chore(objectui): answer the console changeset's ADR-0087 marker, re-record the sdui lockstep, add the citations changeset

Claude-Session: https://claude.ai/code/session_01Rerax7QTjKMPCUZxQUtPFR
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/console-0df67f237c5a.md

@@ -41,6 +41,32 @@ Derived from the changesets objectui declared over the range — 28 releasing of
 
 - _(no changeset)_ fix(scripts): an injected tree hashes apart from an installed one, so a local Spec Main Shape Gate reproduction cannot leave verdicts a sibling worktree replays (objectui#12114) (… (objectui `a194b4e37`)
 
-<!-- adr-0087: TODO — the pin bump cannot answer this; a human must (objectstack#6494) -->
+Clause-②: yes (widening: the html-page save gate and `os validate` read the SDUI manifest this console ships, and at this pin `element:repeater` and `element:number` publish the node-level `dataSource` binding as their only query input. A page source with `<element:repeater dataSource={{ object: 'account' }} />` and no flat `object` was refused with `missing-required-prop` against the previous manifest and passes against this one; a flat `object` / `filter` / `sort` / `limit` still passes, now with a non-gating `unknown-prop` warning.)
+
+<!-- adr-0087: not-required (no-migration-prescription)
+     This diff moves `.objectui-sha` and the artefacts that travel with it: this console
+     changeset, the regenerated `sdui.manifest.json` and its record
+     `scripts/sdui-manifest.record.json`, the re-recorded
+     `packages/sdui-parser/objectui-lockstep.json` (its grammar region, diagnostic codes
+     and containment predicate are unchanged across the range) and the re-measured pin
+     citations in `packages/spec/src`, which carry their own `@objectstack/spec` patch
+     changeset. It adds, removes or renames no ObjectStack-authorable key: no Zod schema,
+     no spec declaration and no stored `sys_metadata` shape moves in it, so
+     `objectstack migrate meta` has nothing here to rewrite, and this body carries no
+     FROM/TO prescription of its own.
+     The manifest is the one accept set that moves, and it moves in one direction. Its
+     `element:repeater` row loses the `object` (required), `filter`, `sort` and `limit`
+     inputs and its `element:number` row loses `object` and `filter` (objectui#12085,
+     `ce991bd70`), the html tier's half of the retirement `@objectstack/spec` already
+     carries with its own disposition (`element-flat-data-binding-retired`, #11509).
+     Measured with `compile()` of `@objectstack/sdui-parser` against both manifests: a
+     repeater bound through `dataSource` alone goes from `missing-required-prop` (error)
+     to clean, and the flat keys go from clean to `unknown-prop` (warning, which the save
+     gate does not refuse). Nothing that passed before is refused now.
+     The range carries one declared-breaking objectui change, by its author's breaking
+     annotation and not by a declared `major`: objectui#6349 batch 10 (`12ff25631`), the
+     row type of `@object-ui/collaboration`'s `VersionHistory` timeline is declared as
+     `VersionHistoryEntry` instead of `VersionEntry`. An objectui TypeScript type; no
+     ObjectStack key. No commit subject in the range carries `!`. -->
 
 objectui range: `20c6d351ad74...0df67f237c5a`

.changeset/objectui-pin-citations-0df67f237c5a.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': patch
+---
+
+The spec's objectui citations, and the shipped description text that names the `.objectui-sha` pin (the `FormField.span` describe and six migration-entry descriptions), are re-measured against the new console pin, objectui `0df67f237c5a`.
+
+Clause-②: no
+
+Every anchor was mapped through the objectui diff `20c6d351ad74..0df67f237c5a`: 293 paths over 21 commits, none deleted and one renamed (`resolveActionParams.ts`, which no record cites). Seventeen files a record cites changed on the hop, plus the `en` / `zh` / `de` packs (whose `calendar.configRequired` strings did not change): `ObjectGrid.tsx`, `ListView.tsx`, `ObjectCalendar.tsx`, `plugin-calendar/src/index.tsx`, `ObjectTimeline.tsx` and plugin-timeline's `renderer.tsx`, `ObjectKanban.tsx`, `KanbanBoardCore.tsx`, `KanbanImpl.tsx`, `plugin-kanban.mdx`, `MePermissionsProvider.tsx`, `PermissionProvider.tsx`, `record-details.tsx`, `basic/data-list.tsx`, `data-objectstack/src/index.ts`, `form.tsx` and plugin-view's `ObjectView.tsx`. Every cited line in them moved or held with its text byte-identical, and each record that cites one is re-pointed with a hop sentence that says by how much. The records that cite only byte-identical files gain a hop sentence that says so.
+
+Three readings changed around a cited read, and each hop sentence says what it found:
+
+- `basic/data-list.tsx`: the `element:repeater` registration no longer publishes the flat `object` / `filter` / `sort` / `limit` inputs; the node-level `dataSource` binding is its one published query input (objectui#12085). The renderer still reads the four as the binding's fallback. The row's two sentences that named the published inputs are rewritten where they stand.
+- `ObjectGrid.tsx`: the `delete` verdict the implicit bulk-delete is gated on now comes from the affordance-to-grant map's `rowDelete` row (objectui#12082). It still asks the managed-object policy and the object's effective API operations, now with the caller's delete grant beside them, so the `sys_api_key` reading holds. The `inlineEditable` verdict reads the same map's `listInlineEdit` row.
+- `ListView.tsx`: the calendar arm gained objectui#12081's fetch window. Its date-field reads are byte-identical and still declared-only, with no floor.
+
+The re-read also corrects two anchors the previous hop left on the `object-tree` flat-config record: its opening still named the `case 'tree'` arm at its `47b1f0bb7` span, and its hop cited the `labelField` line one line low.
+
+The six migration entries' corpus counts were re-taken with `git grep -o -F`, the method that reproduces every `20c6d351ad74` number. The corpus is now 8424 tracked files. Every token an entry counts as zero still reads zero (98 tokens). The controls moved with the corpus, for example `objectstack` from 18047 to 18248 and `timeout` from 1694 to 1705.
+
+No key, default, enum member or export moves.

packages/sdui-parser/objectui-lockstep.json

@@ -6,8 +6,8 @@
   ],
   "objectui": {
     "repo": "https://github.com/objectstack-ai/objectui.git",
-    "rev": "20c6d351ad74d2b14a93becdc134d51b91b2d2e6",
-    "revDate": "2026-10-09T22:57:23+00:00",
+    "rev": "0df67f237c5ab46cbc65252c5f6bd05f2be44c48",
+    "revDate": "2026-10-11T07:26:10+00:00",
     "source": "packages/sdui-parser/src",
     "files": [
       "packages/sdui-parser/src/body-dialect.ts",
@@ -21,7 +21,7 @@
       "packages/sdui-parser/src/validate.ts"
     ]
   },
-  "recordedAgainstPin": "20c6d351ad74d2b14a93becdc134d51b91b2d2e6",
+  "recordedAgainstPin": "0df67f237c5ab46cbc65252c5f6bd05f2be44c48",
   "grammarRegion": {
     "file": "packages/sdui-parser/src/parse.ts",
     "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",