Forward conversion never opens on unreleased main: spec still labelled 17.4.0 while main refuses 17.5.0 retirements, so artifacts built by the published 17.4.0 CLI are refused

[hotlong]

Ruled: 5865890672 · letter A · 2026-09-28T08:02Z

Source

This surfaced on objectstack-ai/hotcrm#1964 (floor 1 of the cloud framework re-cut, objectstack-ai/cloud#2332 / PR objectstack-ai/cloud#2423) and is tracked under epic objectstack-ai/cloud#2440.

Maintainer ruling in the epic session, 2026-09-28 (verbatim): 「平台修转换 + HotCRM 先删 scale（推荐）」. The platform fixes the forward conversion. hotcrm only removes what no release can convert.

What breaks

objectstack main (measured at 862b6ce8) already refuses keys that the retirement ledger marks "removed in @objectstack/spec 17.5.0". But packages/spec on main still carries the version label 17.4.0, and 17.5.x is not published (npm latest = 17.4.0).

applyArtifactForwardConversions (packages/metadata-core/src/artifact-forward-conversion.ts ~301, resolveInstalledSpecVersion) therefore reads runtime 17.4.0 == the artifact's authored floor ^17.4.0 and returns authored-current. The retired conversions are then not replayed, and MetadataPlugin._parseAndRegisterArtifact (packages/metadata/src/plugin.ts ~894) refuses the artifact.

Consequence: any artifact built by the published @objectstack/cli 17.4.0 that contains a dashboard chart cannot boot on a runtime that runs unreleased main. At 17.4.0, chartConfig.type is required, and main refuses it. Such a runtime is the EE composed boot through OS_COMPOSED_ARTIFACT_URL, as cloud does when it pins a framework SHA. No source spelling of chartConfig is legal on both versions short of deleting the block.

Measured (hotcrm#1964 dev report, 2026-09-28)

Probe: the same ObjectStackDefinitionSchema.parse(applyArtifactForwardConversions(...)) from objectstack 862b6ce dist, run on hotcrm main's artifact:

runtime label	verdict	conversions applied	issues left
17.4.0 (actual label on main)	authored-current	none	63: 16 chartConfig.type, 9 xAxis, 9 yAxis, 23 objects..scale, 6 pages..assignedProfiles
forced 17.5.0	converted-forward	dashboard-widget-chart-config-structure-removed ×34, page-assigned-profiles-removed ×6, page-component-filter-record-to-rule-array ×4	only the 23 currency scale issues (no conversion exists; hotcrm is removing them)

Direct EE boot of the same artifact on main: exit 1. With all three key families stripped: serves (HTTP 200).

Direction (for triage and the owning lane)

Make the conversion window open for artifacts authored at the last published release whenever the runtime already enforces a later retirement. The dev named two shapes; picking one is the owning lane's design call:

• Option a. main carries a prerelease label (e.g. 17.5.0-next) as soon as it contains a 17.5 retirement.
• Option b. The window compares the artifact's authored version against the retirement's own version instead of the package label.

Acceptance

1. An artifact built by the published 17.4.0 CLI with dashboard charts and page assignedProfiles boots on main, and the conversion notices are logged.
2. Newly authored sources that use the retired keys are still refused loudly.
3. A regression test pins the "unreleased main, artifact at last release" case.

[objectstack-fleet]

Path: devpath · 发布并装进一个环境 | 缺项 (no item boots an artifact built by the last published CLI on a runtime built from main) | P4

Triage: first grade — bug · priority:p1 · domain:engine · area:devpath · pm:queue

Triage: lands in packages/metadata-core/src/artifact-forward-conversion.ts (resolveInstalledSpecVersion and the window decision), with the refusal in packages/metadata/src/plugin.ts ⇒ domain:engine (packages/metadata*).

