feat(spec)!: FieldSchema refuses a select / radio with neither options nor picklist

[objectstack-fleet]

Fixes #20827
Clause-②: yes

Ruling A (record 5910124148), step two: FieldSchema refuses a select / radio field with neither options nor picklist at parse, on the lookup-without-reference precedent (0fb8760bec). Step one (5917187437) measured the census and the Studio order; the objectui half landed and .objectui-sha 31971ff1e28f carries it (5947557233).

The door

• packages/spec/src/data/field.zod.ts, FieldSchema's superRefine, beside the reference check: a custom issue on the options path whose message names the field type and both remedies (options: [{ label, value }], or picklist: 'NAME' for a shared list), says what the hole costs (an empty control, and no server-side value validation), and offers text when any value is meant to be allowed. No tracker number in the runtime string.
• One predicate, not a second one. The door applies the ADR-0078 completeness predicate itself: checkFieldCompleteness(field) has a field/choice-without-options finding at error severity. That module imports nothing at runtime, so the new edge (data to kernel) closes no cycle, and no export is added. Three facts follow from it rather than being restated: options: [] is the same hole as a missing key; a picklist reference is a source; the types are exactly select / radio (checkboxes stays a warning, multiselect / tags stay free-form). The same reading is what objectui's guard derivation test uses (deriveChoiceTypesRequiringOptions).
• The exclusivity block's comment no longer claims "neither" is only the completeness finding. The options and picklist TSDoc and .describe() texts state the rule; the reference pages were regenerated through check:generated --fix (only check:docs was stale).
• ADR-0078's author-time rule and the registration warning are not edited. The door is one more gate.

Fixture census, measured with the door on

Re-measured at base 5fd4855a9a with the full @objectstack/spec suite (6 red in 5 files) and the full @objectstack/metadata-protocol suite (9 red in 2 files). That matches step one exactly.

Red with the door on	Why it went red	Disposition
field.test.ts:2155 (radio + multiple: false)	oversight: pins multiple, not choices	one option added
field-autonumber-default-unique.test.ts:45 (minimalField)	oversight: "minimal valid input per type"	select / radio get one option
filter-number-comparand-declared-type.ts fixture (fixtureFieldFor)	oversight: "each is a legal FieldSchema input"	single-choice types get one option (SINGLE_OPTION_TYPES); the fixture interface gains an optional options member
filter-text-operator-declared-type.ts fixture (fixtureFieldFor)	same	same
picklist.test.ts:129, 2 tests	pinned the old acceptance by design ("neither is the completeness gate's error, not a parse refusal")	flipped into a refusal pin; its checkFieldCompleteness assertions are kept unchanged
metadata-protocol: 9 tests from legacyObjectRow's status: { type: 'select' } (protocol.stored-conversions.test.ts, protocol.stored-migration.test.ts)	oversight: the row exists to test conditionalRequired	one option added (sent, the value its requiredWhen reads)

One fixture beyond the census: canonicalObjectRow in protocol.stored-migration.test.ts carries the same optionless select. It caused no red (the pass never validates a row that needs no conversion), but its doc says "already canonical — the shape every row ends up in", which the door makes false, so it got the same option.

Stored rows: the disposition

No migration can invent the options an author meant, so a stored row is read and named, never rewritten. That was step one's reading, and it is now pinned in @objectstack/metadata-protocol:

• getMetaItem still serves such a row, with _diagnostics.valid: false naming fields.status.options;
• loadMetaFromDb counts it invalid: 1 and still registers it;
• migrateStoredMetadata({ apply: true }) on a legacy row that also carries an optionless select reports it failed (spec validation), writes no history row, and leaves the stored bytes as they were.

The changeset tells an operator to find such rows through GET /api/v1/meta/diagnostics or the boot log's field/choice-without-options lines, and says the os migrate meta --stored preview does not find them, because it does not validate.

ADR-0087 marker: not-required (no-migration-prescription). Two existing keys are narrowed in validity, and none is removed, renamed or re-shaped. No conversion entry can supply the missing intent, and the gate's other categories are closed on facts (the marker says why). That is the precedent's category. Production sys_metadata cannot be measured from here, so the marker text takes the ruling's "some rows exist" arm and names the read-and-name path, not a migration.

Semver

@objectstack/spec: minor with a BREAKING header, as the precedent shipped. The changeset is .changeset/20827-choice-door-select-radio-needs-options.md. Gate lines:

• check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition · [BREAKING+bang] not-required (no-migration-prescription)
• check-changeset-no-major: This diff introduces no major bump
• check-empty-changeset: No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added)

No other package publishes a change: the metadata-protocol edits are tests only, and content/docs does not publish.

