chore(spec): backfill nine ADR-0087 ledger entries missing from the v17 stock (#6350) (#7624)

The #6148 completeness gate is diff-only by design (#6129), so every breaking
changeset already in the v17 train was never compared against the ADR-0087
ledger. This is the one-time manual reconciliation the maintainer ruled for.
The gate is untouched and still judges diffs only.

Measured today: 274 declared-breaking changesets in stock, 106 in the residue,
61 flagged as never having touched a ledger file. Judging all 61 by hand found
nine genuinely missing entries, registered here as D3 semantic migrations, and
each of the nine stock changesets now carries its adr-0087 disposition marker.

Two had shipped half a retirement: tool.requiresConfirmation carries a live
retiredKey() tombstone and SortNodeSchema carries aliases:{direction:'order'},
but neither had the ledger half. A retirement needs both.

spec-changes.json and docs/protocol-upgrade-guide.md are regenerated.


Claude-Session: https://claude.ai/code/session_0198a2mSFFM18npoJfNtNv8z

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: os-help

.changeset/adr-0087-stock-reconciliation-backfill.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/spec": minor
+---
+
+chore(spec): backfill nine ADR-0087 ledger entries the v17 stock was missing (#6350)
+
+The #6148 completeness gate is deliberately **diff-only** — it judges what a PR
+adds, never the inventory, because auditing stock in CI would turn the repo red on
+adoption day and bill main's history to current authors (#6129). The cost of that
+choice is that every breaking changeset already in the v17 train was never compared
+against the ledger. This is the one-time manual reconciliation the maintainer ruled
+for, not a change to the gate: `check-adr-0087-registration.mjs` still judges diffs
+only, and nothing in CI starts auditing inventory.
+
+Measured today over the stock: **274 declared-breaking changesets**, 106 in the
+residue (published break + a real FROM → TO prescription, so only `registered` or
+`already-registered` remain), **61 of them flagged** as never having touched a
+ledger file. Judging those 61 by hand found nine genuinely missing entries, now
+registered as D3 semantic migrations:
+
+| entry | face | issue |
+| --- | --- | --- |
+| `runtime-httpserver-wrapper-retired` | the exported `HttpServer` delegating wrapper | #5122 |
+| `record-details-sections-object-form` | `RecordDetailsProps.sections` shape + `hideFields` | #5611 |
+| `data-driver-query-omit-object` | `IDataDriver`'s query parameter contract | #5181 |
+| `sort-node-direction-rejected` | `orderBy[].direction` → `order` | #4721 |
+| `tool-requires-confirmation-retired` | `tool.requiresConfirmation` | #3715 |
+| `export-axis-opt-in` | `allowExport` unset flips to deny | #3544 |
+| `apimethod-enum-shrink` | `enable.apiMethods` legacy values | #3543 |
+| `sharing-rule-recipient-reconcile` | sharing-rule `group` / `guest` / owner-type rules | #1878 |
+| `client-delete-result-success` | `DeleteDataResult.deleted` → `success` | #5638 |
+
+Two of them had already shipped **half** a retirement: `tool.requiresConfirmation`
+carries a live `retiredKey()` tombstone in `ai/tool.zod.ts` and `SortNodeSchema`
+carries `aliases: { direction: 'order' }`, but neither had the ledger half. A
+tombstone is the proof the removal was declared; the ledger entry is what
+`spec-changes.json`, the upgrade guide and `os migrate meta` project to consumers,
+and a retirement needs both.
+
+Each of the nine stock changesets now carries its `<!-- adr-0087: registered … -->`
+disposition marker, so the judgement is recorded where the next auditor reads
+rather than only in a PR body. `spec-changes.json` and
+`docs/protocol-upgrade-guide.md` are regenerated from the registry.

