spec: the genuine duration rows adopt a declaration — `DurationMs`/`DurationSeconds` or a unit-suffixed name (census #18078 classes A-true ×6, B ×2, D ×≥2) — step ③ of ruling A on #18115

[os-elon-musk]

Blocked-by: #18669

⏱️ PM 改写本行（巡检 H28 的处方，2026-09-17T14:02Z；原行 Blocked-by: #18122 留在编辑历史里）。 #18122 已于 2026-09-15 关闭，本卡等的早已不是它：步骤③的十行里八行已随 PR #18657 落地（c049e74679 单亲），余下两行等的是决策卡 #18669 的裁定。⇒ 按 H28「把正文那行改写成点名活着的那个阻塞源」，让下一个读者（人或巡检）在正文这个正典位置读到当前的等待。

⚠️ 本阻塞按构造是无限期的（巡检 H26）：解锁谓词是「Blocked-by: 目标关闭」，而 #18669 带 needs-user-decision —— 那是一张开着的时候才待在那个状态的卡。⇒ 释放只能来自目标自身状态的改变（裁定被答），⛔ 不会有任何机制自动放行，得有人想要它。⭐ 裁 A（改名）之后还有第二道：两条 ADR-0087 转换层条目落 packages/spec/src/migrations/registry.ts，该文件由席 1 的 #17534 持有 —— 那一张能关，所以那半程是有机制的。

ℹ️ 巡检 H52 的处置记录在此，免得下一轮重问：终报的三个 open_questions 已在 5714587850 逐条答 A；而执行裁决时长出的两条残留按 H52 的 RESIDUAL 分支另立 #18669，⛔ 未在本卡重挂 needs-user-decision。

Filed by the director seat (objectstack #12708, summon #23, session_01WCEaPsmKY4UyoivKkkaUHt) executing decision batch #134 item 1 — maintainer 「决裁批 #134 同意」 to A on #18115, 2026-09-14T03:44Z. Step ③ of three: the genuine duration rows adopt a declaration. domain:spec; p2; pm:blocked until step ① is on origin/main. Foldable by file family (five-gate fold: same defect shape, same fix, all rows ruled, each row independently checkable, exclusions named below).

The population — census #18078 @ fb29f62cee; re-verify each row on today's origin/main (lines drift, key + file is the identity)

Genuine durations, unit in no channel (class A-true, 6):

file:line	key	reading	likely unit (dev measures the producer, ⛔ not this table)
packages/spec/src/api/contract.zod.ts:311	duration	BaseResponseSchema.meta.duration, beside a string timestamp, no describe/JSDoc	ms (measure the REST server's writer)
packages/spec/src/data/field-value.zod.ts:424	duration	FileValueSchema, media length	seconds? (measure the upload/metadata writer)
packages/spec/src/kernel/plugin-lifecycle-advanced.zod.ts:413	shutdownTimeout	.default(30000), "Graceful shutdown timeout"	ms
packages/spec/src/kernel/plugin-security-advanced.zod.ts:623	maxAge	CORS Access-Control-Max-Age mirror	seconds by RFC — consider externalVocabulary like its sibling expiresIn
packages/spec/src/system/auth-config.zod.ts:563	updateAge	.default(60 * 60 * 24), "Session update frequency"; sibling expiresIn carries externalVocabulary: 'better-auth session'	seconds (better-auth) — same externalVocabulary route as its sibling is legitimate
packages/spec/src/system/metrics.zod.ts:412	slideInterval	sibling durationSeconds in the same window object	seconds

Unit only in JSDoc (class B, 2): packages/spec/src/kernel/plugin-versioning.zod.ts:191 estimatedMigrationTime · packages/spec/src/system/metrics.zod.ts:847 resolution (sibling afterSeconds).

Unit nowhere, outside the census (class D durations, ≥2): packages/spec/src/system/metadata-persistence.zod.ts:259 loadTime, :287 saveTime — bare z.number().optional(), no describe, no JSDoc, beside size and etag.

Plus any genuine duration step ②'s widened detector surfaces (that card routes them here, ⛔ does not convert them).

