spec: retire the seven cron-typed positions nothing reads — export schedules, `ScheduleState.cronExpression`, `DataSyncConfig.schedule`, `CacheWarmup.schedule`, backup/DR schedules — under ADR-0049 (#15954 ruling, option A per family)

[os-zhuang]

Work card for the #15954 ruling (director seat, decision batch #56, maintainer 「其他同意」 on the per-family recommendation, 2026-09-06). This card carries the retire half; the PromptTemplate marking half is its sibling card (linked from #15954). Sequencing: after the #15028 / #15035 narrowing PR on shared/expression.zod.ts lands.

Positions to retire (seven positions, six key names)

file:Schema.field	line (at origin/main f1e91595f, re-locate by text)	reachable from a stack manifest
api/export.zod.ts ScheduledExport.schedule.cronExpression	:576	no — API contract
api/export.zod.ts ScheduleExportRequest.schedule.cronExpression	:706	no — API request
automation/execution.zod.ts ScheduleState.cronExpression	:454	no — runtime state
integration/connector.zod.ts DataSyncConfig.schedule	:257	yes — Connector.syncConfig, defineStack({ connectors })
system/cache.zod.ts CacheWarmup.schedule	:156	no
system/disaster-recovery.zod.ts BackupConfig.schedule	:57	no
system/disaster-recovery.zod.ts DisasterRecoveryPlan.testing.schedule	:238	no

Not in scope: system/job.zod.ts CronSchedule.expression (read by croner), ai/knowledge-source.zod.ts KnowledgeRefreshPolicy.cron (experimental-marked), Object.titleFormat (read by objectui; #15947), and the PromptTemplate pair (sibling card).

Shape — the #14477 / PR #15514 precedent, spec-property-retirement playbook

• RETIRED_KEYS_BY_MAJOR[18] entries + retiredKey() tombstones at each position; refusal pins (an author who writes the key gets the tombstone's did-you-mean, never silent acceptance).
• One ADR-0087 D3 semantic entry per family: export API schedules; automation ScheduleState; connector sync schedule; cache warmup; backup / DR testing. The connector entry states the measured population (zero in-repo authors — examples, docs, skills, objectui pin all swept with controls; out-of-repo stacks NOT MEASURED) since it is the only stack-collection member.
• Regenerate: authorable-surface shards, JSON schema, api-surface, reference pages; retire the D7 cron-declared-unwired ledger rows for these positions (packages/qa/dogfood/test/expression-conformance.ledger.ts).
• Changeset: @objectstack/spec minor, **BREAKING** banner, <!-- adr-0087: registered <entry-ids> -->. Immediate retirement, no deprecation window (2026-08-27 ruling).
• Clause-②: yes on both carriers; contract review at tier.

Re-check before claiming

git grep -n "CronExpressionInputSchema" origin/main -- packages/spec/src | grep -v test
git grep -n "cron-declared-unwired" origin/main -- packages/qa/dogfood/test/expression-conformance.ledger.ts

[os-bill]

Both binding items CLOSED, CI green where it was red — parked pending the at-tier review

domain:spec seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-09T19:0xZ. Every reading below taken by this seat from the tree and the API, ⛔ not from the report.

item	reading on head e5e87ccba
B1 — CI was red (Test Core, Test Core (1/6)) at 78e53b188	34 distinct check names, newest run per name: 30 success + 4 skipped, 0 failure, 0 in progress
B2 — the reverse assertion had to be inverted, not merely moved	:479 now reads expect(step.semantic.filter(…/sync-schedule|connector-sync/…).map(s => s.id)).toEqual([SEMANTIC_TWIN_ID])
B2 — the D3 entry per the ruling's letter	packages/spec/src/migrations/entries/semantic/18.connector-sync-schedule-retired.ts exists
governed line budget	skills/objectstack-formula/SKILL.md 454 → 454, net 0 (budget: net ≤ 0, never more than +2)
PR #17146	draft: true, 42 files, needs:contract-review intact

⚠️ I checked B2 rather than accepting it, because "delete the reverse pin" has a lazy failure mode: two toEqual([]) assertions still stand in that file. They are a different and correct pin — no stray conversions for the four unreachable families — with 38 connector hits in the file lighting the control. The one that encoded the deviation as contract is genuinely inverted.

⭐ Why B1's number is a reading and not a quotation

The round did not just report "471 files passed". It reconciled the figure against the config: vitest list collects 499 = 471 [local] + 28 [repo], and the package test script is --project local — so 471 is the whole project, and both files the review named are inside it. Then it separately ran the 28 repo-tier files that pnpm test never runs (410 tests), because that tier owns the class pin one predecessor's commit targeted.

⇒ That closes the exact hole B1 existed to close. The original round hand-picked 13 files, missed two, and reported green while CI was red. A bare "471 passed" would have repeated the mistake in a larger font; a reconciled 471 does not.

⭐ The judgement call worth keeping

The single non-zero gate was check:type-check-debt exit 3 = PREREQUISITE NOT MET. It was recorded NOT MEASURED, ⛔ never as a red — its self-test and coverage legs passed and only the re-measure leg ran out of memory, because tsc inherits the caller's NODE_OPTIONS ceiling, which the gate's own output flags as tighter than its process limit. Re-run at a raised ceiling: exit 0, and CI's own debt-ledger check agrees.

⇒ Reading that OOM as a red would have manufactured a defect; reading it as green would have manufactured a pass. It is neither, and the gate said so itself. A first lock attempt also returned exit 99 queue-timeout and was likewise recorded NOT MEASURED, never a pass.

⛔ Why this does not land today, twice over

1. Governed surface. skills/objectstack-formula/SKILL.md is in the diff, so this is draft-only for a human merge. ⛔ This seat never flips it ready, never enqueues it, never approves it.
2. Clause-② yes ⇒ it owes a CONTRACT_REVIEW_TIER PASS, and that tier is exhausted (model-scoped 429 since ~17:4xZ). ⛔ The quota exemption covers dispatch, never review.

The two protections stack; neither substitutes for the other. Parked outside the queue is the safe state.

Owed by this seat when the review lands: the 席位意见 field in ## 维护者速读(草稿). ⛔ Correctly left empty by the dev — it is not a dev's to write, and it should carry a post-review opinion rather than a pre-review one.

⚠️ Five bare cards today, and this round filed three of them

#17157, #17158, #17159 were filed as the dispatch required, rather than left as 承接者:无. All three are open and carry no labels at all — as do #16884 and #17153 from other rounds today.

⇒ That is five cards invisible to every lane query, reachable only by the bare-card sweep. Correct behaviour by each round (⛔ a dev does not produce domain:*), but worth naming as a pattern for triage rather than five separate surprises. #17158 in particular is a needs-user-decision candidate the round correctly refused to decide.

---

Generated by Claude Code

[os-bill]

达档契约复核判 PASS —— 两条绑定项均讨清;⛔ 受管面,落地仍归维护者

domain:spec 席,session_01MkQhmuuJAVDjmeWNixwDDH,2026-09-09T22:2xZ。档位熔断:transcript 中 harness 逐消息盖章 90 条 claude-fable-5-1,零其它值(对照 "type":"assistant" 77 条)。⇒ 达档,逐字采信,⛔ 未改写。

⭐ 它是从两个「怎么作弊」的方向进去的,都没打穿

我给它的最重一条是:「一个把主体删掉换绿灯的 pin,是一条穿着及格名字的被删测试」。它照这个方向查了 B1 的两处修补,结论是两处主体都保住了,而且给出了机制:

• 作者形状翻转 pin:原主体是「同一个 literal 在 Connector 下绿、在 ConnectorParsed 下红」。⚠️ 退役之后,这个文件里再没有第二个 input/parsed 有别的键(CronExpressionInputSchema / transform / pipe / preprocess 全查为 0,对照 origin/main 同文件 2 行、shared/expression.zod.ts 2 处)。所以只能改用 defaults 量翻转 —— 而 defaults 恰好可判:六个 .default() 缺五个,正好落在 TS 从 TS2739 转 TS2740 的阈值下方。⭐ 它还做了辨别性检验:把两个别名对调,两个探针同时变红 ⇒ pin 没有失去分辨力。
• 方言收窄 pin:connector 位的旧主体随槽位退役而客观消失;两个仍在的槽位逐字未动,connector 位改成墓碑 pin(三种输入全部 invalid_type,并显式 not.toBe(...cron),外加「去键即通过」的控制)。名册由三改二并写明原因,不是静默缩表。

⇒ 这正是本席担心而无法自己判的那一层。B1 讨清。

⭐ B2:人口句确实落在会投影的字段上,但有一句必须说清

三条投影通道它是逐行读源码核的,不是看声明:spec-changes.ts:111-117 取 semantic.reason;build-upgrade-guide.ts:93-94 取 reason / acceptanceCriteria;chain.ts:102 → meta.ts:403-404 的 why: / verify:。⭐ 并且它纠正了一处实现者没 claim、我也没查的细节:acceptanceCriteria 不进 spec-changes.json,只进指南与 verify:。

⚠️ 但整个 step-18 在当下都不投影:PROTOCOL_VERSION = '17.0.0',两个 build 脚本的循环上界是 PROTOCOL_MAJOR,所以 twin 在 spec-changes.json 与升级指南里都是 0 —— 对照既有 step-18 条目 metadata-plugin-additional-types-retired 同样是 0,而 step-17 的 etl-pipeline-layer-retired 是 2 / 1。⇒ 这是启动窗口惯例,不是本增量的缺陷(本席在 FAIL 第 11 行已接受),但 PR 正文没把「17.x 线上任何读者都还看不到,直到 18 切线或显式 --to 18」说出来。已列入下方非绑定项。

本席自行复核的两处

• 受管面预算:origin/main 454 → head e5e87ccba 454,net 0,单行 diff,Job.schedule.expression (canonical) 留存。
• ADR-0087 disposition 现列六个 id,不是派单里写的五个 —— 增量加了 connector-sync-schedule-retired。⭐ 而且门禁判了而非空跑:[BREAKING+bang] registered …(new here: 全部六个),信号来自 **BREAKING 与 bang 两路,脚本自带夹具防正则烂掉。

⛔ 落地:清标,但不翻 ready、不入队

受管面(skills/objectstack-formula/SKILL.md)⇒ draft-only,人工合并。⛔ 本席永不对受管面 PR 翻 ready、入队、挂 auto-merge 或提交批准 review。达档 PASS 与人工合并是两道叠加的保障,⛔ 前者不替代后者。

⇒ 只做一件事:needs:contract-review 从双载体清掉,并在 ## 维护者速读(草稿) 的 席位意见 填入本席意见。PR 停在 draft 等维护者。

⚠️ 一条落地顺序义务,给维护者:并写邻接

single-writer 门只声明 .objectui-sha,所以它的绿灯不覆盖这两处生成物邻接:

邻接 PR	共同文件	状态
#16778	packages/spec/src/migrations/registry.ts(另加 step-18 semantic 条目)	open
#17090	content/docs/references/api/export.mdx	⚠️ 已在合并队列(本席 22:18:15Z 入队)

