feat(spec)!: retire rowLevelSecurity[].tags — no mainstream platform tags a row-level policy (ADR-0049)

[objectstack-fleet]

Fixes #20321
Clause-②: no (narrowing)

What this does

Retires rowLevelSecurity[].tags (RowLevelSecurityPolicySchema.tags) by the spec-property-retirement route. It is ADR-0049 enforce-or-remove, graded RETIRE by triage (5860425529) under the maintainer's criterion on #18900 (5727134555). Triage's verdict, verbatim: 「Row-level policies carry no tag attribute in the mainstream: Salesforce sharing rules, Dataverse security roles and PostgreSQL RLS policies. Compliance reporting keys on the rule itself. ⇒ RETIRE.」 Retirement is immediate, with no staged window.

The Clause-② line is the seat's measured answer, no (narrowing), which supersedes the claim's yes (5860732909, triage's execution note). scripts/pm/clause2-line.mjs defines the value as the answer to 「本卡放宽接受集或扩大公开面吗」. Nothing widens: the tombstone narrows the accept set, the D2 conversion only heals stored rows the load path already accepted, and no export is added. A policy that carried tags parsed before this change and is refused after it, which is the (narrowing) arm. The changeset carries the same line.

Accept/refuse changes (all pinned)

input	before	after	pin
RowLevelSecurityPolicySchema with tags (any value, [] included)	parsed, stored, read by nothing	refused: invalid_type at ['tags'], with the prescription	rls-tags-retirement.test.ts, rls.test.ts
permission write door (getMetadataTypeSchema('permission') = PermissionSetSchema) with a policy carrying tags	accepted	refused: invalid_type at ['rowLevelSecurity', 0, 'tags'], with the prescription	rls-tags-retirement.test.ts
defineStack with such a permission set	accepted	refused: STACK_SCHEMA_INVALID / 422, issue at ['permissions', 0, 'rowLevelSecurity', 0, 'tags'], with the prescription	rls-tags-retirement.test.ts
the same policy / set / stack without tags	accepted	accepted, byte-identical output, no tags materialized	CONTROL cases in the same file
a near-miss tag	refused as unknown; the did-you-mean offered tags	refused as unknown (unrecognized_keys); the tombstone is never offered (acceptsNothing)	rls-tags-retirement.test.ts
a stored permission row carrying tags	stored verbatim	stripped on rehydration by the D2 permission-rls-tags-removed, then accepted by the write door	rls-tags-retirement.test.ts

The new refusal text, verbatim (RLS_POLICY_TAGS_RETIRED in rls.zod.ts)

rowLevelSecurity[].tags was removed in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — nothing ever read it: the RLS compiler never consulted a policy's tags and nothing else acted on them, so a tag scoped, restricted and reported nothing. Delete the key. A tag never limited whom a policy applies to; to do that, list the positions in positions. A policy is identified by its name and its object; say why it exists in description. Run os migrate meta --from 17 to list the mechanical edits for existing sources; apply them by hand.

The generated .describe() is that text prefixed with [REMOVED] (the retiredKey() helper). It replaces Policy categorization tags in content/docs/references/security/rls.mdx and permission.mdx. A repo-wide grep for the old describe string finds no pin anywhere.

Measured before changing anything (Zone 2 of the dispatch)

Each reading has a lit control on the same ref.

where	ref	readers of a policy's tags	writers of a policy's tags	lit control
objectstack plugin-security / lint / rest / objectql / runtime / metadata* / services src	a78f731a	0. The only tags hits are record-field CEL (size(record.tags)), OpenAPI route tags, and the docs-audience d.tags in meta-item-read-gate.ts, and none of them is a policy.	0 in examples/** and in the plugin-security producers (default-permission-sets.ts, bootstrap-platform-admin.ts, platform-*-policies.ts, permission-set-projection.ts, security-plugin.ts)	.positions read 35 times in plugin-security src; rowLevelSecurity present in all 7 producer files
objectui at the .objectui-sha pin	f8a9d0fb	0. PermissionAdvancedFacets.tsx has 0 tags (its seed is {name,object,operation,using,check,enabled}, and RETIRED_RLS_KEYS is ['priority']). PermissionPreview.tsx renders ${rls.length} RLS rules. permission-slice.ts / clientValidation.ts have 0.	0	facet: .using 3, .enabled 2, priority lit
objectui main	972c1685	0 in all 3 non-test RLS files	0	facet: priority 3, .using 3
cloud main	96eb092f	0	0 (apps/ee-group-showcase security sources)	rowLevelSecurity 1 in each file

So the dispatch's mechanism assumptions 1 and 2 hold. On assumption 3: RowLevelSecurityPolicySchema is a strictObject, so this is not the ADR-0104 silent-strip case. The def is reachable from the permission root, and the precedent one key over (priority) is a retiredKey() tombstone on this same closed shape. That tombstone route keeps the liveness row, which stays dead.

