spec(v18): move PROTOCOL_VERSION 17 → 18 in an ordinary pull request with full CI: regenerate spec-changes.json and the 17 → 18 upgrade-guide section, rewrite the in-repo ^17 handshakes, and give the lockstep test one pre-mode exception (#22085 Q1)

[objectstack-fleet]

Ruled: 6056808625 · letter E · 2026-10-08T09:29Z

This card carries #22085's Q1 half: the ruling 6049734955 (Q1 → B). #22085 keeps Q2, the v18 release page (a release-side action), and Q3, filed as the domain:devx sub-issue filed in the same act (both numbers are recorded on #22085).

Filing gate: ③ a direct task from a maintainer ruling. The ruling 6049734955 records the maintainer's 「22082 22085 同意」 (2026-10-08T00:37Z) taking Q1 → B: "the protocol major moves in an ordinary pull request that runs the full CI, not in the version pass … The constant lives in packages/spec, so the work is the domain:spec lane's card, filed by the domain:devx seat in execution."

Reader: the domain:spec seat claims and dispatches it from its queue. Lane and priority come from the ruling and the parent (#22085, priority:p1, target:v18); p1 carries down the chain. Filed by PM seat domain:devx#2 (session_01VF48aw8RPG6wzDnMgp6rtw). ⛔ Not a claim.

Order: this lands after PR #22084 (#22080, pre mode plus the major marker). The lockstep exception below keys on the pre mode that PR opens. Development can start now. Until this lands, release.yml's version-pr refresh stays red at Validate the post-version tree, and that red publishes nothing. ⛔ #21988 is not merged.

What is measured (on origin/main 8fc50b7647)

• packages/spec/src/kernel/protocol-version.ts:18: export const PROTOCOL_VERSION = '17.0.0';.

• scripts/sync-protocol-version.mjs derives the constant from @objectstack/spec's major at version time, inside the root version script. In pre mode that would rewrite the constant inside the bot's Version Packages PR, which runs no CI. The script's own note on fix(spec): PROTOCOL_VERSION 13.0.0 → 14.0.0 — re-lockstep with the released major #2769 warns against that shape.

• PR fix(release): judge the major-boundary template stamps on the version-pr lane, and stop prerelease cuts re-dating the last GA #22095 (8a925b3b47) made release.yml's Validate the post-version tree refuse a version pass that changes protocol-version.ts. Its refusal text names the reason: the handshake would refuse every engines.protocol: '^17' manifest, and no gate on that lane boots them.

• Files declaring a ^17 protocol handshake: 56, from git grep -l -E "protocol['\"]?\s*:\s*['\"]\^17".

  Path	Files
  packages/cli	21
  packages/metadata	6
  content/docs	6
  packages/qa	4
  packages/runtime	3
  packages/metadata-core	2
  packages/lint	2
  examples/app-multi-package	2
  packages/spec	1
  packages/mcp	1
  packages/create-objectstack	1
  examples/app-todo	1

  Some may pin an old protocol on purpose (a refusal test). Each is judged, not swept.

• The generated documents: packages/spec/spec-changes.json and docs/protocol-upgrade-guide.md, which needs its 17 → 18 section. Their gates are check:spec-changes and check:upgrade-guide.

• The lockstep test: packages/spec/src/kernel/protocol-version.test.ts.

Done when

• PROTOCOL_VERSION reads '18.0.0'. Once both pre.json and the major marker are on main, the next version pass leaves protocol-version.ts untouched and Validate the post-version tree passes that check. This is confirmed by a replay of the root version script on a throwaway tree, quoted in the PR body.
• spec-changes.json and the upgrade guide's 17 → 18 section are regenerated by their own tooling, ⛔ not by hand, and check:spec-changes and check:upgrade-guide exit 0.
• Every in-repo ^17 handshake that means "the current protocol" reads ^18. Each one left at ^17 is named in the PR body with its reason.
• The lockstep test gains exactly one narrow exception: in pre mode with a pending major changeset, the protocol major may equal the major about to be published. Outside that condition it is unchanged, and the exception carries its own failing case.
• First measurements, answered in the PR body before the edit:
  • which packages/cli fixtures declare ^17 on purpose;
  • whether ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082's 17 → 18 conversions (PR feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103 in flight) may take effect before ADR-0131 C8.
• ⛔ No change to sync-protocol-version.mjs's version-time behaviour, release.yml or cut-rc.yml. ⛔ No publish, tag or release workflow run.

