chore(objectui): bump the console pin to 31971ff (one zod instance in the vendored Console), add a single-zod canary to build-console.sh, and key the release console cache on the spec zod range (#21149)

Fixes #21108

Clause-②: no

Moves the console pin past objectstack-ai/objectui#11353, so the
vendored Console bundles one zod instance again. Adds a single-zod
canary to `scripts/build-console.sh`, and keys `release.yml`'s Console
dist cache on the spec's declared zod range.

## Target: `31971ff1e28f`, the minimal containing commit

`.objectui-sha` moves `e420df310f5b` ->
`31971ff1e28f89cfc45f0c19bc5b05e443f28b79`. That is the merge commit of
objectui#11353 itself, which closed objectui#11327. objectui `main` was
`2124d0411175`, 2 commits further on, when I chose the target.

Why not `main`:
- The two later commits are objectui#11293 (standalone `object-kanban` /
`object-calendar` honour `page` navigation through the host's record
navigator) and objectui#11165 (a docs example and its test). Neither is
needed by this card.
- objectui#11293 rewrites `plugin-kanban/src/index.tsx` and
`plugin-calendar/src/index.tsx`. Nine asserting pin-citation anchors in
`packages/spec/src` read those two files. Taking it would turn this
pin's citation re-measure into a navigation-claim change outside this
card.
- The procedure (`docs/releases-maintenance.md`) says the target is
decided in the objectstack issue. The card's unlock criterion is "a
commit that contains objectui#11353". The minimal containing commit
meets it and drags in the least.

Containment was measured on a private full clone of objectui (`rev-parse
--is-shallow-repository` = false):

| question | command | exit |
|---|---|---|
| pin is the objectui#11353 merge | `gh api …/pulls/11353` answers
`merged: true`, `merge_commit_sha: 31971ff…` | — |
| pin is on objectui `main` | `merge-base --is-ancestor 31971ff
origin/main` | 0 |
| old pin is inside the new range | `--is-ancestor e420df3
31971ff` | 0 |
| negative: new pin is not inside the old one | `--is-ancestor
31971ff e420df3` | 1 |
| control for that negative (deeper commit, same target) |
`--is-ancestor db11afd e420df3` | 0 |
| objectui#11293 is NOT in this pin | `--is-ancestor 2124d04
31971ff` | 1 |
| control for that negative | `--is-ancestor e420df3 31971ff`
| 0 |

The range `e420df310f5b..31971ff` is 44 commits.

## What changed

- **`.objectui-sha` and `.changeset/console-31971ff1e28f.md`.** Written
by `scripts/bump-objectui.sh 31971ff --no-commit` against the
private clone, so the shared shallow `../objectui` was never deepened.
The range has 56 releasing changesets, 12 declared breaking, and 3
commits carry no changeset.
- objectui#11353, the fix this bump exists for, is one of those 3. So I
added one lead sentence naming it; the digest would otherwise list it
only under "declared nowhere".
- The bump script's `adr-0087: TODO` placeholder is answered
`not-required (no-migration-prescription)`. It is worded after the
maintainer's ruling on the previous bump (#20949) and fitted to this
diff, and it names all 12 upstream entries. Three of them mirror
ObjectStack keys that are already retired and registered here:
`ui/ChartConfig:aria`, `ui/Page:assignedProfiles` and `ui/Action:aria`.
The `object-form` / `object-map` / `object-gantt` / `object-chart`
entries move objectui's validator onto the `properties` bag that the
spec rows already declare. `showFilters` was never an ObjectStack key on
`object-grid`. Please confirm this disposition; see the open question in
the report on #21108.
- **`sdui.manifest.json` + `scripts/sdui-manifest.record.json`.**
Produced by `node scripts/gen-sdui-manifest-node.mjs` over the tree
`build-console.sh` built at the pin: 107 components, `@object-ui/core`
17.6.0. Eleven components changed their published inputs: `object-form`,
`object-kanban`, `object-calendar`, `object-gantt`, `object-timeline`,
`object-map`, `record:quick_actions`, `element:text`,
`element:definition-list`, `element:repeater` and `action:button`.
- **`packages/sdui-parser/objectui-lockstep.json`.** Re-recorded with
`pnpm gen:sdui-lockstep` against the pin's own checkout: 214 grammar
lines, 25 codes, containment predicate `76c18fb95d1f`.
`check:sdui-lockstep` exits 0 with no port owed.
- **`scripts/build-console.sh`: the single-zod canary.** Details in the
next section.
- **`.github/workflows/release.yml`: the Console dist key.** Details
below.
- **The 49 asserting pin citations in `packages/spec/src`.** Re-measured
at the new pin (section below). This also regenerates
`packages/spec/src/migrations/registry.ts` (`gen:migration-registry`)
and `content/docs/references/ui/view.mdx` (`check:generated --fix`, the
one artifact it proved stale), and adds
`.changeset/objectui-pin-citations-31971ff1e28f.md` (`@objectstack/spec`
patch). The `FormField.span` describe and six migration-entry
descriptions name the pin, so the text change publishes.
- **`origin/main` merged twice.**
- First at `19cbfeba7d`: no file overlapped this diff, and no generated
artifact moved.
- Then `fbcc05f400`, at merge commit `8435a830eb`, through
`scripts/pm/os-regen-merge.sh`. There was one textual conflict, in two
docblocks of `packages/spec/src/ui/component.zod.ts`. main's #21005 and
#21141 are kept verbatim, and the pin citations were re-applied and
re-measured at `31971ff1e`. No regeneration commit is owed:
`check:generated` reports 15/15. That merge also moved the spec's zod to
`^4.6.5`; the console still bundles exactly one zod, `4.6.5`.

