@@ -17,33 +17,34 @@ export const entry: SemanticMigration = {
     + 'SINGLE assignment (`roles: core.positions`), so the two keys were verbatim identical '
     + 'on every dispatch — a second spelling of the vocabulary ADR-0090 D3 reserves and bans, '
     + 'published straight into author-written code. The maintainer ruled it closed IMMEDIATELY '
-    + '(2026-08-06 14:49Z, #6011): no deprecation window, no dual-emit, the alias simply gone '
-    + 'in 17 (PR #6048). '
+    + '(2026-08-06 14:49Z, on the finding that this alias had no closing date): no deprecation '
+    + 'window, no dual-emit, the alias simply gone in 17. '
     + '⚠️ Do not read this entry across to its sibling `action-session-roles-to-positions`: '
     + '`action-session-roles-to-positions` governs `ctx.session`, a DIFFERENT object reached '
-    + 'through the same `ctx`, and that one KEEPS its one-window dual-emit (#5613). Same word, '
+    + 'through the same `ctx`, and that one KEEPS its one-window dual-emit. Same word, '
     + 'same dispatch, two faces, two schedules — `ctx.user.roles` is absent in 17 while '
     + '`ctx.session.roles` still answers for the length of its window. '
     + 'What makes this entry different in KIND from both session-side siblings: `ctx.user` has '
     + 'no spec schema and never had one. It is a runtime TS interface, so unlike '
-    + '`HookContext.session.roles` (tombstoned on a deliberately non-strict `HookContextSchema`, '
-    + '#5050) and unlike `ActionSessionSchema` (declared contract-first at #5697 precisely so '
-    + 'its key could be renamed), there is no schema key here to tombstone and no '
+    + '`HookContext.session.roles` (tombstoned on a deliberately non-strict `HookContextSchema` '
+    + 'once it had no producer and no consumer left) and unlike `ActionSessionSchema` (declared '
+    + 'contract-first, as it stood, as the first stage of the session rename, precisely so its '
+    + 'key could be renamed), there is no schema key here to tombstone and no '
     + '`retiredKey()` prescription that could reach anybody — nothing ever ran an `ActorUser` '
     + 'through a `.parse()`, so a prescription there would have no one to reach. The enforced '
     + 'channel is tsc, and it reports at the READ site inside the author\'s own body; for an '
     + 'untyped or sandboxed body there is no enforced channel at all, which is exactly why '
     + 'this ledger entry has to exist — `spec-changes.json` and the generated upgrade guide '
-    + 'are the ONLY way such a reader learns of the rename. It is the `findStream` (#4484) / '
-    + '`IStorageService.list` (#5540) disposition — a TS/API contract, no stored source, no '
+    + 'are the ONLY way such a reader learns of the rename. It is the `findStream` (no caller) / '
+    + '`IStorageService.list` (no consumer) disposition — a TS/API contract, no stored source, no '
     + 'tombstone, tsc at the call site — applied to a surface that lives one layer further '
     + 'out than either: those two are at least DECLARED in `packages/spec/src/contracts`, '
     + 'this one only in `packages/runtime`. '
     + 'Why it is a D3 semantic TODO and not a D2 conversion, on the same two independent '
     + 'grounds as its session sibling: FIRST, there is no source to convert — an `ActorUser` '
     + 'is constructed per dispatch and never persisted, so no `sys_metadata` row, example or '
-    + 'template can carry the key (the `openApi31` (#4579) / `activationEvents` (#4657) / '
-    + '`hook-context-session-roles-retired` (#5050) shape). SECOND, the only place the key is '
+    + 'template can carry the key (the `openApi31` / `activationEvents` / '
+    + '`hook-context-session-roles-retired` shape). SECOND, the only place the key is '
     + 'ever SPELLED is inside an action body or an AI route handler: author-written JS/TS, or '
     + 'a sandboxed script. A declarative transform cannot safely rewrite an identifier inside '
     + 'free-form code — the same reason the ADR-0090 wave delegated `current_user.roles` to '
@@ -53,12 +54,12 @@ export const entry: SemanticMigration = {
     + 'here because the ledger is where an upgrading consumer meets it: the declaration\'s own '
     + 'comment claimed the alias was "kept for the REST/AI shapes", and that claim was '
     + 'DISPROVEN face by face against `origin/main` — repo-wide `user.roles` was 4 hits, all '
