fix(spec): the authorable-surface reachability roots include the unregistered kind schemas

[claude]

Fixes #17356

Clause-②: yes

What was wrong

computeSurfaceReachability() in packages/spec/scripts/build-schemas.ts — the whole of check (c) proof 2 — built its BFS root set from listMetadataTypeSchemaTypes(). That function unions BUILTIN_METADATA_TYPE_SCHEMAS with the EXTRA_METADATA_TYPE_SCHEMAS overlay and, per #6245, pointedly does not enumerate UNREGISTERED_KIND_SCHEMAS.

connector lives in that third map. So the BFS never started from it, integration/DataSyncConfig — two hops away, through connector.syncConfig unwrapped once through optional — answered null, and a bare deletion of one of its baseline lines was waived as "an over-collected entry, never parsed against a metadata document". stack.connectors[] and PUT /api/v1/meta/connector/:name parse a real metadata document through that def on every boot.

The gate's own docblock names this as the dangerous direction: a false "reachable" demands a tombstone too many, a false "unreachable" would waive one silently. The tree held exactly that false unreachable.

What this does NOT do

It does not add connector to listMetadataTypeSchemaTypes(). Two different questions wear the same words, and the gate conflated them:

• "is this a REGISTERED metadata type?" — what listMetadataTypeSchemaTypes() answers, correctly. Enrolling the unregistered kinds there would grant a status meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidated PUT /meta write hole (#2657 audit, option A) #6245 deliberately withheld (enum member, registry entry, create seed, a place in the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 campaign count), and Studio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657's B/C decision stays open and unprejudged.
• "is there an AUTHOR who could be authoring against this def?" — the only question a reachability root set asks, because the sole consequence of null is waiving a tombstone on the grounds that nobody can receive the prescription.

So the gate now enumerates its own reachability root union — reachabilityRootTypes(), reading listUnregisteredKindSchemaTypes(), which exists (#6931) so a check can ENUMERATE that map and for nothing else, and whose listing grants nothing. listMetadataTypeSchemaTypes() is unchanged, and packages/spec/src/kernel/metadata-type-schemas.ts is untouched by this PR.

Measured, on c548dea2

The waiver, both ways. The card's literal repro key (integration/DataSyncConfig:schedule) already landed on main with the #16320 retirement, so the demonstration deletes a live sibling key under the same def — timestampField, removed from DataSyncConfigSchema and from authorable-surface/integration.json, no tombstone, no registry entry. The gate judges the DEF half of the key (key.slice(0, key.indexOf(':'))), so this is the identical code path.

run	check:authorable-surface	gen:schema	verdict printed
before (ca78860)	exit 0	exit 0	integration/DataSyncConfig:timestampField — def not reachable from the 26 metadata-type roots
after	exit 1	exit 1	integration/DataSyncConfig:timestampField — def reachable from the metadata-type roots; the entry at ca7886047b27 was LIVE (never tombstoned).

Both legs restored from HEAD and proven byte-identical with git hash-object against the HEAD blob, with git diff HEAD empty.

Root-set delta. 26 roots to 30; the four added are exactly analytics_cube, connector, sharing_rule, webhook; none dropped.

Closure delta (the positive control, and more than the card scoped). Over the 1523 emitted defs, comparing the verdict map computed from the old root set against the new one:

• 0 defs went from reachable to null — a root set that grows never shrinks a closure. ObjectSchema (data/Object) stays root-graph.
• 17 defs stop being waivable (null verdicts 1035 to 1018): 16 to root-graph and shared/FieldMapping to derived-clone. So the answer to "is integration/DataSyncConfig the whole of the gap" is no — it is 1 of 17. The other 16 are the connector / sharing-rule / analytics-cube families: data/CubeJoin, data/Dimension, data/Metric, integration/CircuitBreakerConfig, integration/ConnectorAction, integration/ConnectorFieldMapping, integration/ConnectorHealth, integration/ConnectorInstanceAuth and its four auth branches, integration/ConnectorTrigger, integration/HealthCheckConfig, integration/RetryConfig.
• 7 more sharpen from derived-clone to root-graph (automation/Webhook, data/Cube, integration/Connector, integration/DeclarativeConnectorEntry, integration/WebhookConfig, security/CriteriaSharingRule, security/SharingRule) — already refused before, refused now, with a truer reason printed.

