fix(spec,cli): os validate / os build read the ADR-0087 conversions defineStack applied — --json conversions and --strict see the producer's record

[objectstack-fleet]

Fixes #20476
Clause-②: yes (widening)

defineStack applies every ADR-0087 D2 conversion at load, in both modes, and until now it only said so on stderr. os validate and os build accept only defineStack / composeStacks output (ruling B on #20367), so the stack they received was already canonical and their own step-2 conversion pass found nothing. As a result --json answered conversions: [] for every accepted config, and os validate --strict exited 0 on a retiring spelling.

The fix follows triage's direction. The producer records what it applied, and the doors fold that record in. There is no second conversion pass in the CLI.

What changed

spec (stack-provenance.ts, stack.zod.ts)

• defineStack (strict and strict: false) records every ConversionNotice its load-time pass applied on the stack it returns. The record sits beside the provenance mark under Symbol.for('objectstack.stack.conversions') and is stamped in the same markStackProvenance act. It is non-enumerable, non-writable, non-configurable and frozen, so the strict schema, Object.keys and JSON.stringify never see it. The compiled artifact is byte-identical in size: 1372 bytes before and after on the measured case.
• Each element is the conversion layer's own ConversionNotice, the element the doors' conversions field already declares, not a second shape.
• The record is not subject to the stderr warn-once: a second build of the same source still carries it. A built stack handed straight back to defineStack keeps its record.
• composeStacks: the output record is its inputs' records concatenated in input order, and the same built stack passed twice counts once (a Set over the frozen notices). A single input is returned as-is, record included. Composition converts nothing itself, so this concatenation is the whole of what was applied. Each notice's path stays relative to the defineStack call that applied it, which is the source the author wrote.
• One exported reader: stackConversionsOf(value). It returns [] for any value that does not carry the provenance mark, so a forged record on an unmarked value is not read.
• Regenerated: api-surface/root.json and export-origins/root.json, one line each (check:generated --fix proved exactly these 2 of 15 stale).

cli (utils/config.ts, commands/validate.ts, commands/compile.ts)

• loadConfig reads stackConversionsOf off mod.default beside the mark, before the named-export spread drops both, and returns it as LoadedConfig.stackConversions.
• Both doors fold it into their one conversions sink at a new step 1b, right after the provenance refusal at 1a. The sink stays declared above the try, and every exit still reads it. A throw at load and a refused unbuilt export still report [].
• The doors' own step-2 pass stays, and that is measured, not assumed. A key merged onto the stack from a named export (export const pages = [...] beside a defineStack default) is never seen by the producer, and only that pass converts it. Probe at ba5927f714, before any change: os validate --json --strict on that config exits 1 with one conversions entry. After the change it is still exactly one entry, with no double count.
• The --json envelope keeps its shape. No change to which exports the doors accept.

Verification record

The measured case

A defineStack config whose page:header component authors description (live conversion page-header-subtitle-alias, retiresIn: 18), run through the real CLI (bin/run-dev.js).

run	before (ba5927f714)	after
os validate --strict	exit 0, "Validation passed", notice on stderr only	exit 1, the notice in the ⚠ block, "Strict mode: warnings treated as errors"
os validate --json --strict	exit 0, conversions: []	exit 1, valid: true, warnings: [], conversions: [page-header-subtitle-alias @ pages[0].regions[0].components[0].properties.subtitle]
os validate --json	exit 0, conversions: []	exit 0, the one entry
os build --json	exit 0, conversions: []	exit 0, the one entry; artifact 1372 bytes both sides
canonical control (subtitle)	exit 0, conversions: []	exit 0, conversions: []

Terminal output. stderr carries the producer's defineStack: PATH: 'description' → 'subtitle' (converted at load; …) line exactly once per conversion, before and after. Nothing on the door's side writes a second stderr line, and the flipped pins assert the count is 1. The door's own rendering stays on stdout: the text face now adds one ⚠ line (validate: in the warning block --strict gates on; build: at step 2, as it always rendered its own pass's notices).

Pins flipped (full-repo sweep)

The sweep covered every test asserting conversions: [], or --strict exit 0, on a config with a live conversion. It found exactly the three loss-recording pins. The other conversions pins in the CLI either assert no-conversion fixtures by construction (validate-json-warning-parity.e2e, jsx-gate-manifest-notice.e2e) or belong to os lint (see Acceptance notes).

