chore(console): bump `.objectui-sha` past the packaged-automation page — a stock vendored-console build cannot resolve `automation:packaged` at the current pin

[os-zhuang]

Filed by the domain:engine seat (session session_01LZbWd2jNV1FErXTPSS4Dry) on accepting PR #12491 for #12457 — per the standing rule that the seat accepting a PR files the consumer-side follow-up rather than leaving it in a seat's memory.

⚠️ Why this is a separate card and not a rider: the flag currently lives in PR #12491's body and on #12457, which that PR closes. A live cross-repo blocker recorded only on a closing card is a half-state by construction — it would disappear the moment the PR merges. ⛔ And a pin bump is never a rider on a feature PR (standing lane rule), because it moves a large console delta that has nothing to do with the change carrying it.

The gap

.objectui-sha is pinned at 190fbd01 (seeded by #12347). That commit predates the objectui merges that shipped the packaged-automation page (objectui#6382 / #6415).

Consequence: PR #12491 adds the framework NavigationContribution naming component ref automation:packaged, and the entry is served correctly by the backend — but a stock vendored-console build cannot resolve that ref until the pin moves to ≥ 9602dc8 and the console bundle is rebuilt. The page renders today only against a live objectui build.

Who this actually bites

ADR-0126 acceptance card #12438, item A1 — "管理员登录 → Setup → 「Packaged automation」页面存在". With PR #12491 landed but the pin unmoved, A1 still fails on a stock build, and it fails in the most misleading way available: the nav entry is present and correct in the served metadata, so the defect looks like a UI bug rather than a pin-lag artifact. A tester walking the card from a stock build would file a duplicate against a fix that already landed.

⇒ This card is what stops that. ⛔ It is not merely hygiene.

Size, stated honestly because it is the whole reason this was deferred

The bump moves ~700 objectui PRs of console delta. That is a large, risk-bearing change with its own failure modes (this repo has a documented history of pin bumps: #6159, #6663, #7268, #7411, #8051, and #10136's Console Pin Gate build failure). It needs its own dispatch, its own gate run, and a rebuilt packages/console/dist.

⛔ Do not hand-edit packages/console/dist — it is script-generated. Use the repo's dedicated bump tooling (which carries the override and lockfile changes with it), never a manual pin edit.

Routing note — ⛔ this card has no seat today

Console pin bumps are consistently domain:devx (every prior instance above carried that label). ⚠️ The domain:devx @ objectstack seat is VACANT (seat post #6023, last held by yinlianghui, R12). So this card enters a lane with no one to pick it up. Filing it correctly rather than mis-routing it to a staffed lane — a card in the right empty queue is recoverable; a card in the wrong lane is not.

Dedup

Searched before filing, and the channel was healthy (33 results returned, populated result set). Prior console-pin-bump cards #6159, #6663, #7268, #7411, #8051, #9356 are all CLOSED; the open neighbours #9659 (packages reaching the Console bundle via objectui's lockfile) and #8668 (v17 console-bug epic) are different problems. No open pin-bump card exists at filing time.

Refs: PR #12491 · #12457 · #12438 (acceptance card, item A1) · Epic #12150 · ADR-0126 §7.4

Blocked-by: #12968

[os-elon]

Claim: PM loop round 25
Session: session_01CPrUz21stTFhJRUirdc4yw
Branch: claude/issue-12687-objectui-sha-bump
Worktree: objectstack-issue-12687
Domain: domain:devx
File surface: .objectui-sha + whatever the repo's dedicated bump tooling carries with it (override, lockfile, regenerated packages/console/dist) — ⛔ nothing hand-edited. Stop on breach; explain in the report.
Container & model: L, mode:subagent, model: opus — --tier answers "no path-derived mandate". Sized L on the card's own honest statement: the bump moves ~700 objectui PRs of console delta, with a documented history of pin-bump failures (#6159, #6663, #7268, #7411, #8051, and #10136's Console Pin Gate build failure).
Clause-②: no — moves a vendored build pin; no contract accept/reject behaviour and no public surface of this repo changes.
Serial constraints cleared: no open PR claims .objectui-sha or packages/console/dist. ⚠️ #9659 (packages reaching the Console bundle through objectui's lockfile) is pm:on-hold and is not yours.

