chore(console): move the objectui pin 4016370 → 12dc7b4, regime C for sharing rules (objectui#13050) (#24660)

Fixes #24644
Clause-②: no

This PR moves the console pin from `4016370af3c9` to `12dc7b47c340`:
objectui `main` at `12dc7b47c340d9bd80b35406d890c2d27c8017dc`, the merge
of objectstack-ai/objectui#13050 (the console half of regime C for
sharing rules, objectui#12982). It is the newest objectui `main` commit
that contains `12dc7b47` and was green at the move. The card's F1
re-test is posted on #15194 (os-dev-report 6277654282), and the regime C
smoke run is below.

This PR is not a release act. The Version Packages PR is not touched,
and no release workflow is dispatched. No objectui source changed.

**Tier:** not governed. `node scripts/pm/check-governed-merges.mjs
--branch claude/issue-24644-console-pin-12dc7b47` at `0b45222fef`: "0 of
5 path(s) hit the register ... NOT governed". Size: 5 files, +283 / -23.

## Choosing the pin

- **Green, read at the move.** REST
`repos/objectstack-ai/objectui/commits/SHA/check-runs`, every page, read
by this session at 2026-10-19T20:29:52Z and again at 20:31:01Z, just
before the bump (`git ls-remote` tip `2493e85a3992` both times):

  | objectui `main` commit | check-runs at the move | verdict |
  |:--|:--|:--|
| `2493e85a3992` (tip) | 67: 37 success, 3 skipped, **1 failure**
(`Snapshot the board to the archive branch`), 26 in progress | not
green: a failure, which no later run of that commit removes (re-read at
21:36Z: 101 completed, 97 success, 3 skipped, 1 failure) |
| `cc4ae3e144e3` | 65: 44 success, 3 skipped, **3 cancelled** (`Repo
Gates`, `Lint`, `Bundle Analysis`), 15 in progress | not green: three
checks never reached a verdict |
| **`12dc7b47c340`** | **29 completed: 27 success, 2 skipped, 0
failure** | **green: the target** |

`12dc7b47c340` was never a push tip (the queue landed it with `cc4ae3e1`
14 s later), so all its runs are the `merge_group` ones: `CI` (Build &
E2E, Type Check, Test 16 shards, coverage, dist pins), `Lint`, `Repo
Gates`, `Governed Surface Guard`, `Changeset Presence`, all `success`.
objectui `main` moved on to `df71568080e2` after the move; this PR does
not re-choose.
- **The bump.** `OBJECTUI_ROOT=SCRATCH_CLONE bash
scripts/bump-objectui.sh --no-commit
12dc7b4`, exit 0: "objectui pin:
4016370 → 12dc7b4 (on origin/main)", and
"4016370af3c9..12dc7b4 walks completely" in a full (non-shallow)
scratch clone. ⛔ No shared `../objectui` checkout was read or written:
every objectui read and build tree came from that scratch clone.
- **Ancestry,** in that clone (`--is-shallow-repository` false): the old
pin `4016370af3c9` is an ancestor of `12dc7b47c340` (exit 0);
objectui#12957's merge `749ed7607614` too (exit 0); control, the reverse
(`12dc7b47c340` an ancestor of `4016370af3c9`): exit 1. Range: 32
non-merge commits.
- **objectui's own objectstack pin** moved in this range:
`.objectstack-sha` = `f4755a68a797` (objectui `8aa8e3e1e`), was
`2c9bf9430a11`. `f4755a68a797` is an ancestor of this branch's base
`14ccb1da9` (exit 0), 29 commits behind it.

## The console build path, end to end

Run as `ci.yml`'s `console-pin` job runs it, heavy steps under
`scripts/pm/os-verify-lock.sh`, each exit code captured before any pipe.
Shared box, so wall-clock figures are shared-box readings. Deviations
from the CI job: `--concurrency=2` (the container's resource rule), and
`OBJECTUI_ROOT` names a full scratch clone where CI shallow-clones.

