chore(objectui): move the console pin to 7578323a544e (objectui#12200) (#15204 C9)

[objectstack-fleet]

Part of #15204
Clause-②: no

The console pin hop 9646e2ed2bf3 → 7578323a544e (objectui main, 7578323a544e31d574804ae931b595e8f9f92c21, exactly that commit). This hop exists for objectui#12200 (a491b64a6): the position-ref grant picker on Setup's user page stops offering the audience anchors everyone and guest, which no grant can name. This is the open finding #22967 and #23018 carried.

Tier: no governed surface (GOVERNED_SURFACES in scripts/pm/check-governed-merges.mjs). 20 files, the same shape as #23018.

The hop: 25 objectui commits, 288 paths, all on objectui main

Among them: a491b64a6 (objectui#12200, the reason for this hop); 38bb37333 (objectui#12201: app identity moves into the top bar); 7578323a5 (objectui#12198: a page route's breadcrumb drops the 「Pages」 crumb); f5b66bf97 (objectui#12217: an empty gallery draws the grid empty state); 334f0cff9 (objectui#12191: mailto: through one navigation-target answer); 6fb281d64 (objectui#12163: a widget's component envelope takes a metric-card only); b2316074a (objectui#12156: file / image size limit is maxSize); 54159d329 (objectui#12187: the boot screen's one honest line); fa778e67f (objectui#12190: a locked tier mark instead of a paywall button); and 16 more fixes, CI and docs commits, listed in the console changeset.

The pin round, as #23018's

Console Pin Gate steps, run locally (each exited 0):

1. Client build: turbo run build --filter=@objectstack/client....
2. scripts/build-console.sh at the pin.
3. check:console-sha: "Console dist matches the objectui pin (objectui@7578323a544e)".
4. check:console-injection --require-stamp.

Artefacts that travel with the pin:

