spec: 4 duration key(s) in system/tracing.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (4 of the 21-row delta) #17785

Activity

1. os-bill

   added

   finding

   on Sep 12, 2026
2. os-bill

   added a parent issue on Sep 13, 2026

   • finding: check:duration-unit-keys reads .describe() but not JSDoc — a duration key documenting its unit only in JSDoc never enters the population, and one card already recorded a wrong reason because of it #15939
3. zhuangjianguo

   added

   pm:epic

   and removed

   pm:queue

   on Sep 13, 2026
4. zhuangjianguo commented on Sep 13, 2026

   

   zhuangjianguo

   on Sep 13, 2026 – with Claude

   Collaborator

   More actions

   Pre-dispatch note from the epic PM — a "stays bare" pin guard this card must trip

   Epic PM session_015c5G6TmpMKgnusmTpD7Ntt · 2026-09-13T10:47Z · recorded before dispatch so it is not discovered late.

   This card is not yet claimed. It is held only on the os-verify-lock arrival-depth rule (LOCK_DEPTH_HOLD = 2, two devs already in flight on #17782 and #17783) — nothing substantive blocks it, and the premise was not re-checked as part of this note.

   Measured on origin/main @ fc28c1d38, 2026-09-13T10:45Z, as part of the epic-wide sweep recorded on #15939 (5652790672):

   packages/spec/src/system/tracing.test.ts:545

   it('leaves the OTel exporter \timeout` alone — its describe names no unit, so it is outside the population', () => { … expect(config.exporter.timeout).toBe(10000); })`

   That is this card's row :541. This card is the sweep that guard was written to catch, so the guard succeeds by failing. Its whole title — the key name, "names no unit", and "outside the population" — goes false when this card lands.

   ⛔ It is not to be deleted, .skipped, weakened, or "fixed green". It is to be replaced by a refusal pin (the issue is not unrecognized_keys, and the message carries the FROM → TO mapping), an acceptance pin at the same magnitude (10000) with the same default, and a describe pin asserting the unit is now published — and relocated if its enclosing describe header would otherwise become false. That is the shape PR #17983 used for the identical situation on plugin-security-advanced.test.ts:401, and PR #17986 for plugin-lifecycle-advanced.

   Two things to carry into the same round:

   • Re-run the sweep across packages/spec/src for the other three rows (exportTimeout, scheduledDelay, exportInterval) — a green check:duration-unit-keys cannot see a stale sentence, only a stale describe.
   • Note that tracing.test.ts:537 already carries a landed Span.duration → durationMs retirement with exactly the refusal shape to copy from, on this same file.

   The full dispatch order follows when the card is claimed.

   ---

   Generated by Claude Code
5. zhuangjianguo

   added

   pm:dispatched

   needs:contract-review

   on Sep 13, 2026
6. zhuangjianguo

   self-assigned this

   on Sep 13, 2026
7. zhuangjianguo commented on Sep 13, 2026

   

   zhuangjianguo

   on Sep 13, 2026 – with Claude

   Collaborator

   More actions

   Claim: session_015c5G6TmpMKgnusmTpD7Ntt

   Branch: claude/issue-17785-tracing-duration-units

   Claimed 2026-09-13T11:25Z by the epic PM for #15939 (pm:epic subtree, domain:spec lane rules) — the seventh and last of the Ruling-A remediation cards. Card face: packages/spec/src/system/tracing.zod.ts plus its ADR-0087 migration entries, generated artifacts and test file. Disjoint from #17782 (system/logging.zod.ts) and #17783 (system/metrics.zod.ts) on every authored source file; shared only via generated artifacts, which are regenerated and serialise landing, not claiming.

   ⚠️ The two machine-read fields above are written from check-closing-target-claim's own readers — CLAIM_COMMENT_MARKER (/^\s*>?\s*Claim(?:ed)?\s*:/mi, so no leading backtick) and a Branch: directive line for CLAIM_BRANCH_SHAPE. On the sibling card #17783 I wrote both wrong and redded a gate; see #17783 comment 5652931475.

   Clause ② — yes

   Both carriers hung in the same write (needs:contract-review on this card; the PR side is owed the moment the PR exists). Mechanical floor: a new key on a published payload is always yes — each rename puts a spelling on OpenTelemetryCompatibility and TracingConfig that no author could write before. This overrides Ruling A's own Clause-②: no, as corrected for all six siblings (#17784 5652094166, #15939 5652120294).

   Staleness check — three faces, origin/main @ c45ea8c396, 2026-09-13T11:24Z

   face	reading
   action	git log -20 -- system/tracing.zod.ts → one commit (2d34f320d1, #17846, rule-array filter doors). No duration key on this file has been renamed.
   card-reference	#15939 OPEN · PR #17635 OPEN (lands last) · #15678, #15679 landed · siblings #17786 #17784 #17781 merged, #17780 in the merge queue, #17782 and #17783 delivered as PRs #17999 and #18007
   work-item	all four keys still declared in key position and still bare, each exactly once. Lit control z.number 20; dark control 0.

   ⇒ premise holds; all four rows are still owed.

   The four rows, re-located by symbol path

   ⚠️ Line numbers come from PR #17635's enumeration and rot. Located by symbol and read with their JSDoc:

   line	symbol path	JSDoc, as read	default
   :541	OpenTelemetryCompatibility.exporter.timeout	"Timeout in milliseconds"	10000
   :565	OpenTelemetryCompatibility.exporter.batch.exportTimeout	"Export timeout in milliseconds"	30000
   :570	OpenTelemetryCompatibility.exporter.batch.scheduledDelay	"Scheduled delay in milliseconds"	5000
   :723	TracingConfig.performance.exportInterval	"Background export interval in milliseconds"	5000

   Two readings that distinguish this card from its immediate predecessor, both to be re-verified by the dev rather than taken from here:

   • All four are milliseconds, so the suffix family is Ms — and this file already carries the precedent, Span.duration → durationMs from [#14478 stack 4/6] system/: the 15 remaining duration keys carry their unit in the key name — ADR-0087 conversions with readers; metrics.zod.ts size needs an honest name, not the mechanical one #15679, the one already-suffixed key-position declaration on it. That is the opposite of spec: 5 duration key(s) in system/metrics.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (5 of the 21-row delta) #17783, whose five rows were all seconds and which the file's own convention pushed toward durationSeconds.
   • All four are nested — none is a top-level key of its def — so the authorable-surface / authorable-defaults ratchet should move nothing, the feat(spec)!: tenant schemaCacheTTL carries its unit in the key name (#17784) #17954 reading rather than the feat(spec)!: the three kernel/plugin-lifecycle-advanced.zod.ts duration keys carry their unit in the key name #17986 one. spec: 5 duration key(s) in system/metrics.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (5 of the 21-row delta) #17783 splits 2 top-level / 3 nested; this card should split 0 / 4.

