os-zhuang · Oct 29, 2026 · Oct 28, 2026 · Oct 28, 2026
@@ -1,8 +1,9 @@
 # ADR-0145: A `?: never` tombstone on the ui authoring face retires on the spec's own window — one major after the retirement it names, never longer
 
-**Status**: Proposed (2026-10-28). `docs/adr/**` is Tier H (Prime Directive #14): this record becomes **Accepted** by
-the maintainer's merge. **This record declares; it implements nothing** — no tombstone is removed, no code, no schema,
-no changeset. The first application batch is its own card, cut after the merge (see [Applying the rule](#applying-the-rule)).
+**Status**: Accepted (2026-10-28, #27251) · **Amended** (2026-10-28, #27291 — one clause each; see the amendment notes
+under D2's ui-only bullet and under D1's level-axis bullet). **This record declares; it implements nothing** — no
+tombstone is removed, no code, no schema, no changeset. The first application batch is its own card, cut after the merge
+(see [Applying the rule](#applying-the-rule)).
 **Decided by**: the maintainer's letter **A** of 2026-10-25T01:46Z on
 [#25912](https://github.com/objectstack-ai/objectstack/issues/25912) (filed as objectui#13467), transcribed as ruling
 [`6407810703`](https://github.com/objectstack-ai/objectstack/issues/25912#issuecomment-6407810703) over the seat's
@@ -59,7 +60,10 @@ Spelled on ADR-0087's clock, with **R** the protocol major the retirement belong
 - "major" is the major of the one `fixed` release group: `@objectstack/*` and `@object-ui/*` release together, lockstep
   with `PROTOCOL_VERSION` at every cut, and the spec's deletion gate reads its `CURRENT_MAJOR` off
   `@objectstack/spec`'s package version — so one clock serves both faces. A changeset's *level* is a different axis
-  (ADR-0087's 2026-09-13 amendment, `scripts/check-changeset-no-major.mjs`) and moves nothing here;
+  (ADR-0087's #18003 level-half amendment of 2026-09-13 — the note inside its "Ratified: the pre-launch launch-window
+  exemption" section — and `scripts/check-changeset-no-major.mjs`) and moves nothing here;
+  > **Amended 2026-10-28 (#27291) — the citation names its text.** Was "ADR-0087's 2026-09-13 amendment": ADR-0087
+  > carries two texts of that date, the #12772 artifact-ingestion addendum being the other, and D1 means the level half.
 - the window binds in both directions: a tombstone that names a spec retirement ⛔ never leaves while the spec still
   carries that key's kit (the ui author would lose the remedy the spec still prints), and ⛔ never outlives it — except
   as D3 holds it: a named refusal D3 keeps outlives the kit by design (the `agedOutSpecKeyRefusal` twins are that case).
@@ -81,9 +85,16 @@ Spelled on ADR-0087's clock, with **R** the protocol major the retirement belong
   window by this record: with the protocol at major 18, any whose R is 16 or below is already due, and the first
   application batch takes it.
 - **The tombstone names a ui-only retirement** (an objectui or ui card, no spec key behind it): the same window runs
-  from the ui's own retirement. R is the major of the first `@object-ui/types` release tag (or the first release of the
-  package that publishes the `.d.ts`) whose tree carries the tombstone, on the same convention: first carried by a
-  major's `.0.0` cut counts in the major before it.
+  from the ui's own retirement, on the fixed group's clock (D1): R is read off the first `@objectstack/spec` release tag
+  whose tree carries the tombstone's introducing commit (for a commit the ui merge did not import, the first
+  `@objectstack/spec` release cut at or after its date — step 2), on the convention the bullets above use: first carried
+  by a major's `.0.0` cut counts in the major before it. ⛔ Never off `@object-ui/types`' own tags: a major's first tag
+  there need not be a `.0.0` cut.
+  > **Amended 2026-10-28 (#27291) — the ui-only clock reads the group's tags.** Was: "R is the major of the first
+  > `@object-ui/types` release tag (or the first release of the package that publishes the `.d.ts`) whose tree carries
+  > the tombstone, on the same convention: first carried by a major's `.0.0` cut counts in the major before it."
+  > `@object-ui/types` opens 17 at `17.1.0` (no `17.0.0`), so that reading gave a tombstone born before the
+  > `@objectstack/spec@17.0.0` cut R = 17 where the spec's clock reads 16: one major longer, which D1 forbids.
 - **Where R cannot be read** (no tag, no row, a history the reader cannot reach): the tombstone is not due. The batch
   reports it as undated, ⛔ never guesses a date — a wrong date removes a remedy early, which is option B by accident.
 