What changed

• packages/spec/src/security/rls.zod.ts: tags becomes retiredKey(RLS_POLICY_TAGS_RETIRED). The const is declared above the lazy schema, per the OS_EAGER_SCHEMAS TDZ rule. The docblock records the census and the mainstream reading. The suggestion-pool comment now names both tombstones.
• ADR-0087:
  • D2 conversion permission-rls-tags-removed in conversions/registry.ts (toMajor: 18, retiredFromLoadPath: true). It is a stripKeys delete over permissions[].rowLevelSecurity[], copy-on-write, with a fixture of 1 notice that is disjoint from every other entry.
  • The D2 is wired into MIGRATIONS_BY_MAJOR[18].conversionIds, and the step rationale is extended.
  • migrations/entries/retired-keys/18.security__RowLevelSecurityPolicy__tags.ts holds the exact key security/RowLevelSecurityPolicy:tags.
  • The family D3 entry is migrations/entries/semantic/18.permission-rls-tags-retired.ts, per ruling B on [Decision] 一次退役，要写一条记录还是两条？—— 迁移条目的 D2/D3 约定，两处成文相互矛盾 #17152: one D3 entry per retirement family, even when D2 is lossless.
  • registry.ts generated regions were regenerated with gen:migration-registry. spec-changes.json and the upgrade guide are byte-identical, because major-18 entries do not project yet (check:spec-changes / check:upgrade-guide green).
• Liveness: liveness/permission.json's rowLevelSecurity.tags row stays dead under its tombstone. It gets verifiedAt: 2026-09-27, evidence pointing at the tombstone, and a REMOVED note in the priority row's house style. The permission row of liveness/README.md gains one sentence. Counts are unchanged, because the row goes dead to dead.
• Generated: authorable-surface/security.json now reads security/RowLevelSecurityPolicy:tags [RETIRED]. Two reference pages were regenerated (check:generated named only check:docs stale).
• Tests:
  • rls.test.ts fixture triage:
    • Two incidental authorings were dropped: the complete-policy and multi-tenant cases.
    • should validate tags was replaced by a refusal pin, because it pinned exactly the retired branch.
    • The GDPR case now asserts that the purpose lives in description and in the predicate, and that no tags comes back.
    • The minimal-policy case asserts that no tags is materialized.
  • New rls-tags-retirement.test.ts (14 cases) covers every door above, the tsc channel (@ts-expect-error, compiled by tsconfig.test.json), the D2 (stored-row rehydration, per-policy scope, measured idempotence, load-path retirement) and the registration. It also has a tree-scoped absence leg with a structural matcher: an object or YAML mapping whose own keys include tags, operation and using/check. The leg has an anti-vacuity battery over 14 specimens and walks the 5 roots already declared for @objectstack/spec#test. It is listed in vitest.repo-tests.json.
• .changeset/20321-rls-policy-tags-retired.md: @objectstack/spec minor, with a BREAKING banner, FROM → TO, and the ADR-0087 disposition registered permission-rls-tags-removed, permission-rls-tags-retired.

No form or i18n edit: permission.form.ts edits rowLevelSecurity as one json widget, with no per-key input. No skill teaches the key. There is no hand-written doc mention: content/docs/permissions/rls.mdx:231's "tags each with kernelTier" is prose about the explain engine. No objectui change is needed: the pin reads nothing of the key and does not import RowLevelSecurityPolicy['tags'].

Verification, at 62fd232a73

Heavy runs went through scripts/pm/os-verify-lock.sh. The spec dist was rebuilt at this head before any dist-reading gate.

