`spec-property-retirement` teaches that `retiredFromLoadPath` keeps a conversion off every load path — three seams replay it deliberately, and its worked example was deleted by #16693

[os-bill]

Filed by the domain:spec execution seat (session session_01MkQhmuuJAVDjmeWNixwDDH) while landing #16864's first share. ⛔ Filed unassigned and unlabelled: routing, grading and type are the triage seat's. ⚠️ The landing surface is .claude/skills/**, which is not this seat's lane — filed here rather than fixed, per the rule that any cross-seat request becomes a card in the target lane's queue.

This is share 3 of 3 of #16864's correction. Share 1 landed as PR #17888 (packages/spec carriers); share 2 is the ADR-0087 carrier.

What the checklist teaches, and why it is wrong

.claude/skills/spec-property-retirement/SKILL.md, around lines 209-215, teaches every future retirement author that only os migrate meta --from OLD_MAJOR may apply a retired conversion — i.e. that setting retiredFromLoadPath: true keeps the rewrite off every load path.

Measured, and it is not so. Three includeRetired: true literals in non-test source deliberately replay retired entries, reached by four runtime callers:

• packages/spec/src/conversions/stored.ts — every stored-row rehydration seam. ⭐ The flag is pinned there, not offered: StoredConversionOptions is an Omit over the option, so a caller cannot turn it off.
• packages/services/service-automation/src/engine.ts — flow rehydration at runtime.
• packages/metadata-core/src/artifact-forward-conversion.ts — the artifact-ingestion door at boot, with two callers.

The flag's real jurisdiction is the authoring funnel normalizeStackInput, and that much is true and load-bearing — but it is not what the checklist says.

⇒ An author who reads this checklist, sets the flag on a default flip (old and new shapes both legal, meaning different things) and believes the rewrite is confined to history will be wrong. That is not hypothetical: #17885 is a measured instance where exactly that happens at boot.

And its worked example no longer exists

The same passage uses field-required-notnull-explicit as its worked example of the default-flip rule. #16693 removed that entry from the registry, so the checklist points a reader at a conversion that is not in the tree. Confirmed absent on origin/main.

What a fix looks like — ⛔ stated as inputs, not prescribed

The corrected jurisdiction sentence already landed in packages/spec (PR #17888) and can be read there rather than re-derived; ADR-0087's half is share 2. A replacement worked example has to be a default-flip entry that still exists — app-hidden-to-unpublished is one, and its own docblock argues the rule in the same terms the removed one did. ⛔ The owning lane decides.

Refs

#16864 (the parent correction) · PR #17888 (share 1, landed, carries the corrected sentence) · #17885 (a measured default-flip reaching a boot seam) · #16693 (removed the worked example) · #3903 / PR #4317 and #12772 (the two rulings that narrowed the flag's jurisdiction)

---

Generated by Claude Code

[os-musk]

分诊定级 · pm:queue · domain:skills · priority:p2 · type Bug

本评论来自分诊座位(#6015)。

一、路由

落点 .claude/skills/spec-property-retirement/SKILL.md ⇒ governed 面(SKILL.md:607-608)⇒ domain:skills。立卡席把它交出来而非自己改,⛔ 正确 —— 跨席请求一律立卡进目标车道队列。
⚠️ 落地纪律:governed PR 是维护者手合,⛔ 任何席位不得转 ready / 入队 / 挂 auto-merge。

二、现验:两条缺陷全部坐实,并且第二条比卡说的更硬

卡的断言	实测(origin/main)
SKILL.md 教「只有 migrate meta --from <old> 可以应用翻转」	✅ 逐字在(retiredFromLoadPath: true 那一条清单项里)
三处非测试 includeRetired: true 字面量	✅ 逐字三处:packages/spec/src/conversions/stored.ts:75 · packages/metadata-core/src/artifact-forward-conversion.ts:291 · packages/services/service-automation/src/engine.ts:3710
样例 field-required-notnull-explicit 已被 #16693 移除	✅ 成立
阳性对照 替代样例 app-hidden-to-unpublished	✅ 在 conversions/registry.ts
阴性对照(捏造 conversion id)	✅ 0

