chore(objectui): move the console pin from f8267df93aba to 5e15928b4631 before 18.0.0-next.3

[objectstack-fleet]

Fixes #24134
Clause-②: no

This PR moves the console pin from f8267df93aba to 5e15928b4631, objectui main at 5e15928b4631a9dfd0d9bdd7282d1b746cdbaa68 (objectstack-ai/objectui#12844). The new pin carries 8296c6c3ca (objectstack-ai/objectui#12667) and 9d857c998c (objectstack-ai/objectui#12722). #23890 and #23933 remain open: they wait on this pin and are not closed here.

The maintainer ordered the pin first (「先移 pin，你负责派发」, 2026-10-17), ahead of 18.0.0-next.3. This PR is not a release act: the Version Packages PR #23825 is not touched, and no release workflow is dispatched.

Tier: not governed. check-governed-merges.mjs --branch origin/claude/issue-24134-console-pin-next3: 0 of 5 paths hit the register. Size: 5 files, +145 / -14 (159 changed lines, generated files included).

Choosing the pin

• The candidates are objectui main commits at or after both 8296c6c3ca and 9d857c998c. git merge-base --is-ancestor exits 0 for both against 5e15928b4631, and 5e15928b4631 is an ancestor of objectui origin/main.
• CI state comes from repos/objectstack-ai/objectui/commits/SHA/check-runs, read at 2026-10-17 ~03:13Z:
  • 5e15928b4631: 68 runs, 65 success and 3 skipped, none in progress. Completed green.
  • 0812a190f6 (stall guard: a freeze at the END of a healthy ci.yml shard still loses to the job timeout on the DEFERRED path — 15m10s of measured run against 10m of cap headroom #12846, the next commit): 2 coverage shards still in progress.
  • b921f909 (the tip by then): 30 runs still in progress.
• 5e15928b4631 was the tip when chore(objectui): move the console pin from f8267df93aba to a green objectui main commit before 18.0.0-next.3 — the maintainer orders the pin first; it carries objectui#12667 for #23890 and #23933 #24134 was filed, and its CI was still running then. It was the newest completed-green commit when the bump ran, and it builds against this tree (below), so it is the pin.
• Range f8267df93aba..5e15928b4631: 82 non-merge commits.

Gate (a): Console Pin Gate, local equivalent

1. Client closure: turbo run build --concurrency=2 --filter=@objectstack/client --filter=@objectstack/sdui-parser --filter=@objectstack/spec. 34/34 tasks passed.
2. pnpm objectui:build (scripts/build-console.sh) at the new pin, run under the verify lock, ended with VERDICT command-exit 0:
   • bundle canary import/jobs present;
   • exactly one zod version literal, {major:4,minor:6,patch:7}, across 2258 assets/*.js files;
   • "Console bundle carries THIS tree's @objectstack/spec, and only it" (3 of 3 injected-only descriptions present, 1 of 1 published-only absent);
   • "@objectstack/console dist ready (64908 KB) from objectui@5e15928b4631".
3. packages/console/dist/.objectui-sha reads 5e15928b4631a9dfd0d9bdd7282d1b746cdbaa68. pnpm check:console-sha reads "Console dist matches the objectui pin (objectui@5e15928b4631)". pnpm check:console-injection passes. Both exit 0.

That local build ran before the manifest was regenerated, so it warned that the shipped copy of sdui.manifest.json named f8267df93aba. The tracked file is now regenerated (below). packages/console/dist/ is untracked, and CI builds it fresh.