⇒ #17090 会先落。合并本 PR 前须先合 origin/main 并用 bash scripts/pm/os-regen-merge.sh 重生成,⛔ 不手改生成物。PR 正文提了 #16778,未提 #17090。

席位待办(非阻塞)

给 #17157 / #17158 / #17159 贴域标签;#17158 还欠 needs-user-decision 与四棱卡面块 —— dev 不产标签也不写四棱块,而一张进决策箱的卡没有四棱块是半状态。归本席与分诊。

下文自 PASS 起为裁决原文。

---

PASS

Implemented-by: claude/issue-16320-retire-cron-typed-positions
Reviewed-by: contract-review-tier subagent, domain:spec seat

总判

两条绑定项均已按裁决字面落地,且我试图从"删掉测试主体换绿灯"和"只改条目形状不改可见性"两个方向击破,都没有击破。B1 的两处修补各自保住了原 pin 的主体:作者形状翻转 pin 仍双向可判(别名对调 → 两个探针同时翻红),方言收窄 pin 在仍存在的两个槽位上原样保留、connector 位以墓碑形式显式收缩名册而非静默通过。B2 的人口句现在落在 reason / acceptanceCriteria 上,三条投影通道均从源码逐行核到;⚠️ 但必须说清:在 PROTOCOL_VERSION = '17.0.0' 的当下,整个 step-18 都不投影到任何已发布工件(对照:已存在的 step-18 条目 metadata-plugin-additional-types-retired 在 spec-changes.json 中同样为 0),os migrate meta --from 17 不带 --to 18 时链为空——这是本席在 FAIL 第 11 行已接受的启动窗口惯例,不是本增量的缺陷,但 PR 正文没有把"延迟到 18 切线"这一点说出来。增量范围核实:origin/main...e5e87ccba = 42 文件 +1830/−155,与 PR 一致;78e53b188..e5e87ccba 的非 merge 提交中属本分支的只有 60e293676、172c32638 两个,其余 22 个均为 origin/main 合并流量,已剔除。

① 派生判断

#	变化	判定	读数(命令 → 值)
1	ScheduledExport.schedule.cronExpression → retiredKey()	对,增量未动	git grep -n 'retiredKey(' e5e87ccba -- api/export.zod.ts → :612;git log --no-merges 78e53b188..e5e87ccba -- <5 schema files 除 connector> → 空
2	ScheduleExportRequest.schedule.cronExpression → tombstone	对	同上 :743;registry 拼写 registry.ts:10978
3	ScheduleState.cronExpression(原 REQUIRED)→ tombstone	对	execution.zod.ts:556;registry :11116;authorable-surface automation.json:286 "…cronExpression [RETIRED]"(head 12 行 RETIRED vs main 11)
4	DataSyncConfig.schedule → tombstone + D2 connector-sync-schedule-removed + D3 twin	对。增量只改了 6 行段注释(git diff 78e53b188 e5e87ccba -- connector.zod.ts),墓碑文案未变;D2 summary 点名 twin;D3 replacement 点名 D2	connector.zod.ts:285;registry :11354;integration.json:79 [RETIRED](9 vs 8);CONVERSIONS_BY_MAJOR[18] 末项 connectorSyncScheduleRemoved
5	CacheWarmup.schedule → tombstone	对	cache.zod.ts:202;registry :12310;system.json:201
6	BackupConfig.schedule → tombstone	对	disaster-recovery.zod.ts:84;registry :12272;system.json:124
7	DisasterRecoveryPlan.testing.schedule → tombstone	对	disaster-recovery.zod.ts:280;registry :12399(system.json RETIRED 14 vs 12,恰 +2)
8	七个 retiredKey( 在 origin/main 的五文件中的对照	对照点亮	git grep -c 'retiredKey(' origin/main -- <5 files> → connector 5 / cache 2 / DR 1(旧墓碑),export/execution 0
9	B1-a connector-author-shape.test.ts 翻转 pin	主体保住:pin 的主体是"同一 literal 在 Connector(z.input,:947)下绿、在 ConnectorParsed(z.infer,:949)下红"。类型有别的唯一键已从世界上消失——`git grep -P 'CronExpressionInputSchema	TypedExpression
10	B1-b typed-expression-envelope-dialect.test.ts 收窄 pin	主体保住:connector 位的旧主体("stack 可达 typed 槽位上的方言判决")随槽位退役而不复存在;两个仍在的槽位(jobs[].schedule.expression、objects[].titleFormat)的控制组与拒绝用例逐字未动;connector 用例改为墓碑 pin——三种输入(外方言信封 / cron 信封 / 裸串)全部 invalid_type at connectors.0.syncConfig.schedule、message ^connector.syncConfig.schedule was removed…、明确 not.toBe(TYPED_EXPRESSION_DIALECT_ONLY.cron),并有"去键即通过"的控制。docblock 名册由三改二并写明原因	同上,CI 绿;本机 NOT MEASURED
11	B2-1 D3 18.connector-sync-schedule-retired	存在,acceptanceCriteria 非空;entries 文件与 registry.ts:6397-6453 生成区字符串逐字相同	git show e5e87ccba:…/semantic/18.connector-sync-schedule-retired.ts;git diff 78e53b188 e5e87ccba -- migrations/registry.ts
12	B2-2 反向断言反转	反转而非搬家::479 → .map(s => s.id)).toEqual([SEMANTIC_TWIN_ID]);另两处 toEqual([]) 在 :513-514,过滤正则 `/export	schedule-state
13	B2-3 人口句是否投影	机制核实:migrations/spec-changes.ts:111-117 → rationale: semantic.reason(注意:acceptanceCriteria 不进 spec-changes.json,PR 正文也没这么claim);scripts/build-upgrade-guide.ts:93-94 → Why not automatic: ${s.reason} / Done when: ${s.acceptanceCriteria};migrations/chain.ts:102 把 step.semantic 展开成 todos → cli/…/migrate/meta.ts:403-404 why: t.reason / verify: t.acceptanceCriteria。D2 summary → spec-changes.ts:105 to: conversion.summary 与指南表格行。工件核实:twin 在 packages/spec/spec-changes.json = 0、docs/protocol-upgrade-guide.md = 0;对照 etl-pipeline-layer-retired = 2 / 1;既有 step-18 条目 metadata-plugin-additional-types-retired = 0 ⇒ 延迟属于整个 step 18(build-spec-changes.ts / build-upgrade-guide.ts 循环上界 PROTOCOL_MAJOR,protocol-version.ts:18 PROTOCOL_VERSION = '17.0.0');meta.ts:289 toMajor = flags.to ?? PROTOCOL_MAJOR,chain.ts:41 filter(m > from && m <= to) → --from 17 默认为空链,--to 18 时可达(registry.ts:10257 18: step18,无上界守卫)。投影执行本机 NOT MEASURED	pin :469-479 断言 reason 含 ZERO in-repo authors / NOT MEASURED、acceptanceCriteria 含 by hand —— CI 绿即证 twin 已接入 MIGRATIONS_BY_MAJOR[18].semantic
14	类 pin retired-key-migrate-sentence(repo 层)对 twin 的判定	twin 文本无 MARKER(grep -P 'os migrate meta --from \d+' → exit 1;对照 connector.zod.ts 5 处点亮),WITHDRAWN_CLAIM(`to rewrite … automatically	rewrites (it for you
15	受管 skill cron 行	对:454 → 454,单行 diff,删去 connector.schedule / automation/execution.cronExpression / api/export.cronExpression 三载体,Job.schedule.expression (canonical) 留存,template 行未动	git show origin/main:skills/…/SKILL.md | wc -l = 454;git show e5e87ccba:… | wc -l = 454
16	shared/expression.zod.ts docblock	增量已按 FAIL 非绑定项改写(两槽位 + 七位退役说明);仅注释,union 本体未动	git diff origin/main e5e87ccba -- shared/expression.zod.ts
17	与 origin/main 新增 3 提交(87ad73b06)的交集	∅;merge-tree 干净	comm -12 … → 空;git merge-tree --write-tree origin/main e5e87ccba → exit 0

② semver 定级

• Changeset @objectstack/spec: minor + 字面 **BREAKING**,ADR-0087 disposition 现列 六 个 id(增量加了 connector-sync-schedule-retired,git diff 78e53b188 e5e87ccba -- .changeset/),派单里说"五个"是旧头读数。
• 门禁实际判定而非空跑:node scripts/check-adr-0087-registration.mjs --base origin/main --head e5e87ccba → exit 0,[BREAKING+bang] registered …(new here: 全部六个);信号来自 breakingDeclaration() :572 /\*\*BREAKING/i + :574 bang,脚本自带 MUST_MATCH_BREAKING 夹具(:1793-1822)防正则烂掉。node scripts/check-changeset-no-major.mjs --base origin/main --head e5e87ccba → exit 0,无 major;LEVEL 轴本地 N/A(需 PR payload),CI Check Changeset 两次 success(18:01 与 18:59 body-edit 重跑)。
• 定级判断:退役七个已发布键、其一原 REQUIRED——带键文档从通过变拒绝(收窄)、无键 ScheduleState 从拒绝变通过(放宽),两向皆是 accept-set 移动 ⇒ breaking;仓库启动窗口惯例 breaking 走 minor + 横幅(no-major 脚本头注 :5-9)。minor 正确,双向移动不改变级别。

③ 边界旗处置

#	旗	处置
1	CacheWarmup.strategy 保留 'scheduled'	#17157 open,正文给两条选项(ADR-0049 枚举退役 / [EXPERIMENTAL] 标记)未决 ✓。无标签(bare)。
2	导出契约家族零消费者 + 空 schedule 块	#17158 open,[Decision] 标题、"Nothing here is decided"、三选项、dev-seat reading 标明 non-binding ✓ ——是候选而非已决。⚠️ 无 needs-user-decision 标签(dev 不产标签,席位待贴)。
3	docs/adr/0122:73 过时陈述	同意不改(ADR 为记录),承接者:无 ✓
4	etl-pipeline-layer-retired 的 "IS parsed and executed"	#17159 open,docs-only 修法 + 类比 #5781 ✓
5	objectui 检出不在 pin	只读 ref 取数,无动作 ✓
6	D2-only vs D3-twin 约定	#17152 open,needs-user-decision 已挂;本 PR 不等它 ✓,本席不重开。
7	FAIL 的"应标而未标"五项	两测试 → 已重判(①9/10);偏离作 open question → #17152 + 路线 (b) ✓;expression.zod.ts docblock → 已改(①16);普查 dashboards.json 两处 → PR 正文已改为"6 mentions … corrected on review" ✓;CI in-progress → 已全部结论 ✓。非绑定建议 /meta/connector 门断言 path/message、applyConversionsToStoredItem('connector', …) 回放用例 → 均已加(pin diff :306-316、:483-497)✓

应标而未标(本轮新发现,均非绑定):

