@@ -22,7 +22,7 @@ Run `os migrate meta --from 16` to list the mechanical edits for existing source
 
 Stored metadata needs no edit. The automation engine's flow rehydration and stored-row rehydration still replay the whole conversion chain, these seven entries included, so `sys_metadata` flows and sharing-rule rows written under an old spelling keep loading in canonical form. A built artifact whose declared protocol floor is at or below `17.7.0` is also still converted at the artifact-ingestion door.
 
-The metadata save door's flow fallback keeps its verdict: when no automation service is reachable (or its canonicalizer throws), `saveMetaItem` judges a flow body after replaying the same conversion chain the automation engine's canonicalizer replays, retired entries included, so a host's verdict on a saved flow still does not depend on whether it runs an automation service.
+The metadata save door's flow fallback now reaches the canonicalizer's verdict for every retired flow shape. When no automation service is reachable (or its canonicalizer throws), `saveMetaItem` judges a flow body after replaying the full conversion chain the automation engine's canonicalizer replays, retired entries included (the default flip `flow-decision-mode-inclusive-explicit` excepted, as there). That covers the seven entries retired here and those retired earlier that walk a flow: `flow-inert-keys-removed` (`flow.active`, `flow.template`, `nodes[].outputSchema`, `errorHandling.fallbackNodeId`) and `flow-node-wait-timeout-keys-removed` (`waitEventConfig.timeoutMs` / `onTimeout`). On such a host a body carrying one of those older keys was refused 422 by its tombstone before; it is now healed for the verdict, which is what a host with an automation service already did. What is stored stays the body as submitted, so a host's verdict on a saved flow no longer depends on whether it runs an automation service.
 
 Eight more entries below 18 stay on the load path, each with the reason recorded in its docblock: `flow-node-http-callout-rename` and `page-kind-jsx-to-html` (the old value is still accepted by its schema), `view-visibleOn-to-visibleWhen` and `page-component-visibility-to-visibleWhen` (the schema still declares and folds the deprecated key), `flow-node-wait-event-config-lift` and `flow-node-connector-config-lift` (the node's `config` has no contract to refuse the loose keys), `datasource-driver-mongo-to-mongodb` and `retry-policy-converged`.
 
 
@@ -401,10 +401,13 @@ describe('saveMetaItem canonicalizes flow bodies (#4542)', () => {
      * [#21982] On the fallback path — no canonicalizer resolved, or it threw —
      * the gate judges the body in its ADR-0087 D2-converted spelling, for the
      * verdict only. The flow parse refuses an undeclared config key on the
-     * builtin node types, so without the conversion a D2 spelling every other
-     * door converts first (`os validate`, `defineStack`, `registerFlow`) would
-     * be refused here, and only here: a verdict that depended on whether the
-     * host runs an automation service. What is STORED stays the raw body.
+     * builtin node types, so without the conversion a D2 spelling the
+     * canonicalizer converts first (`registerFlow`'s full chain, retired
+     * entries included) would be refused here, and only here: a verdict that
+     * depended on whether the host runs an automation service. So the fallback
+     * replays that same full chain (#23487) — for the seven flow spellings
+     * retired from the authoring funnel at 18 and for those retired before
+     * them alike. What is STORED stays the raw body.
      */
     describe('[#21982] the fallback gate judges the D2-converted body, and stores the raw one', () => {
         const scriptBody = (config: Record<string, unknown>) => ({
@@ -430,6 +433,20 @@ describe('saveMetaItem canonicalizes flow bodies (#4542)', () => {
             expect(storedFlow(rows)!.body.nodes[0].config).toEqual({ functionName: 'helpdesk.triage' });
         });
 
+        it('an older-retired flow shape (`flow.active`) reaches the canonicalizer\'s verdict too — healed for the verdict, stored raw', async () => {
+            // `flow-inert-keys-removed` (retired from the load path after 16.1.0)
+            // tombstones `active`. On a host with no automation service the
+            // fallback used to judge it in the authoring posture and refuse it
+            // 422; the service-backed path replays the entry and heals it. Since
+            // #23487 the fallback replays the same chain, so both hosts agree.
+            const { protocol, rows } = makeProtocol(new Map());
+
+            const result = await save(protocol, { ...flowBody({ objectName: 'lead', filter: { status: 'stale' } }), active: false });
+
+            expect(result.success).toBe(true);
+            expect(storedFlow(rows)!.body.active).toBe(false);
+        });
+
         it('an undeclared key on delete_record is refused 422 INVALID_METADATA at its path — the alias beside it is not', async () => {
             const { protocol, rows } = makeProtocol(new Map());
 
 
@@ -4187,19 +4187,18 @@ const objectIndexTypePartialRemoved: MetadataConversion = {
  *    default flip 3 → 0 never needed a materialization step while the job one
  *    did: nothing was ever deployed under the old reading.
  *
- * `retiredFromLoadPath` is NOT set: `FlowNodeSchema.config` is an unconstrained
- * record, so no schema rejection can reach `config.retry.retryDelayMs` and the
- * conversion layer is the only seam that can declare and retire that spelling.
- * The `RetryPolicySchema` tombstone still fires for anyone who reaches the
- * policy through a parsed job.
- *
- * **A recorded verdict at 18 (#23487):** it stays. Re-measured on the 18 line,
- * a `try_catch` node's `config.retry: { retryDelayMs }` still passes the flow
- * parse unrefused, and a source job that omits `maxRetries` would silently drop
- * from three retries to none without the step-0 default materialization. It can
- * retire once that `retry` block refuses `retryDelayMs` naming `backoffMs`, and
- * the job default flip is settled for sources (or the entry is recorded as
- * permanent).
+ * `retiredFromLoadPath` is NOT set, and the base-delay rename is not why:
+ * every surface that carried `retryDelayMs` already refuses it with the rename
+ * to `backoffMs` (the `RetryPolicySchema` tombstone, which a `try_catch` node's
+ * `config.retry` is, and `flow.errorHandling`'s own).
+ *
+ * **A recorded verdict at 18 (#23487):** it stays, for the job half alone. It
+ * writes the pre-17 `maxRetries: 3` / `backoffMultiplier: 2` into a source
+ * `job.retryPolicy` that omits them; retired, the authoring funnel would stop
+ * doing that, and such a job would silently drop from three retries to none
+ * under the merged 0 / 1 defaults — a default flip no gate can see. It can
+ * retire once that default flip has a ruling for authored sources (or the entry
+ * is recorded as permanent).
  */
 const retryPolicyConverged: MetadataConversion = {
   id: 'retry-policy-converged',