spec: absorb the same-step evaluated-slot D3 entry, and name all four defs that change projection direction

Contract review F1 (blocking): the evaluated-expression-slots-source-required
semantic entry sits in the same unpublished step 18 as this retirement, and still
enumerated the two retired slots among "the 36 declaring positions" while telling
the upgrader to give a sampling condition a dialect and a non-blank source — the
exact envelope this head now refuses. The playbook's same-major absorption rule
applies to the published D3 record exactly as it applied to the census test and the
helper docblock: that entry now reads 34 positions, names the two absentees and the
retirement that took them, and routes a hit at either slot to
observability-cel-predicates-retired instead of to its own repair.

F2: four published JSON Schemas change projection direction, not two. system/MetricsConfig
and system/TracingConfig lose x-io input and gain a default; the nested
system/ServiceLevelIndicator and system/TraceSamplingConfig lose x-io input and gain a
required member (enabled, rules) with no default to declare, so no ratchet row can hold
them — stated in the changeset and in both default-change reasons instead.

F3: the new entry's acceptance proof claimed tsc refuses a string or an envelope at both
slots. Measured: tsc catches the string at both, and the envelope only at successCriteria;
the condition envelope is structurally admitted by the record arm and is refused at parse.
The proof now separates the two channels and says which spelling each one catches.

Also states the nuance the review asked for: both error-map precedents this retirement
copies its mechanism from also registered a D2 conversion because a mechanical rewrite
existed, and here none does.

Claude-Session: https://claude.ai/code/session_01AmH9bKvGoLjiY86Q4Z3og2
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/18118-retire-observability-cel-arms.md

@@ -61,21 +61,45 @@ a wrong number is worse than an absent one.
 - **ADR-0087 disposition: a D3 SEMANTIC entry**, `observability-cel-predicates-retired`,
   not a D2 conversion. A predicate is an intent that no threshold/operator pair or
   attribute filter records; a mechanical strip would delete what the author meant and leave
-  no trace of which SLI or which sampling branch lost it. The prescriptions therefore carry
-  **no** `os migrate meta` sentence — that sentence is owed only where a conversion covers
-  the surface.
+  no trace of which SLI or which sampling branch lost it — and it would not even be lossless
+  in the weak sense, because `successCriteria` is REQUIRED (a strip leaves an SLI that no
+  longer parses) and a composite branch stripped of its `condition` declares no condition at
+  all. That is the one place this retirement parts company with the two precedents it copies
+  its MECHANISM from: `crypto.hash` on `HookBodyCapability` and `managedBy: 'system'` both
+  ALSO registered a D2 conversion, because for each of them a mechanical rewrite existed.
+  Here none does, which is what makes D3 the right disposition rather than merely an
+  available one. The prescriptions therefore carry **no** `os migrate meta` sentence — that
+  sentence is owed only where a conversion covers the surface.
+- **The same-major D3 record is absorbed, per the playbook's 「同 major 记账」.** The
+  `evaluated-expression-slots-source-required` entry landed into this same unpublished step,
+  and it enumerated these two slots among its 36 declaring positions while instructing the
+  upgrader to give a sampling `condition` a dialect and a non-blank `source` — the exact
+  envelope this head now refuses. Both entries first ship together, so the composite of the
+  two changes is the retirement alone: that entry now reads 34 positions, names the two
+  absentees and why, and routes them to this retirement instead of to its own repair.
 - **The surviving accept sets are pinned beside the refusals.** `successCriteria` still
   takes `{ threshold, operator, percentile? }`; a composite `condition` still takes any
   filter object carrying no `dialect` key — `{ source: 'x' }` included, because `source`
   alone is an ordinary filter key and the retirement narrowed the `dialect` door only.
-- **Two published JSON Schemas change projection direction**, and it is mechanical rather
-  than chosen: the retired arm held the last `.transform()` in the `system/MetricsConfig`
-  and `system/TracingConfig` subtrees, so both defs now project in output mode instead of
-  falling back to the input shape. `system/MetricsConfig:slis` and
-  `system/TracingConfig:sampling` therefore publish the `default` the parser has always
-  applied, declared in `DEFAULT_CHANGES_BY_MAJOR`; and the nested type cells of both
-  reference pages lose the `?` from their default-bearing keys. **No runtime default moves**
-  — measured twice, by byte-identity of the untouched `.default(…)` and by parsing a
+- **FOUR published JSON Schemas change projection direction**, and it is mechanical rather
+  than chosen: the retired arm held the last `.transform()` in each of these subtrees, so
+  each def now projects in output mode instead of falling back to the input shape. All four
+  lose `x-io: input`, and what each gains differs:
+
+  | published schema | gains |
+  | --- | --- |
+  | `system/MetricsConfig` | `default: []` on `slis`, plus 8 `required` members |
+  | `system/TracingConfig` | `default: {"type":"always_on","rules":[]}` on `sampling`, plus 4 `required` members |
+  | `system/ServiceLevelIndicator` | one `required` member, `enabled` |
+  | `system/TraceSamplingConfig` | one `required` member, `rules` |
+
+  Only the first two carry a `default` move, so only those two are declarable in
+  `DEFAULT_CHANGES_BY_MAJOR` — the nested pair's `required` growth has no ratchet row to
+  live in and is stated here instead. A `required` that lists defaulted keys is this repo's
+  existing output-mode convention, not a new one, and the same-category control
+  `system/CacheConfig` is untouched. The reference pages show the same signature: the nested
+  type cells of both pages lose the `?` from their default-bearing keys. **No runtime default
+  moves** — measured twice, by byte-identity of the untouched `.default(…)` and by parsing a
   minimal config on the built package.
 
