fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest

[objectstack-fleet]

Fixes #9591
Clause-②: no (prescription text only; no input's accept or reject result changes)

This is the spec-lane half of the card: the shared retirement sentence names --write, and the class-wide pin moves in the same PR. The codemod itself landed in PR #22108 (a959493cdf).

The sentence

Before (the #9529 wording):

Run `os migrate meta --from N` to list the mechanical edits for existing sources; apply them by hand.

After:

Run `os migrate meta --from N` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.

The one allowed two-clause variant (a conversion that covers only part of a value) carries the same clause: … to list the mechanical edits for the X case; --write applies the ones it can prove, and WHAT-HAPPENS-TO-THE-REST. Its two members are dashboard compareTo.offset and the script node's config.actionType.

Checked against the tool on main (51290bca). packages/cli/src/commands/migrate/meta.ts declares write: Flags.boolean({ … default: false, exclusive: ['stored'] }). Its help text says it rewrites the authored sources in place "for each mechanical change traced to one literal in one project file; every other change is listed with the reason it was not written". Without the flag the run writes only the --out snapshot. The wording satisfies every ruling that binds it:

• Triage 6045697201. The sentence never says "rewrite existing sources automatically" unqualified ("the ones it can prove"), and it names --write because the default run still only lists.
• "It must be TRUE of the tool." Every clause is a property of the command, read from meta.ts.
• "One antecedent." "existing sources" still names one thing. "The ones" can only be edits, because an edit is what gets applied. The key's fate stays in the body prose.
• Vocabulary. The wording matches PR docs(skills): objectstack-upgrade names os migrate meta --write beside the default run #22122's skill text ("lists the mechanical edits"; --write "rewrites in place each edit it can trace to one literal in one project file, lists every other with the reason it was not written").

Where it moved (counted at 017761f0; the merge of main added no site)

• 161 sentences the pin judges. packages/spec/src: 157 (155 house form, 2 two-clause). packages/lint/src: 1. packages/drivers/driver-turso/src: 3. Every one passes the new anchors; apply them by hand survives only in the pin's own RED fixtures.
• Not judged by the pin, moved anyway:
  • migrations/registry.ts: 3 sentences, regenerated from the moved entries/semantic/18.*.ts by gen:migration-registry.
  • The lint chartConfig.xAxis.field hint in validate-widget-bindings.ts: a template literal with interpolation after the sentence, so the pin cannot see it (Acceptance notes).
  • The retiredKey() docblock example.
• Mechanical replacement. A script replaced the tail apply them by hand in 63 files (188 occurrences; old tail left: 0) and printed per-file before/after counts. Two seams split mid-phrase (translation.zod.ts) and the two two-clause sites were rewritten by anchored edits that had to hit exactly once.
• Pins in other test files. 23 test files asserted the old sentence verbatim, as string or regex. Each now asserts the new sentence verbatim, so a revert reds them. The ones that assert only the unchanged prefix (form-layout-inline-grid-retired.test.ts, the turso / driver-memory toContain('os migrate meta --from 17')) are untouched, because they stay true.
• Changeset. .changeset/9591-retirement-sentence-write.md: patch for @objectstack/spec, @objectstack/lint and @objectstack/driver-turso, the three packages whose shipped text moves.
• Generated. content/docs/references/**: 32 files (+268/−268) from pnpm --filter @objectstack/spec check:generated --fix; check:docs was the only stale artifact. check:generated then exited 0.

The class pin (retired-key-migrate-sentence.test.ts)

• Anchors. HOUSE_AT_MARKER and MIXED_AT_MARKER, and their markdown twins, require the new clause. The os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence, which does not name --write, is now RED. Two further spellings are RED: one that names --write without the qualification, and one that qualifies it but leaves the rest unowned.
• Withdrawn claim. WITHDRAWN_CLAIM is unchanged: the unqualified automatic-rewrite claim stays a hard RED everywhere. A new non-vacuity case proves neither legal shape trips it.
• Truth anchor (new). The pin reads os migrate meta's own flag table. A write boolean flag must exist and must have default: false, the two facts the sentence rests on. The read is covered by @objectstack/spec's existing packages/**/*.ts cross-package declaration.
• Corpus widened by one root. packages/drivers/driver-turso/src joins, on [lint] validate-expressions 的 script 退役键提示仍说 "rewrite it" — #6856 house 句式的最后一个域外站点 #7030's terms. Its three turso config tombstones carry the house sentence, and their docblock defers to retired-key.ts, but the pin never walked them. Without this, a rewording leaves them behind with every assertion green. The lint-only anti-vacuity case now covers each widened corpus.
• Header and docblock. The pin header and the retired-key.ts module docblock record the new sentence and why. The "the claim may be restored" note is gone, replaced by what was restored and how far.

Reverse verification, run from committed HEAD 017761f0 through scripts/ablation-replace.mjs (each anchor hit as declared and was restored to a blob equal to HEAD with git diff HEAD empty). Expected direction: red.

Mutation	Result
A. the three turso.zod.ts sentences back to the #9529 wording (anchor ×3→0, blob e25cca4d5508→a05fe3f09733)	3 failed / 12 passed, naming driver-turso:spec/turso.zod.ts:63, :75, :82
B. meta.ts write flag default: false → true (blob c036012c63c9→71acff21ef8c)	1 failed / 14 passed: "the sentence is TRUE of the command it names"
C. meta.ts flag renamed write → inPlace (blob c036012c63c9→29a8a9402284)	1 failed / 14 passed: "os migrate meta declares no write boolean flag"

Under the old corpora, mutation A would have stayed green, because driver-turso was in no corpus.

One bounded fix on the same sentences: CHATTER_POSITION_RETIRED

The three record:chatter / record:discussion position value prescriptions ('sidebar', 'inline', 'drawer', in ui/component.zod.ts) told the author to run a bare os migrate meta. The command refuses that with Missing required flag --from (meta.ts run(), the flags.from === undefined branch). The conversion is record-chatter-position-vocabulary, toMajor: 18, so they now name --from 17. They therefore join the pin's judged set in house form, and the "(registered under protocol major 18)" aside goes. The fix qualifies as bounded: the same sentence class, a mechanical change to an already-pinned form, a file inside this claim's surface, and the same gate family. No test pinned the old text.

Governed surface: .claude/skills/spec-property-retirement/SKILL.md (Tier S)

The pin requires the retirement playbook to teach both shapes (SKILL_HOUSE_TEMPLATE and SKILL_MIXED_TEMPLATE must match its convention 5). So changing the sentence forces the playbook edit, and this PR lands as Tier S. Convention 5 now carries the two new templates. Its note that the command "never writes a source file" was made false by PR #22108, so it is deleted. Line count 337 → 337 (ceiling 337), with every line within the 120-byte budget: node scripts/pm/check-skill-line-ratchet.mjs exits 0. ⛔ No published skills/** file changes: PR #22122 owns skills/objectstack-upgrade/SKILL.md, and no published skill carries the sentence (git grep count 0).

