[objectstack-fleet]

Requested by 田騏 · project thread
Fixes #30590
Ruling-ref: 6663894403
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:只改一个文件 docs/adr/0125-release-approval-gate-replaces-the-typed-version.md:末尾新增一节「Amendment (2026-11-05, [Decision] Release cadence: a week of merges is about 1,700 PRs, so each QA-gated release carries a very large delta and app repos wait days to install fixes #29466)」,状态行加一条修订记录,D1 与 D4 下各加一条指向该节的「⚠️ Amended」提示(2026-09-29 修订的既有写法),D1–D6 正文一字未改。它把您裁决的 B 方案写进规范:稳定版发布照旧(QA 清单、Version Packages PR、您在 release 环境批准、发到 latest);另加一条只能手工触发、每天提议一次、仍由您批准的 next 快照发布通道,快照不打 tag、不建 Release、不碰 Version Packages PR、永不移动 latest,也不首发任何包(首发会写 latest,首发归稳定版通道)。
• 为什么改:ADR-0125 D1 原本读作「版本提交是唯一的发布」,不先修订它,ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 的 release.yml 快照通道就不能动工。修订后 D1 读作「版本提交是唯一的稳定版发布」。第二轮按独立复核的裁定补了四条对 ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 的硬要求:不首发包、快照派发不跑任何稳定版作业、pre 模式下拒绝、只快照「全量测试恰在该提交通过」的提交。
• 风险与回滚:纯文档,不改任何 workflow、脚本或代码,不新增任何裁决没有做的决定(本记录自己的两处解读已标明;三件未决事项在文内「Not decided here」列出)。回滚 = revert 本 PR。
• 先看:该文件末尾「What the lane must satisfy」七条(其中「The guard, and the debut rule」是复核发现的必修项:@objectstack/service-push 在树里却从未发布过)和「What the ruling binds」八条(与裁决评论 6663894403 逐条对应);其次是 D1、D4 下新增的两条提示。
• 两分钟验证:打开文件末尾,把八条与裁决评论「What the ruling binds」逐条对读;预期:每条都能在裁决里找到原句,标为「this record's reading」的只有两处,latest 永不被快照移动,每次快照仍需您批准。
• 需要您做的:ADR 属 Tier H 受管面:独立复核通过后,由您合并(或入队)本 PR。

What changes

One file, docs only. Round 2 (independent full review, round 1 FAIL, record 6672362721) is folded in; the diff against origin/main is now four hunks:

• the **Status**: line gains one · **Amended** (2026-11-05, #29466 …) entry, in the shape the 2026-09-29 entry set, pointing at the new section;
• a ⚠️ Amended 2026-11-05 blockquote callout under D1 and another under D4, in the 2026-09-29 house shape — pointers to the new section; D1 to D6 text is not rewritten;
• a new terminal section ## Amendment (2026-11-05, #29466): a maintainer-approved next snapshot lane beside D1, with: Status of this amendment · Why · What the ruling binds (the eight bound lines of ruling record 6663894403, numbered; two sentences marked as this record's own readings — the trial start, citing seat note 6664069140, and the D3 "removed in the same change" consequence) · How D1 to D6 read with it (D1 as amended is the only stable publish; D2 and D3 gate the snapshot job identically; D4's repair lane and force untouched; D5's no-displacement property gains a third lane; D6 gains nothing) · What the lane must satisfy — requirements on ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591, not workflow text: the dist-tag guard and the debut rule (a fixed-group member with no version on npm is refused, because a first publish takes latest whatever tag it carries; @objectstack/service-push is that case today), dispatch-only and exclusive (a snapshot dispatch runs none of the stable lane's jobs, read like refresh_version_pr; the snapshot job runs on no other dispatch; the un-sweepable stale-prompt hazard named), the commit (the head of the newest green full-battery run, distance zero under scripts/ci/scheduled-full-run.mjs --release-gate, so the ruling's "at that commit" holds literally), not during a major's RC cycle (.changeset/pre.json mode: pre refuses; the release-channels table in docs/releases-maintenance.md is a consumer ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 updates), workspace only (bare changeset version --snapshot next, never pnpm run version; consumed changesets and rendered CHANGELOGs stay uncommitted), the approval screen (the name must not match the stable prompt shape release-pending-publish.mjs reads), the dry run (109-package fixed group, not 69; packed manifests, since changesets leaves workspace:* ranges alone) · What stays forbidden · What does not change, with a "Not decided here" list.

Not touched, on purpose: the TL;DR (the ADR's own convention keeps amendments out of it — the 2026-09-29 amendment did not touch it either), the text of D1 to D6, the 2026-09-29 amendment, .github/workflows/release.yml, and docs/adr/README.md (the index row keys on the first status keyword, Accepted, so it is unchanged; node scripts/adr-index.mjs --report answers "current").