• PR 正文 premise 表行「both deferrals discharged; shared/expression.zod.ts out of the write set | holds — untouched」已过期:60e293676 改了该文件 docblock,git diff --name-only origin/main...e5e87ccba 含它。改动只有注释,但延期评论 5571981718 明说这是热文件要过串行队列;正文应改为"docblock-only 改动,已声明"。
• 投影延迟未在 PR 正文说明(见 ①13):在 17.x 线上人口句对任何读者都尚不可见,直到 18 切线或显式 --to 18。与 D2 house sentence 同一惯例(FAIL 第 4/11 行已接受),记录而不重开。
• 并写邻接:single-writer 门只声明 .objectui-sha(check-single-claim-paths.mjs:286-295),故绿灯不覆盖下面两处——feat(service-analytics)!: refuse an aggregate a datetime measure's field type cannot carry, and reconcile the storage-form annotations to one measured statement #16778(open)改 packages/spec/src/migrations/registry.ts(另加 step-18 semantic 条目),feat(spec): ADR-0112 error envelope gains a producer-side refusal declaration so a deliberate 5xx refusal keeps its caller-authored message (#16335) #17090(open)改 content/docs/references/api/export.mdx;两者皆生成物,后落地者须走 os-regen-merge.sh 重生成。PR 正文已提 feat(service-analytics)!: refuse an aggregate a datetime measure's field type cannot carry, and reconcile the storage-form annotations to one measured statement #16778,未提 feat(spec): ADR-0112 error envelope gains a producer-side refusal declaration so a deliberate 5xx refusal keeps its caller-authored message (#16335) #17090。
• check:migration-registry(entries → registry 生成区一致性)在 .github/workflows、turbo.json、根 package.json 中均未按名出现(仅 lint.yml:4703 check:generated --reconcile-only);是否被 CI 某聚合覆盖 NOT MEASURED。风险由 pin(CI 绿,MIGRATIONS_BY_MAJOR[18] 上直接断言 twin 措辞)与本席逐字比对兜住。
• PR 正文 CI 读数「32 success / 2 skipped」现为 30 / 4(Auto Label、Check PR Size 最新一次为 18:59 body-edit 事件的 skipped);34 distinct names、0 failure、Test Core 与 Test Core (1/6) 均 success 不变。

非绑定项(一轮内可顺手做)

1. PR 正文:更正 shared/expression.zod.ts premise 行;补一句投影在 17.x 线上延迟、--to 18 可预览;补 feat(spec): ADR-0112 error envelope gains a producer-side refusal declaration so a deliberate 5xx refusal keeps its caller-authored message (#16335) #17090 的 export.mdx 邻接。
2. 席位:给 spec: CacheWarmup.strategy keeps the 'scheduled' member after its cron left — a declared warmup cadence with no key and no engine (ADR-0049 enum residue of #16320) #17157/[Decision] the export-job API contract family (ScheduledExport / ScheduleExportRequest / ExportJob…) has zero consumers and, after #16320, an empty schedule block — retire the family, keep the contract, or build the scheduler? #17158/spec: etl-pipeline-layer-retired D3 entry says connector-attached sync IS parsed and executed — nothing executes syncConfig (stale claim in a projected ledger string, #5781 class) #17159 贴域标签,[Decision] the export-job API contract family (ScheduledExport / ScheduleExportRequest / ExportJob…) has zero consumers and, after #16320, an empty schedule block — retire the family, keep the contract, or build the scheduler? #17158 贴 needs-user-decision。
3. 席位:落地前对 feat(service-analytics)!: refuse an aggregate a datetime measure's field type cannot carry, and reconcile the storage-form annotations to one measured statement #16778 / feat(spec): ADR-0112 error envelope gains a producer-side refusal declaration so a deliberate 5xx refusal keeps its caller-authored message (#16335) #17090 的落地顺序留一行 regen 义务。

本机 NOT MEASURED 清单:pnpm --filter @objectstack/spec test(local 471 文件)与 test:repo(28 文件)、typecheck、check:generated、composeSpecChanges(17,18) 实际执行——共享检出无 node_modules,os-verify-lock.sh 未启用;以上全部以 CI head e5e87ccba 的同名最新 run(34 名,0 failure,0 in_progress)为测量,未以弱代理替代。

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16320,
  "status": "done",
  "branch": "claude/issue-16320-retire-cron-typed-positions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17146",
  "premise_still_valid": true,
  "summary": "Mechanical merge+regen round on PR #17146, no behaviour change. Every premise in the blocker comment 5610802343 was re-measured and held: content/docs/references/api/export.mdx is merge=os-regen (control packages/spec/src/data/hook.zod.ts reads unspecified), merge base 4261fbc80, both sides had edited that one file, and the both-sides intersection over the whole diff is still exactly 1 path. scripts/pm/os-regen-merge.sh produced merge commit fb230b840, and the silent drop was then confirmed empirically rather than assumed: that merge commit's export.mdx blob was byte-identical to the pre-merge branch tip (d53a4ab90) and carried 0 of PR #17090's refusal rows. Step 2 restored main's side, gen:schema + gen:docs re-derived this branch's cron tombstones on top, and repair commit 4041edb9b lands the 6 recovered rows and nothing else. The merged page now carries both intents. New head 4041edb9b, pushed fast-forward; PR remains draft and awaiting the maintainer's own merge.",
  "tests": "spec build exit 0; gen:schema+gen:docs exit 0 (1593 schemas, 228 doc files); check:generated exit 0 (all 15 artifacts current, incl. check:authorable-surface and check:docs); pnpm --filter @objectstack/spec test exit 0 (471 files / 13242 tests passed) and typecheck exit 0; 19 targeted gates exit 0 (list below); check-governed-merges --test over all 42 merged-diff paths exit 3 GOVERNED as intended. #17090 survival assertion: 5 quoted-exact symbols, main==merged on every one, with a control leg proving the assertion detects the drop (59 pre-repair vs 65 on main and post-repair). All exit codes landed to disk before reading; no exit code read through a pipe.",
  "mcp_calls": "0 — the whole run went through repo-scoped REST reads and git; no MCP GitHub calls",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: blocker comment 5610802343 cites `origin/main` as 4261fbc8, but 4261fbc8 is the MERGE BASE, not main's tip at that time. The operative premise (merge base = 4261fbc8) is correct and was re-verified; only the label on that one sha is wrong. 承接者: the domain:spec PM seat that authored that comment.",
    "noted, not filed: the merge commit fb230b840 carries no Claude-Session / Co-Authored-By trailers, because scripts/pm/os-regen-merge.sh auto-commits step 1 with `git merge --no-edit` and step 3 with its own fixed -m. Amending was refused by this round's own order (no amend, no force-push), so the trailers ride on repair commit 4041edb9b only. 承接者: whoever next edits os-regen-merge.sh's commit-message construction.",
    "noted, not filed: scripts/pm/dispatch-gates.mjs reported STALE TREE mid-round — origin/main advanced to d03c3c96d while the round ran, and 2 files the gate list derives from (scripts/pm/check-half-states.mjs, scripts/pm/check-skill-line-ratchet.mjs) changed inside that range. Re-measured: those 4 new commits touch 7 files, all .claude/skills/pm-dispatch/** plus those 2 scripts, and the intersection with this branch's 42 paths is EMPTY, so they introduce no new os-regen contention. 承接者: none needed — recorded so the next round does not re-derive it."
  ]
}

What the round did

Merge commit fb230b8405c33af7ab7be75e5e13e62d86ddfcb6 (parents e5e87ccba branch, 470746ae4 main).
New head 4041edb9bc3d345fd21a6c4f0eeeb19e9a955784 (repair commit). Pushed e5e87ccba..4041edb9b, fast-forward, no force, no rebase — old head verified still an ancestor of new head (exit 0).

The silent drop, measured rather than assumed

The driver's own merge output was inspected before step 2 touched anything:

blob at fb230b840:content/docs/references/api/export.mdx = d53a4ab9017e0b312cc7ce5b2270074b4b9592a3
blob at e5e87ccba:content/docs/references/api/export.mdx = d53a4ab9017e0b312cc7ce5b2270074b4b9592a3   (identical)
#17090 refusal rows in that merge commit: 0        (origin/main has 6)

Exit 0, zero conflict markers, main's half gone — the exact failure the script exists to close.

Step 2's per-path side selection, as printed

TAKING main's side (both sides changed it) — 1 path:

• content/docs/references/api/export.mdx — "the os-regen driver merged it with exit 0 and silently kept one side. Step 4's regeneration re-derives the generated content on top."

KEEPING the branch's bytes (branch changed it, main did not) — 7 paths:

• content/docs/references/automation/execution.mdx
• content/docs/references/integration/connector.mdx
• content/docs/references/system/cache.mdx
• content/docs/references/system/disaster-recovery.mdx
• packages/spec/authorable-surface/automation.json
• packages/spec/authorable-surface/integration.json
• packages/spec/authorable-surface/system.json

Its printed reasoning for all seven: "the branch changed it and main did not, so git resolved it trivially and there is nothing to reconcile. Taking main's side here would be a pure revert of a COMMITTED change (a retirement branch's hand-deletions are the deliverable). Step 4 regenerates it as usual."

Ordering traps: both avoided

os-regen-merge.sh exited 1 at step 3. That is its designed collection point, not a failure — its header records the pre-commit refuse-stale path firing on the ordinary commit after an auto-committed merge. Confirmed it was the designed shape, not a dropped side: MERGE_HEAD was checked and found absent immediately before regenerating, so gen:schema never ran in MERGE state and the authorable-surface anchor never rolled back — packages/spec/authorable-surface.base.json shows an empty diff, and check:authorable-surface passes. After the repair commit the hook printed ✓ current and os-regen: all deferred artifacts are current — marker cleared, exactly as the header predicts.

The index/worktree trap was handled by inspecting the staged diff, not the working-tree diff: after git add -A the staged diff against the merge commit was 1 file changed, 6 insertions(+) — precisely #17090's six recovered rows, nothing else.

The #17090 survival assertion

Command:

git grep -c -F SYMBOL origin/main -- .     vs     git grep -c -F SYMBOL HEAD -- .

Output (merged HEAD 4041edb9b, origin/main 470746ae4):

OK    main=2    merged=2     refusal: z.literal(true).optional().describe(
OK    main=3    merged=3     Producer-declared deliberate refusal — see ApiErrorSchema.refusal.
OK    main=65   merged=65    Producer-declared: the 5xx this envelope carries is a deliberate refusal
OK    main=68   merged=68    a declared refusal is still withheld
OK    main=1    merged=1     decision batch #58, option C
TOTAL FAILURES: 0

The first row is #17090's implementation body — the refusal: z.literal(true) declaration in packages/spec/src/api/errors.zod.ts and contract.zod.ts. Control leg proving the assertion is not vacuous:

main=65   pre-repair(fb230b840)=59   post-repair(HEAD)=65
CONTROL OK — the assertion DOES fail pre-repair (6 rows short)

Governed line budget — did not move

skills/objectstack-formula/SKILL.md: 454 before, 454 after. Also 454 at the merge base and 454 on origin/main. git diff e5e87ccba HEAD -- skills/objectstack-formula/SKILL.md is empty — this round did not touch the file at all. Net 0, inside the ratchet.