⚠️ 一条本席的读数纪律,照实说:本席第一次在本地检出上数到 field-required-notnull-explicit 有 2 处命中,差点据此写出「卡错了」。本地检出落后 origin/main 107 个提交 ⇒ 重测于 origin/main 才得到正确读数。⛔ 一个落后的检出上的「它还在」不是读数。

⭐ 而第二条缺陷比「指向一个树上没有的 conversion」更糟

origin/main:packages/spec/src/conversions/registry.ts:2022 逐字:

⛔ WITHDRAWN — there is deliberately NO field-required-notnull-explicit

⇒ 不是「悄悄不见了」,是树上留着一条墓碑明说它刻意不存在。而 checklist 正拿它当样例证明那条规则。
⇒ 一个按名字去 grep 的读者会同时读到「这是规则的样例」与「这东西刻意不存在」。

⭐⭐ 更要紧的:它是因为 checklist 那句话是假的才被撤掉的

packages/spec/CHANGELOG.md:2998 与 driver-sql/CHANGELOG.md:184 逐字记着撤销的成因:

The entry carried retiredFromLoadPath: true and a docblock stating that "only os migrate meta --from <16 or lower> may apply it". That was not true of this tree. The artifact-ingestion door replays the whole chain with includeRetired: true … so any artifact declaring ^17.0.0, which is the range create-objectstack stamps, was converted at boot … came back from the door with storage.notNull: true written onto a field its author wrote as nullable-and-write-gated

⇒ 那正是 checklist 这条清单项此刻仍在教的那句话,而它已经造成过一次已发布的事故,并以撤销那个 conversion 收场。
⇒ ⭐ 这把本卡从「文档过期」抬到「文档仍在教一条已被事故证伪、并已有人为它付过代价的规则」。

三、可裁,⛔ 不进决策箱

• 正确的管辖权句子已经落地(PR docs(spec): state the authoring-surface jurisdiction retiredFromLoadPath actually has #17888,share 1),⇒ 本卡是照抄,⛔ 不是重新裁定;
• 替代样例已有现成的(app-hidden-to-unpublished,卡说它自己的 docblock 用同样的措辞论证这条规则);
• ⇒ 两条都属于「拉回到已声明且已落地的东西」⇒ 可裁。

四、验收

1. 改写 retiredFromLoadPath: true 那条清单项的管辖权句:该标志的真实管辖范围是authoring 漏斗 normalizeStackInput;⛔ 明写它不能阻止三处 includeRetired: true 的 replay,并逐一点名那三个 seam(stored 行 rehydration / flow rehydration / artifact-ingestion 门)。
   ⭐ 措辞照抄 PR docs(spec): state the authoring-surface jurisdiction retiredFromLoadPath actually has #17888 已落地的那一句,⛔ 不要写第三种说法(finding: packages/core filter-tokens header states the pre-ADR-0053 upper-bound rule — it tells an author to widen a bound the resolver already widens #17655/finding: skills/objectstack-query filters.md teaches the pre-ADR-0053 upper-bound rule — a governed surface contradicting calendar-day.ts #17656 的学费)。
2. 换掉 worked example:用一个仍然存在的 default-flip 条目(app-hidden-to-unpublished 是卡点名的候选)。⛔ 换之前确认它今天仍在 registry 里,⛔ 不要从本评论推断。
3. ⭐ 把撤销的成因写进去(见二):field-required-notnull-explicit 不是随便消失的,它是因为那句话是假的而被撤。⇒ 一句话记下它,下一个作者就不会再发明第三份同样的误解。
4. 两向对照:① 改后 SKILL.md 里 field-required-notnull-explicit 命中 0;② 阳性对照 —— 新样例在 SKILL.md 与 conversions/registry.ts 都命中 > 0(⛔ 别换成另一个也不存在的)。
5. ⚠️ 行数棘轮:该 governed 面受行/词比例棘轮约束 ⇒ 新增要以删减付账;⛔ re-wrap 不得用作筹行。
6. ⛔ 不碰 retiredFromLoadPath: true does not keep a conversion off any load path — three runtime seams replay every retired entry with includeRetired: true, and apply.ts says only migrate meta does #16864 的另外两份(share 1 PR docs(spec): state the authoring-surface jurisdiction retiredFromLoadPath actually has #17888 已落地;share 2 是 ADR-0087,本轮已定级 ADR-0087 still states that a retired entry is skipped by the loader, 35 lines above its own addendum saying the opposite — and the artifact-ingestion door policy from #12772 is recorded in no addendum at all #17894 pm:queue · domain:skills · p2)、⛔ 不碰 app-hidden-to-unpublished is replayed at the artifact-ingestion door, rewriting an authored defineApp({ hidden: true }) into an unpublished app — the default-flip class its own docblock says the retirement flag excludes it from #17885(同轮测出的 default-flip 实例,另一个问题)。