 ## What is deliberately NOT in this change

packages/spec/scripts/lib/default-changes.ts

@@ -381,6 +381,15 @@ export const DEFAULT_CHANGES_BY_MAJOR: Readonly<Record<number, readonly Declared
         + 'present — and those cells carried `?` at the base. Nothing '
         + 'deployed changes behaviour; the consumer affected is one outside this repo who reads '
         + 'the published JSON Schema\'s `default` himself, and what he now reads is what the '
+        + '⚠️ FOUR published JSON Schemas change projection direction in this diff, not the two this '
+        + 'table has rows for, and the other two are disclosed nowhere else: `system/MetricsConfig` and '
+        + '`system/TracingConfig` lose `x-io: input` AND gain a `default` (these two rows), while the '
+        + 'nested `system/ServiceLevelIndicator` and `system/TraceSamplingConfig` lose `x-io: input` '
+        + 'and gain a `required` MEMBER with no default to declare — `enabled` and `rules` respectively — '
+        + 'so this ratchet never sees them. Measured at head: all four carry no `x-io` and `required` '
+        + 'lists the defaulted keys; ten other `system` defs are still input-mode, and the same-category '
+        + 'control `system/CacheConfig` is untouched. A `required` that lists defaulted keys is this '
+        + 'repo\'s existing output-mode convention, not a new one. '
         + 'parser has always applied. To keep the old value there is nothing to write — the key, '
         + 'its type and its default are unchanged.',
     },
@@ -403,6 +412,15 @@ export const DEFAULT_CHANGES_BY_MAJOR: Readonly<Record<number, readonly Declared
         + 'key of every `system/TracingConfig` nested type cell (`parentBased`, `propagation`, '
         + '`spanLimits`, `performance`, `instrumentation`), the output-mode signature. '
         + 'Nothing deployed changes behaviour; the consumer affected is one outside this '
+        + '⚠️ FOUR published JSON Schemas change projection direction in this diff, not the two this '
+        + 'table has rows for, and the other two are disclosed nowhere else: `system/MetricsConfig` and '
+        + '`system/TracingConfig` lose `x-io: input` AND gain a `default` (these two rows), while the '
+        + 'nested `system/ServiceLevelIndicator` and `system/TraceSamplingConfig` lose `x-io: input` '
+        + 'and gain a `required` MEMBER with no default to declare — `enabled` and `rules` respectively — '
+        + 'so this ratchet never sees them. Measured at head: all four carry no `x-io` and `required` '
+        + 'lists the defaulted keys; ten other `system` defs are still input-mode, and the same-category '
+        + 'control `system/CacheConfig` is untouched. A `required` that lists defaulted keys is this '
+        + 'repo\'s existing output-mode convention, not a new one. '
         + 'repo who reads the published JSON Schema\'s `default` himself. To keep the old value '
         + 'there is nothing to write — the key, its type and its default are unchanged.',
     },

packages/spec/src/migrations/entries/semantic/18.evaluated-expression-slots-source-required.ts