Reverse verification (ablation)

The door's predicate was mutated through scripts/ablation-replace.mjs (FIELD_CHOICE_WITHOUT_OPTIONS to the literal 'ablation-20827-never'; anchor 1 to 0, blob ea9313c768 to 9654443823). Then @objectstack/spec was rebuilt, and ablation-dist-preflight found the marker in 24 built files.

• Mutate leg: red. 8 spec pins red: the 6 refusal pins in field.test.ts and the 2 rewritten pins in picklist.test.ts. 3 metadata-protocol pins red: the two stored-conversions pins and the stored-migration failed pin. The positive controls stayed green (one option, picklist only, and multiselect / checkboxes / tags with neither).
• Restore leg: green. Restored with git checkout HEAD --: blob equal to HEAD and git diff HEAD empty. After a rebuild, --absent reported the marker in 0 of 230 built files and the tree clean. Then 325/325 spec tests and 56/56 metadata-protocol tests passed.

Tests (head ee5b089bbe, after merging origin/main)

• @objectstack/spec full suite: 646 files, 18391 passed, 1 todo.
• @objectstack/spec typecheck: green, including check:test-typecheck.
• @objectstack/spec check:generated: all 15 artifacts up to date.
• @objectstack/metadata-protocol typecheck: green.
• These consumer suites ran with the door on, before the merge, at a9473b8d91. The merge brought no change to these packages' sources.
  • @objectstack/metadata-protocol: 201 files, 2983 passed, 19 skipped.
  • @objectstack/objectql: 363 files, 7277 passed. This includes the two engine door suites that consume the changed spec fixtures.
  • @objectstack/lint: 119 files, 5575 passed.
  • @objectstack/metadata: 56 files, 836 passed.
  • @objectstack/runtime: 306 files, 5081 passed, 11 skipped.
• dispatch-gates --ran: 110 derived families, 109 run, 1 NOT MEASURED, 0 unrun. The one: check:dual-build-cjs-loads exits 3 because it needs every package's dist. As a declared narrowing, all 19 require entries of @objectstack/spec load under CJS, and the door is live through dist/data/index.js.
• check:doc-authoring and check:nul-bytes are green.

Acceptance notes

• Blueprint (A6). packages/spec/src/ai/solution-blueprint.zod.ts, BlueprintFieldSchema.options (optional) and StrictField.options (.nullable()), still let a blueprint select / radio carry no options. Inside objectstack and objectui, nothing expands a blueprint into FieldSchema input. apply_blueprint lives outside both repositories; objectui only renders its progress and plan cards. The module's own header says that the expansion validates against the per-type schema at write time. So once this door ships, an optionless blueprint select is refused loudly at that write, not silently stored. The gap is that the blueprint accepts what the door refuses, so the refusal lands one step late, on the expanded artifact, not on the AI's structured output. Not edited here. For the PM to file: align BlueprintFieldSchema / StrictField options with the door for select / radio.
• objectui pin (A8). packages/data-objectstack/src/object-metadata-write-guard.derivation.test.ts, the describe "the installed server still ACCEPTS a choice with no options", goes red when objectui next bumps @objectstack/spec to a release carrying this door. Its own comment prescribes the follow-up: rewrite the guard's docblock paragraph into the relationship form and turn the block into a refusal pin at options. That is the objectui lane's follow-up. No objectui edit here.
• skills/** hit, not edited (governed surface). skills/objectstack-upgrade/references/examples-upgrade.md:105 teaches status: { type: 'select', required: true, storage: { notNull: true } } inside ObjectSchema.create(...). With this door that example is refused at parse. It needs one options entry, in a skills-lane PR.
• Docs. content/docs/deployment/troubleshooting.mdx had an entry quoting an error message no code emits ("Required property missing: options") and listing multiselect / checkboxes as refused. It now quotes the real refusal, the right two types and the stored-row reading. validation-rules.mdx called options "Required" on all four option types; multiselect / checkboxes now read optional, as the runtime treats them. field-types.mdx names picklist as the alternative. The formulas.mdx ObjectSchema.create example got options. No content page said an optionless select parses or is only a lint finding.
• The Clause-② line is copied from the claim (yes). The diff narrows FieldSchema's accept set, which is BREAKING and is carried by the changeset banner. It also widens one published type: the two exported door-fixture interfaces gain an optional options member. Read together, yes (narrowing) is the fuller spelling. The claim's spelling is kept, and the two gates pass on it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 4 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/external-datasources.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/field-types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/validation-rules.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/troubleshooting.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/validating-metadata.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/getting-started/quick-reference.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/kernel/contracts/data-engine.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/backward-compatibility.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectql/types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectui/concept.mdx (via FieldSchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/releases/v17/17-1.mdx (via FieldSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 138 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ee75aae1a8ebc2625e57074527d446151535634b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0969ed145600f546d4d07c37b1993a4ee833f3c9 — the merge of head ee5b089bbe2533d9d3044b93f4b64d6d57b5bb3a into base ee75aae1a8ebc2625e57074527d446151535634b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0969ed145600f546d4d07c37b1993a4ee833f3c9 && git checkout 0969ed145600f546d4d07c37b1993a4ee833f3c9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ee75aae1a8ebc2625e57074527d446151535634b ee5b089bbe2533d9d3044b93f4b64d6d57b5bb3a && git checkout -B drift-repro ee75aae1a8ebc2625e57074527d446151535634b && git merge --no-ff ee5b089bbe2533d9d3044b93f4b64d6d57b5bb3a