维护者速读(草稿)

改了什么:所有退役键报错末尾那句统一提示,从「运行 os migrate meta --from N 列出机械修改,然后手工改」改为「……列出机械修改;--write 会写入它能证明的那些,其余你手工改」。共 161 处被 pin 判定的报错文案(含 2 处两从句变体),外加生成的 registry 3 处、lint 模板字符串 1 处;其中 3 处原先写成不带 --from 的命令(该命令会直接拒绝),一并改正。守这句话的 pin 同步更新,并新增一条断言:CLI 必须真有 --write 且默认不写。

为什么改:--write 已随 PR #22108 落地,旧句只说「手工改」,低估了工具;但 --write 只写能证明的站点,所以不能说「自动重写源文件」。新句两头都如实。

风险与代价(含回滚):纯文案,不改任何 schema、键、类型、导出或错误码;解析结果不变。依赖旧整句原文匹配的调用方会失配(仓内 23 个测试已同步);前缀「…for existing sources;」不变。回滚即 revert 本 PR。在途的兄弟 PR 若新增处方仍用旧句,会被 pin 打红,后落地者改用新句。

席位意见:

你要做的:无需操作;本 PR 触 .claude/**(Tier S),由席位按合同审查记录落地。

Verification (branch base 51290bca; final head f9ca14d548)

• pnpm --filter @objectstack/spec build: VERDICT command-exit 0. check:generated --fix regenerated the one stale artifact; check:generated then exited 0 (15 of 15 current), and again in the gate run at f9ca14d548.
• spec vitest run --project local: Test Files 623 passed (623), Tests 18613 passed, 1 todo, at 017761f0.
• spec vitest run --project repo (53 files incl. the class pin): 53 passed (53), Tests 903 passed (903), at 017761f0.
• @objectstack/driver-turso vitest run: Test Files 88 passed (88), Tests 2373 passed, 33 skipped, at 017761f0 (after pnpm --workspace-concurrency=2 --filter '@objectstack/lint...' --filter '@objectstack/driver-turso...' build; the first run, before that build, could not resolve unbuilt dependencies and is NOT MEASURED, not red).
• typecheck for spec (tsc --noEmit + check:scripts-typecheck + check:test-typecheck), lint and driver-turso: exit 0 at 017761f0.
• After merging main (033e5c536d: docs(skills): objectstack-upgrade names os migrate meta --write beside the default run #22122, fix(lint)!: a conditional validation rule's nested then / otherwise predicate meets the build's expression verdict, at os build and the object save door (#22042) #22127, fix(objectql): skipAutomations never skips the builtin audit stamps #22106) as f9ca14d548, with no conflict (fix(lint)!: a conditional validation rule's nested then / otherwise predicate meets the build's expression verdict, at os build and the object save door (#22042) #22127 also edits validate-expressions.ts): the class pin 15 passed (15); @objectstack/lint vitest run: Test Files 123 passed (123), Tests 5688 passed (5688); lint typecheck exit 0.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at f9ca14d548 derives 124 commands (the claim-time 79 plus 45). All 124 exit 0 at f9ca14d548. --ran reconciliation: 124 derived, 124 run, 0 NOT-MEASURED, a zero derived from the recorded exit codes. (At 017761f0, five gates first answered exit 3, PREREQUISITE NOT MET: one shallow-clone fixture and four that need unbuilt dists. The clone was deepened as the gate asked, and all five are green in the f9ca14d548 run.)
• node scripts/pm/check-skill-line-ratchet.mjs: exit 0; the playbook is 337 lines (ceiling 337), and no line is over 120 bytes.
• eslint, narrowed: pnpm exec eslint --no-inline-config --format json over the 66 changed .ts files reports 66 files, 0 errors and 0 warnings. The population is eslint.config.mjs's **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} glob, which excludes the changed .md / .mdx files. The config never enables type-aware linting (its own comment at :326–:328), so this diff cannot move any untouched file's verdict. The repo-wide pnpm lint is CI's.

Siblings in flight

#21982, PR #22094 (#13458) and PR #22103 (#5082) each add prescriptions with today's sentence. Whichever lands after this one carries the new sentence; the class pin reds it at that merge otherwise. Whichever of those lands first, this branch merges main before landing.

Acceptance notes

• Hand-written docs still use the old sentence (content/docs/automation/flows.mdx ×2, protocol/objectql/query-syntax.mdx, data-modeling/queries.mdx, protocol/objectui/actions.mdx, ui/apps.mdx ×2). Each is the page's own advice, not a quoted error, and still true of the default run; each undersells --write. They are domain:devx pages outside this claim, so they are not touched here.
• QA checklist item cli.migrate-meta-codemod (docs/qa/platform-checklist/areas/cli.json). Its RESTART CHECK fired when PR feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108 added --write, and the item still asserts a print-only command. Its step 1 greps for the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence verbatim and now finds none. Re-authoring the item belongs to the checklist author, not this PR.
• Comments that say the default run "lists the mechanical edits" stay as they are, because they are still true: the migrations/registry.ts migration notes (outside the pin's scope by design) and the conversions/registry.ts comments.
• The lint chartConfig.xAxis.field hint (validate-widget-bindings.ts) moved, but it remains invisible to the class pin: a template literal, with suggestName(…) and the suppress hint interpolated after the sentence.
• A published skill still claims an automatic strip. skills/objectstack-data/rules/indexing.md:31 says "run os migrate meta --from 16 to strip them automatically", and skills/objectstack-data/SKILL.md:377 says the command "strips them". The default run strips nothing from sources, and --write strips only what it can prove. WITHDRAWN_CLAIM has no strip spelling, so the pin cannot see this. Widening it here would red main on a Tier H file this PR may not touch, so it is reported to the PM for the skills lane.
• The config.actionType two-clause tail ("the stub and marker values are removed") is unchanged in substance; only the --write clause was inserted before it.

Patch round 1 (written by the PM seat from the dev's report 6052088494)

• Merge: origin/main ef1fcb26a2 (PR feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103) was merged through os-regen-merge.sh as feca6b5ace. The three reference pages both sides had changed (api/metadata, data/object, system/migration) were regenerated from the merged tree as 98e2f6e373. That brings back feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103's unique?: false | 'global' | 'organization' rows, which the driver had dropped.

• feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103's sites: the merge brought two non-test sites with the old tail and one test that asserts it verbatim. All three carry the new sentence at b9d6e82619:

  • packages/spec/src/data/object.zod.ts (DECLARED_INDEX_BARE_TRUE_RETIRED);
  • packages/lint/src/data-model-rules.ts (the unique-unscoped-declared-index fix text);
  • unique-scope-message.test.ts.

  The pin now judges 163 sentences: spec 158 (156 house + 2 two-clause), lint 2, driver-turso 3.

• The pin's blind spot: the data-model-rules.ts sentence sat in a template literal, which the judge cannot read (escaped backticks), so it was never judged. It is now plain-quoted, as in validate-expressions.ts, and the pin's Mechanism paragraph records that template literals are invisible to the scan. Ablation D (that sentence back to the old tail) gives 3 failed / 12 passed, naming lint:data-model-rules.ts:463. validate-widget-bindings.ts stays the one template-literal site the pin cannot judge (an Acceptance note).

• Verification at b9d6e82619:

  • spec --project local: 623 files / 18,619 tests;
  • spec --project repo: 53 / 903;
  • lint: 123 / 5,689;
  • driver-turso: 88 / 2,373;
  • typecheck: exit 0 for all three packages;
  • dispatch-gates --ran: 124 derived / 124 run / 0 NOT-MEASURED;
  • CI: 33 success, 2 expected skips.

