[objectstack-fleet]

Part of #15204
Clause-②: no

The console pin hop e5311165a8d6 → 088e0f705520 (objectui main; the merge of objectui#12175). It is the follow-up #22939 named: #22939 declares widget: 'position-ref' / 'permission-ref' on the two grant name fields of Setup's user page, and this pin brings the console that registers those widgets. Until it lands, those fields render as text inputs. #22900 waits for this PR and #22939.

Tier: no governed surface (GOVERNED_SURFACES in scripts/pm/check-governed-merges.mjs). 20 files plus #22973's ported CI files (.github/workflows/ci.yml, scripts/check-test-suite-ceilings.mjs, scripts/partition-test-shards.mjs).

The hop: 3 objectui commits, all on objectui main

• 088e0f705, objectui#12175 (objectui#7611 PR-5): a record-form field names one registry item by name (position-ref lists GET /meta/position, permission-ref lists GET /meta/permission, and each stores the chosen name);
• 83b9fade2, objectui#12174 (objectui#7611 Q3b): a position approver is read through the spec's registry binding { source: 'registry', type };
• 2498a0753, objectui#12110: the rich-text editor draws no hint lines.

The pin round, as #22874's

Console Pin Gate steps, run locally (each exited 0):

1. Client build: turbo run build --filter=@objectstack/client....
2. scripts/build-console.sh at the pin.
3. check:console-sha: "Console dist matches the objectui pin (objectui@088e0f705520)".
4. check:console-injection --require-stamp.

Artefacts that travel with the pin:

• Console changeset. scripts/bump-objectui.sh generated .changeset/console-088e0f705520.md: @objectstack/console minor, the level feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874's pin move used. It has 3 releasing entries, 0 breaking, so there is no ADR-0087 placeholder, and it carries Clause-②: no. check:objectui-changeset passes.
• SDUI manifest. node scripts/gen-sdui-manifest-node.mjs: sdui.manifest.json is byte-identical across the hop (107 components), and scripts/sdui-manifest.record.json is re-recorded at the pin. check-sdui-manifest passes.
• Lockstep record. pnpm gen:sdui-lockstep re-records packages/sdui-parser/objectui-lockstep.json at 088e0f705520. check:sdui-lockstep passes, so the save gate's parser and the renderer's copy agree and no port is owed.
• Pin citations, re-measured for this hop only (re-measure, never find-and-replace):
  • files that three records cite changed on the hop, all for objectui#12175, and every cited line held or moved byte-identical:
    • form.tsx (+3, registering the two widget hints): spanLadderFor held at :275-302, and its call site moved :3326 → :3329 unchanged, so the FormField.span describe's claim holds (re-pointed, with content/docs/references/ui/view.mdx regenerated);
    • data-objectstack/src/index.ts (+33 at :5335, the adapter's listMetadataItems): below both reads the curated-public-blocks record cites, so serializeOrderBy 869-895 and the translateFilterArray arm 5066-5077 are unmoved;
    • the en / zh / de packs (fields.registryRef keys, +4 each): the calendar record's calendar.configRequired strings moved +4 and did not change;
  • every other record cites only files that are byte-identical across the hop (git diff --quiet, checked file by file), and each gains a hop sentence saying so. The first version of this PR said two of the three changed files were byte-identical; the contract review caught it, and 378004003 corrects both records and the changeset;
  • the six migration entries were recounted with git grep -o -F, which reproduces every e5311165a8d6 figure exactly. The corpus is 8519 files, and every retired name still reads 0;
  • check:objectui-pin-citations --verify-anchors: 55 asserting citations match 088e0f705, and the 13 quoted anchors verify against objectui at the pin;
  • changeset .changeset/objectui-pin-citations-088e0f705520.md: @objectstack/spec patch, Clause-②: no.

Browser check, against this branch's built dist

examples/app-showcase was booted --fresh with this branch's console dist and #22939's object metadata temporarily merged in, uncommitted; #22939 is not on main yet. As the admin on Setup's user page:

• the Position and Permission Set fields render as registry pickers (registry-ref-position / registry-ref-permission), listing 16 positions and 17 permission sets;
• picking auditor and mcp_agent_data_read, then pressing Create, wrote both grant rows (verified through the data API);
• everyone is still listed among the positions (the open objectui finding: the server refuses it as a grant target).

Verification (local, at this head)

• full turbo run build green;
• spec typecheck green, spec suite 706 files / 20,387 passed. This was run with the docs build's git-ignored content/docs/protocol-upgrade/ moved aside: that generated guide reds four tree-scan pins in any checkout where the docs app was built, as recorded on feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939;
• dispatch-gates --ran: 125 derived families, all recorded with exit 0.