   Already recorded on this card

   The pre-dispatch note 5652791909 names the "stays bare" pin guard at packages/spec/src/system/tracing.test.ts:545, whose entire title — the key, "names no unit", "outside the population" — goes false when this card lands. It is carried into the dispatch order.

   The full dispatch order follows in the next comment.

   ---

   Generated by Claude Code
8. zhuangjianguo commented on Sep 13, 2026

   

   zhuangjianguo

   on Sep 13, 2026 – with Claude

   Collaborator

   More actions

   Dispatch order — #17785

   Epic PM for #15939 · session_015c5G6TmpMKgnusmTpD7Ntt · 2026-09-13T11:26Z · mode:subagent · base origin/main @ c45ea8c396 · branch claude/issue-17785-tracing-duration-units (⚠️ this exact name — the claim above names it and check-closing-target-claim reads it)

   You implement exactly this card: the four duration rows in packages/spec/src/system/tracing.zod.ts. One PR, draft, Fixes #17785. This is the last of the seven remediation cards.

   ---

   Zone 1 — Adjudicated. Not reopenable by you.

   Director seat on #15939, 2026-09-11T14:08Z, maintainer 「同意」, decision batch #115 — verbatim, not translated:

   Ruling A. Batch #65's direction stands (the gate refuses a duration key whose JSDoc names a unit its describe does not). Sequencing: the remediation lands first, per file, each as its own Clause-②: no / patch round following the #15678 / #15679 shape (rename the key with its unit token, ADR-0087 conversion + tombstone + pin where the key is published; describe-only fixes where no rename is needed), and PR #17635 (the gate + self-test + the two corrected prose sites) lands last, into a tree it already reads as clean. ⛔ Not B (18 published-key renames in one PR); ⛔ C is gate weakening.

   ⛔ Settled, do not re-litigate:

   1. Direction. The four keys get renamed. "Fix the describe instead" is answered: no.
   2. Clause-②: yes, overriding the ruling's no (corrected pre-dispatch; spec: 1 duration key(s) in system/tenant.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (1 of the 21-row delta) #17784 5652094166, finding: check:duration-unit-keys reads .describe() but not JSDoc — a duration key documenting its unit only in JSDoc never enters the population, and one card already recorded a wrong reason because of it #15939 5652120294). Put Clause-②: yes in the PR body.
   3. minor, overriding the ruling's patch. Every [#14478 stack 3/6] kernel/: the 14 remaining duration keys carry their unit in the key name — ADR-0087 conversions with readers (runtime-emitted measurements included) #15678/[#14478 stack 4/6] system/: the 15 remaining duration keys carry their unit in the key name — ADR-0087 conversions with readers; metrics.zod.ts size needs an honest name, not the mechanical one #15679 sibling shipped feat(spec)! at minor; the launch window refuses major (check-changeset-no-major.mjs) and carries breaking-ness by a **BREAKING** banner plus adr-0087: registered, not by the level. Measure the siblings in packages/spec/CHANGELOG.md yourself.
   4. Both ADR-0087 registrations per key — a D3 semantic entry and a RETIRED_KEYS_BY_MAJOR[18] row. Settled for the epic on finding: check:duration-unit-keys reads .describe() but not JSDoc — a duration key documenting its unit only in JSDoc never enters the population, and one card already recorded a wrong reason because of it #15939.
   5. ⛔ Do not touch packages/spec/scripts/check-duration-unit-keys.ts or its self-test (PR feat(spec): refuse a duration key whose JSDoc names a unit its describe does not #17635, lands last, red by construction — designed).
   6. ⛔ Sibling files are not yours — the other six .zod.ts files of this epic. Three are merged; spec: 3 duration key(s) in kernel/plugin-lifecycle-advanced.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (3 of the 21-row delta) #17780 is in the merge queue; spec: 4 duration key(s) in system/logging.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (4 of the 21-row delta) #17782 and spec: 5 duration key(s) in system/metrics.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (5 of the 21-row delta) #17783 are open as PRs feat(spec)!: the four system/logging.zod.ts duration keys carry their unit in the key name (#17782, ruling A on #15939) #17999 and feat(spec)!: the five system/metrics.zod.ts durations carry their unit in the key name (#17783) #18007.

   ---

   Zone 2 — Mechanism assumptions. Falsify each before relying on it.

   2.1 The four rows, by symbol path

   Measured on origin/main @ c45ea8c396, 2026-09-13T11:24Z. Line numbers rot — re-locate by symbol path:

   line	symbol path	JSDoc, as read	value
   :541	OpenTelemetryCompatibility.exporter.timeout	"Timeout in milliseconds"	int().positive().optional().default(10000)
   :565	OpenTelemetryCompatibility.exporter.batch.exportTimeout	"Export timeout in milliseconds"	…default(30000)
   :570	OpenTelemetryCompatibility.exporter.batch.scheduledDelay	"Scheduled delay in milliseconds"	…default(5000)
   :723	TracingConfig.performance.exportInterval	"Background export interval in milliseconds"	…default(5000)

   Each is declared exactly once in key position; lit control z.number reads 20 on this file, dark control 0. Re-measure and state your own counts. grep -c counts LINES — use grep -o … | wc -l for occurrences. Read every JSDoc yourself; ⛔ never infer a unit from a default's magnitude.

   2.2 The suffix is Ms — and this file already set that precedent

   All four are milliseconds, unlike the immediately preceding card #17783 whose five rows were all seconds. ⛔ Do not carry that card's Seconds reasoning over.

   #15679 already renamed Span.duration → durationMs on this same file — it is the one already-suffixed key-position declaration on it. Derive the spelling from tree counts anyway (key-position *Ms across packages/spec/src, and the competing spellings for each of timeout, exportTimeout, scheduledDelay, exportInterval) and put the counts in the PR body.

   ⚠️ One judgement to show your work on: exporter.timeout and exporter.batch.exportTimeout would become timeoutMs and exportTimeoutMs — two *TimeoutMs keys one nesting level apart. Check that reads unambiguously and say why you accepted or rejected it.

   2.3 The ratchet should move NOTHING here — verify, don't assume

   authorable-surface/*.json records top-level keys per def (build-schemas.ts reads schema.properties one level deep). My reading: all four of your rows are nested — exporter.*, exporter.batch.*, performance.* — so no ledger row moves. That is the #17954 reading, and the opposite of #17986 (three top-level keys, ledger moved) and of #17783 (2 top-level / 3 nested).

   ⛔ Verify this from the generator source, not from me. If check:authorable-surface is green without regeneration, that is the correct outcome here and not an omission — say so explicitly in the PR body, with the reason.

   2.4 Tombstones, and the TDZ ordering trap

   Check .strict() on each enclosing object. Where absent, a bare deletion is an ADR-0049 silent strip — the operator's value vanishes and a default lands on an exporter deadline. Every row needs a retiredKey() tombstone whose message carries the FROM → TO mapping.

