feat(spec)!: the four system/logging.zod.ts duration keys carry their unit in the key name (#17782, ruling A on #15939) (#17999)

Fixes #17782
Clause-②: yes

Ruling A on #15939 (director seat 2026-09-11, maintainer 「同意」, decision
batch #115), per-file
remediation of the #14478 rule. This is the `system/logging.zod.ts` card
— 4 rows of the 21-row
delta enumerated in PR #17635, which lands LAST.

## What changed

| def | before | after | nesting |
|:--|:--|:--|:--|
| `HttpDestinationConfig` | `batch.flushInterval: 5000` |
`batch.flushIntervalMs` | nested under `batch` |
| `HttpDestinationConfig` | `retry.initialDelay: 1000` |
`retry.initialDelayMs` | nested under `retry` |
| `HttpDestinationConfig` | `timeout: 30000` | `timeoutMs` |
**top-level** |
| `LoggingConfig` | `buffer.flushInterval: 1000` |
`buffer.flushIntervalMs` | nested under `buffer` |

Every value, default and bound is unchanged. Each old spelling stays as
a `retiredKey()` tombstone;
none of the four enclosing objects is `.strict()`, so a bare deletion
would have stripped the value
in silence.

## The JSDoc I read on each key, and what the published channel said

All four named milliseconds in a source JSDoc — "Flush interval in
milliseconds", "Initial retry
delay in milliseconds", "Timeout in milliseconds" — and **none carried a
`.describe()` at all**.
The `check:duration-unit-keys` census on this tree read all four as
`[name: -] [prose: -]` before
the change, so `content/docs/references/system/logging.mdx` published a
bare 5000 / 1000 / 30000 /
1000 with nothing on the page to decide milliseconds from seconds. Each
key is renamed **and** given
the describe it never had: under the #14478 rule, fixing only the
describe would itself be a
violation.

## The two traps this card carried

**`flushInterval` is declared twice, in two different defs, with two
different defaults** — 5000 on
the HTTP destination's `batch`, 1000 on the logging `buffer`. They are
two keys. Each gets its own
tombstone, its own `RETIRED_KEYS_BY_MAJOR[18]` row, and a prescription
that names its def so an
author who lands on one is not sent to the other. Located by def, not by
key name.

**Mixed nesting, so the ratchet moves for exactly one key.**
`authorable-surface` records top-level
keys per def (`build-schemas.ts` reads `schema.properties` one level
deep). `HttpDestinationConfig.timeout`
is the only top-level key of the four, so it is the only one whose rows
move:
`system/HttpDestinationConfig:timeout` becomes `[RETIRED]` beside a new
`system/HttpDestinationConfig:timeoutMs`, and the `authorable-defaults/`
row is renamed with it. The
three nested keys move neither file — correct, not an omission.
`authorable-surface.base.json` is
untouched (it is written only by `gen:authorable-surface-base`).

## Naming

`Ms`, derived from the family on this tree rather than from the card:
272 key-position `*Ms:`
declarations in `packages/spec/src` against 75 `*Seconds:`. The only
competing unit spellings are
3 `*MS:` and 9 `*Millis:`, and every one mirrors a name fixed outside
this repo — MongoDB's
`maxCommitTimeMS` / `connectTimeoutMS`, node-postgres's
`idleTimeoutMillis` /
`connectionTimeoutMillis` on `PoolConfigSchema` — so unlike the
`Ttl`-versus-`TTL` question a
sibling round settled, there is no in-repo alternative to choose
between. All three target spellings
were already attested as key-position `*.zod.ts` declarations:
`flushIntervalMs` 1 (on
`kernel/events/integrations.zod.ts`, at the same 1000 default),
`initialDelayMs` 5, `timeoutMs` 30.

## Changeset level

`.changeset/17782-logging-duration-units.md` declares
`"@objectstack/spec": minor`, a `feat(spec)!`
summary, a `**BREAKING**` banner and the `adr-0087: registered
logging-durations-unit-in-key`
disposition. Ruling A wrote `patch`; that half of the clause is
falsified by the precedent the same
sentence names — every `#15678` / `#15679` entry in
`packages/spec/CHANGELOG.md` under `## 17.4.0`
is `feat(spec)!` at minor — and the correction is recorded publicly on
#15939 (`5652120294`). The
declaration is `Clause-②: yes` for the same mechanical reason: a rename
puts a new authorable
spelling on a published payload, and the floor in
`references/contract-review.md` makes that a
mandatory affirmative whatever the round's size.