• test/validate-json-failure-conversions.e2e.test.ts and test/build-json-failure-conversions.e2e.test.ts: expectTheOneNotice now asserts the payload carries exactly the one notice (conversionId, surface, from, to, path, plus code and a numeric retiresIn) and that the producer line appears on stderr exactly once. The negative controls keep asserting []: canonical kind, and throw at load.
• src/commands/validate-json-strict-exit.e2e.test.ts: the conversions-only cell is back to the measurement in its own header. Both --strict faces exit 1 (floor, then parity), valid: true, warnings: [], the one entry. A new no---strict control exits 0 and still lists it. The canonical control is unchanged at [] and exit 0.
• New integration-tier file test/stack-conversion-record-door.test.ts (it runs in PR CI, unlike the nightly .e2e files). Both doors cover four rows: the record across the named-export spread, a composeStacks record, the doors' own pass over a named-export key (exactly one entry), and the canonical control. os validate --strict is checked on both faces.
• New packages/spec/src/stack-conversions-record.test.ts, 16 tests.

Reverse verification

Each fix was committed first. Every mutation went through scripts/ablation-replace.mjs, which requires the anchor to hit exactly once and checks the blob hash before and after. Every restore was proven by blob equal to HEAD and an empty git diff HEAD. Direction observed: red on the record rows, with the pass-only row and the controls staying green.

ablation	mutation (on disk)	result
A: validate.ts fold removed	anchor 1 → 0, blob 0d4bbdf6 → 6bb0e494	door test: 3 red (validate spread row, composed row, --strict both faces) / 7 green (4 build rows, the named-export pass row, canonical controls). Strict-exit e2e: the conversions cell and its no---strict control red. Restored to 0d4bbdf6.
B: compile.ts fold removed	anchor 1 → 0, blob b1ae356a → 5bc31cd6	door test: 2 red (build spread row, build composed row) / 8 green. Restored.
C: defineStack stops recording	anchor 1 → 0, blob ebbad2e7 → ae987e44	spec record test: 12 red / 4 green. The greens are the true controls: canonical, non-objects, a compose of canonical inputs, and the descriptor-shape row. The first run of C left 4 rows vacuously green, so I added anti-vacuity floors and re-ran it. Restored.

A and B run the CLI from src/ (no rebuild on that path). C was measured through the spec unit test, which reads src/. No dist/ ablation was run.

Suites and gates

• @objectstack/spec full suite at a2dce8612c (the merge of origin/main b05743433b): 607 files, 17513 passed, 1 todo, exit 0. Typecheck at the same head, including check:scripts-typecheck and check:test-typecheck: exit 0.
• @objectstack/cli at a2dce8612c:
  • unit tier: 234 files. 232 files passed on the first run. Two published-subpath-* pins exited on the not-built prerequisite, then passed (29 tests) after pnpm --filter @objectstack/cli build.
  • integration tier: 66 files in three chunks, 559 passed, 1 skipped.
  • the three flipped nightly-tier pins (OS_TEST_TIERS=nightly): 3 files, 36 passed.
  • typecheck: exit 0.
• Examples at a2dce8612c, built CLI:
  • examples/app-crm and examples/app-todo: os validate --json exits 0 (valid: true) and os build --json exits 0 (success: true). Both answer conversions: [], with no producer conversion line on stderr.
  • Their --strict exit 1 comes from 9 and 7 pre-existing advisories. This change adds nothing there, since there is nothing to fold.
• Gates at the reviewed head b80dce953b (merge of origin/main f572a7eb3c, which touches no packages/cli file and none of the spec files here; an earlier revision of this line named 1c761c0d71 in error):
  • node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 89 commands, all exit 0.
  • check:dual-build-cjs-loads and check:i18n-coverage first exited 3 (PREREQUISITE NOT MET: other packages' dist/ absent). Both were re-run after a full turbo run build (72/72) and exited 0.
  • --ran reconciles 89 derived, 89 run, 0 NOT-MEASURED, 0 UNRUN.
• Merge-only round (seat-sent): head 9de090d5fa merges origin/main f11b5f20a2 into b80dce953b, to re-run CI after Lint & Repo Gates failed to read the issue board (PREREQUISITE NOT MET). Each of the 13 files keeps its git patch-id --stable (checked by the dev and by the seat), and check:generated is 15/15 at the new head.
• ESLint (--no-inline-config) on the 10 touched TS files at b80dce953b: 10 files, 0 errors, 0 warnings. eslint.config.mjs never enables type-aware linting, so this diff cannot move the verdict of any untouched file. The repo-wide pnpm lint is CI's.