What each row does — one of two declarations, per the ruling

• Type: adopt DurationMs / DurationSeconds (step ①), keep the key name; describe gains the unit. Preferred where the key name is a domain word (duration, resolution, maxAge).
• Name: suffix the key with its unit (shutdownTimeoutMs, loadTimeMs…). This is a RETIREMENT of an authorable key: retiredFromLoadPath conversion + ADR-0087 chain entry + tombstone + **BREAKING** banner at minor (launch-window convention, ADR-0087 amended 2026-09-13), following .claude/skills/spec-property-retirement. Preferred where the name is already unit-suggestive (*Timeout, *Time) and the census's own finding: check:duration-unit-keys reads .describe() but not JSDoc — a duration key documenting its unit only in JSDoc never enters the population, and one card already recorded a wrong reason because of it #15939 sibling rows were renamed that way.
• externalVocabulary meta stays a legitimate third route where the value mirrors an external contract's unit (maxAge, updateAge) — it is already an exemption class the gate declares.

⚠️ The unit of each row is a measurement of its producer/consumer (who writes the number, in what unit), ⛔ never a guess from the name — a wrong unit declaration is the exact silent ×1000 error this whole program exists to prevent. Print the reading per row in the PR body.

Exclusions (named so the fold is honest)

• The 17 dimensionless rows — step ②'s (in-schema marker), ⛔ not converted.
• The 10 instants — spec: route the 10 bare z.number() wall-clock instants to EpochMs (census #18078 class C ×4 + unit-nowhere instants ×6) — tranche 1 of ruling C on #18080 #18114's, ⛔ not touched here.
• lamportTimestamp / lamportClock — logical clocks, correctly not time.

Acceptance

• After this PR and step ②, --list shows zero undeclared time-shaped refusals on packages/spec/src; the summary line's declared-duration count equals the rows converted by type.
• Each renamed key carries its ADR-0087 entry, tombstone pin and form/docs/baseline updates per the retirement skill; each typed key carries a pin that a non-integer / negative literal is refused.
• Clause-②: the seat derives at claim — a type adoption narrows acceptance (no); a rename retires an authorable key (no, a published surface shrinks) — both carry the BREAKING banner where a producer is measured writing what is now refused.
• Changeset minor with **BREAKING** banner and ADR-0087 disposition for any renamed or newly-refusing row (pre-GA convention).

Fences

• ⛔ No gate change (step ②); ⛔ no new type (step ①; if a row needs a unit neither type covers, STOP and report — the ruling adds units only on a measured need); ⛔ content/docs/releases/** untouched.

Re-check before claiming

git fetch origin main
git grep -n -E 'export const (DurationMs|DurationSeconds)' origin/main -- packages/spec/src   # step ① landed? must be ≥1
cd packages/spec && tsx scripts/check-duration-unit-keys.ts --list | grep -c '\[name: -\] \[prose: -\]'   # A-class count today (23; 22 after #18114)

Refs

#18115 (ruling A) · #18080 (ruling C) · #18078 (census §A-true, §B, §D) · #15939 (the parent epic that renamed 21 sibling rows — the precedent for the rename route) · step ① / step ② cards · .claude/skills/spec-property-retirement

Dedup terms: shutdownTimeout DurationMs, loadTime saveTime unit, estimatedMigrationTime, slideInterval, genuine duration conversion, unit-nowhere durations

---

Generated by Claude Code

[os-bill]

Claim: PM loop round 7
Session: session_01JbZnqu8bt6YqfJsr9vaFb3
Branch: claude/issue-18124-duration-rows-adopt-declaration
Worktree: objectstack-issue-18124
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549; seat 1 is #6017 and this claim does not touch it)
File surface: 卡面点名的行所在文件 —— packages/spec/src/api/contract.zod.ts · data/field-value.zod.ts · kernel/plugin-lifecycle-advanced.zod.ts · kernel/plugin-security-advanced.zod.ts · kernel/plugin-versioning.zod.ts · system/auth-config.zod.ts · system/metrics.zod.ts(⚠️ 逐行按 key+file 重导,行号会漂)。开放并预先申报:.changeset/*.md 与任何门禁反向要求的派生物。只读:packages/spec/src/shared/duration.zod.ts(步骤①落下的声明)与 packages/spec/scripts/check-duration-unit-keys.ts(验收仪器)(stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier
Clause-②: no
Thread-read: none
Serial constraints cleared: 本席名下两条 PR 在飞 —— #18635(队列中)持 contracts/automation-service.ts · services/service-automation/** · types/src/env.ts · content/docs/automation/flows.mdx;#18641(CI 中)持 scripts/check-cross-package-test-inputs.mjs。⛔ 与本卡七个文件皆不相交(⚠️ api/contract.zod.ts ≠ contracts/automation-service.ts,两者名字像但不是同一文件)。
🚨 条件性串行:见下「改名支」——若任一行的诚实答案是改名,那要 ADR-0087 条目、落在 packages/spec/src/migrations/registry.ts,而该文件仍被席 1 的 #17534 持有(其线程点名 5 次)⇒ 停下回报,⛔ 不碰它。

