[objectstack-fleet]

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Requested by Yibo Wang · project thread

Fixes #29987

Ruling-ref: 6583399215
Clause-②: no (move-only)
Metadata-protocol: none
Skills-docs: follow-up filed as #29994 — .claude/skills/spec-property-retirement/SKILL.md (it still says a new conversion is written in conversions/registry.ts; after the split it is a module under conversions/entries/ plus one import line in registry.ts)

ADR-0087 / D3: no migration entry moves. migrations/ is untouched, and check-adr-0087-registration --base origin/main exits 0.

维护者速读

• 改了什么：codemod scripts/codemod-split-conversions-registry.mjs 把 packages/spec/src/conversions/registry.ts（16,019 行）拆成 112 个条目模块（entries/<toMajor>/<id>.ts）加一个 entries/shared.ts；registry.ts 剩 354 行，只留导入和四张表。另有 4 个按路径读这个文件的读者同步放宽。
• 为什么改：[Decision] Large source files: replace the hand-cut split with a script-generated split per file, so the remaining monoliths split in days, not months #29465 大文件拆分计划（裁决 6583399215）的 Phase 0。这张表是冲突最多的文件之一，按条目拆开后，每条 conversion 单独成文件，评审和合并都更容易。
• 风险与回滚：只搬不改。159 条语句、727,159 字节逐字节相同；ALL_CONVERSIONS 和每个 CONVERSIONS_BY_MAJOR[n] 的 id、顺序和函数源码在 base 与 head 完全一致；134 个声明文件逐字节相同。回滚就是 revert 这个 PR。
• 先看：packages/spec/src/conversions/registry.ts（新的宿主文件）、entries/shared.ts，以及下面的读者普查表。
• 两分钟验证：pnpm install --frozen-lockfile，然后 node scripts/codemod-split-conversions-registry.mjs --verify --base origin/main（字节一致）和 --arrays --base origin/main（表相等）。
• 需要你做的：现在不用做什么。这是 Phase 0 草稿。Phase 1 等你定窗口：在最新 main 上重新生成、跑一次 CI、你批准（超过 3,000 行，Tier H），然后进合并队列。

What changes

• New: scripts/codemod-split-conversions-registry.mjs. It sits beside the pilot's codemod-split-sql-driver.mjs and follows its conventions (ts-morph in memory, a plan mode, --write, --verify, --self-test).
• Generated: packages/spec/src/conversions/entries/11/ (3), 15/ (2), 17/ (12) and 18/ (95) hold one module per conversion entry, named by its id. entries/shared.ts holds the 11 helpers that two or more entries read. The 31 helpers that only one entry reads move into that entry's module, following pilot ruling 6591753301. Every module is a leaf: it imports ../../types.js, ../../walk.js, ../shared.js and the spec modules registry.ts already imported (for example ui/assembled-views.zod.js), and never another entry.
• Host: registry.ts keeps its module docblock, import type { MetadataConversion }, one import line per entry in base definition order, and OrderedConversion, inApplicationOrder, MAJOR_18_CONVERSIONS, CONVERSIONS_BY_MAJOR and ALL_CONVERSIONS byte for byte, including the @__PURE__ markers. The public import path conversions/registry and its two exports are unchanged.
• Readers widened (ruling 6597555122):
  • packages/spec/scripts/conversions-major18-merge.test.ts now reads the import lines in registry.ts and each entries/18/ module.
  • scripts/check-adr-0087-registration.mjs reads the conversions ledger as registry.ts plus entries/**, and gains a CR1-CR3 battery.
  • scripts/docs-audit/affected-docs.mjs treats registry.ts plus entries/** as the conversion table.
  • scripts/adr-anchors/: the ADR-0120 anchor follows declared-index-unique-scope into its module, and the host keeps ADR-0087.
  • The scripts/regen-artifacts.mjs row note was updated.