   ⚠️ gen:schema and check:authorable-surface run with OS_EAGER_SCHEMAS=1, making lazySchema evaluate at module load. A tombstone const declared after the schema that reads it is a temporal-dead-zone read. PR #17983 hit exactly this and had to move its const above the schema. Check where each new const has to sit.

   2.5 The pin guard this card must trip — already located

   packages/spec/src/system/tracing.test.ts:545:

   it('leaves the OTel exporter \timeout` alone — its describe names no unit, so it is outside the population', …)→expect(config.exporter.timeout).toBe(10000)`

   This card is the sweep that guard was written to catch, so it succeeds by failing. Its whole title goes false. ⛔ Not deleted, not .skipped, not weakened, not "fixed green". Replace it with a refusal pin (issue is not unrecognized_keys; message carries FROM → TO), an acceptance pin at 10000 with the same default, and a describe pin asserting the unit is published — and relocate it if its enclosing describe header would otherwise become false. tracing.test.ts:537 already carries the landed Span.duration → durationMs refusal with exactly the shape to copy.

   Then re-run that sweep yourself across packages/spec/src for the other three rows: any prose, comment, tombstone or test asserting one of your keys is bare, unitless, or outside the gate's population. A green check:duration-unit-keys cannot see a stale sentence. Report every hit with file:line.

   2.6 Consumer packages — named, each owes a real reading

   Lane requirement, not a suggestion: a sweep inside packages/spec cannot see a consumer's fixture asserting the old spelling. Run and report an exit code for each:

   package	why
   @objectstack/observability	the tracing/metrics-domain package — highest fixture risk on this card
   @objectstack/core	the runtime that consumed #17780's keys
   @objectstack/verify · @objectstack/cli	schema-driven fixtures
   @objectstack/rest · @objectstack/qa	published-surface fixtures

   ⚠️ Do not exclude a package because it is one you are editing. The at-tier review of PR #17986 found a stale doc precisely because that card's sweep excluded packages/core wholesale on the reasoning that core was "the package being changed". A package you are editing is still a consumer of the keys you are renaming.

   2.7 Pinned objectui

   git grep the pinned checkout at .objectui-sha, re-read from this tree. Report every export of tracing.zod.ts and each of the four key names, with lit controls on that corpus and a dark control. ⚠️ The citation must land on ONE physical source line — three sibling PRs each lost a cycle to a citation split across a TypeScript string concatenation.

   ---

   Zone 3 — Suggested route. Deviate with evidence.

   1. Worktree off origin/main @ c45ea8c396, branch exactly claude/issue-17785-tracing-duration-units. ⛔ Never edit the shared checkout; ⛔ never git stash.
   2. Re-locate all four rows by symbol path; read all four JSDocs; settle the suffix from tree counts.
   3. Rename + retiredKey() tombstone per row, consts above their readers.
   4. Fix each .describe() to name the unit — the describe is what the reference page renders and what an AI author reads.
   5. Semantic entry (or entries — check how the siblings scoped theirs) and four RETIRED_KEYS_BY_MAJOR[18] rows. Regenerate registry.ts with gen:migration-registry; ⛔ never hand-merge it.
   6. Regenerate every artifact (gen:schema, gen:docs); check:generated must read all current.
   7. Tests: per row, a refusal pin, an acceptance pin at the same magnitude and default, and a describe pin. Plus the 2.5 replacement.
   8. Reverse-verify at least two new pins by ablation: delete the tombstone, prove the deletion on disk (anchor count and blob hash), re-run and show exactly the expected tests red, restore under an EXIT INT TERM trap, prove byte-identity (git hash-object, empty git diff HEAD, empty git status --porcelain).
   9. minor changeset with the **BREAKING** banner, the FROM → TO mapping for all four, and adr-0087: registered.
   10. Merge main only with bash scripts/pm/os-regen-merge.sh. ⚠️ Its header records the trap: os-regen paths merge with exit 0 and zero conflict markers while silently dropping one side's changes. Afterwards assert by exact-name grep that the sibling migration entries survived — with main moving fast, that now includes spec: 1 duration key(s) in kernel/plugin-security-advanced.zod.ts name their unit only in JSDoc — #15939 Ruling A remediation (1 of the 21-row delta) #17781's kernel-runtime-config-timeout-unit-in-key — with a dark control at 0, then re-run check:generated.
   11. Full gate sweep: dispatch-gates --commands reconciled against --ran … :: exit N; report derived / run / NOT-MEASURED / UNRUN and every non-zero exit classified.

   ⚠️ main is moving fast — five merges in the last hour, three of them this epic's. Merge it when you have a concrete reason (a real conflict, or a sibling entry you need in the tree for a check to be meaningful), ⛔ not on a schedule: the merge queue merges against the latest main at merge time, so this PR does not need to be up to date to land, and every push cancels the run in flight. Two sibling PRs have accumulated red aggregator runs from exactly that.

   Known noise — recognise, don't chase

   • check-widening-tells T1 on retiredKey() lines is the known inverted false positive [finding] check-widening-tells fires T1 on a retiredKey() tombstone line, so every ADR-0087 key retirement reads as a clause-2 widening for the one reason the accept set shrank #17955 (those lines narrow the accept set). ⛔ Do not reshape the diff; ⛔ do not weaken the checker. Record it.
   • Docs Drift Check will over-name pages off generic string anchors (timeout, interval). Check each named page for an actual tracing-config mention before touching it. FYI: I measured the hand-written docs surface for the two sibling cards and both were clean — you still owe your own reading.
   • check:doc-authoring refuses tracker ids inside runtime strings; put anchors in an adjacent // comment. ⛔ Never add a baseline entry — maintainer-only.

   ---

   Deliverable and red lines

   • Draft PR, Fixes #17785, Clause-②: yes in the body, and hang needs:contract-review on the PR the moment it exists (the card side is already hung). ⛔ Do not turn it ready, enqueue, enable auto-merge, or merge — the in-seat clause-② review at CONTRACT_REVIEW_TIER is owed first and landing is the PM's step.
   • ⛔ Never edit content/docs/releases/ — release-owned.
   • ⛔ Never weaken a gate, lower a threshold, delete a required check, raise a ratchet ceiling, or skip a test.
   • Capture every exit code before any pipe (cmd > log 2>&1; ex=$?); route heavy runs through scripts/pm/os-verify-lock.sh and read verdicts from its VERDICT command-exit line.
   • Report as os-dev-report on this card: every reading with its command, exit code and UTC timestamp; per-consumer-package exit codes; an open_questions list; and anything measured that contradicts this order.

   A measured "the premise is false, here is the evidence" is a good outcome. Stop and report rather than inventing scope.

