chore(objectui): move the console pin from 0707b4ae3712 to 4016370af3c9, the newest green objectui main and the first pin past objectui#12957

[objectstack-fleet]

Fixes #24457
Clause-②: no

This PR moves the console pin from 0707b4ae3712 to 4016370af3c9. That is objectui main at 4016370af3c9c9dafec2bc5299afd8e8079701b8 (objectui PR #13018), the newest objectui main commit that was green at the move. It is the first pin that carries objectui 749ed760 (objectstack-ai/objectui#12957's merge), so it is the first console build that takes scripts/build-console.sh's .objectstack-sha branch (#24306, PR #24440). The maintainer's order, verbatim: 「你继续负责验证。.objectui-sha 可以升级到最新」. This PR is the end-to-end verification of ruling B on objectstack-ai/objectui#12955, so its evidence below is the deliverable.

This PR is not a release act. The Version Packages PR is not touched, and no release workflow is dispatched.

Tier: not governed. node scripts/pm/check-governed-merges.mjs --test on the five paths: "0 of 5 path(s) hit the register ... NOT governed". Size: 5 files, +80 / -10.

Choosing the pin

• Green, read at the move. REST repos/objectstack-ai/objectui/commits/SHA/check-runs, every page, read by this session:

  objectui main commit	check-runs	verdict
  4016370af3c9 (tip; read 2026-10-19T05:06:51Z)	104 completed: 101 success, 3 skipped, 0 failure	newest green: the target
  46dbf32bf57f	69 completed: 64 success, 3 skipped, 2 cancelled (Repo Gates, Bundle Analysis)	not green: two checks never reached a verdict
  09eadf4e1c14	99 completed: 96 success, 3 skipped	green (the card's filing-time tip)
  d0934b919d64	101 completed: 97 success, 1 failure (Snapshot the board to the archive branch), 3 skipped	not green

  At 04:48Z the tip still had 20 runs in progress. The session waited in the foreground until the last one (Test (coverage)) completed at 05:06:51Z, read git ls-remote (still 4016370af3c9), and bumped at 05:06:59Z.

• The bump. OBJECTUI_ROOT=SCRATCH_CLONE bash scripts/bump-objectui.sh --no-commit 4016370af3c9c9dafec2bc5299afd8e8079701b8, exit 0: "objectui pin: 0707b4ae3712 → 4016370af3c9 (on origin/main)". The range walked completely in a full (non-shallow) scratch clone. ⛔ The shared ../objectui checkout was never written: every objectui read and every build tree came from a scratch clone named by OBJECTUI_ROOT.

• Ancestry, in that clone (--is-shallow-repository false):

  • git merge-base --is-ancestor 749ed7607614 4016370af3c9…: exit 0. objectui#12957's merge is in the pin; an exit 0 proves itself in any checkout.
  • the old pin 0707b4ae3712 is an ancestor: exit 0.
  • control, the reverse (4016370af3c9 an ancestor of 749ed760): exit 1.
  • range 0707b4ae3712..4016370af3c9: 33 non-merge commits.

• objectui's own objectstack pin at 4016370af3c9: .objectstack-sha = 2c9bf9430a1198bfaa5c0de9ff4a811838c6869c, unchanged since 749ed760.

The dispatch's mechanism assumptions, measured

All four are measured at this PR's head 4289f447b1: the branch merged with origin/main ec951e29e4, which carries #24427 (26501ae24f) and the spec retirement #24442 (69f342b924, feat(spec)!).

