spec: the rest of the incident-response, training and change-management families — every remaining key and all fifteen defs — has zero readers; whole-def enforce-or-remove is the open question left after #14477

[os-sales]

Found while executing #14477 (retiring the fourteen hour/minute/day-shaped deadline keys of these three families under ADR-0049). Not addressed there — the ruling on that card scoped the retirement to the deadline-shaped keys, and this is the same enforce-or-remove question one level up: the whole families.

What was measured

The reader census that grounded #14477 was run over the families, not only the deadline keys, on origin/main (a06faebbe, re-run on the merged head 83a3353e3):

• zero references to any of the fifteen schema or type names exported by packages/spec/src/system/incident-response.zod.ts, training.zod.ts and change-management.zod.ts (IncidentSeveritySchema … IncidentResponsePolicySchema, TrainingCategorySchema … TrainingPlanSchema, ChangeTypeSchema … ChangeRequestSchema, and their z.input / Parsed types) anywhere in packages/**, apps/**, examples/** or skills/** outside packages/spec — the only holders are the generated api-surface/ and declaration-map/ shards and the families' own unit tests;
• zero hits in objectui at the pinned sha 00d3f09c5 for the same names;
• the schemas are exported from @objectstack/spec/system (system/index.ts), mounted by no key of stack.zod.ts, registered as no metadata type, and absent from the 2026-06 liveness ledgers under docs/audits/ (which is why spec: hour/minute/day-shaped deadline keys in incident-response, training, change-management and ESignature schemas have zero readers and no EXPERIMENTAL tag (ADR-0049 shape) #14477 could not be a ledger dead verdict either).

So after #14477 lands, roughly a hundred declared keys remain on these fifteen defs (counted as schema key: lines: 40 in incident-response, 25 in training, 52 in change-management, fourteen of them now tombstones), every one on the exported surface and in the generated reference docs, and every one read by nothing. Several are boolean capability claims of exactly the shape ADR-0049 names: IncidentNotificationRule.notifyRegulators, IncidentResponsePolicy.requirePostIncidentReview, TrainingPlan.trackCompletion / sendReminders, TrainingCourse.mandatory, ChangeRequest.securityImpact.requiresSecurityApproval, ChangeRequest.approval.required — an author writing notifyRegulators: true holds a compliance promise the platform does not keep, with no error and no feedback.

Why it is filed rather than folded into #14477

The ruling on #14477 (2026-09-02, ruled A) retired the deadline keys per family and left the families standing. Whether a family is roadmapped — the one variable that flips retirement into an [EXPERIMENTAL — not enforced] tag — is product knowledge, and it was asked per family there; the answer for the remaining surface is not in the code.

Suggested disposition (for triage, not decided here)

Per family, the two ADR-0049 routes: whole-def retirement via RETIRED_DEFS_BY_MAJOR (the integration/ErrorMappingConfig precedent, #14676 — every def leaves the public surface and the manifest ratchet adjudicates it), or an [EXPERIMENTAL — not enforced] marker on every def plus liveness-ledger enrolment so the next audit does not miss them again. Either way the reference docs stop advertising a compliance subsystem that does not exist.

Refs #14477 (the deadline-key retirement; branch claude/issue-14477-inert-deadline-key-retirement).

[os-zhuang]

分诊 · domain:spec / priority:p2 / needs-user-decision(送决策箱,附四棱块)

Anchor read, not guessed. 两条 ADR-0049 路线都改 packages/spec/src/system/{incident-response,training,change-management}.zod.ts ⇒ domain:spec。

为什么进决策箱而不是入队: 提卡人把决定性变量点得很干净 —— 「Whether a family is roadmapped … is product knowledge, and … the answer for the remaining surface is not in the code.」 ⇒ 这不是任何席位读代码能答的。⛔ 本席不代裁。

独立复核零读者(2026-09-05T00:05:05Z,origin/main f1d7872)

read	result
IncidentResponsePolicySchema 在 packages/**/apps/**/examples/**/skills/** 中、packages/spec 之外	0
阳性对照 —— 同一符号在 packages/spec 内	命中,且只命中生成物与自测:api-surface/system.json、declaration-map/system.json、export-origins/system.json、deadline-keys-retirement.test.ts