   ---

   Generated by Claude Code
9. zhuangjianguo commented on Sep 13, 2026

   

   zhuangjianguo

   on Sep 13, 2026 – with Claude

   Collaborator

   More actions

   Clause-②-correction: 5652963724

   Clause-②: yes

   Session: session_015c5G6TmpMKgnusmTpD7Ntt

   ---

   ⚠️ Pre-emptive correction — the same PM defect measured on sibling card #17783. My claim 5652963724 writes the clause-② determination as a prose heading (### Clause ② — \yes`) and never as a **line-anchored** Clause-②: yes. The declaration limb of check-clause2-carriersis line-anchored: only whitespace, a blockquote>`, a list bullet and backtick/bold wrapping may precede the key, so a determination stated in prose is not read however correctly it is reasoned.

   On #17783 that produced --pair 18007 exit 4 (measured 11:39Z). This card has no PR yet, so the defect is not yet observable — it is corrected now rather than waiting for CI to find it.

   The substance is unchanged and is argued in the claim: yes, on the mechanical floor that a new key on a published payload is always affirmative, overriding Ruling A's no.

   ⇒ Corrected with the sanctioned instrument: ⛔ not a second Claim: (forbidden by the claim protocol), ⛔ not an edit of the posted comment (no edit-an-issue-comment call is available here). The literal line to copy lives at .claude/skills/pm-dispatch/SKILL.md:809.

   Standing correction to my own practice, third instance today: every machine-read field — Claim:, Branch:, Clause-②: — gets copied from the template, never composed from memory, and gets probed with the reader's own regex before I move on. Two of the three defects reached CI before I caught them; this one did not.

   ---

   Generated by Claude Code
10. claude commented on Sep 13, 2026

    

    claudebot

    on Sep 13, 2026 – with Claude

    Contributor

    More actions

    Verification readings — #17785 / PR #18016

    Dev seat under the #15939 epic PM. Worktree /home/user/objectstack-issue-17785, branch
    claude/issue-17785-tracing-duration-units, BASE = 98bd7986fe, final head c3d53951a9.
    Every exit code below was captured before any pipe (cmd > log 2>&1; ex=$?); every heavy
    run went through scripts/pm/os-verify-lock.sh and the verdict is read from its own
    VERDICT command-exit line. Timestamps are UTC on 2026-09-13.

    Deviation from Zone 3, declared

    Zone 3 step 1 says to branch off origin/main @ c45ea8c396. I branched off origin/main
    as it stood at worktree creation, 98bd7986fe — which is c45ea8c396 plus the three
    sibling merges (git merge-base --is-ancestor c45ea8c396 98bd7986fe → exit 0 at 11:29:30Z,
    and an exit-0 ancestry answer is self-proving on a shallow checkout, no control leg owed).
    A strict superset of the ordered base, obtained without a merge. I then never merged main
    again: the queue merges against latest main at merge time and every push cancels the run in
    flight, per the order's own warning.

    Premise re-verification (Zone 2.1)

    reading	command	result	time
    four rows in key position	grep -nE '^\s*(timeout|exportTimeout|scheduledDelay|exportInterval)\s*:' packages/spec/src/system/tracing.zod.ts	:541 :565 :570 :723, each exactly once	11:32Z
    lit control	grep -o 'z\.number' … | wc -l	20	11:32Z
    dark control	grep -o 'qqzzxx' … | wc -l	0	11:32Z
    .strict() on any enclosing object	grep -o '\.strict()' … | wc -l	0 — so a bare deletion is an ADR-0049 silent strip on all four	11:32Z

    ⚠️ One correction to the card and to Zone 2.1. Both describe these keys as ones whose
    .describe() "does not carry" the unit. Measured: none of the four has a .describe() at
    all. The published reference row was a bare integer with no unit anywhere on the page —
    a strictly worse channel than the unit-in-prose shape #14478 already refuses. The conclusion is
    unchanged and stronger; the reason recorded in the entry is now the measured one.

    The suffix, from tree counts — every number reproducible at a named ref

    Corpus: git grep -hoE '^[[:space:]]*NAME[[:space:]]*:' 98bd7986fe -- 'packages/spec/src/*.ts',
    run at 12:05:25Z. grep -c counts LINES, so every count here is grep -o … | wc -l.

    reading	count
    key-position *Ms occurrences	281
    distinct *Ms names	42
    timeoutMs	65
    intervalMs	14
    durationMs	73
    key-position timeoutSeconds	0
    key-position *Seconds, any name	77
    exportTimeoutMs / exportTimeoutSeconds	0 / 0
    scheduledDelayMs / scheduledDelaySeconds	0 / 0
    exportIntervalMs / exportIntervalSeconds	0 / 0
    Delay-plus-Ms family	maxDelayMs 9, initialDelayMs 9, maxRetryDelayMs 5, debounceDelayMs 2, delayMs 2, retryDelayMs 1
    dark control qqzzxxMs	0

    Per the mid-round correction, every one of these counts is now written into the ADR-0087
    entry and the retired-key comments with the ref beside it (98bd7986fe) and the corpus
    spelled out, so a future reader can reproduce them from a ref that does not move.

    The ratchet (Zone 2.3) — verified from the generator, not assumed

    reading	result
    packages/spec/scripts/build-schemas.ts:852	const props = (schema as {properties?…}).properties; then for (const [name, prop] of Object.entries(props)) currentKeys.set(\${defKey}:${name}`, …)` — one level deep
    grep -o 'system/OpenTelemetryCompatibility:[^"]*' authorable-surface/system.json	5 rows, …:exporter among them — the whole nested object is ONE row
    dotted keys in authorable-surface/system.json	0
    dotted keys in authorable-defaults/system.json	0 against 247 total keys there
    lit control	system/Span:duration [RETIRED] present
    check:authorable-surface	exit 0 with no regeneration
    git diff --name-only 98bd7986fe | grep -cE 'authorable-surface|authorable-defaults'	0

    ⇒ the #17954 reading. Also confirms the PM's note: this PR touches neither system.json
    shard, so it is outside the #17999 / #18007 landing-order constraint.

    The pin guard (Zone 2.5) and the stale-prose sweep

    Sweep: packages/spec/src · packages/spec/scripts · content/docs, patterns
    outside (the) population · names no unit · no unit at all · left alone ·
    leaves … alone · untouched here · stays bare; lit control unit 2308, dark control
    0. Then narrowed to hits whose SUBJECT is one of the four keys, and a whole-repo
    occurrence grep of each key name.

    file:line	disposition
    packages/spec/src/system/tracing.test.ts:545	replaced and relocated. Its title, its "names no unit" clause and its "outside the population" clause all go false. Not deleted, not .skipped, not weakened. Moved out of the Span.duration carries its unit (#15679) describe (no longer its subject) into a new #17785 block.
    packages/spec/src/system/tracing.test.ts:437	expect(config.exporter.timeout).toBe(10000) in should apply defaults — moved to timeoutMs, same magnitude.
    packages/spec/src/system/tracing.test.ts:415-416	the batch acceptance fixture — moved to the suffixed spellings, same 60000 / 10000.
    packages/spec/CHANGELOG.md:2866	left alone, reported. Release-owned; two limbs go false; jointly owned with #17783. See open_questions.
    .../semantic/18.system-tracing-span-duration-unit-in-key.ts	left alone, deliberately — a predecessor's scoped record is never amended (epic settlement); the new entry opens by relating to it.
    content/docs/references/system/tracing.mdx:57, :470	generated — regenerated by gen:docs.

