chore(console): move the objectui pin 4016370af3c9 → 12dc7b47c340, regime C for sharing rules (objectui#13050)

[objectstack-fleet]

Fixes #24644
Clause-②: no

This PR moves the console pin from 4016370af3c9 to 12dc7b47c340: objectui main at 12dc7b47c340d9bd80b35406d890c2d27c8017dc, the merge of objectstack-ai/objectui#13050 (the console half of regime C for sharing rules, objectui#12982). It is the newest objectui main commit that contains 12dc7b47 and was green at the move. The card's F1 re-test is posted on #15194 (os-dev-report 6277654282), and the regime C smoke run is below.

This PR is not a release act. The Version Packages PR is not touched, and no release workflow is dispatched. No objectui source changed.

Tier: not governed. node scripts/pm/check-governed-merges.mjs --branch claude/issue-24644-console-pin-12dc7b47 at 0b45222fef: "0 of 5 path(s) hit the register ... NOT governed". Size: 5 files, +283 / -23.

Choosing the pin

• Green, read at the move. REST repos/objectstack-ai/objectui/commits/SHA/check-runs, every page, read by this session at 2026-10-19T20:29:52Z and again at 20:31:01Z, just before the bump (git ls-remote tip 2493e85a3992 both times):

  objectui main commit	check-runs at the move	verdict
  2493e85a3992 (tip)	67: 37 success, 3 skipped, 1 failure (Snapshot the board to the archive branch), 26 in progress	not green: a failure, which no later run of that commit removes (re-read at 21:36Z: 101 completed, 97 success, 3 skipped, 1 failure)
  cc4ae3e144e3	65: 44 success, 3 skipped, 3 cancelled (Repo Gates, Lint, Bundle Analysis), 15 in progress	not green: three checks never reached a verdict
  12dc7b47c340	29 completed: 27 success, 2 skipped, 0 failure	green: the target

  12dc7b47c340 was never a push tip (the queue landed it with cc4ae3e1 14 s later), so all its runs are the merge_group ones: CI (Build & E2E, Type Check, Test 16 shards, coverage, dist pins), Lint, Repo Gates, Governed Surface Guard, Changeset Presence, all success. objectui main moved on to df71568080e2 after the move; this PR does not re-choose.

• The bump. OBJECTUI_ROOT=SCRATCH_CLONE bash scripts/bump-objectui.sh --no-commit 12dc7b47c340d9bd80b35406d890c2d27c8017dc, exit 0: "objectui pin: 4016370af3c9 → 12dc7b47c340 (on origin/main)", and "4016370af3c9..12dc7b47c340 walks completely" in a full (non-shallow) scratch clone. ⛔ No shared ../objectui checkout was read or written: every objectui read and build tree came from that scratch clone.

• Ancestry, in that clone (--is-shallow-repository false): the old pin 4016370af3c9 is an ancestor of 12dc7b47c340 (exit 0); objectui#12957's merge 749ed7607614 too (exit 0); control, the reverse (12dc7b47c340 an ancestor of 4016370af3c9): exit 1. Range: 32 non-merge commits.

• objectui's own objectstack pin moved in this range: .objectstack-sha = f4755a68a797 (objectui 8aa8e3e1e), was 2c9bf9430a11. f4755a68a797 is an ancestor of this branch's base 14ccb1da9 (exit 0), 29 commits behind it.

The console build path, end to end

Run as ci.yml's console-pin job runs it, heavy steps under scripts/pm/os-verify-lock.sh, each exit code captured before any pipe. Shared box, so wall-clock figures are shared-box readings. Deviations from the CI job: --concurrency=2 (the container's resource rule), and OBJECTUI_ROOT names a full scratch clone where CI shallow-clones.