Tests

Docs only: no package moved, so local verification scope ① (dependency closure) and ② (package tests and typecheck) are empty by rule. The gates that read docs/adr/** are under Verification.

Acceptance notes

• Governed surface (docs/adr/**, Tier H): this PR stays a draft with no reviewers and no assignees. The seat orders the independent full review and does the hand-off; landing is the maintainer's hand.
• Round 1 of the independent full review (record 6672362721 on this PR) failed on M1 (the debut rule) and asked S1 to S5; every finding is applied on this head as the seat ruled, and the review's observations for ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 now live in the amendment's requirements list. A re-render of the review is owed on this head.
• No decision the ruling did not make is taken. The amendment lists three items as "Not decided here", for the lane card and the maintainer: whether a snapshot builds the runtime image (the ruling names npm alone); the form the daily proposal takes; what becomes of the next channel when the trial ends.
• Registry readings behind the text (read-only npm view): @objectstack/service-push answers 404 while the tree carries it at 18.2.0 in the fixed group — the live debut case; next resolves to 18.2.0 (a stable version, which scripts/release-dist-tags.mjs leaves alone by its own rule) and latest to 18.3.0. .changeset/config.json carries no snapshot block, so changeset version --snapshot next composes its default 0.0.0-next- timestamp version shape — the dry run the ruling asks for will show it; no .changeset/pre.json exists at origin/main.
• Observation, not filed: the pre-existing #10150 link on the Status line (cited as a pull) answers 404 through the issues API; left as is.

Verification

• Gate derivation for the final diff: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at head 8adeb7793e (after the merge of origin/main ab44ec94b0) derived 21 commands (13 matched by path, 8 whole-tree). All 21 ran at that head with each exit code captured before any pipe; every one exited 0 on the first pass. Reconciliation dispatch-gates --ran: 21 derived families accounted for, 21 run, 0 NOT MEASURED. (Round 1 at 28c6fc09b8: the same 21 green after one prerequisite build of @objectstack/formula and @objectstack/lint under the verify lock.)
• The 21, every one exit 0: check-adr-links (+ self-test), check-closing-keyword-parity (+ self-test), check-comment-mask-corpus, plan-test-core-shards self-test, lint check:doc-formula-expressions, check:adr-anchors, check:adr-index, check:adr-symbol-anchors, check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal.
• node scripts/adr-index.mjs --report: exit 0 — "docs/adr/README.md is current, every record parsed, self-test 46 assertions green".
• Control-character scan of the edited file: none. git diff --stat origin/main...HEAD: 1 file, +69 / −1 — exactly one removed line (the Status line); D1 and D4 gain appended callouts, no decision text is rewritten.
• CI's own, not rerun locally: the whole-tree and wide-population families, check-issue-citations (the citations this diff adds — [Decision] Release cadence: a week of merges is about 1,700 PRs, so each QA-gated release carries a very large delta and app repos wait days to install fixes #29466, docs(adr): amend ADR-0125 to admit a maintainer-approved next snapshot lane beside D1 (#29466 ruling B) #30590, ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591, chore(release): exit Changesets pre mode (next), so the next Version Packages PR versions 18.0.0 GA #24528, release: after a stable publish, the next and rc npm dist-tags still point below latest (npx create-objectstack@next installs 18.0.0-next.5, older than 18.0.0) #25581 — resolve on the board), Lint & Repo Gates and the other PR check-runs; their verdicts are read from the PR, and this report does not wait for them.

🤖 Generated with Claude Code

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 28c6fc09b8538570dff8e5a10aaa13ee4ffbab3a
Local-runs: none
Scope: docs/adr/0125-release-approval-gate-replaces-the-typed-version.md + .github/workflows/release.yml, scripts/ci/scheduled-full-run.mjs, scripts/release-dist-tags.mjs, scripts/release-publish.sh, scripts/release-pending-publish.mjs, .changeset/config.json, package.json (the version script), AGENTS.md (Prime Directive #15), docs/adr/0087-metadata-protocol-upgrade-contract.md, docs/releases-maintenance.md, packages/services/service-push/package.json, and the published @changesets/cli@3.0.3 / @changesets/apply-release-plan@8.1.1 / @changesets/assemble-release-plan@7.0.0 sources (the versions pnpm-lock.yaml pins; read from the registry tarballs, nothing installed or run)

Independent full review of the ADR-0125 amendment on card #30590, ordered by the 2026-10-25 rule (substance against the code and the first consumer, by an agent other than the drafter). Read: ruling 6663894403 and the whole #29466 thread, cards #30590 (triage 6666636809, claim 6671491544, dev report 6671957724) and #30591, PR #30719 body and diff (origin/main...28c6fc09, one file, +63/−1), the code named in Scope at origin/main badf24dffc, the registry (npm view), and the head's check-runs. The dispatch order, the drafter's report and the seat's conclusions were read as claims, not as evidence; every judgment below is against the tree. Check-runs on the head: 46; at the first read three were still in progress (Type Check · debt ledger, Type Check · consumer gates, Test Core 1/8); at the second read, 2026-11-05T23:26Z, all 46 had completed with no failure (success or skipped); no review and no comment on the PR.