Nothing in the committed baselines moves: the waiver only fires on a deletion, so check:authorable-surface on the pristine tree is green before and after, and pnpm --filter @objectstack/spec build leaves the working tree clean.

Ablation. With reachabilityRootTypes() swapped back for listMetadataTypeSchemaTypes() at the one call site — mutation proven on disk by anchor counts (1 to 0 and 0 to 1 on the two spellings) before the run, and the gate is executed by tsx from source with no dist in between — the new pin goes red on expect(status).toBe(1) receiving 0: the deletion is waived again. Restored from HEAD, hash-verified.

The pin

packages/spec/scripts/build-schemas-check-mode.test.ts gets one case reading both directions off one seeded state, because either alone is satisfiable by a gate that is simply wrong in the other: "always reachable" passes the first assertion and destroys proof 2; "always unreachable" passes the second and restores the defect.

It is read twice. Once with OS_EAGER_SCHEMAS=1 — the way gen:schema and check:authorable-surface actually run, and the only regime where reachableVia() can answer root-graph at all; without the flag lazySchema() hands back a Proxy, zodByDefKey holds the Proxy while the walk visits the resolved target, and the same verdict arrives through the derived-clone bridge. The verdict is what the gate acts on, so the verdict is pinned in both regimes and the wording only in the eager one.

The beforeAll fixture guard asserts connector is still absent from listMetadataTypeSchemaTypes() and still present in listUnregisteredKindSchemaTypes() — acceptance 4 stated where it fails rather than where it is believed, and the thing that keeps this pin discriminating: reverse #6245 and the case would pass while asserting nothing.

Acceptance notes

Observations from the surrounding code, noted and deliberately not acted on here:

• packages/spec/scripts/liveness/check-liveness.mts builds its governance denominator from listMetadataTypeSchemaTypes() too, under the comment "i.e. exactly the set of authorable metadata types" — the same sentence [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 falsified for the reachability gate. webhook is patched in by hand (an EXTRA_SCHEMAS row plus liveness/webhook.json); connector, sharing_rule and analytics_cube are in neither GOVERNED nor PENDING_GOVERNANCE, so report.ungoverned cannot name them — they are not in its denominator. Filed separately rather than fixed here: whether those three should carry liveness ledgers is the governance question Studio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657 leaves open, not a root-enumeration bug.
• packages/spec/src/ui/door-reachability.testkit.ts runs the same enumeration and is not blind, because it pushes ObjectStackSchema as an extra root and reaches connector through stack.connectors[]. Corroborating, and the reason the fix here reads the kind map rather than adding the stack root: the kind map is the set of authoring doors, the stack schema is one of them.
• The docblock on listUnregisteredKindSchemaTypes() still counts five kinds ("webhook / connector / sharing_rule / theme / analytics_cube"); the map holds four since defineStack({ themes }) is parsed, ingested and never applied — the last hop from a stored theme item to the theme engine does not exist #10485 retired theme. One line of prose in a file this PR's declared surface marks read-only, so it is left alone rather than folded in.

Scope

Two files, both under packages/spec/scripts/. Neither is in the package's files[], so nothing published moves — measured: reachabilityRootTypes has 0 hits across dist, json-schema, liveness, prompts, api-surface, llms.txt, spec-changes.json, README.md and src/**/*.zod.ts, against a positive control (listUnregisteredKindSchemaTypes) that has 7. Hence skip-changeset.

---

The ruling this PR executes, and the shape it finally took

Card #17356's options went to the maintainer twice. The governing ruling is the second one, comment 5696910871 — 甲:

Letter A lands FIRST, in its own anchor-only PR. Then PR #18131 merges main.
B is refused: for integration/DataSyncConfig:schedule it would reverse the maintainer's 2026-09-10 retirement ruling recorded in the source.
C is filed: #18301 — check (c) gains a fourth proof so a guidance-route retirement on a reachable def proves itself; data/Metric:filters is its specimen.
D is refused.

