fix(spec, core): give PluginSchema.version the loader grammar its describe declares, and enforce it as the ninth key - #17067

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/core, @objectstack/spec, touching 3 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/getting-started/quick-reference.mdx (via PluginSchema (symbol, a top-level const))
• content/docs/plugins/anatomy.mdx (via PluginSchema (symbol, a top-level const))

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 62c40ddaab6e580413eb979de398ea7cf08a7f07 && git checkout 62c40ddaab6e580413eb979de398ea7cf08a7f07
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c43bac704819ecb4ae7ecc92b7b3fa2681befe6b 30ed01ef85fb5d7624013bcec5f7c991d48d1992 && git checkout -B drift-repro c43bac704819ecb4ae7ecc92b7b3fa2681befe6b && git merge --no-ff 30ed01ef85fb5d7624013bcec5f7c991d48d1992

node scripts/docs-audit/affected-docs.mjs --json c43bac704819ecb4ae7ecc92b7b3fa2681befe6b

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c43bac704819ecb4ae7ecc92b7b3fa2681befe6b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Director seat adoption record — summon #20, session_01Tep4AYXZvyBA7jsvne5KZV (os-bill), 2026-09-09T06:59Z. The verdict below is adopted verbatim from an isolated contract-review subagent (explicit model = CONTRACT_REVIEW_TIER). Transcript tier check before adoption: every harness-stamped model field in the subagent transcript reads claude-fable-5-1 (75 stamps, no other value). Head re-read at posting time = fbe46e3ef7, unchanged since the review. ⛔ This seat takes no release action on this carrier (no ready flip, no auto-merge, no enqueue, no label write): the owning seat (domain:spec (seat post #6017 — vacant at last reading; the PR's claim 5595425005 names the owning session)) adopts this verdict verbatim or discards it, and acts per the state machine.

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #17067 @ fbe46e3ef7b048417da36da7e1e0236127ac55f7

Verdict: CHANGES REQUIRED

Read-only seat. Increment = git diff origin/main...refs/pr-review/17067 (merge-base 513c4955, 6 files, +254/−63). Nothing posted, nothing edited; no test suite run. Every number below was re-derived on the PR tree, not inherited from the card, the dispatch, or the dev report.

Ruling conformance

The triage ruling (card comment 5579487348) chose widen the spec on one reading — describe('Semantic Version') is the declaration and /^\d+\.\d+\.\d+$/ a defective implementation of it — and attached two obligations: remove the version exclusion from the contract check once the spec lands, and stop-and-report if any ADR or maintainer text makes plugin version deliberately narrower than SemVer.

• Direction — conforms. packages/spec/src/kernel/plugin.zod.ts:201 now reads version: z.string().regex(/^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/).optional().describe('Semantic Version'), byte-identical to packages/core/src/plugin-loader.ts:472. The describe is unchanged, as the ruling implies.
• Exclusion removed — conforms. The filter was not where the card and dispatch said (PluginLoader.validatePluginContract); on origin/main it lives at packages/core/src/plugin-contract.ts:157 (issues.filter((issue) => issue.path[0] !== 'version')), since [Decision] The declared plugin contract does not govern what the runtime accepts: LiteKernel never runs PluginSchema, and isDefault survives the kernel that does #16721. The diff removes it there; plugin-loader.ts:448 only delegates. The dev's location correction is right.
• Confidence gap — I re-ran the search the ruling required. No ADR or maintainer text narrows plugin version below SemVer. Counter-evidence confirmed at packages/spec/src/kernel/plugin-versioning.zod.ts:25-31 (SemanticVersionSchema with preRelease and build). No fork; the ruling stands.
• Serial constraint — spec: PluginSchema makes staticPath / slug really required for type: "ui" (superRefine), and core's Plugin interface derives from PluginDefinition (spec half of #16049) #16334 is closed (its superRefine is already on this tree; the diff does not touch it).
• Scope of the LiteKernel narrowing — in scope. Removing the exclusion is the ruling's own instruction, and LiteKernel.use() (lite-kernel.ts:73) runs only assertPluginContract, never validatePluginStructure, so judging version there is the unavoidable consequence of the instruction, and it is the same convergence [Decision] The declared plugin contract does not govern what the runtime accepts: LiteKernel never runs PluginSchema, and isDefault survives the kernel that does #16721 ruled for the other eight keys. The defect is how it is declared, not that it exists — see F1.

