docs(liveness): sweep the pre-ruling "no runtime consumer" notes against the previews rule (#7427) (#7445)

The 2026-08-10 maintainer ruling on #7131 asked that "the ledger methodology
note records the principle so the next sweep asks the question mechanically".
This is that sweep, run against the README section PR #7425 landed.

Eighteen rows and file-level notes whose ground was "no runtime consumer" (or
wording meaning it), written before 2026-08-10, were partitioned display vs
behavioural. Every display hit got the README's two lookup commands run against
objectui origin/main @e9ab52f9. Behavioural hits are untouched: the ruling does
not reopen the 2026-07 corrections.

ZERO verdicts move. That is the finding, not a shortfall — three of the four
display candidates that read like twins of PR #7425's re-graded rows turn out
to fail on REACHABILITY or on render-vs-count:

  * permission.rowLevelSecurity.label/.description/.tags — PermissionPreview
    reads rowLevelSecurity only as an array and renders `${rls.length} RLS
    rules`. A count is not a render; the 2026-07-30 closure survives intact.
  * view.label — ViewPreview DOES read the container label (:115) and injects
    it as its single listView's label, but neither render path fires: the
    named-view tab bar returns null below two entries, and the
    `renderListView` label path needs a prop the object-view registration
    never passes.
  * view.name — the preview reads the `name` PROP, never the body copy, so it
    is not translation.name's shape after all.
  * validation.label/.description/.tags — ValidationPreview renders all three,
    but the standalone `validation` kind was retired by ADR-0088 (#4509) and
    the surviving embedded path routes to EmbeddedItemEditor's SchemaForm, so
    the governed path never hands the preview a draft.

Two rows already `live` gained the falsifiable pointer a `live` verdict is
supposed to be: datasource.label/.description, whose prose still claimed "No
runtime consumer by design" while the datasource preview had been rendering
both as card title and subtitle.

Three measured ABSENCES are recorded rather than skipped, per the README's
"an absent preview is a finding to record": app.areas.description (AppPreview
has zero `areas` reads), flow.description (FlowPreview reads no description),
and hook.label/.description (no registered `hook` preview at all).

datasource.json's file-level note is rewritten: its preview clause was stale
on both halves independently. Its ground moved (the ruling), and its facts
moved the OPPOSITE way to the card's expectation — the SideBlocks were never
removed; what went away is the schema half, so three of the five renders now
acknowledge keys `.strict()` rejects. Filed as objectui#4131.

No changeset: verdict-neutral ledger prose plus evidence re-citation, the
PR #7179 shape (which shipped with skip-changeset and no changeset), not the
PR #7425 shape (verdict re-grades, patch changeset).


Claude-Session: https://claude.ai/code/session_016R9de1FqP7NvwKvqXi92Gh

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-help

packages/spec/liveness/app.json

@@ -182,7 +182,7 @@
         "description": {
           "status": "dead",
           "verifiedAt": "2026-08-01",
-          "note": "display annotation no surface renders. Benign — docs-shaped, kept, not warned (hook.label precedent)."
+          "note": "display annotation no surface renders. Benign — docs-shaped, kept, not warned (hook.label precedent). VERDICT RE-TESTED AND UPHELD 2026-08-10 (#7427) under the previews ruling (#7131; README, 'Designer previews count as consumers'): 'no surface renders' is exactly the claim that ruling put back on the table for display keys, so it was measured instead of trusted. At objectui @e9ab52f9 AppPreview IS registered (previews/index.ts:40) and reachable (ResourceEditPage.tsx:949), and it contains ZERO occurrences of `areas` — it reads the app label at AppPreview.tsx:193 and walks `navigation` items, never the area collection. The area-level description reaches no human there."
         },
         "navigation": {
           "status": "live",