Acceptance notes

• CI Test Core red on 6ef50e894 only on the suite-duration ceiling step (service-analytics, knowledge-ragflow), which is ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's class and not this diff's. This branch now carries ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973's two commits, cherry-picked in order (e6c7a6ce6 → 598bb69c1, ef3d0764b → 55535f501); both scripts' --self-tests pass.
• objectui finding, carried over (carrier: none yet): the position-ref picker lists the everyone audience anchor.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/sdui-parser, @objectstack/spec, touching 14 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/analytics.mdx (via DatasetMeasureSchema (symbol, a top-level const))
• content/docs/protocol/objectui/layout-dsl.mdx (via ComponentPropsMap (symbol, a top-level const object))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageTabsProps (symbol, a top-level const object))
• content/docs/releases/v17/17-1.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-3.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-4.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-5.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-7.mdx (via ComponentPropsMap (symbol, a top-level const object))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a2240c4dcfc3a19f058cb0b3a4f15a351908acde → packageMentionDocs.

Which tree this was computed on

This run read content/docs from de3991c1c0b4e2c135b6d29f7502ecd2c12946ee — the merge of head 37800400315831108300e98352be75c72087be79 into base a2240c4dcfc3a19f058cb0b3a4f15a351908acde, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin de3991c1c0b4e2c135b6d29f7502ecd2c12946ee && git checkout de3991c1c0b4e2c135b6d29f7502ecd2c12946ee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a2240c4dcfc3a19f058cb0b3a4f15a351908acde 37800400315831108300e98352be75c72087be79 && git checkout -B drift-repro a2240c4dcfc3a19f058cb0b3a4f15a351908acde && git merge --no-ff 37800400315831108300e98352be75c72087be79

node scripts/docs-audit/affected-docs.mjs --json a2240c4dcfc3a19f058cb0b3a4f15a351908acde

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a2240c4dcfc3a19f058cb0b3a4f15a351908acde → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Seat note: Test Core reds only on the suite-duration ceiling step, in packages this PR does not touch · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-12T06:51Z

What red on 6ef50e894b: run 38212782740, Test Core → "Check the per-package suite-duration ceilings". Two packages are over:

• @objectstack/service-analytics: 444.29s over its 440.54s ceiling;
• @objectstack/knowledge-ragflow: 4.11s over its 3.40s ceiling (its slowest file takes 0.05s).

Test Core is the only failing check on this head.

Why it is not this PR's: the diff (the console pin, the SDUI manifest and lockstep records, and the pin-citation re-measure) touches neither package. This is the class #22949 anchors, now ruled C2 for both timing steps plus an absolute floor (6119186511).

The fix: the domain:devx lane's PR for that ruling. Once it is up and its CI is green, the seat has this PR's developer cherry-pick it here, as for W2 (6119234024). The ported hunks no-op when the fix lands on main. No re-run is spent here.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6ef50e894b5a0b141fcd2d9fe7baf0e1d18c74e6
Local-runs: none

PR #22967 (card #15204 B2: the console pin hop objectui e5311165a8d6 → 088e0f705520), read at 2026-10-12T07:43Z. Inputs and nothing else: the card body and its 173 comments (the pin-order seat note 6118044018, the hop dispatch and claim 6118841421, the ruling 6119234024, PR-5's Landed record 6117301706 on objectui#7611, #22939's ACCEPT 6118326033, the #22949 ruling 6119186511, the seat note 6119265238); #22874's body ("The console pin (round 2)") and its contract review 6118257575; the PR body, its 20-file list and the net diff against the merge base e23eccb164 (+214 / −63); objectui at both pins in a scratch clone, read with git only; scripts/build-console.sh, scripts/bump-objectui.sh, scripts/gen-sdui-manifest-node.mjs, scripts/check-sdui-manifest.mjs, scripts/check-sdui-lockstep.mjs, packages/spec/scripts/check-objectui-pin-citations.ts, scripts/pm/clause2-line.mjs and .changeset/pre.json on main; the head's 42 check-runs, the Test Core job's steps and its annotations, through REST. The seat's and the dev's conclusions were read for what they assert and not adopted; every reading below was re-taken from the trees, the diff and the check-runs. Nothing was built, run or re-run.

