[finding] os migrate meta aborts at load on an object built with ObjectSchema.create that carries a retired key, although the refusal it prints tells the author to run os migrate meta

[objectstack-fleet]

Filing gate: ① a product defect with a measured reach:, class (a). Filed by the domain:cli execution seat (#6024, session local_1d2a197c-c20e-4e90-9be8-413d4d432289) from the #20620 dev's report on PR #20691. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens (measured at 6981abfd26)

os migrate meta --from 17 exits 1 at load with a raw ZodError array (unrecognized_keys, tenancy.organizationField) on a stack whose object is built with ObjectSchema.create(...) and carries a retired key. The refusal's own message prescribes "Run os migrate meta --from 17 to list the mechanical edits…", so the command it names refuses the same stack before its chain runs.

• Repro: defineStack({ objects: [ObjectSchema.create({ name: 'cr_ticket', label: 'Ticket', fields: { title: { type: 'text', label: 'Title' } }, tenancy: { enabled: true, organizationField: 'organization_id' } })] }) gives exit 1 with unrecognized_keys tenancy.organizationField.
• Control: the same object as a plain literal loads, the conversion object-tenancy-organization-field-removed applies, and schemaValid is true.
• The mechanism the dev read: the authored-source shim in packages/cli/src/utils/config.ts (DEFINE_HELPER_RE = /^define[A-Z]/) wraps only define* exports. ObjectSchema.create validates strictly at the call, before the migration chain can convert anything.
• reach: the public door os migrate meta. The named producers are 35 ObjectSchema.create( sites across examples/ (app-crm, app-showcase) and HotCRM (src/sales/objects/account.object.ts at hotcrm 087b7c5d). Any of them that carries a key retired at a step the author upgrades across cannot be migrated by the tool the refusal names.

Not decided here

Whether the fix belongs in the shim (wrap ObjectSchema.create too), in ObjectSchema.create (defer to the chain the way defineStack does), or in the refusal text is triage's routing and the owning seat's design. This card only records the defect and its reach.

Dedupe

A search of this repository for ObjectSchema.create migrate meta, authored-source shim ObjectSchema.create, DEFINE_HELPER_RE and migrate meta load unrecognized_keys finds only #20620 and PR #20691, where this was found, and closed cards about individual retirements. No card carries this defect.

Dedupe words: authored-source shim ObjectSchema.create · migrate meta load abort retired key · defineHelpersOf DEFINE_HELPER_RE · tombstone prescribes migrate meta that refuses

[objectstack-fleet]

Path: the road's upgrade step — the tool the refusal names can run on the stack it refused | 缺项 (os migrate meta's authored-source shim wraps only define* exports; ObjectSchema.create validates strictly at the call, so a retired key aborts the load before the chain can convert it) | P2

Triage: first grade — bug · priority:p2 · domain:cli · area:devpath · pm:queue. Direction (triage's call): widen the shim to the strict factories. ⛔ Don't loosen ObjectSchema.create

Triage: lands in packages/cli/src/utils/config.ts (DEFINE_HELPER_RE and the shim) ⇒ domain:cli.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T19:54Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2.

• The upgrade tool dead-ends on a real authoring style. The refusal prescribes os migrate meta, which then refuses the same stack with a raw ZodError.
• The producers are named: 35 ObjectSchema.create( sites in examples/, and HotCRM's objects. Any that carries a key retired across the author's upgrade can't be migrated.
• A workaround exists (rewrite the key by hand, or the object as a plain literal), which keeps it below p1.

Direction.

• The fix is in the shim. The migration loader needs to see pre-conversion sources.
  • ObjectSchema.create stays strict: its call-time refusal is what authors want at tsc and boot.
  • The shim wraps ObjectSchema.create the way it wraps define*, so the chain converts first.
• Enumerate, don't guess. List every strict factory @objectstack/spec exports for authoring (*.create and siblings), and wrap them all from one list. ⛔ Not a second regex heuristic.
• Pins: the card's repro migrates (the conversion applies, schemaValid: true). The plain-literal control is unchanged. An unrelated strict error still surfaces as a refusal, ⛔ not a raw ZodError array.

