[finding] `action.execute` is ledgered `live` citing a `.transform` that protocol 17 removed — the key is a retiredKey tombstone with no consumer anywhere

[os-trump]

Found while re-closing call graphs for the #13003 anchor-adoption batch 1 (PR #13035). Filed unassigned; the repair is a status re-classification, which that PR deliberately did not execute.

The claim, and what the tree says

packages/spec/liveness/action.json carries:

"execute": {
 "status": "live",
 "evidence": "packages/spec/src/ui/action.zod.ts:581 — the .transform lowers execute -> target and DROPS the alias, so authoring it changes what the runtime dispatches",
 "note": "... DIVERGENCE RESOLVED in #3713: the alias is now consumed at parse time and removed from the output ..."
}

On main at c459da6bc there is no such transform. execute was removed in protocol 17 (#3855) and is now a tombstone:

• packages/spec/src/ui/action.zod.ts:1040 — execute: retiredKey('executewas removed in @objectstack/spec 17 — usetarget. ...'), whose own docblock says the key is "[REMOVED in protocol 17 — [P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855] The deprecated alias of target" and types it never, so authoring it fails tsc before any parse runs.
• packages/spec/src/ui/action.zod.ts:559-562 — "The execute alias was removed in protocol 17 ([P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855). target is the only handler slot ... An authored execute is rejected with the rename prescription rather than silently stripped."
• packages/cli/src/utils/lower-callables.ts:213-233 — deliberately refuses to consume it: "Only a callable target is lowered. A function on the removed execute" ... "a function-valued execute here would consume the key and the tombstone would" not fire.

There is no lowering, no alias resolution, and no reader. A key that cannot be authored and is read by nothing is not live.

Why no existing check caught it

This is the #12516 class in its purest form, and it is worth recording because all four checks pass on it:

• Existence — action.zod.ts resolves.
• Line bound — :581 is inside a 1802-line file.
• Key-mention — the file names execute (the tombstone declaration and the prose above it), so the [finding] A liveness citation can rot WITHIN its file — 14 measured candidates the new line bound structurally cannot see, incl. permission.objects.allowExport citing a symbol that moved repos-internally #11457 word-bounded check anchors and passes.
• verifiedAt — the entry carries none, so the re-verification clock never asked.

What :581 actually points at today is a comment about the global_nav enum-value retirement's declaration style — unrelated to this key in every respect. The pointer is in range, in the right file, and wrong.

Suggested disposition (not executed)

The honest verdict looks like dead, matching the two already-tombstoned siblings in the same ledger — action.shortcut and action.bulkEnabled, both status: "dead" with a "REMOVED ... tombstoned at the schema (retiredKey carries the prescription)" note and the rls.priority precedent cited for why the row stays (a retiredKey() tombstone keeps the key in the walked shape, so its row must not be deleted).

If that reading holds, the change is small and local: flip status to dead, replace the falsified evidence/note with the tombstone pointer, and stamp verifiedAt. Worth confirming against .claude/skills/spec-property-retirement/SKILL.md §2 before acting, since the ledger disposition for a tombstoned-vs-strict-removed key is exactly the asymmetry that skill governs.

One thing to preserve rather than delete: the entry's note carries the #3713 history of three readers disagreeing in two directions, which is the argument for why target is the single handler slot. That belongs in whatever replaces it.

Dedup (searched 2026-08-28)

Channel deviation, same shape the parent card records and re-probed this session: repo-scoped REST reads return HTTP 403 from this dev seat (GET /repos/objectstack-ai/objectstack/labels → 403, "GitHub access is not enabled for this session") and gh is absent, so the REST-first dedup rule could not be followed. Used one targeted MCP semantic search; non-empty result set, so the channel is self-validating.

Nine hits, none covering this key: #11210 (built the line bound), #7133 (closed — objectui-side citation-repair bundle), #7130 and #6756 (retiredKey tombstones with a live surface still pointing at them, but different keys and, for #7130, the other repo), #3714 / #4837 / #4895 / #3490 / #10913 (other ledger corrections, other properties). No open card covers action.execute.