[pm:seat] domain:ui — objectui execution seat

[os-sales]

Seat registration post for the domain:ui lane (objectui execution seat), created under the maintainer's 2026-08-21 ruling that split objectui cards three ways (domain:devx / domain:spec / domain:ui, the last being the only new label).

Body is authoritative; title and assignee are derived views. Single writer: the sitting seat PM. Comments are audit only and never carry state.

1. Current PM

• Session: session_01EuPCi56cnGyykygi3z9w4m (took over 2026-08-22 ~19:50Z)
• Seat: domain:ui @ objectstack-ai/objectui (execution seat)
• Posture: round 17 closed 22:45Z — 5/5 merged, in-flight zero. Round 18 not yet dispatched.
• Batch size: 3 — maintainer, 2026-08-22: 「并发保持3」. Supersedes the batch-5 instruction of 2026-08-21.
• This seat may dispatch above its own served tier — maintainer, 2026-08-22: 「你虽然是 opus，但是可以派 fable 的卡」.
• Clause-② at-tier dispatch is the route in this repo — maintainer, 2026-08-22, on a card dispatched at CONTRACT_REVIEW_TIER with no compensating label available: 「直接入队」.
• R1–R16 see §2 of the prior revision. R17 19:58Z→22:45Z (5 cards / 5 PRs, all merged).

2. Inherited ledger

Taken over from session_012u2pRjcqAYtoEjgr3wwhnK, dark since its 11:52Z body write with round 16 still marked in flight. R16 in fact completed 5/5 — #5202/PR #5699, #5131/PR #5698, #5235/PR #5707, #5279/PR #5706 merged 11:59–13:21Z; #5401 closed completed 12:05Z with no PR (correct — it was the ordered survey leg, a measurement-only card).

Two items the dark session had parked resolved without it: #5611/PR #5644 merged 18:12Z as the narrower seam shape (not the ActionDef widening it was holding), and #5469/PR #5665 merged 16:04Z.

Takeover mutex, re-checkable: last shift briefing 11:52Z (~8 h stale); newest open-round marker the same line; no Claim: from another session on any lane pm:dispatched card. All three clear.

3. Hot-file serial queue

EMPTY — round 17 closed with in-flight zero. All R17 holds released: packages/types/src/zod/** + packages/providers (#5710), packages/components/src/renderers/basic/record-picker.tsx (#5637), packages/auth + packages/app-shell/** + apps/console/.../SystemHubPage.tsx (#5619), packages/sdui-parser (#5661), packages/data-objectstack (#5663).

Two cards were serialised behind R17 and are now unblocked:

• Console FormPage still drops the other three conditional-rule surfaces after #5594: section-level visibleWhen/visibleOn, and the object-level field rules visibleWhen/readonlyWhen/requiredWhen #5627 (Console FormPage's three remaining conditional-rule surfaces) — was held behind useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619's apps/console / app-shell console fence. ⚠️ Whoever takes it re-reads useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619's landed shape first: useIsWorkspaceAdmin is gone, replaced by useWorkspaceAdminStatus returning a resolved/unresolved verdict, so any gating read in FormPage may have moved under it.
• finding(app-shell): the designer's ViewColumnInspector writes back whichever column spelling it found, so editing a stored accessorKey column re-saves a spelling object-grid no longer renders #5344 — ruled D alone (see §6), one-file diff in packages/app-shell/src/views/metadata-admin/inspectors/, was held behind useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619's packages/app-shell/src/views/** fence.
• Option B of Analytics widgets report "capability not installed" for a 401/dataset-not-found answer — misdiagnosis sends operators to the wrong fix #5663's i18n question — DatasetWidget reading err.code and rendering translated copy per branch, keys in all ten packs; app-shell's DatasetPreview wants the same and its hold is now released. The landed adapter change makes B possible (it exposes code/serverCode/serverMessage/datasetName); it was not before.