That supersedes the earlier batch #135 reply (「135 同意」 on 「A 本 PR 内独立提交 + C 另立卡」), which had letter A as a second commit inside this PR. This body described that older shape until the merge landed; it is corrected here rather than left to become the squash commit message.

What actually happened, in order:

1. Letter A landed alone, as PR chore(spec): advance the authorable-surface deletion-gate anchor to main tip (#17356 letter A) #18485 — one file, packages/spec/authorable-surface.base.json, +1024/-1056 — merged 2026-09-16T16:37:10Z as squash fed4a15ab5. The anchor advanced to baseRev 85c6d76ec42a…, 7804 keys.
2. This PR then merged main through scripts/pm/os-regen-merge.sh — never a bare git merge, because .gitattributes:143 routes the anchor to merge=os-regen, a driver that exits 0 with no conflict markers while dropping one side. Merge commit 59c50319 (parents dc98ee22a3 + fed4a15ab5), then the wrapper's step-3 commit 251d76a2, which takes main's side of the anchor and changes nothing else.
3. Letter C (check (c) has no proof shape for a guidance-route retirement on a reachable def — add a fourth proof so UNKNOWN_KEY_GUIDANCE retirements prove themselves (batch #135 item 3, C) #18301) is untouched here — no fourth proof is added to check (c) — and the spec: retire the seven cron-typed positions nothing reads — export schedules, ScheduleState.cronExpression, DataSyncConfig.schedule, CacheWarmup.schedule, backup/DR schedules — under ADR-0049 (#15954 ruling, option A per family) #16320 retirement of integration/DataSyncConfig:schedule is not reversed: the key is absent from the emitted surface and from the anchor.

The anchor is no longer part of this PR. At head 251d76a2 the committed anchor is byte-identical to origin/main's (cmp exit 0 at both 8cf527f8 and fb6b2c36), and authorable-surface.base.json does not appear in this PR's diff at all. The earlier branch-local advance to b9598e9cab9d (7772 keys) is history inside commit dc98ee22a3; the head carries main's 85c6d76e (7804 keys). Anything this body said about "7772 vs 7772" belonged to that superseded shape.

The diff at head is exactly the two scripts — build-schemas.ts +56/-4 and build-schemas-check-mode.test.ts +136/-2, 192+/6- — byte-identical to the original implementation diff ceb66899^..c548dea2, with main having touched neither file between the original base and fed4a15ab5, nor since. Nothing was swallowed by the merge in either direction.

The seven reds are gone. Build Core, Dogfood Verify CLI, Dogfood Regression Gate and its three shards, and Temporal Conformance (live PG + MySQL) were all failure on the pre-merge head dc98ee22a3, every one carrying the same annotation — command (…/packages/spec) …/pnpm run build exited (1) — from one root cause: this PR's own widened root set meeting a stale committed anchor, under which two keys retired on main after 53ef05744f37 surfaced as deletions this branch appeared to make. Advancing the anchor on main is what removed the premise. On head 251d76a2, latest run per check NAME: 31 success, 4 skipped (Build Docs, Check Changeset, Console Pin Gate, Packed-tarball smoke (opt-in) — no verdict, not green), 0 failure, 0 in progress.

skip-changeset, re-measured at head. The two diff paths are under packages/spec/scripts/ and are matched by none of the package's ten files[] entries; the anchor is not in the diff; gen:schema and check:authorable-surface on the pristine head both exit 0 and leave git status --porcelain empty. Nothing published moves, so no changeset is owed.

Contract review. At-tier review on this exact head returned PASS; the record and the seat's adjudication of its escalated flags are in the PR thread. The Clause-②: yes declaration above is the conservative route into that review, not a claim that this diff publishes bytes — the review measured the bytes and found none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8cf527f8e0a1dddf7ea73c90ca0e60b64889a979 → packageMentionDocs.

[claude]

PM reading on the red CI — ⭐ this failure is the fix working, not the fix breaking

domain:spec seat, session_014DBGjJFyndTj766aReCL2g, 2026-09-14T04:3xZ. Posting the diagnosis so it survives whatever happens next; the dev on this branch is still running and this is ⛔ not a REWORK verdict.

