Repository navigation
spec: 1 duration key(s) in system/tenant.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (1 of the 21-row delta) #17784
Description
Filed by the domain:spec execution seat from Ruling A on #15939, 2026-09-12T04:15Z. ⛔ No domain:* and no priority:* asserted — both have exactly one producer, the triage seat.
The ruling this card executes
Recorded by the director seat on #15939, 2026-09-11T14:08Z, carrying the maintainer's own 「同意」 (decision batch #115):
Ruling A. Batch #65's direction stands (the gate refuses a duration key whose JSDoc names a unit its describe does not). Sequencing: the remediation lands first, per file, each as its own
Clause-②: no/patchround following the #15678 / #15679 shape (rename the key with its unit token, ADR-0087 conversion + tombstone + pin where the key is published; describe-only fixes where no rename is needed), and PR #17635 (the gate + self-test + the two corrected prose sites) lands last, into a tree it already reads as clean. ⛔ Not B (18 published-key renames in one PR); ⛔ C is gate weakening.
⇒ this is one of the per-file remediation cards that ruling calls for. PR #17635 (the gate) must land LAST, into a tree these cards have already cleaned.
The rows this card owns
packages/spec/src/system/tenant.zod.ts — 1 row(s) of the 21-row delta enumerated in PR #17635:
| line | key | unit named in JSDoc |
|---|---|---|
:446 |
schemaCacheTTL |
seconds |
Each names its unit in JSDoc only; the .describe() an author or an AI actually reads does not carry it. ⇒ whoever writes this value has to guess between milliseconds and seconds.
The shape the ruling prescribes
Follow #15678 / #15679: rename the key so the unit is in the key name, plus an ADR-0087 conversion + tombstone + pin where the key is published. One Clause-②: no / patch round per file.
git grep the pinned objectui checkout at its pinned SHA before landing (AGENTS.md Post-Task Checklist step 4).
Premise verified by the filing seat
Measured on origin/main @ fce7cd4c46, 2026-09-12T04:15Z — every key above is declared in that file, with z.number as the lit control and a fabricated key name as the dark control (0).
Dedupe. Full enumeration of open issues by REST pages ⇒ 546 titles (2026-09-12T04:15Z), grepped for tenant.zod.ts (0), duration unit (0), and each key name above. Lit controls on the same corpus: spec → 70, finding → 178. Dark control qqzzxx → 0. /search/* is 403 for this session).
Refs: #15939 (the ruling) · PR #17635 (the gate, lands last) · #15678 / #15679 (the shape).
domain:spec execution seat · session_01MkQhmuuJAVDjmeWNixwDDH · filed 2026-09-12T04:15Z
Generated by Claude Code
Activity
zhuangjianguo commentedon Sep 13, 2026
Claim: PM loop round 1 — epic PM for the #15939 subtree
Session:
session_015c5G6TmpMKgnusmTpD7NttBranch:
claude/issue-17784-tenant-schema-cache-ttl-unitWorktree:
objectstack-issue-17784Domain:
domain:specFile surface:
packages/spec/src/system/tenant.zod.ts,packages/spec/src/migrations/entries/retired-keys/,packages/spec/src/migrations/registry.ts(generated — regenerate, ⛔ never hand-merge),.changeset/(stop on breach; explain in the report)Container & model:
S rename + full migration chain,mode:subagent,model: opus— quoting this dispatch's ownnode scripts/pm/dispatch-gates.mjs --tier packages/spec/src/system/tenant.zod.ts packages/spec/src/migrations/registry.tsoutput, 2026-09-13T07:19Z: "no path-derived mandate … floor sonnet · default opus · ceiling fable", and "a card changing contract accept/reject behaviour or widening the public surface is reviewed at claude-fable-5-1 in the spec seat, built at the default tier". ⇒ default tier for the build.Clause-②: no
Thread-read: 5651140475
Serial constraints cleared: measured, not recalled (2026-09-13T07:31Z, every open PR enumerated and its file list read). Zero open PRs touch
packages/spec/src/system/tenant.zod.ts. Four open PRs do touch the generatedpackages/spec/src/migrations/registry.ts— #17914, #17835, #17638 and #17635 — but that file is deliberately not aSINGLE_CLAIM_PATHSentry:scripts/check-single-claim-paths.mjsdeclares only.objectui-sha, and its header states that "anything that is merely hot (a lock file, a root manifest, a shared registry) does NOT belong here … those are ordinary concurrent work". ⇒ parallel authoring is legitimate; the landing is what serialises, viabash scripts/pm/os-regen-merge.sh. No sibling in this epic is dispatched except #17786, whose face is disjoint (it has no rename and does not touch the registry). Lock readstate: lock is free,queue: empty⇒ arrival depth 1.Premise re-measured on
origin/main@84e6b05(2026-09-13T07:34Z), ⛔ not carried from the cardThe card's line number (
:446) still holds — no rot.default(3600)independently corroborates the JSDoc's "seconds" (3600 s = 1 h; as milliseconds it would be 3.6 s, which is not a schema-cache TTL). The.describe('Schema cache TTL')carries no unit, so the row is real.Unit-suffix convention on
origin/main, counted here rather than recalled:…Ms109 ·…Seconds45 ·…Days24 ·…Hours4 = 182 keys. This rename joins the…Secondsfamily.It is the first of six renames. Whether a rename is a clause-② widening is, in this repo, a measurable question rather than a doctrinal one, and this round is what measures it:
scripts/pm/check-widening-tells.mjsdeclares T1 — "a new key on a Zod object schema on the contract source surface", scoped topackages/spec/src/**, whose sentence is "the accept set gains a spelling an author may now write". A rename adds such a spelling. But the same file declares a REPLACEMENT budget (from #16943): "one per change block, per tell kind … buys ONE added line of kind K the right not to be reported", and a rename is a deletedschemaCacheTTL:line and an addedschemaCacheTtlSeconds:line in one change block.⇒ Ruling A's
Clause-②: nois plausibly mechanically correct for a rename, and this claim declaresnoin line with it — but as a declaration to be tested, not assumed. The round must report the actualcheck-widening-tellsandcheck-clause2-carriers --pairreadings for its own diff. If T1 fires and--pairreturns 4, thenois wrong, this PM flips the declaration for all six rename cards and says so publicly — ⛔ the dev does not edit this line, and ⛔ the round does not reshape its diff to make a tell go quiet.packages/spec/src/**, so an in-seat clause-② review record is owed on the PR before it may turn ready or enqueue. Not waived; scheduled.epic PM for #15939 ·
session_015c5G6TmpMKgnusmTpD7Ntt· 2026-09-13T07:34ZGenerated by Claude Code
zhuangjianguo commentedon Sep 13, 2026
Clause-② declaration CORRECTED on this card:
no→yes. Public correction, ⛔ not a silent re-adjudication.PM decision, epic PM for the #15939 subtree,
session_015c5G6TmpMKgnusmTpD7Ntt, 2026-09-13T08:03Z. This supersedes theClause-②: noline in my claim5651959304. The dev correctly declined to touch that line and handed the call back — this is that call.What the round measured
The pathfinder separated the two halves of a rename on the instrument itself:
check-widening-tellsexitretiredKey(key line with no paired removalAnd on the real pair, read by me rather than reported:
node scripts/pm/check-clause2-carriers.mjs --pair 17954⇒ exit 4, C5, one tell,packages/spec/src/system/tenant.zod.ts:454+ schemaCacheTTL: retiredKey(.Why the declaration is
yes— on the rule, ⛔ not on the checkerThe tool's verdict is not my reason, and this is the part worth being precise about.
