docs(adr-0087): the disposition text names the second no-migration-prescription refusal - #33460

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c87603a2a628344cbc4e1867280016f71707ca5e
Local-runs: none
Scope: docs/adr/0087-metadata-protocol-upgrade-contract.md + none (no implementing file is in the diff; scripts/check-adr-0087-registration.mjs on origin/main was read to judge the ADR, not reviewed)

Inputs: card #32674 (body, triage, claim, os-dev-report), PR #33460 (body, one-file list, net diff against main at merge base ba35dfd7), and the 50 check-runs on the head. main has since moved to 0c2aeb96; no commit after the merge base touches the ADR or the gate, so the gate read on origin/main is the gate the amendment describes. Check-runs at review time: 15 success, 26 skipped, 9 in progress (Test Core 1/8, Type Check x4, Lint x4), none failed. The in-progress runs have to go green before landing; this record does not stand in for them.

① Derived judgments

• Accept set: unchanged. The diff touches no gate, schema or code. The ADR's documented category set, read with the gate's own documentedCategories pattern (adr-0087\s*:\s*not-required\s*\(\s*([a-z-]+)) on base and head, is the same six on both: already-registered, no-migration-prescription, runtime-export-retired, runtime-interface-only, type-surface-only, unpublished. That is exactly CATEGORIES on main, so assertInputs' VOCABULARY DRIFT check (both directions) cannot fire. The diff adds no marker example. Right.
• Public surface: none. docs/adr/** ships in no package. Right.
• Gate vocabulary: no category, marker spelling, signal name (NARROWED_SIGNAL = metadata-protocol-narrowed) or refusal text changed. Right.

② Semver level

skip-changeset (label applied; Check Changeset is success). That matches a diff that publishes nothing. The PR body carries Clause-②: no and Metadata-protocol: none, both correct for a prose-only ADR amendment that narrows nothing an author writes. Right.

③ Boundary flags

• open_questions: empty.
• Dev deviation 1 (thread ran at the claim's default tier, while dispatch-gates --tier mandates contract-review tier for docs/adr/**): answered by this record, which is the owed review at tier.
• Dev deviations 2 and 3 (the signature is a prose line rather than an HTML comment; the commit carries a model-free trailer pair): process only, outside ④. Not escalated.
• Out-of-scope note (the Status block does not list this amendment; the 2026-10-12 table row at :1078 stays as measured): see ④ finding 4 for the Status block. The :1078 row is a dated measurement of feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 under the gate as it stood then, and is correctly left alone.

④ Design judgment

docs/adr/0087-metadata-protocol-upgrade-contract.md, against its first consumer scripts/check-adr-0087-registration.mjs on main, sentence by sentence:

• "it is also refused outright, before its justification or its body is read": holds. In scan(), the no-migration-prescription plus NARROWED_SIGNAL check sits right after CATEGORIES.includes and before the 40-character why check and every prescription-detector read. This matches the gate header's own wording ("before its justification or its body is read").
• "on a changeset that declares Metadata-protocol: narrowed, signal (5) of the breaking declaration": holds. breakingDeclaration() pushes NARROWED_SIGNAL only when readMetadataProtocolLine returns kind === 'declared' && value === 'narrowed', which is signal (5) in its docblock.
• The reason sentence ("A narrowing refuses something an author used to write ... upgrade guide and objectstack migrate meta, both generated from the ledger ... before a save door, a publish or a boot refuses it; whether the fix is written as an arrow, a table or a sentence does not change that"): a faithful paraphrase of the refusal message in scan() and the header section "A declared narrowing owes the upgrade guide (check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601)".
• The prescription ("a registered semantic entry, one file under packages/spec/src/migrations/entries/semantic/, or a category resting on a checked fact when one is true: already-registered, unpublished, runtime-interface-only, type-surface-only, runtime-export-retired"): matches the refusal text (MIGRATION_LEDGER_ENTRY_DIRS[0] is packages/spec/src/migrations/entries/semantic). The open list is exactly the gate's: in scan() the refusal is keyed on d.category === 'no-migration-prescription' alone, so every other category stays open on a narrowing.
• "If the change refuses nothing an author could write, the Metadata-protocol: line is what is wrong, not the disposition": matches the refusal text's last line.
• Boundaries ("added, semantic and none keep the exemption, and a changeset already breaking at the branch point is inherited and never re-judged"): hold. Those three kinds push no signal. The M/R branch in scan() skips a changeset whose base-side text is already breaking by any signal, which is exactly "already breaking at the branch point".
• Table row note at :880 ("on a changeset declaring Metadata-protocol: narrowed it is refused before the body is read; see the vocabulary paragraph of the 2026-08-13 addendum"): correct. The measured text "refused — the body carries a FROM/TO block." is kept, and the pointer resolves to the heading "the changeset disposition vocabulary".
• No ruled sentence deleted: the word diff replaces only the closing prescription; with prescription ( + insertion + );. The −6 lines are the same words re-wrapped, and the table row's measured text is intact. Amendments annotate.
• Citations: check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601 is the gate card (closed by PR fix(adr-0087): refuse not-required (no-migration-prescription) on a declared Metadata-protocol: narrowed #32649). Its body's "Seat decision (option A of the dev's three ...)" is the rule stated. PR fix(adr-0087): refuse not-required (no-migration-prescription) on a declared Metadata-protocol: narrowed #32649 merged at merge commit a8c761fbe5ec06978f5e3582a35cf8be0c0503ae on 2026-11-12, which is the amendment's date. All accurate. Seat decision A's own open list omits runtime-export-retired; the amendment follows the landed gate, which includes it. That is the right source to follow, and the gate dev flagged it on check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601.
• Style: (**amended DATE**, #card ...: ...) matches the ADR's existing inline amendments (e.g. :147, :562).