Reader census (all 110 base files that name conversions/registry)

class	files	disposition
import	50	unaffected: both exports stay in registry.ts (3 tests vi.mock it, same exports)
prose only	47	unaffected (CHANGELOGs, docblocks, ADR text)
code reads the path or text	13	one row each below

code reader	disposition
packages/spec/scripts/conversions-major18-merge.test.ts	widened. The base version fails 3 of its cases on the split tree; the widened one passes 12/12
scripts/check-adr-0087-registration.mjs	widened; self-test 710 assertions pass, --base origin/main exit 0
scripts/docs-audit/affected-docs.mjs	widened. The pre-edit version fails 2 counterfactual cases on the split tree; the edited one passes 605/605
scripts/adr-anchors/packages__spec__src__conversions__registry.ts.json	split: ADR-0120 moved with its entry, so a new anchor was added for entries/18/declared-index-unique-scope.ts. check:adr-anchors exit 0
scripts/regen-artifacts.mjs	row note updated (prose of a NOT_DRIVER_MANAGED row)
packages/spec/scripts/build-schemas.ts	unchanged. Its remedy text says to add a D2 conversion in src/conversions/registry.ts, and that is still where an entry is registered
packages/spec/scripts/build-schemas-check-mode.deletion-proofs.test.ts	unchanged: it pins the remedy text above
packages/spec/scripts/build-schemas-check-mode.retired-keys.test.ts	unchanged: an import plus the same remedy pin
packages/spec/src/root-entry-migrations-split.pin.test.ts	unchanged: registry.ts is still in the root graph; passes
packages/spec/export-origins/root.json	unchanged: the export origin is still registry.ts; check:export-origins exit 0
packages/spec/liveness/action.json	unchanged. Its note cites registry.ts:5578, which was already stale on main before this PR
scripts/check-spec-docblock-symbol-anchors.mjs	unchanged: the anchored symbols stay in the host; passes
scripts/check-future-spec-major.mjs	unchanged: the path is only a self-test fixture label

To reproduce the census: git grep -l 'conversions/registry' 5cdaddbc -- scripts packages/spec.

Tests

• Byte-identity: --verify --base 5cdaddbc compares 159 statements (727,159 bytes). All 112 of 112 entries and all 42 helpers moved (11 into entries/shared.ts), and 5 statements stayed. It writes 113 modules and checks 584 import bindings. Undoing the split rebuilds the base registry.ts byte for byte.
• Tables: --arrays --base 5cdaddbc loads both registries. Exports match (ALL_CONVERSIONS, CONVERSIONS_BY_MAJOR). ALL_CONVERSIONS holds 112 ids, sha256 6dfde60307ccd336d6265e84bb095632acbbdbcd08483d73f5e83070c9728ae7, in the same order. CONVERSIONS_BY_MAJOR is {11: 3, 15: 2, 17: 12, 18: 95} with the same membership and order. 112 of 112 entry digests are equal, where a digest is JSON with the function source included.
• Determinism: two plan runs on base's unsplit text both give output tree sha256 960cdabf7a6532e0f0ffaa035cbe200a85b0eff2a1ddea58b0df515b4147d74b (input sha256 3f5386899b7024a1e429d6a7b93cd41ce567f1171bfb5ee27974d1ffb2ec6c01). A --write from base's registry.ts on this branch leaves git diff HEAD empty.
• Declaration files (ruling 6348891160 item 1, with 6441032442 B's second normalisation as the reading):
  • All 134 dist/*.d.ts and *.d.mts files are raw byte-identical between base and head. The set sha256 is 757dc13d98549d73dc2c199941bd2f75b49dd071e1ccfa139472b5e72ea9dcbc on both sides.
  • The positive control, a renamed declaration in action.zod-CQhac7BH.d.mts, is caught: the normalised hash and the declared-surface digest both differ. The codemod's own --dts reads PASS, with its control (a dropped readonly) caught.
  • check:api-surface and check:dual-source-exports exit 0.
• Self-test: --self-test runs 40 cases in 6 batteries, and all pass.
• Spec suite at the base's counts: base has 808/808 files and 24,277 tests (plus 1 todo); test:repo has 89 files and 1,524 tests. Head has 807 files plus 1 named skip, 24,275 tests plus 1 skipped. The skip is root-entry-type-nameability.pin.test.ts, which skips by design while dist is stale. Run after the head build with OS_EXPECT_ROOT_NAMEABILITY=1, it passes 2/2, which brings head to base's counts. test:repo at head: 89 files and 1,524 tests.
• Built-entry checks: pure-schema-construction.test.ts passes 7/7 at head. That includes the ./shared consumer bundle, which drops every conversion for the console's names and keeps all of them for normalizeStackInput.
• Type-check: pnpm --filter @objectstack/spec typecheck exits 0 at head with NODE_OPTIONS=--max-old-space-size=6144. Without the flag, the check:test-typecheck step runs out of heap at about 2 GB on this box, at base and at head alike. The first run, at the codemod commit before dist existed, exited 0 without the flag.