Acceptance notes

• Same family, outside this claim's file surface: os lint --json. It answers conversions: [] on a defineStack config with a live conversion. Measured at ba5927f714 on the same probe: exit 0, conversions: [], producer line on stderr. lint.ts runs its own pass over loadConfig's config and does not read LoadedConfig.stackConversions. The one-line fold is the same as here, but os lint is not one of the two doors the ruling and this claim name, so it is left for the seat.
• A boundary of the carrying shape. A strict defineStack that refuses after converting returns no stack, so there is nothing to carry the record. Measured: that config (requires: ['no-such-capability'] beside the description header) exits 1 with STACK_CAPABILITY_UNKNOWN and conversions: [], and the notice is on stderr only. The run already fails loudly, and the notice surfaces once the refusal is fixed. Reaching the envelope from a refusal would need a second channel (the refusal carrying the notices), which is a design choice outside this change. The stackConversionsOf TSDoc names this boundary.
• Also inherent to the shape: a spread or JSON copy of a built stack drops the record along with the mark. The doors refuse such a copy anyway. defineStack({ ...built, … }) re-marks the copy with an empty record, because the source keys it re-normalizes are already canonical.
• content/docs/deployment/cli.mdx's "Warnings checked" list for os validate names neither conversion notices nor the other advisory classes --strict already gated on. It was incomplete before this change and is not made false by it.
• A config built by an older @objectstack/spec (mark present, no record) reads [] through stackConversionsOf. The doors then behave exactly as before this change for that config.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/spec, touching 11 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/root.json, packages/spec/export-origins/root.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f11b5f20a2ee22698c6647c2fb76aa67e99a7a53.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/spec/api-surface/root.json, packages/spec/export-origins/root.json) — pages documenting those are invisible to this run
• 3 anchor(s) matched too much of the corpus to be a work list: defineStack (symbol, 63 pages), defineStack (literal, 63 pages), os validate (command, 53 pages)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 143 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 88c3ad4f1249cc63c67a42140dab18bd9da49cf2 — the merge of head 9de090d5fae2bb114d4c1e2714f9866c84f68ea2 into base f11b5f20a2ee22698c6647c2fb76aa67e99a7a53, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 88c3ad4f1249cc63c67a42140dab18bd9da49cf2 && git checkout 88c3ad4f1249cc63c67a42140dab18bd9da49cf2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 9de090d5fae2bb114d4c1e2714f9866c84f68ea2 && git checkout -B drift-repro f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 && git merge --no-ff 9de090d5fae2bb114d4c1e2714f9866c84f68ea2

node scripts/docs-audit/affected-docs.mjs --json f11b5f20a2ee22698c6647c2fb76aa67e99a7a53

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f11b5f20a2ee22698c6647c2fb76aa67e99a7a53 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b80dce953b4ed5742c55d30322f17f0295ce12d6
Local-runs: none

Inputs, and nothing else: card #20476 (body; triage 5875680707; park 5876892426; unlock 5882168560; claim 5882191714; os-dev-report 5883869680), #20367 ruling B 5869334748 and its confirmation 5881817230, PR #20579 (body, its one bot comment, the 13-file list) and the net diff against main at merge-base f572a7eb3c (13 files, +857 / −99), origin/main's stack-provenance.ts (blob 3b2367f528, PR #20460's landing), and the check-runs on the head, read once at 2026-09-29T05:02Z. Read-only: git object reads and API reads only; nothing built, run or re-run.