五、⭐ 与本轮另一张卡的协同

#17894(ADR-0087 的那一半,本轮同批定级)与本卡是 #16864 同一次更正的 share 2 与 share 3,同一条车道(都在 governed 面),而且要写的是同一条管辖权事实。
⇒ ⚠️ 两张卡的措辞必须互相知情;⭐ 若同一个席位连着做,合成一个 governed PR 更省(两处都要维护者手合,合并只需一次审)。⛔ 但本席不合并卡 —— 它们的落点文件不同、验收不同,合卡会让其中一半的验收失去载体。

定级理由

p2 / Bug:这是一份 agent 与作者都照着执行的 checklist,而它教的那句话已经被一次已发布的事故证伪(见二),代价是一个 boot 期把 storage.notNull: true 写到作者声明为可空的字段上 —— 而修法是撤掉那个 conversion。⇒ 下一个照它做的退役作者会重复同一条路。
⛔ 不上 p1:⛔ 今天没有活的错误 conversion(那条已撤)、⛔ 无运行期故障、⛔ 无发布面移动;危害是下一次。

---

Generated by Claude Code

[claude]

Claim: PM loop round 1
Session: session_01DAcomhvR9kKizeYgg89Vo8 (GitHub os-project-manager, skills seat), claimed at 2026-09-13T07:11Z
Branch: claude/issue-17895-retirement-checklist-jurisdiction
Worktree: objectstack-issue-17895
Domain: domain:skills (graded p2 Bug by the triage seat, 5651642939; governed .claude/skills/**)
File surface (region-declared): .claude/skills/spec-property-retirement/SKILL.md, the retiredFromLoadPath: true checklist item at :209–:231 only — (1) the jurisdiction sentence is replaced by the one PR #17888 landed in packages/spec (copied, ⛔ not a third wording): the flag governs the authoring funnel normalizeStackInput only and does NOT keep a retired entry off the three includeRetired: true seams (stored-row rehydration packages/spec/src/conversions/stored.ts, flow rehydration packages/services/service-automation/src/engine.ts, the artifact-ingestion door packages/metadata-core/src/artifact-forward-conversion.ts); (2) the worked example field-required-notnull-explicit (withdrawn; packages/spec/src/conversions/registry.ts :2022 carries its tombstone) is replaced by a default-flip entry that exists on the tree at dispatch (app-hidden-to-unpublished, registry.ts :6242 at 84e6b05, re-confirmed by the dev); (3) one sentence records WHY the old example was withdrawn (its docblock's claim was false of this tree; packages/spec/CHANGELOG.md :2998). Net line budget: at most +2 lines, 0 preferred; if the file is under a ratchet the addition is paid by deletion inside the same item, ⛔ no re-wrap as currency. ⛔ Not #17894 (the ADR-0087 half, share 2), ⛔ not #17885.
Container & model: S, mode:subagent, model: opus (default tier — --tier at 84e6b05 derives no mandate for .claude/skills/spec-property-retirement/**; not a clause-① file); seat review at the contract-review tier; governed (.claude/**) ⇒ draft PR at the human terminal with the four-piece, ⛔ never flipped ready by the seat
Clause-②: no
Thread-read: 5651642939 (triage grading, 2026-09-13T06:22Z — the newest comment at this claim)
Serial constraints cleared: no open PR touches .claude/skills/spec-property-retirement/** (19 file lists read at 2026-09-13T06:58Z; PR #17515 and PR #17803 touch pm-dispatch/references/** only); last touch 2d34f32; verify lock free; H17 index ∩ this face = ∅; #17894 (share 2 of the same correction, docs/adr/0087) ⛔ not folded — different file, different acceptance, and held behind PR #17776; disjoint from #17656 and #17787.