-    + 'of them in the pins PR #6048 flipped; the four `ActorUser` construction sites build '
+    + 'of them in the pins the removal flipped; the four `ActorUser` construction sites build '
     + 'server-side envelopes that never enter a response body; objectui\'s `.roles` reads '
     + 'belong to two unrelated producers (the better-auth session, and the '
     + '`/auth/me/permissions` payload). The `cloud` repo was NOT reachable in that session and '
     + 'is the one consumer face left unverified — this entry, and the changeset\'s FROM/TO '
-    + 'prescription, are its disposition. ADR-0090 D3 / ADR-0049 / ADR-0087, #6011 (PR #6048).',
+    + 'prescription, are its disposition. ADR-0090 D3 / ADR-0049 / ADR-0087.',
   acceptanceCriteria:
     'No action body reads `ctx.user.roles` and no AI route handler reads `req.user.roles`; '
     + 'every such read is `.positions` and observes the SAME array — the value was '
 
@@ -18,7 +18,8 @@ export const entry: SemanticMigration = {
     + 'fact. The FROM → TO is a table rather than a rename: `upsert` → `create` + `update`; '
     + '`import` → `create` + `update`; `export`, `aggregate` and `search` → `list`; '
     + '`history` → `get`; and `restore` / `purge` map to NOTHING — they never derived, '
-    + 'because `enable.trash` was retired in #2377, so the value is deleted outright. That '
+    + 'because `enable.trash` was retired with the other dead `enable.*` flags in the 11.0 '
+    + 'ADR-0049 removal of dead author-facing properties, so the value is deleted outright. That '
     + 'last row is why this is a semantic entry and not a mechanical conversion, and the '
     + 'reason is a security one: the mapping WIDENS. An allowlist naming `history` was '
     + 'granting read of one record\'s audit trail; rewritten to `get` it grants ordinary '
@@ -30,8 +31,11 @@ export const entry: SemanticMigration = {
     + 'replacement per site, and FLAGS the allowlists the mapping would widen so the edit '
     + 'stays reviewable — it reports, it does not rewrite. Stored metadata keeps parsing '
     + '(permanent tolerance, narrowing only), so nothing breaks at rest; what changes is what '
-    + 'an author may newly write. Registered by the #6350 stock reconciliation; #3543 (P2 of '
-    + '#3391) predates the #6148 completeness gate. ADR-0087, #3543 (backfilled #6350).',
+    + 'an author may newly write. Registered late, by the stock reconciliation that compared '
+    + 'the breaking changesets already on the v17 release train against this ledger: the enum '
+    + 'shrink (phase 2 of the programme that made UI action buttons agree with the '
+    + '`apiMethods` allowlist) predates the gate that makes a breaking changeset state its '
+    + 'ledger disposition. ADR-0087.',
   acceptanceCriteria:
     'No authored `enable.apiMethods` array names a legacy value; `objectstack validate` '
     + 'passes. Run the reporter codemod first and read its widening flags before applying '
@@ -42,6 +46,6 @@ export const entry: SemanticMigration = {
     + 'operation. Where the six primitives are all present, prefer deleting the key: that is '
     + 'equivalent to default-open and it tracks future primitives, whereas a hand-listed six '
     + 'silently stops granting anything added later. `restore` / `purge` are deleted with no '
-    + 'replacement — if trash-like behaviour was being relied on, that capability left in '
-    + '#2377 and this entry is not where it returns.',
+    + 'replacement — if trash-like behaviour was being relied on, that capability left in the '
+    + '11.0 dead-property removal and this entry is not where it returns.',
 };
@@ -11,7 +11,9 @@ export const entry: SemanticMigration = {
     + '`{ kind, dimension? }`, with no `offset` concept in it at all. On the ADR-0021 dataset '
     + 'path — the spec\'s single author-facing analytics shape — `{ offset }` was forwarded '
     + 'verbatim into that contract and threw `compareTo requires a timeDimension "undefined"`, '
-    + 'taking the widget down; the arm ever only ran on the legacy inline chart path (#5011). '
+    + 'taking the widget down; the arm ever only ran on the legacy inline chart path (measured '
+    + 'when all three declared arms were found dead on the dataset path: two silently dropped, '
+    + 'this one throwing). '
     + "The conversion rewrites `{ offset: '1y' }`, which IS `previousYear` by definition. Every "