Gate exit codes

Every one landed to disk before reading (cmd > log 2>&1; EXIT=$?).

exit	command
0	pnpm --filter @objectstack/spec build
0	pnpm --filter @objectstack/spec gen:schema && ... gen:docs
0	pnpm --filter @objectstack/spec check:generated (all 15 artifacts current)
0	pnpm --filter @objectstack/spec test (471 files / 13242 tests)
0	pnpm --filter @objectstack/spec typecheck
0	pnpm check:nul-bytes
0	pnpm check:merge-driver
0	pnpm check:pm-governed-merges
0	node scripts/check-skills-token-ratchet.mjs
0	node scripts/pm/check-skill-line-ratchet.mjs
0	node scripts/check-adr-0087-registration.mjs --base origin/main
0	node scripts/check-empty-changeset.mjs --base origin/main
0	node scripts/check-changeset-no-major.mjs --base origin/main
0	pnpm check:doc-anchors
0	pnpm check:docs-single-h1
0	pnpm check:doc-authoring
0	pnpm check:docs-redirects
0	node scripts/check-doc-frontmatter.mjs
0	node scripts/check-docs-section-name.mjs
0	pnpm check:skill-compatibility
0	pnpm check:skill-frame-sync
0	pnpm check:skill-identifier-liveness
0	pnpm check:published-files
0	pnpm check:pm-widening-tells
3	node scripts/pm/check-governed-merges.mjs --test over all 42 merged-diff paths — GOVERNED, the intended state

The governed reading: "1 of 42 path(s) hit the register … skills/** ×1 — the published skills catalog: skills/objectstack-formula/SKILL.md. One hit governs the whole PR."

check-clause2-carriers.mjs was not run. The dispatch's caveat about primary-checkout drift was checked anyway: in this worktree both scripts/pm/check-clause2-carriers.mjs and scripts/pm/check-widening-tells.mjs are byte-equal to origin/main (git hash-object vs git rev-parse origin/main:PATH), because the merge brought main's copies in.

Check runs — newest run per check name

Read from /commits/4041edb9b/check-runs, deduplicated to the newest run per name (not the raw run list, not the required subset): 31 names.

in_progress: 22
success:      6
skipped:      2
queued:       1
RED: none

Nothing is red. CI had not converged at report time; per the dispatch contract this round reports at the push rather than waiting on it.

PR state — unchanged, as required

draft: true, state: open, base main, head 4041edb9b, mergeable_state: blocked (required checks still running). No ready-flip, no enqueue, no auto-merge, no approving review, no label touched. A governed PR visibly awaiting a human merge is the correct terminal state.

Housekeeping

The worktree /home/user/objectstack-issue-16320 was left in place, deliberately: it is the worktree this card's Claim: comment registers (Worktree: objectstack-issue-16320), the card stays pm:dispatched until the PR merges, and the tree is clean with everything pushed. Removing it would contradict the claim record. No background process was started, so none was left running.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16320,
  "status": "done",
  "branch": "claude/issue-16320-retire-cron-typed-positions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17146",
  "premise_still_valid": true,
  "summary": "Second mechanical merge+regen round on PR #17146, no behaviour change, no scope of my own. PR #17257 merged at 04:42:41Z (merge commit 4792049f6, confirmed an ancestor of origin/main, exit 0), so this branch owed the round it was promised in comment 5612965675. scripts/pm/os-regen-merge.sh merged origin/main c47edbb21 into 4041edb9b, producing merge commit b16c221a8 — the new head. Step 2 took main's side of NOTHING and kept the branch's bytes of all 8 os-regen paths it had edited: the both-sides intersection over the os-regen set is EMPTY this round, so the driver never ran and there was no silent drop to repair. The only path both sides touched at all is packages/spec/src/migrations/registry.ts, which is NOT merge=os-regen routed (check-attr reads unspecified; the positive control content/docs/references/api/export.mdx reads os-regen) — it text-merged cleanly. check:generated then reported all 15 generated artifacts already current on the merged tree, and an explicit gen:migration-registry reproduced registry.ts byte-identically, so this round produced NO regeneration commit: merge commit b16c221a8 is the whole product. PR stays draft, awaiting the maintainer's own hand merge.",
  "tests": "os-regen-merge.sh exit 0; pnpm install --frozen-lockfile exit 0; spec build exit 0 (via os-verify-lock, VERDICT command-exit 0); check:generated exit 0 (all 15 artifacts up to date); gen:migration-registry exit 0 and registry.ts blob identical before/after (20483505bdc7b277d67f1becc3f5b66058c2bac5); pnpm --filter @objectstack/spec typecheck exit 0; pnpm --filter @objectstack/spec test exit 0 (471 files / 13257 tests passed); 22 targeted gates all exit 0; check-governed-merges --test over all 42 merged-diff paths exit 3 GOVERNED as intended. Survival assertions: #17257's entry id, 7 quoted-exact symbols, main == merged on every one, with a control leg reading 0 on the pre-merge branch tip; #17090's export.mdx rows, 5 quoted-exact symbols, main == merged on every one, control leg 59 pre-repair vs 65 on main and on the merged head. Every exit code landed to disk before reading; no exit code read through a pipe. The spec test run exceeded the 10-minute foreground cap and was blocked on in-turn with tail --pid on the PID recorded from os-verify-lock --status; no process was killed by name.",
  "mcp_calls": "0 — the whole run went through repo-scoped REST reads and git; no MCP GitHub call was made",
  "open_questions": [],
  "out_of_scope_findings": [
    "PREMISE FALSE, reported not worked around: the order states os-regen-merge.sh 'exits 1 by design at step 3'. This round it exited 0. That shape is CONDITIONAL on step 2 having taken main's side of at least one path — with an empty both-sides intersection step 3 prints '(merge left no additional changes to commit)', makes no ordinary commit, and no pre-commit refuse-stale can fire.承接者: the PM seat that writes this dispatch order, and anyone reading the script header's step-3 section as unconditional.",
    "noted, not filed: the merge commit b16c221a8 carries no Claude-Session / Co-authored-by trailers, because git merge --no-edit auto-commits with its own default message. The order names this as known and not to be fixed by amending, and it is the ONLY commit this round produced, so no trailer was written at all. 承接者: whoever next edits os-regen-merge.sh's commit-message construction.",
    "noted, not filed: ATTRIBUTION CONFLICT flagged rather than silently chosen. The harness attribution block asks for a model-identifying Co-Authored-By trailer; this order requires the model-free pair. The order wins per its own text. It never had to be resolved in bytes this round: I authored no commit of my own. 承接者: none — recorded so the next round does not re-derive it.",
    "noted, not filed: my FIRST survival probe for #17257 used a symbol I paraphrased from the PR title rather than lifted from the tree. It read 0 on origin/main as well as on the merged head — a probe error, not a loss. Corrected by lifting 7 real fixed strings from the landed entry file and from page.zod.ts, and the corrected run reads non-zero and equal on main and merged for every one. Recorded because a green report built on a symbol that matches nothing would be exactly the vacuous assertion the control leg exists to prevent. 承接者: none.",
    "noted, not filed: scripts/pm/dispatch-gates.mjs --commands derives 120+ gate commands from this branch's 42-path change set, i.e. effectively the whole farm. I ran a DECLARED narrowing (the generated-artifact gates plus 22 families this diff implicates) and left the farm to CI, per the local-verification-scope rule. 承接者: none.",
    "noted, not filed: the repository checkout is SHALLOW (git rev-parse --is-shallow-repository reads true). The one load-bearing ancestry reading this round is POSITIVE (merge-base --is-ancestor 4792049f6 origin/main, exit 0), which is self-proving in any checkout, so no control leg was owed. 承接者: none."
  ]
}

What this round did

Merge commit b16c221a895a811a80a9ccf37ceb4ce3a5245f1c — parents 4041edb9b (branch) and c47edbb21 (origin/main).
New head: the same commit. There is no repair commit this round; see "Regeneration was a no-op" below.
Pushed 4041edb9b..b16c221a8, fast-forward. No force, no rebase, no amend — old head verified still an ancestor of the new head (exit 0).

The trigger, verified rather than assumed

git merge-base --is-ancestor 4792049f61f38a0b9b762b61691f09c6b197463b origin/main   -> exit 0

PR #17257 merged 2026-09-10T04:42:41Z, merge commit 4792049f6, on origin/main.

⛔ The order's step-3 premise did NOT hold — reported, not worked around

The order says os-regen-merge.sh "exits 1 by design at step 3". It exited 0.

OS_REGEN_MERGE_EXIT=0
→ step 3: committing the merge BEFORE any regeneration
   (merge left no additional changes to commit)

That is not a different failure — it is the same design with step 2 having nothing to do. The exit-1 shape is the pre-commit refuse-stale hook firing on the ordinary commit step 3 makes after step 2 has restored something. With an empty both-sides intersection step 2 restores nothing, step 3 makes no ordinary commit, and no hook runs. Last round step 2 had one path to take, so it exited 1; this round it had none.

Step 2's per-path side selection, as printed

TAKING main's side (both sides changed it): 0 paths. The intersection of the branch-edited and main-edited os-regen sets is empty:

side	os-regen paths moved since merge base 470746ae4
branch	8 — content/docs/references/api/export.mdx, .../automation/execution.mdx, .../integration/connector.mdx, .../system/cache.mdx, .../system/disaster-recovery.mdx, packages/spec/authorable-surface/automation.json, .../integration.json, .../system.json
main	4 — content/docs/references/ui/component.mdx, .../ui/page.mdx, packages/spec/api-surface/ui.json, packages/spec/export-origins/ui.json
both	(empty)

KEEPING the branch's bytes: all 8, each with the script's printed reasoning:

the branch changed it and main did not, so git resolved it trivially and there is nothing to reconcile. Taking main's side here would be a pure revert of a COMMITTED change (a retirement branch's hand-deletions are the deliverable). Step 4 regenerates it as usual.

No os-regen-pending marker was left behind, consistent with a driver that never ran.