[objectstack-fleet]

Claim: PM loop round 1 of the domain:cli seat's session session_01VvcEokUG1tvVxkceYfR5XB (batch 3): priority:p2, the next card by the lane's full order after the two maintainer-prioritised p1 cards (#20761 went to the decision box)
Session: session_01VvcEokUG1tvVxkceYfR5XB
Account: huangyiirene
Branch: claude/issue-20696-migrate-strict-factories
Worktree: objectstack-issue-20696
Domain: domain:cli
Seat: domain:cli#1
File surface:

• packages/cli/src/utils/config.ts: the authored-source shim (DEFINE_HELPER_RE and the helper enumeration beside it) only.
• A pin file under packages/cli/test/ (or beside the shim's existing tests).
• .changeset/20696-*.md for @objectstack/cli.
• ⛔ No packages/spec edit: ObjectSchema.create stays strict (triage 5897579905). If the one list of strict authoring factories can only live in packages/spec, the dev stops and reports it, because packages/spec always belongs to the spec seat.

Stop on breach and explain in the report
Container & model: M, mode:subagent, model: default tier (opus) (dispatch-gates --tier at f7c6d65f: no path-derived mandate).
Clause-②: no
Clause-② reading: os migrate meta exists to read pre-conversion sources, and the refusal the platform prints already prescribes it for exactly this stack. Letting it load the stack brings it back to that declared behaviour. No spec schema, export or published accept set moves.
Thread-read: 5897579905
Serial constraints cleared: No open PR touches packages/cli (file lists of all 12 open PRs read in this act). The blocked cards #20583 and #20620 (this lane, pm:blocked) name the migrate or lint path but are not in flight. #20679 and #20676 (this seat, in flight) edit packages/runtime only.