Rationale: an artifact built by the published 17.4.0 CLI with a dashboard chart or page assignedProfiles cannot boot on a runtime built from main. The conversion window never opens, because both sides read 17.4.0. This blocks cloud's framework re-cut (objectstack-ai/cloud#2440, objectstack-ai/hotcrm#1964). The maintainer's ruling in that epic is quoted in the body: 「平台修转换 + HotCRM 先删 scale(推荐)」 ⇒ p1.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-28T06:58Z. ⛔ Not a claim, ⛔ not a dispatch.

Duplicate check. Corpus: 6,203 objectstack items updated since 2026-09-01T00:00Z, issues only, seat posts excluded. forward conversion|applyArtifactForwardConversions|resolveInstalledSpecVersion together with a version or window term gives 4 hits, all closed (#18992, #17894, #17885, #16693). None is this window.

On the two shapes. The body leaves the choice to the owning lane; one boundary for it:

• Option (a), a prerelease label on main, changes the package version label. That is release mechanics, and ⛔ seats never run or stage releases (AGENTS.md). If the lane prefers (a), it needs the maintainer's word.
• Option (b), comparing the artifact's authored version against each retirement's own version, is lane-local.

Acceptance, as the body states:

1. A 17.4.0-built artifact with charts and assignedProfiles boots on main, and the conversion notices are logged.
2. Newly authored sources that use the retired keys are still refused loudly.
3. A regression test pins the "unreleased main, artifact at the last release" case.

[objectstack-fleet]

Claim: PM loop round 23
Session: session_01N8TPEsoJxPsdSdNKGnNGEN
Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20390-forward-conversion-window
Worktree: objectstack-issue-20390
Domain: domain:engine
Seat: domain:engine#1
File surface:

• packages/metadata-core/src/artifact-forward-conversion.ts: the window decision only (how applyArtifactForwardConversions decides whether an artifact's authored floor predates a retirement the runtime enforces: resolveInstalledSpecVersion and the floor / runtime verdict). The body's option (b): compare the artifact's authored version against the retirement's own version, not the package label.
• tests in packages/metadata-core and packages/metadata (the artifact door in MetadataPlugin._parseAndRegisterArtifact, test side unless the door itself must change);
• .changeset/20390-*.md.

Stop on breach and explain in the report. ⛔ Not packages/spec/package.json's version label, nor any release or prerelease label: option (a) is release mechanics, which a seat never stages (triage 5865033067). ⛔ Not DEFAULT_FLIPS_NOT_REPLAYED_HERE or its docblock: open PR #20344 (#15429, spec lane) edits that list. ⛔ Not packages/spec (the conversion registry's entries): if option (b) needs a per-entry version the registry does not already carry, stop and report the fork.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no
Thread-read: 5865033067
Serial constraints cleared: at 2026-09-28T07:13Z, a census of the 10 open PRs' file lists finds one on packages/metadata-core/src/artifact-forward-conversion.ts: PR #20344 (#15429, domain:spec seat 4). Its only hunk there is DEFAULT_FLIPS_NOT_REPLAYED_HERE and its docblock, a region this card does not touch, so the two are text-disjoint and the later lander merges main. No open PR touches packages/metadata/src/plugin.ts. No in-flight domain:engine claim holds packages/metadata*.

Clause-②: no because this pulls the door back to its declared contract; it does not widen one. The module docblock's policy on main: "a key retired at version V stays a loud refusal for anything authored at ≥ V". An artifact authored at 17.4.0 is authored below a retirement at 17.5.0, so the declared policy replays its conversions. The label comparison is what refuses it.

