chore(objectui): bump the console pin to 89cad75d5570 (carries objectui 0858267e, 8001068b, 3ae91930 and d0fba91aa)

[objectstack-fleet]

Clause-②: no

Moves the bundled Console's objectui pin from 31971ff1e28f (the pin 17.6.0 shipped) to current objectui main, 89cad75d55702cc4f267bead5bf267de575d5842, so the Console carries the four fixes 17.6.0's release verification found missing (#21330, objectstack-ai/hotcrm#1982, and the "Known console issues" list in content/docs/releases/v17/17-6.mdx).

Range

31971ff1e28f..89cad75d5570: 64 non-merge commits, 74 releasing changesets (16 declared breaking), 14 release-nothing, 6 commits without a changeset. git merge-base --is-ancestor <c> origin/main exits 0 in an objectui clone for the old pin and for each fix commit below; 89cad75d5570 is origin/main.

Breaking entries: 990a2d616 (objectui retires its bare tree / view node-type keys and the bare field-widget fallbacks), 063832222 (@object-ui/plugin-designer TypeScript face), f9c8c4e45 (two @object-ui/core exports), 063119f2b (an unevaluable gate is a fault), 138ad4554 / 6aa029b63 (authored flex / object-grid take the properties bag), a1a44d621 (page refuses maxWidth / padding), e100589f3 (app mobileNavMode refused), 1a88ce22f (dashboard widget chartConfig.* structure keys).

The four fixes this bump carries

defect at 31971ff1e28f	objectui fix
Studio's dataset designer saves a count measure with field: '', refused 422 measures.0.field	0858267e (objectui#11402)
The datasource editor saves an External / Validate-only datasource without the external block, refused 400 since #21133	8001068b (objectui#11368)
Both page editors send the served requires back, so republishing an html page that gained a plugin component is refused 422 page-requires-disagrees-with-source	3ae91930 (objectui#11357)
zh-CN reverts to English on a full page load (objectui#11326; #21330 R4)	d0fba91aa

What changed here, and why

• .objectui-sha and .changeset/console-89cad75d5570.md, written by scripts/bump-objectui.sh --no-commit (auto level minor). The script's adr-0087: TODO placeholder is answered not-required (no-migration-prescription), in the wording the previous two bumps used, naming all 16 upstream breaking entries: each is objectui's own surface, or (chartConfig.*) mirrors keys ui/dashboard.zod.ts already retired and tombstoned.
• packages/sdui-parser/objectui-lockstep.json, re-recorded with pnpm gen:sdui-lockstep: 214 grammar lines, 25 codes, containment predicate 76c18fb95d1f, all unchanged; no port owed.
• sdui.manifest.json + scripts/sdui-manifest.record.json, from node scripts/gen-sdui-manifest-node.mjs over the tree pnpm objectui:build built at the pin: 107 components, none added or removed; object-kanban, object-calendar, object-gantt, object-timeline, object-map and object-tree changed their published inputs (objectui#11168 slices 3–5, objectui#11293).
• The 49 asserting pin citations in packages/spec/src (check:objectui-pin-citations turns red on any pin move), re-measured at the new pin: anchors mapped through each cited file's diff and re-read, block hashes and corpus counts re-taken with a method that first reproduced every 31971ff1e number. This regenerates packages/spec/src/migrations/registry.ts and content/docs/references/ui/view.mdx, and adds .changeset/objectui-pin-citations-89cad75d5570.md (@objectstack/spec patch, since the FormField.span describe and six migration descriptions name the pin). Records whose claims moved, not only their numbers: object-map's declared-block style precedence (mapStyle now first, objectui#11168 slice 3; the getMapConfig return quote is rewritten); object-tree's navigation read and ObjectTreeSchema mirror now carry the row's keys uncast, and objectui's record-source table drops the retired bare tree / view:tree keys (objectui#10859 batch 8); two object-timeline anchors that were already one line off at 31971ff1e are corrected. No key, default, enum member or export moves.
• No example, test or gate needed adapting for the breaking entries: the showcase's html pages compile flat JSX attributes, which the renderer still hoists, and its type: 'tree' view and field are spec-level types, not the retired bare node keys. The browser run below covers both.