① Derived judgments

1. The pin and its gate — holds. .objectui-sha reads 088e0f705520e82bee1d65a5fa3c1f7a26672dde, nothing else. In the scratch clone git merge-base --is-ancestor e5311165a8d6 088e0f705520 exits 0, and git log e5311165a8d6..088e0f705520 is exactly the three commits the PR names, all on objectui main, all squashes: 2498a0753 (objectui#12173, the rich-text hint lines), 83b9fade2 (objectui#12174, Q3b) and 088e0f705 (objectui#12175, PR-5). The hop is 54 paths, +2210 / −140. Console Pin Gate on this head is success (run 38212782740); it did not skip, because the net diff moves .objectui-sha.

2. The SDUI artefacts — hold. sdui.manifest.json is not in the diff, and scripts/sdui-manifest.record.json keeps its sha256 (a799c55a18d6…) on both sides while changing only objectuiSha and modulesRoot — so the manifest the generator wrote from the tree built at 088e0f705 is byte-identical to main's, as the PR says (107 components). That is consistent with the hop: it touches none of the console's registry modules; the two widgets PR-5 adds go into @object-ui/fields' fieldWidgetMap (field:position-ref, field:permission-ref), and the manifest carries no field widget today (no object-ref or recipient-picker row either). check-sdui-manifest (tamper, staleness, record shape) runs in Lint & Repo Gates, green. Lockstep: objectui's packages/sdui-parser is byte-identical across the hop (git diff --quiet exits 0), so the grammar region, the diagnostic codes and the containment predicate cannot have moved; packages/sdui-parser/objectui-lockstep.json changes exactly rev, revDate (the committer date of 088e0f705) and recordedAgainstPin, and nothing in grammarRegion, the code list or the predicate. check:sdui-lockstep runs in the same green job.

3. The spec source edits — comments and strings only; no accept-set change. A mechanical filter over the diff (every + / − line under packages/spec/src that does not begin as a comment) leaves exactly: the six migration entries' rationale string fragments (the pin sha, the corpus count 8506 → 8519 and the lit controls) and the FormField.span describe's pin sha in view.zod.ts. component.zod.ts (+102 / −21), action.zod.ts, dataset.zod.ts and functional-completeness.ts change comment lines alone. No key, default, .optional(), required flag, enum member or export moves; nothing is tombstoned. Clause-②: no and the patch level are right in kind. The content of those comments is judged in 4.

4. The citations — form.tsx holds, the counts hold, two records carry a false hop sentence.

• form.tsx: the hop's whole diff to it is the 3-line insertion into DATA_SOURCE_ONLY_WIDGET_TYPES at :595-597 (the two widget hints). spanLadderFor is at :275-302 at both pins and the range is byte-identical (a diff of the two ranges is empty); its one call site reads spanLadderFor(containerClass, targetCols); at :3326 before and :3329 after. The view.zod.ts record (:3432-3440) and the span describe read true at this pin.
• The six migration entries: every figure in the diff reproduces with git grep -o -F at 088e0f705520 — useState 2661, window 4615, objectstack 18400, @objectstack/spec 7603, timeout 1706, TTL 184, tenant 1365, Span 519, SpanSchema 57, RuntimeConfig 357, resourceLimits 2; and debounceDelay, flushInterval, initialDelay, LoggingConfig, HttpDestinationConfig, schemaCacheTtlSeconds, resourceLimits.timeout each 0 at both pins. git ls-tree -r counts 8506 and 8519 tracked files.
• ⛔ False sentence 1 — packages/spec/src/kernel/functional-completeness.ts:301-304, the calendar record. It cites the en / zh / de packs by their calendar.configRequired strings (the record's own words: the tt('calendar.configRequired', …) default "and the en pack both read …", "a non-English locale renders its own pack's words (e.g. zh, de)"). All three packs changed on this hop: objectui#12175 adds fields.registryRef.loadFailed / notFound to every locale (+4 lines each; git diff --quiet e5311165a8d6 088e0f705520 -- packages/i18n/src/locales/en.ts exits 1, zh.ts and de.ts likewise). The strings themselves held and moved by 4 (en.ts :945 → :949), so no anchor is wrong — but the new sentence says "every objectui file this record cites is byte-identical across the hop from e5311165a (git diff --quiet)", which is false for three of them. Every earlier round of this same record said it correctly ("the en / zh / de packs changed (…) but not their calendar.configRequired strings").
• ⛔ False sentence 2 — packages/spec/src/ui/component.zod.ts:3420-3423, the §4b "curated public blocks" record, whose element:repeater row cites data-objectstack/src/index.ts:5066-5077 and :869-895 (:4432), and whose own history names that file at every hop it changed. The file changed on this hop: +33 lines at :5335 (PR-5's listMetadataItems on ObjectStackAdapter), below both cited reads, so serializeOrderBy :869-895 and the translateFilterArray arm :5066-5077 held unmoved — but the file is not byte-identical, and the new sentence says it is.
• So the PR body's "every other record cites only byte-identical files" and the citations changeset's "Every other record cites only files that are byte-identical across the hop" are false for these two records: three files a record cites changed besides form.tsx. The gate cannot see this — check:objectui-pin-citations --verify-anchors checks the sha label and the 13 quoted anchors, never the hop prose — so its green is consistent with the finding. The 41 hop-sentence lines are one boilerplate sentence pasted into every record but view.zod.ts's; the two records above are exactly the two whose previous-round sentences were bespoke because they track files that keep changing. Each other asserting record I scanned cites only files outside the 54 hop paths (ObjectCalendar.tsx, ListView.tsx, ObjectGrid.tsx, public-blocks.ts, basic/data-list.tsx, the five plugin shells, autoLayout.ts, field-type-alias.ts: git diff --quiet exits 0 on each), so the boilerplate is true there.
• content/docs/references/ui/view.mdx: the two changed rows (the FormField table and the form-view select-option shape, which derive from the same describe) carry the describe's new text byte for byte and nothing else — the shape a gen:docs regeneration produces (content/docs/references/** is the gen:docs / check:docs route in scripts/regen-artifacts.mjs). Not re-run here.