packages/spec/liveness/datasource.json

@@ -1,6 +1,6 @@
 {
   "type": "datasource",
-  "_note": "DatasourceSchema. Consumers: @objectstack/service-datasource (DatasourceConnectionService.toSpec → DatasourceConnectionSpec → createDefaultDatasourceDriverFactory), @objectstack/objectql (engine.ts federation write gate), @objectstack/runtime (external-validation-plugin). Seeded 2026-08-01 (#4487) after #4465/#4481 found six inert keys BY HAND on a type no gate governed. Method: the authoritative boundary is what crosses into `ConnectableDatasource` (datasource-connection-service.ts:45-74) and `DatasourceConnectionSpec` (contracts/datasource-driver-factory.ts:25-59) — a block on neither reaches no driver. objectui's DatasourcePreview renders `pool`/`ssl`/`retryPolicy`/`healthCheck` as SideBlocks and is NOT counted as evidence for any entry (see README, 'An authoring/preview renderer is NOT a runtime consumer' — the #4481 precedent was exactly this). Framework provenance/lock fields auto-live. RETIREMENT 2026-08-02 (#4583): the whole `capabilities` block (11 flags, every one dead and authorWarn'd) was REMOVED from the schema rather than bridged — pushdown is decided by the runtime driver's own `supports.*`, a different mechanism, so there was nothing to connect it to. Its rows are deleted rather than flipped, per the strict-removal route (the keys left the walked shape, so a kept row would read as an ORPHAN). `readOnly` is called out separately in the tombstone: deleting it does NOT hand the author a working alternative, because `external.allowWrites` only gates FEDERATED datasources — a managed datasource has no read-only gate at all, which is #4584 rather than something this removal invented. BATCHES B/C/D CLOSED 2026-08-02 (#4583): `retryPolicy` (4) and `healthCheck` (3) were removed as whole blocks and `external.label` / `external.requirePermission` as individual keys — all nine dead, all authorWarn'd, none bridgeable because each already had a DIFFERENT live mechanism: connection failure is the boot policy (degraded boot / bootCritical), liveness is the driver handle's on-demand ping()/checkHealth(), the federation label is the top-level `label`, and federated access is governed by ordinary permission sets + RLS. Rows deleted rather than flipped (strict-removal route). The retryPolicy rejection deliberately does NOT offer a rename: hook/job retryPolicy ARE enforced but spell the delay `backoffMs`, and that very inconsistency is the evidence nothing read the datasource one. datasource now carries ZERO dead properties.",
+  "_note": "DatasourceSchema. Consumers: @objectstack/service-datasource (DatasourceConnectionService.toSpec → DatasourceConnectionSpec → createDefaultDatasourceDriverFactory), @objectstack/objectql (engine.ts federation write gate), @objectstack/runtime (external-validation-plugin). Seeded 2026-08-01 (#4487) after #4465/#4481 found six inert keys BY HAND on a type no gate governed. Method: the authoritative boundary is what crosses into `ConnectableDatasource` (datasource-connection-service.ts:45-74) and `DatasourceConnectionSpec` (contracts/datasource-driver-factory.ts:25-59) — a block on neither reaches no driver. PREVIEW CLAUSE RE-MEASURED 2026-08-10 (#7427) at objectui @e9ab52f9, replacing the 2026-08-01 sentence 'objectui's DatasourcePreview renders pool/ssl/retryPolicy/healthCheck as SideBlocks and is NOT counted as evidence for any entry'. That sentence was stale on BOTH halves, independently. (a) ITS GROUND MOVED. The maintainer ruling of 2026-08-10 (#7131) makes a designer preview that renders a key to a human a runtime consumer for DISPLAY keys — see README, 'Designer previews count as consumers' — so a blanket 'not counted for ANY entry' is no longer the rule here. The split is by what the property CLAIMS, not by what the surface is: `label` and `description` are display and now cite that preview as evidence in their own rows below; `pool` and `ssl` are BEHAVIOURAL connection material, so a SideBlock echoing them settles nothing and their verdicts still rest on the ConnectableDatasource boundary above — the #4481 precedent is untouched, which is the whole point of the two-section division. (b) ITS FACTS MOVED, in the opposite direction to the one the #7427 card expected. The preview still reads and renders all four SideBlocks (DatasourcePreview.tsx:105-108 read, :211-218 render) AND a capabilities chip strip (:116 read, :222 render) — nothing was deleted objectui-side. What #4583 removed was the SCHEMA half: `retryPolicy`, `healthCheck` and the whole `capabilities` block are gone from DatasourceSchema, which is `.strict()` and now REJECTS all three. So three of those five renders acknowledge keys no draft can carry — the objectui#3275 shape the preview's own header warns about, filed as objectui#4131 (a ledger row cannot fix a renderer). Framework provenance/lock fields auto-live. RETIREMENT 2026-08-02 (#4583): the whole `capabilities` block (11 flags, every one dead and authorWarn'd) was REMOVED from the schema rather than bridged — pushdown is decided by the runtime driver's own `supports.