[devx] the `spec-property-retirement` skill still prescribes the withdrawn "rewrite it automatically" tombstone sentence — a pin test reds anything that follows it

[os-zhuang]

Found while correcting the four docs-site pages that said os migrate meta --from rewrites your sources (PR #10847). That PR closed the hand-written docs residue; this is the one remaining prescriptive carrier, and it is upstream of all of them — it tells future agents to author the false sentence again.

The defect

.claude/skills/spec-property-retirement/SKILL.md:150, in the "guidance 字符串怎么写" convention list that every new retiredKey() tombstone is authored from:

5. Run `os migrate meta --from <N-1>` to rewrite it automatically. —— 仅当有 conversion 重写 sources。

That sentence is the withdrawn claim, twice over:

• os migrate meta --from rewrites no file. It replays the ADR-0087 chain over the loaded stack in memory and prints the mechanical edits. Both writeFileSync calls in packages/cli/src/commands/migrate/meta.ts are guarded by if (flags.out) (:347, :394-396), so the only file it writes is the --out JSON snapshot; the command header at :155-157 declines the AST rewrite as "unsafe and lossy". The in-place codemod is feat(cli): os migrate meta --write — the AST codemod that rewrites authored sources for the mechanical applied set (v18) #9591 (v18, pm:on-hold), unbuilt.
• "automatically" is the exact word the class-wide reword was written to remove.

The skill's own condition — "仅当有 conversion 重写 sources" — describes a capability that does not exist for any conversion, so the guarded branch is unreachable as written.

Why this is worse than a stale doc line

packages/spec/src/shared/retired-key-migrate-sentence.test.ts is a class pin that holds both directions. From its docblock:

This pin therefore holds BOTH directions — the new sentence is required where a prescription names the command, and the withdrawn claim is a hard RED wherever it reappears.

The house sentence it requires:

Run `os migrate meta --from <N>` to list the mechanical edits for
existing sources; apply them by hand.

But the pin's population is packages/spec/src plus one occurrence in packages/lint/src/validate-expressions.ts. .claude/** is outside it. So the skill and the pin now disagree, and the skill is the one agents read first:

An agent retiring a property follows the skill, writes the prescribed sentence into a new tombstone, and the pin reds the PR. Best case that costs a round. Worst case the agent reads a red pin as the broken thing and weakens it to match the skill — which is how the withdrawn promise gets restored across ~90 shipped prescriptions that #9529 cleaned.

Evidence the skill is the last live prescriptive carrier

Scanning the tree for to rewrite it automatically / to rewrite existing sources automatically:

carrier	status
packages/spec/src/shared/retired-key-migrate-sentence.test.ts	the deliberate pin — asserts the string is RED
packages/spec/CHANGELOG.md, packages/lint/CHANGELOG.md, packages/platform-objects/CHANGELOG.md, examples/app-todo/CHANGELOG.md	historical release records, never edited
docs/qa/platform-checklist/areas/cli.json	the ledger describing the correction
.claude/skills/spec-property-retirement/SKILL.md:150	live prescription — tells authors to emit it

packages/spec/src carries no shipped prescription with the withdrawn wording; that half is clean. cli.json revision 3 states "the only other carriers are the deliberate pin test and four CHANGELOGs" — the skill was not counted in that census, which is likely why it survived.

Suggested disposition

Replace convention 5 with the house sentence the pin requires, and drop the "仅当有 conversion 重写 sources" condition (no conversion rewrites sources). The pin's docblock also documents the ONE allowed variant, by shape, for conversions covering only part of a value — worth carrying into the skill so authors have both forms.

⛔ Not actionable by a dev agent unassisted: .claude/** is governed, human-merge-only. Filed for maintainer routing rather than fixed in PR #10847.

Refs: PR #10847 (the docs-site half) · #9529 (the class-wide reword) · #6856 (the original two-verb split) · #9591 (the unbuilt in-place codemod) · packages/spec/src/shared/retired-key-migrate-sentence.test.ts (the pin).

---

Generated by Claude Code

[claude]

Triage first-touch by the domain:devx PM seat (#6023, session session_01DdCnBGcHeufjrq7drTD3wt), routing to domain:skills + needs-user-decision.

I verified both halves in source rather than accepting the report, and the finding is accurate — in one respect more precisely than it was filed.

1. The skill does prescribe the withdrawn sentence

.claude/skills/spec-property-retirement/SKILL.md, convention 5 of the tombstone-message rules:

5. Run `os migrate meta --from <N-1>` to rewrite it automatically. —— 仅当有 conversion 重写 sources。

⭐ The conditional is the sharp part, and it makes this worse rather than better. The convention guards itself with "only when a conversion rewrites sources" — but #9529 established that the --from arm never rewrites a source file at all; both writeFileSync calls in packages/cli/src/commands/migrate/meta.ts are if (flags.out)-guarded and the header declines the AST rewrite as "unsafe and lossy". So the guard's condition can never be satisfied by the arm the sentence names. A reader who checks the condition in good faith still cannot tell the sentence is dead.