---

🚨 阻塞条件已解除 —— 而且是主题探针证的,⛔ 不是凭卡态

卡面写 Blocked-by: #18122、「pm:blocked until step ① is on origin/main」。#18122 现读 closed / completed —— ⛔ 但卡关了不等于东西落地了。本席先跑了主题探针(⏱️ 读于本评论同一动作,2026-09-17T12:02Z):

LIT   DurationMs 在 packages/spec/src 下的文件数       4
LIT   DurationSeconds                                   4
LIT   CONTROL — EpochMs(已知存在的姊妹)                21
DARK  CONTROL — 伪造的 DurationFortnights(必须 0)      0
声明处:packages/spec/src/shared/duration.zod.ts

⇒ 步骤①的产物在树上。⭐ 顺带一条读数纪律:git log --oneline origin/main | grep -F '(#18122)' 读不到 —— 因为 squash 提交名里带的是合入它的那个 PR 号,不是卡号。卡号不是落地判据,主题探针才是(亮控 (#18631) 读回 1,所以仪器是响的)。

这是裁定的第三步

director 席执行决裁批 #134 item 1(维护者「决裁批 #134 同意」,对 #18115 取 A)。三步:①闭合 duration 类型(已落)②门禁改按声明认(#18123,仍开)③本卡 —— 真正的 duration 行采纳声明。⛔ 方向不可重裁。

本席答不了的三件,写成给 dev 的问题,⛔ 不写成栅栏

1. 每一行的真实单位是什么? 卡面那张表的「likely unit」一列自己就写着「dev measures the producer, ⛔ not this table」。⇒ 逐行量生产者,⛔ 不照抄。
2. ⚠️ 步骤②尚未落地,门禁仍按旧的名形清单认。 一行改用 DurationMs 而名字不带单位时,check-duration-unit-keys 会不会不再看见它、或反而拒绝它?本席没测。⇒ 先测再改,并在报告里说清改动前后该门禁对这些行各读到什么。
3. externalVocabulary 路线:卡面对 maxAge(CORS,RFC 定秒)与 updateAge(better-auth,兄弟 expiresIn 已走该路线)提示该路线合法。是走它还是走 DurationSeconds,由你量兄弟行与生产者后定;⛔ 本席不替你选。

🚨 改名支:若触发,停下回报

卡题写的是「DurationMs/DurationSeconds 或一个带单位后缀的名字」。⇒ 改名是退役,要 ADR-0087 条目,落在 migrations/registry.ts —— 该文件被席 1 的 #17534 持有。⇒ 若任一行的诚实答案是改名,停下回报,⛔ 不开那个文件;本席来排序。回报是正确结果,⛔ 不是失败。

Clause-②: no —— 与 #18114 同一推导

采纳 Duration*(带 .int())在已发布键上收窄接受集;无新导出符号、无新键、无登记行。⇒ no。⚠️ 若第 3 问的答案把某行推向 externalVocabulary 或改名,申报可能要变 —— 那时报回来,⛔ 不自行改行。

查重

MCP search_issues 含 closed:6 条,⛔ 无孪生(#18122 已合、#18123 是步骤②另一张卡、#18075 是门禁的另一缺陷、#15939 已闭)。

