chore(console): move the objectui pin to b41ed7f so Console Pin Gate builds again (#25735)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DFPJsyK4BzCzQ782unkED33)_

Fixes #25713

Clause-②: no
Metadata-protocol: none

## What this does

Moves `.objectui-sha` from `2958f17e9c6a` to objectui `main`
**`b41ed7f68956c8cfda21bc790548361af81b09ac`**, the merge of
objectstack-ai/objectui#13485 (the change behind
objectstack-ai/objectui#13478: the translation preview draws the
`positions` and `permissions` groups). This is the pin target the devx
seat chose on the card (comment 6392376241), not objectui `main` HEAD.

- Compare:
objectstack-ai/objectui@2958f17...b41ed7f
(15 commits, all on objectui `main`; `git merge-base --is-ancestor`
exits 0).
- `.objectui-sha` and `.changeset/console-b41ed7f68956.md` were written
by `scripts/bump-objectui.sh b41ed7f
--no-commit`. Neither was hand-edited. The digest walked the range
completely: 9 releasing changesets, 1 release-nothing, 6 commits with no
changeset; objectui declared `minor`, recorded as `patch`.
- `scripts/sdui-manifest.record.json` was re-recorded by `node
scripts/gen-sdui-manifest-node.mjs` over the tree
`scripts/build-console.sh` built at the new pin. `sdui.manifest.json`
itself is **byte-identical** (sha256 `d1fde278ffd6…`, 107 components),
so objectui's public component registry did not change over the range.
- `packages/sdui-parser/objectui-lockstep.json` was re-recorded by `pnpm
gen:sdui-lockstep` (see "In-place addition" below).

## Why

At the old pin, objectui's `@object-ui/app-shell` fails `tsc` against
this tree's spec, which declares the `positions` / `permissions`
translation groups. So `Console Pin Gate` is red on `main` (schedule
`CI` run 40136758584), and the release gate refuses a cut while it stays
red. Version Packages #25640 is open.

## Reproduction (local, the Console Pin Gate job's own steps)

`Console Pin Gate` runs only on `push` and `schedule` (its `if:` in
`ci.yml` excludes `pull_request` and `merge_group`), so this PR's checks
cannot show it. Instead, every step of the job was run locally on this
branch: `pnpm exec turbo run build --filter=@objectstack/client...`,
then `bash scripts/build-console.sh`, then the dist presence assertion,
`pnpm check:console-sha` and `pnpm check:console-injection
--require-stamp`. Heap was `NODE_OPTIONS=--max-old-space-size=6144`,
because a 4-CPU / 15 GB cloud container OOMs `app-shell`'s `tsc` at
Node's default heap.

| Pin | Tree | Result |
|:--|:--|:--|
| `2958f17e9c6a` (old) | objectstack `f3fea0a03d` | **RED**,
`build-console.sh` exit 2: `@object-ui/app-shell:build:
src/views/metadata-admin/previews/TranslationPreview.tsx(99,3): error
TS1360: Type '{ objects: …; … 7 more …; settingsCommon: … }' does not
satisfy the expected type` (a `Record` keyed by the spec's translation
groups, `positions` and `permissions` among them). Same failure as run
40136758584. |
| `b41ed7f68956` (new) | this branch, head `8b7fcf45` | **GREEN**,
`build-console.sh` exit 0 (34/34 objectui tasks): bundle canary present;
single-zod canary finds one literal `{major:4,minor:6,patch:7}` over
2291 assets; spec injection carries this tree's spec only (1 of 1
injected-only description present, all 3 pin-only absent, reference is
objectui's own build of objectstack `47af3dde42bb`); `dist ready (66308
KB) from objectui@b41ed7f68956`. Then `pnpm check:console-sha` exit 0
and `pnpm check:console-injection --require-stamp` exit 0. |

The build at the new pin ran before the manifest re-record, so it
printed the expected warning that the record still named `2958f17e9c6a`.
After the re-record, `node scripts/check-sdui-manifest.mjs` exits 0 at
pin `b41ed7f68956`.

Acceptance after merge: the next schedule `CI` on `main` reads `Console
Pin Gate` `success`. That run id will be reported on #25713.

## Contract changes the range brings

None on what a metadata author writes. Every objectui changeset in the
range declares `Metadata-protocol: none`. In detail:

