[finding][devx] `os migrate meta --from 17` buries a project's real findings under 240 generic protocol-18 notices, and marks default-flip conversions as "Applied" when the right action is usually no edit

[hotlong]

Observed on a real upgrade: HotCRM 17.4.0 → 17.5.0, 2026-09-29

os migrate meta --from 17 printed 874 lines for HotCRM. It ended with "Migrated stack does not yet pass schema validation". The output contained:

• 41 refusals (the actionable part);
• 57 mechanical edits;
• 240 "manual change" notices. These are the entire protocol-18 catalogue (WebSocket durations, kernel.advancedPluginLifecycle, …). None of them applies to this stack.

Three problems for an upgrader:

1. Noise. The 41 refusals that block boot are hard to find among 240 notices about surfaces the stack does not use.
2. Default-flip conversions are presented as edits to apply. The 13 flow-decision-mode-inclusive-explicit edits appear as "Applied". But for a decision whose branch conditions partition, the right action is no edit. Applying the offered mode: 'inclusive' literally then triggers the flow-decision-inclusive-overlap lint on every one. All 13 of HotCRM's decisions partition.
3. No write-back. The mechanical edits say "apply them by hand", so lossless edits still have to be transcribed manually.

Asks

1. Filter the notices to the surfaces the stack actually uses, or at least group them after the actionable findings.
2. Mark semantic default flips as review items, not "Applied".
3. Offer a source-writing mode for lossless mechanical edits.

Related, different concern: #20233 (tracker numbers in the migration text).

---

Generated by Claude Code

[objectstack-fleet]

Path: the road's upgrade step — os migrate meta leads with what blocks the stack | 缺项 (chain.ts hands every semantic entry of every hop to the printer, so 240 catalogue notices bury 41 refusals) | P3

Triage: first grade — tooling · priority:p3 · domain:cli (rerouted from domain:devx) · area:devpath · pm:queue. Direction: order and pair the output, never drop a notice. Ask 3 (write-back) is not taken here

Triage: the printer is packages/cli/src/commands/migrate/meta.ts (:500–:527) ⇒ domain:cli. The shipped surface is os migrate meta, so tooling stays.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T10:09Z. ⛔ Not a claim, ⛔ not a dispatch.

The mechanism.

• packages/spec/src/migrations/chain.ts:102 maps every step.semantic entry into todos, whatever the stack holds.
• SemanticMigration (types.ts:40–51) carries no predicate over the stack, and no link to the conversion it judges.
• So the printer can't tell a relevant notice from the catalogue. And the decision-mode pair (conversion flow-decision-mode-inclusive-explicit, semantic entry flow-decision-edge-branching-first-match, whose replacement reads 「nothing, where the out-edge conditions partition」) prints in two unrelated sections.

Why p3. It is a tax on the upgrade step: nothing wrong is written. The written mode: 'inclusive' preserves the old behaviour exactly, and its semantic entry does say "no edit where the branches partition". It is just buried among 240 other notices.

Direction.

1. Order.
   • Lead with the verdict and the refusals, then the applied mechanical edits, then the semantic notices, with one header line counting each group.
   • ⛔ No notice is dropped. ADR-0087 D3 is "never silence": an entry leaves the list only on a structured, stack-derived proof that its surface is absent. It is ⛔ never removed by prose-matching surface.
2. Pair.
   • Where an applied conversion has a semantic sibling that judges it, print the sibling beside the applied edit, marked review.
   • That needs a structured link that SemanticMigration lacks today, which is a packages/spec field. If the seat takes this, it files the spec child the way spec(stack): a refusing defineStack carries the conversions it applied on its StackRefusalError, so the doors can report them (the spec half of #20583) #20618 was filed for [finding] the conversions defineStack applies still miss two door paths after PR #20579: os lint --json never reads the record, and a defineStack that converts then refuses drops them from --json #20583.
3. Write-back: not taken here.
   • Rewriting an author's TypeScript sources is a new capability, with its own risks (comments, formatting, computed keys).
   • Every listed edit is a D2 conversion that defineStack already applies at load, so nothing fails to boot without it.
   • Re-entry: a D2 conversion is scheduled to leave the load path, at which point the source must carry the edit.

Serial after #20233's PR (pm:dispatched), which rewrites the text this printer shows at meta.ts:519–526.

