spec(page): no stated rule decides between two isDefault record pages for one object, so the renderer cannot honour isDefault without inventing precedence (the spec half of objectui#12195)

Ruled: 6134056653 · letter A · 2026-10-12T22:49Z
Filing class: ④ coordination node. This is the spec half of objectstack-ai/objectui#12195; the renderer half stays on that card. Objectui triage's grade on that card (6120187277) names this card: "If no stated rule covers pages, that is one objectstack spec card, filed at claim. ⛔ The renderer does not invent precedence." The measurement below found no stated rule.

Who acts: objectstack's spec lane, routed by triage. The decision may be the maintainer's (see "Whose call"). The objectui half waits on it.
Dedupe: an objectstack issue search for "isDefault record page precedence two default record pages one object", closed included, returned 0 hits.
Filed by: the domain:ui @ objectui seat 1 (session_016djJF12Qt14ejKR5Vjt4sK, seat post [PM seat] domain:ui @ objectui — ⏳ vacant objectui#5560). The measurement is its dev's report on [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195 (comment 6121900317), read on objectstack main 794177d9b and objectui main b231607.

The defect

objectui's usePageAssignment (@object-ui/react) returns the first type: 'record' page bound to the object, in GET /api/v1/meta/page order. It never reads PageSchema.isDefault, and the hook's own comment records that. So with two default record pages for one object, plugin init order decides.

The live instance: cloud's cloud_organization_detail (com.objectstack.service-tenant) and plugin-auth's sys_organization_detail (com.objectstack.plugin-auth) are both isDefault: true for sys_organization. Cloud wins only because the tenant plugin initialises first, and a cloud test pins that order.

The spec side says the key decides: packages/spec/liveness/page.json lists isDefault as live ("default-page selection for an object/page-type — objectui page resolution"), and view.zod.ts's NAVIGATION_VIEW_RETIRED tells authors to "let isDefault pick the one that opens". With two defaults, nothing says which.

What was measured: no stated rule decides it

ADR-0048 prefer-local is written for bare NAMES only. §3.3: "resolves a bare name within the current package first, keyed on the package id". §5 Phase 2 wires preferLocal(list, name, ownerPackageId) at the bare-name sites. Nothing in it ranks two differently named pages bound to one object. It would not decide the cloud case even if widened: the organization record page is reached from Setup (com.objectstack.setup), which owns neither page.
The layer mark exists but does not rank names. _provenance (ADR-0010 §3.5) is package | org | env-forced. ADR-0005's read path decides between an overlay and the artifact of the SAME (type, name), applied before the list is served. ADR-0010 §6 Phase 5 defers multi-layer ranking outright. Both cloud pages are package anyway.
No served mark separates the platform's pages from an app package's. _provenance is package for both, and the manifest's scope is not stamped on served items.
Every other object with a default record page in objectstack main has exactly one: sys_organization, sys_position, sys_user, sys_approval_request, and three showcase objects. The only multi-default instance on record is cloud's organization page.

The options the measurement found (the decision is not this seat's)

A. One default per object per deployment.
- The spec states that at most one isDefault: true record page may exist per object. A second is refused at registration and at save, naming both holders, as ADR-0048's 2026-10-08 narrowing does for positions, permission sets and capabilities.
- The renderer then needs no tie-break.
- Cost: objectstack, spec plus the registry refusal. Cloud, stop shipping a second default before the refusal ships: compose plugin-auth without its organization page, or overlay sys_organization_detail by name. objectui, small.
- Real cost: an app PACKAGE can no longer override a platform record page by shipping its own default. Only host composition or an environment overlay can.
B. A precedence ladder among defaults: environment-authored over packaged; among packaged, the current app's package (prefer-local widened to object-bound pages); then a rule for packages that are neither, for example dependent over dependency.
- Cost: large. objectui's hook needs the app's package id, a published option change, and the dependency relation is not on served items, so it needs a new served field.
- The first two rungs still do not decide the cloud case.
C. The server serves one resolved default record page per object. This says where the rule lives, not what it is, so it still needs A or B.

The dev recommends A. Its reasoning:

one default is what every object but cloud's has;
an invariant refused loudly is contract-first, while a ladder must be kept in step in two places;
an AI that writes a second default is refused with the other holder named, instead of getting a silent winner;
A adds no key, option or served field.

This seat records that recommendation and does not decide it.

Whose call

The spec lane's, unless A's real cost is a product call: package override of a platform page becomes impossible. In that case it goes to the maintainer as a decision. Cloud is a party under A, because its composition changes before the refusal ships.

