test(spec): pin the view item owner/hidden retirement at every record door

Adds the tombstone, conversion, registration and tree-scoped structural
absence pins, and extends the D2 conversion to the assembled-manifest
viewItems channel so an artifact assembled before the retirement still
registers.

Claude-Session: https://claude.ai/code/session_01Rjy9MeetSfq34PKn81CRiN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/conversions/registry.ts

@@ -42,6 +42,7 @@ import {
   normalizeFilterOperator,
   type ViewFilterOperator,
 } from '../ui/view.zod.js';
+import { ASSEMBLED_VIEW_ITEMS_KEY } from '../ui/assembled-views.zod.js';
 
 /**
  * Flow callout node type rename (protocol 11.0).
@@ -10318,6 +10319,17 @@ const objectTenancyOrganizationFieldRemoved: MetadataConversion = {
  * forever over two keys that never had an effect. It also lets
  * `os migrate meta --from 17` list the mechanical edits for existing sources.
  *
+ * **Two collections, because a ViewItem record travels in two.** `views` is the
+ * stack collection and the stored-row seam's `{ views: [row] }` wrapping.
+ * `viewItems` ({@link ASSEMBLED_VIEW_ITEMS_KEY}) is the assembled-manifest
+ * channel — package export and environment artifacts carry tenant-authored
+ * standalone ViewItems there, `applyArtifactForwardConversions` replays the
+ * chain over it, and the registration loop then parses each entry against
+ * `AssembledViewArtifactSchema`, whose ViewItem member carries these tombstones.
+ * Walking `views` alone would leave an artifact assembled before this release
+ * refused at registration (`INVALID_METADATA`, 422) over two keys that never
+ * had an effect.
+ *
  * ⚠️ Scoped to the ViewItem RECORD spelling — `viewKind` names the family and
  * `config` holds the payload, the discriminator {@link mapViewPayloads} uses for
  * its case 1 — and deliberately NOT walked through `mapViewPayloads`, whose
@@ -10339,14 +10351,30 @@ const viewItemOwnerHiddenRemoved: MetadataConversion = {
     + 'and stored verbatim, read by nothing: no view switcher ever filtered on `hidden`, and no '
     + 'per-user scope ever read `owner`, so a view marked as one user\'s was listed for everyone)',
   apply(stack, emit) {
-    return mapCollection(stack, 'views', (view, path) => {
+    const stripFromRecord = (view: Dict, path: string): Dict => {
       const kind = view.viewKind;
       if ((kind !== 'list' && kind !== 'form') || !isDict(view.config)) return view;
       return stripKeys(view, ['owner', 'hidden'], emit, path);
-    });
+    };
+    return mapCollection(
+      mapCollection(stack, 'views', stripFromRecord),
+      ASSEMBLED_VIEW_ITEMS_KEY,
+      stripFromRecord,
+    );
   },
   fixture: {
     before: {
+      // The assembled-manifest channel: a standalone record a package export
+      // carried before this release.
+      viewItems: [
+        {
+          name: 'crm_lead.escalations',
+          object: 'crm_lead',
+          viewKind: 'list',
+          hidden: false,
+          config: { type: 'grid', columns: ['name'] },
+        },
+      ],
       views: [
         // A record carrying both keys: both go, and the live identity keys
         // beside them (`scope`, `label`) are untouched.
@@ -10368,6 +10396,14 @@ const viewItemOwnerHiddenRemoved: MetadataConversion = {
       ],
     },
     after: {
+      viewItems: [
+        {
+          name: 'crm_lead.escalations',
+          object: 'crm_lead',
+          viewKind: 'list',
+          config: { type: 'grid', columns: ['name'] },
+        },
+      ],
       views: [
         {
           name: 'crm_lead.my_hot_leads',
@@ -10381,8 +10417,9 @@ const viewItemOwnerHiddenRemoved: MetadataConversion = {
         { name: 'crm_lead.pipeline', object: 'crm_lead', viewKind: 'list', hidden: true },
       ],
     },
-    // `stripKeys` emits one notice per KEY removed: two keys on one record.
-    expectedNotices: 2,
+    // `stripKeys` emits one notice per KEY removed: two on the `views` record,
+    // one on the `viewItems` record.
+    expectedNotices: 3,
   },
 };
 

