fix(spec): the remaining migration-entry families state each lesson in words, not tracker numbers (stage 9)

Each ADR-0087 semantic entry that still cited a tracker, pull-request,
decision-batch or cross-repository number in its replacement / reason /
acceptanceCriteria prose now says what the cited ruling, measurement or
fix decided. Verbatim quotes that carried a card or batch number keep only
their operative words. ADR ids and contributor-guide rule references stay;
the address entry's dangling AGENTS.md rule number is stated as the rule.

Text only: no entry id, surface, conversion or matcher changes.

Claude-Session: https://claude.ai/code/session_014EJ1ED8X4MMrT18BhVx4tx
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/migrations/entries/semantic/17.approval-escalation-enabled-default-flip.ts

@@ -16,7 +16,8 @@ export const entry: SemanticMigration = {
     + 'the escalation sweep actually reads',
   reason:
     'A DECLARED-DEFAULT CORRECTION plus the enforcement that makes the key real '
-    + "(#12278, maintainer ruling 2026-08-27) — the same category as protocol 17's "
+    + "(maintainer ruling 2026-08-27, which moved the declared default to what the sweep had "
+    + "always done) — the same category as protocol 17's "
     + '`import-run-automations-declared-default-corrected`: the schema promised '
     + '`enabled` defaults to `false` (SLA off) while the plugin-approvals sweep never '
     + 'read the key at all — any escalation block with a positive `timeoutHours` '

packages/spec/src/migrations/entries/semantic/17.auth-config-unadvertised-reserved-features.ts

@@ -11,14 +11,16 @@ export const entry: SemanticMigration = {
     + 'client: no login UI anywhere renders a passkey or magic-link affordance off them, so '
     + 'the payload advertised two sign-in methods a user could never reach, and a deployer '
     + 'setting `plugins.passkeys` / `plugins.magicLink` flipped a switch with no observable '
-    + 'effect (ADR-0049 enforce-or-remove; maintainer ruling 2026-08-11 on #7481 chose remove '
-    + 'over keep-as-reserved). The two are not equally empty: nothing at all is wired behind '
+    + 'effect (ADR-0049 enforce-or-remove; the maintainer ruling of 2026-08-11 chose remove '
+    + 'over keep-as-reserved, so that a deployer cannot flip a flag that does nothing '
+    + 'anywhere). The two are not equally empty: nothing at all is wired behind '
     + '`passkeys`, whereas `magicLink`\'s better-auth endpoints are live and only their '
     + 'advertisement was withdrawn. This is a RESPONSE surface — nobody authors or persists '
     + 'an `AuthFeaturesConfig` — so there is no source for the chain to rewrite; the schema '
     + 'tombstones both keys via retiredKey() and consumers drop their read. The withdrawal is '
     + 'conditional: both return to the payload in the change that ships the login UI '
-    + '(objectui#4179). ADR-0049, #7481.',
+    + '(flag-gated passkey and magic-link entry points, which objectui defers until the '
+    + 'maintainer schedules them). ADR-0049.',
   acceptanceCriteria:
     'No client reads `features.passkeys` or `features.magicLink` off `/api/v1/auth/config`; '
     + 'a client that gated UI on either now treats the capability as absent rather than '

packages/spec/src/migrations/entries/semantic/17.batch-row-result-schema-shape.ts