node scripts/docs-audit/affected-docs.mjs --json ee75aae1a8ebc2625e57074527d446151535634b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ee75aae1a8ebc2625e57074527d446151535634b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ee5b089bbe2533d9d3044b93f4b64d6d57b5bb3a
Local-runs: none

Inputs read: card #20827 (body and all 11 comments, the ruling 5910124148, step one 5917187437, the dispatch claim 5947645436, the dev report 5950037486), PR #21390 (body, 16-file list, net diff against main, its one comment), the check-runs on the head, and files at the head sha through git show only. Nothing built, run or re-run.

① Derived judgments

Every accept-set and public-surface change the diff implies, each judged:

1. FieldSchema narrows — a select / radio whose options is absent or [] and whose picklist is absent is refused at parse with a custom issue on the options path. RIGHT: ruling A orders exactly this on the 0fb8760bec precedent, and the door sits beside the reference check in the same superRefine. The predicate is read, not restated: checkFieldCompleteness filtered to FIELD_CHOICE_WITHOUT_OPTIONS at error. At this head that module has DEAD_WITHOUT_OPTIONS_ERROR = {select, radio}, hasOptionSource = hasEntries(options) || typeof picklist === 'string', hasEntries = non-empty array, and zero import statements, so the new data-to-kernel edge closes no cycle and no export is added (the dev's claim holds). The three consequences the shared predicate fixes — options: [] is the same hole, picklist is a source, checkboxes (warning) and multiselect / tags (non-rule) keep parsing — are each pinned per type in field.test.ts, plus a document-level pin at fields.status.options.
2. Reach of the narrowing — every schema embedding FieldSchema at this head: ObjectSchema.fields, ObjectExtensionSchema.fields, the standalone field metadata type (metadata-type-schemas.ts), system/migration.zod.ts addField.field, ui/widget.zod.ts field. All RIGHT. The one that could have refused a legitimate shape is ObjectExtensionSchema (an override of an existing select relying on the base's options), but objectql/src/registry.ts mergeObjectDefinitions merges fields by per-key replacement ({ ...base.fields, ...extension.fields }), so an optionless select override was already a dead field at runtime; refusing it at parse is the ADR-0049 move. The only in-tree extension with a select (showcase account.extension.ts) carries options.
3. Served picklist shape — PicklistServedFieldSchema is a separate looseObject with options.min(1), and PicklistSchema.options is .min(1), so a picklist-bound field is never re-parsed into the hole. RIGHT, no served-shape regression.
4. Stored rows — not rewritten; getMetaItem serves with _diagnostics.valid: false at fields.status.options; loadMetaFromDb counts invalid: 1 and still registers; migrateStoredMetadata({ apply: true }) on a legacy row reports failed, writes no history row, leaves the bytes. RIGHT: this is the ruling's "some rows exist" arm (read and named, since no migration can invent options), and all three are new pins in @objectstack/metadata-protocol.
5. Public type surface widens — NumberComparandDoorFixtureField and TextOperatorDoorFixtureField (both reach the public entry through export * in data/index.ts) gain an optional readonly options member. RIGHT, additive; check:api-surface records that an export exists, not its shape, so its "unchanged" is the expected reading, not a miss.
6. Describe texts on options / picklist changed, so content/docs/references/data/field.mdx, data/object.mdx, system/migration.mdx regenerated. RIGHT: Type Check · source gates, the job that runs check:docs, is success on this head.
7. Hand-written docs — troubleshooting.mdx heading renamed from a message no code emits ("Required property missing: options") to the real refusal; no inbound link to the old anchor exists at this head (grep over content, skills, packages). validation-rules.mdx now grades multiselect optional and checkboxes warning, matching the predicate. field-types.mdx select row rewritten; its radio / multiselect / checkboxes sections say "Same options property as select", and the refusal clause in that row names select and radio explicitly, so the multi types are not over-claimed. RIGHT. formulas.mdx example gained options. No content/docs/releases/ or CHANGELOG.md touched.
8. Field.select([]) emits options: [] and now reaches the refusal. RIGHT: stated in the changeset and pinned; it is the ruling's "every door" reading, and Field.select({ picklist }) and Field.select(['Open', 'Closed']) still pass (pinned).
9. Fixture census — 4 oversight fixtures plus the intended pin at picklist.test.ts:129 (flipped into a refusal pin, its checkFieldCompleteness assertions kept) in spec; one legacyObjectRow row in two metadata-protocol files; canonicalObjectRow beyond the census for doc consistency. Matches step one exactly. RIGHT. Every helper the rewritten tests rely on (issuesByPath, Field, ObjectSchema, SINGLE_OPTION_TYPES) is already imported at this head.
10. ADR-0078 relationship — the ruling says "one more gate, not a replacement": the author-time rule and the registry.ts warn-never-throw twin are untouched (file list), and the registration seam still registers a stored optionless row (pinned). RIGHT against the ruling; see ③ for the ADR's own text.
11. ADR anchors — the one anchor on field.zod.ts (ADR-0120, UniqueScopeSchema) is symbol-based and the system-context.mdx census row anchors field.zod.ts#readonly by symbol, so the inserted lines move nothing. RIGHT.

