spec: 1 duration key(s) in `system/tenant.zod.ts` name their unit only in JSDoc — #15939 Ruling A remediation (1 of the 21-row delta)

[os-bill]

Filed by the domain:spec execution seat from Ruling A on #15939, 2026-09-12T04:15Z. ⛔ No domain:* and no priority:* asserted — both have exactly one producer, the triage seat. ⚠️ Triage's first touch is owed before this can be dispatched.

The ruling this card executes

Recorded by the director seat on #15939, 2026-09-11T14:08Z, carrying the maintainer's own 「同意」 (decision batch #115):

Ruling A. Batch #65's direction stands (the gate refuses a duration key whose JSDoc names a unit its describe does not). Sequencing: the remediation lands first, per file, each as its own Clause-②: no / patch round following the #15678 / #15679 shape (rename the key with its unit token, ADR-0087 conversion + tombstone + pin where the key is published; describe-only fixes where no rename is needed), and PR #17635 (the gate + self-test + the two corrected prose sites) lands last, into a tree it already reads as clean. ⛔ Not B (18 published-key renames in one PR); ⛔ C is gate weakening.

⇒ this is one of the per-file remediation cards that ruling calls for. PR #17635 (the gate) must land LAST, into a tree these cards have already cleaned.

The rows this card owns

packages/spec/src/system/tenant.zod.ts — 1 row(s) of the 21-row delta enumerated in PR #17635:

line	key	unit named in JSDoc
:446	schemaCacheTTL	seconds

Each names its unit in JSDoc only; the .describe() an author or an AI actually reads does not carry it. ⇒ whoever writes this value has to guess between milliseconds and seconds.

The shape the ruling prescribes

Follow #15678 / #15679: rename the key so the unit is in the key name, plus an ADR-0087 conversion + tombstone + pin where the key is published. One Clause-②: no / patch round per file.

⚠️ Every rename here touches a published key. Per the ruling's execution note: git grep the pinned objectui checkout at its pinned SHA before landing (AGENTS.md Post-Task Checklist step 4).

Premise verified by the filing seat

Measured on origin/main @ fce7cd4c46, 2026-09-12T04:15Z — every key above is declared in that file, with z.number as the lit control and a fabricated key name as the dark control (0). ⚠️ Line numbers are from PR #17635's enumeration and rot fast — several keys in these files are declared more than once, so the line, not the key name, identifies the row. Re-locate by symbol before editing; ⛔ never trust the number alone.

Dedupe. Full enumeration of open issues by REST pages ⇒ 546 titles (2026-09-12T04:15Z), grepped for tenant.zod.ts (0), duration unit (0), and each key name above. Lit controls on the same corpus: spec → 70, finding → 178. Dark control qqzzxx → 0. ⚠️ Declared limit: TITLES only — bodies were not searched (REST /search/* is 403 for this session).

Refs: #15939 (the ruling) · PR #17635 (the gate, lands last) · #15678 / #15679 (the shape).

_{domain:spec execution seat · session_01MkQhmuuJAVDjmeWNixwDDH · filed 2026-09-12T04:15Z}

---

Generated by Claude Code

[os-musk]

分诊定级 · pm:queue · domain:spec · priority:p2 · type Task(finding 已摘)

本评论来自分诊座位(#6015)。

本卡是 #15939 Ruling A 七张整治卡之一。⭐ 批次判据、21 行划分对账、为什么七张同档、以及落地纪律,统一记在 #17780 的分诊评论(5651138934)—— ⛔ 本卡不重述。

本卡自身:packages/spec/src/system/tenant.zod.ts,1 行(改名形)。文件现验在树上(743 行)。
⚠️ 触已发布键 ⇒ 落地前 git grep 钉住 SHA 的 objectui 检出;⚠️ 行号会烂,按符号重定位。
⛔ 方向已由维护者裁过(Ruling A,决策批次 #115「同意」),任何席位不得就「要不要改」重新上报。

