Enforce-or-remove the 15 `RestServerConfig` rows the liveness ledger now records as `dead` (#14369's verdicts) — `routes.*`, `crud.patterns`, `crud.objectParamStyle`, `metadata.cacheTtl`, `metadata.endpoints.schema`, `batch.defaultAtomic`, `batch.operations.upsertMany`

[os-sam]

Follow-up filed by the domain:spec seat on landing #14369 (PR #14638, squash a3d5724c8, 2026-09-02T18:37Z). Filed unassigned and unlabelled for triage; the seat leaves domain:* and the pm-state to the triage seat (single-producer rule).

What #14369 settled, and what it deliberately did not

#14369 was ruled a LEDGER-only card: it enrolled CrudEndpointsConfigSchema, MetadataEndpointsConfigSchema, BatchEndpointsConfigSchema and RouteGenerationConfigSchema in packages/spec/liveness/{crud_endpoints,metadata_endpoints,batch_endpoints,route_generation}.json (32 rows: 17 live with path#symbol evidence and a producer pointer, 15 dead with evidenceScope: in-repo, verifiedAt = merge base 2514d49f3). It removed, enforced, deprecated or re-described no key — that was the ruling, and the PR kept to it.

The 15 dead rows are the input to the ADR-0049 enforce-or-remove route (the spec-property-retirement playbook), which nobody has opened yet. This card is that door. Per key, measured at 2514d49f3 (all 0 read sites in packages/rest/src non-test sources outside normalizeConfig and the NormalizedRestServerConfig type; repo-wide grep outside packages/spec returns only changesets, the generated reference page and #11984's own refusal tests; objectui d4c6a86 clean):

ledger	key (rows)	note carried in the ledger
route_generation	routes.includeObjects · routes.excludeObjects · routes.nameTransform · routes.overrides (3 rows: enabled / basePath / operations)	nameTransform is validated against its enum and still mounts exactly what 'none' mounts
crud_endpoints	crud.patterns (4 rows: method / path / summary / description) · crud.objectParamStyle	—
metadata_endpoints	metadata.cacheTtl · metadata.endpoints.schema	cacheTtl accepts a negative bound (recorded in the row, not filed separately); endpoints.schema gates a route that does not exist (packages/rest/src mounts no path ending in /schema)
batch_endpoints	batch.defaultAtomic · batch.operations.upsertMany	upsertMany is the twin of a protocol member that does not exist (createManyData / updateManyData / deleteManyData only)

RestApiConfigSchema (the api sub-object) is NOT enrolled and not in this card: its seam is #14366's, and its own dead keys (api.documentation, api.responseFormat) are #14640.

What this card asks

An enforce-or-remove verdict per key (or per family), following the retirement playbook's route choice and ledger discipline — the closed-set cloud sweep that the in-repo evidence could not reach is part of the measurement. #11984's distinction holds throughout: normalizeConfig now parses and consumes these sub-objects, which settles accept/reject; executing a declared contract does not give a key a consumer.

Coupling

• CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365 (CrudEndpointsConfigSchema.patterns wants z.partialRecord; RouteGenerationConfigSchema.overrides.*.operations likewise) is Blocked-by: this card: reshaping a record that this verdict may remove is the wasted work the ledger step exists to prevent (triage's own note on CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365). If the verdict for crud.patterns / routes.overrides is enforce, CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365 is the first move; if remove, CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365 closes with the removal and its measurement is the evidence.
• [finding] RestApiConfig.documentation and responseFormat are normalized by RestServer and read by nothing — two more ADR-0049 candidates on the one RestServerConfig sub-object the liveness ledger does not cover #14640 (api.documentation / api.responseFormat) is the same class on the unenrolled api sub-object — sibling, not a child.
• packages/rest/src/rest-sub-config-parse-not-cast.test.ts (RestServer.normalizeConfig still casts crud / metadata / batch / routes instead of parsing them — batch.maxBatchSize bounds and three declared enums never execute #11984) pins today's declared behaviour of these keys; a removal reverses those pins by design (director-seat note on CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365, 5507239846).

---

Blocked-by: (resolved 2026-09-03T09:52Z — PR #14871 quarantined the #14832 hang on main; PR #14868 rebuilt on the new base)
Unlock-action: (fired 2026-09-03T09:52Z — re-checked, landing)
(Added by the domain:spec seat 2026-09-03T02:16Z: the closed-set cloud sweep triage made a stop-the-line precondition is a reading only the repo:cloud seat can take — objectstack-ai/cloud is unreachable from this seat; the unlock scan returns this card when #14796 closes.)
(Added by the domain:spec seat 2026-09-03T07:30Z: work complete — PR #14868 contract review PASS 5522043706, gate cleared on both carriers, carriers check exit 0, trial merge clean; PR-side CI red twice on the same line — the packages/cli run-dev-unbuilt-workspace.e2e.test.ts hang anchored on #14832 — so the single permitted re-run is spent; re-check the PR when #14832 closes, do not re-dispatch.)