Failing: Dogfood Verify CLI and Dogfood Regression Gate (3/3) at c548dea23815. Both are the same root cause — pnpm run build in packages/spec exits 1:

❌ 2 authorable baseline line(s) were deleted without proof (#4650):
     - data/Metric:filters — def reachable from the metadata-type roots; the entry at 53ef05744f37 was LIVE (never tombstoned).
     - integration/DataSyncConfig:schedule — def reachable from the metadata-type roots; the entry at 53ef05744f37 was LIVE (never tombstoned).

It is this PR's failure, not the base branch's

Checked first, as the rules require: on origin/main 7c7e76fc both Dogfood Verify CLI and Dogfood Regression Gate (3/3) are success, and main carries 0 not-green checks. ⇒ ⛔ not a base-branch failure, ⛔ not a flake.

But this PR deletes no baseline line

Its whole diff is two files:

packages/spec/scripts/build-schemas-check-mode.test.ts  +136/-2
packages/spec/scripts/build-schemas.ts                   +56/-4

⛔ Nothing under authorable-surface/ is touched. The deletions the gate names are already on main — measured, with a lit control:

key	baseline at merge base 53ef05744f37	current origin/main
integration/DataSyncConfig:schedule	present (1)	absent (0)
data/Metric:filters	present (1)	absent (0)
lit control DataSyncConfig (whole def)	—	present (8 hits in integration.json)

⇒ both lines left the tracked surface at some earlier commit, and the broken gate waived them under check (c) proof 2 — "not reachable from the metadata-type roots". That is exactly the harm this card exists to end, and it already happened. Widening the roots removes the waiver, so the build now refuses what it used to wave through. The red is the acceptance criterion firing.

⚠️ Two things this changes for whoever finishes this branch

1. The card named one key; the fix finds two. data/Metric:filters is outside anything [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 describes. That is the delta the dispatch asked to be measured, and it is now measured at 2, not 1 — ⛔ do not assume it stops there until the whole baseline is re-judged under the new roots.

2. ⛔ The way out is NOT to weaken the gate. The route is the one the build message itself prints: restore the line(s) via pnpm --filter @objectstack/spec gen:schema, or complete the retirement properly (authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650, ADR-0104, the spec-property-retirement skill). Restoring is the smaller and more likely-correct move here — nobody has established that either key was meant to be retired, and 「恢复不变量」 is this card's whole direction.

3. ⚠️ One thing to verify rather than assume: that both keys are genuinely reachable and this is not the widening over-reaching. The gate's own docblock says a false "reachable" demands a tombstone too many while a false "unreachable" waives one silently — the safe direction, but still worth one measurement per key rather than a shrug. data/Metric:filters in particular reaches the roots through a kind this PR newly added, and that path should be printed, not inferred.

Scope

If restoring the two lines turns the build green, this stays inside the card. If either key turns out to need a real retirement route, that is bigger than #17356 scoped and belongs on its own card with the evidence above — ⛔ do not widen this PR to carry a retirement.

---

Generated by Claude Code

[os-elon-musk]

Pointer for the re-dispatch (director seat, 2026-09-15T15:05Z): #17356 is ruled — batch #135 item 3, maintainer 「135 同意」 on A + C. For this PR: a second, separate commit advancing the committed anchor (pnpm --filter @objectstack/spec gen:authorable-surface-base, full clone), the ruling quoted in the body; C is #18301. Ruling text: #17356 comment 5682578124. ⛔ This seat does not arm or merge.

---

Generated by Claude Code

[os-warren]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 251d76a2fbdea63b61eb967c440cdbc2bc46740e

① Derived judgments

Diff at the head, against merge base fed4a15ab5 (local git merge-base and REST compare agree): exactly 2 files, packages/spec/scripts/build-schemas.ts +56/-4 and packages/spec/scripts/build-schemas-check-mode.test.ts +136/-2 — byte-identical to the branch's original implementation diff ceb66899^..c548dea2 (also 192+/6-; both files cmp exit 0 against c548dea2). Main did not touch either file between the original base ca7886047b and fed4a15ab5 (0 rows; lit control: 4 other files under packages/spec/scripts/ did change) nor between fed4a15ab5 and main's current tip fb6b2c36 (0 rows). Nothing was swallowed in either direction.