Findings:

1. nit. The ADR still says "the no-migration-prescription refusal" in the singular at :823 (D7, runtime-interface-only "also inherits" it), :881 (table, "inherits that same refusal"), :1001 (type-surface-only "the only category exempt from" it) and :1204 (runtime-export-retired "inherits" it). Each means the body-prescription refusal, and the gate inherits only that one. The category now has two refusals, though, and a reader who enters at D7 does not see that the narrowing refusal is not inherited. The amendment's explicit open list settles it, so there is no contract effect. Accepted deviation, or a follow-up card if the seat wants the four sentences qualified.
2. nit. The amendment's "declares" carries the gate's DECLARED-reading boundary unstated: a malformed or near-miss Metadata-protocol: line triggers nothing here. The gate header calls this a deliberate boundary pinned in the NP battery. There is no contract effect, because the level gate refuses such a line on the PR. Accepted deviation.
3. nit. "The fix is a registered semantic entry" mirrors the refusal's own prescription, but registered accepts any id that is new in the diff and resolves in LEDGER_SOURCES. The migration registry is generated from all three MIGRATION_LEDGER_ENTRY_DIRS (semantic, retired-keys, retired-defs), so a new retired-keys entry for a removed key also clears the gate. Prescriptive rather than exclusive, and it matches the gate's text. Accepted deviation.
4. nit. The Status block lists no amendment for this rule change. Precedent is mixed: inline amendments 2026-08-06 (spec 生成物按 category 分片：拆掉三个单体 ratchet 文件的合并队列串行税（维护者 2026-08-06 已拍板） #5837) and 2026-09-13 ([Decision] 两条裁决援引同一个 launch-window convention，却给出相反的 changeset 等级（minor vs major）—— 退役一个可写键到底发哪一级？ #18003) are also absent from it, and the dated inline note plus the table pointer make the change findable. Accepted deviation, or a follow-up card if the maintainer wants the Status block exhaustive.

No must-fix and no should-fix: nits alone end the round.

Implemented-by: claude/project-thread-4z6pjc
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T21:56Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