Taken 2026-09-30T04:55Z, main f7c6d65f.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20696,
  "status": "done",
  "branch": "claude/issue-20696-migrate-strict-factories",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20801",
  "session": "session_01VvcEokUG1tvVxkceYfR5XB",
  "premise_still_valid": true,
  "summary": "Premise reproduced on main 91e8fa194. The card's repro (defineStack + ObjectSchema.create imported from @objectstack/spec/data + tenancy.organizationField) made `os migrate meta --from 17 --json` exit 1 with a raw ZodError array; the plain-literal control exited 0 with object-tenancy-organization-field-removed applied and schemaValid true. The fix is in the shim in packages/cli/src/utils/config.ts only. A written list, STRICT_AUTHORING_FACTORIES, holds 5 entries: ObjectSchema.create from spec/data, and App/Dashboard/Report/Action.create from spec/ui. The shim wraps each entry in place on the owner through a Proxy: the listed member is try-real-then-authored and every other member passes through. DEFINE_HELPER_RE is unchanged and no second pattern was added. The shim's stderr line now renders a raw ZodError through the project's formatZodError rather than its JSON array; this applies to define* helpers such as defineAgent too, because the template is shared. Where the list lives: the cli side. It does not have to be a packages/spec export, because the shim is its only reader and pin case 5 holds it to the spec surface in both directions. packages/spec is untouched and there is no needs_decision. Sibling cards: for #20620 (verdict-first report, its changeset already on main) and #20583 (os lint --json reads the conversion record), this diff touches neither code path. The only premise it moves is that `os migrate meta` now opens stacks whose objects are built with a strict factory.",
  "tests": "All at 5f3c0f648 unless noted; 3d877c6d4 is the final head, a docblock-only commit. (1) Pin packages/cli/test/migrate-meta-strict-factories.test.ts, unit tier, in-process MigrateMeta.run and loadConfig: `Test Files 1 passed (1) / Tests 5 passed (5)`; re-run at 3d877c6d4, 5 passed. (2) `pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2`: `Test Files 237 passed (237) / Tests 3370 passed (3370)`. The integration tier is declared to CI: no integration-tier file and no spawn or boot entry point was touched. (3) `pnpm --filter @objectstack/cli typecheck`: exit 0, test layer `OK ... 3 file(s) / 28 error(s) / 6 pinned signature(s) held` (pre-existing debt); tsconfig.test.json --listFilesOnly includes the pin file. (4) Full `pnpm lint`: exit 0 in 183s at 5f3c0f648. At 3d877c6d4 a targeted `eslint --no-inline-config --format json` over the 2 touched TS files: 2 linted, 0 ignored, 0 errors, 0 warnings. eslint.config.mjs sets no parserOptions.project and no typed rules, so the diff cannot move a verdict on an untouched file. (5) Ablations via scripts/ablation-replace.mjs, fix committed first. Each shows the anchor x1 to x0, the blob changed, then a restore to blob == HEAD with an empty `git diff HEAD`. The subject is src through relative imports, so no dist was involved. A, ObjectSchema entry deleted, at 5f3c0f648: 4 failed and 1 passed. Cases 1 and 3 fail on `expected 1 to be undefined` (exit 1 at load). Case 2 fails on `no applied in the --json payload: {\"error\":\"[ { \\\"code\\\": \\\"unrecognized_keys\\\"...`, the original defect. Case 5 fails on `add a strict create to STRICT_AUTHORING_FACTORIES...`. Case 4 is green by design: its population is the list. B, ZodError rendering disabled, at 888e0c78d: 2 failed (cases 1 and 3, `not to match /\"code\":\\s*\"/`) and 3 passed, as predicted. (6) Direct CLI runs at the fix: repro exit 0 with the tenancy conversion applied and schemaValid true; control unchanged; `os validate` on the repro still exits 1 with the tombstone.",
  "mcp_calls": "0 — no MCP GitHub tool used (reads: REST GET issue 20696 + comments, GET pulls?head= readback)",
  "api_writes": "3 — each one fleet-write relay repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches) carrying one op: pr_create -> POST /repos/objectstack-ai/objectstack/pulls (PR 20801, draft forced); assign via scripts/pm/label-write.mjs -> POST /repos/objectstack-ai/objectstack/issues/20801/assignees (huangyiirene, read back MATCHES); comment -> POST /repos/objectstack-ai/objectstack/issues/20696/comments (this report). git push is not a REST write (7 pushes to the branch).",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted in PR 20801 Acceptance notes, not filed · Reflect.ownKeys on a lazySchema proxy (e.g. ObjectSchema) throws TypeError because the trap omits the target function's non-configurable prototype; no public door measured reaching it, so it is an observation, not class a/b/c",
    "carrier: none (承接者:无) · noted in PR 20801 Acceptance notes and in the changeset, not filed · boundary: checks that only a factory makes when called (ObjectSchema.create: system-data with no write, referenceVia sibling, cbp master_detail required:false) are not part of the stack schema. A source that trips one now migrates with the refusal on the stderr line and schemaValid true. `os validate` still exits 1. This matches the existing shim's handling of defineStack's namespace-prefix check (throws, while ObjectStackDefinitionSchema.safeParse succeeds). schemaValid is documented as the stack-schema verdict"
  ],
  "gates": {
    "head": "3d877c6d4",
    "derived": 63,
    "ran": 63,
    "exit_zero": 63,
    "reconcile": "dispatch-gates --ran: 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero — all 63 recorded an exit code)",
    "delta_vs_dispatch_list": "+7 families added by the changeset (check-adr-0087-registration x2, check-empty-changeset x2, release-rehearsal-clone --self-test, check:objectui-changeset, check:pm-changeset-deadline-census); all run, exit 0",
    "also_at_5f3c0f648": "same 63 all exit 0 before the docblock-only final commit",
    "ci": "not read — PR opened as draft; convergence is the PM's read"
  },
  "deviations": [
    "Merged origin/main (085ca6bc1) into the branch before opening the PR, because dispatch-gates flagged the tree as stale. After the merge I rebuilt @objectstack/spec, the six cli-closure packages the merge changed, and @objectstack/cli.",
    "The unit tier, typecheck and full pnpm lint readings are at 5f3c0f648. 3d877c6d4 only corrects the docblock counts; at that head the 63 gates, the pin file and a targeted lint were re-run.",
    "The raw-ZodError rendering also changes the stderr text for define* helpers that throw a raw ZodError. It is the same template in the claimed file, the same defect class (pin 3), and it is named in the PR body and changeset.",
    "Ablation A was first run at 5156f7b14, where case 4 failed on a ReferenceError: the fixture depended on the list naming ObjectSchema. Commit 794971ded fixed the fixture, and A was re-run at 5f3c0f648. Ablation B was run at 888e0c78d, which is 5f3c0f648 minus the merge.",
    "Attribution: commit trailers use the model-free pair from the dispatch, and the PR footer uses the AGENTS.md session-URL form. The harness reminder's model-bearing trailer and its PR footer line were not used, per os-dev."
  ],
  "files_changed": [
    ".changeset/20696-migrate-meta-strict-factories.md",
    "packages/cli/src/utils/config.ts",
    "packages/cli/test/migrate-meta-strict-factories.test.ts"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #20801 at 3d877c6d (os migrate meta wraps the strict authoring factories)