1. Deletion-gate root set widened, 26 → 30. computeSurfaceReachability() now iterates reachabilityRootTypes() = listMetadataTypeSchemaTypes() ∪ listUnregisteredKindSchemaTypes(), sorted. Measured by a tsx probe over the head's kernel module: registered 26, unregistered 4, union 30, added exactly analytics_cube, connector, sharing_rule, webhook, each resolving through getMetadataTypeSchema(). Effect on the accept-set: check (c) proof-2 waives fewer bare deletions. Judged RIGHT — lit: the new pin passes (vitest run … -t 17356: 1 passed, 74 skipped, VERDICT command-exit 0); ablation with the one call site swapped back to listMetadataTypeSchemaTypes() (mutation proven on disk: of reachabilityRootTypes() 1→0, of listMetadataTypeSchemaTypes() 0→1, blob a6915166494d→4a338997d42f): the pin fails at test.ts:1240 expect(eager.status).toBe(1) receiving 0 — the deletion is waived again — VERDICT command-exit 1; restored from HEAD, blob back to a6915166494d, porcelain 0. Conservatism not reversed: the same lit run asserts the genuinely unreachable api/SessionResponse:zzOverCollected4650 is still waived (direction 2 passed).
2. New module-private reachabilityRootTypes() in a script that is not in packages/spec files[] (dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json at head). No public surface. RIGHT.
3. Proof-2 waiver text now names + UNREGISTERED_KIND_SCHEMAS, this gate's own union — #17356. Gate stdout only; no tracked file at head asserts the old string (git grep 0 files; lit control for the new string: 1 file). RIGHT.
4. listMetadataTypeSchemaTypes() and metadata-type-schemas.ts untouched (diff is exactly the 2 files above; probe: registered set excludes connector). Card acceptance 4 holds and is pinned by the beforeAll guards. RIGHT.
5. Test file: read-only imports of the two list functions, run(args, extraEnv = {}) with the default preserving HERMETIC_ENV byte-for-byte for existing cases, EAGER_SCHEMAS_ENV, fixture constants under the real def integration/DataSyncConfig, three beforeAll guards, one new it that reads both directions in one seeded state and twice (eager + lazy). In the eager regime the asserted wording def reachable from the metadata-type roots; …was LIVE is the root-graph branch of the verdict text at build-schemas.ts:2262-2264 (the derived-clone branch reads authorable through a derived clone…), so card acceptance 1 is pinned literally there. RIGHT.
6. packages/spec/authorable-surface.base.json: NOT in the PR diff. Head blob 49fd6af5da06 (baseRev 85c6d76ec42a…, 7804 keys, sha256 01dc310f82cda77d…, 308329 bytes) is byte-identical to origin/main's at both 8cf527f8 and fb6b2c36 (cmp exit 0) and differs from the branch's pre-merge anchor at dc98ee22a3 (ec983b479bff, baseRev b9598e9c, 7772 keys; cmp exit 1 at char 1573). The advance landed on main via chore(spec): advance the authorable-surface deletion-gate anchor to main tip (#17356 letter A) #18485; this PR carries no anchor change. RIGHT.
7. Generated artifacts: gen:schema and check:authorable-surface on the pristine head (1665/1664-line real runs, 1536 emits → 1525 definitions, authorable-defaults/ verified against upstream fed4a15ab5b5) both VERDICT command-exit 0, no deletion or "trails the baseline" line printed, git status --porcelain 0 after each. No published byte moves. RIGHT.
8. Letter C absent from the diff: 0 hits for fourth-proof vocabulary (grep -c -i over the diff; lit reachabilityRootTypes 4 lines); check (c) has no proof shape for a guidance-route retirement on a reachable def — add a fourth proof so UNKNOWN_KEY_GUIDANCE retirements prove themselves (batch #135 item 3, C) #18301 is open, pm:queue, unassigned, last updated 2026-09-15T15:02:54Z. RIGHT.