5. The three edited tests — comment-only, no assertion moved. api-methods-batch-conformance.test.ts (+4 / −1): the SINGLE_RECORD_WRITE_ONLY table's header comment carries an asserting citation (ObjectGrid.tsx's bulk door), which the gate requires to equal the pin. action-outcome-messages.test.ts (+3): the file's header docblock carries one (objectui#11344's reader). component.test.ts (+24 / −6): six describe-header comments carry one each. The non-comment filter in 3 finds no changed line in any of the three — no expect, fixture, specimen or describe title changed. None weakens an assertion to pass.

6. CI on the head. 42 check-runs: 38 success, 3 skipped (Auto Label and Check PR Size on the second pr-automation run, whose first runs on this head are success; Packed-tarball smoke (opt-in)), 1 failure: Test Core. Its job has ten steps and exactly one failed, "Check the per-package suite-duration ceilings"; the check-run's annotations name @objectstack/service-analytics (444.29s over its 440.54s ceiling) and @objectstack/knowledge-ragflow (4.11s over 3.40s; slowest file 0.05s). Neither package is in this diff; all six Test Core shards and Verify test shard results are success. That is #22949's class, ruled C2 plus a floor (6119186511), as the seat note 6119265238 says — confirmed from the job, not from the note. No check is pending or in progress. Governed Surface Queue Guard, both Check Changeset runs and the four PR-context guards are green.

7. The base. The merge base is e23eccb164 (#22874's merge). main has moved six commits since; none touches a path in this PR, none adds a line naming the old pin, and git merge-tree --write-tree origin/main FETCH_HEAD is clean.

② Semver level

• .changeset/console-088e0f705520.md, @objectstack/console minor: the highest level objectui declared over the range (7611-registry-name-widget.md is minor on fields, types, data-objectstack and i18n; the other two are patch), the level feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874's pin move used, under pre.json mode: pre, tag: next. "3 releasing of 3 changesets added across 3 non-merge commits" matches the log; each entry is the opening sentence of the objectui changeset it names, truncated. No entry is declared breaking and no subject carries !, so no ADR-0087 marker is owed, and Check Changeset is green. Clause-②: no is right for this repository: the hop adds no ObjectStack-authorable key — widget: 'position-ref' is a value of FieldSchema.widget, a free string (the reading feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939's ACCEPT already made) — and objectui's own Clause-②: yes (widening) is on objectui's DataSource.listMetadataItems and its field: keys, no @objectstack/spec surface.
• .changeset/objectui-pin-citations-088e0f705520.md, @objectstack/spec patch, Clause-②: no: the right level and kind for a comment-and-description re-measure, and its count paragraph is true. Its hop paragraph is not: "One file a record cites changed on the hop … Every other record cites only files that are byte-identical across the hop" — see ①.4; this text ships as CHANGELOG.md.
• The PR body's line 2 reads Clause-②: no, consistent with both.