## The single-zod canary

It sits beside the existing bundle canary.
- It counts zod version literals across
`packages/console/dist/assets/*.js`. Each zod 4 instance carries one
version object (the `version` export of `zod/v4/core/versions`),
minified as `{major:4,minor:6,patch:5}`.
- It requires **exactly one** occurrence. It refuses two different
versions (the shipped defect), one version found twice (two instances),
and zero (a blind matcher, since the console always bundles zod).
- The same function runs standalone as `scripts/build-console.sh
--check-single-zod ASSETS_DIR`, which builds and writes nothing. That
standalone mode is how both directions below were measured.

| fixture | result |
|---|---|
| the real dist this PR's build produced at `31971ff1e28f` (2450
`assets/*.js`) | exit 0: `exactly one zod version literal
{major:4,minor:6,patch:5} in vendor-objectstack-UrN_Az-7.js` |
| the real `db11afd4967c` dist (the published two-zod split) | exit 1:
`2 different zod versions` —
`vendor-objectstack-CfLtdaY1.js:{major:4,minor:6,patch:1}`,
`vendor-zod-CHLW1iCr.js:{major:4,minor:4,patch:3}` |
| the new dist plus one chunk carrying `{major:4,minor:4,patch:3}` |
exit 1, two different versions |
| the new dist plus a second `{major:4,minor:6,patch:5}` chunk | exit 1:
`2 copies of ONE zod version literal` |
| the new dist with its one literal rewritten (`major` -> `MAJOR`; `grep
-o` count 1 -> 0 before, 0 -> 1 after) | exit 1: the blind-matcher
refusal |
| no argument | exit 2, usage |

The fixtures are copies in a scratch directory. No tracked file was
mutated.

## `release.yml`: the key carries the spec's declared zod range, not the
whole `package.json`

The card suggested `hashFiles('packages/spec/package.json')`. I went
with a narrower input:
- A new step reads `dependencies.zod` out of
`packages/spec/package.json`. It fails rather than emitting an empty or
`undefined` range.
- The restore, the `CONSOLE_DIST_CACHE_KEY` env and the save step all
spell the same key, with `-zod-RANGE` appended (today `-zod-^4.6.5`,
after the merge of `fbcc05f400`).

Why not hash the whole file: its `version` field moves on every Version
Packages merge, and that merge is the push that drives the publish lane.
Hashing it would make every publish a cache miss and a cold console
rebuild. The comment above the key records that design as deliberate.
The declared range is the input the build actually judges:
objectui#11353's parity assertion refuses a console zod outside it.

`release.yml` is not a governed surface. `GOVERNED_SURFACES` in
`scripts/pm/check-governed-merges.mjs` lists `docs/adr/**`,
`.claude/**`, `skills/**`, `AGENTS.md`, `CLAUDE.md` and
`docs/NORTH-STAR.md`. No workflow was run or dispatched.