## Registration

One ADR-0087 D3 semantic entry `logging-durations-unit-in-key` plus four
`RETIRED_KEYS_BY_MAJOR[18]`
rows, one per key — the shape settled for the four remaining rename
cards on #15939. No D2
conversion: `stack.zod.ts` declares no logging collection and neither
`LoggingConfigSchema` nor
`HttpDestinationConfigSchema` is referenced anywhere in
`packages/spec/src` outside
`system/logging.zod.ts`, so the chain has no rehydration seam that runs
on an authored logging
document.

Registry regenerated with `gen:migration-registry`, never hand-merged.
Set-difference over every
registry row (every `id:` line plus every lone quoted array element),
measured three ways:

| comparison | rows | lost | gained |
|:--|:--|--:|:--|
| my regeneration, before → after | 1624 → 1629 | **0** | my 1 semantic
id + 4 retired-key rows |
| the two `os-regen-merge.sh` syncs of `main`, pre → post regeneration |
1631 → 1631 and 1631 → 1633 | **0** | only what `main` brought (#17784,
#17781) |
| merge base `ae1b258889` → head | 1628 → 1633 | **0** | exactly my 5
rows |

Exact-name occurrence counts on the regenerated registry after the
second sync, guarding the silent
drop the `os-regen` driver can produce: sibling #17781's
`kernel-runtime-config-timeout-unit-in-key`
1 and its row `kernel/RuntimeConfig:resourceLimits.timeout` 1; sibling
#17784's
`tenant-schema-cache-ttl-unit-in-key` 1 and
`system/SchemaLevelIsolationStrategy:performance.schemaCacheTTL`
1; my own id and four rows 1 each; dark control 0. Both siblings'
implementation bodies survive too
(`timeoutMs` 7 in `kernel/plugin-security-advanced.zod.ts`,
`schemaCacheTtlSeconds` 3 in
`system/tenant.zod.ts`).

## Cross-repo

The pinned objectui checkout at `.objectui-sha` pin
`53ded82bf7a494f54e344e19099dbf00854b8694`
spells `flushInterval` 0 times, `initialDelay` 0,
`HttpDestinationConfig` 0 and `LoggingConfig` 0
across its 6409 tracked files, against lit controls `useState` 2304 and
`timeout` 702 on the same
corpus. Nothing in the sibling reads these keys.

## Tests

All readings below are from head `a5976809c2`, the head this PR now
carries, re-run after both
`os-regen-merge.sh` syncs of `main`.

