feat(spec)!: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (#20288)

[objectstack-fleet]

Closes #20288

Clause-②: yes (narrowing)

RealtimeEventType (@objectstack/spec/api, the type of SubscriptionEvent.type) now names exactly what the runtime emits: DataEventType + BulkDataEventType, i.e. data.record.created / data.record.updated / data.record.deleted and data.records.updated / data.records.deleted. Its four old values (record.created, record.updated, record.deleted, field.changed), which nothing ever emitted, are refused with a per-value prescription. The runtime's published event names do not change.

• Schema and pins: packages/spec/src/api/realtime.zod.ts, realtime.test.ts (the enum equals DataEventType + BulkDataEventType; each retired value is refused through SubscriptionSchema with its code, path and first sentence pinned).
• ADR-0087: D3 semantic entry realtime-event-type-unemitted-values-retired. No D2 conversion, because a subscription is never a stack collection member or a stored row.
• Stale examples: the service-realtime README and InMemoryRealtimeAdapter docblock, and the RealtimeEventPayload.type / RealtimeEvent.type examples. The realtime reference page is regenerated.
• Ledger: a one-line _note pointer in liveness/realtime_subscription.json (realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646 ruling A, realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347 ruling 甲).
• Changesets: @objectstack/spec minor (BREAKING, FROM → TO), @objectstack/service-realtime patch.

No transport, no route and no client subscribe primitive (#14646 ruling A). The verification evidence is in the dev report on the card.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-realtime, @objectstack/spec, touching 15 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/services/service-realtime/README.md, packages/spec/liveness/README.md, packages/spec/liveness/realtime_subscription.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/webhooks.mdx (via data.record.updated (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic), data.records.updated (literal, a string literal in RealtimeEventType; a string literal in a comment in RealtimeEventPayload; a string literal in replacement; a string literal in semantic))
• content/docs/protocol/kernel/realtime-protocol.mdx (via data.record.created (literal, a string literal in RealtimeEventType; a string literal in a comment in RealtimeEventPayload; a string literal in a comment on a changed line; a string literal in replacement; a string literal in semantic), data.record.deleted (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic), data.record.updated (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic))
• content/docs/protocol/knowledge.mdx (via data.record.created (literal, a string literal in RealtimeEventType; a string literal in a comment in RealtimeEventPayload; a string literal in a comment on a changed line; a string literal in replacement; a string literal in semantic), data.record.deleted (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic), data.record.updated (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic), data.records.deleted (literal, a string literal in RealtimeEventType; a string literal in replacement; a string literal in semantic), data.records.updated (literal, a string literal in RealtimeEventType; a string literal in a comment in RealtimeEventPayload; a string literal in replacement; a string literal in semantic))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/services/service-realtime/README.md, packages/spec/liveness/README.md, packages/spec/liveness/realtime_subscription.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 139 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5187981860e61c1a229a97589428eaba236d25e4 — the merge of head 17612ad5eaf0c3cac6e67f6a03daf04eb952051e into base f11b5f20a2ee22698c6647c2fb76aa67e99a7a53, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5187981860e61c1a229a97589428eaba236d25e4 && git checkout 5187981860e61c1a229a97589428eaba236d25e4
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 17612ad5eaf0c3cac6e67f6a03daf04eb952051e && git checkout -B drift-repro f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 && git merge --no-ff 17612ad5eaf0c3cac6e67f6a03daf04eb952051e

node scripts/docs-audit/affected-docs.mjs --json f11b5f20a2ee22698c6647c2fb76aa67e99a7a53

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0b2a76726c6503d31ca13962d7260c2fe0438ac9
Local-runs: none

Inputs read: card #20288 (body + 5 comments: first grade 5859582726, retriage request 5881693927, re-grade 5882152948, claim 5882309567, dev report 5883321020); rulings by id — #14646 A (5542632689), #8347 甲 (5791499872), #14446 direction (5506262367); PR #20567 body, file list (11 files, +399 −55, matches git diff origin/main...0b2a767 byte-for-byte on the stat) and the net diff against merge-base ba5927f714; the 39 check-runs on the head. Git objects only — git show origin/main:path and git grep sha -- path; no checkout, no build, no test.