.changeset/apimethod-enum-shrink.md

@@ -79,3 +79,5 @@ passing through Zod; the parse-time strip warning carries no object name).
 primitives = default-open). Read-only and deny-all whitelists are unchanged;
 the seven `[]` declarations are deliberately KEPT as defense-in-depth alongside
 `apiEnabled: false`.
+
+<!-- adr-0087: registered apimethod-enum-shrink -->

.changeset/client-delete-result-success.md

@@ -96,3 +96,5 @@ server suite never had: a real DELETE over HTTP whose body is read as
 `deleted.success` and whose key set is asserted literally — `z.object` strips
 unknown keys, so a passing parse alone cannot prove no stray `deleted` rode
 along.
+
+<!-- adr-0087: registered client-delete-result-success -->

.changeset/data-driver-query-omit-object.md

@@ -27,3 +27,5 @@ await driver.find('account', { where: { status: 'open' } });
 `QueryAST` 的 zod 形状（`data/query.zod.ts` 的 `BaseQuerySchema`）**没有动**：`object` 在引擎与 hook 那一层是被读的，改的只是驱动契约的参数类型。`expand` 条目里的 `object` 同样保留 —— 那里它命名的是**关联对象**，没有任何实参携带这个事实，不是冗余。
 
 标 major 是因为这是**源码级破坏性**变更（调用点字面量），运行时行为零变化。注意 `check:api-surface` 只看得见新增的 `DriverQuery` 导出、看不见参数类型的收窄（它记录导出存在与否，不记录签名），所以这条迁移说明是该变更唯一的下游载体。
+
+<!-- adr-0087: registered data-driver-query-omit-object -->

.changeset/export-axis-opt-in.md

@@ -73,3 +73,5 @@ is the segregation-of-duties case the axis exists for.
   revoked. `html_table` stays a read — it is a rendered view, not a bulk copy.
   Deployments without `plugin-security` are unaffected (no permission sets
   exist, so the axis does not apply).
+
+<!-- adr-0087: registered export-axis-opt-in -->

.changeset/record-details-sections-object-form.md

@@ -54,3 +54,5 @@ of silently stripping a live page's hidden-field list.
 `fields` (required), `label`, `columns` (1-4), and `name` — the i18n anchor that
 resolves `objects.<object>._sections.<name>.label`, which `packages/lint`'s
 `translation-section-name-missing` rule tells authors to add.
+
+<!-- adr-0087: registered record-details-sections-object-form -->

.changeset/runtime-httpserver-wrapper-retired.md

@@ -58,3 +58,5 @@ and re-audited every time `IHttpServer` gains an optional member — it gained o
 as recently as #5080. The 2026-08-06 maintainer ruling took the #4939
 (`ApiRegistry`) precedent instead — retiring a part that was never assembled
 beats repairing it — under ADR-0049's remove side.
+
+<!-- adr-0087: registered runtime-httpserver-wrapper-retired -->

.changeset/sharing-rule-recipient-reconcile.md

@@ -38,3 +38,5 @@ validates and then silently does nothing (ADR-0078).
   rows by field values (see the migrated examples:
   `share_open_tasks_with_manager` in app-showcase,
   `share_active_leads_with_manager` in app-crm), or use a scope-depth grant.
+
+<!-- adr-0087: registered sharing-rule-recipient-reconcile -->

.changeset/sort-node-direction-rejected.md

@@ -63,3 +63,5 @@ nonsenseKey: 1 }).success === true`). That is tracked in the #4001 campaign map
 for its own batch, not smuggled in here.
 
 Related: #4674, #4720, #4363, #4371, #4001, ADR-0049.
+
+<!-- adr-0087: registered sort-node-direction-rejected -->

.changeset/tool-requires-confirmation-removed.md

@@ -48,3 +48,5 @@ liveness-ledger entry, and the generated reference-doc row.
 objectui's `ToolPreview.tsx` reads the field via `!!d.requiresConfirmation`, so it
 degrades to "not shown" with no error; removing that badge is a follow-up in that
 repo.
+
+<!-- adr-0087: registered tool-requires-confirmation-retired -->