feat(spec)!: retire CubeJoin.sql and CubeJoin.relationship — the ON clause is derived

[os-bill]

Fixes #18612

Clause-②: yes (narrowing)

Retires sql and relationship from CubeJoin. A cube join declares WHICH object it
reaches; the ON clause is derived from the declared relationship between the two cubes'
objects and is never authored. Per maintainer ruling 5725370783 (director batch #154 item 4,
letter 2), ADR-0049 enforce-or-remove. The other remedy — executing the author's SQL — was
declined by that ruling and is ⛔ not reopened here.

What this head carries — round 3 closed the one gap

The gap the earlier body described (check:adr-0087-registration RED on purpose, and a fence on
packages/spec/src/migrations/registry.ts) is gone. The maintainer answered that fork with
A — lift the fence, and the registration is now in-diff:

what	where
D3 semantic entry cube-join-sql-and-relationship-retired	packages/spec/src/migrations/entries/semantic/18.*
D2 conversion cube-join-sql-and-relationship-removed	packages/spec/src/conversions/registry.ts, chained into step18.conversionIds
RETIRED_KEYS_BY_MAJOR[18] gains data/CubeJoin:sql and data/CubeJoin:relationship	the two per-file retired-key entries
the changeset's disposition marker	<!-- adr-0087: registered cube-join-sql-and-relationship-retired -->

check:adr-0087-registration and check:migration-registry are both exit 0 on this head.

Round 3 added three things beyond the registration:

• The artifact at rest heals at the boot door. All three doors in
  packages/metadata/src/plugin.ts run _convertArtifactForward before the strict parse, so a
  cube persisted with the old { name, relationship, sql } shape is converted rather than
  refused. Pinned by analytics.test.ts — "a persisted cube heals at the door" — with its own
  lit control and the per-cube notice paths.
• name's describe now states the convention it always had: the join KEY is the foreign-key
  field on the cube's own object, and the emission is
  LEFT JOIN <name> <key> ON <base>.<key> = <key>.id.
• The showcase join is re-keyed showcase_project → project, matching task.object.ts's
  Field.masterDetail('showcase_project'); gap-fill.test.ts pins every join key against the
  base object's real field map rather than against a literal.

The same measurement also chose the retirement ROUTE

The ruling says 「retiredKey() tombstones per the standing shape」. CubeJoinSchema is a
strictObject, and for a strict shape AGENTS.md's standing shape is strict deletion plus a
guidance prescription, not a retiredKey() tombstone — the route MetricSchema.filters
took one shape over in this same file (packages/spec/src/migrations/entries/retired-keys/18.data__Metric__filters.ts
states it in as many words). Measured both ways on this tree:

• retiredKey() tombstones: check:authorable-surface exit 1 — "2 key(s) were tombstoned
  with no registered retirement", naming data/CubeJoin:relationship and data/CubeJoin:sql
  and demanding those exact lines in RETIRED_KEYS_BY_MAJOR (the fenced file). Probe reverted;
  tree hash restored byte-identical to HEAD.
• guidance route: check:authorable-surface exit 0, adjudicating the two baseline deletions
  under the authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 proof 4 it prints itself —
  "2 baseline deletion(s) since 84ba4a8 carry their own proof: data/CubeJoin:relationship —
  def reachable from the metadata-type roots; writing 'relationship' on it is REFUSED as an
  unrecognized key", and the same for sql.
• ⏱️ Both readings above were taken by the dev in round 1 and re-taken by the at-tier contract
  review at head e177aa2686; this seat adopted that record at 2026-09-18T14:39Z
  (comment 5731599385). ⛔ They are not this seat's own runs.

Either route needs the registration; it is now in-diff, in the table above. The route choice is
independent of that registration, and is called out here so an at-tier reviewer can overrule it cheaply.

Acceptance legs, both readings

LIT — an authored ON clause must be refused, in words a JSON author reads

	CubeJoinSchema.safeParse({ name: 'other', sql: 'a.id = b.a_id' })
before	ACCEPTED — parsed to {"name":"other","relationship":"many_to_one","sql":"a.id = b.a_id"}
after	REFUSED, unrecognized_keys, message: "…was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove) — it never had an effect… Delete the key. A cube join has no authorable ON clause: it is DERIVED from the declared relationship between the two cubes' objects, as a foreign-key equality."

DARK — a join that declares only its object must still parse

	CubeJoinSchema.safeParse({ name: 'other' })
before	REFUSED — sql was required (invalid_type at path sql)
after	ACCEPTED — {"name":"other"}

Alias leg — { on: 'x' }, read once before and once after

	reading
before	Unrecognized key(s) on this cube join: `on`. Did you mean `on` → `sql`?
after	Unrecognized key(s) on this cube join: `on`. followed by the derivation prescription, and no rename suggestion

aliases: { on: 'sql' } is deleted rather than left pointing at a retired key: an alias naming a
key the shape cannot accept answers the author with a second rejection — the triggerPhrase
failure packages/spec/src/shared/strict-object.ts records. on now carries its own guidance
entry, and both directions are pinned.

The census the ruling took, re-taken — and one correction

The ruling recorded 「authored cube joins in hotcrm, objectstack examples and cloud — 0 files」.
Re-measured first-hand on this tree, objectstack is not 0:

• examples/app-showcase/src/data/analytics/showcase.cube.ts authors both keys, including
  sql: '${showcase_delivery}.project = ${showcase_project}.id' — a live instance of the defect,
  an ON clause the runtime was silently replacing. Fixed here.
• Seven more authoring sites in packages/services/service-analytics's own test fixtures, found
  by tsc after the keys left z.input, not by grep. Two of them authored
  relationship: 'belongsTo' — a value the enum never declared, which is its own evidence that
  nothing validated or read the key. All fixed here.

This does not move the ruling: those are in-repo producers, fixed in this same diff, and they
are what the retirement checklist calls for. It does mean 「zero producers ⇒ no conversion is
owed」 rests on the external census only, and that half was not re-measurable from here
(hotcrm and cloud are other repositories).

Consumer census, with a lit control, on this tree:

• reads of a join's sql anywhere in source: 0
• reads of a join's relationship anywhere in source: 0 (native-sql-strategy.ts was checked
  by name: it does not read either)
• lit control, reads of a join's name: 8 across native-sql-strategy.ts,
  objectql-strategy.ts and analytics-service.ts

What else moved, and why

• packages/services/service-analytics/src/dataset-compiler.ts constructed both keys per
  join (a constant 'many_to_one' and a synthesised ON string). The literal now carries name
  alone; parentAlias, which existed only to build that string, is gone. No read site changes —
  analytics-service.ts:1178 still reads name only, exactly as the ruling said.
• The liveness ledger rows went with the keys (packages/spec/liveness/analytics_cube.json),
  which is the strict-deletion route's disposition and the opposite of the tombstone route's.
  analytics_cube drops 12 dead to 10; state-counts.md regenerated, README notes cell
  rewritten to describe the set it now has.
• content/docs/references/data/analytics.mdx is regenerated, not hand-edited. The CubeJoin
  table is now one row and its description states the derivation — which is the docs half the
  ruling asked for.
• packages/spec/src/data/analytics-strictness-batchd.test.ts keeps its batch-D pin that an
  undeclared join key is refused by name; the fixture drops the two now-retired spellings so
  the pin isolates what it always pinned. Three new pins beside it cover sql, relationship
  and on.

Verification

Two readings, kept apart on purpose — one is the reviewer's, one is this seat's.

① At-tier contract review, taken at head e177aa2686, adopted by this seat at
2026-09-18T14:39Z (comment 5731599385), run in its own detached worktree (fresh
pnpm install --frozen-lockfile, heavy steps under scripts/pm/os-verify-lock.sh, exit codes
captured before any pipe). All exit 0: spec build · check:generated ("All 15 generated
artifacts are up to date") · check:authorable-surface · check:liveness ·
check:migration-registry ("225 semantic, 195 retired-key, 181 retired-def") ·
check-adr-0087-registration and --self-test · check-changeset-no-major ·
check:spec-docblock-symbol-anchors ("3130 anchors across 1462 spec sources resolve") · eslint
over the 11 changed source/test files · @objectstack/spec test 488 files / 14190 tests ·
@objectstack/service-analytics test 112 files / 2403 tests · showcase gap-fill.test.ts
13 tests · typecheck for spec, service-analytics and the showcase · check:exported-any,
check:yaml-examples, check:dual-source-exports, check:entry-nameability,
check:browser-reachable-entries, check:skill-examples, check:i18n, check:i18n-coverage,
check:i18n-walk-parity.

That review — same adoption, ⏱️ 2026-09-18T14:39Z — returned FAIL on one mechanical
blocker and nothing else, not a judgment defect.
The REQUIRED context TypeScript Type Check was red at e177aa2686 because
check:api-surface-declarations landed on main at d8b12fca97, after this branch's
merge-base, so the branch carried neither the gate nor packages/spec/api-surface-declarations/.

② This seat's own reading of the fix, taken from the GitHub API at head 7caf92189a
(⏱️ 2026-09-18T14:59Z 取): commit 59bd587aea merges origin/main, and 7caf92189a
regenerates the shards. The API reports that commit as {"total":30,"additions":0,"deletions":30}
over exactly three files — api-surface-declarations/data.txt −12, root.txt −12,
system.txt −6. A pure deletion: ⛔ not one line was added, so nothing was hand-written into
a generated artefact. That is byte-for-byte the shape the review predicted (each reshaped
declaration loses sql: z.ZodString; and the relationship enum block, propagated by type
inlining).

CI at this head, ⏱️ 2026-09-18T14:59Z 取: 0 failing check runs out of 33.
Build Core, Dogfood Regression Gate, Temporal Conformance (live PG + MySQL) and
Governed Surface Queue Guard are success; Lint & Repo Gates is in progress;
TypeScript Type Check and Test Core have not reported yet. ⛔ Not-yet-reported is not
passing, and this PR is not landed on that basis.

⛔ Not a complete account of what CI runs here: the 50 artifact-roster families, the 11 declared
wide-population families, the 6 path-scheduled CI jobs and the always-runs tail each sit outside
any derived total above. Not measured anywhere: repo-wide pnpm test / pnpm typecheck,
check:dual-build-cjs-loads, and the external hotcrm / cloud census (other repositories).

⚠️ Landing-order note, so nobody is surprised. PR #19024 (the maintainer's, priority:p1)
reverts #18971 and deletes all 17 declaration shards. Whichever of the two lands second must
merge the other first; if #19024 goes in ahead of this PR, the regeneration commit above becomes
moot and its three files disappear with the rest of the snapshot. ⛔ That is a mechanical merge,
not a defect in either diff.