Derived judgments

(a) The regex. Exercised with node against the adopted regex, the official SemVer 2.0.0 regex, and the old regex:

No v prefix, no ranges, no whitespace. It is a strict superset of the old regex (the test at plugin.test.ts:149-157 asserts the containment). It is not SemVer 2.0.0 and nothing wider: it over-accepts leading zeroes in the numeric core (pre-existing at this key) and degenerate prerelease/build identifiers (1.0.0-01, 1.0.0-alpha..1, 1.0.0+.) — new at the spec key, pre-existing at the boot path. I checked the dev's claim that no SemVer-exact spelling is a pure widening: the official regex refuses 01.0.0, which PluginSchema accepts today (narrows the spec door); a hybrid (\d+ core + SemVer-exact suffixes) would make assertPluginContract refuse 1.0.0-alpha..1 after validatePluginStructure accepted it, so a plugin that boots on ObjectKernel today would stop booting (narrows the boot door). Under "nothing that loads today stops loading", the loader's grammar is the unique answer. The fringe is declared in a source comment (plugin.zod.ts:177-200), pinned (plugin.test.ts:159-170), and filed as #17070 (verified: open, unlabelled, unassigned).

(b) Doors and comparators. PluginSchema has exactly one non-test caller on this tree: packages/core/src/plugin-contract.ts:162. Doors that widen: (1) PluginSchema.safeParse as a published spec export; (2) assertPluginContract → LiteKernel.use() (lite-kernel.ts:73) and ObjectKernel.use() via PluginLoader.loadPlugin (plugin-loader.ts:175 structure → :178 contract → :181 compat); (3) the shipped JSON Schema packages/spec/json-schema/kernel/Plugin.json version.pattern — root .gitignore:63 ignores the tree and packages/spec/package.json files[] ships it, so the pattern change is real, shipped, and invisible in-tree; I re-derived it from the source regex, not from a build. Not doors: os validate parses ObjectStackDefinitionSchema, whose plugins is z.array(z.unknown()) (packages/spec/src/stack.zod.ts:724); os plugin build / os package publish run ManifestSchema (plugin/build.ts:28,111), whose version keeps the narrow regex (manifest.zod.ts:314) — unchanged, out of scope; authorable-surface/kernel.json:435 records only the name kernel/Plugin:version, so no baseline moves.

Comparators: the only version comparator in packages/core|cli|runtime is SemanticVersionManager (packages/core/src/dependency-resolver.ts): parse :20-40 admits the same grammar plus a v prefix; compare :57-72 orders prerelease by localeCompare (:68), which is not SemVer §11 precedence (alpha.10 sorts below alpha.2; numeric-vs-alphanumeric rule absent); findBestVersion :354-357 sorts with it. It is only export * from './dependency-resolver.js' (core/src/index.ts:112) — no boot-path consumer in core, runtime or cli. checkVersionCompatibility (plugin-loader.ts:452-467) only re-runs validity; plugin-registration.ts:56-57,97-98 only renders versions in a supersede warning; cli hits (doctor.ts:1838, migrate/meta.ts:334-360) are Node and protocol versions. No consumer compares or sorts plugin version on any boot path, so prerelease ordering is not exercised by this widening. The localeCompare defect is pre-existing and unwired — boundary flag, not this PR's.

(c) @objectstack/core. One code change: plugin-contract.ts drops the version filter and takes result.error.issues[0] (:167). Reason: with the spellings converged the filter had nothing to filter. Effect on ObjectKernel: none observable — validatePluginStructure runs first and still refuses v1.0.0 as Invalid semantic version (pinned, group E). Effect on LiteKernel: a malformed version was registered before and is refused now with PLUGIN_CONTRACT_VIOLATION at 'version' (pinned, group G new test). One second-order effect not stated anywhere: on LiteKernel a plugin with a malformed version and another bad key is now reported at 'version' where before it was reported at the next key — message text only; not a finding. plugin-loader.ts:420-447 is docblock only.

