Merge branch 'claude/issue-14478-duration-unit-in-key-name' into claude/issue-15682-widen-duration-unit-keys-population

Cards 2/6..5/6 of the #14478 stack landed on the trunk as squashes, which kept
their content and destroyed their ancestry, so this branch's merge base rewound
to 140e0b2 and seven files conflicted. Every one resolves by taking a side
whole; none is hand-merged.

Group A - five files this card never touched (head blob == fork point
3351a86), resolved to the TRUNK's side, which carries cards 3/6 and 4/6's
later prose corrections:

  .changeset/kernel-duration-keys-unit-in-key-name.md
  packages/spec/src/kernel/plugin-security-advanced.test.ts
  packages/spec/src/migrations/entries/semantic/18.kernel-plugin-security-durations-unit-in-key.ts
  packages/spec/src/migrations/entries/semantic/18.system-metrics-window-durations-unit-in-key.ts
  packages/spec/src/migrations/registry.ts

Group B - two files that are this card's own work, resolved to THIS BRANCH's
side. The trunk contributes nothing to either: its blob is byte-identical to
this branch's fork point (check-duration-unit-keys.ts fe98c8f,
conversions/registry.ts 07e13ff), so the conflict is an artifact of the
rewound base alone:

  packages/spec/scripts/check-duration-unit-keys.ts
  packages/spec/src/conversions/registry.ts

No merge=os-regen path is modified on both sides (all seven read
`merge: unspecified`), so nothing is deferred and there is no regeneration
half. The migrations registry takes the trunk's side and loses no row: both
sides carry the same 180 retired-key ids, and the only textual difference is
prose inside two entries' rationale strings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G4138K1EG7kQ81FNba5Kp4

Author: claude

.changeset/kernel-duration-keys-unit-in-key-name.md

@@ -91,10 +91,15 @@ registered by exact key in `RETIRED_KEYS_BY_MAJOR`.
 `EventSourcingConfig.snapshotRetention` is a COUNT of snapshots and
 `MultiVersionSupport.rollout.percentage` is a proportion — neither is a
 duration, so neither has a unit to carry and both keep their names.
-`RuntimeConfig.resourceLimits.timeout` names no unit anywhere in its prose, so
-it is outside the gate's population and outside this rename; a pin test asserts
-that, so a later sweep cannot read the four security renames as "every timeout
-on that file".
+`RuntimeConfig.resourceLimits.timeout` names its unit only in the JSDoc above
+the key ("Execution timeout in milliseconds"), a channel
+`check:duration-unit-keys` does not read: it reads `.describe()` and
+`.meta({ description })`, and this key's describe ("Maximum execution time")
+names none. The gate therefore lists it among the duration-shaped keys but
+deliberately does not judge it — neither an offender nor an exemption — so it is
+outside this rename; that JSDoc-channel gap is filed as #15939. A pin test
+asserts the key still parses bare, so a later sweep cannot read the four
+security renames as "every timeout on that file".
 
 ## Readers moved in the same PR, at the same magnitude
 

content/docs/getting-started/quick-reference.mdx

@@ -206,7 +206,7 @@ from the provider itself, not from hand-written spec files.
 |:---------|:-----------|:------------|:--------|
 | **[Connector](/docs/references/integration/connector)** | `connector.zod.ts` | Connector | The connector protocol — auth, sync, webhooks, rate limiting |
 
-## Shared Protocol (5 of 8 schemas)
+## Shared Protocol (5 of 9 schemas)
 
 Common utilities used across all protocols.
 

packages/spec/llms.txt

@@ -77,7 +77,7 @@ const query = {
 
 ---
 
-## 3. Schema Inventory by Domain (207 schemas)
+## 3. Schema Inventory by Domain (208 schemas)
 
