two defaults — FlowSchema `.default(0)` and the engine\'s ' +
     '`maxRetries ?? 3` — so an unstated count retried 0 times through the schema and 3 ' +
-    'times through a hand-built definition (#4247). With the engine\'s copy removed the ' +
+    'times through a hand-built definition. With the engine\'s copy removed the ' +
     'unstated count is unambiguously 0, and retrying zero times is exactly ' +
     "`strategy: 'fail'`, so the schema now refuses the combination instead of it silently " +
     'doing nothing. There is no lossless rewrite: 0 preserves the behaviour a parsed flow ' +
 
@@ -21,8 +21,9 @@ export const entry: SemanticMigration = {
     + '`@objectstack/runtime`\'s `instrumentRouteHandler`, applied only by the dispatcher\'s '
     + 'own route Proxy — so the series never saw auth\'s `getRawApp()` mount, the REST data '
     + 'API via `RouteManager`, or any other inbound surface. Its two siblings in the same '
-    + 'family were moved to the transport seam (#9650/#9835 for the counter, #9834/#10004 '
-    + 'for the histogram) and this one could not follow: `HttpResponseObservation` carries '
+    + 'family were moved to the transport seam (the request counter, then the latency '
+    + 'histogram, both through the response-observing hook the transport was given) and this '
+    + 'one could not follow: `HttpResponseObservation` carries '
     + '`{method, routePattern, status, elapsedMs}` and NO throw signal of any kind, so every '
     + 'transport-side shape would have counted a DIFFERENT population rather than the same '
     + 'one more widely. The divergence was measured in both directions — the dispatcher '
@@ -38,8 +39,8 @@ export const entry: SemanticMigration = {
     + 'the series in its own dashboard or alert file, outside this repo. That is exactly why '
     + 'this entry exists: for an operator whose Grafana keys on the string, the ledger is the '
     + 'only notification channel there is. Same disposition, and the same reason, as '
-    + '`runtime-httpserver-wrapper-retired` (#5122) and `enhanced-api-error-field-errors-renamed` '
-    + '(#3977). ADR-0049 / ADR-0087, #9834.',
+    + '`runtime-httpserver-wrapper-retired` and `enhanced-api-error-field-errors-renamed`. '
+    + 'ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No dashboard, alert rule or exporter config names `http_request_errors_total`: the '
     + 'series stops receiving samples the moment 17.2.0 is deployed, so a panel keyed on it '
 
@@ -18,8 +18,8 @@ export const entry: SemanticMigration = {
     + 'record can only disagree with them. Server-level configuration that IS authorable '
     + 'lives on `defineStack({ server })` / `StackServerConfigSchema`, which is unaffected)',
   reason:
-    'The second and final ADR-0049 pass over `system/http-server.zod.ts`. #4938 removed the '
-    + 'CONFIG half (`HttpServerConfigSchema`, nine keys, zero readers, zero authoring '
+    'The second and final ADR-0049 pass over `system/http-server.zod.ts`. The first removed '
+    + 'the CONFIG half (`HttpServerConfigSchema`, nine keys, zero readers, zero authoring '
     + 'entry); this removes the RUNTIME half — a 7-member lifecycle event union with a '
     + 'timestamped envelope, an eight-boolean capability report, and a five-state status '
     + 'record with connection and request counters. Nothing ever emitted, consumed or '
@@ -39,10 +39,12 @@ export const entry: SemanticMigration = {
     + 'this file when there was one. '
     + 'With no carrier key there is nothing to tombstone, and with no author there is no '
     + 'source or `sys_metadata` row for a D2 conversion to rewrite: RETIRED_DEFS_BY_MAJOR '
-    + 'plus this entry are the declaration — route 3, the same shape as #4938 in this very '
-    + 'file, #4834, #4988 and #5055. If host-implementer conformance becomes a real '
+    + 'plus this entry are the declaration — route 3, the same shape as the config half\'s '
+    + 'removal in this very file and the earlier removals of the dynamic plugin-loading family, '
+    + 'the `ui/` interaction configs and the widget / i18n shapes. If host-implementer '
+    + 'conformance becomes a real '
     + 'requirement it returns through the ENFORCE route: an adapter contract with a checker '
-    + 'behind it, vocabulary second. ADR-0049, #5295.',
+    + 'behind it, vocabulary second. ADR-0049.',
   acceptanceCriteria:
     'No source imports `ServerEvent`, `ServerEventType`, `ServerEventSchema`, '
     + '`ServerCapabilities`, `ServerCapabilitiesSchema`, `ServerCapabilitiesParsed`, '
 