① Derived judgments

Fidelity to ruling 6663894403 — every bound line is present, none is softened; four sentences decide what the ruling left open (named).

bound line of the ruling	where the record carries it	judgment
B: stable releases stay as today — QA sweep, Version Packages PR, approval at environment: release, publish to latest	"What the ruling binds" 1; Status line; "How D1 to D6 read with it" D1	present, unchanged in meaning
a maintainer-approved next snapshot from main, proposed daily, dispatch-only	line 2; Status line	present; "proposed daily is a cadence of proposals, not a trigger" is a correct reading of "dispatch-only"
requires the full battery green at that commit	line 3 ("at the commit it snapshots"); "What the lane must satisfy — The full-battery reading"	present in line 3; the requirement paragraph then names the stable lane's reader, whose answer is "at or before" (④-a below)
changeset version --snapshot next in the workspace only, never committed	line 4; "Workspace only"	present
changeset publish --tag next --no-git-tag	line 4	present; both flags exist in @changesets/cli@3.0.3 (dist/index.mjs:62: --tag, --git-tag default true, so --no-git-tag negates it)
held at environment: release like the stable publish	line 5; D2/D3 paragraph; Status line	present
pushes no tag, no GitHub Release, never touches the Version Packages PR, ⛔ never moves latest	line 6; Status line; "What stays forbidden"	present; the guard the record names for the ⛔ does not cover a package's first publish (④ M1)
app repos pin next when they need a fix now	line 7	present
two-week trial, then the director reports usage on #29466	line 8	present; "The trial starts at the first snapshot the lane publishes" is not in the ruling (named below)
the maintainer's three answers: every publish stays the maintainer's act, snapshots included; stable channel unchanged, next on top; today's release.yml has only the version-commit push and the repair dispatch, D1 publishes the version commit only	"Why", second paragraph; D1 paragraph	present and true at origin/main (② below)
workload: two Tier H PRs; a dry run of changeset version --snapshot on the fixed group and its workspace:* ranges before the first real snapshot	Status of this amendment; "The dry run"	present; the record carries no package count (right: the group is 109, not the ruling's 69 — see ③)

Sentences that decide something the ruling did not decide, all in the record's own voice rather than marked as this record's reading:

• bound line 8: "The trial starts at the first snapshot the lane publishes." The ruling fixes the length, not the start. The reading matches the seat's own Restart-when on [Decision] Release cadence: a week of merges is about 1,700 PRs, so each QA-gated release carries a very large delta and app repos wait days to install fixes #29466 (6664069140) and ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591's acceptance, so it is consistent with the execution record, but it is the seat's, not the maintainer's.
• D2/D3 paragraph: the snapshot lane "is removed in the same change that reverts D1 to a dispatch trigger." D3 (ADR:71-77) voids the record and reverts D1; what becomes of a dispatch-only lane whose own event is a barrier is a new decision. It is the conservative one (Prime Directive Add missing Field.phone() helper and factory methods for Action/Dashboard/Report #15 lets the relay dispatch release.yml, AGENTS.md:315-316, so the event alone is not the barrier it was before release workflow: publish pushes tags + npm but its version commit never reaches main — twice now (rc.3 c6a52d3, rc.4 a10cbc77); landing the commit must be part of the publish lane #6170's relay stroke) and I would keep it, marked as this record's.
• "What the lane must satisfy — The full-battery reading": "read the way the stable lane's full-battery job reads it, against the snapshot's own commit" chooses the at-or-before reader for the ruling's "at that commit" (④-a).
• "What the lane must satisfy — The approval screen": the job name says next snapshot and names the main commit. A D2 extension, not a ruling line; right, and it should stay.

Nothing in the ruling is softened except as ④-a states; nothing material is added beyond the four sentences above. The "Why" section's numbers are the ruling card's (1,700 PRs a week measured as 1,776; 214 changesets at b17dbcf2; 18.2.0 at 2026-10-27T06:20Z) and the registry's (next 18.2.0, latest 18.3.0, re-read here at 2026-11-05T23:2xZ for @objectstack/spec and @objectstack/cli, identical). "18.3.0 published 2026-11-03T15:16Z" is @objectstack/cli's time (15:16:56Z); the ruling's 15:15Z is @objectstack/spec's (15:15:07Z); both true, and the CLI is the package D1 reads.

Truth against the code at origin/main badf24dffc — every claim checked holds, with one wording inexactness.

