chore(spec): raise MIGRATION_SUPPORT_FLOOR from 10 to 16 — upgrades are supported from protocol 16 onward

[os-steve]

维护者裁决,2026-09-18,直接下达给 domain:spec#4 席位(session_01AmH9bKvGoLjiY86Q4Z3og2)。原话:

升级只需要支持从 16.0版本开始。

⇒ MIGRATION_SUPPORT_FLOOR(packages/spec/src/migrations/registry.ts:48)由 10 抬到 16。

⛔ 本卡由席位代录,⛔ 席位不是裁决人;裁决归维护者,记录在案是为了让它不停留在 chat(结论只在 chat 是半状态)。

口径

PROTOCOL_VERSION = '17.0.0'(kernel/protocol-version.ts:18),@objectstack/spec 包版本 17.4.0,step18 是在研大版本。⇒ 「16.0」读作协议大版本 16,与 MIGRATION_SUPPORT_FLOOR 同单位。⚠️ 该口径已回呈维护者确认,未被否定前按此执行。

变更内容

下限为 16 ⇒ --from 16 必须可用 ⇒ 需要 step17(16→17)与 step18(17→18)。step11–step16 成为死代码。

项	处置
MIGRATION_SUPPORT_FLOOR	10 → 16
step11–step16 及其在 MIGRATIONS_BY_MAJOR 的登记	删除
entries/ 下前缀 11. 12. 13. 15. 16. 的条目文件(共 10 个;major 14 为 0)	删除后重新生成,⛔ 不在 <os-generated> 标记间手改
RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR 中 11–16 的行	⚠️ 先测再决定 —— 见下方未决项
低于 16 的重放夹具	随链删除(migrations.test.ts 从最老受支持大版本重放全链)

⭐ 一个必须先测的未决项,⛔ 不要顺手删

RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR 记录「某个可授权键在哪个大版本被立墓碑」。这两张表是否只服务于迁移链,还是也被 schema 里的 retiredKey() 墓碑或 build-schemas.ts 读作独立事实? 已知 packages/spec/scripts/build-schemas.ts:113 就 import 了这两个符号。

⚠️ registry.ts 头部写明:两张表都按集合消费,一次丢掉条目的改动在任何地方都不报错,被声明的退役就静默失效(#6957,613 行手工冲突的教训)。⇒ 删 11–16 的行之前,必须先证明没有任何读者把它们当作「这个键已退役」的事实来源。测不出来就保留,并在卡上说明。

席位实测的爆炸半径(2026-09-18T14:4xZ,origin/main)

step	行数	占 registry.ts
step11	61	0.4%
step12	41	0.2%
step13	104	0.6%
step14	27	0.2%
step15	45	0.3%
step16	54	0.3%
step11–16 合计	332	1.9%
step17	4,708	27.5%
step18	12,041	70.2%

entries/ 共 598 个条目文件,按大版本前缀:11=2 · 12=1 · 13=5 · 14=0 · 15=1 · 16=1 · 17=159 · 18=429。

⭐ 所以:本卡不是一张"瘦身"卡。 文件体积的 98.1% 是 step17+18,而它们必须留下。席位此前向维护者建议「抬下限可显著瘦身」是未经测量的错误建议,在此更正;本卡的价值在支持承诺收窄(6 条永久可重放链不再需要维护、夹具与 CI 重放缩短),⛔ 不在行数。

代价,须写进 changeset

MIGRATION_SUPPORT_FLOOR 是 @objectstack/spec 的公开导出(migrations/index.ts:23)。抬高后 applyMetaMigrations(doc, N) 对 N ∈ 10..15 抛 MigrationFloorError(chain.ts:73-74)。停在协议 10–15 的用户失去一条命令直升的路径。

⇒ Clause-②: yes(收窄已发布面),达档合约复核;changeset @objectstack/spec major 或 minor 由施工方按仓库口径判定,正文写明支持下限变更与受影响版本区间。

已知读者(按符号取,⛔ 非文件名)

migrations/index.ts:23(公开导出)· migrations/chain.ts:18,73,74 · migrations/migrations.test.ts:15,56,387,445,493 · packages/spec/scripts/build-spec-changes.ts:65,194,198,213,214 · packages/spec/scripts/build-upgrade-guide.ts:24,40,60 · packages/spec/scripts/build-schemas.ts:113(读两张退役表)

查重词

MIGRATION_SUPPORT_FLOOR · migration support floor · migrate meta --from · MigrationFloorError · RETIRED_KEYS_BY_MAJOR

⛔ 立卡席不查重(本席只附词);分诊按词查自有列表,零命中须控制词背书。

---

Generated by Claude Code

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 13
Session: session_01AmH9bKvGoLjiY86Q4Z3og2
Branch: claude/issue-19056-migration-support-floor-16
Worktree: objectstack-issue-19056
Domain: domain:spec
Seat: domain:spec#4(座位贴 #18917)
File surface: packages/spec/src/migrations/**(registry、chain、entries、测试)+ 读者侧 packages/spec/scripts/build-spec-changes.ts、build-upgrade-guide.ts、build-schemas.ts
Container & model: M, mode:subagent, model: default judgement tier
Clause-②: yes
Thread-read: 0 comment(s) on this card at 2026-09-20T09:37Z(卡面无评论)

⏱️ 2026-09-20T09:37Z 取数。⛔ 并发:本轮本席同时派 5 张,其余四张的面是 src/system/job.zod.ts、src/stack.zod.ts、src/shared/suggestions.zod.ts、src/ui/view.zod.ts —— ⛔ 与本卡不相交。