**Final run, at this PR's head `0b45222fef`** (the branch merged with
`origin/main` `f89d29e382`, which brings #24629's `@objectstack/formula`
and `core` changes into the packed packages). The build tree and the
dist were deleted first.

| step | command | exit |
| --- | --- | --- |
| install | `pnpm install --frozen-lockfile` | 0 |
| closure + build | `pnpm exec turbo run build
--filter=@objectstack/client... --concurrency=2 && bash
scripts/build-console.sh` (lock VERDICT `command-exit 0`, held 733 s) |
0 |
| assert | the job's "Assert a real Console dist is in place" checks,
`CACHE_HIT` empty: index.html, assets and `.objectui-sha` present, 65492
KB, objectui@12dc7b47c340 | 0 |
| stamp | `pnpm check:console-sha`: `✓ Console dist matches the objectui
pin (objectui@12dc7b47c340).` | 0 |
| injection | `pnpm check:console-injection --require-stamp` (self-test
84 assertions; "Nothing assertable in this stamp; the dist was not
contradicted") | 0 |
| manifest | `node scripts/gen-sdui-manifest-node.mjs`: 107 components,
sha256 `b7a53e34856f…`; byte-identical to the committed pair (`git
status --porcelain`: 0 lines) | 0 |
| manifest check | `OBJECTUI_ROOT=.cache/objectui-12dc7b47c340 node
scripts/check-sdui-manifest.mjs`: present, intact, recorded at the live
pin, `@object-ui 17.7.0` | 0 |
| lockstep | `pnpm check:sdui-lockstep`: byte-identical to
objectui@12dc7b47c340 over 214 grammar lines | 0 |

**The `.objectstack-sha` branch ran, in this order** (build log):
- `→ objectui@12dc7b47c340 installs @objectstack/client
@objectstack/core @objectstack/formula @objectstack/lint
@objectstack/sdui-parser @objectstack/spec @objectstack/types by commit
— building them here...` (turbo 36/36);
- `→ Building objectui's own @objectstack/* at its .objectstack-sha
f4755a6, the reference the spec assertion judges this bundle
against...` (from the pin store);
- `→ OBJECTSTACK_ROOT is set: packing @objectstack/* from
/home/user/objectstack-issue-24644, standing in for the pin
f4755a6.`, `pack 7 package(s): 17.6s`, `✓
node_modules/.cache/objectstack now holds ... from
/home/user/objectstack-issue-24644 (0b45222)`;
- the frozen install: `Lockfile is up to date, resolution step is
skipped`, `Done in 7.6s`;
- objectui's console build: 34/34 tasks, 0 cached, then `✓ 8959 modules
transformed.`;
- `✓ Bundle canary 'import/jobs' present`; `✓ Single-zod canary: exactly
one zod version literal {major:4,minor:6,patch:7}` (2261 `assets/*.js`
read); `✓ Injected and vendored @objectstack/spec declare the same
descriptions (vendored: @objectstack/spec of objectui's own build of
objectstack f4755a6) — no observable skew`; `✓ Shipped the tracked
sdui.manifest.json (recorded at objectui@12dc7b47c340, this pin).`; `✓
@objectstack/console dist ready (65492 KB) from objectui@12dc7b47c340`.

**All seven `@objectstack/*` packages objectui installs are this
tree's,** read off the build tree after the install at `0b45222fef`:
- `node_modules/.cache/objectstack/.stamp.json`: `source: external`,
`sha` = `0b45222fef98…`, `dirty: false`.
- `node_modules/.pnpm`: 7 `@objectstack` entries, all in the
`@objectstack+NAME@file+.objectstack-pin+NAME…` form.
- each installed package's `dist/` against `packages/NAME/dist/`: `diff
-rq` exit 0 for all seven (spec, core, types, client, formula,
sdui-parser, lint). Control: the installed spec's `dist` against
`packages/core/dist`: exit 1.
- the build tree's `pnpm-lock.yaml` (byte-identical to the one committed
at `12dc7b47c340`, `cmp` exit 0): 0 registry-resolved `@objectstack/*`
keys, 14 `file:` keys. Control for the pattern: objectui's lockfile at
`0707b4ae3712` counts 14 registry-resolved keys.