- **SDUI component registry:** unchanged. The manifest is
byte-identical, as above.
- **sdui-parser lockstep:** unchanged. objectui's
`packages/sdui-parser/src` did not change over the range. The grammar
region blob `0131f27cf86d`, the 25 diagnostic codes and the
`not-a-container` predicate blob `76c18fb95d1f` all agree.
- **objectui's own `.objectstack-sha`:** `915e94049922` →
`47af3dde42bb`, by way of `e649c2d91e` (objectstack 18.1.0, objectui
`0984c77e1`). `scripts/objectstack-pin.mjs` accepted this tree standing
in for it, with no dependency-name refusal.
- **objectui release `a3c0da922`** (`chore: release packages (#13289)`):
the `@object-ui` workspace version recorded in the manifest record moves
from `18.0.0` to `18.1.0`.
- **Readiness work for the ui-merge (objectstack#25685 / `cd70b7818`,
objectstack#25723 / `c85408f`):** react and `@types/react` are pinned to
19.3.0, and `zod` is declared `^4.6.5`, the range this monorepo
declares. Workspace-root readers resolve one level up when the tree sits
under `ui/`. Tooling only, no published behaviour changes. The console
bundle still carries a single zod.
- **objectui#13478 / `b41ed7f68`** (`Clause-②: yes` in objectui):
`isSpecTranslationData` now also recognises a served translation
document by the `positions` / `permissions` groups. That is the consumer
catching up with the spec this repo already declares; this repo's
contract does not change.
- **Console behaviour:** form actions open inside their app, create
forms no longer lock fields through `readonlyWhen`, `html` / `richtext`
values are sanitized with `rehype-sanitize`, settings evaluate `visible`
through the expression interpreter and fail closed, and the chat UI
leaves the first page load. All of it is listed in the changeset.

## In-place addition (outside the claimed file surface)

`pnpm check:sdui-lockstep` reds on any pin move (`[pin-moved]`: its
record was taken at `2958f17e9c6a`), so the required lint job would be
red without a re-record. Recorded with
`OBJECTUI_ROOT=.cache/objectui-b41ed7f68956 pnpm gen:sdui-lockstep`, a
clean detached checkout at the pin. Only `objectui.rev`,
`objectui.revDate` and `recordedAgainstPin` move. The gate is then
green: "this copy is byte-identical to objectui@b41ed7f68956 … agrees on
all 25 diagnostic code(s) and on the `not-a-container` predicate". The
four bounded-fix conditions hold: it is the same class as the manifest
re-record (a pin-derived record); it is mechanical and
generator-written; no in-flight claim holds `packages/sdui-parser/**`
(#25711 and #25712 surfaces read); and the gate family was already in
this diff's derived set. The file is not in `@objectstack/sdui-parser`'s
`files[]`, so nothing it publishes changes and no extra changeset is
needed.

## Serial note

#25711 (ui-merge 4a) lists `.objectui-sha` in its claimed surface,
because it deletes the pin files at cutover. This PR modifies that file.
Whichever of the two lands second resolves a delete/modify conflict on
it. No other ui-merge child surface is touched. `origin/main` was merged
before each push (no new commits since `f3fea0a03d`).

## Gates

- `node scripts/pm/dispatch-gates.mjs --commands` at head `a2ad39d3`: 75
families derived. 73 exit 0. 2 are NOT MEASURED locally, both exit 3
PREREQUISITE NOT MET: `pnpm check:dual-build-cjs-loads` needs a full
`pnpm build`, and `node scripts/check-plugin-teardown-shape.mjs
--self-test` needs an unshallow clone. CI runs both. `--ran`
reconciliation: "75 derived famil(ies) accounted for — 73 run, 2
NOT-MEASURED".
- Among the 73: `check-sdui-manifest`, `check:sdui-lockstep`,
`check:console-sha`, `check:console-injection`,
`check:objectui-changeset`, `check-changeset-no-major --base
origin/main`, `check-empty-changeset --base origin/main`,
`check-adr-0087-registration --base origin/main`, `check:nul-bytes`,
`check:merge-driver`.
- `node scripts/pm/check-governed-merges.mjs --branch HEAD`: 0 of 4
paths hit the register, so this PR is NOT governed. Size is +38 / -8.
- `node scripts/check-commit-card-trailers.mjs --range
origin/main..HEAD`: 3 commits clean.
- No package source changed, so there is no package test or typecheck to
run. CI's required set judges the rest.

## Acceptance notes

- The bump digest renders a changeset's declaration lines as its entry
summary when the body opens with them. In this PR's changeset that shows
as `**patch** — Clause-②: yes Metadata-protocol: none (objectui
b41ed7f)` and two `Clause-②: no Metadata-protocol: none` lines for
`cd70b7818`. The same shape has already shipped in
`packages/console/CHANGELOG.md` (for example, lines 256, 514 and 543).
objectui's changesets now open with `Clause-②:` / `Metadata-protocol:`
lines, so the first paragraph `parseChangeset` takes as `summary` is the
declaration block, not the description. The changeset here is left
exactly as generated. `scripts/objectui-changeset-digest.mjs` is in
#25711's claimed surface. Reported to the seat for filing; dedupe words:
objectui-changeset-digest summary declaration lines Clause-② first
paragraph.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01BvMXmT8umCQPhoBPsBjqCA)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/console-b41ed7f68956.md