## Pin-citation re-measure

Each record was handled the same way:
- Its anchors were mapped through the `e420df310f5b..31971ff` diff
of each cited file and re-read at the new pin.
- Block hashes (`git hash-object`) and corpus counts (`git grep -o -F`
over the tracked tree, 9912 files) were taken again with the method each
record names. The method reproduces every `e420df310` count exactly at
the old pin: 9800 files, `objectstack` 15352, `@objectstack/spec` 6024,
`timeout` 1293.
- Earlier hops stay as history.
- `check:objectui-pin-citations --verify-anchors`, run against the pin's
checkout, reports 49 asserting citations matching `31971ff1e`, and 7
anchor content assertions verified.

Records whose CLAIMS moved, not only their numbers. These want a human
read:
- **`object-calendar` `navigation`.** objectui#8652 declared the key on
`ObjectCalendarSchema`. That removes the one `as any` cast objectui#8651
had left: the ledger comment `1008-1025` is replaced by a declaration
note, and the read `1026` -> `1018` now says `schema.navigation ?? {
mode: 'drawer' }`.
- **`object-kanban` `navigation`.** The read is unchanged. It now
compiles through a declared `ObjectKanbanSchema.navigation` member
rather than `BaseSchema`'s index signature.
- **`object-timeline`.** objectui#8654 declared `navigation`. The read
lost its cast (`753-756` -> `793-796`), and both registrations gained a
`navigation` input. The `schema.*` read set is unchanged, because
`navigation` was already read and is already on this row.
- **`action:button`.** objectui#11168 slice 2 makes the `size` input
publish the five values the row declares. The `inputs` range grew
`414-551` -> `414-559`.
- **`record:quick_actions`.** objectui#10224 rewrote the fail-closed
docblock: the bar is replaced by the notice, not hidden. The cited gate
lines moved by 6 with their text byte-identical.
- **`object-tree` optionality count.** By the record's own method,
`plugin-map/src/index.tsx` now reads 4 `ElementDataSourceGate` hits, not
3. objectui#10859 batch 5 added a comment naming the gate, while the
wiring is still three lines. The record now says so.
- **Wrong when written.** The `object-timeline` data door's
start/end-binding anchor `621-622` began one line early, on the
`rawData.map` head, at `e420df310` too. It is re-pointed to `657-658`
and the record says why.

No key, default, enum member or export moves.

## Acceptance at the new pin

**Build.** `scripts/build-console.sh` ran at `31971ff1e28f` with this
tree's client and spec injected, under the shared verify lock: `VERDICT
command-exit 0`.
- The single-zod canary passed (above). `assert-console-spec-injection`
passed: 21 of 21 injected-only descriptions are present and all 8
published-only ones are absent.
- The dist is 63032 KB.
- Environment, not a product change: objectui's `jsdom` requires Node
`^22.22.2` under engine-strict, and this container's Node is 22.22.0. A
verified Node 22.22.2 was prepended to `PATH` for the console build
only.
- The build ran before the manifest regeneration, as the procedure
orders it. So that local dist ships the previous manifest bytes, and the
build itself prints the re-run step. CI's Console Pin Gate builds fresh.

**Boot.** `pnpm dev -- --fresh --ui --no-watch -p 41633` started the
showcase with its own ephemeral DB and the seeded admin.
`check:console-sha` reads `objectui@31971ff`. I drove it in
headless Chromium (`/opt/pw-browsers/chromium`) from `localhost`:
- **Studio "New package (writable base)"** (`/_console/studio`): the
dialog renders **Display name (`name`)**, **Package ID (`id`)** and
**Object namespace (`namespace`)**, plus Version, Type and Description.
- I filled `Zod Probe` / `com.acme.zodprobe` / `zodprobe` and clicked
Create package. The request was **`POST /api/v1/packages` -> 201**.
- The Studio opened `/_console/studio/com.acme.zodprobe/data`. `GET
/api/v1/packages/com.acme.zodprobe` answers 200 with `writable: true`.
- **Dashboard inspector**
(`/_console/apps/showcase_app/metadata/dashboard/showcase_ops_dashboard`):
the spec-derived form renders Columns, Gap, Refresh Interval Seconds,
Header, Show Title, Show Description and Actions. "Spec schema
unavailable" appears 0 times.
- **Report inspector** (`…/metadata/report/showcase_task_overview`):
Label, Report type, Description and Blocks render, with 0 "Spec schema
unavailable".
- **Control for that absence:** the string is in the shipped bundle
(`i18n-D40RWXZZ.js`, 3 occurrences), so 0 on screen is a reading, not a
missing probe.
- **Errors:** 0 page errors and 0 console errors across the drive.
- **Non-2xx:**
  - `401 GET /api/v1/auth/get-session` before sign-in.
  - `404 GET /api/v1/usage/storage`, as at the previous pin.
  - `501 GET /api/v1/ai/usage`, with no AI provider configured.
- `404 GET /api/v1/meta/{dashboard,report}/NAME?state=draft`, the
no-draft probe of a code-loaded item.
- **Teardown:** only the 7 PIDs I recorded were stopped. The port is
free, and the `--fresh` tempdir went with the process.

