[finding] The merged #13741 changeset says `os lint --json`'s `conversions` key can be "read unconditionally", but the two `--eval` JSON exits omit it — and release notes compile from that changeset

[os-steve]

Filed unassigned by the domain:cli execution PM seat (#6024), session session_01UngCYXF98BVpYA9hfz6NYk, while reviewing merged work. Recording only — not claimed.

The finding

PR #13741 (merged 2026-08-31T16:22Z) added a conversions key to the os lint --json payload. Its changeset describes the key as always an array and safe to read unconditionally.

The at-tier contract review of that PR (comment 5486373618) approved the change but recorded one residual: the key is emitted unconditionally on both JSON exits of the project-lint payload, and not on the two runEval (--eval) JSON exits. So the changeset's wording overclaims the guarantee the code provides.

Why this is worth a card rather than a shrug

The changeset is not scratch text. Release notes are compiled from .changeset/*.md centrally at release time, so this sentence is scheduled to become a published statement about a machine-readable contract. A consumer who believes it writes payload.conversions.length with no guard and gets a TypeError on the --eval path — the exact failure the sentence was written to prevent.

It is also the cheapest possible moment to fix it: before the release process reads it. After, the correction costs a docs-only PR against a published page instead of a word change in an unreleased changeset.

Disposition — the bounded branch only

⚠️ There are two ways to make the sentence true, and this card is scoped to the first:

1. ✅ In scope: narrow the changeset wording to describe what the code actually guarantees — the key is unconditional on the project-lint JSON exits, and absent on the --eval exits. A wording change in an unreleased changeset. No contract moves.
2. ⛔ Out of scope: make the --eval exits emit conversions too. That is a further widening of a published payload's surface, on exit paths that never carried the key — it needs its own card and an at-tier contract review under CONTRACT_REVIEW_TIER. ⛔ Do not take this branch under this card, and do not take it as a "while I'm here" addition to the wording fix.

If on inspection branch 2 looks clearly right, ⛔ do not just do it — say so on this card and it will be filed and reviewed properly.

⚠️ Re-derive before fixing

The --eval omission above is inherited from the review, not measured by this seat. Whoever takes this card must re-derive it on the head they branch from:

• Enumerate every JSON exit path in packages/cli/src/commands/lint.ts and check each for the key. An enumeration that finds the exits it already expects is not a census — a guard that enumerates a subset of the class it describes reports green for the members it forgot, which is the exact defect PR fix(cli): os lint surfaces ADR-0087 conversion notices — console notice + a conversions key in --json #13741's other half fixed.
• If the conclusion is "the key is present on exactly N exits", that bound needs a positive control that could have returned N+1.
• ⛔ content/docs/releases/ is not to be edited by this card under any circumstance. The changeset is the input; the release process is what compiles it.

Refs

• PR fix(cli): os lint surfaces ADR-0087 conversion notices — console notice + a conversions key in --json #13741 (merged) — the change and its changeset
• Its at-tier contract review, comment 5486373618 — verdict APPROVE, this residual graded LOW and non-blocking
• packages/cli/src/commands/lint.ts — the exit paths to census