The contended file is a DIFFERENT hazard class this round

The only path both sides touched at all is packages/spec/src/migrations/registry.ts, and it is not routed to the driver:

git check-attr merge -- packages/spec/src/migrations/registry.ts      -> merge: unspecified
git check-attr merge -- packages/spec/src/data/hook.zod.ts            -> merge: unspecified   (negative control)
git check-attr merge -- content/docs/references/api/export.mdx        -> merge: os-regen      (positive control)

So the hazard here is a visible text conflict, never the silent drop. Both merge probes agreed in advance and both matched the real merge — same tree object:

probe	exit	tree
git merge-tree --write-tree --name-only in this worktree, driver registered	0	25f5d42d5
the same, in a throwaway git clone --bare --shared with the driver absent (GitHub's condition; config --get merge.os-regen.driver exits 1 there)	0	25f5d42d5
the real git merge origin/main	0	Auto-merging packages/spec/src/migrations/registry.ts, Merge made by the 'ort' strategy

Regeneration was a no-op — proved, not assumed

MERGE_HEAD was checked absent before anything was regenerated, so no generator ran while the tree was in MERGE state and the authorable-surface anchor could not roll back.

pnpm --filter @objectstack/spec check:generated   ->  exit 0
✓ All 15 generated artifacts are up to date.

and, for the file at the heart of the contention, an explicit regeneration reproduced the merged bytes exactly:

registry.ts blob BEFORE gen = 20483505bdc7b277d67f1becc3f5b66058c2bac5
✓ wrote src/migrations/registry.ts (198 semantic, 172 retired-key, 116 retired-def)
registry.ts blob AFTER  gen = 20483505bdc7b277d67f1becc3f5b66058c2bac5
IDENTICAL — the merged registry.ts IS what the generator produces
git status --porcelain after the run: empty

Both PRs added entry FILES under packages/spec/src/migrations/entries/ (this branch 12, #17257 one), which is why the generated region reconciles: the generator concatenates the directory, so neither side's entry can be resolved away.

⭐ Survival assertion A — PR #17257's entry, with its control

Command, quoted-exact fixed string, three trees:

git grep -c -F "SYMBOL" origin/main -- PATHSPEC
git grep -c -F "SYMBOL" HEAD        -- PATHSPEC
git grep -c -F "SYMBOL" 4041edb9b   -- PATHSPEC   (control: the pre-merge branch tip)

OK    main=1    merged=1    CONTROL pre-merge=0   packages/spec/src/migrations/registry.ts   element-data-source-and-object-block-filter-rule-array
OK    main=1    merged=1    CONTROL pre-merge=0   entries/semantic/18.element-data-source-...ts  element-data-source-and-object-block-filter-rule-array
OK    main=22   merged=22   CONTROL pre-merge=0   .   element-data-source-and-object-block-filter-rule-array
OK    main=2    merged=2    CONTROL pre-merge=0   .   the value placeholders and date macros are unchanged.
OK    main=2    merged=2    CONTROL pre-merge=0   .   got a silent success receipt while the html tier already declared
OK    main=3    merged=3    CONTROL pre-merge=0   .   Additional filter criteria — the ViewFilterRule array form
OK    main=5    merged=5    CONTROL pre-merge=0   .   ElementDataSourceParsed
TOTAL FAILURES: 0

The lit control:

main=22   pre-merge branch tip (4041edb9b)=0   merged HEAD=22
CONTROL OK — the same command reads 0 on a tree that genuinely lacks the entry,
             and 22 on main and on the merged head. Not vacuous.

The first three rows are the index (the entry id); the last four are the implementation body — the entry's own prose and the filter declaration #17257 landed in page.zod.ts, which is what a bad merge swallows while leaving the index looking fine.

⭐ Survival assertion B — PR #17090's export.mdx rows still survive

Same command shape, origin/main vs the merged HEAD:

OK    main=2    merged=2     refusal: z.literal(true).optional().describe(
OK    main=3    merged=3     Producer-declared deliberate refusal — see ApiErrorSchema.refusal.
OK    main=65   merged=65    Producer-declared: the 5xx this envelope carries is a deliberate refusal
OK    main=68   merged=68    a declared refusal is still withheld
OK    main=1    merged=1     decision batch #58, option C
TOTAL FAILURES: 0

Control leg, the same 59-vs-65 measurement as last round:

main=65   pre-repair (fb230b840)=59   merged HEAD=65
CONTROL OK — the assertion DOES fail on the known-dropped tree (6 rows short),
             so its pass on the merged head is a measurement, not a tautology.

And the six recovered rows read directly out of the page itself, across four trees:

tree	rows in content/docs/references/api/export.mdx
origin/main (c47edbb)	6
fb230b840 — last round's pre-repair merge	0
4041edb9b — last round's repair commit	6
b16c221a8 — this round's merged head	6

Last round's recovery is intact; this merge did not undo it.

The governed file's line budget — did not move

tree	skills/objectstack-formula/SKILL.md
merge base 470746ae4	454
pre-merge branch tip 4041edb9b — before	454
origin/main c47edbb21	454
merged head b16c221a8 — after	454

Net 0, inside the ratchet (net at most 0, never more than +2). git diff 4041edb9b HEAD -- skills/objectstack-formula/SKILL.md is empty — this round did not touch the file at all. node scripts/pm/check-skill-line-ratchet.mjs exits 0.

Gate exit codes

Every one landed to disk before reading (cmd > log 2>&1; EXIT=$?); no exit code was read through a pipe. Heavy runs went through bash scripts/pm/os-verify-lock.sh -c with a stable OS_VERIFY_LOCK_SLOT.

exit	command
0	bash scripts/pm/os-regen-merge.sh
0	pnpm install --frozen-lockfile
0	pnpm --filter @objectstack/spec build (lock VERDICT command-exit 0, held 148s, waited 46s)
0	pnpm --filter @objectstack/spec check:generated — all 15 artifacts up to date
0	pnpm --filter @objectstack/spec gen:migration-registry — byte-identical output
0	pnpm --filter @objectstack/spec typecheck (lock VERDICT command-exit 0, held 54s, waited 57s)
0	pnpm --filter @objectstack/spec test — 471 files / 13257 tests (lock VERDICT command-exit 0, held 413s, waited 401s)
0	pnpm check:nul-bytes
0	pnpm check:merge-driver
0	pnpm check:pm-governed-merges
0	node scripts/check-skills-token-ratchet.mjs
0	node scripts/pm/check-skill-line-ratchet.mjs
0	node scripts/check-adr-0087-registration.mjs --base origin/main
0	node scripts/check-empty-changeset.mjs --base origin/main
0	node scripts/check-changeset-no-major.mjs --base origin/main
0	pnpm check:doc-anchors
0	pnpm check:docs-single-h1
0	pnpm check:doc-authoring
0	pnpm check:docs-redirects
0	node scripts/check-doc-frontmatter.mjs
0	node scripts/check-docs-section-name.mjs
0	pnpm check:skill-compatibility
0	pnpm check:skill-frame-sync
0	pnpm check:skill-identifier-liveness
0	pnpm check:published-files
0	pnpm check:pm-widening-tells
0	pnpm check:tier-file-adoption
0	pnpm check:cross-package-test-inputs
3	node scripts/pm/check-governed-merges.mjs --test over all 42 merged-diff paths — GOVERNED, the intended state

The governed reading, verbatim:

⛔ GOVERNED — a human merge is the review record for this PR (#9495 regime). … One hit governs the whole PR … skills/** ×1 — the published skills catalog: skills/objectstack-formula/SKILL.md

It was run from a byte-verified copy: git hash-object scripts/pm/check-governed-merges.mjs equals git rev-parse origin/main:scripts/pm/check-governed-merges.mjs (081df968d…), so the predicate is origin/main's, not the branch's.

CI — newest run per check name

Read from /commits/b16c221a8/check-runs, deduplicated to the newest run per name (not the raw list, not the required subset): 34 names.

success:     31
skipped:      2   (Console Pin Gate; Packed-tarball smoke (opt-in))
in_progress:  1   (Lint & Repo Gates)
RED: none

Nothing is red. Lint & Repo Gates had not converged at report time; per the dispatch contract this round reports at the push rather than waiting on CI.

PR state — unchanged, as required

draft: true, state: open, base main, head b16c221a8, mergeable: true, mergeable_state: blocked (the one required check still running), auto_merge: null. Labels are the same five it carried at round start: documentation, size/xl, tests, tooling, protocol:system. No ready-flip, no enqueue, no auto-merge, no approving review, no label cleared. A governed PR visibly awaiting a human merge is the correct terminal state; making that merge safe was this round's job, performing it is not.

Housekeeping

The worktree /home/user/objectstack-issue-16320 was left in place, deliberately — it is the worktree this card's Claim: comment registers, the card stays dispatched until the PR merges, and the tree is clean with everything pushed. The one background process was my own pnpm --filter @objectstack/spec test; its PID was read from os-verify-lock.sh --status, blocked on in the foreground with tail --pid, and observed to exit on its own. Nothing was killed, by name or otherwise.

---

Generated by Claude Code

[os-bill]

维护者裁决已录：直接删，不做墓碑

domain:spec 执行席，session_01MkQhmuuJAVDjmeWNixwDDH，录于 2026-09-10T07:00Z。授权指令逐字引用，⛔ 不译、⛔ 不概括：

「#17146 是否建议直接删除，而不是搞墓碑。」

「我们的客户也不会按照你的设想的版本按顺序升级」

「直接删」

席位在第一问后给出了相反的推荐（保留 connector 家族的 D2 与墓碑、只削三个够不着作者的家族），并明确写出了代价：「删掉 connector 那个 D2 ⇒ 今天能加载的 stack manifest 明天加载不了。这不是提示变差，是数据坏掉。」 维护者在看到该代价后重申「直接删」。⇒ 按字面执行，⛔ 席位不再复议。

裁决覆盖面（按字面，⛔ 不外推）

本裁决只点名 #17146。⛔ 它不自动覆盖另外两张受管退役 PR（#17249 / #17298）——那两张各自的墓碑与账本行照现状，除非维护者另裁。⚠️ 三张 PR 之间的一致性值得一个字，但那是维护者的问题，⛔ 不是席位可代答的。

这张 PR 上要被删掉的东西（读自其 42 文件差异，2026-09-10T07:00Z）

现状	直接删之后
7 个 entries/retired-keys/18.*.ts 退役账本条目	全删
5 个 entries/semantic/18.*-retired.ts（D3 墓碑散文）	全删
migrations/registry.ts +351/-1 的生成区域	随之收缩
conversions/registry.ts +112/-0 —— connector 家族那个 D2（connector-sync-schedule-removed）	全删
六个 schema 文件的 +41/-4、+33/-3、+33/-5、+22/-3、+32/-7（删键 并 补 retiredKey 墓碑）	只剩删键那一半
cron-typed-positions-retirement.test.ts +516/-0	收缩成「这七个位置不再存在」的 pin
.changeset/cron-typed-positions-retired.md +136/-0	重写

⇒ 这张 PR 会从 42 个文件大幅收缩。按「创业阶段不扩散」那一轴，这是改善：每一个墓碑都是一份永久义务，而这次删掉的是十二份。

⚠️ 一条必须写在 PR 正文里、供人工合并那一刻看见的后果

DataSyncConfig.schedule 是七个位置里唯一从 stack manifest 够得着的（stack.zod.ts → connectors[] → connector.zod.ts syncConfig → schedule）。删掉它的 D2 之后，一个今天能加载的 stack manifest，在升级后会在 schedule 这个键上被拒绝加载——不是提示变差，是加载失败。

⛔ 这不是重新提问，裁决已作。它写在这里，是因为人工合并本身就是签核动作，签核的人应当在按下按钮的那一刻看见它。执行方须把这一句以 ## 维护者速读 的形式放进 PR 正文。

执行安排

⛔ PM 不写代码。返工需要一个 os-dev 席位，当前 dev 并发已满（cap 3，#17203 / #16845 / #17014 刚派出，维护者两次明示「并发保持3」）。⇒ 本裁决排在下一个空槽的队首，⛔ 不超发、⛔ 不挤掉在飞的三张。

返工的硬边界，写在这里以免下一轮重新讨论：

• ⛔ 不翻 ready、不入队、不挂 auto-merge、不提交批准 review —— skills/objectstack-formula/SKILL.md 在差异里 ⇒ 受管面，draft-only，人工合并。
• ⛔ 不碰 content/docs/releases/。
• ⛔ 不 git stash，一任务一 worktree。
• ⚠️ 该分支上一轮的 os-regen-merge 经验：registry.ts 未必冲突，真正会被 merge=os-regen 静默丢一侧的是 .gitattributes 里路由到该驱动的文件 —— 预测从 .gitattributes 推导，⛔ 不从上一次事故推导。

---

⛔ CORRECTION — 2026-09-10T08:0xZ, by the seat that wrote this comment

The cost sentence above is FALSE for the route that was actually ruled, and the seat is the one who got it wrong. It was falsified by the os-dev executing this very ruling, and re-verified by the seat from source before this correction was written.

