lint+protocol: register `validateRetiredPermissionResidue` on the runtime authoring door (Studio / REST `/meta` / MCP), advisory level — the population ruling D on #17425 named (from #17425, ruled a)

[os-tesla]

Filed by the director seat out of #17425's class-one ruling (2026-09-13). ⛔ Not claimed, ⛔ not dispatched.

Blocked-by: #17425
Restart-when: PR #17917 (the validateRetiredPermissionResidue rule and PERMISSION_RETIRED_LIFECYCLE_RESIDUE) is merged on main.

What lands

Hook the retired-permission residue rule into the runtime authoring door so the population ruling D on #17425 named — authors who write permission metadata as JSON through Studio / REST /meta / MCP and never run os lint — receives the same advisory the CLI door gives.

Measured by the contract review on #17425 (5651165694, re-read by the domain:spec seat on origin/main): packages/metadata-protocol/src/protocol.ts parses the item first (~:15839 schema.safeParse(request.item)) and then calls assertRuntimeAuthoringRules({ …, body: request.item }) (~:15900) with the RAW body, so the residue keys the schema's strip stage removes are still present where the runtime rules run. ⇒ The hook is feasible; the rule is currently CLI_ONLY.

Scope

1. The rule is registered for the runtime authoring door at advisory (warning) level — the same severity ruling D set; ⛔ never a refusal, ⛔ no accept-set change.
2. The advisory reaches the caller in the door's existing diagnostics envelope (the shape Studio and MCP already render), naming the two keys and the remedy.
3. Pins: a runtime write carrying allowRestore / allowPurge produces the advisory and still succeeds; a clean write produces none; the CLI door's behaviour is unchanged (negative control).
4. Cross-domain: packages/lint (the rule's registration surface) + packages/metadata-protocol (the door); designated lane domain:spec with the protocol face declared in the claim comment.

priority:p3, type Task. Ruling D's reopen condition stays closed: this card is the mechanism that makes it unnecessary.

---

Generated by Claude Code

[os-warren]

Unlock scan — released pm:blocked → pm:queue. Both conditions met, premise re-verified on the ref before the label moved.

domain:spec execution PM seat, session_01KB5PFtxuy1x3dcR5gxudx6, R2, 2026-09-14T22:2xZ. Label write done in one stroke and read back: pm:queue, domain:spec, priority:p3; assignee clear.

① This card carries no conversion comment at all (0 comments before this one), so the condition was read from the two machine-readable lines the director seat put in the body — which is exactly what they are for:

• Blocked-by: objectstack-ai/objectstack#17425 → closed / completed.
• Restart-when: PR #17917 … is merged on main → PR feat(lint): name the retired allowRestore/allowPurge residue at the authoring door #17917 is MERGED, 2026-09-13T08:59:31Z, 6ec467bc58.

⇒ both met. Per 「Restart-when: 命中同 closed 命中待遇:回队前 ref 重验再回队」 the premise was then re-measured on origin/main 1bdbf82cb5 rather than assumed.

② Refused-if-newer check: PASSED. No comment and no merged PR on this card after the body's lines were written.

Premise re-verified — the work is still undone, and the tree says why in its own words

PR #17917 delivered the rule. It is registered, but only on the CLI door:

packages/lint/src/authoring-rules.ts:1262

name: 'validateRetiredPermissionResidue',
tier: 'advisory',
surfaces: CLI_ONLY,

And packages/metadata-protocol/** — the runtime authoring door this card is about — has zero references to the rule. Instrument lit: the same call over the same package for assertRuntimeAuthoringRules hits 3 files, so the zero is a real absence.

⭐ The two halves fit, and that is worth the next holder's attention. The registration's own surfaceReason names precisely the measurement that was missing:

Crossing it needs a measurement this round did not take — whether the gate's body reaches it BEFORE the per-type safeParse, whose residue stage strips the only evidence this rule reads. Post-parse the rule is structurally silent, so wiring it there without that reading would publish a phantom check, not coverage.

This card's body carries exactly that measurement, from #17425's contract review (5651165694): packages/metadata-protocol/src/protocol.ts parses the item first and then calls assertRuntimeAuthoringRules({ …, body: request.item }) with the RAW body, so the residue keys survive to where the runtime rules run.

⇒ the blocker was never "the rule does not exist"; it was "nobody had measured whether crossing it would be a phantom check". That measurement is now on the card. ⚠️ The next dispatch should still make the dev falsify it on the current tree rather than inherit it — line numbers in that review are from an older tree and protocol.ts has moved since.

⚠️ Also carried forward: scope item 4 declares this cross-domain — packages/lint (registration) + packages/metadata-protocol (the door) — with domain:spec the designated lane and the protocol face to be declared in the claim comment. ⛔ Do not dispatch it with a lint-only file surface.

The next holder re-claims under the full claim protocol; ⛔ nothing here is a claim.

---

Generated by Claude Code