**The in-build injection assertion is vacuous at this pin, so injection
is measured independently.** Since #24532 the assertion judges the
bundle against objectui's own build of its `.objectstack-sha`
(`f4755a68a797`). Its probes are the `.describe()` literals 32 to 160
characters long with no escape (`describeCandidates`,
`scripts/console-spec-probes.mjs`). The one spec describe that changed
between `f4755a68a797` and this tree, the flow `runAs` text, is longer
than 160 characters and carries an escape in the built dist, so the
assertion finds no skew and the stamp records `skew: false` with null
witnesses. Independent witnesses, `grep -lF` over the bundle's
`assets/*.js` (counts in brackets: files in this tree's
`packages/spec/dist` / in the `f4755a68a797` reference spec's `dist`):

| string | this PR's bundle | objectui's own (control) bundle |
|:--|:--|:--|
| `system flows keep system privileges; after` (flow `runAs`, [20 / 0])
| 1 | 0 |
| `A rule a package declares to share records; organizations author
their own in Setup` (the `sharing_rule` type-registry entry from #24599,
[16 / 0]) | 1 | 0 |
| `the trigger user until a human decision` ([20 / 0]) | 1 | 0 |
| stale: `Execution identity for the run: system = elevated (bypasses
RLS), user = the triggering user` ([0 / 20]) | 0 | 1 |

So the bundle carries this tree's spec as of this PR's head, and only
these witnesses tell it from objectui's own build. The control bundle is
the one F1 built (os-dev-report 6277654282). On it the in-build
assertion also exits 0; the release path's second check,
`check:console-injection --require-stamp`, exits 1 (no stamp). Two
earlier readings: against npm `@objectstack/spec@18.0.0-next.3` the
two-sided assertion passes this bundle with 16 of 16 injected-only
descriptions present and 0 of 2 published-only present, and against npm
`18.0.0-next.5` it sees no skew either.

**An earlier run,** at `e730837` (the bump commit, before the manifest
regeneration and the merge): `build-console.sh` VERDICT 0, held 719 s,
the same branch order, `dist ready (65484 KB)`, seven `diff -rq` exit 0,
control exit 1, 0 registry-resolved keys. It warned "Shipped the tracked
sdui.manifest.json, but its record names objectui@4016370af3c9", as
expected before the regeneration. That run produced the committed
manifest pair and lockstep record.

## The second half: manifest and lockstep record

- `node scripts/gen-sdui-manifest-node.mjs`, exit 0: 107 components,
sha256 `b7a53e34856f…`, re-recorded `scripts/sdui-manifest.record.json`
at the pin (`built-tree`, `@object-ui/core` 17.7.0). Re-run at
`0b45222fef`: exit 0, byte-identical.
- `sdui.manifest.json`: 107 → 107 components, none added or removed. Six
change their inputs:
- `list-view` publishes the spec keys its renderer honours on a page
node (33 inputs added; `columns`, `filter`, `sort` and `options`
re-described) — objectui `a244a172a`, objectui#13047;
- `record:details`, `record:highlights` and `record:quick_actions` gain
`emptyState` — objectui `c2191654a`, objectui#12932;
- `action:button` and `action:icon` drop the `patch` input and
re-describe `operation` — objectui `61ed5ada6`. No page in this tree
authors `patch` on those nodes (`git grep` over `examples/`: 0), and
`check:page-declaration-shape` passes.
- `packages/sdui-parser/objectui-lockstep.json`: `node
scripts/check-sdui-lockstep.mjs` exit 1 before (`[pin-moved]`),
`OBJECTUI_ROOT=.cache/objectui-12dc7b47c340 pnpm gen:sdui-lockstep` exit
0, then `pnpm check:sdui-lockstep` exit 0. Both blobs are unchanged
(`0131f27cf86d`, `76c18fb95d1f`), so no parser port is owed.