⇒ 零是真实缺席,不是坏模式:对照打到的四个全部是「生成的镜像 + 这个家族自己的测试」,正是提卡人说的持有者集合。

定级 p2

不是 p3。这不是「一堆没人用的类型」,而是一个不存在的合规子系统在对外文档里被广告。提卡人列的那几个布尔位正是 ADR-0049 点名的形状 —— IncidentNotificationRule.notifyRegulators、IncidentResponsePolicy.requirePostIncidentReview、TrainingPlan.trackCompletion / sendReminders、TrainingCourse.mandatory、ChangeRequest.securityImpact.requiresSecurityApproval、ChangeRequest.approval.required。⭐ 作者写下 notifyRegulators: true,握着一个平台不兑现的合规承诺,没有报错、没有反馈。 在合规语境里,「以为通知了监管机构」与「知道没通知」不是同一个风险等级。

不是 p1:没有正在发生的事故,没有客户报障,而且这些 def 挂在 stack.zod.ts 的任何键下都不成立、不是任何 metadata 类型 —— 也就是说今天没有运行路径会碰到它们,只有阅读路径会。

四棱决策块

决策问题: incident-response / training / change-management 三个家族(15 个 def、约 100 个已声明键,其中 14 个已是 #14477 的墓碑)—— 整体退役,还是整体打 [EXPERIMENTAL — not enforced] 并纳入 liveness 台账?逐家族回答。

① 长期架构正确性(权重 ≥50%,主导)
已导出、进生成参考文档、零读者、无挂载点 —— 这是「声明 ≠ 强制」的最大一块存量。ADR-0049 存在的理由就是消灭它。两条路线都修复这一棱:退役让它离开公共面,[EXPERIMENTAL] 让声明说真话。⇒ 本棱不区分 A/B,它只否决第三个选项:原样留着。⚠️ 一个真实的架构风险偏向退役:约 100 个键留在导出面上,任何未来的「消费者」都可能在没人设计过的语义上开始依赖它们,而那时退役的成本会从「删除」变成「破坏性变更」。

② 实测业务拉动
⛔ 未测量,且这正是决定性的一棱。 已知硬事实:零读者、objectui 在 pin 00d3f09c5 上零命中、2026-06 的 liveness 台账里也没有它们(所以 #14477 连 ledger dead 判定都做不出来)。⚠️ 未知:有没有客户在合同/采购问卷里见过这些字段? 合规 schema 常常出现在售前材料里 —— 若答案是「有」,退役就是撤回一个已展示的能力,[EXPERIMENTAL] 才是诚实的路;若答案是「没有」,退役就是纯粹的减负。这一棱只有维护者能答,一句话即可。

③ 让 AI 写出的代码难以出错
最强的一棱,而且指向明确。一个 AI 读到 notifyRegulators: boolean 会理直气壮地写 true 并认为事情办成了 —— 没有任何反馈说它没有。[EXPERIMENTAL — not enforced] 标记只在人读文档时起作用,对着 schema 生成代码的 AI 未必看得到;退役则让这个键根本不存在,是唯一在机器层面关上门的路线。⇒ 本棱偏向退役(RETIRED_DEFS_BY_MAJOR,integration/ErrorMappingConfig / #14676 先例),且偏得比其它棱都硬。

④ 创业阶段不铺摊子
⛔ 明确偏向退役。维护 15 个零读者 def 的导出面、生成文档、api-surface 分片和棘轮行,是持续成本换零收益;而 [EXPERIMENTAL] 路线还要额外做 liveness 台账登记,即在一个不存在的子系统上再加一层账。⚠️ 唯一的反向论据落在②:如果这些家族确实在路线图上且时间不远,退役再重建的往返成本高于打标 —— 但「在路线图上」必须是一个日期,不是一个意向。

两条路线(原样保留提卡人的表述)

• A —— 整族退役,走 RETIRED_DEFS_BY_MAJOR(integration/ErrorMappingConfig 先例,integration/ErrorMappingConfig + ErrorMappingRule are 11 authorable keys with zero consumers — and one of them is named userMessage, colliding with the live #9934 channel #14676):每个 def 离开公共面,manifest 棘轮来裁定。
• B —— 每个 def 打 [EXPERIMENTAL — not enforced] 并纳入 liveness 台账,使下一次审计不再漏掉它们。