Final run, at this PR's head 0b45222fef (the branch merged with origin/main f89d29e382, which brings #24629's @objectstack/formula and core changes into the packed packages). The build tree and the dist were deleted first.

step	command	exit
install	pnpm install --frozen-lockfile	0
closure + build	pnpm exec turbo run build --filter=@objectstack/client... --concurrency=2 && bash scripts/build-console.sh (lock VERDICT command-exit 0, held 733 s)	0
assert	the job's "Assert a real Console dist is in place" checks, CACHE_HIT empty: index.html, assets and .objectui-sha present, 65492 KB, objectui@12dc7b47c340	0
stamp	pnpm check:console-sha: ✓ Console dist matches the objectui pin (objectui@12dc7b47c340).	0
injection	pnpm check:console-injection --require-stamp (self-test 84 assertions; "Nothing assertable in this stamp; the dist was not contradicted")	0
manifest	node scripts/gen-sdui-manifest-node.mjs: 107 components, sha256 b7a53e34856f…; byte-identical to the committed pair (git status --porcelain: 0 lines)	0
manifest check	OBJECTUI_ROOT=.cache/objectui-12dc7b47c340 node scripts/check-sdui-manifest.mjs: present, intact, recorded at the live pin, @object-ui 17.7.0	0
lockstep	pnpm check:sdui-lockstep: byte-identical to objectui@12dc7b47c340 over 214 grammar lines	0

The .objectstack-sha branch ran, in this order (build log):

• → objectui@12dc7b47c340 installs @objectstack/client @objectstack/core @objectstack/formula @objectstack/lint @objectstack/sdui-parser @objectstack/spec @objectstack/types by commit — building them here... (turbo 36/36);
• → Building objectui's own @objectstack/* at its .objectstack-sha f4755a68a797, the reference the spec assertion judges this bundle against... (from the pin store);
• → OBJECTSTACK_ROOT is set: packing @objectstack/* from /home/user/objectstack-issue-24644, standing in for the pin f4755a68a797., pack 7 package(s): 17.6s, ✓ node_modules/.cache/objectstack now holds ... from /home/user/objectstack-issue-24644 (0b45222fef98);
• the frozen install: Lockfile is up to date, resolution step is skipped, Done in 7.6s;
• objectui's console build: 34/34 tasks, 0 cached, then ✓ 8959 modules transformed.;
• ✓ Bundle canary 'import/jobs' present; ✓ Single-zod canary: exactly one zod version literal {major:4,minor:6,patch:7} (2261 assets/*.js read); ✓ Injected and vendored @objectstack/spec declare the same descriptions (vendored: @objectstack/spec of objectui's own build of objectstack f4755a68a797) — no observable skew; ✓ Shipped the tracked sdui.manifest.json (recorded at objectui@12dc7b47c340, this pin).; ✓ @objectstack/console dist ready (65492 KB) from objectui@12dc7b47c340.

All seven @objectstack/* packages objectui installs are this tree's, read off the build tree after the install at 0b45222fef:

• node_modules/.cache/objectstack/.stamp.json: source: external, sha = 0b45222fef98…, dirty: false.
• node_modules/.pnpm: 7 @objectstack entries, all in the @objectstack+NAME@file+.objectstack-pin+NAME… form.
• each installed package's dist/ against packages/NAME/dist/: diff -rq exit 0 for all seven (spec, core, types, client, formula, sdui-parser, lint). Control: the installed spec's dist against packages/core/dist: exit 1.
• the build tree's pnpm-lock.yaml (byte-identical to the one committed at 12dc7b47c340, cmp exit 0): 0 registry-resolved @objectstack/* keys, 14 file: keys. Control for the pattern: objectui's lockfile at 0707b4ae3712 counts 14 registry-resolved keys.

The in-build injection assertion is vacuous at this pin, so injection is measured independently. Since #24532 the assertion judges the bundle against objectui's own build of its .objectstack-sha (f4755a68a797). Its probes are the .describe() literals 32 to 160 characters long with no escape (describeCandidates, scripts/console-spec-probes.mjs). The one spec describe that changed between f4755a68a797 and this tree, the flow runAs text, is longer than 160 characters and carries an escape in the built dist, so the assertion finds no skew and the stamp records skew: false with null witnesses. Independent witnesses, grep -lF over the bundle's assets/*.js (counts in brackets: files in this tree's packages/spec/dist / in the f4755a68a797 reference spec's dist):

string	this PR's bundle	objectui's own (control) bundle
system flows keep system privileges; after (flow runAs, [20 / 0])	1	0
A rule a package declares to share records; organizations author their own in Setup (the sharing_rule type-registry entry from #24599, [16 / 0])	1	0
the trigger user until a human decision ([20 / 0])	1	0
stale: Execution identity for the run: system = elevated (bypasses RLS), user = the triggering user ([0 / 20])	0	1