*`, a different mechanism, so there was nothing to connect it to. Its rows are deleted rather than flipped, per the strict-removal route (the keys left the walked shape, so a kept row would read as an ORPHAN). `readOnly` is called out separately in the tombstone: deleting it does NOT hand the author a working alternative, because `external.allowWrites` only gates FEDERATED datasources — a managed datasource has no read-only gate at all, which is #4584 rather than something this removal invented. BATCHES B/C/D CLOSED 2026-08-02 (#4583): `retryPolicy` (4) and `healthCheck` (3) were removed as whole blocks and `external.label` / `external.requirePermission` as individual keys — all nine dead, all authorWarn'd, none bridgeable because each already had a DIFFERENT live mechanism: connection failure is the boot policy (degraded boot / bootCritical), liveness is the driver handle's on-demand ping()/checkHealth(), the federation label is the top-level `label`, and federated access is governed by ordinary permission sets + RLS. Rows deleted rather than flipped (strict-removal route). The retryPolicy rejection deliberately does NOT offer a rename: hook/job retryPolicy ARE enforced but spell the delay `backoffMs`, and that very inconsistency is the evidence nothing read the datasource one. datasource now carries ZERO dead properties.",
   "props": {
     "name": {
       "status": "live",
@@ -9,7 +9,11 @@
     },
     "label": {
       "status": "live",
-      "note": "display metadata (Setup → Datasources list). No runtime consumer by design — ADR-0033 docs-shaped, deliberately kept, not authorWarn'd."
+      "verifiedAt": "2026-08-10",
+      "evidenceScope": "cross-repo",
+      "evidence": "objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:96 takes `label` off the datasource draft with the datasource's own `name` as fallback, and packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:146 renders it as the preview card's title",
+      "producer": "objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/index.ts:44 registers DatasourcePreview against the `datasource` metadata type, and packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx:949 resolves that registration and hands the component the draft being edited — the read point is reachable, not merely present",
+      "note": "display metadata (Setup → Datasources list). ADR-0033 docs-shaped, deliberately kept, not authorWarn'd. PROSE RECONCILED 2026-08-10 (#7427): the old clause 'No runtime consumer by design' is superseded as a whole-system claim — a designer preview rendering a key to a human IS a runtime consumer (maintainer ruling 2026-08-10, #7131; README, 'Designer previews count as consumers'), and the metadata-admin datasource preview has been showing this value as the card title the whole time. What the old clause got right, and what is preserved: NO CONNECTION-PATH CONSUMER reads it — nothing in `ConnectableDatasource` / `DatasourceConnectionSpec` / the driver factory takes `label`, and `live` here does not mean a driver acquired a use for it. UNCHANGED by the reconciliation: still ADR-0033 docs-shaped, still deliberately KEPT, still not authorWarn'd. Status did not move (this row was already `live`); what it gained is a falsifiable pointer, which is the thing a `live` verdict is supposed to be. Reachability checked rather than assumed: `datasource` IS a registered metadata kind (packages/spec/src/kernel/metadata-type-schemas.ts:119), so the metadata-admin route that resolves this preview is a live authoring path — contrast `validation.label`, whose preview renders the same way into a kind ADR-0088 retired."
     },
     "driver": {
       "status": "live",
@@ -74,7 +78,11 @@
     },
     "description": {
       "status": "live",
-      "note": "internal documentation. No runtime consumer by design — ADR-0033 docs-shaped, deliberately kept, not authorWarn'd."
+      "verifiedAt": "2026-08-10",
+      "evidenceScope": "cross-repo",
+      "evidence": "objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:97 takes `description` off the datasource draft, and packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:150 renders it beneath the title whenever it is non-empty",
+      "producer": "objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/index.ts:44 registers DatasourcePreview against the `datasource` metadata type, and packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx:949 resolves that registration and hands the component the draft being edited",
+      "note": "internal documentation. ADR-0033 docs-shaped, deliberately kept, not authorWarn'd — and displayed under the title in the same preview card as `label`. Prose reconciled with `label` on 2026-08-10 (#7427), same ruling, same preserved caveat: no connection-path consumer reads it, and `live` does not mean one acquired a use for it."
     },
     "active": {
       "status": "live",