授权:维护者的字,⛔ 不重开

本卡正文记的是 2026-09-18 维护者直接下达的裁决,原话「升级只需要支持从 16.0版本开始」⇒ MIGRATION_SUPPORT_FLOOR 由 10 抬到 16。⭐ 方向 ⛔ 不再论证,本轮只执行。口径(「16.0」读作协议大版本 16)已回呈维护者,未被否定。

⭐⭐ 一个必须先测的未决项 —— ⛔ 不要顺手删

RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR 记录「某个可授权键在哪个大版本被立墓碑」。

这两张表是只服务迁移链,还是也被 schema 的 retiredKey() 墓碑或 build-schemas.ts 读作独立事实? 已知 packages/spec/scripts/build-schemas.ts:113 就 import 了这两个符号。

⚠️ registry.ts 头部写明:两张表都按集合消费,一次丢掉条目的改动在任何地方都不报错,被声明的退役就静默失效(#6957,613 行手工冲突的教训)。

⇒ 删 11–16 的行之前,必须先证明没有任何读者把它们当作「这个键已退役」的事实来源。⭐ 测不出来就保留,并在 PR 上说明为什么。 这一条比省下几行代码重要得多。

变更表(卡面已定)

MIGRATION_SUPPORT_FLOOR 10→16 · 删 step11–step16 及其在 MIGRATIONS_BY_MAJOR 的登记 · entries/ 下前缀 11. 12. 13. 15. 16. 的 10 个条目文件删除后重新生成(⛔ 不在 <os-generated> 标记间手改)· 低于 16 的重放夹具随链删除。

⛔ 本卡不是一张「瘦身」卡

卡面自带更正:文件体积的 98.1% 是 step17+18(step11–16 合计 332 行 / 1.9%),而 17、18 必须留下。⭐ 本卡的价值在支持承诺收窄(6 条永久可重放链不再需要维护、夹具与 CI 重放缩短),⛔ 不在行数。不要在 PR 里把它写成瘦身。

代价,须写进 changeset

MIGRATION_SUPPORT_FLOOR 是 @objectstack/spec 的公开导出(migrations/index.ts:23)。抬高后 applyMetaMigrations(doc, N) 对 N ∈ 10..15 抛 MigrationFloorError(chain.ts:73-74)⇒ 停在协议 10–15 的用户失去一条命令直升的路径。

⇒ Clause-②: yes(收窄已发布面),欠一次达档契约复核(本席会起隔离子代理,⛔ 不自审)。changeset 的 major 还是 minor 由你按仓库口径判定并给读数,正文写明支持下限变更与受影响版本区间。

已知读者(按符号取,⛔ 非文件名)

migrations/index.ts:23 · chain.ts:18,73,74 · migrations.test.ts:15,56,387,445,493 · scripts/build-spec-changes.ts:65,194,198,213,214 · scripts/build-upgrade-guide.ts:24,40,60 · scripts/build-schemas.ts:113

顶回条款

⭐ 任何一条你量出做不到、或与卡面/实测抵触,照实顶回来。尤其那个未决项:保留是完全可接受的交付,⛔ 静默删除不是。

---

Generated by Claude Code

[os-steve]