So the bundle carries this tree's spec as of this PR's head, and only these witnesses tell it from objectui's own build. The control bundle is the one F1 built (os-dev-report 6277654282). On it the in-build assertion also exits 0; the release path's second check, check:console-injection --require-stamp, exits 1 (no stamp). Two earlier readings: against npm @objectstack/spec@18.0.0-next.3 the two-sided assertion passes this bundle with 16 of 16 injected-only descriptions present and 0 of 2 published-only present, and against npm 18.0.0-next.5 it sees no skew either.

An earlier run, at e730837 (the bump commit, before the manifest regeneration and the merge): build-console.sh VERDICT 0, held 719 s, the same branch order, dist ready (65484 KB), seven diff -rq exit 0, control exit 1, 0 registry-resolved keys. It warned "Shipped the tracked sdui.manifest.json, but its record names objectui@4016370af3c9", as expected before the regeneration. That run produced the committed manifest pair and lockstep record.

The second half: manifest and lockstep record

• node scripts/gen-sdui-manifest-node.mjs, exit 0: 107 components, sha256 b7a53e34856f…, re-recorded scripts/sdui-manifest.record.json at the pin (built-tree, @object-ui/core 17.7.0). Re-run at 0b45222fef: exit 0, byte-identical.
• sdui.manifest.json: 107 → 107 components, none added or removed. Six change their inputs:
  • list-view publishes the spec keys its renderer honours on a page node (33 inputs added; columns, filter, sort and options re-described) — objectui a244a172a, objectui#13047;
  • record:details, record:highlights and record:quick_actions gain emptyState — objectui c2191654a, objectui#12932;
  • action:button and action:icon drop the patch input and re-describe operation — objectui 61ed5ada6. No page in this tree authors patch on those nodes (git grep over examples/: 0), and check:page-declaration-shape passes.
• packages/sdui-parser/objectui-lockstep.json: node scripts/check-sdui-lockstep.mjs exit 1 before ([pin-moved]), OBJECTUI_ROOT=.cache/objectui-12dc7b47c340 pnpm gen:sdui-lockstep exit 0, then pnpm check:sdui-lockstep exit 0. Both blobs are unchanged (0131f27cf86d, 76c18fb95d1f), so no parser port is owed.

The console changeset

.changeset/24644-console-pin-12dc7b47c340.md was written by scripts/bump-objectui.sh --no-commit and renamed to this card's prefix, as PR #24476 did. Its list is the generator's, untouched.

• @objectstack/console minor: 28 releasing changesets across 32 non-merge commits, 1 annotated breaking, 0 release-nothing, 4 commits without a changeset (listed by subject in the changeset).
• The generator wrote its unanswered ADR-0087 placeholder, because the range declares a breaking entry, and said a human must answer it. It is answered not-required (no-migration-prescription) against this tree, with Clause-②: no beside it, as in PR chore(objectui): move the console pin from 0707b4ae3712 to 4016370af3c9, the newest green objectui main and the first pin past objectui#12957 #24476. That is the one hand-written part of the five files:
  • objectui a928aaa61 (objectui#13015) makes failures a required member of @object-ui/types' ImportJobUndoResult and widens @object-ui/i18n's TranslationKeys.
  • No package in this tree imports or depends on an @object-ui/* package (git grep for imports: 0). The route side of the shape is this tree's own: UndoImportJobResponseSchema already requires failures.

F1 on the new pin

Posted on #15194 as os-dev-report 6277654282, method of 6263864885 / 6262553400, every value re-measured. Verdict: F1 absent. Tombstone byte probe 0 of 2261 assets in both builds; 0 banners on the 4 permissionSets editor pages and the 3 finance pages of a fresh showcase under single, for both builds; positive control 0 → 1 banner (2 errors) on both; of the two release refusals, the assertion passes the control bundle at this pin (vacuous, above) and check:console-injection --require-stamp refuses it (exit 1).