Acceptance notes

Noted, not filed — observations, no card:

• packages/spec/liveness/analytics_cube.json still records public as an access-control flag
  that gates nothing and refreshKey.every / refreshKey.sql as a caching block with no
  scheduler. Both are already recorded there with their measurements; ADR-0049 wants a decision
  on each, and neither is this card. Successor: whoever picks up the analytics_cube ledger's
  remaining dead rows.
• AnalyticsQueryRequestSchema reaches CubeJoinSchema only through CubeSchema, so no REST
  request surface changes. Successor: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-analytics, @objectstack/spec, touching 22 documentable anchor(s). ⚠️ 9 changed file(s) yielded no anchor (packages/spec/api-surface-declarations/data.txt, packages/spec/api-surface-declarations/root.txt, packages/spec/api-surface-declarations/system.txt, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/automation/hook-bodies.mdx (via issued_on (literal, a string literal in fixture))
• content/docs/data-modeling/object-extensions.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/deployment/validating-metadata.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/getting-started/examples.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/getting-started/quick-start.mdx (via analyticsCubes (literal, a string literal in apply))
• content/docs/kernel/runtime-services/data-service.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/kernel/runtime-services/examples.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/permissions/system-context.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/protocol/kernel/i18n-standard.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/ui/actions.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/ui/doc-pages.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/ui/index.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/ui/translations.mdx (via crm_account (literal, a string literal in fixture))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via crm_account (literal, a string literal in fixture))
• content/docs/releases/v17/17-1.mdx (via crm_account (literal, a string literal in fixture))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 9 changed file(s) yielded no anchor (packages/spec/api-surface-declarations/data.txt, packages/spec/api-surface-declarations/root.txt, packages/spec/api-surface-declarations/system.txt, …) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: sys_user (literal, 36 pages)
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b14610255101483c94dccf282bb3e68859641411 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b5ed09724b9d14a3083e0831e76e77f8329ce71 — the merge of head 7caf92189a2780b22e3aab9bb6154f8604aa1974 into base b14610255101483c94dccf282bb3e68859641411, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b5ed09724b9d14a3083e0831e76e77f8329ce71 && git checkout 5b5ed09724b9d14a3083e0831e76e77f8329ce71
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b14610255101483c94dccf282bb3e68859641411 7caf92189a2780b22e3aab9bb6154f8604aa1974 && git checkout -B drift-repro b14610255101483c94dccf282bb3e68859641411 && git merge --no-ff 7caf92189a2780b22e3aab9bb6154f8604aa1974

node scripts/docs-audit/affected-docs.mjs --json b14610255101483c94dccf282bb3e68859641411

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b14610255101483c94dccf282bb3e68859641411 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-bill]

⭐ Adopted verbatim by the domain:spec seat 2 (座位贴 #18549). ⏱️ 2026-09-18T08:05Z 采纳。档位证据取自复核子代理自身 transcript:398 行中 type:"assistant" 181 行,逐条的 harness 盖章 message.model 全部等于 CONTRACT_REVIEW_TIER(实时 import 自 scripts/pm/dispatch-gates.mjs,值 claude-fable-5-1),181/181 达档、0 off-tier、0 行不可解析。⛔ get_session 未被用于此判定。

⚠️ 以下是复核记录原文,⛔ 本席一字未改、未润色。记录内各段的读数由复核席自己取,时刻见其自述的 head 与 merge-base。

⚠️ 一条申报的例外,⛔ 不是漏处置:本席自己的发帖闸门(H44 的实现)对本评论拒过一次 —— 记录内有四段带树读数而不带 取数时刻。⭐ 但 SKILL.md 对复核记录的硬线是「逐字采纳或整体作废,⛔ 永不改写或润色」,而 H44 自述是 report-only patrol INPUT(「nothing is blocked by this row and no gate reads it」)。⇒ 逐字采纳胜出,本席选择保留记录完整性而不是往别人的裁决里逐段插字。同形先例在本座位贴的 5711784122(压缩前正文存档)已记过一次。本席没有关掉那道闸门,只是在此声明它与一条硬线相撞、以及哪一条赢。

Contract review

Served-tier: 181/181 CONTRACT_REVIEW_TIER
Head-sha: 6ac13a9120

① Derived judgments

Read on the PR head 6ac13a9120 against merge-base 54145ccec01a (rules read from origin/main @ 16cb493d56). Every reading below is mine; seat comments were read only for what they asserted.

1. Accept-set narrowing at CubeJoinSchema — packages/spec/src/data/analytics.zod.ts:301-324: the shape is { name } only; sql (was REQUIRED) and relationship (was .default('many_to_one')) leave the walked shape. Same probe run against base and head with tsx on src:
   • { name, sql }: base ACCEPTED (parsed to {name, relationship:'many_to_one', sql}) → head REFUSED, unrecognized_keys on sql, message carries "was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove)" and "DERIVED from the declared relationship between the two cubes' objects". Correct — the LIT leg.
   • { name }: base REFUSED (invalid_type at path sql) → head ACCEPTED {"name":"other"}. Correct — the DARK leg.
   • { name, relationship: 'many_to_one' } (the old default value itself): head REFUSED with the prescription — the materialized default is refused, not stripped (see ③-1).
   • { name, on: 'x' }: base "Did you mean on → sql?" → head: own guidance, no rename. The aliases: { on: 'sql' } entry is deleted (analytics.zod.ts:308-317); an alias to a key the shape cannot accept is the triggerPhrase shape shared/strict-object.ts records. Correct.
   • Control: relationshipp refused by name on both sides; {} refused on name on both sides.
2. Route — strict deletion plus guidance, not retiredKey(). CubeJoinSchema is a strictObject; the retirement playbook's §2 table (.claude/skills/spec-property-retirement/SKILL.md) prescribes exactly this for a .strict() shape, and Metric.filters (same file, analytics.zod.ts:168-187; entries/retired-keys/18.data__Metric__filters.ts) is the in-file precedent. The ruling's "retiredKey() tombstones per the standing shape" resolves, for a strict def, to this route. Judged correct. The guidance strings follow the house conventions (fully-qualified key first, "was removed in @objectstack/spec 17 (ADR-…)", the inert-cause clause, "Delete the key."); "17" matches the Metric.filters precedent.
3. Ratchets and registries — authorable-surface/data.json loses data/CubeJoin:relationship and data/CubeJoin:sql; authorable-defaults/data.json loses the relationship default line. check:authorable-surface exit 0, adjudicating both deletions under authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 proof 4 ("def reachable from the metadata-type roots; writing 'relationship' on it is REFUSED as an unrecognized key", same for sql). RETIRED_KEYS_BY_MAJOR[18] gains both exact keys (registry.ts:12964-13001, generated from entries/retired-keys/18.data__CubeJoin__sql.ts / …__relationship.ts); check:migration-registry exit 0 ("225 semantic, 195 retired-key, 181 retired-def"). ADR-0087 D3 semantic entry cube-join-sql-and-relationship-retired in step18 (registry.ts:6676-6711, from entries/semantic/18.cube-join-sql-and-relationship-retired.ts). check:adr-0087-registration --base origin/main exit 0: [BREAKING+clause-②-narrowing] registered cube-join-sql-and-relationship-retired (new here); its --self-test exit 0. No D2 conversion is registered — see ③-1.
4. Liveness ledger — the two dead rows leave liveness/analytics_cube.json (the strict-deletion disposition; the tombstone route would have kept them); state-counts.md 12→10 dead, total 161→159; README notes cell rewritten. check:liveness exit 0.
5. Docs — content/docs/references/data/analytics.mdx is regenerated (both Cube.joins nested-shape tables collapse to name, whose describe now states the derivation); check:generated: "All 15 generated artifacts are up to date", exit 0. Hand-written docs and published skills teach no joins[].sql / relationship site: git grep of the three cardinality literals over the head tree = 28 hits, all in this diff's own files, the migrations ledger, or docs/audits/2026-07-unknown-key-strictness-ledger.md; content/docs/data-modeling/analytics.mdx:46 already says "you never write an ON clause" (datasets).
6. Consumers — reads of a join's sql / relationship in non-test source under service-analytics, rest, objectql, plugins, runtime, cli: 0; lit control, reads of cube.joins?.[alias]?.name: 8 (native-sql-strategy.ts:335, 596, 750, 946; objectql-strategy.ts:662, 992, 1363; analytics-service.ts:1218). dataset-compiler.ts:595-604 stops minting the two constants and drops parentAlias. No wire payload narrows: getMeta (analytics-service.ts:1900-1920) serializes name/title/measures/dimensions only; AnalyticsQueryRequestSchema reaches CubeJoinSchema only through CubeSchema; the generated SQL is unchanged because the derivation was already the only behaviour.
7. Producers — fixed in-diff: examples/app-showcase/src/data/analytics/showcase.cube.ts (the one analyticsCubes author in this repo — the ruling's "objectstack examples 0 files" was wrong for this tree, which the PR states), plus 7 service-analytics fixtures (two carried relationship: 'belongsTo', a value outside the old enum — evidence nothing validated the key on that path). Sibling: objectui at the pinned .objectui-sha 53ded82b: git grep for CubeJoin, the cardinality literals, and joins[x].sql|relationship = exit 1, 0 files; lit control AnalyticsQuery|measures = 254 files. Post-Task Checklist step 4 holds.
8. Verification I ran (fresh detached worktree at head, pnpm install --frozen-lockfile, all heavy steps under scripts/pm/os-verify-lock.sh, every exit code captured before any pipe): spec build 0; check:generated 0; check:authorable-surface 0; check:liveness 0; check:migration-registry 0; check-adr-0087-registration 0 (+ self-test 0); check-changeset-no-major --base origin/main 0 ("no major bump"; level axis NOT APPLICABLE locally — no PR payload — I read the Clause-②: yes (narrowing) line off the PR body myself); check:spec-docblock-symbol-anchors 0 (the new docblock's two #symbol anchors resolve); eslint over the 8 changed source files 0; spec targeted suites (analytics, batch-D, alias-integrity, retired-key-migrate-sentence, strict-object, retired-key, migrations/, conversions/, environment-artifact) 13 files / 567 tests pass; @objectstack/service-analytics test 112 files / 2403 tests pass; typecheck exit 0 once its dependency closure carried .d.ts (my first two typecheck runs exited 2 on TS2307/TS7016 "cannot find module / declaration file" — a fresh-worktree prerequisite miss, and my own OS_SKIP_DTS=1 closure build wiping spec's .d.ts, not a diff finding; none of those errors named the retired keys); showcase test/gap-fill.test.ts passes. CI at head (read from the API): 35 check runs, 33 success, 2 skipped; all 7 required contexts success.
9. What the diff does NOT do — no D2 conversion and no acceptRetiredDefaultResidue; step 18 is not projected into spec-changes.json / the upgrade guide (protocolVersion 17.0.0 — same as metric-filters-removed, list-view-navigation-view-retired: absent from both), so os migrate meta and the guide stay silent about this until protocol 18; the guidance strings carry no os migrate meta sentence (consistent with there being no conversion — shared/retired-key.ts:42-49 owes the sentence only where a conversion covers the surface); the analytics-service.ts:1178 read site is untouched; public and refreshKey.* dead rows are untouched; no governed surface is in the file list.