## The console changeset

`.changeset/24644-console-pin-12dc7b47c340.md` was written by
`scripts/bump-objectui.sh --no-commit` and renamed to this card's
prefix, as PR #24476 did. Its list is the generator's, untouched.

- `@objectstack/console` **minor**: 28 releasing changesets across 32
non-merge commits, 1 annotated breaking, 0 release-nothing, 4 commits
without a changeset (listed by subject in the changeset).
- The generator wrote its unanswered ADR-0087 placeholder, because the
range declares a breaking entry, and said a human must answer it. It is
answered `not-required (no-migration-prescription)` against this tree,
with `Clause-②: no` beside it, as in PR #24476. That is the one
hand-written part of the five files:
- objectui `a928aaa61` (objectui#13015) makes `failures` a required
member of `@object-ui/types`' `ImportJobUndoResult` and widens
`@object-ui/i18n`'s `TranslationKeys`.
- No package in this tree imports or depends on an `@object-ui/*`
package (`git grep` for imports: 0). The route side of the shape is this
tree's own: `UndoImportJobResponseSchema` already requires `failures`.

## F1 on the new pin

Posted on #15194 as os-dev-report 6277654282, method of 6263864885 /
6262553400, every value re-measured. **Verdict: F1 absent.** Tombstone
byte probe 0 of 2261 assets in both builds; 0 banners on the 4
`permissionSets` editor pages and the 3 finance pages of a fresh
showcase under `single`, for both builds; positive control 0 → 1 banner
(2 errors) on both; of the two release refusals, the assertion passes
the control bundle at this pin (vacuous, above) and
`check:console-injection --require-stamp` refuses it (exit 1).

## Regime C console smoke

Fresh showcase (`OS_PORT=36417 pnpm dev -- --fresh -p 36417`, `Tenancy:
single`, health 200), serving this PR's injected console at `b1abdca6`
(`check:console-sha` at boot: matches objectui@12dc7b47c340). Playwright
1.63.0, Chromium `/opt/pw-browsers/chromium`, 1440×1000, signed in
through the console form.

| clause | reading | result |
|:--|:--|:--|
| Setup lists the 2 declared showcase sharing rules read-only, with
provenance | `/apps/setup/metadata/sharing_rule?scope=environment`: both
`share_new_inquiries_with_field_ops` and
`share_key_account_qualified_contacts_with_managers` listed, Package
column `com.example.showcase`, the declared-only hint shown, no New, an
"Organization rules" link. `GET /api/v1/meta/sharing_rule`: 2 items,
`_packageId` `com.example.showcase`, `_provenance` `package`. The rule's
detail page shows "This item is locked and cannot be edited or deleted.
com.example.showcase@0.1.0" and offers no Edit or Save | PASS |
| Disable writes `POST /api/v1/security/_activation/sharing_rule/:name`;
the rule stays listed, switched off | the Active switch on
`share_new_inquiries_with_field_ops` (aria-checked `true` before) sent
`POST
/api/v1/security/_activation/sharing_rule/share_new_inquiries_with_field_ops`,
body `{"enabled":false}`, 200, the only write. After a reload the rule
is still listed and its switch reads `false`; `sys_metadata_activation`
holds one row for it, `active: false` | PASS |
| Clone creates an organization rule under a new name | Clone on
`share_key_account_qualified_contacts_with_managers` pre-filled
`share_key_account_qualified_contacts_with_managers_copy` with criteria
`{"$and":[{"stage":"qualified"},{"company":"Northwind"}]}`; submit sent
`POST /api/v1/data/sys_sharing_rule`, 201, the only write. The
`sys_sharing_rule` row exists under that name, `object_name`
`showcase_contact`, with the showcase organization's `organization_id` |
PASS |
| A principal without the `sys_sharing_rule` create grant sees no Clone
| a user created by the admin (`POST /api/v1/auth/admin/create-user`)
and bound to showcase's `ops` position (it carries `setup.access`):
`POST /api/v1/data/sys_sharing_rule` as that user answers `403
PERMISSION_DENIED`; the same Setup page lists both rules with 0 Clone
buttons (the admin, same page: 2), and shows "Read-only for your
account: switching a declared item on or off requires the
`manage_metadata` capability." Control: the same user without a position
is refused the Setup app ("You don't have access to this app"), which is
why the `ops` binding was needed for a non-vacuous reading | PASS |
| `PUT /api/v1/meta/sharing_rule/NEW_NAME` answers `403 NOT_CREATABLE` |
`PUT
/api/v1/meta/sharing_rule/share_key_account_qualified_contacts_with_managers_copy`
as the admin: `403`, `code: NOT_CREATABLE`, "Metadata type
'sharing_rule' is code-only ... Author an organization rule instead
(POST /api/v1/sharing/rules) ...". With `?mode=draft`: `403
NOT_CREATABLE` | PASS |