⭐ The routing note on this card is now out of date, in this card's favour

It was filed observing that "the domain:devx @ objectstack seat is VACANT … a card in the right empty queue is recoverable; a card in the wrong lane is not." The seat has been held since 2026-08-28T06:00Z. ⇒ The card is being picked up from the queue it was correctly filed into, which is the outcome that filing discipline was protecting.

Why this is not hygiene, restated because it decides the priority

ADR-0126 acceptance card #12438 item A1 (管理员登录 → Setup → 「Packaged automation」页面存在) still fails on a stock build with PR #12491 landed, and fails in the most misleading way available: the nav entry is present and correct in the served metadata, so it reads as a UI bug rather than a pin-lag artifact. A tester walking A1 from a stock build files a duplicate against a fix that already landed.

Premise to re-measure before touching anything

The card states .objectui-sha is pinned at 190fbd01 (seeded by #12347) and that the target is ≥ 9602dc8 (objectui#6382 / #6415 shipped the packaged-automation page). ⚠️ Both ends must be re-read on the current tree and the current objectui, ⛔ not quoted from the card — it was filed 2026-08-27 and pins move. If the pin has already advanced past 9602dc8, that is a premise_still_valid: false delivery and a complete one.

---

Generated by Claude Code

[os-elon]

Dev claim — os-dev subagent

• Session: session_01CPrUz21stTFhJRUirdc4yw (dispatched as an os-dev subagent inside the PM loop's session, so the id matches the claim above — this comment is the developer-side claim, the one above is the PM dispatch)
• Branch: claude/issue-12687-objectui-sha-bump (pushed empty as the write-route probe before the first edit)
• Worktree: /home/user/objectstack-issue-12687, based on origin/main at 8beb3deaf6755311ed6ef88dcce4b5dcbebbdac3
• Assignee field: not touched (PM owns it).

Channel declaration

gh is absent in this container and repo-scoped REST returns 403 for this seat, so GitHub reads/writes route through the github MCP server, with the public-repo zero-quota payload channel used for the card body and comments. MCP call count is reported in the terminal report.

Both premise ends re-measured (not quoted)

	card says	measured
.objectui-sha on origin/main	190fbd01	190fbd01d0615e2e168faf9e08b8ad7844bc039d — unchanged, pin has not advanced
target	>= 9602dc8	9602dc820450dda956843c6cfe5b329bcf88c757 exists and is on objectui origin/main; not contained in the current pin

So the premise holds and the bump is real work. Full measurements — including a correction to the card's "lowest SHA" framing and to the ~700 PRs figure — go in the terminal report and the PR body.