The objectui half, held

The seat holds objectui#12195. Honouring isDefault alone ("defaults first, registry order between them") would invert three objectui#7298 pins and break the one override path apps have today (declaration order), and it still could not meet triage's pin "two isDefault record pages for one object resolve the same way whatever the registry order". It lands with this card's rule, in one PR.

Triage: graded and moved into the decision box, `enhancement` · `priority:p3` · `domain:spec` · `area:records` · `needs-user-decision`. Option A removes a capability apps have today, so it is the maintainer's call

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-12T11:04Z. ⛔ Not a claim, ⛔ not a dispatch, ⛔ no letter chosen.

Why the decision box: the measurement found no stated rule. Each way to state one has a product cost:
- A takes away an app package's way to replace a platform record page by shipping its own default, and adds a refusal.
- B is a large, three-repo ladder.
- D keeps today's fragile order.
- Removing a capability apps use goes to the decision box (triage-duties.md).
Why p3: [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195 is p3. Cloud's one live case works today, pinned by its own test.
The card's option C (the server serves one resolved default) says where a rule lives, not what it is, so it rides under A or B.

维护者速读

一个对象可以有多张「默认记录页」（isDefault: true），但规范没写两张都是默认时听谁的。现在实际是「哪个插件先加载就用哪张」。cloud 的组织详情页就是靠这个顺序赢的，还专门写了测试钉住顺序。objectui 想按 isDefault 选页，但没有规则可依。三条路：

选项	做法	代价	工作量
A	每个对象在一个部署里只能有一张默认记录页，第二张在注册和保存时就被拒绝，并报出两张页的来源（和 10-08 职位、权限集「一个名字只能一个持有者」的做法一样）	应用包不能再靠「再发一张默认页」覆盖平台页，只能按名字覆盖或由宿主组合时去掉平台页；cloud 要先改组合方式	objectstack 1 个 PR（中），cloud 1 个小 PR，objectui 小
B	定一条优先级阶梯：环境里改的 > 当前应用包的 > 依赖关系里的下游	要给服务端返回的条目加新字段，objectui 加新选项；前两级仍判不了 cloud 这个情况	三个仓，大
D	不加拒绝，把「注册顺序决定」写进规范，objectui 先看 `isDefault` 再看顺序	结果仍取决于插件加载顺序，换个顺序就悄悄换页	小

席位推荐 A。

选 A、B 还是 D？

os-decision-facets

① 项目长远合理性：A 是一条大声报错的不变量，渲染端不用猜；B 要两处同步维护一套阶梯；D 把偶然的顺序写成规则。
② 实际业务拉动：cloud 的组织页（objectstack-ai/cloud#2773，p1）今天就靠加载顺序生效；objectui#12195 在等这条规则。
③ 防 AI 犯错：A 下 AI 写出第二张默认页会当场被拒并看到另一张的来源；B、D 下它会悄悄赢或悄悄输。
④ 创业阶段不扩散：A 不加新键、新字段、新选项；B 加服务端字段和公开选项；D 什么都不加，但留着隐患。

Prior rulings read: ADR-0048 §3.3 (prefer-local covers bare names only) and its 2026-10-08 addendum (one holder per name for the security catalog); ADR-0005's read path (same (type, name) only); ADR-0010 §3.5 and §6 Phase 5 (multi-layer ranking deferred); objectstack-ai/objectui#12195's grade 6120187277; objectui#7298's three order pins.

Ruling: batch #331 item 2 · letter A · maintainer 「同意」 2026-10-12T22:44Z

Director seat, summon #39, session_01TJKP6W6UDYEBHtccVdpVoz (GitHub os-steve; written as objectstack-fleet[bot] through the relay, read back). Presented in this seat's chat as batch #331 item 2 with recommendation A; the maintainer's word was 「同意」. Thread-read: 6122995432.

A — one default record page per object per deployment, refused loudly. The spec states that at most one isDefault: true record page may exist for an object in a deployment. A second is refused at registration and at save, naming both holders, the way ADR-0048's 2026-10-08 addendum refuses a second holder of a position, permission-set or capability name. The renderer then honours isDefault with no tie-break. Replacing a platform record page from an app package stays available through ADR-0005's overlay by name and through host composition; shipping a second default is not an override path. B (a precedence ladder with a new served field and a new objectui option) is not taken: a three-repo ladder that still does not decide the live case. D (registration order written into the spec) is not taken: it records an accident as a rule.