③ Boundary flags

• The browser check and objectui#12200. Both grant fields render as registry pickers and a pick wrote both rows, measured against this branch's dist with feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939's metadata merged in uncommitted; feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939 is open and not merged (head 7de0f00c91), so on main the two fields stay text inputs until it lands — expected, and the two PRs together are D's gate. The everyone audience anchor listed in the position picker is filed as objectui#12200 (p1, domain:ui). Not a reason to hold this pin: the server already refuses an audience anchor as a grant target (recorded in feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939's ACCEPT), and the pre-pin text input lets the same name be typed, so the pin opens no new wrong write; it is a known limitation for the first next until the filter lands.
• Test Core. Not this diff's; the landing waits on ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's fix being ported here (6119265238), which produces a new head anyway. The correction below costs no extra head if it rides that push.
• What turns this into a PASS (text only, three places; nothing else in the diff needs re-measuring): (1) functional-completeness.ts:302-304 — the calendar record's hop sentence should say ObjectCalendar.tsx and ListView.tsx are byte-identical, so its four anchors held, and the en / zh / de packs changed (objectui#12175's fields.registryRef keys, +4 each) but not their calendar.configRequired strings; (2) component.zod.ts:3421-3423 — name data-objectstack/src/index.ts as changed (+33 at :5335, objectui#12175's listMetadataItems, below both cited reads), with serializeOrderBy :869-895 and the translateFilterArray arm :5066-5077 unmoved, and the other cited files byte-identical; (3) the citations changeset's hop paragraph, and the PR body's matching sentence, to say three cited files changed besides form.tsx. Then the re-review on the new head is a delta on these three places.
• Dev flags in the body, answered: the spec suite was run with the docs build's git-ignored content/docs/protocol-upgrade/ moved aside (a local condition recorded on feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939, not this diff's); dispatch-gates --ran 125 families is the dev's claim and was not re-run. Nothing was NOT MEASURED that this record needed.
• State. 20 files, no governed-surface path; head repo is the base repo; draft, auto-merge unarmed. Implemented-by is the dev's session id, as a mode:remote dispatch records it.
• Independence. Reviewed-by names the seat session that holds the claim; the verdict was rendered by an isolated reviewing subagent of that session with the inputs listed above and no others.

Implemented-by: session_013XKtmoR5QCUSTMjiQ3os49
Reviewed-by: session_01Rerax7QTjKMPCUZxQUtPFR

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 37800400315831108300e98352be75c72087be79
Local-runs: none

PR #22967 (card #15204 B2: the console pin hop objectui e5311165a8d6 → 088e0f705520), re-read at 2026-10-12T08:00Z as a DELTA on the record 6119955714 (FAIL on 6ef50e894b5a0b141fcd2d9fe7baf0e1d18c74e6). Everything that record judged "holds" stands and was not re-taken unless the delta touches it. Inputs and nothing else: that record; the PR body as rewritten at 07:50Z; the three commits that moved the head (598bb69c11, 55535f501b, 378004003), read with git show / git diff against pull/22967/head and pull/22973/head fetched into a worktree; objectui at e5311165a8d6 and 088e0f705520 in a fresh scratch clone (--filter=blob:none), read with git only; scripts/pm/check-governed-merges.mjs on main; the head's check-runs and the runs behind them, through REST. The dev's conclusions in the body and the commit message were read for what they assert and not adopted. Nothing was built, run or re-run.

① Derived judgments

1. FAIL point 1, the calendar record (packages/spec/src/kernel/functional-completeness.ts:301-309) — now true. Its newest hop sentence (:302-308) makes four claims and each re-takes at the pins. (i) plugin-calendar/src/ObjectCalendar.tsx and plugin-list/src/ListView.tsx: git diff --quiet e5311165a8d6 088e0f705520 exits 0 on both. (ii) The anchors at 088e0f705: function getCalendarConfig :311, if (!calendarConfig) { :1354, 'calendar.configRequired' :1361, and case 'calendar': { at ListView.tsx:3813. (iii) The packs changed: en.ts, zh.ts, de.ts are each +4 / −0, one hunk apiece (@@ -431,0 +432,4, @@ -317,0 +318,4, @@ -309,0 +310,4), the four lines being registryRef: { loadFailed, notFound }; git log e5311165a8d6..088e0f705520 on each names exactly 088e0f705 (objectui#12175). (iv) configRequired moved en.ts :945 → :949, zh.ts :721 → :725, de.ts :701 → :705, and the string on each pair of lines is identical byte for byte. The sentence now says what every earlier round of this record said, with this hop's figures.

2. FAIL point 2, the §4b curated-public-blocks record (packages/spec/src/ui/component.zod.ts:3420-3429) — now true. The files it names as byte-identical are: core/src/registry/public-blocks.ts, renderers/action/auto-trigger.ts, renderers/action/static-params.ts, ui/button.tsx, action-button.tsx / action-group.tsx / action-icon.tsx / action-menu.tsx (and action-bar.tsx beside them), renderers/basic/data-list.tsx, metadata-admin/previews/block-config.ts — git diff --quiet exits 0 on all eleven. data-objectstack/src/index.ts is +33 / −0 in one hunk, @@ -5334,0 +5335,33 @@ export class ObjectStackAdapter, so "+33 at :5335" is exact; listMetadataItems sits inside it at :5352; the file goes 7282 → 7315 lines; it changed in 088e0f705 alone. A diff of lines 869-895 between the pins is empty (export function serializeOrderBy at :869), and so is one of 5066-5077 (if (Array.isArray(params.$filter)) at :5066): both reads are unmoved, as the sentence says.

3. FAIL point 3, the changeset and the body — now true. .changeset/objectui-pin-citations-088e0f705520.md's hop paragraph now reads "Files that three records cite changed on the hop, all for objectui#12175", with one bullet per file carrying the facts in 1, 2 and the previous record's form.tsx reading (+3 at :595-597, also 088e0f705 alone; spanLadderFor :275-302, call site :3326 → :3329), then "Every other record cites only files that are byte-identical across the hop". The body's "Pin citations" bullet says the same in the same three bullets and names the correction (378004003). Both are true on the sweep in 4. The changeset's frontmatter and level did not move (@objectstack/spec patch, Clause-②: no).

4. The re-sweep — no third false hop sentence. At the head, the 088e0f705 hop sentence appears in 41 asserting records across eight files (action-outcome-messages.test.ts 1, action.zod.ts 1, api-methods-batch-conformance.test.ts 1, component.test.ts 6, component.zod.ts 26, dataset.zod.ts 1, functional-completeness.ts 4, view.zod.ts 1): 38 carry the boilerplate "every objectui file this record cites is byte-identical across the hop from e5311165a", 3 are bespoke (the calendar record, §4b, and view.zod.ts:3432's FormField.span record, which names autoLayout.ts and fields' field-type-alias.ts — both byte-identical, plugin-form and plugin-detail autoLayout.ts alike). Spot-checked well past three: the cited files were resolved by reading each record and every one exits 0 under git diff --quiet across the hop — api-methods-batch-conformance.test.ts:59 (plugin-grid/src/ObjectGrid.tsx, hooks/useBulkExecutor.ts); action-outcome-messages.test.ts:3 and action.zod.ts:1328 (core/src/actions/ActionRunner.ts, the action renderers); dataset.zod.ts:266 (core/src/utils/dataset-format.ts, date-display.ts); component.test.ts:283 (renderers/layout/containers.tsx); component.zod.ts:5962 kanban (plugin-kanban/src/ObjectKanban.tsx, index.tsx), :9653 timeline (plugin-timeline/src/ObjectTimeline.tsx, renderer.tsx, index.tsx), :1083 (record-details.tsx, record-highlights.tsx, record-quick-actions.tsx, types/src/permissions.ts), :4681 / :4824 / :5243 (ObjectGrid.tsx, complex/data-table.tsx), :9231 (the five plugin shells' index.tsx); functional-completeness.ts's gantt, timeline and map rows (ObjectGantt.tsx, ObjectTimeline.tsx, ObjectMap.tsx, ListView.tsx). Then a mechanical cross-check the other way: the basename of each of the 54 hop paths, grepped over the eight files. Outside the calendar and §4b records, the only hop basename any record names is form.tsx, in the [#21464] inline-validation record at component.zod.ts:7225-7410 — that record is measured at the 9dfaca654311 pin, carries no 088e0f705 sentence and is not an asserting citation at this pin, so it has no hop sentence to be false. The 41 lines the previous record counted are the same 41; the two it named false are the two that changed.

5. The port (b) — exact. pull/22973/head is ef3d0764b9; its merge base with origin/main is 246edf5b39. git diff 6ef50e894b..55535f501b and git diff 246edf5b39..ef3d0764b9 are byte-identical — the index lines included, since the pre-images are the same blobs — over exactly .github/workflows/ci.yml (48 lines), scripts/check-test-suite-ceilings.mjs (320) and scripts/partition-test-shards.mjs (218), +502 / −84. Per commit, git patch-id --stable matches: 598bb69c11 = e6c7a6ce6c (3e1beb00…) and 55535f501b = ef3d0764b9 (4fe2905c…), each cherry-pick keeping the original subject and body. In ci.yml at the head both timing steps receive --event "$GITHUB_EVENT_NAME": the drift check at :1121-1122 and "Check the per-package suite-duration ceilings" at :1540-1542 (if: always()). None of the three paths is a GOVERNED_SURFACES row (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, docs/NORTH-STAR.md); Governed Surface Queue Guard is success on this head.