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

os-dev-report

{
  "issue": 12687,
  "status": "done",
  "branch": "claude/issue-12687-objectui-sha-bump",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12955",
  "premise_still_valid": true,
  "summary": "Both premise ends re-measured, not quoted: `.objectui-sha` on origin/main is still 190fbd01d0615e2e168faf9e08b8ad7844bc039d (unadvanced), and 9602dc820450dda956843c6cfe5b329bcf88c757 exists on objectui origin/main and is NOT contained in the current pin — so the premise holds and the bump is real work. Moved the pin through `scripts/bump-objectui.sh` only; nothing hand-edited except the `adr-0087: TODO` placeholder the tooling itself prints an instruction to replace (the gate rejects it on purpose). Diff is 2 files, 201 additions. FOUR PM measurements falsified: (1) the true LOWEST sha resolving `automation:packaged` is b362c1b474b8 (objectui#6382, 2026-08-25 19:32), not 9602dc8 — 9602dc820450 (objectui#6415, 3h and 17 commits later) adds the packaged ACTIONS half; pinned at 9602dc820450 anyway, deliberately, because b362c1b474b8 would ship the page with its actions half missing and recreate the same 'reads as a UI bug' trap one ADR-0126 acceptance item later, and 9602dc820450 is the card's own stated bar. (2) The range is 359 non-merge commits / 188 releasing changesets, not '~700 objectui PRs'. (3) `packages/console/dist` is GITIGNORED (`packages/console/.gitignore` = `dist/`) and `bump-objectui.sh` writes exactly two files — it carries NO override and NO lockfile change, because there are none to carry; the large console delta is build-time, never committed. (4) `dispatch-gates.mjs` does NOT derive `Console Pin Gate` / `check:console-sha` / `check:console-injection` for an `.objectui-sha` diff — all 8 derived families matched via the changeset file and `.objectui-sha` matched nothing; those gates are keyed on a dorny/paths-filter job OUTPUT, not a workflow `paths:` filter. Read them out of ci.yml and ran them by hand. Also ran the pin bump's documented second half (`pnpm sdui:manifest`, ADR-0082 D4) — the ratchet reports no new divergence and `packages/spec/react-declaration-parity.baseline.json` is byte-identical before and after (sha256 79c1f51b…62f15 both times), which is why the diff is still 2 files. Minor card correction: the body attributes the current pin to '#12347'; `git log -- .objectui-sha` says it was seeded by PR #11146 (commit 208bd2236). Two states on the PR I did not set, recorded and not touched: an automation appended a SECOND `Generated by Claude Code` footer after a `---`, and the size-labeler applied `size/m`. `skip-changeset` is not applicable — this PR ships a changeset.",
  "tests": "All gate runs below are on the branch's FINAL head commit 02ddae3a54d64cc6fa1f1ba3730e2c989c8428dc (nothing pushed since; `git status --porcelain` empty at removal). Exit codes captured before any pipe; verdicts quoted from each gate's own line, never from a bare $?. — THE CARD'S ACTUAL QUESTION, answered on the BUILT BUNDLE, not on metadata: `bash scripts/build-console.sh` (stock, unmodified, under the shared verify lock) => VERDICT command-exit 0, `✓ Bundle canary 'import/jobs' present`, `✓ Console bundle carries THIS tree's @objectstack/spec, and only it.`, `✓ @objectstack/console dist ready (49824 KB) from objectui@9602dc820450`. Then `grep -rl automation:packaged packages/console/dist/assets` => EXIT 0, 1 occurrence, in `assets/index-CLjFSs3c.js`, as `q_({ref:`automation:packaged`,label:`Packaged Automation`,source:`@object-ui/app-shell`,component:xv})` — the app-shell component registry, bound to the minified PackagedAutomationPage. Negative control (`automation:definitely-not-a-real-ref`) => EXIT 1, correctly absent. Positive control present. — TWO-SIDED SOURCE MEASUREMENT across the pin move: at 190fbd01d061, `git grep -c automation:packaged` => EXIT 1 (zero occurrences repo-wide) with control term `registerAppComponent` hitting 4x in the same file at the same revision (so the search works there), and `packages/app-shell/src/views/setup/` holds 0 files (the directory does not exist); at 9602dc820450, 4 files carry the ref and the setup dir holds 6. A bundle built from a tree lacking the string cannot register the ref — that is the defect and its remedy, measured in both directions. — DERIVED FAMILY (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, 8 families, all green): check-adr-0087-registration `✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.