Checks: 39 runs, 0 failures. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard). Every other run success or skipped (path-filtered Console Pin Gate, opt-in tarball smoke, the second-trigger duplicates of Auto Label / Check PR Size). No path is a governed surface; head repo = base repo; 454 changed lines. PR is draft, unarmed, unqueued — correct for a needs:contract-review head.

① Derived judgments

1. RealtimeEventType accept set (@objectstack/spec/api, a real exports entry): FROM {record.created, record.updated, record.deleted, field.changed} TO {data.record.created, data.record.updated, data.record.deleted, data.records.updated, data.records.deleted} — exactly DataEventType ∪ BulkDataEventType (events.zod.ts:138-142, :172-175), pinned equal to that union in realtime.test.ts. Widens by five, narrows by four. Right.
2. Doors that parse it: SubscriptionEventSchema.type (realtime.zod.ts:115, the only schema reader) and therefore SubscriptionSchema.events[] and RealtimeConfigSchema.subscriptions[].events[] (.passthrough() on other keys, strict on this enum). All three now refuse each retired value with its own prescription (invalid_value at ['events', 0, 'type'], pinned through SubscriptionSchema); the error map returns undefined for any other input so a typo keeps zod's own message — the HookBodyCapability / RuntimeMode precedent, verified same shape (hook-body.zod.ts, kernel/context.zod.ts). No other spec schema embeds these doors (repo grep: comments and the migration entry only); stack.zod.ts has no realtime key; nothing outside packages/spec imports them. Right, and the changeset names exactly these three doors.
3. Doors whose accept set does NOT move, correctly left: protocol.zod.ts#RealtimeSubscribeRequestSchema.events is z.array(z.string()); websocket.zod.ts#EventSubscriptionSchema.events is EventPatternSchema; contracts/realtime-service.ts#RealtimeSubscriptionOptions.eventTypes is string[]; RealtimeEventPayload.type / RealtimeEventSchema.type are string. Only their example prose moved, where it was stale. Right.
4. TS narrowing: RealtimeEventType, SubscriptionEvent, Subscription, RealtimeConfig are z.input of the enum, so tsc refuses the old literals — stated in the changeset. Right.
5. Producers untouched — the card's ⛔ holds. objectql/src/engine.ts publishDataEvent (:7099-7118, data.record.${action}, parsed through DataEventSchema, envelope payload: { ...event }), publishBulkDataEvent (:7198-7215, data.records.${action}), metadata/src/metadata-manager.ts (:695-723, metadata.${type}.${action} gated by MetadataEventType, 39 members). None is in the file list. The runtime's published names do not change. Right (declared ≠ enforced (ADR-0049): RealtimeEventType spells record.* while the runtime emits data.record.*, and SubscriptionSchema.filters is z.unknown() nothing reads #14446 direction: repoint the enum, never the runtime).
6. No transport, no route, no client subscribe primitive. The 11 paths touch no packages/rest, packages/runtime, packages/client, no route table, no ws/sse dependency; the in-memory-realtime-adapter.ts change is a docblock @example only. realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646 ruling A and realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347 ruling 甲 hold. Right.
7. metadata.* deliberately not members. A SubscriptionEvent is record-shaped (object names a data object, filters narrows records); metadata events have their own closed MetadataEventType and their own client primitive subscribeMetadata (client/src/realtime-api.ts:73); adding 39 names would widen past the re-grade. The new RealtimeEventPayload.type example 'metadata.object.updated' is a real member (events.zod.ts:19) on a string field the envelope genuinely carries. Right.
8. Every prescription is true of the code: each retired value names an emitted twin that exists; "data.records.* carries a count and no record" — BulkDataEventSchema has no recordId; "field.changed → data.record.updated, read the field from changes" — DataEventSchema.changes exists; "no event is published per field" — no producer does. True.
9. The version each prescription names — @objectstack/spec 17.5.0: spec is 17.4.0 on origin/main; pending changesets include many minor and no major, and check-changeset-no-major refuses a major (launch-window guard) — so the release that carries this is 17.5.0. ADR-0087's amended level ruling says a tombstone names the npm release it ships in, never the protocol major; the same 17.5.0 form is already on 21 sites in 14 files at main. True of the release that will carry it (see ③ for the one caveat shared with those 21 sites).
10. Regenerated reference content/docs/references/api/realtime.mdx: description equals the new .describe(), Allowed Values are the five, the Subscription / SubscriptionEvent tables show the new enum, RealtimeEvent.type example moved; produced by the repo's generator (check:docs inside the green TypeScript Type Check). True.
11. README / adapter @example: the published object { id: uuid, type, object, recordId, after, timestamp } is a valid DataEvent (required: id, type, object, recordId, timestamp) and is what engine.ts wraps as payload; subscribe('records', cb, { object, eventTypes }) matches RealtimeSubscriptionOptions; "the engine publishes data.record.created / data.record.updated with the full record body (after)" matches engine.ts. True.
12. Enum docblock: "Nothing in the open framework parses a subscription" — true (ledger census, no importer outside spec); "realtime.test.ts pins this enum equal to their union" — true; the old NOT YET ENFORCED block is replaced by a sentence that stays true (the vocabulary now fires; the container is still unparsed, and the docblock says so). True.
13. D3 entry text: "field.changed … DataEventType already dropped in protocol 17 (data-field-changed-event-retired)" — that entry sits in step17 (registry.ts:2138, toMajor: 17); "stack.zod.ts has no realtime key" — 0 hits; "maintainer ruling of 2026-09-04: realtime stays out of open core" — realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646 A. surface / replacement carry no backticks or pipes as build-upgrade-guide.ts needs. entries/semantic/18.*.ts and the registry.ts copy are the house pattern (check:migration-registry green). True.
14. Ledger: one-line _note addition only; all six rows stay dead (they land live-elsewhere only when a channel-serving occupant parses the contract — re-grade 5882152948); Spec property liveness green; no state-counts.md change owed. Right.
15. PR body: every sentence checked against the diff — "Closes realtime: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (open-core contract half; the transport stays out, #14646 A and #8347 甲) #20288" (the card's claim names this branch; check green), the enum description, the five bullets, "No transport, no route and no client subscribe primitive", the session-URL footer. All true. RealtimeEventPayload.type and RealtimeEvent.type examples are both in the diff as stated.
16. objectui at the pin dd3f7e1b: 0 hits for RealtimeEventType or any old spelling (grep at the pinned commit) — the Console Pin Gate is unaffected, as the dev measured.