4. Landing ledger

Rounds 1–17: seventy-eight cards resolved, seventy-four PRs merged. Zero rework landed, zero red CI merged, zero re-runs issued, zero failed escalations. (Derivation: R1–14 = 62 cards / 61 PRs; R15 = +6/+4; R16 = +5/+4; R17 = +5/+5.) Two landed-and-blocked (#5521, #5544).

R17 (5 cards / 5 PRs, 19:58Z→22:45Z):

card	PR	note
#5710	#5713	The ruled FIRST leg of unbreaking objectstack's Console Pin Gate. Remove branch taken; the Zone-2b conditional stop did not fire because measurement collapsed the fork. Dispatched at claude-fable-5 per clause ②. Filed #5715, #5716.
#5637	#5714	Part of, not Fixes — one ruled clause unreachable inside the fence. Card stays open, now needs-user-decision (§6). Filed #5717.
#5619	#5718	Shape (a). Breaking removal of a published export, maintainer-approved. Found a third consequence shape neither the report nor the grading had.
#5661	#5722	Twin filed upstream as objectstack#11148. Snapshot sweep answered with a collection control.
#5663	#5723	Card's causal account of its own incident measured false (§5). Ruled option A on the i18n clause. Filed #5721.

Findings filed this round: #5715, #5716, #5717, #5721, objectstack#11148.

5. Notes

• ⛔ CLAUSE ② — the trip test is the SURFACE, not the package. packages/types is mostly not a contract face, but theme.zod.ts re-exports spec zod validators by reference, so it is the spec-mirroring surface and trips (Remove/localize the six dangling @objectstack/spec/ui theme-schema imports in packages/types/src/zod/theme.zod.ts — the ruled FIRST leg of unbreaking objectstack's Console Pin Gate #5710). packages/auth is a published package and does not trip — useIsWorkspaceAdmin was an internal React hook no metadata author writes against (useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619). Published ≠ contract face.

  • A conditional stop is the honest shape when a ruling's branches differ in trip status. Remove/localize the six dangling @objectstack/spec/ui theme-schema imports in packages/types/src/zod/theme.zod.ts — the ruled FIRST leg of unbreaking objectstack's Console Pin Gate #5710's ruling said "removes or localizes": removing is repair, localizing hand-types a validator whose authority was deleted. The brief proceeded on remove and would have stopped on localize. It did not fire — measurement collapsed the fork — which is the outcome such a clause is for.
  • ⛔ needs:contract-review DOES NOT EXIST IN THIS REPO (ensure-pm-labels.sh:238 creates it for objectstack only). With the maintainer's fable-dispatch authorization, at-tier dispatch is the route here; ruled 「直接入队」 2026-08-22.

• ⛔ scripts/pm/dispatch-gates.mjs IS THE WRONG TREE FOR THIS LANE. It lives in objectstack and derives against objectstack's 26 workflows; objectui has no scripts/pm/ at all. Pointed at objectui paths it prints a confident, well-formatted, entirely inapplicable gate list. Its --tier line is still usable as a floor; its gate families are not. objectui's real gates come from its own 22 workflows and root package.json: check:spec-symbols, check:i18n-keys, check:i18n-drift, check:i18n-dead-keys, check:phantom-deps, check:esm-specifiers, check:control-bytes, check:self-import, check:published-dist, check:doc-types, check:doc-snippets, check:eager-closure, check:skills-paths, lint:coverage, type-check:coverage, plus type-check/lint/test. All four R17 devs derived from the right tree after being told; none used the objectstack list.

• ⛔ THE SANITIZER RULE, NOW CHARACTERISED PROPERLY (R17). Earlier note: "the <!-- os-dev-report --> marker gets eaten." Measured sharper by kind:'html' page source loses the space between a text run and an adjacent inline element — A <strong>x</strong> page renders as Axpage #5661's dev on read-back: bare angle-bracketed tokens are eaten; angle brackets inside backticks survive (`<ul>`, `<li>` came through intact; a bare placeholder in a shell command did not). That is why the HTML-comment marker dies. Consequence: any collection pass that greps for the <!-- os-dev-report --> form is scanning for something that cannot exist on a comment written through this tooling. Standing instruction now in every brief: lead the report with the literal text os-dev-report and read the comment back. Three devs hit this in one round; two caught it themselves by read-back.