## Gates and tests, at head `8435a830eb` (re-run in full after the
merge: 151 derived, 151 run, 0 NOT-MEASURED, 0 UNRUN)

- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 151 commands, all run sequentially
with exit codes captured before any pipe.
  - 150 exit 0.
- `pnpm check:pm-dispatch-gates` hit my 900 s runner timeout under
contention (exit 124). Re-run alone with no timeout, it passed: exit 0,
`dispatch-gates self-test: 1976 cases pass`, battery 1096.7 s.
- `dispatch-gates --ran` reconciliation: `151 derived, 151 run, 0
NOT-MEASURED, 0 UNRUN`.
- Highlights: `check:objectui-pin-citations` 49 matching,
`check-sdui-manifest` intact at the live pin, `check:sdui-lockstep` OK,
`check:console-sha`, `check:console-injection`,
`check-adr-0087-registration` (2 declaring changesets, each with a
disposition), `check:generated` (15 of 15 current), `check:docs` (227 in
sync), `check:migration-registry`, `check:bash32-floor` (32 shell
files), `check:nul-bytes`, `check-ci-filter-parity` and
`check:published-files`.
- `pnpm --filter @objectstack/spec test`: 591 files, 17368 passed and 1
todo, exit 0. `pnpm --filter @objectstack/spec typecheck`: exit 0.
- NOT MEASURED, by CI only: the Console Pin Gate job's own steps and the
workspace type-check lanes. The local equivalent of the Console Pin Gate
is the build above.

## Acceptance notes

- `scripts/check-console-injection.mjs`'s header still says
release.yml's key "hashes the pin and the build script". That sentence
is now incomplete, because the key also carries the spec's zod range.
The file is outside this card's file surface. It is a comment, and
nothing reads it.
- objectui#11353 landed with no objectui changeset, so objectui's own
CHANGELOG does not mention the zod fix. The console changeset here names
it.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MRdbfpy4sQT8bUjmMhxsN7)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/console-31971ff1e28f.md