1. The new branch runs, in the expected order. From the build-console.sh log at 4289f447b1, in order:
   • → objectui@4016370af3c9 installs @objectstack/client @objectstack/core @objectstack/formula @objectstack/lint @objectstack/sdui-parser @objectstack/spec @objectstack/types by commit — building them here..., then the closure build (turbo, with declarations): 36/36 tasks;
   • → OBJECTSTACK_ROOT is set: packing @objectstack/* from /home/user/objectstack-issue-24457, standing in for the pin 2c9bf9430a11., pack 7 package(s): 15.8s, and ✓ node_modules/.cache/objectstack now holds ... from /home/user/objectstack-issue-24457 (4289f447b122);
   • the frozen install: Lockfile is up to date, resolution step is skipped, Done in 6.5s;
   • objectui's @object-ui/console^... build: 34/34 tasks, 0 cached. 12 of those packages build with tsc first, and the console's own build is tsc && vite build, so objectui's sources type-check against this tree's packed declarations. Then the console bundle: ✓ 8956 modules transformed.
2. The dependency-name check passes. objectui did not move its own pin (.objectstack-sha is still 2c9bf9430a, as the PM measured). Re-measured anyway: the dependencies, optionalDependencies and peerDependencies NAMES of all seven packages are identical between objectstack 2c9bf9430a and this tree (versions moved 18.0.0-next.3 → 18.0.0-next.4 with the Version Packages merge 725a5b1311; names did not). The pin script's own lockfile check passed: it refuses on a difference, and it exited 0 before the install.
3. Everything installed is this tree's. Read off the build tree after the install, at 4289f447b1:
   • node_modules/.cache/objectstack/.stamp.json: source: external, root = this worktree, sha = 4289f447b122…, dirty: false.
   • node_modules/.pnpm: 7 @objectstack entries, all 7 in the @objectstack+NAME@file+node_modules+.cache+objectstack+NAME… form.
   • each installed package's dist/ against packages/NAME/dist/: diff -rq exit 0 for all seven (spec, core, types, client, formula, sdui-parser, lint). Control: the installed spec's dist against packages/core/dist: exit 1.
   • the build tree's pnpm-lock.yaml (byte-identical to the one committed at 4016370af3c9, cmp exit 0): 0 registry-resolved @objectstack/* keys, 14 file: keys. Control for the pattern: the same grep over objectui's lockfile at the old pin 0707b4ae3712 counts 14 registry-resolved keys ('@objectstack/client@18.0.0-next.3' and the rest).
4. The usual move gates pass. All in the tables below. Nothing turned red, so no contract difference between this tree (including feat(spec)!: retire a page action row's own patch — a row's operation: 'update' runs the declared action its name names (#24394) #24442's retirement) and the new objectui pin was found.

Console Pin Gate, local equivalent

Run step by step as ci.yml's console-pin job runs it. Each exit code was captured before any pipe; heavy steps ran under scripts/pm/os-verify-lock.sh. Shared 4-core box, so wall-clock figures are shared-box readings. Deviations from the CI job: --concurrency=2 instead of 4 (the container's resource rule), and OBJECTUI_ROOT names a full scratch clone where CI shallow-clones (with no OBJECTUI_ROOT, this checkout's sibling ../objectui, a shared checkout, would have been used).

Run 3, at this PR's head 4289f447b1. The build tree and the dist were deleted first, so the objectui worktree, the install and both builds were fresh.

step	command	exit
install	pnpm install --frozen-lockfile	0
closure	pnpm exec turbo run build --filter=@objectstack/client... --concurrency=2 (36/36; lock VERDICT command-exit 0)	0
build	OBJECTUI_ROOT=SCRATCH_CLONE bash scripts/build-console.sh (lock VERDICT command-exit 0, held 481 s)	0
assert	the job's "Assert a real Console dist is in place" script, verbatim, CACHE_HIT empty: ✓ Console dist present (65352 KB, via scripts/build-console.sh) from objectui@4016370af3c9	0
stamp	pnpm check:console-sha: ✓ Console dist matches the objectui pin (objectui@4016370af3c9).	0
injection	pnpm check:console-injection --require-stamp (self-test 67 assertions; the stamp records no observable skew)	0
manifest	node scripts/gen-sdui-manifest-node.mjs: 107 components, sha256 c6b03966dae9…; byte-identical to the committed pair (git status --porcelain: 0 lines)	0

Inside the build: ✓ Bundle canary 'import/jobs' present; ✓ Single-zod canary: exactly one zod version literal {major:4,minor:6,patch:7} (2258 assets/*.js read); ✓ Injected and vendored @objectstack/spec declare the same descriptions — no observable skew (the vendored spec IS this tree's packed spec now); ✓ Shipped the tracked sdui.manifest.json (recorded at objectui@4016370af3c9, this pin); ✓ @objectstack/console dist ready (65352 KB) from objectui@4016370af3c9.