• ⛔ THE STALE-PREMISE CHECK PAID FIVE TIMES IN ONE ROUND. useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619's card said 11 call sites, measured 13 (two extra, one dragging in apps/console). Remove/localize the six dangling @objectstack/spec/ui theme-schema imports in packages/types/src/zod/theme.zod.ts — the ruled FIRST leg of unbreaking objectstack's Console Pin Gate #5710's card named one file; packages/providers held three more references. Analytics widgets report "capability not installed" for a 401/dataset-not-found answer — misdiagnosis sends operators to the wrong fix #5663's card pointed at plugin-dashboard; the copy is in packages/data-objectstack/src/index.ts. kind:'html' page source loses the space between a text run and an adjacent inline element — A <strong>x</strong> page renders as Axpage #5661's card cited :177; the call is at :176. And finding(app-shell): the designer's ViewColumnInspector writes back whichever column spelling it found, so editing a stored accessorKey column re-saves a spelling object-grid no longer renders #5344's §6 entry was inherited as "awaiting the maintainer" when it had been ruled 9 hours earlier — my error, caught only by the freshness gate. The gate applies to the body you are WRITING, not only to the cards you are dispatching.

• ⛔ A CARD'S OWN INCIDENT REPORT CAN BE CAUSALLY WRONG (R17, Analytics widgets report "capability not installed" for a 401/dataset-not-found answer — misdiagnosis sends operators to the wrong fix #5663). The card recorded a live 401 UNAUTHENTICATED and treated it as the response behind the banner. Measured: under the pre-fix code a 401 fell past status === 501 || status === 404 into a generic string and could never reach the capability-missing copy — while the banner's own parenthetical quoted the 404 NOT_FOUND body verbatim. The 401 was a separate probe. The real defect was 404 ROUTE_NOT_FOUND vs 404 NOT_FOUND — two unrelated conditions on one status, and the old mapping tested only the status. A prod-observed card is evidence, not a diagnosis; check whether the evidence could have produced the output.

• ⛔ THE MERGE QUEUE VALIDATES NOTHING — 合并队列声称「已强制」却从未产生过一次 merge_group 构建(repo-wide 0),必需集实测不含 4 个 shard / Type Check / Lint —— #3523 的第 3 步从未落地,而 AGENTS.md §9 已按「队列会替你兜住」反转了 auto-merge 禁令 #4986, open. THREE MORE CONFIRMATIONS THIS ROUND. enqueued→merged: fix(types): remove the six retired @objectstack/spec/ui theme-schema re-exports (#5710) #5713 18 s, fix(components): record_picker label / placeholder resolve the inline locale map their contract admits (#5637) #5714 17 s, Give the workspace-admin verdict a "not resolved yet" state instead of collapsing it into false #5718 17 s, fix(sdui-parser): keep the space between a text run and an adjacent inline element #5722/fix(data-objectstack): map dataset-query failures by the server's error code, not its status (#5663) #5723 ~16 s — against a PR-lane Type Check of 5–7 min and shards of 8–10 min. 74 PRs have now been landed on the premise that the queue catches things. Reading gates by name is the only gate. Not this lane's to fix; do not claim 合并队列声称「已强制」却从未产生过一次 merge_group 构建(repo-wide 0),必需集实测不含 4 个 shard / Type Check / Lint —— #3523 的第 3 步从未落地,而 AGENTS.md §9 已按「队列会替你兜住」反转了 auto-merge 禁令 #4986.

  • ⛔ check_suite.completed: success IS NOT A GATE READING — demonstrated, not recalled. Four such webhooks fired on fix(types): remove the six retired @objectstack/spec/ui theme-schema re-exports (#5710) #5713's head at 20:21Z while seven named jobs were still in_progress thirty minutes later. Green = 19 success + 3 skipped (dependabot, Test (coverage), the unexpanded shard placeholder) = 22.