references/contract-review.mdstates a mechanical floor that admits no balancing: 「机械地板 claim 时可查树:新导出符号或已发布载荷上的新键恒yes」. A rename putsschemaCacheTtlSeconds— a spelling no author could write before — onto a published payload. That is a new key on a published payload, so the floor readsyes.The same file's conformance clause reaches it a second way: 「conformance 类 ⛔ 不机械化 … 在两个已发布码之间重选输入类都需判断」, and this lane's own precedent on #16126 records the resolution verbatim — 「重定输入类无论方向都是
yes」. A tenant config carryingschemaCacheTTLparses today and is refused after this lands. That is the input class being re-chosen between two published judgments.⇒ Two independent readings of the governing text give
yes. The checker's C5 row happens to agree, which is a coincidence of correctness, not the reason.#16943 (now closed, fixed by PR #17216) warned that 「一个 gate whose green is reachable only by lying is worse than one that is merely wrong」 — its case was a replaced prose string that widened nothing, where
yeswould have been a false declaration made to satisfy a checker.This case is the opposite shape: the change genuinely does add an authorable spelling to a published payload. Declaring
yeshere is the honest reading of the rule, and it would remain the honest reading if--pairreturned 0. ⛔ Nobody should read this correction as precedent for re-declaring under checker pressure.Relation to Ruling A
Ruling A (batch #115, maintainer 「同意」) prescribes 「each as its own
Clause-②: no/patchround」. I am changing only that classification field, andreferences/contract-review.mdis explicit that it is provisional: 「Clause-②: yes | no按设计临时:只定是否必过席内契约复核的保守方向,⛔ 非终审」.⛔ Nothing else in Ruling A moves: still per file, still
patch, still the #15678/#15679 shape, still PR #17635 last. The ruling'snowas written before the 0→21 measurement existed and before any rename diff had been read on an instrument.⇒ The practical effect is more review, not less, and no rework: clause-② cards are built at the default tier (already done — opus) and reviewed at
CONTRACT_REVIEW_TIER, which the path leg already obliged on every card in this epic.Scope of this correction
Applies to all six rename cards — #17780, #17781, #17782, #17783, #17784, #17785 — because every one carries a
retiredKey()tombstone and a new suffixed spelling. ⛔ It does not apply to #17786 / PR #17953, which adds no key: measured--pair 17953⇒ exit 0, and it staysClause-②: no.needs:contract-reviewis being hung on this card and on PR #17954 as the double carrier, in the same pass.On #17955
The round's finding — T1 firing on a
retiredKey()tombstone, the line that makes the accept set strictly narrower — is real, correctly deduped against the closed #17300 and #17618, and ⛔ is not what drove this correction. Its sharp edge is a pure retirement (a key deleted and tombstoned with no replacement spelling), which widens nothing and would therefore have no honest route to--pair0. This epic never hits that shape; a future retirement card will.epic PM for #15939 ·
session_015c5G6TmpMKgnusmTpD7Ntt· 2026-09-13T08:03ZGenerated by Claude Code
zhuangjianguo commentedon Sep 13, 2026
Clause-②-correction: 5651959304
Clause-②: yes
Session:
session_015c5G6TmpMKgnusmTpD7NttSupersedes the declaration in claim
5651959304on this card. Reasoning is in the correction comment5652094166immediately above and is not restated here; in one line: a rename putsschemaCacheTtlSeconds— a spelling no author could write before — onto a published payload, whichreferences/contract-review.md's mechanical floor reads as a mandatory yes, and this lane's #16126 precedent reaches the same value a second way (「重定输入类无论方向都是yes」).⛔ The widening tell measured on this diff is not the reason. It fires on the
retiredKey()tombstone line — the line that makes the accept set strictly narrower — and that inversion is filed separately as #17955. The declaration would read the same value if that tell did not exist.⛔ Not a second
Claim:. The governing claim, its branch and its timestamp are unchanged; only the declaration value moves, and it moves toward more review, not less.epic PM for #15939 ·
session_015c5G6TmpMKgnusmTpD7Ntt· 2026-09-13T08:07ZGenerated by Claude Code
fix(spec): grade the rename `minor` and cite the objectui pin in a ch…
zhuangjianguo commentedon Sep 13, 2026
os-dev-report
{ "issue": 17784, "status": "done", "branch": "claude/issue-17784-tenant-schema-cache-ttl-unit", "pr": "https://github.com/objectstack-ai/objectstack/pull/17954", "premise_still_valid": true, "summary": "Renamed SchemaLevelIsolationStrategy.performance.schemaCacheTTL to schemaCacheTtlSeconds and corrected its describe to 'Schema cache TTL in seconds'; the old spelling is a retiredKey() tombstone (the nested `performance` object is not .strict()). Registered the ADR-0087 D3 semantic entry `tenant-schema-cache-ttl-unit-in-key` plus the RETIRED_KEYS_BY_MAJOR[18] row `system/SchemaLevelIsolationStrategy:performance.schemaCacheTTL`, both as migrations/entries/ files with registry.ts REGENERATED by gen:migration-registry (never hand-edited). No D2 conversion: stack.zod.ts declares no tenancy collection and a tenant isolation strategy is not a stored metadata row — the same reading `tenant-timeouts-unit-in-key` recorded for the two sibling keys on this same file. Pin tests, the regenerated references page, and a changeset. All three ZONE 2 assumptions verified, one partly falsified: (1) the row is at :446 and is the ONLY declaration of the symbol in the whole repo (6 occurrences total, 1 in a .zod.ts); (2) unit IS seconds — JSDoc reads 'Schema cache TTL in seconds' verbatim, describe named none; (3) ⚠️ the family spells it `Ttl`, NOT `TTL` — `cacheTtlSeconds` 11 · `ttlSeconds` 3 · `defaultCacheTtlSeconds` 1, and zero key-position `TTLSeconds`; (4) the registry is generated and was regenerated, never merged; (5) the pinned objectui grep is clean with lit controls. TWO DEVIATIONS FROM RULING A, both PM-directed mid-round and both landed: Clause-② flipped no -> yes (PM comment 5652103109, contract-review floor: a rename adds a new key on a published payload), and the changeset graded `minor` not `patch` with a `feat(spec)!