     + 'other duration has NO faithful target: `previousPeriod` shifts by the length of whatever '
     + "window the widget's filter resolves to, which equals `7d` only when that window happens "
 
@@ -16,17 +16,19 @@ export const entry: SemanticMigration = {
     'The by-id target of an `update()` or `delete()` is now IMMUTABLE inside a `before*` '
     + 'handler, on both verbs, cleared or rebound. `delete()` was the last cell of that table '
     + 'still answering differently: it HONOURED a repoint, re-resolving the new target by '
-    + "re-reading its pre-image and rebinding `previous` (#5272), so `afterDelete` and the "
-    + 'roll-up recompute saw the row actually deleted. It now refuses with '
+    + "re-reading its pre-image and rebinding `previous` (the fix that first made a single-row "
+    + "delete bind `previous` at all), so `afterDelete` and the roll-up recompute saw the row "
+    + 'actually deleted. It now refuses with '
     + '`HookTargetRebindError` / `ERR_HOOK_TARGET_REBIND`, `path: \'by-id\'`, exactly as the '
     + '`update()` twin and both per-row paths (ADR-0058 Amendment II.1 / D4) already did.\n\n'
     + 'Read this as a RULING, not a defect report — that distinction is the reason the entry '
-    + 'is worth its length. #5272\'s re-resolution was internally CORRECT and nothing stale '
+    + 'is worth its length. That re-resolution was internally CORRECT and nothing stale '
     + 'ever leaked from it; the case that retires a rebind on `update()` (the write landing on '
     + 'a row whose pre-image, `readonlyWhen` locks and validation rules were never evaluated) '
-    + 'simply did not apply to it. #5574\'s engine half (PR #6697) therefore left the asymmetry '
-    + 'standing on purpose rather than folding a behaviour removal into an ordering change, and '
-    + 'filed it as #6752. The 2026-08-09 maintainer ruling on that card closed it on three '
+    + 'simply did not apply to it. The engine change that dispatches `before*` hooks per matched '
+    + 'row on a bulk write therefore left the asymmetry standing on purpose rather than folding '
+    + 'a behaviour removal into an ordering change, and filed it as a finding of its own. The '
+    + '2026-08-09 maintainer ruling on that finding closed it on three '
     + 'measured axes instead: compatibility cost zero (a repository-wide grep for assignments '
     + "into a hook's `input.id`, re-run on the implementing PR's base, found six sites and ALL "
     + 'SIX are this family\'s own pins — no consumer anywhere repoints); one rule across both '
@@ -35,8 +37,9 @@ export const entry: SemanticMigration = {
     + 'silently redirects which row gets deleted" is a top-grade footgun for authored — '
     + 'especially AI-authored — handlers however correctly the redirect is implemented. '
     + 'Correctness of a mechanism does not justify the surface it exposes. Aligning the other '
-    + 'way, by building `update()` the same re-resolution, stays excluded by #5574\'s own '
-    + 'recorded ruling ("do not silently pick re-resolution instead").\n\n'
+    + 'way, by building `update()` the same re-resolution, stays excluded by the recorded '
+    + 'ruling that extended per-row hook semantics to `before*` hooks on bulk writes ("do not '
+    + 'silently pick re-resolution instead").\n\n'
     + 'Why this is a D3 semantic TODO and not a D2 conversion, on the same two grounds as '
     + '`hook-register-empty-object-target-refused` and `hook-context-session-roles-retired` at '
     + 'this step: FIRST, there is no source to convert — a `HookContext` is constructed per '
@@ -51,8 +54,7 @@ export const entry: SemanticMigration = {
     + 'throws before anything is written and its message NAMES the retired capability and the '
     + 'three replacement routes, so a handler that still repoints fails loudly and self-'
     + 'describingly on its first execution rather than going quiet. This ledger entry is the '
-    + 'channel that reaches an upgrader BEFORE that first execution. #6752, #5272, #5574, '
-    + 'PR #6697, ADR-0058 Amendment II.2.',
+    + 'channel that reaches an upgrader BEFORE that first execution. ADR-0058 Amendment II.2.',
   acceptanceCriteria:
     'No `beforeDelete` handler assigns `ctx.input.id` anything but the id it arrived with — '
     + 'grep handler bodies for assignments into `input.id` and rewrite each into an explicit '
 
