docs(metadata): correct the retiredKey tombstone's minor version in the published 17.3.0 CHANGELOG entry (#16277) (#17426)

packages/metadata/CHANGELOG.md's 17.3.0 section (54e2d36 / #12772) described a
measured pre-fix incident as "spec 17.2.0's `retiredKey` tombstone refused the
boot". packages/spec/CHANGELOG.md files the allowRestore/allowPurge retirement
(8af88dd, #12497, ADR-0049) under its own 17.3.0 section, and its 17.2.0
section mentions neither key nor #12497 (grep count 0). Triage located the
entry by section structure (17.3.0: line 3 vs 3343; 17.2.0: 7798-8854) to show
the two changelogs' evidence pointed at the same reading, but drew the line at
"CHANGELOG absence is not release absence" and left the tag-level check open.
The PM dispatch closed it: @objectstack/cli@17.2.0's
packages/spec/src/security/permission.zod.ts:157-158 declares allowRestore/
allowPurge as live ordinary boolean fields (not retiredKey), and zero tombstone
files under packages/spec/src/migrations/entries/retired-keys/ match either
name at that tag; the tombstone
(18.security__ObjectPermission__allowRestore.ts) first appears at
@objectstack/cli@17.3.0. The tombstone shipped with 17.3.0, not 17.2.0 — the
metadata entry's minor is a slip.

Repair follows the principle both the filer and triage converged on: cite the
MAJOR version in prose, not the minor, unless the minor distinction itself
carries information (it doesn't here — the incident is about the tombstone
existing at all, not about which 17.x introduced it). The platform's own
parse-time removal message already does this ("was removed in @objectstack/spec
17 (ADR-0049)"), which is the one sentence both changelogs already agree on.
"spec 17.2.0's `retiredKey` tombstone" becomes "spec 17's `retiredKey`
tombstone" — the sentence no longer depends on a minor version that can be
wrong.

Precedent for correcting published CHANGELOG text in place (as opposed to only
an erratum in a future release) is established practice in this repo:
eabdd66 ("correct three false sentences in the published 17.3.0 release
text"), c3b6da4 ("correct the offer-set claim in the icon-withdrawal
CHANGELOG entry"), 222be39 ("correct the withdrawn `os migrate meta` claim
in the published 17.0.0 app-area retirement entry"), and eb91eba. All are
docs-only, text-only, no changeset, no code, no test — the shape this PR
follows.

Text-only correction: one word changed on one line, no packages/*/src/**
touched, no accept/reject behaviour moves, no public surface widens.


Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

Co-authored-by: Claude <noreply@anthropic.com>

Author: baozhoutao

packages/metadata/CHANGELOG.md

@@ -911,7 +911,7 @@
   #14512's decision, not this door's.
 - 54e2d36: Artifacts built by released 17.x tooling boot again on ≥17.2 runtimes: the artifact-ingestion door now runs a versioned ADR-0087 forward conversion before the strict parse (#12772).
 
-  A compiled artifact whose declared `engines.protocol` floor predates the running `@objectstack/spec` version replays the full conversion chain — retired entries included — before validation, exactly the policy the stored-row read path already applies to `sys_metadata` rows. Measured incident: `dist/objectstack.json` built by `@objectstack/cli` 17.1.0 carries the then-legal `allowRestore`/`allowPurge` permission bits (75 of each, injected by the released builder), and spec 17.2.0's `retiredKey` tombstone refused the boot with no operator remedy (`os migrate meta` targets sources, not built artifacts).
+  A compiled artifact whose declared `engines.protocol` floor predates the running `@objectstack/spec` version replays the full conversion chain — retired entries included — before validation, exactly the policy the stored-row read path already applies to `sys_metadata` rows. Measured incident: `dist/objectstack.json` built by `@objectstack/cli` 17.1.0 carries the then-legal `allowRestore`/`allowPurge` permission bits (75 of each, injected by the released builder), and spec 17's `retiredKey` tombstone refused the boot with no operator remedy (`os migrate meta` targets sources, not built artifacts).
 
   The conversion is versioned, not a blanket amnesty: an artifact authored at the current (or a newer) spec version converts nothing and still refuses at the tombstone — the retired keys return with the M2 lifecycle initiative (#1883), and artifacts authored against that surface are never stripped by history. Conversion notices surface operator-visibly and deduped, one summary line per conversion per artifact. New exports from `@objectstack/metadata-core`: `applyArtifactForwardConversions`, `resolveInstalledSpecVersion`, `parseRangeFloor`, `resolveDeclaredRange`.
 - 7ef0268: fix(metadata,runtime): retire the `policies` dead pointer in both artifact registrars, and pin the map that carried it (#12894)