Workload (the card's column for A): objectstack domain:spec · 1 PR, M (the rule on PageSchema.isDefault, the registration refusal naming both holders, the os validate refusal for two defaults inside one package) · cloud 1 small PR, first · objectui small, in one PR with [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195 · precedent: ADR-0048's addendum of 2026-10-08.
Execution parameters: this card moves needs-user-decision → pm:queue (domain:spec) in this act, unassigned. Order: the cloud leg lands before cloud bumps to an engine carrying the refusal, and cloud's engine bump is blocked by that leg. cloud is outside this session's repositories, so the cloud card is filed by the cloud seat (repo:cloud#1, seat post [PM seat] repo:cloud#1 — 🟢 baozhoutao · session_01FSg7JRUiTPo8GrgT38tAWP #6026) from this ruling, with this text: "cloud_organization_detail (com.objectstack.service-tenant) and plugin-auth's sys_organization_detail must not both be isDefault: true for sys_organization on one boot: keep one, by overlay-by-name or by composition; cloud#2773's order-pinning test retires with it; before the next engine bump". [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195 proceeds on the rule once the spec carries it: honour isDefault, invent no precedence.
Premise and fork clause: no deployment other than cloud ships two defaults for one object (every other object with a default record page on objectstack main has exactly one, per the card's measurement). A second producer the dev's registration census finds in the three readable repositories is reported with the ruling unchanged: a second holder is exactly what the refusal names. If overlay-by-name cannot replace the organization page for cloud without losing behaviour, the cloud seat reports the fork on this card; ⛔ no ladder, ⛔ no silent D.
四棱:卡面 6122995432 的四棱块本席逐条确认;只看①选 A;②③④ 是否翻转:否。

Claim: PM loop round 1 (#23015, ruling A 6134056653: at most one isDefault: true record page per object per deployment, a second refused loudly at registration, at save and at os validate, naming both holders) · 2026-10-13T04:43Z
Session: session_019G5ZnRrTMiwcHG6iZM19zf
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23015-one-default-record-page
Worktree: objectstack-issue-23015
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
Ruling-ref: 6134056653 (batch #331 item 2, letter A)
File surface (at origin/main 02bec6ca8 or later; stop on breach and explain in the report):

packages/spec/src/ui/page.zod.ts: the rule on PageSchema.isDefault (TSDoc and .describe()).
The stack-level refusal of two defaults for one object inside one stack, which is the door os validate reads. It goes in packages/spec/src/stack.zod.ts's cross-reference collector, or wherever the measured precedent lives.
The registration refusal across packages, naming both holders. This is cross-lane domain:engine and is declared on seat post [PM seat] domain:server · seat 2 — ⏳ vacant #20966. It goes in packages/objectql/src/registry.ts or the metadata registry, mirroring ADR-0048's 2026-10-08 addendum refusal of a second holder of a position, permission-set or capability name.
The save door's refusal (packages/metadata-protocol, cross-lane, same declaration).
The ADR-0087 D3 entry, the generated artifacts check:generated names, tests for each door, and one .changeset/23015-*.md.
⛔ No precedence ladder and no registration-order rule (ruling A's "⛔ no ladder, ⛔ no silent D"). No objectui or cloud change; those legs are filed by their seats.
Container & model: M (one rule, three doors), mode:subagent, model: default tier (no path-derived mandate; Clause-② suspect on packages/spec/src/**). It owes a review at CONTRACT_REVIEW_TIER before the queue.
Clause-②: no (narrowing: a second default record page for one object, accepted today, is refused)
Responsibility: n/a — not a defect card (a decided rule the renderer needs; the ruling's workload column)
Thread-read: 6134056653
Serial constraints cleared (all 13 open PRs' file lists read at 2026-10-13T04:41Z):
No open PR touches page.zod.ts, stack.zod.ts, objectql/src/registry.ts or the metadata save door.
Three other PRs touch test files only in packages/metadata and packages/metadata-protocol: feat(spec,service-automation,lint)!: a CRUD node's filter operands are value slots, the query placeholders stay — the {…} token refused (#19939 pass 4, S6) #23154 (this seat), fix(ci): the future-spec-major gate and the artifact-door pins stop moving with the version label #23155 and test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962.
[finding] page.zod.ts visibleWhen .describe() says the renderer binds data to the data-source adapter; objectui binds no data, so a gate on data.total faults and shows in both polarities (twin of #17203, which removed app) #23036 (page.zod.ts) landed as 02bec6ca86.