    Whole-repo occurrence counts of each key name returned exactly these files and no others.

    Consumers (Zone 2.6) — greps first, then a real exit code each

    Occurrence sweep per package, git grep -o … | wc -l, 12:37:32Z. Subjects:
    OpenTelemetryCompatibility, TracingConfig, exportTimeout, scheduledDelay,
    exportInterval, exporter.timeout.

    package	all six subjects	lit control	dark
    @objectstack/observability	0	Schema 2	0
    @objectstack/core	0	Schema 219	0
    @objectstack/verify	0	Schema 33	0
    @objectstack/cli	0	Schema 1084	0
    @objectstack/rest	0	Schema 982	0
    @objectstack/dogfood	0	Schema 267	0
    @objectstack/downstream-contract	0	Schema 36	0
    @objectstack/http-conformance	0	Schema 1	0
    @objectstack/refd-timer-testkit	0	Schema 0 — VOID control, re-taken: objectstack 12, export 7, 3 tracked files	0
    packages/spec (positive control)	72 / 70 / 34 / 32 / 34 / 17	Schema 38738	0

    ⚠️ @objectstack/qa does not exist in this tree. packages/qa/ holds four differently
    named packages; I ran all four. Raised in open_questions.

    Exit codes. packages/core is included, not excluded — the #17986 lesson: a package you
    edit is still a consumer. (I do not edit core here, but the same reasoning applies to
    packages/spec, which is why its own suite and gates are in the sweep.)

    package	task	exit	note
    @objectstack/observability	test	0	12:41Z
    @objectstack/observability	typecheck	—	no such script; declared DEBT in check-type-check-coverage.mjs:811 (errors: 11). Hand-rolled tsc --noEmit -p tsconfig.json reproduces exactly 11 — TS2554 ×10 + TS2552 ×1, the ledger's recorded signature set, 0 naming anything in my diff. NOT MEASURED as a PR verdict; the gate check:type-check-coverage is exit 0.
    @objectstack/core	typecheck / test	0 / 0	12:43Z
    @objectstack/verify	typecheck / test	0 / 0	13:05Z
    @objectstack/cli	typecheck / test --project unit	0 / 0	13:10Z
    @objectstack/rest	typecheck / test	0 / 0	12:47Z
    @objectstack/dogfood	typecheck / test	0 / 0	13:14Z
    @objectstack/downstream-contract	typecheck / test	0 / 0	13:15Z
    @objectstack/http-conformance	typecheck / test	0 / 0	12:51Z
    @objectstack/refd-timer-testkit	typecheck / test	0 / 0	12:51Z

    First pass returned 1/2/1 on five of these. Every one was TS2307 Cannot find module or
    MODULE_NOT_FOUND against an unbuilt sibling — proven on disk rather than inferred:
    service-settings, driver-turso, create-objectstack, plugin-email, verify, cli and
    plugin-webhooks each had no dist/, against a lit control of spec, objectql and
    lint — the ones I had built — each having one. Zero tracing-subject hits in any failure log.
    Building those closures converted all of them to exit 0, so none is left as a claim.

    The pinned objectui checkout (Zone 2.7)

    Cloned and checked out at .objectui-sha = 53ded82bf7a494f54e344e19099dbf00854b8694;
    git ls-files | wc -l = 6409, matching the sibling rounds' corpus.

    subject	count
    all 37 exports of tracing.zod.ts	0 each, except the two below
    Span (raw)	404 — read, not counted: objectui's own HTML text-span component
    SpanSchema (raw)	40 — all TextSpanSchema; standalone SpanSchema = 2, both objectui's own docs for its HTML span-element component
    exportTimeout / scheduledDelay / exportInterval / exporter.timeout	0 / 0 / 0 / 0
    lit controls	objectstack 10171 · @objectstack/spec 3479 · timeout 832
    dark control	0

    The citation in the semantic entry is on one physical source line in the asserting
    spelling, and check:objectui-pin-citations reads exit 0.

    Gate reconciliation

    node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack → 109
    commands. Derived twice, five commits apart (11:58Z and 11:59Z after a fetch) — byte-identical
    output both times.

    node scripts/pm/dispatch-gates.mjs --ran ran.list --repo objectstack-ai/objectstack at
    13:22:40Z, exit 0:

    Run reconciliation — 109 derived, 109 run, 0 NOT-MEASURED, 0 UNRUN.

    Every non-zero exit, classified. Seven gates were non-zero on the first pass; all seven
    were PREREQUISITE-NOT-MET, none was a finding, and all seven were re-run green after building
    what they read:

    gate	first exit	cause	after
    @objectstack/lint check:doc-formula-expressions	3	@objectstack/formula + lint unbuilt	0
    @objectstack/lint check:doc-security-posture	3	@objectstack/lint unbuilt	0
    @objectstack/spec check:skill-examples	1	client-react/dist holds no .d.ts	0
    pnpm check:docs-transcript-drift	3	reads the built lint registry	0
    pnpm check:lean-entry-closure	3	loads built entry points	0
    pnpm check:dual-build-cjs-loads	3	reads built output	0
    pnpm check:type-check-debt	3	needs every package built	0

    Notable greens: check:authorable-surface 0 (no regeneration — the correct outcome),
    check:duration-unit-keys 0, check:objectui-pin-citations 0, check:doc-authoring
    0, check:nul-bytes 0, check:adr-0087-registration 0,
    check:changeset-no-major 0, check:pm-widening-tells 0 — the known #17955 inverted
    T1 on retiredKey() lines did not fire on this diff, so there was nothing to record.

    ⚠️ dispatch-gates printed STALE TREE (HEAD c3d53951a9 vs origin/main 1e20f816ea,
    2 derivation inputs changed). Dispositioned, not ignored: .github/workflows/board-snapshot.yml
    is schedule / workflow_dispatch only, has no paths: filter, and names none of
    packages/spec, content/docs or .changeset (0 hits); scripts/pm/check-half-states.mjs
    is not among the derived 109 at all, its live callers key on that script's own path, and its
    18 mentions of my prefixes are its own internal fixtures. Neither adds a family for this card.

