docs(spec): correct the "silent strip" cost statement at all four sites, and re-count clause ② as seven

A CONTRACT_REVIEW_TIER review measured this branch's head and found the cost
statement the maintainer signs off on by merging to be factually wrong. Four
sites said the strip is silent. It is not: `lintUnknownAuthoringKeys` (#3786)
walks every stack collection whose entry schema is strip-mode, and `connectors`
is one, so for `connectors[].syncConfig.schedule` — the one deleted position a
stack manifest reaches — `os validate` and `os build` NAME the dropped key and
`os validate --strict` EXITS 1 on it. Measured at head on an otherwise-clean
stack: without the key 0 warnings / exit 0, with it 1 warning / exit 1.

The truth is more favourable to authors than what the maintainer was told, but
it is not the sentence they were asked to confirm. Corrected at all four sites:
the changeset, `migrations/registry.ts`'s step-18 rationale, two comments in
`cron-typed-positions-retirement.test.ts`, and the PR body's 维护者速读. The
accurate statement is per channel: the PARSE strips silently, `os validate` /
`os build` name the key, `--strict` refuses, `os migrate meta` still lists
nothing.

Same round, two more corrections and no behaviour change:

  * Clause ② is SEVEN widenings, not two, and THREE of them are required-key
    removals (`ScheduleState.cronExpression`,
    `ScheduledExport.schedule.cronExpression`,
    `ScheduleExportRequest.schedule.cronExpression`). Measured on both legs:
    the five schema files restored to the merge-base on disk, one probe run,
    restored to HEAD and re-run, with a byte-identity check after the restore.
    14 cases, 14 refusals on the base leg, 14 accept-and-strip on the head leg.
  * The changeset now names the departure of the required `cronExpression:
    string` member from `ScheduleExportInput` — a published TS interface on
    `IExportService`. "No def leaves the public surface" is true and does not
    cover a member. Sweep: zero consumers outside `packages/spec`.

⛔ No behaviour changed: the seven deletions, the merge and the ADR-0087
disposition are untouched, and the 直接删 ruling is not re-litigated.

Claude-Session: https://claude.ai/code/session_01MkQhmuuJAVDjmeWNixwDDH
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/cron-typed-positions-retired.md

@@ -25,13 +25,30 @@ ledger row `cron-declared-unwired` had every one of them `unevaluated`.
 | backup / DR testing | `BackupConfig`, `DisasterRecoveryPlan.testing` (`system/disaster-recovery.zod.ts`) | `schedule` (both) | no |
 
 **What an upgrading author actually observes.** None of the five schemas is `.strict()`, so
-a bare deletion means Zod DROPS the key: an existing document still parses, still loads, and
-the value is discarded without a word. Nothing refuses it, so there is nothing for
+a bare deletion means Zod DROPS the key at the PARSE: an existing document still parses and
+still loads, and the value is discarded there without a word. There is nothing for
 `objectstack migrate meta` to list and nothing for the ADR-0087 chain to replay — the value
-was already inert before this change, and it is inert after. The one channel that speaks is
-`tsc`: a TypeScript author annotating with `Connector`, `ScheduledExport`, `ScheduleState`,
-`CacheWarmup`, `BackupConfig` or `DisasterRecoveryPlan` gets an excess-property error at the
-key and deletes it.
+was already inert before this change, and it is inert after.
+
+The parse is not the only channel, and the two that speak are worth stating exactly,
+because a reader who stops at "non-strict schema" will conclude the opposite:
+
+- **`os validate` / `os build` NAME the dropped key**, for the one deleted position a stack
+  manifest reaches (`connectors[].syncConfig.schedule`). `os validate` exits 0 and reports
+  `connectors.<name>.syncConfig.schedule: 'schedule' is not a declared connector key, so its
+  value is dropped at load.` — in the text face and in `--json`'s `warnings`; `os build`
+  prints the same line under `Undeclared authoring keys — dropped at load (#3786)`. The
+  channel is `lintUnknownAuthoringKeys`, which walks every stack collection whose entry
+  schema is strip-mode, and `connectors` is one. **`os validate --strict` treats that warning
+  as an error and EXITS 1**, so a pipeline running `--strict` over an otherwise-clean stack
+  refuses the upgraded manifest until the key is deleted. `os migrate meta` still lists
+  nothing, in either direction.
+- **`tsc`**: a TypeScript author annotating with `Connector`, `ScheduledExport`,
+  `ScheduleState`, `CacheWarmup`, `BackupConfig` or `DisasterRecoveryPlan` gets an
+  excess-property error at the key and deletes it.
+
+The other six positions are not reachable from a stack manifest, so no CLI walk visits them:
+for those the parse-level strip really is the whole of it.
 