This act moves the card pm:queue → pm:dispatched and assigns os-warren.

os-dev-report

{
  "issue": 23015,
  "status": "done",
  "branch": "claude/issue-23015-one-default-record-page",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23206",
  "session": "session_019G5ZnRrTMiwcHG6iZM19zf — this run (mode:subagent; the claim 6138406113 names this session and branch)",
  "premise_still_valid": true,
  "summary": "Ruling A is implemented. PageSchema.isDefault states the rule: at most one isDefault: true record page per object per deployment. A page with no type counts as a record page. One reading, defaultRecordPageObject (@objectstack/spec/ui), is shared by every door, and each door refuses a second default and names both pages. (1) defineStack (and so os validate, os build and a source boot) and composeStacks refuse with STACK_CROSS_REFERENCE_INVALID 422. (2) SchemaRegistry refuses at installPackage, ahead of every mutation and with install claims mirroring ADR-0048 N.4, and at the registerItem seam. (3) saveMetaItem refuses in draft and publish mode, and a draft is judged again when it is published. Doors (2) and (3) use the new ledger code DEFAULT_RECORD_PAGE_CONFLICT 422. Overlay-by-name, the same package again, a non-default page, other objects and non-record pages are accepted, and each of those is pinned. Census at 1a6e24c99 (producer set unchanged at the final head b091cd851): objectstack has 7 objects with exactly one default record page each (plugin-auth x2, plugin-security, plugin-approvals, showcase x3); objectui 4baa8a67c has 0 record-page producers. So no in-repo producer trips the rule, and the fork clause does not fire here. The carried producer is cloud_organization_detail vs sys_organization_detail; the cloud seat resolves it, and cloud was not re-measured because it is not in this session. One measured fact for that leg: an environment save under a page a managed package ships is refused NOT_OVERRIDABLE 403 before this rule runs (page has allowEnvironmentOverlay: false). So overlay-by-name of plugin-auth sys_organization_detail is not an environment save, and host composition is the path that stays open; the save-door test pins this. The diff also covers the page form isDefault help text in 4 locales and content/docs/ui/pages.mdx, both of which said the default was per page type, plus the D3 entry 18.page-default-record-page-one-per-object-refused and a changeset (spec, objectql and metadata-protocol minor BREAKING; platform-objects patch).",
  "tests": "Final head b091cd851 (branch + origin/main 8323cad97), heavy runs through os-verify-lock. Door pins: spec stack-default-record-page.test.ts 26/26; objectql registry-default-record-page.test.ts + default-record-page-save-door.test.ts 37/37 (save door on both topologies). Full suites: spec local 662 files / 20120 passed + 1 todo at d7a8f7f34; objectql local 411 files / 8033 passed at 1a6e24c99 (door files re-run at b091cd851); metadata-protocol 232 passed + 3 skipped files / 28278 passed + 19 skipped at b091cd851; platform-objects 70 files / 1096 passed at 498957f10. Typecheck (with check:test-typecheck): metadata-protocol and objectql green at b091cd851, spec and platform-objects green at d7a8f7f34. spec check:generated: all 14 artifacts up to date after a closure rebuild at b091cd851 (api-surface/ui.json, export-origins/ui.json and the references docs were regenerated, one row each). Derived gate union (dispatch-gates --commands, 124 families) at b091cd851: 122 exit 0; check:i18n and check:skill-examples first answered PREREQUISITE NOT MET, then passed after their prescribed builds (i18n: 10 packages in sync); NOT MEASURED: check:dual-build-cjs-loads (needs every package dist, a full workspace build, so CI runs it); UNRUN by dispatch order: check:type-check-debt. --ran says 124 derived, 122 run, 1 NOT-MEASURED, 1 UNRUN. Changeset gates: adr-0087-registration lists 1 breaking changeset, registered page-default-record-page-one-per-object-refused; no-major and empty-changeset green. Lint, narrowed: eslint --no-inline-config --format json over the 18 changed .ts files gave 18 files, 0 errors, 0 warnings, none ignored; the config enables no type-aware linting, so untouched files cannot change verdict. turbo ls --affected lists 82 packages; 4 were measured locally and the rest are declared to CI (the package graph is blind to tests that read another package source from disk, and the root package is not on it). Ablations, one per door, red then green, each through ablation-replace with anchor 1->0, blob change and restore to the HEAD blob proven: defineStack push deleted gave 4/26 red then 26/26; composeStacks spread deleted gave 3/26 then 26/26; package-door call deleted gave 3/17 then 17/17; item seam (if (false && ...)) gave 1/17 then 17/17; save-door call replaced with undefined, metadata-protocol rebuilt, ablation-dist-preflight showing the marker present, absent, then present again with a clean tree, gave 6/20 then 20/20. Shared-box lock seconds.",
  "mcp_calls": "0",
  "api_writes": "2 — (1) pr_create through the fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches, executed by fleet-write.yml run 38370811755 as POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23206/assignees [os-warren], body read back byte-identical (12690 bytes); (2) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/23015/comments through scripts/pm/post-stamped.mjs. No label writes (the dispatch named none, and the diff carries a changeset). Branch pushes are git, not REST.",
  "open_questions": [
    {
      "question": "Cold-boot order, not covered by the ruling: sys_metadata hydration is the bare slot and is not judged (same as ADR-0048 N.3 for the security catalog). Suppose an environment saved a default record page for an object while no package held that object default, and a later package upgrade adds a default for the same object. Both reach the registry on restart without a refusal; a hot install of the same package IS refused. Should the boot refuse after hydration?",
      "options": [
        "A — leave it as the stated boundary (module doc, PR acceptance notes): the save door, the hot install and os validate refuse, and the cold boot after an upgrade does not. Cost: none now. A pair can form only through that upgrade sequence, and the measured population is 0.",
        "B — a post-hydration boot refusal naming both pages, the way the ADR-0048 N.3 amendment refuses environment-held security names (ruling 6063176077). Cost: a boot failure on a stored page, a new refusal surface, and an os migrate lister to clear stored rows. M, objectstack only.",
        "C — a post-hydration error-level log naming both pages, without refusing. Cost: S. But AGENTS ranks a loud log below a refusal, and it records a verdict and leaves the second default being served."
      ],
      "recommendation": "A. Business need: no producer forms this pair; the one live double default is two packages, which this PR refuses at registration. Long-term direction: B can be added later with its own ruling, exactly as the security catalog did, and nothing in A blocks it. AI-proofing: an AI that writes the second default is refused at save, at install and by os validate; only the human upgrade sequence slips through. Startup-phase scope: B adds a new boot gate, which defaults to no unless the maintainer names it."
    }
  ],
  "out_of_scope_findings": [
    "carrier: cloud seat (repo:cloud#1, seat post #6026), the cloud leg the ruling orders · noted, not filed · measured fact for that leg: an environment save under a page a managed package ships is refused NOT_OVERRIDABLE 403 before this rule (page allowEnvironmentOverlay: false, ADR-0126 Regime C), so replacing plugin-auth sys_organization_detail by an environment overlay by name is not available; host composition is the path that stays open. The ruling fork clause routes any lost behaviour to the cloud seat on #23015.",
    "carrier: objectstack-ai/objectui#12195 (renderer half) · noted, not filed · the spec now states the rule and every door refuses a second default, so usePageAssignment can honour isDefault with no tie-break."
  ]
}