os-dev-report

{
  "issue": 19056,
  "status": "done",
  "branch": "claude/issue-19056-migration-support-floor-16",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19302",
  "session": "session_01AmH9bKvGoLjiY86Q4Z3og2",
  "premise_still_valid": true,
  "summary": "MIGRATION_SUPPORT_FLOOR raised 10 -> 16 in packages/spec/src/migrations/registry.ts; step11-step16 (328 lines) and their MIGRATIONS_BY_MAJOR registrations deleted; the 10 entries/semantic/ files prefixed 11. 12. 13. 15. 16. deleted and the marked regions re-emitted by gen:migration-registry, never hand-edited between the markers. spec-changes.json, docs/protocol-upgrade-guide.md and api-surface-declarations/root.txt regenerated by check:generated --fix (exactly the 3 it proved stale). Tests in migrations.test.ts re-pointed off the literal 10 onto MIGRATION_SUPPORT_FLOOR, plus four new assertions the old ones could not see (no step survives at or below the floor; --from floor is a usable command; every dropped major is refused by name with fromMajor/floor/message; the chain-replay gate states why a below-floor conversion leaves it, with an anti-vacuity case). BOTH RETIREMENT TABLES KEPT WHOLE - see the first open_question entry for the proof. Changeset is minor + **BREAKING** + Clause-2 narrowing, because the repo bans major during the launch window. One declared out-of-surface fix in packages/cli. The card arrived with assignee os-steve already set by the PM dispatch; I wrote no assignee and posted no second claim.",
  "tests": "ALL exit codes captured before any pipe (cmd > file 2>&1; EXIT=$?). GREEN: pnpm --filter @objectstack/spec test -> 500 files / 14,639 tests pass, 1 file+1 test skipped (pre-existing), VERDICT command-exit 0. pnpm --filter @objectstack/spec typecheck -> Done, green. pnpm --filter @objectstack/cli run typecheck -> exit 0, 0 errors (see NOT MEASURED note below for the first attempt). pnpm --filter @objectstack/cli exec vitest run --project unit -> 219 files / 3,082 tests pass. pnpm --filter @objectstack/spec check:generated -> 16 artifacts, 3 proved stale (spec-changes.json, protocol-upgrade-guide.md, api-surface-declarations/), --fix regenerated only those 3; check:authorable-surface and check:api-surface green throughout, i.e. no tombstone lost its declaration. check-adr-0087-registration --base origin/main -> exit 0, reads the changeset as [BREAKING+bang+clause-2-narrowing] not-required (no-migration-prescription). check-changeset-no-major -> exit 0. check-empty-changeset -> exit 0. GATE SWEEP: derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (90 families, derived from this tree, NOT from a hand-written list), then reconciled with --ran: 90 derived, 88 run green, 1 NOT-MEASURED, 1 UNRUN. Full green list includes check:nul-bytes, check:published-files, check:cross-package-test-inputs, check:test-source-alias, check:type-check-coverage, check:type-check-debt, check:merge-driver, check:dts-closure, check:dual-build-cjs-loads, check:i18n, check:i18n-coverage, check:engine-double-contract, check:pm-governed-merges, check:pm-widening-tells, check:closing-keyword-parity, check:undeclared-dep-imports, check:spec-docblock-symbol-anchors, check:comment-mask-adoption/-corpus, check:keyed-text-bounds, docs-audit/check-affected-docs, docs-audit/check-drift-comment, and the spec source audits (exported-any, dual-source-exports, empty-state, entry-nameability, browser-reachable-entries, llms-txt, objectui-pin-citations, variant-docs, duration-unit-keys). EXIT 3 = PREREQUISITE NOT MET, neither a pass nor a finding: pnpm check:type-check-debt FIRST exited 3 (30 workspace dependencies had no built dist/*.d.ts). I then built the closure (turbo run build over ./packages/* and ./packages/*/* -> 72 tasks successful) and RE-RAN it: exit 0, 77/81 packages type-checked, 4 ledger entries re-measured, none above its recorded number. SAME CAUSE, SAME CURE: the first packages/cli typecheck reported 316 errors, 231 of them TS2307 plus the usual implicit-any cascade, including the only one inside my edited file (meta.ts:709, a line this PR does not touch). After the closure build it is 0 errors. That first reading was an unbuilt closure, not a finding. NOT MEASURED (1, named): pnpm check:pm-dispatch-gates - its self-test does not finish inside this container's ~10-minute foreground cap; killed at 500s and again at 520s (exit 124, a timeout, NOT a gate verdict - deliberately left OUT of the --ran record so it reads UNRUN rather than as a failure). 1,702 passing assertions printed before the cut and no failure line. CI owns this one. ABLATION (the card's starred item), committed first, both legs proved on disk by scripts/ablation-replace.mjs: mutation anchor 1 -> 0, blob d4cb483a4fc5 -> 7cf35c8f1b3e; restore blob == HEAD (d4cb483a4fc5) and git diff HEAD empty. No dist preflight needed: build-schemas.ts imports ../src/migrations/registry directly under tsx, not through dist. One earlier attempt was REFUSED by the tool (anchor count did not drop because my replacement contained the anchor) and it restored cleanly - that attempt measured nothing and is reported rather than quietly retried.",
  "mcp_calls": "0 - no MCP GitHub tool was called, read or write. Every GitHub read and write went through the REST proxy with curl and GITHUB_TOKEN.",
  "api_writes": "2 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR #19302, HTTP 201) and POST /repos/objectstack-ai/objectstack/issues/19056/comments (this report). Plus 4 git pushes to the one branch (the empty-branch routing probe, then three WIP pushes) - no force-push. 0 label writes: the dispatch order named no labels and skip-changeset does not apply (this PR ships a changeset), so the write scope is empty by the rule, not skipped. Reads (not writes): GET issue 19056, GET comment 5748996208, GET pull 19302 for the body read-back. PR body was read back after creation: byte-identical to what was sent, exactly one attribution footer, no sanitizer mutation, no angle-bracket fragments and no HTML comments anywhere in it.",
  "open_questions": [
    {
      "question": "STARRED ITEM, ANSWERED, NOT DEFERRED: is anything other than the migration chain reading RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR as the fact 'this key was retired'? YES - and both tables are KEPT WHOLE, nothing was deleted from either. Three measurements. (1) Neither table has a row under 11-16 AT ALL: both literals carry exactly two keys, 17 and 18, and entries/retired-keys/ and entries/retired-defs/ hold only 17.* and 18.* files (195 and 181). The card's change-table row 'rows 11-16' describes rows that do not exist, so there was nothing to delete even before the safety question. (2) STRUCTURAL: chain.ts - the floor's only enforcement point - imports MIGRATIONS_BY_MAJOR, MIGRATION_MAJORS and MIGRATION_SUPPORT_FLOOR and NEITHER table; the tables' only non-test importer is packages/spec/scripts/build-schemas.ts:116 (check:authorable-surface, checks b/b2/b3/c), which folds Object.entries across EVERY major into one set and never mentions MIGRATION_SUPPORT_FLOOR at all - the major is kept only to date a tombstone's aging clock. (3) ABLATION: a row naming a LIVE key was planted under major 11 - a major whose step this PR deletes - and check:authorable-surface still read and judged it: '1 RETIRED_KEYS_BY_MAJOR entr(ies) name a key that is still LIVE: - data/Object:access (registered at major 11)'. Control: the same gate is green unmutated. So a row below the floor is still live proof the retirement was declared, and dropping one errors nowhere at the moment it is dropped - exactly #6957. Both structural facts are now pinned in packages/spec/src/migrations/retired-tables-not-floor-scoped.test.ts so the next floor move reads them first. Same reasoning kept the D2 conversion registry untouched: every rehydration seam replays the FULL conversion chain over stored sys_metadata rows, so the protocol-11/13/14/15 conversions keep converting rows at rest. No decision is owed here - this is the measurement the card asked for.",
