feat(spec): retired-defaulted-key tolerance — the retired default parses as inert residue and strips; non-default values keep the loud refusal (#12497 class rule)

[os-zhuang]

Part of objectstack-ai/cloud#1653 (via cloud#1685 — the ruling record with the maintainer's three-question rationale lives there; read it first).

Deliverable — retired-defaulted-key tolerance (a CLASS rule)

The #12497 retirement of allowRestore/allowPurge currently refuses the keys outright (expected: 'never', measured refusal: permissions[5].objects.crm_campaign_member.allowRestore). But every PUBLISHED @objectstack/spec still carries z.boolean().default(false) for them, so every artifact built by the released toolchain has the keys MATERIALIZED as false in every permission entry (75 occurrences in the HotCRM artifact; its sources declare neither — verified). Refusing the emitted default sentences every existing built artifact — marketplace packages, installed environments — to death on the next runtime upgrade.

Ruled semantics (maintainer, 2026-08-28 — not re-adjudicable):

• Value equals the retired default (false) ⇒ accepted as inert residue and STRIPPED on parse — the parsed/normalized output must NOT carry the key (no re-emission; a round-trip must converge to the clean shape). Optionally a low-noise notice, never a warning storm (75 per artifact).
• Value is non-default (true) ⇒ the existing spec: retire the allowRestore / allowPurge permission props (ruled 2026-08-26; M2 anchor stays open, keys return with M2) #12497 refusal, byte-for-byte guidance preserved.
• Implement as a REUSABLE helper for the class ("retired defaulted key" tombstone shape), applied to both keys — the next defaulted-key retirement uses the same helper rather than reinventing the judgement. Follow the repo's existing tombstone conventions (object.zod.ts has the doctrine block for retired keys).

Consumer acceptance (must be demonstrated)

A permission entry carrying {"allowRestore": false, "allowPurge": false} (the published-toolchain shape) parses, boots, and round-trips WITHOUT the keys; one carrying true for either is refused with the #12497 guidance. Ideal proof: the actual HotCRM artifact case from cloud PR #1672's red step — its shape is in cloud#1685.

Bounds

• ⛔ This does not un-retire anything: no schema re-declares the keys as authorable; the authoring surface still refuses them in source metadata the way spec: retire the allowRestore / allowPurge permission props (ruled 2026-08-26; M2 anchor stays open, keys return with M2) #12497 ruled — the tolerance applies to PARSED artifacts' inert defaults. If the parse and authoring paths cannot be distinguished where the tombstone sits, say so precisely and STOP (that would change the card's shape).
• Changeset minor (launch-window rule; never major). Tests: the acceptance matrix + round-trip convergence + the helper's own contract. Ablation with disk-proven mutation.

[os-zhuang]

Claim: PM loop (epic objectstack-ai/cloud#1653 via cloud#1685, maintainer direct-dispatch channel)
Session: session_71836b57-5db6-459d-ae4d-c6d9d7dd2cc6
Branch: claude/issue-12840-retired-defaulted-key-tolerance
Worktree: objectstack-issue-12840
Domain: domain:spec
File surface: packages/spec/src/** (the #12497 tombstones + a class helper + tests; generated manifests as forced) (stop on breach; explain)
Container & model: M, mode:subagent, model: claude-fable-5 — Clause-② mandatory (changes the spec accept set: the retired default becomes accepted-and-stripped)
Clause-②: yes
Serial constraints cleared: no open PR touches the spec permission tombstones (checked this hour). Downstream consumer: cloud PR #1672's HotCRM acceptance step — after this merges, #1672 re-bumps once more to a covering SHA. mode:subagent tier not self-provable ⇒ needs:contract-review chain applies at ACCEPT.
Audit: maintainer approval 2026-08-28, verbatim: 「同意」 (following the three-question review recorded on cloud#1685); ⛔ per the same thread this does NOT substitute for the spec release — Option A proceeds at the maintainer's own pace.

[hotlong]