@@ -0,0 +1,30 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `b41ed7f68956`. Frontend changes in this range:
+
+Derived from the changesets objectui declared over the range — 9 releasing of 10 changesets added across 15 non-merge commits; omitted: 1 release-nothing changeset, 6 commits carrying no changeset (they ship no package code).
+
+- **minor** — The Console's first page load no longer downloads the chat UI (objectui#13410). The `plugin-chatbot` chunk (169.6 KB gzipped, the third-largest eager chunk) and most of `vendor-ma… (objectui `47138b718`)
+- **patch** — Clause-②: yes Metadata-protocol: none (objectui `b41ed7f68`)
+- **patch** — Clause-②: no Metadata-protocol: none (objectui `cd70b7818`)
+- **patch** — Clause-②: no Metadata-protocol: none (objectui `cd70b7818`)
+- **patch** — The `@objectstack/*` pin moves from `915e940499` to objectstack `e649c2d91e`, the 18.1.0 release commit (objectstack#25606), past objectstack#25483 and objectstack#25564, which sh… (objectui `0984c77e1`)
+- **patch** — A `type: 'form'` action fired inside an app opens its form inside that app, headed by a label, with a Cancel (objectui#13433). (objectui `576fd257d`)
+- **patch** — A create form no longer locks fields through `readonlyWhen`. The server does not apply `readonlyWhen` on insert, but the form evaluated it against the seeded defaults, so a predic… (objectui `a78608f38`)
+- **patch** — `html` and `richtext` values are now sanitized with `rehype-sanitize`, the sanitizer the `markdown` pipeline already used, instead of a hand-written pattern filter. (objectui `f3044f708`)
+- **patch** — Settings: a setting's `visible` predicate is evaluated with the renderer's expression interpreter, and a predicate that does not evaluate hides the setting. (objectui `06ce712fc`)
+
+**In this console build, declared nowhere** — objectui merged 6 commits in this range with no `.changeset/*.md`. The code is inside the pin above and ships here, but nothing upstream declared them, so they appear in no objectui CHANGELOG and in no entry above. Listed by subject rather than counted, because a count cannot tell a dependency bump from a form-behaviour change (objectstack#6174); the upstream gate that would prevent this is objectui#3387.
+
+- _(no changeset)_ chore(test): refresh the per-file test timings (objectui#12208) (#13028) (objectui `723776b5b`)
+- _(no changeset)_ chore: release packages (#13289) (objectui `a3c0da922`)
+- _(no changeset)_ ci: pin credential-holding third-party actions by sha and default ci.yml and check-links.yml to a read-only token (#13430) (objectui `798138418`)
+- _(no changeset)_ fix(ci): the affected-tests fast path runs: the shard step compares the output value, not the selector's key=value line (objectui#13350) (#13358) (objectui `861fdff76`)
+- _(no changeset)_ ci(test-shard-timings-refresh): push and open the refresh pull request as the fleet App so it runs CI (#13362) (objectui `cf2419005`)
+- _(no changeset)_ ci(repo-gates): restore the build's turbo cache, save and prune on push only (#13360) (objectui `3688e5cd4`)
+
+Metadata-protocol: none (the console refresh changes no key, value or type a metadata author writes)
+
+objectui range: `2958f17e9c6a...b41ed7f68956`

.objectui-sha

@@ -1 +1 @@
-2958f17e9c6add35636bb07aa9da4b1dcb1daa5f
+b41ed7f68956c8cfda21bc790548361af81b09ac

packages/sdui-parser/objectui-lockstep.json

@@ -6,8 +6,8 @@
   ],
   "objectui": {
     "repo": "https://github.com/objectstack-ai/objectui.git",
-    "rev": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
-    "revDate": "2026-10-23T22:00:30+00:00",
+    "rev": "b41ed7f68956c8cfda21bc790548361af81b09ac",
+    "revDate": "2026-10-25T01:50:02+00:00",
     "source": "packages/sdui-parser/src",
     "files": [
       "packages/sdui-parser/src/body-dialect.ts",
@@ -21,7 +21,7 @@
       "packages/sdui-parser/src/validate.ts"
     ]
   },
-  "recordedAgainstPin": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
+  "recordedAgainstPin": "b41ed7f68956c8cfda21bc790548361af81b09ac",
   "grammarRegion": {
     "file": "packages/sdui-parser/src/parse.ts",
     "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",

scripts/sdui-manifest.record.json

@@ -11,12 +11,12 @@
     "a pin bump without regeneration goes RED there — that is the anti-rot half of the freshness gate.",
     "Regenerate + re-record: pnpm objectui:build && node scripts/gen-sdui-manifest-node.mjs"
   ],
-  "objectuiSha": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
+  "objectuiSha": "b41ed7f68956c8cfda21bc790548361af81b09ac",
   "source": "built-tree",
-  "modulesRoot": ".cache/objectui-2958f17e9c6a/apps/console",
-  "objectuiWorkspaceVersion": "18.0.0",
+  "modulesRoot": ".cache/objectui-b41ed7f68956/apps/console",
+  "objectuiWorkspaceVersion": "18.1.0",
   "generator": "scripts/gen-sdui-manifest-node.mjs",
-  "generatedAt": "2026-10-23",
+  "generatedAt": "2026-10-25",
   "sha256": "d1fde278ffd643900aba9e8fcf834d35a9c345246709f1667ae71618eaad109c",
   "components": 107
 }