      "options": [
        "no decision required - reported for the record"
      ],
      "recommendation": "No action. Both tables intact; the finding is pinned by a test rather than left in prose."
    },
    {
      "question": "A GENUINE RULE CONFLICT I did not resolve silently. skills/objectstack-upgrade/SKILL.md:103 advertises 'os migrate meta --from 10', which REFUSES after this change - a published example that fails when copied verbatim, i.e. the class my instructions say a change must fix when it makes it false. But skills/** is a Tier H governed surface and one governed path forks the WHOLE PR to Tier H (AGENTS.md Prime Directive #14), which would hold this ordinary code change for the maintainer's hand. I left it untouched and named it in the PR's Acceptance notes rather than picking a side.",
      "options": [
        "A - leave as is; a seat lands a separate one-line docs-only PR against skills/objectstack-upgrade/SKILL.md (Tier H, needs the maintainer's word for that PR alone)",
        "B - fold it into PR #19302, which converts #19302 to Tier H and blocks it behind a maintainer approval",
        "C - leave it stale until the next skills/ edit touches the file for other reasons"
      ],
      "recommendation": "A. It keeps #19302 landable through the ordinary queue and pays the Tier H cost only on the one line that actually needs it. C is not acceptable: the example refuses the moment this PR lands."
    },
    {
      "question": "Changeset level: major or minor, which the card left to me with the reading shown. I wrote MINOR, and the reading is that this is the repo's own convention and not a severity judgement. scripts/check-changeset-no-major.mjs REFUSES a major bump for the duration of the launch window - every publishable package sits in one Changesets fixed group, so a single major promotes all ~70 packages - and it names the two carriers that replace the bump level meanwhile: the **BREAKING** banner and the ADR-0087 disposition. The change IS breaking: MIGRATION_SUPPORT_FLOOR is a public export (migrations/index.ts:23), applyMetaMigrations(doc, N) now throws MigrationFloorError for N in 10..15, and the constant's literal TYPE narrows from 10 to 16. Both carriers are in the body, plus 'Clause-2: yes (narrowing)'. Measured: check-adr-0087-registration exits 0 and classifies it [BREAKING+bang+clause-2-narrowing] not-required (no-migration-prescription) - no authorable surface moves, so there is no source rewrite for a D2 conversion or D3 entry to carry; what narrows is an accepted ARGUMENT RANGE, which the ledger has no vocabulary for. Flagging it because the level is the PM's to overrule: if a major IS intended, the escape hatch is the allow-major PR label, not an edit to the changeset.",
      "options": [
        "minor + **BREAKING** banner + ADR-0087 disposition (what shipped)",
        "major behind the allow-major label"
      ],
      "recommendation": "minor, as shipped - the guard refuses major outright and names these carriers as the substitute during the launch window."
    },
    {
      "question": "needs:contract-review is the seat's to hang, so I neither added nor removed it. Reading, for the record: node scripts/pm/check-clause2-carriers.mjs --pair 19302 exits 4 (C3) - card #19056 declares Clause-2: yes while NEITHER the card NOR PR #19302 carries needs:contract-review, and the label event stream shows it was never hung on either carrier. PR #19302 currently has zero labels.",
      "options": [
        "seat hangs needs:contract-review on both carriers and runs the contract review sub-round"
      ],
      "recommendation": "Seat action. The PR is draft and not armed; nothing is racing it."
    }
  ],
  "out_of_scope_findings": [
    "to file (3 classes, dedupe words: migrate meta --from, MigrationFloorError, MIGRATION_SUPPORT_FLOOR, protocol-handshake, migrateCommand): class (a) reproducible defect - packages/metadata-core/src/protocol-handshake.ts:252 builds 'objectstack migrate meta --from TARGET' from the incompatible package's own declared target major with no clamp to the support floor, so a package targeting a major below the floor is handed a command that throws MigrationFloorError. Pre-existing (its own test at protocol-handshake.test.ts:164 already pins a '--from 6' answer) and WIDENED by this card from 'below 10' to 'below 16'. Out of this card's surface, in another package, and not created by this change.",
    "to file (3 classes, dedupe words: objectstack-upgrade SKILL, migrate meta --from 10, Tier H, support floor): class (a) reproducible defect - skills/objectstack-upgrade/SKILL.md:103 advertises 'os migrate meta --from 10', an example that refuses verbatim once this lands. Deliberately NOT fixed here: skills/** is Tier H and would fork PR #19302 whole. See open_questions entry 2 - this is the rule conflict, named rather than resolved.",
    "noted, not filed: the card's own blast-radius table over-counts step18. It lists 12,041 lines; measured on src/migrations/registry.ts at e6a03e649 (17,718 lines) the step18 BLOCK is 7,565. The 12,041 figure runs from step18 to end of file and therefore absorbs MIGRATIONS_BY_MAJOR plus BOTH retirement tables - about 5,077 lines, i.e. precisely the tables the same card says must not be deleted. Full measurement: step11-16 = 328 (1.9%), step17 = 4,699 (26.5%), step18 = 7,565 (42.7%), map + retirement tables = 5,077 (28.7%), header = 49. The card's CONCLUSION is unaffected and stands - this is emphatically not a slimming card. Carrier: none - no open PR touches this file; the correction lives in PR #19302's body and its changeset so the next reader of either finds it.",
    "noted, not filed: docs/adr/0087-metadata-protocol-upgrade-contract.md:181,426 and content/docs/releases/v15.mdx:520 narrate 'migrate meta --from 10' as HISTORY. Both are correct as history and both sit on surfaces a code PR must not edit (governed Tier H; release-owned). Carrier: none.",
    "noted, not filed: packages/spec/scripts/build-upgrade-guide.ts is a gate script, so clause 5 of the local verification scope asks for its own test suite on top of the derived families. Measured: git grep finds NO test file anywhere in the repo naming build-upgrade-guide, so that obligation is empty here rather than skipped. check:upgrade-guide itself is green and the full spec suite ran."
  ]
}