 **What stays, byte-identical:** every other key of the five schemas and every export — no def
 leaves the public surface. `ScheduledExport.schedule` / `ScheduleExportRequest.schedule` keep
@@ -40,6 +57,19 @@ their `timezone` (still defaulting to `UTC`); `ScheduleState` keeps `timezone`,
 key); `CacheWarmup.strategy` keeps its `scheduled` member — a value, not a position the
 ruling names, and exactly as inert as before.
 
+**One published TS MEMBER does leave, and "no def leaves" does not cover it.** The required
+`cronExpression: string` member is deleted from `ScheduleExportInput` in
+`contracts/export-service.ts` — the input type of `IExportService.scheduleExport`, a
+published runtime TS interface (both names are in `api-surface/contracts.json`). It follows
+the two spec positions it mirrored: with `ScheduledExport.schedule.cronExpression` gone, an
+input demanding the key would ask a provider for a cadence it cannot store. The interface,
+the method and every other member stay. Measured blast radius: no source outside
+`packages/spec` names `ScheduleExportInput` or `IExportService` — 0 hits in this repo
+(positive control: a symbol of the same class resolves outside `packages/spec` in the same
+sweep) and 0 in `objectui` (control: 1326 files there import `@objectstack/spec`). An
+implementor that *does* exist off-tree drops the member from its object literal; a caller
+constructing a `ScheduleExportInput` drops it from the literal it passes.
+
 **Not in scope, deliberately:** `CronSchedule.expression` (`system/job.zod.ts`, read by
 `croner` — the ONE cron slot the platform evaluates), `KnowledgeRefreshPolicy.cron`
 (experimental by design), `Object.titleFormat`, and the `PromptTemplate` pair (marked, not
@@ -48,11 +78,13 @@ retired, on its sibling card).
 ## This change states no before/after rewrite, because there is none
 
 A breaking changeset in this repo normally states the old spelling beside the new one.
-This one has no such pair to state: the same document parses before and after, the value
-was inert in both, and nothing refuses it — so a metadata upgrader has no edit to make and
-`os migrate meta` has nothing to list. The one party with work to do is a TypeScript
-author, and the compiler names the key and the line for them. What follows is guidance for
-authoring a cadence going forward, not a rewrite of an existing document.
+This one has no such pair to state: the same document PARSES before and after, the value
+was inert in both, and no conversion can be written for it — so a metadata upgrader has no
+edit to make and `os migrate meta` has nothing to list. That is a statement about the
+migration chain, not about silence: `os validate` / `os build` do name the dropped
+connector key and `os validate --strict` refuses on it (above), and `tsc` names the key and
+the line for a TypeScript author. What follows is guidance for authoring a cadence going
+forward, not a rewrite of an existing document.
 