[objectstack-fleet]

Claim: PM loop round 7 of the domain:cli seat's session local_1d2a197c (batch 3): priority:p3 tooling (the published os migrate meta surface), direction 1 (order); its serial predecessor #20233 has closed
Session: local_1d2a197c-c20e-4e90-9be8-413d4d432289
Account: hotlong
Branch: claude/issue-20620-migrate-meta-order
Worktree: objectstack-issue-20620
Domain: domain:cli
Seat: domain:cli#1
File surface:

• packages/cli/src/commands/migrate/meta.ts: the printer (about :500–:527), ordering and group counts only;
• tests in packages/cli/;
• one .changeset/20620-*.md (@objectstack/cli).

Read-only: packages/spec/** (chain.ts, SemanticMigration). The pairing in triage's direction 2 needs a spec field, so it is not in this PR. Stop on breach and explain in the report
Container & model: S, mode:subagent, model: default tier (dispatch-gates --tier: no path-derived mandate).
Clause-②: no
Thread-read: 5888087153
Serial constraints cleared: #20233 closed. The file lists of all 8 open PRs were read in this act, and none touches packages/cli/src/commands/migrate/. The fleet has no other tooling card in pm:dispatched

Taken 2026-09-29T17:06Z, main 6981abfd26. Executes direction 1 of triage's first grade (5888087153): the verdict and the refusals lead, then the applied mechanical edits, then the semantic notices, with one header line counting each group. ⛔ No notice is dropped (ADR-0087 D3). Direction 2 (pair an applied conversion with its semantic sibling) needs a structured link in SemanticMigration, a packages/spec field, so the dev proposes its shape, and the seat files the spec child the way #20618 was filed for #20583. Direction 3 is not taken, per triage. The PR says Part of #20620.

[objectstack-fleet]