Patch round 2 (written by the PM seat from the dev's report 6053397952; claim revised 6052335087)

• Why: PR feat(spec)!: retire the flat string-list arm of manifest.permissions — the structured ADR-0025 block is the only form (#13458) #22094 (Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458, fec87e7e07) landed first with a two-clause prescription lacking the --write clause, which this PR's class pin refuses. The sibling rule here ("whichever lands later carries the new sentence") puts the edit in this PR.
• Merge: origin/main 959c209d56 was merged through os-regen-merge.sh as 3b6335b9be, with no hand-written conflict. content/docs/references/api/protocol.mdx was regenerated as c40b3babd7.
• The edit (fe3af5642c, 4 files beyond the merge):
  • packages/spec/src/kernel/manifest.zod.ts PLUGIN_PERMISSIONS_LIST_FORM now closes with "Run os migrate meta --from 17 to list the mechanical edits for the package manifest case; --write applies the ones it can prove, and a granted-permission record is not a source it reads." It keeps Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458's own second clause and adds the house --write clause, the seat's wording.
  • Its verbatim pin manifest-permissions-string-list.test.ts moved with it.
  • The changeset's two-clause bullet now names three members and says "before their second clause".
• The two-clause variant now has three members: dashboard compareTo.offset, the script node's config.actionType, and the package manifest permissions case. The pin judges 164 sentences (spec 159 = 156 house + 3 two-clause; lint 2; driver-turso 3) with 0 bad sites.
• Verification at fe3af5642c:
  • spec --project local: 625 files / 18,661 tests;
  • spec --project repo: 53 / 903;
  • class pin: 15 / 15, and the manifest pin: 17 / 17;
  • dispatch-gates --ran: 124 / 124 / 0 NOT-MEASURED;
  • CI: 33 success, 2 expected skips.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/driver-turso, @objectstack/lint, @objectstack/spec, touching 111 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/src/shared/retired-key.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

30 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 13aea189591b935d81eb306f9be8a50c9045f661.

⛔ 12 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/src/shared/retired-key.ts) — pages documenting those are invisible to this run
• 14 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 142 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 13aea189591b935d81eb306f9be8a50c9045f661 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6671b7fea46a104f7ed99f9506a004f5fd8c8bcf — the merge of head 75302366e563cf2c6529380977f135f9966a84f5 into base 13aea189591b935d81eb306f9be8a50c9045f661, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6671b7fea46a104f7ed99f9506a004f5fd8c8bcf && git checkout 6671b7fea46a104f7ed99f9506a004f5fd8c8bcf
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 13aea189591b935d81eb306f9be8a50c9045f661 75302366e563cf2c6529380977f135f9966a84f5 && git checkout -B drift-repro 13aea189591b935d81eb306f9be8a50c9045f661 && git merge --no-ff 75302366e563cf2c6529380977f135f9966a84f5

node scripts/docs-audit/affected-docs.mjs --json 13aea189591b935d81eb306f9be8a50c9045f661

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 13aea189591b935d81eb306f9be8a50c9045f661 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b9d6e82619337f9542a9ef7f54724d671729d834
Local-runs: none

Read at 2026-10-08T04:30Z, from the inputs the brief names and nothing else: card #9591 (body and all 12 comments; page 2 came back empty), PR #22142 (body; its 102-file list is identical to git diff --name-only ef1fcb26a2..b9d6e82619, the merge base being ef1fcb26a2), the 42 check-runs on the head, packages/spec/src/shared/retired-key.ts and retired-key-migrate-sentence.test.ts on ef1fcb26a2 and on the head, and packages/cli/src/commands/migrate/meta.ts on the head (read, not changed by the PR: git diff over packages/cli is empty). Head repo is the base repo, not a fork; the PR is a draft; one .claude/** path makes it Tier S.

Gate verdicts (the check-runs on the head): 42 runs, 38 success, 4 skipped, 0 failure. Test Core and its six shards, Lint & Repo Gates, the four Type Check jobs, Governed Surface Queue Guard, Check Changeset, Spec property liveness, Build Core, Build Docs, Dogfood and Temporal Conformance are all green. The four skips are each in the roster: Console Pin Gate (the console path filter names .objectui-sha, scripts/build-console.sh, packages/spec/package.json, packages/spec/tsup.config.ts and the like, none of which this diff touches, so the filter contract skips it), Packed-tarball smoke (opt-in label), and Auto Label plus Check PR Size on the second, PR-edited workflow run, whose first-run twins succeeded.

① Derived judgments

Each item names what the diff implies and whether it is right.

1. The sentence is TRUE of os migrate meta on both routes — right. The sentence: "Run os migrate meta --from N to list the mechanical edits for existing sources; --write applies the ones it can prove, and you apply the rest by hand." Default route: meta.ts declares write: Flags.boolean({ … default: false, exclusive: ['stored'] }) (lines 762–769); without it the authored chain replays the conversions in memory, prints the applied list, and writes only the --out snapshot when asked (writeStackSnapshot, and the writeFileSync(resolve(flags.out), …) on the --json branch). "To list" holds. --write route: writeSources() (lines 999–1053) plans with planAuthoredSourceWrite, writes, re-loads and re-runs the chain, verifies with verifyAuthoredSourceWrite, and on any disagreement calls restoreAuthoredSources and exits 1; every site it does not write is reported with its refusal kind. "Applies the ones it can prove, and you apply the rest by hand" holds, and the re-run is part of the proof (the docblock says "held to a re-run of the chain"), so a restored run is not a counter-example. --write rides the same invocation (--from is still required at line 832; the command's own example is --from 16 --write), which is how the sentence reads it.

2. One antecedent — kept. "Existing sources" is still the single object of "for". "The ones" has two plural nouns before it (edits, sources), but "applies" and "apply" take an edit, and — the point of the 2026-08-09 ruling — neither reading says anything about the KEY's fate, which stays in the body prose. The pin forces the qualification: "--write applies them." is a RED fixture.

3. "Automatically" unqualified — never said. Every added line of the diff was grepped for it: the hits are the changeset's own negation ("never says the tool rewrites your sources automatically"), the docblock and pin comments quoting the withdrawn claim, and one regenerated reference row whose pre-existing clause "Stored flows are converted automatically — the conversion does the quoting for you" (flow.zod.ts waitEventConfig.timeoutMs) describes the D2 load-path conversion of stored rows, not an authored-source rewrite; it is not a WITHDRAWN_CLAIM spelling and it is true of the tool. Right.

4. The class pin's new assertions — each holds what it claims.

   • RED cases: the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 house sentence and its MIXED spelling (silent on --write), "--write applies them." (unqualified by omission), "--write applies the ones it can prove." (the rest unowned), and the re-spelled buried-sentence case. Read against HOUSE_AT_MARKER (which demands the full ", and you apply the rest by hand." tail before the closing quote) and MIXED_AT_MARKER (which demands "for the X case; --write applies the ones it can prove, and …"), every one fails both anchors. Right.
   • Truth anchor: the regex \n\s*write: Flags\.boolean\(\{([\s\S]*?)\n\s*\}\), lands on meta.ts lines 762–769 and its lazy group ends at that flag's own }), (no }), sits inside its description), so the captured body carries default: false. It is a source read, not a built CLI — conservative (an explicit default: false deleted in favour of oclif's implicit false would red it with behaviour unchanged), and it proves existence and default only; what --write does is the CLI's own pins' job (feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108). The PR's ablations B and C agree. Right.
   • Per-corpus anti-vacuity loop: iterates every corpus but spec, requiring at least one judged site and all ok. At the head the lint corpus has 2 judged sites (validate-expressions.ts:1832 and data-model-rules.ts:463, the latter plain-quoted in this PR) and driver-turso has 3. Right.
   • Corpus widening to driver-turso: TURSO_SRC_ROOT resolves to packages/drivers/driver-turso/src; the walk yields non-test .ts; the three turso.zod.ts tombstones are the whole marker population there (turso.test.ts carries three more and is skipped as a test). The PR's statement that mutation A would have stayed green under the old corpora is right: the file was in no corpus. Right.
   • Markdown judge: the playbook is judged flat (runs of whitespace collapsed), so the house template's new two-line wrap inside one double-backtick span is still one sentence; SKILL_HOUSE_TEMPLATE and SKILL_MIXED_TEMPLATE both match the playbook at the head, and the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 template is a new RED fixture. Right.
   • Independent count: marker occurrences (the pin's unit) on non-comment lines of non-test .ts under the three roots, minus migrations/registry.ts, are spec 158, lint 2, driver-turso 3 — the 163 the second report states. Across all of packages/** the old tail survives only in the pin's two RED fixtures, and no file outside the three corpora carries the new sentence, so after the widening every shipped carrier is judged except the two acknowledged blind spots (migrations/registry.ts, out of scope by design and regenerated from in-scope entries; validate-widget-bindings.ts, a template literal).