- `pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2
src/system/logging.test.ts` —
46 passed. Three existing pins asserted the retired spellings
(`config.timeout` 30000,
`batch.flushInterval` 10000, `buffer.flushInterval` 2000); each was
**moved to the new key**, its
  comment rewritten to say why, and none was deleted or weakened.
- `pnpm --filter @objectstack/spec typecheck && pnpm --filter
@objectstack/spec test` — VERDICT
  command-exit 0, 476 files / 13533 tests passed.
- `pnpm --filter @objectstack/spec check:generated` — **15 of 15
artifacts up to date** on this
head, with the working tree clean, after `gen:migration-registry`, the
package build and
  `gen:docs`.
- `node scripts/pm/dispatch-gates.mjs --commands` derives **109**
families for these 12 paths;
`--ran` with a recorded exit code per command reconciles **109
accounted, 107 run green, 2
NOT MEASURED, 0 unrun**. The two are `check:dual-build-cjs-loads` and
`check:type-check-debt`,
both exit **3** `PREREQUISITE NOT MET` — they need every workspace
package built, which CI's
`Build Core` supplies and a spec-only worktree does not. ⛔ Neither is a
pass.
- `pnpm --filter @objectstack/spec check:duration-unit-keys` — 0
offenders; the four rows leave the
  census's unit-nowhere population.
- `pnpm --filter @objectstack/spec check:objectui-pin-citations` —
**exit 0**: 16 asserting
citations match `.objectui-sha` (53ded82bf), 26 historical recorded and
not checked. The asserting citation sits on ONE physical source line in
both its sites (the
semantic entry and its generated registry mirror), which is the failure
three sibling PRs hit.
- `node scripts/pm/check-widening-tells.mjs --declaration yes` — **exit
0**. Under a hypothetical
`--declaration no` it exits 4 with **4 T1 tells, one per `retiredKey()`
line** (:326 :351 :371
:759) — the inversion already filed as #17955, and the four newly
writable `*Ms` keys are not what
  it flags. ⛔ The diff is not reshaped and the checker is not weakened.
- **Ablation**, from the committed state, with an `EXIT INT TERM`
restore trap. All four
`retiredKey(...)` calls replaced by a marker comment: occurrence counts
1/1/1/1 → 0/0/0/0 and the
injected marker 0 → 4, `git hash-object` `9768a4bb…` → `40095a54…` (the
mutation proven on disk,
not inferred from an editor exit code). The suite then read **4 failed |
42 passed** — exactly the
four `REFUSES the retired spelling` pins, no others. Restored with `git
checkout HEAD -- ` on an
absolute path: `git hash-object` back to `9768a4bb…` and `git diff HEAD`
empty. That blob is still
  the one at this head, so the reading stands for the PR as it is.

## Landing order, for whoever lands after me

This diff edits `packages/spec/authorable-surface/system.json` (+2/−1)
and
`packages/spec/authorable-defaults/system.json` (±1), and card #17783
(`system/metrics.zod.ts`,
two top-level rows) is in flight against the same two shards. Both paths
are routed
`merge=os-regen` in `.gitattributes`, so the local driver defers them
and `pre-commit` collects the
debt — the merge queue rebuilds server-side where no driver runs, so the
shard is textually shared
and a conflict there is expected, not a defect. The only correct
resolution is
`bash scripts/pm/os-regen-merge.sh` (commit the merge FIRST, then
regenerate on the merged base),
⛔ never a hand-merge of the JSON: these rows are a sorted set, a dropped
line is silent, and
`gen:schema` recomputes the whole shard from the merged Zod graph
anyway. One thing measured here
that the later lander can rely on: the ratchet moved for exactly one of
my four keys, so the
regenerated shard differs from `main` by three lines and nothing else on
this file is mine.

## Acceptance notes

- `packages/spec/src/system/logging.zod.ts:298` `backoffMultiplier` also
reads `[name: -]
[prose: -]` in the census, but it is a ratio, not a duration, and is not
one of this card's four
  rows. Noted, not filed.
- Six gate families in this diff's derived set refuse with `PREREQUISITE
NOT MET` on a
worktree that has not built the whole repo; they are named in the report
comment as NOT MEASURED
  rather than passed. CI's `Build Core` supplies what they need.

⛔ Not ready for review by this seat: the in-seat clause-② review at tier
is the PM's step. Draft,
not enqueued, no auto-merge.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_015c5G6TmpMKgnusmTpD7Ntt


---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.changeset/17782-logging-duration-units.md