• pnpm --filter @objectstack/spec build: VERDICT command-exit 0, tree clean afterwards (no artifact drift).
• pnpm --filter @objectstack/spec run typecheck → exit 0. check:test-typecheck: 53 files, 255 errors, 142 pinned signatures held. So the @ts-expect-error compiles in a real program.
• vitest run --project local: exit 0, 554 files / 16357 tests passed, 1 todo.
• vitest run --project repo: exit 0, 34 files / 618 tests passed. This includes the new retirement file (14/14).
• Consumer suites (contract-face fixture triage), after building their closures:
  • @objectstack/lint vitest run: exit 0, 111 files / 4304 tests.
  • @objectstack/plugin-security vitest run: exit 0, 141 files / 2990 tests.
• Reverse verification (one-time, no file left behind; a trap deletes the probe; git status is clean afterwards): a probe in plugin-security/src resolves @objectstack/spec/security through its exports to the built dist/security/index.d.mts.
  • Typing { …, tags: ['gdpr'] } as RowLevelSecurityPolicy → exit 2, error TS2322: Type 'string[]' is not assignable to type 'undefined' at the tags column.
  • The same literal without tags → exit 0.
  • The expected direction was red, and red was observed.
  • The first attempt was a null op, stated rather than hidden: TS 6 refused the command-line file with TS5112 until --ignoreConfig was passed.
• The dispatch gates were re-derived on the actual change set (dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 62fd232a73, 113 lines). All were run with exit codes recorded, then reconciled: --ran → 113 derived, 112 run, 1 NOT-MEASURED, 0 UNRUN. All 112 run exit 0. That includes check:liveness (86 tombstones reached, all graded with an allowed status), check:generated (15/15 current), check:migration-registry, check:spec-changes, check:upgrade-guide, check:adr-0087-registration --base origin/main, check:changeset-no-major, check:authorable-surface, check:api-surface, check:doc-authoring, check:cross-package-test-inputs, check:nul-bytes and check:type-check-debt (re-measure, 4 entries, none above record).
• The roster gates whose roster sits under a changed directory were also run: check-changeset-fixed, check:meta-url-spelling, check:authz-resolver, check:error-code-casing and check:filter-alias-parity. All exit 0.

NOT MEASURED: check:dual-build-cjs-loads. Reason: PREREQUISITE NOT MET, exit 3. It loads every package's built entry, and 38 workspace packages are unbuilt in this worktree (apps, connectors, most services). That is a whole-workspace build, which is CI's Build Core job.

NOT MEASURED: packages/cli integration tier (migrate-meta.e2e.test.ts replays the chain). This diff touches no bin/ or spawn entry, so it is declared to CI.

NOT MEASURED: packages/qa/dogfood expression conformance. tags carries no expression surface, and the ledger's RLS covers rows name only .using / .check.

main gained one commit (d3958bac, driver-sql only) after the base a78f731a. It is disjoint from this diff and was not merged in.

Acceptance notes (observations, not filed)

• objectui's RLS facet strips only RETIRED_RLS_KEYS = ['priority'] on load. A stored permission row carrying tags is healed before it reaches the editor, because the D2 replays at rehydration, so no path to a refused save is measured. This is an inference only. Carrier: none.
• .claude/skills/spec-property-retirement §0 still says benign display metadata (description, tags, icon) should never be retired. This card was graded RETIRE under the maintainer's later [Decision] Route declared≠enforced work by the SEAM, not the layer — a Seam: line on filing, vertical dispatch by default in the spec lane, automatic parent + sub-issues for spec↔objectui seams, Journey as a filter, bulk retirement per spec family, Console Pin Gate back to required (the maintainer's 「同意」 on the five-line batch, 2026-09-18) #18900 criterion, which asks about the mainstream capability rather than readers. That skill line now contradicts ruled practice for this family. It is a governed surface and the PM's call. Carrier: none.
• authorable-surface.base.json still lists the key without [RETIRED]. That is by design: only gen:authorable-surface-base writes that file, and check:authorable-surface is green.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 14 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/spec/authorable-surface/security.json, packages/spec/liveness/README.md, packages/spec/liveness/permission.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via crm_case (literal, a string literal in fixture))
• content/docs/deployment/cli.mdx (via crm_case (literal, a string literal in fixture))
• content/docs/deployment/seed-tenancy-repair.mdx (via crm_case (literal, a string literal in fixture))
• content/docs/protocol/objectql/security.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))
• content/docs/releases/v17/17-0.mdx (via RowLevelSecurityPolicySchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/spec/authorable-surface/security.json, packages/spec/liveness/README.md, packages/spec/liveness/permission.json, …) — pages documenting those are invisible to this run
• 8 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json eee0974236c87a7232f9805a19b6e53e3e36da59 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 006b56d5a764e21ae26c5fd4306ea294842849c8 — the merge of head 8acd22854ad0bb24f4645ba10cfdc933fa2ddedc into base eee0974236c87a7232f9805a19b6e53e3e36da59, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 006b56d5a764e21ae26c5fd4306ea294842849c8 && git checkout 006b56d5a764e21ae26c5fd4306ea294842849c8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin eee0974236c87a7232f9805a19b6e53e3e36da59 8acd22854ad0bb24f4645ba10cfdc933fa2ddedc && git checkout -B drift-repro eee0974236c87a7232f9805a19b6e53e3e36da59 && git merge --no-ff 8acd22854ad0bb24f4645ba10cfdc933fa2ddedc

node scripts/docs-audit/affected-docs.mjs --json eee0974236c87a7232f9805a19b6e53e3e36da59