[objectstack-fleet]

os-dev-report

{
  "issue": 20390,
  "status": "needs_decision",
  "branch": "claude/issue-20390-forward-conversion-window",
  "pr": null,
  "session": "session_01N8TPEsoJxPsdSdNKGnNGEN — the seat session; this run is mode:subagent under it",
  "premise_still_valid": true,
  "summary": "The card's defect is real and reproduced on origin/main df3ba164a (spec label 17.4.0): an artifact declaring engines.protocol ^17.4.0 with dashboard chartConfig.type/xAxis/yAxis and page assignedProfiles gets verdict authored-current and 0 notices, and the strict parse refuses it with 4 issues naming the 17.5.0 retirement. The dispatch's premise for route (b) does NOT hold, so I stopped at the premise check as the ruling orders. Nothing the claim may read carries a retirement's own version. MetadataConversion has only id, toMajor, retiredFromLoadPath, surface, summary, apply and fixture. toMajor reads 18 on all 18 retirements registered after 17.4.0, and ALSO on permission-allow-restore-purge-removed (retired at 17.2), so it cannot tell minors apart. The retired-keys ledger is keyed by major (18.ui__DashboardWidgetChartConfig__type.ts). spec-changes.json has no per-release section: none on main by design, and none in the published 17.4.0 tarball either. It also covers only majors up to 17. PROTOCOL_VERSION is '17.0.0', which is major-only. '17.5.0' appears only in tombstone prose, 34 times in packages/spec/src. The per-artifact fallback ('the highest retirement version the running spec enforces') has no machine-readable source either. I wrote no code, opened no PR and added no changeset. open_questions sets out the fork with a recommendation: A, a required per-entry version on the spec registry built by the spec lane, after which this card is a small metadata-core change.",
  "tests": "No code changed, so no unit tests are owed. The readings below are one-off probes run against the built dist at df3ba164a; nothing was committed. BUILD: os-verify-lock.sh -c 'pnpm --filter @objectstack/spec --filter @objectstack/metadata-core build', which printed 'VERDICT command-exit 0'. PROBE 1, applyArtifactForwardConversions with the installed spec resolving to 17.4.0: ^17.4.0 gives verdict authored-current with 0 notices (THE DEFECT). ^17.0.0 gives converted-forward with 4 notices (page-assigned-profiles-removed x1, dashboard-widget-chart-config-structure-removed x3). ^17.5.0 gives authored-current. No engines gives converted-undeclared. PROBE 2, acceptance-2 door readings on main. defineStack on a newly authored ^17.4.0 source is refused with StackSchemaInvalidError code=STACK_SCHEMA_INVALID status=422 and 4 retired-key issues (the first is at pages.0.assignedProfiles: 'page.assignedProfiles was removed in @objectstack/spec 17.5.0 ...'). normalizeStackInput + ObjectStackDefinitionSchema.safeParse gives success=false with 4 issues. At the artifact door, ^17.4.0 is authored-current and the parse fails with 4. ^17.5.0 is authored-current and the parse fails with 4: a floor at or above V is refused, as the docblock says. ^17 is converted-forward with 4 notices, and the parse succeeds. REGISTRY CENSUS, main's ALL_CONVERSIONS against the published @objectstack/spec tarballs. Main has 108 entries, 91 of them retired. The published 17.4.0 tarball has 90, 73 retired. So 18 entries were registered on main after 17.4.0, all retiredFromLoadPath true and all toMajor 18: cube-sub-day-granularities-removed, cube-join-sql-and-relationship-removed, object-kanban-quick-add-removed, connector-connection-timeout-ms-removed, view-page-mount-removed, list-view-sort-string-clause-to-array, page-assigned-profiles-removed, chart-config-aria-removed, dashboard-widget-chart-config-structure-removed, translation-per-app-settings-removed, object-tenancy-organization-field-removed, page-component-filter-record-to-rule-array, view-item-owner-hidden-removed, report-joined-chart-removed, view-overlay-owner-hidden-removed, form-layout-inline-grid-to-vertical, currency-config-precision-removed, permission-rls-tags-removed. For main's 91 retired entries, the first published tarball that carries each one as retired (17.0.0, 17.1.0, 17.2.0, 17.3.0, 17.4.0): 17.0.0=50, 17.1.0=5, 17.2.0=2, 17.3.0=8, 17.4.0=8, unreleased=18. So a backfill of a per-entry version can be measured