② Semver level

• @objectstack/spec: minor with the **BREAKING** banner, FROM → TO mapping, the one-line fix, and the marker adr-0087: registered realtime-event-type-unemitted-values-retired (an HTML-comment marker in the changeset; the gate resolved it — Check Changeset and Lint & Repo Gates green). Matches ADR-0087's amended level ruling (pre-GA, a metadata-facing retirement ships minor; the banner and the disposition carry breaking-ness) and AGENTS.md (yes ⇒ at least minor; (narrowing) ⇒ BREAKING). Right.
• Clause-②: yes (narrowing) in the PR body and the changeset. Right. The criterion is "does this widen the accept set or the public surface" — five values now parse that were refused before, so yes; four are refused that parsed before, so (narrowing). This is the exact shape the gate's own fixture names ("a diff that widens AND narrows"). The pure-removal precedents that declared no (17707, 19116, 20295) removed without adding and are not this case.
• ADR-0087 disposition: D3 semantic entry, no D2 conversion — fits. ADR-0087 D2 does list "enum re-spellings" as lossless, but D2 is applied by the loader to metadata sources, and a Subscription is reachable from no such seam: not a stack collection member (stack.zod.ts has no realtime key), not a metadata type, not embedded in any other spec schema, not imported outside spec. A conversion entry would be a declared transform nothing ever runs — the declared≠enforced shape ADR-0049 forbids. Established: 47 step18 semantic entries are D3-only for the same reason (error codes, contract-map entries, REST config keys, route params). RETIRED_KEYS_BY_MAJOR correctly untouched — an enum value is not a key. The (narrowing) arm and a D3-without-D2 entry are consistent: the prescription lives on the enum's error map, which IS the door.
• @objectstack/service-realtime: patch. README ships in the tarball (files), the @example ships in dist .d.ts; a stale example that could never fire is a documentation defect in a released package (precedent 17152). skip-changeset would have been wrong. Right.