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs eee0974236c87a7232f9805a19b6e53e3e36da59 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 53e71951fff1cc15836bbe6b02c12002e3301f77
Local-runs: probe — the seat's brief mandates measured judgments at this tier: build-free tsx reads over src at the head and at the merge-base, git reads of objectui and cloud refs, the two changeset gates, three registry checks and the liveness audit, and ONE lock-held vitest run (a control plus the ablation through scripts/ablation-replace.mjs) for the pin-bite question CI cannot answer; nothing was built

PR #20353 (card #20321), reviewed at the head the brief named; it did not move during the review (read from the PR three times, last after every check run completed). The head is the merge fa1807f9 + 26daf0b0, so the two-dot and three-dot diffs against the base are the same 14 files, +858/−28; its merge-base with the PR base and with current origin/main (d498113b, one commit past the base: #20346, four packages/lint files, disjoint from this diff) is 26daf0b0. Measurements were taken in two detached worktrees under the scratchpad, at 53e71951 and at 26daf0b0 (pnpm install --frozen-lockfile, exit 0 in each), by tsx over src and by git; objectui and cloud were read by git grep / git show against refs only. Both worktrees were removed afterwards.

① Derived judgments

1. Zero pull, re-counted — RIGHT. objectstack packages/** at 53e71951, non-test source: plugin-security/src has ONE tags line, explain-engine.ts:847, a docblock verb ("tags every layer with its kernelTier"), not a key; rls-compiler.ts reads policy.using (3), policy.operation (2), policy.object (2) and, loosely, object 30 / check 29 / using 21 / name 13 / operation 11 / positions 9 / enabled 3 — tags 0. Lit controls on the same instrument: .positions 36 lines and .using 12 lines in plugin-security/src. Across lint, rest, runtime, metadata, metadata-protocol, objectql, core and services/* source, the only tags line adjacent to policy or RLS is packages/lint/src/validate-rls-predicate-enforceability.ts:1406, the CEL record-field example size(record.tags) greater-than 0 inside a message string (the comparison is spelled out here because the body sanitizer eats tag-shaped fragments); no policy.tags-shaped member read exists in packages/*/src or packages/*/*/src. Writers: the six plugin-security producers that spell rowLevelSecurity (bootstrap-platform-admin.ts 1, objects/default-permission-sets.ts 4, permission-set-projection.ts 3, platform-ownership-policies.ts 1, platform-tenant-policies.ts 1, security-plugin.ts 3) spell tags 0 times each; examples/** has one rowLevelSecurity file (app-showcase/src/security/permission-sets.ts) and 16 tags lines, every one a field type, a QA tag, a translation label or a record field — none on a policy. objectui at the .objectui-sha pin f8a9d0fb0596f4521076628e2bbfe27e6ce67d52: the four non-test files that carry rowLevelSecurity — PermissionAdvancedFacets.tsx (tags 0; controls using 5, priority 3; the facet reads pol.object ×5 and pol.using / operation / name / enabled / check ×1; RETIRED_RLS_KEYS = ['priority'] at :71; the seed at :456 is { name, object, operation, using, enabled }), clientValidation.ts 0, permission-slice.ts 0, previews/PermissionPreview.tsx 0 (:115 reads rowLevelSecurity as an array, :168 renders ${rls.length} RLS rules); no file imports the key's type. objectui origin/main 972c1685: the same four files, tags 0 (facet control using 10). cloud origin/main 96eb092f: three files carry rowLevelSecurity (apps/ee-group-showcase/src/security/index.ts, test/group-posture.dogfood.test.ts, docs/design/control-plane-unscoped-object-audit.md), tags 0 in each, and no tags beside policy or RLS anywhere. No reader, no author; the PR body's census (taken at a78f731a) holds at the head.