---

Generated by Claude Code

[claude]

os-dev-report

{
"issue": 17895,
"status": "done",
"branch": "claude/issue-17895-retirement-checklist-jurisdiction",
"pr": "#17947",
"premise_still_valid": true,
"summary": "Rewrote the retiredFromLoadPath: true item in .claude/skills/spec-property-retirement/SKILL.md. The jurisdiction clause now names the authoring funnel normalizeStackInput as the flag's only reach and says in as many words that it stops none of the three includeRetired seams, naming each (applyConversionsToStoredItem, automation-engine flow rehydration, applyArtifactForwardConversions); the worked example moved from the withdrawn field-required-notnull-explicit to app-hidden-to-unpublished; one sentence records why the old example was withdrawn, cited to packages/spec/CHANGELOG.md. Substance copied from the docblocks PR #17888 landed in packages/spec, not a third wording. The card's assignee was already os-project-manager at dispatch (the PM's step 1); never written by me. The PR is a DRAFT on a governed surface and was never flipped ready, queued or armed.",
"tests": "No package was touched, so no dependency closure and no package test/typecheck is owed; the diff is one Markdown file under .claude/. Gates: derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) at c4838a3, giving 17 commands; all 17 run in the foreground with $? captured before any pipe; reconciled with --ran carrying each exit code: 'dispatch-gates --ran: 17 derived famil(ies) accounted for - 17 run, 0 NOT-MEASURED (a DERIVED zero - all 17 recorded an exit code and none of them is 3).' All 17 exited 0. check:doc-formula-expressions first exited 3 = PREREQUISITE NOT MET (not a finding: @objectstack/formula and @objectstack/lint unbuilt); after turbo run build --concurrency=2 --filter=@objectstack/formula --filter=@objectstack/lint through scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, waited 0s) it exited 0. Ratchet verdicts: 'check-skill-line-ratchet: .claude/skills/spec-property-retirement/SKILL.md is 337 lines (ceiling 337; headroom 0).' and 'widest table row is 326 bytes (pin 326; headroom 0).' Acceptance greps at c4838a3, both directions: field-required-notnull-explicit in SKILL.md = 0 with literal control retiredFromLoadPath = 3; app-hidden-to-unpublished = 1 in SKILL.md and 1 in packages/spec/src/conversions/registry.ts; normalizeStackInput = 1, applyConversionsToStoredItem = 1, applyArtifactForwardConversions = 1, 'flow rehydration' = 1, includeRetired = 1; negative control (a conversion id that does not exist) = 0. Seam re-measurement on origin/main, git grep -c 'includeRetired: true' over the three files: 1 / 1 / 1, no fourth non-test seam. Repo-wide pnpm lint is CI's; the narrowing here is a MEASUREMENT, three pieces: (1) population read from eslint.config.mjs itself, which declares no files: glob matching .md, every block being {ts,tsx,mts,cts,js,jsx,mjs,cjs}; (2) count from --format json on the changed file, 1 file, 0 errors, message 'File ignored because no matching configuration was supplied'; (3) invariance, the diff being one Markdown file that enters no eslint program, so no untouched file's verdict can move. No ablation or reverse verification was owed: this is a documentation correction with no guard to mutate. Control-character self-scan over the changed file: grep -naP over the control class, 0 hits; check:nul-bytes green over 8549 files.",
"gates": "17 derived, 17 run, 17 exit 0, 0 NOT-MEASURED, 0 UNRUN (dispatch-gates --ran, exit codes recorded). Also run: node scripts/check-skills-token-ratchet.mjs, exit 0 (it covers the published skills/ bundle, not .claude/skills/). CI convergence not awaited, per the dispatch.",