Dedupe

REST page loop (since 2026-09-01, state=all, 1,940 issues: 45 open, 1,895 closed) grepped for PROTOCOL_VERSION|protocol-version\.ts|\^18|protocol major|protocol 18|17 → 18 → 18 hits.

• The parent release(v18): the version-pr lane refuses the major boundary at Validate the post-version tree, so #21988 never refreshes into 18.0.0-next.0 — wire the lane's major-only gates in, and stop prerelease cuts re-dating the last GA #22085 and this seat's post [PM seat] domain:devx · seat 2 — ⏳ vacant #20163.
• The retiredKey() tombstone findings spec: 14 retiredKey() tombstones again prescribe @objectstack/spec 18, a version that will not contain the change — #4350 recurring with no gate behind its fix #18040, 14 ADR-0049 tombstones tell authors a key was removed in @objectstack/spec 18 — an npm version that does not exist and, under the 2026-09-13 level ruling, will not be the carrier #18048, [finding] Six retiredKey() tombstones tell authors a key "was removed in @objectstack/spec 18" — a version that does not exist; the package is 17.4.0 and every retirement now ships minor #18059 (closed).
• Migration-registry and spec findings [finding] migrations/registry.ts mixes generated regions with hand-authored ones, so the documented merge remedy silently drops step18.conversionIds — 115 gates stayed green; only a chain-replay test caught it #18062, [finding] @objectstack/spec has four grammars for a package version, and ManifestSchema refuses the 2.0.0-beta.1 that PackageVersionSchema's own docstring advertises #18697, chore(spec): raise MIGRATION_SUPPORT_FLOOR from 10 to 16 — upgrades are supported from protocol 16 onward #19056, The spec-property-retirement playbook still instructs a major changeset, which ADR-0087's 2026-09-13 amendment superseded and check-changeset-no-major refuses #19366, [finding] Two major-18 D3 entries print CurrencyConfigSchema.precision … unchanged through os migrate meta, which PR #20251 makes false in the same major #20379, [finding] spec(migrations): the ui-html-page-div-refused entry's why text says dev and start run compile first; they do only when the artifact is missing or --compile is passed #20649, [finding] spec build: the pure-schema-construction plugin rewrites strictObject( inside a string literal, so the published migration text differs from its source #20686 (closed).
• The import template (GET /data/:object/export?template=true) sits behind the EXPORT gate (allowExport): a caller who may import but not export cannot download it — gate it by the import door instead? (from #18386 acceptance-6 verification) #20896, docs: positioning follow-up: stale home title, cover image and alt; README restructured on the four promises; an ontology concept page; glossary and north-star bridges #21586 and four red-main reports (closed), matched on unrelated text.

None moves the constant.

[objectstack-fleet]

Claim: PM loop round 1 (ruling 6049734955 on #22085, Q1 → B, retrieved at this stamp; the maintainer's 「22082 22085 同意」) · 2026-10-08T03:05Z
Session: session_01LAi5BVvQNiYzepSAcsoFLK
Account: os-litant (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22130-protocol-18
Worktree: objectstack-issue-22130
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
Ruling-ref: 6049734955
File surface (at origin/main ef1fcb26a2; stop on breach and explain in the report):

• packages/spec/src/kernel/protocol-version.ts (PROTOCOL_VERSION, :18) and its lockstep test protocol-version.test.ts: exactly one narrow exception (pre mode with a pending major), with its own failing case.
• The two generated documents, regenerated by their own tooling and ⛔ never by hand: packages/spec/spec-changes.json and the 17 → 18 section of docs/protocol-upgrade-guide.md (both merge=os-regen).
• The in-repo ^17 handshakes, judged one by one (56 files at this stamp from the card's git grep; control: the ^16 spelling reads 2). In scope: packages/cli 21, packages/metadata 6, content/docs 6, packages/qa 4, packages/runtime 3, packages/metadata-core 2, packages/lint 2, examples/app-multi-package 2, packages/spec, packages/mcp, packages/create-objectstack, examples/app-todo, examples/app-showcase and examples/app-crm 1 each. A site that pins ^17 on purpose (a refusal test) stays, named with its reason in the PR body.
• ⛔ Not in this PR, named in its body with the reason: skills/objectstack-platform/SKILL.md and evals/config-plugins-ops.json, and skills/objectstack-upgrade/SKILL.md (governed Tier H; the seat routes them), and .github/workflows/scaffold-e2e.yml :106 (a comment).
• ⛔ No change to scripts/sync-protocol-version.mjs's version-time behaviour, release.yml or cut-rc.yml. ⛔ No publish, tag or release workflow run.
• Tests of each package touched, and .changeset/22130-*.md. Grade: minor with its BREAKING banner and ADR-0087 disposition while .changeset/pre.json is absent on main, major once it is; the dev reads main at PR time.
• Declared cross-lane files: domain:cli (cli, qa, runtime, mcp, create-objectstack) on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024; domain:engine (metadata, metadata-core) on [PM seat] domain:engine — 🟢 os-litant · session_01EUBvqtauTDmHi2ZgY759p2 #6367 and [PM seat] domain:engine · seat 2 — ⏳ vacant #20966; domain:devx (content/docs, examples/**) on [PM seat] domain:devx @ objectstack — 🟢 os-sales · session_0115N1oNnQS5WqofZ2DzaT3q · R3 · landed 4 · in flight 3 #6023 and [PM seat] domain:devx · seat 2 — ⏳ vacant #20163.
  Container & model: L, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate on these paths; the default tier). Contract review at CONTRACT_REVIEW_TIER owed before enqueue (path limb packages/spec/src/**, and this claim's Clause-②: yes), from an isolated at-tier subagent.
  Clause-②: yes (widening: the exported PROTOCOL_VERSION moves to '18.0.0', and the runtime handshake accepts a ^18 manifest it refused before; it also refuses ^17)
  Responsibility: n/a — not a defect card
  Thread-read: none
  Serial constraints cleared:
• Lands after PR chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 (release(v18): enter Changesets pre mode on main (changeset pre enter next) with one major marker, so the first v18 prerelease is 18.0.0-next.0 — the opening ruled B on #22050 #22080: pre mode plus the major marker; the maintainer's merge). The lockstep exception keys on that pre mode, so this PR parks as a draft with a signature-level expected-red list until chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 merges.
• spec-changes.json, protocol-upgrade-guide.md and migrations/registry.ts are also regenerated by this seat's feat(cli): os migrate meta --write — the AST codemod that rewrites authored sources for the mechanical applied set (v18) #9591 (PR fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest #22142) and possibly feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207. Whichever lands later merges main through os-regen-merge.sh.
• Open PRs on the handshake files: PR feat(plugin-security)!: the six built-in positions are declared position metadata (ADR-0131 C2 stage S2) #22139 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196, domain:services) on packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts; PR feat(spec)!: retire the flat string-list arm of manifest.permissions — the structured ADR-0025 block is the only form (#13458) #22094 (Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458, seat 2) on packages/spec/src/kernel/manifest-unknown-keys.test.ts; PR docs(skills): objectstack-upgrade's late-arrival example starts at the support floor #22145 (skills(objectstack-upgrade): the "several majors late" paragraph still examples os migrate meta --from 10, which the chain refuses below MIGRATION_SUPPORT_FLOOR = 16 (MigrationFloorError) #22123) on skills/objectstack-upgrade/SKILL.md, which this PR leaves alone. Whichever lands later merges main.
• ⛔ chore: version packages #21988 (Version Packages) is not merged.

[objectstack-fleet]