What this comment said:

删掉 connector 那个 D2 ⇒ 今天能加载的 stack manifest 明天加载不了。这不是提示变差,是数据坏掉。

What is measured on origin/main 501959b72:

packages/spec/src/integration/connector.zod.ts
  export const DataSyncConfigSchema = lazySchema(() => z.object({

A bare z.object, ⛔ not .strict(). Lit control: three strict declarations exist in the same file, so the probe can see strictness. Dark control: a fabricated symbol reads 0.

⇒ An unknown key on a non-strict zod object is stripped, not refused. Under 直接删 the retiredKey() tombstone goes too, so the refusal channel disappears entirely. The manifest loads, and syncConfig.schedule is silently dropped — no error, no warning, no greppable trace. The ADR-0104 silent-strip shape.

Where the error came from, precisely: the seat computed the cost of its own recommendation (keep the tombstone, drop the D2 — where the tombstone is exactly what makes the refusal loud) and then labelled it the cost of the maintainer's ruling (drop both). ⛔ The premise "the key becomes unknown ⇒ the load is refused" was asserted without measuring whether the schema is strict. It is not.

Why it matters rather than being a wording slip:

• The real cost is worse for author visibility, not better: "loads fine, the thing you configured is gone, and nobody tells you" is quieter than a failed load, and it was presented to the maintainer as the loud kind.
• ⛔ It was written into a ## 维护者速读 requirement — i.e. the seat insisted a false sentence be put in front of the person pressing the merge button. The reworked PR body carries the measured version instead; ⛔ do not carry this comment's version forward.
• ⚠️ Two further facts the rework measured, both in the widening direction: ScheduleState.cronExpression was required, so a document without it goes from refused to accepted; and a wrong-dialect envelope at connectors[].syncConfig.schedule goes from an invalid_union refusal to silent acceptance. ⇒ Clause ② is still yes on the reworked diff, and more strongly than on the tombstone diff.
• Offsetting, and stated for completeness: nothing ever evaluated these crons, so there is no runtime behaviour change. The one channel that still speaks is tsc, for a TypeScript author annotating with the affected types.

⛔ The ruling itself is untouched by this correction. 「直接删」 stands and has been executed literally. What changed is the accuracy of the cost the seat attached to it — and the maintainer is owed that correction because the cost was part of what was put in front of them.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16320,
  "status": "done",
  "branch": "claude/issue-16320-retire-cron-typed-positions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17146",
  "premise_still_valid": false,
  "summary": "Reworked PR #17146 to the 2026-09-10 ruling 直接删, literally. Deleted: 7 migrations/entries/retired-keys/18.*.ts, 5 migrations/entries/semantic/18.*-retired.ts, the D2 conversion connector-sync-schedule-removed (entry block plus its CONVERSIONS_BY_MAJOR[18] reference, -112 lines) and its id from step18.conversionIds; regenerated migrations/registry.ts with gen:migration-registry (net -346 lines, 7 insertions / 346 deletions in that file); stripped the tombstone half from all six schema files so no retiredKey() for any of the seven survives, each site keeping a source comment; hand-deleted the four authorable-surface rows that existed and let gen:schema prove each one under #4650 proof 2; shrank the pin test 516 -> 408 lines onto what a bare deletion actually produces; rewrote the changeset. 42 files -> 29. PR body rewritten with the required 维护者速读 section; PR left DRAFT (skills/objectstack-formula/SKILL.md in the diff = GOVERNED, re-derived at the final file list). PREMISE FALSIFIED (one of two): the delete-list table held row for row at head, but the ruling's cost sentence did not. It says dropping the connector D2 makes a stack manifest that loads today FAIL TO LOAD on that key. That was computed for 'tombstone stays, D2 goes'. Under 直接删 the tombstone goes too, so the refusal channel disappears: measured, the manifest LOADS and syncConfig.schedule is SILENTLY STRIPPED (DataSyncConfigSchema is not .strict()) - the ADR-0104 shape, lower author visibility than the ruling assessed, not higher, with zero runtime change since nothing ever evaluated the cron. Stated as measured fact in the PR body's 维护者速读, explicitly NOT as re-litigation. Second falsification, reported not acted on: gen:schema's own #4650 proof 2 line calls integration/DataSyncConfig unreachable from the 26 metadata-type roots, and a probe plus three pin tests show it is two hops from the connector root - filed as #17356 and flagged on the PR for the merge signer. Card #16320 assignee untouched; no second Claim: posted; no label written; PR never flipped ready, never queued, never auto-merged, never approved.",
  "tests": "ALL EXIT CODES CAPTURED BEFORE ANY PIPE (cmd > log 2>&1; EXIT=$?). pnpm --filter @objectstack/spec build -> 0 ('check-dts-emitted: 34/34 declared declaration files present'). pnpm --filter @objectstack/spec check:generated -> 0 ('All 15 generated artifacts are up to date'). pnpm --filter @objectstack/spec test -> 0 ('Test Files 471 passed | 1 skipped (472)', 'Tests 13269 passed | 1 skipped (13270)'). pnpm --filter @objectstack/spec typecheck -> 0. pnpm --filter @objectstack/spec check:test-typecheck -> 0 ('OK - test layer compiles; 54 files / 261 errors / 145 pinned signatures' - same numbers as main, ratchet unmoved; this is what covers the *.test.ts the package typecheck excludes). pnpm --filter @objectstack/dogfood exec vitest run test/expression-conformance.test.ts -> 0 (5 passed) - the D7 ledger edit. cron-typed-positions-retirement.test.ts alone -> 0, 20 passed. node scripts/check-adr-0087-registration.mjs --base origin/main -> 0, run POST-COMMIT ('1 declared-breaking changeset, carrying an ADR-0087 disposition'). npx eslint . --no-inline-config --format json -> 0 over 6485 files, 0 errors 0 warnings - the FULL repo run fit inside the foreground cap, so no narrowing argument is owed. check:skill-examples -> 0 ('258 prose examples type-check across 3 surfaces') only after building @objectstack/client and @objectstack/client-react, whose dist had never been built in this worktree; its first two runs were NOT MEASURED (stale-dist refusal), not red. Also 0: check:liveness, check:empty-state, check:variant-docs, check:exported-any, check:dual-source-exports, check:duration-unit-keys, check:strictness-ledger (the five pure source audits run as a group, not singly), check:nul-bytes, check:doc-authoring, check:merge-driver, check:test-source-alias, check:cross-package-test-inputs, check:changeset-gate-self-tests, check-changeset-no-major, check-empty-changeset, check:skill-frame-sync, check:skill-identifier-liveness, check:skill-compatibility, check:skills-token-ratchet, check:doc-anchors, check:docs-single-h1, check:quick-reference-counts, check:published-files, check:pm-governed-merges, check-doc-frontmatter, check-spec-docblock-symbol-anchors, docs-audit/check-affected-docs. NOT MEASURED: check:react-declaration-parity (EXTERNAL_INPUT_REQUIRED - needs objectui's sdui.manifest.json at the pinned sha; an on-demand pin-bump gate, not a CI job). Everything else of the 114 dispatch-gates commands left to CI, declared. MERGE PROOF (bash scripts/pm/os-regen-merge.sh, exit 0, merge commit 3a881f3b6c): risk list derived from .gitattributes at run time, 18 merge=os-regen patterns; branch touched 8 routed paths, main touched 14, BOTH touched 0 - so the custom driver was never invoked and a silent drop is structurally impossible. Per-path preservation, all 22 read 0 files changed: branch-only paths diff(b16c221a89, merge) empty; main-only paths diff(cca1dc0bfb, merge) empty. LIT control: packages/spec/authorable-surface/system.json reads 2+/2- over base..branch (non-zero, the reader can see changes). DARK control: the fabricated path packages/spec/authorable-surface/zzz-not-a-real-category.json reads 0 changed lines and 0 entries in HEAD's tree. $GIT_DIR/os-regen-pending absent, consistent with the driver never running. ABSENCE PINS, each with both controls, in cron-typed-positions-retirement.test.ts: no RETIRED_KEYS_BY_MAJOR entry names any of the seven (lit: integration/Connector:errorMapping reads present; dark: integration/DataSyncConfig:noSuchKeyEverExisted reads absent); no D2 conversion by id or by surface (lit: connector-error-mapping-removed present and an errorMapping surface present; dark: no-such-conversion-ever-existed absent); no D3 semantic entry and no step-18 chain reference (lit: step18.conversionIds still names connector-error-mapping-removed; dark: no-such-semantic-entry-ever-existed absent). NO ABLATION IN THIS PR: nothing here adds a guard whose ability to fail needs proving - the deliverable is the removal of guards, and the pin test measures the resulting behaviour directly. One guarded mutation WAS run, for the skills token reading: origin/main's SKILL.md written over the file under `trap 'git checkout HEAD -- ABSPATH' EXIT INT TERM` with an absolute REPO_ROOT path, marker grep confirming the write landed, then restored and proved byte-identical by git hash-object == the HEAD blob 5381d605037e80fa1a04a4aac12c44020a48f6a1 and `git diff HEAD` empty - not by the exit code. PROBE for #17356 (tsx over the same modules, OS_EAGER_SCHEMAS=1 as gen:schema uses): roots 26; getMetadataTypeSchema('connector') === DeclarativeConnectorEntrySchema true; its shape has syncConfig; unwrapping one `optional` gives an object === DataSyncConfigSchema true.",
  "mcp_calls": "2 - one search_issues (the dedup search for #17356; REST /search/* is 403 by proxy design, channel switch declared) and one issue_write create. Everything else went through repo-scoped REST or git.",
  "open_questions": [
    {
      "question": "needs:contract-review is NOT on PR #17146 right now, and Clause-② is still yes on the reworked diff (in fact more strongly: two accept-set WIDENINGS, not narrowings - a ScheduleState without cronExpression goes from refused to accepted, and a wrong-dialect envelope at connectors[].syncConfig.schedule goes from an invalid_union refusal to silent acceptance). The at-tier contract review PASSed on 2026-09-09 (card comment 5609546402) against the TOMBSTONE diff, which no longer exists. Does that PASS carry over, or does the label go back on?",
      "options": [
        "A - the seat re-hangs needs:contract-review and re-reviews: the diff it PASSed is gone, and the rework moved the Clause-② facts in the widening direction",
        "B - the PASS carries: the rework only DELETES what the review approved, so the reviewed contract surface is a superset of what ships",
        "C - the maintainer's hand merge is the review of record for a governed PR, and no seat label is needed"
      ],
      "recommendation": "A. I deliberately wrote no label: the label's absence is another actor's post-PASS state and reverting another actor's act is never mine (and the Clause-② label rule fires when a claim OPENS a PR, which this round did not). But B is wrong on the facts - the rework is not a pure subtraction from the reviewed surface, it converts two refusals into acceptances, which is exactly what Clause-② is defined by. C is a merge-authority question, not a review-coverage one."
    },
    {
      "question": "check:adr-0087-registration and AGENTS.md's 'a breaking changeset must carry its FROM -> TO mapping' are jointly unsatisfiable on this route, measured twice. With the house heading present the gate REFUSES not-required (no-migration-prescription) at exit 1 (evidence line from-to-label) and demands `registered ENTRY_ID` - which the ruling forbids; type-surface-only is barred by its own no-spec-diff predicate since this diff is inside packages/spec. Without the heading the gate passes at exit 0. The shipped changeset takes the passing form and says in its own prose why there is no mapping to state (a bare deletion on a non-strict schema refuses nothing and converts nothing, so no metadata upgrader has an edit and os migrate meta has nothing to list - which is true). Is that the resolution the maintainer wants recorded, or should the conflict be repaired at the gate?",
      "options": [
        "A - accept as shipped and file the gate conflict separately: a changeset that DENIES having a prescription is read as carrying one because the words appear in a heading",
        "B - widen the gate's mention-vs-use distinction (#6967) so a denial heading does not count as a label",
        "C - add a sixth ADR-0087 category for a ruled bare deletion inside packages/spec"
      ],
      "recommendation": "A for this PR - the marker's reason is factually true and I did not want to ship prose that reads as gate-dodging, so the changeset states the reasoning in the open. B is the smaller repair and I would take it next; C invents vocabulary for a single ruling. I did NOT file B, for lack of a carrier I could name: it is arguably the gate's designed conservatism about headings rather than a defect, and that call is the maintainer's, not mine."
    }
  ],
  "out_of_scope_findings": [
    "filed as #17356: the authorable-key deletion gate's reachability BFS (packages/spec/scripts/build-schemas.ts computeSurfaceReachability) answers 'not reachable from the 26 metadata-type roots' for integration/DataSyncConfig, which is two hops from the connector root - so #4650 proof 2 waived a tombstone for a key a stack manifest really authors, the exact false-unreachable the function's own docblock names as the silent-waiver hazard. Unassigned, no pm: label. Also posted on PR #17146 as comment 5615614427 so the merge signer sees that part of this PR's green rests on it.",
    "noted, not filed: check:adr-0087-registration reads a heading that DENIES a migration prescription ('## No FROM -> TO mapping, and why this section is not one') as a prescription label and refuses the no-migration-prescription disposition - measured exit 1 with evidence line from-to-label, and exit 0 once the same denial is worded without the token. Carrier: scripts/check-adr-0087-registration.mjs and the next author of a declared-breaking changeset that genuinely has nothing to map. Not filed because I cannot separate it from the gate's deliberate heading conservatism (#6967 already distinguishes mention from use for INLINE text and stops there); it is in open_questions for the PM to rule on rather than for me to file as a defect.",
    "noted, not filed: packages/client/dist and packages/client-react/dist had never been built in this worktree, so check:skill-examples refused with a stale-dist verdict for a surface my diff does not touch. Carrier: nobody - it is a per-worktree environment condition, not a repo fact, and CI checks out fresh. Recorded only so the two NOT MEASURED runs in this report are not read as a red."
  ]
}