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 18124,
  "status": "rework",
  "branch": "claude/issue-18124-duration-rows-adopt-declaration",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18657",
  "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
  "premise_still_valid": true,
  "summary": "Eight of the card's ten ruled rows now declare their unit: six by TYPE (meta.duration, shutdownTimeout ms; slideInterval, resolution seconds; loadTime, saveTime ms) and two by externalVocabulary (cors.maxAge, session.updateAge, both seconds). Each unit was measured at the producer and the reading is printed per row in the PR body — including the two where the measurement came back EMPTY. TWO ROWS ARE REPORTED BACK, not converted: (1) data/field-value.zod.ts FileValue.duration — no producer, no consumer, no documented unit anywhere, and both closed types are hazardous (web/ffprobe convention is FRACTIONAL seconds, which DurationSeconds' .int() would refuse, while DurationMs would be a 1000x contradiction; and FileValueSchema is the ADR-0104 dual-mode STORED inline blob, so .int() narrows against rows that may already exist); (2) kernel/plugin-versioning.zod.ts estimatedMigrationTime — measured unit is HOURS (its JSDoc and its fixtures 8 and 40), which neither closed type covers, and the only remaining route is a RENAME of a published authorable key, owing an ADR-0087 entry in the held migrations registry. The rename branch fired for exactly that one row and this seat STOPPED, without opening packages/spec/src/migrations/**. PR body line 1 is 'Part of #18124', not 'Fixes' — see open_questions.",
  "tests": "BUILD pnpm --filter @objectstack/spec build :: exit 0 (twice; the second after the pin tests landed, because src/** hashes into dist/.build-input-hash-dts). GATES pnpm --filter @objectstack/spec check:generated :: exit 0 ('All 15 generated artifacts are up to date'); check:authorable-surface :: exit 0 (no authorable key added/removed/renamed, no regeneration); check:api-surface :: exit 0; check:docs :: exit 0; check:duration-unit-keys :: exit 0 (zero offenders, no baseline); pnpm check:nul-bytes :: exit 0 plus a manual control-character sweep of the diff (clean). TYPECHECK pnpm --filter @objectstack/spec typecheck :: exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck). TESTS pnpm --filter @objectstack/spec test :: exit 0 — 484 files passed / 1 skipped, 13864 tests passed / 1 skipped. CLAUSE-2 node scripts/pm/check-widening-tells.mjs --declaration no --diff (real 29-file diff) :: exit 0 — 6 files judged against a declared surface, no widening tell, 23 NOT MEASURED (no declared surface / tests); node scripts/pm/check-clause2-carriers.mjs --pair 18657 :: exit 0 — 'the clause-② declaration is readable in the fixed spelling and both carriers agree'. ADR-0087 node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 — 1 declared-breaking changeset carrying 'not-required (no-migration-prescription)'. DURATION CENSUS --list before :: exit 0, 195 unit-declaring keys, 0 offenders, 0 declared duration types, 15 EpochMs, 11 externalVocabulary, 0 dimensionless; all ten ruled rows ABSENT from the census (they declare nothing, so the gate does not admit them). --list after :: exit 0, 203 keys, 0 offenders, 6 declared duration types (== the rows converted by type, the card's acceptance line), 15 EpochMs (DARK CONTROL unmoved), 13 externalVocabulary (+2), 0 dimensionless (DARK CONTROL unmoved). LIT CONTROLS unchanged and still reading as declared: shared/http.zod.ts:143 maxAge, api/http-cache.zod.ts:82 maxAge, auth-config.zod.ts:561 expiresIn, metrics.zod.ts:400 durationSeconds, metrics.zod.ts:847 afterSeconds. DARK CONTROL: the two reported-back rows stayed absent; census grew by exactly 8. RED BEFORE GREEN: the gate that reverse-requires this change is check:docs (with check:skill-refs) — before regeneration check:generated :: exit 1, '2 of 15 artifact(s) stale: skill references / content/docs/references/**'; after --fix :: exit 0. check:duration-unit-keys itself CANNOT go red for an unconverted row (an undeclared key is not admitted to the census, so there is no verdict to fail) — stated plainly, and the gate that CAN is check:docs. ABLATION (from the committed state, trap on EXIT INT TERM, absolute REPO_ROOT, on-disk proof by grep count on the exact anchored text, restore by 'git checkout HEAD -- path' verified by git-hash-object == HEAD blob AND 'git diff HEAD' clean): LEG A mutate slideInterval's describe seconds->ms — deleted-text 1->0, injected-text 0->1, gate exit 1 '[duration-unit-contradicts-schema] metrics.zod.ts:416 slideInterval — typed DurationSeconds (seconds) but the describe says ms', restore hash 2063c360949dc2a35e7fa88501f23ec7cf76970e == HEAD, gate exit 0. LEG B delete updateAge's externalVocabulary marker — marker 1->0, the new pin fails (exit 1) AND the gate fails (exit 1) '[unit-in-prose-not-in-name] auth-config.zod.ts:563 updateAge', restore hash e1fd6e449e6629f5c848f7ff8bd77d3d5aa6132b == HEAD, pin exit 0 (48 passed). LEG B reverses this author's own prediction: the mirror route IS gate-enforceable, because the describe still names the unit after the marker goes. A first ablation attempt was VOID (its anchor matched 2 occurrences — the JSDoc as well as the describe — so the on-disk proof refused the reading); the anchor was corrected and re-run, and that first run is reported rather than silently retried. NOT MEASURED: pnpm --filter @objectstack/spec check:skill-examples :: exit 1 as PREREQUISITE NOT MET (refuses without @objectstack/client-react built) — not a red on this diff. pnpm check:cross-package-test-inputs :: exit 1 and it is NOT this diff — the finding names packages/cli/test/init-created-files-summary.e2e.test.ts descending packages/spec/dist/, and none of this branch's 29 paths touches packages/cli/**, the declaration table or that gate's script (which is this seat's own in-flight PR 18641). node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran reconciles 33 of 110 derived families; the other 77 are the farm and are CI's — a DECLARED narrowing. 26 further derived gates run individually, all exit 0 (skill-refs, exported-any, dual-source-exports, export-origins, liveness, empty-state, variant-docs, yaml-examples, strictness-ledger, doc-frontmatter, docs-single-h1, doc-anchors, spec-docblock-symbol-anchors, pm-widening-tells, watch-hint-literal, merge-driver, spec-parsed-alias, docs-spec-enumerations, quick-reference-counts, published-files, type-source-resolution, skills-token-ratchet, changeset-fixed, empty-changeset, changeset-no-major, test-source-alias).",
  "mcp_calls": "0 — no MCP GitHub tool was called, read or write. Every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "3 — POST /repos/objectstack-ai/objectstack/pulls (draft PR 18657); POST /repos/objectstack-ai/objectstack/issues/18657/labels (additive: documentation, protocol:system, tests, tooling — comparative read-back confirms all four present beside the size-labeler's size/xl, nothing stripped); POST /repos/objectstack-ai/objectstack/issues/18124/comments (this report). No PATCH of any body. git push x2 is git, not a REST write.",
  "open_questions": [
    {
      "question": "PR body line 1 is 'Part of #18124', not the 'Fixes #18124' the dispatch specified. Two ruled rows are reported back rather than converted, so a merge would close a card that step ③ has not finished. AGENTS.md and the os-dev contract both forbid a closing keyword where the merge should not retire the card, and the os-dev contract says the agent file wins a conflict with the dispatch and the conflict is named rather than silently chosen.",
      "options": [
        "A — keep 'Part of #18124' and let the director seat close the card once the two reported-back rows are sequenced (what the PR does today).",
        "B — the seat judges the two reported-back rows out of this card's scope, re-files them, and asks for the body to be edited to 'Fixes #18124'."
      ],
      "recommendation": "A, because the card's own acceptance line asks for zero undeclared time-shaped refusals across the whole ruled population, and two of the ten rows are undelivered; check:partof-closing-keyword also blocks a body that says 'Part of #N' while telling GitHub to close that same #N, so the two spellings cannot coexist."
    },
    {
      "question": "The PR body carries the seat-derived 'Clause-②: no' verbatim, but the changeset carries 'Clause-②: no (narrowing)'. The (narrowing) arm is what makes the changeset declared-breaking, which check:adr-0087-registration then requires a disposition for, and which the card itself demands ('BREAKING banner ... for any renamed or newly-refusing row'). Three rows do newly refuse: meta.duration, loadTime and saveTime were bare z.number() and are now .int().nonnegative().",
      "options": [
        "A — leave both as they are. check-clause2-carriers --pair 18657 exits 0 and reports that both carriers AGREE, so the two spellings are not in conflict for any gate.",
        "B — add the (narrowing) arm to the PR body line too, so the two read identically."
      ],
      "recommendation": "A — the seat said ⛔ not to change the line itself, the pair predicate is green, and the narrowing is stated in full prose in the body anyway. Flagged here because the seat asked to be told if a measurement moved the declaration; it did not move the yes/no, only the arm."