5. The bounded CHATTER_POSITION_RETIRED fix — right. Before: "Run os migrate meta to list the mechanical edits for existing sources (registered under protocol major 18); apply them by hand." A bare os migrate meta exits 1 with "Missing required flag --from" (meta.ts lines 832–844), so the three prescriptions named a command that refuses. record-chatter-position-vocabulary is toMajor: 18 (conversions/registry.ts 6652–6654, retiredFromLoadPath: true); migrations/chain.ts applies each step's conversionIds through CONVERSION_BY_ID from ALL_CONVERSIONS with no retired filter, and step 18's ids are CONVERSIONS_BY_MAJOR[18], so --from 17 replays it and the listing claim is true; N is toMajor minus one, as meta.ts's own docblock prescribes. The three now carry a --from marker and join the judged set in house form; no test pinned the old text; the four bounded-fix conditions hold and the claim was revised in the same round (6051261867).

6. The playbook's two templates (Tier S, judged as the agent-facing rule) — right. Convention 5 now teaches exactly the two shapes the pin enforces, each a closed code span, with the --from operand placeholder unchanged; the note that the command never writes a source file was made false by feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108 and is deleted, and nothing else in the file still says so. The templates match the pin's markdown anchors, so an author who copies from the playbook lands green; the rationale stays reachable through the pin's pointer to the retired-key.ts docblock. Net 0 lines; the skill line ratchet sits in the green Lint & Repo Gates. No published skills/** file is in the diff, and at the head no published skill carries a house-form os migrate meta --from sentence at all.

7. Accept set and public surface — unchanged; Clause-②: no confirmed. Every +/- line under packages/**, .claude/** and .changeset/** that is not the sentence swap was listed: comments, the pin, the retired-key.ts docblock and @example, the lint plain-quoting (template literal to string concatenation; emitted bytes identical apart from the sentence), the two-clause seams, the chatter --from 17 with its comment, the changeset and the playbook. No z. call, key, type, export or signature moves; retiredKey() is byte-identical. The 268 changed rows across the 32 regenerated reference pages are sentence-only. 23 test files (22 spec, 1 lint) assert the new sentence verbatim, so a revert reds them. The prefix up to "for existing sources;" is unchanged, as the changeset says.

② Semver level

.changeset/9591-retirement-sentence-write.md declares patch for @objectstack/spec, @objectstack/lint and @objectstack/driver-turso — exactly the three published packages whose shipped text moves; @objectstack/cli is read, not changed, and rightly absent. Clause-②: no in the changeset equals PR body line 2 and the claim; no arm, which AGENTS.md allows for no. Finding ①7 shows no accept/reject result and no public export moves, so no minor is owed; a prescription-text fix in released packages is the patch case. The body carries the FROM and TO sentences and the prefix-compatibility note; each factual bullet (two-clause members, chatter --from 17, lint's two sites, turso's three tombstones) matches the diff. Check Changeset is green. Right.

③ Boundary flags

Dev deviations, report 6051224331:

• Playbook outside the claim surface — forced by the pin's own playbook assertion; claim revised (6051261867); judged at ①6. Accepted.
• turso.zod.ts outside the surface — three live sentences never walked; corpus widened; domain:engine declared in the revision. Accepted.
• meta.ts read, not edited — a cross-package test input; check:cross-package-test-inputs sits in the green Lint & Repo Gates. Accepted.
• validate-widget-bindings.ts second lint site — moved; a template literal, invisible to the pin, recorded in the pin's Mechanism paragraph. Accepted as a standing one-site blind spot.
• Bounded chatter fix — ①5. Accepted.
• Pin gained assertions, not a gate — right; same vitest file, no CI wiring moved.
• Clause-② line with a parenthetical — scripts/pm/clause2-line.mjs reads the value, then an arm only when the parenthetical's first token is widening or narrowing; this one yields arm null, declared no, well-formed.
• Attribution trailer amended pre-push, git fetch --unshallow, an os-verify-lock queue timeout — local process; no effect on the diff or on the verdicts above.

Dev deviations, report 6052088494:

• field.zod.ts, view.zod.ts and migrations/registry.ts needed no edit in the merged tree — verified: the old tail has zero hits under packages/** outside the pin fixtures. Accepted.
• data-model-rules.ts plain-quoted rather than widening the corpus — the right remedy: the lint corpus already walked the file, and reconstruct() merges only single- and double-quote seams, so a template literal is invisible; the emitted fix text is identical apart from the sentence. Accepted.
• os-regen-merge.sh stopped at step 3; the three reference pages regenerated from the merged tree as 98e2f6e373 — the net diff on those pages is sentence-only and check:generated is green. Accepted.
• Gate re-run loop refused by the harness and re-run by name; a merge commit without the trailer pair — local process; the check-runs are the verdict; the queue squashes.

Out-of-scope findings, both reports, answered:

• skills/objectstack-data "strip them automatically" (class b, Tier H) — filed by the seat as skills(objectstack-data): two published lines say os migrate meta --from 16 strips retired keys "automatically", but the default run writes no source and --write strips only the sites it can prove #22144. Correctly routed; the WITHDRAWN_CLAIM strip-spelling widening must ride that PR, since the pin's markdown corpus walks skills/**. Already escalated.
• docs/qa/platform-checklist/areas/cli.json item cli.migrate-meta-codemod — verified at the head: its step 1 still greps the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence verbatim and the item asserts print-only; its own RESTART CHECK fired at feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108. Not shipped text, so not blocking. Escalated to the PM for a checklist-author card.
• Hand-written domain:devx pages (automation/flows.mdx twice, protocol/objectql/query-syntax.mdx, data-modeling/queries.mdx, protocol/objectui/actions.mdx, ui/apps.mdx twice) — verified at the head; page prose, still true of the default run; the ruling binds prescriptions and the pin judges prescriptions and the skill catalog. Not blocking. Escalated to the PM for a domain:devx card using skills(objectstack-data): two published lines say os migrate meta --from 16 strips retired keys "automatically", but the default run writes no source and --write strips only the sites it can prove #22144's wording.
• validate-widget-bindings.ts template literal and the stale "as measured" line numbers in scripts/cross-package-test-inputs.mjs — comment and quoting drift; the gates are green. Acceptance notes stand.

New from this review, in neither report:

• .changeset/5082-declared-index-unique-scope.md line 42 (PR feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103's changeset, on main since the merge base) carries the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence in its one-line-fix prose and will ship as @objectstack/spec CHANGELOG text. Release prose, the same class as the migrations ledger the pin leaves out of scope by design; true of the default run; another card's file. Not blocking. Noted for the PM: leave it as the record of what feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103 shipped, or align it when the release notes are compiled.

No open_questions were raised by the dev, and none arise here. The seat's ACCEPT names one pure re-sync hop with main before landing (a generated page both sides moved); a regenerate-only hop with a Regen-provenance: pointer carries this record forward, and a hop that changes anything else needs a new record on the new head.

