docs(spec): the retirement changeset states twelve distinct names, and the tree-scan pin states its turbo radius

Contract-review conditions 1 and 2 on this PR. Prose and comment only: no
schema, registration, test assertion or generated artifact changes.

1. `.changeset/inert-deadline-keys-retired.md` — the retirement covers
   fourteen sites across twelve distinct leaf names, not thirteen.
   `durationMinutes` occurs at `TrainingCourse` and `ChangeImpact.downtime`,
   `estimatedMinutes` at `RollbackPlan.steps[]` and
   `ChangeRequest.implementation.steps[]`; thirteen is the count of distinct
   (file, name) pairs. The retirement kit no longer lists
   `json-schema.manifest/`, `spec-changes.json` or the protocol upgrade guide
   among the artifacts this branch moves: the manifest ratchets def names and
   no def leaves the published surface, and both projections filter the
   migration chain at the current protocol major, so the protocol-18
   registrations reach them at the 18 cut.

2. `packages/spec/src/system/deadline-keys-retirement.test.ts` — the tree-scan
   header now records that the walk's inputs outside this package's declared
   cross-package globs are not hashed by turbo, so that leg is a full-run
   guarantee rather than an affected-path one, and that typed resurrections
   are caught by the `never` channel independently. Comment only, no new
   declaration; the playbook-vs-gate gap is tracked on #15528.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G4138K1EG7kQ81FNba5Kp4

Author: claude

.changeset/inert-deadline-keys-retired.md

@@ -13,8 +13,9 @@ Maintainer ruling 2026-09-02 on the census card (ruled A: retire per family):
 ADR-0049 enforce-or-remove decides it — declared-but-unenforced deadline
 surface with zero measured readers comes off.
 
-Fourteen hour/minute/day-shaped deadline, SLA and duration keys (thirteen
-distinct names) sat on the exported incident-response, training and
+Fourteen hour/minute/day-shaped deadline, SLA and duration key sites — twelve
+distinct names, because `durationMinutes` and `estimatedMinutes` each occur at
+two sites — sat on the exported incident-response, training and
 change-management schemas and in the generated reference docs, and **nothing
 read them**: the schemas are exported from `@objectstack/spec/system`, mounted
 by no stack key, registered as no metadata type, absent from the 2026-06
@@ -125,10 +126,15 @@ The retirement kit:
   through the nesting carriers; the tsc `never` channel; no-materialize pins
   for the six former defaults; the ADR-0087 registration; and a tree-scoped
   absence pin over every authored source in the repo
-- generated baselines/docs follow the schema (`authorable-surface/` gains
-  eleven `[RETIRED]` rows, `authorable-defaults/` loses six rows,
-  `json-schema/`, `json-schema.manifest/`, spec-changes, upgrade guide,
-  reference docs)
+- generated baselines and docs follow the schema: `authorable-surface/` gains
+  eleven `[RETIRED]` rows, `authorable-defaults/` loses six rows, the three
+  system reference pages are regenerated, and the gitignored `json-schema/`
+  output is re-emitted on the next build
+- `json-schema.manifest/` is unchanged, and correctly so: it ratchets def
+  *names*, and retiring keys removes no def from the published surface
+- `spec-changes.json` and the protocol upgrade guide are unchanged too: both
+  project the migration chain at the current protocol major (17), so these
+  protocol-18 registrations reach them at the 18 cut
 - zero authored occurrences in this repo's examples, skills and hand-written
   docs, and zero hits in objectui at the pinned sha, so no in-repo source
   changes ride along beyond the three families' own unit tests

packages/spec/src/system/deadline-keys-retirement.test.ts

@@ -548,6 +548,27 @@ describe('[#14477] ADR-0087 registration', () => {
   });
 });
 
+// What this leg guarantees, and what it does not. The walk below reads the
+// whole repo tree from REPO_ROOT, but the inputs it reaches outside
+// `@objectstack/spec`'s declared cross-package globs in `turbo.json` are not
+// hashed by turbo. So a resurrection authored in `examples/**`, `apps/**`,
+// hand-written `content/docs/**` or most `packages/*/src/**` does not put this
+// suite into `turbo ls --affected`, and the PR that authors it can replay a
+// cached green. Read this leg as a FULL-RUN guarantee — the merge queue and a
+// plain `pnpm test` — rather than an affected-path one.
+//
+// `check:cross-package-test-inputs` is green here as designed: every literal
+// path this file names is declared, and the gate's declaration file states the
+// trade for a walk that descends on a loop variable (the escape verdict
+// resolves and the name does not). Widening spec's declared inputs to the
+// walk's real radius would put this suite on every docs PR, so nothing is
+// widened here; the playbook-vs-gate question is filed as #15528 and is not
+// this PR's to answer.
+//
+// Independently of turbo, every *typed* TypeScript resurrection is caught at
+// author time by the `never` channel pinned above, which needs no tree walk.
+// The residue this leg covers is the untyped rest: JSON, YAML, MDX and
+// unannotated literals.
 describe('[#14477] tree-scoped absence: nothing in the repo authors a retired key any more', () => {
   const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../..');
   const THIS_DIR = path.dirname(fileURLToPath(import.meta.url));