• Console changeset. scripts/bump-objectui.sh generated .changeset/console-7578323a544e.md: @objectstack/console minor (the level the script derived and the one chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018 used). It has 29 releasing entries, 2 release-nothing and 2 commits with no changeset (listed by subject). Clause-②: no was added by hand, as in chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018.
  • New this hop: 5 entries are breaking by their authors' annotation (none declares major, and no commit subject carries !). So the script wrote an adr-0087: TODO placeholder. It is answered not-required (no-migration-prescription), the disposition every earlier pin hop with annotated breaking entries used (chore(objectui): bump the console pin to 20c6d351ad74 (carries objectui#12056) #22592, chore(objectui): bump the console pin to a58626c88dc8 (carries objectui#11670 and #11669) #22015, chore(objectui): bump the console pin to 0df67f237c5a (carries objectui#12089) #22812, feat(spec,metadata-protocol)!: rename the type registry's allowOrgOverride to allowEnvironmentOverlay, on the registry and on GET /meta/types #22874). Each entry is answered against this tree:
    • objectui#12198 and objectui#12190 retire @object-ui/i18n pack keys, and feat(runtime): flow clone action — whole-definition copy, mandatory new name, no ancestry (ADR-0126 §7.1) #12190 also renames a test id. Nothing here reads either key or the old test id.
    • objectui#12163 narrows a widget component envelope that @objectstack/spec already refuses (QUARANTINED_WIDGET_KEYS); no example dashboard authors component or data.
    • objectui#12156 makes maxSize the one spelling, which FieldSchema already declares; no example or package authors any old key.
    • objectui#12187 retires boot-splash pack keys and changes the splash line; this repo's two splash readers already accept both lines and the data-boot-splash marker.
  • check-adr-0087-registration --base origin/main reads the disposition; check:objectui-changeset passes.
• SDUI manifest. node scripts/gen-sdui-manifest-node.mjs: sdui.manifest.json is byte-identical across the hop (107 components), and scripts/sdui-manifest.record.json is re-recorded at the pin. check-sdui-manifest passes.
• Lockstep record. pnpm gen:sdui-lockstep re-records packages/sdui-parser/objectui-lockstep.json at 7578323a544e. objectui's packages/sdui-parser/src is byte-identical across this hop; check:sdui-lockstep passes (214 grammar lines, 25 codes, the predicate). No parser port is owed.
• Pin citations, re-measured for this hop only:
  • Every objectui file named in every asserting record was resolved at the pin and checked with git diff --quiet 9646e2ed2bf3 7578323a544e -- <path>, one file at a time. Bare names were resolved by context; the only changed candidate among them, app-shell's ObjectView.tsx, is named only in the kanban record's history.
  • Three cited files changed; every cited line held its text, and the moved ones are re-pointed:
    • plugin-list/src/ListView.tsx (+34/−79, objectui#12217). One import line was added at :16 and a four-line docblock near :1040; the other hunks change lines in place (:10, :12, :1044) or sit at :5677 and below.
      • The kanban / calendar / timeline / gantt / map / tree arms moved +5 (3767 / 3818 / 3907 / 3964 / 4084 / 4125-4149).
      • resolveListMapConfig moved :209 → :210, FLAT_MAP_CONFIG_SPELLING :95 → :96 and resolveTimelineDateBinding 695 → 696.
      • Each moved span is byte-identical (diff of the old and new ranges is empty).
      • Hand-written sentences went into the functional-completeness calendar / gantt / timeline / map rows, the object-gantt and flat-TreeConfig records, and the map-config record in view.zod.ts. That last record is a dated "RE-READ at pin" record that --verify-anchors caught: its two quoted anchors were one line off, and both are re-pointed. The tree record's 4120-4144 is re-pointed too.
    • core/src/actions/ActionRunner.ts (+39/−23, objectui#12191). Eleven import lines were added above composeSuccessMessage, which moved 1498 → 1509 with its body byte-identical. The outcomeMessages record re-points its anchor, and it and the action-outcome-messages.test.ts header say so. The four action renderers are byte-identical.
    • The en / zh / de packs: the calendar.configRequired strings did not change and moved en :949 → :953, zh :725 → :726, de :705 → :706.
  • Every other record (31 by script with asserts, plus the curated-blocks, action-group and FormField.span records) cites only byte-identical files, and each gains a hop sentence.
  • The six migration entries were recounted with git grep -o -F, which reproduces every 9646e2ed2bf3 figure. The corpus is 8600 files, and a superset of every export and key each entry names reads 0 (unrelated Span 519 / SpanSchema 57, unchanged). Controls moved, e.g. objectstack 18438 → 18552, timeout 1707 → 1686, tenant 1393 → 1404.
  • check:objectui-pin-citations --verify-anchors: 55 asserting citations match 7578323a5, and 13 quoted anchors verify. content/docs/references/ui/view.mdx was regenerated by the build (the describe's pin stamp, two rows).
  • Changeset .changeset/objectui-pin-citations-7578323a544e.md: @objectstack/spec patch, Clause-②: no.

Browser check, against this branch's built console

examples/app-showcase was booted --fresh (Playwright, Chromium). The walled run used the same local, uncommitted harness as #23018: the @objectstack/organizations dependency, plus OS_PLATFORM_OWNER_EMAIL=admin@objectos.ai and OS_AUTH_MEMBERSHIP_POLICY=invite-only. Both files were reverted afterwards, and neither is in this diff.

• position-ref (objectui#12200), under single, as the operator, on a user's Positions tab: the picker lists 15 positions, and neither everyone nor guest is offered (chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018 measured 17, with both). Picking auditor and pressing Create wrote the grant (POST /data/sys_user_position → 201, confirmed via the data API). permission-ref is unchanged: 18 sets, and showcase_auditor was written (201).
• Walled catalog pages (isolated, served degradedTenancy: false). The tenant holds org-scoped manage_metadata, has isPlatformAdmin: false, and gets a server 403 on PUT /meta/position. On position / permission-set lists and editors it sees no New / Save / Clone and the walled reasons (catalog-readonly-reason, walled-catalog-readonly-banner, perm-walled-readonly). The operator gets New, Save and an editable position editor, and a label edit auto-saved (PUT /meta/position/wall_demo_pos?mode=draft → 200). Unchanged from chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018.
• App identity in the top bar (38bb37333), on the showcase app and on Setup: the app pill (glyph, name, chevron) sits at the left edge, the platform mark is gone and PREVIEW sits beside search, the Studio entry reads "Edit app", and the sidebar has no logo header. The page breadcrumb goes app › page with no 「Pages」 crumb (objectui#12198). No page errors.