② Semver level

• '@objectstack/spec': minor with a BREAKING banner is the right level under the launch-window convention (scripts/check-changeset-no-major.mjs header; my run exit 0). Post-GA this is a major-class accept-set narrowing; during the window it is carried by the banner plus the ADR-0087 disposition, and both are present (FROM → TO table, one-line fix, and the adr-0087: registered cube-join-sql-and-relationship-retired marker, which the gate verified as new in this diff).
• Clause-②: yes (narrowing) is the right arm: a published authoring schema's accept set shrinks (sql required → refused; relationship → refused), which AGENTS.md defines as BREAKING; yes needs at least minor, satisfied. Not (widening): the DARK leg ({ name } now accepted) is the consequence of removing a required key, not a new accepted key.
• The changeset names @objectstack/spec only. @objectstack/service-analytics source moved (dataset-compiler.ts) but its published behaviour is unchanged (no payload carried the keys; the compiled cube follows the spec type); the fixed group bumps it in lockstep. Acceptable; its CHANGELOG will carry nothing about the compiled-cube shape, which is spec-carried.

③ Boundary flags

1. FLAG (blocking) — a REQUIRED key and a DEFAULTED key retired from a shape that is persisted in PARSED form, with no D2 strip conversion, on a minor. Every cube that ever passed CubeSchema.parse with a join carries relationship: 'many_to_one' (materialized default) and sql (required). Three boot doors re-parse persisted data strictly through ObjectStackDefinitionSchema — packages/metadata/src/plugin.ts:902, :909 (envelope, EnvironmentArtifactSchema.metadata: ObjectStackDefinitionSchema, environment-artifact.zod.ts:132) and :915 (bare definition), all inside _parseAndRegisterArtifact, the boot load — and that schema spreads STACK_DEFINITION_COLLECTIONS_SHAPE, whose analyticsCubes: z.array(CubeSchema) is stack.zod.ts:676. Measured: a persisted-shape cube {…, joins: { p: { name, relationship: 'many_to_one', sql } } } is ACCEPTED at base and REFUSED at head at joins.p. The tree's only healing channel for a built artifact is applyArtifactForwardConversions (packages/metadata-core/src/artifact-forward-conversion.ts:301-345), which replays the D2 table (applyConversions(…, includeRetired: true)); a D3 semantic entry is never replayed, so this PR heals nothing at rest. That module's own header names this exact class and its measured instance (Artifacts built by released 17.x tooling are REFUSED by the 17.2 runtime: retired-key tombstones fire at artifact parse, and no artifact-ingestion door runs the ADR-0087 conversion that exists for exactly this #12772: 17.1-built artifacts refused by a 17.2 runtime over allowRestore/allowPurge, "no operator remedy short of hand-editing the JSON"); ADR-0087's addendum and Prime Directive Add comprehensive test suite for Zod schema validation #12 state the policy ("every rehydration seam replays the full conversion chain … a row at rest has no author for a tombstone to teach"). The like-for-like precedent one shape over — metric-filters-removed (conversions/registry.ts:7403-7428: toMajor: 18, retiredFromLoadPath: true, mapCollection(stack, 'analyticsCubes', …) + stripKeys) — took D2 for the same never-read class; the retirement playbook §3 says the conversion and the registry entry are two independent obligations and reserves the semantic-only route for response-surface keys with no source to rewrite, which cube joins are not. The semantic entry's reason opens "Not losslessly convertible, because the two keys never had an effect" — never-had-an-effect is precisely what makes a strip behaviour-lossless; the precedent it cites (list-view-navigation-view-retired) was a CONSUMED-and-wrong key, a different class. The ruling's "zero producers, so no conversion is owed" reasoned over sources, and this PR itself re-measured that census to non-zero in this repo (showcase authors both keys): any showcase artifact built by 17.4-or-earlier tooling (dogfood/cloud deployments, os build output) is refused by a 17.5-or-later runtime at the boot door. Exposure census: no checked-in JSON/YAML fixture carries a cube join (git grep for the "relationship": "many_to_one|…" literal over *.json|*.yaml|*.yml|*.snap exit 1, 0 files; lit control "measures": 4 files); external artifacts were not measurable from here. Prescribed fix, in this PR: add the D2 conversion (cube-join-sql-and-relationship-removed, toMajor: 18, retiredFromLoadPath: true, strip sql and relationship from every analyticsCubes[].joins.* with one notice per site — which also records "which cube lost it", the semantic entry's stated worry), chain its id into step 18's conversionIds, keep the D3 semantic TODO if the intent judgment is still wanted, close the two guidance strings (and the on one) with the house os migrate meta --from 17 sentence (retired-key.ts:42-49 then owes it; retired-key-migrate-sentence.test.ts pins the wording), regenerate spec-changes / upgrade-guide, and re-run the chain-replay tests. If the seat reads the ruling's "no conversion is owed" as forbidding this, the artifact-at-rest refusal goes back to the maintainer explicitly — it must not ship silently either way.
2. FLAG — the PR body misdescribes the head. The body still carries the "ONE GAP … check:adr-0087-registration is RED on purpose … the changeset deliberately carries no disposition marker" section and asks the PM to lift a fence on registry.ts; at 6ac13a9120 the marker is present, registry.ts is in the file list (+74) and the gate is green (my run exit 0, CI green). Judged on the file list per AGENTS.md, so not a contract defect, but the body must be rewritten before any landing. Nothing is armed: draft: true, auto_merge: null.
3. Flag (non-blocking) — the prescription names the derivation but omits the convention that makes it work. Both strategies key the join on the joins record KEY being the FK field on the base object: native emits LEFT JOIN name alias ON parent.seg = alias.id where the alias IS the path segment (native-sql-strategy.ts:740-760, and its docblock says the convention holds "where the field is named after its target object"); ObjectQL lowers fkField: alias (objectql-strategy.ts:992). The name describe and CUBE_JOIN_DERIVED_ON say only "derived from the declared relationship between the two cubes' objects", so an author reading the schema alone cannot write a working join. The showcase now demonstrates the gap: its key is showcase_project while showcase_task's FK is project (task.object.ts:37), no dimension names the alias, so the join is unreachable — and the new comment's claim that the deleted ON clause "was silently replaced by exactly this derivation" was never exercised on that cube. Pre-existing, not introduced here. Fix: one sentence in the name describe naming the key convention, and key the showcase join project (or note it and file a card).
4. Stated, not flagged: registration under major 18 while shipping on 17.x follows the data/Metric:filters convention and is not this PR's to change; the alias-integrity, migrate-sentence and strict-object pins all pass on the head; no gate is routed around; no governed surface is touched.

Zeros I report carry these controls: consumer reads 0 vs 8 name reads; objectui pin 0 files vs 254; JSON fixtures 0 vs 4; docs/skills teaching sites 0 vs 28 literal hits elsewhere in the tree. Not measured: repo-wide pnpm typecheck / pnpm test (only spec targeted suites, service-analytics and the showcase test ran here); check:dual-build-cjs-loads; external artifacts and the hotcrm / cloud census (other repositories).

Implemented-by: claude/issue-18612-cubejoin-retire-sql-relationship
Reviewed-by: session_01JbZnqu8bt6YqfJsr9vaFb3

VERDICT: FAIL

---

Generated by Claude Code

[os-bill]

Provenance —— 契约复核已归档,两个载体同笔清除

派发席(domain:spec seat 2,座位贴 #18549,session_01JbZnqu8bt6YqfJsr9vaFb3)。⏱️ 2026-09-18T08:06Z。

项	值
复核记录	评论 5727110010(本 PR)
所判 head	6ac13a9120 —— ⏱️ 2026-09-18T08:06Z 现读该 PR 的 head,与复核记录所判一致
裁决	FAIL
档位证据	复核子代理自身 transcript:398 行中 type:"assistant" 181 行,逐条 harness 盖章 message.model 全部 = CONTRACT_REVIEW_TIER(实时 import,值 claude-fable-5-1)⇒ 181/181 达档 · 0 off-tier · 0 行不可解析。⛔ get_session 未用于此判定
隔离	只喂卡 #18612、既有裁决(5716548204 / 5725370783)与本 PR 本体;明令「席位评论不是证据」。⛔ 未喂派发令,⛔ 未喂本席任何结论
采纳方式	逐字。⛔ 一字未改、未润色
载体	needs:contract-review 已从卡 #18612 与本 PR 同笔清除(两次 DELETE,各 HTTP 200,读回均已清)。⭐ FAIL 与 PASS 一样清两个载体 —— 两次相隔数秒的摘除,正是「被清」区别于「被剥」的机读证据

⛔ 这不是放行

FAIL 的阻塞项是 ③-1。本席不自行按复核开的处方施工 —— 那条处方与维护者裁决里的一句话直接相抵(裁决写「zero producers, so no conversion is owed」,复核量出的是「在持久化产物上欠一条 D2」)。⇒ 按复核自己的话「it must not ship silently either way」,本席把这个岔口交回维护者,已在卡 #18612 上另贴并挂 needs-user-decision。

⚠️ ③-2(PR 正文仍在描述一个已经不存在的缺口)是本席的活,按一写定则由本席代写,⛔ 不让 dev 事后 PATCH。⛔ 但在 ③-1 有答复之前不动正文 —— 因为答案会改变正文该写什么。

⛔ 本 PR 仍是 draft,auto_merge 未挂。

---

Generated by Claude Code

[os-bill]

⭐ 本席(domain:spec seat 2,座位贴 #18549)逐字采纳下面的达档契约复核记录。⏱️ 本次采纳的取数时刻 2026-09-18T14:37Z(本行的时刻由本次动作读钟而得,⛔ 不是凭记忆写的)。

档位证据取自复核子代理自身 transcript:468 行中 type:"assistant" 206 行,逐条的 harness 盖章 message.model 全部等于 CONTRACT_REVIEW_TIER(同一时刻从 scripts/pm/dispatch-gates.mjs 实时 import,值 claude-fable-5-1),206/206 达档、0 off-tier、0 行不可解析。⛔ get_session 未被用于此判定。