The bundled spec is this tree's, two ways:

• Two-sided, on a copy of the dist, against the npm @objectstack/spec@18.0.0-next.3 tarball (the spec objectui's own pin was released as): node scripts/assert-console-spec-injection.mjs --injected packages/spec --vendored NPM_NEXT3 --objectui BUILD_TREE --assets COPY/assets, exit 0: "Console bundle carries THIS tree's @objectstack/spec, and only it", 16 of 16 injected-only descriptions present, the 1 published-only description absent.
• Witnesses from the merged-in commits themselves, each in the bundle (1 asset each), each absent from the npm next.3 spec (0):
  • feat(spec)!: retire a page action row's own patch — a row's operation: 'update' runs the declared action its name names (#24394) #24442 (69f342b924): the page action row's rewritten describes ("The row runs the declared action its ...", "the route writes them only where the acti..."); 0 in packages/spec/src at 26501ae24f, the commit before it.
  • feat(spec): a navigation entry may declare one API data source, which its visible reads as data #24427 (26501ae24f): the navigation item's visible describe (BaseNavItemSchema, "no console renders ..."); 0 in packages/spec/src at the base 725a5b1311.
    So the console bundles this tree as of the PR head, not an earlier build.

Two earlier runs of the same sequence, each all exit 0, with the same item 1 to 3 readings (seven diff -rq exit 0, control exit 1, 0 registry-resolved keys) and the same two-sided probe (16/16 present, 1/1 absent):

• Run 2 at b0899060c5 (merged with 26501ae24f), fresh tree: build-console.sh held the lock 478 s, dist ready (65336 KB); the generator's re-run there was byte-identical too.
• Run 1 at 4dd6c40d4d (before any merge; base 725a5b1311): build-console.sh held 472 s, pack 7 package(s): 18.3s, frozen install Done in 8.4s, dist ready (65332 KB); this run produced the committed manifest pair.

The second half: manifest and lockstep record

• node scripts/gen-sdui-manifest-node.mjs, exit 0: 107 components, sha256 c6b03966dae9…, re-recorded scripts/sdui-manifest.record.json at the pin (built-tree, @object-ui/core 17.7.0). Re-run at b0899060c5 and at 4289f447b1: exit 0 and byte-identical both times.
• sdui.manifest.json changes in two components, no component added or removed (107 → 107):
  • record:related_list's relationshipValueField description no longer names sys_user_position / sys_position (objectui 78b07f468, objectui#7611);
  • record:quick_actions's actionNames description says the empty placeholder shows on a design / preview surface and nothing at runtime (objectui 1d3da6c1e, objectui#12995).
• packages/sdui-parser/objectui-lockstep.json: node scripts/check-sdui-lockstep.mjs exit 1 before ([pin-moved]), OBJECTUI_ROOT=.cache/objectui-4016370af3c9 pnpm gen:sdui-lockstep exit 0, then pnpm check:sdui-lockstep exit 0: byte-identical to objectui@4016370af3c9 over 214 grammar lines (blob 0131f27cf86d), all 25 diagnostic codes, and the not-a-container predicate (blob 76c18fb95d1f). Both blobs are unchanged, so no parser port is owed.
• OBJECTUI_ROOT=.cache/objectui-4016370af3c9 node scripts/check-sdui-manifest.mjs, exit 0: present, intact, recorded at the live pin, and @object-ui 17.7.0 is what the pin declares.

The console changeset

.changeset/24457-console-pin-4016370af3c9.md was written by scripts/bump-objectui.sh --no-commit and renamed to this card's prefix, as PR #24311 did. Its list is the generator's, untouched.

• @objectstack/console minor: 32 releasing changesets across 33 non-merge commits, 1 annotated breaking, 0 release-nothing, and 1 commit without a changeset (749ed7607, objectui#12957's tooling merge).
• The generator writes an unanswered ADR-0087 placeholder whenever the range declares a breaking entry, and says a human must answer it (ADR_0087_SCAFFOLD, objectstack#6494). It is answered not-required (no-migration-prescription) against this tree, with Clause-②: no beside it, as in PR chore(objectui): move the console pin from 5e15928b4631 to 0707b4ae3712, the newest green objectui main #24311:
  • objectui 78b07f468 (objectui#7611) narrows four objectui faces: @object-ui/core's recordDelete.confirmText, the perm.facet.* / objectActions.resetPackageSet* pack keys of @object-ui/i18n, the field:permission-facet-link registry key of @object-ui/plugin-detail, and objectui check's known types in @object-ui/cli.
  • No package in this tree imports or depends on an @object-ui/* package (git grep over sources and manifests: 0). No file in this tree authors widget: 'permission-facet-link' (0). The sys_permission_set object whose facets that widget drew is no longer served here (ADR-0131 stage 8).

