[finding][spec] Nine flat "rewrite existing sources automatically" sites remain across three published CHANGELOGs — outside #9734's line-specific authorization

[os-warren]

Filed unassigned, observation class, while implementing #9734. Deliberately not edited there: the 2026-08-22 maintainer ruling on #9734 authorized exactly one line and closed with "no blanket sweep".

Why this is recorded rather than fixed

#9734 corrected one shipped false claim in packages/spec/CHANGELOG.md under an explicit, card- and line-specific maintainer authorization to edit a published release artifact. Editing a published CHANGELOG is otherwise not something a dispatched agent does on its own judgment — that is precisely why #9734 sat in needs-user-decision for a day before the ruling.

The census below is the rest of the same defect class. It needs the same kind of decision, not the same PR.

Precedent worth reading first: #11100 recorded an equivalent CHANGELOG-history defect explicitly "so nobody 'fixes' append-only history". "Leave it, recorded" is a fully respectable outcome here.

Census (measured on origin/main @ 353f4e8f, after #9734's one-line fix)

⚠️ The hits are three different things and a search-and-replace would damage two of them. This is the trap the #9734 thread hit twice.

Defect class — flat prescriptions stating the false claim (9 sites)

File	Lines
packages/spec/CHANGELOG.md	5306, 8539, 51610, 51666, 52914
packages/platform-objects/CHANGELOG.md	2564, 5589
examples/app-todo/CHANGELOG.md	254, 2384

Each reads, flat and in the present tense: Run `os migrate meta --from 16` to rewrite existing sources automatically. The command has never rewritten an authored source file (#9529); there is no --write / --fix flag. os migrate meta --write is filed for v18 as #9591 and is pm:on-hold — so the claim is not merely stale wording, it describes a capability that does not exist yet.

Note packages/spec/CHANGELOG.md:51610 is the 17.0.0-rc.2 copy of the very entry #9734 corrected (ad047d2, the app-area fail-open gates retirement). The GA copy and the rc copy diverged long ago — the rc copy already carries its own > **Correction (#5809):** blockquote — so after #9734 the two copies now disagree about the migrate sentence as well.

⛔ NOT defects — quoted in order to retract (do not touch)

• packages/spec/CHANGELOG.md:3791 — os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529's own entry, quoting the withdrawn sentence to retract it; the next line reads "The command has never rewritten an authored source file."
• packages/spec/CHANGELOG.md:5009 — the correction blockquote [finding] Pending changeset migrate-meta-reads-retired-key-sources.md quotes the withdrawn retirement sentence, and a superseded count, in the present tense #9734 just added, same shape.
• packages/lint/CHANGELOG.md:727 — os migrate meta never rewrites the authored sources that 144 shipped retirement messages promise it will #9529's entry replicated into lint's changelog.

⛔ NOT defects — descriptive, quoting the sentence as evidence

• packages/spec/CHANGELOG.md: 33399, 37221, 37263, 44922, 45840, 45857 — the 08863dd / ecc9110 entries describing the [finding][spec] Tombstones over STRIP-only conversions say os migrate meta --from 16 will "rewrite it" — the corpus is split between two verbs for one behaviour #6856 house-sentence sweep, where the sentence is the subject being described.
• packages/cli/src/utils/config.ts:133 — explicitly protected by the [finding] Pending changeset migrate-meta-reads-retired-key-sources.md quotes the withdrawn retirement sentence, and a superseded count, in the present tense #9734 ruling.

The options, if a decision is wanted

• A — leave it, recorded. Published changelogs are append-only history; readers of a 17.0.0 entry are reading what shipped. The retractions at :3791 / :5009 and lint :727 are the mitigation. Zero risk. This is [finding] create-objectstack's CHANGELOG repeats the retired 10.31 pnpm boundary in two shipped release entries — recorded so nobody "fixes" append-only history #11100's disposition.
• B — correct the packages/spec rc/GA divergence only (5306, 8539, 51610, 51666, 52914), same one-line-plus-inline-note form [finding] Pending changeset migrate-meta-reads-retired-key-sources.md quotes the withdrawn retirement sentence, and a superseded count, in the present tense #9734 used, leaving the other two packages alone. Narrower than a sweep; fixes the one place where the same file now contradicts itself.
• C — correct all nine across the three files, same form.

Any of B/C needs the same explicit maintainer authorization #9734 got. ⛔ None of them is a regex sweep — the "not defects" lists above must be excluded by hand, and site-by-site the correct replacement is the house sentence Run `os migrate meta --from 16` to list the mechanical edits for existing sources; apply them by hand.

---

Generated by Claude Code

[claude]

Concentrated triage round: closing not planned — this inherits an existing maintainer ruling rather than needing a new one. The 2026-08-22 ruling on #9734 authorized exactly one line and closed with "no blanket sweep" (quoted in this card's own body); these nine sites are the blanket sweep that ruling declined. #11100 is the standing precedent for the outcome: recorded so nobody "fixes" append-only history. The census stays here as the record; reopen only if the maintainer issues a #9734-style line-specific authorization.

---

Generated by Claude Code