Acceptance notes

1. Size. 35,210 changed lines (+19,393 / -15,817 in 121 files) is over the 3,000-line threshold. The PR stays a draft until the maintainer orders the Phase 1 window.
2. skip-changeset: the .d.ts meets ruling 6348891160 item 1 in its strongest form (raw identity). Following 6441032442 item 4 and the pilot PR refactor(driver-sql): codemod pilot — generated, byte-identity-proved section split of sql-driver.ts (#29520) #29598, the PR takes no changeset.
3. Two earlier head builds read differently. They were the first two head builds of this card, and both ran while unlocked gate runs were working in the same worktree. 10 to 18 declaration files differed only in the order of string-literal members inside mapped types such as a z.ZodEnum argument (low/high, paused/pending and others). The declared-surface digest stayed EQUAL. The two pairs disagreed with each other as well as with base. Two quiet head builds and four base builds are all byte-identical. The cause is not established. The reading above comes from the quiet builds, and the readings from all builds are kept in the project files.
4. Follow-ups, noted and not filed:
   • The MAJOR_18_CONVERSIONS docblock in the host still says to define a conversion directly above the entry that follows it. It has to stay byte-identical in a move-only PR, so the merge test now gives the post-split spelling: import it directly above that entry's import.
   • The skills line above names the second follow-up.

Verification

• Regenerate (in the Phase 1 window, on the latest main, never a rebase): git checkout origin/main -- packages/spec/src/conversions/registry.ts, then node scripts/codemod-split-conversions-registry.mjs --write. --write deletes stale codemod-marked modules and refuses any file under entries/ that it did not write. If the regeneration moves different code, re-check the reader table above.
• Proofs: node scripts/codemod-split-conversions-registry.mjs --verify --base origin/main, then --arrays --base origin/main.
• .d.ts: build @objectstack/spec at base and at head on a quiet tree, then run node scripts/codemod-split-conversions-registry.mjs --dts BASE_DIST HEAD_DIST. The report reading under 6441032442 B is dtsnorm.mjs, kept in the project files at issue-29987/dtsnorm.mjs, sha256 e0b4b0c3d6a29e99dea99b2a65b683b0649f3e7c6d4fa671b994d590d48219b4. Run it as node dtsnorm.mjs --typescript node_modules/typescript --dirs BASE_DIST HEAD_DIST --control, and expect exit 0 and "pass": true.
• Gates: node scripts/pm/dispatch-gates.mjs --commands derives 96. Of those, 92 exit 0 and 4 are NOT MEASURED with exit 3: check:doc-formula-expressions, check:dts-closure, check:dual-build-cjs-loads and check:lean-entry-closure. Each one needs sibling packages built that this card does not touch, and CI runs them. --ran accounts for all 96 (92 run, 4 NOT-MEASURED, 0 unrun).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WGufzg1QFj9ukYzafVoAqg

Body refreshed by spec seat 3 (Skills-docs follow-up filed as #29994; head c5fc113 rewords the three D2 remedies in packages/spec/scripts/build-schemas.ts to name src/conversions/entries/ plus the registry.ts import and array line, pinned in deletion-proofs and retired-keys tests): 2026-11-04T01:37Z

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 607 documentable anchor(s).

149 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0b99c2b1645b101459b1dd9fd4fecdf996194a76.