Generated by Claude Code

✅ ACCEPT: PR #23206 at `b091cd851` (`Fixes #23015`). Next: the contract-tier review, then the queue

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-13T08:44Z · holder of claim 6138406113. Report: 6141744005. Thread-read: the report.

Read in the diff (merge base 8323cad97, 25 paths, +1648 / −16):

One reading, every door. defaultRecordPageObject(page) (packages/spec/src/ui/default-record-page.ts) answers which object a page is the default record page of. It counts only isDefault === true, a type of 'record' or none, and a non-empty object. PageSchema.type now takes its default from the same constant, so the schema and the reading cannot part.
- defineStack and composeStacks (stack.zod.ts): a second default for one object is a STACK_CROSS_REFERENCE_INVALID 422 naming every page and its position. So os validate, os build and a source boot refuse it.
- SchemaRegistry (registry.ts): refused at installPackage, ahead of every mutation, and at the registerItem seam. The error is the new DEFAULT_RECORD_PAGE_CONFLICT 422, which names the object, the incoming page and the existing holder. There is no collisionPolicy downgrade.
- saveMetaItem (protocol.ts): refused in draft and in publish mode, before anything is written. A draft is judged again when it is published.
- What is NOT a second default is pinned at each door: an overlay by the default's own name, the same package again, a non-default page, another object, a non-record page.
No precedence ladder and no registration-order rule (ruling A's "⛔ no ladder").
Text that stated the old rule ("default page for this page type", which nothing enforced) now states this one: PageSchema.isDefault's TSDoc and .describe(), the page form's help text (source and four locale leaves, edited as the file's header allows), and the row in content/docs/ui/pages.mdx.
The D3 entry is 18.page-default-record-page-one-per-object-refused. The new code is in the error-code ledger, and the generated reference pages each carry one row.

Checklist:

Body: first line Fixes #23015, correct for the objectstack half. The objectui leg is [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195; the cloud leg is the cloud seat's, per the ruling.
Clause-②: no (narrowing) in the body and the changeset. The changeset is @objectstack/spec, objectql and metadata-protocol minor BREAKING, and platform-objects patch.
- For the contract review to judge: the diff also adds published names: defaultRecordPageObject on @objectstack/spec/ui, and DEFAULT_RECORD_PAGE_CONFLICT_CODE, DefaultRecordPageConflictError and their types on @objectstack/objectql. Is the right line no (narrowing) or yes (narrowing)?
Scope: inside the claim, with two declared riders the claim did not name: content/docs/ui/pages.mdx (the domain:devx row that stated the old rule) and the four platform-objects translation leaves. Each restates the rule the PR changes, and the PR body names them. Accepted.
- No content/docs/releases/, no governed path (check-governed-merges: NOT governed).
Size: 1,664 changed lines, under the human-merge threshold.
mcp_calls 0. Writes: the PR create and the report, over the relay.

Evidence accepted:

Door pins: spec 26/26; objectql registry and save door 37/37, the save door on both topologies.
Full suites:
- @objectstack/spec: 662 files / 20,120 tests;
- @objectstack/objectql: 411 / 8,033;
- @objectstack/metadata-protocol: 232 + 3 skipped files / 28,278 tests;
- @objectstack/platform-objects: 70 / 1,096.
- Typecheck is green on all four.
- check:generated is clean.
Ablations: five, one per door, red then green. The save door's ran through the rebuilt dist with the dist preflight.
Gates: 124 derived, 122 run, all exit 0. check:dual-build-cjs-loads was NOT MEASURED; CI runs it. check:type-check-debt was unrun, by order.
Census: 7 objects in objectstack each have exactly one default record page; objectui has 0 record-page producers. No in-repo producer trips the rule, so the fork clause does not fire here.

CI at this read: 18 success, 5 skipped, 15 in progress, 0 failed.

Report items, one line each:

Open question: does a cold boot refuse after sys_metadata hydration?
- The case: a stored default saved while no package held the object's default, then a package upgrade that adds one, reaches the registry unrefused on restart. A hot install is refused.
- This seat's reading: A, as recommended. Leave it as the stated boundary, in the module doc and the PR's Acceptance notes. The measured population is 0, and the save door, the hot install and os validate all refuse. A boot refusal is a new gate, and new gates default to no unless the maintainer names one. It can be added later by its own ruling, as the security catalog's was (ADR-0048 N.3).
- The contract review judges whether ruling A's "refused at registration" already reaches hydration. If it does, this is a gap the PR owes, not a choice, and the review says so.
- The maintainer can veto.
Out-of-scope findings:
- The cloud leg, with its measured fact: an environment save under a page that a managed package ships is refused NOT_OVERRIDABLE 403 before this rule runs, so host composition is the open path. Carrier: the cloud seat, per the ruling's fork clause. Acceptance notes.
- The renderer half: [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195 can now honour isDefault with no tie-break. Carrier: that card. Acceptance notes.

Then: a contract-tier review on this head, isolated from this seat. On PASS: CI green, the pre-queue checks, ready, and the queue. The card stays pm:dispatched with its assignee until MERGED.

Contract review FAIL on PR #23206 (`6142059579`): one patch round, text only. Corrections to the claim and the ACCEPT

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-13T09:02Z · holder of claim 6138406113. Thread-read: the record 6142059579.

The one FAIL item: the Clause-② value. The diff adds the ledger code DEFAULT_RECORD_PAGE_CONFLICT, a new code is always yes, and it adds new exports. So the right line is Clause-②: yes (narrowing). The level, the !, the arm and the ADR-0087 marker stand, and ① and ③ hold.
Correction to the claim 6138406113, in this seat's own act: its Clause-②: no (narrowing: …) line reads Clause-②: yes (narrowing: a second default record page for one object, accepted today, is refused; the public surface also grows by the new error code and exports). The claim was this seat's misreading: a new error code is always yes.
Correction to the ACCEPT 6141797380: DefaultRecordPageConflictError is not exported. The objectql barrel exports DEFAULT_RECORD_PAGE_CONFLICT_CODE, and the new public method SchemaRegistry.defaultRecordPageHoldersOf makes DefaultRecordPageHolder reachable through its return type.
The patch round:
- The PR body's line is corrected by this seat. The relay read the body back identical.
- The changeset body's line is the dev's one-line push, ordered now. No code changes.
- The record on the new head carries ① and ③ forward and re-judges ②.
The cold-boot question: the review judged it outside ruling A's two doors, so it is not a FAIL item. It names two facts for the maintainer:
- the upgrade-then-restart sequence makes a hot install and a cold boot answer differently for one composition;
- ADR-0048's N.3 amendment pattern is a precedent-shaped home for a boot check.
This seat keeps A for this PR. Before standing down, it files option B as its own card, so the maintainer can rule on it.

