[objectstack-fleet]

Requested by Tesla · project thread

Part of #25712 (4b PR 2a: the two SDUI gates keep the required lane green when the pin goes).
Part of objectstack#25677.

Clause-②: no
Metadata-protocol: none

Why

The sitting merges the cutover PR #25825 (adds ui/), and then 4a #25745 (deletes .objectui-sha). Two steps of lint.yml job lint-repo-tooling (the required Lint & Repo Gates lane) read that pin, and without it both exit 1. Measured on the sitting tree (cutover c326d2fdf1 + 4a 50bd417d30 with its README apply steps 2–3 + main b00fc55c7d) without this PR:

• pnpm check:sdui-lockstep: REFUSED — .objectui-sha could not be read, exit 1.
• node scripts/check-sdui-manifest.mjs: ✗ .objectui-sha is MISSING — cannot judge freshness., exit 1.

This PR gives each gate, and the manifest generator, a second oracle: the in-tree copy under ui/. It is green on main as it is, so it can merge right after the cutover and before 4a, and main is never red. It deletes nothing: packages/sdui-parser/objectui-lockstep.json, the pin and every check stay. Unifying the two parsers is a later PR.

What changes

The mode is decided by .objectui-sha alone.

With the pin (today's main): zero behaviour change. The same record, checks, messages and output. Proven by golden harnesses, captured before and after and compared byte for byte:

• lockstep: every judge() outcome over the existing fixtures;
• manifest: checkTree over 14 fixtures × 2 option sets;
• the real main output of both gates.

The existing self-test rows are unchanged and pass.

With no pin:

• scripts/check-sdui-lockstep.mjs compares packages/sdui-parser/src with ui/packages/sdui-parser/src directly. It uses the same three readings the record holds today: the grammar region of parse.ts, the diagnostic code set, and the not-a-container containment predicate. The record is not consulted.
• scripts/check-sdui-manifest.mjs:
  • Checks 1–2 (shape, tamper) are unchanged, held against the in-tree record fields.
  • Check 3 becomes a registry source digest. It is a sha256 over the src/ files (tests excluded) of the @object-ui/* workspace closure of @object-ui/core and the generator's 16 registry modules. It is read from the git index (git ls-files -s: sorted paths, committed blob ids, no generated or untracked files), so the lint lane builds nothing.
  • A mismatch prints the one command that clears it: node scripts/gen-sdui-manifest-node.mjs.
  • There is no check 4. The in-tree @object-ui/core version moves with every release of the fixed group while the registry does not, so it is recorded and printed as provenance only.
• scripts/gen-sdui-manifest-node.mjs, with no pin:
  • It builds the registry closure itself with turbo (a cache hit when nothing moved), then enumerates from ui/apps/console exactly as before.
  • It refuses registry sources that the index does not hold.
  • It writes the record's inTree block and an in-tree // note.
• Pin absent and ui/ absent: both gates exit 1, and the message names both .objectui-sha and the in-tree path.

Record fields added, and what stays untouched

The new block is inTree: { modulesRoot, objectuiWorkspaceVersion, registryPackages, registrySources, registrySourcesSha256 }. It is written only by an in-tree run.

The pin-mode fields (objectuiSha, source, modulesRoot, objectuiWorkspaceVersion, generator, generatedAt, sha256, components) are untouched. An in-tree run carries the pin-keyed ones only while the artefact stays byte-identical to the one they describe.

This PR commits no regenerated artefact. sdui.manifest.json and scripts/sdui-manifest.record.json are unchanged, per the dispatcher's ruling below.

The committed manifest describes the pin, not the frozen registry (measured)

On the sitting tree, the in-tree generator exits 0 and writes 106 components (1f6e1ccb925a…). The committed artefact has 107 (d1fde278ffd6…). The registry really moved between pin b41ed7f689 and freeze 9e1fe03286:

• objectui 610d9ef (fix(core,rest,services): fail loud when a permission-store read fails #13475, objectui#13449) retired the raw-HTML html node type.
• objectui 46c56ee (Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483, objectui#13386) reworded plugin-detail's sections input description.

One committed artefact cannot be true for both the pin and the in-tree registry. So the regeneration rides with the pin deletion, in 4a: a ready patch and its measurements are with the dispatcher. Until 4a applies it, 4a's lint lane reds with exactly this:

✗ check-sdui-manifest:
  record is missing `inTree`.
    The record is keyed to the one producer, which reads the in-tree console build (ui/apps/console). Regenerate:
    node scripts/gen-sdui-manifest-node.mjs

The registry source digest is identical on cutover c326d2fdf1 alone and on the sitting tree: 27 packages, 922 files, 35ef1abd88b0011a06bfc895b3091d1f8ecf319c3f78d2bfb0d9feb4e53f3bbe. So the regenerated record holds through both states. Two generator runs on the sitting tree were byte-identical, artefact and record.

Known cost

After 4a, a UI PR that touches a registry source reds Lint & Repo Gates until its author runs node scripts/gen-sdui-manifest-node.mjs and commits the two files. Measured: 96 of objectui's last 200 non-merge commits (2026-10-20..25) touched the digested set, so about half of UI PRs would pay that one command.

The follow-up that removes the tax is a regenerate-and-compare step in Build & E2E UI (ci.yml), which has the console build in hand. It is the next 4b dispatch. That compare must ignore the record's generatedAt date (the artefact itself is byte-deterministic).

Verification

Gate	main (this branch)	sitting tree + this PR
pnpm check:sdui-lockstep (self-test, then the gate)	0 (pin mode)	0 (in-tree: 214 grammar lines, blob 0131f27cf86d, 25 codes, predicate 76c18fb95d1f)
node scripts/check-sdui-manifest.mjs --self-test	0 (22 cases)	0 (22 cases)
node scripts/check-sdui-manifest.mjs	0 (pin mode, 107 components)	1 before 4a's regeneration, as above; 0 after it

• New self-test rows:
  • lockstep battery The in-tree oracle (no pin: the merged layout), 18 cases;
  • manifest, 9 in-tree rows, including an in-tree producer run through a stub turbo.
• Ablations: 8 of 9 targeted ablations red the rows. The ninth drops inTree from the required list; the row stays red because the field-level check catches the same thing.
• Derived gates (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack): 35 families, all exit 0 at head a6ee32ec; --ran reconciles 35 run, 0 NOT-MEASURED, 0 UNRUN. ESLint on the three changed files: 0.
• Git children over self-test fixtures run with gitFreeEnv() ([finding] 25 more throwaway-git-repo builders spawn git with no environment of their own — the #16624 class, enumerated, with three competing spellings of the fix in tree #16644).

Deviations from the order

1. No regenerated artefact in this PR (dispatcher ruling, after the 106/107 measurement above). The order asked that the generator reproduce the committed sdui.manifest.json byte for byte on the sitting tree; it cannot, so the regeneration moves to 4a.
2. No in-tree version judgment (accepted): objectuiWorkspaceVersion is provenance, printed beside the live ui/packages/core version.
3. The generator builds the registry itself in-tree (accepted), so regeneration is one command with no prior step.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS