docs(spec): correct the withdrawn os migrate meta claim in the published 17.0.0 app-area retirement entry

The `ad047d2` app-area fail-open gates entry closed with "Run `os migrate meta
--from 16` to rewrite existing sources automatically" — a claim the command has
never satisfied. It replays the conversion chain in memory and prints the
mechanical change list; there is no --write / --fix flag.

Replace it with the post-#9529 house sentence and add a `> **Correction:**`
blockquote recording that the released artifact shipped the original wording —
matching the `> **Correction (#5809):**` form this file already uses.

Authorized by the maintainer ruling of 2026-08-22 for this one line only. The
#9529 retraction quote and packages/cli/src/utils/config.ts:133 are deliberately
untouched, and the remaining flat sites are recorded rather than swept.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rxnd8cyFnoU8V5y21PaTsy

Author: claude

packages/spec/CHANGELOG.md

@@ -5001,9 +5001,19 @@ configured` without it. Check `discovery.services` before calling, exactly as
   The retired alias spellings `visibleWhen` / `visibleOn` / `permissions` carry the
   same prescriptions rather than renaming onto keys that are themselves gone.
 
-  Run `os migrate meta --from 16` to rewrite existing sources automatically
-  (ADR-0087 D2 conversion `app-area-fail-open-gates-removed`, wired into the
-  protocol-17 D3 chain step).
+  Run `os migrate meta --from 16` to list the mechanical edits for existing
+  sources; apply them by hand (ADR-0087 D2 conversion
+  `app-area-fail-open-gates-removed`, wired into the protocol-17 D3 chain step).
+
+  > **Correction (#9734):** as published, this entry closed with "Run
+  > `os migrate meta --from 16` to rewrite existing sources automatically". The
+  > command has never rewritten an authored source file: it replays the
+  > conversion chain over the loaded stack **in memory** and prints the
+  > attributed mechanical change list, and there is no `--write` / `--fix` flag.
+  > The sentence was withdrawn class-wide in #9529, and the prescription above is
+  > the one `areas[].visible` / `areas[].requiredPermissions` carry today.
+  > Corrected post-publication — the released 17.0.0 artifact shipped the
+  > original wording.
 
   **Why they read alive — and why that made them worse than dead.** The _same key
   names_ are genuinely enforced one level up and one level down: