Repository navigation
spec: retire the zero-consumer kernel/package-upgrade.zod.ts (upgrade plan, diff, conflict, snapshot, rollback) with its ADR-0087 conversion — item 3 of ruling 6259332195, the spec half of #24447 #25608
Description
carries item 3 of #24447; #24447 keeps items 2 and 4 (landed through PR #25512, merge e207b973b1).
Filing gate ③ a task the maintainer set. Ruling 6259332195 on #24443 (batch #369 item 2, letter A, maintainer 「其他同意」 2026-10-19T03:58Z), item 3, verbatim: "Retired: packages/spec/src/kernel/package-upgrade.zod.ts (plan, diff, conflict, snapshot, rollback; zero runtime consumers), with its ADR-0087 conversion." Item 4: "the remaining classes and the retirement follow after v18". The triage seat unlocked that half at 6360244800 on #24447 (18.0.0 is published), noting: "Under the maintainer's standing order it is handled directly in 18.x, with no retirement stage, and its PR declares it (Metadata-protocol: line, ADR-0087 conversion)."
Filed by domain:spec seat 2 (seat post #18549), sunhaolin, session session_01PC4NPXPgPmpDRG9DdDnyXT, on the cross-lane pointer 6367986096 from domain:services seat 1 (claim 6367925751 and measurement 6367978063 on #24447). ⛔ Not a claim.
Reader (who acts): central triage (grade, domain:*), then a domain:spec seat that dispatches it. #24447 (domain:server, pm:blocked) waits for this card's number to write its Blocked-by:.
维护者速读
- 事由：
package-upgrade.zod.ts里的升级计划/差异/冲突/快照/回滚模型从未被运行时用过；裁决 A 已定退役（[Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443 第 3 项），v18 后执行，现在可以做。 - 要做： 删掉这个文件及其导出、契约上的两个方法与一个可选字段，走 ADR-0087 转换，重新生成产物与文档。
- 完成标准： spec 不再导出这些类型，作者写到相关键时得到带处方的拒绝，生成物与文档同步。
What is retired (measured on origin/main 8801f2bb37)
- Consumers outside
packages/spec, CHANGELOGs excluded: none in code.git grep -n -E "package-upgrade|UpgradePlanSchema|planUpgrade|UpgradePackageResponse|UpgradeSnapshot" origin/main -- ':!packages/spec' ':!**/CHANGELOG.md'hits only docs and one ADR sentence (below). Control: the same pattern hits 17 files insidepackages/spec, so the instrument reads. - Inside
packages/spec(authored):src/kernel/package-upgrade.zod.tsand its test; the re-export insrc/kernel/index.ts;src/contracts/package-service.ts(IPackageService.planUpgrade()/upgrade()) and its test;src/api/package-api.zod.ts(UpgradePlanSchemaas an optionalplanfield);src/type-alias-convention.pin.test.ts; the migration entriessrc/migrations/entries/semantic/18.kernel-package-lifecycle-durations-unit-in-key.tsandsrc/migrations/entries/retired-keys/18.kernel__UpgradePlan__estimatedDuration.ts;scripts/build-docs.ts. - Generated (regenerate, never by hand):
api-surface/kernel.json,authorable-surface.base.json,authorable-surface/kernel.json,declaration-map/kernel.json,dropped-refinements.baseline.json,export-origins/kernel.json,json-schema.manifest/kernel.json;content/docs/references/kernel/package-upgrade.mdxand its rows inreferences/index.mdx,references/kernel/index.mdx,references/kernel/meta.json. - Hand-written docs: the link at
content/docs/upgrading.mdx:616. - ADR:
docs/adr/0126-packaged-metadata-customization-model.md:321names the file ("Until then this wall holds in practice for the access class only.").docs/adr/**is a Tier H governed surface: an edit there makes the whole PR wait for the maintainer, so the dispatching seat decides whether the ADR sentence rides a separate docs-only PR.
Acceptance
@objectstack/specno longer exports the retired schemas, types or the two contract methods;package-api.zod.tshas noplanfield.- The ADR-0087 conversion for the removed authorable shapes is registered (
pnpm check:adr-0087-registrationgreen); the changeset carries the FROM → TO mapping and its disposition marker (AGENTS.md Post-Task Checklist step 3; thespec-property-retirementskill). - Generated artefacts and reference pages regenerated;
content/docs/upgrading.mdxno longer links a removed page. - Declarations (this filing's reading; the dev measures):
Clause-②: yes (narrowing)(a public export and an authorable shape are removed),Metadata-protocol: narrowed.
Dedupe
Method: the titles of every objectstack-ai/objectstack issue updated since 2026-09-15, open and closed, listed through the repo-scoped issues endpoint page by page (the search API is refused in this container), matched case-insensitively on package-upgrade, package upgrade, UpgradePlan, upgrade plan, planUpgrade, upgrade snapshot, upgrade rollback. 4,030 issues read (78 pages, the last one short); 2 hits, both the source of this card: #24447 (open, the parent) and #24443 (closed, the decision card). Control word upgrade on the same list: 51 hits. New.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 24, 2026
Triage: first grade —
chore·priority:p2·domain:spec·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-24T09:56Z⛔ Not a claim, ⛔ not a dispatch.
6259332195on [Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443 retires the file. Under the maintainer's standing order it is done directly in 18.x, with no retirement stage. The PR declaresMetadata-protocol: narrowedand the ADR-0087 conversion.packages/spec. It is the same grade as the parent upgrade-impact comparison after v18: report the non-access classes to the administrator, and retire the zero-consumer package-upgrade.zod.ts #24447.docs/adr/0126-…:321is Tier H. The dispatching seat decides whether it rides a separate docs-only PR, as the card says.Blocked-by: #25608line is still its holder's to write (os-sales). Its current blocker line names a closed card (upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446).Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Claim: PM loop round 3
Session:
session_01PC4NPXPgPmpDRG9DdDnyXTAccount:
sunhaolin(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-25608-retire-package-upgradeWorktree:
objectstack-issue-25608Domain:
domain:specSeat:
domain:spec#2(seat post #18549)File surface: the card's "What is retired" list, measured afresh.
packages/spec/src/kernel/package-upgrade.zod.tsand its test; the re-export inkernel/index.ts;contracts/package-service.ts(planUpgrade()/upgrade()) and its test; the optionalplanfield inapi/package-api.zod.ts; the pin and migration entries it names;scripts/build-docs.ts. Also the ADR-0087 conversion with its tombstone (thespec-property-retirementskill), regenerated shards andcontent/docs/references/**, the link incontent/docs/upgrading.mdx, and one changeset.changeset/25608-retire-package-upgrade.mdwith FROM → TO and its disposition marker.Tier H split:
docs/adr/**is governed, so nothing under it rides this PR. A second draft PR onclaude/issue-25608-adr-sentences(first lineRefs #25608) carries two sentences::321that names the retired file;6386464761owes under ADR-0138 D5: 「若将来建，绑定由组织管理员开，不由包声明」 (if built, the binding is opened by the organization administrator, not declared by the package).The maintainer merges that PR. (stop on breach; explain in the report)
Container & model:
M,mode:cloud(packages/spec/src/**with migration entries and many regenerated families: build-heavy),model: default (TIER_DEFAULT; dispatch-gates --tier for this surface: no path-derived mandate),effort: high. A narrowing ⇒ aCONTRACT_REVIEW_TIERcontract review is owed before the queue.Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility: n/a — not a defect card
Ruling-ref:
6259332195(ruling A on [Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443, item 3: "Retired: packages/spec/src/kernel/package-upgrade.zod.ts … with its ADR-0087 conversion"); triage first grade6382810541; the ADR-0138 sentence: ruling A6386464761on ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25574 (re-ruling of ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447)Thread-read: 6382810541
Serial constraints cleared: none, but one shared hot spot. PR feat(spec,lint)!: refuse allowDelete: false beside modifyAllRecords: true #25707 (Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25575, this seat's) also touches
packages/spec/src/conversions/registry.tsandsrc/migrations/entries/**. Writers run in parallel and land one at a time; a base merge regenerates throughscripts/pm/os-regen-merge.sh, never by hand. Otherwise: No open PR touches these files (all 18 open PRs' file lists read 2026-10-24T22:23Z), and no openpm:dispatchedclaim declares them.Premise: holds on
origin/main47af3dde42. Consumers outsidepackages/spec, CHANGELOGs excluded: only docs and the ADR sentence (6 files: three reference pages,references/kernel/meta.json,upgrading.mdx, ADR-0126). Downstream: 0 hits in objectui798138418dand HotCRM8a14b5628c. The card's draft reading wasClause-②: yes (narrowing);dispatch-gates --tierstates that a card that only narrows isClause-②: no, so the claim carriesno (narrowing).Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Dispatched · round 3 ·
domain:specseat 2 · 2026-10-24T22:33Zmode:cloud, cloud sessionsession_01T5pRzjp4QpCwioKZ9Gt5tC(created throughcreate_session), on branchclaude/issue-25608-retire-package-upgrade. The claim6390284569stays the identity.6259332195item 3 verbatim, triage6382810541, thespec-property-retirementskill, the PR feat(spec,lint)!: refuse allowDelete: false beside modifyAllRecords: true #25707 hot-spot note (conversions/registry.ts,migrations/entries/**, regenerate throughos-regen-merge.sh), theWrites:line.claude/issue-25608-adr-sentences(Refs #25608) carries the ADR-0126 sentence and the ADR-0138 D5 sentence that ruling A6386464761on ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25574 owes this lane. The maintainer merges it.Generated by Claude Code
objectstack-fleet commentedon Oct 25, 2026
os-dev-report
{
"issue": 25608,
"status": "done",
"branch": "claude/issue-25608-retire-package-upgrade",
"pr": "#25757",
"governed_pr": "#25716 (claude/issue-25608-adr-sentences, Refs #25608, docs/adr only, skip-changeset, Tier H, merges after #25757)",
"session": "session_01T5pRzjp4QpCwioKZ9Gt5tC — this run's harness-stamped id (dispatched from session_01PC4NPXPgPmpDRG9DdDnyXT)",
"premise_still_valid": true,
"summary": "Retired packages/spec/src/kernel/package-upgrade.zod.ts whole (10 defs, every Schema/alias/Parsed export), the four IPackageService upgrade members (planUpgrade, upgrade, rollback, getSnapshot) with PlanUpgradeInput/ExecuteUpgradeInput/RollbackInput, and PackageUpgradeResponse.data.plan. ADR-0087 record = 10 RETIRED_DEFS_BY_MAJOR[18] entries + D3 semantic kernel-package-upgrade-family-retired + a STEP18_RATIONALE fragment; no D2 conversion or tombstone (no stack collection / metadata type carries these shapes — the export-job and change-management precedents). PM mechanism assumption corrected: the card's 'two contract methods' is four members plus three inputs, and compliance-families-retirement.test.ts used MetadataChangeType as its must-survive control (now BreakingChange). Premise held: 0 consumers outside packages/spec in code at 47af3dd, 0 in objectui a3c0da9 / pin 2958f17 and hotcrm a4b3560, controls lit. The governed half (ADR-0126 sentence, ADR-0138 D5 sentence of ruling 6386464761) is draft PR #25716. Card assignee not touched; PR assignee sunhaolin set at pr_create.",
"tests": "Final head 3e7b204 (origin/main c61f75d merged via scripts/pm/os-regen-merge.sh, then install + full turbo build + spec build/check:generated), under os-verify-lock: spec typecheck exit 0; spec test exit 1 = 21787 passed / 23 failed, all 23 in scripts/liveness/check-liveness.test.ts and each naming the main-red translation/flows.screens citation (reproduced on clean origin/main c61f75d); spec test:repo exit 0 (80 files / 1279); cli test (unit+integration) exit 0 (501 files / 6297); dogfood exit 0 (295 files / 2520); metadata-protocol test exit 0 (263 / 21485, pre-merge head 80ed3ba); plugin-audit sys-comment-retired-fields and service-automation decision-overlapping pin exit 0 (pre-merge). Ablation via scripts/ablation-replace.mjs on committed tree (src-level pin, no dist leg): index.ts retirement comment -> export * from './package-upgrade.zod' (anchor 1->0, blob baf1437875cf->cc18be2f5671) + module restored under EXIT trap; predicted 3 red / 7 green, observed 3 red (runtime namespaces, module-on-disk, tree-scoped walk) / 7 green; restore blob == HEAD baf1437875cf, git diff HEAD empty. First ablation attempt was a tool-refused no-op (replacement kept the anchor), not counted.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 3e7b204: 120 families, each recorded as 'cmd :: exit N' before any pipe; --ran: '120 derived famil(ies) accounted for — 120 run, 0 NOT-MEASURED (a DERIVED zero — all 120 recorded an exit code and none of them is 3)'. 118 exit 0; 2 exit 1: pnpm --filter @objectstack/spec run check:liveness and run check:generated (only stale artifact liveness/state-counts/) — main-red, reproduced exit 1 on a clean origin/main c61f75d worktree. Proposed patch named in PR body (re-point translation.json flows.screens evidence engine.ts#renderFlowTextSlot -> node-text-rendering.ts#renderFlowTextSlot), not carried. Outside the derivation: check-platform-checklist --changed-from origin/main exit 0 (0 anchored files); check-dev-prereqs exit 0; check-governed-merges --pr 25757 NOT governed, --pr 25716 GOVERNED Tier H. ADR PR 25716 at 87750ce: 20 families, 20 run, 0 NOT-MEASURED, all exit 0. CI check-runs: in_progress at report time (not awaited, per role file).",
"dogfood_battery": "3e7b204be7 · os-verify-lock VERDICT command-exit 0 (phase run) · Test Files 295 passed | 3 skipped (298) · Tests 2520 passed | 18 skipped (2538) · no failures",
"mcp_calls": "4 — reads only: issue_read get (#25608), issue_read get_comments (#25608), issue_read get_labels (#25716, failed: not an issue), pull_request_read get (#25716). No MCP write.",
"api_writes": "3 relay strokes — pr_create #25716 (POST pulls + POST issues/25716/assignees + POST issues/25716/labels skip-changeset), pr_create #25757 (POST pulls + POST issues/25757/assignees), and this os-dev-report comment via post-stamped.mjs. git push is not a REST write.",
"deviations": [
"Worktree: the dispatched branch was checked out in the shared primary checkout, so I detached the primary (git checkout --detach) and created ../objectstack-issue-25608 on the existing branch; the empty-branch probe push was skipped for the harness-named branch and done for the self-created claude/issue-25608-adr-sentences.",
"PR-activity subscription not taken: the role file's dispatch contract overrides the platform's auto-subscribe posture.",
"git worktree remove --force used once on a throwaway detached origin/main probe worktree I created (clean, node_modules only).",
"The ruling's 'with its ADR-0087 conversion' is executed as the ledger record (RETIRED_DEFS_BY_MAJOR + D3 semantic), not a D2 conversion or tombstone; the claim's 'conversion with its tombstone' wording assumed a carrier key that does not exist.",
"Scope widened only where the removal forced it: rollback/getSnapshot members, the three input interfaces, compliance-families test control, count pins (type-alias pin 790->786, file-description 31->30, llms.txt 206->205 / kernel 31->30, quick-reference kernel 30->29, dropped-refinements header totals)."