⛔ 19 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 anchor(s) matched too much of the corpus to be a work list: created_at (literal, 43 pages), defaultValue (literal, 41 pages), master_detail (literal, 40 pages), objectName (literal, 56 pages), sys_user (literal, 49 pages)
• 10 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 169 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0b99c2b1645b101459b1dd9fd4fecdf996194a76 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 45089076a39d962c144b862b39268d19d8c9e382 — the merge of head c5fc11367642c409ba5d65656145d0624cf50ff4 into base 0b99c2b1645b101459b1dd9fd4fecdf996194a76, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 45089076a39d962c144b862b39268d19d8c9e382 && git checkout 45089076a39d962c144b862b39268d19d8c9e382
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0b99c2b1645b101459b1dd9fd4fecdf996194a76 c5fc11367642c409ba5d65656145d0624cf50ff4 && git checkout -B drift-repro 0b99c2b1645b101459b1dd9fd4fecdf996194a76 && git merge --no-ff c5fc11367642c409ba5d65656145d0624cf50ff4

node scripts/docs-audit/affected-docs.mjs --json 0b99c2b1645b101459b1dd9fd4fecdf996194a76

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0b99c2b1645b101459b1dd9fd4fecdf996194a76 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Contract-review-claim: session_01WGufzfgvGexKn9vLHsy89K · head a8c5d94 · 2026-11-04T00:42Z

Schema face (packages/spec/src/conversions/**, move-only), so the review runs at CONTRACT_REVIEW_TIER. This is Phase 0; the landing head is regenerated in the window the maintainer orders.

[objectstack-fleet]

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a8c5d94d081c6858f792d977361b87f7564f1ff6
Local-runs: probe — an independent byte-identity re-check: a TypeScript-parser script over git show output, in the scratchpad; no repo script, build, test, gate or codemod was run, and the dev's residual JSON was read the same way
Scope: packages/spec/src/conversions/registry.ts, packages/spec/src/conversions/entries/** + scripts/codemod-split-conversions-registry.mjs (read whole), packages/spec/src/conversions/entries/shared.ts, entries/11/flow-node-http-callout-rename.ts (first), entries/18/flow-decision-mode-inclusive-explicit.ts (last), entries/15/view-visibleOn-to-visibleWhen.ts, entries/17/retry-policy-converged.ts, entries/18/page-component-filter-record-to-rule-array.ts, entries/18/declared-index-unique-scope.ts, packages/spec/scripts/conversions-major18-merge.test.ts, scripts/check-adr-0087-registration.mjs, scripts/docs-audit/affected-docs.mjs, scripts/regen-artifacts.mjs, scripts/adr-anchors/packages__spec__src__conversions__registry.ts.json, scripts/adr-anchors/packages__spec__src__conversions__entries__18__declared-index-unique-scope.ts.json, packages/spec/export-origins/root.json, packages/spec/tsconfig.json, packages/spec/package.json (sideEffects), scripts/pm/clause2-line.mjs, .claude/skills/spec-property-retirement/SKILL.md (main), .claude/skills/pm-dispatch/references/review-checklist.md, /mnt/project-files/issue-29987/* (report.md, dtsnorm.mjs sha256 e0b4b0c3… matches the PR body, dtsnorm-reading*.json, dtsnorm-residuals.json, codemod-dts logs, gates-ran.list), PR #29993 body, card #29987 and its 3 comments, rulings 6583399215 / 6582376616 / 6583664223 / 6591753301 / 6597555122 / 6348891160 / 6441032442, pilot PR #29598, check-runs on the head (two reads).

① Derived judgments

• Public surface: unmoved. registry.ts still exports exactly CONVERSIONS_BY_MAJOR and ALL_CONVERSIONS at the same path and with the same explicit types (host lines 322 and 351 are the base text); no entry module is re-exported by any entry point (every entry's own export { NAME } is reached only through the host import); the 3 vi.mock('./conversions/registry', importOriginal) tests see the same two exports. packages/spec/export-origins/root.json still names src/conversions/registry.ts#ALL_CONVERSIONS and #CONVERSIONS_BY_MAJOR, which is still true; check:export-origins, check:api-surface, check:dual-source-exports exit 0 in the dev's run, Spec property liveness and Lint & Repo Gates are green on the head.
• Membership and order: the whole host tail from the OrderedConversion docblock to EOF is byte-identical to base (my own compare, 12,413 bytes), so MAJOR_18_CONVERSIONS (95 rows, sorted by identifier, every order value), the literal arrays for 11 (3), 15 (2) and 17 (12) and the ALL_CONVERSIONS flatten are unchanged; 112 host imports, one per entry, bound to 112 modules each holding exactly that const NAME: MetadataConversion. The --arrays digest proof (112/112, ALL ids sha256 6dfde603…) is consistent with this; I did not rerun it because the tables and every referenced declaration are byte-identical by construction.
• @__PURE__: both markers (18: /* @__PURE__ */ inApplicationOrder(…) and the ALL_CONVERSIONS flatten) are in the host, byte for byte. No entry module carries or needs one: the plan refuses any top-level expression statement, so every module holds declarations only; packages/spec/package.json declares sideEffects: false; the dev's pure-schema-construction.test.ts 7/7 includes the ./shared consumer bundle.
• Ledgers: api-surface*, authorable-surface* and export-origins are untouched by the diff, and should be — api-surface is symbol-keyed (no path in it names conversions/registry), authorable-surface reads the Zod tree, and the export origin really is still registry.ts. retired-after.census.* reads ALL_CONVERSIONS through an import and the published dist, not by path: nothing to widen.