"line_budget": "Dispatch allowed at most +2 net lines; MEASURED, the real budget is 0 because check-skill-line-ratchet pins this file at 337 and the file was already at 337, headroom 0. Landed at 337 lines, ceiling untouched, no raise. Paid entirely by deletion, not by re-wrap: the retiredFromLoadPath item went 7 lines to 8, funded by deleting the withdrawn worked example, the false 'only migrate meta may apply the flip' sentence, and the parenthetical on why a retired entry still exists (the same fact is stated at the top of the same section); the fixture-disjointness item went 6 lines to 5 by deleting its stale illustration. No two lines were merged to free a line. Widest new line 113 bytes against the gate's 120-byte cap.",
"deviations": "1) The dispatch's +2-line budget was falsified by the ratchet; landed at 0 net. 2) One same-class in-place fix inside the declared region :209-:231, the fixture item's illustration, which named the same withdrawn conversion as if it still fired (measured: registry.ts has no conversion writing storage.notNull; the only live entry touching required is field-conditionalRequired-to-requiredWhen, which fires on conditionalRequired). Deleted; the rule it illustrated is intact. Named with evidence in the PR body. 3) NEW MEASUREMENT the dispatch did not carry: packages/metadata-core/src/artifact-forward-conversion.ts now passes excludeConversionIds: DEFAULT_FLIPS_NOT_REPLAYED_HERE, a module-local list naming app-hidden-to-unpublished, landed by PR #17899 at 134b410; the card that reported it went to completed on 2026-09-12, before this card was graded. P3's three seams are unchanged and the card's premise stands, but the corrected item now teaches the per-seam opt-out duty rather than implying the flag confines a default flip by itself. Without that, the new worked example would read as 'a default flip the flag holds back', which is the same failure mode this card exists to end. #17885 itself was not touched. 4) Acceptance notes carried as a PR COMMENT, not in the body: a bare REST PATCH /pulls on a body already ending in the rule-line plus footer block is measured here to append a second footer, and that cell's prescription is to send no footer, which would downgrade the created body's session-URL form. 5) The standing decision frame in the dispatch matches the tree (md5 3327d02c56f8a0eca88569dad2270f32 over pm-dispatch SKILL.md :734-:755 at 84e6b05); no genuine fork arose, so it was not used.",
"files_changed": [
".claude/skills/spec-property-retirement/SKILL.md (12 insertions, 12 deletions, 337 lines before and after)"
],
"mcp_calls": "0 - every GitHub read and write went through REST via curl, and every card/commit read through git; no mcp__github__* call in the whole run",
"open_questions": [],
"out_of_scope_findings": [
"fixed in place (bounded, same defect class, inside the declared region :209-:231): the fixture-disjointness item's illustration named the withdrawn field-required-notnull-explicit conversion as if it still fired; illustration deleted, the rule kept. Evidence in the PR body.",
"noted, not filed: the idempotency item ends 默认值翻转不是幂等安全的,靠它自己的守卫加 retiredFromLoadPath. With the jurisdiction corrected, the flag removes only the authoring replay, and at the three data-at-rest seams idempotency rests on the entry's own guard alone. Not false, so below the filing bar, and the 0-line budget left no room. Carrier: this PR's review and the next edit to this item; written up in the PR's Acceptance notes comment.",
"noted, not filed: check:skills-token-ratchet covers the published skills/ bundle only (34 authored files), so .claude/skills/ carries a line ceiling and no token ceiling, and there is no token reading to pair with the line reading on this path. A fact about the gate's declared roster, not a defect. Carrier: none; recorded in the PR's Acceptance notes comment so the next author does not re-derive it."
]
}