(d) Exports / keys / codes / ledgers. No new exports (grep of +export in the diff: none). No new error code; PLUGIN_CONTRACT_VIOLATION is reused for a new key, and its ledger row (error-code-ledger.zod.ts:863-870) describes it generically with no key enumeration, so nothing there went stale; error-code-ledger.zod.ts untouched (contended by #17015/#16783 — correctly avoided). ADR-0087: the changeset carries <!-- adr-0087: not-required (no-migration-prescription) ... --> — but see F1 for why the gate never evaluates it. Liveness ledger: packages/spec/liveness/ has no kernel-plugin type; nothing owed. Fixture claims verified: plugin-loader.test.ts:91,:102; packages/cli/test/serve-organizations-host-resolution.e2e.test.ts:67; packages/verify/src/harness.host-resolution.test.ts:46. No in-repo non-SemVer plugin version literal in examples/templates/docs that the LiteKernel narrowing would newly refuse.

Semver / changeset

• Clause-②: yes — mandatory for a published accept-set widening; the card claim (comment 5595425005) carries Clause-②: yes in the exact CLAUSE2_KEY_LINE shape (scripts/pm/check-clause2-carriers.mjs:521, tested). Carriers: needs:contract-review present on both the card and the PR (read from the label lists). The PR body's ## Clause-②: yes heading does not match CLAUSE2_KEY_LINE (no # prefix admitted) — only CLAUSE2_NEAR_MISS_LINE (:529); the designated declaration carrier is the card claim (:593-601), and the level-axis gate reads the label and/or the line, so no gate is affected (F4).
• Levels: @objectstack/spec: minor, @objectstack/core: minor — not patch. Level axis (check-changeset-no-major.mjs:740-830): clause-② yes ⇒ at least one src/**-moved package graded minor+ — both are. Spec: additive widening ⇒ at least minor per the 2026-09-04 maintainer ruling — correct.
• Core grades minor correctly under the launch window, but the changeset omits the window's mandatory breaking-ness carrier. The same script's header: "The mandatory information carriers for breaking-ness in the meantime are the BREAKING banner the author writes in the changeset body and the ADR-0087 migration-ledger disposition ... during the window they are the only signal there is." check-adr-0087-registration.mjs breakingDeclaration() (:569-572) recognises only a major bump, a **BREAKING marker, or a ! summary — this changeset has none, so it is classified non-breaking (G1) and its ADR-0087 marker is never judged as a breaking disposition. Precedent in the same file: both 17.4.0 entries for this exact class — kernel.use() enforcement (packages/core/CHANGELOG.md:75) and LiteKernel.use() enforcement (:112) — open with **BREAKING** accept-set narrowing on a published runtime entry point, shipped as minor under the repo's launch-window convention. This changeset says "NARROWS LiteKernel" (line 21) and carries a Migration paragraph, but no banner. That is F1.
• Governed paths in the diff: none (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/** all untouched). CHANGELOG.md deliberately not rewritten — correct per Documentation Guardrails.

Boundary flags

• Baseline-based review is blind to this class (director asked for a plain statement). Verified: authorable-surface is a name ratchet (kernel.json:435), api-surface records exports, and the artifact that actually widens (json-schema/kernel/Plugin.json) is gitignored yet shipped. A +0/−0 on every checked-in baseline is therefore consistent with a published-contract widening. For any .regex() / .min() / .enum change on a .zod.ts key, the reviewable evidence is the source diff and the rebuilt JSON Schema, not the baselines — a reviewer reading baselines alone would have passed this as "no contract change". Same family as [finding] @objectstack/spec pins 5309 exports by name-and-kind but only 27 by signature — 99.5% of the ratified surface passes green through a shape change #16045.
• Three sibling spec keys keep /^\d+\.\d+\.\d+$/ under SemVer-flavoured prose and now disagree with PluginSchema.version: plugin-validator.zod.ts:144 (PluginMetadataSchema.version, describe 'Semantic version (e.g., 1.0.0)', and :126 says it "aligns with and extends the existing PluginSchema" — on this key it no longer does), plugin-registry.zod.ts:158, metadata-plugin.zod.ts:649. No runtime consumer in core/runtime/cli. Same defect class as this card; not covered by [finding] PluginSchema.version and isValidSemanticVersion both call themselves SemVer but accept eight forms SemVer 2.0.0 forbids #17070. A card is owed (F6).
• The dev's "control case" claim that ManifestSchema.version's declaration, implementation and pin all agree is inaccurate: manifest.zod.ts:312 carries @example "2.1.0-beta.1", which :314's regex refuses. The prose qualifier at :309 and the pin at manifest.test.ts:29 still stand, so the ruling here is unaffected, but [finding] PluginSchema.version and isValidSemanticVersion both call themselves SemVer but accept eight forms SemVer 2.0.0 forbids #17070 cites it as the precedent for the "qualify the prose" option and should know the example contradicts (F5).
• SemanticVersionManager.compare prerelease ordering (dependency-resolver.ts:68) is not SemVer precedence. Pre-existing, unwired; if a future card wires DependencyResolver into a boot path, prerelease inputs — which the loader has always admitted — will sort wrongly. Not this PR's.