os-dev-report

{
  "issue": 20620,
  "status": "done",
  "branch": "claude/issue-20620-migrate-meta-order",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20691",
  "session": "local_1d2a197c-c20e-4e90-9be8-413d4d432289 (the dispatch-named CLAUDE_CODE_HOST_SESSION_ID of this Mac-hosted run; identity = the branch named in claim 5894939836)",
  "premise_still_valid": true,
  "summary": "Direction 1 is done in draft PR 20691, which says 'Part of #20620'. The human report of `os migrate meta --from N` is now the exported printMigrationReport (packages/cli/src/commands/migrate/meta.ts). It prints three groups, each under one header line that counts it: (1) the verdict plus every schema refusal of the MIGRATED stack, one formatZodIssue line each; (2) 'Applied N mechanical change(s):'; (3) 'N manual change(s) require your judgment:'. No notice or edit line moved inside its group or changed a byte. --json, the exit codes and the loader's stderr are unchanged. The card's premise holds. PM hypothesis H0 is partly false: the verdict was the last line, but the printer never listed a refusal. The only refusal list was the loader's `[authored-source] defineStack()` warning on stderr, printed before the chain. It names the stack as AUTHORED: 6 issues on the scratch stack h1, 4 of which the chain converts. So the refusal group is the one content addition, and 'no line added apart from the headers' (H1) holds for notices and edits only. The two schema-invalid verdict sentences were reworded, because the old one pointed at 'the manual changes above'.",
  "tests": "FINAL HEAD 8304fb9e13 (main 14f80e2395 merged in, pnpm install --frozen-lockfile, CLI closure rebuilt 59/59; later a full turbo build, 72/72): (1) pnpm --filter @objectstack/cli typecheck: exit 0. check:test-typecheck OK (3 files / 28 errors / 6 signatures held in the debt ledger). The new test is in the tsc --noEmit program (tsc --listFiles -p tsconfig.json count 1; tsconfig.test.json does not cover src/**, count 0). (2) pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2: Test Files 2 failed | 233 passed (235), Tests 5 failed | 3358 passed. The 2 failing files are test/published-subpath-console.pin.test.ts and test/published-subpath-hook-body.pin.test.ts. The same 5 fail on a clean worktree at base 6981abfd26 (Tests 5 failed | 24 passed): a macOS /var vs /private/var realpath mismatch, not this diff. (3) dispatch-gates --ran over the 62 derived commands, each recorded with its exit code: '62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN', a DERIVED zero. (4) pnpm lint (full eslint .): exit 0. eslint --format json over the 2 touched .ts files: 2 files, 0 errors, 0 warnings. (5) node scripts/check-issue-citations.mjs --base origin/main: exit 0, 3 citations resolve. AT 7c484d891f (pre-merge; packages/cli identical): (6) the new unit test plus meta.stored-flags.test.ts: 2 files, 16 tests passed. (7) --project integration test/migrate-meta-default-range.test.ts test/migrate-meta-engine-guidance.test.ts: 10 passed, 1 skipped (a registry-selected skipIf, by design). (8) OS_TEST_TIERS=nightly test/migrate-meta.e2e.test.ts: 19 passed. REAL-STACK before/after, bin/run.js, base build 6981abfd26 vs branch build 7c484d891f, same spec, 11 invocations, NO_COLOR, stdout and stderr captured apart: h1 (5 applied, 242 notices, 2 refusals left): before, applied header at line 9, semantic header at line 16, verdict at line 780 (the last line). After, verdict at line 9 plus 2 refusal lines, applied at line 13, semantic at line 20. app-crm: before, semantic at line 9, verdict at line 773. After, verdict at line 9, semantic at line 11. dm (--from 16, 319 notices): before, the verdict came after the data-migration advice at line 1044. After, the verdict is at line 9 and the advice is last. Applied lines equal in number and in order (5=5, 0=0, 1=1), and notice lines equal in number and in order (744=744, 744=744, 996=996). --step and --out likewise. --json is identical minus duration, in the same key order (4 cases). The --out snapshot is byte-identical, stderr is byte-identical in every run, and every exit code was 0 before and after. ABLATION H3, at committed 7c484d891f, through scripts/ablation-replace.mjs wrap mode plus a trap-guarded outer restore: the mutation restores the old order only (body first, verdict last). Anchor 1 to 0, blob 1a002a9b to d80c2332. Result: 3 failed | 5 passed. Exactly the 3 ORDER pins went red ('the verdict is the first line the report prints: expected 1030 to be +0'); the header-count pin and the 4 SET pins stayed green. Restore proven twice (by the tool and by the trap): blob 1a002a9b == HEAD blob, git diff HEAD empty, ABLATION marker count 0. The subject resolves through a relative ./meta.js import to src, so no dist/build leg applies.",
  "mcp_calls": "0",
  "api_writes": "3 — (1) the draft PR create: `gh pr create` under with-fleet, which gh sends as GitHub's GraphQL createPullRequest mutation, not the REST POST /repos/objectstack-ai/objectstack/pulls (see deviations); (2) POST /repos/objectstack-ai/objectstack/issues/20691/assignees → 201 via label-write; (3) POST /repos/objectstack-ai/objectstack/issues/20620/comments via post-stamped (this os-dev-report). The first label-write attempt, run without with-fleet, exited 3 with 'nothing was read and nothing was written'. Plus 4 git pushes (the empty branch, 2 WIP pushes, the merge of main); a git push is not a REST write.",
  "open_questions": [
    {
      "question": "Direction 2 (seat to file as a packages/spec child): which structured link lets the printer show the semantic entry that judges an applied conversion beside that edit, marked review?",
      "options": [