① Derived judgments

Every accept-set and public-surface change the diff implies, judged from the code:

1. @objectstack/spec root gains stackConversionsOf(value) — RIGHT. One reader beside hasStackProvenance, same file, same Symbol.for discipline (two copies of the package resolve one key). It answers [] for an unmarked value (a forged record on an unmarked object is not read — pinned), for a marked value that applied nothing, and for a stack built by an older spec (mark present, record absent: Array.isArray(undefined) is false). markStackProvenance's third parameter is internal to the two producers and not on the package entry — no surface.
2. A second non-enumerable, non-writable, non-configurable symbol property on every built stack — RIGHT, and invisible where it must be: a symbol key is outside Object.keys, JSON.stringify, a spread copy (non-enumerable) and the string-keyed strict Zod parse; the compiled artifact is JSON.stringify output of the parsed stack. Pinned in packages/spec/src/stack-conversions-record.test.ts (descriptor, keys, JSON, ObjectStackDefinitionSchema.safeParse success on a stack that carries a non-empty record, spread and JSON copies reading [] beside a positive control).
3. Freezing each notice IN PLACE — SAFE. Every holder of a notice is read-only: warnConversionNotice derives a string key and prints (stack.zod.ts:3426); formatConversionNotice formats (cli/src/utils/format.ts:1863); the doors push notices into their own conversionNotices array and hand it to emitJson. applyConversions (conversions/apply.ts:182) constructs a fresh object literal per application and retains none, so no registry-shared object is frozen and the warn-once Set holds strings, not objects. A ConversionNotice holds primitives only, so the shallow freeze is total. A grep of packages/spec/src and packages/cli/src (non-test) finds no assignment to a notice field and no Object.assign on one. normalizeStackInput's other callers (lint, info, doctor, migrate meta) receive their own fresh notices from their own pass.
4. The early return for an already-marked stack never drops a record — RIGHT. Neither producer hands markStackProvenance a marked object: normalizeStackInput returns { ...input } (shared/metadata-collection.zod.ts:229), the strict parse yields fresh data, composeStacks builds composed from {}, and its single-input path returns stacks[0] untouched (no re-stamp, so no duplication). defineStack(built) seeds appliedConversions from the input's record and re-normalizes a fresh copy on which the pass fires nothing, so the record is kept exactly once — pinned (outer is a new object carrying the same one entry).
5. No double count, no loss — RIGHT. The producer's output is canonical, and the conversion layer rewrites only a shape it positively recognises (D1, apply.ts header), so step 2's pass cannot re-fire on a site the producer converted. A key loadConfig merges from a named export never reached the producer, so only step 2 converts it, once. Pinned at BOTH doors with exactly one entry per non-empty row (packages/cli/test/stack-conversion-record-door.test.ts: the record across the named-export spread; a composed stack; a named-export key converted by the door's own pass with no producer stderr line; the canonical control at []), and for a second live conversion (page-kind-jsx-to-html) on every failure exit in the two flipped *-failure-conversions.e2e pins.
6. composeStacks record: inputs' records concatenated in input order, one application once by notice identity — RIGHT. Two DIFFERENT built stacks carry distinct notice objects even for equal content (fresh literal per application), so both are listed — pinned ([a, b, c] gives two entries whose order follows the input order and whose identities are the inputs' own). The same built stack passed twice is one application and is counted once — pinned. Nesting, manifest: 'preserve', the single input returned as-is, and an empty compose at [] on a marked artifact are pinned too.
7. LoadedConfig.stackConversions — an internal CLI interface (packages/cli/src/index.ts exports command classes only), read off mod.default before the named-export spread, beside the mark and for the same reason. Not a published-payload key.
8. os validate --json / os build --json: conversions now carries the producer's notices — same key, same element (ConversionNotice), no new key on any exit (validate.ts 7 emit sites, compile.ts 13 emit sites, all reading the one array). Envelope shape unchanged — the claim's ⛔ holds.
9. os validate --strict exits 1 when a producer-applied conversion exists, on both faces — RIGHT: the fold lands in the list the text face's ⚠ block and the JSON exit slot already gate on (validate.ts:769, :858, :887); that class was gated before ruling B landed (the [finding] the conversions-only exit-code cell of os validate --json --strict is documented but untested — every fixture raises zero conversions #11301 cell's own header measured description at exit 1 on both --strict faces), and this restores it for the one shape the door now accepts. os validate without --strict and os build keep exit 0 (build has no --strict flag). refuseUnbuiltStack at 1a and loadConfig's accept logic are untouched, so which exports the doors accept is unchanged — the claim's ⛔ holds and ruling B stands.
10. No second conversion pass was ADDED — CONFIRMED on origin/main: validate.ts:239 and compile.ts:284 already call normalizeStackInput with an onConversionNotice sink at step 2. The diff adds only the two push(...loaded.stackConversions) folds at 1b, after 1a, so a refused export or a throw at load still reports [] — the claim's ⛔ holds.
11. Text faces add one stdout ⚠ line per producer conversion (validate: in the gated block; build: at step 2, where it already printed its own pass's notices from the same array); stderr keeps the producer's one line — the pins count it exactly once per face.
12. Generated artifacts: packages/spec/api-surface/root.json and export-origins/root.json each gain one line, in code-point order, in the sibling format hasStackProvenance already uses; the required TypeScript Type Check job (which runs check:api-surface / check:export-origins) is green on this head, so they are generator output, not hand edits.
13. Unchanged and outside the claim: os lint, os serve, os migrate, os generate, os info, os doctor — see ③.