② Semver level

• skip-changeset with no changeset fits: the diff publishes nothing observable from @objectstack/spec — 134/134 dist/*.d.ts and *.d.mts raw byte-identical on the quiet builds, same file set, control (a renamed declaration in action.zod-CQhac7BH.d.mts) caught on both the normalised and surface readings; exports unchanged. That is ruling 6348891160 item 1 in its strongest form and 6441032442 item 4 (skip-changeset stays; no patch for a declaration-order diff). Precedent: pilot PR refactor(driver-sql): codemod pilot — generated, byte-identity-proved section split of sql-driver.ts (#29520) #29598 merged 2026-11-03T16:26Z with skip-changeset, no .changeset/ file, its .d.ts passing only under the second normalisation — a weaker reading than this one. Check Changeset is green on the head.
• Clause-②: no (move-only) reads as a bare no: scripts/pm/clause2-line.mjs reads the arm only when the first word in the parenthetical is of the widen/narrow family, so (move-only) is description, not a malformed arm (PR-body guards and PM dispatch-gates green). Correct: no accept set, export or declaration moves. Metadata-protocol: none is correct: nothing an author can write changes.

③ Boundary flags

• (a) Irregular head builds: I read all 62 residual statements in dtsnorm-residuals.json. Every one is the same declaration with the property members of a z.ZodEnum{…} record type printed in another order (low/high, paused/pending, critical/background…); all 62 are equal after sorting lines, and the declared-surface digest is EQUAL. Two readings: (1) that class is INSIDE a declaration, so it is outside both sanctioned normalisers — 6348891160 covers only "a" | "b" union runs and 6441032442 B item 1(b) says a member that moves within its declaration fails (b) — and the dev's tool rightly reports pass: false for those builds rather than widening anything; had it been the reading of record it would be a fork on [Decision] Large source files: replace the hand-cut split with a script-generated split per file, so the remaining monoliths split in days, not months #29465, not a pass. (2) It is build noise, not a declaration difference the split causes: 4 base builds and 2 quiet head builds are raw byte-identical to each other (set sha256 757dc13d… both sides), the two irregular builds disagree with each other, both ran beside unlocked gate runs in the same worktree, and the diff class is the TypeScript printer's type-creation-order artefact that both rulings already classify as meaningless to a consumer. The cause is not established (the --arrays scratch copy lives under packages/spec/.codemod-arrays-*, but tsconfig includes only src/**/*, so that copy does not enter the program). Verdict on (a): noise; the reading of record is the quiet one. Should-fix S1 below binds Phase 1 to a quiet reading.
• (b) The 4 NOT MEASURED gates are hosted in CI on this head: check:dts-closure in Type Check · debt ledger (lint.yml:5892, success) and Type Check · consumer gates (lint.yml:6030, success); check:doc-formula-expressions in Type Check · consumer gates (lint.yml:6254, success); check:dual-build-cjs-loads and check:lean-entry-closure in Build Core (ci.yml:3040 and 3064, in progress at my second read). At review time the head has 24 success, 28 in progress, 0 failure/cancelled (Build Core, Test Core 1-8, Test UI 1-16, Type Check UI, Type Check · workspace pending). Phase 1 regenerates anyway, so the landing CI run is the one that counts.
• (c) Skills-docs: .claude/skills/spec-property-retirement/SKILL.md line 176 still prescribes writing the MetadataConversion in conversions/registry.ts; after the split that is a module under entries/18/ plus one import line, and the widened merge test reds an inline definition. The dev declares the follow-up but files no card. Two more prescriptions now mis-describe the mechanics and cannot be fixed in a move-only PR: the MAJOR_18_CONVERSIONS docblock (host lines 181-185, must stay byte-identical) and the build-schemas.ts remedy text at 1231, 2801 and 3012 (pinned by two tests). Should-fix S2.