        "A — `SemanticMigration.conversionIds?: readonly string[]` (packages/spec/src/migrations/types.ts), declared on the SEMANTIC side: the ids of the D2 conversions, from this step's or an earlier step's MigrationStep.conversionIds, whose applied edits this entry judges. The printer joins it against MigrationApplication.conversionId, the same name on both sides of the join. A migrations.test.ts assertion refuses an id that resolves to no conversion in the same or an earlier step.",
        "B — `MetadataConversion.semanticIds?: readonly string[]`, declared on the conversion side. The D2 registry is the load path's own table and carries no D3 knowledge today, and a conversion can be judged by several families, so the link would sit in the table that does not own the judgment.",
        "C — no field: pair by finding the conversion id in the semantic entry's prose. Rejected: this is the prose-matching triage bans for filtering. The measured candidates include incidental mentions, e.g. audit-log-action-enum-retired names 3 unrelated conversions as analogues.",
        "D — no pairing: direction 1 alone. The flow-decision residue stays two sections apart."
      ],
      "recommendation": "A. The four axes: (1) Real business need, measured: the pull is HotCRM's 13 flow-decision-mode-inclusive-explicit edits, which are 'Applied' while their judge, flow-decision-edge-branching-first-match, prints about 240 notices away. Over the chain from floor 16 (majors 17 and 18, at 8304fb9e13): 103 chain conversions and 321 semantic entries. 57 candidate pairs by exact-id mention (49 conversions named, 51 semantic entries naming at least one), and 54 conversions named by no semantic entry. These are CANDIDATES for the seat to confirm, not links: C's false positives are in them. (2) Long-term soundness: a structured, contract-first link in the spec, joined by id, with no consumer-side inference. (3) Resistance to AI mistakes: an AI adding a semantic entry must name the conversion explicitly, and an unknown id is refused by an assertion in the existing migrations.test.ts. That is a test, not a new check:* gate. (4) No scope creep: one optional key, one side, no new gate, and it stays empty where nothing is judged. Candidate pairs, as major:conversion ← major:semantic: 17:hook-body-crypto-hash-removed ← 17:audit-log-action-enum-retired;17:dataset-measure-array-string-agg-removed ← 17:audit-log-action-enum-retired;17:action-global-nav-location-removed ← 17:audit-log-action-enum-retired;17:dataset-measure-array-string-agg-removed ← 17:query-array-string-agg-retired;17:sharing-rule-access-level-full-to-edit ← 17:sharing-rule-recipient-reconcile;18:action-aria-removed ← 18:action-aria-retired;18:metric-filters-removed ← 18:analytics-authorable-unknown-keys-refused;18:cube-sub-day-granularities-removed ← 18:analytics-cube-single-granularity-default-enforced;18:api-endpoint-cache-ttl-to-cache-ttl-seconds ← 18:api-endpoint-cache-ttl-unit-in-key;18:chart-config-aria-removed ← 18:chart-config-aria-retired;18:connector-error-mapping-removed ← 18:connector-error-mapping-retired;18:connector-connection-timeout-ms-removed ← 18:connector-provider-context-connection-timeout-ms-retired;18:connector-resilience-keys-removed ← 18:connector-resilience-keys-retired;18:connector-triggers-removed ← 18:connector-resilience-keys-retired;18:connector-triggers-removed ← 18:connector-triggers-retired;18:cube-join-sql-and-relationship-removed ← 18:cube-join-sql-and-relationship-retired;18:cube-member-inner-name-removed ← 18:cube-member-inner-name-retired;18:metric-filters-removed ← 18:cube-metric-filters-retired;18:currency-config-precision-removed ← 18:currency-config-precision-retired;18:dashboard-refresh-interval-to-refresh-interval-seconds ← 18:dashboard-refresh-interval-unit-in-key;18:dashboard-widget-chart-config-structure-removed ← 18:dashboard-widget-chart-config-structure-refused;18:page-component-filter-record-to-rule-array ← 18:element-data-source-and-object-block-filter-rule-array;18:element-filter-removed ← 18:element-filter-and-form-node-refused;18:element-form-removed ← 18:element-filter-and-form-node-refused;18:element-input-target-variable-removed ← 18:element-input-target-variable-retired;18:field-column-lists-canonicalized ← 18:field-inline-and-related-list-columns-closed;18:field-reference-to-alias ← 18:field-reference-to-spelling-retired;18:field-malformed-scale-precision-removed ← 18:field-scale-precision-integer-refused;18:currency-config-precision-removed ← 18:field-scale-precision-integer-refused;18:flow-decision-mode-inclusive-explicit ← 18:flow-decision-edge-branching-first-match;18:form-view-option-default-removed ← 18:form-view-option-default-retired;18:hook-timeout-to-timeout-ms ← 18:hook-timeout-unit-in-key;18:job-timeout-to-timeout-ms ← 18:job-timeout-unit-in-key;18:view-page-mount-removed ← 18:list-view-page-mount-retired;18:list-view-sort-string-clause-to-array ← 18:list-view-sort-string-clause-retired;18:view-list-tabs-removed ← 18:list-view-tabs-retired;18:mapping-lookup-params-removed ← 18:mapping-lookup-params-retired;18:memory-persistence-auto-save-interval-to-ms ← 18:memory-persistence-auto-save-interval-unit-in-key;18:page-component-filter-record-to-rule-array ← 18:object-grid-default-filters-rule-array;18:object-grid-default-sort-removed ← 18:object-grid-default-sort-retired;18:object-kanban-quick-add-removed ← 18:object-kanban-quick-add-retired;18:object-tenancy-organization-field-removed ← 18:object-tenancy-organization-field-retired;18:page-assigned-profiles-removed ← 18:page-assigned-profiles-audience-to-permission-set;18:page-component-responsive-removed ← 18:page-component-responsive-retired;18:permission-allow-restore-purge-removed ← 18:permission-restore-purge-bits-retired;18:permission-rls-tags-removed ← 18:permission-rls-tags-retired;18:record-chatter-position-vocabulary ← 18:record-chatter-position-vocabulary-converged;18:record-highlights-field-icon-removed ← 18:record-highlights-field-icon-retired;18:cube-sub-day-granularities-removed ← 18:time-update-interval-sub-day-retired;18:translation-component-submit-label-removed ← 18:translation-component-submit-label-retired;18:turso-config-timeout-to-timeout-ms ← 18:turso-config-timeout-unit-in-key;18:currency-config-precision-removed ← 18:ui-form-field-precision-scale-integer-refused;18:form-layout-inline-grid-to-vertical ← 18:ui-form-layout-inline-grid-retired;18:report-joined-chart-removed ← 18:ui-report-joined-chart-retired;18:view-item-owner-hidden-removed ← 18:view-item-owner-hidden-retired;18:view-overlay-owner-hidden-removed ← 18:view-item-owner-hidden-retired;18:view-overlay-owner-hidden-removed ← 18:view-overlay-owner-hidden-retired"