Pins assert the substance, not the absence of an old assertion. validate-json-strict-exit.e2e: text --strict toBe(1), JSON parity to it, the Strict mode: warnings treated as errors line, valid: true, warnings: [], conversions exactly one entry (page-header-subtitle-alias at pages[0].regions[0].components[0].properties.subtitle, description to subtitle) with a numeric retiresIn, the id in the text face's ⚠ block, and the producer's stderr line exactly once on each face; a NEW no---strict control at exit 0 that still lists the id; the canonical control unchanged at exit 0 and []. The two *-failure-conversions.e2e pins assert toEqual([THE_NOTICE]) over five fields plus code and a numeric retiresIn on every failure exit and on the success control, and one stderr line. Ablations judged from the test code: A (validate fold removed) reds the validate record rows, the strict row and both strict-exit cells while the build rows, the named-export-pass row and the canonical controls stay green (3 red / 7 green in the door test, as reported); B (build fold removed) reds exactly the two build record rows (2 / 8); C (producer stops recording) reds every row carrying a toHaveLength(1) floor or a [HEADER_NOTICE] expectation and leaves the canonical, non-object, compose-of-canonical and descriptor-shape rows green (12 / 4). Each direction is real, none vacuous.

② Semver level

Changeset .changeset/20476-define-stack-conversions-reach-doors.md: @objectstack/spec minor, @objectstack/cli minor; the PR body and the changeset both carry Clause-②: yes (widening).

• @objectstack/spec minor — RIGHT under WHICH LEVEL: a new exported symbol on the root index is a purely additive widening and takes at least minor; the level axis is satisfied by this package.
• Clause-②: yes (widening) — RIGHT. The act that widens is the new root export. The --strict verdict change is not an accept-set narrowing in the repo's sense: nothing the doors accepted is refused (valid: true / success: true, exit 0 without --strict; the retiring spelling still loads, converts and builds), no authorable key, export or config field is removed or renamed, and --strict applies its one documented meaning (content/docs/deployment/cli.mdx:682, "Treat warnings as errors (exit code 1)") to a warning class the text face already folded into the gated block before feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build #20460 landed. No BREAKING banner and no ADR-0087 disposition marker is owed; Check Changeset (level axis, check-adr-0087-registration, empty-changeset guard) is green on this head. Contrast PR feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build #20460's yes (narrowing): that PR refused exports the doors used to accept; this one refuses none.
• @objectstack/cli minor — ADMISSIBLE. The cli act is a behaviour change on two published commands' verdict and payload content, not a surface widening (LoadedConfig is not on the package entry), so the rule's floor is patch; grading above the floor is not refused, minor is the conservative in-window grade for a CI-facing verdict flip, and the fixed group versions in lockstep, so the release outcome is minor from spec either way. The changeset body states what a CI job sees and the one-line fix (author the canonical spelling the notice prints).
• The two generated artifacts are exactly the generator's two lines (① item 12).