    },
    {
      "question": "Route choice for the two externalVocabulary rows was left to this seat. cors.maxAge took the mirror route because its identical TWIN (shared/http.zod.ts CorsConfig.maxAge, the same Access-Control-Max-Age field) already carries exactly that marker, and giving the twin a different declaration would make one field read two ways. updateAge took it because the schema's own comment already describes the expiresIn/updateAge PAIR as better-auth names forwarded verbatim while only expiresIn carried the marker. Step ①'s own test file, however, names session.updateAge as 'the only default in the seconds half' of DurationSeconds — i.e. step ① anticipated the TYPE route for it.",
      "options": [
        "A — keep the mirror route for both (what the PR does). DurationSeconds is not orphaned: slideInterval and resolution adopt it.",
        "B — give updateAge DurationSeconds instead, matching step ①'s docblock, and accept that its sibling expiresIn then declares differently.",
        "C — give updateAge BOTH the type and the marker."
      ],
      "recommendation": "A, because the sibling is the stronger evidence the dispatch asked to be measured, and because a marker the gate can never refuse would be an allowlist wearing a .meta() — whereas ablation leg B proves the mirror route here IS refusable."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: MetricsConfig.retention.downsampling[].resolution gains its unit in the JSON Schema (json-schema/system/MetricsConfig.json) but NOT on the rendered reference page — build-docs.ts emits a nested table for an object-valued member (KernelSecurityPolicy.cors gains one in this very diff) and not for an ARRAY-of-object member, so downsampling stays a one-line type signature. Boundary case, deliberately not widened into a class: the declaration is correct and does reach a published channel. Who will hit this file next: whoever converts another array-item row, i.e. the same duration programme. Not filed because it is a generator polish item, not a defect, an incompleteness or an authoring trap.",
    "noted, not filed: RestServerConfig.responseFormat.includeMetadata and PluginRestApiConfig.includeMetadata both declare 'include response metadata (timestamp, requestId)' and nothing in packages/rest/src writes that block — measured with a lit control (packages/rest/src contains no 'timestamp:' writer at all). Declared but unimplemented, which is the Prime Directive #10 shape. Handover: none identified — no open PR or seat touches packages/rest's envelope today, and this is stated rather than left implied. Not filed only because it is one layer out from this card and the census rows it explains are already reported; the seat may want it as its own card.",
    "noted, not filed: pnpm check:cross-package-test-inputs is RED on origin/main independently of this diff — packages/cli/test/init-created-files-summary.e2e.test.ts descends packages/spec/dist/ with no declared glob reaching inside it. Handover: identified — scripts/check-cross-package-test-inputs.mjs is named in this dispatch as this seat's own in-flight PR 18641, which is the owner of that gate's current widening. Not filed to avoid duplicating an in-flight card.",
    "PREMISE CORRECTION, reported rather than filed: the dispatch states 'Step ② has NOT landed (#18123 is still open)'. Its SUBJECT has landed — commit 8ca7aafc45 (PR 18486, 'spec(gate): check-duration-unit-keys admits by declaration — retire the name-shape token list') carries 'Part of #18123' rather than a closing keyword, so the card stayed open while the behaviour shipped, and DURATION_ROOTS already maps DurationMs and DurationSeconds on this branch's merge base 922c75588. The dispatch's own subject-probe rule is what caught it. Consequence for the dispatch's question 2: the gate neither stops seeing a converted row nor starts refusing it — before, it did not see ANY of the ten rows, because a key that declares nothing is never admitted to the census.",
    "STALE DOCBLOCK, reported rather than filed: packages/spec/src/shared/duration.zod.ts still says 'Until step ② lands ... the gate recognises exactly one identifier root today, EpochMs'. That sentence has been false since 8ca7aafc45. Deliberately NOT corrected in this PR — it is a doc nit in a file this card does not otherwise need to touch, and correcting prose about step ② inside step ③'s diff would bury it. Handover: identified — #18123's closing PR is the natural place."
  ]
}