2. The tombstone refuses at every door and prescribes the right replacement — RIGHT. Measured by tsx on the head source. RowLevelSecurityPolicySchema.safeParse of a well-formed policy plus tags: ['compliance','gdpr']: refused, one issue, invalid_type at ['tags'], message opening `rowLevelSecurity[].tags` was removed in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — nothing ever read it … Delete the key. … list the positions in `positions`. … say why it exists in `description`. Run `os migrate meta --from 17` …; [], ['gdpr'], 'gdpr', null and {} are each refused at ['tags'] with one issue. The permission write door: getMetadataTypeSchema('permission') refuses at ['rowLevelSecurity', 0, 'tags'] (and at index 1 when the second policy carries it), with the prescription; that binding IS the door — protocol.ts:15588 saveMetaItem resolves the schema through resolveOverlaySchema (:704, which returns getMetadataTypeSchema(singular)), safeParses the item (:16184) and throws INVALID_METADATA / 422 carrying issues, and PUT /api/v1/meta/:type/:name is ledgered to meta.saveItem (rest-route-ledger.ts:250, runtime/src/domains/meta.ts:874). defineStack throws STACK_SCHEMA_INVALID, status 422, one issue at ['permissions', 0, 'rowLevelSecurity', 0, 'tags'] with the prescription, and accepts the same stack without the key. A near-miss tag: at base the refusal offered "Did you mean tag → tags?"; at head it is unrecognized_keys naming tag and offering nothing (the tombstone is out of the suggestion pool). Controls, byte-equal base vs head: a select policy carrying every live member (name, label, description, object, operation, using, positions, enabled: false) and an update policy carrying using and check parse to identical outputs on both trees; the permission set holding both parses identically through the door; defineStack on both returns an identical stack; the minimal policy parses identically and no tags is materialised. One probe control had to be corrected: its first form put check on a select policy, which an existing rule refuses on both trees alike — stated so the readings above are known to be the second, valid form. One probe artefact, not a finding: under tsx, getMetadataTypeSchema('permission') === PermissionSetSchema read false at base and head alike (both bound ZodClosedObject, identical shape keys) — a module-instance effect of the probe's import path; the file's toBe pin holds under vitest, where CI's Test Core ran it green.

3. The D2 conversion heals stored rows and only that — RIGHT. The real load path is applyConversionsToStoredItem: packages/metadata/src/loaders/database-loader.ts:825 (rowToData) and metadata-protocol/src/protocol.ts:4782 (convertStoredItemDetailed) both call it for every stored type but flow, and it wraps a permission row as { permissions: [row] } and replays with includeRetired: true (conversions/stored.ts:100–104). Measured through that primitive at the head: a stored permission row whose two policies carry tags → two notices, permission-rls-tags-removed at permissions[0].rowLevelSecurity[0].tags and [1].tags, both policies equal their input minus tags, the set's other keys byte-equal, and the healed row is accepted by the write door; at base the same row passes through with 0 notices and tags kept. Touches no other key: a wide stack (a permission set with adminScope and description, an object whose fields has a tags column) replays to exactly the input minus the policy tags, with no notice from any other conversion. Fixture: replaying the WHOLE table (includeRetired) over before equals after exactly, 1 notice = expectedNotices, every notice owned by this id; the live-window replay (default load path) leaves before untouched with 0 notices — the second half of the disjointness contract. Replaying the converted stack a second time yields 0 notices and returns the same reference (copy-on-write, stripKeys). toMajor: 18 equals the step it is wired into; retiredFromLoadPath: true; surface is prose.

4. Nothing else narrowed — RIGHT. z.toJSONSchema (input and output) of RowLevelSecurityPolicySchema and of PermissionSetSchema, base vs head: exactly three differing leaf paths per schema, all under the tags node — description → [REMOVED] …, type: "array" gone, items.type gone (and not: {} added); the required lists are unchanged (name, object, operation; output adds enabled on both trees). authorable-surface/security.json moves one row (security/RowLevelSecurityPolicy:tags → … [RETIRED]). Step-18 conversionIds: the base's 38 ids are a prefix of the head's 39, in order, with permission-rls-tags-removed appended; every id resolves to a conversion with toMajor 18, and every CONVERSIONS_BY_MAJOR[18] entry is wired; the id is unique in the table. RETIRED_KEYS_BY_MAJOR[18] 190 → 191, sorted, unique, the key present under no other major; MIGRATIONS_BY_MAJOR[18].semantic 222 → 223, sorted by id, unique, the D3 present under no other major. Merge-tree: a driverless bare clone (git clone --bare of the local repository, no merge driver in its config; main fetched from GitHub = d498113b) — git merge-tree --write-tree d498113b 53e71951 → tree 3f275ff5, exit 0, no conflict; in that merged tree all 14 PR files have the same blob as at HEAD (so the generated regions and registries in the merged tree are the ones measured here: check:migration-registry current at 300 semantic / 220 retired-key / 199 retired-def, sorted and resolving as above), and fix(lint)!: refuse an RLS predicate that compares a field with a json or multiple field when it is authored #20346's four files do not overlap the diff. Three PR files are merge=os-regen routed (two reference .mdx, security.json); irrelevant to the driverless probe, and byte-identical in it.