@@ -8,7 +8,8 @@ export const entry: SemanticMigration = {
   replacement: 'explicit `allTenants: true` for a cross-tenant uninstall, or an `organizationId` to scope it',
   reason:
     'An uninstall that named no organization matched EVERY organization\'s rows — measured '
-    + 'at 5 of 5 deleted, including a foreign org\'s (#7705, #7780). That width was never '
+    + 'at 5 of 5 deleted, including a foreign org\'s, while uninstall\'s orphaned-row defect was '
+    + 'being repaired. That width was never '
     + 'chosen; it fell out of a missing argument, and the two transports of the same route '
     + 'disagreed because of it. In protocol 17 the call is REFUSED instead: neither '
     + '`organizationId` nor `allTenants: true` answers 400 `TENANT_SCOPE_REQUIRED` and '
@@ -19,7 +20,7 @@ export const entry: SemanticMigration = {
     + 'at the call site — which is the whole reason the parameter had to become explicit '
     + 'rather than conventional. Nothing in authored metadata spells this: it is a runtime '
     + 'call-site contract, so it is one semantic TODO for operators and API callers rather '
-    + 'than a stack conversion — the same disposition `rest-requireauth-default-flip` (#12) '
+    + 'than a stack conversion — the same disposition `rest-requireauth-default-flip` (protocol 12) '
     + 'takes for its own default flip.',
   acceptanceCriteria:
     'Every caller of `deletePackage` states its tenant scope. A caller that intends an '
@@ -31,5 +32,5 @@ export const entry: SemanticMigration = {
     + 'that script was relying on the cross-tenant reading and must now say so on purpose. '
     + 'The org-scoped path is unchanged — an uninstall carrying an `organizationId` still '
     + 'removes that org\'s rows AND the environment-wide (`organization_id IS NULL`) rows, '
-    + 'exactly as #7705 left it.',
+    + 'exactly as the orphaned-row repair left it.',
 };
@@ -18,13 +18,14 @@ export const entry: SemanticMigration = {
     + 'only `api`/`crud`/`metadata`/`batch`/`routes`, and the served /openapi.json is the '
     + 'pre-generated @objectstack/spec contract enriched with the live server URL and the '
     + 'registered objects — a webhook declared here never appeared in any served document '
-    + '(ADR-0049; the #3197 connector-webhook shape one layer up). There is no behaviour '
+    + '(ADR-0049; the declared-but-unconsumed shape an earlier audit found in the connector '
+    + 'webhook and event enums one layer up). There is no behaviour '
     + 'to preserve and nothing stored to rewrite: `RestServerConfig` is plugin TS '
     + 'configuration (REST plugin constructor / `plugin-hono-server` `restConfig`), never '
     + "a `sys_metadata` shape — the stack tree's `api` block declares only its four "
     + 'scoping/auth knobs. The three schemas are removed with the key (zero import-level '
     + 'consumers in objectstack / cloud / objectui); the key itself is tombstoned because '
-    + 'the schema is not `.strict()` and a plain delete would strip it silently. #4579.',
+    + 'the schema is not `.strict()` and a plain delete would strip it silently.',
   acceptanceCriteria:
     'No `RestServerConfig` value passed to the REST plugin (or `plugin-hono-server` '
     + '`restConfig`) carries `openApi31` — a config that includes it now fails the parse '
 