Verification (local)

• full turbo run build green (74/74, none cached); check:generated green;
• dispatch-gates --ran: 125 derived families. The sweep was running when this draft opened, and its verdict follows in a comment, as on chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_018yfmohHttjK9aTbKnZLuDr

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/sdui-parser, @objectstack/spec, touching 14 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/analytics.mdx (via DatasetMeasureSchema (symbol, a top-level const))
• content/docs/protocol/objectui/layout-dsl.mdx (via ComponentPropsMap (symbol, a top-level const object))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageTabsProps (symbol, a top-level const object))
• content/docs/releases/v17/17-1.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-3.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-4.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-5.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-7.mdx (via ComponentPropsMap (symbol, a top-level const object))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/spec/src/kernel/functional-completeness.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e49aaec733d5cebd82a6b2e5521cdaae998b5b8d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3d49a97f5cd10d71844996b15deffcff5b4d831c — the merge of head 2d054b8dde3650223524ce14794549189b82aac9 into base e49aaec733d5cebd82a6b2e5521cdaae998b5b8d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3d49a97f5cd10d71844996b15deffcff5b4d831c && git checkout 3d49a97f5cd10d71844996b15deffcff5b4d831c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e49aaec733d5cebd82a6b2e5521cdaae998b5b8d 2d054b8dde3650223524ce14794549189b82aac9 && git checkout -B drift-repro e49aaec733d5cebd82a6b2e5521cdaae998b5b8d && git merge --no-ff 2d054b8dde3650223524ce14794549189b82aac9

node scripts/docs-audit/affected-docs.mjs --json e49aaec733d5cebd82a6b2e5521cdaae998b5b8d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e49aaec733d5cebd82a6b2e5521cdaae998b5b8d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2d054b8dde3650223524ce14794549189b82aac9
Local-runs: none

Console pin hop #3 (card #15204, dispatch and claim 6125834452; the first next waits for it, ruling 6125978136). Read: the card body and the comments bearing on this hop, the PR body, its 20 files and its diff against main (merge base df7a137923; main has moved 4 commits since, all in packages/organizations, no file in common), objectui at 7578323a544e and 9646e2ed2bf3 in a scratch clone (git diff --quiet per file, git show per anchor), the pin-round scripts and .changeset/pre.json on main, and the head's check-runs, read at 14:33Z and again at 15:02Z (the final read, below). The precedent hunted for is #22967's FAIL 6119955714: a "byte-identical" sentence on a file that changed.

① Derived judgments

(a) The pin and its gate. .objectui-sha is exactly 7578323a544e31d574804ae931b595e8f9f92c21; 9646e2ed2bf315a6ae99b2a1633bc7c7d162f7b9 is its ancestor (merge-base --is-ancestor), both on objectui main. The hop is 25 commits, all first-parent (linear), 288 paths; a491b64a6 (objectui#12200) is among them, as are the eight the PR names. Console Pin Gate on this head is skipped, by design, not by filter: ci.yml's console-pin job carries github.event_name != 'pull_request' && != 'merge_group' (the two-speed split, #22998), so it never runs on a PR and judges the pin on main's push and hourly battery after merge. The developer's four local steps (client build, build-console.sh, check:console-sha "dist matches objectui@7578323a544e", check:console-injection --require-stamp) are the only pre-merge evidence, the same shape #23018 landed on. Right.

(b) The SDUI artefacts. sdui.manifest.json is not in the diff and is byte-identical to main; at the head it holds 107 components and its sha256 (a799c55a…4db4) equals scripts/sdui-manifest.record.json's sha256, whose only moved fields are objectuiSha and modulesRoot (.cache/objectui-7578323a544e/apps/console); check-sdui-manifest's staleness clause (record sha equals the pin) is satisfied. packages/sdui-parser/objectui-lockstep.json moves rev, revDate (2026-10-12T13:34:53+00:00, which is 7578323a5's committer date) and recordedAgainstPin only; I recomputed the grammar region of objectui's parse.ts at the pin from the recorded delimiter to end of file: 214 lines, blob 0131f27cf86d…, equal to the record; 25 diagnostic codes and the containment predicate are carried unchanged. objectui's packages/sdui-parser/src is byte-identical across the hop (git diff --quiet on the directory). No parser port is owed. Right.