Regime C console smoke

Fresh showcase (OS_PORT=36417 pnpm dev -- --fresh -p 36417, Tenancy: single, health 200), serving this PR's injected console at b1abdca6 (check:console-sha at boot: matches objectui@12dc7b47c340). Playwright 1.63.0, Chromium /opt/pw-browsers/chromium, 1440×1000, signed in through the console form.

clause	reading	result
Setup lists the 2 declared showcase sharing rules read-only, with provenance	/apps/setup/metadata/sharing_rule?scope=environment: both share_new_inquiries_with_field_ops and share_key_account_qualified_contacts_with_managers listed, Package column com.example.showcase, the declared-only hint shown, no New, an "Organization rules" link. GET /api/v1/meta/sharing_rule: 2 items, _packageId com.example.showcase, _provenance package. The rule's detail page shows "This item is locked and cannot be edited or deleted. com.example.showcase@0.1.0" and offers no Edit or Save	PASS
Disable writes POST /api/v1/security/_activation/sharing_rule/:name; the rule stays listed, switched off	the Active switch on share_new_inquiries_with_field_ops (aria-checked true before) sent POST /api/v1/security/_activation/sharing_rule/share_new_inquiries_with_field_ops, body {"enabled":false}, 200, the only write. After a reload the rule is still listed and its switch reads false; sys_metadata_activation holds one row for it, active: false	PASS
Clone creates an organization rule under a new name	Clone on share_key_account_qualified_contacts_with_managers pre-filled share_key_account_qualified_contacts_with_managers_copy with criteria {"$and":[{"stage":"qualified"},{"company":"Northwind"}]}; submit sent POST /api/v1/data/sys_sharing_rule, 201, the only write. The sys_sharing_rule row exists under that name, object_name showcase_contact, with the showcase organization's organization_id	PASS
A principal without the sys_sharing_rule create grant sees no Clone	a user created by the admin (POST /api/v1/auth/admin/create-user) and bound to showcase's ops position (it carries setup.access): POST /api/v1/data/sys_sharing_rule as that user answers 403 PERMISSION_DENIED; the same Setup page lists both rules with 0 Clone buttons (the admin, same page: 2), and shows "Read-only for your account: switching a declared item on or off requires the manage_metadata capability." Control: the same user without a position is refused the Setup app ("You don't have access to this app"), which is why the ops binding was needed for a non-vacuous reading	PASS
PUT /api/v1/meta/sharing_rule/NEW_NAME answers 403 NOT_CREATABLE	PUT /api/v1/meta/sharing_rule/share_key_account_qualified_contacts_with_managers_copy as the admin: 403, code: NOT_CREATABLE, "Metadata type 'sharing_rule' is code-only ... Author an organization rule instead (POST /api/v1/sharing/rules) ...". With ?mode=draft: 403 NOT_CREATABLE	PASS

The server was stopped through its recorded process group (group read empty, port refused).

Gates

All at this PR's head 0b45222fef, after a workspace build there (turbo run build --filter=!@objectstack/docs, 76/76, lock VERDICT 0) and rm -rf packages/runtime/.objectstack. Each exit code captured before any pipe.

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths: 5 paths vs merge base f89d29e382, three-dot) derived 72 commands. All 72 exited 0.
  • --ran reconciliation over COMMAND :: exit N lines: "72 derived famil(ies) accounted for — 72 run, 0 NOT-MEASURED (a DERIVED zero — all 72 recorded an exit code and none of them is 3)", exit 0.
  • The same 72 also ran at b1abdca6 (before the merge): 71 exit 0, and node scripts/check-plugin-teardown-shape.mjs --self-test exit 3 because this shallow checkout lacked its pinned fixture commit; after git fetch --depth=1 of that commit it exited 0.
• Named in that list and worth reading out: check-adr-0087-registration --base origin/main 0 (the exemption notice names this changeset), check-empty-changeset --base origin/main 0, check-changeset-no-major --base origin/main 0, check-sdui-manifest.mjs 0 and --self-test 0, pnpm check:sdui-lockstep 0, pnpm check:console-sha 0, pnpm check:console-injection 0, pnpm check:objectui-changeset 0, pnpm check:nul-bytes 0, pnpm check:dual-build-cjs-loads 0.
• Added: pnpm check:objectui-bump 0 ("20 assertions across 5 cases").
• No package source changed, so no package test / typecheck is owed.