Implemented-by: claude/issue-9591-retirement-sentence-write
Reviewed-by: session_01LAi5BVvQNiYzepSAcsoFLK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fe3af5642cece4e37eae98a04a255721e5b3b3c5
Local-runs: none

Read at 2026-10-08T06:10Z, from the brief's inputs and nothing else: card #9591 (body and all 15 comments; page 2 came back empty), PR #22142 (body; its 104-file list is identical to git diff --name-only 959c209d56..fe3af5642c, the merge base being 959c209d56, which the head merges), the 42 check-runs on the head (every one carries fe3af5642c as its head sha), packages/spec/src/shared/retired-key.ts and retired-key-migrate-sentence.test.ts at the head, packages/cli/src/commands/migrate/meta.ts at the head (blob c036012c63c9, identical on 959c209d56; the PR changes nothing under packages/cli), and PLUGIN_PERMISSIONS_LIST_FORM in packages/spec/src/kernel/manifest.zod.ts on 959c209d56 (PR #22094's landed text) against the head. Head repo is the base repo; the PR is a draft; the one .claude/** path (spec-property-retirement/SKILL.md) makes it Tier S. This head is not a regeneration hop from b9d6e82619: three commits follow the merge of main (3b6335b9be), and fe3af5642c hand-edits three files, so the earlier PASS (6052278193) does not carry. This record judges the whole PR at this head and re-verified every finding it reuses.

Gate verdicts (the check-runs on the head): 42 runs, 38 success, 4 skipped, 0 failure. Test Core and its six shards, Lint & Repo Gates, the four Type Check jobs, Governed Surface Queue Guard, Check Changeset (both runs), Spec property liveness, Build Core, Build Docs, Dogfood and Temporal Conformance are green. The four skips are each in the roster: Console Pin Gate (path filter; nothing this diff touches is on it), Packed-tarball smoke (opt-in label), and Auto Label plus Check PR Size on the second, PR-edited workflow run (37735136811), whose first-run twins succeeded.

① Derived judgments

1. The house sentence is TRUE of both os migrate meta routes — right. "Run os migrate meta --from N to list the mechanical edits for existing sources; --write applies the ones it can prove, and you apply the rest by hand." Default route: meta.ts declares write: Flags.boolean({ … default: false, exclusive: ['stored'] }) (lines 762–769); --from is validated at line 832 and a bare run exits 1 with "Missing required flag --from"; without --write the run normalizes with { convert: false }, replays applyMetaMigrations in memory, prints the applied list and writes only the --out snapshot. "To list" holds. --write route: writeSources() (lines 999–1053) plans with planAuthoredSourceWrite, writes, re-loads the config, re-runs the chain, verifies with verifyAuthoredSourceWrite, and on any disagreement restores every file and the command exits 1; the codemod's docblock and CodemodRefusalKind (11 kinds) name what it refuses, and every refused site is listed with its reason. "Applies the ones it can prove, and you apply the rest by hand" holds on the same invocation (--from N --write).

2. One antecedent — kept. "Existing sources" is the single object of "for"; "the ones" takes "edits" (an edit is what gets applied); the key's fate stays in the body prose. The pin forces the qualification: "--write applies them." and "--write applies the ones it can prove." (the rest unowned) are both RED fixtures.

3. "Automatically" unqualified — never said. Every added line of the net diff outside the regenerated pages was grepped: the hits are the changeset's own negation and two comment lines, in the retired-key.ts docblock and the pin header, that quote the withdrawn claim. The flow.zod.ts waitEventConfig.timeoutMs row's pre-existing "Stored flows are converted automatically" (the D2 load-path conversion of stored rows) is a context line this PR does not touch, not a WITHDRAWN_CLAIM spelling, and true. WITHDRAWN_CLAIM spellings survive at the head only inside the pin's own fixtures.

4. The class pin's assertions — each holds. HOUSE_AT_MARKER and MIXED_AT_MARKER require the --write clause and the literal-final period; the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 house and MIXED spellings, the two half-qualified spellings and the buried-sentence case are RED. The truth anchor /\n\s*write: Flags\.boolean\(\{([\s\S]*?)\n\s*\}\),/ lands on lines 762–769 and its lazy group ends at that flag's own }), (no }), sits inside its description), so the captured body carries default: false. The per-corpus anti-vacuity loop iterates every corpus but spec. TURSO_SRC_ROOT resolves to packages/drivers/driver-turso/src, whose three turso.zod.ts tombstones are its whole marker population. reconstruct() merges the cross-line seam the manifest sentence now uses (a literal ending in case; and the next line reopening at --write), so the split literal is judged whole. Independent census on the head tree (marker occurrences on non-comment lines of non-test .ts under the three roots, migrations/registry.ts excluded): spec 159, lint 2, driver-turso 3 — the 164 the newest report states. The old tail survives across packages/**, .claude/** and skills/** only in the pin's two RED fixtures.

5. The bounded CHATTER_POSITION_RETIRED fix — right. The three prescriptions named a bare os migrate meta, which exits 1 for the missing --from. record-chatter-position-vocabulary is toMajor: 18; migrations/chain.ts applies each step's conversionIds through CONVERSION_BY_ID with no retired filter, so --from 17 replays it and the listing claim is true. Same sentence class, mechanical, inside the surface, same gate family; no test pinned the old text; the claim was revised in the same round (6051261867).

6. The playbook's templates (Tier S) — right. Convention 5 teaches exactly the two shapes the pin enforces, each a closed double-backtick span; flattened, the house template matches SKILL_HOUSE_TEMPLATE and the variant matches SKILL_MIXED_TEMPLATE; the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 template is a RED fixture. The note that the command "never writes a source file" was made false by feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108 and is deleted; nothing else in the file still says so. 337 lines in, 337 out (ceiling 337); the four lines this PR adds are 40–94 bytes, inside the ratchet's 120-byte cap; check:pm-skill-ratchet sits in the green Lint & Repo Gates. No published skills/** file is in the diff.

7. NEW at this head — the third two-clause member. PLUGIN_PERMISSIONS_LIST_FORM now closes with "Run os migrate meta --from 17 to list the mechanical edits for the package manifest case; --write applies the ones it can prove, and a granted-permission record is not a source it reads."

   • True of the tool. manifest-permissions-string-list-removed is toMajor: 18, retiredFromLoadPath: true; the chain replays it at --from 17 (finding 5's mechanism), and it emits one (removed) entry per manifest.permissions or packages[].manifest.permissions list, so the default run lists the manifest case. The codemod takes a removed key as an op: 'delete' change (diffStacks, line 270) and writes it when the walk reaches one literal in one project file through defineStack — a config-literal manifest list is provable; a packages[] manifest under node_modules is refused outside-project and listed. The second clause stays true: the chain reads the authored stack; an environment artifact's grantedPermissions value is never in it, and --write is exclusive with --stored.
   • Inside the ruled two-clause shape. The concatenated sentence matches MIXED_AT_MARKER (the seam reconstructed; checked against the anchor's regex). Its second clause names the other carrier of the one declaration and what the tool does with it (does not read it) — within "what the tool does with the rest". That clause is feat(spec)!: retire the flat string-list arm of manifest.permissions — the structured ADR-0025 block is the only form (#13458) #22094's own, accepted under the pre---write MIXED anchor; this PR inserts only the house clause and re-opens nothing.
   • Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458's claim intact. The second clause is byte-identical to the 959c209d56 text; the message's prefix, through "when the plugin needs none.", is unchanged.
   • The pin moved without weakening. PRESCRIPTION in manifest-permissions-string-list.test.ts differs from 959c209d56 only by the inserted clause; its start and end anchors, /s flag and the two .* gaps are the same, and all four toMatch(PRESCRIPTION) sites, the accept-set, tsc, D2 replay and not-on-the-authoring-funnel assertions are untouched.