mechanically. HYPOTHESES. H1 holds: version 17.4.0 at df3ba164a. H2 holds (probe 1). H3 holds, and it decides the premise (summary). H4: see open_questions[1]. Today's implementation honours the sentence 'a key retired at V stays a loud refusal for anything authored at or above V' only per artifact, using the runtime label as a single stand-in for every V. H5: the authoring funnel cannot be touched by any door-side fix, because normalizeStackInput calls applyConversions without includeRetired and apply.ts skips retired entries in that case (the defineStack refusal is in probe 2). A floor-at-or-above-V artifact is refused at the door (^17.5.0 in probe 2). GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack printed 'this branch changes nothing against origin/main (merge base df3ba164a) — nothing to derive' and exited 2. The gate set is empty.",
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/20390/comments (this report), via scripts/pm/post-stamped.mjs on the fleet relay. The only other writes were a git push of the empty branch, which is not REST. The reads were REST GETs of the card, its comments and the npm registry.",
  "gates": "none owed: the diff is empty (dispatch-gates at merge base df3ba164a: nothing to derive)",
  "line_budget": "n/a — no diff",
  "files_changed": [],
  "deviations": [
    "Stopped at the ruling premise, as the ruling orders, so there is no PR, no label-write and no changeset. Because the premise failed, the deliverable is this report and not a draft PR with Fixes #20390.",
    "The remote branch claude/issue-20390-forward-conversion-window was pushed empty (it points at origin/main df3ba164a) as the claim marker and write probe, and is left in place for the next dispatch.",
    "Scratch probes ran against the published @objectstack/spec tarballs fetched from registry.npmjs.org into the scratchpad. Nothing was installed into the repo."
  ],
  "open_questions": [
    {
      "question": "Route (b) needs each retirement's own version, and the conversion registry does not carry one. packages/spec is fenced for this claim. Which fork carries the fix?",
      "options": [
        "A (spec lane first, then this card). Add a per-entry retirement version to MetadataConversion, for example retiredAfter: 'x.y.z'. Its meaning: the last @objectstack/spec version whose authoring surface still accepted the old shape. That is the package label at the moment the retirement lands, so it is a fact when the entry is written, never a guess at the next release number. Make it REQUIRED at the type level whenever retiredFromLoadPath is true. Backfill the 73 already-published retired entries from the published tarballs; the census in tests is mechanical. Stamp the 18 unreleased entries 17.4.0. This card then replays entry E when the floor is below the runtime label OR the floor is at or below E.retiredAfter, and DEFAULT_FLIPS_NOT_REPLAYED_HERE is still read first. Business: it unblocks the measured hotcrm#1964 / cloud#2440 re-cut (63 issues; 44 conversions at a forced 17.5.0). Long term: the registry stays the single authority, and the fact the window needs lives on the entry it describes. Any label-derived window reopens this gap every release cycle, because main's label always lags its content. AI-proofing: tsc forces the field onto every future retirement, the authoring-funnel tombstones are untouched, and a floor at or above V is still refused. Scope: one field, no new gate, and a one-time mechanical backfill. Cost: 91 registry entries plus gen:api-surface in packages/spec, on a spec-lane card. Then about 30 lines plus tests here, and this card becomes Blocked-by that card.",
        "A' (spec lane, smaller). The same field, but optional, and set only on the 18 unreleased entries; where it is absent, today's label rule applies. The cost is 18 entries. It is weaker on AI-proofing: the next retirement that omits the field silently brings this defect back for that entry.",
        "B (spec lane). One spec-level constant naming the highest version whose retirements this build enforces, and the window compares the floor against max(label, constant) per artifact. It is the cheapest spec change, but the decision is per artifact, not per entry, so it cannot honour 'at or above V stays refused' entry by entry. It is also a second version label beside package.json that every retirement must remember to bump: release-adjacent and easy to forget.",