@@ -12,25 +12,29 @@ export const entry: SemanticMigration = {
     + '`isSystem`) that sharing, approval and report enforcement signatures used to name',
   replacement:
     '`ExecutionContext` from `@objectstack/spec` — the complete '
-    + '`resolveAuthzContext` envelope the contracts have declared since #6523. Every one '
+    + '`resolveAuthzContext` envelope the sharing, approval and report contracts have declared '
+    + 'since they converged onto it. Every one '
     + 'of the retired type\'s six fields exists on it under the same name and type, so a '
     + 'value that satisfied the old type already satisfies the envelope: only the '
     + 'annotation is rewritten, never the value',
   reason:
-    'ADR-0049 enforce-or-remove, completing the #6206 ruling (2026-08-07: enforcement '
-    + 'adjudicates on the WHOLE envelope, never a per-site subset). This type was the '
+    'ADR-0049 enforce-or-remove, completing the maintainer\'s ruling of 2026-08-07 on the '
+    + 'share-link context (enforcement adjudicates on the WHOLE envelope, never a per-site '
+    + 'subset). This type was the '
     + 'declared context parameter of 36 signatures across three contracts — '
     + '`ISharingService` / `ISharingRuleService`, `IApprovalService`, `IReportService` — '
     + 'and it omitted four fields those gates need: `accessible_org_ids` (under the '
     + '`group` tenancy posture this IS the Layer 0 wall, ADR-0105 D2), `org_user_ids`, '
     + '`posture` (ADR-0095 D2) and `tabPermissions`. Its damage ran in the MIRROR '
-    + 'direction of the share-link twin (#6430 / PR #6511): nothing trimmed the VALUES — '
+    + 'direction of the share-link twin, which that same ruling moved onto the whole context: '
+    + 'nothing trimmed the VALUES — '
     + "the engine middleware always handed the whole context down — it was the declared "
     + 'TYPE that was narrow, so an implementation could not READ what it had been given '
     + 'without casting out of its own contract (`const posture = (context as any).posture` '
-    + "in plugin-approvals' privileged-override gate). #6523 / PR #7068 converged the "
-    + 'contracts, PR #7140 and PR #7206 re-annotated the four implementations, and this '
-    + 'card removes the now-unreferenced declaration (#7070, #7218). '
+    + "in plugin-approvals' privileged-override gate). One change converged the "
+    + 'contracts, two more re-annotated the four implementations (sharing and audit, then '
+    + 'approvals and reports), and this change removes the now-unreferenced declaration, the '
+    + 'deletion that split had deferred. '
     + 'Why this needs a ledger entry despite nothing in-repo referencing it: it is the '
     + '`export-field-meta-constraints-retired` / `hook-context-session-roles-retired` '
     + 'disposition — a PUBLISHED TypeScript surface with no spec schema, so there is no '
@@ -39,7 +43,7 @@ export const entry: SemanticMigration = {
     + 'Why D3 semantic and not a D2 conversion: nothing authored or stored changes shape. '
     + 'The name is only ever spelled inside a consumer\'s own TypeScript, so no '
     + '`objectstack migrate meta` transform can reach it, and no `sys_metadata` row '
-    + 'carries it. ADR-0049 / ADR-0087, #7218.',
+    + 'carries it. ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No source of yours imports `SharingExecutionContext` from `@objectstack/spec` or '
     + '`@objectstack/plugin-sharing`; each such import becomes `ExecutionContext` from '
 
@@ -33,9 +33,11 @@ export const entry: SemanticMigration = {
     + 'runtime-reserved and deliberately non-authorable (there is no `sys_queue` yet). Note '
     + 'the two neighbouring conversions cover DIFFERENT faces of this schema and not this '
     + 'one: `sharing-recipient-role-to-position` is the ADR-0090 role → position rename and '
-    + '`sharing-rule-access-level-full-to-edit` is the access-level vocabulary. Registered by '
-    + 'the #6350 stock reconciliation. ADR-0078 / ADR-0090 D3 / ADR-0087, #1878 (backfilled '
-    + '#6350).',
+    + '`sharing-rule-access-level-full-to-edit` is the access-level vocabulary. The change came '
+    + 'out of the metadata property liveness audit, which found security properties parsed but '
+    + 'never enforced, and was registered late, by the stock reconciliation that compared the '
+    + 'breaking changesets already on the v17 release train against this ledger. ADR-0078 / '
+    + 'ADR-0090 D3 / ADR-0087.',
   acceptanceCriteria:
     'No sharing rule names `group` or `guest`, and none carries `type: owner`; stale '
     + 'definitions now FAIL parse with the valid options listed, so the sweep is "fix until '