@@ -20,14 +20,18 @@ export const entry: SemanticMigration = {
     + 'validated and read `undefined` at runtime — the declared-but-not-delivered shape this '
     + 'registry exists to close, on the response envelope (ADR-0119 D4 deferred the '
     + 'reconciliation off a bug fix; this is that tracked change, shipped in the 17 major '
-    + 'window). The ADR-0119/#4620 rollback marking is structured in the same move: the '
+    + 'window). The ADR-0119 rollback marking, which the fix making `deleteManyData` and '
+    + '`updateManyData` honour `atomic` carried to those two endpoints, is structured in the '
+    + 'same move: the '
     + '`ROLLED_BACK:` / `NOT_ATTEMPTED:` message-string prefixes become registered '
     + '`ApiError.code` values (message keeps the human-readable cause and causal row index), '
     + 'so "attempted and undone" vs "never ran" is machine-readable instead of a regex '
     + 'convention. A RESPONSE surface — nothing stored in stack metadata carries a batch '
     + 'row, so there is no source for the chain to rewrite; consumers of the legacy keys '
     + 'move their reads themselves. Off-contract readers only: the legacy keys were never '
-    + 'in the schema or the SDK types, so a typed consumer needs no change. #4793.',
+    + 'in the schema or the SDK types, so a typed consumer needs no change. Ruled 2026-08-03: '
+    + 'the implementation moves to the schema\'s shape as a hard cut in the 17 major, with no '
+    + 'dual-emit transition.',
   acceptanceCriteria:
     'No consumer reads `row.error` or `row.record` on a batch result row; failures are read '
     + 'from `row.errors` (message via `errors[0].message`, rollback state via '

packages/spec/src/migrations/entries/semantic/17.connector-inline-authentication-publish-refused.ts

@@ -14,9 +14,11 @@ export const entry: SemanticMigration = {
     'still carries resolved secrets inline.',
   reason:
     'A published connector row lands whole in `sys_metadata`, so an inline `token` / `key` ' +
-    '/ `password` / `clientSecret` is cleartext at rest, readable through the data API ' +
-    '(#7990). No mechanical rewrite exists: whether the entry should become a `none` ' +
-    'descriptor or a provider-bound instance with a `credentialRef` — and which secret ' +
+    '/ `password` / `clientSecret` is cleartext at rest, readable through the data API (the ' +
+    'class a credential-persistence survey measured: any authored artefact whose schema ' +
+    'permits an inline credential lands it there). No mechanical rewrite exists: whether ' +
+    'the entry should become a `none` descriptor or a provider-bound instance with a ' +
+    '`credentialRef` — and which secret ' +
     'store receives the credential — is a judgment about the connector, not a rename.',
   acceptanceCriteria:
     'Every authored connector entry parses through `DeclarativeConnectorEntrySchema`; no ' +

packages/spec/src/migrations/entries/semantic/17.enhanced-api-error-field-errors-renamed.ts

@@ -13,7 +13,8 @@ export const entry: SemanticMigration = {
     'was reading a field no server sent (ADR-0078\'s silently-inert declaration, on the ' +
     'error envelope). This is a RESPONSE surface: no stack, example or template carries ' +
     'the key, so there is no source for the chain to rewrite — the schema tombstones it ' +
-    'via retiredKey() and consumers move their read themselves. ADR-0114 D4, #3977.',
+    'via retiredKey() and consumers move their read themselves. ADR-0114 D4 (the ' +
+    'field-level error code catalog).',
   acceptanceCriteria:
     'No consumer reads `error.fieldErrors`; per-field validation detail is read from ' +
     '`error.fields`, and constructing an EnhancedApiError with `fieldErrors` fails to parse ' +

packages/spec/src/migrations/entries/semantic/17.job-retry-policy-constraints-tightened.ts

@@ -7,7 +7,8 @@ export const entry: SemanticMigration = {
   surface: 'job.retryPolicy.maxRetries (> 10) / job.retryPolicy.backoffMultiplier (< 1)',
   replacement: 'maxRetries <= 10, and backoffMultiplier >= 1',
   reason:
-    'The converged RetryPolicy (#4661) keeps the automation side\'s bounds, which the job '
+    'The RetryPolicy converged onto one declaration from its automation and system copies '
+    + 'keeps the automation side\'s bounds, which the job '
     + 'side never had: `maxRetries` is capped at 10 and `backoffMultiplier` floored at 1. '
     + 'Neither has a lossless rewrite. Clamping `maxRetries: 20` to 10 would halve a '
     + 'retry budget its author chose, and a `backoffMultiplier` below 1 describes a delay '

packages/spec/src/migrations/entries/semantic/17.position-permissions-column-retired.ts