os-dev-report
{
"issue": 22130,
"status": "needs_decision",
"branch": "claude/issue-22130-protocol-18",
"pr": "#22215",
"session": "session_01LAi5BVvQNiYzepSAcsoFLK — mode:subagent, the parent seat id (CLAUDE_CODE_REMOTE_SESSION_ID cse_01LAi5BVvQNiYzepSAcsoFLK)",
"premise_still_valid": true,
"summary": "PROTOCOL_VERSION reads '18.0.0'. spec-changes.json and docs/protocol-upgrade-guide.md were regenerated by gen:spec-changes / gen:upgrade-guide, not by hand: the 17 -> 18 record has 64 conversions and 318 semantic entries after merging main at 959c209. 51 handshake sites in 35 files that mean the current protocol now read ^18. Every site left at ^17 is named with its reason in the PR body. Two runtime probes that boot through the load seam moved from ^17.1.0 to >=17.1.0, which keeps the floor and admits 18. First measurements, answered before the edit: (M1) only packages/cli/src/utils/protocol-version-gap.test.ts:68 pins ^17 on purpose. (M2) the bump does not change when any #5082 conversion applies, because no seam filters conversions by PROTOCOL_MAJOR and os migrate meta already ends at 18. No step-18 entry assumes ADR-0131 C8, so there is no fork. H3 is falsified and the route changed. A spec test reading .changeset/ must live in the repo project (check:cross-package-test-inputs exit 1), and release.yml runs protocol-version.test.ts by --project local (measured: a repo-listed file under --project local gives 'No test files found', exit 1). Route R is built: the local test hands the one exception shape to a new repo-project test that judges pre.json mode pre AND a pending spec major, with its own failing case. The gates then demanded .changeset/** as a declared radius and as a ci.yml crosspkg entry, and that turns dispatch-gates' #15753 invariant red (a changeset path alone must reach no value-bearing family). That collision is the decision this report asks for. The root version script replay on a throwaway clone with PR #22084's pre.json and marker overlaid leaves protocol-version.ts untouched; the control leg on ef1fcb2 moves it. The draft stays draft.",
"tests": "Builds, all under os-verify-lock: spec build; turbo build of the closures of dogfood/cli/cloud-connection/examples/create-objectstack/mcp, 65/65 tasks; the 7 dist-only packages, 40/40. spec check:generated: all 15 up to date. spec local full at af47cd6: 623 files / 18619 tests passed. spec local after merging main, src/kernel+src/migrations+src/conversions+2 pins: 72/72 files, 1868 tests. spec repo full at af47cd6: 53/54; the 1 red is the expected pre-mode live case (AssertionError: @objectstack/spec@17.7.0, pre mode: absent, ...: expected 18 to be 17). spec typecheck (tsc + scripts + test layer) exit 0. runtime local: 332/334, with 2 red (ProtocolIncompatibleError ... ^17.1.0 ... protocol 18.0.0); after the fixture fix those 2 plus app-plugin-artifact-forward-conversion are 3/3. runtime repo 3/3. metadata-protocol 221 files / 28253 tests; cloud-connection 41; metadata-core 18; metadata 58; lint 123; create-objectstack 16; cli --project unit 263 files / 3874 tests; cli touched .e2e files with OS_TEST_TIERS=nightly 2/2 (45); dogfood 6 files incl. the 2 install-local handshake files (44); example-crm 5, example-todo 7, example-showcase 33. The cli integration layer is declared to CI. Lockstep with PR #22084 overlaid on this tree: local 3/3, pre-mode 5/5. Replay at 9d7c04e + #22084 overlay, pnpm run version: "PROTOCOL_VERSION already 18.0.0 — in lockstep with @objectstack/spec@18.0.0-next.0". 287 moved paths, release.yml shape filter UNEXPECTED empty, UNVALIDATED empty; local lockstep 3/3, pre-mode 5/5, check:spec-changes 0, check:upgrade-guide 0, check:template-manifests ok, create-objectstack 16/16. Control on ef1fcb2: "PROTOCOL_VERSION 17.0.0 → 18.0.0"; protocol-version.ts is in the moved set. Reach probe: os migrate meta --from 17 --write (CLI built from this branch) rewrote a declared index and left engines.protocol ^17. NOT MEASURED: full runtime local after the fixture fix (only the 3 affected files re-run); full spec local and repo after merging main.",
"mcp_calls": "0",
"api_writes": "3 — POST /repos/objectstack-ai/objectstack/pulls (pr_create #22215, draft); POST /repos//issues/22215/assignees (os-litant, via label-write.mjs); POST /repos//issues/22130/comments (this report, via post-stamped.mjs). Each went through the fleet-write relay as one POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]. Not counted: git push (8 pushes of the branch). Labels: none written; documentation, ci/cd, size/xl, tests and tooling on the PR are the labeler bot.",