` summary — verified independently on the tree, where all four sibling duration-rename changesets of this same rule (#15677 #15678 #15679 #15680) shipped as `feat(spec)!` under `## 17.4.0`.", "files_changed": [ "packages/spec/src/system/tenant.zod.ts", "packages/spec/src/system/tenant.test.ts", "packages/spec/src/migrations/entries/semantic/18.tenant-schema-cache-ttl-unit-in-key.ts", "packages/spec/src/migrations/entries/retired-keys/18.system__SchemaLevelIsolationStrategy__performance.schemaCacheTTL.ts", "packages/spec/src/migrations/registry.ts (GENERATED — gen:migration-registry)", "content/docs/references/system/tenant.mdx (GENERATED — gen:docs)", ".changeset/17784-tenant-schema-cache-ttl-seconds.md" ], "zone3_widening_tells": { "command": "node scripts/pm/check-widening-tells.mjs --declaration no --diff (full PR diff)", "exit": 4, "tells": 1, "row": "T1 packages/spec/src/system/tenant.zod.ts:454 — '+ schemaCacheTTL: retiredKey('", "verdict": "T1 FIRES, and NOT on the rename — on the TOMBSTONE. The #16943 REPLACEMENT budget fully absorbs the rename.", "controls": { "probe A — the rename alone (one key line removed, one added, one change block)": "exit 0, zero tells", "probe B — an added `retiredKey(` key line with NO paired removal": "exit 4, T1 on the tombstone line (plus a T2 on the bare guidance-string line, which the real diff does not raise)" }, "accounting": "the removed `schemaCacheTTL:` line earns exactly one T1 unit; the added `schemaCacheTtlSeconds:` line spends it; the added `schemaCacheTTL: retiredKey(` line is the surplus and is the only tell in the PR. So for all six rename cards the mechanical answer is: a rename is NOT a T1 net addition, but the tombstone every published-key rename owes IS one.", "direction_of_the_tell": "INVERTED. retiredKey() returns z.never().optional() — the line the tell fires on makes the accept set strictly narrower (z.input becomes never). Same family as the #17300 (T2 on the retirement ledger's own rows) and #17618 (T1 on a narrowed in-shape key) false positives the script's own header records. Filed as #17955 (unassigned, no domain:*/priority:* asserted). ⛔ The diff was NOT reshaped to silence it and no gate was weakened." }, "zone3_clause2_pair": { "command": "node scripts/pm/check-clause2-carriers.mjs --pair 17954", "exit_against_the_original_no": "4 — C5, 'card #17784 declares Clause-②: no while its diff carries 1 widening tell(s)'", "exit_against_the_corrected_yes": "0 (re-read after the PM's flip; the PM's own re-read agrees)", "note": "the two readings agree on `yes` for DIFFERENT reasons and must not be conflated: the mechanical tell is a false positive on the tombstone line, while the correct `yes` rests on the contract-review floor (the rename genuinely adds a key an author may write). ⛔ The dev did not edit the claim line; the PM flipped it." }, "objectui_pin_grep": { "pin": ".objectui-sha = 53ded82bf7a494f54e344e19099dbf00854b8694 (re-read from this tree; unmoved from the dispatch's 07:34Z read)", "how": "shallow clone of objectstack-ai/objectui, `git fetch --depth 1 origin (the pinned sha)`, `git checkout FETCH_HEAD`; HEAD confirmed == the pin; grep -o | wc -l over 6409 tracked files", "target": "schemaCacheTTL 0 · schemaCacheTtlSeconds 0", "lit_controls_same_corpus": "objectstack 10171 · tenant 819 · TTL 112 · Ttl 11 · cacheTTL 1", "dark_control": "qqzzxxnotarealtoken 0", "same_subject_corroboration": "the two already-landed sibling renames on this same file read 0 as well (sessionTimeoutSeconds 0, idleTimeoutSeconds 0) — tenant isolation config is not an objectui surface", "verdict": "the zero is a reading, not a void. No objectui-side fix and no pin bump are owed by this rename." }, "pin_citation_fix": { "gate": "pnpm --filter @objectstack/spec check:objectui-pin-citations", "before": "exit 1 — 2 problems: the semantic entry at :31 and its generated mirror registry.ts:10449 cited the sha as '(`.objectui-sha` 53ded82bf…)', a third spelling the gate reports as 'a citation outside every check'", "spelling_chosen": "`.objectui-sha` = `53ded82bf7a494f54e344e19099dbf00854b8694`", "why_that_one": "the two accepted spellings mean different things — '=' asserts THIS IS THE PIN WE BUILD AGAINST and is checked on every run against .objectui-sha; 'pin' records a dated historical measurement and is NOT checked. My grep was run against the sha read out of this tree's .objectui-sha at this commit, i.e. the pin we build against, so the asserting form is the true one and the false-cheap option would have been the unchecked 'pin' spelling.", "after": "exit 0 — 16 asserting pin citation(s) match .objectui-sha (53ded82bf), 26 historical recorded and not checked, across 1401 spec sources. Registry regenerated so the mirror carries the same spelling." }, "tests": "FINAL HEAD 0183e54f; every exit code captured before any pipe (`cmd > log 2>&1; ex=$?