6. Nothing else moved (c). git diff 55535f501b..3780040031 is three files, +24 / −7: the changeset (+7 / −1, prose under the frontmatter), functional-completeness.ts (+8 / −3) and component.zod.ts (+9 / −3). Every changed line in the two .ts files begins * inside the two docblocks named in 1 and 2; no key, default, .optional(), required flag, enum member, describe string or export moves, and no test line. The net diff against the merge base e23eccb164 is now 23 files, +733 / −147: the previous 20 plus the port's 3. So Clause-②: no and both changeset levels stand exactly as 6119955714 ② judged them.

7. CI on the head (d) — 42 check-runs, all complete at 08:20Z: 38 success, 3 skipped, 1 superseded cancelled; no red, none pending. The skipped three are Auto Label and Check PR Size on the second pr-automation run (38220000047; their first runs on this head are success) and Packed-tarball smoke (opt-in). The cancelled one is the Single-Claim Path Guard run in ③, whose re-run is green. Green by name: Build Core, Build Docs, both Check Changeset, Check Documentation Links, Console Pin Gate, Dogfood Regression Gate and its three shards, Dogfood Verify CLI, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Spec property liveness, Temporal Conformance (live PG + MySQL), Test Core and its six shards, Type Check · consumer gates / debt ledger / source gates / workspace, TypeScript Type Check, filter, and the four PR-context guards (each twice, once per pull_request event). The ported timing steps did what the port says: on the aggregate Test Core job (114723038009) all ten steps are success, "Check the per-package suite-duration ceilings" included, and it raised four warning annotations instead of a red — @objectstack/service-analytics 479.36 s over its 440.54 s ceiling, @objectstack/runtime 918.78 s over 913.09 s, @objectstack/cloud-connection 182.53 s over 163.89 s, @objectstack/client 225.69 s over 179.74 s — each ending "Report only on a pull_request run: this gate exit-grades on schedule runs alone". On Test Core (6/6) the step "Check this shard's timing drift" is success with one warning annotation (2951.5 s measured vs 1867.6 s predicted across 14 packages, 1.58×, "past the red bound … Report only on a pull_request run"); the other five shards' drift steps are success with no annotation. On 6ef50e894b the ceilings step was the one red (6119955714 ①6); on this head the same class reports, which is the port's whole effect on CI. None of the packages named is in this diff.

8. The base. origin/main is a2240c4dcf, eight commits past the merge base; none touches a path in this PR, the old pin e5311165a survives on main only in the three files this PR moves (.objectui-sha, objectui-lockstep.json, sdui-manifest.record.json), and git merge-tree --write-tree origin/main 378004003 is clean. #22973 is open, not merged (head ef3d0764b9).

② Semver level

Unchanged from 6119955714, re-read on the delta only: .changeset/console-088e0f705520.md @objectstack/console minor and .changeset/objectui-pin-citations-088e0f705520.md @objectstack/spec patch, both Clause-②: no, the body's line 2 Clause-②: no; the delta touches no frontmatter and no accept set. The citations changeset's hop paragraph, the one thing ② held against the previous head, is now true (①3, ①4). Both Check Changeset runs are success on this head. No subject carries ! and no entry is declared breaking, so no ADR-0087 marker is owed.

③ Boundary flags

• The port rides this PR as well as ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973. The same two patches now sit on two open PRs; whichever lands second applies an already-applied change, which a textual merge takes cleanly only while nothing else moves those three files (today nothing on main does — ①8). Not a defect of this PR; the owning seat should land them in whichever order and expect the second to need a rebase if those files move first.
• The cancelled check. Single-Claim Path Guard run 38219957459 (07:50:00Z) is cancelled by concurrency: the body rewrite raised a second pull_request event 25 s later and run 38219999905 on the same head is success; the cancelled job's own step "At most one open PR may modify a declared single-writer path" had already completed success. It is a superseded run, not a red.
• The timing warnings widened. Four packages over ceiling on this head against two on the previous one, and one shard's drift past the 1.5× red bound; none in this diff's paths, all report-only on pull_request by the port's design, graded on the next hourly schedule run on main. Not this PR's to fix; noted for the seat that owns ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's floor.
• Carried from 6119955714, unchanged by the delta: the pin and its gate (①1 there), the SDUI artefacts and lockstep (①2), the comment-and-string-only spec edits (①3), the form.tsx reading and the six migration counts (①4), the three comment-only tests (①5). The browser check and objectui#12200 stand as flagged there; feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939 is still the other half of D's gate.
• Dev claims not re-run (read-only shape): both scripts' --self-tests, the local Console Pin Gate steps, dispatch-gates --ran 125 families, the spec suite. Nothing this record needed was NOT MEASURED.
• State. 23 files, no governed-surface path; head repo is the base repo; draft, auto-merge unarmed. Implemented-by is the dev's session id, as a mode:remote dispatch records it.
• Independence. Reviewed-by names the seat session that holds the claim; the verdict was rendered by an isolated reviewing subagent of that session with the inputs listed above and no others.