③ Boundary flags

open_questions: none declared. Dev deviations (5) and out-of-scope findings (5), each answered or escalated:

• Assignee unset on the PR (label-write --assign refused locally) — seat sets os-justin (the card's) when it adopts this record. Answered.
• "Closes" vs "Fixes" — both close; the card is pm:dispatched, not in the decision box. Answered.
• PR body carries no test evidence — the evidence of record is the tests field of dev report 5883321020 at 0b2a76726c (deletion leg, final run, two ablations A/B with restore proofs, 117-gate reconciliation); the seat may cite it in the body. Answered.
• _note carries a repoint clause beside the two ruling pointers — still one line; it qualifies the seed-time member list ("as measured at 5f5511f") rather than contradicting it. Accepted.
• origin/main moved after branch-off — mergeable state clean; the queue rebuilds the merged generation. Answered.
• service-knowledge record.* branch left unmoved (knowledge-service-plugin.ts:218-231, TSDoc :24, knowledge-service.ts:232, :252) — reads event.type as a plain string off its own IRealtimeService subscription, never the enum or SubscriptionSchema; dead before and after; leaving it in this PR is right. But it is a consumer-side legacy-shape fallback (payload.record ?? payload, Prime Directive Add comprehensive test suite for Zod schema validation #12 class) plus stale TSDoc, and "承接者:无" is not a carrier — under Prime Directive chore: version packages #10 the reviewer files a note that is a contract violation. Escalated: the seat files a domain:services card (dedupe words: knowledge-event-sync, record.created legacy branch, handleRecordUpsert payload.record).
• packages/spec/liveness/README.md:945 left unmoved — the row reads, present tense, that RealtimeEventType's "four members (record.created / record.updated / record.deleted / field.changed) are DISJOINT from what the engine publishes". False at this head, and liveness/ ships in the npm tarball (files). Hand-owned enrolment prose (no generator writes it; readme-table.mts only reads it). The dev stayed inside the claim's surface and reported it, so nothing is buried — but leaving it leaves one shipped sentence false. Escalated with a carrier: a one-clause qualifier mirroring the JSON _note ("repointed by realtime: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (open-core contract half; the transport stays out, #14646 A and #8347 甲) #20288; member list as measured at 5f5511f"), either folded into this PR before enqueue or a docs-only follow-up the seat files; check-liveness.mts:452-458 (same sentence; scripts/ is outside files, so not shipped) rides that same fix. Not a blocker: the accept set, the prescriptions, the reference page and the changeset are all true.
• websocket.zod.ts:104 describe example "record.*" — an EventPatternSchema wildcard on spelling (2), an open door whose accept set did not move; correctly fenced to the five-spelling convergence stage the re-grade reserved. Answered: stays with that stage's card.
• client/src/realtime-api.ts:153-159 comment says data.field.changed is "declared in DataEventType" — false since protocol 17, unrelated to this enum, a code comment. Noted; rides the same follow-up as the README line or the next client touch.
• check:platform-checklist red — identical on the clean base, not CI-wired. Answered: pre-existing, unrelated.
• Version caveat, shared with 21 existing sites: "17.5.0" is true only while 17.5.0 is uncut. If the maintainer cuts 17.5.0 before this lands, this PR's four prescriptions go stale together with every pending tombstone at main — a fleet convention, not this PR's defect; the seat re-dates before enqueue if that happens.

Implemented-by: claude/issue-20288-realtime-event-type-emitted-vocabulary
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1

VERDICT: PASS

Adopted and posted by domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1) · 2026-09-29T04:16Z · rendered by the seat's at-tier review subagent; its served tier family was read from the subagent transcript before posting. The seat folds the ③ liveness/README.md:945 fix into this PR (a new head, reviewed again before enqueue), so needs:contract-review stays on.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 17612ad5eaf0c3cac6e67f6a03daf04eb952051e
Local-runs: none

Inputs read: card #20288 (body + all 7 comments — first grade 5859582726, retriage request 5881693927, re-grade 5882152948, claim 5882309567, dev report 5883321020, surface extension 5883551279, dev follow-up report 5884206324); the PR thread (Docs Drift Check 5882899479, the prior record 5883544890 on head 0b2a76726c); rulings by id — #14646 A (5542632689), #8347 甲 (5791499872), #14446 direction (5506262367); PR #20567 body (byte-identical to the body reviewed at 0b2a76726c), file list (13 files, +402 −56, matches git diff origin/main...17612ad5ea on the stat) and the whole net diff against merge-base ba5927f714; the 35 check-runs on this head. Git objects only — no checkout, no build, no test.