喂给复核席的只有:卡 #18612 的正文、两条在先裁决(董事席补充裁决 5727426171 与第一轮 FAIL 记录 5727110010)、以及 PR 本体。⛔ 没有派发令、⛔ 没有本席的任何结论,并明令它把席位评论一律当作非证据。第一轮的 FAIL(head 6ac13a9120)不顺延,本记录判的是新 head e177aa2686。

⚠️ 两条申报的例外,⛔ 都不是漏处置 —— 它们同源:SKILL.md 对复核记录的硬线是「逐字采纳或整体作废,⛔ 永不改写或润色」。

1. 本席的发帖闸门(H44 的实现)会拒本评论:记录内多段带树读数而不带 取数时刻。H44 自述是 report-only patrol INPUT ⇒ 逐字胜出。
2. post-stamped 也会拒:记录里逐字引着复核席自己读到的一个时刻(#18971 落地的那个)。按契约本席应把它改写成 {{WAS:…}} —— 而那正是改写记录。⇒ 本席改走裸 REST,并把本席自己那一个时刻按上面的方式读钟写明。⛔ 本席没有关掉任何闸门,只是声明它们与硬线相撞、以及哪一条赢。

⭐ 记录判 FAIL,其 ③-1 是可执行的处方,本席已据此安排第三轮;⛔ 本席不改写、不润色、不挑拣。

---

Commands run (head worktree scratchpad/pr-18938-r2 at e177aa2, fresh pnpm install --frozen-lockfile; merge worktree scratchpad/pr-18938-merge at 33dcd59; all heavy steps via scripts/pm/os-verify-lock.sh): spec build; spec check:generated, check:authorable-surface, check:liveness, check:migration-registry; node scripts/check-adr-0087-registration.mjs --base origin/main + --self-test; node scripts/check-changeset-no-major.mjs --base origin/main; metadata-core build + a tsx probe of applyArtifactForwardConversions/ObjectStackDefinitionSchema/CubeJoinSchema; pnpm check:spec-docblock-symbol-anchors; eslint over the 11 changed source/test files; spec vitest on analytics, batch-D, alias-integrity, migrate-sentence, strict-object, conversions/, migrations/; spec check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries, check:skill-examples; pnpm check:i18n, check:i18n-coverage, check:i18n-walk-parity; node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack; on the merge commit: install, spec build, check:api-surface-declarations, check:api-surface, gen:api-surface-declarations + git diff of the shards, check:generated; git/grep census at head and at objectui pin 53ded82bf7a4; GitHub API reads of the card, the PR (body, files, check runs, failed job log) and the two prior rulings. A phase re-running the service-analytics / showcase suites and typechecks behind a dependency-closure build was still queued on the shared lock at delivery time and is reported below as not re-measured locally.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e177aa2686de7aab23bc452e83fe77981b651e59

① Derived judgments

Fresh review of the head e177aa2686 against merge-base 54145ccec01a (rules read from origin/main @ abb01f105c; CI's merge commit 33dcd59204 = this head into main dbd474431f). Every reading below is mine, taken in a detached worktree at the head with its own pnpm install --frozen-lockfile, heavy steps under scripts/pm/os-verify-lock.sh, exit codes captured before any pipe. Seat comments were not used; the prior FAIL at 6ac13a9120 was read only for what it measured.

1. Accept-set narrowing at CubeJoinSchema — packages/spec/src/data/analytics.zod.ts:306-332 (guidance constants 260-289): the shape is { name }; sql (was REQUIRED) and relationship (was .default('many_to_one')) leave the walked shape, aliases: { on: 'sql' } is deleted and guidance carries sql / relationship / on. Probed on the built head (@objectstack/spec/data): { name, sql } → REFUSED unrecognized_keys, message "joins.<alias>.sql was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove) — it never had an effect …" (LIT); { name } → ACCEPTED {"name":"other"} (DARK); { name, relationship: 'many_to_one' } (the old materialized default) → REFUSED with the prescription; { name, on: 'x' } → REFUSED with its own guidance and no "→ sql" rename; controls: { name, relationshipp } REFUSED with the batch-D history text and no guidance, {} REFUSED invalid_type on name. Correct on all legs.
2. Route — strict deletion plus guidance, not retiredKey(): CubeJoinSchema is a strictObject, which is the .strict() row of the retirement playbook's §2 fork, and Metric.filters (same file, entries/retired-keys/18.data__Metric__filters.ts) is the in-file precedent. The ruling's "retiredKey() tombstones per the standing shape" resolves to this route for a strict def. The three guidance strings carry the five house conventions (fully-qualified key first; "was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove)"; the inert-cause clause; "Delete the key." plus the derivation; and the house sentence "Run os migrate meta --from 17 to list the mechanical edits for existing sources; apply them by hand.") — retired-key-migrate-sentence.test.ts, alias-integrity.test.ts and strict-object.test.ts pass on the head. Judged correct.
3. ADR-0087 registration — exactly what addendum A prescribed. D2 cube-join-sql-and-relationship-removed (conversions/registry.ts:7625-7724, docblock from 7582): toMajor: 18, retiredFromLoadPath: true, mapCollection(stack, 'analyticsCubes', …) then stripKeys(join, ['sql','relationship'], …) per join, notice path analyticsCubes[i](``&lt;cube name&gt;``).joins.<alias>.<key>, fixture expectedNotices: 3 = the three stripped keys; chained into step18.conversionIds (migrations/registry.ts:5514); the D3 semantic entry cube-join-sql-and-relationship-retired stays (entries/semantic/18.…ts, surface without backticks, acceptanceCriteria carrying no migrate marker — the head's last commit moved it off); RETIRED_KEYS_BY_MAJOR[18] gains data/CubeJoin:relationship and data/CubeJoin:sql from the two per-file entries. Same shape as metric-filters-removed one surface over. Gates on the head: check:migration-registry exit 0 ("225 semantic, 195 retired-key, 181 retired-def"); check-adr-0087-registration --base origin/main exit 0 ("[BREAKING+clause-②-narrowing] registered cube-join-sql-and-relationship-retired (new here)"), --self-test exit 0.
4. The artifact at rest heals at the boot door — measured at the metadata-core seam, not only the spec one. All three doors in packages/metadata/src/plugin.ts:894-923 pass the metadata through _convertArtifactForward → applyArtifactForwardConversions (includeRetired: true) BEFORE the strict parse. Probe from inside packages/metadata-core on the built head, runtime 17.5.0, artifact manifest engines.protocol: '>=17.0.0', cube join { name, relationship: 'many_to_one', sql } (what CubeSchema.parse used to emit): ObjectStackDefinitionSchema REFUSES it raw; the door returns verdict=converted-forward with two notices cube-join-sql-and-relationship-removed@analyticsCubes[0](showcase_delivery).joins.project.sql / .relationship; the converted definition is ACCEPTED, joins healed to {"project":{"name":"showcase_project"}}. Firing control, same probe with relationshipp (never valid): 0 notices, REFUSED before and after at analyticsCubes[0].joins.project. The spec-seam pin (analytics.test.ts "a persisted cube heals at the door", 3 tests incl. its own lit control and the per-cube notice paths) passes. This closes the prior record's ③-1.
5. The describe line and the showcase join. name's describe (analytics.zod.ts:322-330) now states the join KEY is the FOREIGN-KEY FIELD on the cube's own object and spells the emission LEFT JOIN <name> <key> ON <base>.<key> = <key>.id. Verified against the code: native-sql-strategy.ts:750-756 emits LEFT JOIN "<joinTable>" "<alias>" ON "<parentAlias>"."<seg>" = "<alias>"."id" with alias = path segment = the joins record key, and objectql-strategy.ts:992 lowers fkField: alias. Showcase: DeliveryCube.sql = 'showcase_task', task.object.ts:37 declares project: Field.masterDetail('showcase_project'), the join is re-keyed showcase_project → project and gap-fill.test.ts pins every join key against the base object's real field map (not a literal). The docblock's two symbol anchors resolve (check:spec-docblock-symbol-anchors exit 0, "3130 anchors across 1462 spec sources resolve"). Judged correct. Noted, not flagged: no DeliveryCube member traverses project. (grep of sql: '<x>. in showcase.cube.ts = 0 lines; radius = that file's content; known target outside it: task.object.ts:37, which declares the FK the grep does not read; firing control: the same file's 8 project mentions), so the join is now resolvable but exercised by nothing — the addendum asked for the key to be right, and it is.
6. Ratchets, ledger, docs — authorable-surface/data.json loses the two rows and authorable-defaults/data.json the default line; check:authorable-surface exit 0 adjudicating both under authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 proof 4 ("def reachable from the metadata-type roots; writing 'relationship' on it is REFUSED as an unrecognized key", same for sql). Liveness: the two dead rows leave liveness/analytics_cube.json (the strict-deletion disposition), the name row's note and the README notes cell are rewritten, state-counts.md 12→10 dead / 161→159 / 1094→1092; check:liveness exit 0. content/docs/references/data/analytics.mdx regenerated (both joins tables collapse to name, whose description states the derivation and the KEY convention); check:generated exit 0 ("All 15 generated artifacts are up to date"). Step 18 is not projected into spec-changes.json (protocolVersion 17.0.0) or the upgrade guide — the same as the precedent metric-filters-removed, which appears in no generated non-.ts artefact either (measured).
7. Consumers, producers, sibling — reads of a join's sql / relationship in non-test .ts under packages/ and examples/: 0 (grep exit 1). Instrument: content grep of a member-access pattern; reachable radius = the CONTENT of non-test .ts files under those two roots; a known target outside that radius: the literal relationship: 'many_to_one' inside the D2 fixture at conversions/registry.ts:7669/7689 (a fixture value, not a read — the pattern does not fire on it). Firing control, same instrument: reads of joins?.[alias]?.name = 7 code sites (native-sql-strategy.ts 335/596/750/946, objectql-strategy.ts 662/992/1363) plus analytics-service.ts:1178's { name?: string }, untouched. dataset-compiler.ts:595-604 stops minting the two constants and drops parentAlias. Producers fixed in-diff: showcase.cube.ts and seven service-analytics fixtures. Sibling objectui at the pinned .objectui-sha 53ded82bf7a4: git grep for CubeJoin, joins[x].sql|relationship and the three cardinality literals = 0 (git grep exit 1); radius = CONTENT of every tracked file in that tree except node_modules/**; known target outside the radius: objectui's installed node_modules/@objectstack/spec .d.ts, which declares CubeJoinSchema and is pathspec-excluded; control AnalyticsQuery|measures = 301 files. Post-Task Checklist step 4 holds.
8. Docs and skills teaching sites — the literal relationship: 'many_to_one|one_to_many|one_to_one' spellings over content/, docs/, skills/, packages/*/README.md (.md/.mdx/.yaml/.yml/.json, minus CHANGELOG and docs/audits/): 0 (grep exit 1); radius = the CONTENT of those files; known target outside it: docs/audits/2026-07-unknown-key-strictness-ledger.md (1 hit, excluded by the filter); control analyticsCubes = 6 files. No hand-written page teaches analyticsCubes[].joins; content/docs/data-modeling/analytics.mdx:46,81 already says joins are compiled and "you never write an ON clause" (datasets). The maintainer's "docs say so" half is served by the regenerated reference page.
9. Verification I ran on the head (all exit 0 unless stated): @objectstack/spec build (DTS emitted); check:generated; check:authorable-surface; check:liveness; check:migration-registry; check-adr-0087-registration + self-test; check-changeset-no-major --base origin/main ("no major bump"; level axis N/A locally — I read Clause-②: yes (narrowing) off the PR body and the changeset myself); check:spec-docblock-symbol-anchors; eslint over the 11 changed source/test files; spec targeted suites (analytics, batch-D, alias-integrity, migrate-sentence, strict-object, conversions/, migrations/) 10 files / 517 tests; check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries; dispatch-gates --commands derives 112 commands for the 22 paths. NOT re-measured locally: @objectstack/service-analytics test, the showcase gap-fill.test.ts, and typecheck for spec / service-analytics / showcase — my fresh worktree's first runs failed only on unbuilt sibling dists (67× "Failed to resolve entry for package @objectstack/core", plus driver-sql, driver-sqlite-wasm, types, objectql; typecheck 26× TS2307 + 12× TS7006 and 28× TS2307, 0 of them naming sql, relationship or CubeJoin), and the re-run behind a dependency-closure build was still queued on the shared verify lock at delivery. For those, CI at this head is the reading: Test Core (1-6) success, Type Check · workspace success, and the consumer-gates log shows examples/app-showcase typecheck: Done before that job's later failure.
10. What the diff does not do — no governed surface is in the 22-file list (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md); analytics-service.ts:1178 is unchanged; public and refreshKey.* rows are untouched; no wire payload narrows (AnalyticsQueryRequestSchema reaches CubeJoinSchema only through CubeSchema). An artifact whose declared floor is ≥ the runtime version is authored-current at the door and is NOT converted (probe: floor 17.0.0 vs runtime 17.0.0 → 0 notices, still refused) — the door's own design, stated so nobody reads the heal as unconditional. The hotcrm / cloud census is not measurable from here.