5. Liveness and ledgers — RIGHT. liveness/permission.json rowLevelSecurity.tags: status: dead, verifiedAt: 2026-09-27, evidence pointing at the tombstone in rls.zod.ts, note opening REMOVED 2026-09-27 (#20321, ADR-0049 enforce-or-remove … in the priority house style, naming the D2 and why the row stays; the permission row of liveness/README.md gains one sentence. Local at the head: check:liveness exit 0 — 88 [REMOVED] tombstones reached and 88 graded with an allowed status (the precedent read 87; this key is the 88th), state-counts.md current (40 rows); gen:liveness-counts regenerates to an empty diff (permission 36 live / 6 dead / 42 classified, unchanged — dead to dead). CI at the head agrees: Spec property liveness success with the same lines, plus check:strictness-ledger current. check:generated currency read off CI's Type Check · source gates job (success) per constituent step: the check:/gen: classification reconcile, spec-changes.json, the upgrade guide, the authorable key surface, the generated reference docs (check:docs), the skill references, react-blocks, template manifests, objectui pin citations (47 match f8a9d0fb0) and llms.txt — every step success; Migration registry matches its entry files success in Lint & Repo Gates. Locally at the head: check:migration-registry current, check:spec-changes up to date, check:upgrade-guide up to date (major-18 entries do not project yet, so no projection change was owed).

6. Pins bite — RIGHT. Registration first: packages/spec/vitest.repo-tests.json gains src/security/rls-tags-retirement.test.ts; the repo project's include IS that list (vitest.config.ts:89–90), test:repo runs it, and CI's Test Core runs turbo run test test:repo on every shard (ci.yml:725). The file's tree-scoped absence leg walks the five roots the @objectstack/spec entry of scripts/cross-package-test-inputs.mjs declares per extension (packages/**/*.{ts,mts,cts,js,mjs,cjs,json,md,mdx,yaml,yml}, examples/**/*.{json,md,mdx,yaml,yml}, content/**, skills/**, scripts/**) — the same extension sets the walk scans — with anti-vacuity (more than 1000 files visited, more than 20 of them spelling rowLevelSecurity) and a 14-specimen matcher battery; check:cross-package-test-inputs runs in Lint & Repo Gates (success). Its one ledger exclusion, packages/spec/liveness/, is justified by measurement: parsed as JSON, permission.json's $.props.rowLevelSecurity.children is an object whose own keys include tags, operation, using and check — exactly the structural signature — and it is the row the tombstone route requires to stay. Ablation, ONE leg, through scripts/ablation-replace.mjs in WRAP mode, held under os-verify-lock.sh (acquired on the second ticket after 281 s of queueing; held 14 s): anchor tags: retiredKey(RLS_POLICY_TAGS_RETIRED) in rls.zod.ts (hits 1, as declared) → tags: z.any().optional() ?? retiredKey(RLS_POLICY_TAGS_RETIRED) (anchor 1 → 0, blob febec4e6 → 2878c13c, the tool's own on-disk proof), running vitest run --project repo src/security/rls-tags-retirement.test.ts: 6 failed | 8 passed — the policy-schema refusal, the value-shape battery, the permission write door, the defineStack envelope, the did-you-mean pin (the pass-through re-enters the suggestion pool, so tag → tags is offered again) and the tsc pin's parse leg went red; the controls, the three D2 legs, the registration and the tree walk stayed green, as they must. Control before the mutation, same file, same project, same lock hold: 14 / 14. Restore proven twice: the tool's blob == HEAD and empty git diff HEAD, and independently git hash-object = febec4e618cd73086460f683ca01d9e4bcaf0d1b = HEAD:packages/spec/src/security/rls.zod.ts, the anchor count back to 1, git diff HEAD --stat and git status --porcelain both empty. Three earlier tickets (a separate control, a separate ablation, and the first ticket of the retry loop) timed out in the queue at exit 99 without ever acquiring the lock; the file was never mutated by them (blob equal to HEAD throughout) and they are not counted. The @ts-expect-error compiles in a real program: tsconfig.test.json is the project check:test-typecheck compiles, run by the spec typecheck script inside CI's Type Check · workspace (success).