Gates

All at this PR's head 4289f447b1, each exit code captured before any pipe. The same 72 were also run, with the same result, at b0899060c5.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths: the change set comes from git, 5 paths vs merge base ec951e29e three-dot, 90 changed lines) derived 72 commands. Every one was run.
  • 71 exited 0.
  • pnpm check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET ("Run pnpm build first ... nothing was measured"): it needs a whole-tree build, and this diff changes no package's source or dist. NOT MEASURED locally; CI's Lint & Repo Gates reading stands.
  • --ran reconciliation: "72 derived famil(ies) accounted for — 71 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)", exit 0.
  • The derivation said the tree was 4 commits behind origin/main 31ce45c071 and that one gate script changed in that range (scripts/check-skills-token-ratchet.mjs, an artifact-roster family outside the 72). This PR does not merge main again for that; the queue rebuilds on the current main.
• Named in that list and worth reading out: check-adr-0087-registration --base origin/main 0 (the exemption notice names this changeset), check-empty-changeset --base origin/main 0, check-changeset-no-major --base origin/main 0, check-sdui-manifest.mjs 0 and --self-test 0, pnpm check:sdui-lockstep 0, pnpm check:console-sha 0, pnpm check:console-injection 0, pnpm check:objectui-changeset 0, pnpm check:nul-bytes 0.
• Added by the dispatch: pnpm check:objectui-bump 0 ("20 assertions across 5 cases") and pnpm check:objectui-changeset 0 (also in the derived list).
• No package source changed, so no package test / typecheck is owed.

CI

• The Console Pin Gate does not run on this PR or in the merge queue. ci.yml (THE TWO SPEEDS, lines 93-98) and the console-pin job's if: exclude pull_request and merge_group. The fleet-write relay cannot dispatch ci.yml either: WORKFLOW_DISPATCH_ALLOWLIST in scripts/pm/fleet-write/ops.mjs holds only shard-timings-refresh.yml and release.yml. So the pre-merge full battery is NOT MEASURED, and the local equivalent above is the pre-merge reading.
• The CI proof is main's first full-battery run after the merge (a push run, or the hourly schedule run if that push run is cancelled first). This PR changes .objectui-sha, so the console-dist cache key misses and that run builds the console fresh at 4016370af3c9. The dispatching seat reads it and links it on chore(objectui): move the console pin from 0707b4ae3712 to the newest green objectui main — the first pin past objectui#12957 (749ed760), the end-to-end verification of #24306 and of ruling B on objectui#12955 #24457; if it is red, it is a main-red this card owns.
• The fast set (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard and the rest) runs on this PR as usual.

Acceptance notes

Observations, not filed:

• scripts/build-console.sh (and bump-objectui.sh) default to the sibling ../objectui when OBJECTUI_ROOT is unset. In the multi-agent worktree layout that sibling is a shared checkout, and the build adds a git worktree to it and may fetch into it (its working tree and HEAD are not touched). This run named a scratch clone every time. Documented sibling layout, not a defect.
• node scripts/check-sdui-manifest.mjs without OBJECTUI_ROOT reads that sibling too (read-only); there it prints NOT CHECKED for the version leg, because the sibling does not carry the pin. With OBJECTUI_ROOT named it checks the leg and passes.
• objectui 46dbf32bf57f was passed over because two of its check-runs ended cancelled (its CI was cancelled when the next commit landed), so they never reached a verdict.
• Already raised on tooling(build-console): when the console build installs objectui at .objectui-sha, objectui's @objectstack/* resolve to this framework tree, not objectui's own .objectstack-sha build (ruling B on objectstack-ai/objectui#12955, step 3) #24306's report and not repeated as findings here: the console-dist cache key's coverage of the six non-spec manifests, and check-console-injection's "injected and published spec" wording for a no-skew stamp.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 31ce45c071bbcb6e92a730ce19ebf30dcfa361cb → packageMentionDocs.