`; check-changeset-no-major exit 0; check-empty-changeset exit 0; check:changeset-gate-self-tests `✓ 118 + 212 + 116 assertions`; check:objectui-changeset `✓ objectui-range --self-test: all checks passed`; check:pm-half-states `✓ check-half-states self-test: 1515 cases pass.`; release-rehearsal-clone --self-test `✓ self-test passed`. — ADDED BEYOND THE DERIVATION (the console pair path derivation cannot reach): check:console-sha `✓ Console dist matches the objectui pin (objectui@9602dc820450).`; check:console-injection `✓ the dist carries this tree's copy, and not the published one.` Plus check:nul-bytes `OK (scanned 7184 text file(s) … no raw ASCII control bytes)` and a direct control-byte self-scan of both changed files => EXIT 1 (clean). — ADR-0082 D4 RATCHET (`pnpm sdui:manifest`, the pin bump's only trigger): `✓ wrote 57 public blocks`, `## Baseline ratchet ✓ no new DECLARATION divergence vs accepted baseline`. First attempt FAILED on a Playwright revision gap (container has chromium_headless_shell-1194, pinned objectui wants build 1234) — that is the exact case docs/releases-maintenance.md records, and its documented scratchpad symlink remedy was applied verbatim (nothing under /opt/pw-browsers touched; PLAYWRIGHT_BROWSERS_PATH overridden for that one invocation; Chromium 141.0.7390.37, as the note predicts). `playwright install` was NOT run. — NOT MEASURED, reported as neither colour: `node scripts/pm/check-half-states.mjs` exits 3, its own explicit 'no reading at all' code — it is a board sweep needing the GitHub API and this seat's repo-scoped REST answers 403. Its self-test wiring is green. — LINT, narrowed with the narrowing PROVEN, three pieces: (1) population read from eslint's own config resolution, which answers `File ignored because no matching configuration was supplied` for BOTH changed files; (2) count from `--format json` — 2 files submitted, 0 linted, 0 findings; (3) invariance — the diff adds no TypeScript and edits no eslint config, so no untouched file's verdict can move under any configuration. The lint population of this diff is empty by measurement, not by assumption. — NO ABLATION was run: this card adds no guard and no assertion whose failure needs proving, so the ablation field of the template does not apply here rather than being filled in for form. — STALE-TREE NOTE from the derivation: origin/main advanced to 944d798c5 mid-run and the tool flagged 2 gate scripts as stale; checked the intervening commit (944d798c5) — it touches no `.github/workflows/**` and no `package.json`, which are the only inputs gate DISCOVERY reads, and neither stale script's population includes my paths, so the derived family stands.",
  "mcp_calls": "7 — issue_read(1, card body) + add_issue_comment(2, claim + this report) + create_pull_request(1) + pull_request_read(1, mandatory PR-body readback) + search_issues(1, the pre-file dedup) + issue_write(1, filing #12956). Channel declared: `gh` absent and repo-scoped REST 403 for this seat, so GitHub routed through MCP; the card body AND its comments were read on the zero-quota public-repo payload channel instead, and everything else came from git.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12956 (finding + tooling, unassigned): dispatch-gates names NO console gate for an `.objectui-sha` diff — Console Pin Gate is keyed on a dorny/paths-filter job OUTPUT rather than a workflow `paths:` filter, so a pin bump (the one card whose entire risk is the console build, and which has prior form at #10136) derives zero console coverage and reads green locally. Deduped first: same family as the closed #12205 / #11199 / #11404 / #10790 / #12850, no OPEN card covers this instance; #12924 is open but is a different problem (sdui.manifest.json not wired into validateJsxPages).",
    "NOT filed, recorded only: the card body attributes the 190fbd01 pin to '#12347', but `git log -- .objectui-sha` shows it was seeded by PR #11146 (commit 208bd2236). Card-text inaccuracy, not a repo defect — no card warranted.",
    "NOT filed, out of scope by explicit instruction: #9659 (packages reaching the Console bundle through objectui's lockfile) is pm:on-hold. The bump did not surface that class — build-console.sh's spec/client injection assertions both passed in both directions, so nothing about objectui's lockfile reached the bundle."
  ]
}