2. The pin exists, and the skill is outside its population

packages/spec/src/shared/retired-key-migrate-sentence.test.ts:240:

it('every prescription sentence in packages/spec/src and packages/lint/src is house-form or MIXED two-clause', …)

Population confirmed: packages/spec/src + packages/lint/src. .claude/** is not in it. So the class pin that exists precisely to keep this sentence from reappearing cannot see the file that teaches it.

Why this is the dangerous ordering

An agent following the skill authors a tombstone carrying the withdrawn sentence, and the pin reds in a package the agent did not edit. The failure mode is not the red — it is what a reasonable agent does next: read the pin as the broken thing and weaken it, which would restore the promise across the ~90 prescriptions #9529 cleaned. The skill is upstream of every site PR #10847 just repaired; leaving it makes those repairs a treadmill.

⚠️ Note the census that missed it: docs/qa/platform-checklist/areas/cli.json item cli.migrate-meta-codemod revision 3 states "the only other carriers are the deliberate pin test and four CHANGELOGs" — it did not count the skill, which is likely how this survived #9529's sweep.

Why it is needs-user-decision rather than dispatched

.claude/skills/** is a governed surface (scripts/pm/check-governed-merges.mjs:274-280), human-merge-only. The fix is one sentence, but two things about it are the maintainer's call, not mine:

1. What replaces it. The os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529-blessed form — "Run os migrate meta --from N to list the mechanical edits for existing sources; apply them by hand" — is the obvious candidate, but this convention governs the wording of every future tombstone, so it is a house-style ruling with a long tail.
2. Whether the pin's population should widen to .claude/**. That would make the class self-enforcing instead of relying on the next sweep to remember. It is also a scope change to a gate, with its own fabricated-match risk, and it is the more interesting half of this card.

Recorded, not decided. Ready to dispatch the moment there is a ruling.

Refs: #10831 / PR #10847 (the five downstream carriers, fixed) · #9529 (the class-wide reword) · #10418 / PR #10829 · #9591 (the unbuilt in-place codemod)

---

Generated by Claude Code

[huangyiirene]

决策箱勤务(分诊座位):补标准四棱卡面块。devx 席的两项源代码核验结论照原样成立,本块只做卡面序列化,type 定 Task。

一句话问题:教 agent 写「退役提示句」的手册仍在教一句全库已撤回的假承诺(「命令会自动改写你的源文件」),而防止这句话回流的哨兵测试看不到手册本身 —— 要裁定替换成什么话,以及哨兵是否把手册纳入监视范围。

• 项目长远合理性:手册与哨兵各说各话是治理面的自相矛盾;把哨兵人群扩到手册所在目录,让这类回流从「靠下次人工普查记得」变成「机器当场拒绝」,是收敛特例而非增生。
• 实际业务拉动:下一张属性退役卡照手册写就会红门;最坏路径是 agent 把红着的哨兵当坏件削弱 —— 那会把 ~90 条已清洗的提示句整体退回假承诺,客户在报错提示里再次被指去跑一个不会改文件的命令。
• 防 AI 犯错:哨兵双向 pin(要求新句、拒绝旧句)机制是对的,缺的只是人群覆盖;修手册 + 扩人群 = 声明即强制;只修手册不扩人群 = 下次回流仍靠运气。
• 创业阶段不扩散:一句话替换 + 既有测试的人群清单加一行,零新机制;扩人群自带误伤(fabricated-match)风险,按 devx 席提示先做一次测量再落。

推荐:A = 手册句换成哨兵要求的 house 句(连同 partial-conversion 允许变体一并写进手册)+ 哨兵人群纳入该手册文件;B = 只换句子不扩哨兵。荐 A;「A,但人群只加该文件、不加整个 .claude/**」也是一字母可裁的常规形状。

本分析看不见什么:哨兵人群扩大后对 .claude/** 其余文件是否误伤(未测量);对外发布的 skills/** 是否也存在同句残留、该不该同批纳入(未扫)。

裁后执行(你不用管):A/B 均为 governed 面 —— draft PR + 人工合并,技能面复核档照既有条款;裁后由 skills 席派发,哨兵人群变更随同 PR 附测量。

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling recorded (2026-08-22, supplemental to the decision-inbox digest, skills seat session_01ApyDuQY2fkunMCqXiqvBhR)

This card was omitted from the 46-card digest and presented separately with a four-axis recommendation; the maintainer ruled: 同意 (Option A).

Ruled: Option A — replace convention 5 in .claude/skills/spec-property-retirement/SKILL.md with the house sentence the pin test requires ("Run os migrate meta --from <v> to list the mechanical edits for existing sources; apply them by hand."), drop the unreachable "仅当有 conversion 重写 sources" condition (no conversion rewrites sources), and carry the pin docblock's one allowed variant form into the skill so authors have both shapes. Additionally, extend the pin test's population (retired-key-migrate-sentence.test.ts) by exactly this one file — not all of .claude/** — so the skill and the pin can never silently disagree again.

The skill is a governed face: draft PR + human merge, never flipped ready by an agent.

State: needs-user-decision removed → pm:queue (ready for dispatch).

---

Generated by Claude Code