@@ -0,0 +1,98 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec)!: the four `system/logging.zod.ts` duration keys carry their unit in the key name (#17782, ruling A on #15939)
+
+<!-- adr-0087: registered logging-durations-unit-in-key -->
+
+**BREAKING** — the HTTP log destination's batch flush, retry backoff start and request deadline,
+and the logging buffer's flush, now carry `Ms` in the key name.
+
+| def | before | after |
+|:--|:--|:--|
+| `HttpDestinationConfig` | `batch.flushInterval: 5000` | `batch.flushIntervalMs: 5000` |
+| `HttpDestinationConfig` | `retry.initialDelay: 1000` | `retry.initialDelayMs: 1000` |
+| `HttpDestinationConfig` | `timeout: 30000` | `timeoutMs: 30000` |
+| `LoggingConfig` | `buffer.flushInterval: 1000` | `buffer.flushIntervalMs: 1000` |
+| values, defaults, bounds | ms; 5000 / 1000 / 30000 / 1000; positive int | **unchanged** |
+
+## Migration
+
+```diff
+  const destination = HttpDestinationConfigSchema.parse({
+    url: 'https://logs.example.com/v1/logs',
+-   batch: { maxSize: 500, flushInterval: 10000 },
+-   retry: { maxAttempts: 3, initialDelay: 1000 },
+-   timeout: 30000,
++   batch: { maxSize: 500, flushIntervalMs: 10000 },
++   retry: { maxAttempts: 3, initialDelayMs: 1000 },
++   timeoutMs: 30000,
+  });
+
+  const logging = LoggingConfigSchema.parse({
+    name: 'app_logging',
+    label: 'App logging',
+    destinations: [],
+-   buffer: { enabled: true, size: 5000, flushInterval: 2000 },
++   buffer: { enabled: true, size: 5000, flushIntervalMs: 2000 },
+  });
+```
+
+Rename the keys. Every value is the same number of milliseconds it always was, and the
+5000 / 1000 / 30000 / 1000 defaults are unchanged; nothing else on either def moves.
+
+## Why
+
+Each key named milliseconds in a source JSDoc — "Flush interval in milliseconds", "Initial retry
+delay in milliseconds", "Timeout in milliseconds" — and the JSDoc above a key is not what
+`content/docs/references/**` renders; `.describe()` is, and **none of the four carried one at
+all**. Measured by the `check:duration-unit-keys` census on this tree before the change, all four
+read `[name: -] [prose: -]`: no unit in the key, and no published prose to supply it either. So
+`content/docs/references/system/logging.mdx` printed a bare `5000` / `1000` / `30000` / `1000`,
+and nothing on the page decided milliseconds from seconds. Under the #14478 rule, moving the unit
+into the describe alone would itself be a violation (unit in prose, none in the name), so each key
+is renamed and given the describe it never had in the same stroke. Executes director-seat ruling A
+on #15939 (2026-09-11, maintainer 「同意」, decision batch #115), the per-file remediation of the
+#14478 rule.
+
+⚠️ `flushInterval` was declared **twice** on this file, in two different defs and with two
+different defaults — 5000 on the HTTP destination's `batch`, 1000 on the logging `buffer`. They are
+two keys, not one; each gets its own tombstone, its own registered row, and a prescription that
+names its def, so an author who lands on one is not sent to the other.
+
+The `Ms` suffix is the family's own spelling, counted in key position on this tree: 272 `*Ms:`
+declarations in `packages/spec/src` against 75 `*Seconds:`. The only competing unit spellings are
+3 `*MS:` and 9 `*Millis:`, and every one of them mirrors a name fixed outside this repo — MongoDB's
+`maxCommitTimeMS` and `connectTimeoutMS`, node-postgres's `idleTimeoutMillis` and
+`connectionTimeoutMillis` on `PoolConfigSchema` — so unlike the `Ttl`-versus-`TTL` question a
+sibling round had to settle, there was no in-repo alternative to choose between. All three target
+spellings were already attested as key-position `*.zod.ts` declarations before this change:
+`flushIntervalMs` 1 (on `kernel/events/integrations.zod.ts`, at the same 1000 default),
+`initialDelayMs` 5, `timeoutMs` 30.
+
+## The kit
+
+- a `retiredKey()` tombstone on each of the four old spellings, so `tsc` types it `never` and a
+  value reaching the parse raises the rename prescription instead of being silently stripped — none
+  of the four enclosing objects is `.strict()` (`HttpDestinationConfig` itself and its nested
+  `batch` and `retry`; `LoggingConfig`'s nested `buffer`)
+- the ADR-0087 D3 semantic entry `logging-durations-unit-in-key` and four
+  `RETIRED_KEYS_BY_MAJOR[18]` rows, one per key. No D2 conversion: `stack.zod.ts` declares no
+  logging collection and neither `LoggingConfigSchema` nor `HttpDestinationConfigSchema` is
+  referenced anywhere in `packages/spec/src` outside `system/logging.zod.ts`, so the chain has no
+  rehydration seam that runs on an authored logging document — the same reading
+  `tenant-schema-cache-ttl-unit-in-key` recorded for its sibling key
+- pin tests per key: the refusal carries the rename prescription and names the def, the suffixed
+  key parses at the magnitude the retired one carried with the same default, and the describe
+  publishes the unit
+- exactly one authorable-surface row pair moves, and it is the one that should: that ratchet records
+  top-level keys per def (`build-schemas.ts` reads `schema.properties` one level deep), and
+  `HttpDestinationConfig.timeout` is the only top-level key of the four —
+  `system/HttpDestinationConfig:timeout` becomes `[RETIRED]` beside a new
+  `system/HttpDestinationConfig:timeoutMs`, and the `authorable-defaults/` row is renamed with it.
+  The three nested keys move neither file, which is correct and not an omission
+- the pinned objectui checkout is untouched by this rename: at `.objectui-sha` pin
+  `53ded82bf7a494f54e344e19099dbf00854b8694` it spells `flushInterval` 0 times, `initialDelay` 0,
+  `HttpDestinationConfig` 0 and `LoggingConfig` 0 across its 6409 tracked files, against lit
+  controls `useState` 2304 and `timeout` 702 on the same corpus