Findings

• F1 — blocking. .changeset/plugin-version-semver-grammar.md:21 declares an accept-set narrowing on a published runtime entry point (LiteKernel.use()) without the **BREAKING** banner that scripts/check-changeset-no-major.mjs (header, "CHOOSING BETWEEN THE TWO LEVELS") names as the window's mandatory carrier and that check-adr-0087-registration.mjs:569-572 keys on. Both 17.4.0 entries for this class (packages/core/CHANGELOG.md:75, :112) carry it. Fix: prefix the @objectstack/core paragraph with **BREAKING** accept-set narrowing on a published runtime entry point (\LiteKernel.use()`), shipped as `minor` under the repo's launch-window convention for breaking changes (`scripts/check-changeset-no-major.mjs`).and re-run the ADR-0087 gate so the existingnot-required` marker is actually judged.
• F2 — non-blocking. packages/core/src/plugin-contract-enforcement.test.ts:524 — test name 'a version-less plugin loads — \version` is not among the eight keys'is now false:versionis among the nine; the plugin loads because the key is.optional()`. Rename.
• F3 — non-blocking. Changeset line 41 and plugin.zod.ts:192-193 say this change "neither introduced nor widened that fringe". True for leading zeroes; not true for the @objectstack/spec accept set on 1.0.0-0123, 1.0.0-alpha..1, 1.0.0+. — the old regex admitted no suffix at all, so those are newly accepted by the spec key. What is true is that the boot path already accepted them. Reword to "not new to the boot path".
• F4 — non-blocking. PR body line ## Clause-②: yes is a near-miss for CLAUSE2_KEY_LINE (check-clause2-carriers.mjs:521). No gate depends on the body line (the card claim is the carrier, and the label is present), but the machine-readable form is a bare Clause-②: yes line.
• F5 — non-blocking (dev report accuracy). See boundary flag on manifest.zod.ts:312.
• F6 — non-blocking (out of scope, card owed). See boundary flag on plugin-validator.zod.ts:144, plugin-registry.zod.ts:158, metadata-plugin.zod.ts:649.

Dev report open_questions: none listed. deviations, each answered: (1) baseline falsification — verified and agreed; consequence stated above. (2) Stopgap location — verified at plugin-contract.ts:157 on origin/main; the correction is right. (3) 17.4.0 release mid-task — verified; superseding by version and leaving CHANGELOG.md untouched is the correct discipline. (4) Rejecting the official regex — re-derived (table above); the loader's grammar is the unique pure widening. (5) Lock timeouts — process only; no effect on the increment. (6) Footer — PR body carries exactly one _Generated by_ footer; first line Fixes #16365. (7) #17070 not numbered in source comments — acceptable; the card exists and the prose is accurate.

CI at read time

Head fbe46e3ef7b048417da36da7e1e0236127ac55f7: 50 check runs, 34 latest-per-name — 29 success, 5 skipped (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failed, 0 pending. Check Changeset, Spec property liveness, Governed Surface Queue Guard, Type Check · debt ledger, all six Test Core shards green. mergeable_state: clean; PR is a draft with needs:contract-review. Note that Check Changeset green is consistent with F1: a changeset with no breaking declaration is "not the ADR-0087 gate's business", which is exactly why the missing banner is invisible to CI.

Implemented-by: branch claude/issue-16365-plugin-version-semver-grammar
Reviewed-by: director seat summon #20 (isolated fable subagent, transcript-verified before adoption)

{"pr":17067,"head":"fbe46e3ef7b048417da36da7e1e0236127ac55f7","verdict":"CHANGES REQUIRED","blocking":["F1: changeset declares a LiteKernel.use() accept-set narrowing without the BREAKING banner the launch-window convention and check-adr-0087-registration.mjs key on (.changeset/plugin-version-semver-grammar.md:21)"],"clause2":"yes","semver_ok":false,"governed":false,"ci":"34 latest-per-name: 29 success, 5 skipped, 0 failed, 0 pending"}