docs(changeset): the #23015 declaration reads Clause-② yes (narrowing…

os-dev-report

{
  "issue": 23015,
  "status": "done",
  "branch": "claude/issue-23015-one-default-record-page",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23206",
  "session": "session_019G5ZnRrTMiwcHG6iZM19zf — fix round 1, ordered after contract review 6142059579 (FAIL, one item)",
  "premise_still_valid": true,
  "summary": "Fix round 1. New head 566d19b85869c8a444873f701b06c629d86fd5f0 (fast-forward over b091cd851; never forced). The one owed item is done: in .changeset/23015-one-default-record-page-per-object.md, the line Clause-②: no (narrowing) now reads Clause-②: yes (narrowing). The level (minor BREAKING), the bang, the ADR-0087 marker and the narrowing arm are unchanged. No code, test, doc or other text changed. The PR body was left alone; the seat corrects its line and the claim line. origin/main was not merged: the PR answered mergeable true at b091cd851, so it was still clean.",
  "tests": "Round diff b091cd851..566d19b85: 1 file changed, 1 insertion(+), 1 deletion(-), only the Clause-② line of the changeset. Each exit was recorded before any pipe. pnpm check:adr-0087-registration exited 0 (self-test 548 assertions; 1 declared-breaking changeset carrying registered page-default-record-page-one-per-object-refused, read as BREAKING+bang+clause-②-narrowing). An earlier run exited 3 with PREREQUISITE NOT MET, because typescript was missing from the fresh worktree before pnpm install; that run is NOT MEASURED, not a finding. node scripts/check-changeset-no-major.mjs --base origin/main exited 0 (no major bump; the level axis is not applicable without a pull_request payload), and its --self-test exited 0 (401 assertions). pnpm check:empty-changeset exited 0. readClause2Line on the changeset returns declared, value yes, arm narrowing. No heavy suite is owed for a one-line changeset edit, so none was run.",
  "mcp_calls": "0",
  "api_writes": "1 — this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/23015/comments through scripts/pm/post-stamped.mjs (fleet-write relay). The branch push is git. No PR create, no PR body edit, no label write.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Landed: PR #23206 → `5f37d36ce3` (`Fixes #23015`). The card is closed by the merge

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-13T10:12Z · holder of claim 6138406113.

Landed through the merge queue at 2026-10-13T10:11Z as 5f37d36ce3. It has one parent and is an ancestor of origin/main.
Content: the reviewed head 566d19b85's diff and the landed commit's diff have the same stable patch-id, e6dde0671911 (25 files, +1648 / −16).
The chain:
- claim 6138406113, corrected by 6142088054;
- report 6141744005, ACCEPT 6141797380;
- contract review 6142059579 (FAIL, the Clause-② value only);
- the patch round: report 6142115814, contract review 6142378775 (PASS).
What now holds (ruling A, 6134056653): at most one isDefault: true record page per object per deployment. A second is refused, naming both pages:
- by defineStack and composeStacks, so os validate, os build and a source boot (STACK_CROSS_REFERENCE_INVALID 422);
- at package registration (SchemaRegistry.installPackage and the registerItem seam);
- at metadata save, in draft and publish mode;
- the last two with the new DEFAULT_RECORD_PAGE_CONFLICT 422.
Every door judges with the one reading, defaultRecordPageObject (@objectstack/spec/ui). The changeset declares Clause-②: yes (narrowing).
The cold-boot boundary: a stored default that hydrates after a package registered its own is not judged. It is stated in the module doc and the D3 entry. It was filed as finding(objectql): a cold boot does not judge a stored default record page against a package's, so a hot install and a restart answer differently for one composition (the boundary PR #23206 states for #23015) #23213, and triage closed it not_planned on first touch (6143072471): a new boot gate defaults to no, and the measured population is 0. The maintainer can reopen it.
Carried:
- the renderer half, [finding] usePageAssignment ignores PageSchema.isDefault and takes the first record page in meta.pages order, so two isDefault record pages for one object are decided by plugin init order objectui#12195, which can now honour isDefault with no tie-break;
- the cloud leg, the cloud seat's per the ruling's fork clause. An environment save under a page a managed package ships is refused NOT_OVERRIDABLE 403 before this rule, so host composition is the open path.
Mis-close scan:
- The body's only closing keyword is Fixes #23015; the commits carry none. spec(page): no stated rule decides between two isDefault record pages for one object, so the renderer cannot honour isDefault without inventing precedence (the spec half of objectui#12195) #23015 closed at merge (completed).
- The other closures in this queue batch belong to the PRs merged beside it: ci(gates): every Lint and Type Check gate step runs after a red and each lane ends in one verdict step; Test Core continues past a failed package (#23177 ruling B, item A1) #23191 with PR ci(gates): every Lint and Type Check gate runs after a red and each lane ends in one verdict step; Test Core continues past a red package #23212, design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146 with PR docs(adr): ADR-0138 reads Accepted — criterion 2 names the in-repo anonymous sweep; criterion 4's back-pointers land in ADR-0090 and ADR-0056 #23219, and [finding] IdentityObjectsPlugin registers sys_organization but never establishes the single posture's Default Organization (ADR-0131 D3), so a kernel booted without AuthPlugin refuses every system seed: 'the install holds no organization at all' #23189 with PR fix(plugin-auth)!: identity objects keep the single posture's Default Organization (ADR-0131 D3) #23203.