The server was stopped through its recorded process group (group read
empty, port refused).

## Gates

All at this PR's head `0b45222fef`, after a workspace build there
(`turbo run build --filter=!@objectstack/docs`, 76/76, lock VERDICT 0)
and `rm -rf packages/runtime/.objectstack`. Each exit code captured
before any pipe.

- `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
--commands` (no paths: 5 paths vs merge base `f89d29e382`, three-dot)
derived **72** commands. **All 72 exited 0.**
- `--ran` reconciliation over `COMMAND :: exit N` lines: "72 derived
famil(ies) accounted for — 72 run, 0 NOT-MEASURED (a DERIVED zero — all
72 recorded an exit code and none of them is 3)", exit 0.
- The same 72 also ran at `b1abdca6` (before the merge): 71 exit 0, and
`node scripts/check-plugin-teardown-shape.mjs --self-test` exit 3
because this shallow checkout lacked its pinned fixture commit; after
`git fetch --depth=1` of that commit it exited 0.
- Named in that list and worth reading out: `check-adr-0087-registration
--base origin/main` 0 (the exemption notice names this changeset),
`check-empty-changeset --base origin/main` 0, `check-changeset-no-major
--base origin/main` 0, `check-sdui-manifest.mjs` 0 and `--self-test` 0,
`pnpm check:sdui-lockstep` 0, `pnpm check:console-sha` 0, `pnpm
check:console-injection` 0, `pnpm check:objectui-changeset` 0, `pnpm
check:nul-bytes` 0, `pnpm check:dual-build-cjs-loads` 0.
- Added: `pnpm check:objectui-bump` 0 ("20 assertions across 5 cases").
- No package source changed, so no package `test` / `typecheck` is owed.

## CI

- **The Console Pin Gate does not run on this PR or in the merge queue**
(`ci.yml`'s two speeds; the `console-pin` job's `if:` excludes
`pull_request` and `merge_group`), and the fleet-write relay cannot
dispatch `ci.yml`. So the **pre-merge full battery is NOT MEASURED**,
and the local run above is the pre-merge reading.
- **The CI proof is `main`'s first full-battery run after the merge.**
This PR changes `.objectui-sha`, so the console-dist cache key misses
and that run builds the console fresh at `12dc7b47c340`. The dispatching
seat reads it; if it is red, it is a `main`-red this card owns.
- The fast set (Lint & Repo Gates, TypeScript Type Check, Test Core,
Build Core, Governed Surface Queue Guard and the rest) runs on this PR
as usual.