os-dev-report

{
 "issue": 12840,
 "status": "done",
 "branch": "claude/issue-12840-retired-defaulted-key-tolerance",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/12845",
 "premise_still_valid": true,
 "summary": "Implemented the ruled retired-defaulted-key tolerance as a reusable class helper, acceptRetiredDefaultResidue(schema, residue), in packages/spec/src/shared/retired-key.ts: a z.preprocess stage ahead of the closed shape (the ViewMetadataSchema / pipeAuthorableSide precedent) that accepts the retired default captured as a literal at retirement time, strips it copy-on-write before the tombstone sees it, and lets every non-default value fall through to the untouched #12497 refusal (guidance byte-for-byte, expected never, invalid_type). Applied to allowRestore/allowPurge on ObjectPermissionSchema AND the EffectiveObjectPermission wire clone (older published-toolchain servers emit the residue on the wire too). The card's reserved seam stop did not trigger: the ruling discriminates by VALUE, and the distinguishable authoring channels are preserved and pinned - z.input stays never (compiled ts-expect-error pin), the authorable-surface artifact still publishes both RETIRED rows, non-default values keep the loud refusal. Notice posture: zero notices by design (bound was at-most-low-noise; pinned via console spies on a 38-entry residue artifact). The D2 conversion stays migrate-meta-only; its docblock and the four migration-entry comments now record the split. Changeset minor for @objectstack/spec; no ADR-0087 marker owed (not declared breaking). Delivered evidence tier: schema-level matrix + round-trip convergence + a composed-artifact-door reproduction at the exact measured coordinate permissions[5].objects.crm_campaign_member.allowRestore via ObjectStackDefinitionSchema; a full HotCRM artifact boot was NOT reproduced locally - that is cloud PR #1672's own acceptance step, and the PR body carries the consumer re-verification list for it.",
 "tests": "All runs unlocked (no flock on this host), exits captured before any pipe, union at commit 8599de858. pnpm --filter @objectstack/spec test: 'Test Files 433 passed | 4 skipped (437); Tests 11556 passed | 22 skipped (11578)'. typecheck: clean incl. test layer ('check:test-typecheck: OK'); the ts-expect-error pin is live, not phantom (tsc --listFiles counts both edited test files in the test program; neither is in the debt ledger). check:generated: 'All 14 generated artifacts are up to date' (zero regeneration needed - the pipe serializes transparently; RETIRED rows verified present in authorable-surface/security.json). dispatch-gates derivation (no paths; stderr named this repo at 8599de858) yielded 22 families - all green, including authorable-surface, docs, spec-changes, cross-package-test-inputs, test-source-alias, nul-bytes; doc-formula-expressions was PREREQUISITE NOT MET twice (unbuilt @objectstack/formula then @objectstack/lint - not measurements), green after building both. Reverse verification observed direction: on the pre-change tree the new semantics showed as exactly 2 red (the false-leg pins), 49 green. Ablation: mutated the helper pipe to pass-through; mutation disk-proven (injected marker grep-count 1, original line count 0); ablated run 9 failed | 61 passed - the failures exactly the residue/round-trip/no-storm legs, every true-refusal leg green; restore via git checkout HEAD inside an EXIT/INT/TERM trap on absolute paths, proven by empty git diff HEAD and git hash-object equal to the HEAD blob (17e82fa3c93ee067b5d5aef4e2b88605e4d1df84). Rebuild statement: spec's vitest resolves the subject from src via relative imports (no dist in the loop), so neither ablation leg needed a rebuild; the dist consumer path was separately exercised by a node probe through packages/spec/dist. CI on PR #12845: in_progress at report time (report delivered at draft-PR time per contract). objectui at pinned SHA 190fbd01d: zero references to either schema symbol - no sibling coupling.",
 "mcp_calls": "0 - all GitHub traffic via bare gh api REST on the local seat",
 "open_questions": [],
 "out_of_scope_findings": []
}

[os-zhuang]

ACCEPT — PR #12845. Verified against the branch (11 files, all inside packages/spec), CI 0 failing at review time. Landing on green.

• The helper is the ruled class rule, and its docblock carries the whole justification — including the one property that makes the capture trustworthy: the residue value is a LITERAL written down at retirement time, ⛔ never derived from anything live, because the default no longer exists anywhere in the schema (the tombstone replaced it). That is the difference between recording history and re-inventing it.
• The card's reserved STOP resolved correctly rather than being worked around: the authoring channels are preserved and PINNED — z.input stays never with a compiled ts-expect-error pin (so writing the key in source still fails typecheck), the authorable-surface artifact still publishes both RETIRED rows, and non-default values reach the untouched spec: retire the allowRestore / allowPurge permission props (ruled 2026-08-26; M2 anchor stays open, keys return with M2) #12497 refusal byte-for-byte. The tolerance discriminates by VALUE at the parse seam, which is exactly what the ruling asked and all the ruling asked.
• Applied to the wire clone too (EffectiveObjectPermission) — older published-toolchain SERVERS emit the residue on the wire, a population the card didn't name and the dev caught.
• Zero-notice posture is the right reading of "at most low-noise", and it is PINNED (console spies over a 38-entry residue artifact), with the loud channels for authored sources explicitly unchanged and enumerated.
• Evidence: matrix + round-trip fixpoint + a composed-artifact-door reproduction at the exact measured coordinate (permissions[5].objects.crm_campaign_member.allowRestore); reverse verification on the pre-change tree (exactly the 2 new false-leg pins red); ablation red on exactly the residue/round-trip/no-storm legs with every true-refusal leg green; dist consumer path probed separately since vitest resolves src. The full HotCRM artifact boot is correctly left to feat(service-ai): consistent agent narration when builds auto-publish #1672's own acceptance step — that is the consumer's bar, and the PR body hands it the re-verification list.

Contract review (needs:contract-review → PASS): the accept-set change is precisely the ruled tolerance — {retired key: retired default} moves from refused to accepted-and-stripped; true values, authoring surface, z.input type, RETIRED authorable rows, and the #12497 guidance are all byte-level unchanged (checked in the diff, pinned in tests). check:generated 14/14 untouched. Changeset minor. Reviewer: this seat, machine-verified at CONTRACT_REVIEW_TIER (claude-fable-5, host transcript field). Cleared on both carriers with this comment as the record.

Next: land → resume the Phase-2 seat for the final #1672 re-bump (covering this) → HotCRM acceptance green → land → #1675 → Phase 3 → staging, per the standing authorizations.