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

os-dev-report

{
  "issue": 12687,
  "status": "needs_decision",
  "branch": "claude/issue-12687-objectui-sha-bump",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12955",
  "premise_still_valid": true,
  "summary": "PATCH ROUND 1. The pin bump itself is unchanged and Console Pin Gate passed — the card's actual claim holds. The red was `Type Check · source gates` → `check:objectui-pin-citations`: 8 spec read-point records asserted `.objectui-sha` = `190fbd01d`, which this PR moves off. Re-measured every cited anchor at 9602dc820450 rather than replacing the sha (the gate forbids that and ships no `gen:`); 6 of 8 records repaired, sha and anchors moved together, comment text only — mechanically verified that every added line in the diff is a comment line. `TypeScript Type Check` was NOT an independent red: read from the aggregator's own OS_NEEDS (job 98827675406), one lane `failure` and three `success`, its only error being `type-check lane 'typecheck-source-gates' concluded 'failure'`; it is a pure rollup over four lanes with `if: always()`. TWO RECORDS DELIBERATELY LEFT RED, which is why this is needs_decision and not done: the `element:button` icon read point MOVED. objectui#5993 deleted button.tsx's file-local icon normaliser and routed it through the shared `resolveIcon` (`../action/resolve-icon`) — precisely because the duplicate silently missed a lucide alias every `action:*` site got. Anchors are mechanically re-derivable (resolution :44-47 → :36 plus a hop into a DIFFERENT file, render :69/:71 → :57/:59, registration :82-98 → :70-87, and the cited normaliser at button.tsx:14-27 is now imports + the forwardRef opening). What is not mechanical is the shipped `.describe()` string, which tells authors the renderer uses \"its OWN PascalCase normaliser and rename map\" — false at the new pin. The key is still LIVE and the record's verdict still holds; only the ownership clause broke (`resolveIcon` still returns null on an unknown name, so the LazyIcon contrast survives). Correcting authorable-surface contract prose is a rider on a pin bump and a contract-text change, so per the standing ruling I reported rather than re-pointed, and did not re-spell it as a historical citation to buy green. ALSO FOUND, and it is the #10274 class: `useBulkExecutor.ts:284-288` was WRONG SINCE WRITTEN — it stopped before `label = 'bulk delete'`, truncating the second of the two branches it names. Caught only because I re-READ every anchor at the new pin instead of trusting byte-identity; that file is byte-identical across the move, so a sha-only rewrite would have preserved the error behind a fresh-looking sha. Widened to 284-289. #12956 updated and materially sharpened per your instruction: it is no longer \"the console gate is unreachable\" but \"an `.objectui-sha` diff derives NO pin-critical gate, and the class is defined by gates that CANNOT be path-filtered\" — `check:objectui-pin-citations` is deliberately unfiltered because, in lint.yml's own words, `a paths filter on packages/spec/** would go dormant on exactly the PR that moves .objectui-sha`. Being unfiltered is what makes it invisible. Its evidence is now a red CI run.",
  "tests": "All readings on the final head commit 39b05bf821af235c8046064c9cd4e08764cecec8 (`git status --porcelain` empty and 0 unpushed commits at teardown). Exit codes captured before any pipe; verdicts quoted from each gate's own line. — REPRODUCED THE RED LOCALLY FIRST: `pnpm --filter @objectstack/spec check:objectui-pin-citations` => exit 1, `✗ 8 spec source(s) assert an objectui pin this repo does NOT build against`. After the repair: exit 1 with `✗ 2`, naming exactly component.test.ts:2440 and component.zod.ts:1827 — the two button records left red on purpose. — PER-ANCHOR RE-MEASUREMENT at 9602dc820450. Byte-identity used as a first cut, never as proof: `containers.tsx`, `useBulkExecutor.ts`, `lazy-icon.tsx`, `ObjectMetricWidget.tsx`, `MetricWidget.tsx`, `MetricCard.tsx` identical; `ObjectGrid.tsx` (3762→3955 