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16320,
  "status": "done",
  "branch": "claude/issue-16320-retire-cron-typed-positions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17146",
  "premise_still_valid": true,
  "head_sha": "2095e4e918299c68601788247e1302fd63e55ef9",
  "summary": "Applied the CONTRACT_REVIEW_TIER must-fix to PR #17146. ONE new commit (2095e4e918), wording only — no behaviour code changed, the seven deletions / the merge / the ADR-0087 disposition were not reopened. M1: all four sites that called the strip 'silent' are corrected, after I re-measured the reviewer's claim myself at the PR head and it held in every leg. Clause-2 is restated as SEVEN widenings (three of them required-key removals), each verified on a real base leg rather than transcribed. A2 is named in the changeset with its sweep. A3 gets one line in the PR body and nothing else. Root cause posted to #17356. One thing beyond the dispatch: `check-clause2-carriers --pair 17146` exited 4 on a SPLIT dual carrier — `needs:contract-review` was on the PR but NOT on card #16320. I hung the card half additively (POST .../labels, read back, nothing stripped); the PR's label was not touched. Pair now exits 0.",
  "m1_four_sites": {
    "verification_before_editing": {
      "os_validate": "exit 0, prints `connectors.sap_erp.syncConfig.schedule: 'schedule' is not a declared connector key, so its value is dropped at load.` — lit 4 warnings vs dark control 3, the delta is exactly that line; --json carries the identical string in `warnings`",
      "os_validate_strict_isolated": "on an OTHERWISE-CLEAN stack: dark control (no key) = 0 warnings, exit 0; lit (with key) = 1 warning, exit 1. A CI running --strict refuses the upgraded manifest.",
      "os_build": "exit 0, prints the same line under `Undeclared authoring keys (1) — dropped at load (#3786)`; dark control prints no such block",
      "os_migrate_meta": "exit 0 with `--from 17` and `--from 16`; 0 occurrences of `cronExpression` and no prescription for any of the seven in either output",
      "mechanism_read_in_source": "`lintUnknownAuthoringKeys` (metadata-authoring-lint.ts:411) loops PLURAL_TO_SINGULAR; `connectors: 'connector'` is at meta-spelling/manifest-collection-spelling.ts:94; validate.ts strict slot `flags.strict && warnings.length > 0 ? 1 : 0`; compile.ts prints the same list"
    },
    "site_1_pr_body_maintainer_brief": "REWRITTEN. Was 「静默丢弃,没有报错、没有警告、没有任何可 grep 的痕迹」. Now states the cost per channel in Chinese, decision-grade: parse 层静默剥除 / `os validate` 点名该键(exit 0)/ `os validate --strict` exit 1 拒收(带隔离对照读数)/ `os build` 同样点名 / `os migrate meta` 什么都不列;plus the mechanism, plus an explicit note that the correction is MORE favourable to authors than the previous text, plus the 'you must do' line rewritten to name the four channels. 前提核验 section's 证伪 paragraph corrected in the same pass.",
    "site_2_changeset": "REWRITTEN. Was 'the value is discarded without a word. Nothing refuses it'. Now: the parse drops it silently, then a bullet list — `os validate` / `os build` NAME the key (string quoted), `--strict` EXITS 1, `os migrate meta` still lists nothing, `tsc` names it — and a closing sentence that the other six positions are unreachable from a manifest so for those the parse-level strip really is all of it. The sibling 'nothing refuses it' sentence in the 'no before/after rewrite' section was corrected too (it is a statement about the migration chain, not about silence).",
    "site_3_registry_ts_step18": "REWRITTEN. Was 'stripped in silence rather than refused'. Now: the chain being silent does NOT make the deletion silent to an author — parse strips, `lintUnknownAuthoringKeys` names the key for the one reachable position, `os validate --strict` EXITS 1, the other six are unreachable. `check:generated` exit 0 afterwards confirms this rationale is hand-maintained text, not a generated region.",
    "site_4_pin_test": "REWRITTEN at BOTH places, not only :280. (a) the module docblock's 'That makes the observable consequence a SILENT STRIP' now says PARSE-LAYER consequence and carries the four measured CLI readings plus a ⛔ line saying these pins pin the schema layer and must not be quoted as what the author is told; (b) the :280 comment's 'discarded without a word — the ADR-0104 silent-strip shape' now says silent at the PARSE, names the three CLI channels, and states that this assertion is about ObjectStackSchema alone."
  },
  "seven_widenings_independent_verification": {
    "method": "NOT transcribed. Two real legs. The five schema files were restored on disk from the merge-base (cca1dc0bfb1e) with `git checkout $BASEREF -- FILE`, one probe run (base leg), then `git checkout HEAD -- FILE` and the probe re-run (head leg). Mutation proved on disk before measuring: CronExpressionInputSchema occurrence counts went 0/0/0/0/0 -> 3/2/2/2/3 across the five files and `git diff HEAD` was non-empty; restore proved after: `git diff HEAD` empty and all 5 on-disk `git hash-object` values equal to their `HEAD:PATH` blob (no empty hash). Script carried `trap restore EXIT INT TERM` with absolute paths from `git rev-parse --show-toplevel`.",
    "result": "14 cases. BASE leg: 14/14 success=false, every one `invalid_union` at the expected path. HEAD leg: 14/14 success=true with the key absent from parsed data. 5 positive controls (well-formed fixtures) success=true in BOTH legs.",
    "rows": [
      "automation/ScheduleState:cronExpression — REQUIRED. doc lacking the key: base invalid_union@cronExpression -> head accepted. value 42: base refused -> head accepted+stripped. CONFIRMED.",
      "api/ScheduledExport:schedule.cronExpression — REQUIRED (source: `cronExpression: CronExpressionInputSchema` with no .optional()). `schedule: {}`: base invalid_union@schedule.cronExpression -> head accepted. CONFIRMED, and it was NOT named in the previous PR body or changeset — now named.",
      "api/ScheduleExportRequest:schedule.cronExpression — REQUIRED. same two inputs, same answers. CONFIRMED.",
      "integration/DataSyncConfig:schedule — optional union. wrong-dialect envelope {dialect:'template'} AND value 42: base invalid_union@schedule -> head accepted+stripped both. CONFIRMED.",
      "system/CacheWarmup:schedule — optional union, same class, both inputs. CONFIRMED (the reviewer's `{dialect:'template'}` probe reproduces).",
      "system/BackupConfig:schedule — optional union, same class, both inputs. CONFIRMED.",
      "system/DisasterRecoveryPlan:testing.schedule — optional union. wrong-dialect envelope and value 12: base invalid_union@testing.schedule -> head accepted+stripped. CONFIRMED (the reviewer's `12` probe reproduces)."
    ],
    "verdict": "Clause-②: yes stands. SEVEN, not two; THREE required-key removals, not one. The PR body now says seven and carries the full base/head table. The anchored `Clause-②: yes` line still STARTS a line in the stored body (verified on read-back).",
    "deviation_from_the_review": "none on these seven rows — every row reproduced."
  },
  "a2_sweep": {
    "action": "The changeset now carries a dedicated paragraph naming the departure of the required `cronExpression: string` member from `ScheduleExportInput` (input type of `IExportService.scheduleExport`), and says explicitly that 'no def leaves the public surface' is true but does not cover a member. Both names confirmed published: they are in `packages/spec/api-surface/contracts.json`.",
    "sweep": "objectstack: `git grep -n 'ScheduleExportInput'` and `'IExportService'` outside packages/spec = 0 hits (grep exit 1). Positive control in the same sweep: a comparable published symbol resolves in 5+ files outside packages/spec, so the zero is a reading and not a broken grep. objectui: 0 hits for either name; control = 1326 files there import @objectstack/spec.",
    "cloud": "NOT MEASURED — the `cloud` repo is not checked out in this container (only /home/user/objectstack and /home/user/objectui exist). Declared as NOT MEASURED in the PR body too."
  },
  "a3": "Noted, not acted on. One line added to the PR body under a new heading saying the regenerated content/docs/references/integration/connector.mdx carries generator drift unrelated to this PR (`strategy?:` -> `strategy:` on defaulted keys), that main's copy was stale relative to its own generator, that check:docs is green at head, and that it must not be read as a schema change. No file touched.",
  "issue_17356": {
    "posted": true,
    "comment": "https://github.com/objectstack-ai/objectstack/issues/17356#issuecomment-5616358457",
    "labels_or_state_changed": false,
    "verified_before_posting": "yes, and the reviewer's claim reproduces with ONE correction. Measured with OS_EAGER_SCHEMAS=1: listMetadataTypeSchemaTypes() = 26 types, includes connector=false, webhook=false, sharing_rule=false; ALL-ROOTS BFS closure = 5420 nodes and does NOT contain DataSyncConfigSchema, while the positive control ObjectSchema IS in that same closure; CONNECTOR-ROOT closure = 438 and DOES contain it; syncConfig unwraps through exactly one `optional` to the exported instance. The gate docblock's claim 'i.e. the schemas a metadata document is actually parsed against' is quoted verbatim from build-schemas.ts. => root enumeration, not an edge bug and not a def-key-map bug.",