② Semver level

• '@objectstack/spec': minor with the BREAKING banner, the FROM → TO table (three rows incl. on), the one-line fix and <!-- adr-0087: registered cube-join-sql-and-relationship-retired --> is the right level under the launch-window convention (scripts/check-changeset-no-major.mjs, my run exit 0). Clause-②: yes (narrowing) is the right arm: a published authoring schema's accept set shrinks (sql required → refused, relationship → refused, on alias → refused); yes needs at least minor, satisfied; not (widening) — the DARK leg is the consequence of removing a required key.
• The declaration-text reshape is this same narrowing, not a second change. CI's check:api-surface-declarations (see ③-1) reports "0 removed, 0 added, 5 reshaped": ObjectStackDefinitionSchema, ObjectStackSchema (root.txt), CubeJoinSchema, CubeSchema (data.txt), EnvironmentArtifactSchema (system.txt). I reproduced it on the PR's merge commit 33dcd59204 (fresh install, spec build, gate exit 1 with the same five; check:api-surface exit 0) and regenerated: the shard diff is 30 deleted lines, 0 added — each of the five loses exactly sql: z.ZodString; and the relationship: z.ZodDefault<z.ZodEnum<{ one_to_one; one_to_many; many_to_one }>>; block, propagated by type inlining; check:generated on that regenerated merge tree exit 0 ("All 16 generated artifacts are up to date"). Ruled here so the regeneration commit needs no re-judgment: intentional, covered by the minor-with-BREAKING-banner above; no major.
• @objectstack/service-analytics (published, 17.4.0) changes its compiled-cube literal but rides the 70-package fixed group with spec, and no consumer reads the two keys; no separate changeset owed. Judged acceptable.

③ Boundary flags

1. FLAG (blocking for landing) — the head cannot merge: the REQUIRED context TypeScript Type Check is red at this head, on a generated artefact the branch has never carried. Read from the API: 39 check runs; Type Check · consumer gates = failure at step "Check @objectstack/spec declaration text (the shape half)" (pnpm --filter @objectstack/spec run check:api-surface-declarations: "5 reshaped … If intentional, run gen:api-surface-declarations and commit the updated shards"), which reds the typecheck aggregator listed in REQUIRED_CONTEXTS (scripts/check-required-contexts.mjs:388); the other six required contexts (lint, test-gate, dogfood-gate, build-core, temporal-conformance, governed-surface-guard) are success. Cause, measured: that gate landed on main at d8b12fca97 (2026-09-18T09:30Z, feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971) — after this branch's merge-base 54145ccec0 (06:26Z) and after the prior head 6ac13a9120 (07:06Z) — so the head tree has neither the script nor packages/spec/api-surface-declarations/, and CI's merge with main reshapes five declarations (attributed in ② — each of the five carries the old one_to_many enum in main's shards at root.txt 22351/44204, data.txt 982/1059, system.txt 54364). Not a judgment error and not a regression of round 2, but a commit this branch owes and the queue cannot supply. Prescribed fix: merge origin/main into the branch (or rebase), run pnpm --filter @objectstack/spec gen:api-surface-declarations, commit the three shards (expected diff: the 30-line pure deletion above), and confirm check:api-surface-declarations and check:generated are green on the merged tree (I measured both green after regeneration on 33dcd59204). Secondary consequence: the consumer-gates job aborted at that step, so its 15 later steps are unmeasured by CI at this head; of those I measured on the head check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries (all 0, and the same five 0 on the merge tree); check:skill-examples REFUSED on both trees ("packages/client-react/dist holds no .d.ts declarations — the package is not built", exit 1 = not measured, a prerequisite of my fresh worktrees); check:i18n, check:i18n-coverage, check:i18n-walk-parity exit 3 on both trees ("PREREQUISITE NOT MET — the workspace CLI is not built"); not measured here: the root-entry nameability pin, check:exported-any-returns (client), the lint package's doc-formula / doc-security-posture checks, the sdui react parity ratchet. A merged, regenerated head will let CI measure all fifteen.
2. FLAG — the PR body still describes a head that no longer exists. It carries "ONE GAP … check:adr-0087-registration is RED on purpose … the changeset deliberately carries no disposition marker" and asks the PM to lift a fence on registry.ts; at e177aa2686 the marker is present, the gate is green, and the body says nothing about the D2 conversion, the describe line or the showcase re-key that this round added. Judged on the file list per AGENTS.md, so not a contract defect, but it must be rewritten before landing (the seat's, per the one-writer rule). Nothing is armed: draft: true.
3. Non-blocking — the changeset's ADR-0087 marker names the D3 id only; the D2 id cube-join-sql-and-relationship-removed is equally new in this diff, and the marker form takes a list. Naming both would make the disposition self-describing; the gate accepts the current form (exit 0), so this is a completeness note, not a defect.
4. Stated, not flagged: registration under major 18 while shipping on 17.x follows the data/Metric:filters convention; spec-changes.json / the upgrade guide / os migrate meta stay silent about step 18 until protocol 18 (precedent-consistent); the showcase join is resolvable but exercised by no member (①-5); external artifacts and the hotcrm / cloud census were not measurable from here.

Zeros I report carry these controls and radii: consumer reads 0 vs 7+1 name reads (radius: non-test .ts content under packages/+examples/; outside-radius target: the D2 fixture literal); objectui pin 0 vs 301 files (radius: tracked content at the pinned SHA minus node_modules; outside: its installed spec .d.ts); docs/skills sites 0 vs 6 (radius: .md/.mdx/.yaml/.json content under content/, docs/, skills/, package READMEs minus CHANGELOG and docs/audits/; outside: the 2026-07 strictness ledger); showcase members traversing the join 0 vs the same cube's 8 project mentions (radius: showcase.cube.ts content; outside: task.object.ts:37); boot-door probe 2 notices vs 0 on relationshipp. One instrument was dark on both sides and certifies nothing: the old join spellings in translation bundles (*/i18n|locales|translations/*.json) = 0 with control analyticsCubes|"measures" also 0 — reported as unmeasured, not as a zero. Not measured: repo-wide pnpm test / pnpm typecheck; check:dual-build-cjs-loads; the CI steps listed in ③-1; the local re-runs named in ①-9; external artifacts.

Implemented-by: claude/issue-18612-cubejoin-retire-sql-relationship
Reviewed-by: session_01JbZnqu8bt6YqfJsr9vaFb3

VERDICT: FAIL

---

Generated by Claude Code

[os-bill]

⚠️ 更正:上一条(5731580036)采纳的是一份中途的记录,⛔ 不是最终的。本条采纳最终记录,并把两处偏差照实说清。 ⏱️ 本次采纳的取数时刻 2026-09-18T14:39Z(本行时刻由本次动作读钟而得)。

偏差一:上一条采纳的是 interim hand-back —— ⭐ 这是本席的错

复核子代理第一次交回时,宿主的通知里写明它仍有后台工作在跑、结果可能是中途的。本席读到了那句话,仍然采纳了。随后它交回了最终记录。

两版的差别,本席逐段比对过:

• 判决相同:两版都是 FAIL。
• 阻塞项相同:③-1 一字未动(TypeScript Type Check 在本 head 红,因分支早于 check:api-surface-declarations 落地;处方是合 main + gen:api-surface-declarations + 提交三个分片)。
• 变的是证据:第一版把 @objectstack/service-analytics 的测试、showcase 的 gap-fill.test.ts 与若干 typecheck 记作「还排在共享锁上、未在本地重测」;最终版把它们跑完了 —— service-analytics 112 文件 / 2403 测试通过、showcase gap-fill.test.ts 13 测试通过,并据此改写了 ①-5 / ①-7 / ①-9 的相应句子。