content/docs/references/system/logging.mdx

@@ -109,9 +109,10 @@ HTTP destination configuration
 | **method** | `Enum<'POST' \| 'PUT'>` | optional (default: `"POST"`) |  |
 | **headers** | `Record<string, string>` | optional |  |
 | **auth** | `{ type: Enum<'basic' \| 'bearer' \| 'api_key'>; username?: string; password?: string; token?: string; … }` | optional |  |
-| **batch** | `{ maxSize: integer; flushInterval: integer }` | optional |  |
-| **retry** | `{ maxAttempts: integer; initialDelay: integer; backoffMultiplier: number }` | optional |  |
-| **timeout** | `integer` | optional (default: `30000`) |  |
+| **batch** | `{ maxSize: integer; flushIntervalMs: integer }` | optional |  |
+| **retry** | `{ maxAttempts: integer; initialDelayMs: integer; backoffMultiplier: number }` | optional |  |
+| **timeoutMs** | `integer` | optional (default: `30000`) | Timeout in milliseconds |
+| **timeout** | `never` | optional | [REMOVED] `HttpDestinationConfig.timeout` was renamed to `timeoutMs` in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Its unit (milliseconds) lived in a source JSDoc only and the key carried no `.describe()` at all, so the reference page published a bare 30000. Rename the key to `timeoutMs`; the value (milliseconds) and the 30000 default are unchanged. |
 
 ### Nested Shape: `HttpDestinationConfig.auth`
 
@@ -124,6 +125,23 @@ HTTP destination configuration
 | **apiKey** | `string` | optional |  |
 | **apiKeyHeader** | `string` | optional (default: `"X-API-Key"`) |  |
 
+### Nested Shape: `HttpDestinationConfig.batch`
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **maxSize** | `integer` | optional (default: `100`) |  |
+| **flushIntervalMs** | `integer` | optional (default: `5000`) | Flush interval in milliseconds |
+| **flushInterval** | `never` | optional | [REMOVED] `HttpDestinationConfig.batch.flushInterval` was renamed to `flushIntervalMs` in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Its unit (milliseconds) lived in a source JSDoc only and the key carried no `.describe()` at all, so the reference page published a bare 5000. Rename the key to `flushIntervalMs`; the value (milliseconds) and the 5000 default are unchanged. This is the batch flush on an HTTP log destination — `LoggingConfig.buffer.flushInterval` is a different key with its own rename. |
+
+### Nested Shape: `HttpDestinationConfig.retry`
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **maxAttempts** | `integer` | optional (default: `3`) |  |
+| **initialDelayMs** | `integer` | optional (default: `1000`) | Initial retry delay in milliseconds |
+| **initialDelay** | `never` | optional | [REMOVED] `HttpDestinationConfig.retry.initialDelay` was renamed to `initialDelayMs` in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Its unit (milliseconds) lived in a source JSDoc only and the key carried no `.describe()` at all, so the reference page published a bare 1000. Rename the key to `initialDelayMs`; the value (milliseconds) and the 1000 default are unchanged. |
+| **backoffMultiplier** | `number` | optional (default: `2`) |  |
+
 