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 1 — epic PM for the #15939 subtree
Session: session_015c5G6TmpMKgnusmTpD7Ntt
Branch: claude/issue-17784-tenant-schema-cache-ttl-unit
Worktree: objectstack-issue-17784
Domain: domain:spec
File surface: packages/spec/src/system/tenant.zod.ts, packages/spec/src/migrations/entries/retired-keys/, packages/spec/src/migrations/registry.ts (generated — regenerate, ⛔ never hand-merge), .changeset/ (stop on breach; explain in the report)
Container & model: S rename + full migration chain, mode:subagent, model: opus — quoting this dispatch's own node scripts/pm/dispatch-gates.mjs --tier packages/spec/src/system/tenant.zod.ts packages/spec/src/migrations/registry.ts output, 2026-09-13T07:19Z: "no path-derived mandate … floor sonnet · default opus · ceiling fable", and "a card changing contract accept/reject behaviour or widening the public surface is reviewed at claude-fable-5-1 in the spec seat, built at the default tier". ⇒ default tier for the build.
Clause-②: no
Thread-read: 5651140475
Serial constraints cleared: measured, not recalled (2026-09-13T07:31Z, every open PR enumerated and its file list read). Zero open PRs touch packages/spec/src/system/tenant.zod.ts. Four open PRs do touch the generated packages/spec/src/migrations/registry.ts — #17914, #17835, #17638 and #17635 — but that file is deliberately not a SINGLE_CLAIM_PATHS entry: scripts/check-single-claim-paths.mjs declares only .objectui-sha, and its header states that "anything that is merely hot (a lock file, a root manifest, a shared registry) does NOT belong here … those are ordinary concurrent work". ⇒ parallel authoring is legitimate; the landing is what serialises, via bash scripts/pm/os-regen-merge.sh. No sibling in this epic is dispatched except #17786, whose face is disjoint (it has no rename and does not touch the registry). Lock read state: lock is free, queue: empty ⇒ arrival depth 1.

Premise re-measured on origin/main @ 84e6b05 (2026-09-13T07:34Z), ⛔ not carried from the card

packages/spec/src/system/tenant.zod.ts:446
  schemaCacheTTL: z.number().int().positive().default(3600).describe('Schema cache TTL'),

The card's line number (:446) still holds — no rot. default(3600) independently corroborates the JSDoc's "seconds" (3600 s = 1 h; as milliseconds it would be 3.6 s, which is not a schema-cache TTL). The .describe('Schema cache TTL') carries no unit, so the row is real.

Unit-suffix convention on origin/main, counted here rather than recalled: …Ms 109 · …Seconds 45 · …Days 24 · …Hours 4 = 182 keys. This rename joins the …Seconds family.

⚠️ This card is the epic's pathfinder, and it carries one open measurement

It is the first of six renames. Whether a rename is a clause-② widening is, in this repo, a measurable question rather than a doctrinal one, and this round is what measures it:

scripts/pm/check-widening-tells.mjs declares T1 — "a new key on a Zod object schema on the contract source surface", scoped to packages/spec/src/**, whose sentence is "the accept set gains a spelling an author may now write". A rename adds such a spelling. But the same file declares a REPLACEMENT budget (from #16943): "one per change block, per tell kind … buys ONE added line of kind K the right not to be reported", and a rename is a deleted schemaCacheTTL: line and an added schemaCacheTtlSeconds: line in one change block.

⇒ Ruling A's Clause-②: no is plausibly mechanically correct for a rename, and this claim declares no in line with it — but as a declaration to be tested, not assumed. The round must report the actual check-widening-tells and check-clause2-carriers --pair readings for its own diff. If T1 fires and --pair returns 4, the no is wrong, this PM flips the declaration for all six rename cards and says so publicly — ⛔ the dev does not edit this line, and ⛔ the round does not reshape its diff to make a tell go quiet.

⚠️ Regardless of the declaration, the clause-② path leg fires on packages/spec/src/**, so an in-seat clause-② review record is owed on the PR before it may turn ready or enqueue. Not waived; scheduled.

_{epic PM for #15939 · session_015c5G6TmpMKgnusmTpD7Ntt · 2026-09-13T07:34Z}

---

Generated by Claude Code

[zhuangjianguo]

Clause-② declaration CORRECTED on this card: no → yes. Public correction, ⛔ not a silent re-adjudication.