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: public door, `os migrate meta --from 17` exits 1 at load with a raw ZodError array whose own message prescribes 'Run `os migrate meta --from 17` to list the mechanical edits…'; named producers: 35 `ObjectSchema.create(` sites across examples/ (app-crm, app-showcase) and HotCRM (src/sales/objects/account.object.ts at hotcrm 087b7c5d) · evidence: the authored-source shim (packages/cli/src/utils/config.ts, DEFINE_HELPER_RE = /^define[A-Z]/) wraps only define* exports, so an object built with ObjectSchema.create that carries a retired key aborts the load before the chain runs. Repro at objectstack 6981abfd26: defineStack({ objects: [ObjectSchema.create({ name: 'cr_ticket', label: 'Ticket', fields: { title: { type: 'text', label: 'Title' } }, tenancy: { enabled: true, organizationField: 'organization_id' } })] }) gives exit 1 with unrecognized_keys tenancy.organizationField. Control: the same object as a plain literal loads, object-tenancy-organization-field-removed applies, and schemaValid is true · dedupe words: authored-source shim ObjectSchema.create; migrate meta load abort retired key; defineHelpersOf DEFINE_HELPER_RE; tombstone prescribes migrate meta that refuses",
    "carrier: 承接者:无 · noted, not filed — docs/qa/platform-checklist/areas/cli.json item cli.migrate-meta-codemod (revision 3) quotes the old invalid-verdict sentence ('resolve the manual changes above') verbatim, and this PR makes that quoted step stale. The acceptance clause still holds. The fix needs a revision bump and a history entry by the checklist's author; recorded in the PR's Acceptance notes",
    "carrier: 承接者:无 · noted, not filed — skills/objectstack-upgrade/SKILL.md lists the printed groups in the old order (applied, manual, verdict). It claims no order and every quoted string still prints. Tier H governed; recorded in Acceptance notes",
    "carrier: 承接者:无 · noted, not filed — `pnpm check:platform-checklist` is red on main (at 6981abfd26 and at 8304fb9e13): areas/identity-auth.json ABSENT SYMBOL packages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor. The gate is maintainer-run, out of per-PR CI",
    "carrier: 承接者:无 · noted, not filed — test/published-subpath-console.pin.test.ts and test/published-subpath-hook-body.pin.test.ts fail on macOS only (a /var/folders vs /private/var/folders realpath), identically on a clean base worktree. CI is Linux"
  ],
  "gates": "At 8304fb9e13: dispatch-gates --repo objectstack-ai/objectstack --ran: 62 derived / 62 run / 0 NOT-MEASURED / 0 UNRUN, every one exit 0. check:dual-build-cjs-loads and check:i18n-coverage first exited 3 (PREREQUISITE NOT MET, dist missing) and exited 0 after a full turbo build. Roster rows that could apply, all exit 0: check-changeset-fixed, check:authz-resolver, check:error-code-casing and check:filter-alias-parity (all ⛔-marked); release-pending-publish --self-test, check:cli-examples-parity, check-platform-checklist-watchdog, check-published-list-mirrors and check:commit-card-trailers. PR-context rows exit 2 without a payload (NOT MEASURED): check-single-claim-paths and check-closing-target-claim. check-partof-closing-keyword was re-run with PR_BODY set to the PR body: exit 0. pnpm lint: exit 0. check-issue-citations --base origin/main: exit 0. Not in the derivation: check:platform-checklist exit 1, pre-existing on main, see findings.",
  "line_budget": "3 files, +462/-78 = 540 changed lines vs merge base 14f80e2395, under the 5000 human-merge threshold. meta.ts is 770 → 860 lines (+168/-78). No governed or ratcheted ledger was touched, and skills/** was not touched",
  "deviations": [
    "The draft PR was created with `gh pr create` under with-fleet, as the dispatch spells it. gh sends that as the GraphQL createPullRequest mutation, so the 'REST only' clause was not literally met for that one write.",
    "The first label-write ran with the fleet env sourced but outside with-fleet: exit 3 (no token), nothing written. It was re-run under with-fleet: 201 and a matching read-back. That was the only label-write that wrote.",
    "The dispatch said to measure on examples/app-crm or app-showcase. app-showcase does not load in this worktree without building connector-slack (not in the CLI closure), so the measurement used app-crm plus two scratch stacks (h1: refusals plus applied edits; dm: data-migration advice).",
    "The integration-tier and nightly e2e runs are cited at 7c484d891f, before the merge of main; the merge brought no packages/cli change. The unit, typecheck, gate, lint and citation readings are at the final 8304fb9e13.",
    "A second, detached worktree at base 6981abfd26 (../objectstack-issue-20620-base) was created for before-readings and control runs, and is removed at cleanup."
  ],
  "files_changed": [
    "packages/cli/src/commands/migrate/meta.ts (+168/-78)",
    "packages/cli/src/commands/migrate/meta.report-order.test.ts (+261, new, unit tier)",
    ".changeset/20620-migrate-meta-verdict-first.md (+33, @objectstack/cli patch, Clause-②: no)"
  ]
}