• "its only publish paths are the version-commit push and the repair dispatch": release.yml:182-184 (push: branches: [main]), :199-200 (schedule, bookkeeping only), :208-227 (workflow_dispatch with force and refresh_version_pr only); the one publishing job's gate :1608-1612 admits a push with publish-pending, or a non-refresh dispatch; scripts/release-pending-publish.mjs:381-387 makes a dispatch pending exactly when the version is absent from npm. True.
• "D1 publishes the version commit only": release.yml:1657 checks out needs.release-integrity.outputs.version-commit. True.
• "schedule, which release.yml already refuses as a publishing trigger because a scheduled run is queued rather than guaranteed and is disabled by inactivity": release.yml:193-198, verbatim in substance ("Scheduled runs are queued, not guaranteed … disables them entirely after 60 days … the publish lane must never be reachable from schedule"). True.
• "Prime Directive Add missing Field.phone() helper and factory methods for Action/Dashboard/Report #15 reserves dispatching release.yml from every seat, the fleet-write relay's refresh stroke excepted": AGENTS.md:315-316. True. "approving a release environment deployment" is on the list: AGENTS.md:317-318; D6 adds it: ADR:93-95. True.
• "refused before any deployment is queued — the direction the stable lane's full-battery job already takes": release.yml:1497-1551 (full-battery needs release-integrity, :1520; publish needs it, :1568; its if: opens with success(), :1608-1609; the comment :1509-1513 says exactly this). True.
• "the stable lane's post-publish acts — the atomic tag push, the GitHub Releases, the ADR-0087 D4 asset, the dist-tag move up to latest": scripts/release-publish.sh:98 (changeset publish) and :112 (git push origin --tags, run from pnpm run release, release.yml:1977); release.yml:2030-2036 (Releases), :2038-2049 (ADR-0087 D4 asset), :2067-2073 (release-dist-tags.mjs --apply). True.
• "next resolves to 18.2.0 — a stable version, which the stable lane's post-publish dist-tag step leaves alone by its own rule": scripts/release-dist-tags.mjs:40-42 ("a tag on a STABLE version … is left alone … latest itself is never written"). True.
• "the eviction the 2026-09-29 amendment measured applies to it": ADR:137-142; release.yml:1623-1637 (group release-publish-${{ github.ref }}, cancel-in-progress: false). True.
• "exited by chore(release): exit Changesets pre mode (next), so the next Version Packages PR versions 18.0.0 GA #24528": chore(release): exit Changesets pre mode (next), so the next Version Packages PR versions 18.0.0 GA #24528 is "chore(release): exit Changesets pre mode (next)". True (card docs(adr): amend ADR-0125 to admit a maintainer-approved next snapshot lane beside D1 (#29466 ruling B) #30590's "retired by ci(release): retire the rc channel — delete cut-rc.yml, state the two channels (latest, next), and have release-dist-tags remove the retired rc tag instead of moving it #26196" named the rc retirement; the record has the right one). No .changeset/pre.json at origin/main. True.
• .changeset/config.json: fixed is one group of 109 names (:10-121), equal to the 109 non-private manifests under the pnpm-workspace.yaml globs (131 manifests, 22 private); privatePackages: { version: true, tag: false } (:127); no snapshot key, so changeset version --snapshot next composes 0.0.0-next-YYYYMMDDHHMMSS (assemble-release-plan dist/index.mjs:241-263: base 0.0.0, suffix tag-datetime) and the fixed constraint gives every non-skipped member the same version (:197-210). The record's "rewrites the fixed group" assumption holds. Inexactness, inherited from the ruling's wording: changesets does not rewrite workspace:* / ^ / ~ ranges at all (apply-release-plan dist/index.mjs:178-181 skips them); pnpm publish substitutes the exact snapshot version at pack time. A dry run that reads workspace package.json files will show the ranges unchanged; the lane's dry run must read packed manifests. Observation for ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591, not a defect of the record.
• D4 "the snapshot lane never reads force": consistent with release.yml:210-216 (force = finish a partial stable publish). True as a requirement; see ③ S1 for the converse the record omits.

Not decided here lists three items (runtime image, the proposal's form, the channel after the trial). Right: release.yml:2079-2101 builds the image off either lane's published output, Prime Directive #15 lists "pushing a runtime image" as a release act, and the ruling names npm alone.

② Semver level

None. Docs-only diff: one file under docs/adr/, no package moves, no changeset owed (skip-changeset label; Check Changeset green). Clause-②: no on the PR body matches the tree.

③ Boundary flags

The boundary this record draws is "the stable lane is untouched; the snapshot lane writes next and nothing else." I tried to cross it from the first consumer's side (#30591, built exactly as the record requires) and crossed it once for real and twice in shape.