• ⛔ DEV REPORTS REACH GITHUB EVEN WHEN THE RETURN MESSAGE DOES NOT (R17). Two devs finished, opened correct PRs, cleaned up their worktrees, and posted full reports to their cards at 21:17–21:19Z — and no completion notification ever arrived. Judged dead at ~2 h, they would have been re-dispatched into finished work. The collection order in the skill is load-bearing: scan GitHub FIRST; a missing return message proves nothing. The pm:dispatched comment count is the cheapest probe.

  • A live worktree ahead of its remote is positive liveness evidence at zero API cost. useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619 was at 46 min with no PR; git worktree list + a source-file mtime 11 minutes old answered the liveness question without spending a probe. 45 min is the probe threshold, never the death threshold.

• ⛔ RENDER THE UI CHANGE. Both R17 render cards carried it and both found things static checks cannot see: components: record-picker's label and placeholder drop the same inline-locale-map arm emptyText just stopped dropping — one throws, the other silently renders English or nothing #5637's vanishing label element ({label && …} with toText returning ''), useIsWorkspaceAdmin collapses "not resolved yet" into false, so an org-role admin renders once as a non-admin — every admin-gated surface can refuse or hide from a real admin #5619's flip window (only observable as a pair of frames from a real mount with the pipeline held open by hand).

• ⛔ A CONTROL THAT SURVIVES IS WORTH MORE THAN ONE THAT DIES. kind:'html' page source loses the space between a text run and an adjacent inline element — A <strong>x</strong> page renders as Axpage #5661's ablation went 9 red / 1 green, and the single green — "still drops the edge space at the parent's own start and end" — is the half of .trim() that was always correct. A 10/10 red would only have proved the tests notice the file changed. Same shape in Analytics widgets report "capability not installed" for a 401/dataset-not-found answer — misdiagnosis sends operators to the wrong fix #5663: the route-absent pin correctly stayed green because the ablation does not move that branch.

• ⛔ "NO SNAPSHOT CHANGED" NEEDS A COLLECTION CONTROL (R17, kind:'html' page source loses the space between a text run and an adjacent inline element — A <strong>x</strong> page renders as Axpage #5661). The claim is indistinguishable from "the snapshot tests never ran" unless you prove they were collected — vitest list --filesOnly confirming all 104 files, plus git status --porcelain empty afterwards (a mismatch fails rather than rewrites). ⛔ No -u run, ever, to make a snapshot agree.

• ⛔ THE TWIN DIFF, NOT THE LINE-NUMBER INFERENCE (R17, kind:'html' page source loses the space between a text run and an adjacent inline element — A <strong>x</strong> page renders as Axpage #5661). I reported objectui's and objectstack's parse.ts as "already drifted" because the line numbers differ by 9. The dev diffed them: the only difference is objectui's provenance stamp — an import plus a 9-line block — which is exactly that offset. The files are otherwise identical. An offset is not evidence of drift.

• ⛔ DEAD LOCALE KEYS ARE NOT COMPLIANCE (R17, Analytics widgets report "capability not installed" for a 401/dataset-not-found answer — misdiagnosis sends operators to the wrong fix #5663). Triage's ruling ended "i18n keys per the pack conventions", but the copy lives in a transport adapter with no i18n dependency and no t() call sites — keys there would be dead on arrival, the exact class the reverse-sweep gate exists to catch. Ruled A (ship without keys); the clause is conditional on keys being added, so nothing was breached. Satisfying a clause by manufacturing the defect it guards against is the wrong kind of obedience.

• ⛔ A RULING'S NAMED HOME CAN BE UNBUILDABLE — honour the OBSERVABLE requirement, not the literal placement. Remove/localize the six dangling @objectstack/spec/ui theme-schema imports in packages/types/src/zod/theme.zod.ts — the ruled FIRST leg of unbreaking objectstack's Console Pin Gate #5710's ruling named one file; its observable requirement was a green Console Pin Gate. Related: components: record-picker's label and placeholder drop the same inline-locale-map arm emptyText just stopped dropping — one throws, the other silently renders English or nothing #5637's ruled translateLabel pairing was module-private behind a fence, and the dev stopped at the fence and escalated rather than crossing it — the correct move (§6).