"gates": "At 9d7c04e: dispatch-gates --commands --repo objectstack-ai/objectstack derives 162; ran the claim-time 118 union the derivation = 171 commands. dispatch-gates --ran: 162 derived, 162 run, 0 NOT-MEASURED, 0 UNRUN, plus 9 outside the derivation. All exit 0 except pnpm check:pm-dispatch-gates (exit 1): 1 of 1976 self-test cases failed, the #15753 case "a changeset path alone reaches NO value-bearing family any more" — the route-R collision. Gate-driven fixes on the way: check:cross-package-test-inputs (undeclared .changeset read, then the self-test top-level whitelist), check:ci-filter-parity (crosspkg coverage, then the rollback pin 22 -> 23). check:skill-examples and check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET) and were green after building the missing dists. Expected red until PR #22084 merges: packages/spec/src/kernel/protocol-version-pre-mode.test.ts > this tree: PROTOCOL_MAJOR equals the major its release state allows. Edited gate scripts own suites: check-cross-package-test-inputs --self-test 257/257, check-ci-filter-parity --self-test 131/131.",
"line_budget": "7960 changed lines vs merge base 959c209 (+7230 / -730), 49 files; 7632 of them are the two generated documents (spec-changes.json +5896/-666, protocol-upgrade-guide.md +1068/-2). Over the 5000-line human-merge threshold (AGENTS.md §7 class c).",
"deviations": [
"Lockstep exception: H3 (read .changeset/pre.json inside protocol-version.test.ts) refuted by measurement. Built route R: local test hands the shape off, plus a new repo-project test that judges the evidence. Done-when "Outside that condition it is unchanged" holds for the system (test + test:repo), not for the local file alone, which accepts the stable-package one-major-ahead shape after asserting the repo check is listed.",
"Files outside the claim surface, each demanded by a gate for route R: packages/spec/vitest.repo-tests.json, scripts/cross-package-test-inputs.mjs, scripts/check-cross-package-test-inputs.mjs (RECOGNISED_TOP_LEVEL_DIRECTORIES gains .changeset), turbo.json (@objectstack/spec#test:repo input), .github/workflows/ci.yml (crosspkg entry), scripts/check-ci-filter-parity.mjs (rollback pin 22 -> 23). release.yml, cut-rc.yml and sync-protocol-version.mjs are untouched.",
"Route R leaves pnpm check:pm-dispatch-gates red on the #15753 case; it is the subject of the open question, not fixed here.",
"Two runtime fixtures (standalone-stack-security-registrar / standalone-stack-seeder-declaration-copy) moved from ^17.1.0 to >=17.1.0 rather than ^18: their subject is the forward-conversion window, which needs a floor below the installed spec while the range admits protocol 18.",
"Merged origin/main once (os-regen-merge.sh) at 959c209 and regenerated both documents; origin/main has moved since, without registry changes (checked). The release condition already requires another merge after PR #22084.",
"Commit trailers are the model-free pair AGENTS.md prescribes (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By.",
"Status needs_decision rather than done: the PR is complete for route R, but R needs the seat to choose between amending the #15753 invariant and switching to E or S."
],
"files_changed": [
".changeset/22130-protocol-18.md",
".github/workflows/ci.yml",
"content/docs/deployment/cli.mdx",
"content/docs/getting-started/your-first-project.mdx",
"content/docs/upgrading.mdx",
"docs/protocol-upgrade-guide.md",
"examples/app-crm/objectstack.config.ts",
"examples/app-multi-package/src/packages/core/index.ts",
"examples/app-multi-package/src/packages/orders/index.ts",
"examples/app-showcase/objectstack.config.ts",
"examples/app-todo/objectstack.config.ts",
"packages/cli/** (19 test files, ^17 -> ^18)",
"packages/lint/src/authoring-rule-input-tier.test.ts",
"packages/lint/src/validate-form-layout.test.ts",
"packages/mcp/README.md",
"packages/metadata/src/plugin-artifact-packages-attribution.test.ts",
"packages/qa/dogfood/test/{authored-row-write-scope,bulk-widener-probe,owd-public-read-write-write-floor,view-container-default-form}.dogfood.test.ts",
"packages/runtime/src/standalone-stack-security-registrar.test.ts",
"packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts",
"packages/spec/spec-changes.json",
"packages/spec/src/kernel/protocol-version.ts",
"packages/spec/src/kernel/protocol-version.test.ts",