## Acceptance notes

Observations, not filed:

- **The in-build spec assertion cannot tell this bundle from objectui's
own at this pin** (above, and the open question in os-dev-report
6277654282). Its probe filter skips describe literals over 160
characters or with an escape, and that is all that changed between
`f4755a68a797` and this tree's spec. Raised for the seat to decide; not
changed here.
- **objectui, for the seat:** at 1440 px wide the declared sharing-rule
list puts the Clone action off-screen. Measured with Playwright at
1440×1000: the first `catalog-clone-*` button's box starts at x = 1515
(outside the viewport), and the table's scroll container is 1323 px wide
in a 1134 px box, so the Active switch is also cut at the right edge
until the user scrolls the table sideways. At 1920 px the button is
inside the viewport (x = 1806). Screenshots in the session scratchpad.
The card bars objectui source changes here; the seat files it on
objectui if it judges it a defect.
- For a principal who can open Setup but cannot read the activation
ledger (the `ops` user above), the Active column shows `?` for each
rule.
- `scripts/build-console.sh` defaults to the sibling `../objectui` when
`OBJECTUI_ROOT` is unset; every run here named a scratch clone, as PR
#24476 did.

---
_Generated by [Claude
Code](https://claude.ai/code/session_017QnMGFC4agzW9DVBSwQ6Cc)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/24644-console-pin-12dc7b47c340.md