packages/spec/src/migrations/registry.ts

@@ -5303,8 +5303,11 @@ const step18: MigrationStep = {
     + 'tombstones on the SHARED shape, because that shape also feeds the `.strip()` wire '
     + 'member, where a bare deletion would be a silent strip. The D2 conversion '
     + '`view-item-owner-hidden-removed` strips them from the view item RECORD spelling only, '
-    + 'as a lossless delete; a flattened overlay keeps its own `owner` / `hidden`, which are '
-    + 'declared on a different door this retirement does not touch.',
+    + 'as a lossless delete, in both collections a record travels in — `views` (stack sources '
+    + 'and stored rows) and the assembled-manifest `viewItems` channel (package export, '
+    + 'environment artifacts), whose registration parse would otherwise refuse an artifact '
+    + 'assembled before this release; a flattened overlay keeps its own `owner` / `hidden`, '
+    + 'which are declared on a different door this retirement does not touch.',
   conversionIds: [
     'field-malformed-scale-precision-removed',
     'record-chatter-position-vocabulary',
@@ -18258,6 +18261,56 @@ export const RETIRED_KEYS_BY_MAJOR: Readonly<Record<number, readonly string[]>>
     // carrying both — and the D2 conversion `chart-config-aria-removed` strips all
     // of them together with the dashboard site.
     'ui/ReportChart:aria',
+    // #20085 (ADR-0049 enforce-or-remove; triage direction 「retire both keys」).
+    // `ViewItem.hidden` promised to hide a view item from the switcher, and nothing
+    // ever read it: no writer and no reader of the view-item key in the framework,
+    // in objectui at its pin and at `main`, or in cloud, and both switcher read
+    // paths filter on `viewKind` + `object` only — `hidden: true` hid nothing.
+    // Tombstoned with `retiredKey()` on the shared `viewItemBaseShape()`, because
+    // that shape also feeds the `.strip()` wire member (`ui/ViewItemWire`,
+    // registered beside this row), where a bare deletion would strip in silence.
+    // The flattened-overlay members declare their own `hidden` on a different door,
+    // untouched. ⚠️ No gate below can JUDGE this row: `ui/ViewItem` is a
+    // discriminated union, whose emitted JSON Schema has no top-level
+    // `properties`, so `authorable-surface/` carries no `ui/ViewItem:*` line and
+    // check (b) never sees the tombstone — the row is declared, not checked.
+    // D2: `view-item-owner-hidden-removed`.
+    'ui/ViewItem:hidden',
+    // #20085 (ADR-0049 enforce-or-remove; triage direction 「retire both keys」).
+    // `ViewItem.owner` named the user a `personal` view item belonged to, and
+    // nothing ever read it: no writer and no reader of the view-item key in the
+    // framework, in objectui at its pin and at `main`, or in cloud, and both
+    // switcher read paths filter on `viewKind` + `object` only — so a view marked
+    // as one user's was listed for everyone who can read the object. Per-user view
+    // scoping is a parked direction (ADR-0017, amended 2026-09-04). Tombstoned with
+    // `retiredKey()` on the shared `viewItemBaseShape()`, because that shape also
+    // feeds the `.strip()` wire member (`ui/ViewItemWire`, registered beside this
+    // row), where a bare deletion would strip in silence. ⚠️ No gate below can
+    // JUDGE this row: `ui/ViewItem` is a discriminated union, whose emitted JSON
+    // Schema has no top-level `properties`, so `authorable-surface/` carries no
+    // `ui/ViewItem:*` line and check (b) never sees the tombstone — the row is
+    // declared, not checked. D2: `view-item-owner-hidden-removed`.
+    'ui/ViewItem:owner',
+    // #20085 — the wire carrier of `ui/ViewItem:hidden` (see that row for the
+    // measurement). `ViewItemWireSchema` is member 1 of the `view` union
+    // `saveMetaItem` validates; it is built from the same `viewItemBaseShape()`, so
+    // the one tombstone refuses the key there too instead of letting `.strip()`
+    // drop it in silence — registered under both def keys, the
+    // `integration/DeclarativeConnectorEntry:connectionTimeoutMs` precedent. Same
+    // blind spot as its sibling: a discriminated-union def emits no top-level
+    // `properties`, so no gate judges this row.
+    // D2: `view-item-owner-hidden-removed`.
+    'ui/ViewItemWire:hidden',
+    // #20085 — the wire carrier of `ui/ViewItem:owner` (see that row for the
+    // measurement). `ViewItemWireSchema` is member 1 of the `view` union
+    // `saveMetaItem` validates; it is built from the same `viewItemBaseShape()`, so
+    // the one tombstone refuses the key there too instead of letting `.strip()`
+    // drop it in silence — registered under both def keys, the
+    // `integration/DeclarativeConnectorEntry:connectionTimeoutMs` precedent. Same
+    // blind spot as its sibling: a discriminated-union def emits no top-level
+    // `properties`, so no gate judges this row.
+    // D2: `view-item-owner-hidden-removed`.
+    'ui/ViewItemWire:owner',
     // </os-generated retired-key:18>
   ],
 };