"packages/spec/src/kernel/protocol-version-pre-mode.test.ts",
"packages/spec/vitest.repo-tests.json",
"scripts/check-ci-filter-parity.mjs",
"scripts/check-cross-package-test-inputs.mjs",
"scripts/cross-package-test-inputs.mjs",
"turbo.json"
],
"open_questions": [
{
"question": "Route for the lockstep exception's evidence. The ruling's condition (pre mode AND a pending major) can only be judged by reading .changeset/. In a spec test that read forces the repo project (release.yml runs the file by --project local, so the local file must stay), and the declared radius then makes .changeset/** a ci.yml crosspkg scheduling surface. That contradicts dispatch-gates' #15753 invariant (a changeset path alone reaches no value-bearing family; 'Every user-visible PR in this repo adds a changeset'). Which route?",
"options": [
"R (built on PR #22215): keep the repo-project evidence test and amend the #15753 pin in scripts/pm/dispatch-gates.mjs. Business need: serves the measured window (protocol 18 vs package 17.7.0 until the first next.0 pass), recurring once per major. Long term: the most literal reading, but .changeset/ becomes a derivation and scheduling surface for every card, the defect #15753 removed. AI-error: strict at PR time, in tests. Focus: six declaration files plus a PM-tool invariant change.",
"E: keep the local shape hand-off and move the evidence check into scripts/check-changeset-no-major.mjs, which already reads pre.json and the pending majors (its pre-mode exemption) and runs on every PR in a required context. Business need: same window. Long term: one owner for 'majors x pre mode', no scheduling surface, #15753 untouched. AI-error: strict at PR time, with a refusal that names the remedy. Focus: no new gate, but a new question in an existing gate, which 新增门禁默认否 puts before the maintainer.",
"S: shape only, with no .changeset read. The local lockstep accepts protocol = package + 1 on a stable package version, and the residual is caught at version time (sync-protocol-version.mjs rewrites it, then release.yml refuses with UNVALIDATED). Business need: same window. Long term: smallest, no machinery. AI-error: weaker at PR time, loud only on the six-hourly version-pr lane. Focus: zero additions, but it widens the ruling's stated condition, so it reopens Q1's letter."
],
"recommendation": "E. It enforces the ruling's full condition at PR time in the gate that already owns majors x pre mode. It adds no CI scheduling surface and leaves the #15753 noise-floor invariant intact. R's cost is measured on every card. S drops half of the condition the ruling states. Switching from R is a patch round on the same branch: revert the six declaration edits and the repo test, then extend check-changeset-no-major with its self-test battery."
}
],
"out_of_scope_findings": [
"class: b · Seam: metadata-core:ProtocolIncompatibleDiagnostic.migrateCommand ('The command that resolves the refusal (wired end-to-end by ADR-0087 P2)') → cli:packages/cli/src/commands/migrate/meta.ts (reads and writes no engines.protocol) · reach: public door — os migrate meta objectstack.config.ts --from 17 --write (CLI built from this branch) rewrote objects[0].indexes[0].unique and left engines: { protocol: '^17' }, and its output never mentions the range. The load seam then refuses the same manifest (measured in this PR's runtime run: ProtocolIncompatibleError ... targets protocol ^17.1.0 ... Run: objectstack migrate meta --from 17). Published since 16 -> 17; first reachable on this line with this PR. · dedupe words: migrateCommand engines.protocol; migrate meta range bump; OS_PROTOCOL_INCOMPATIBLE resolves refusal; handshake range not rewritten",
"carrier: #22085 Q2 (v18 release page) · noted, not filed — content/docs getting-started / deployment/cli / upgrading now show engines.protocol '^18' (the ruling's docs snippets) while npm latest stays 17.x until 18 GA, and a 17.x runtime refuses ^18.",
"carrier: 承接者:无 · noted, not filed — in the window between this merge and the first next.0 version pass, main's CLI advisory (checkProtocolVersionGap) judges against the installed spec package 17.7.0 while the runtime handshake judges against PROTOCOL_VERSION 18; a published 18.0.0-next.N has both on 18."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Seat review of the report 6053991953: the work stands; the route for the exception's evidence goes to the maintainer · domain:spec seat 1 (#6017) · os-litant · session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T06:41Z