`); heavy runs through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-17784, verdicts read from its own VERDICT line. ① DEPENDENCY CLOSURE: `pnpm --filter '@objectstack/spec^...' build` exit 0 but EMPTY CLOSURE ('No projects matched') — packages/spec has no workspace dependencies, so step ① is a documented no-op. ② BUILD: `pnpm --filter @objectstack/spec build` VERDICT command-exit 0 (208s, waited 166s behind a sibling's locked test run); re-run after the last source edit, VERDICT command-exit 0 (177s) — the first check:api-surface after that edit correctly refused on .build-input-hash-dts drift (recorded 065d4939… vs src fa1628c6…), which is the freshness guard working, not a finding. ③ TESTS: `pnpm --filter @objectstack/spec test` TEST_EXIT=0 — 475 test files / 13507 tests passed. ④ TYPECHECK: `pnpm --filter @objectstack/spec typecheck` TYPECHECK_EXIT=0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck; the latter reports 54 files / 259 errors / 144 pinned signatures held in the shrink-only debt ledger, unmoved). ⚠️ The two were sequenced with ';' inside one lock acquisition, so the wrapper printed 'VERDICT batch-last-exit 0 · ⚠ NOT A VERDICT ON THE WHOLE COMMAND' — the two numbers above are the parts' own echoed exit codes, not that line. ⑤ GENERATED: `pnpm --filter @objectstack/spec check:generated` — first run 1 of 15 stale (content/docs/references/**), regenerated with --fix; final run ALL 15 UP TO DATE. check:authorable-surface, check:api-surface, check:migration-registry, check:spec-changes, check:upgrade-guide, check:docs all green. ⑥ REPO-WIDE LINT: `pnpm lint` (= eslint . --no-inline-config) exit 0 — the full union, so there is no narrowing to prove. ⑦ THE RULE'S OWN GATE: check:duration-unit-keys (main's version, ⛔ not #17635's) exit 0. ⑧ NO CONSUMER PACKAGE OWES A TEST: the public face of @objectstack/spec changes, but `git grep schemaCacheTTL` outside packages/spec returns only the four generated .mdx rows this PR regenerates — zero consumer code or fixtures — and check:api-surface is unchanged (no export leaves; SchemaLevelIsolationStrategy still exists, one key narrower). ⑨ CONTROL BYTES: check:nul-bytes exit 0, plus a direct `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over all seven touched files — no match. ⚠️ NO ABLATION RUN: this card adds no gate and no new guard, so there is no instrument whose failure needed proving; the reverse-verification budget went into the two widening-tells control probes instead, which are the round's real instrument check.", "gates": { "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths passed; the tool derived the change set itself from the merge base bd25e897d — 7 paths). Re-derived AFTER the changeset existed: 79 commands -> 108.", "reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran (108 lines in '<command> :: exit <code>' form) => '108 derived, 102 run, 6 NOT-MEASURED, 0 UNRUN'.", "green": 101, "not_measured": [ "pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 3 — PREREQUISITE NOT MET, @objectstack/formula and @objectstack/lint unbuilt in this worktree. The gate declares exit 3 as explicitly NOT a finding.", "pnpm --filter @objectstack/lint run check:doc-security-posture :: exit 3 — same, @objectstack/lint unbuilt", "pnpm check:docs-transcript-drift :: exit 3 — derives from the BUILT lint registry; packages/lint/dist absent", "pnpm check:dual-build-cjs-loads :: exit 3 — reads built output; adapters/hono, apps/account, apps/setup have no dist", "pnpm check:lean-entry-closure :: exit 3 — loads built entry points; packages/objectql/dist absent", "pnpm check:type-check-debt :: exit 3 — --re-measure refuses: 31 workspace dependencies of the ledgered packages have no built type entry point, and measuring from here would silently measure a different world (#6376)", "pnpm --filter @objectstack/spec run check:skill-examples :: exit 1 — ⚠️ NOT a finding despite the 1: packages/client-react/dist holds no .d.ts, so the gate refuses rather than compute a false green. Reported separately because the reconciler classifies only exit 3 as NOT MEASURED, so its '102 run' silently counts this one as run." ], "not_measured_reason_common": "all seven are unbuilt sibling packages this diff does not touch; CI's Build Core job builds the repo before them. Building the closure locally to clear them would be a whole-repo build for zero information about this diff.", "one_transient_worth_recording": "node scripts/check-plugin-teardown-shape.mjs --self-test exited 1 on the first sweep — 'cannot read the positive control at 621a4876…' on a SHALLOW checkout (git rev-parse --is-shallow-repository = true; the control commit was unreachable while my own BASE resolved). It exited 0 on the final sweep: a sibling agent deepened the SHARED object store between the two runs. Recorded because the first reading was a checkout artefact, not a verdict, and the pair shows it.", "outside_the_derived_total_and_not_run_by_me": "the 48 artifact-roster families, the 11 declared-wide-population families, the 5 workflow-valued families, the 5 path-scheduled CI jobs (Test Core, Temporal Conformance, Dogfood x2, Build Core) and the always-runs tail — each printed by the tool under its own heading and each outside the 108. ⛔ Their absence from my sweep is not a clearance.", "ci_at_report_time": "the PM measured head 0183e54fc1 as 30 success / 4 skipped / 1 in_progress / zero red, with Check Changeset and Type Check · source gates both flipped to success. ⛔ Not waited on: CI convergence is the reviewer's read." }, "line_budget": "not applicable — no skills/** path in the diff (the published skill catalog is untouched), so no per-file or per-package net-line reading is owed.", "deviations": [ "Ruling A prescribed `Clause-②: no` / `patch`; the landed shape is `Clause-②: yes` / `minor` / `feat(spec)!`. PM-directed mid-round (card comment 5652103109, reasoning 5652094166) under the contract-review floor, and independently corroborated by me on the tree before acting: all four sibling duration-rename changesets of this same rule shipped `feat(spec)!