packages/spec/liveness/flow.json

@@ -21,7 +21,7 @@
     "description": {
       "status": "dead",
       "evidence": "no reader either layer",
-      "note": "KEPT deliberately (2026-07-30 sweep): docs-shaped, not capability-shaped — an annotation field documents intent for the next reader (per ADR-0033, often a model) even without a runtime consumer. Exempt from enforce-or-remove; do not re-litigate."
+      "note": "KEPT deliberately (2026-07-30 sweep): docs-shaped, not capability-shaped — an annotation field documents intent for the next reader (per ADR-0033, often a model) even without a runtime consumer. Exempt from enforce-or-remove; do not re-litigate. PREVIEW LOOKUP RECORDED 2026-08-10 (#7427): 'no reader either layer' is a cross-repo absence claim, so the previews ruling (#7131; README, 'Designer previews count as consumers') was applied to it mechanically. At objectui @e9ab52f9 FlowPreview IS registered (previews/index.ts:58) and reachable (ResourceEditPage.tsx:949), and it does NOT read the flow description — the only `description` token in the file is a TypeScript interface member at FlowPreview.tsx:64, not a draft read; the preview keys off `d.name`, the node graph and the edges. The claim survives the look; the verdict is unchanged and this note re-litigates nothing."
     },
     "version": {
       "status": "live",

packages/spec/liveness/hook.json

@@ -1,6 +1,6 @@
 {
   "type": "hook",
-  "_note": "HookSchema. Seeded from docs/audits/2026-06-hookschema-property-liveness.md — a model-healthy schema (near-total liveness). Consumers: objectql hook-binder/engine + runtime sandbox.",
+  "_note": "HookSchema. Seeded from docs/audits/2026-06-hookschema-property-liveness.md — a model-healthy schema (near-total liveness). Consumers: objectql hook-binder/engine + runtime sandbox. PREVIEW LOOKUP RECORDED 2026-08-10 (#7427): the two `dead` rows here (`label`, `description`) are the docs-shaped precedent the rest of this ledger cites, so the maintainer's 2026-08-10 previews ruling (#7131 — see README, 'Designer previews count as consumers') was applied to them mechanically, and the answer is an ABSENCE. There is NO registered metadata-admin preview for `hook` at objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/index.ts registers 22 types and `hook` is not among them. Recorded rather than skipped, because 'the type has no registered preview' is the sentence the README asks for and the one `translation.label`'s superseded note was missing. Both verdicts stand unchanged; the ruling gives them nothing to re-litigate.",
   "props": {
     "name": {
       "status": "live",