(c) The spec source edits. A mechanical sweep of every changed line under packages/spec/src finds exactly one line that is neither a comment line nor a string-continuation line: the FormField.span describe in view.zod.ts, and inside it only the pin token (9646e2ed2bf3 to 7578323a544e) moves; z.enum(['auto', 'full']).default('auto') is unchanged. The six migrations/entries/semantic/18.* edits are inside description string literals (pin sha, corpus 8540 to 8600, the control counts). functional-completeness.ts, component.zod.ts, action.zod.ts, dataset.zod.ts and the three tests change comment text only. No accepted shape, default, required flag, enum member or exported symbol moves. Clause-②: no and patch on the spec changeset are right.

(d) The citations, the #22967 class — hunted file by file, not sampled.

• I scanned every docblock and // run in packages/spec/src at the head for the blanket sentence "every objectui file this record cites is byte-identical across the hop from 9646e2ed2" (joined across wrapped comment lines): 32 blanket records plus 4 named-list records. For each, every objectui file name in the same docblock was resolved at 7578323a544e and checked with git diff --quiet 9646e2ed2bf3 7578323a544e -- path. Zero blanket records cover a changed file. The one blanket record that names changed files is the object-kanban row cap (component.zod.ts 6167–6453), and its own sentence carves them out: "ListView.tsx and ObjectView.tsx, named below only as an earlier re-read's record … (ListView.tsx and app-shell's ObjectView.tsx changed on this hop)". Confirmed: packages/app-shell/src/views/ObjectView.tsx changed (+4/−3, objectui fa778e67f and f38a42827); packages/plugin-view/src/ObjectView.tsx is byte-identical.
• plugin-list/src/ListView.tsx: hop diff is +34/−79 with hunks at :10, :12 (in place), +:16 (the ListEmptyState import), +1039–1042 (a four-line docblock), :1044 in place (useListViewTranslation exported), and 5677 down. So lines 17–1037 shift by one and 1040–5676 by five; I diffed both shifted regions whole (old 17–1037 vs new 18–1038; old 1040–5676 vs new 1045–5681): empty. Every anchor the PR names reads the quoted text at both pins: FLAT_MAP_CONFIG_SPELLING 95→96, resolveListMapConfig 209→210, resolveTimelineDateBinding 695→696, case 'kanban' 3762→3767, calendar 3813→3818, timeline 3902→3907, gantt 3959→3964, map 4079→4084, tree 4120–4144→4125–4149 (the 25-line arm diffs empty; labelField: treeCfg.labelField || 'name' is at :4145).
• core/src/actions/ActionRunner.ts: +39/−23; the only hunks above the reader add 1 + 10 = 11 lines (classifyNavigationTarget import and NAVIGATION_TARGET_REFUSAL), the next hunk starts at old 1648. composeSuccessMessage is at 1498 and 1509, and old 1498–1647 vs new 1509–1658 diffs empty. The outcomeMessages record in action.zod.ts re-points to :1509; the four action renderers are byte-identical (scan).
• i18n/src/locales/{en,zh,de}.ts changed (en +17/−9, zh and de 9/9); calendar.configRequired is textually identical at en 949→953, zh 725→726, de 705→706. en.ts carries exactly the five commits named (7578323a5, fa778e67f, 38bb37333, b2316074a, 54159d329).
• Quoted anchors: all 13 (the ASSERTED_ANCHOR_FLOOR) verify at the pin, including the two the PR says --verify-anchors caught in the dated map-config record of view.zod.ts (ListView.tsx:210 first line function resolveListMapConfig(…; ListView.tsx:96 first line export const FLAT_MAP_CONFIG_SPELLING = {), and plugin-view/src/ObjectView.tsx:2479 case 'map':, objectql.zod.ts:2523 / :1506, ObjectMap.tsx:449 / :454. No asserting citation names a sha other than the pin. The CI owner of this gate, Type Check · source gates (check:objectui-pin-citations), is green on the head.
• Out of population, stated so the next reader need not re-derive it: eight more anchored objectui files changed on the hop (plugin-form/src/{ObjectForm,DrawerForm,ModalForm}.tsx, plugin-form/src/sectionFields.ts, fields/src/widgets/LookupField.tsx, app-shell/src/views/RecordDetailView.tsx, app-shell/src/hooks/useConsoleActionRuntime.tsx, types/src/field-types.ts, types/src/zod/complex.zod.ts). Every record naming them is a dated pin record or carries no pin claim (none asserts = 7578323a5), which the gate deliberately excludes; no byte-identical sentence covers them.
• content/docs/references/ui/view.mdx: the two span rows' text equals the describe string character for character (after the generator's \| escaping), both rows are identical, and no old sha remains in the file. A regeneration, not a hand edit. Right.