@@ -21,7 +21,8 @@ export const entry: SemanticMigration = {
     + 'A value that was recording intent as documentation belongs in `description`, '
     + 'which remains declared',
   reason:
-    'Maintainer ruling 2026-08-20 (#9885), ADR-0049 enforce-or-remove: REMOVE. The '
+    'Maintainer ruling 2026-08-20 on the finding that nothing writes or reads this column, '
+    + 'ADR-0049 enforce-or-remove: REMOVE. The '
     + 'object-scoped census (all sys_position-naming files, with same-object positive '
     + 'controls resolving `active` / `delegatable` / `is_default` / `name` to real '
     + 'readers) measured the column at zero on both sides: the only row writers — the '

packages/spec/src/migrations/entries/semantic/17.ups-delegated-from-column-retired.ts

@@ -20,7 +20,8 @@ export const entry: SemanticMigration = {
     + 'until Y". A permission-set grant that needs a provenance note keeps `reason` '
     + '(free text), which remains declared on both grant tables',
   reason:
-    'Maintainer ruling 2026-08-18 (#9730), ADR-0049 enforce-or-remove: REMOVE. The '
+    'Maintainer ruling 2026-08-18 on the finding that the delegation gate never reads this '
+    + 'column on this object, ADR-0049 enforce-or-remove: REMOVE. The '
     + 'runtime delegation gate is structurally scoped to sys_user_position '
     + '(`isDelegationWrite` returns false for every other object, so '
     + '`assertSelfDelegation` is unreachable for this table), and the explain engine '

packages/spec/src/migrations/entries/semantic/17.workflow-service-slot-retired.ts

@@ -17,13 +17,14 @@ export const entry: SemanticMigration = {
     + 'repository ever registered or resolved it (ADR-0115 Evidence 5 — the only touches '
     + 'were plugin-dev\'s retired stub probe and the generic discovery walk), no '
     + 'implementation of any WorkflowProtocol method ever existed, and no host ever '
-    + 'mounted `/api/v1/workflow` (the pre-#3586 DEFAULT_DISPATCHER_ROUTES listed it among '
+    + 'mounted `/api/v1/workflow` (DEFAULT_DISPATCHER_ROUTES, before it was retired as a '
+    + 'stale list, named it among '
     + 'routes that never existed). Every part of it was ADR-0078\'s silently-inert '
     + 'declaration: a CoreServiceName nothing filled, a contract nothing implemented, a '
     + 'protocol nothing served, a discovery route field no builder could truthfully '
     + 'populate. These are TS/API surfaces and a discovery RESPONSE field — never stored '
     + 'in stack metadata, so there is no source for the chain to rewrite; consumers of the '
-    + 'deleted types move their imports themselves. ADR-0049 / ADR-0078, #4451.',
+    + 'deleted types move their imports themselves. ADR-0049 / ADR-0078.',
   acceptanceCriteria:
     'No import of IWorkflowService, WorkflowProtocol or the Get/WorkflowState/Config/'
     + 'Transition types resolves; no code calls getService(\'workflow\') or reads '

packages/spec/src/migrations/entries/semantic/18.address-location-value-unknown-keys-refused.ts

@@ -13,7 +13,8 @@ export const entry: SemanticMigration = {
     + 'exactly `lat`, `lng`, `altitude`, `accuracy`. Every rejection carries the surface, the '
     + 'offending key and a rename (`postal_code` / `zipCode` / `zip` / `postcode` → `postalCode`, '
     + '`latitude` → `lat`, `longitude` → `lng`). A key that names no declared member is removed '
-    + 'at the producer — never tolerated at a consumer (AGENTS.md #0.1)',
+    + 'at the producer — never tolerated at a consumer: an alias for an off-spec key in a '
+    + 'consumer stays forbidden (contract-first — fix the metadata, not the runtime)',
   reason:
     'Maintainer ruling 2026-09-01, option A: both value classes refuse undeclared keys. Both '
     + 'value classes were all-optional '