 Counted as `*.zod.ts` modules under `packages/spec/src/<domain>/` — the sources
 that ship in this tarball (`files` includes `src/**/*.zod.ts`), so every number
@@ -91,7 +91,7 @@ here is verifiable from the installed package.
 | api | 30 | Endpoint, REST Server, Discovery, OData, Batch, WebSocket, Response Envelope, Package Lifecycle |
 | ui | 18 | View, App, Action, Dashboard, Page, Chart, Component, Animation |
 | automation | 13 | Flow, Approval, BPMN Interop, Control Flow, State Machine, Webhook |
-| shared | 13 | Enums, HTTP, Identifiers, Mapping, Metadata Types, Connector Auth, Retry Policy, Value Domain |
+| shared | 14 | Enums, HTTP, Identifiers, Mapping, Metadata Types, Connector Auth, Retry Policy, Value Domain, Epoch Instant (EpochMs) |
 | ai | 11 | Agent, Conversation, Knowledge Source/Document, Model Registry, MCP, Skill, Tool |
 | cloud | 11 | Marketplace, Developer Portal, App Store, Environment, Package, Tenant |
 | identity | 5 | Identity, Organization, Position, SCIM, Eval User |

packages/spec/src/api/websocket.zod.ts

@@ -471,7 +471,7 @@ export type WebSocketConfigParsed = z.infer<typeof WebSocketConfigSchema>;
  *   type: 'subscribe',
  *   channel: 'record.account.123',
  *   payload: { events: ['created', 'updated'] },
- *   timestamp: Date.now()
+ *   occurredAt: Date.now()
  * }
  * ```
  * 
@@ -481,7 +481,7 @@ export type WebSocketConfigParsed = z.infer<typeof WebSocketConfigSchema>;
  *   type: 'data-change',
  *   channel: 'record.account.123',
  *   payload: { id: '123', action: 'updated', data: {...} },
- *   timestamp: Date.now()
+ *   occurredAt: Date.now()
  * }
  * ```
  */

packages/spec/src/kernel/plugin-security-advanced.test.ts

@@ -393,8 +393,10 @@ describe('Plugin security durations carry their unit (#15678)', () => {
     expect(parsed.vulnerabilityDisclosure?.bugBounty).toBe(true);
   });
 
-  // A NEGATIVE control on the same file: this key names no unit anywhere, so it
-  // is outside the gate's population and outside this rename. Without it, a
+  // A NEGATIVE control on the same file: this key names its unit only in the
+  // JSDoc above it, a channel the gate does not read (it reads `.describe()` and
+  // `.meta({ description })`) — so the gate lists it without judging it, and it
+  // is outside this rename. The JSDoc-channel gap is #15939. Without this test, a
   // later sweep reads the four renames above as "every timeout on this file".
   it('leaves `RuntimeConfig.resourceLimits.timeout` bare — its describe names no unit', () => {
     const parsed = RuntimeConfigSchema.parse({

packages/spec/src/kernel/startup-orchestrator.zod.ts

@@ -91,7 +91,7 @@ export type StartupOptionsParsed = z.infer<typeof StartupOptionsSchema>;
  * @example
  * {
  *   "healthy": true,
- *   "timestamp": 1706659200000,
+ *   "checkedAt": 1706659200000,
  *   "details": {
  *     "databaseConnected": true,
  *     "memoryUsage": 45.2
@@ -147,7 +147,7 @@ export type HealthStatus = z.input<typeof HealthStatusSchema>;
  *   "durationMs": 1250,
  *   "health": {
  *     "healthy": true,
- *     "timestamp": 1706659200000
+ *     "checkedAt": 1706659200000
  *   }
  * }
  */

packages/spec/src/migrations/entries/semantic/18.kernel-plugin-security-durations-unit-in-key.ts

@@ -33,8 +33,12 @@ export const entry: SemanticMigration = {
     + 'collection member or a stored sys_metadata row and the conversion chain has no seam '
     + 'that would see one. That is what ruling B prescribes for a key that is not authorable '
     + 'metadata. One key deliberately left alone: RuntimeConfig.resourceLimits.timeout on this '
-    + 'same file names no unit anywhere, so it is outside the gate\'s population and outside '
-    + 'this rename. #15678, #14478, ADR-0087.',
+    + 'same file names its unit only in the JSDoc above it ("Execution timeout in '
+    + 'milliseconds"), a channel the gate does not read: it reads `.describe()` and '
+    + '`.meta({ description })`, and that key\'s describe ("Maximum execution time") names '
+    + 'none. So the gate lists it among the duration-shaped keys without judging it — neither '
+    + 'an offender nor an exemption — and it is outside this rename; that JSDoc-channel gap is '
+    + '#15939. #15678, #14478, ADR-0087.',
   acceptanceCriteria:
     'Every SandboxConfigSchema.parse(…), KernelSecurityPolicySchema.parse(…) and '
     + 'PluginSecurityManifestSchema.parse(…) site, and every literal handed to a plugin '

packages/spec/src/migrations/entries/semantic/18.system-metrics-window-durations-unit-in-key.ts