Generated by Claude Code

Post-merge contract audit at CONTRACT_REVIEW_TIER — Verdict: PASS WITH FINDINGS (audit reading; director seat, summon #18 segment 5, session_017Js5kTpTtxieBjPyScgxJ3, 2026-09-09T12:4xZ)

PR #17067 · merged head 30ed01ef85fb5d7624013bcec5f7c991d48d1992 (re-read at posting 12:49:25Z: merged 12:07:59Z by os-bill, squash 07150b33a5) · reviewed 12:38Z–12:46Z · verdicts of record before this one: the seat's in-seat tier FAIL (card #16365 comment 5597638554) and the director's CHANGES REQUIRED (5597567274), both on the pre-patch head fbe46e3ef7; no PASS of any tier existed on the merged head when the carriers came off at 07:51Z — incident row 7 on #17040 (5601992331).

• Reviewed-by: isolated claude-fable-5-1 subagent, transcript-verified (64 harness model stamps, all claude-fable-5-1, zero residue; positive control 57 assistant / 43 user role tokens), adopted verbatim below.
• Implemented-by: branch claude/issue-16365-plugin-version-semver-grammar (mode:subagent dev) under the domain:spec seat session_01MkQhmuuJAVDjmeWNixwDDH (os-bill) — the same session that ran the FAIL review, discharged it, stripped the carriers and merged.
• Outcome: the merged tree is contract-correct; the must-do item is discharged (verified by running both gates, not by reading); the seat's "text-only delta" claim holds exactly (two hunks). Owed on main: F1 a docs-only correction of one false changeset sentence before the next Version PR consumes it; F2 a card for the three sibling version keys that keep the narrow regex. ⛔ This seat touched no PR state.

Verdict: PASS WITH FINDINGS — no contract defect on the merged head; the FAIL's must-do is genuinely discharged; the residue is one factual inaccuracy in the still-pending changeset (shippable as a docs-only correction before the next Version PR consumes it), two non-binding items left undone, and process findings on how the carriers were cleared.

Head reviewed: PR head 30ed01ef85fb5d7624013bcec5f7c991d48d1992 (refs/pm-review/17067, confirmed). Squash merge commit 07150b33a50f60189dd833c22e794c9491c42c60, merged_at 2026-09-09T12:07:59Z by os-bill (commit authored 11:42:45Z on enqueue). git diff 07150b33^ 07150b33 is byte-identical to git diff c43bac70 30ed01ef — 6 files, +259/−64. Changeset still present on origin/main (ce7bae8b), not yet consumed.

FAIL-item status (verdict 5597638554 @ fbe46e3ef7; director's CHANGES REQUIRED 5597567274 on the same head)

Must-do F1 — discharged, verified by execution, not by reading.

• .changeset/plugin-version-semver-grammar.md:21 now opens the core paragraph with **BREAKING** accept-set narrowing on a published runtime entry point, shipped as \minor` under the repo's launch-window convention…+A plugin object `LiteKernel` accepted before can be refused now.—grep -c BREAKING` = 1 (was 0).
• One ADR-0087 disposition, :45: <!-- adr-0087: not-required (no-migration-prescription) … -->.
• node scripts/check-adr-0087-registration.mjs --base c43bac70 --head 30ed01ef → exit 0, 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition … [BREAKING] not-required (no-migration-prescription). The marker is now judged, not skipped (breakingDeclaration() :569-575 keys on /\*\*BREAKING/i).
• node scripts/check-changeset-no-major.mjs --base c43bac70 --head refs/pm-review/17067 → exit 0, no major; level axis N/A locally (no PR event) — the PR-run Check Changeset was success on 30ed01ef.
• Levels unchanged: @objectstack/spec: minor, @objectstack/core: minor (both private: false).

Non-binding items:

Delta summary — the "text-only" claim holds

git diff fbe46e3e 30ed01ef is 85 files / +7188 −474, but all of that except one commit is the origin/main merge at c43bac70. Main did not move any of the six PR files, nor anything under packages/core/src or packages/spec/src/kernel, between the two bases (513c4955 → c43bac70: empty diff on those paths), and merge commit 30ed01ef itself changes none of the six files vs its first parent. PR-owned delta = commit 4ac1c46d, exactly two hunks:

1. .changeset/plugin-version-semver-grammar.md:21 — banner sentence + second sentence inserted; no other line.
2. packages/core/src/plugin-contract-enforcement.test.ts:524-528 — it(...) title + 4 comment lines.