• ⛔ REACHABILITY IS MEASURED THROUGH THE CHECKER, NEVER GREPPED. A re-exported class carries alias flags (2097152); a naive getDeclaredTypeOfSymbol reads the static side and reports a confident, wrong zero. Resolve the alias first. Inversely, export * makes a symbol reachable where text search misses it.

• ⛔ THE BARREL GAUGE IS VACUOUS FOR RE-EXPORTS. A barrel's emitted .d.ts is byte-identical under any change to a re-exported declaration's SHAPE — neither export * nor export type { X } from '…' restates X's shape. Only the module that DECLARES X can move.

• ⛔ A control probe must be scoped to the SAME thing, be capable of failing, and MEASURE that it can fail. Void legs reported, never silently retried. Same exit code on both legs = unfalsifiable, reject it. Non-vacuity control in the SAME run as the red leg. A widening cannot be pinned with currently-valid input. Test whether a pin can go VACUOUS. A wrong prediction is not a void leg. ⛔ Commit before you ablate; confirm mutations on disk by occurrence count in both directions (injected marker present AND deleted text absent), restore under trap … EXIT INT TERM.

• ⛔ MEASUREMENT TRAPS — one shape: the right answer for the wrong reason. grep -c counts LINES; word boundaries are not optional (bare actor gave 972 vs 153); tsc skips emit if tsconfig.tsbuildinfo survives, and it lives outside dist/; equal byte count ≠ equal content; || echo clean prints a false all-clear from the ERROR path; a census in a built tree without --exclude-dir inflates. Zero hits must be controlled with a neighbouring term known to exist, or the zero is not a reading.

• ⛔ Verify every citation on origin/main, never the shared worktree — its HEAD is moved by other agents.

• ⛔ GOVERNED SURFACES — exactly four: AGENTS.md, CLAUDE.md, .claude/**, docs/adr/**. Sole criterion: does the path start with .claude/. Root skills/** is NOT governed.

• ⛔ GITHUB API QUOTA IS SHARED — one identity across the PM and its devs. Reads and writes fail together at the primary limit's boundary (the old "secondary content-creation limit" claim was wrong). ⛔ Never poll get_check_runs waiting for green — 22 runs per call; read once after the shard window. While waiting, do local verification against origin/main at zero cost. Webhooks are pushed and cost nothing.

• ⛔ list_pull_requests reports merged: false beside a populated merged_at — trust merged_at. Direct merge_pull_request is refused 405; path is flip ready → enable_pr_auto_merge (SQUASH).

• ⛔ CONTAINER: Firecracker microVM, suspended and resumed from snapshot. A resume restores the filesystem and kills the process tree. ⛔ "The remote branch has no commits" proves nothing was PUSHED, not that nothing EXISTS. Never pkill -f vitest; verify /proc/PID/cwd, kill by PID. --reporter=basic no longer exists in vitest 4. scripts/vitest-invocation-guard.mjs refuses a package-cwd run — it would otherwise go green on another package's files.

• Broken gauges, not failures: check-eager-closure-budget exits 2 unless the console is vite-built; check-doc-snippet-types exits 1 until built; check-published-dist-tooling hits the cap (CI owns it). Fresh-worktree type-check failures are usually the unbuilt dependency closure — pnpm --filter '^...' build first. Footer: session-URL in PR bodies, bare in comments.

• ⚠️ Eager-closure budget margin is thin and nobody owns it: 3914.9 / 3990.2 KB — 1.9% headroom. Every R17 PR moved it slightly; none breached. A lane landing 5 PRs a round against a 1.9% margin meets this as a surprise red, not as a decision. Not this seat's budget to change; recorded so the surprise is at least predicted.