CI

• The Console Pin Gate does not run on this PR or in the merge queue (ci.yml's two speeds; the console-pin job's if: excludes pull_request and merge_group), and the fleet-write relay cannot dispatch ci.yml. So the pre-merge full battery is NOT MEASURED, and the local run above is the pre-merge reading.
• The CI proof is main's first full-battery run after the merge. This PR changes .objectui-sha, so the console-dist cache key misses and that run builds the console fresh at 12dc7b47c340. The dispatching seat reads it; if it is red, it is a main-red this card owns.
• The fast set (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard and the rest) runs on this PR as usual.

Acceptance notes

Observations, not filed:

• The in-build spec assertion cannot tell this bundle from objectui's own at this pin (above, and the open question in os-dev-report 6277654282). Its probe filter skips describe literals over 160 characters or with an escape, and that is all that changed between f4755a68a797 and this tree's spec. Raised for the seat to decide; not changed here.
• objectui, for the seat: at 1440 px wide the declared sharing-rule list puts the Clone action off-screen. Measured with Playwright at 1440×1000: the first catalog-clone-* button's box starts at x = 1515 (outside the viewport), and the table's scroll container is 1323 px wide in a 1134 px box, so the Active switch is also cut at the right edge until the user scrolls the table sideways. At 1920 px the button is inside the viewport (x = 1806). Screenshots in the session scratchpad. The card bars objectui source changes here; the seat files it on objectui if it judges it a defect.
• For a principal who can open Setup but cannot read the activation ledger (the ops user above), the Active column shows ? for each rule.
• scripts/build-console.sh defaults to the sibling ../objectui when OBJECTUI_ROOT is unset; every run here named a scratch clone, as PR chore(objectui): move the console pin from 0707b4ae3712 to 4016370af3c9, the newest green objectui main and the first pin past objectui#12957 #24476 did.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json cc95f5e63e3c96acafa55378a57d06c086e7d639 → packageMentionDocs.

[objectstack-fleet]

Seat review · TIER_DEFAULT (in-seat) · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T21:57Z

Head 0b45222fe. This is a pin move with the file shape of PR #24476. All 5 files are regenerated by scripts/bump-objectui.sh:

file	change
.objectui-sha	4016370af3c9 → 12dc7b47c340 (objectui#13050's merge)
packages/sdui-parser/objectui-lockstep.json	rev, revDate and recordedAgainstPin
scripts/sdui-manifest.record.json, sdui.manifest.json	the recorded renderer manifest at the new pin
.changeset/24644-console-pin-12dc7b47c340.md	the move's record

• Pin choice. 12dc7b47 has 29 check-runs: 27 success, 2 skipped, 0 failure. The tip 2493e85a3992 was passed over because its Board Snapshot run failed; cc4ae3e144e3 had 3 runs cancelled. The choice meets the card's green rule.
• Not governed. check-governed-merges --pr 24660 reads 0 of 5 paths. 306 changed lines.
• Build path. The dev's readings show the .objectstack-sha branch ran, the 7 installed packages are this tree's (diff -rq equal, control exit 1), and every pin gate exits 0. Its injection witness was measured independently: injected 1/1/1, control 0/0/0.
• F1: still absent on the new pin (os-dev-report 6277654282 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194).
• Regime C smoke: 5/5 PASS (os-dev-report 6278269372 on chore(objectui): move the console pin from 4016370af3c9 to the newest green objectui main past objectui#13050 (12dc7b47), and re-run F1 on it #24644).

VERDICT: ACCEPT. The seat sets the PR ready with auto-merge on; it lands when CI is green.

Follow-ups the seat files from the dev's report:

• (a) objectui: at 1440px the declared-rules table pushes Clone off-screen.
• (b) this repo: the in-build injection assertion's describe probe is vacuous at this pin.