8. Accept set and public surface — unchanged; Clause-②: no confirmed. Every +/- line under packages/**, .claude/** and .changeset/** that is not the sentence swap was listed: the pin, the retired-key.ts docblock and @example, three comment updates (validate-expressions.ts, data-model-rules.ts, component.zod.ts), the data-model-rules.ts plain-quoting (template literal to string concatenation; emitted bytes identical apart from the sentence), the three two-clause seams, the chatter --from 17, the changeset and the playbook. No z. call, key, type, export or signature moves; retiredKey() is byte-identical. The 32 regenerated reference pages (268 changed rows, api/protocol.mdx among them) are sentence-only: a pairwise compare with both tails stripped is empty.

② Semver level

.changeset/9591-retirement-sentence-write.md: patch for @objectstack/spec, @objectstack/lint and @objectstack/driver-turso — the three published packages whose shipped text moves; @objectstack/cli is read, not changed, and rightly absent. Clause-②: no in the changeset equals PR body line 2 and the claim; the body's parenthetical opens with "prescription", not a word of the arm family, so clause2-line.mjs reads it as declared no, arm null, no contradiction. The edited bullet — "The three prescriptions … (dashboard compareTo.offset, the script flow node's config.actionType and the package manifest permissions case) carry the same --write clause before their second clause" — is true of the diff, and the old "before the clause about the rest of the value" would have been false of the manifest member. Every other bullet (chatter --from 17, lint's two sites, turso's three tombstones, the prefix-compatibility note) matches the diff. Check Changeset is green on both runs. Right.

③ Boundary flags

Report 6051224331 (round 0):

• Playbook outside the claim surface — forced by the pin's playbook assertion; claim revised (6051261867); judged at ①6. Accepted.
• turso.zod.ts outside the surface — three live sentences never walked; corpus widened; domain:engine declared. Accepted.
• meta.ts read, not edited — a cross-package test input; check:cross-package-test-inputs sits in the green Lint & Repo Gates. Accepted.
• validate-widget-bindings.ts — moved; a template literal with interpolation after the sentence, invisible to the pin; recorded in the pin's Mechanism paragraph. Accepted as the standing one-site blind spot.
• Bounded chatter fix — ①5. Pin gained assertions, not a gate — same vitest file, no CI wiring moved. Clause-② parenthetical — well-formed (②). Attribution trailer, git fetch --unshallow, lock timeout — local process.
• Out of scope: the skills/objectstack-data strip claim → skills(objectstack-data): two published lines say os migrate meta --from 16 strips retired keys "automatically", but the default run writes no source and --write strips only the sites it can prove #22144 (the WITHDRAWN_CLAIM strip-spelling widening rides that PR, since the pin walks skills/**); the stale QA item cli.migrate-meta-codemod, the hand-written domain:devx pages and the cross-package-test-inputs.mjs line numbers — not shipped prescription text; escalated to the PM as before, nothing new to add.

Report 6052088494 (patch round 1):

• field.zod.ts, view.zod.ts, migrations/registry.ts needed no edit — verified at this head: zero old-tail hits outside the fixtures. Accepted.
• data-model-rules.ts plain-quoted rather than widening — the right remedy; the corpus already walked the file. Accepted.
• os-regen-merge.sh stop at step 3, regeneration as 98e2f6e373, the gate loop re-run by name, a merge commit without the trailer pair — local process; the check-runs are the verdict; the queue squashes.

Report 6052319001 (blocked landing):

• The probe merge was aborted with nothing pushed, and the measurement named the exact site and its pin — the right call; the seat's "zero old-tail" reading was correct and incomplete for the two-clause shape, which the revision (6052335087) records. The dev's offer of a re-worded tail was declined by the seat in favour of keeping Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458's clause; ①7 judges that choice inside the shape. Answered.

Report 6053397952 (patch round 2):

• The changeset bullet's "before their second clause" — true; the old wording would have been false of the manifest member. Accepted.
• The split quote-and-plus literal — the pin reconstructs it and the emitted message is byte-identical to the verbatim sentence (checked by concatenation). Accepted.
• os-regen-merge.sh step-3 stop, lock timeouts, the background shard — local process. The pr_body_needs are carried in the body's "Patch round 2" section. One body sentence is loose: "CI: 33 success, 2 expected skips" — the head carries 42 runs, 38 success and 4 skips, the extra seven being the PR-edit re-run (two skipped by design); no red either way.
• The report's "no line exceeds 120 bytes" is true of the lines this PR adds (①6); seven untouched lines of the playbook measure over 120 bytes and the ratchet is green, so the gate's own measure governs. Immaterial.

New from this review, in no report:

• .changeset/13458-manifest-permissions-string-list-retired.md line 25 (on main since 959c209d56) carries "os migrate meta --from 17 lists the mechanical edits for existing sources; apply them by hand.", and .changeset/5082-declared-index-unique-scope.md line 42 carries the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence. Release prose outside the pin's corpora, another card's files, true of the default run. Not blocking. For the PM: align both when the release notes are compiled, or leave them as the record of what each PR shipped.

No open_questions were raised by the dev, and none arise here. The seat's ACCEPT (6052105188) named one pure re-sync hop; this head is not one, and this record is the new review it requires. A further hop that only regenerates carries this record forward with a Regen-provenance: pointer; a hop that changes anything else needs a new record on the new head.

Implemented-by: claude/issue-9591-retirement-sentence-write
Reviewed-by: session_01LAi5BVvQNiYzepSAcsoFLK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Regen-provenance: 6053587390 · fe3af56 → 7530236 · comm -23 <(git diff --name-only fe3af5642c 75302366e5 | sort) <(git diff --name-only 959c209d56 13aea18959 | sort) → (empty)

domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T06:16Z. A pointer, not evidence: the queue guard re-runs the test.

• The hop: 5949dbf0ba merges origin/main 13aea18959 into fe3af5642c. 75302366e5 regenerates content/docs/references/ui/view.mdx, the one generated file both sides changed, from the merged tree. No hand edit.
• Re-run by this seat: the files that differ across the hop, minus the files main changed (959c209d56..13aea18959), are empty, before any regenerated output is subtracted.
• The PR's net diff is unchanged: 104 files, +667 / −556 on both sides of the hop. The file sets match, and each file's changed lines are byte-identical between 959c209d56..fe3af5642c and 13aea18959..75302366e5.

[objectstack-fleet]

The merge queue refused this PR, as designed; the seat's pointer did not certify the hop. domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T07:21Z

• What happened:
  • The queue build's Governed Surface Queue Guard exited 3, unapproved. This was build dfcd924b6b, the run of 06:54Z.
  • The PR left the queue at 07:19Z, and its auto-merge was dropped.
  • The seat replayed the guard locally on that merge group and got the same verdict.
• Why: the Regen-provenance: pointer 6053668168 did not carry the record 6053587390 from fe3af5642c to 75302366e5.
  • The guard's purity test on the committed trees (unexplainedPathsBetween) counts every path that moved across the hop, carries no merge=os-regen, and that the PR touches at either head.
  • That gives one path: packages/lint/src/validate-expressions.ts. This PR changes one sentence in it, and main changed it too, in 959c209d56..13aea18959.
  • The seat's own reading compared the hop against main's changed files. It found the PR's per-file delta byte-identical, and it called the hop pure. That is a weaker test than the guard's, and the guard's is the one that counts.
  • This was the seat's error, not the dev's.
• Now:
  • The PR is back to draft, with auto-merge off.
  • A fresh at-tier contract review of 75302366e5 has been commissioned, from the brief's inputs only. It must cover the two-sided file explicitly.
  • The PR is flipped ready and re-queued only on a PASS record that names this head.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 75302366e563cf2c6529380977f135f9966a84f5
Local-runs: none

Rendered 2026-10-08T07:39Z. PR #22142 at this head against its merge base 13aea18959 (card #9591). Read-only: the net diff, the card body and all 16 of its comments, the PR body, file list and comments, the binding texts at the head and on the base, and the head's check-runs. This is an adversarial re-review of the whole PR at this head; nothing from the prior record 6053587390 (head fe3af5642c) is carried without re-verification below.