• A dispatch is a hypothesis; measurement outranks it. Thirty-nine devs have corrected this seat's briefs — four in R17 (the missing ThemePreviewSchema consumer, the type-only providers reads, the (b)-is-cheaper prior, the 401 causal claim).

• Mislabels reported to triage, never changed here: [Decision]-titled cards sitting in pm:queue ([Decision] Should component-registry lookup normalise case? Two measured instances of "every node renders Unknown component type" #5247, [Decision] schema.onNavigate is a function value read off the grid schema — the fifth key #5091's ruling did not cover #5234, [Decision] ObjectMapConfigSchema 要不要 .strict() —— 类型面的保证只保护 TS 作者,而 AI 产出的 metadata 恰恰不带类型 #5157, [决策] objectui record:details 渲染器的双形状接缝:合成器产 title/descriptor-fields 与 spec 区块形状经裸 ?? 缝合,往哪个方向收 #4018, [决策] System Hub bespoke 卡片墙(SystemHubPage)是否按 #3655 选项 C 退场 #3743); 台账燃尽批次 8/8 · 被 objectstack#4171 阻塞的 any 擦除簇,3 符号——上游解除后处理(objectstack#4115) #3162 carries pm:queue with an objectstack blocker in its body; plugin-form: navigateOnSuccess is mount-blind and says nothing when its destination is refused — the key has no ruling and its own contract question is still open #5034 carries pm:queue while its body opens Blocked-by: objectui#4989 — ⛔ verify plugin-form: ObjectForm/WizardForm consume submitBehavior.url against the pre-ruling shape — out-of-contract values silently dropped, same-origin absolutes followed, mount-blind #4989 before treating it as dispatchable, the queue label is not clearance. #3965, #2762, #2628 carry non-agent assignees.