@@ -0,0 +1,99 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `31971ff1e28f`. This pin carries objectui#11353 (objectui `31971ff1e`): the console bundles one zod instance again, so the Studio's spec-derived forms render their fields — the New Package dialog creates a package and the dashboard and report inspectors show the spec schema. The previous pin shipped objectui's zod 4.4.3 beside the injected spec's 4.6.1. That commit carries no objectui changeset, so it is listed under "declared nowhere" below. Frontend changes in this range:
+
+Derived from the changesets objectui declared over the range — 56 releasing of 58 changesets added across 44 non-merge commits; omitted: 2 release-nothing changesets, 3 commits carrying no changeset (they ship no package code).
+
+- **minor** — `FormulaFieldMetadata` declares `@objectstack/spec`'s `expression` in place of `formula`, and three readers of a lookup's display pointer read the spec's `displayField` alone (obj… (objectui `19f484f54`)
+- **minor** — **BREAKING** — feat(types): an authored `object-gantt` takes its props in the spec's `properties` bag; the flat spelling is refused by name (objectui#10859, batch 6) (objectui `db0beb2aa`)
+- **minor** — `object-form.layout` publishes only `vertical` and `horizontal`. This is objectui#11168 slice 3 and delivers objectui#7759 group C. `@objectstack/spec` 17.5.0 retired `inline` and… (objectui `17dc16793`)
+- **minor** — The form layout mirrors state the two values the spec and the renderers honour. This is objectui#11168 slice 3 and delivers objectui#7759 group C. (objectui `17dc16793`)
+- **minor** — **BREAKING** — feat(layout): a navigation label written as an inline locale map renders in the viewer's locale; three inert resolver props retire (objectui#11299) (objectui `770cc5ba4`)
+- **minor** — fix(types): a navigation entry's `label` accepts an inline locale map, as the spec does (objectui#11299) (objectui `770cc5ba4`)
+- **minor** — **BREAKING** — feat(types): an authored `object-chart` takes its props in the `properties` bag; the flat spelling is refused by name (objectui#11276) (objectui `5262f7dd3`)
+- **minor** — `navigation` is declared on the `object-timeline` block, by reference to `@objectstack/spec` (objectui#8654). This is the timeline arm of the objectui#8652 maintainer ruling: the… (objectui `95bd23c90`)
+- **minor** — feat(types): a node bound through `dataSource.object` needs no `objectName` on the validator (objectui#11117) (objectui `0e6e76bc4`)
+- **minor** — feat(types)!: retire `data-table`'s `selectionStyle` and `chatbot`'s `floatingConfig` on both faces, and stop teaching `data-table`'s inline-edit flags as authored keys (objectui#… (objectui `b5b928ab0`)
+- **minor** — fix(components): a related list's row menu shows an action whose `visible` is blank, as its toolbar does (objectui `be5211522`)
+- **minor** — **Breaking (types only):** the `ActionGroup` interface is removed from `@object-ui/types` (objectui#11168, slice 2). Nothing in this repository imported it. (objectui `cd5b19a7e`)
+- **minor** — `element:definition-list`, `element:repeater` and `action:button` publish their inputs as the `@objectstack/spec` 17.5.0 rows declare them and as their renderers read them (object… (objectui `cd5b19a7e`)
+- **minor** — **BREAKING (authoring, TypeScript only):** `chartConfig.aria` on a dashboard widget is now a compile error, the same verdict the validator already gives (objectui#4044). (objectui `f3c2bb0f9`)
+- **minor** — **BREAKING** — feat(types): an authored `object-map` takes its props in the spec's `properties` bag; the flat spelling is refused by name (objectui#10859, batch 5) (objectui `997ce38cb`)
+- **minor** — The text-family field types and every length reader use `@objectstack/spec`'s own `minLength` / `maxLength`, and the snake_case `min_length` / `max_length` are retired at once, wi… (objectui `dd5ff190e`)
+- **minor** — `element:text` takes the nine `variant` values `ui:text` publishes (`h1`-`h6`, `body`, `caption`, `overline`) and renders each one the way `ui:text` does (objectui#7450). (objectui `caa0cd392`)
+- **minor** — **BREAKING** — `showFilters` is retired on `object-grid` (objectui#11068). (objectui `582edef1c`)
+- **minor** — fix(plugin-dashboard): a served dashboard draws its own title, description and sub-caption, not the packaged catalog's (objectui#11295) (objectui `b28bde8a4`)
+- **minor** — `navigation` is declared on the `object-kanban` and `object-calendar` blocks, by reference to `@objectstack/spec` (objectui#8652). This is the objectui half of the maintainer ruli… (objectui `d79f525d9`)
+- **minor** — **BREAKING** — The object-metadata write guard now holds a `select` / `radio` field that has no option source. (objectui `1563d3e10`)