    Build, artifacts, tests, ablation

    reading	exit	time
    pnpm --filter @objectstack/spec build (locked)	0 (VERDICT command-exit 0)	11:55Z, re-run 12:12Z
    pnpm --filter @objectstack/spec check:generated	0 — all 15 artifacts current	13:24:09Z on c3d53951a9
    pnpm --filter @objectstack/spec exec vitest run src/system/tracing.test.ts	0 — 45/45	11:40Z, re-run each ablation leg
    pnpm --filter @objectstack/spec gen:migration-registry	0 — 211 semantic / 177 retired-key / 178 retired-def	12:05Z

    Sibling migration entries survive, by exact-name grep after every regeneration —
    kernel-runtime-config-timeout-unit-in-key 1, kernel-health-check-and-hot-reload-durations-unit-in-key 1,
    tenant-schema-cache-ttl-unit-in-key 1, system-tracing-span-duration-unit-in-key 1, mine 1;
    dark control id: 'qqzzxx-none' 0.

    Ablation, two legs, each: mutate → prove on disk → run → restore under an
    EXIT INT TERM trap with absolute paths → prove byte-identity by state.

    leg	on-disk proof	mutated run	restored
    remove the exporter.timeout tombstone	anchor timeout: retiredKey( 1 → 0; blob 81c8fb8b → d34d7cbc	exit 1, exactly one test red: expected true to be false at expect(result.success).toBe(false) — the parse SUCCEEDED, i.e. the ADR-0049 silent strip the tombstone exists to prevent	git diff HEAD empty, git status --porcelain empty, hash back to 81c8fb8b, 45/45
    drop the exportIntervalMs describe()	anchor Background span-export interval in milliseconds 1 → 0; blob → b673b0cd	exit 1, exactly the describe pin red	identical restore, 45/45

    No rebuild is owed between legs and none was faked: tracing.test.ts imports its subject as
    the relative specifier './tracing.zod', so it resolves to src and never through the package
    exports that point at dist — the ablation-dist-preflight hazard condition does not hold
    here. Predicted direction was transition to red before running; observed direction matched.
    Final tree: git status --porcelain empty, git diff HEAD empty.

    Channel and MCP accounting

    Every GitHub read and write went through repo-scoped REST after a green probe
    (GET /repos/objectstack-ai/objectstack/issues/17785 → 200, 11:30Z). Card body, all four
    comments, #17780's batch triage comment and #15939 with its 14 comments were read that way.
    MCP GitHub calls this run: 0. The needs:contract-review label was hung with the additive
    endpoint POST /issues/18016/labels (HTTP 200) and read back: ['needs:contract-review'].

    ---

    Generated by Claude Code
11. claude commented on Sep 13, 2026

    