6. Awaiting the maintainer

• components: record-picker's label and placeholder drop the same inline-locale-map arm emptyText just stopped dropping — one throws, the other silently renders English or nothing #5637 — the translateLabel pairing. Triage ruled label takes pickLocalized + translateLabel; the symbol is module-private to a fenced file, and reaching it needs either a cross-family static import (against a 1.9%-margin eager-closure budget) or a hoist across more out-of-fence files. Three measurements argue against the clause on its merits: translateLabel is a hardcoded dictionary of tab tokens with entries for zh-CN/zh-TW only; both live call sites translate labels buildDefaultTabs generated, while a record-picker label is author-supplied; and console i18n residual on 17.0.0 GA: built-in record-detail tabs untranslated in ja-JP / es-ES (zh-CN fine), plus two English aria-labels in every locale #4645 (pm:on-hold) already records that dictionary leaving built-in tabs untranslated in ja-JP/es-ES. Four-axis analysis on the card, in Chinese, recommending C. ⛔ Not re-ruled by this seat.
• finding(app-shell): the designer's ViewColumnInspector writes back whichever column spelling it found, so editing a stored accessorKey column re-saves a spelling object-grid no longer renders #5344 — RULED, no longer awaiting. Maintainer answered the outstanding factual question 2026-08-22 (「无」 — no known population of pre-examples/schema-catalog: 13 个 grid 示例用了未声明的 cols 键,列数被静默丢弃 —— 要 3/4 列的示例在 docs 站实际渲染成 2 列 #4001 stored view documents carrying accessorKey columns), so the 02:25Z ruling's conditional fails: option D alone, A does not land, patchIdentity's writeback untouched, column-identity.ts:36-47 not amended. Stale assignee cleared. Round-18 candidate.
• [finding] 响应式词汇的两个零消费表面:useResponsiveConfig 生产零调用者(page.components[].responsive 因此实际未生效)、MobileComponentConfig 零消费者 #4773 (half B) — the cloud-side half; seam handoff filed as objectstack#11029.
• Decision-inbox cards this lane surfaced and cannot rule: RadioField 完全不读 multiple —— spec 允许 radio 带 multiple: true,实际静默渲染成单值 radio 组 #4015 (recommend C, fall back to B) · holdsStudioAccess is unreachable from @object-ui/app-shell, so the library's surfaces cannot share the console's one definition of "platform operator" #5576 (lean B) · [finding] maxToolRoundtrips is an authorable, documented chatbot key that reaches nothing — useObjectChat destructures it and never reads it #5605 · skills/objectui/guides/i18n.md 两处把 label 规则归给 @objectstack/spec v4,仓内实测 ^17.0.0 —— agent 面上 13 个 major 的版本化石 #5081 · Four more client sites still read the retired user.roles — role-addressed approvals and requiredRoles gates degrade silently at protocol 17 #5424 · finding: ThemeSwitcherSchema / ThemePreviewSchema are the same dead component kind #5489 retires — theme-switcher and theme-preview are registered by nothing either #5647 · [finding] A THIRD hand-written FormViewSchema mirror survives in packages/react's spec bridge, and it has drifted on three keys #5596 just measured #5652 · ui:icon reads the SDUI identity key name as its lucide icon name, so any icon node that authors name renders nothing at all #5631/Nothing checks that an icon: literal reaching a record-reading lucide resolver is a live icons key — four hand-copied resolvers, four local pins, no gate over the population #5633 · warnOnUnknownActionKeys's dev-console message states a fact step 3 retired, and points the author at the wrong file #5642 · content/docs/core/theme-schema.mdx teaches a schema that does not exist — six independent falsehoods, now including the type: 'theme' kind #5489 retires #5648 · finding(app-shell): ActionParamDialog's isLookupParam restates the picker family over RAW param spellings, so a degraded master_detail param loses the #3405 affordances #5654 · A file-header comment in packages/components/src DOES project into the published .d.ts — #5461's changeset asserts the opposite, and shipped a @object-ui/components doc change with no entry #5666 · finding(types/plugin-calendar): CalendarViewSchema declares 9 of its 13 keys that the calendar-view renderer never reads — including events, its only required key, which the renderer deliberately drops #5667 · [finding] #4580's "dist/index.d.ts is byte-identical" justification is a vacuous measurement, and it is written into the repo as evidence #5673–[finding] MetadataClient.layered() casts the whole ADR-0010 protection envelope through unchecked, while @objectstack/spec declares Zod for every field of it #5676 · finding(app-shell): the injected <base href>'s trailing slash is an unstated invariant of the console-mount resolver family #5678 · [finding] The anti-drift guard #5680 adds covers BaseSchema only — the ~17 sibling zod mirrors have nothing equivalent, and the class already has two confirmed instances #5684 · [finding] action-param-dialog.tsx hardcodes English in five places while already importing a translation hook for one key #5685 · SchemaRenderer's node visibility gate resolves a data.* predicate against the data-source ADAPTER, so a hoisted properties.visible written that way hides the block on every row, silently #5687 · finding: 9 catalog flex nodes still hand-write spacing as space-x-*, the one spelling #4891's sweep deliberately left behind #5690 · finding(plugin-dashboard): two more private copies of the reference-bearing field family — #5312's "LAST private copy" claim is false #5692 · clientValidation.ts theme: entry reads spec.ThemeSchema, which the spec retired — dangling dynamic read on a metadata type that is not registered #5715 · The theme TYPE surface (Theme, ThemeMode, ColorPalette, …) still derives from @objectstack/spec/ui, which retired it — objectui cannot refresh its spec pin past 17.1.0 until this is re-homed or dropped, and the choice needs a ruling #5716 · components: element:text_input's label / placeholder / description are the INVERSE of #5637 — the renderer already resolves the locale map, the declaration still says 'string', so the gate warns on a legal write #5717 · classifyAnalyticsFailure reads the status before the code, so /analytics/query's CUBE_NOT_FOUND is warned as a missing capability and silently degraded #5721 · objectstack#10928 · objectstack#11029 · objectstack#11148.
• The theme TYPE surface (Theme, ThemeMode, ColorPalette, …) still derives from @objectstack/spec/ui, which retired it — objectui cannot refresh its spec pin past 17.1.0 until this is re-homed or dropped, and the choice needs a ruling #5716 carries a consequence worth reading before the next spec bump: objectui cannot refresh its spec pin past 17.1.0 until the theme TYPE surface is re-homed or dropped.
• Build Docs is red on main: fs reaches the browser bundle via @objectstack/spec → pg-connection-string #5668 — Build Docs; still open under domain:devx. Practical block lifted (a content/docs/** PR merged 16:04Z), but that is not the same as fixed.
• 合并队列声称「已强制」却从未产生过一次 merge_group 构建(repo-wide 0),必需集实测不含 4 个 shard / Type Check / Lint —— #3523 的第 3 步从未落地,而 AGENTS.md §9 已按「队列会替你兜住」反转了 auto-merge 禁令 #4986 — not this seat's, but the one that most changes how this seat reads its own gates. Five confirmations now.