Implemented-by: session_013XKtmoR5QCUSTMjiQ3os49
Reviewed-by: session_01Rerax7QTjKMPCUZxQUtPFR

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Seat ACCEPT: #22967 (the console pin hop objectui e5311165a8d6 → 088e0f705520) at 378004003; queued on green

Epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian), seat epic:#15194, 2026-10-12T08:22Z.

• Developer: session_013XKtmoR5QCUSTMjiQ3os49.
• Dispatch and the .objectui-sha single-claim: 6118841421.
• Order: step 3 of 6118044018, after feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874 (merged as e23eccb164).
• Next ruling: the first next waits for this full console (6119234024).
• Contract review:
  • FAIL 6119955714 on 6ef50e894b, on hop prose alone;
  • delta PASS 6120490239 on 378004003. It re-swept every hop sentence; the port is patch-identical to ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973; no third false sentence was found.

What the hop carries: objectui 2498a0753 (#12173), 83b9fade2 (#12174, Q3b, approver names by position) and 088e0f705 (#12175, PR-5, the position-ref / permission-ref grant pickers). The review read these as exactly the range, all three on objectui main.

Checklist, read on GitHub, not from the report:

• PR form: base main; Part of #15204, then Clause-②: no; no closing keyword; assignee marchtian. Not governed. 23 files, +733/−147, under 3,000: the 20 of the hop round plus the 3 ported ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973 files.
• The pin and its gate: .objectui-sha is 088e0f705520, a descendant of e5311165a8d6. Console Pin Gate is green. Locally the developer ran:
  • build-console.sh at the pin;
  • check:console-sha;
  • check:console-injection --require-stamp.
• SDUI:
  • sdui.manifest.json is byte-identical across the hop (the record's sha256 is unchanged);
  • the lockstep record changes rev, revDate and recordedAgainstPin only, because objectui's packages/sdui-parser is byte-identical across the hop.
• Spec edits: comments and citation strings only. No shape, default or export moved (review ① 3). The three edited tests change comments only.
• Citations:
  • form.tsx (spanLadderFor :275-302 held; call site :3326 → :3329);
  • the 6 migration entries' counts (corpus 8519);
  • --verify-anchors 55 match and 13 verified.
  • The two hop sentences and the changeset paragraph that the FAIL named are corrected in 378004003: the calendar record's en / zh / de packs, the §4b record's data-objectstack/src/index.ts, and three changed cited files named besides form.tsx.
• Changesets:
  • console-088e0f705520.md: minor, as feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874's pin move;
  • objectui-pin-citations-088e0f705520.md: @objectstack/spec patch;
  • both carry Clause-②: no.
• The port: 598bb69c1 and 55535f501 are ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973's two commits for ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's ruling (6119186511), ported as on W2 (ACCEPT 6120417056). They touch ci.yml and the two timing scripts only, and no-op when ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973 lands.
• Browser (the developer, against this dist with feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939's metadata): both grant fields render as registry pickers (16 positions, 17 sets), and a pick wrote both rows. everyone is still listed in the position picker; that is Position picker (position-ref widget) lists the everyone audience anchor, which the server refuses as a grant target; filter the audience anchors out of the grant picker objectui#12200 (domain:ui), a known limitation for the first next. The server refuses an audience anchor as a grant target.
• CI on 378004003: 42 check-runs: 38 success, 3 skipped (Auto Label and Check PR Size on the second pr-automation run, whose first run is success; Packed-tarball smoke (opt-in)), and 1 cancelled. The cancelled run is a superseded No other open PR may claim the same single-writer path; its later run on this head is success. Test Core and all six shards are green. mergeable_state is clean.

Then: flipped ready and enqueued in this same stroke. On MERGED, a Landed record. Main's console is then the full new console the first next waits for.

---

Generated by Claude Code