④ Design judgment

• Deterministic: the script reads only the text of registry.ts into an in-memory ts-morph project (no node_modules, no build output, no clock); every emission is in source order or sorted; the self-test pins two runs tree-equal; the dev's two plan runs give tree sha256 960cdabf… on input 3f538689…. Re-run on a later main: plan refuses an input that already carries the [#29987 codemod] mark, so the documented git checkout origin/main -- registry.ts precedes --write; --write unlinks stale marked modules and refuses an unmarked file under entries/; a new conversion with a default/namespace import, a destructuring or an exported entry exits 2 (a fork to report, never a hand edit). Sound.
• Byte identity: proof 1 compares raw getFullText() (leading comments and blank lines included), never normalised text, keyed by declared name, in base order per file, each base statement placed exactly once, and the undo rebuild must equal the base text. I re-implemented it independently with the TypeScript parser over git show output: base 159 statements, head 159 across host + 113 modules, 0 not in base, 0 missing, 0 duplicated, 0 out of order, 727,159 bytes (the dev's figure), undo tiles the base, host head (lines 1-17) identical. The .d.ts reading of record is raw identity; no normaliser decided anything.
• Readers by path: on main 125 files name conversions/registry (the dev's 110 is the scripts + packages/spec subset at 5cdaddb); imports and prose dominate. Code readers: the 4 widened (merge test reads host imports plus each entries/18/ module with the legacy-shape controls kept; check-adr-0087-registration reads registry.ts plus entries/** .ts via conversionLedgerTextAt with CR1-CR3 and the commit census widened; affected-docs treats host plus entries/** as the replay table; ADR-0120 anchor follows its entry, host keeps ADR-0087 — the entry file carries ADR-0120 5 times); regen-artifacts row note. Checked beyond the PR's grep: agent-lifecycle-retirement.test.ts and agent-memory-store-retirement.test.ts exclude by the prefix packages/spec/src/conversions/, which covers entries/; check-spec-docblock-symbol-anchors.mjs names the host only in a repaired-row record; check-future-spec-major.mjs uses the path as a fixture label; root-entry-migrations-split.pin.test.ts still finds the host in the root graph. No missed path reader found.
• Import order: definition order in the host is load-bearing only for the merge test's placement rule (by design, as the definition rule was) and for nothing at runtime — each per-major array is an explicit literal or inApplicationOrder(…) by order, every module is a leaf (verify refuses a leaf importing the host or another entry; grep finds none; 98 entries import only ../shared.js, itself a leaf), so evaluation order cannot change a table. ESLint is green on the head.
• Hand edits: none. Commits 5553ee4 and a8c5d94 touch no generated file; all 114 generated files carry the mark; every statement is verbatim base text; header shapes match the generator's wrapLineComment.
• Note (no finding, precedent): the script's --dts mode carries the 6348891160 union normaliser inside scripts/, which that ruling's item 3 said not to do; the pilot's script did the same and merged, and the second normalisation is correctly kept out of scripts/.

Findings:

• S1 should-fix (Phase 1 procedure): the regenerate's .d.ts reading must be taken on a quiet tree (no concurrent gate run in the worktree) and the report must say so; if a quiet head build ever reproduces the record-member-order diff, it is a fork on [Decision] Large source files: replace the hand-cut split with a script-generated split per file, so the remaining monoliths split in days, not months #29465 (outside both normalisers), not a pass under either. No code change.
• S2 should-fix: file the follow-up card now and cite its number in the PR body (review-checklist: follow-up owed becomes #N), covering the SKILL.md line 176 prescription, the MAJOR_18_CONVERSIONS docblock placement rule and the build-schemas.ts remedy text, so an agent retiring a key between landing and that fix is not sent to write a definition into registry.ts.
• No must-fix.

Implemented-by: claude/project-thread-enusuc
Reviewed-by: session_01WGufzfgvGexKn9vLHsy89K

VERDICT: PASS