@@ -140,9 +151,12 @@ what it could not date. ⛔ No count is written here: the population moves, and
 2. **Date.** Per member, find the commit that introduced the tombstone with `git log -S'<the member line>' --reverse`
    on a **full** clone, then the first release tag that contains it (`git tag --contains`). The ui tree's history before
    the ui merge was not imported into this repository: a tombstone older than the merge is dated on a full clone of
-   `objectstack-ai/objectui`, whose `@object-ui/types@*` tags carry that era. On a shallow clone the reading is refused,
-   ⛔ never read as "no history" (`git rev-parse --is-shallow-repository`, with a control leg of known age). For a
-   tombstone that names a spec retirement, read R from the spec (D2), not from the ui commit.
+   `objectstack-ai/objectui`, whose `@object-ui/types@*` tags carry that era — that clone gives the introducing commit
+   and its date, and R is then read on the group's clock (D2): the first `@objectstack/spec` release cut at or after
+   that date, a `.0.0` cut counting in the major before it, ⛔ never the `@object-ui/types` tag the clone's
+   `git tag --contains` names. On a shallow clone the reading is refused, ⛔ never read as "no history"
+   (`git rev-parse --is-shallow-repository`, with a control leg of known age). For a tombstone that names a spec
+   retirement, read R from the spec (D2), not from the ui commit.
 3. **Judge.** Due ⇔ the current major (D1) ≥ R + 2 and D3 does not hold the key. Report three lists — due, held by
    D3 (with the container), undated — and remove only the first.
 4. **Remove and re-pin.** Delete the member, its JSDoc and its zod twin together (D3); move any test that pins

@@ -17,8 +17,8 @@
 
 | Status | Records |
 |---|---|
-| Accepted | 126 |
-| Proposed | 5 |
+| Accepted | 127 |
+| Proposed | 4 |
 | Superseded | 4 |
 | Draft | 3 |
 | Deferred | 2 |
@@ -105,7 +105,7 @@ A bare `ADR-0006` names the decision; its current text is [0006-project-environm
 | [ADR-0032](./0032-unified-expression-layer.md) | Expression layer for an AI-authored platform — validate-by-default, schema-aware, one CEL language, no silent… | Accepted — implemented; designer builders pending (objectui) (proposed 202… | 2026-06-02 | — | — |
 | [ADR-0033](./0033-ai-assisted-metadata-authoring.md) | AI-assisted metadata authoring — one agent brain, draft-gated review, type-agnostic apply, open-core boundary | Accepted — 2026-06-02 | 2026-06-02 | — | cloud ADR-0025 |
 | [ADR-0034](./0034-transactional-writes-and-ambient-transaction.md) | Robust multi-write transactions (ambient transaction context) | Accepted — implemented (v8.0.0) (calibrated 2026-06-12) | 2026-06-12 | — | — |
-| [ADR-0035](./0035-config-driven-master-detail.md) | Config-driven master-detail (declare on the relationship, forms derive) | Accepted | — | — | — |
+| [ADR-0035](./0035-config-driven-master-detail.md) | Config-driven master-detail (declare on the relationship, forms derive) | Accepted — · Amended (2026-10-28, #27069, maintainer rulings on that card:… | 2026-10-28 | — | — |
 | [ADR-0036](./0036-app-as-rest-api-and-mcp-server.md) | Every app is a REST API + an MCP server — make it visible and connectable after build | Accepted — framework implemented; cloud surfacing pending (proposed 2026-0… | 2026-06-06 | — | — |
 | [ADR-0037](./0037-live-canvas-draft-preview.md) | Live Canvas — draft-overlay live preview while you build | Accepted — 2026-06-10 — all four phases implemented: `previewDrafts` reads… | 2026-06-10 | — | — |
 | [ADR-0038](./0038-build-verification-loop.md) | Build Verification Loop — the agent builds, verifies, and corrects itself | Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2… | 2026-10-28 | — | cloud ADR-0025 |
@@ -211,7 +211,7 @@ A bare `ADR-0006` names the decision; its current text is [0006-project-environm
 | [ADR-0141](./0141-inter-app-dependency-declared-checked-before-install.md) | An app may depend on another installed app — declared in `manifest.dependencies`, checked once before install… | Proposed — 2026-10-25; first draft 2026-10-24. `docs/adr/` is Tier H (Prim… | 2026-10-25 | — | — |
 | [ADR-0142](./0142-ownership-queue-membership-claim-and-assignment-rules.md) | An ownership queue is a platform primitive — a queue entity, membership through the existing recipient kinds,… | Proposed — 2026-10-25 · Amended (2026-10-28, ruling `6457475657` on #25769… | 2026-10-25 | — | — |
 | [ADR-0143](./0143-outbound-connector-auth-is-open-tier.md) | Outbound connector auth is open tier — OAuth2 grants, vendor app-credential exchange and request signing in o… | Accepted — 2026-10-28. Proposed 2026-10-27 (#26833, which also landed the… | 2026-10-28 | — | — |
-| [ADR-0145](./0145-ui-deprecation-tombstones-retire-on-the-spec-window.md) | A `?: never` tombstone on the ui authoring face retires on the spec's own window — one major after the retire… | Proposed — 2026-10-28. `docs/adr/` is Tier H (Prime Directive #14): this r… | 2026-10-28 | — | — |
+| [ADR-0145](./0145-ui-deprecation-tombstones-retire-on-the-spec-window.md) | A `?: never` tombstone on the ui authoring face retires on the spec's own window — one major after the retire… | Accepted — 2026-10-28, #27251 · Amended (2026-10-28, #27291 — one clause e… | 2026-10-28 | — | — |
 
 ## ObjectUI registry — `ui/docs/adr/` (`ui-` prefix)