Whole PR, not the delta. 17612ad5ea is one commit on top of 0b2a76726c (parent verified); the delta is exactly packages/spec/liveness/README.md (1 line changed) and packages/spec/scripts/liveness/check-liveness.mts (+2 lines). The other 11 files are byte-identical to the head reviewed in 5883544890, so judgments ①1–16 below are re-stated as they stood and re-checked against this head's checks; ①17–20 are new.

Checks: 35 runs, 33 success, 2 skipped (path-filtered Console Pin Gate, opt-in tarball smoke), 0 failures. All seven required contexts success (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard). Spec property liveness green on the edited README row. No path is a governed surface or a single-writer path (both guards green); head repo = base repo; 458 changed lines; mergeable clean. PR is draft, unarmed, unqueued — correct for a needs:contract-review head.

① Derived judgments

1. RealtimeEventType accept set (@objectstack/spec/api, a real exports entry): FROM {record.created, record.updated, record.deleted, field.changed} TO {data.record.created, data.record.updated, data.record.deleted, data.records.updated, data.records.deleted} — exactly DataEventType ∪ BulkDataEventType (events.zod.ts:138-142, :172-175), pinned equal to that union in realtime.test.ts. Widens by five, narrows by four. Right.
2. Doors that parse it: SubscriptionEventSchema.type (realtime.zod.ts:115, the only schema reader), hence SubscriptionSchema.events[] and RealtimeConfigSchema.subscriptions[].events[]. All three refuse each retired value with its own prescription (invalid_value at ['events', 0, 'type'], pinned through SubscriptionSchema); the error map returns undefined for any other input so a typo keeps zod's own message — the HookBodyCapability / RuntimeMode precedent, same shape. No other spec schema embeds these doors; stack.zod.ts has no realtime key; nothing outside packages/spec imports them. Right; the changeset names exactly these three doors.
3. Doors whose accept set does NOT move, correctly left: protocol.zod.ts#RealtimeSubscribeRequestSchema.events (z.array(z.string())), websocket.zod.ts#EventSubscriptionSchema.events (EventPatternSchema), contracts/realtime-service.ts#RealtimeSubscriptionOptions.eventTypes (string[]), RealtimeEventPayload.type / RealtimeEventSchema.type (string). Only stale example prose on them moved. Right.
4. TS narrowing: RealtimeEventType, SubscriptionEvent, Subscription, RealtimeConfig are z.input of the enum, so tsc refuses the old literals — stated in the changeset. Right.
5. Producers untouched — the card's ⛔ holds. objectql/src/engine.ts publishDataEvent (:7099-7118, data.record.${action} parsed through DataEventSchema, payload: { ...event }), publishBulkDataEvent (:7198-7215, data.records.${action}), metadata/src/metadata-manager.ts (:695-723, metadata.${type}.${action} gated by MetadataEventType). None is in the file list. Right (declared ≠ enforced (ADR-0049): RealtimeEventType spells record.* while the runtime emits data.record.*, and SubscriptionSchema.filters is z.unknown() nothing reads #14446: repoint the enum, never the runtime).
6. No transport, no route, no client subscribe primitive. No packages/rest, packages/runtime, packages/client, route table or ws/sse dependency in the 13 paths; the adapter change is a docblock @example. realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646 A and realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347 甲 hold. Right.
7. metadata.* deliberately not members — a SubscriptionEvent is record-shaped; metadata events keep MetadataEventType and subscribeMetadata (client/src/realtime-api.ts:73). The RealtimeEventPayload.type example 'metadata.object.updated' is a real member (events.zod.ts:19) on a string field the envelope carries. Right.
8. Every prescription is true of the code: each retired value names an emitted twin that exists; data.records.* "carries a count and no record" (BulkDataEventSchema has no recordId); field.changed → data.record.updated with changes (DataEventSchema.changes exists); "no event is published per field" (no producer does). True.
9. The version each prescription names — @objectstack/spec 17.5.0: spec is 17.4.0 on origin/main, pending changesets are minor/patch only, check-changeset-no-major refuses a major, so the carrier is 17.5.0; ADR-0087's amended level ruling names the npm release; the same form is already on 21 sites in 14 files at main. True of the release that will carry it (caveat in ③).