Browser verification (examples/app-showcase, this branch)

pnpm dev -- --fresh --ui --no-watch -p 41733 (own ephemeral DB, seeded admin), check:console-sha = objectui@89cad75d5570, driven in headless Chromium (/opt/pw-browsers) with every request captured. A writable package com.acme.pinprobe with one object pinprobe_item was created through POST /api/v1/packages and the metadata API for the authoring checks.

defect	drive	result at 89cad75d5570
dataset field: ''	metadata editor on dataset pin_ds → Add measure → name row_count, Aggregate count, Field left blank → ⌘S	PUT /meta/dataset/pin_ds?mode=draft carries {"name":"row_count","aggregate":"count"} (no field key) → 200; publish → 200; the served measure has no field
datasource external block	Setup → Datasources → New datasource, SQLite :memory:, Schema mode External, then Validate only, no credential	POST /api/v1/datasources carries "external":{} → 201 for both external and validate-only
page requires echo	html page published with <box> only (served requires: ["ui"]); metadata editor Source → add <object-kanban objectName="pinprobe_item" groupBy="status" /> → ⌘S → publish	save body carries no requires → 200; publish → 200; the server stamps requires: ["ui","plugin-kanban"]
zh-CN on full load	/_console/apps/com.objectstack.account/component/approvals/inbox, localStorage['objectui-locale']='zh-CN', full reload	h1 审批中心, tabs 待我审批 / 我发起的 / 全部, <html lang="zh-CN">, i18n-locale-zh-*.js fetched (before the switch: "Approvals Inbox")

Smoke: sign-in lands on the /_console/home launcher; the showcase JSX home page (Capability Map, <flex> / <box>) renders; the showcase_task list grid; a task record page; the showcase_ops_dashboard dashboard with KPIs and charts; the Studio landing and the writable package's object surface. 0 page errors. Non-2xx responses were only 401 /auth/get-session before sign-in, 404 /usage/storage, 501 /ai/usage (no AI provider) and 404 ?state=draft no-draft probes. Only the PIDs this run started were stopped.

Gates and tests run locally

check-adr-0087-registration --base origin/main, check:console-sha, check:console-injection, check:sdui-lockstep, check-sdui-manifest, check:objectui-pin-citations (49 matching; --verify-anchors: 7 anchor content assertions verified at 89cad75d5), check:migration-registry, check:objectui-bump, @objectstack/spec check:generated (after gen:docs) — all exit 0. pnpm build exit 0. The console build passed its single-zod canary and spec-injection check. pnpm --filter @objectstack/spec test: 598 files, 17512 passed, 1 todo. pnpm --filter @objectstack/sdui-parser test: 218 passed. pnpm --filter @objectstack/spec typecheck: exit 0.

Environment, not a product change: objectui's jsdom needs Node >= 22.22.2; the container has 22.22.0, so a Node 22.23.3 was prepended to PATH for the console build and the dev boot.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/sdui-parser, @objectstack/spec, touching 12 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/analytics.mdx (via DatasetMeasureSchema (symbol, a top-level const))
• content/docs/protocol/objectui/layout-dsl.mdx (via ComponentPropsMap (symbol, a top-level const object))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageTabsProps (symbol, a top-level const object))
• content/docs/releases/v17/17-1.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-3.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-4.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-5.mdx (via ComponentPropsMap (symbol, a top-level const object))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 139 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 11905a4f8be1c7b47f8b5bea600ce4e60829782a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 20df9b78ebbc56c5829942c373f79900c2bb7c44 — the merge of head f2449fc18392d5171edec9902afa8122722210cf into base 11905a4f8be1c7b47f8b5bea600ce4e60829782a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 20df9b78ebbc56c5829942c373f79900c2bb7c44 && git checkout 20df9b78ebbc56c5829942c373f79900c2bb7c44
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 11905a4f8be1c7b47f8b5bea600ce4e60829782a f2449fc18392d5171edec9902afa8122722210cf && git checkout -B drift-repro 11905a4f8be1c7b47f8b5bea600ce4e60829782a && git merge --no-ff f2449fc18392d5171edec9902afa8122722210cf

node scripts/docs-audit/affected-docs.mjs --json 11905a4f8be1c7b47f8b5bea600ce4e60829782a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 11905a4f8be1c7b47f8b5bea600ce4e60829782a → pass the list as
args.docs, on the commit named under Which tree this was computed on.