[objectstack-fleet]

Seat answer to the round's open question: the spec child is filed as #20697. The shape is the spec seat's, and the dev's option A is carried as the proposal

_{domain:cli execution PM seat #6024 · session local_1d2a197c-c20e-4e90-9be8-413d4d432289 · written 2026-09-29T18:00Z. Answers the open_questions entry in this round's os-dev-report, per triage's direction 2 (5888087153: 「If the seat takes this, it files the spec child the way #20618 was filed for #20583」).}

• Direction 2's spec half is filed bare as spec(migrations): a semantic entry names the D2 conversions whose applied edits it judges (SemanticMigration.conversionIds), so os migrate meta can pair them (the spec half of #20620) #20697, a coordination node for triage to route to domain:spec. It carries the dev's option A (SemanticMigration.conversionIds?, declared on the semantic side and joined by id, with a migrations.test.ts assertion) as the proposal, and B and C as read. The measured pull is there too: HotCRM's 13 flow-decision-mode-inclusive-explicit edits, and 57 candidate pairs that are candidates, not links. ⛔ The field's shape is the spec seat's.
• This card keeps the printer's pairing. It is dispatched once spec(migrations): a semantic entry names the D2 conversions whose applied edits it judges (SemanticMigration.conversionIds), so os migrate meta can pair them (the spec half of #20620) #20697 lands and the links are authored. PR fix(cli): os migrate meta leads with the verdict and the refusals, then the applied edits, then the semantic notices #20691 (direction 1) says Part of #20620, so the card stays open for it.
• The out-of-scope finding is filed bare as [finding] os migrate meta aborts at load on an object built with ObjectSchema.create that carries a retired key, although the refusal it prints tells the author to run os migrate meta #20696: os migrate meta aborts at load on an ObjectSchema.create object that carries a retired key, while the refusal names os migrate meta as the remedy. It has a measured repro and a control, and 35 producer sites in examples/ and HotCRM.
• The other notes go to Acceptance notes:
  • the checklist item cli.migrate-meta-codemod quotes the old verdict sentence (a revision bump for the checklist's author);
  • skills/objectstack-upgrade/SKILL.md lists the groups in the old order, with no order claimed (Tier H governed);
  • check:platform-checklist is red on main for twoFactor (maintainer-run, pre-existing);
  • the macOS TMPDIR pins are host-only.
• H0 was partly falsified, and the dev said so: the printer never listed a refusal, and the only refusal list was the loader's stderr warning. So the refusal group is this PR's one content addition, and "no line added apart from the headers" holds for notices and edits. The at-tier review judges that addition.