10. Regenerated reference content/docs/references/api/realtime.mdx: description = the new .describe(), Allowed Values = the five, the Subscription / SubscriptionEvent tables and the RealtimeEvent.type example follow; generator-owned, check:docs green. True.
11. README / adapter @example: the published { id: uuid, type, object, recordId, after, timestamp } is a valid DataEvent and is what engine.ts wraps as payload; the subscribe call matches RealtimeSubscriptionOptions; the security-posture sentence matches engine.ts. True.
12. Enum docblock: "Nothing in the open framework parses a subscription" — true; "realtime.test.ts pins this enum equal to their union" — true; the old NOT YET ENFORCED block replaced by a sentence that stays true. True.
13. D3 entry text: data-field-changed-event-retired sits in step17 (registry.ts:2138, toMajor: 17); stack.zod.ts has no realtime key; the 2026-09-04 ruling is realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646 A; surface / replacement carry no backticks or pipes; the entries/semantic/18.*.ts + registry.ts copy is the house pattern (check:migration-registry green). True.
14. Ledger JSON: one-line _note addition only, unchanged since 0b2a76726c; all six rows stay dead per re-grade 5882152948; Spec property liveness green. Right.
15. PR body: byte-identical to the body reviewed at 0b2a76726c; every sentence re-read against the 13-file diff — all still true. It does not name the two prose texts this head adds (see ③: silence, not falsity). True.
16. objectui at the pin dd3f7e1b: 0 hits for RealtimeEventType or any old spelling. Console Pin Gate unaffected.
17. NEW — packages/spec/liveness/README.md, the realtime_subscription row (shipped: liveness/ is in the tarball's files). The inserted clause reads ", as measured at 5f5511f0 before realtime: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (open-core contract half; the transport stays out, #14646 A and #8347 甲) #20288 repointed the enum at the emitted DataEventType + BulkDataEventType names," placed after the member list and before "are DISJOINT from what the engine publishes". Checked: 5f5511f0 is a real commit (2026-09-04, the census day the JSON _note records — "CENSUS METHOD AND SCOPE, run at 5f5511f (2026-09-04)"); the enum at this head is exactly DataEventType + BulkDataEventType; the qualifier is the same one the JSON _note carries ("the events.type row's member list is as measured at 5f5511f"). The sentence is now true as a dated record; the row otherwise reads as it did (delta: this one table line, nothing else in the file). Right. Inherited, not introduced: the row's pre-existing phrase "live emitter in service-knowledge" (present at origin/main) misnames a subscriber as an emitter — the engine emits, knowledge-service-plugin.ts branches on the strings. Outside the extension's surface ("nothing else in either file moves"), pre-dates this PR, no action owed here; noted for a later ledger tidy.
18. NEW — packages/spec/scripts/liveness/check-liveness.mts:452-453 (not shipped: scripts/ is outside files). Two comment lines inserted after "whose four members": "(as measured at 5f5511f0, before realtime: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (open-core contract half; the transport stays out, #14646 A and #8347 甲) #20288 repointed the enum at the emitted / DataEventType + BulkDataEventType names)". Same qualifier, same truth; the delta shows +2 lines and nothing else in the file. Right.
19. Gate derivation for a script edit: editing check-liveness.mts derives the pm-dispatch-gates / governed-merges / bare-root-worklist self-test families; all ride Lint & Repo Gates, green on this head. Neither edited file is a governed surface or single-writer path (both guards green). Right.
20. Docs Drift Check (advisory, 5882899479) names three hand-written pages (automation/webhooks.mdx, protocol/kernel/realtime-protocol.mdx, protocol/knowledge.mdx) because they contain the NEW names data.record.* / data.records.*. Grep at this head: none of them names an old spelling or any RealtimeEventType member; the repoint makes them consistent, not false. No page falsified.