M1 (must-fix) — a package's first publish moves latest, the record's guard cannot see it, and the case is live today. @objectstack/service-push is a public member of the fixed group (.changeset/config.json:52), at version 18.2.0 in packages/services/service-push/package.json, landed 2026-11-03T15:59Z in #29794 (commit 8aa2e915), 43 minutes after 18.3.0 shipped; two pending changesets name it; npm view @objectstack/service-push answers E404 — it has never been published. The first snapshot cut from today's main is therefore its first publish. changeset publish --tag next includes it (getPublishPlan.mjs:605-650: publishedState: "never", still planned) with tag next (:599-603: an explicit --tag always wins), so the publish carries next, and the record's guard — "Any publish from the snapshot lane that would carry a dist-tag other than next fails the job" — passes it. The registry then gives a package its latest on its first publish whatever tag the client sent: changesets' own pre-mode rule is built on that fact (publish.mjs:19-24: "packages that have not had normal releases … will be published to latest"; getPublishPlan.mjs:627-631, the only-pre state keyed on a latest tag that exists although every version is a prerelease). Outcome of the first run of #30591 as specified: @objectstack/service-push@latest = 0.0.0-next-YYYYMMDDHHMMSS until 18.4.0 ships — bound line 6's ⛔ broken on the very first snapshot, and the record's sentence "latest is written by the stable lane and by nothing else" false. Fix, one requirement in "What the lane must satisfy" and one clause in line 6's gloss: the snapshot lane never debuts a package — a member of the group with no version on npm is refused before anything is published, because a first publish takes latest whatever tag it carries; the stable lane debuts packages. With that sentence, the "made executable" claim becomes true; without it, the record promises what the lane it specifies cannot keep.

S1 (should-fix) — the two uses of workflow_dispatch must be exclusive, and the record asserts it without requiring it. Under D1 the record says the snapshot lane "never consults D1′'s publish-pending, never alters it, and cannot queue D1's publish job"; under D4 only the converse is required ("a dispatch that does not ask for a snapshot runs exactly as today"). At origin/main, every non-refresh dispatch runs release-integrity (release.yml:959-961), stale-prompts (:1459-1461), and — whenever main's version is absent from npm — full-battery and publish (:1521-1525, :1608-1612; release-pending-publish.mjs:383). A snapshot dispatched between a Version Packages merge and its approval would queue a second, dispatch-lane Publish X to npm prompt in release-publish-main; sweep never touches a dispatch run (release-pending-publish.mjs:174-176, release.yml:1443-1445), so after the push-lane prompt ships, that prompt holds the group and hides the next real one — the 17.4.0 shape the 2026-09-29 amendment measured (ADR:142), this time un-sweepable. Fix: add to "What the lane must satisfy" that a dispatch asking for a snapshot runs none of the stable lane's jobs (the snapshot input is read by release-integrity, stale-prompts, full-battery and publish exactly as refresh_version_pr is today — strictly subtractive, release.yml:218-222), and that the snapshot job runs on no other dispatch. The D5 paragraph's "the group spelling is the lane's" is fine; the exclusivity is the record's property and belongs in its list.

S2 (should-fix) — next is already ADR-0087's pre-mode channel, and the record is silent on the collision. ADR-0087:335: "Every major is published to the next dist-tag at least one RC cycle before"; docs/releases-maintenance.md:191-201: two channels, next = "the pre-release (X.Y.Z-next.N), published by release.yml in pre mode"; release-dist-tags.mjs:43-47 says the same. While .changeset/pre.json says mode: pre, changeset version --snapshot is refused ("Snapshot release is not allowed in pre mode", version.mjs:47-53) and changeset publish --tag is refused ("Releasing under custom tag is not allowed in pre mode", publish.mjs:61-66): a snapshot approved during a major's RC cycle fails after approval and publishes nothing — loud, but a wasted approval and an unexplained red run in the maintainer's name. Fix: one sentence that the lane refuses (before any deployment is queued) while pre mode is on, because the major's RC cycle owns next under ADR-0087; and name docs/releases-maintenance.md's channel table as a consumer #30591 updates (next gains a second publisher and a second version shape). One more consequence to state for the "App repositories pin next" line: at each stable publish release-dist-tags.mjs:35-37 moves next up to the new stable (a 0.0.0-next-… snapshot is a prerelease below every stable), so next = the stable version between a release and the following snapshot. Intended since #25581, consistent with "never moves latest", and the thing a next pinner will notice first.