Checked on GitHub and on the branch, not from the report:

• PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215: draft, head 9d7c04e924, 49 files, +7230 / −730, of which 7632 lines are the two generated documents.
• Done-when 1: packages/spec/src/kernel/protocol-version.ts:22 reads PROTOCOL_VERSION = '18.0.0'.
• The lockstep test (protocol-version.test.ts:31–:51) cites the ruling 6049734955. It recognises only the shape (a stable package, protocol = package major + 1) and hands the judgement to protocol-version-pre-mode.test.ts in the repo project. The hand-off asserts that the file is listed in vitest.repo-tests.json.
• release.yml:679 runs the lockstep file with --project local, so the local file must stay. The dev's H3 (read .changeset/ inside it) is refuted, as reported.
• ci.yml gains a .changeset/** crosspkg entry for that test. With it, pnpm check:pm-dispatch-gates fails exactly the extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753 case at scripts/pm/dispatch-gates.mjs (the self-test "a changeset path alone reaches NO value-bearing family any more"). extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753 (closed) is the fix that stopped a changeset path deriving a gate family onto every card.
• scripts/check-changeset-no-major.mjs already reads .changeset/pre.json (:662, the pre-mode exemption) and runs in pr-automation.yml's Check Changeset job on every PR.

Readings accepted, as the dev measured them:

• M1: only protocol-version-gap.test.ts:68 pins ^17 on purpose.
• M2: no seam filters ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082's conversions by PROTOCOL_MAJOR, and no step-18 entry assumes C8.
• The replay: with PR chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084's pre.json and marker overlaid, the version script leaves protocol-version.ts untouched. The control on ef1fcb26a2 moves it.

Not measured:

• the full runtime local suite after the fixture fix;
• the full spec local and repo suites after the merge of main.

The patch round owes both.

Landing shape, whatever the route: 7960 changed lines exceed the 5000-line human-merge threshold, so this PR takes the final four-piece set: the maintainer merges, or an authorized approval lands it. It also waits on PR #22084, and it owes an at-tier contract review (protocol:breaking).

Out of scope:

• os migrate meta --from 17 --write leaves engines.protocol: '^17', while the load refusal it is named in still refuses. That is filed separately, with the dev's measurement.
• The v18 docs snippets' ^18 against npm latest 17.x: carried by release(v18): the version-pr lane refuses the major boundary at Validate the post-version tree, so #21988 never refreshes into 18.0.0-next.0 — wire the lane's major-only gates in, and stop prerelease cuts re-dating the last GA #22085 Q2, noted.
• The window advisory: no carrier, noted.

Release: session_01LAi5BVvQNiYzepSAcsoFLK · why: every route for the exception's evidence touches the maintainer's floor. R amends a PM-tool invariant (#15753) and makes .changeset/** a CI scheduling surface. E adds a question to an existing gate (new gates default to no). S drops half of the condition the ruling 6049734955 states. · to: needs-user-decision, unassigned. PR #22215 stays draft on its branch, and the patch round is claimed afresh after the ruling.

---

os-decision-facets

待裁(needs-user-decision):协议 18 的「锁步例外」要靠读 .changeset/ 才能判，这份判定放在哪里?

维护者速读

• 改了什么: PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215(草稿)已把协议版本改成 18,两份生成文档按工具重生成，仓内 51 处 ^17 握手改成 ^18。锁步测试按你的裁定只开了一个窄例外。
• 为什么要你定: 你的裁定 6049734955 规定，只有在预发布模式下、并且确有待发的大版本时，例外才成立。要判断这两个条件，必须读 .changeset/ 目录。可读的位置只有三种，每种都碰到只有你能改的东西:
  • R:改 PM 工具的一条不变量;
  • E:给现有门禁加一个新问题;
  • S:放宽你写下的条件。
• 测到的关键事实:
  • 发版流程用 --project local 跑锁步测试，所以测试本身不能直接读仓库根的 .changeset/。
  • 现有的 check-changeset-no-major.mjs 已经在读 pre.json 和待发的大版本，并且在每个 PR 上都运行。
• 席位意见: 推荐 E。
• 你要做的: 回一行「22130 E」(或 R / S)。

一句话问题

在预发布正式开始之前，有一段窗口期：协议号已经是 18,包版本还是 17.7.0。门禁要能分辨两种情况：一种是 18 大版本真的在路上;另一种是有人误把协议号提前。如果分辨不了，误提的协议号可能随 17.x 补丁发出去，所有声明 ^17 的客户应用都会在加载时被拒。

背景

• 本卡承接 release(v18): the version-pr lane refuses the major boundary at Validate the post-version tree, so #21988 never refreshes into 18.0.0-next.0 — wire the lane's major-only gates in, and stop prerelease cuts re-dating the last GA #22085 的 Q1。你在 2026-10-08T00:37Z 回「22082 22085 同意」,Q1 取 B:协议主版本在一个跑全量 CI 的普通 PR 里升级。
• 开发报告 6053991953:实现已完成，只剩这个路线问题。
• 本 PR 还要等 PR chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084(预发布模式加大版本标记)合并，而且超过 5000 行，无论走哪条路线都要你亲手合并或授权批准。

Governing text

• 裁定 6049734955:"gives the lockstep test one narrow exception: in pre mode with a pending major, the protocol major may equal the major about to be published" 以及 "No new gate and no new version-time rewriter: one lockstep condition"。
• release.yml:679:vitest run --project local src/kernel/protocol-version.test.ts。
• extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753(已关)与 scripts/pm/dispatch-gates.mjs 的自测 "a changeset path alone reaches NO value-bearing family any more"。
• pm-dispatch SKILL 〈升级与决策〉:既有门禁只做参数与盲区修复(加强、非新增);新增门禁默认否。