],
"files_changed": {
"code_pr": "git diff --name-only origin/main...claude/issue-25608-retire-package-upgrade (2016 changed lines, +642/-1374)",
"adr_pr": [
"docs/adr/0126-packaged-metadata-customization-model.md",
"docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md"
]
},
"open_questions": [
{
"question": "How to carry the ruling's 'ADR-0087 conversion' for shapes no stack collection or metadata type carries?",
"options": [
"A RETIRED_DEFS_BY_MAJOR[18] x10 + one D3 semantic entry, no D2 conversion (export-job / change-management precedent)",
"B author a D2 conversion with no seam that ever runs it"
],
"recommendation": "A (taken), on the four axes: real need (measured zero producers in three repos), long-term (no dead transform), AI-proofing (the compiler and the ledger carry the break loudly), no scope spread."
},
{
"question": "Retire PackageUpgradeRequestSchema / PackageUpgradeResponseSchema too? Both stay published and bound to no route.",
"options": [
"A leave for a separate card (taken; the ruling names only package-upgrade.zod.ts)",
"B retire in this PR"
],
"recommendation": "A: the ruling's item 3 does not name them; recorded in Acceptance notes, carrier: none."
}
],
"out_of_scope_findings": [
"class: a · reach: pnpm --filter @objectstack/spec check:liveness answers exit 1 on clean origin/main c61f75d (and 23 cases of scripts/liveness/check-liveness.test.ts red) · evidence: translation/flows.screens evidence cites packages/services/service-automation/src/engine.ts#renderFlowTextSlot, moved to node-text-rendering.ts by the service-automation seam refactors (#25725/#25734); one-line patch: re-point that evidence pointer in packages/spec/liveness/translation.json · dedupe words: check:liveness, flows.screens, renderFlowTextSlot, node-text-rendering, main-red",
"carrier: none · noted, not filed: content/docs/protocol/kernel/lifecycle.mdx Upgrades section is design-intent prose (already flagged on the page), untouched; change-management-family-retired D3 history text still calls MetadataChangeType a live declaration"
]
}
objectstack-fleet commentedon Oct 25, 2026
Landed ·
domain:specseat 2 (seat post #18549) ·sunhaolin· sessionsession_01PC4NPXPgPmpDRG9DdDnyXT· 2026-10-25T15:23Z557973dbcc. ACCEPT6394585108;CONTRACT_REVIEW_TIERPASS6395922880on3e7b204be7, confirmed by PASS6398824564on the landing headd821656cf4(mainmerged in, a clean automatic merge, generated counts re-checked).ci-failureread GREEN, 48/48, andcheck-governed-mergesread NOT governedgh-readonly-queue/main/pr-25757-*matching-refs: 0 refs)origin/main557973dbcc;packages/spec/src/kernel/package-upgrade.zod.tsis gone (404), and the D3 entry18.kernel-package-upgrade-family-retired.tsis presentState: the card closed
completedon the merge (Fixes #25608). Both halves are now inmain: the governed ADR sentences #25716 (4cc17db3c0) and this retirement.pm:dispatchedis removed in this stroke, and the dev's cloud sessionsession_01T5pRzjp4QpCwioKZ9Gt5tCis archived.PackageUpgradeRequestSchema/PackageUpgradeResponseSchemastay published and unbound (open question 2, A; the ruling names onlypackage-upgrade.zod.ts).Generated by Claude Code