Smaller flags, none a finding on its own:

• The fixed group is 109 packages, not the "69" the ruling and ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 carry (that figure is the rc.3 / rc.4 count, ADR:73). The record carries no number — right. ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 should correct its acceptance line.
• scripts/release-pending-publish.mjs:282 reads any job named Publish (one token) to npm (awaiting approval) as a stable prompt; the snapshot job's name must not match that shape. A name with spaces in the middle ("Publish next snapshot of main@sha to npm") does not.
• Under --snapshot changesets still deletes the consumed changeset files from the checkout (apply-release-plan dist/index.mjs:302-320, not guarded by snapshot) and writes CHANGELOG.md entries through scripts/changeset-changelog.mjs (:288-292); commit is forced false (version.mjs:38). The record's "workspace only, never committed" covers it; the changelog generator's token need is the lane's.
• The ruling's bare changeset version --snapshot next is right and the lane must not substitute pnpm run version: that script (package.json version) runs sync-protocol-version.mjs, which refuses a major below 1 (scripts/sync-protocol-version.mjs, "cannot parse major", exit 1 when the parsed major is not an integer of 1 or more), and the template / docs-image / skill-compatibility syncs would pin the stable versions anyway. PROTOCOL_VERSION stays at the protocol major, which is correct for a snapshot.
• D3 paragraph wording: "a dispatch with no human behind the approval is the rc.3 / rc.4 shape under a different dist-tag" is inexact — rc.3 / rc.4 had no human anywhere in the trigger chain (ADR:73); a dispatch has one at the dispatch. The conclusion (void with the push lane) stands for the relay reason given in ①.

④ Design judgment

The ADR against its first consumer (#30591) and the code it cites. The record is well built: it restates the ruling line by line, reads D1 to D6 against the real release.yml accurately (every file:line in ② holds), separates requirements on the lane from workflow text, and lists what it does not decide. It fails on one point of substance — M1 — where the lane it specifies, built exactly as written and passing its own guard, moves latest on its first run because of a package that is in the tree today. That is the ruling's strongest line, the record claims the guard makes it executable, and the claim is false for a case the registry already presents. A one-sentence requirement repairs it; until it is there the record cannot be the thing #30591 is built against.

④-a — "at that commit" versus "at or before" (the drafter's open choice; recommendation A was to leave it). Leaving it as written is not right, because the record is not silent: bound line 3 says "green at the commit it snapshots", and "The full-battery reading" requires the stable lane's reader "against the snapshot's own commit". That reader (release.yml:1551; scripts/ci/scheduled-full-run.mjs:797-830) selects the newest completed schedule or push run of CI and Lint & Type Check whose head is the commit or a first-parent ancestor within 400 commits (:864), reports the distance (:909), and passes on "at or before" (:1074); push runs are affected-only (:826-829), and 62 of 100 recent CI push runs on main were cancelled (:814-816), so for a snapshot of HEAD the deciding run is routinely a few landings back and narrower than the schedule run. Two sentences in one record now carry two guarantees, and the approval screen will carry one of them. Either (i) say under bound line 3 that "at that commit" is read as the stable lane reads the version commit — the newest full-battery verdict at or before it on the first-parent chain — which is a reading of the ruling's words, not a new decision, and lets the maintainer see what "green" means on the prompt; or (ii) require the lane to snapshot the head of the newest green full-battery run (distance 0 — the reader already answers "at" exactly, so no new reader is needed, and the ruling holds literally). I would take (ii) for the lane and would accept (i) for the record; the record must not keep both. Should-fix (S3).

④-b — a pointer callout under D1 (the drafter chose none). Add it, under D1 and D4, in the 2026-09-29 house shape (ADR:61, :91: a blockquote "⚠️ Amended …" under the decision, not a rewrite of its text). D4's heading — "workflow_dispatch survives as the repair lane, with no version input" — is no longer a complete statement of what a dispatch may do, and a reader of D1 or D4 alone does not reach the Status line or the end of the file. The order's "D1–D6 text is not rewritten" is kept by a callout, as the precedent shows. Should-fix (S4).

Fidelity attributions (S5, should-fix, wording only). Mark the trial-start sentence and the D3 "removed in the same change" sentence as this record's readings (or cite 6664069140 for the first), so the next reader can tell the maintainer's lines from the seat's.

Must-fix: M1. Should-fix: S1, S2, S3 (④-a), S4 (④-b), S5. A re-render is owed on the head that carries them.

Implemented-by: claude/issue-30590-adr-0125-next-lane
Reviewed-by: session_017ihL2ebbZkr2QAEG1x7UC8

VERDICT: FAIL

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fb905387858b2789f7887522227e3019871a89cd
Local-runs: none
Scope: docs/adr/0125-release-approval-gate-replaces-the-typed-version.md + .github/workflows/release.yml, scripts/ci/scheduled-full-run.mjs, scripts/release-dist-tags.mjs, scripts/release-publish.sh, scripts/release-pending-publish.mjs, scripts/sync-protocol-version.mjs, scripts/sync-template-versions.mjs, .changeset/config.json, package.json (the version script), AGENTS.md (Prime Directive #15), docs/adr/0087-metadata-protocol-upgrade-contract.md, docs/releases-maintenance.md, packages/services/service-push/package.json, and the published @changesets/cli@3.0.3 / @changesets/apply-release-plan@8.1.1 / @changesets/assemble-release-plan@7.0.0 sources (the versions pnpm-lock.yaml pins; read from the registry tarballs, nothing installed or run)