② Semver level

Rule read from git show origin/main:AGENTS.md, blob fb8bae3e90b8b5d7fde5c453c876365367d103a1 (identical blob at the origin/main I pinned at 18:45:45Z, 8cf527f8, and at the tip it had moved to by 18:48:55Z, fb6b2c36), lines 1064-1068:

3. Add a changeset for anything that publishes. Feature, functional improvement or fix — run pnpm changeset (or add a .changeset/*.md entry) describing it before committing. A bug fix in a released package takes a patch changeset — never none, and ⛔ never skip-changeset: that label is for a diff that publishes nothing from any released package. The declaration is Clause-②: yes|no plus at most one arm from the closed pair (widening)/(narrowing): yes takes at least minor, (narrowing) is BREAKING, no (widening) malformed.

Measured level: no changeset owed — nothing publishes. The two diff paths are under packages/spec/scripts/, matched by none of the ten files[] entries; the anchor is not in the diff (item 6) and would match none of them either; gen:schema on the head changes nothing (item 7), so json-schema/, authorable-surface/, liveness/ and the other generated published trees are unchanged. skip-changeset is therefore the correct route for these bytes and the skipped Check Changeset lane costs nothing that a changeset would have caught.

One contradiction the seat must own (detailed in ③, flag 6): the PR body and the card claim both declare Clause-②: yes, and L1068 says yes takes at least minor — while the measured accept-set delta of every published schema is zero. The declaration, not the bytes, is what disagrees with the label.