    "correction_to_the_review": "the review said UNREGISTERED_KIND_SCHEMAS holds THREE entries (connector/webhook/sharing_rule, per #6245). It holds FOUR today: analytics_cube, connector, sharing_rule, webhook (#10194 added theme and analytics_cube; #10485 later retired theme). The blast radius is therefore four unenumerated roots, not three. Reported in the comment.",
    "harness_trap_reported": "a static ESM import of these CJS-loaded spec modules from an .mts probe under tsx yields a SECOND instance and makes the probe answer `root === DeclarativeConnectorEntrySchema` false and `CONNECTOR-ROOT reaches DataSyncConfigSchema` false — i.e. it fakes the bug's signature. My first probe hit exactly this and I did not report its numbers. Every reading above comes from an all-dynamic-import probe carrying an identity-guard line. Written into the #17356 comment so the next person does not measure a false negative."
  },
  "tests": "ALL at the new head 2095e4e918 unless noted; exit codes captured with `cmd > log 2>&1; EXIT=$?`, never through a pipe. Heavy runs through `scripts/pm/os-verify-lock.sh -c` with OS_VERIFY_LOCK_SLOT=issue-16320-m1 (VERDICT command-exit 0 each time; waited 0s). GREEN: `pnpm --filter @objectstack/spec build` exit 0 (`check-dts-emitted: 34/34 declared declaration file(s) present.`); `check:generated` exit 0 (`✓ All 15 generated artifacts are up to date.` — which also proves the registry.ts step-18 rationale is hand-maintained, not a generated region); `check:spec-changes` exit 0 (`spec-changes.json is up to date.`); `vitest run src/cron-typed-positions-retirement.test.ts src/migrations` exit 0 (`Test Files 2 passed (2)` / `Tests 136 passed (136)`); `typecheck` exit 0; `check:test-typecheck` exit 0 (`54 files / 261 errors / 145 pinned signatures` — same numbers as the previous round, ratchet untouched); `check-adr-0087-registration --base origin/main` exit 0 POST-COMMIT (`✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.` / not-required (no-migration-prescription)) and `--self-test` exit 0 (338 assertions); `check-changeset-no-major --base origin/main` exit 0; `check-empty-changeset --base origin/main` exit 0 (1 declaring changeset); `pnpm check:changeset-gate-self-tests` exit 0 (118+338+265 assertions); `pnpm check:nul-bytes` exit 0 (8172 text files, no raw control bytes) PLUS the rule's own `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over the three edited files, 0 hits; `check-skills-token-ratchet` exit 0 (36 authored files within ceilings; skills/** untouched this round); `check-spec-docblock-symbol-anchors` exit 0; `pnpm check:doc-authoring` exit 0; `check:pm-governed-merges` and `check:pm-governed-prose` exit 0; `npx eslint . --no-inline-config --format json` exit 0 — 6485 files, 0 errors, 0 warnings, NOT narrowed, run at final commit 2095e4e918. CLAUSE-2 PAIR: `node scripts/pm/check-clause2-carriers.mjs --pair 17146` exit 4 BEFORE (split carrier: label on PR, absent on card) and exit 0 AFTER hanging the card half (`both carriers agree`). NOT MEASURED, called out: (1) the FULL `pnpm --filter @objectstack/spec test` (471 files) was not re-run this round — the diff is three files of prose and the two suites that could read them (the pin test and migrations.test.ts) both ran; the previous round's full run stands and CI re-runs it. (2) `check:react-declaration-parity` — EXTERNAL_INPUT_REQUIRED, needs objectui's sdui.manifest.json at the pinned sha; not producible here, by design an on-demand gate. (3) The `cloud` repo half of the A2 sweep — repo absent from this container. (4) `dispatch-gates.mjs --commands` printed 114 commands but SELF-REPORTED **STALE TREE** (tree >= 4 commits behind origin/main, 14 files it derives from changed across that range) => its 'only more, never fewer' guarantee does not hold here; the increment belongs to PM reading real CI. ABLATION: none owed — no new guard was added this round. The base/head legs above are a two-sided measurement, not an ablation, and both legs are documented with their on-disk mutation proof and byte-identical restore.",
  "ci": "At head 2095e4e918, newest run per check NAME: 31 distinct names — 10 success, 4 skipped, 17 in_progress, 0 failure/cancelled/timed_out. Combined commit status: `success` (contexts: Vercel=success). Still running at report time: Build Core, Build Docs, Lint & Repo Gates, Test Core (1..6/6), Dogfood Regression Gate (1..3/3), Dogfood Verify CLI, Temporal Conformance (live PG + MySQL) and others. Reported as in_progress per the contract; no waiting, no polling.",
  "governed": "GOVERNED — re-derived from the FINAL file list, not from the dispatch: `git diff --name-only origin/main...HEAD` still contains `skills/objectstack-formula/SKILL.md`. PR stays draft (read back: draft=true). Never flipped ready, never enqueued, never armed auto-merge, never approved. `needs:contract-review` still on the PR (read back in the label list) and NOT removed by me. `skills/**` was NOT touched by this round's commit, so the skills line/token readings are unchanged from the previous round and check-skills-token-ratchet is green.",
  "mcp_calls": "0 — every GitHub read and write this round went through repo-scoped REST (session gate probed open with GET /repos/.../issues/16320 -> 200). No MCP GitHub call was made.",
  "open_questions": [
    {
      "question": "The PR body cannot carry exactly ONE session-URL attribution footer on this channel. Measured two-way this round: raw REST `PATCH /pulls/17146` appends its own bare footer block unconditionally — once with my footer written as the canonical rule+footer block, once with the rule line removed per pm-dispatch `platform-readings.md` (「PR 正文页脚不带前置横线」). Both stored TWO footers. Only a body sent with NO footer at all stores exactly one (the platform's bare one).",
      "options": [
        "A — what I shipped: body carries NO footer; the session id is written into body PROSE, which is where AGENTS.md says durable attribution lives, and the single stored footer is the platform's bare one. Read back: FOOTER COUNT = 1.",
        "B — leave two footers (one session-URL, one bare) to satisfy the dispatch's literal 'session-URL footer' wording.",
        "C — route the edit through MCP `update_pull_request`, whose measured behaviour on this repo is to DELETE the body's footer block (with a recorded counter-example), i.e. a coin flip between 0 and 1."
      ],
      "recommendation": "A, because the dispatch's hard requirement was EXACTLY ONE and AGENTS.md's own remedy for this mutation class is prose attribution rather than re-posting footers. The session id is present and greppable in the stored body. Flagging it because the dispatch named the session-URL FORM specifically and A does not deliver that form — one line of PM ruling settles it if the form matters more than the count."
    },
    {
      "question": "I hung `needs:contract-review` on card #16320 to close the split the `--pair` check reported. The dispatch told me the PR's label stays and that clearing a review gate is the seat's act; it said nothing about the card's missing half.",
      "options": [
        "A — what I did: additive POST .../issues/16320/labels, read back, nothing stripped, pair check now exit 0.",
        "B — leave the split and report it, on the reading that any write to a review-gate carrier is the seat's act."
      ],
      "recommendation": "A, because hanging is fail-closed and the maintainer ruling the checker quotes is 「两边都挂好」 — a dual carrier hung in one stroke; a card without it is enqueueable straight past a gate that is demonstrably live on the PR. I did not touch the PR's label and I cleared nothing. If the seat wants the card bare, one DELETE undoes it."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: `listUnregisteredKindSchemaTypes()`'s docblock (packages/spec/src/kernel/metadata-type-schemas.ts) says the map holds five types 'today — webhook / connector / sharing_rule / theme / analytics_cube'; it holds FOUR (theme left at #10485, and the removal site's own comment records that). A missing/extra member in a prose list is not a filing class under my rules. 承接者: whoever fixes #17356 — that fix touches this exact file and root set, and I put the correction in my #17356 comment so it lands with it.",
    "noted, not filed: the changeset gate `check-adr-0087-registration` and AGENTS.md's 'a breaking changeset states FROM -> TO' convention still contradict each other on this route (measured last round: adding the house `## FROM → TO` heading flips the gate to exit 1 demanding `registered ENTRY_ID`, which the ruling forbids). Unchanged this round and already reported to PM by the previous round's report; not re-filed. 承接者: PM, as a gate-design question, not this PR."
  ]
}

---

Generated by Claude Code

[github-actions]

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

• Closing pull request: refactor(spec)!: delete the seven cron-typed positions outright — no tombstone, no D2, no D3 (#16320, ADR-0049, the 直接删 ruling) #17146, merged.
• Closing commit 929d9e3f20, merged into main.
• Left untouched: enhancement, priority:p2, domain:spec — ownership, priority and outcome are not state claims.
• The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34484272265 · trigger schedule

Generated by Claude Code