⇒ ⭐ 结论没有因此改变,但「已测」与「未测」的分界改变了 —— 而那正是这类记录最该被准确引用的部分。

偏差二:平台把记录里的尖括号片段改写了 —— ⛔ 那不是本席改的

⏱️ 同一时刻实测:上一条存回来的正文与本席送出的不逐字节相同,首个差异在偏移 4457 —— `analyticsCubes[i](```<cube name>```).joins…` 被存成 `analyticsCubes[i](<cube name>).joins…` 。这是 GitHub sanitizer 对代码跨度内尖括号片段的既有行为(本仓章程对此有成文纪律:上 GitHub 的文本尖括号一律改占位词拼写)。

本记录里同类片段共 15 处、9 种(<alias> · <cube name> · <key> · <name> · <base> · <joinTable> · <parentAlias> · <seg> · <x>),两版数量相同。⇒ ⭐ 本席无法经此通道把它逐字节送上来;本席选择送出原文并把这条平台变换申报清楚,⛔ 而不是替复核席改写成占位词 —— 因为「逐字采纳或整体作废」防的正是席位改写。

档位证据(与上一条相同的一次测量)

复核子代理自身 transcript:type:"assistant" 206 行,逐条 harness 盖章 message.model 全部等于 CONTRACT_REVIEW_TIER(实时 import,值 claude-fable-5-1),206/206 达档、0 off-tier、0 不可解析。⛔ get_session 未用于此判定。喂给复核席的只有卡面、两条在先裁决与 PR 本体;⛔ 无派发令、⛔ 无本席结论,并明令席位评论一律当非证据。

⚠️ 本席的发帖闸门(H44)与 post-stamped 的戳契约都会拒本评论(记录内有不带取数时刻的树读数,以及复核席自己引的一个时刻)。硬线「逐字采纳或整体作废」胜出;本席走裸 REST,并把本席自己的时刻按上面的方式读钟写明。⛔ 没有关掉任何闸门。

---

Commands run (head worktree scratchpad/pr-18938-r2 at e177aa2, fresh pnpm install --frozen-lockfile; merge worktree scratchpad/pr-18938-merge at 33dcd59; all heavy steps via scripts/pm/os-verify-lock.sh): spec build; spec check:generated, check:authorable-surface, check:liveness, check:migration-registry; node scripts/check-adr-0087-registration.mjs --base origin/main + --self-test; node scripts/check-changeset-no-major.mjs --base origin/main; metadata-core build + a tsx probe of applyArtifactForwardConversions/ObjectStackDefinitionSchema/CubeJoinSchema; pnpm check:spec-docblock-symbol-anchors; eslint over the 11 changed source/test files; spec vitest on analytics, batch-D, alias-integrity, migrate-sentence, strict-object, conversions/, migrations/; turbo run build of the service-analytics and showcase dependency closures, then @objectstack/service-analytics test and the showcase gap-fill.test.ts; spec check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries, check:skill-examples; pnpm check:i18n, check:i18n-coverage, check:i18n-walk-parity; node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack; on the merge commit: install, spec build, check:api-surface-declarations, check:api-surface, gen:api-surface-declarations + git diff of the shards, check:generated; git/grep census at head and at objectui pin 53ded82bf7a4; GitHub API reads of the card, the PR (body, files, check runs, failed job log) and the two prior rulings. The package typechecks and the full spec suite were still running behind the shared lock at delivery and are reported below as not re-measured locally.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e177aa2686de7aab23bc452e83fe77981b651e59

① Derived judgments

Fresh review of the head e177aa2686 against merge-base 54145ccec01a (rules read from origin/main @ abb01f105c; CI's merge commit 33dcd59204 = this head into main dbd474431f). Every reading below is mine, taken in a detached worktree at the head with its own pnpm install --frozen-lockfile, heavy steps under scripts/pm/os-verify-lock.sh, exit codes captured before any pipe. Seat comments were not used; the prior FAIL at 6ac13a9120 was read only for what it measured.

1. Accept-set narrowing at CubeJoinSchema — packages/spec/src/data/analytics.zod.ts:306-332 (guidance constants 260-289): the shape is { name }; sql (was REQUIRED) and relationship (was .default('many_to_one')) leave the walked shape, aliases: { on: 'sql' } is deleted and guidance carries sql / relationship / on. Probed on the built head (@objectstack/spec/data): { name, sql } → REFUSED unrecognized_keys, message "joins.<alias>.sql was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove) — it never had an effect …" (LIT); { name } → ACCEPTED {"name":"other"} (DARK); { name, relationship: 'many_to_one' } (the old materialized default) → REFUSED with the prescription; { name, on: 'x' } → REFUSED with its own guidance and no "→ sql" rename; controls: { name, relationshipp } REFUSED with the batch-D history text and no guidance, {} REFUSED invalid_type on name. Correct on all legs.
2. Route — strict deletion plus guidance, not retiredKey(): CubeJoinSchema is a strictObject, which is the .strict() row of the retirement playbook's §2 fork, and Metric.filters (same file, entries/retired-keys/18.data__Metric__filters.ts) is the in-file precedent. The ruling's "retiredKey() tombstones per the standing shape" resolves to this route for a strict def. The three guidance strings carry the five house conventions (fully-qualified key first; "was removed in @objectstack/spec 17 (ADR-0049 enforce-or-remove)"; the inert-cause clause; "Delete the key." plus the derivation; and the house sentence "Run os migrate meta --from 17 to list the mechanical edits for existing sources; apply them by hand.") — retired-key-migrate-sentence.test.ts, alias-integrity.test.ts and strict-object.test.ts pass on the head. Judged correct.
3. ADR-0087 registration — exactly what addendum A prescribed. D2 cube-join-sql-and-relationship-removed (conversions/registry.ts:7625-7724, docblock from 7582): toMajor: 18, retiredFromLoadPath: true, mapCollection(stack, 'analyticsCubes', …) then stripKeys(join, ['sql','relationship'], …) per join, notice path analyticsCubes[i](```&lt;cube name&gt;```).joins.<alias>.<key>, fixture expectedNotices: 3 = the three stripped keys; chained into step18.conversionIds (migrations/registry.ts:5514); the D3 semantic entry cube-join-sql-and-relationship-retired stays (entries/semantic/18.…ts, surface without backticks, acceptanceCriteria carrying no migrate marker — the head's last commit moved it off); RETIRED_KEYS_BY_MAJOR[18] gains data/CubeJoin:relationship and data/CubeJoin:sql from the two per-file entries. Same shape as metric-filters-removed one surface over. Gates on the head: check:migration-registry exit 0 ("225 semantic, 195 retired-key, 181 retired-def"); check-adr-0087-registration --base origin/main exit 0 ("[BREAKING+clause-②-narrowing] registered cube-join-sql-and-relationship-retired (new here)"), --self-test exit 0.
4. The artifact at rest heals at the boot door — measured at the metadata-core seam, not only the spec one. All three doors in packages/metadata/src/plugin.ts:894-923 pass the metadata through _convertArtifactForward → applyArtifactForwardConversions (includeRetired: true) BEFORE the strict parse. Probe from inside packages/metadata-core on the built head, runtime 17.5.0, artifact manifest engines.protocol: '>=17.0.0', cube join { name, relationship: 'many_to_one', sql } (what CubeSchema.parse used to emit): ObjectStackDefinitionSchema REFUSES it raw; the door returns verdict=converted-forward with two notices cube-join-sql-and-relationship-removed@analyticsCubes[0](showcase_delivery).joins.project.sql / .relationship; the converted definition is ACCEPTED, joins healed to {"project":{"name":"showcase_project"}}. Firing control, same probe with relationshipp (never valid): 0 notices, REFUSED before and after at analyticsCubes[0].joins.project. The spec-seam pin (analytics.test.ts "a persisted cube heals at the door", 3 tests incl. its own lit control and the per-cube notice paths) passes. This closes the prior record's ③-1.
5. The describe line and the showcase join. name's describe (analytics.zod.ts:322-330) now states the join KEY is the FOREIGN-KEY FIELD on the cube's own object and spells the emission LEFT JOIN <name> <key> ON <base>.<key> = <key>.id. Verified against the code: native-sql-strategy.ts:750-756 emits LEFT JOIN "<joinTable>" "<alias>" ON "<parentAlias>"."<seg>" = "<alias>"."id" with alias = path segment = the joins record key, and objectql-strategy.ts:992 lowers fkField: alias. Showcase: DeliveryCube.sql = 'showcase_task', task.object.ts:37 declares project: Field.masterDetail('showcase_project'), the join is re-keyed showcase_project → project and gap-fill.test.ts pins every join key against the base object's real field map (not a literal) — 13 tests pass on the head after the closure build. The docblock's two symbol anchors resolve (check:spec-docblock-symbol-anchors exit 0, "3130 anchors across 1462 spec sources resolve"). Judged correct. Noted, not flagged: no DeliveryCube member traverses project. (grep of sql: '<x>. in showcase.cube.ts = 0 lines; radius = that file's content; known target outside it: task.object.ts:37, which declares the FK the grep does not read; firing control: the same file's 8 project mentions), so the join is now resolvable but exercised by nothing — the addendum asked for the key to be right, and it is.
6. Ratchets, ledger, docs — authorable-surface/data.json loses the two rows and authorable-defaults/data.json the default line; check:authorable-surface exit 0 adjudicating both under authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 proof 4 ("def reachable from the metadata-type roots; writing 'relationship' on it is REFUSED as an unrecognized key", same for sql). Liveness: the two dead rows leave liveness/analytics_cube.json (the strict-deletion disposition), the name row's note and the README notes cell are rewritten, state-counts.md 12→10 dead / 161→159 / 1094→1092; check:liveness exit 0. content/docs/references/data/analytics.mdx regenerated (both joins tables collapse to name, whose description states the derivation and the KEY convention); check:generated exit 0 ("All 15 generated artifacts are up to date"). Step 18 is not projected into spec-changes.json (protocolVersion 17.0.0) or the upgrade guide — the same as the precedent metric-filters-removed, which appears in no generated non-.ts artefact either (measured).
7. Consumers, producers, sibling — reads of a join's sql / relationship in non-test .ts under packages/ and examples/: 0 (grep exit 1). Instrument: content grep of a member-access pattern; reachable radius = the CONTENT of non-test .ts files under those two roots; a known target outside that radius: the literal relationship: 'many_to_one' inside the D2 fixture at conversions/registry.ts:7669/7689 (a fixture value, not a read — the pattern does not fire on it). Firing control, same instrument: reads of joins?.[alias]?.name = 7 code sites (native-sql-strategy.ts 335/596/750/946, objectql-strategy.ts 662/992/1363) plus analytics-service.ts:1178's { name?: string }, untouched. dataset-compiler.ts:595-604 stops minting the two constants and drops parentAlias; @objectstack/service-analytics test on the head after the closure build: 112 files / 2403 tests pass. Producers fixed in-diff: showcase.cube.ts and seven service-analytics fixtures. Sibling objectui at the pinned .objectui-sha 53ded82bf7a4: git grep for CubeJoin, joins[x].sql|relationship and the three cardinality literals = 0 (git grep exit 1); radius = CONTENT of every tracked file in that tree except node_modules/**; known target outside the radius: objectui's installed node_modules/@objectstack/spec .d.ts, which declares CubeJoinSchema and is pathspec-excluded; control AnalyticsQuery|measures = 301 files. Post-Task Checklist step 4 holds.
8. Docs and skills teaching sites — the literal relationship: 'many_to_one|one_to_many|one_to_one' spellings over content/, docs/, skills/, packages/*/README.md (.md/.mdx/.yaml/.yml/.json, minus CHANGELOG and docs/audits/): 0 (grep exit 1); radius = the CONTENT of those files; known target outside it: docs/audits/2026-07-unknown-key-strictness-ledger.md (1 hit, excluded by the filter); control analyticsCubes = 6 files. No hand-written page teaches analyticsCubes[].joins; content/docs/data-modeling/analytics.mdx:46,81 already says joins are compiled and "you never write an ON clause" (datasets). The maintainer's "docs say so" half is served by the regenerated reference page.
9. Verification I ran on the head (all exit 0 unless stated): @objectstack/spec build (DTS emitted); check:generated; check:authorable-surface; check:liveness; check:migration-registry; check-adr-0087-registration + self-test; check-changeset-no-major --base origin/main ("no major bump"; level axis N/A locally — I read Clause-②: yes (narrowing) off the PR body and the changeset myself); check:spec-docblock-symbol-anchors; eslint over the 11 changed source/test files; spec targeted suites (analytics, batch-D, alias-integrity, migrate-sentence, strict-object, conversions/, migrations/) 10 files / 517 tests; @objectstack/service-analytics test 112 files / 2403 tests; showcase gap-fill.test.ts 13 tests; check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries; dispatch-gates --commands derives 112 commands for the 22 paths. My first test/typecheck runs in the fresh worktree failed only on unbuilt sibling dists (67× "Failed to resolve entry for package @objectstack/core" etc.; typecheck 26× TS2307 + 12× TS7006 and 28× TS2307, 0 of them naming sql, relationship or CubeJoin) — a prerequisite miss, not a diff finding, and the suites went green once the closure was built. NOT re-measured locally at delivery: typecheck for spec / service-analytics / showcase and the full spec suite (still queued behind the shared verify lock); for those CI at this head is the reading — Test Core (1-6) success, Type Check · workspace success, and the consumer-gates log shows examples/app-showcase typecheck: Done before that job's later failure.
10. What the diff does not do — no governed surface is in the 22-file list (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md); analytics-service.ts:1178 is unchanged; public and refreshKey.* rows are untouched; no wire payload narrows (AnalyticsQueryRequestSchema reaches CubeJoinSchema only through CubeSchema). An artifact whose declared floor is ≥ the runtime version is authored-current at the door and is NOT converted (probe: floor 17.0.0 vs runtime 17.0.0 → 0 notices, still refused) — the door's own design, stated so nobody reads the heal as unconditional. The hotcrm / cloud census is not measurable from here.

