[objectstack-fleet]

Requested by Elon · project thread

Fixes #25713

Clause-②: no
Metadata-protocol: none

What this does

Moves .objectui-sha from 2958f17e9c6a to objectui main b41ed7f68956c8cfda21bc790548361af81b09ac, the merge of objectstack-ai/objectui#13485 (the change behind objectstack-ai/objectui#13478: the translation preview draws the positions and permissions groups). This is the pin target the devx seat chose on the card (comment 6392376241), not objectui main HEAD.

• Compare: objectstack-ai/objectui@2958f17...b41ed7f (15 commits, all on objectui main; git merge-base --is-ancestor exits 0).
• .objectui-sha and .changeset/console-b41ed7f68956.md were written by scripts/bump-objectui.sh b41ed7f68956c8cfda21bc790548361af81b09ac --no-commit. Neither was hand-edited. The digest walked the range completely: 9 releasing changesets, 1 release-nothing, 6 commits with no changeset; objectui declared minor, recorded as patch.
• scripts/sdui-manifest.record.json was re-recorded by node scripts/gen-sdui-manifest-node.mjs over the tree scripts/build-console.sh built at the new pin. sdui.manifest.json itself is byte-identical (sha256 d1fde278ffd6…, 107 components), so objectui's public component registry did not change over the range.
• packages/sdui-parser/objectui-lockstep.json was re-recorded by pnpm gen:sdui-lockstep (see "In-place addition" below).

Why

At the old pin, objectui's @object-ui/app-shell fails tsc against this tree's spec, which declares the positions / permissions translation groups. So Console Pin Gate is red on main (schedule CI run 40136758584), and the release gate refuses a cut while it stays red. Version Packages #25640 is open.

Reproduction (local, the Console Pin Gate job's own steps)

Console Pin Gate runs only on push and schedule (its if: in ci.yml excludes pull_request and merge_group), so this PR's checks cannot show it. Instead, every step of the job was run locally on this branch: pnpm exec turbo run build --filter=@objectstack/client..., then bash scripts/build-console.sh, then the dist presence assertion, pnpm check:console-sha and pnpm check:console-injection --require-stamp. Heap was NODE_OPTIONS=--max-old-space-size=6144, because a 4-CPU / 15 GB cloud container OOMs app-shell's tsc at Node's default heap.

Pin	Tree	Result
2958f17e9c6a (old)	objectstack f3fea0a03d	RED, build-console.sh exit 2: @object-ui/app-shell:build: src/views/metadata-admin/previews/TranslationPreview.tsx(99,3): error TS1360: Type '{ objects: …; … 7 more …; settingsCommon: … }' does not satisfy the expected type (a Record keyed by the spec's translation groups, positions and permissions among them). Same failure as run 40136758584.
b41ed7f68956 (new)	this branch, head 8b7fcf45	GREEN, build-console.sh exit 0 (34/34 objectui tasks): bundle canary present; single-zod canary finds one literal {major:4,minor:6,patch:7} over 2291 assets; spec injection carries this tree's spec only (1 of 1 injected-only description present, all 3 pin-only absent, reference is objectui's own build of objectstack 47af3dde42bb); dist ready (66308 KB) from objectui@b41ed7f68956. Then pnpm check:console-sha exit 0 and pnpm check:console-injection --require-stamp exit 0.

The build at the new pin ran before the manifest re-record, so it printed the expected warning that the record still named 2958f17e9c6a. After the re-record, node scripts/check-sdui-manifest.mjs exits 0 at pin b41ed7f68956.

Acceptance after merge: the next schedule CI on main reads Console Pin Gate success. That run id will be reported on #25713.

Contract changes the range brings

None on what a metadata author writes. Every objectui changeset in the range declares Metadata-protocol: none. In detail:

• SDUI component registry: unchanged. The manifest is byte-identical, as above.
• sdui-parser lockstep: unchanged. objectui's packages/sdui-parser/src did not change over the range. The grammar region blob 0131f27cf86d, the 25 diagnostic codes and the not-a-container predicate blob 76c18fb95d1f all agree.
• objectui's own .objectstack-sha: 915e94049922 → 47af3dde42bb, by way of e649c2d91e (objectstack 18.1.0, objectui 0984c77e1). scripts/objectstack-pin.mjs accepted this tree standing in for it, with no dependency-name refusal.
• objectui release a3c0da922 (chore: release packages (#13289)): the @object-ui workspace version recorded in the manifest record moves from 18.0.0 to 18.1.0.
• Readiness work for the ui-merge (objectstack#25685 / cd70b7818, objectstack#25723 / c85408f): react and @types/react are pinned to 19.3.0, and zod is declared ^4.6.5, the range this monorepo declares. Workspace-root readers resolve one level up when the tree sits under ui/. Tooling only, no published behaviour changes. The console bundle still carries a single zod.
• objectui#13478 / b41ed7f68 (Clause-②: yes in objectui): isSpecTranslationData now also recognises a served translation document by the positions / permissions groups. That is the consumer catching up with the spec this repo already declares; this repo's contract does not change.
• Console behaviour: form actions open inside their app, create forms no longer lock fields through readonlyWhen, html / richtext values are sanitized with rehype-sanitize, settings evaluate visible through the expression interpreter and fail closed, and the chat UI leaves the first page load. All of it is listed in the changeset.