lines), `plugin-dashboard/src/index.tsx` (351→394), `button.tsx` changed. MOVED, content byte-identical: ObjectGrid.tsx 2492-2507 → 2586-2601 (diffed the two spans, identical); plugin-dashboard/src/index.tsx 161 → 204 (the file now carries TWO identical `Icon (Lucide name)` inputs — :132 on `metric-card`, :204 on `object-metric` — and only the record's own \"on the registered object-metric block\" wording disambiguated it). CORRECTED, pre-existing error: useBulkExecutor.ts 284-288 → 284-289. UNMOVED and re-read rather than inferred: containers.tsx tabs 662-668 (verified `mr-1.5 h-3.5 w-3.5 shrink-0 opacity-70` + aria-hidden inside TabsTrigger, left of the label span) and :721; containers.tsx accordion 851-857 (verified the `flex items-center gap-1.5` wrapper grouping icon and label inside AccordionTrigger) and :898; ObjectMetricWidget :142/:474; MetricWidget :312-321 (getLazyIcon guarded on typeof string) and :373-382; lazy-icon :66-80; MetricCard :83. — GATE FAMILY RE-DERIVED on the repaired diff: 5 paths, family grew 8 → 33. All 33 green except the pin-citation gate. Spot-quoted: `check:authorable-surface`, `check-comment-mask-adoption`, `check:doc-authoring`, spec `check:docs`, `check:spec-parsed-alias`, `check:cross-package-test-inputs`, `check:test-source-alias`, `check:objectql-double-limit`, `check:liveness`, `check:empty-state`, `check:strictness-ledger`, `check:variant-docs`, `check:skill-refs`, `check:page-declaration-shape`, `check:slot-lookup`, `check:published-files`, `check-ci-filter-parity`, `check-plugin-teardown-shape`, `check:merge-driver`, `check:type-source-resolution` — all exit 0. — ADDED BY HAND because the derivation does not name them: `check:objectui-pin-citations` (above) and `check:nul-bytes` => `OK (scanned 7184 text file(s) … no raw ASCII control bytes)`. — `pnpm --filter @objectstack/spec typecheck` => VERDICT command-exit 0 under the shared verify lock, including `check:test-typecheck: OK — the test layer compiles`, so the edited test files really are covered. — `vitest run --maxWorkers=2` on both edited test files => `Test Files 2 passed (2)`, `Tests 234 passed (234)`. — TWO NOT-MEASURED-THEN-MEASURED: `check-dev-prereqs` and `check:doc-formula-expressions` first exited 1 with `PREREQUISITE NOT MET` / `Nothing was measured … It is NOT a finding` — a fresh worktree with no dist, not a red. Rather than report them as unmeasured I built: `pnpm build` => `Tasks: 71 successful, 71 total`, after which dev-prereqs => `✓ 67 package build artifacts present` and doc-formula => exit 0. — DELIBERATELY NOT RE-QUOTED: `check:console-sha`. This worktree has no packages/console/dist, where that gate prints `ℹ No console dist — skipping` and exits 0 — a vacuous pass, not a measurement. The round-0 console evidence stands: the pin did not move in this round and this round's diff is comment text under packages/spec/src.",
  "mcp_calls": "10 total across both rounds — round 0: issue_read(1) + add_issue_comment(1 claim) + create_pull_request(1) + pull_request_read(1) + search_issues(1) + issue_write(1, filing #12956) = 6. Round 1: get_job_logs(1, the aggregator OS_NEEDS reading) + issue_write(1, sharpening #12956) + update_pull_request(1, with `draft: true` passed explicitly since that call sends the draft bit whether or not you set it) + pull_request_read(1, body readback) = 4, plus this report comment. Everything else came from git and the zero-quota public-repo payload channel.",
  "open_questions": [
    {
      "question": "The two `element:button` icon read-point records (packages/spec/src/ui/component.zod.ts:1827 and component.test.ts:2440) cannot be closed by a citation refresh, because objectui#5993 moved the read point AND falsified a clause of the shipped `.describe()` string: it tells authors the renderer resolves the icon 'using its own PascalCase normaliser and rename map', and at 9602dc820450 the normaliser is the SHARED `resolveIcon` in ../action/resolve-icon. The key is still live and every other clause still holds. How should this be closed?",