维护者速读

• 改了什么:ADR-0087 处置一节与类别表行补记第二种拒绝：变更集声明 Metadata-protocol: narrowed 时,no-migration-prescription 也被拒(PR fix(adr-0087): refuse not-required (no-migration-prescription) on a declared Metadata-protocol: narrowed #32649 起门禁已如此),并写明原因、处方与仍开放的类别。只加注，不删已裁定的句子。
• 为什么改：门禁与它所依据的 ADR 文字不一致，作者照 ADR 写标记会撞上 ADR 没解释的拒绝(卡 ADR-0087: the disposition section says no-migration-prescription is refused only by a body carrying a prescription; since PR #32649 it is also refused on a changeset declaring Metadata-protocol: narrowed #32674)。
• 风险与回滚：纯文档，不动门禁与类别词表(ADR 与 CATEGORIES 仍是同样六类)。回滚即还原本 PR。
• 先看:ADR-0087 处置段落里带 2026-11-12 日期的插注，再看类别表那一行的注。
• 两分钟验证:git diff origin/main -- docs/adr/0087-metadata-protocol-upgrade-contract.md。
• 需要你做的：受管面 Tier H(docs/adr/**),契约复审 PASS 评论 6884807805(Head-sha c87603a2a628344cbc4e1867280016f71707ca5e)已在案，请批准或直接合并。
• 席位意见：可以合。复审逐句对照 check-adr-0087-registration.mjs:触发条件、在 scan() 中的顺序、处方、仍开放的类别与边界均成立;四处措辞小瑕疵记为接受的偏差。

席位核对

Verdict: ACCEPT, held for the maintainer · head c87603a2a628344cbc4e1867280016f71707ca5e · card #32674 · report 6884608125 · contract review 6884807805 (PASS on this head, CONTRACT_REVIEW_TIER; Ruling-ref for the in-seat review: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb option A).

• Shape: draft → main, Fixes #32674. docs/adr/0087-metadata-protocol-upgrade-contract.md (+19 / -6, the -6 is re-wrapping of the same words). skip-changeset. GOVERNED, Tier H (docs/adr/**). Clause-②: no; Metadata-protocol: none.
• Contract: the amendment states signal (5) from breakingDeclaration(), its place in scan(), the refusal's reason and its fix (MIGRATION_LEDGER_ENTRY_DIRS[0]), the open categories (equal to the gate's) and the boundaries, all as the merged gate (a8c761fb) makes them. The ADR's documented categories still equal CATEGORIES; assertInputs cannot fire.
• Gates: 25 derived, 25 exit 0 (ADR-0087 self-test and --base run included). Check-runs on the head all concluded, none failing.
• Accepted deviations (review nits): N1, four later places (D7 and three more) say "the no-migration-prescription refusal" in the singular, meaning the body-prescription one; the amendment's explicit open list settles the reading. N2, "declares" leaves out that a malformed Metadata-protocol: line triggers nothing. N3, "the fix is a registered semantic entry" is a recommendation; any LEDGER_SOURCES id passes. N4, the Status block does not list the amendment (precedent mixed).
• Process: the thread ran at the default tier, met by this in-seat review.
• Landing: Tier H. The seat does not flip this PR ready or enqueue it. It needs the maintainer's merge, or an authorised APPROVED review after which the seat lands it.

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c87603a2a628344cbc4e1867280016f71707ca5e
Local-runs: none
Scope: docs/adr/0087-metadata-protocol-upgrade-contract.md + none (no implementing file is in the diff; scripts/check-adr-0087-registration.mjs, packages/spec/scripts/build-migration-registry.ts and the entry directories on main were read to judge the ADR, never reviewed)

At-tier re-review, judged from the tree. Inputs: card #32674 (body and all four comments), PR #33460 (body, one-file list, net diff against main from merge base ba35dfd7), and the check-runs on the head. main is now 8e63ed87; no commit between the merge base and it touches the ADR or the gate, so the gate read on main is the gate the amendment describes. Check-runs on the head: every run completed, conclusions are success or skipped only, none failed or cancelled (Lint · docs & code guards, Lint · PM dispatch-gates, Check Changeset, Check Documentation Links, Governed Surface Queue Guard, Test Core, Type Check all success).

① Derived judgments

• Accept set: unchanged. One prose file; no gate, schema or code in the diff. The diff adds no adr-0087: not-required (CATEGORY marker example, so the set documentedCategories reads off the ADR is the same six on base and head and equals CATEGORIES on main (unpublished, already-registered, no-migration-prescription, runtime-interface-only, type-surface-only, runtime-export-retired). assertInputs' VOCABULARY DRIFT check cannot fire in either direction. Right.
• Public surface: none. docs/adr/** ships in no package. Right.
• Ruled text: the word diff removes exactly one token, the closing prescription;, replaced by prescription ( + the insertion + );. The other removed lines are the same words re-wrapped, and the table row keeps its measured sentence whole. Nothing ruled is deleted or re-graded. Right.