Round 4, the last check, of the independent full review on card #30590 (ADR-0125 amendment, #29466 ruling B). Round 1 on 28c6fc09 is record 6672362721 (FAIL: M1 + S1–S5); round 2 on 8adeb779 PASS with W1–W3; round 3 on 14115bea47 PASS with W2′ and W3a′. This head is one commit, fb90538785 ("say publishing jobs throughout, drop a wrong parenthetical"), on 14115bea47; git diff 14115bea47..fb90538785 is four lines changed in the one ADR file; the delta against origin/main (447226b222, merge-base ab44ec94b0) is still that file alone, +69/−1, and against the round-1 head +21/−15. Every file cited in rounds 1 to 3 is byte-identical across badf24dffc, ab44ec94b0, f0ad1f790c and 447226b222, so every earlier file:line citation still holds and is relied on below. Registry re-read at 2026-11-06T00:2xZ: @objectstack/cli next 18.2.0 / latest 18.3.0; @objectstack/service-push still E404. Check-runs on this head: 8 at the first read, 38 at the last with 13 in progress, 0 failures; CI is not awaited by this record (the round-1 head's 46 runs all finished green; rounds 2 to 4 change prose only, inside the same section and callout shapes). Judged against the tree, not against the drafter's account of it.

① Derived judgments

Do W2′ and W3a′ close? Both do. Nothing new is false.

• W2′ — closed. The D1 callout (line 63), the D4 callout (line 85) and the ⛔ bullet (line 226) now say "publishing jobs", matching the requirement "Dispatch-only, and exclusive" (line 212: "none of the stable lane's publishing jobs — release-integrity, the stable full-battery gate and publish"), and line 235 ("the stale-prompts job … untouched") is literally true: stale-prompts (release.yml:1422, PUSH LANE 3; :1459-1461) is left to run on a snapshot dispatch, mints nothing and cancels only push-lane prompts whose version is on npm (release-pending-publish.mjs:170-185). One sentence keeps the older shorthand: line 203, the D4 reading, "runs none of the stable lane's jobs (the exclusivity requirement below)". It points at the requirement that defines the set by name, so it is a shorthand with its definition attached rather than a fourth voice; a one-word edit ("publishing jobs") would make the file uniform, and nothing depends on it.
• W3a′ — closed. The parenthetical about the template syncs is dropped. What "Workspace only" still claims — the lane runs the bare changeset version --snapshot next, never pnpm run version, "whose chain aborts at sync-protocol-version.mjs on a major below 1" — is true: package.json's version script chains sync-protocol-version.mjs and the later syncs with && after changeset version, and scripts/sync-protocol-version.mjs exits 1 when the parsed major is not an integer of 1 or more, which 0.0.0-next-YYYYMMDDHHMMSS is not. The paragraph makes no claim about what the template syncs would do, so nothing in it can disagree with sync-template-versions.mjs.

Carried from rounds 1 to 3, re-checked at this head — all still hold. Every bound line of ruling 6663894403 is carried unsoftened (line 3 in the ruling's own words, read literally). The sentences that decide what the ruling left open are the four readings forced by the ruling's own lines — the commit choice (head of the newest green full-battery run, distance zero from the reader that exists), the debut rule, the pre-mode refusal, exclusivity — plus the two marked as this record's readings (trial start, cites 6664069140; removal with D1's reversion, with the relay reason, AGENTS.md:315-316). No sentence in this delta decides anything. Truth against the code at 447226b222: the D1 and D4 callouts; release.yml:182-184, :193-200, :208-227, :218-222, :959-961, :1459-1461, :1497-1551, :1564, :1568, :1586, :1608-1612, :1635-1637, :1657, :1977, :2030-2073, :269-271, :2081; release-publish.sh:98, :112; release-dist-tags.mjs:35-42, :51-53; release-pending-publish.mjs:174-176, :282, :381-387; scheduled-full-run.mjs:826-827, :864, :870-888, :892-915, :909; .changeset/config.json:10-121 (109 names, equal to the 109 non-private workspace manifests), :52, no pre.json; ADR-0087:335; docs/releases-maintenance.md:191-201; changesets index.mjs:57, :62, version.mjs:38, :47-53, publish.mjs:19-24, :61-66, getPublishPlan.mjs:599-603, :605-650, :627-631, apply-release-plan:178-181, :288-292, :302-320, assemble-release-plan:197-210, :241-263. The live debut case is unchanged: @objectstack/service-push public, in the fixed group, 18.2.0 in the tree, absent from npm. The round-1 inexactness inherited from the ruling's wording (changesets does not rewrite workspace:* ranges; pnpm publish substitutes them) is stated correctly in "The dry run".

② Semver level

None. Docs-only diff: one file under docs/adr/, no package moves, skip-changeset; Clause-②: no on the PR body matches the tree.