+- **minor** — **BREAKING** — The Field Designer's drawer no longer offers `select` as a field type for a new field, or as a type to change an existing non-choice field into. (objectui `1563d3e10`)
+- **minor** — A related list inside a record now places its child object's `record_related` actions on each row (objectui#11270; the renderer half of the enforce answer on objectstack-ai/object… (objectui `a8b988933`)
+- **minor** — **BREAKING** — feat(types): an authored `object-form` takes its props in the spec's `properties` bag; the flat spelling is refused by name (objectui#10859, batch 4) (objectui `e3782d26e`)
+- **minor** — **BREAKING (authoring):** `assignedProfiles` on a `page` node is now refused on both published faces (objectui#9409). (objectui `02f1813f8`)
+- **minor** — `JoinedReportBlock` is now the spec's own type, derived from the installed `@objectstack/spec` instead of hand-written (objectui#10940). It is `JoinedReportBlock` from `@objectsta… (objectui `92970c4d6`)
+- **minor** — **BREAKING** — fix(core): `ActionDef` no longer declares `aria`, which `@objectstack/spec` 17.5.0 retired on an action (objectui `e2271568f`)
+- **minor** — feat(types): four declared keys nothing honoured are retired on both faces, and two chatbot keys gain their zod mirror (objectui#6152, round 4) (objectui `3e4fa2cfb`)
+- **minor** — A blank gate predicate is diagnosed on the three paths that still drew it in silence, and objectui's two gate mirrors whose protocol key refuses a blank now refuse it too (objectu… (objectui `58da8aeca`)
+- **patch** — fix(plugin-detail): `record:quick_actions.requiredPermissions` publishes what the gate does — the contract's shared record-block describe, verbatim (objectui `fd6f5da44`)
+- **patch** — perf(console): the first screen no longer downloads the spec entries only the metadata designers' validation uses (objectui `993f27e60`)
+- **patch** — docs(plugin-gantt): authored `object-gantt` examples write their props in the `properties` bag (objectui#10859, batch 6) (objectui `db0beb2aa`)
+- **patch** — The page-block inspector no longer offers `Inline` and `Grid` for an `object-form`'s `layout` (objectui#11168 slice 3, objectui#7759 group C). `@objectstack/spec` 17.5.0 refuses b… (objectui `17dc16793`)
+- **patch** — fix(app-shell): a Studio pillar whose draft load is cancelled no longer leaves its canvas on "Loading…" (objectui#11331) (objectui `bef9f204a`)
+- **patch** — fix(app-shell): a navigation label written as an inline locale map shows in the viewer's language across the console (objectui#11299) (objectui `770cc5ba4`)
+- **patch** — chore(plugin-designer): follow `@object-ui/layout`'s and `@object-ui/types`' navigation label changes (objectui#11299) (objectui `770cc5ba4`)
+- **patch** — fix(runner): the sidebar no longer reads the app's retired `version` key (objectui `47e3ce008`)
+- **patch** — fix(plugin-gantt, plugin-calendar): the `objectName` input description names the `dataSource.object` binding (objectui#11117) (objectui `0e6e76bc4`)
+- **patch** — fix(plugin-grid): a grid row shows an action whose `visible` is blank, as the action's toolbars do (objectui `be5211522`)
+- **patch** — `object-calendar` is taught with its `calendar` block, not with flat field-name keys (objectstack-ai/objectui#8831). (objectui `50583364a`)
+- **patch** — docs(plugin-map): authored `object-map` examples write their props in the `properties` bag, and the `objectName` input names the `dataSource` binding (objectui#10859, batch 5) (objectui `997ce38cb`)
+- **patch** — Message text only: the refusal an `element:text` node draws for an authored `body` or `children` describes what the block renders in the converged `variant` vocabulary, the headin… (objectui `caa0cd392`)
+- **patch** — The Studio page-block inspector's `element:text` **Variant** select offers the nine values `ui:text` publishes (Heading 1 to Heading 6, Body, Caption, Overline) in place of Headin… (objectui `caa0cd392`)
+- **patch** — The `page` preview sample authors its "Quick links" section heading as `variant: 'h3'`, replacing the pre-convergence spelling `subheading` that the ruling retires (objectui#7450)… (objectui `caa0cd392`)
+- **patch** — fix(app-shell): Studio's Automations rail stops telling a flow with a declared trigger that it has "no trigger" (objectui `9cfe9977f`)
+- **patch** — fix(app-shell): a served dashboard and a served list view are named as served, on the dashboard page, the view tab and the breadcrumb (objectui#11295) (objectui `b28bde8a4`)
+- **patch** — fix(layout): a present navigation label renders as written, with no exception, and an inline locale-map label renders its text (objectui#11201) (objectui `1ccb5ba7d`)
+- **patch** — fix(app-shell): a Studio pillar never saves one item's document into another while the second is loading, after a package switch, or after visiting a non-editable leaf (objectui `5f2d9676c`)