@@ -0,0 +1,66 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `12dc7b47c340`. Frontend changes in this range:
+
+Derived from the changesets objectui declared over the range — 28 releasing of 28 changesets added across 32 non-merge commits; omitted: 4 commits carrying no changeset (they ship no package code).
+
+- **minor** — Setup lists the sharing rules installed packages declare again, read-only, with Disable / Enable and Clone (objectui#12982). (objectui `12dc7b47c`)
+- **minor** — `list-view` publishes the keys of its `@objectstack/spec` row that the renderer honours on a page node (objectui#13047). (objectui `a244a172a`)
+- **minor** — **BREAKING** — An import undo that leaves rows unreverted now says so in the Import Wizard (objectui#13015). (objectui `a928aaa61`)
+- **minor** — A `type: 'form'` action placed at `record_related` and fired from a related-list row now opens the clicked row's edit form (`/forms/NAME?recordId=ROW_ID&recordObject=CHILD`), as i… (objectui `9f1dd79fe`)
+- **minor** — A field group whose `visibleWhen` cannot be evaluated is now hidden, header and members, on the form and on the record detail page (objectui#13055). (objectui `fb85637e1`)
+- **minor** — The AI build chat's pending-drafts bar no longer covers the composer's input (objectui#12978). (objectui `51269f0fd`)
+- **minor** — Bound record blocks draw an authored empty state when their binding answers no row (objectui#12932, the renderer half of objectstack-ai/objectstack#24266). (objectui `c2191654a`)
+- **minor** — Publish `optionListDefault` (and its parameter type `OptionListFieldLike`) from the package entry: the reading of an option list's `default: true` that create forms seed from (obj… (objectui `b9e188762`)
+- **minor** — Build `@objectstack/*` from objectstack `main` `f4755a68a7` (objectui#12971). (objectui `8aa8e3e1e`)
+- **minor** — Two Cloud SDUI widgets are retired: `cloud:onboarding-next`, the Welcome page's next-step block, and `cloud:plan-status`, the pricing page's current-plan marker (objectui#12954).… (objectui `30083da91`)
+- **minor** — Every app now has a report index at `/apps/APP/reports` (objectui#13020). It lists the reports the app's package ships, by their localized labels, each linking to its `report/NAME… (objectui `47508f3bb`)
+- **minor** — A record page that shows the same unfiltered related list both as a `record:reference_rail` card and in a `page:tabs` count badge now reads that list once on open, not twice. The… (objectui `d0b9648ef`)
+- **patch** — Studio's RLS policy editor now gives a predicate the runtime cannot lower the server's verdict: an error that holds Save and autosave (objectui#13061). A `USING` or `CHECK` clause… (objectui `2a75c83b2`)
+- **patch** — A master-detail edit form now applies its line rules to the header record however late that record loads (objectui#13062). (objectui `bc98626ed`)
+- **patch** — A deep link to an object read by name always leaves the "Opening your console…" splash (objectui#13052). (objectui `1ce071187`)
+- **patch** — A kanban card move is announced to screen readers when its write answers, not when the card is dropped (objectui#13054). (objectui `083e80735`)
+- **patch** — An `app` page that declares a `record` binding now reads that row, and its components' `visibleWhen` predicates read it as `record` (objectui#12931, the renderer half of objectsta… (objectui `a23a33d6f`)
+- **patch** — One page open asks the server for one object document once (objectui#13044). The metadata provider's by-name object read now goes through the adapter's `getObjectSchema`, so the p… (objectui `65fe4c285`)
+- **patch** — A record page no longer asks `POST /api/v1/security/explain` for a verdict nothing on screen uses (objectui#13045). (objectui `50ba1bb0a`)
+- **patch** — Charts and dataset widgets read their object's metadata through the data source, so the widgets of one dashboard ask for one object's metadata once (objectui#13039). (objectui `988aa9fa1`)
+- **patch** — The Undo of an `operation: 'update'` action covers the `patch` of the declared action its `name` names, and no action renderer forwards a page action row's own `patch` (objectui#1… (objectui `61ed5ada6`)
+- **patch** — A list view draws a `referenceVia` pointer column's record when its columns do not show the type half (objectui#13036). (objectui `fe11eb12e`)
+- **patch** — A record link in an assistant answer opens that record inside the console (objectui#13037). (objectui `633b8f18f`)
+- **patch** — The chat's step line no longer shows the agent's tool-loading step, and no longer counts it (objectui#13038). (objectui `912bfd4a6`)
+- **patch** — An assistant answer reads well in the narrow assistant panel (objectui#13032). Headings inside a chat answer render at chat size (15–16px, bold, set apart by weight and spacing in… (objectui `6f877f1df`)
+- **patch** — The console's pending-approvals read now asks for one page of requests and takes the count from the route's `total` (objectui#13027). (objectui `d14ba9636`)
+- **patch** — A record page of a `trackHistory` object reads its audit history when the History tab is shown (objectui#13010). (objectui `acefe6fa6`)
+- **patch** — A record page reads its timeline, comments, user list and foot-of-page attachments when they are shown, not on every open (objectui#13010, part 2). (objectui `29c19cc1a`)
+
+⚠️ 1 of these carries a breaking change: 1 by the author's own breaking annotation in the changeset body — objectui declares no `major` inside a launch window (`scripts/check-changeset-no-major.mjs`). Each is marked **BREAKING** in the list above — read them before compiling the release record.
+
+**In this console build, declared nowhere** — objectui merged 4 commits in this range with no `.changeset/*.md`. The code is inside the pin above and ships here, but nothing upstream declared them, so they appear in no objectui CHANGELOG and in no entry above. Listed by subject rather than counted, because a count cannot tell a dependency bump from a form-behaviour change (objectstack#6174); the upstream gate that would prevent this is objectui#3387.
+
+- _(no changeset)_ fix(ci): read transient jobs-API failures, re-run attempts and stale shards without false reds in the aggregate Test gate (objectui#13064) (#13077) (objectui `90a4fc49b`)
+- _(no changeset)_ tooling(pin): keep one pinned @objectstack build per machine and copy it into each new checkout (objectui#12972) (#13035) (objectui `f9401e6af`)
+- _(no changeset)_ tooling(pin): commit the pin's packed manifests so a lockfile-only resolution needs no build (objectui#13008) (#13031) (objectui `b014f5eea`)
+- _(no changeset)_ tooling: publish computes each @objectstack/* floor from .objectstack-sha (objectui#12958) (#13024) (objectui `4484a1104`)
+
+Clause-②: no
+
+<!-- adr-0087: not-required (no-migration-prescription)
+     This diff moves `.objectui-sha` and the artefacts that travel with it: this console
+     changeset, the re-recorded `scripts/sdui-manifest.record.json` and the regenerated
+     `sdui.manifest.json`, and the re-recorded `packages/sdui-parser/objectui-lockstep.json`.
+     It adds, removes or renames no ObjectStack-authorable key: no Zod shape, no spec
+     declaration and no stored `sys_metadata` shape moves in it, so `objectstack migrate meta`
+     has nothing here to rewrite, and this body carries no FROM/TO prescription of its own.
+     The range carries one objectui change its author annotated breaking, and the digest
+     marked it. It is answered against this tree: objectui `a928aaa61` (objectui#13015)
+     makes `failures` a required member of `@object-ui/types`' `ImportJobUndoResult`, so a
+     custom objectui `DataSource`'s `undoImportJob` answer must carry it, and widens
+     `@object-ui/i18n`'s `TranslationKeys` with the `grid.import.undoPartial` family. No
+     package in this tree imports or depends on any `@object-ui/*` package, and
+     `@objectstack/console` publishes objectui's built SPA and exports no objectui type. The
+     route side of that shape is this tree's own: `UndoImportJobResponseSchema` already
+     requires `failures`, and `client.data.undoImportJob` already returns it. -->
+
+objectui range: `4016370af3c9...12dc7b47c340`