packages/spec/liveness/permission.json

@@ -155,13 +155,15 @@
         },
         "label": {
           "status": "dead",
-          "verifiedAt": "2026-07-30",
-          "note": "CORRECTED 2026-07-30 (was live with no evidence): no consumer in either repo — objectui's PermissionAdvancedFacets edits policies and PermissionPreview counts them, and an authoring surface echoing input is not a runtime consumer (see README §preview-renderer). Benign display metadata — deliberately NOT authorWarn'd."
+          "evidenceScope": "cross-repo",
+          "verifiedAt": "2026-08-10",
+          "note": "CORRECTED 2026-07-30 (was live with no evidence): no consumer in either repo. VERDICT RE-TESTED AND UPHELD 2026-08-10 (#7427) against the maintainer ruling that a designer preview rendering a key to a human is a runtime consumer (2026-08-10, #7131; README, 'Designer previews count as consumers'). This row is the closest structural twin of the four rows that ruling re-graded — a display `label` marked dead — so it was measured rather than assumed, and it comes out the other way. THE MEASUREMENT, at objectui @e9ab52f9: PermissionPreview IS registered for `permission` (previews/index.ts:71) and IS reachable (ResourceEditPage.tsx:949), so the preview lookup runs; but PermissionPreview.tsx:111 reads `rowLevelSecurity` only as an ARRAY and PermissionPreview.tsx:164 renders `${rls.length} RLS rules` — a COUNT. It never indexes a policy, never reads `.label`, and no policy field reaches a human through it. The 2026-07-30 wording 'PermissionPreview counts them' was exact, and counting is not rendering: the ruling turns on the VALUE being shown to a person, which is precisely what a length does not do. The other measured surface is PermissionAdvancedFacets.tsx:192-193 (reads `draft.rowLevelSecurity`, strips retired keys) and :264 (writes it back) — an authoring FORM, the 'authoring surface echoing input' the 2026-07 correction rejected, and the new ruling names previews, not edit forms. So both halves of the original closure survive it. Benign display metadata — deliberately NOT authorWarn'd. To re-open this row, the thing to look for is a preview that renders the policy's label text, not another surface that counts policies."
         },
         "description": {
           "status": "dead",
-          "verifiedAt": "2026-07-30",
-          "note": "CORRECTED 2026-07-30 (was live with no evidence): same closure as label. Benign — not authorWarn'd."
+          "evidenceScope": "cross-repo",
+          "verifiedAt": "2026-08-10",
+          "note": "CORRECTED 2026-07-30 (was live with no evidence): same closure as label. RE-TESTED AND UPHELD 2026-08-10 (#7427) with `label`, same measurement at objectui @e9ab52f9 — the permission preview counts RLS policies (PermissionPreview.tsx:164) and renders no field of any individual policy. Benign — not authorWarn'd."
         },
         "object": {
           "status": "live",
@@ -206,8 +208,9 @@
         },
         "tags": {
           "status": "dead",
-          "verifiedAt": "2026-07-30",
-          "note": "CORRECTED 2026-07-30 (was live with no evidence): no reader in either repo — governance/compliance reporting never consumes policy tags. Benign organizational metadata — not authorWarn'd."
+          "evidenceScope": "cross-repo",
+          "verifiedAt": "2026-08-10",
+          "note": "CORRECTED 2026-07-30 (was live with no evidence): no reader in either repo — governance/compliance reporting never consumes policy tags. RE-TESTED AND UPHELD 2026-08-10 (#7427) under the previews ruling (#7131), same measurement as this block's `label`: at objectui @e9ab52f9 the permission preview reads `rowLevelSecurity` as an array and renders its LENGTH (PermissionPreview.tsx:111, :164), never a policy's fields, so no tag value reaches a human there. Benign organizational metadata — not authorWarn'd."
         }
       }
     }