② Semver level

• '@objectstack/spec': minor with the BREAKING banner, the FROM → TO table (three rows incl. on), the one-line fix and <!-- adr-0087: registered cube-join-sql-and-relationship-retired --> is the right level under the launch-window convention (scripts/check-changeset-no-major.mjs, my run exit 0). Clause-②: yes (narrowing) is the right arm: a published authoring schema's accept set shrinks (sql required → refused, relationship → refused, on alias → refused); yes needs at least minor, satisfied; not (widening) — the DARK leg is the consequence of removing a required key.
• The declaration-text reshape is this same narrowing, not a second change. CI's check:api-surface-declarations (see ③-1) reports "0 removed, 0 added, 5 reshaped": ObjectStackDefinitionSchema, ObjectStackSchema (root.txt), CubeJoinSchema, CubeSchema (data.txt), EnvironmentArtifactSchema (system.txt). I reproduced it on the PR's merge commit 33dcd59204 (fresh install, spec build, gate exit 1 with the same five; check:api-surface exit 0) and regenerated: the shard diff is 30 deleted lines, 0 added — each of the five loses exactly sql: z.ZodString; and the relationship: z.ZodDefault<z.ZodEnum<{ one_to_one; one_to_many; many_to_one }>>; block, propagated by type inlining; check:generated on that regenerated merge tree exit 0 ("All 16 generated artifacts are up to date"). Ruled here so the regeneration commit needs no re-judgment: intentional, covered by the minor-with-BREAKING-banner above; no major.
• @objectstack/service-analytics (published, 17.4.0) changes its compiled-cube literal but rides the 70-package fixed group with spec, and no consumer reads the two keys; no separate changeset owed. Judged acceptable.

③ Boundary flags

1. FLAG (blocking for landing) — the head cannot merge: the REQUIRED context TypeScript Type Check is red at this head, on a generated artefact the branch has never carried. Read from the API: 39 check runs; Type Check · consumer gates = failure at step "Check @objectstack/spec declaration text (the shape half)" (pnpm --filter @objectstack/spec run check:api-surface-declarations: "5 reshaped … If intentional, run gen:api-surface-declarations and commit the updated shards"), which reds the typecheck aggregator listed in REQUIRED_CONTEXTS (scripts/check-required-contexts.mjs:388); the other six required contexts (lint, test-gate, dogfood-gate, build-core, temporal-conformance, governed-surface-guard) are success. Cause, measured: that gate landed on main at d8b12fca97 (2026-09-18T09:30Z, feat(spec): pin every export by its .d.ts declaration text, and retire the 27 signature hashes #18971) — after this branch's merge-base 54145ccec0 (06:26Z) and after the prior head 6ac13a9120 (07:06Z) — so the head tree has neither the script nor packages/spec/api-surface-declarations/, and CI's merge with main reshapes five declarations (attributed in ② — each of the five carries the old one_to_many enum in main's shards at root.txt 22351/44204, data.txt 982/1059, system.txt 54364). Not a judgment error and not a regression of round 2, but a commit this branch owes and the queue cannot supply. Prescribed fix: merge origin/main into the branch (or rebase), run pnpm --filter @objectstack/spec gen:api-surface-declarations, commit the three shards (expected diff: the 30-line pure deletion above), and confirm check:api-surface-declarations and check:generated are green on the merged tree (I measured both green after regeneration on 33dcd59204). Secondary consequence: the consumer-gates job aborted at that step, so its 15 later steps are unmeasured by CI at this head; of those I measured on the head check:exported-any, check:yaml-examples, check:dual-source-exports, check:entry-nameability, check:browser-reachable-entries (all 0, and the same five 0 on the merge tree); check:skill-examples REFUSED on both trees ("packages/client-react/dist holds no .d.ts declarations — the package is not built", exit 1 = not measured, a prerequisite of my fresh worktrees); check:i18n, check:i18n-coverage, check:i18n-walk-parity exit 3 on both trees ("PREREQUISITE NOT MET — the workspace CLI is not built"); not measured here: the root-entry nameability pin, check:exported-any-returns (client), the lint package's doc-formula / doc-security-posture checks, the sdui react parity ratchet. A merged, regenerated head will let CI measure all fifteen.
2. FLAG — the PR body still describes a head that no longer exists. It carries "ONE GAP … check:adr-0087-registration is RED on purpose … the changeset deliberately carries no disposition marker" and asks the PM to lift a fence on registry.ts; at e177aa2686 the marker is present, the gate is green, and the body says nothing about the D2 conversion, the describe line or the showcase re-key that this round added. Judged on the file list per AGENTS.md, so not a contract defect, but it must be rewritten before landing (the seat's, per the one-writer rule). Nothing is armed: draft: true.
3. Non-blocking — the changeset's ADR-0087 marker names the D3 id only; the D2 id cube-join-sql-and-relationship-removed is equally new in this diff, and the marker form takes a list. Naming both would make the disposition self-describing; the gate accepts the current form (exit 0), so this is a completeness note, not a defect.
4. Stated, not flagged: registration under major 18 while shipping on 17.x follows the data/Metric:filters convention; spec-changes.json / the upgrade guide / os migrate meta stay silent about step 18 until protocol 18 (precedent-consistent); the showcase join is resolvable but exercised by no member (①-5); external artifacts and the hotcrm / cloud census were not measurable from here.

Zeros I report carry these controls and radii: consumer reads 0 vs 7+1 name reads (radius: non-test .ts content under packages/+examples/; outside-radius target: the D2 fixture literal); objectui pin 0 vs 301 files (radius: tracked content at the pinned SHA minus node_modules; outside: its installed spec .d.ts); docs/skills sites 0 vs 6 (radius: .md/.mdx/.yaml/.json content under content/, docs/, skills/, package READMEs minus CHANGELOG and docs/audits/; outside: the 2026-07 strictness ledger); showcase members traversing the join 0 vs the same cube's 8 project mentions (radius: showcase.cube.ts content; outside: task.object.ts:37); boot-door probe 2 notices vs 0 on relationshipp. One instrument was dark on both sides and certifies nothing: the old join spellings in translation bundles (*/i18n|locales|translations/*.json) = 0 with control analyticsCubes|"measures" also 0 — reported as unmeasured, not as a zero. Not measured: repo-wide pnpm test / pnpm typecheck; check:dual-build-cjs-loads; the CI steps listed in ③-1; the local typechecks and full spec suite named in ①-9; external artifacts.