    claudebot

    on Sep 13, 2026 – with Claude

    Contributor

    More actions

    os-dev-report

    {
    "issue": 17785,
    "status": "done",
    "branch": "claude/issue-17785-tracing-duration-units",
    "pr": "#18016",
    "premise_still_valid": true,
    "summary": "All four JSDoc-only duration rows in packages/spec/src/system/tracing.zod.ts are renamed with the Ms suffix (exporter.timeout -> timeoutMs, exporter.batch.exportTimeout -> exportTimeoutMs, exporter.batch.scheduledDelay -> scheduledDelayMs, performance.exportInterval -> exportIntervalMs), each tombstoned with retiredKey() and registered as one ADR-0087 D3 semantic entry plus four RETIRED_KEYS_BY_MAJOR[18] rows. One reading corrects the card: none of the four carried a .describe() AT ALL - not a describe that omits the unit - so the published reference row was a bare integer, and all four now publish the unit. The authorable-surface / authorable-defaults ratchet moved nothing, verified from build-schemas.ts:852 and from the committed shards, which is the correct outcome for four nested keys and not an omission. Draft PR #18016 with Clause-2: yes and needs:contract-review hung; the card's assignee was already set by the dispatch and I did not write it.",
    "tests": "See the report comment on #17785 for every command with its exit code and UTC timestamp. Headline: dispatch-gates --ran reconciliation 109 derived / 109 run / 0 NOT-MEASURED / 0 UNRUN, exit 0 at 13:22:40Z, quoted from final head c3d5395. packages/spec build exit 0 (VERDICT command-exit 0, os-verify-lock); check:generated exit 0, all 15 artifacts current at 13:24:09Z on c3d5395; tracing.test.ts 45/45 pass. Per-consumer exit codes all 0 after building the closures those gates read. ABLATION, two legs, both with on-disk proof and byte-identical restore: (1) removed the exporter.timeout tombstone - anchor count 1 -> 0, blob d34d7cbc -> HEAD 81c8fb8b - exactly one test red, 'expected true to be false', i.e. safeParse SUCCEEDED, demonstrating the ADR-0049 silent strip the tombstone prevents; restored, git diff HEAD empty, git status empty, hash back to 81c8fb8b, 45/45 green. (2) dropped the exportIntervalMs describe() - anchor 1 -> 0 - exactly the describe pin red; restored identically, 45/45 green. Restore ran under an EXIT INT TERM trap with absolute paths, was verified by hash equality and empty diff, never by an exit code. No rebuild between legs is required and none was faked: tracing.test.ts imports its subject by the relative specifier './tracing.zod', so it resolves to src and never through the package exports that point at dist - the ablation-dist-preflight hazard condition does not hold here.",
    "mcp_calls": "0 - every GitHub read and write went through repo-scoped REST after a green probe (GET /repos/.../issues/17785 -> 200 at 11:30Z). No MCP GitHub tool was called at any point in the run.",
    "open_questions": [
    {
    "question": "All four retired keys carried a Zod .default(...). retired-key.ts ships acceptRetiredDefaultResidue() precisely for a retired DEFAULTED key - it accepts and silently strips the emitted default as inert residue while keeping the loud refusal for every other value. I used plain retiredKey(), matching every landed sibling of this epic (#17780's debounceDelay was also defaulted). Should this epic's class of rename use the residue helper?",
    "options": [
    "A. Leave as-is (plain retiredKey on all four), matching #17780 / #17781 / #17784 and #15679, and treat the residue helper as scoped to permission-style keys materialised into stored artifacts.",
    "B. Wrap the two enclosing shapes in acceptRetiredDefaultResidue with the captured literals 10000 / 30000 / 5000 / 5000, so an artifact built by a released toolchain that materialised the default is not sentenced to a parse failure.",
    "C. Settle it once epic-wide on #15939 and, if B wins, apply it to all six rename cards in one follow-up rather than diverging here."
    ],
    "recommendation": "A for this PR, then C as a follow-up question for the epic PM. B's founding case is an authorable surface whose parsed output is STORED and re-parsed (marketplace packages, installed environments). These two defs are not that: no stack collection declares tracing, no metadata-type binding or manifest embed carries either, and a tracing config is never a stored sys_metadata row - which is the same reading that makes them semantic entries rather than D2 conversions. So there is no population of already-built artifacts carrying the emitted default. Diverging from five landed siblings inside the last card of an epic would also be the wrong place to change the shape."
    },
    {
    "question": "packages/spec/CHANGELOG.md:2866 (released, under ## 17.4.0) says 'ServiceLevelObjective.errorBudget's burn-rate window and the OpenTelemetry exporter timeout name no unit anywhere in their prose, so both are outside the gate's population entirely.' Both limbs about MY key go false with this PR, and the window half belongs to #17783. Who corrects it?",
    "options": [
    "A. Nobody - it is a scoped past-tense record of what #15679 measured and stays true in that scope.",
    "B. A dedicated docs-only PR amending that released entry, the route AGENTS.md prescribes for a factual error in a released CHANGELOG entry.",
    "C. Fold it into PR #17635 alongside residue items A and D, which already collects exactly this class."
    ],
    "recommendation": "C, with B as the fallback. It is the same shape as residue item A on #15939 (the SandboxConfig tombstone prose), it is jointly owned by two cards so neither should rewrite it alone, and its second limb only goes fully false when #17635 lands. I did NOT edit it: packages/*/CHANGELOG.md is release-owned and AGENTS.md forbids touching it in a code PR."
    },
    {
    "question": "Zone 2.6 names @objectstack/qa as a consumer package. No package by that name exists in the tree.",
    "options": [
    "A. It meant the packages/qa/ directory, which holds @objectstack/dogfood, @objectstack/downstream-contract, @objectstack/http-conformance and @objectstack/refd-timer-testkit.",
    "B. It meant one specific member of that directory.",
    "C. It is a stale name from an earlier tree."
    ],
    "recommendation": "A - I read it as the directory and ran all four members, reporting an exit code for each. Flagging it so the dispatch template is corrected rather than re-guessed on the next card."
    },
    {
    "question": "@objectstack/observability declares no typecheck script (ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT). Its debt is recorded in check-type-check-coverage.mjs:811 as errors: 11, 'all code-tier (TS2554 wrong arity x10, TS2552)'. My ad-hoc tsc --noEmit -p tsconfig.json reproduces exactly 11 - TS2554 x10 and TS2552 x1, zero of them naming anything in my diff. Is a hand-rolled tsc run on a script-less package a reading the lane wants recorded?",
    "options": [
    "A. No - the package's declared check is test (exit 0) and check:type-check-coverage (exit 0) is the gate; a hand-rolled tsc is NOT MEASURED as a PR verdict.",
    "B. Yes - record it, since the signature match against the ledger is itself evidence that nothing moved."
    ],
    "recommendation": "A for the verdict, B for the evidence: I report the run as NOT MEASURED as a PR verdict, and separately report that its 11 errors match the ledger's recorded signature set exactly, which is the positive control that my diff moved nothing there."
    },
    {
    "question": "New platform reading, not in pm-dispatch references/platform-readings.md: a PR-BODY EDIT over raw REST appends a bare footer even when the sent body already ends with a session-URL footer under a rule line (two footers), whereas the CREATE on the same channel stored my session-URL footer byte-identical (one footer). Sending a body that ends with the bare block under a rule line is stored byte-exact (one footer). Should that cell be recorded?",
    "options": [
    "A. Record it in references/platform-readings.md as a measured REST x PR-body x EDIT cell.",
    "B. Leave it - the file is a governed surface and this is one session's reading."
    ],
    "recommendation": "A, filed by the PM rather than by me: .claude/** is a governed surface and I am not editing it in this PR. The PR body now ends with the bare block (byte-exact read-back, one footer) and carries the session URL as body prose, which is what AGENTS.md prescribes when the footer channel is the platform's."
    }
    ],
    "out_of_scope_findings": [
    "noted, not filed: packages/spec/CHANGELOG.md:2866's two present-tense limbs about the OTel exporter timeout go false with this PR. Release-owned, so not editable here; jointly owned with #17783; the naturalsuccessor is PR #17635, which already carries residue items A and D of exactly this class. Raised as an open question so the epic PM dispositions it rather than it being lost.",
    "noted, not filed: the reference-page generator emits a 'Nested Shape' section one level deep only, so exporter.batch.exportTimeoutMs and exporter.batch.scheduledDelayMs now carry a describe that no published row renders - the unit reaches the JSON schema but not the .mdx table. Generator behaviour, unchanged by this PR, and it affects every two-level-nested key in the spec, not these two. successor: whoever next touches packages/spec/scripts/build-docs.ts; no PR or person is queued to, so it is a real observation with no queuedsuccessor rather than a defect this card should file.",
    "noted, not filed: @objectstack/observability declares no typecheck script while carrying an 11-error DEBT entry in check-type-check-coverage.mjs. That is the ledger working as designed (a package either declares the script or carries a measured entry), not a gap - recorded only because the Zone 2.6 sweep asked for a typecheck exit code from it and there is none to give. successor: none.",
    "noted, not filed: dispatch-gates reported STALE TREE at derivation time (HEAD c3d5395 vs origin/main 1e20f81, 2 derivation inputs changed: .github/workflows/board-snapshot.yml and scripts/pm/check-half-states.mjs). Dispositioned rather than ignored: board-snapshot.yml is schedule/workflow_dispatch only with no paths filter and names none of packages/spec, content/docs or .changeset (0 hits); check-half-states.mjs is not in the derived 109 at all, its live callers are half-state-patrol.yml and board-snapshot.yml keyed on that script's own path, and its 18 mentions of my path prefixes are its own internal fixtures. Neither adds a family for this card, and the derived list was byte-identical across two derivations five commits apart. I did not merge main: the queue merges against latest main at merge time and every push cancels the run in flight."
    ]
    }

    ---

    Generated by Claude Code
12. zhuangjianguo

    removed

    needs:contract-review

    on Sep 13, 2026
13. claude commented on Sep 13, 2026

    

    claudebot

    on Sep 13, 2026 – with Claude

    Contributor

    More actions

    Correction — the os-dev-report above describes head c3d53951a9; the round now stands at efbf300508

    Pointer only, not a re-report. The original comment is not edited: it stands as the record
    of the round up to c3d53951a9, and this comment names what three later commits superseded in it.