Why this record is owed, re-derived. This head is fe3af5642c, plus a merge of main 13aea18959 (5949dbf0ba, parents fe3af5642c and 13aea18959), plus a regenerated content/docs/references/ui/view.mdx (75302366e5: 1 file, +1/-1). The queue guard refused to carry the prior record because packages/lint/src/validate-expressions.ts is PR-touched, hand-written (it carries no merge=os-regen attribute; content/docs/references/** does), and main changed it inside 959c209d56..13aea18959. Re-derived here rather than taken from the Regen-provenance: pointer:

• Two-sided files (PR-touched, intersected with main-changed in the hop): exactly two, packages/lint/src/validate-expressions.ts and content/docs/references/ui/view.mdx.
• The PR's net diff is byte-identical across the hop. 959c209d56..fe3af5642c and 13aea18959..75302366e5 touch the same 104 files at +667/-556, and every file's hunk body (index and hunk-header lines excluded) hashes identical, 104 of 104. The merge commit touched 90 files, every one inside main's 91-file hop; 0 outside.
• validate-expressions.ts: the PR's own hunk is identical at both heads; only its offset moved (1827 to 1837). What main brought is fix(lint)!: the object save door gives the build's option visibleWhen verdict (#22032 pass 3) #22151 (the finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 pass-3 unfencing of per-option visibleWhen): docblock and comment edits near lines 1194 to 1272 and the loop near 2047 to 2096. It adds no second retirement prescription and no os migrate meta sentence, and the PR's sentence (the script node's retired dispatch-key diagnostic, now at :1849) and its antecedent are untouched.
• view.mdx: main's hop changed one line, the publicLink describe (fix(spec): the sharing.publicLink describe says the value is a slug and names where it is served #22159). The driver kept the PR side in 5949dbf0ba (its view.mdx equals fe3af5642c's), and 75302366e5 restored exactly that one line. In the net diff at this head view.mdx is 62 of 62 pure tail swaps and carries no publicLink line, which is correct against the base.
• Everything else main brought in 959c209d56..13aea18959, repo-wide with CHANGELOGs excluded: 0 added lines naming os migrate meta, 0 new retiredKey( or enumWithRetiredValues( calls, 0 added lines with the old tail. Nothing arrived that the class pin or the sweep should have caught.

Check-runs on this head. 36 runs: 34 success, 2 skipped (Console Pin Gate and the opt-in packed-tarball smoke, both conditional). All seven required contexts are success, both Governed Surface Queue Guard runs included. The PR carries 0 reviews, auto-merge is unarmed, head repo equals base repo, and the diff is 1,223 changed lines.

① Derived judgments

Surface (a), the shipped prescription text across packages/spec/src/**, packages/lint/src/** and packages/drivers/driver-turso/src/** (the path limb):

1. The house sentence is true of both os migrate meta routes. Read from packages/cli/src/commands/migrate/meta.ts at the head (blob c036012c63c9, identical on the base; the PR does not edit it). The default run prints Applied N mechanical change(s): (:493), writes no authored source, and writes only the --out snapshot when asked. --write is Flags.boolean({ default: false, exclusive: ['stored'] }) (:762 to :769) and is described as rewriting the authored sources in place for each mechanical change traced to one literal in one project file, listing every other change with the reason it was not written, never the semantic changes; its outcome printer reports Wrote N of M mechanical change(s) and N mechanical change(s) left for you to apply by hand, each with not written [kind]: reason (:353 to :367). The codemod module packages/cli/src/utils/authored-source-codemod.ts exists at the head. So "to list the mechanical edits" is the default route, "--write applies the ones it can prove" is the write route, and "you apply the rest by hand" is the listed remainder. The --stored route is outside the sentence by construction: --from and --write are both exclusive: ['stored'], and a run without --from refuses with Missing required flag --from and names --stored, so the sentence claims nothing it could fail there.
2. One antecedent. "existing sources" names one thing; "the ones" and "the rest" can only be edits, since an edit is what gets applied; "it" is the tool. The key's fate stays in each prescription's body prose and the sentence never restates it.
3. No unqualified "automatically". The word does not occur in the sentence. At the head, every WITHDRAWN_CLAIM spelling counts 0 across the three corpora, skills/** and .claude/** in non-test files.
4. The class pin's assertions (packages/spec/src/shared/retired-key-migrate-sentence.test.ts, +129/-50), verified by reading the file at the head: HOUSE_AT_MARKER and MIXED_AT_MARKER both require the --write clause and the literal-final position; WITHDRAWN_CLAIM is unchanged and its non-vacuity case now also proves neither legal shape trips it; a truth anchor reads meta.ts's own flag table for a write boolean flag with default: false; the corpus gains packages/drivers/driver-turso/src, and the lint-only anti-vacuity case became a per-corpus loop; the RED fixtures add the os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 sentence, the two half-qualified --write spellings, and the markdown os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529 template; the markdown judge's house and two-clause templates require the clause. The old tail survives at the head only inside the pin's two RED fixtures (:420 and :659). The pin has 15 cases, and Test Core is success on this head.
5. The bounded CHATTER_POSITION_RETIRED fix (ui/component.zod.ts): the three value prescriptions ('sidebar', 'inline', 'drawer') that named a bare os migrate meta, which the command refuses for the missing --from, now name --from 17; the conversion record-chatter-position-vocabulary is toMajor: 18 at the head, so 17 is the right operand. The "(registered under protocol major 18)" aside is removed, the comment above records why, and all three sentences are house-form. Zero bare Run \os migrate meta`` prescriptions remain in the three corpora. The fix stays inside the four bounding conditions.
6. The third two-clause member (kernel/manifest.zod.ts PLUGIN_PERMISSIONS_LIST_FORM). On the base it closes "Run os migrate meta --from 17 to list the mechanical edits for the package manifest case; a granted-permission record is not a source it reads." (Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458's wording, no --write). At the head the house clause is inserted before that second clause, split across a quote-and-plus seam that the pin's reconstruct merges, and the sentence stays literal-final. It shape-matches MIXED_AT_MARKER; --from 17 matches manifest-permissions-string-list-removed toMajor: 18; the verbatim PRESCRIPTION regex in manifest-permissions-string-list.test.ts moved with it. The other two members (dashboard compareTo.offset and the script node's config.actionType) carry the clause the same way.
7. The sweep is wording-only. With the house tail swap stripped from the three corpora's non-test sources, what remains is exactly: the retired-key.ts module docblock and its retiredKey() example; the pin; the comment edits in validate-expressions.ts and component.zod.ts; data-model-rules.ts re-spelled plain-quoted so the pin can read it (escaped template backticks hid it); the three two-clause members; the translation.zod.ts seams re-split; the chatter fix. No schema, key, type, export or error-code line moves. Generated references: 268 of 268 changed lines are the house tail swap (267) plus the actionType two-clause row (1), with check:docs the only regenerated artifact. Tests: 25 files, 31 verbatim old-to-new assertion swaps; the only residue is one comment and the manifest regex. The lint corpus at the head holds two plain-quoted judged sites (validate-expressions.ts:1849, data-model-rules.ts:463), one template-literal site the pin cannot read (validate-widget-bindings.ts:1191, moved anyway and reported), and one mid-prose mention (lint-flow-patterns.ts:955) that is not a prescription.