      "options": [
        "A — Close it in a separate follow-up card owned by whoever owns the spec's authorable-surface prose: re-point the anchors (:36, :57/:59, :70-87, plus resolve-icon.ts:14-24/:30-35) AND correct the `.describe()` clause to say the resolution is shared with `action:*` through `resolveIcon`. Leaves PR #12955 red on this one gate until that lands.",
        "B — Do both edits inside PR #12955 now. Fastest to green, but adds a spec contract-text change to a card whose Zone 1 ruling is 'a pin bump and nothing else', and puts a shipped authorable-surface string under a dev's unilateral judgment.",
        "C — Re-spell the two citations in the historical form (`.objectui-sha` pin `190fbd01d`). Green immediately and mechanically legal. ⛔ I am not recommending this and did not do it: these are live claims about the pin the repo builds against, and converting them to dated records is exactly the trade the gate exists to refuse — it would also strand a now-false `.describe()` with nothing checking it.",
        "D — Land the pin bump with the gate red and an explicit override. Not recommended: it normalises a red required context and the next pin bump inherits an unverifiable record."
      ],
      "recommendation": "A. The pin bump and the contract-text correction have different owners, different review needs and different blast radii, and bundling them is precisely what Zone 1 ruling 2 forbids. It also keeps the gate doing its job: a loud, accurate red on a record that genuinely needs a human decision is the outcome this gate was built to produce, and #10274 is the precedent that silently refreshing such a record is worse than leaving it red. The cost is that #12955 cannot go green until the follow-up lands — which is a real cost and the reason this is your call, not mine. If you would rather not block the pin, B is defensible provided the `.describe()` edit is reviewed as a contract change on its own merits rather than waved through as part of a bump."
    }
  ],
  "out_of_scope_findings": [
    "UPDATED #12956 (finding + tooling, unassigned) — retitled and rewritten per your instruction. The claim is now the class, not the single gate: an `.objectui-sha` diff derives NO pin-critical gate, and the class is characterised by gates that CANNOT be path-filtered. Instance 1 `Console Pin Gate` (filtered via a dorny/paths-filter job OUTPUT, one indirection from where the derivation reads); instance 2 `check:objectui-pin-citations` (deliberately UNFILTERED — lint.yml says a paths filter on packages/spec/** 'would go dormant on exactly the PR that moves .objectui-sha, which is the PR this exists to catch'). Measured escalation included: 2-file diff → 8 families → no pin gate; 5-file diff editing the very files that gate scans → 33 families → STILL no pin gate. Residue placement recorded: pin-citations and console-sha in `Undetermined` (34 families), console-injection in `Silent` (111) — the two buckets whose own labels say they are not clearances and which nobody reads at that size. Evidence is now a red CI run, not a local reading.",
    "NOT filed, recorded only: the PR-body signature footer behaves differently on create vs PATCH here. Round 0's `create_pull_request` produced a duplicated `Generated by Claude Code` footer after a `---` (an automation appended a second one); round 1's `update_pull_request` did not, and the body read back exactly as sent. Consistent with the documented create-vs-PATCH footer asymmetry; recorded rather than filed because it is cosmetic and already covered by standing guidance.",
    "NOT filed, recorded only: PR #12955 has since acquired the labels documentation / tests / tooling / protocol:ui / protocol:data alongside size/m. None were set by me; they are the labeler acting on the round-1 spec-source edits. Not corrected, per the rule that PR state I did not set belongs to another actor."
  ]
}

Generated by Claude Code

---

Generated by Claude Code