[os-sales]

Audit probe — angle-bracket survival through this write path

Not lane state. Posted to measure, precisely, which angle-bracket forms survive a body written through the GitHub MCP tools, because the seat post currently asserts a mechanism ("the GitHub body sanitizer strips angle-bracket-delimited content") that a counter-observation contradicts: dependabot's PR bodies (#4945, #4958) carry hundreds of literal HTML tags intact. If those survive and mine do not, the variable is the write path, not GitHub. This comment will be read back and the result recorded; it can be deleted afterwards.

Five forms, each on its own line, each labelled so a missing one is identifiable by its label alone:

• A · HTML comment:
• B · JSX tag in prose:
• C · TS generic in prose: Array<{ a: string }>
• D · bare comparison in prose: a < b and c > d
• E · pre-escaped entity: <div>

Fenced block, same five:

A <!-- os-dev-report -->
B <div className="x">
C Array<{ a: string }>
D a < b and c > d
E &lt;div&gt;

Inline code spans: A <!-- os-dev-report --> · B <div className="x"> · C Array<{ a: string }> · D a < b > c

Control (must survive, proves the comment itself landed): ZZCONTROL-SENTINEL-5560.

---

Generated by Claude Code

[os-sales]

Audit note — round 7, cross-repo finding raised for the maintainer's attention. Seat post body is authoritative; this comment records one item ahead of the round-close rewrite because it names a production-affecting shape in the other repo, outside this seat's lane.

objectstack-ai/objectstack#10928, filed by the #4765 dev while measuring the installed spec. Unassigned and unlabelled — deliberately, because it is an objectstack card and neither the labelling nor the grading is this seat's to do.

The shape: UniqueScopeSchema's rejection message calls 'organization' "the explicit spelling of true" on both surfaces. Measured against installed GA 17.0.0, that is false on one of them — on a declared index, bare true is the positional spelling of 'global', not 'organization'. The helper readout is unambiguous:

value	isUniqueDeclared	isGlobalUnique	isOrganizationUnique
true	true	false	false
'global'	true	true	false
'organization'	true	false	true

Bare true sets neither scope flag, so no organization key part is prepended — which is precisely what makes it 'global' on that surface.

Why it is worth the maintainer's eye rather than the queue's. An author refused on that key is told by the error message itself to write 'organization'. Doing so silently changes materialization — the driver prepends the NULL-safe organization key part — on an index that may already exist on deployed databases. That is the unannounced reinterpretation the #8323 ruling and the #5082 sequencing exist to prevent, arriving through the error text rather than through a schema change.

Duplicate-searched before filing (two searches, objectstack repo). Nearest prior art is #8463 / PR #8512, which corrected the same field-vs-index divergence on a different artifact — isOrganizationScopedUnique's JSDoc in driver-sql — not on the shared error map.

Relevance to this lane, and why it changed a fix here. The same divergence is why #5614 does not uniformly rewrite unique: true: at field level bare true is not deprecated at all ("stays valid indefinitely … no trap" per the spec's own prose), so harmonizing both occurrences would have shipped a fresh piece of false guidance on a card whose entire purpose is stopping exactly that. The dev caught this by measuring rather than by following the card, and the card is better for it.

---

Generated by Claude Code