(e) The changesets and ADR-0087. The hop adds 31 changesets across 23 of the 25 commits; 2 are release-nothing (12204, 12202) and 2 commits carry none (5039e8117, 21fdeb34d, both ci:), so "29 releasing of 31, 2 release-nothing, 2 no changeset" is exact. The highest declared level is minor (several minor, no major), which is the digest's rule for the console bump; the Clause-②: no line is hand-added (the digest emits none). The five breaking entries are breaking by annotation only, none major, no ! subject. Each not-required (no-migration-prescription) line, judged against this tree at the head and objectui at the pin:

1. objectui#12198, console.breadcrumb.pages: 0 occurrences in this repo outside changesets. Right.
2. objectui#12163, the widget component envelope: ui/dashboard.zod.ts:188–189 quarantines component and data (QUARANTINED_WIDGET_KEYS), so no authored dashboard here can reach the envelope; the eight *.dashboard.ts files under examples/ author neither key. objectui's own changeset carries a FROM/TO prescription, but it is objectui's consumer prescription for @object-ui/types; nothing in sys_metadata or any objectstack-authorable key moves, so objectstack migrate meta has nothing to rewrite. Right.
3. objectui#12190, environment.addEnvironment and test id environment-add-upgrade: 0 occurrences. Right.
4. objectui#12156, maxSize: declared at data/field.zod.ts:1376; FieldSchema is a strictObject (aliases maxFileSize / maxBytes to maxSize), so max_size, max_files, max_width, max_height are refused; none is authored in examples/ or packages/ (the only max_size hit is scripts/pr-labels.mjs's unrelated xs_max_size). Right.
5. objectui#12187, the splash: the four retired keys have 0 occurrences; the two readers here, examples/app-showcase/e2e/showcase-smoke.spec.ts:110–111 (BOOT_SPLASH_LINE = /Initializing application|Opening your console/i, [data-boot-splash]) and docs/qa/platform-checklist/areas/platform-core.json's boot-splash clause, already accept both lines and the marker. Right.
   The gate's mechanical refusal (a prescription in THIS changeset's body) does not fire: the console body carries the digest's truncated entry lines and no FROM/TO of its own; Check Changeset (runs check-adr-0087-registration --base and check-changeset-no-major) is green. not-required is right for all five; no migration prescription is owed by this repository.
   Clause-②: no for this repository: the line answers 「本卡放宽接受集或扩大公开面吗」 for THIS diff. objectui's 38bb37333 declares Clause-②: yes for an additive AppSwitcher prop and three @object-ui/i18n keys — surfaces of objectui's packages, which this repo does not publish; @objectstack/console ships a built SPA, and the diff widens no objectstack accept set and adds no export (the sweep in (c)). The breaking-ness the hop carries is declared by the five **BREAKING** banners, which the ADR-0087 gate reads independently of the Clause line. no is right, as on chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018 and chore(objectui): move the console pin to 088e0f705520 (objectui#12175 PR-5, #12174 Q3b) (#15204 B2) #22967.