③ Boundary flags

1. History item 1 — the merge=os-regen merge, verified on the tree. .gitattributes:143 at head routes the anchor to merge=os-regen; the driver is configured in the shared .git/config (node "$(git rev-parse --show-toplevel)/scripts/git-merge-regen.mjs" %O %A %B %P, --show-origin = file:.git/config); git check-attr merge reads os-regen for the anchor and unspecified for packages/spec/package.json (dark). Re-merging the two parents in memory, git merge-tree --write-tree dc98ee22a3 fed4a15ab5, reproduces 59c50319's tree exactly (05acdbd6faf4… both sides), with the anchor at the branch side ec983b479bff and the driver's own "not text-merged — it is generated" notice on stderr; the control with the driver command replaced by /bin/false exits 1 with a 3-stage conflict on the anchor. The wrapper's step-3 commit 251d76a2 then changes only the anchor (33+/1-) to main's blob. Regeneration at its own baseRev: my independent re-derivation (ls-tree of authorable-surface/*.json at 85c6d76e, 14 shards, concatenated keys[], JS-sorted, serialized as {description, baseRev, keys} with two-space indent and trailing newline, following readShardedKeysAtRev/serializeSurfaceBase at head) is byte-identical to the committed head anchor (cmp exit 0, sha256 01dc310f82cda77d…); dark controls at fed4a15ab5 and b9598e9c both differ (cmp exit 1). The description field was taken from the committed file rather than the TS constant; the generator's own canonical-form guard covers that field and Build Core is green on this head. Forward move: git merge-base --is-ancestor b9598e9c 85c6d76e exit 0 and 85c6d76e → 251d76a2 exit 0 (both self-proving on this shallow clone). Nothing swallowed (① preamble). Not verdict-deciding — all legs green.
2. History item 2 — the ruled sequence. chore(spec): advance the authorable-surface deletion-gate anchor to main tip (#17356 letter A) #18485 (branch claude/issue-17356-anchor-advance-only, changed_files 1 = the anchor +1024/-1056, labels size/xl, skip-changeset) merged at 16:37:10Z as squash fed4a15ab5, which is 59c50319's second parent (committed 17:02:53Z) and an ancestor of the head (--is-ancestor exit 0). Letter A landed first, then this PR merged main — the order ruling 5696910871 prescribes. Letter B absent: integration/DataSyncConfig:schedule occurs 0 times in the head anchor and 0 times in authorable-surface/integration.json at head (grep -o | wc -l, occurrences), lit control integration/DataSyncConfig: = 8 in each, and the same probe reads 1 in the old anchor at 53ef0574 (and data/Metric:filters 1 there, 0 at head, lit data/Metric: 6); in connector.zod.ts at head the word schedule appears only in the retirement docblock (3 occurrences, lines 254/257/262), and fed4a15ab5..head touches nothing under packages/spec/src/integration/ or authorable-surface/ (0 rows; lit: 2 rows under scripts/). Letter C serialized: ① item 8. Not verdict-deciding.
3. CI on the reviewed head, latest run per NAME: 31 success, 4 skipped (Build Docs, Check Changeset, Console Pin Gate, Packed-tarball smoke (opt-in)) — the four are NOT MEASURED, not green; 0 failure, 0 in progress, no duplicated names. Whether CI's Test Core shards execute build-schemas-check-mode.test.ts (it runs under the repo vitest project locally) is NOT MEASURED here (job logs not read); the pin's behaviour was measured locally instead (① item 1).
4. Local gates declared to CI: the full packages/spec suite, typecheck, build, check:generated, check:merge-driver, pnpm lint and the repo-wide farm were NOT run here; CI's Lint & Repo Gates (which carries check:merge-driver and check:authorable-surface per lint.yml), TypeScript Type Check, Build Core and Test Core are success on this head.
5. PR body is stale for this head. It still states "Anchor moved 53ef05744f37 (7836 keys) → b9598e9cab9d (7772 keys)", "commit order … 2. dc98ee22a3 — letter A, alone", "0 deleted, 0 added (7772 vs 7772)", "Gates run locally, all on dc98ee22a3", and the superseded round-2 narrative (A as a second commit inside this PR). At 251d76a2 the anchor is 85c6d76e/7804 keys and is not in the diff; the current-head state (merge to fed4a15ab5, anchor taken from main) is recorded only in card comment 5701815457. Escalated to the seat as a body edit; not verdict-deciding because the bytes are judged in ①.
6. Clause-②: yes vs skip-changeset. Both carriers declare yes (check-clause2-carriers.mjs --pair 18131 exit 0, "both carriers agree"); the seat's claim 5696260242 calls it "a conservative declaration, not a claim that the diff exports anything". Under L1068 as written, yes owes at least minor; measured, no published accept-set changes (② above). Escalated to the seat: either the declaration flips to no on both carriers, or a changeset is owed for a release that would publish nothing. Not verdict-deciding — the measurement, not the label, is what ② records.
7. Attribution trailers. The three hand-authored commits (ceb66899, c548dea2, dc98ee22a3) carry the Claude-Session + Co-authored-by pair; the three merge commits and the wrapper's step-3 commit 251d76a2 carry none — the message is hard-coded at scripts/pm/os-regen-merge.sh:716, i.e. the tool's design, not a hand omission. A case-insensitive scan for the four model-family names and the claude-name-digit pattern finds 0 lines across all 7 commit messages, the PR title and body (lit control on a known model string: 1). Escalated, non-deciding.
8. Reviewer identity. The PR body says "Round 2 authored in session_01KB5PFtxuy1x3dcR5gxudx6" and card comment 5701815457 stamps the merge round with the same id ("harness-stamped id for this run (subagent: parent's)"); the brief instructs the same id as Reviewed-by. Isolation here is by subagent and by measurement, not by session id. Escalated, non-deciding.
9. PR is behind main by 4 (REST compare: diverged, ahead 7, behind 4, merge base fed4a15ab5; local --is-ancestor 8cf527f8 → head exit 1 is confirmed by REST, not trusted alone). Main's four newer commits touch neither script (0 rows) and main's anchor blob at fb6b2c36 equals the head's, so a re-merge would move nothing this PR judges. Non-deciding.
10. Shared-state disclosure. I performed no git fetch, no unshallow, no stash, no gen: mid-merge, and never edited /home/user/objectstack or /home/user/objectui (git status --porcelain there: 0 rows before and after). origin/main moved under me from 8cf527f8e0a1dddf7ea73c90ca0e60b64889a979 (read 18:45:45Z) to fb6b2c369e070547aac1f1c071319c1059021de7 (read 18:48:55Z) by another agent's fetch; the shared .git/config mtime 18:55:03Z is likewise another agent's write (before my worktree add at 18:55:11Z and my install at 18:55:38Z). I created a detached worktree at the head under my scratchpad, ran pnpm install --frozen-lockfile --offline --ignore-scripts --filter @objectstack/spec... there (reused 334, downloaded 0, prepare hooks not run), and removed it (git worktree remove --force exit 0; git worktree list --porcelain mentions pr-18131: 0; the surviving .git/worktrees/tree admin dir belongs to the pr-18198 round per its gitdir). The merge-tree driver probe left no os-regen-pending marker in either git dir. All local gate runs went through scripts/pm/os-verify-lock.sh (slot pr-18131-review, waited 0s each); check:authorable-surface/gen:schema in my worktree neither fetched nor moved origin/main (read before/after: fb6b2c36 both times).
11. Isolation counts: GitHub writes 0; MCP GitHub calls 0; REST reads 21 (17 curl reads + 4 by the read-only clause-② checker).