② Semver level

Unchanged from the reviewed head, and still right:

• @objectstack/spec: minor with the **BREAKING** banner, FROM → TO mapping, the one-line fix, and the adr-0087: registered realtime-event-type-unemitted-values-retired marker (Check Changeset and Lint & Repo Gates green). Matches ADR-0087's amended level ruling and AGENTS.md. Right. The two prose texts this head adds are in the same package and ship (README) or do not ship (scripts/) under that same changeset; no further changeset is owed, and the dev rightly added none.
• Clause-②: yes (narrowing) in the PR body and the changeset. Right — five values now parse that were refused (yes), four are refused that parsed ((narrowing)); the gate's own fixture names this shape ("a diff that widens AND narrows"). The prose delta moves no accept set and does not change the arm.
• ADR-0087 disposition: D3 semantic entry, no D2 conversion — fits. D2 applies at the loader seam to metadata sources; a Subscription is reachable from no such seam (no stack key, no metadata type, no embedding schema, no importer outside spec), so a conversion entry would be a declared transform nothing runs. 47 step18 semantic entries are D3-only for the same reason. RETIRED_KEYS_BY_MAJOR correctly untouched.
• @objectstack/service-realtime: patch — README ships in the tarball, the @example ships in dist .d.ts; a non-firing example in a released package is a documentation defect (precedent 17152). Right.

③ Boundary flags

Dev follow-up report 5884206324: open_questions none, out_of_scope_findings none, no deviations listed. Status of every flag from record 5883544890, plus what this head adds:

• README.md:945 and check-liveness.mts:452-458 shipped-false / stale sentences (escalated in 5883544890 ③) — RESOLVED on this head by surface extension 5883551279 and commit 17612ad5ea: each carries the qualifier the JSON _note already carried; nothing else in either file moved (verified on the delta). The extension corrects the claim's composition error (a fence that forbade touching a text the change falsified) and says so on the card. Closed.
• service-knowledge record.* legacy branch (knowledge-service-plugin.ts:218-231, TSDoc :24, knowledge-service.ts:232, :252) — unchanged and rightly outside this PR (reads event.type as a plain string, never the enum). Still a Prime Directive Add comprehensive test suite for Zod schema validation #12-class consumer fallback plus stale TSDoc with no carrier; still escalated: the seat files a domain:services card (dedupe words: knowledge-event-sync, record.created legacy branch, handleRecordUpsert payload.record). Not a blocker.
• PR body does not list the two new prose texts — every sentence in it is true; the omission is silence, not falsity. The seat may add one bullet ("Ledger prose: the liveness README row and the check-liveness enrolment comment date the old member list to 5f5511f0") when it rewrites the body to cite the test evidence (5883321020 and 5884206324). Answered.
• PR assignee unset — the seat sets os-justin (the card's) when it adopts this record. Answered.
• "Closes" vs "Fixes" — both close; the card is pm:dispatched, not in the decision box. Answered.
• No merge of origin/main on the branch — mergeable clean; the queue rebuilds the merged generation and re-runs the required set. Answered.
• Inherited phrase "live emitter in service-knowledge" in the README row (①17) — pre-existing at origin/main, outside the extension's surface, not made false by this change. Noted; rides the next ledger tidy, no action owed by this PR.
• websocket.zod.ts:104 describe example "record.*" — an EventPatternSchema wildcard on spelling (2); correctly fenced to the five-spelling convergence stage the re-grade reserved. Answered: stays with that stage's card.
• client/src/realtime-api.ts:153-159 comment on data.field.changed "declared in DataEventType" — false since protocol 17, unrelated to this enum. Noted; rides the next client touch.
• check:platform-checklist red — identical on the clean base, not CI-wired. Answered: pre-existing.
• Version caveat, shared with 21 existing sites: "17.5.0" holds while 17.5.0 is uncut; if the maintainer cuts 17.5.0 first, this PR's four prescriptions go stale together with every pending tombstone at main — a fleet convention, not this PR's defect; the seat re-dates before enqueue if that happens.

Implemented-by: claude/issue-20288-realtime-event-type-emitted-vocabulary
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1

VERDICT: PASS

Adopted and posted by domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1) · 2026-09-29T05:31Z · rendered by the seat's at-tier review subagent on the new head; its served tier family was read from the subagent transcript before posting. The ③ service-knowledge escalation is already filed as #20573.

---

Generated by Claude Code