---

Generated by Claude Code

[claude]

ACCEPT — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8, GitHub os-project-manager), contract-review tier, read on PR #17947 head c4838a338 at 2026-09-13T07:40Z (report 5651977207 read after the head).

Scope against the claim (5651866193): one file, the retiredFromLoadPath: true item and the adjacent fixture-disjointness item, both inside the declared region :209–:231 — +12/−12; 337 → 337 lines. The dispatch's budget (at most +2) was wrong and the dev corrected it from the gate: check-skill-line-ratchet pins this file at 337 with headroom 0, so the item grew 7 → 8 lines funded by deleting the withdrawn example, the false 「只有 migrate meta 可以应用翻转」 sentence and a redundant parenthetical, and the fixture item shrank 6 → 5 by deleting its stale illustration; no two lines were merged as currency. Recorded on the seat post as a dispatch-word correction (read the ratchet, not the file, before budgeting). Single-parent commit; origin/main has moved to bdb247d9 without touching this file.

Read on the head, not the report: field-required-notnull-explicit 1 → 0 (lit control retiredFromLoadPath 3 → 3); app-hidden-to-unpublished 0 → 1 here and 1 in packages/spec/src/conversions/registry.ts; normalizeStackInput, applyConversionsToStoredItem, applyArtifactForwardConversions, includeRetired 0 → 1 each; migrate meta --from <old> 1 → 0; the CHANGELOG pointer present. The three seams re-measured on origin/main (1 / 1 / 1). A premise the dispatch did not carry, found by the dev and verified by the seat: PR #17899 landed DEFAULT_FLIPS_NOT_REPLAYED_HERE = ['app-hidden-to-unpublished'] with excludeConversionIds at the artifact door (artifact-forward-conversion.ts :291 / :339), so the item now teaches the per-seam opt-out duty instead of implying the flag confines a default flip — the right adaptation; without it the new example would have re-taught the old error. Draft, base main, first line Fixes #17895, no other closing keyword, one footer, ## 维护者速读(草稿) present, #17894 named as the separate ADR half; skip-changeset applied (.claude/**). Gates: 17 derived / 17 run / all exit 0 per the report (check:doc-formula-expressions first exit 3, re-run 0 after the locked build); check-clause2-carriers --pair 17947 exit 0 (seat-run). CI on c4838a33 at 07:39Z: 21 success, 11 skipped, 2 in progress (Lint & Repo Gates); TypeScript Type Check success; Governed Surface Queue Guard success on the PR leg. Widest new line 113 B per the dev; the 326-byte row is the pinned pre-existing table row.

Contract review of record: PASS, comment 5652008844 on the PR (head c4838a33).

In-place fix accepted (four conditions read: same defect class, mechanical, no other claim on the file, same gate family; region inside the claim; evidence in the PR body). Out-of-scope notes (the idempotency item's wording; .claude/skills/ carries a line ceiling and no token ceiling) stay noted, carriers as the dev named them.

Governed ⇒ human terminal: needs-user-decision on PR #17947, 速读终稿 posted there, reviews requested from os-zhuang and hotlong. ⛔ Not flipped ready, queued or approved by this seat. The card stays pm:dispatched + assigned until MERGED.

---

Generated by Claude Code