 ---
 
@@ -163,9 +181,10 @@ Log destination configuration
 | **method** | `Enum<'POST' \| 'PUT'>` | optional (default: `"POST"`) |  |
 | **headers** | `Record<string, string>` | optional |  |
 | **auth** | `{ type: Enum<'basic' \| 'bearer' \| 'api_key'>; username?: string; password?: string; token?: string; … }` | optional |  |
-| **batch** | `{ maxSize: integer; flushInterval: integer }` | optional |  |
-| **retry** | `{ maxAttempts: integer; initialDelay: integer; backoffMultiplier: number }` | optional |  |
-| **timeout** | `integer` | optional (default: `30000`) |  |
+| **batch** | `{ maxSize: integer; flushIntervalMs: integer }` | optional |  |
+| **retry** | `{ maxAttempts: integer; initialDelayMs: integer; backoffMultiplier: number }` | optional |  |
+| **timeoutMs** | `integer` | optional (default: `30000`) | Timeout in milliseconds |
+| **timeout** | `never` | optional | [REMOVED] `HttpDestinationConfig.timeout` was renamed to `timeoutMs` in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Its unit (milliseconds) lived in a source JSDoc only and the key carried no `.describe()` at all, so the reference page published a bare 30000. Rename the key to `timeoutMs`; the value (milliseconds) and the 30000 default are unchanged. |
 
 
 ---
@@ -297,7 +316,7 @@ Logging configuration
 | **enrichment** | `{ staticFields?: Record<string, any>; dynamicEnrichers?: string[]; addHostname: boolean; addProcessId: boolean; … }` | optional | Log enrichment configuration |
 | **redact** | `string[]` | optional (has default) | Fields to redact |
 | **sampling** | `{ enabled: boolean; rate: number; rateByLevel?: Record<string, number> }` | optional |  |
-| **buffer** | `{ enabled: boolean; size: integer; flushInterval: integer; flushOnShutdown: boolean }` | optional |  |
+| **buffer** | `{ enabled: boolean; size: integer; flushIntervalMs: integer; flushOnShutdown: boolean }` | optional |  |
 | **performance** | `{ async: boolean; workers: integer }` | optional |  |
 
 ### Nested Shape: `LoggingConfig.default`
@@ -354,6 +373,16 @@ Log destination configuration
 | **addCaller** | `boolean` | optional (default: `false`) |  |
 | **addCorrelationIds** | `boolean` | optional (default: `true`) |  |
 
+### Nested Shape: `LoggingConfig.buffer`
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **enabled** | `boolean` | optional (default: `true`) |  |
+| **size** | `integer` | optional (default: `1000`) |  |
+| **flushIntervalMs** | `integer` | optional (default: `1000`) | Flush interval in milliseconds |
+| **flushInterval** | `never` | optional | [REMOVED] `LoggingConfig.buffer.flushInterval` was renamed to `flushIntervalMs` in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Its unit (milliseconds) lived in a source JSDoc only and the key carried no `.describe()` at all, so the reference page published a bare 1000. Rename the key to `flushIntervalMs`; the value (milliseconds) and the 1000 default are unchanged. This is the in-process log buffer — `HttpDestinationConfig.batch.flushInterval` is a different key with its own rename. |
+| **flushOnShutdown** | `boolean` | optional (default: `true`) |  |
+
 
 ---
 

packages/spec/authorable-defaults/system.json

@@ -107,7 +107,7 @@
     "system/FileDestinationConfig:append = true",
     "system/FileDestinationConfig:encoding = \"utf8\"",
     "system/HttpDestinationConfig:method = \"POST\"",
-    "system/HttpDestinationConfig:timeout = 30000",
+    "system/HttpDestinationConfig:timeoutMs = 30000",
     "system/Job:enabled = true",
     "system/KeyRotationPolicy:autoRotate = true",
     "system/KeyRotationPolicy:enabled = false",

packages/spec/authorable-surface/system.json

@@ -460,7 +460,8 @@
     "system/HttpDestinationConfig:headers",
     "system/HttpDestinationConfig:method",
     "system/HttpDestinationConfig:retry",
-    "system/HttpDestinationConfig:timeout",
+    "system/HttpDestinationConfig:timeout [RETIRED]",
+    "system/HttpDestinationConfig:timeoutMs",
     "system/HttpDestinationConfig:url",
     "system/IntervalSchedule:intervalMs",
     "system/IntervalSchedule:type",

packages/spec/src/migrations/entries/retired-keys/18.system__HttpDestinationConfig__batch.flushInterval.ts