(f) The edited tests. api-methods-batch-conformance.test.ts (+4/−1) changes the docblock inside the SINGLE_RECORD_WRITE_ONLY record; action-outcome-messages.test.ts (+6/−1) changes its header docblock (the composeSuccessMessage move); component.test.ts (+24/−6) changes six // describe headers. The sweep in (c) finds no non-comment line in any of the three. No assertion is weakened.

(g) The browser check. 15 options on #23018's 17 is exactly the two anchors removed. objectui#12200 (a491b64a6) filters RegistryRefField on AUDIENCE_ANCHOR_POSITIONS imported from @objectstack/spec; this tree exports it (identity/position.zod.ts:166, index.ts:181, ['everyone','guest']), so the measured list is the code path, and the 201 on POST /data/sys_user_position shows the picker still writes. For objectui#12185: its seven source files under app-shell/src/views/metadata-admin/ are byte-identical across the hop (only packages/app-shell/README.md overlaps the 288 paths), so the walled re-run (tenant 403 on PUT /meta/position, no New / Save / Clone, the three reason test ids; operator auto-save 200) is confirmation of an unchanged surface under a changed shell — adequate. The harness is #23018's uncommitted local dependency and two env vars; none of the 20 files is under examples/. The top-bar identity claims match 38bb37333's commit record item by item. Adequate evidence.

(h) No collateral. 20 files: the pin, the two changesets, the regenerated view.mdx, the lockstep and manifest records, and the packages/spec/src re-measures. No CHANGELOG.md, nothing under content/docs/releases/, nothing under examples/, nothing outside the pin round's shape. Tier: no governed surface (Governed Surface Queue Guard green).

Check-runs on 2d054b8dde36 at the final read (15:02Z, 41 runs, all completed): no red and nothing pending. Green: Build Core, Build Docs, all six Test Core shards, every Lint · and Type Check · job, Check Changeset, Spec property liveness, Dogfood Regression Gate, Governed Surface Queue Guard and the three claim guards. Skipped by design, the only non-success conclusions: Console Pin Gate (above), the dogfood shards and Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke. At 14:33Z the same set had fourteen runs still in progress and Test Core (3/6) / (4/6) were the last two to finish.

② Semver level

• .changeset/console-7578323a544e.md, @objectstack/console minor: matches the hop's highest declared level (minor), as the digest derives it; the sentence census (29 / 2 / 2, five annotated-breaking, two _(no changeset)_ rows naming 5039e8117 and 21fdeb34d) reads true against the 25 commits. Right.
• .changeset/objectui-pin-citations-7578323a544e.md, @objectstack/spec patch: what publishes is description text (the span describe and six migration description strings) and comments; no key, default, enum member or export moves. Each sentence in it (the three changed files, the moved line numbers, 288 paths / 25 commits, 8600 tracked files) is reproduced above. Right.
• Clause-②: no on both, and on the PR: right for this repository (e).

③ Boundary flags

• Console Pin Gate skipped on the PR: answered — the two-speed design (skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998); the full battery on main judges the pin after merge, as it did for chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018.
• No check-run is red or pending at the final read (15:02Z); the five skips are design skips, each named above.
• The developer's "every other record cites only byte-identical files" is a claim about asserting records; the eight changed files cited only by dated records are out of the gate's population by design and are named above so the exclusion is visible.
• objectui 38bb37333's Clause-②: yes vs this PR's no: answered — different published surfaces (e).
• check:objectui-pin-citations --verify-anchors cannot run in CI (no ../objectui); the dev's 13-of-13 anchor verification is reproduced here against the scratch clone.
• The sweep's verdict comment the PR body promises (dispatch-gates --ran) is not on the PR thread at the time of this record; the head's check-runs are the gate verdicts this record reads.

Implemented-by: session_018yfmohHttjK9aTbKnZLuDr
Reviewed-by: session_01Rerax7QTjKMPCUZxQUtPFR

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Seat ACCEPT: #23061 (console pin hop #3, objectui 9646e2ed2bf3 → 7578323a544e, carrying objectui#12200) at 2d054b8dde; queued on green

Epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian), seat epic:#15194, 2026-10-12T15:04Z.