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-09-30T07:50Z}

• Contract review of record: 5906682661 on the PR, CONTRACT_REVIEW_TIER, head 3d877c6d, PASS. The seat spot-checked the reviewer's readings before posting.

• Checklist:

  • Draft, base main, first line Fixes #20696, line-initial Clause-②: no, and no other closing keyword (scanned).
  • 3 files, +567 / −27, all on the claim's surface; no packages/spec path.
  • A @objectstack/cli patch changeset.
  • check-governed-merges --pr 20801: NOT governed.
  • 34 check runs on the head, latest per name: 31 success and 3 skipped. mergeable_state reads clean.

• Triage's three pins are held by migrate-meta-strict-factories.test.ts, and two ablations each reddened the expected cases:

  • the repro migrates, with schemaValid: true;
  • the plain-literal control is unchanged;
  • an unrelated strict error surfaces as a refusal, not a raw validation-error array.

  The one list is written on the cli side, and pin case 5 holds it to the spec surface in both directions.

• Out-of-scope findings: both are noted, not filed, and carried in the PR's Acceptance notes.

  • The lazy-schema proxy's ownKeys invariant has no measured public reach.
  • Factory-only checks sit outside schemaValid, which is its documented meaning.

• Sibling cards: [finding][devx] os migrate meta --from 17 buries a project's real findings under 240 generic protocol-18 notices, and marks default-flip conversions as "Applied" when the right action is usually no edit #20620 and [finding] the conversions defineStack applies still miss two door paths after PR #20579: os lint --json never reads the record, and a defineStack that converts then refuses drops them from --json #20583 (pm:blocked) are untouched by this diff, per the dev's reading, which the reviewer confirmed.

• Next: land through the queue. At the merge, the Fixes closes this card, and the seat removes pm:dispatched, closing the card itself if the merge does not.

---

Generated by Claude Code

[objectstack-fleet]

Landed: PR #20801 → d2b188fb57 (os migrate meta wraps the strict authoring factories)

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-09-30T08:10Z}

• Landing reading: d2b188fb57dc122fff81440c0aae96bec9c94ce4 is on origin/main as a single-parent squash. Content: packages/cli/src/utils/config.ts on origin/main names STRICT_AUTHORING_FACTORIES on 6 lines; the control DEFINE_HELPER_RE reads 3 lines.
• Closure: the merge did not close this card by itself (the same reading as PR fix(runtime): mount POST /automation/:name/clone on the dispatcher bridge, at both bases #20779 on runtime: POST /api/v1/automation/:name/clone is not mounted on the HTTP server — every flow clone, from the API and from the Setup packaged-automation page, answers 404 ENDPOINT_NOT_FOUND #20676 today). The seat closes it as completed and removes pm:dispatched in the same act.

---

Generated by Claude Code