In-place addition (outside the claimed file surface)

pnpm check:sdui-lockstep reds on any pin move ([pin-moved]: its record was taken at 2958f17e9c6a), so the required lint job would be red without a re-record. Recorded with OBJECTUI_ROOT=.cache/objectui-b41ed7f68956 pnpm gen:sdui-lockstep, a clean detached checkout at the pin. Only objectui.rev, objectui.revDate and recordedAgainstPin move. The gate is then green: "this copy is byte-identical to objectui@b41ed7f68956 … agrees on all 25 diagnostic code(s) and on the not-a-container predicate". The four bounded-fix conditions hold: it is the same class as the manifest re-record (a pin-derived record); it is mechanical and generator-written; no in-flight claim holds packages/sdui-parser/** (#25711 and #25712 surfaces read); and the gate family was already in this diff's derived set. The file is not in @objectstack/sdui-parser's files[], so nothing it publishes changes and no extra changeset is needed.

Serial note

#25711 (ui-merge 4a) lists .objectui-sha in its claimed surface, because it deletes the pin files at cutover. This PR modifies that file. Whichever of the two lands second resolves a delete/modify conflict on it. No other ui-merge child surface is touched. origin/main was merged before each push (no new commits since f3fea0a03d).

Gates

• node scripts/pm/dispatch-gates.mjs --commands at head a2ad39d3: 75 families derived. 73 exit 0. 2 are NOT MEASURED locally, both exit 3 PREREQUISITE NOT MET: pnpm check:dual-build-cjs-loads needs a full pnpm build, and node scripts/check-plugin-teardown-shape.mjs --self-test needs an unshallow clone. CI runs both. --ran reconciliation: "75 derived famil(ies) accounted for — 73 run, 2 NOT-MEASURED".
• Among the 73: check-sdui-manifest, check:sdui-lockstep, check:console-sha, check:console-injection, check:objectui-changeset, check-changeset-no-major --base origin/main, check-empty-changeset --base origin/main, check-adr-0087-registration --base origin/main, check:nul-bytes, check:merge-driver.
• node scripts/pm/check-governed-merges.mjs --branch HEAD: 0 of 4 paths hit the register, so this PR is NOT governed. Size is +38 / -8.
• node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD: 3 commits clean.
• No package source changed, so there is no package test or typecheck to run. CI's required set judges the rest.

Acceptance notes

• The bump digest renders a changeset's declaration lines as its entry summary when the body opens with them. In this PR's changeset that shows as **patch** — Clause-②: yes Metadata-protocol: none (objectui b41ed7f68) and two Clause-②: no Metadata-protocol: none lines for cd70b7818. The same shape has already shipped in packages/console/CHANGELOG.md (for example, lines 256, 514 and 543). objectui's changesets now open with Clause-②: / Metadata-protocol: lines, so the first paragraph parseChangeset takes as summary is the declaration block, not the description. The changeset here is left exactly as generated. scripts/objectui-changeset-digest.mjs is in release(ui-merge): one release lane for both scopes — 39 @object-ui packages join the @objectstack fixed group, packages/console builds from ui/apps/console, both repos' pin scripts and sha files are deleted (parent #25677, 4a/6) #25711's claimed surface. Reported to the seat for filing; dedupe words: objectui-changeset-digest summary declaration lines Clause-② first paragraph.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3fea0a03df3f4859dd389899df5a4ea036d1545 → packageMentionDocs.

[objectstack-fleet]

Seat review (domain:devx, #6023): ACCEPT at a2ad39d3.

Read against dispatch order dispatch-25713.md:

• .objectui-sha → b41ed7f68956c8cfda21bc790548361af81b09ac, the target the card names (seat comment 6392376241). It is objectui PR fix(mcp): scope the tool bridge's openWorldHint: false to platform-registered names #13485's merge, on objectui main: the compare from 2958f17e9c6a reads 15 ahead, 0 behind.
• .changeset/console-b41ed7f68956.md is emitted by scripts/bump-objectui.sh from objectui's declared changesets, and the range line matches. Three of its entries render objectui's declaration lines (Clause-②: … Metadata-protocol: none) as summaries. That is a digest defect, not this PR's: it is filed separately, and this PR is not widened for it.
• scripts/sdui-manifest.record.json was regenerated by gen-sdui-manifest-node.mjs. sdui.manifest.json is byte-identical (sha256 unchanged, 107 components).
• packages/sdui-parser/objectui-lockstep.json was re-recorded by pnpm gen:sdui-lockstep, because check:sdui-lockstep reds on any pin move. The source files did not change. It was outside the claimed surface and is added to the claim on chore(console): move the objectui pin past objectstack-ai/objectui#13478 so Console Pin Gate builds against the spec of 47af3dde42 — main is red on the 22:01Z schedule CI #25713.
• check-governed-merges --pr 25735: no governed path, 46 lines. Tier S: lands under the standing grant on this ACCEPT plus green CI.

The thread reproduced Console Pin Gate locally with the job's own steps: red at the old pin (TS1360, TranslationPreview.tsx:99), green at the new pin (build-console.sh, check:console-sha, check:console-injection --require-stamp). The job does not run on pull_request, so the card's acceptance is the next schedule CI on main after the merge. The card thread reports it on #25713.

Serial: #25711 (ui-merge 4a) deletes .objectui-sha at cutover. This PR lands first, and #25711 merges main.

---

Generated by Claude Code