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// #15939 ruling A (per-file remediation of #14478). `batch.flushInterval` said
+// "Flush interval in milliseconds" in a source JSDoc and carried no
+// `.describe()` at all, so the reference page published a bare 5000. Renamed to
+// `flushIntervalMs` — the family's own spelling, 272 key-position `*Ms:`
+// declarations in `packages/spec/src` and `flushIntervalMs` already declared on
+// `kernel/events/integrations.zod.ts`. The value and the 5000 default are
+// unchanged. Tombstoned with `retiredKey()`: the nested `batch` object is not
+// strict, so a bare deletion would silently strip the key. ⚠️ Not the same key
+// as `system/LoggingConfig:buffer.flushInterval`, which defaults to 1000 and
+// has its own row. No D2 conversion: no logging collection on `stack.zod.ts`,
+// not a stored row. See `logging-durations-unit-in-key`.
+export const entry = 'system/HttpDestinationConfig:batch.flushInterval';

packages/spec/src/migrations/entries/retired-keys/18.system__HttpDestinationConfig__retry.initialDelay.ts

@@ -0,0 +1,11 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// #15939 ruling A (per-file remediation of #14478). `retry.initialDelay` said
+// "Initial retry delay in milliseconds" in a source JSDoc and carried no
+// `.describe()` at all, so the reference page published a bare 1000. Renamed to
+// `initialDelayMs` — already attested as a key-position declaration 5 times on
+// this tree. The value and the 1000 default are unchanged. Tombstoned with
+// `retiredKey()`: the nested `retry` object is not strict, so a bare deletion
+// would silently strip the key. No D2 conversion: no logging collection on
+// `stack.zod.ts`, not a stored row. See `logging-durations-unit-in-key`.
+export const entry = 'system/HttpDestinationConfig:retry.initialDelay';

packages/spec/src/migrations/entries/retired-keys/18.system__HttpDestinationConfig__timeout.ts

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// #15939 ruling A (per-file remediation of #14478). `timeout` said "Timeout in
+// milliseconds" in a source JSDoc and carried no `.describe()` at all, so the
+// reference page published a bare 30000. Renamed to `timeoutMs` — already
+// attested as a key-position declaration 30 times on this tree. The value and
+// the 30000 default are unchanged. Tombstoned with `retiredKey()`:
+// `HttpDestinationConfig` is not strict, so a bare deletion would silently
+// strip the key. ⚠️ The one TOP-LEVEL key of this card's four, so this is the
+// one whose `authorable-surface/` and `authorable-defaults/` rows move — that
+// ratchet records `schema.properties` one level deep. No D2 conversion: no
+// logging collection on `stack.zod.ts`, not a stored row. See
+// `logging-durations-unit-in-key`.
+export const entry = 'system/HttpDestinationConfig:timeout';

packages/spec/src/migrations/entries/retired-keys/18.system__LoggingConfig__buffer.flushInterval.ts

@@ -0,0 +1,13 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// #15939 ruling A (per-file remediation of #14478). `buffer.flushInterval` said
+// "Flush interval in milliseconds" in a source JSDoc and carried no
+// `.describe()` at all, so the reference page published a bare 1000. Renamed to
+// `flushIntervalMs`. The value and the 1000 default are unchanged. Tombstoned
+// with `retiredKey()`: the nested `buffer` object is not strict, so a bare
+// deletion would silently strip the key. ⚠️ Not the same key as
+// `system/HttpDestinationConfig:batch.flushInterval`, which defaults to 5000
+// and has its own row — the two spellings were identical and the defaults never
+// were. No D2 conversion: no logging collection on `stack.zod.ts`, not a stored
+// row. See `logging-durations-unit-in-key`.
+export const entry = 'system/LoggingConfig:buffer.flushInterval';