    Three fixes landed after it, all from the in-seat contract review and the epic PM:

    fix	exit
    reworded the lit-control prose out of check:cli-command-ids — the string had broken so a quoted run began objectstack 10171 and, which that gate reads as a CLI invocation resolving to no command path	pnpm check:cli-command-ids 0
    corrected the Schema lit control, which disagreed with the corpus its own sentence named	pnpm --filter @objectstack/spec gen:migration-registry 0
    four tombstones @objectstack/spec 18 to 17 — the prose names the released PACKAGE version (this ships in 17.5.0), while RETIRED_KEYS_BY_MAJOR[18] names the PROTOCOL major; two axes, settled on #15939	pnpm --filter @objectstack/spec check:generated 0, gen:docs 0

    The corrected count. The entry said 20875 Schema occurrences on a corpus it described as
    the tree excluding packages/spec and the generated reference pages. 20875 is the count with
    content/docs/references still in. On the corpus the sentence actually names it reads 18920,
    and both numbers now come from one reading rather than from assembled steps:

    git grep -o 'Schema' 98bd7986fe -- ':(exclude)packages/spec' ':(exclude)content/docs/references' | wc -l
    18920
    

    Dropping the second exclusion reproduces the old 20875, which is how the drift is identified
    rather than merely asserted.

    ⚠️ The version-token fix needed a joined-literal search to see at all: the phrase spans a
    '...' + '...' break, so a single-line grep of the diff reads zero and looks clean. Baseline
    4x 18 / 1x 17 became 0x 18 / 5x 17, the fifth being this file's own Span.duration
    precedent.

    Re-verified on efbf300508, not carried over: the derived gate list is byte-identical to the
    c3d53951a9 derivation, and dispatch-gates --ran reads 109 derived / 109 run / 0 NOT-MEASURED
    / 0 UNRUN (exit 0). tracing.test.ts 45/45. check:generated reports all 15 artifacts
    current. Everything else in the original report — the premise reading, the ratchet verification,
    the pin-guard replacement, the stale-prose sweep, the consumer and pinned-objectui sweeps and the
    two ablation legs — was re-checked against this head and is unchanged.

    ---

    Generated by Claude Code
14. zhuangjianguo

    added

    needs:contract-review

    on Sep 13, 2026
15. zhuangjianguo commented on Sep 13, 2026

    

    zhuangjianguo

    on Sep 13, 2026 – with Claude

    Collaborator

    More actions

    ACCEPT — PR #18016, post-merge delta review PASS

    Epic PM for #15939 · session_015c5G6TmpMKgnusmTpD7Ntt · 2026-09-13T15:50Z. The seventh and last remediation card of the epic.

    review of record	#18016 (comment)
    head judged	1de92aba380312d8f83d0b16b384249fbb6776ca
    prior heads	c3d53951a9 FAIL (5653714585) → efbf300508 PASS (5653949483) → dequeued MERGE_CONFLICT → this
    verdict	PASS, adopted verbatim
    served tier	claude-fable-5-1 × 126 harness stamps, no other model value, lit control 103, dark control 0
    --pair 18016	exit 0
    checks	35 runs, 31 success + 4 skipped, 0 failure; Lint & Repo Gates success

    The primary question — did the merge silently drop #17783's rows? No, by four instruments

    This was the failure mode the whole merge=os-regen discipline exists for, and the review answered it four independent ways rather than once:

    1. Occurrence table — reproduces the 15:13Z baseline cell for cell: 2 / 2 / 6 / 6 / 2 / 14, lit controls 10 and 4, dark 0.
    2. Whole-set difference over entries/ at four trees: 561 → 566 (+5) / 574 (+13) → 579; head is exactly sort -u of the two sides; 0 lost either way.
    3. The generator's own --self-test --check at all four trees — 210/173/178, 211/177/178, 214/182/178, 215/186/178 — the printed line equalling the file-set count at every endpoint, which is what makes the file-list method trustworthy where the generator cannot run.
    4. Sorted line-set proof on registry.ts — main's +452/−9 and the PR's +128/−0 each reappear identically on the other side of the merge.

    ⚠️ A correction to a number I relayed

    The 6s were explained to me as "2 quoted-exact + 2 prefix-of-intervalSeconds" — that sums to 4 and under-counts. The true decomposition is 2 + 2 + 2, the third pair being occurrences on the [RETIRED] comment line. Verified independently here: total 6, prefix hits 2, [RETIRED]-line hits 2.

    ⇒ I passed that "2 + 2" along to the reviewer as an established note. It was caught only because I also told it to verify the decomposition rather than accept it. The conclusion (one registration in the entry, one in the registry) was never in doubt; the arithmetic behind it was wrong and I relayed it.

    The conflict resolution, and the hazard inside the correct remedy

    The merge took main's whole blob (c7a7d1be, 0 markers) and the regeneration added back exactly 128 lines. Prose outside the markers measured 1913 = 1913 and 1928 = 1928.

    ⚠️ check:migration-registry exit 0 proves only registry.ts == f(entries/). It is sufficient only when entries/ is the union of both sides and no prose was edited outside the generated regions on the discarded side. Both were measured true here — but nothing in the tooling checks either, so a hand-edited rationale outside the generated regions on the discarded side would be dropped silently with every gate green. Recorded on #18047 (5654282996), because it qualifies the remedy that card recommends.

    The three earlier fixes survived the merge

    Measured with concatenated literals joined first: spec 17 5 / spec 18 0 in tracing.zod.ts, 3 / 0 in the mdx; 18920 present, 20875 absent; the reword intact. Ratchet unmoved: authorable-surface.base.json byte-identical across ff1e7716c5, current main and head; the authorable dirs differ from both by 0 files — the all-four-nested reading survived a merge, which is exactly where it could have quietly acquired a row.

    Declared limit, honoured

    The reviewer stated Lint & Repo Gates as in_progress at its 15:41Z poll and not read, citing the previous head's green as precedent on the text rather than as a claim about this head. It has since completed success, read here at 15:49Z — so the limit is now discharged by the seat rather than assumed away by the reviewer.

    Landing

    Carriers stripped from both sides first, citing this record, then --pair re-run post-strip, then ready, then enqueue.

    ---

    Generated by Claude Code
16. zhuangjianguo

    removed

    needs:contract-review

    on Sep 13, 2026
17. zhuangjianguo

    closed this as completedin #18016on Sep 13, 2026
18. claude

    removed

    pm:dispatched

    pm:epic

    on Sep 13, 2026
19. zhuangjianguo

    added a commit that references this issue on Sep 13, 2026

    docs(spec): correct the 17.4.0 duration-keys erratum (#18076)

    ...

    bfc744c
20. akarma-synetal

    added 4 commits that reference this issue on Sep 17, 2026

    feat(spec)!: tenant `schemaCacheTTL` carries its unit in the key name (…

    ...

    fc28c1d

    feat(spec)!: RuntimeConfig `resourceLimits.timeout` carries its unit …

    ...

    cbcae14

    feat(spec)!: the four `system/tracing.zod.ts` duration keys carry the…

    ...

    6d64785

    docs(spec): correct the 17.4.0 duration-keys erratum falsified by obj…

    ...

    fb29f62
21. akarma-synetal

    added a commit that references this issue on Oct 7, 2026

    test(spec): the last system/ file group's test titles state each cite…

    ...

    f7b8a59