@@ -34,8 +34,13 @@ export const entry: SemanticMigration = {
     + 'unchanged: window.durationSeconds: 300 aggregates over five minutes exactly as '
     + 'size: 300 did, and the positive-integer bounds ride along with the renamed keys. Two '
     + 'keys on this same file deliberately do NOT move, and a sweep that renamed either has '
-    + 'over-applied the rule: the error-budget burn-rate window, whose describe reads only '
-    + '"Window size" and names no unit anywhere, is outside the gate population entirely; '
+    + 'over-applied the rule: the error-budget burn-rate window '
+    + 'names its unit only in the JSDoc above it ("Window size in seconds"), a channel the '
+    + 'gate does not read: it reads `.describe()` and `.meta({ description })`, and that '
+    + 'key\'s describe ("Window size") names none. So the gate lists it among the '
+    + 'duration-shaped keys without judging it — neither an offender nor an exemption — and '
+    + 'it is outside this rename, not outside the gate population; that JSDoc-channel gap is '
+    + '#15939; '
     + 'and the exporter batch size is a COUNT of records, not a duration, so it has no unit '
     + 'to carry. Both keep their names.',
 };

packages/spec/src/migrations/registry.ts

@@ -7631,8 +7631,12 @@ const step18: MigrationStep = {
         + 'collection member or a stored sys_metadata row and the conversion chain has no seam '
         + 'that would see one. That is what ruling B prescribes for a key that is not authorable '
         + 'metadata. One key deliberately left alone: RuntimeConfig.resourceLimits.timeout on this '
-        + 'same file names no unit anywhere, so it is outside the gate\'s population and outside '
-        + 'this rename. #15678, #14478, ADR-0087.',
+        + 'same file names its unit only in the JSDoc above it ("Execution timeout in '
+        + 'milliseconds"), a channel the gate does not read: it reads `.describe()` and '
+        + '`.meta({ description })`, and that key\'s describe ("Maximum execution time") names '
+        + 'none. So the gate lists it among the duration-shaped keys without judging it — neither '
+        + 'an offender nor an exemption — and it is outside this rename; that JSDoc-channel gap is '
+        + '#15939. #15678, #14478, ADR-0087.',
       acceptanceCriteria:
         'Every SandboxConfigSchema.parse(…), KernelSecurityPolicySchema.parse(…) and '
         + 'PluginSecurityManifestSchema.parse(…) site, and every literal handed to a plugin '
@@ -8915,8 +8919,13 @@ const step18: MigrationStep = {
         + 'unchanged: window.durationSeconds: 300 aggregates over five minutes exactly as '
         + 'size: 300 did, and the positive-integer bounds ride along with the renamed keys. Two '
         + 'keys on this same file deliberately do NOT move, and a sweep that renamed either has '
-        + 'over-applied the rule: the error-budget burn-rate window, whose describe reads only '
-        + '"Window size" and names no unit anywhere, is outside the gate population entirely; '
+        + 'over-applied the rule: the error-budget burn-rate window '
+        + 'names its unit only in the JSDoc above it ("Window size in seconds"), a channel the '
+        + 'gate does not read: it reads `.describe()` and `.meta({ description })`, and that '
+        + 'key\'s describe ("Window size") names none. So the gate lists it among the '
+        + 'duration-shaped keys without judging it — neither an offender nor an exemption — and '
+        + 'it is outside this rename, not outside the gate population; that JSDoc-channel gap is '
+        + '#15939; '
         + 'and the exporter batch size is a COUNT of records, not a duration, so it has no unit '
         + 'to carry. Both keep their names.',
     },