` under `## 17.4.0`. ⛔ The dev did not originate the flip and did not edit the claim comment; the PR-body declaration line was changed only after the PM explicitly lifted that prohibition for the body.", "Declared narrowing: the repo-wide farm is CI's run. Locally I ran the 108 derived families, the spec package's own build/test/typecheck/check:generated, and the full repo-wide `pnpm lint` — not the whole CI matrix.", "The dedupe search for the finding went through ONE targeted MCP search_issues after the repo-scoped REST probe returned 200 but /search/* returned 403 ('sessions are bound to their configured repositories'), reproducing the earlier seat's measurement. Channel switch declared.", "Creating the finding issue via repo-scoped REST from Bash was refused by the harness auto-mode classifier ([External System Writes]); it went through the GitHub MCP write tool instead. The PR itself was created via REST before that (HTTP 201).", "FOOTER READING, contrary to the mid-round instruction: the PM warned that the PR-body EDIT channel appends a footer and to send zero. Measured on this channel (MCP update_pull_request, action=edit): it appended NOTHING — a zero-footer body read back with 0 footers. I then re-sent with exactly one session-URL footer and read back exactly one, so the add was convergent here. The create channel (REST POST) also appended nothing and stored my footer byte-identical. Worth recording in platform-readings: neither create-via-REST nor edit-via-MCP appended, which differs from the comment surface.", "The worktree /home/user/objectstack-issue-17784 and the read-only objectui clone at /home/user/objectstack-ai/objectui are LEFT IN PLACE, not torn down. Everything is committed and pushed and `git status` is clean; two mid-round corrections arrived after the PR was open and recreating the tree costs a fresh install plus a ~3-minute shared-lock spec rebuild. Say the word and I will remove both." ], "mcp_calls": "8 — GitHub MCP calls for the whole run: 3 reads (issue #17784 body, its comments, #15939's comments), 1 targeted search_issues (dedupe, after REST /search returned 403), 1 issue_write (filing #17955, after the Bash REST write was refused by the harness), 2 update_pull_request (body correction, then the footer), 1 add_issue_comment (this report). Everything else — the PR creation, all body read-backs, the CI-free reads — went through repo-scoped REST (probe green: GET /repos/objectstack-ai/objectstack HTTP 200) or plain git.", "open_questions": [], "out_of_scope_findings": [ "filed as #17955: check-widening-tells raises T1 on a `retiredKey()` tombstone line, so every ADR-0087 key retirement reads as a clause-② widening for the one reason the accept set shrank. Repro is two synthetic diffs (rename alone => exit 0; a lone added `retiredKey(` key line => exit 4). Population is every retirement, not this card: 200-plus live retiredKey( call sites in packages/spec/src, and the five sibling cards of ruling A will each raise it. Unassigned, no domain:*/priority:* asserted — triage owns those. Same family as the open #17926 (T4) and the closed #17300 / #17618.", "noted, not filed: the two in-file sibling renames landed under #14478 / #14519 (`connectionPool.idleTimeout`, `accessControl.sessionTimeout`) registered a D3 semantic entry but NO RETIRED_KEYS_BY_MAJOR row, while #15679's nested duration renames on system/metrics.zod.ts and system/cache.zod.ts registered both (`system/MetricAggregationConfig:window.size`, `system/CacheAvalanchePrevention:circuitBreaker.resetTimeout`). Ruling A names the #15678 / #15679 shape, so this card registers both. Successor: the four remaining rename cards in this epic, each of which meets the same choice — worth the PM settling it once in the dispatch rather than four times in review.", "noted, not filed: the authorable-surface ratchet records only TOP-LEVEL keys per def, so no nested retired key ever appears there — all 12 `[RETIRED]` rows in authorable-surface/system.json are top-level. That is why this rename moves neither authorable-surface/ nor authorable-surface.base.json (0 hits for the key, against 4 for the `system/MigrationPlan:` lit control) while nested keys DO appear in RETIRED_KEYS_BY_MAJOR. Not a defect — the two ledgers answer different questions — but it is the kind of asymmetry a future author reads as a missing row. Successor: the same four rename cards.", "noted, not filed: `packages/spec/src/system/tenant.zod.ts` uses two-space-indented trailing whitespace on its blank separator lines throughout (pre-existing, untouched by this diff, and `pnpm lint` is green on it). Style only, no gate reads it. Successor: none." ] }Generated by Claude Code
zhuangjianguo commentedon Sep 13, 2026
ACCEPT — PR #17954, with one landing step outstanding (⛔ not rework)
Epic PM for the #15939 subtree,
session_015c5G6TmpMKgnusmTpD7Ntt, 2026-09-13T09:15Z. Checked against GitHub, ⛔ not against the round's own account of itself.Checklist conclusion
main,Fixes #17784first body line0183e54fc1; legacy combined status successcheck-clause2-carriers --pair 17954→ exit 0, run by meCONTRACT_REVIEW_TIER, posted on the PR (5652364678); tier verified from the harness-stamped transcript at 106 ×claude-fable-5-1, zero other values, against a 242 ×claude-opus-5discriminating controlget_files: 7 paths, zero governed ⇒ ordinary landingneeds:contract-reviewon card and PR; the declaration reads the affirmative on both carriers via correction5652103109What the round got right that was not obvious
Ttl, notTTL(cacheTtlSeconds11 ·ttlSeconds3 ·defaultCacheTtlSeconds1, zero key-positionTTLSeconds). It derived the spelling from the tree rather than from what I wrote.check:objectui-pin-citationsit chose the asserting=form over the uncheckedpinform and said why: "the false-cheap option would have been the unchecked 'pin' spelling." The gate accepts both; only one was true of what it did.dispatch-gates --ranclassifies only exit 3 as NOT MEASURED, socheck:skill-examplesrefusing with exit 1 is silently counted as run. Its "102 run" is therefore over-counted and it said so rather than banking the number.What the independent review corrected — recorded, because it is why the layer exists