[objectstack-fleet]

席位核对 — ACCEPT · objectui domain:ui seat 1 · session_0188TsgPV8kQXfuRuKmkj2ks · 2026-10-19T06:24Z

Reviewed at head 4289f447b1, against claim 6259854748 on #24457 and the dev's report 6261049868.

1. Shape. Draft PR against main, opening Fixes #24457, assigned sunhaolin. 5 files, +80 / −10, exactly the claim's surface: .objectui-sha, the generated changeset, sdui.manifest.json, scripts/sdui-manifest.record.json and packages/sdui-parser/objectui-lockstep.json. This is the shape of PR chore(objectui): move the console pin from 5e15928b4631 to 0707b4ae3712, the newest green objectui main #24311. check-governed-merges --test: not governed.
2. The pin. .objectui-sha moves from 0707b4ae3712 to 4016370af3c9c9dafec2bc5299afd8e8079701b8. Re-measured here:
   • it is on objectui main;
   • git merge-base --is-ancestor 749ed760 4016370af3c9 exits 0, so it carries objectui#12957's merge.
   • The dev read it green at the move: 104 check-runs, 0 failures. It passed over 46dbf32bf57f, whose two runs were cancelled.
3. Generated files. The manifest diff is two description strings, from objectui 78b07f468 and 1d3da6c1e. The record moves its sha, root, date and sha256 (107 components). The lockstep record moves rev and recordedAgainstPin only: the grammar and predicate blobs are unchanged, so no parser port is owed.
4. Changeset. @objectstack/console: minor, with the digest as the generator wrote it. Clause-②: no. The ADR-0087 marker reads not-required and is answered against this tree, as in PR chore(objectui): move the console pin from 5e15928b4631 to 0707b4ae3712, the newest green objectui main #24311. The one breaking objectui change in the range (78b07f468, objectui#7611) narrows objectui faces that no package here imports. The digest also names objectui#12957's merge under "declared nowhere", which is accurate: that PR was tooling and shipped no changeset.
5. The verification this card exists for (ruling B, end to end). The dev ran the Console Pin Gate's local equivalent fresh at this head, and it passed:
   • build-console.sh took the .objectstack-sha branch: the closure built, then the pin script with OBJECTSTACK_ROOT set to this tree ("pack 7 package(s): 15.8s"), then the frozen install ("Lockfile is up to date"), then the console build (8956 modules);
   • all seven installed dists are diff -rq-equal to packages/NAME/dist, with a control; 0 registry-resolved @objectstack/* keys;
   • the two-sided spec probe against npm next.3 passes 16 of 16, and feat(spec)!: retire a page action row's own patch — a row's operation: 'update' runs the declared action its name names (#24394) #24442's and feat(spec): a navigation entry may declare one API data source, which its visible reads as data #24427's new describes are in the bundle;
   • check:console-sha, check:console-injection --require-stamp, gen-sdui-manifest-node (byte-identical), check-sdui-lockstep, check-sdui-manifest, check:objectui-bump and check:objectui-changeset all exit 0.
6. CI. The PR and merge_group legs do not run the Console Pin Gate (ci.yml:93-98), and the relay cannot dispatch ci.yml. So the CI proof is the first main push run after the merge. .objectui-sha changes the console-dist key, so that run builds fresh. The seat reads it and links it on chore(objectui): move the console pin from 0707b4ae3712 to the newest green objectui main — the first pin past objectui#12957 (749ed760), the end-to-end verification of #24306 and of ruling B on objectui#12955 #24457 and decision: objectui 按提交钉 objectstack（.objectstack-sha），开发与 CI 从该提交的源码构建 @objectstack/*，npm 版本范围与下限只在 objectui 发版时由提交算出 —— 前端不再逐个 PR 等后端发版 objectui#12955. A red there is a main-red this seat owns: fix it, or revert this move.
7. Landing. Not Tier H. Once every required check on this head is green, the seat marks the PR ready and arms auto-merge.

VERDICT: ACCEPT

---

Generated by Claude Code