@@ -7,29 +7,28 @@ import type { SemanticMigration } from '../../types.js';
 export const entry: SemanticMigration = {
   id: 'evaluated-expression-slots-source-required',
   surface:
-    'every EVALUATED expression slot in the spec — the 36 declaring positions the #15811 census '
-    + 'enumerated by identity, not by a name scan: the formula Field.expression; the predicate '
+    'every EVALUATED expression slot in the spec — the 34 declaring positions of the #15811 census '
+    + 'that survive into this major, enumerated by identity and not by a name scan: the formula '
+    + 'Field.expression; the predicate '
     + 'keys visibleWhen / visibleOn / readonlyWhen / requiredWhen / visibility / disabledWhen / '
     + 'visible / disabled / condition / when, on Field, SelectOption, InlineGridColumn, '
     + 'ScriptValidation, CrossFieldValidation, ConditionalValidation, Hook, ObjectFieldGroup, '
     + 'RowCrudActionOverride, CriteriaSharingRule, PluginPermission.filter, MultiVersionSupport '
     + 'routing, Action and ActionParam (including each param option), BaseNavItem, BulkActionDef, '
-    + 'PageComponent, PageTabs items, RecordAlert, ListViewShape, FormFieldBase, FormSection, the '
-    + 'settings-manifest Specifier and manifest visible, the ServiceLevelIndicator successCriteria '
-    + 'union member and the TraceSamplingConfig composite condition union member — authored either '
+    + 'PageComponent, PageTabs items, RecordAlert, ListViewShape, FormFieldBase, FormSection and the '
+    + 'settings-manifest Specifier and manifest visible — authored either '
     + 'as an expression envelope carrying only ast ({ dialect: \'cel\', ast: … } with no source), '
     + 'or with a source that is blank after trimming, through the envelope key '
-    + '({ dialect: \'cel\', source: \'   \' }) or the bare-string shorthand for it. ⚠️ At the '
-    + 'TraceSamplingConfig composite condition slot the reachable set is WIDER than those two '
-    + 'spellings, because the structured-filter arm beside the expression arm narrowed with it: a '
-    + 'bare record accepted { dialect: \'cel\', ast } as an ordinary filter, which made the rule '
-    + 'inert there, so that arm now declines ANY object carrying a dialect key. Six shapes the '
-    + 'base accepted through that arm alone are refused at that slot: { dialect: \'cel\' }, '
-    + '{ dialect: \'js\', source: \'x\' }, { dialect: \'nope\', source: \'x\' }, '
-    + '{ dialect: \'cel\', source: 5 }, '
-    + '{ dialect: \'cel\', source: \'x\', meta: { rationale: 5 } } and '
-    + '{ dialect: \'zzz\', foo: 1 }. A structured filter carrying no dialect key is accepted '
-    + 'exactly as before. The published '
+    + '({ dialect: \'cel\', source: \'   \' }) or the bare-string shorthand for it. ⚠️ The census '
+    + 'this entry was written against counted 36, and the two that are deliberately absent here are '
+    + 'the ServiceLevelIndicator successCriteria and TraceSamplingConfig composite condition '
+    + 'expression arms. They are not lost: they were RETIRED OUTRIGHT in this same unpublished '
+    + 'major by the observability-cel-predicates-retired entry of this step, under ADR-0049 '
+    + 'enforce-or-remove, because nothing evaluated either. Both entries first ship together, so an '
+    + 'upgrader never meets those two slots under THIS rule — the composite of the two changes is '
+    + 'the retirement alone, and stating the narrowing for a slot that no longer accepts an '
+    + 'expression at all would send the upgrader to author one. That absorption is the only reason '
+    + 'the count here is not the census figure the #15811 card records. The published '
     + 'TypeScript interface RowCrudPredicates narrows with the two slots it mirrors. Reachable '
     + 'wherever metadata is authored or stored: defineStack sources, an exported stack passed to '
     + 'objectstack validate, a POST body on any of these metadata types, and a row already sitting '
@@ -94,19 +93,15 @@ export const entry: SemanticMigration = {
     + 'the slots named in `surface`: an expression envelope with no `source` key, and a `source` '
     + '(or bare-string shorthand) that is empty after trimming. ⚠️ Sweep by SLOT, not by key name '
     + '— `visible` is on this list for actions, action params, nav items, bulk actions, record '
-    + 'alerts and settings manifests, and is NOT an expression slot elsewhere; and three of the '
-    + 'positions are union members (`RecordAlertProps.visible`, '
-    + '`ServiceLevelIndicator.successCriteria`, `TraceSamplingConfig.composite[].condition`). On '
-    + 'TWO of those three the sibling arm is untouched: `RecordAlertProps.visible` still takes a '
-    + 'boolean literal, and `ServiceLevelIndicator.successCriteria` still takes its structured '
-    + '`{ threshold, operator, percentile? }` object — including one that carries a `dialect` '
-    + 'key. ⚠️ On the third, `TraceSamplingConfig.composite[].condition`, the sibling arm '
-    + 'narrows WITH the expression arm and that is deliberate: a bare record accepted '
-    + '`{ dialect: \'cel\', ast }` as an ordinary filter, so the rule was inert there. The sweep '
-    + 'at that ONE slot is therefore wider — flag every `condition` object carrying a `dialect` '
-    + 'key, not only the two spellings above; if it is a structured filter, drop the `dialect` '
-    + 'key, and if it is an expression it needs a dialect this platform evaluates AND a non-blank '
-    + '`source`. For each hit: if it carries an `ast`, run '
+    + 'alerts and settings manifests, and is NOT an expression slot elsewhere; and ONE of the '
+    + 'positions is a union member, `RecordAlertProps.visible`, whose sibling arm is untouched: it '
+    + 'still takes a boolean literal, so a boolean there is not a hit. ⚠️ The two OTHER union '
+    + 'members the #15811 census listed — `ServiceLevelIndicator.successCriteria` and '
+    + '`TraceSamplingConfig.composite[].condition` — are deliberately NOT on this sweep, because '
+    + 'their expression arms were retired outright in this same major (see `surface`). Sweep those '
+    + 'two under `observability-cel-predicates-retired` instead, whose instruction is the opposite '
+    + 'of this one: there, an expression is not repaired, it is replaced by the structured shape or '
+    + 'moved out of application metadata. For each hit: if it carries an `ast`, run '
     + '`printCelAst(ast)`; a string result IS the migration and needs no judgment beyond reading '
     + 'it back. A `null` result, or a blank `source`, is the hand-migration case — decide per the '
     + '`replacement` note whether the slot was meant to carry a predicate (author the `source`) or '