+- **patch** — docs(plugin-form): the README's authored `object-form` examples write their props in the `properties` bag (objectui#10859, batch 4) (objectui `e3782d26e`)
+- **patch** — The flow designer's edge `condition` type now mirrors the server's edge slot, the spec's `EvaluatedExpressionInput` (objectui#8946). (objectui `48401689f`)
+- **patch** — docs(core): the `ElementDataSourceConfig.filter` note now separates what an author may write from what a renderer may still receive (objectui#8945) (objectui `969d4f291`)
+- **patch** — fix(app-shell): the generic metadata editor renders a stored `view`, and a string-array repeater edits strings (objectui `1b30c0fe0`)
+- **patch** — `object-grid` re-reads its rows when an input its query reads changes: a `conditionalFormatting` rule, a row or bulk action def, or the view's `searchableFields` (objectui#10689). (objectui `be0ad007b`)
+- **patch** — `list-view` re-reads its rows when a `conditionalFormatting` rule, a row action def or a bulk action def adds a field its predicates read (objectui#10689). (objectui `be0ad007b`)
+- **patch** — fix(app-shell,components,console): the three remaining select placeholders show the locale's own "Select…" word (objectui#11252) (objectui `7fed09d07`)
+- **patch** — fix(plugin-dashboard): a dimensionless table renders a row of every measure, and a dimensionless chart one mark per measure (objectui `b4333ab8a`)
+
+⚠️ 12 of these carry a breaking change: 12 by the author's own breaking annotation in the changeset body — objectui declares no `major` inside a launch window (`scripts/check-changeset-no-major.mjs`). Each is marked **BREAKING** in the list above — read them before compiling the release record.
+
+**In this console build, declared nowhere** — objectui merged 3 commits in this range with no `.changeset/*.md`. The code is inside the pin above and ships here, but nothing upstream declared them, so they appear in no objectui CHANGELOG and in no entry above. Listed by subject rather than counted, because a count cannot tell a dependency bump from a form-behaviour change (objectstack#6174); the upstream gate that would prevent this is objectui#3387.
+
+- _(no changeset)_ fix(console): an injected spec shares the console's one zod instance (objectui#11327) (#11353) (objectui `31971ff1e`)
+- _(no changeset)_ ci(half-state-patrol): call objectstack's composite action pinned to a sha, with the no-anchor opt-in (objectui#11174) (#11332) (objectui `2c274e3a8`)
+- _(no changeset)_ docs: layout.md names the object-grid object with objectName, and flex.mdx teaches the four direction values (objectui#11298) (#11314) (objectui `0c6f9bbd7`)
+
+<!-- adr-0087: not-required (no-migration-prescription)
+     This diff moves `.objectui-sha` and the artefacts that travel with it: this console
+     changeset, `sdui.manifest.json` + `scripts/sdui-manifest.record.json`, the re-recorded
+     `packages/sdui-parser/objectui-lockstep.json` (no port owed: both parser copies agree on
+     all 25 codes at the new pin), and the re-measured pin citations in `packages/spec/src`,
+     which carry their own `@objectstack/spec` patch changeset. It adds, removes or renames no
+     ObjectStack-authorable key: no Zod schema, no spec declaration and no stored
+     `sys_metadata` shape moves in it, so `objectstack migrate meta` has nothing here to
+     rewrite, and this body carries no FROM/TO prescription of its own.
+     The 12 declared-breaking entries listed above are objectui's OWN package surfaces, each
+     already carrying its upstream record: `db0beb2aa`, `e3782d26e`, `997ce38cb` and
+     `5262f7dd3` (objectui's validator for `object-gantt`, `object-form`, `object-map` and
+     `object-chart` refuses the flat spelling and reads the `properties` bag, the shape
+     `@objectstack/spec`'s `ComponentPropsMap` rows already declare), `770cc5ba4` (objectui's
+     navigation resolver props), `cd5b19a7e` (objectui's `ActionGroup` TypeScript interface),
+     `582edef1c` (objectui's own `object-grid` `showFilters`, which no ObjectStack shape ever
+     declared), `1563d3e10` (objectui's Studio field designer and metadata write guard), and
+     three that mirror an ObjectStack-authorable key already retired and registered on this
+     side: `f3c2bb0f9` (`ui/ChartConfig:aria`), `02f1813f8` (`ui/Page:assignedProfiles`) and
+     `e2271568f` (`ui/Action:aria`). Where an entry mirrors an ObjectStack key, the ledger
+     entry belongs to the `packages/spec` PR that lands the retirement, never to the pin bump.
+     Scope of the claim, stated rather than implied: it is a claim about THIS diff, not a
+     per-entry re-measurement of the 12 upstream declared-breaking entries.
+-->
+
+objectui range: `e420df310f5b...31971ff1e28f`