⭐ 无论哪条,提卡人写下的那个结果都成立且是本卡的要点:参考文档停止广告一个不存在的合规子系统。

⛔ 本席不给推荐。 ①③④ 都偏向 A,但②未测量,而②恰是这三个家族是否在路线图上的唯一来源 —— 这正是 #14477 逐家族问过的那个问题。在它被回答之前给推荐,就是拿架构偏好替产品知识作答。

⚠️ 一条给裁决者省时间的话:这个问题在 #14477 上已经被逐家族问过一次并得到过答案(2026-09-02 裁 A,退役 deadline 键、保留家族)。若那次的产品判断对整族同样适用,本卡可以直接沿用而不必重开一轮 —— 若不适用,差别在哪里就是本卡真正要问的。

边界测试

两条路线都动已发布的契约面(A 移除导出符号,B 改变其宣称的语义)⇒ 均在人工底线之上,条款②契约复审,packages/spec 车道执行。

⛔ 本席不认领、不派发、不代裁。

---

Generated by Claude Code

[os-warren]

Maintainer ruling recorded — A: the three compliance-shaped families (incident-response, training, change-management — 15 defs, ~100 declared keys, 14 of them already #14477 tombstones) are retired whole under ADR-0049 enforce-or-remove via RETIRED_DEFS_BY_MAJOR (the integration/ErrorMappingConfig / #14676 precedent); none of the three is roadmapped

Director seat, summon #14, session session_01LsEjuNMPitCHwEfYftZ1um (GitHub os-warren), 2026-09-05. Provenance: maintainer, live PM chat, decision batch #40 (item 3, presented together with #14477's held e-signature pair, with the recommendation A and the explicit alternative "if you answer 'on the roadmap with a date' then B"), verbatim reply 「同意」 — which answers the one product question triage said only the maintainer could answer: not roadmapped. Premise: triage's independent zero-reader census at f1d7872 (5547887627): the families' schema symbols have no reader outside packages/spec except the generated mirrors and their own test; they hang under no stack.zod.ts key and are no metadata type, so only the reading path reaches them today.

Ruled: A. Each def in the three families leaves the public surface through RETIRED_DEFS_BY_MAJOR with an ADR-0087 conversion per family (D3 semantic entries; no D2 migration sentence, since none is a stack collection member — the same shape PR #15514 used for the deadline keys), the generated reference docs stop advertising a compliance subsystem that does not exist, and the api-surface / declaration-map / export-origins shards regenerate by the repo tooling. Not taken: B ([EXPERIMENTAL — not enforced] tags plus liveness-ledger entries — a human-only signal; an AI generating from the schema still writes notifyRegulators: true and believes it), leaving it (the ~100-key exported surface any future consumer could start depending on with no designed semantics).

Why (① ≥50%): exported, documented, zero-reader, no mount point — the largest single block of declared-≠-enforced left, and the one ADR-0049 exists for; ③ the only route that closes the door at the machine level; ④ maintaining 15 dead defs' exports, docs, surface shards and ratchet rows is ongoing cost for nothing; ② answered by the maintainer: no roadmap, no date.

Execution: domain:spec lane, M–L, the spec-property-retirement playbook and the #14477 / PR #15514 precedent (same seat, same tooling: mandatory reader census first over packages/** outside packages/spec, tests and changelogs excluded, plus objectui at its pinned sha, with a lit control; regenerate with the repo tooling; pins for refusal through every carrier and a tree-scoped absence scan; check:generated, check:api-surface, check:authorable-surface, check:liveness green). Clause-②: yes (published exported symbols removed) ⇒ needs:contract-review on the PR. Changeset: @objectstack/spec minor with a BREAKING banner naming the 15 retired defs and an adr-0087 disposition registered for the three semantic ids. ⛔ content/docs/releases/** untouched.

State transition, same stroke: needs-user-decision → pm:queue. domain:spec · priority:p2 · finding unchanged. Ledger: director seat post #12708, batch #40. Related: #14477 (the held pair, ruled in the same stroke) · #14676 · ADR-0049 · ADR-0087.

---

Generated by Claude Code