Governed surfaces: none in the file list (.changeset/, content/docs/, packages/), and Governed Surface Queue Guard is success. This record is the dispatch's owed at-tier review, not a Tier S landing record. Size 344 changed lines over 16 files, well under the 5,000 human-merge threshold.

② Semver level

• Changeset .changeset/20827-choice-door-select-radio-needs-options.md: "@objectstack/spec": minor, summary fix(spec)!: with the bang, a **BREAKING** header, the migration in prose (FROM a select / radio with neither key TO options: [{ label, value }] or picklist: 'NAME', or a text field when any value is meant to be allowed), the unchanged types named, and the stored-row prescription naming GET /api/v1/meta/diagnostics and the boot log's field/choice-without-options lines while saying the os migrate meta --stored preview does not find them. RIGHT: it is the 0fb8760bec changeset's shape (minor plus BREAKING, same marker category), and @objectstack/spec is the only package that publishes a change — the metadata-protocol edits are tests only, content/docs does not publish. skip-changeset does not apply.
• ADR-0087 marker: one HTML-comment marker reading not-required (no-migration-prescription) …; the category is in CATEGORIES of check-adr-0087-registration.mjs, and the "why" closes the other four categories on facts (publishes, no id covers the rule, a schema narrowing not a runtime-interface-only or type-surface-only change). RIGHT. The gate verdicts: Check Changeset (pr-automation.yml, which runs check-empty-changeset, check-adr-0087-registration and check-changeset-no-major against the merge base) is success on this head.
• Clause-②: yes (PR body, changeset, and the dispatch claim 5947645436). Valid: yes takes at least minor and the diff grades minor; the arm is optional by rule (clause2-line.mjs: "The arm is OPTIONAL, and that is a measurement"). The dev's own flag is right that yes (narrowing) is the fuller spelling — clause2-line.mjs defines it as "a diff that widens one surface and narrows another", which is this diff (two fixture interfaces widen, FieldSchema narrows), and the step-one claim 5916083155 spelled it so. The breaking signal the arm exists to carry is already carried where the gate reads it (**BREAKING** plus bang, [BREAKING+bang]), so the bare yes loses nothing at any gate. Judged right as written; the owning seat may amend the PR-body line to yes (narrowing) before landing. Optional, not a condition.
• Cosmetic: PR title feat(spec)!: while the changeset says fix(spec)!: (the precedent used fix). No gate reads the pair together. Not a condition.