.objectui-sha

@@ -1 +1 @@
-4016370af3c9c9dafec2bc5299afd8e8079701b8
+12dc7b47c340d9bd80b35406d890c2d27c8017dc

packages/sdui-parser/objectui-lockstep.json

@@ -6,8 +6,8 @@
   ],
   "objectui": {
     "repo": "https://github.com/objectstack-ai/objectui.git",
-    "rev": "4016370af3c9c9dafec2bc5299afd8e8079701b8",
-    "revDate": "2026-10-19T03:42:35+00:00",
+    "rev": "12dc7b47c340d9bd80b35406d890c2d27c8017dc",
+    "revDate": "2026-10-19T20:08:18+00:00",
     "source": "packages/sdui-parser/src",
     "files": [
       "packages/sdui-parser/src/body-dialect.ts",
@@ -21,7 +21,7 @@
       "packages/sdui-parser/src/validate.ts"
     ]
   },
-  "recordedAgainstPin": "4016370af3c9c9dafec2bc5299afd8e8079701b8",
+  "recordedAgainstPin": "12dc7b47c340d9bd80b35406d890c2d27c8017dc",
   "grammarRegion": {
     "file": "packages/sdui-parser/src/parse.ts",
     "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",

scripts/sdui-manifest.record.json

@@ -11,12 +11,12 @@
     "a pin bump without regeneration goes RED there — that is the anti-rot half of the freshness gate.",
     "Regenerate + re-record: pnpm objectui:build && node scripts/gen-sdui-manifest-node.mjs"
   ],
-  "objectuiSha": "4016370af3c9c9dafec2bc5299afd8e8079701b8",
+  "objectuiSha": "12dc7b47c340d9bd80b35406d890c2d27c8017dc",
   "source": "built-tree",
-  "modulesRoot": ".cache/objectui-4016370af3c9/apps/console",
+  "modulesRoot": ".cache/objectui-12dc7b47c340/apps/console",
   "objectuiWorkspaceVersion": "17.7.0",
   "generator": "scripts/gen-sdui-manifest-node.mjs",
   "generatedAt": "2026-10-19",
-  "sha256": "c6b03966dae9b17b1f5864323efa05c143b31d95eee3cd77e4572eac980ac0cb",
+  "sha256": "b7a53e34856fc4b34c5e615aaf62e149361b92ba6936290d9e1e6cbcbd068bf5",
   "components": 107
 }