---

Generated by Claude Code

[os-steve]

⛔ 本卡两处出自本席的读数被 dev 实测推翻 —— 记录在此,⛔ 不删原文

domain:spec seat 4(session_01AmH9bKvGoLjiY86Q4Z3og2),⏱️ 2026-09-20T12:50Z。本卡由本席代录维护者裁决并撰写,以下两处都是本席自己量的,都错了。

① ⭐ 本席让人「先测再决定」的那几行,根本不存在

卡面变更表写:

RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR 中 11–16 的行 ⇒ ⚠️ 先测再决定

dev 实测(报告 5749891889):两张表在 11–16 下没有任何一行。两个字面量各自只有 17 和 18 两个键;entries/retired-keys/ 与 entries/retired-defs/ 下只有 17.* 和 18.*(195 与 181 个文件)。

⇒ 本席描述了一组不存在的行,并围绕它设了一道「先测再决定」的关卡。 该关卡本身无害(它逼出了下面那个真读数),但卡面那一行是错的。

⭐ 而安全问题被 dev 做实了,用的是消融而不是论证:在 major 11(本 PR 正要删掉其 step 的那个 major)下种一行指向活键的记录,check:authorable-surface 仍然读到并判了它——

1 RETIRED_KEYS_BY_MAJOR entr(ies) name a key that is still LIVE:
  - data/Object:access (registered at major 11)

对照:同一门禁在未变异时是绿的。⇒ 低于下限的行仍是「该退役曾被声明」的活证据,而删掉它在当场不会报任何错 —— 逐字就是 #6957 的形状。两张表整个保留,且 dev 把这两条结构事实钉进了 retired-tables-not-floor-scoped.test.ts,让下一次抬下限的人先读到它们,而不是重新发现一遍。这比本席原来设想的交付好。

② 本席的爆炸半径表把 step18 多算了约 5,077 行

卡面写 step18 = 12,041 行 / 70.2%。dev 实测:step18 的块是 7,565 行。那个 12,041 是从 step18 一路数到文件末尾,于是把 MIGRATIONS_BY_MAJOR 与两张退役表(约 5,077 行)一并吞了进去 —— ⚠️ 恰恰是同一张卡写着「不许删」的那两张表。

实测分布(registry.ts 在 e6a03e649,17,718 行):step11–16 328(1.9%)· step17 4,699(26.5%)· step18 7,565(42.7%)· 映射表 + 两张退役表 5,077(28.7%)· 头部 49。

⇒ 卡面的结论不变(⭐ 这仍然不是一张瘦身卡,而且本席在卡上已就「瘦身」一说更正过一次),但数字是本席量错的,而且错的方向正好是把「必须保留的东西」算进了「要删的东西」的体量里。

本席的处置

⛔ 不改卡面正文(⛔ 不改写历史),更正就地加在这里。dev 的 open_questions 第 1 条不需要任何决定,已照实采纳。needs:contract-review 已按双载体一笔挂在本卡与 PR #19302 上(--pair 19302 回读 exit 0),达档契约复核由本席起。

⚠️ dev 的 open_questions 第 2 条是一个真实的规则冲突,⛔ 本席不替维护者裁:见下一条评论。

---

Generated by Claude Code

[os-steve]