7. Changeset / semver — RIGHT. .changeset/20321-rls-policy-tags-retired.md: @objectstack/spec: minor; Clause-②: no (narrowing) as the first line after the title; a **BREAKING** banner; a FROM → TO table; the one-line fix; and exactly one ADR-0087 marker, an HTML comment reading adr-0087: registered permission-rls-tags-removed, permission-rls-tags-retired. node scripts/check-changeset-no-major.mjs --base 26daf0b0 exit 0 (no major; its level axis is PR-scoped and reads on CI, where Check Changeset is success on all three runs); node scripts/check-adr-0087-registration.mjs --base 26daf0b0 exit 0, reading [BREAKING+bang+clause-②-narrowing] registered permission-rls-tags-removed, permission-rls-tags-retired (new here: both). Every sentence checked against a measurement: the compiler's reads (name, object, operation, positions, enabled, predicates; tags 0) match ①; the preview count and the editor's seed and reads match ①; "no example, default permission set or cloud source wrote it" matches ①; "refused at parse, with the prescription" matches ②; the D2 as a lossless, load-path-retired delete over permissions[].rowLevelSecurity[] matches ③; the registry entries match ④; the row staying dead matches ⑤; [RETIRED] and the regenerated pages are in the diff; os migrate meta --from 17 is the toMajor 18 spelling (the sibling priority tombstone at 17.0.0 says --from 16); 17.5.0 is the next minor from 17.4.0 and the spelling of the nine other 17.5.0 tombstones already on this release; the launch-window sentence matches check-changeset-no-major.mjs's own header; "out-of-repo consumers NOT MEASURED" is an honest bound. The PR body's clause line and the changeset agree; the claim's yes (triage's execution note) is superseded by the seat's measured no (narrowing), and both gates read the same disposition either way.

8. CI at the head — RIGHT. Waited until every run completed (last completion 2026-09-28T02:20:05Z): 46 check runs on 53e71951, 39 success, 7 skipped, 0 failure, 0 cancelled. The skips are all expected: Packed-tarball smoke (opt-in) twice (opt-in), Auto Label and Check PR Size on the two secondary workflow runs (both ran and passed on the primary), and Console Pin Gate (the objectui pin did not move). The seven required contexts are success — Lint & Repo Gates, TypeScript Type Check (with source gates, workspace, consumer gates, debt ledger), Test Core (with shards 1/6–6/6, which run turbo run test test:repo, the population that holds rls-tags-retirement.test.ts), Dogfood Regression Gate (1–3/3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard — plus Build Docs, Dogfood Verify CLI, Check Changeset ×3, Spec property liveness, Check Documentation Links, Flag docs affected by code changes, the four claim / single-writer guards and filter. Vercel commit status: success. No red to name.

② Semver level

minor + declared breaking is right. The diff narrows a published accept set — RowLevelSecurityPolicySchema, the permission write door and defineStack refuse a key they accepted — and widens nothing: no export is added, no accept set grows, and the D2 heals only rows the load path already accepted; the ADR-0087 registrations are ledger data, as the two nearest retirements (#20343 / #20295, #20238) declared them. Clause-②: no (narrowing) is the measured value and supersedes the claim's yes; the gates read the same disposition (registered) either way. patch would be wrong (a refusal of previously accepted input); major is refused by check-changeset-no-major in the launch window, and the breaking-ness is carried by the banner, the (narrowing) arm and the ADR-0087 marker.

③ Boundary flags

• Out of scope, named only: [finding] spec-property-retirement §0 says benign display metadata (description, tags, icon) is never retired, which contradicts the maintainer's #18900 ④ criterion (retire by mainstream capability) that triage applies to every family card #20354 (skills lane, bare) — the retirement skill's §0 says benign display metadata (description, tags, icon) is never retired, which contradicts the [Decision] Route declared≠enforced work by the SEAM, not the layer — a Seam: line on filing, vertical dispatch by default in the spec lane, automatic parent + sub-issues for spec↔objectui seams, Journey as a filter, bulk retirement per spec family, Console Pin Gate back to required (the maintainer's 「同意」 on the five-line batch, 2026-09-18) #18900 ④ criterion triage applied to this card. Not re-measured here.
• getMetadataTypeSchema('permission') identity: the file's third pin asserts toBe(PermissionSetSchema); under tsx that identity read false on both trees while the refusal read true. It holds under vitest (CI green), so it is a probe-environment artefact and not a defect; a future reader who sees it flip should look at module instances before the binding. Carrier: none.
• The tree-scoped absence walk excludes two DIRECTORY prefixes, packages/spec/src/conversions/ (the D2 fixture's home, but also every other conversion and its tests) and packages/spec/liveness/ (the ledger row that must stay; measured, the structural matcher fires on permission.json's rowLevelSecurity.children object, whose own keys are tags, operation, using, check). Both are kit or classification surfaces; the exclusions are justified, and the prefixes are wider than the one file each names. Carrier: none.
• objectui's RLS facet at the pin strips only RETIRED_RLS_KEYS = ['priority'] on load; a stored tags is healed one seam earlier, in database-loader.ts's rowToData (the seam measured in ③), before the editor sees it. Consistent with the dev's inference; measured at the primitive, not in a browser. Carrier: none.
• main moved by one commit (d498113b, fix(lint)!: refuse an RLS predicate that compares a field with a json or multiple field when it is authored #20346) after the PR's base; it touches packages/lint only and the driverless merge is clean.