packages/spec/src/migrations/entries/semantic/18.observability-cel-predicates-retired.ts

@@ -45,6 +45,14 @@ export const entry: SemanticMigration = {
     + 'predicate is an intent no threshold/operator pair or attribute filter records, so '
     + 'stripping the key would delete what the author meant and leave no trace of which SLI or '
     + 'which sampling branch lost it — exactly the judgment a semantic TODO exists to hand back. '
+    + '⚠️ And a strip here is not merely lossy, it is INVALID: `successCriteria` is a REQUIRED '
+    + 'key, so removing it leaves an SLI that no longer parses, and a composite sampling branch '
+    + 'that loses its `condition` declares no condition at all — inert today, and the moment a '
+    + 'sampler is wired it reads as UNCONDITIONAL. That is the difference from the '
+    + 'two error-map precedents this retirement copies its MECHANISM from — `crypto.hash` on '
+    + 'HookBodyCapability and `managedBy: \'system\'` — both of which also registered a D2 '
+    + 'conversion, because for each of them a mechanical rewrite existed. Here none does, which is '
+    + 'what makes D3 the right disposition rather than merely an available one. '
     + '⚠️ The structured arm of each union is NOT decided here: it is equally unread today, and '
     + 'it is measured on its own card. ADR-0087, ADR-0058 D7, ADR-0049.',
   acceptanceCriteria:
@@ -56,12 +64,18 @@ export const entry: SemanticMigration = {
     + 'predicate into a threshold by guessing the number — nothing was evaluating it, so there is '
     + 'no behaviour to preserve and a wrong number is worse than an absent one. Two proofs. '
     + '(1) `objectstack validate` is clean on a stack authored in config files: a surviving '
-    + 'predicate is refused at the slot with the retirement prescription, and authoring one is a '
-    + '`tsc` error at the call site because the slot\'s input type no longer admits a string or '
-    + 'an envelope. ⚠️ The prescription reaches the author for the STRING spelling; the envelope '
-    + 'spelling on `successCriteria` is refused by the structured arm\'s own missing-key issues '
-    + '(`threshold`, `operator`) rather than by the prescription — measured, and pinned both ways '
-    + 'in the schema\'s unit tests. (2) For stored rows, load the tenant and confirm every '
+    + 'predicate is refused at the slot with the retirement prescription. ⚠️ TWO CHANNELS, and '
+    + 'they do not cover the same set — measured, not assumed. `tsc` catches the BARE-STRING '
+    + 'spelling at both slots, and the `{ dialect, source }` envelope at `successCriteria` only '
+    + '(the structured arm is a closed object literal, so the envelope is an excess-property '
+    + 'error). It does NOT catch the envelope at `condition`: the surviving arm there is a record '
+    + 'of string to unknown, which admits `{ dialect, source }` structurally, so that one spelling '
+    + 'compiles and is refused at PARSE by the arm\'s `dialect` rule. ⛔ Do not read a clean '
+    + '`tsc` as a clean sweep of `condition`. The PRESCRIPTION divides differently again: it '
+    + 'reaches the author for every refused spelling at `condition`, and for the string spelling '
+    + 'only at `successCriteria`, where the envelope is refused by the structured arm\'s own '
+    + 'missing-key issues (`threshold`, `operator`). All three legs are pinned in the schemas\' '
+    + 'unit tests. (2) For stored rows, load the tenant and confirm every '
     + 'metrics and tracing config still rehydrates: a row carrying a predicate at either slot now '
     + 'fails its parse at the load seam and is reported there, naming the slot. A row whose '
     + '`successCriteria` is a structured rule and whose sampling `condition` objects carry no '