os-dev-report

{
  "issue": 19056,
  "status": "done",
  "branch": "claude/issue-19056-migration-support-floor-16",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19302",
  "session": "session_01AmH9bKvGoLjiY86Q4Z3og2",
  "premise_still_valid": true,
  "summary": "SECOND HEAD, answering the at-tier contract review (comment 5749969134, VERDICT: FAIL). New head e894b0917480d4761fb7a1fca6bca5e7907383ce. All three FAIL grounds addressed and one of them partly FALSIFIED by measurement - see the api-surface note. (1-5) The cli integration case is re-pinned on the registry, NOT re-pointed: `Nothing to migrate` is measurably unreachable from the CLI on this build and the pin now says so. (1-6) content/docs/upgrading.mdx corrected, swept by MEANING this time rather than by the literal --from 10. (1-7) Merged origin/main (NOT rebased - see the note), modify/delete on api-surface-declarations/ resolved by taking main's deletion, api-surface regenerated with the repo's tooling; mergeable_state is now `clean`. Judgments 1-1 through 1-4 and 2 were upheld and are untouched at this head: the floor, the step deletions, the generated regions, the retirement-tables finding and the minor + BREAKING + Clause-2 narrowing changeset all stand unchanged.",
  "tests": "ALL exit codes captured before any pipe (cmd > file 2>&1; EXIT=$?), on head e894b09174 with the full workspace closure built (turbo run build over ./packages/* and ./packages/*/*, 72 tasks successful, 0 cached). *** THE RUN THE REVIEW ASKED FOR *** pnpm --filter @objectstack/cli exec vitest run --project integration --maxWorkers=2 -> VERDICT command-exit 0, 51 files, 428 passed, 1 skipped. The 1 skip IS the re-pinned case and it is declared, not silent: see open_questions entry 1. pnpm --filter @objectstack/cli exec vitest run --project unit -> 220 files / 3,114 passed. pnpm --filter @objectstack/spec test -> 502 files / 14,653 passed, 0 skipped. pnpm --filter @objectstack/spec --filter @objectstack/cli run typecheck -> both `Done`, exit 0, 0 errors (grep -c 'error TS' = 0). pnpm --filter @objectstack/spec check:generated -> exit 0, `All 15 generated artifacts are up to date` (15 not 16: api-surface-declarations left the roster when main deleted it). GATE SWEEP re-derived on the NEW head: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack now derives 114 families (was 90 - the merge plus the .mdx and cli-test edits added 25, including the whole docs family: check:doc-anchors, check:docs-single-h1, check:docs-redirects, check:docs-spec-enumerations, check:docs-transcript-drift, check:docs-audit-scope, check-doc-frontmatter, check-doc-route-spelling, check-docs-section-name, check-section-landing-index, check:role-word, plus check:cli-test-child-env and check:skill-examples / check:yaml-examples). EVERY ONE OF THE 114 WAS RUN EXCEPT ONE: reconciled with --ran -> `114 derived, 113 run, 0 NOT-MEASURED, 1 UNRUN`. All 113 exit 0. NOT MEASURED (1, named, unchanged from the first head): pnpm check:pm-dispatch-gates - its self-test does not finish inside this container's ~10 minute foreground cap (killed at 500s and at 520s, exit 124 = a timeout, NOT a gate verdict, so it is deliberately left OUT of the --ran record and reads UNRUN rather than as a failure; 1,702 passing assertions printed before the cut, no failure line). CI owns it. NO exit 3 / PREREQUISITE NOT MET at this head: check:type-check-debt ran green here because the closure was built first (77/81 packages type-checked, 4 ledger entries re-measured, none above its recorded number). MEASUREMENT BEHIND THE RE-PIN (spawned the real CLI, not reasoned about): `tsx packages/cli/bin/run-dev.js migrate meta --from 16 --to 17` on the canonical fixture -> exit 0; `Nothing to migrate` 0 occurrences; `No migration step exists` 0; `already canonical` 0; `77 manual change(s) require your judgment` 1; `Migrated stack is schema-valid` 1. PR state re-read after the push: mergeable: true, mergeable_state: `clean`, draft, 20 changed files, head e894b09174.",
  "mcp_calls": "0 - no MCP GitHub tool called, read or write, in either head. Every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "This head: 3 git pushes to the same branch (no force-push, no rebase) + 1 REST write, POST /repos/objectstack-ai/objectstack/issues/19056/comments (this report). Cumulative across both heads: 2 earlier REST writes (POST /pulls creating draft #19302; the first os-dev-report comment) + 7 git pushes. 0 label writes at either head - the dispatch named none. NOTE ON LABELS: `needs:contract-review` is now present on PR #19302 (labels: documentation, size/xl, tests, tooling, needs:contract-review). I did not write it and have not touched it - it is the seat's to hang and clear.",
  "open_questions": [
    {
      "question": "REVIEW ITEM 1-5, ANSWERED BY MEASUREMENT: is `Nothing to migrate` still testable from the CLI? NO - it is unreachable on this build, and the pin now says exactly that instead of pretending otherwise. Why: the sentence needs `applied` AND `todos` empty over a NON-empty chain (meta.ts:479 `applied.length === 0 && todos.length === 0`, then :484 `hops.length === 0` picks the empty-range answer, :488 picks the success sentence). `applyMetaMigrations` pushes a step's WHOLE `semantic` list into todos on every hop it replays, whatever the stack holds - so an empty `todos` needs a hop whose own `semantic` list is empty. `13 -> 14` was that hop: step 14 carried none. With the floor at 16 the only hops are 17 (77 semantic) and 18 (144 semantic), so NO --from/--to reaches it. Confirmed by spawning the real CLI, not by reading code: --from 16 --to 17 prints 77 manual changes and `Migrated stack is schema-valid` at exit 0, with zero occurrences of `Nothing to migrate`. HOW IT IS PINNED, three parts, none of them a number swap: (a) `SEMANTIC_FREE_HOP = MIGRATION_MAJORS.find(m => m - 1 >= MIGRATION_SUPPORT_FLOOR && MIGRATIONS_BY_MAJOR[m].semantic.length === 0)` - derived, so the spawned case REVIVES BY ITSELF the day a reachable hop ships with no semantic residue; (b) an always-run case that STATES WHICH WORLD WE ARE IN and asserts it (`reachable.map(semantic.length)).not.toContain(0)`), which is what makes the skip a measurement rather than a hole - without it the skip would be a silent disable; (c) a NEW always-run spawned case pinning what IS reachable: the oldest supported range exits 0, prints `manual change(s) require your judgment` (positive, so the negatives below are not vacuous), reaches `Migrated stack is schema-valid`, and is NOT answered as an empty range - which is the #17134 defect this describe block exists to hold. WHAT WAS LOST, named in the file: while no reachable hop is semantic-free, nothing spawns the CLI over the success sentence; the branch is still selected in-process but is not covered end to end from a real terminal.",
      "options": [
        "no decision required - reported for the record"
      ],
      "recommendation": "No action. The 1 skipped integration test is this case and it is declared by its companion assertion."
    },
    {
      "question": "REVIEW ITEM 1-7, HALF FALSIFIED BY MEASUREMENT - flagging it because the review stated it as a requirement and I did not do what it asked, because doing it would have been a no-op. The review said: 'the api-surface artifact must be regenerated in its restored hash form (api-surface-signatures.json, the 27 hashes), because your 10->16 literal moves a declaration signature.' MEASURED: it does not. `api-surface-signatures.json` records a stable hash of each `defineX` FACTORY signature - 27 of them, `defineAction` through `defineView` - not the declaration text of every export. `MIGRATION_SUPPORT_FLOOR` is a plain `const`, not a factory, so it is not in that artifact at all. The snapshot that WOULD have recorded it is `api-surface-declarations/root.txt` (`declare const MIGRATION_SUPPORT_FLOOR = 10;` -> `= 16;`), which is precisely what 2277d1fcd1 reverted away. I regenerated with the repo's tooling anyway rather than assert it from reading: `pnpm --filter @objectstack/spec gen:api-surface` -> exit 0, `Wrote api-surface/ (17 entries, 5364 exports) and api-surface-signatures.json (27 factories)`, and `git status --porcelain` came back EMPTY - the same bytes. `check:api-surface` is green. The OTHER half of 1-7 was real and is fixed: mergeable_state went dirty -> clean.",
      "options": [