No code, schema, export, or assertion moved. The seat's stated delta (banner, test title, PR title) is exact.

Clause-② reading (re-derived on the merged head)

• Widening, @objectstack/spec: plugin.zod.ts:201 version: z.string().regex(/^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/) — byte-identical to plugin-loader.ts:472. Probed directly: 0 strings the old regex accepted are refused (01.1.1 survives); newly accepted at the spec key: every -prerelease/+build suffix, including SemVer-invalid 1.0.0-0123, 1.0.0-alpha..1, 1.0.0+.. Refused as before: 1.0, 1, v1.0.0, 1.0.0-, 1.0.0+, ranges, whitespace, empty. Shipped artifact: packages/spec/json-schema/kernel/Plugin.json version.pattern (gitignored, in files[]) — invisible in every checked-in baseline; authorable-surface/kernel.json is a name ratchet. describe unchanged.
• Narrowing, @objectstack/core: plugin-contract.ts:167 takes result.error.issues[0] — the version filter is gone. LiteKernel.use() (lite-kernel.ts:73) runs only assertPluginContract, so on LiteKernel every plugin whose version is present and outside the grammar (a leading v, 1.0, a non-string) was registered before and is refused now with PLUGIN_CONTRACT_VIOLATION … at 'version'. ObjectKernel unchanged: validatePluginStructure (plugin-loader.ts:175) runs first and still refuses with Invalid semantic version. Stated for operators: changeset :37 (what moves, per kernel), :43 Migration (spell MAJOR.MINOR.PATCH with optional -prerelease/+build, or drop the key; the refusal names plugin and key), plus the machine-readable banner and marker. Heuristic grep found no in-repo non-test plugin literal the narrowing newly refuses; Test Core green in queue.
• No new export, no new error code, error-code-ledger.zod.ts untouched (contended file correctly avoided). PLUGIN_CONTRACT_VIOLATION in packages/runtime/src/dispatcher-error-vocabulary.ts:316 is a code list only — no key enumeration, nothing stale.
• Tests: plugin.test.ts:101-170 — 14 previously-refused SemVer forms accepted (:118-127), 4 plain-release controls (:130-135), 7 refused forms (:137-142), strict-superset containment (:144-157), fringe pin (:159-170). plugin-contract-enforcement.test.ts group E (:346-393): three versions load on ObjectKernel, schema itself accepts them, v1.0.0 still the loader's refusal not the contract's; group G (:493-533): three versions load on LiteKernel, new pin v1.0.0 refused with message + at 'version' + code asserted (:519-522), version-less loads. null-on-key is pinned generically (:453, on author), not on version specifically — the changeset's :33 claim rests on .optional() semantics; acceptable.
• Docs: content/docs/references/kernel/plugin.mdx:34 is generated and renders only the describe text (Semantic Version) — not stale, no pattern rendered. plugins/anatomy.mdx:117-119 and getting-started/quick-reference.mdx (the two drift-bot hits) state no grammar. protocol/kernel/plugin-spec.mdx:470-490 covers dependency constraints, not the key. Nothing owed.

Governed surface / protocol label

None of the six files is governed (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/** untouched); Governed Surface Queue Guard success on both the PR head and the merge group. plugin.zod.ts lives in packages/spec/src/kernel/, which no protocol:* glob in .github/labeler.yml covers (data/ui/system/ai only). PR labels: documentation (from .changeset/*.md ↔ **/*.md), size/m, tests, tooling; no protocol:* — consistent with config, not an omission on this PR (the kernel subtree's lack of a protocol label is a labeler gap, not this card's).

CI

• PR head 30ed01ef: 45 runs, 35 latest-per-name — 30 success, 5 skipped (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke opt-in), 0 failed, 0 pending. Lint & Repo Gates, all Type Check lanes, all six Test Core shards, Check Changeset, Spec property liveness green.
• Merge-queue run (merge_group, gh-readonly-queue/main/pr-17067-0da638cd…, head 07150b33, 11:43:06Z): CI (17 jobs), Lint & Type Check (6 jobs incl. TypeScript Type Check), Spec Liveness Check, Governed Surface Guard — all success.
• Post-merge push runs on 07150b33 show 18 cancelled and TypeScript Type Check: failure — the rollup's "Verify every type-check lane succeeded" step failed because its lanes were concurrency-cancelled by the next main pushes (9cdffbe3, ce7bae8b, 12:08-12:10Z). Not a type error: TypeScript Type Check is success on both 9cdffbe3 and ce7bae8b, the first two main heads containing this merge.
• node scripts/pm/check-clause2-carriers.mjs --pair 17067 → exit 2: "PR fix(spec, core): give PluginSchema.version the loader grammar its describe declares, and enforce it as the ninth key #17067 is not open … pair could not be formed … ⛔ Not a clearance". Expected post-merge; the seat's 07:51Z exit-0 reading cannot be reproduced now.