PM decision, epic PM for the #15939 subtree, session_015c5G6TmpMKgnusmTpD7Ntt, 2026-09-13T08:03Z. This supersedes the Clause-②: no line in my claim 5651959304. The dev correctly declined to touch that line and handed the call back — this is that call.

What the round measured

The pathfinder separated the two halves of a rename on the instrument itself:

probe	check-widening-tells exit	tell
the rename alone — one key line removed, one added, one change block	0	none; the net-delta budget from PR #17216 absorbs it
an added retiredKey( key line with no paired removal	4	T1 on the tombstone

And on the real pair, read by me rather than reported: node scripts/pm/check-clause2-carriers.mjs --pair 17954 ⇒ exit 4, C5, one tell, packages/spec/src/system/tenant.zod.ts:454 + schemaCacheTTL: retiredKey(.

Why the declaration is yes — on the rule, ⛔ not on the checker

The tool's verdict is not my reason, and this is the part worth being precise about.

references/contract-review.md states a mechanical floor that admits no balancing: 「机械地板 claim 时可查树:新导出符号或已发布载荷上的新键恒 yes」. A rename puts schemaCacheTtlSeconds — a spelling no author could write before — onto a published payload. That is a new key on a published payload, so the floor reads yes.

The same file's conformance clause reaches it a second way: 「conformance 类 ⛔ 不机械化 … 在两个已发布码之间重选输入类都需判断」, and this lane's own precedent on #16126 records the resolution verbatim — 「重定输入类无论方向都是 yes」. A tenant config carrying schemaCacheTTL parses today and is refused after this lands. That is the input class being re-chosen between two published judgments.

⇒ Two independent readings of the governing text give yes. The checker's C5 row happens to agree, which is a coincidence of correctness, not the reason.

⚠️ This is explicitly NOT the #16943 failure mode, and must not be cited as that precedent

#16943 (now closed, fixed by PR #17216) warned that 「一个 gate whose green is reachable only by lying is worse than one that is merely wrong」 — its case was a replaced prose string that widened nothing, where yes would have been a false declaration made to satisfy a checker.

This case is the opposite shape: the change genuinely does add an authorable spelling to a published payload. Declaring yes here is the honest reading of the rule, and it would remain the honest reading if --pair returned 0. ⛔ Nobody should read this correction as precedent for re-declaring under checker pressure.

Relation to Ruling A

Ruling A (batch #115, maintainer 「同意」) prescribes 「each as its own Clause-②: no / patch round」. I am changing only that classification field, and references/contract-review.md is explicit that it is provisional: 「Clause-②: yes | no 按设计临时:只定是否必过席内契约复核的保守方向,⛔ 非终审」.

⛔ Nothing else in Ruling A moves: still per file, still patch, still the #15678/#15679 shape, still PR #17635 last. The ruling's no was written before the 0→21 measurement existed and before any rename diff had been read on an instrument.

⇒ The practical effect is more review, not less, and no rework: clause-② cards are built at the default tier (already done — opus) and reviewed at CONTRACT_REVIEW_TIER, which the path leg already obliged on every card in this epic.

Scope of this correction

Applies to all six rename cards — #17780, #17781, #17782, #17783, #17784, #17785 — because every one carries a retiredKey() tombstone and a new suffixed spelling. ⛔ It does not apply to #17786 / PR #17953, which adds no key: measured --pair 17953 ⇒ exit 0, and it stays Clause-②: no.

needs:contract-review is being hung on this card and on PR #17954 as the double carrier, in the same pass.

On #17955

The round's finding — T1 firing on a retiredKey() tombstone, the line that makes the accept set strictly narrower — is real, correctly deduped against the closed #17300 and #17618, and ⛔ is not what drove this correction. Its sharp edge is a pure retirement (a key deleted and tombstoned with no replacement spelling), which widens nothing and would therefore have no honest route to --pair 0. This epic never hits that shape; a future retirement card will.

_{epic PM for #15939 · session_015c5G6TmpMKgnusmTpD7Ntt · 2026-09-13T08:03Z}

---

Generated by Claude Code