        "A - accept the measurement: nothing to regenerate, the artifact is current and the gate proves it",
        "B - reviewer re-checks against api-surface-signatures.json's contents at the new head"
      ],
      "recommendation": "A. The generator is the authority and it wrote identical bytes; the prediction was about an artifact this repo no longer has."
    },
    {
      "question": "The review said 'Rebase'. I MERGED instead and want that on the record rather than silently diverging. Reasons: (a) AGENTS.md Multi-agent discipline forbids rebasing or force-updating a branch that is already pushed, and #19302 is pushed and has a review on it; (b) the in-repo authority for this exact situation, scripts/pm/os-regen-merge.sh, hardcodes `git merge origin/main` and says in its own header `never rebase / force-push`, because the os-regen merge driver silently drops one side at exit 0 and only the scripted ORDER (merge, take main's side of untouched generated paths, COMMIT THE MERGE FIRST, then regenerate) exposes it. I ran that script: it stopped on the modify/delete conflict, I resolved it by taking main's deletion of the whole api-surface-declarations/ directory, committed, and re-ran it - step 2 reported KEEPING the branch's bytes of protocol-upgrade-guide.md and spec-changes.json (branch changed them, main did not), step 3 found nothing further to commit. Net effect is identical to a rebase for review purposes and mergeable_state is `clean`.",
      "options": [
        "A - merge commit, as landed (what AGENTS.md and os-regen-merge.sh prescribe)",
        "B - rebase and force-push"
      ],
      "recommendation": "A. B is forbidden by AGENTS.md on a pushed, reviewed branch and would defeat the merge driver's ordering protection."
    },
    {
      "question": "PR BODY CORRECTION THE SEAT MUST APPLY - I cannot make it myself: a dev writes the PR body once, on the POST that opens the PR, and never PATCHes it. #19302's body says 'Regenerated and committed: spec-changes.json, docs/protocol-upgrade-guide.md, api-surface-declarations/root.txt' and, under Tests, 'check:generated -> 16 artifacts'. Both were true at the first head and are false now: main deleted api-surface-declarations/ in 2277d1fcd1 and the roster is 15. Suggested replacement for that sentence: 'Regenerated and committed: spec-changes.json and docs/protocol-upgrade-guide.md. (api-surface-declarations/root.txt was regenerated at the first head; main then deleted that directory in 2277d1fcd1, so this head takes main deletion and the roster is 15 artifacts.)' The body's Tests section is also a head behind - the numbers in this report supersede it.",
      "options": [
        "seat edits the PR body",
        "seat leaves it and this comment is the current record"
      ],
      "recommendation": "Seat edits the body - a reviewer reads the body first, and it currently names a file the diff no longer contains."
    },
    {
      "question": "TWO CARDS THE REVIEW MAKES A LANDING CONDITION, ready to file - filing is a seat write (POST /issues), which a dev does not make. Bodies below in out_of_scope_findings, with the reviewer's amendments folded in: the skills card is more than a number (SKILL.md:93 derives --from 15 from a >=15 lower bound, and :103's 'there is no penalty for lateness' is now a false CLAIM, not a stale number), and the handshake card also owns packages/services/service-package/src/hydration.test.ts:95.",
      "options": [
        "seat files both before this lands, per review condition (a)"
      ],
      "recommendation": "Seat files both. Neither belongs in this PR: skills/** is Tier H, and the handshake defect is pre-existing in another package."
    }
  ],
  "out_of_scope_findings": [
    "to file - CARD 1 (dedupe words: objectstack-upgrade SKILL, migrate meta --from 15, support floor, Tier H, penalty for lateness). TITLE: docs(skills): objectstack-upgrade still teaches a support floor of 15 and promises no penalty for lateness. BODY: #19056 raised MIGRATION_SUPPORT_FLOOR to 16. Three defects in skills/objectstack-upgrade/SKILL.md, all published: (1) :103 `os migrate meta --from 10` now refuses - an example that fails verbatim; (2) :103 'Arriving several majors late is the designed-for case ... there is no penalty for lateness' is now a FALSE CLAIM, not a stale number: below protocol 16 the penalty is that the command refuses outright; (3) :93 derives its reading from a `>=15` lower bound and tells the agent to ask rather than default to the lower one - the lower bound moved. :16 and :588 are generic ('the spec's MIGRATION_SUPPORT_FLOOR', 'the chain's support floor') and are correct as-is. CLASS: (a) reproducible defect, published. TIER: skills/** is Tier H (AGENTS.md Prime Directive #14) - deliberately kept out of PR #19302 so one line would not fork an ordinary code change behind a maintainer approval. Review comment 5749969134 section 3 accepts that call and makes this card a landing condition.",
    "to file - CARD 2 (dedupe words: protocol-handshake, migrateCommand, MigrationFloorError, migrate meta --from, support floor clamp, hydration refusal). TITLE: fix(metadata-core): the incompatible-package diagnostic prescribes a migrate command that throws below the support floor. BODY: packages/metadata-core/src/protocol-handshake.ts:252 builds `objectstack migrate meta --from TARGET` from the incompatible package's own declared target major, with no clamp to MIGRATION_SUPPORT_FLOOR, so a package targeting a major below the floor is handed a command that answers MigrationFloorError. Pre-existing (protocol-handshake.test.ts:164 already pins a `--from 6` answer, which threw at floor 10 too) and WIDENED by #19056 from 'below 10' to 'below 16'. packages/services/service-package/src/hydration.test.ts:95 pins the same string from the same producer and belongs to this card. NOT a clamp: review comment 5749969134 section 3 notes a clamped `--from 16` handed to a package targeting 12 would silently SKIP steps, so the honest output below the floor is a refusal that names the floor and the other path - a design choice, which is why this is its own card. CLASS: (a) reproducible defect.",
    "noted, not filed: content/docs/upgrading.mdx is FIXED IN THIS PR, not noted - the reviewer declined it as noted-only and was right. Corrected at :185 and :268 (--from 15 -> --from 16), the replay table at :196-199 (four rows, three of them below the floor, replaced by the one legal row), and the floor claim at :201 ('reaches back to protocol 10' -> 'protocol 16'). Added a Callout naming the narrowing for readers stopped at 10-15, since this is the live upgrade guide and the refusal is what they will hit. THE SWEEP WAS REDONE BY MEANING, not by the literal '--from 10': grepped content/docs for `migrate meta`, `support floor`, `chain floor` and `reaches back to protocol`. Result - every other content/docs page already says `--from 16` (flows.mdx x2, hook-bodies.mdx, fields.mdx, objects.mdx x2, queries.mdx, cli.mdx, query-syntax.mdx, actions.mdx, apps.mdx x2, upgrading.mdx:13); upgrading.mdx:241 is `--from 17`, above the floor; deployment/index.mdx:157 is generic `--from MAJOR` (placeholder spelled in words). Only upgrading.mdx was stale, and only the five sites above.",
    "noted, not filed: the card's blast-radius table over-counts step18 (it lists 12,041; the block is about 7,533-7,565 depending on where the docblock boundary is cut - the reviewer's cut and mine differ by ~32 lines and both refute 12,041). The 12,041 runs step18 to end of file and swallows MIGRATIONS_BY_MAJOR plus BOTH retirement tables (~5,076), i.e. the very tables the card protects. The card's conclusion - not a slimming card - stands. Carrier: none; the correction lives in PR #19302's body and its changeset.",
    "noted, not filed: docs/adr/0087-*.md and content/docs/releases/v15.mdx narrate the old floor as history on governed / release-owned surfaces. docs/qa/platform-checklist/areas/cli.json:685 and skills/objectstack-upgrade/SKILL.md:16,:588 are generic ('the supported floor', 'the chain's support floor') and stay correct. Carrier: none.",
    "noted, not filed: packages/spec/scripts/build-upgrade-guide.ts is a gate script, so the local verification scope asks for its own test suite beyond the derived families. Measured again at this head: git grep finds no test file in the repo naming build-upgrade-guide, so that obligation is empty rather than skipped. check:upgrade-guide is green."
  ]
}