        "C. Option (a), a prerelease label on main. That is release mechanics and needs the maintainer's word (triage 5865033067). The ruling excludes it for this seat.",
        "D (lane-local). A table in metadata-core mapping each conversion id to its retirement version. It can be built inside the claim, but it is the second conversion table the module docblock rules out ('Not a second conversion table'), and a consumer-side copy of a spec fact (PD #12). It drifts silently the day the spec lane lands a retirement without touching metadata-core, which is exactly the failure this card reports.",
        "E (lane-local, one line). Open the window when the floor equals the runtime label, by switching the comparison from strictly-below to at-or-below. It fixes main today but breaks the declared policy at V equal to the runtime. Once the M2 batch brings back allowRestore/allowPurge, permission-allow-restore-purge-removed would strip them from an artifact authored exactly at the return version: the hazard the module docblock names. A floor-17.5.0 artifact on a 17.5.0 runtime would also be converted silently instead of refused."
      ],
      "recommendation": "A. It is the only per-entry option, which is what the ruling's option (b) means. It keeps the spec registry the single authority, the type system enforces it rather than memory or a new gate, and no release act is involved. Choose A' only if the spec lane wants the smallest change and accepts the risk that a later retirement forgets the field. The metadata-core half is small, and ready to build as soon as the field exists on main."
    },
    {
      "question": "Once the per-entry version exists, which rule should the window use? The union rule replays E when the floor is below the runtime label OR the floor is at or below E.retiredAfter. The strict per-entry rule replays E only when the floor is at or below E.retiredAfter.",
      "options": [
        "Union. It opens exactly the unreleased gap: on main, a floor-17.4.0 artifact gets the 18 post-17.4.0 entries and nothing more, and after 17.5.0 ships the rule reduces to today's. It narrows nothing (Clause-② no). A today-scaffolded app stamps ^17 (floor 17.0.0) and is ALREADY converted-forward on this runtime: 107 of 108 entries are eligible (90 of 91 retired; app-hidden-to-unpublished is excluded). So for that app the union does not widen the retired-key class. Axes: it serves the measured case; the long-term cost is that it keeps today's per-artifact stand-in for released retirements; AI-proofing is unchanged from today; scope is minimal.",
        "Strict. It implements the docblock sentence ('a key retired at V stays a loud refusal for anything authored at or above V') entry by entry, which today's implementation does NOT do for released retirements. Today the runtime label serves as the one V for every entry, so an artifact at floor 17.3.0 carrying a key retired at 17.2.0 is replayed. But strict narrows. The 50 entries retired at or before 17.0.0 would stop replaying for every ^17 scaffold artifact. More generally, every entry retired at a V at or below the label would stop replaying for floors from V up to the label. That is a Clause-② narrowing (breaking), and the affected population is unmeasured. Axes: it is the tighter contract and more AI-proof, but it has no named business pull, and it is a narrowing with no measured population."
      ],
      "recommendation": "Union for this card: it is the fix the card asks for and nothing else. Strict is a separate narrowing decision, to be taken only on named evidence of artifacts that need it."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed. The door notice for an already-retired entry says 'retires from the load path in protocol 19'. packages/spec/src/conversions/apply.ts:193 derives retiresIn = toMajor + 1, and toMajor is 18 on all 18 post-17.4.0 entries, yet those entries already carry retiredFromLoadPath true on main and the authoring funnel refuses them. This is wording only, not class a/b/c. Dedupe words: retiresIn, retires from the load path, conversion notice, toMajor."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