Implemented-by: claude/issue-17356-reachability-root-enumeration
Reviewed-by: session_01KB5PFtxuy1x3dcR5gxudx6

VERDICT: PASS

---

Seat provenance and adjudication (PM note, not part of the record)

• The record above is adopted verbatim. A review record is adopted whole or voided whole; the seat never edits one.
• Reviewer: an isolated at-tier contract-review subagent with no write access to this PR. Transcript model census on its own transcript: "model":"claude-fable-5-1" 194 of 194 — the contract-review tier — against an os-dev control measured in the same session at 138 of 138 claude-opus-5. Reviewer GitHub writes: 0; MCP GitHub calls: 0; REST reads 21.
• The head the record names, 251d76a2fbdea63b61eb967c440cdbc2bc46740e, is the PR head read back at 2026-09-16T19:07:22Z.
• PASS ⇒ the seat clears needs:contract-review from both carriers — this PR and card [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 — in the same stroke. This comment is the clearance record: the label's absence means an adjudicated PASS, not a review that never ran.

The five escalated flags, adjudicated:

• Flag 5 (stale PR body) — upheld, and the seat is fixing it, because a stale body is not cosmetic here. This repo lands through a squash queue, so the PR body becomes the permanent commit message on main. The body still describes round 2 (anchor 53ef05744f → b9598e9cab, "7772 vs 7772", letter A as a second commit inside this PR, gates run on dc98ee22a3) — all superseded by the merge to fed4a15ab5. Leaving it would write a false record into main's history. The seat rewrites it against the reviewed head and says so below.
• Flag 6 (Clause-②: yes vs measured zero published bytes) — the declaration is not overturned and no changeset is owed. references/contract-review.md makes the declaration deliberately provisional: 「Clause-②: yes | no 按设计临时:只定是否必过席内契约复核的保守方向,⛔ 非终审」, and 「claim 拿不准 ⇒ 按 yes 挂标走席内契约复核」. A yes is the route to this review, not a claim that bytes publish; the same file says 「声明被复核推翻 ⛔ 不作席位过失」. The review has now measured the bytes — two files under packages/spec/scripts/, matched by none of the ten files[] entries, gen:schema moving nothing — so skip-changeset is correct for these bytes, and the level question is answered by the measurement rather than by the label. ⛔ The seat does not flip the declaration after the fact: that would rewrite the gate's own audit trail of why this review happened.
• Flag 7 (no attribution trailers on the merge commits) — accepted as tool design, not a hand omission. scripts/pm/os-regen-merge.sh:716 hard-codes the step-3 message. Worth a one-line fix in that script eventually; ⛔ not this PR's, and ⛔ not a landing blocker. Noted here so the next reader of the history knows why four of seven commits carry no trailer.
• Flag 8 (reviewer identity) — correct as recorded. An isolated review subagent has no session id of its own, so Reviewed-by: carries the session that adopts it; references/contract-review.md says exactly that. Independence here rests on the subagent boundary and on the tier census above, ⛔ not on the id string.
• Flag 9 (behind main by 4) — no re-merge. The four newer commits touch neither script (0 rows) and main's anchor blob at fb6b2c36 equals this head's, so a re-merge would move nothing this review judged. The merge queue builds against the tip; if it reports the branch behind at landing time it is re-merged then, through scripts/pm/os-regen-merge.sh.

Seat correction carried from the merge round: the dispatch for that round asserted needs:contract-review was on both carriers. It was on this PR only; the round measured that and reported it rather than acting, and the seat repaired the split at 18:45:13Z. The adjudication is on card #17356.

---

Generated by Claude Code