③ Boundary flags

open_questions: [] in the dev report — nothing to answer. The eight deviations and three out-of-scope findings, each answered or escalated:

1. Clause-② spelling — ANSWERED above: right as written, fuller spelling optional.
2. skills/objectstack-upgrade/references/examples-upgrade.md:105 (status: { type: 'select', required: true, storage: { notNull: true } } inside ObjectSchema.create, in an os:check block whose intro says it "cannot rot into teaching a shape that no longer compiles") — VERIFIED at this head: the block is there, and check-skill-examples.ts type-checks with tsc --noEmit only, no safeParse, so no gate sees the parse refusal. ESCALATED: skills/** is Tier H and PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14 says to split the governed file off, which the dev did. The fix is one options entry, valid before and after the door, so there is no ordering dependency; the owning seat should file the skills-lane PR now so the published skill does not teach a refused shape across a release. Not a condition on this PR.
3. Blueprint (solution-blueprint.zod.ts:88 options optional; :320 .nullable()) — VERIFIED at this head, and the module header (lines 15–16) says apply_blueprint stages the expansion as a draft so the per-type schema validates it, so the door reaches the expanded artifact one step after the AI emitted it. ESCALATED to the PM to file: align the blueprint options with the door for select / radio. Not a condition.
4. objectui object-metadata-write-guard.derivation.test.ts ("the installed server still ACCEPTS a choice with no options") — ANSWERED: not a main-red hazard from this landing. The Console Pin Gate is skipped on this head because its console path filter names .objectui-sha, scripts/build-console.sh, packages/spec/package.json, tsup.config.ts and the probe scripts, none touched; when it runs it builds the SPA at the pin, bundling this tree's spec, and runs check:console-sha / check:console-injection — no objectui tests, and a runtime superRefine cannot break a bundle. .objectui-sha reads 31971ff1e28f… at this head and carries objectui 1563d3e10b (unlock scan 5947557233), so the console this repo ships already has the guard the ruling ordered first. The red the dev names arrives in objectui's own CI on its next @objectstack/spec bump — the objectui lane's follow-up, as noted.
5. canonicalObjectRow beyond the census — ANSWERED: right; doc consistency, no behaviour.
6. origin/main merged before the PR; consumer suites at a9473b8d91 — ANSWERED: procedural; the head's check-runs are the authority (below), not the dev's local runs.
7. Full spec suite as a background job; labels; model-free commit trailers — ANSWERED: procedural and consistent with AGENTS.md.
8. A4 precision (a row whose only defect is the missing source counts canonical in the preview; failed only when the row also carries an older spelling) — ANSWERED: right, stated in the changeset, pinned.

New flag, not raised by the dev — ADR-0078's text. §4 of docs/adr/0078-no-silently-inert-metadata.md says "No hard Zod .refine() that rejects existing metadata at registration (back-compat)", and its Non-goals list "Hard Zod refinement that rejects existing metadata … not a registration-time crash — existing apps with benign-incomplete instances must keep loading." The door is a hard Zod refinement. It leaves the registration seam that text protects exactly as it was (warn, never throw; a stored row still registers — pinned here), but a code-declared optionless select now throws at ObjectSchema.create(), which is the BREAKING arm the changeset declares. The maintainer's ruling A positions the door against ADR-0078 explicitly ("one more gate, not a replacement") on a precedent (0fb8760bec, the relationship-without-reference rule) that shipped the same way without an ADR edit, so the ruling governs here. What is owed is a Tier H landing note on ADR-0078 naming the two completeness rules that are now also parse-door refusals, so the ADR does not read against the schema it governs. ESCALATED for the owning seat to carry to the maintainer. Not a condition on this PR.

Check-runs on the head at 2026-10-02T10:24Z: 27 success, 2 skipped by design (Console Pin Gate — path filter; Packed-tarball smoke — opt-in), 4 in_progress: Test Core (1/6), Test Core (3/6), Test Core (6/6), Type Check · workspace. Green so far includes Lint & Repo Gates, Check Changeset, Type Check · source gates, Type Check · consumer gates, Type Check · debt ledger, Dogfood Regression Gate 1–3, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, Build Core, Spec property liveness. An in_progress gate is an honest reading, not a pass: the landing still waits for Test Core and the TypeScript Type Check aggregate to conclude success, and this record does not stand in for them.

Implemented-by: claude/issue-20827-choice-door
Reviewed-by: session_01YDt3PzwfrkuFzUBF89WPmM

VERDICT: PASS

---

Generated by Claude Code