决策卡:转换窗口按「每条退役自己的版本」判断,需要在 spec 的转换登记表上加字段。要不要加、谁来做(p1,挡住 cloud 重切)

domain:engine#1 · session_01N8TPEsoJxPsdSdNKGnNGEN (os-warren) · written 2026-09-28T07:36Z. 线程读至 dev 报告(本卡上的 os-dev-report,status: needs_decision)。

一句话问题:用已发布的 17.4.0 CLI 构建的应用包(带仪表盘图表或页面 assignedProfiles),在 main 构建的运行时上启动失败。平台本应自动把旧写法转换成新写法，却没有触发转换;要永久修好，需要给 spec 的公开类型加一个字段。

背景与已测事实

dev 在 origin/main df3ba164a 上复现了缺陷：^17.4.0 的 artifact 判为 authored-current,0 条转换，严格解析报 4 个退役键。

路线 (b) 的前提被证伪，所以 dev 按派发令停手，没写代码、没开 PR。

• 登记表 MetadataConversion 只有 id / toMajor / retiredFromLoadPath / surface / summary / apply / fixture。
• 17.4.0 之后新增的 18 条退役 toMajor 全是 18;17.2 退役的 permission-allow-restore-purge-removed 也是 18。所以这个字段分不出次版本。
• 17.5.0 只出现在墓碑文案里(34 处),不是机器可读的数据。
• 按已发布 tarball 做普查,main 上 91 条已退役条目的首次退役版本分别是:17.0.0 有 50 条,17.1.0 有 5 条,17.2.0 有 2 条,17.3.0 有 8 条,17.4.0 有 8 条，尚未发布的 18 条。所以回填这个字段可以机械完成。

Governing text

• ADR-0087 D2:"each conversion is applied by the loader for one major … then retired from the load path in N+1"。
• packages/metadata-core/src/artifact-forward-conversion.ts 模块文档:"a key retired at version V stays a loud refusal for anything authored at ≥ V";以及 "Not a second conversion table: the ADR-0087 registry in @objectstack/spec stays the single authority on what converts"。
• AGENTS.md:席位永不执行或暂存发布动作(triage 5865033067 据此把选项 (a) 划给维护者)。

协议声明:MetadataConversion 从 @objectstack/spec 包根导出(src/index.ts:224 export * from './conversions/index.js'),是已发布类型。选项 A / A′ / B 都会改公开契约的形状，属于 spec 车道的 Clause-②: yes。

前提(每条附 re-check 命令)

• P1:main 上 spec 仍标 17.4.0。git show origin/main:packages/spec/package.json | grep -m1 '"version"' → "version": "17.4.0"。
• P2:转换类型上没有任何版本字段。git grep -cE 'retiredAfter|sinceVersion|removedIn' origin/main -- packages/spec/src/conversions/types.ts → 0;同文件对照 git grep -c toMajor → 3。
• P3:npm latest 是 17.4.0。curl -sS https://registry.npmjs.org/@objectstack/spec/latest → 17.4.0。

选项 × 代价

选项	做什么	客户可感知的后果
A	spec 车道给已退役条目加一个必填字段 retiredAfter(最后一个仍接受旧写法的版本):已发布的 73 条从 tarball 机械回填，未发布的 18 条填 17.4.0。然后 metadata-core 按条目判断：地板低于运行时标签，或地板 ≤ 该条目的 retiredAfter,就回放这条转换	17.4.0 构建的应用包在 main 上能启动，并记录转换通知;以后每次退役都由类型系统强制写明版本，同一问题不会每个发布周期复发
A′	同 A,但字段可选，只标未发布的 18 条	眼下修好;下一次退役忘了填字段，就对那一条静默复发
B	spec 加一个常量:「本构建执行到哪个版本的退役」,窗口改为按 max(标签, 常量) 整包判断	修好，但等于多了第二个版本标签，每次退役都得记得改;按整包判断，做不到逐条「≥V 仍拒」
C	发布 17.5.0,或给 main 挂预发布标签(维护者动作)	最快:零代码。发布后 main 标签变 17.5.0,17.4.0 构建的包立刻能开窗转换。但下个周期 main 执行 17.6 退役时同样的缺口会复发
D	metadata-core 自己维护一张「转换 id → 版本」表	模块文档已明令排除(第二张转换表);spec 一加退役就静默漂移，正是本卡报告的那种失败
E	把比较从 < 改成 ≤	一行修好 main,但违反已声明的政策：地板恰为 17.5.0 的包在 17.5.0 运行时上会被静默转换而不是拒绝