The second half: manifest and lockstep record

• node scripts/gen-sdui-manifest-node.mjs read .cache/objectui-5e15928b4631/apps/console and wrote 107 components (sha256 5c47c5b98cc2…). It also re-recorded scripts/sdui-manifest.record.json at the pin, with @object-ui/core 17.7.0.
• sdui.manifest.json changes in two components. Both changes come from objectui commits in the range:
  • list-view (plugin-list) publishes data and type in place of objectName and viewType. This is objectui 5c0846ebd (objectui#12099), which writes a page list-view node in the spec's own list view spelling. ListViewSchema here declares only data and type.
  • page:header.maxVisible's description changes (objectui 80863adea, objectui#12705).
  • No component is added or removed.
• OBJECTUI_ROOT=.cache/objectui-5e15928b4631 pnpm gen:sdui-lockstep re-recorded packages/sdui-parser/objectui-lockstep.json at the pin. Before the re-record, check:sdui-lockstep reported one pin-moved finding. After it, the gate passes: the grammar blob 0131f27cf86d and the predicate blob 76c18fb95d1f are unchanged (214 grammar lines, 25 codes, 7 sources). No parser port is owed.
• node scripts/check-sdui-manifest.mjs exits 0, and it confirms @object-ui 17.7.0 from the objectui checkout.

Spec Shape Gate and pin citations

• Spec Shape Gate: the pin does not reach this gate. It compiles objectui main, not .objectui-sha (see "Why the clone is objectui main, not the pin" in .github/workflows/spec-shape-gate.yml). Its pull_request trigger is filtered to its own three files, so it does not run on this PR. No registry row is added.
• check:objectui-pin-citations: this tree has no such script. pnpm --filter @objectstack/spec run check:objectui-pin-citations answers ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT, and git grep finds the name only in CHANGELOG.md and .changeset/pre/ text. It is not in the derived gate list either. No citation line is edited.
• normaliseOptions (objectui packages/fields/src/resolveActionParams.ts) does not change between f8267df93aba and 5e15928b4631. git log f8267df93aba..origin/main on that file is empty, and the function body hashes the same at both ends. PR docs(spec): describe objectui's normaliseOptions as it is at the console pin #24072's description of it holds at the new pin.

The console changeset

.changeset/24134-console-pin-5e15928b4631.md was written by scripts/bump-objectui.sh --no-commit 5e15928b4631… and renamed from the script's console-5e15928b4631.md to this card's prefix.

• @objectstack/console minor: 88 releasing changesets across 82 non-merge commits, 3 annotated breaking, 3 release-nothing, and 2 commits without a changeset.
• The script's ADR-0087 placeholder is answered not-required (no-migration-prescription). Each of the three breaking entries is answered against this tree:
  • 236624d56: the designer reads and writes visibleWhen only. The spec here already retires the form view's visibleOn (ADR-0089 D2).
  • 378896da6 and 5c0846ebd: a page list-view node is spelled data / type. ListViewSchema here declares no objectName or viewType.
• The body carries Clause-②: no, as the precedent pin changeset does.
• check-adr-0087-registration --base origin/main, check-changeset-no-major --base origin/main and check-empty-changeset --base origin/main all exit 0.

Verification, at bfcc588b

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths, merge base c1c0a9094) derived 70 commands. Each was run, with its exit code captured before any pipe. --ran with exit codes reads "70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero)".
• Two commands first exited 3 (prerequisite not met). Both were re-run green at the same head:
  • check-plugin-teardown-shape --self-test: its fixture commit 621a48760 was outside the shallow clone. After git fetch --depth=1 origin 621a48760… it passed 48 cases.
  • check:dual-build-cjs-loads: it needs a full build. turbo run build --concurrency=2 --filter=!@objectstack/docs passed 76/76, and the gate then passed (111 entries, 69 packages).
• This PR changes no package source, so no package test / typecheck is owed.

Acceptance notes

• Setup navigation, one audit entry: "Audit Log" opens the audit browser and the record list becomes its presets (item 1 of #23803; plugin-audit nav + the console audit page) #23890 and cloud-connection: the "Installed Apps" entry opens Setup Packages filtered to Source = marketplace (ruling B on #23892; after the objectui card lands and the pin moves) #23933 remain open. They can be re-read once this pin lands.
• objectui main has moved on (0812a190f6, b921f909), and those commits were still running CI when the pin was chosen. They go with the next hop.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01H3vERtBAfqFtKns7ZHnYXb

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 462d02f00a565da15f4146e88f42d5dbeb15cc97 → packageMentionDocs.