@@ -17,7 +17,8 @@ export const entry: SemanticMigration = {
     + '`AutomationEngine.registerConnector` runs `ConnectorSchema.parse` and stores the '
     + 'parsed definition; nothing reads `syncConfig` back off it, and the key has no '
     + 'reader outside `packages/spec` at all — the same measurement that retired '
-    + '`syncConfig.schedule` in 18 under ADR-0049 (#16320). What the platform DOES '
+    + '`syncConfig.schedule` in 18 under ADR-0049, with the other cron-typed positions '
+    + 'nothing reads. What the platform DOES '
     + 'execute on a connector is its `actions`: a flow\'s `connector_action` node '
     + 'resolves the registered handler and awaits it, so an author who needs data '
     + 'actually moved drives it from there. Per-field value '
@@ -28,7 +29,8 @@ export const entry: SemanticMigration = {
     + 'because it never had an implementation either. It returns through the ENFORCE route: '
     + 'the engine first, the vocabulary second)',
   reason:
-    'The reading #4738 used to retire L1 `DataSyncConfig`, re-measured one layer up and '
+    'The reading the spec dual-source cleanup used to retire L1 `DataSyncConfig` (its '
+    + 'automation copy deleted as dead), re-measured one layer up and '
     + 'identical: narrative-only. No engine ever parsed, scheduled or executed an '
     + '`ETLPipeline`. Measured on origin/main immediately before the removal: the only '
     + 'non-spec references in this repo are two fumadocs-generated documentation sources '
@@ -37,26 +39,29 @@ export const entry: SemanticMigration = {
     + 'on it — while the same file family\'s EXECUTED half does have one '
     + '(`liveness/mapping.json`), which is the contrast that makes the absence meaningful '
     + 'rather than an oversight. The `etl` string in this registry was the one untested '
-    + 'link the finding named, and it is not a loader path: it was the id of the #4962 '
-    + 'retry-vocabulary entry, absorbed here. '
+    + 'link the finding named, and it is not a loader path: it was the id of the '
+    + 'retry-vocabulary entry for `ETLPipeline.retry` (a third retry-policy vocabulary the '
+    + 'retry convergence had not covered), absorbed here. '
     + 'The layer was ADR-0078\'s asymmetry in its purest form — an author could write a '
     + 'complete ten-stage pipeline, get no error, and get no execution. It was also '
     + 'advertised: `packages/spec/docs/SYNC_ARCHITECTURE.md` named `ETLPipeline` as the '
-    + 'recommended destination for authors displaced by the L1 retirement (#4738) and '
+    + 'recommended destination for authors displaced by the L1 retirement and '
     + 'listed ten transformation types with copyable examples down to '
     + '`script | Custom JavaScript/Python`. That document is rewritten in the same change; '
     + 'a retirement whose own doc still recommends the retired layer is self-contradictory, '
     + 'and forwarding L1\'s authors to a second layer with no executor was the defect '
     + 'compounding rather than closing. '
-    + '⚠️ `etl-retry-converged-onto-retry-policy` (#4962) is SUBSUMED here, the '
-    + '#4657/#4834/#5055 way: both land in the unreleased protocol 17, so composed, a '
+    + '⚠️ `etl-retry-converged-onto-retry-policy` is SUBSUMED here, the way the '
+    + '`activationEvents`, dynamic plugin-loading and widget / i18n retirements each let an '
+    + 'earlier tombstone go with the shape that carried it: both land in the unreleased '
+    + 'protocol 17, so composed, a '
     + 'rename of `retry.maxAttempts` on a shape that does not survive the major has no '
     + 'observable effect — and keeping both would tell an upgrader to rewrite a key on a '
     + 'schema the same upgrade deletes. The `maxAttempts` `retiredKey()` tombstone goes '
     + 'with the shape that carried it, which is strictly stronger than the tombstone: there '
     + 'is no longer a `retry` block to author the key into. Route 3 — no carrier key, no '
     + 'parse site, so no D2 conversion and no tombstone; RETIRED_DEFS_BY_MAJOR plus this '
-    + 'entry are the declaration. ADR-0049, ADR-0078, #6414.',
+    + 'entry are the declaration. ADR-0049, ADR-0078.',
   acceptanceCriteria:
     'No source imports `ETLPipeline`, `ETLPipelineParsed`, `ETLPipelineSchema`, '
     + '`ETLPipelineRun(Schema)`, `ETLSource(Schema)`, `ETLDestination(Schema)`, '