业务含义直译:

• A:给每条退役规则写上生效日期，系统自己查表。
• A′:只给新规则写日期，旧规则靠记性。
• B:在墙上贴一张「今天执行到哪条」的告示。
• C:先把版本号往前拨，今天就能过，下个月再碰一次。
• D:另抄一本账。
• E:把门槛放宽一格，恰好压线的也放行。

四维分析(业务立场)

• 长远合理性:A 把「何时退役」这个事实放在它描述的那条登记上，登记表仍是唯一权威。只要窗口还靠标签推算，main 的标签永远落后于内容，这个缺口每个发布周期都会复发。
• 实际业务需求:实测拉动是 hotcrm#1964 / cloud#2440 框架重切被挡(63 个问题;强制 17.5.0 时 44 条转换生效)。
• 防 AI 犯错:A 的必填字段让 tsc 强制以后每条退役写明版本，写漏在编译期就会被响亮拒绝;E 会把应当拒绝的包静默转换(静默泄露)。
• 创业阶段不扩散:A 是一个字段加一次机械回填，不新增门禁;B 多一个需要人记着改的标签;D 多一张表。

四棱块

os-decision-facets

• ① 项目长远合理性:A 缩小特例(退役版本由唯一权威携带，不再用标签推算);B / D 各增生一个并行事实源。
• ② 实际业务拉动：今天 cloud 框架重切被挡(hotcrm#1964,63 个问题实测);p1。
• ③ 防 AI 犯错:A 必填字段让编译器响亮拒绝漏写;E 静默转换;A′ 漏写即静默复发。
• ④ 创业阶段不扩散:A 增一个字段(机械回填，零新门禁);B 增第二版本标签;D 增第二张表。

Prior rulings read: forward conversion,retiredafter,conversion window,tomajor,resolveinstalledspecversion → 1 hits; ADR-0120 D2 (false positive: matched toMajor, rules on unique scope); thread: none; repo: objectstack-ai/objectstack

推荐:A,窗口规则取 dev 的「并集」(地板低于运行时标签，或地板 ≤ 该条目的 retiredAfter,即回放该条)。回退项:A′。

两个可以同时做的动作:

• C(发布 17.5.0)是维护者动作，可以作为当天解锁 cloud 的独立快速通道,与 A 并行。
• 它不替代 A:下个周期缺口会复发。

只看①选 A;②③④ 是否翻转：否(② 是 C 的时效理由，只影响分期，不翻字母)。

置信缺口:

• MetadataConversion 是已发布类型，加必填字段对仓外自行实现该接口的人是破坏性变更。仓外有没有这样的实现者，没有实测(推测为零)。
• 按 tarball 回填 17.0.0 批次(50 条)的准确度，由 spec 席的测试验证。

裁后执行

• 裁 A 或 A′:本卡按 Seam: 形态交分诊改道 spec 席(spec 字段 + 回填 + metadata-core 窗口，纵向一个 PR),p1 保留;dev 报告里已写好 metadata-core 那一半。
• 同时裁 C:由维护者执行发布;本卡照常等 A 落地。
• 裁 B / D / E:本席重新派发，按所裁形状施工。

Release: claim 5865235478 · session session_01N8TPEsoJxPsdSdNKGnNGEN (os-warren) · cause: premise falsified (route (b) needs a per-entry retirement version the registry does not carry, and packages/spec is fenced for this lane) · destination: needs-user-decision (this comment). Branch claude/issue-20390-forward-conversion-window is empty at df3ba164a and free for the next taker.