Implemented-by: claude/issue-20321-rls-tags-retire
Reviewed-by: session_01Rjy9MeetSfq34PKn81CRiN

VERDICT: PASS

[objectstack-fleet]

Seat verification: base-merge round · head da5d40167a424199394a4298a726638beb52fbfd adopts the at-tier record 5862589446 · 2026-09-28T04:27Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN). The at-tier review PASSED at 53e71951 (record 5862589446). The queue removed the PR at 03:31Z with MERGE_CONFLICT after PR #20262 (569d4d2d) landed, because both add to conversions/registry.ts and the step-18 conversionIds. This round only brings main in, so the seat verifies that the increment is unchanged instead of re-reviewing the contract.

What the round is. Merges of 569d4d2d, a88a1bb3 and 862b6ce8, each through scripts/pm/os-regen-merge.sh (no rebase, no force-push), plus 4e3412f0, which regenerates rls.mdx / permission.mdx from the merged tree.

• conversions/registry.ts keeps main's file whole, with this PR's permissionRlsTagsRemoved block re-inserted byte for byte.
• The step-18 list is main's, in order, with permissionRlsTagsRemoved appended.
• conversionIds is main's, in order, with permission-rls-tags-removed appended.
• The generated regions come from gen:migration-registry.

Verified by the seat

• Three-dot increment: git diff --stat of 53e71951 against its merge-base and of da5d4016 against origin/main are byte-identical: 14 files, +858/−28.
• Per-file identity: the added and removed lines of each file's increment hash identically at both heads, except migrations/registry.ts. There the one moved line is the joining period: the rationale's previous last sentence, now feat(spec)!: form layout accepts only vertical | horizontal — the inline and grid arms retired (#20221) #20262's form-layout sentence, ends '. ' so that this PR's RLS tags sentence follows it.
• Driverless merge-tree onto the current main 862b6ce8 (a bare clone, no os-regen driver): exit 0, adding exactly the PR's 14 files, +858/−28.
• The dev's checks at da5d4016, exit 0:
  • the spec build;
  • conversions, migrations and rls suites: 581 tests, including the fixture-disjointness replay;
  • rls-tags-retirement.test.ts 14/14;
  • check:migration-registry, check:generated 15/15, check:liveness, check-adr-0087-registration.

The contract judged in 5862589446 is unchanged at this head. Auto-merge is re-enabled once CI at da5d4016 is green or shows only expected skips.

[objectstack-fleet]

Seat verification: base-merge round 2 · head 8acd22854ad0bb24f4645ba10cfdc933fa2ddedc adopts the at-tier record 5862589446 · 2026-09-28T05:12Z

domain:spec seat 1 (session_01Rjy9MeetSfq34PKn81CRiN). PR #20251 landed as 67c98f6a, and a merge of da5d4016 onto it conflicted in the shared step-18 lists, so auto-merge stayed off. This round brings main (eee09742) in once more.

• The round. Merge eff5fc61 (through os-regen-merge.sh), then 8acd2285, which regenerates the migration registry's generated regions (302 semantic / 221 retired-key / 199 retired-def).
  • conversions/registry.ts keeps main's file whole, with permissionRlsTagsRemoved appended after currencyConfigPrecisionRemoved.
  • conversionIds is main's, in order, with permission-rls-tags-removed appended.
• Three-dot increment: byte-identical to 53e71951 (the reviewed head): 14 files, +858/−28.
• Per-file identity: the increment's lines hash identically except for the one joining-period line in migrations/registry.ts, now on feat(spec)!: retire currencyConfig.precision — a currency's decimal places are its currency's (ADR-0049) #20251's rationale sentence.
• Driverless merge-tree onto the current main eee09742: exit 0, adding exactly the 14 files.
• The dev's checks at 8acd2285, exit 0:
  • the spec build;
  • conversions, migrations and rls: 583 tests, including the fixture-disjointness replay and the ruling-B census pin;
  • rls-tags-retirement.test.ts 14/14;
  • check:migration-registry, check:generated 15/15, check:liveness, check-adr-0087-registration.

The contract judged in 5862589446 is unchanged at this head. Auto-merge is re-enabled once CI at 8acd2285 is green or shows only expected skips.