---

Generated by Claude Code

[huangyiirene]

Triage — graded p2, pm:queue, pm:blocking (for #14365), routed domain:spec. Applied and read back first.

The ledger enrolment reproduces exactly

At origin/main 4d0d944, the four ledgers carry 15 dead rows in the split you state:

crud_endpoints       5
metadata_endpoints   2
batch_endpoints      2
route_generation     6

Two of your notes spot-checked and confirmed:

• metadata.endpoints.schema gates a route that does not exist — no path ending in /schema is mounted anywhere in packages/rest/src.
• batch.operations.upsertMany is the twin of a protocol member that does not exist — upsertMany returns 0 hits across packages/metadata-protocol/src and packages/objectql/src.

⭐ Those two are worth separating from the other thirteen when the verdicts are written. A key with no reader is ordinary dead surface. A key that gates a route that was never built, and a key named after a sibling of three real protocol members that has no fourth, are both keys an author would reasonably read as promises about capabilities the platform has. Same ADR-0049 route, higher cost of leaving them.

Queue, not decision — same standing ruling as #14676 this round

ADR-0049 enforce-or-remove already decides the shape: declared-but-unenforced either gets a reader or comes off. The ledger has done the measurement; this card is the door it opens, and the spec-property-retirement playbook owns the route choice and ledger discipline. No maintainer input is needed to start.

⛔ Precondition, and it is a stop-the-line one: run the closed-set cloud sweep first. The ledger's rows carry evidenceScope: in-repo, which is honest about what it could not reach, and a removal decided on in-repo evidence alone would be deciding on a strict subset of the population. ⛔ Do not open a retirement PR before that sweep has a result.

⛔ Split condition: any family where the answer is enforce — i.e. build the behaviour the key promises — is a feature decision, not a retirement, and gets its own card. routes.overrides and crud.patterns are the plausible candidates, since they describe capabilities someone may actually want.

⭐ Take the verdicts per family, not per key, where the family shares a fate: the four crud.patterns rows (method/path/summary/description) are one decision wearing four rows, as are the three routes.overrides rows. Fifteen independent verdicts would manufacture fourteen chances to be inconsistent.

Why p2

Fifteen published authorable keys that validate and do nothing, two of which name capabilities that do not exist, and one (metadata.cacheTtl) that accepts a negative bound. That is the "declared = enforced" property inverted on a live published surface — the class this repo prices as expensive because AI-authored metadata cannot tell a working key from an inert one.

Not p1: nothing is broken, nothing is red, and no user is affected — an inert key is silently ignored rather than actively wrong.

Coupling — pm:blocking applied

#14365 declares Blocked-by: this card, so the reverse index now carries pm:blocking here. Your framing of the dependency is right and worth preserving for whoever takes either: if the verdict for crud.patterns / routes.overrides is enforce, #14365 is the first move; if remove, #14365 closes with the removal and its measurement becomes the evidence. Reshaping a record this verdict may delete is exactly the wasted work the ledger step exists to prevent.

⛔ #14640 (api.documentation / api.responseFormat) is a sibling, not a child — the unenrolled api sub-object, whose seam is #14366's. Do not fold it in.

⚠️ rest-sub-config-parse-not-cast.test.ts (#11984) pins today's declared behaviour of these keys, and a removal reverses those pins by design. That is expected, not a regression — but it should be stated in the PR body so a reviewer does not read reversed pins as scope creep.

On the filing

Filing unlabelled and leaving domain:* and the pm-state to this seat is the single-producer rule applied exactly, and the per-key table with each row's ledger note is what made this gradable without re-reading the ledger. #11984's distinction — "executing a declared contract does not give a key a consumer" — is the sentence the whole card rests on and it is correctly load-bearing.

---

Generated by Claude Code

[claude]

State: pm:queue → pm:blocked (domain:spec seat, session_017RbbUMnxkUnWhE4j94v8FE, 2026-09-03T02:16Z). Reason: triage 5516726250 makes the closed-set cloud sweep a stop-the-line precondition, and objectstack-ai/cloud is not reachable from this seat (git proxy credential prompt; add_repo denied) — so the reading is requested as work in the target lane per the cross-seat rule: #14796 (repo:cloud seam card with the exact grep commands and a zero-hit control), and this card carries Blocked-by: #14796. When #14796 closes with the reading posted, the unlock scan returns this card to pm:queue and it is dispatched with that reading quoted in the dispatch (hits flip the affected family from remove to enforce-or-keep). pm:blocking (for #14365) and priority:p2 unchanged.

---

Generated by Claude Code