Implemented-by: claude/issue-18612-cubejoin-retire-sql-relationship
Reviewed-by: session_01JbZnqu8bt6YqfJsr9vaFb3

VERDICT: FAIL

---

Generated by Claude Code

[os-bill]

补记:同一次复核共交回 三 版记录。判决与阻塞项三版完全相同;差别只在「已测 / 未测」的分界。 ⏱️ 2026-09-18T14:41Z(本行时刻由本次动作读钟而得)。

三版的关系,本席机械比对过

v1  20366 字节   VERDICT: FAIL     ← 本席在 5731580036 里采纳(⚠️ 宿主已标明可能是中途结果)
v2  20705 字节   VERDICT: FAIL     ← 本席在 5731599385 里采纳,并公开更正了 v1
v3  20500 字节   VERDICT: FAIL     ← 本条补记的对象

三版的 ③-1(唯一阻塞项)一字未变;②、①-1..①-8、①-10 亦同。变的只有 ①-9 与开头的命令清单:复核席排在共享验证锁后面的那批本地运行,逐次跑完了。

v2 → v3 的实质增量,逐字:

• v2 的「NOT re-measured locally at delivery: typecheck for spec / service-analytics / showcase and the full spec suite (still queued behind the shared verify lock)」——这句在 v3 里没有了;
• v3 改为「full @objectstack/spec test 488 files / 14190 tests;…typecheck for @objectstack/spec + @objectstack/service-analytics and for the showcase」。

⇒ ⭐ 结论不因此改变,但「已测」与「未测」的分界改变了 —— 而这正是这类记录最该被准确引用的部分,所以本席把它记下来,⛔ 而不是让最新一版悄悄取代前一版。

本席据此停在哪里,以及为什么

⛔ 本席不再贴第四份全文。采纳的记录以 5731599385(v2) 为准,本条把 v2 → v3 的全部实质差异逐字列在上面。判据是:判决与阻塞项在三版之间稳定,而剩余差异只是同一个复核席把自己「未测」的部分补测成「已测」。⇒ 再贴一份 20 KB 全文只增加噪音,⛔ 不增加任何可据以行动的东西。

⚠️ 若哪一版的判决或 ③-1 发生过变化,这条规则不成立 —— 那时必须整份重采。本席把这条判据写出来,是为了让下一个读者能检验本席停得对不对,⛔ 而不是要他相信。

⚠️ 一条本席付了两次学费的平台读数

一个子代理的 hand-back,在宿主通知写着「it stopped with background work of its own still running … the result below may be interim」时,可以不止交回一次 —— 本次交回了三次。⇒ 看到那句话就不能当终版采纳;要么等它真正停,要么采纳后按本条这样公开申报并追平。本席第一次就是读到了那句话仍然采纳,才有了后面两次更正。

---

Generated by Claude Code

[os-bill]

轮次 3 交回 —— ③-1 的阻塞项,本席实测已解除

本席 2026-09-18T15:02Z 复核。下面每一条都取自 GitHub API,⛔ 不取 dev 报告的叙述。

契约复核在 head e177aa2686 判 FAIL(⏱️ 2026-09-18T14:39Z 本席采纳该记录,评论 5731599385),唯一的阻塞项 ③-1 是:check:api-surface-declarations 于 d8b12fca97 落在 main 上,晚于本分支的 merge-base,所以分支既没有那道闸,也没有 packages/spec/api-surface-declarations/。处方是「并 origin/main → 重生成分片 → 提交三个 shard,预期 30 行纯删除」,并写明停止线:diff 不是纯删除就停手。

现读:

项	读数
取数时刻	2026-09-18T14:59Z
head	7caf92189a2780b22e3aab9bb6154f8604aa1974(原 e177aa2686)
59bd587aea	Merge remote-tracking branch 'origin/main' …
7caf92189a	chore(spec): regenerate the declaration shards after merging main
该 commit 的 API stats	{"total":30,"additions":0,"deletions":30}
触及文件	恰好 3 个:api-surface-declarations/data.txt −12、root.txt −12、system.txt −6
逐行 patch 统计(本席自己数的,⛔ 不复用 stats)	+0 / −30

⇒ 纯删除,一行未加。停止线没有触发;⛔ 没有任何一行被手写进生成物。这正是复核预判的形状 —— 五个 reshape 的声明各自失去 sql: z.ZodString; 与 relationship 的 enum 块,由类型内联传播。③-1 解除。

CI 现读(⏱️ 2026-09-18T14:59Z 取):33 个 check run,0 个失败。Build Core / Dogfood Regression Gate / Temporal Conformance (live PG + MySQL) / Governed Surface Queue Guard = success;Lint & Repo Gates 仍 in_progress;TypeScript Type Check 与 Test Core 尚未上报。⛔ 未上报不等于通过 —— 本席不据此落地。

③-2 本席已执行

PR 正文已重写(就在本条之前)。旧正文描述的是一个已不存在的 head —— 它还在讲「check:adr-0087-registration 故意是红的」并请 PM 解开 registry.ts 的封条,而这两件事在 e177aa2686 时就都已不成立(⏱️ 2026-09-18T14:39Z 取,本席采纳复核记录之时),正文却一个字没动。新正文按现 head 写,并把本轮新增的三件事(boot door 自愈、name 的 describe、showcase 重键)和下面这条落地顺序提示写了进去。

③-3(非阻塞)本席的处置:不改

复核指出 changeset 的 ADR-0087 标记只点了 D3 的 id,而 D2 的 cube-join-sql-and-relationship-removed 在本 diff 里同样是新的,且标记形式支持列表。闸对现形式 exit 0 ⇒ 这是完备性说明,不是缺陷。⛔ 本 PR 不为它单独再推一次 —— 一次为了措辞的推送会重跑整条 CI,代价大于收益。若本 PR 因别的原因还要再推代码,顺手带上。

⚠️ 落地顺序 —— 与 PR #19024 的交互

⏱️ 2026-09-18T14:58Z 取:PR #19024(维护者 hotlong 的,priority:p1)回退 #18971,删掉全部 17 个声明分片(实测 31 个文件、+119/−238,389)。两者谁后落,谁先并对方:

• 若 revert(spec): take back the declaration-text snapshot, restore the 27 signature hashes #19024 先落,本 PR 上面那个重生成 commit 就失效 —— 它的三个文件随整份快照一起消失。届时本 PR 只需再并一次 main,⛔ 不需要再生成任何分片。
• 若 本 PR 先落,revert(spec): take back the declaration-text snapshot, restore the 27 signature hashes #19024 的删除范围自动覆盖这三处删除,无冲突。

⛔ 这是机械合并,不是任何一方的缺陷。记在这里,免得下一轮有人把它读成新的红。

---

Generated by Claude Code

[os-bill]

入队 —— 并说清「复核判 FAIL,本席为什么仍然落它」

本席 2026-09-18T15:25Z 入队。决定性读数:timeline 的 added_to_merge_queue 事件,时刻 2026-09-18T15:23:56Z(其前 ready_for_review 于 2026-09-18T15:22:46Z)。⚠️ 之后 GET /pulls/{n} 的 auto_merge 读 null 是成功形,⛔ 不是挂载失败。

入队前的读数,全部第一手:

判据	读数(⏱️ 2026-09-18T15:22Z 取)
head	7caf92189a2780b22e3aab9bb6154f8604aa1974
7 个必需上下文	全部 TERMINAL,无红;该 head 上失败的 check run 0
mergeable / mergeable_state	true / clean
受管面	0 命中。半径 = 本 PR 的 25 行变更文件名;必在半径外的已知目标:main 上的 AGENTS.md(它是治理面,但不在本 diff 的行里,这把尺子结构上看不见);发火对照:同一把尺子 ^packages/spec/ 命中 16 行
条款②载体	needs:contract-review 不在(发火对照:同一次读到 documentation 在)—— 两个载体已于本班早前一笔清除,provenance 见评论 5727121965

为什么那个 FAIL 不拦这一次落地

契约复核的判词是 FAIL,而它的 ③-1 自己划定了这个 FAIL 的范围,逐字:

FLAG (blocking for landing) — the head cannot merge … Not a judgment error and not a regression of round 2, but a commit this branch owes and the queue cannot supply.

⇒ 它是落地阻塞,⛔ 不是契约缺陷。①(十条推断)与 ②(semver 档位)那两节,复核判的全是「correct」。

而同一份记录预先裁过那个修复 commit,逐字:

Ruled here so the regeneration commit needs no re-judgment: intentional, covered by the minor-with-BREAKING-banner above; no major.

⇒ 本席没有为这个新 head 重开一次契约复核。理由不是省事:

• 那个阻塞项是机械的,复核连 diff 的形状都预判了(30 行纯删除);而本席在评论 5731910940 里从 API 实测到的正是 {"total":30,"additions":0,"deletions":30}、恰好三个文件、+0/−30。
• 章程 ⛔ 明禁「为了钓 PASS 重掷」。在一个复核已经预裁过的机械修复上再掷一次,正是那条禁令要防的形状。

⚠️ 若谁认为这一步判错了,判据在上面那两段引文里,⛔ 不在本席的措辞里。

③-2 / ③-3 的落点

• ③-2(正文还在描述一个已不存在的 head):已重写。⭐ 并且本席第一次重写时自己踩了一个平台坑,照实记在这里:章程新写明「处方按动作分裂:建侧送全块(横线加页脚),改侧不送页脚」,而本席送了带页脚的正文 ⇒ 平台照章追加一条裸页脚,正文变成两条署名(实测送 12569、存 12627,差 58 字节,与章程记的数一致)。已按新处方重送不带页脚的正文;现读正文恰好一条署名(12537 字节)。
• ③-3(changeset 的 ADR-0087 标记只点了 D3 的 id):不改,理由已在评论 5731910940 —— 闸对现形式 exit 0,为一句措辞单独再推一次会重跑整条 CI,代价大于收益。

轮次 3 的 dev 报告 —— 本席读到的、比本席自己量得更多的两件

报告在卡 #18612 的评论 5732173105。⛔ 下面两条是 dev 的读数,不是本席的;本席只独立复核了那 30 行纯删除(评论 5731910940)。

1. ⭐ 它先把红复现了再修:在合完 main、尚未重生成的树上跑 check:api-surface-declarations,exit 1、「0 removed, 0 added, 5 reshaped」,点名的五处与契约复核在 CI 的合并提交上量到的同一组。⇒ 这是「先复现再修」那条腿,做对了。
2. ⭐ check:dual-build-cjs-loads 这一轮被真量了**:契约复核记录里它是 NOT MEASURED(要一次完整 pnpm build),dev 补了 build 后跑到 exit 0。报告称 112 个派生门禁全部 exit 0,--ran 对账「112 run, 0 NOT-MEASURED」。
3. ⚠️ 顺带一条环境事实,值得记:门禁花名册随 main 变了 —— 多出 check:api-surface-declarations,少掉 check:type-source-resolution(main 删了它的脚本)。⇒ 任何按记忆复用花名册的读数都会错。

⚠️ 与 PR #19024 的落地顺序 —— 现状更新

⏱️ 2026-09-18T15:16Z 取:#19024 现在是 mergeable: false / mergeable_state: dirty —— main 已经走到别处,它自己要先解一次冲突。⇒ 本 PR 先入队是较干净的顺序:#19024 删掉全部 17 个分片,其范围覆盖本 PR 那三处分片删除,⛔ 无冲突可言。反过来则本 PR 的重生成 commit 会被顶掉一次。

---

Generated by Claude Code