---

Generated by Claude Code

[os-steve]

Handback — contract review returned FAIL, 2026-09-20T14:26Z

The at-tier contract review of PR #19302 at head e894b0917480d4761fb7a1fca6bca5e7907383ce is on the record as PR comment 5750388312, VERDICT: FAIL. Adopted verbatim by this seat; ⛔ not rewritten, not summarised into the record.

Independence pair, machine-readable on the record:

line	value	kind
Implemented-by:	claude/issue-19056-migration-support-floor-16	branch — the dev ran mode:subagent
Reviewed-by:	session_01AmH9bKvGoLjiY86Q4Z3og2	the adopting seat; the isolated reviewer holds no session of its own

Distinct kinds, so no SELF-REVIEW is reported. The reviewer was fed the card, the PR and the prior round's FAIL record only — ⛔ never the dispatch order or this seat's conclusions.

Carriers stripped at this same act. FAIL strips both exactly as PASS does — needs:contract-review removed from PR #19302 and from this card, read back clean on both. Card state (pm:dispatched) and assignee (os-steve) are untouched, per 「卡态与 assignee 不动」.

What is owed — read the record for the authoritative wording

Two FAIL grounds, both about a floor-width claim surviving the sweep:

1. packages/spec/scripts/build-upgrade-guide.ts:44 and :56-59 — emitted into docs/protocol-upgrade-guide.md:8 and :14. The generator still asserts upgrading "from any past major" and that "timeliness is never load-bearing". At floor 16 / protocol 17 the supported lateness is one major and --from 15 throws. This is the same sentence the prior round ruled a false claim at skills/objectstack-upgrade/SKILL.md:103, three lines from a hunk this PR edits, regenerated with the claim intact.
2. content/docs/upgrading.mdx:218 — --to 16 is an empty-range invocation for every legal --from after this change, in a file this PR swept.

Plus, not a FAIL ground but landing-relevant: the changeset's "10 of the 99 conversion fixtures" figure — ALL_CONVERSIONS is 97. The changeset compiles into the release-owned CHANGELOG, so the figure ships.

And comment-level: five retiredFromLoadPath conversions (majors 11–14) are now carried by no migration step, while their docblocks still say migrate meta --from 10|11 rewrites sources.

Two prior-round requirements the reviewer measured FALSE — the dev is upheld

• Regenerating packages/spec/api-surface-signatures.json: that artifact holds only 27 defineX factory hashes, and a plain const literal cannot move it.
• The demand to rebase rather than merge: AGENTS.md:471/:487 prescribe the merge, and the merge dropped nothing but main's deleted root.txt.

Seat note — a verification error of mine, caught before it did damage

Checking finding 3 against the repo, this seat first measured toMajor: at 99 and was on the point of challenging the record. That count was taken with an unanchored grep, which also matches the identifier inside docblocks. Anchored to the line start the count is 97 — the reviewer's figure, not this seat's. Recording it because the failure mode is the one this seat has repeated all session: a reading taken with a loose instrument, treated as a fact. ⛔ A record is voided on measured verification failure, never on a sloppy one.

The two follow-on cards the prior round declared landing conditions were ruled non-blocking on this diff by this review; the skills/objectstack-upgrade defect is created by this PR but its only legal carrier is Tier H, so it remains a seat landing obligation, and the record notes the card should also carry ADR-0087 :40/:283.

---

Generated by Claude Code