---

Generated by Claude Code

[os-bill]

ACCEPT(部分交付) — PR #18657,十行里八行。domain:spec seat 2(session_01JbZnqu8bt6YqfJsr9vaFb3,座位贴 #18549),R7。⏱️ 本条读数取自同一动作:2026-09-17T12:46Z。对 GitHub 与树核验,⛔ 不对终报自述核验。

形态与范围

GET /pulls/18657:draft: true · base: main · head 43b24d4c70 · changed_files: 29 · +955 −77。首行 Part of #18124,全文零个闭合关键词 —— ✅ 正确:两行未交付,合并 ⛔ 不该关卡。Clause-②: no;1 个页脚。 ⏱️ 补记取数时刻(巡检 H44 的补正,⛔ 非重测):本段这组 GET /pulls/18657 读数取于本评论自身的 created_at,由 API 实读回 2026-09-17T12:46:46Z;所判 head 即 43b24d4c70。⛔ 未重新测量后冒充原读数。

⛔ 持有文件一个没碰:packages/spec/src/migrations/**(席 1 的 #17534)、check-duration-unit-keys.ts(#18123)、check-cross-package-test-inputs.mjs(本席已落地的 #18641)—— 逐条核过,NONE。

---

🚨 本席派发令里有一条前提是错的,dev 用本席自己写给它的规则逮到了

派发令写:「步骤② 尚未落地(#18123 仍开),门禁仍按旧的名形清单认」。

dev 报回:步骤②的行为早就落了 —— 提交 8ca7aafc45(PR #18486)带的是 Part of #18123 而不是闭合关键词,所以卡开着而行为已发。本席复核,属实,并且更彻底: ⏱️ 补记取数时刻（巡检 H44 的补正，⛔ 非重测）：本段的树读数取于本评论自身的 created_at，由 API 实读回 2026-09-17T12:46:46Z。⛔ 未重新测量后冒充原读数。

origin/main 的 check-duration-unit-keys.ts 已按声明认(DURATION_ROOTS / INSTANT_ROOT)
提交正文逐字:「⚠️ Deliberately **not** a closing keyword: one acceptance item
              on the card is answered conservatively rather than literally,
              and the reviewing seat should rule on it before the card closes.」
LIT CONTROL — 该文件里 EpochMs 出现次数   23
DARK CONTROL — 伪造 root                   0
⇒ 而且 #18123 现在读 closed —— 本席派发时读的「仍开」也已过时。

⭐ 这正是本席在同一份派发令里教它的规则,被它用在了反方向:本席写的是「卡关了不等于东西落地了,主题探针才是判据」;它读成了同样成立的另一半 —— 卡开着也不等于东西没落地。⇒ 纪律补全成一句:卡态与落地之间没有任何方向的蕴含关系;两个方向都只能用主题探针答。

⚠️ 后果:本席那条「先测门禁改动前后怎么读这些行」的问题建在假前提上。dev 照测不误,并给出了真答案:改动前门禁根本看不见这十行中的任何一行 —— 一个什么都不声明的键从不被纳入普查。⇒ 问题答到了,只是不是本席框定的那个形状。

---

三个待答问题 —— 全部取 A,理由本席逐条核过

Q1 Part of 还是 Fixes ⇒ A,保持 Part of。十行交付八行,合并若关卡就关掉了一张步骤③没做完的卡。dev 还引了 check:partof-closing-keyword(正文说 Part of #N 同时又叫 GitHub 关 #N 会被拦),⇒ 两种拼法本就不能共存。⭐ 这是本班第五次靠这个拼法避免误关。

Q2 正文 Clause-②: no 与 changeset Clause-②: no (narrowing) ⇒ A,两边都不动。--pair 18657 读 exit 0 并报「both carriers agree」⇒ 对任何门禁都不构成冲突;(narrowing) 那一臂正是让 changeset 成为 declared-breaking、从而被 check-adr-0087-registration 要求给出处置的那一臂(它读 exit 0,带 not-required (no-migration-prescription))。⇒ 测量没有移动 yes/no,只定了臂。本席说过「⛔ 不自行改那行」,它没改,报上来了 —— 处置正确。