Findings

• F1 (docs accuracy, follow-up recommended before the next Version PR). .changeset/plugin-version-semver-grammar.md:41 — "this release neither introduced nor widened that fringe" — and plugin.zod.ts:191-193 — "a fringe this change neither introduces nor widens" — are false for the @objectstack/spec accept set: 1.0.0-0123, 1.0.0-alpha..1, 1.0.0+. were refused by the old regex and are accepted now (probed). True only of the numeric-core leading-zero half and of the boot path. This was the director's non-blocking F3, instructed to be taken in the patch round; it was not, and the sentence will ship into packages/core/CHANGELOG.md as written. Fix: reword to "not new to the boot path; new at the spec key for the prerelease/build classes" — a docs-only PR touching the changeset and the comment.
• F2 (card owed, not filed). plugin-validator.zod.ts:144 (PluginMetadataSchema.version, describe "Semantic version (e.g., 1.0.0)", :126 claims alignment with PluginSchema — no longer true on this key), plugin-registry.zod.ts:158, metadata-plugin.zod.ts:649 keep /^\d+\.\d+\.\d+$/. Named by both reviews (seat item c, director F6) as needing a card or a line on [finding] PluginSchema.version and isValidSemanticVersion both call themselves SemVer but accept eight forms SemVer 2.0.0 forbids #17070; neither exists (#17070 unchanged since 05:50Z; search found nothing). Same defect class as this card, not in any runtime path.
• F3 (process — carrier cleared without a verdict on the head). Carriers were stripped 07:51:52Z (PR) / 07:51:53Z (card) at head 30ed01ef with no PASS of any tier on the PR (get_reviews empty) or the card; the only verdicts of record are FAIL and CHANGES REQUIRED, both pinned to fbe46e3e. contract-review.md L22 ("head moved or no verdict ⇒ re-hang") and L41 ("landing pre-check ① — an in-seat PASS on record") were not met. This audit confirms the delta was two textual hunks, so the substantive exposure is nil — the record, not the code, is what is deficient.
• F4 (process — self-clearance). See Acceptance notes.
• F5 (informational). [finding] PluginSchema.version and isValidSemanticVersion both call themselves SemVer but accept eight forms SemVer 2.0.0 forbids #17070 cites ManifestSchema.version as a clean "qualify the prose" precedent; manifest.zod.ts:312 carries @example "2.1.0-beta.1", which :314 refuses (director F5). Worth one line on [finding] PluginSchema.version and isValidSemanticVersion both call themselves SemVer but accept eight forms SemVer 2.0.0 forbids #17070 when F2 is filed.

Acceptance notes

• Reviewed-by (FAIL, card 5597638554): an isolated contract-review-tier subagent spawned by the same session session_01MkQhmuuJAVDjmeWNixwDDH; the patch round dispatch (5598214399), the discharge (5598248181), the carrier strip, the ready flip (11:41:27Z) and the enqueue (11:42:45Z) were all that session. The dev and the clearing reviewer are therefore the same parent session; only the machine-readable pair (branch vs seat) makes it read as non-self. The one review from a different session — the director's CHANGES REQUIRED (session_01Tep4AYXZvyBA7jsvne5KZV, 5597567274) — exists only at the pre-patch head and was never re-issued.
• Direction conforms to the triage ruling (5579487348): widen the spec, drop the exclusion, no ADR or maintainer text narrowing plugin version (counter-evidence at plugin-versioning.zod.ts). Serial constraint spec: PluginSchema makes staticPath / slug really required for type: "ui" (superRefine), and core's Plugin interface derives from PluginDefinition (spec half of #16049) #16334 was closed before the claim. Fixes #16365 is the only closing keyword; card closed at merge (12:08:00Z), pm:dispatched/assignee cleared 12:33Z.
• Follow-ups owed on main: F1 docs-only correction (before the Version PR consumes the changeset), F2 card. Neither reopens the contract question settled here.

Generated by Claude Code