③ Boundary flags

No must-fix. No should-fix that holds anything open: W1, W2, W3, W2′ and W3a′ are closed on this head. One optional wording note, and the observations for the lane card, carried unchanged:

• Optional, wording — line 203 (D4 reading): "runs none of the stable lane's jobs (the exclusivity requirement below)" → "publishing jobs", for uniformity with lines 63, 85, 212 and 226. The pointer already defines the set, so this holds nothing.

Observations for #30591, carried from rounds 2 and 3:

• With the debut rule, the first real snapshot waits for 18.4.0 to debut @objectstack/service-push (the stable lane's changeset publish tags a never-published package latest, getPublishPlan.mjs:599-603), or for the maintainer's own hand; the two-week trial starts no earlier than the next stable release. Say so on the lane card and in the PR body.
• Distance zero needs the reader to expose it: releaseGateVerdict reports the distance only in its prose where line (scheduled-full-run.mjs:892-915); the lane parses it or adds a flag to scripts/ci/scheduled-full-run.mjs, whose --self-test (lint.yml) pins the selection rule and the release.yml wiring (:946-960) — ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591's surface grows by that script. Both CI and Lint & Type Check must have a completed, non-cancelled schedule or push run at the chosen commit.
• The exclusivity edit is three if: clauses (release-integrity, full-battery, publish) plus the snapshot job's own; version-pr and docker need nothing (:269-271, :2081); stale-prompts may run on a snapshot dispatch.
• The snapshot job's name must not match release-pending-publish.mjs:282's stable-prompt shape; the dry run reads packed manifests; the group is 109, not 69; docs/releases-maintenance.md's channel table is the consumer to update.
• 13 of 38 check-runs on this head were in progress at the last read, 0 failures.

④ Design judgment

The record is now uniform with itself and with the code it cites. Over four rounds the substance moved once — the debut rule, which repaired a specified guard that could not keep the ruling's strongest line against a package that is in the tree today — and the rest brought the record's sentences into agreement with each other and with release.yml's own naming of its jobs. What the lane must do, what the approval screen shows, and what the maintainer is asked to authorise have been stable since round 2 and hold against release.yml, the full-battery reader, the dist-tag sweep, the changesets sources and the registry. The record is fit to be the thing #30591 is built against, and no further round is owed.

Open: none. Must-fix: none.

Implemented-by: claude/issue-30590-adr-0125-next-lane
Reviewed-by: session_017ihL2ebbZkr2QAEG1x7UC8

VERDICT: PASS

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

席位核对 — ACCEPT · domain:devx#2 · Head-sha fb905387858b2789f7887522227e3019871a89cd · 2026-11-06T00:22Z

• Shape: 1 file, docs/adr/0125-release-approval-gate-replaces-the-typed-version.md, +69/−1, read from the diff and not the report. The **Status**: line gains an Amended entry. D1 and D4 each gain a callout that says "publishing jobs". The new terminal section ## Amendment (2026-11-05, #29466) holds the eight bound lines of ruling 6663894403, a reading of D1 to D6, and the requirements on ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591: the dist-tag guard and the debut rule, dispatch-only and exclusive, the commit (newest green full battery, distance zero), refused during an RC cycle, workspace only, the approval screen, and the dry run. Then come "What stays forbidden" and "What does not change". No workflow, script or other doc changes.
• Ruling: 「29029 29425 29918 30461 29466 同意」 (ruling record 6663894403) for [Decision] Release cadence: a week of merges is about 1,700 PRs, so each QA-gated release carries a very large delta and app repos wait days to install fixes #29466. The amendment states requirements only. The lane itself is ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591. The PR body says Fixes #30590, which is right: the amendment is the whole of that card.
• Review: complete Fable review in four rounds. Round 1 on 28c6fc09b8 FAILed (6672362721) on M1: a package's first publish takes latest whatever tag it carries, so the lane must never debut a package (@objectstack/service-push is that case today). It also raised S1–S5. Dev deltas 6671957724 and 6672652569 and the seat's wording fix fb90538785 closed them. Round 4 PASSed on this head (6672965881) with nothing open. Pointer note 6672973281 on ci(release): add the dispatch-only next snapshot lane to release.yml, held at environment: release, never moving latest (#29466 ruling B) #30591 says its first snapshot waits for service-push's stable debut.
• Gates:
  • Head checks: 25 success and 16 skipped, none red.
  • check-expected-skips: OK, all 16 skips are in main's roster (exit 0).
  • check-governed-merges: GOVERNED, docs/adr/** ×1, landing tier H. 70 changed lines, which is ≤ 3000.
  • dispatch-gates --commands: 21 of 21 exit 0 on this head, and --ran reconciled.
• Out of scope: Skills-docs: n/a, Clause-②: no, Metadata-protocol: none.
• Landing: Tier H. Ready, reviewers os-zhuang and hotlong, needs-user-decision. The seat lands it after an authorized APPROVED review.