.changeset/objectui-pin-citations-31971ff1e28f.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/spec': patch
+---
+
+The spec's objectui citations, and the shipped description text that names the `.objectui-sha` pin (the `FormField.span` describe and six migration-entry descriptions), are re-measured against the new console pin, objectui `31971ff1e28f`.
+
+Clause-②: no
+
+Several records were corrected rather than moved, because objectui changed what they describe on this hop: `object-calendar` and `object-timeline` now read `navigation` with no cast, and `object-kanban`'s read compiles through a declared member, since objectui declared the key on all three blocks (objectui#8652, objectui#8654); `object-timeline` also publishes a `navigation` input (objectui#8654); and the `action:button` registration now publishes the five `size` values its row declares (objectui#11168). Two stale readings are also corrected: the `object-timeline` start/end binding anchor began one line early at the previous pin as well, and the `object-tree` optionality count now records the comment that names the gate in `plugin-map`'s shell. No key, default, enum member or export moves.

.github/workflows/release.yml

@@ -1507,13 +1507,38 @@ jobs:
       - name: Build
         run: pnpm run build
 
-      # This key hashes the pin and the build script. ci.yml's Console Pin Gate
-      # (#4290) hashes a SUPERSET: those two, the probe scripts and the spec's
-      # entry layout (#20765). So the two workflows no longer share dist entries,
-      # and each one builds its own on a miss. Keeping this key narrower is
-      # deliberate. Following ci.yml would rebuild the console on every Version
-      # Packages merge, and publishing a cached console whose spec content lags
-      # is the existing cache design.
+      - name: Read the spec's declared zod range (Console dist key input)
+        id: spec-zod
+        # Fails rather than keying on an empty or `undefined` range: a key that
+        # silently stopped carrying the range would restore across a zod move.
+        run: |
+          node -e '
+            const range = require("./packages/spec/package.json").dependencies?.zod;
+            if (typeof range !== "string" || range.trim() === "") {
+              console.error("packages/spec/package.json declares no dependencies.zod, so the Console dist key cannot carry it.");
+              process.exit(1);
+            }
+            console.log("range=" + range.trim());
+          ' >> "$GITHUB_OUTPUT"
+
+      # This key hashes the pin and the build script, and carries the spec's
+      # DECLARED zod range (the step above). ci.yml's Console Pin Gate (#4290)
+      # hashes a SUPERSET of the files: those two, the probe scripts and the
+      # spec's entry layout (#20765). So the two workflows no longer share dist
+      # entries, and each one builds its own on a miss. Keeping this key narrower
+      # is deliberate.
+      # Following ci.yml would rebuild the console on every Version Packages
+      # merge, and publishing a cached console whose spec content lags is the
+      # existing cache design.
+      #
+      # The zod range is the one spec input the cached dist is NOT allowed to
+      # lag (#21108). The console bundles a single zod instance, the console's
+      # own copy, and its build refuses a console zod outside the injected spec's
+      # declared `zod` range (objectui#11353). A dist restored after that range
+      # moved would publish a console the build never judged against it. The
+      # range is read out of packages/spec/package.json, not hashed with it: the
+      # file's `version` moves on every Version Packages merge, and hashing the
+      # whole file would turn every publish into a cold console rebuild.
       #
       # Split restore/save, matching ci.yml, and not the combined actions/cache
       # action: the combined form's post-step saves even when the job FAILED,
@@ -1526,7 +1551,7 @@ jobs:
         uses: actions/cache/restore@v6
         with:
           path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}
+          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
 
       - name: Build vendored @objectstack/console SPA
         # Clones objectstack-ai/objectui at the SHA pinned in .objectui-sha,
@@ -1550,7 +1575,7 @@ jobs:
       # (no dist, or a dist no build ever stamped) is wrong on a publish lane.
       - name: Verify the restored Console dist bundles this tree's spec
         env:
-          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}
+          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
         run: pnpm check:console-injection --require-stamp
 
       # Reached only with every console assertion above green: Actions steps
@@ -1562,7 +1587,7 @@ jobs:
         uses: actions/cache/save@v6
         with:
           path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}
+          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
 
       - name: Downstream backward-compat smoke (live hotcrm)
         # Pre-publish gate (#2035): the about-to-publish @objectstack/spec must

.objectui-sha

@@ -1 +1 @@
-e420df310f5ba9526fd19d5fe65c2a52d6ac6d8c
+31971ff1e28f89cfc45f0c19bc5b05e443f28b79