② Semver level

skip-changeset label, Check Changeset success: matches a diff that publishes nothing. PR body carries Clause-②: no and Metadata-protocol: none; both are correct for an ADR annotation that changes no accept set and nothing an author writes. Right.

③ Boundary flags

• open_questions: empty.
• Dev deviation 1 (the thread ran at the claim's default tier while dispatch-gates --tier reads MANDATORY contract-review tier for docs/adr/**): answered by this record, the owed review at tier.
• Dev deviations 2 and 3 (prose signature line instead of an HTML comment; model-free commit trailer pair): process only, no contract face. Not escalated.
• Dev out-of-scope note (Status block not extended; the 2026-10-12 table row at :1078 left as measured): the :1078 row is a dated measurement of feat(plugin-email)!: email templates resolve from the registry; the built-in seed, the boot sweep and the live projector retire (ADR-0131 D6/D10, C4 stage 2) #22875 under the gate of its day and is correctly untouched; the Status block is finding 4 below.
• Earlier record 6884807805 (served off-tier; not used as evidence): it raised four nits and no must-fix or should-fix, so there is no fix owed on this head. Judged independently, I confirm all four (they are findings 1 to 4 below) and reject none. Its per-sentence readings of scan() and breakingDeclaration() match what the tree says. I add two nits it did not raise (5 and 6).

④ Design judgment

docs/adr/0087-metadata-protocol-upgrade-contract.md, against its first consumer, scripts/check-adr-0087-registration.mjs on main, and against the decision it records (#32601, seat decision A; PR #32649 merged 2026-11-12 as a8c761fbe5ec06978f5e3582a35cf8be0c0503ae).

Sentence by sentence (:765 to :778):

• "also refused outright, before its justification or its body is read": holds. In scan() the check d.category === 'no-migration-prescription' && decl.signals.includes(NARROWED_SIGNAL) sits directly after the CATEGORIES.includes refusal and before the 40-character why check and before any findMigrationPrescription read. Same words as the gate's header section "A declared narrowing owes the upgrade guide (check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601)".
• "on a changeset that declares Metadata-protocol: narrowed, signal (5) of the breaking declaration": holds. breakingDeclaration() pushes NARROWED_SIGNAL only for kind.kind === 'declared' with value narrowed, read from the changeset body by the imported readMetadataProtocolLine; that is item 5 of its docblock.
• The reason sentences (a narrowing refuses something an author used to write; the upgrade guide and objectstack migrate meta, generated from the ledger, are where an upgrading author learns it; arrow, table or sentence does not change that): a faithful restatement of the refusal message and the header section. No claim beyond them.
• "The fix is a registered semantic entry, one file under packages/spec/src/migrations/entries/semantic/": that path is MIGRATION_LEDGER_ENTRY_DIRS[0], the directory the refusal text and the check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601 Ask both name. The same ADR paragraph, two lines up, already states the real registered rule (ids that resolve and are new in the diff), so the accept rule is not misstated; see finding 3.
• "or a category resting on a checked fact when one is true: already-registered, unpublished, runtime-interface-only, type-surface-only, runtime-export-retired": exactly the gate's open set. The refusal is keyed on the one category, so the other five stay open on a narrowing, each under its own re-checked predicate. Seat decision A's text lists four; the gate as landed adds runtime-export-retired, and the ADR rightly follows the landed gate.
• "If the change refuses nothing an author could write, the Metadata-protocol: line is what is wrong, not the disposition": the refusal message's last sentence.
• "added, semantic and none keep the exemption": holds; none of the three pushes a signal, and the category then falls through to the ordinary body check.
• "a changeset already breaking at the branch point is inherited and never re-judged": holds; the M / R branch reads the base-side text and skips the file when breakingDeclaration is already true there, before any disposition is read.

Table row (:880): the measured sentence stays; the note says the category is refused before the body is read on a declared narrowing and points to "the vocabulary paragraph of the 2026-08-13 addendum", which resolves to the heading at :732 ("the changeset disposition vocabulary, and its fifth category"). Correct, and it does not re-grade the #12104 measurement.