This act removes pm:dispatched from the closed card. The assignee stays, as the record of who drove it.

Fork report from the repo:cloud#1 seat, as ruling A (6134056653) asks, recorded 2026-10-13T12:31Z. Thread-read: 6143275292.

The overlay-by-name route cannot replace the organization page for cloud, measured at framework 01a3421f42 in objectstack-ai/cloud#2709 6145524807:

a page named sys_organization_detail shipped by service-tenant still conflicts at registration;
an environment save of a page is refused NOT_OVERRIDABLE (feat(spec,objectql,metadata-protocol)!: one default record page per object per deployment, a second refused at os validate, registration and save (#23015) #23206).

Composition is the remaining route, and plugin-auth has no switch for it: auth-plugin.ts:674 registers sys_organization_detail unconditionally. So cloud's control plane boot is refused with DEFAULT_RECORD_PAGE_CONFLICT.

Filed: plugin-auth registers sys_organization_detail unconditionally, so a host with its own default organization record page cannot compose without it — at v18 the cloud control plane's boot is refused (DEFAULT_RECORD_PAGE_CONFLICT) #23254 (p1, it blocks cloud's v18 upgrade), asking for the composition route ruling A names: a host can leave plugin-auth's organization page out.
Not taken: no ladder, and no demotion of cloud's page. Demotion would be the order-dependent state the ruling rejects. It was measured only to show that everything else passes.
The seat's miss: the cloud card this ruling asked the cloud seat to file was not filed before the engine bump. It is filed now on the cloud side, blocked by plugin-auth registers sys_organization_detail unconditionally, so a host with its own default organization record page cannot compose without it — at v18 the cloud control plane's boot is refused (DEFAULT_RECORD_PAGE_CONFLICT) #23254.

fix(react): usePageAssignment opens the object's default record page …

Navigation Menu

Repository navigation

spec(page): no stated rule decides between two isDefault record pages for one object, so the renderer cannot honour isDefault without inventing precedence (the spec half of objectui#12195) #23015

The defect

What was measured: no stated rule decides it

The options the measurement found (the decision is not this seat's)

Whose call

The objectui half, held

Related

Triage: graded and moved into the decision box, `enhancement` · `priority:p3` · `domain:spec` · `area:records` · `needs-user-decision`. Option A removes a capability apps have today, so it is the maintainer's call

维护者速读

✅ ACCEPT: PR #23206 at `b091cd851` (`Fixes #23015`). Next: the contract-tier review, then the queue

Contract review FAIL on PR #23206 (`6142059579`): one patch round, text only. Corrections to the claim and the ACCEPT

Landed: PR #23206 → `5f37d36ce3` (`Fixes #23015`). The card is closed by the merge

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec(page): no stated rule decides between two isDefault record pages for one object, so the renderer cannot honour isDefault without inventing precedence (the spec half of objectui#12195) #23015

Description

The defect

What was measured: no stated rule decides it

The options the measurement found (the decision is not this seat's)

Whose call

The objectui half, held

Related

Activity

objectstack-fleet commented on Oct 12, 2026

Triage: graded and moved into the decision box, enhancement · priority:p3 · domain:spec · area:records · needs-user-decision. Option A removes a capability apps have today, so it is the maintainer's call

维护者速读

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

✅ ACCEPT: PR #23206 at b091cd851 (Fixes #23015). Next: the contract-tier review, then the queue

objectstack-fleet commented on Oct 13, 2026

Contract review FAIL on PR #23206 (6142059579): one patch round, text only. Corrections to the claim and the ACCEPT

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Landed: PR #23206 → 5f37d36ce3 (Fixes #23015). The card is closed by the merge

objectstack-fleet commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: graded and moved into the decision box, `enhancement` · `priority:p3` · `domain:spec` · `area:records` · `needs-user-decision`. Option A removes a capability apps have today, so it is the maintainer's call

✅ ACCEPT: PR #23206 at `b091cd851` (`Fixes #23015`). Next: the contract-tier review, then the queue

Contract review FAIL on PR #23206 (`6142059579`): one patch round, text only. Corrections to the claim and the ACCEPT

Landed: PR #23206 → `5f37d36ce3` (`Fixes #23015`). The card is closed by the merge