• Developer: session_018yfmohHttjK9aTbKnZLuDr.
• Dispatch and the .objectui-sha single-claim: 6125834452.
• Next ruling: the first next moves to tomorrow and waits for this hop (6125978136).
• Contract review: PASS 6126914178 on 2d054b8dde. Its citation sweep was file by file, not sampled: zero blanket records cover a changed file, which is the chore(objectui): move the console pin to 088e0f705520 (objectui#12175 PR-5, #12174 Q3b) (#15204 B2) #22967 FAIL class.

What the hop carries: 25 objectui commits on objectui main (288 paths), among them a491b64a6 (objectui#12200). With it, the position-ref grant picker stops offering the audience anchors, which the server refuses as grant targets. That removes a known limitation of the first next.

Checklist, read on GitHub, not from the report:

• PR form: draft, base main; Part of #15204, then Clause-②: no; no closing keyword; assignee marchtian. NOT governed. 20 files, the pin round's shape. No CHANGELOG.md, no content/docs/releases/. The trailers are Co-Authored-By: Claude <noreply@anthropic.com>, with no model name.

• The pin: .objectui-sha is 7578323a544e, a descendant of 9646e2ed2bf3. The developer's four local Console Pin Gate steps are each exit 0. In CI that gate is a design skip on PRs since skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998: it judges the pin on main's full battery after the merge, as for chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018.

• SDUI: the manifest is byte-identical (107 components, sha256 unchanged). objectui's sdui-parser/src is byte-identical across the hop, so no parser port is owed. The lockstep record moves rev, revDate and recordedAgainstPin only.

• Spec edits: comments and citation strings only. The one non-comment line is the FormField.span describe's pin token. No shape, default or export moved.

• Citations: three changed cited files.

  • ListView.tsx: every arm and helper moved, byte-identical.
  • ActionRunner.ts: composeSuccessMessage moved 1498→1509, byte-identical.
  • The en / zh / de packs: calendar.configRequired moved.

  The dated map-config record in view.zod.ts was re-pointed after --verify-anchors caught it. The migration entries reproduce at corpus 8600.

• Changesets and ADR-0087:

  • console-7578323a544e.md is minor: 29 releasing of 31, 2 release-nothing, 2 commits without a changeset.
  • Five objectui entries are annotated breaking (fix(driver-sql): carry an over-long UNIQUE index on a hash-shadow column (MySQL utf8mb4) #12198, feat(runtime): flow clone action — whole-definition copy, mandatory new name, no ancestry (ADR-0126 §7.1) #12190, finding: two packages/cli sites still restate the filePatterns glob-discovery rationale without its precondition, while three siblings now carry it #12163, L4: flow clone action — whole-definition copy, mandatory new name, no ancestry (ADR-0126 §7.1) #12156, docs(scripts): drop the removed GENERATED_SKILL_ARTIFACTS from the check-doc-authoring control entry #12187). Each takes not-required (no-migration-prescription) with a measured line, and the review confirmed all five against this tree.
  • Clause-②: no holds for this repository. objectui's 38bb37333 yes concerns objectui's own published surface.
  • objectui-pin-citations-7578323a544e.md is @objectstack/spec patch.

• Browser (the developer, against this dist):

  • position-ref offers 15 options, with no everyone and no guest, and still writes a grant.
  • permission-ref is unchanged.
  • Under isolated, the walled read-only catalog pages hold for a tenant, and the operator edits.
  • 38bb37333 moves the app identity into the top bar, with 0 page errors.

• Gates: dispatch-gates --ran 125/125 exit 0; spec 19,640 passed; sdui-parser 225 passed; turbo run build 74/74.

• CI on 2d054b8dde: 41 check-runs, 36 success, 5 design skips (the dogfood shards, Dogfood Verify CLI, Temporal Conformance and Console Pin Gate under skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998, plus Packed-tarball smoke), 0 red. mergeable_state is clean.

Then: flipped ready and enqueued in this same stroke. On MERGED:

• a Landed record;
• the seat reads main's full battery, where Console Pin Gate and the dogfood shards first judge this pin;
• the .objectui-sha claim is released, and later pin bumps go to domain:ui.

---

Generated by Claude Code