③ Boundary flags

open_questions: none declared. Every deviation and out-of-scope finding in 5883869680, answered or escalated:

• Readings pinned to two heads (suites at a2dce8612c; gates, reconciliation and eslint at b80dce953b) — ANSWERED by the head's own CI. The second merge (b05743433b..f572a7eb3c, 53 files) touches no file under packages/cli and none of the spec files here (verified on the merge parents). Check-runs on b80dce953b at the single read: 34 runs — 26 success, 3 skipped by path or opt-in (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failed, and 5 NOT CONCLUDED: Lint & Repo Gates, Test Core (1/6), Test Core (3/6), Test Core (5/6), Test Core (6/6). Green and answering their families: TypeScript Type Check (the spec generated-artifact gates), the four Type Check · jobs (coverage and debt ledgers, so the new and flipped test files are compiled), Check Changeset, Governed Surface Queue Guard (no governed path in the file list), Spec property liveness, Build Core, Test Core (2/6) and (4/6), the three Dogfood shards, Dogfood Verify CLI, Temporal Conformance, the claim and card guards. This record does NOT presume the five in-progress runs green: the Tier S landing waits on them under Prime Directive 14's every-check-green condition, and the new test/stack-conversion-record-door.test.ts and stack-conversions-record.test.ts are answered by the test shards.
• The full spec suite held the verify lock 17m43s — process, no contract effect.
• Ablation A's tier switch and C's anti-vacuity floors (commit a739d6df05) — the floors are in the test (toHaveLength(1) ahead of each invisibility, forgery and compose assertion); judged in ①.
• Beyond the claim's mechanism: defineStack seeds from the input's record; composeStacks dedupes by notice identity — judged RIGHT in ① items 4 and 6.
• Changeset level left open by the dispatch — judged in ②.
• Text faces gain one stdout line per producer conversion — judged in ① item 11.
• Out-of-scope finding 1, os lint --json answers conversions: [] on the card's case — VERIFIED from code: packages/cli/src/commands/lint.ts:948 destructures only config and absolutePath from loadConfig, and :956 runs its own pass over the already-converted config; LoadedConfig.stackConversions is never read there. Correctly OUTSIDE this PR: the card, triage's direction, the claim's file surface and ruling B all name os validate and os build only, and the ruling's confirmation 5881817230 states that widening to lint is a new decision. ESCALATED to the seat: a class (a) defect with a measured reach at a public door, unfiled — file it, or fold it into the family's closure card, under Prime Directive 10; the fold is the same one line.
• Out-of-scope finding 2, a strict defineStack that converts and then refuses loses its conversions from the envelope — VERIFIED from code: the record rides on the value defineStack returns, a refusal returns none, and the doors' catch-all reports the conversionNotices in hand, which is [] because the fold at 1b sits after loadConfig. Correctly OUTSIDE: the run already fails loudly with the family's own code, and carrying notices on the refusal is a second channel — a design choice. ESCALATED together with finding 1 as an item for the family card.
• cli.mdx's "Warnings checked" list for os validate omits conversion notices and the other advisory classes --strict already gated on — pre-existing, docs-only, not falsified by this PR; the seat carries it.
• The claim's three ⛔ lines — no second conversion pass in the CLI, the --json envelope keeps its shape, no change to which exports the doors accept — each held (① items 8, 9, 10).

Implemented-by: claude/issue-20476-define-stack-conversions-reach-doors
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Lint & Repo Gates is red on b80dce953b, and the failure is not this PR's · domain:spec seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-29T05:08Z

• What failed: step chore(deps)(deps): bump the production-dependencies group with 6 updates #189, "Issue citations this change adds resolve on the board" (pnpm check:issue-citations && node scripts/check-issue-citations.mjs), exited 3.
  • The first half is the self-test, which fails with exit 1, never 3.
  • Exit 3 is the second half's PREREQUISITE NOT MET — the board was not read: that run could not read the issue board. That is a transport failure, not a citation verdict.
  • The job log could not be read from this container, so the exact read error is not quoted.
• Why it is not this PR's: the seat ran the same step on this head, b80dce953b, in a scratch clone. It read the board (probed, frontier test(create-objectstack): satisfiesCaret reads a prerelease floor, so the runtime-image agreement holds on a cut-rc version pass #20581) and exited 0: the one citation this change adds resolves. Every other derived family on this head is green or a roster skip, and one shard is still running.
• What happens next: the fleet relay has no re-run op, so the check re-runs through a base-merge round. The dev merges origin/main, which touches none of this PR's files, and pushes. This seat lands the PR only when every check on the new head is green or a roster skip.

---

Generated by Claude Code