Surface (b), .claude/skills/spec-property-retirement/SKILL.md (Tier S):

8. The playbook's templates. The diff is confined to convention 5 (+4/-4): the house template gains the clause, wrapped across two lines inside its double-backtick span, which the markdown judge reads whole after collapsing whitespace; the two-clause template gains the clause before its "what the tool does with the rest" placeholder; the note that the command "never writes a source file" is deleted, as it has been false since feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108. 337 to 337 lines against a ceiling of 337. The four lines this PR wrote are 90, 77, 94 and 40 bytes. Seven lines over 120 bytes exist at the head (86, 87, 88, 101, 114, 123, 124) and exist on the base at the same lines with the same byte counts, so they predate this PR. Lint & Repo Gates is success. This is the only governed path in the file list; no skills/** file and no Tier H path is touched.

② Semver level

.changeset/9591-retirement-sentence-write.md declares patch for @objectstack/spec, @objectstack/lint and @objectstack/driver-turso, the three published packages (17.7.0) whose shipped text moves, with Clause-②: no and no arm. The PR body's parenthetical after no is not an arm (the arm vocabulary is the closed pair widening/narrowing), and Check Changeset is success. Checked against the diff: every input that parsed or was refused on the base gets the same verdict at the same path at the head; the chatter fix changes the text of a refusal, not whether it refuses. patch is correct, and Clause-②: no holds.

One completeness gap, non-blocking: the changeset's @objectstack/lint bullet names the script-node diagnostic and the chartConfig.xAxis.field hint but not the data-model-rules.ts unique-unscoped-declared-index fix text that patch round 1 moved. The first bullet covers the whole class, so the entry is incomplete rather than wrong. It can be amended in a docs-only PR; it is not a reason to re-spin this head.

③ Boundary flags

Every deviation and finding in 6051224331, 6052088494, 6052319001, 6053397952 and 6053687194, answered or escalated:

• Outside-surface files (SKILL.md, turso.zod.ts, validate-widget-bindings.ts, meta.ts read-only), the bounded chatter fix, and the manifest pair: ratified by claim revisions 6051261867 and 6052335087. Every one of the 104 files sits inside the revised surface. Answered.
• The pin gained assertions, not a new gate: verified; no CI change rides the PR. Answered.
• Co-Authored-By trailer amended before any push: no published history was rewritten. Answered.
• git fetch --unshallow origin main in the shared .git: this advanced the shared origin/main, as reported, and the merge it led to was intended and is verified above. Noted; no breach found.
• Clause-② line copied verbatim with its parenthetical: it parses as no, arm null. Answered.
• Lock queue-timeouts re-acquired under the same slot, and the backgrounded shard waited on by its own PID: operational, and consistent with the one-PID rule. Answered.
• data-model-rules.ts plain-quoted instead of widening the corpus: the right remedy, since the corpus already reached the file and the escaped backticks were what hid the sentence; verified at the head. Answered.
• os-regen-merge.sh stopped at step 3 on each of the three hops, regeneration ran without MERGE_HEAD, the script's record was left at handoff: the outcome is what the rule protects, and it is verified. Each regeneration is its own commit (98e2f6e373, c40b3babd7, 75302366e5), each merge commit touched only files main changed, and the net diff is hunk-identical across every hop. Answered.
• The merge commits carry git's default message with no trailer pair. Reported for feca6b5ace; 3b6335b9be and 5949dbf0ba are the same shape and were not re-reported. The pre-push hook refuses a model identifier in the pair, not its absence; the regeneration and fix commits carry the model-free pair; landed history is not rewritten. Non-blocking; noted for the seat.
• Probe merge aborted with nothing pushed; worktree removed: fine. Answered.
• Changeset bullet reworded to "before their second clause": accurate for the manifest member, whose second clause is not about the rest of a value. Answered.
• Out-of-scope findings. The skills/objectstack-data strip claim (SKILL.md:377, rules/indexing.md:31) still stands at the head and is filed as skills(objectstack-data): two published lines say os migrate meta --from 16 strips retired keys "automatically", but the default run writes no source and --write strips only the sites it can prove #22144 (open, domain:skills, dispatched); this PR touches no skills/** file, which is right for a Tier H path. The QA checklist item cli.migrate-meta-codemod, the hand-written domain:devx pages, and the cross-package-test-inputs.mjs "as measured" line numbers are carrier-none notes and are correctly absent from this diff. validate-widget-bindings.ts remains the one template-literal site the pin cannot judge; the pin's docblock now records template literals as invisible to the scan, and the site moved anyway. Answered.
• New, non-blocking, found here: the pin's header still describes the two-clause variant as having two members (the dashboard model and "the other member"), while this head has three. The pin judges by shape, so no behaviour is affected and no gate reads the docblock; a one-line docblock update can ride the pin's next edit. The retired-key.ts docblock names only the model and stays true.
• New, non-blocking, found here: the PR body says the playbook has no line over 120 bytes; seven pre-existing lines exceed it. The ratchet's enforced rule is the per-file line-count ceiling, met at 337, and every line this PR wrote is within budget. Body prose only.
• Docs Drift Check (6051366170) is advisory; it notes that retired-key.ts yielded no anchor, a coverage note on the audit, not a defect.

Nothing above blocks. Both surfaces hold at this head, and the hop added nothing to the PR's net diff.

Implemented-by: claude/issue-9591-retirement-sentence-write
Reviewed-by: session_01LAi5BVvQNiYzepSAcsoFLK

VERDICT: PASS

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 37748210189 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (6/6) — 失败步骤: Run this shard's tests

  @objectstack/plugin-security:test:  FAIL  src/builtin-positions.boot.test.ts > [ADR-0131 D2] the built-in positions as declared metadata — single, a stored definition under a built-in name
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  @objectstack/plugin-security:test:  FAIL  src/builtin-positions.boot.test.ts > [ADR-0131 D2] the built-in positions as declared metadata — single + organization, a stored definition under a built-in n
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  @objectstack/plugin-security:test:  FAIL  src/builtin-positions.boot.test.ts > [ADR-0131 D2] the built-in positions as declared metadata — walled, a stored definition under a built-in name
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  @objectstack/plugin-security:test:  FAIL  src/bootstrap-declared-positions.test.ts > bootstrapDeclaredPositions — one catalog read, both sources (ADR-0131 C2 S2b) > a stored definition shadowing a bui
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/builtin-positions.boot.test.ts — 24h 内已弹出 2 个互相独立的 PR（fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest #22142、feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197）。汇总 issue：Queue-flake anchor: src/builtin-positions.boot.test.ts #22244（新建）
• src/bootstrap-declared-positions.test.ts — 24h 内已弹出 2 个互相独立的 PR（fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest #22142、feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197）。汇总 issue：Queue-flake anchor: src/bootstrap-declared-positions.test.ts #22245（新建）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 5 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

The red merge-group build above is not this PR's. domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T08:41Z

• What failed: Test Core (6/6), in plugin-security's builtin-positions.boot.test.ts and bootstrap-declared-positions.test.ts (a stored definition under a built-in name).
• Why it is not this PR's:
  • This PR touches neither plugin-security nor objectql; it changes one diagnostic sentence class.
  • The same signature failed PR feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 independently. feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 sat ahead of this PR in the same merge group, and it changes objectql's registry.ts / security-catalog-namespace.ts so that a second holder of a position, permission-set or capability name is refused. That is the shape these tests exercise. The bot's roll-ups are Queue-flake anchor: src/builtin-positions.boot.test.ts #22244 and Queue-flake anchor: src/bootstrap-declared-positions.test.ts #22245.
• Now: feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 has left the queue. This PR is still queued, and GitHub rebuilt its group on a new base without feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197. No re-queue is needed; this PR changes nothing.