Attempts to break it, none of which lands:

• A second, contradicting statement of the rule elsewhere in the ADR: every other no-migration-prescription mention (:800, :823, :912, :1001, :1078, :1083, :1204, :1224, :1249) is about the body-prescription refusal or a dated measurement; none says the category is open to a narrowing.
• A narrowing declared by the direction arm alone (signal (4), no narrowed kind): the gate does not refuse it, and the ADR does not say it does; the amendment is worded on the kind, not on narrowing in general.
• Citation and date: check-adr-0087-registration: a changeset declaring Metadata-protocol: narrowed can still take not-required (no-migration-prescription), so a narrowing ships with no upgrade-guide entry (#32345 item 2) #32601 is closed by PR fix(adr-0087): refuse not-required (no-migration-prescription) on a declared Metadata-protocol: narrowed #32649, whose merge commit and merge date are the ones cited; the inline (**amended DATE**, #card ...) form matches :147 and :562.
• Mechanical gates on the changed file (adr links, anchors, symbol anchors, index, doc authoring): all inside green check-runs on the head. No link, anchor or marker example was added.

Findings (all nits; none affects correctness or the contract):

1. nit. :823 (D7), :881, :1001 (D8) and :1204 (D9) still say "the no-migration-prescription refusal" in the singular. Each means the body-prescription refusal, which is the only one those categories inherit or are exempt from; the amendment's explicit open list settles the reading. Accepted deviation, or a follow-up card to qualify the four sentences.
2. nit. "declares" leaves the DECLARED-reading boundary unstated: a malformed or near-miss Metadata-protocol: line, or a changeset carrying no such line, triggers nothing in this gate (the level gate refuses a bad line on the PR). The gate header calls this deliberate and pins it in the NP battery. Accepted deviation.
3. nit. "The fix is a registered semantic entry" is the decision's and the refusal's own prescription, but narrower than what the gate admits: registered accepts any id new in the diff under either LEDGER_SOURCES registry, and the migration registry is built from all three entry directories (semantic, retired-keys, retired-defs). A removed key, the first shape narrowed names, is properly a retired-key entry. The paragraph's own registered sentence carries the true rule and an author following the ADR is never refused, so no contract effect. Accepted deviation.
4. nit. The Status block does not list this amendment. Precedent is mixed (the inline 2026-08-06 spec 生成物按 category 分片：拆掉三个单体 ratchet 文件的合并队列串行税（维护者 2026-08-06 已拍板） #5837 and 2026-09-13 [Decision] 两条裁决援引同一个 launch-window convention，却给出相反的 changeset 等级（minor vs major）—— 退役一个可写键到底发哪一级？ #18003 amendments are not listed either), and this one records a seat decision under an existing gate, not a maintainer ruling. Accepted deviation, or a follow-up card if the maintainer wants the block exhaustive.
5. nit (new). "signal (5) of the breaking declaration" and the Metadata-protocol: line itself are defined nowhere in the ADR; both live in the gate's breakingDeclaration docblock (ruling A, changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105). The paragraph ends by pointing at the gate file, so the reference resolves one hop away. Accepted deviation.
6. nit (new). The amendment is a thirteen-line, seven-sentence parenthesis inside one item of a semicolon list, so the list's remaining items (runtime-interface-only, type-surface-only, runtime-export-retired) now start mid-paragraph after it. It is the ADR's own inline-amendment form (:562) and reads correctly; a blockquote note under the paragraph would read easier. Prose only. Accepted deviation.

No must-fix and no should-fix: nits alone end the round.

Implemented-by: claude/project-thread-4z6pjc
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-15T00:29Z · isolated sub-agent at CONTRACT_REVIEW_TIER (served model verified by the seat) · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Correction: contract-review tier

The contract-review record(s) 6884807805 on this PR say Served-tier: CONTRACT_REVIEW_TIER, and the seat adopted them as "isolated sub-agent at CONTRACT_REVIEW_TIER". That is wrong. The seat launched the reviewing sub-agent without the tier, so it ran at the seat's own default tier, not at CONTRACT_REVIEW_TIER. The seat found this on its own audit. The review was still isolated and adversarial, and its findings stand as an off-tier review. They are not the at-tier record AGENTS.md and the in-seat review ruling require.

The seat re-runs the review at CONTRACT_REVIEW_TIER on this PR's head and posts that record here. Until it does, this PR has no at-tier record.