Q3 updateAge 走 mirror 路还是 DurationSeconds ⇒ A,mirror 路。判据取它给的更强证据:同一字段的孪生 shared/http.zod.ts 的 CorsConfig.maxAge 已经带着同一个 marker,给孪生两种声明会让一个字段读出两种意思;而 updateAge 的兄弟 expiresIn 已在该路线上。⭐ 而且它的消融腿 B 反过来推翻了它自己的预判:删掉 marker 后门禁确实变红([unit-in-prose-not-in-name])⇒ mirror 路是可被门禁拒绝的,⛔ 不是「披着 .meta() 的白名单」。步骤①的 docblock 曾预期 type 路线,但那是预期,⛔ 不是裁定。

---

⛔ 两行报回来了,而且报得对

• FileValue.duration —— 无生产者、无消费者、任何地方都没有成文单位;而两个闭合类型都有害:web/ffprobe 惯例是小数秒(DurationSeconds 的 .int() 会拒),DurationMs 则是 1000× 的矛盾;且 FileValueSchema 是 ADR-0104 的双模已存储内联 blob,.int() 会对可能已存在的行收窄。
• estimatedMigrationTime —— 实测单位是小时(JSDoc 与 fixtures 8 / 40),两个闭合类型都不覆盖,唯一剩下的路是改名一个已发布的可authoring 键 ⇒ 欠 ADR-0087 条目 ⇒ 落在被持有的 migrations/**。

⇒ 🚨 改名支恰好为这一行触发,而 dev 停下了、⛔ 没开那个文件 —— 派发令里那条 ⛔ 生效了,而且它明白「回报是正确结果,不是失败」。受理。

⚠️ 这两行都不是 dev 能定的:一个要定单位(或退役),一个要定改名。⇒ 本卡合并后 ⛔ 不关,余下两行的去向由本席在落地时按 Part of 收口规则安置,⛔ 不在此刻替维护者选。

⏱️ 后续处置(EDIT,⛔ 非原文改写) —— 本补记所属动作的时刻由 API 实读:决策卡 #18669 的 created_at = 2026-09-17T13:30:38Z。这两行已按巡检 H52 的处方另立决策卡 #18669(执行既有裁决时长出的残留问题 ⇒ 立新卡并链回本卡,⛔ 不在本卡重挂 needs-user-decision)。⭐ 该卡带来一条改变结论的实测:门禁的采纳通道有三条而非两条 —— 其 docblock 逐字「carries it in its NAME or in its TYPE」,即键名自带单位即被采纳,值类型不必是闭合类型。⇒ 两行都有一条不加新类型、不收窄已存储数据的出路(durationSeconds / estimatedMigrationTimeHours),且 migrations/registry.ts 里已有两次同形先例。

---

⭐ 三条方法上值得记的

1. 红先于绿,并且诚实地说明哪个门禁办不到:它指出 check:duration-unit-keys 不可能为一个未转换的行变红(未声明的键从不入普查,没有裁决可失败),然后点名真正能红的是 check:docs,并给出 exit 1 → exit 0 的对照。⇒ 这正是本席上一轮学到的那条(「要求门禁 X 演示成红前,先确认 X 读得到你改的东西」),它自己做到了。
2. 第一次消融被判作废并重跑:锚点匹配到 2 处(JSDoc 与 describe 各一),on-disk 证明拒绝了该读数 ⇒ 改锚点重跑,并把作废那次报出来,⛔ 不静默重试。
3. 暗控用在了「不该动的东西没动」上:EpochMs 计数 15 不变、dimensionless 0 不变、两行报回来的仍然缺席、普查恰好增长 8。

out_of_scope_findings

四条自标 noted, not filed 并各自点名后继;其中 shared/duration.zod.ts 的陈旧 docblock(仍写「Until step ② lands … 只认 EpochMs」)—— 它故意不在本 PR 改,理由是「在步骤③的 diff 里改步骤②的散文会把它埋掉」,并点名 #18123 的收口 PR 是自然位置。⭐ 判断正确,⛔ 本席不代改。
check:cross-package-test-inputs 那条已由本席的 #18641 落地修掉(squash e1f4f06d1d),⛔ 不再是遗留项。 ⏱️ 补记取数时刻（巡检 H44 的补正，⛔ 非重测）：本段的树读数取于本评论自身的 created_at，由 API 实读回 2026-09-17T12:46:46Z。⛔ 未重新测量后冒充原读数。

---

CI 待收敛后当场跑落地前检三条。

---

Generated by Claude Code