devx(sdui): one manifest record per ui registry package, so ui PRs on different packages stop conflicting

docs/releases-maintenance.md

@@ -55,11 +55,12 @@ ships the Console from the same commit as the spec it builds against.
 > root `.changeset/` before the first joint Version PR is #25831. New frontend
 > changesets go in the root `.changeset/`.
 
-#### After a registry change: regenerate the committed manifest (#12924, #17735, #25712)
+#### After a registry change: regenerate the committed manifest (#12924, #17735, #25712, #26051)
 
 The repo-root `sdui.manifest.json` (ADR-0080, the Console's public-tier component
-manifest) and its provenance record `scripts/sdui-manifest.record.json` are
-generated, and one command writes them:
+manifest), its provenance record `scripts/sdui-manifest.record.json` and one record
+per registry package under `scripts/sdui-manifest.sources/` are generated, and one
+command writes them:
 
 ```bash
 node scripts/gen-sdui-manifest-node.mjs   # no arguments
@@ -68,14 +69,20 @@ node scripts/gen-sdui-manifest-node.mjs   # no arguments
 It builds the registry packages under `ui/packages/`, enumerates them from
 `ui/apps/console` under plain Node, and serializes them through
 `@objectstack/sdui-parser` (it needs `packages/sdui-parser/dist`:
-`pnpm --filter @objectstack/sdui-parser build`). The record carries an `inTree`
-block with a digest of the registry packages' `src/`.
+`pnpm --filter @objectstack/sdui-parser build`). Each package record is one line:
+a digest of that package's own `src/` and the `sha256` of the artefact it was
+verified against. A run rewrites only the records whose line changed, so a PR that
+edits one registry package re-records that package alone; the shared record moves
+only when the artefact does, and then every package record names the new `sha256`.
 
-A required lint step reads the tracked pair on **every PR**:
+A required lint step reads the tracked files on **every PR**:
 `node scripts/check-sdui-manifest.mjs` checks the shape, the `sha256` against the
-record, and recomputes the source digest from the index. A PR that edits a registry
-package's source without regenerating goes red there, and the failure text prints
-the regeneration call. ⛔ There is no npm install route to the manifest; that was
+record, and recomputes each package's source digest from the index. A PR that edits
+a registry package's source without regenerating goes red there, naming the package,
+and the failure text prints the regeneration call. Two PRs that edit different
+registry packages touch different record files and do not conflict; two that edit
+the same package, or a PR that changes the artefact, still conflict once, and the
+later one merges `main` and re-runs the command. ⛔ There is no npm install route to the manifest; that was
 deleted by ruling 丙 on #17735.
 
 **One producer, one artefact.** `packages/console/build-dist.sh` copies the tracked

scripts/check-changeset-no-major.mjs

@@ -1365,9 +1365,10 @@ export function publishedSourceOwners(path, manifestOf) {
 // packed output — one path — and never which files it copies: the day the
 // console build ships a second tracked file, this leg sees it with no edit
 // here, and the day it stops copying the manifest, the leg stops claiming it.
-// `scripts/sdui-manifest.record.json` is measured OUT for that reason rather
-// than by choice: the build reads it for a warning line and does not copy it,
-// so it is not part of the shipped artefact.
+// `scripts/sdui-manifest.record.json` and the per-package records under
+// `scripts/sdui-manifest.sources/` are measured OUT for that reason rather than
+// by choice: the build does not copy them, so they are not part of the shipped
+// artefact.
 //
 // ⚠️ Residual, stated rather than implied: the reader understands the plain
 // shell the script is written in — `NAME="value"` assignments, `$NAME` /
@@ -4875,8 +4876,8 @@ function selfTest() {
         `this repository's ${PACKED_COPY_BUILD_SCRIPTS[0]} copies the repo-root sdui.manifest.json into packages/console/dist/ as read by this leg — got ${JSON.stringify(realPairs)}`,
       );
       assert(
-        !realPairs.some((p) => p.source === 'scripts/sdui-manifest.record.json'),
-        `measured, not chosen: the real build does not ship the manifest record — got ${JSON.stringify(realPairs)}`,
+        !realPairs.some((p) => p.source === 'scripts/sdui-manifest.record.json' || p.source.startsWith('scripts/sdui-manifest.sources/')),
+        `measured, not chosen: the real build ships neither the manifest record nor a package record — got ${JSON.stringify(realPairs)}`,
       );
 
       // ── The owner of a destination ────────────────────────────────────────
@@ -4956,14 +4957,21 @@ function selfTest() {
       const no = levelOf(copyRepo({ head: { ...PR22812, '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]) } }), declaredNo);
       assert(no.result.verdict === 'none-clean' && no.exitCode === 0, `the manifest moved under \`Clause-②: no\` + \`none\` is unaffected — got ${no.result.verdict} / ${no.exitCode}`);
 
-      // The record moves with every regeneration but ships nothing.
+      // The records move with regeneration but ship nothing: the shared one, and
+      // the one-line record of the registry package a ui PR re-recorded.
       const recordOnly = levelOf(
-        copyRepo({ head: { 'scripts/sdui-manifest.record.json': '{"objectuiSha":"bbbb"}\n', '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]) } }),
+        copyRepo({
+          head: {
+            'scripts/sdui-manifest.record.json': '{"objectuiSha":"bbbb"}\n',
+            'scripts/sdui-manifest.sources/plugin-grid.json': '{"package":"ui/packages/plugin-grid"}\n',
+            '.changeset/console-bbbb.md': changeset([[CONSOLE, 'patch']]),
+          },
+        }),
         yesWidening,
       );
       assert(
         recordOnly.touched.packages.length === 0 && recordOnly.touched.unreadable.length === 0 && recordOnly.result.verdict === 'clean',
-        `control: the record alone moves no published file — got ${JSON.stringify(recordOnly.touched)} / ${recordOnly.result.verdict}`,
+        `control: the records alone move no published file — got ${JSON.stringify(recordOnly.touched)} / ${recordOnly.result.verdict}`,
       );
 
       // #4690 on this leg: a build script that is THERE but yields no copy is