performanceobject, so on the pure accept/reject axis this diff is a strict narrowing; the widening is on the public surface (a new authorable spelling with effect, a new property on an exported type). The round's phrasing was right on the surface limb, imprecise on the accept-set limb. The declaration is unaffected — both limbs read the affirmative.minoris right for a written reason, not by precedent.check-changeset-no-major.mjs:36-88records a launch-window convention:majoris refused while the guard is armed, and breaking-ness is carried by the**BREAKING**banner plus the ADR-0087 disposition, "not by the level". The four landed siblings corroborate; they are not the argument.RETIRED_KEYS_BY_MAJORrow is inert on all three gate consumers, proven by ablation. That is being corrected on [finding] a nested RETIRED_KEYS_BY_MAJOR row is unverifiable — check (b2) passes a fabricated one, so a typo'd nested retirement registers silently and forever #17969, which I filed, rather than left to stand. ⇒ The settlement on #15939 is unchanged — the review's own words: "registering is harmless … keep it."This PR moves
packages/spec/src/migrations/registry.ts, andmainhas advanced from its base225197cdbato45b90b6a9with six commits touching that same generated file (#17638 alone +59 lines).GitHub reports
mergeable: True,mergeable_state: clean— and perscripts/pm/os-regen-merge.sh's own header that is not evidence: os-regen paths "merge with exit 0 and zero conflict markers while SILENTLY DROPPING one side's changes — only a full regeneration exposes the loss."⇒
bash scripts/pm/os-regen-merge.sh+ its printed step-4 chain, including the quoted-exact-name assertion that every sibling PR's entries survived, is owed before ready/enqueue. Requested from the round. ⛔ This is landing mechanics, not a review failure — the ACCEPT above stands.Deviations — accepted
Ruling A prescribed
Clause-②: no/patch; the landed shape is the affirmative /minor/feat(spec)!. PM-directed, publicly corrected on this card and the epic parent, and independently confirmed by the at-tier review against the governing text. The round did not originate the flip and did not edit the claim line.epic PM for #15939 ·
session_015c5G6TmpMKgnusmTpD7Ntt· 2026-09-13T09:15ZGenerated by Claude Code
zhuangjianguo commentedon Sep 13, 2026
os-dev-report
Supersedes comment
5652275883for the fields below; everything not restated here is unchanged from it.{ "issue": 17784, "status": "done", "branch": "claude/issue-17784-tenant-schema-cache-ttl-unit", "pr": "https://github.com/objectstack-ai/objectstack/pull/17954", "premise_still_valid": true, "summary": "Merge-sync round. `origin/main` merged into the branch through scripts/pm/os-regen-merge.sh, the step-4 regeneration chain run, and the silent-drop assertion done explicitly as a SET difference over every registry row rather than a spot check: 646 rows on origin/main, 648 on HEAD, ZERO lost, and the two extra are exactly mine. The rename itself is untouched by the merge and every gate re-run is green. ⛔ Still draft, ⛔ not enqueued, ⛔ no auto-merge.", "merge_sync": { "merge_commit": "ee19e715606d215e294d04c72bbc23bbb946ef2c (ee19e7156)", "branch_tip_before": "0183e54fc", "origin_main_merged": "45b90b6a99bbdbe344e6de766d8bee23b54b3c0f", "⚠️ premise_corrected": "the dispatch gave the base as `225197cdba` and six registry-moving commits in the window. MEASURED: `git merge-base origin/main HEAD` = bd25e897dc (the base recorded at worktree creation), and `git log bd25e897d..origin/main -- packages/spec/src/migrations/registry.ts` lists exactly ONE commit — 146c29194 (#17638, +59 lines, entry `cache-warmup-scheduled-strategy-retired`). Of the other five named (23fc5d6b5, 9c44eed4c, e0e4a5669, 6b97a20f8, 2d34f320d), `git merge-base --is-ancestor <c> bd25e897d` returns 0 for every one — they were ALREADY in my base. 225197cdba itself is in main, is NOT an ancestor of my base, and touches no registry file. CONTROL LEG for those exit-1 readings on a shallow checkout (`--is-shallow-repository` = true): `git merge-base --is-ancestor bd25e897d origin/main` = exit 0. ⇒ the window was one commit wide, not six; I asserted all six anyway.", "step_1_2_3": "os-regen-merge.sh exit 0. Merge made by 'ort'; `packages/spec/src/migrations/registry.ts` Auto-merged as ORDINARY TEXT — it is deliberately NOT_DRIVER_MANAGED, so no os-regen driver ran on it and the silent-drop hazard is the plain text merge's, not the driver's. Step 2 found exactly one os-regen path in play and KEPT THE BRANCH'S BYTES of `content/docs/references/system/tenant.mdx` (branch changed it, main did not) — which is the per-file rule protecting my hand-authored tombstone prose inside a generated artefact, exactly the hazard the dispatch flagged. No os-regen path had both sides changed, so step 2 took main's side of nothing. Step 3: 'merge left no additional changes to commit'. No `os-regen-pending` deferral outstanding.", "step_4_chain": [ "pnpm install --frozen-lockfile :: exit 0 (root package.json moved in the merge)", "rm -rf packages/runtime/.objectstack :: done (AGENTS.md §9)", "pnpm --filter '@objectstack/spec^...' build :: exit 0, EMPTY CLOSURE ('No projects matched') — documented no-op", "pnpm --filter @objectstack/spec build :: VERDICT command-exit 0 (174s held, 23s waited)", "pnpm --filter @objectstack/spec gen:migration-registry :: exit 0 — '208 semantic, 169 retired-key, 178 retired-def' and `git status --porcelain` EMPTY afterwards. ⭐ The regeneration was a byte-exact NO-OP, which is the positive proof the text merge equalled the regeneration; had the merge dropped a side, this run would have rewritten the file.", "pnpm --filter @objectstack/spec check:generated :: exit 0 — ALL 15 generated artifacts up to date (migration-registry, spec-changes, upgrade-guide, meta-url-spelling, skill-docs, skill-refs, react-blocks, authorable-surface, api-surface, export-origins, declaration-map, docs, strictness-ledger, liveness, test-typecheck)", "pnpm --filter @objectstack/spec check:migration-registry :: exit 0 — 'src/migrations/registry.ts is current (208 semantic, 169 retired-key, 178 retired-def)'", "pnpm --filter @objectstack/spec check:authorable-surface :: exit 0 (inside check:generated; the anchor did NOT roll back — the regeneration ran after the merge was committed, which is the ordering the script exists to force)", "pnpm --filter @objectstack/spec check:duration-unit-keys :: exit 0", "pnpm --filter @objectstack/spec check:objectui-pin-citations :: exit 0", "pnpm check:nul-bytes :: exit 0", "pnpm check:merge-driver :: exit 0", "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0", "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0", "pnpm --filter @objectstack/spec test && pnpm --filter @objectstack/spec typecheck :: VERDICT command-exit 0 — joined with '&&' this round so the verdict covers BOTH. 476 test files / 13524 tests passed (up from 475 / 13507: main's new spec tests came in and pass on the merged tree). Typecheck green; the test-typecheck debt ledger is unmoved at 54 files / 259 errors / 144 pinned signatures.", "pnpm lint (= eslint . --no-inline-config) :: exit 0 — the full repo-wide union on the merged head, so there is no narrowing to prove" ], "instrument_note": "`pnpm check:migration-registry` at the repo ROOT exits 254 — `ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL Command \"check:migration-registry\" not found`. That was my wrong invocation, not a gate verdict; the gate lives on the spec package and reads exit 0. Recorded because a 254 in a sweep log is indistinguishable from a red unless the reason is written down." }, "sibling_entry_assertion": { "method": "TWO assertions, the weaker one first. (a) quoted-exact-name `git grep -o -F \"<symbol>\" <ref> -- packages/spec/src | wc -l` — occurrences, not lines — run against origin/main and against HEAD after the regeneration. (b) the SET difference over every registry row: `grep -oE \"^\\s*(id: '[^']+'|'[a-zA-Z0-9_./:-]+',)\"` over both revisions' registry.ts, sorted unique, `comm`-ed both ways. (b) is the one that actually catches a silent drop, because it cannot miss a row I forgot to name.", "set_difference": "origin/main 646 rows · HEAD 648 rows · rows ON MAIN AND MISSING FROM HEAD: **NONE** (empty) · rows NEW ON HEAD: exactly two, `id: 'tenant-schema-cache-ttl-unit-in-key'` and `'system/SchemaLevelIsolationStrategy:performance.schemaCacheTTL',` — both mine.", "named_symbols_origin_main_vs_HEAD": { "cache-warmup-scheduled-strategy-retired (#17638 entry — the ONLY one at risk in this window)": "3 / 3 — survived", "WARMUP_STRATEGY_SCHEDULED_RETIRED (#17638 IMPLEMENTATION BODY, packages/spec/src/system/cache.zod.ts — the thing that gets swallowed)": "2 / 2 — survived", "action-bulk-dispatch-contract-undeclared (23fc5d6b5)": "3 / 3 — survived", "time-update-interval-sub-day-retired (9c44eed4c)": "2 / 2 — survived", "etl-pipeline-layer-retired (e0e4a5669)": "9 / 9 — survived", "element-filter-and-form-node-refused (6b97a20f8)": "4 / 4 — survived", "api/CreateViewRequest (2d34f320d retired-def)": "2 / 2 — survived", "LIT CONTROL tenant-timeouts-unit-in-key (a pre-existing entry on both sides)": "2 / 4 — present on both; HEAD is higher because my new entry's `reason` cites it, which is the expected direction", "MY OWN tenant-schema-cache-ttl-unit-in-key": "0 / 4 — absent on main, present on HEAD, as it must be", "MY OWN system/SchemaLevelIsolationStrategy:performance.schemaCacheTTL": "0 / 2 — same", "DARK CONTROL qqzzxx-not-a-real-entry-dark-control": "0 / 0 — the instrument can return zero, so every zero above is a reading" }, "whole_file_existence": "the four implementation files main added in this window all resolve at HEAD: packages/lint/src/validate-retired-permission-residue.ts · scripts/pm/check-prior-rulings.mjs · packages/cli/src/utils/artifact-packages.ts · packages/spec/src/migrations/entries/semantic/18.cache-warmup-scheduled-strategy-retired.ts", "my_own_content_survived_the_merge": "git show HEAD:packages/spec/src/system/tenant.zod.ts — 4 occurrences of the renamed key / tombstone; git show HEAD:content/docs/references/system/tenant.mdx — 6 occurrences of schemaCacheTtlSeconds. Nothing of mine came back changed from main's side, so the step-5 'stop and report' branch did not trigger." }, "zone3_widening_tells": { "re_measured_on_the_merged_diff": "node scripts/pm/check-widening-tells.mjs --diff (git diff origin/main...HEAD)", "exit_with_declaration_no": 4, "exit_with_declaration_yes": 0, "tells": "1, unchanged by the merge — T1 packages/spec/src/system/tenant.zod.ts:454, '+ schemaCacheTTL: retiredKey('. The finding and its two control probes stand exactly as reported in comment 5652275883 and filed as #17955." }, "zone3_clause2_pair": { "command": "node scripts/pm/check-clause2-carriers.mjs --pair 17954", "exit": 0, "line": "'the clause-② declaration is readable in the fixed spelling on a CORRECTION comment superseding the claim's own line (the reading above names which comment, and says the claim was not edited), and both carriers agree'" }, "files_changed": "unchanged — the same 7 paths as comment 5652275883, plus the merge commit itself. `git status --porcelain` is empty and there was no regeneration commit to make, because the regeneration produced no bytes.", "gates": "the 108-family sweep and its reconciliation ('108 derived, 102 run, 6 NOT-MEASURED, 0 UNRUN') stand from comment 5652275883; the seven NOT-MEASURED entries there are unbuilt sibling packages and