前提(各带复核命令与阳性对照)

1. 发版流程只跑 local 项目。 复核:grep -n "project local src/kernel/protocol-version.test.ts" .github/workflows/release.yml。对照:grep -c "vitest run" .github/workflows/release.yml 应大于 0。
2. R 会触发 extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753 那条自测失败。 复核:在 PR 分支上 git diff origin/main... -- .github/workflows/ci.yml | grep "'.changeset/\*\*'"。对照:grep -n "a changeset path alone reaches NO value-bearing family" scripts/pm/dispatch-gates.mjs 应命中。
3. 现有门禁已在读预发布状态。 复核:grep -n "pre?.mode === 'pre'" scripts/check-changeset-no-major.mjs。对照:grep -n "check-changeset-no-major" .github/workflows/pr-automation.yml 应命中。

选项 × 真实代价

选项	做什么	代价与后果
R(已在 PR 上建好)	判定写成 spec 包 repo 项目里的一个测试;.changeset/** 声明为它的输入，进 CI 调度	几乎每个 PR 都带 changeset,所以每个 PR 都会多跑这一组测试，每张派发卡的门禁清单也多一族。#15753 修掉的噪声会回来，还要改 PM 工具的不变量。最贴近你裁定的字面
E	锁步测试只认形状；证据判定并入 check-changeset-no-major.mjs(它已懂预发布模式和待发大版本),配自测	没有新的 CI 调度面,#15753 不动；「大版本 × 预发布」只有一个主人。代价是给现有门禁加了一个新问题。在同一分支上做一轮补丁：回退 6 处声明，删掉 repo 测试
S	只认形状，不读 .changeset/	改动最小。但 PR 阶段只拦一半，误提的协议号要到六小时一次的版本流程才被 release.yml 拦下(UNVALIDATED)。等于放宽你写下的条件

业务含义直译

• R 等于「为了一年一次的升版检查，在每个 PR 的流水线上加一道工序」。
• E 等于「把这项检查交给本来就在管大版本的那个岗位」。
• S 等于「只看外表，查证留到出货前」。

四棱(四轴从业务立场)

• ① 项目长远合理性: E 让「大版本 × 预发布」只有一个判定主人，不新增调度面。R 把 .changeset/ 变成所有卡的派发面，等于倒退 extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753。S 让两年后的平台在 PR 阶段少一道真实的条件。
• ② 实际业务拉动: 三个选项服务同一个窗口：从本 PR 合并到第一个 18.0.0-next.0 之间。每个大版本出现一次。
• ③ 防 AI 犯错: E 和 R 都在 PR 阶段拒收，而且拒收时会说明怎么修。S 在 PR 阶段放行一半，只在版本流程上报错，不会静默泄露，但发现得晚。
• ④ 创业阶段不扩散: S 零新增;E 给现有门禁加一个问题，不加新门禁、不加新调度面;R 加 6 处声明，还要改一条 PM 工具不变量。

Prior rulings read: PROTOCOL_VERSION lockstep, pre mode, pending major, .changeset scheduling surface → 10 hits (#22130, #22080, #20784, #19611, #8658 and others; none rules where the evidence lives); 6049734955 (Q1 B); #15753 (closed); thread: 1 comment (the dev report).

推荐:22130 E。 自检：只看①选 E。②③④ 是否翻转：否(④偏向 S,但 S 放宽了你的裁定条件，不作推荐)。
置信缺口: E 还没有建出来，它的自测与真实预发布状态下的表现要到补丁轮才能实测;check-changeset-no-major 是否在所有必查上下文里，按 pr-automation.yml 读，没有查分支保护设置。

裁后执行

• 本席重新认领本卡，在同一分支 claude/issue-22130-protocol-18 上开补丁轮:
  • 选 E:回退 6 处声明，删掉 repo 测试，把证据判定加进 check-changeset-no-major.mjs,附自测正反例；
  • 选 R:仅另开 PM 工具 PR 修订 extractWatchHints reads a noise-floor EXCLUSION constant as a watch hint: .changeset derives check:pm-half-states onto every changeset-adding card #15753 的不变量，留给你合并;
  • 选 S:删掉 repo 测试，只保留形状。
• 补丁轮补齐两项未测的全量测试，然后做达档合约复审。
• PR chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 合并后再合并一次 main,按超过 5000 行的流程交你合并或授权批准。