 ## What to write instead
 

packages/spec/src/cron-typed-positions-retirement.test.ts

@@ -36,11 +36,34 @@ import {
 // a `retiredKey()` tombstone, a `RETIRED_KEYS_BY_MAJOR[18]` entry, an ADR-0087 D2
 // conversion or a D3 semantic entry.
 //
-// That makes the observable consequence a SILENT STRIP, not a refusal: none of
+// That makes the PARSE-layer consequence a SILENT STRIP, not a refusal: none of
 // the five schemas is `.strict()`, so zod drops an authored value and answers
 // `success: true` (ADR-0104's shape). These pins record exactly that — what an
-// author who keeps writing one of these keys actually gets — so the day someone
-// changes the route, the change is loud here rather than invisible in the field.
+// author who keeps writing one of these keys gets from the SCHEMA — so the day
+// someone changes the route, the change is loud here rather than invisible in
+// the field.
+//
+// ⚠️ The parse is NOT the whole channel, and the difference is measured rather
+// than reasoned. Above the parse, `lintUnknownAuthoringKeys` (#3786) walks every
+// `PLURAL_TO_SINGULAR` collection whose entry schema is strip-mode, and
+// `connectors: 'connector'` is one of them — so for the ONE of the seven a stack
+// manifest reaches, the CLI NAMES the dropped key:
+//
+//   • `os validate` — exit 0, and prints (`--json` carries the same string in
+//     `warnings`):
+//       connectors.sap_erp.syncConfig.schedule: 'schedule' is not a declared
+//       connector key, so its value is dropped at load.
+//   • `os validate --strict` — exit 1. Measured on an otherwise-clean stack:
+//     the same manifest WITHOUT the key is 0 warnings / exit 0, WITH it is
+//     1 warning / exit 1. A CI running `--strict` REFUSES the upgraded manifest.
+//   • `os build` — the same line, under `Undeclared authoring keys (1) —
+//     dropped at load (#3786)`.
+//   • `os migrate meta` — still lists nothing, in either direction. There is no
+//     prescription to make, which is the half the bare deletion really does own.
+//
+// ⇒ ⛔ Do not read these pins as "the author is never told". They pin the schema
+// layer. The author-facing loss is louder than a bare `safeParse` suggests, and
+// it is louder than the ruling comment's cost statement assumed.
 
 const CRON = '0 6 * * MON';
 /** The envelope the old schema normalized the bare string into — dropped just the same. */
@@ -276,9 +299,17 @@ describe('[#16320] the one manifest-reachable position — what an upgrading sta
     // ⚠️ THE CONSEQUENCE OF THE 直接删 RULING, pinned. `DataSyncConfig.schedule`
     // is the only one of the seven a stack manifest reaches (`stack.zod.ts`
     // `connectors[]` → `connector.zod.ts` `syncConfig` → `schedule`). With no
-    // tombstone the manifest still LOADS, and the cadence the author wrote is
-    // discarded without a word — the ADR-0104 silent-strip shape, accepted
+    // tombstone the manifest still LOADS and the cadence the author wrote is
+    // dropped — the ADR-0104 silent-strip shape at the PARSE, accepted
     // deliberately by the ruling.
+    //
+    // ⛔ Silent at the parse is not silent to the author, and the module
+    // docblock carries the measurement: on this exact path `os validate` prints
+    // `connectors.<name>.syncConfig.schedule: 'schedule' is not a declared
+    // connector key, so its value is dropped at load.`, `os build` prints it
+    // under its undeclared-keys block, and `os validate --strict` EXITS 1 on it.
+    // This assertion is about `ObjectStackSchema` alone; it does not measure —
+    // and must not be quoted as — what the CLI tells the author.
     const { ObjectStackSchema } = await import('./stack.zod');
     const parsed = ObjectStackSchema.safeParse({
       connectors: [{ ...CONNECTOR_WELL_FORMED, syncConfig: { ...SYNC_WELL_FORMED, schedule: CRON } }],

packages/spec/src/migrations/registry.ts

@@ -5410,8 +5410,14 @@ const step18: MigrationStep = {
     '(the D7 ledger row `cron-declared-unwired`). All seven are DELETED OUTRIGHT — no ' +
     'retiredKey tombstone, no RETIRED_KEYS_BY_MAJOR[18] entry, no D2 conversion and no D3 ' +
     'semantic entry — so this step replays nothing for them and `migrate meta` lists no ' +
-    'edit: the keys simply stop existing, and the six positions on non-strict schemas are ' +
-    'stripped in silence rather than refused. That is the maintainer ruling of 2026-09-10 ' +
+    'edit: the keys simply stop existing. That the chain is silent does NOT make the ' +
+    'deletion silent to an author: the PARSE strips (no schema here is `.strict()`), but ' +
+    'above it `lintUnknownAuthoringKeys` (#3786) names the dropped key for the one ' +
+    'position a stack manifest reaches — `os validate` and `os build` both print ' +
+    '`connectors.<name>.syncConfig.schedule: \'schedule\' is not a declared connector ' +
+    'key, so its value is dropped at load.`, and `os validate --strict` EXITS 1 on that ' +
+    'warning. The other six positions are unreachable from a manifest, so for those the ' +
+    'parse-level strip is the whole of it. That is the maintainer ruling of 2026-09-10 ' +
     'on the retirement PR, taken over the seat recommendation to keep the connector D2, on ' +
     'the reading that customers do not upgrade major by major in order.',
   conversionIds: [