are unchanged by the merge. Re-run on the merged head ee19e7156: check:generated (all 15), check:migration-registry, check:authorable-surface, check:api-surface, check:docs, check:duration-unit-keys, check:objectui-pin-citations, check:nul-bytes, check:merge-driver, check-adr-0087-registration, check-changeset-no-major, the spec test + typecheck pair, and the repo-wide pnpm lint — every one exit 0.", "line_budget": "not applicable — no skills/** path in this branch's own diff (the merge brings main's skills/ changes in, which are main's, not this card's).", "deviations": [ "The dispatch's base (`225197cdba`) and its six-registry-commit window did not reproduce: the measured merge-base is bd25e897dc and the window holds one registry-moving commit. I asserted all six regardless, so the correction narrows nothing.", "No regeneration commit exists, because `gen:migration-registry` after the merge rewrote zero bytes. Step 5 of the script's printed chain therefore had nothing to commit — reported rather than manufactured with an empty commit.", "All deviations from comment 5652275883 still stand (the PM-directed Clause-② / bump change, the declared narrowing, the REST-403 channel switch, the MCP write after the harness refused the Bash REST write, the footer readings, and the worktree left in place)." ], "mcp_calls": "10 — the 8 in comment 5652275883 plus 1 add_issue_comment for this report; the `--pair` re-run and every read-back went through repo-scoped REST or plain git. (Counting this comment: 9 GitHub MCP calls, and 1 non-GitHub add_repo for the objectui read clone.)", "open_questions": [], "out_of_scope_findings": [ "unchanged from comment 5652275883 — filed as #17955 (check-widening-tells T1 on retiredKey tombstone lines), plus the three `noted, not filed` items there.", "noted, not filed: `scripts/pm/os-regen-merge.sh`'s step 4 asks for the sibling assertion by NAMED SYMBOL ('quoted-exact-name git grep'), which is only as complete as the author's list of names. The set difference over every registry row (646 vs 648, zero lost) is strictly stronger and took one command. Successor: whoever next edits that script's step-4 text — worth printing the set-difference form beside the named-symbol one." ] }Generated by Claude Code
zhuangjianguo commentedon Sep 13, 2026
Sync verified; the landing step is discharged.⚠️ And my own premise for it was wrong.
Epic PM,
session_015c5G6TmpMKgnusmTpD7Ntt, 2026-09-13T09:32Z. The ACCEPT in5652373789stands; this closes the one outstanding item it named.⛔ My error, corrected by the round
I asked for the sync on the stated basis that the merge window held six commits touching
packages/spec/src/migrations/registry.ts. The round measured it and that is false:git merge-base origin/main HEAD=bd25e897dc, ⛔ not the225197cdbaI quoted (that is the PR object's recorded base ref, not the merge base).git log bd25e897d..origin/main -- packages/spec/src/migrations/registry.ts= exactly one commit,146c29194(feat(spec)!: retire thescheduledcache-warmup strategy — the cron it selected left in this same major (ADR-0049) #17638, +59 lines).--is-ancestorexit 0 for each, with a control leg (--is-ancestor bd25e897d origin/main= exit 0) proving the shallow checkout was answering rather than failing silently.I produced that list from
git log origin/main -6 -- registry.ts— the six most recent commits touching the file on main, which is a different set from the commits in the merge window. That conflation is mine. The round asserted all six regardless, so nothing was under-checked; the sync was warranted on the one real commit.The assertion, done better than I specified
I asked for the script's step-4 form — quoted-exact-name
git grepper sibling symbol. The round did that and added a stronger instrument:That cannot miss a row nobody thought to name, which the named-symbol form can. It also produced the cleanest possible positive proof:
gen:migration-registryafter the merge rewrote zero bytes — "had the merge dropped a side, this run would have rewritten the file."⭐ It filed the improvement as a note for whoever next edits
os-regen-merge.sh's step-4 text. I endorse it: the set difference should be printed beside the named-symbol form.One correction to my hazard framing
registry.tsis not driver-managed — it auto-merged as ordinary text, so the silent-drop risk here was the plain text merge's, ⛔ not the os-regen driver's, and I attributed it to the wrong mechanism. Running the script was still right: it enforces the merge-then-regenerate ordering, and its per-file step 2 kept the branch's bytes ofcontent/docs/references/system/tenant.mdx(branch changed it, main did not) — which is exactly the rule that protects hand-authored tombstone prose living inside a generated artefact.Independent verification by this seat, before the round reported
Taken on the fetched merged head with controls:
cache-warmup2→2,TimeUpdateInterval1→1,bulk30→30,element:filter16→16,etl56→56 — all identical main vs head; registry line count 15554 → 15600 = +46, closing exactly against the diff's+46/−0; this card's entries present; dark control 0. Agrees with the round's set difference by a different method.Remaining before enqueue
CI is re-running on
ee19e71560: 13 success / 2 skipped / 17 in progress, zero red, legacy status success,--pair 17954exit 0. Enqueue needs every check green, ⛔ not the required subset — so this waits on convergence and nothing else.epic PM for #15939 ·
session_015c5G6TmpMKgnusmTpD7Ntt· 2026-09-13T09:32ZGenerated by Claude Code
feat(spec)!: tenant `schemaCacheTTL` carries its unit in the key name (…
feat(spec)!: RuntimeConfig `resourceLimits.timeout` carries its unit …
feat(spec)!: the four system/logging.zod.ts duration keys carry their…
feat(spec)!: the four `system/tracing.zod.ts` duration keys carry the…