chore(objectui): bump the console pin to e420df310f5b (carries objectui#11163 and objectui#11199) (#20990)

Fixes #20949

Clause-②: no (narrowing)

Bumps the console pin: `.objectui-sha` `db11afd4967c` -> `e420df310f5b`,
objectui `origin/main` HEAD at bump time (2026-09-30T22:03Z). The pin's
`apps/console/package.json` is `@object-ui/console` 17.6.0, the same
version the old pin carried (`npm view @object-ui/console dist-tags`
answers `latest: 17.6.0`).

## Containment (objectui `merge-base --is-ancestor C e420df310f5b`,
private full clone, `rev-parse --is-shallow-repository` = false)

| commit | subject | result |
|---|---|---|
| `f4ed2387e9` | record:related_list reads its declared `actions`
(objectui#11163, PR objectui#11263) | exit 0, contained |
| `f8334f8777` | the permission editor's RLS policy list draws each
policy's label and description (objectui#11199, PR objectui#11215) |
exit 0, contained |
| control `db11afd4967c` (old pin) | | exit 0, contained (90 commits
behind the new pin) |
| negative control: `e420df310f5b` as ancestor of `db11afd4967c` | |
exit 1 |

On `main`: `git branch -r --contains e420df310f5b` lists `origin/main`,
and `merge-base --is-ancestor e420df310f5b origin/main` exits 0.

Riders: objectui#11270 and objectui#11253 are not in the range (0 hits
in the `db11afd4967c..e420df310f5b` log). So the three rider texts on
#20949 (comment `5920572123`) are not due at this pin.

## What changed

- `.objectui-sha` and `.changeset/console-e420df310f5b.md`, written by
`scripts/bump-objectui.sh` (`@objectstack/console` minor). The range has
87 releasing changesets. 5 of them are declared breaking, and all 5 are
on objectui's own packages (see "Resolved since the first report").
- `sdui.manifest.json` and `scripts/sdui-manifest.record.json`, from
`node scripts/gen-sdui-manifest-node.mjs` (no arguments): 107
components, `@object-ui/core` 17.6.0.
- `packages/sdui-parser/objectui-lockstep.json`, from `pnpm
gen:sdui-lockstep` against the pin's own checkout: 214 grammar-region
lines, 25 diagnostic codes on objectui's side.
- **The `@objectstack/sdui-parser` port the lockstep demands.** This is
the seat's ruling A on #20949 (`5923109668`), which widened the claim's
surface. It mechanically mirrors objectui `6f864cf62` (objectui#8285).
  - `packages/sdui-parser/src/kanban-quick-add.ts` is deleted.
- Its wiring in `validate.ts` and its four barrel exports in `index.ts`
(`checkKanbanQuickAdd`, `INERT_QUICK_ADD`, `QUICK_ADD_HOST_TYPES`,
`QUICK_ADD_KEY`) are removed.
- `__tests__/inert-quick-add.test.ts` is rewritten for the new state, as
objectui rewrote its own pin: an authored `quickAdd` on `object-kanban`
draws the prop walk's own `unknown-prop` warning, and the barrel no
longer publishes the four names.
  - There is no new diagnostic.
- No other workspace package imports the four names (`git grep`, 0 hits
outside `packages/sdui-parser`). `@objectstack/lint` and
`@objectstack/metadata-protocol` import only `compile`, `parseJsx` and
types.
- `.changeset/sdui-parser-retire-inert-quick-add.md` declares the export
removal: `minor`, `**BREAKING**` under the launch-window convention, a
`!` summary and `Clause-②: no (narrowing)`.
- `pnpm check:sdui-lockstep` now exits 0: the copy agrees with objectui
at `e420df310f5b` on all 25 codes.
- The 49 asserting pin citations in `packages/spec/src`, re-measured at
the new pin (next section). Also the regenerated
`packages/spec/src/migrations/registry.ts` and
`content/docs/references/ui/view.mdx`, and
`.changeset/objectui-pin-citations-e420df310f5b.md` (`@objectstack/spec`
patch). The `FormField.span` describe and six migration-entry
descriptions ship the pin sha, so the text change publishes.
- `pnpm objectui:build` at the new pin built objectui against this
tree's client and spec. It found no API break against framework code: 34
of 34 objectui dependency builds succeeded, with 0 TypeScript errors.
- `origin/main` was merged three times through
`scripts/pm/os-regen-merge.sh`, at `e32638aeac`, `b1da822c0f` and
`62ec639b04`.
- The first two overlapped only on the generated `registry.ts`, and
`gen:migration-registry` reproduced the merged file byte for byte.
- The third overlapped on `component.zod.ts` and `component.test.ts`
(#20961's slot positions). It text-merged cleanly, and
`check:objectui-pin-citations` still reads 49 asserting citations
matching.
- After each merge `check:generated` read every artifact current, so no
regeneration commit was owed.

## Pin-citation re-measure

Each record was handled in the same way. Its anchors were mapped through
the `db11afd4967c..e420df310f5b` diff of the file each one cites, and
each anchor was re-read at the new pin. Line hashes and corpus counts
were taken again with the method the record names: `git hash-object` of
the cited block, and `git grep -o -F` over the tracked tree. Only after
that were the pin and the moved numbers updated. Each record keeps its
earlier hops as history. `check:objectui-pin-citations` now reports 49
asserting citations matching `e420df310` and 7 anchor content assertions
verified against objectui at the pin.

Records whose CLAIMS moved, not only their numbers. These want a human
read:

- **`action:*` rows** (`component.zod.ts`): objectui#11168 slice 1
rewrote all four registrations' `inputs`.
- `action:button` now publishes 27 of its 29 keys, all but `endpoint`
and `undoable`. It used to publish 7.
  - `action:menu` now publishes `size` and `visible`.
- `action:group` no longer publishes its group-level `name`, and
publishes the primitive's four sizes.
- The three publication sentences are corrected. `action:icon`'s `label`
is now read five times, where the record said four: objectui#11212 added
a fault label.
- **New, recorded and not declared:** objectui#11182 has `action:group`
and `action:menu` consume the host's evaluated `disabled` verdict. So a
`properties.disabled` on either block now greys it out at render, while
their strict rows refuse the key at save. The docblocks say so.
Declaring the key is a contract decision, not a pin re-measure.
- **`object-kanban` `limit`:** objectui#9853 renamed the default
`DEFAULT_KANBAN_LIMIT` to `DEFAULT_KANBAN_FETCH_BATCH_SIZE`. It is still
100. The query line changed on the anchor itself.
- **`object-kanban` `quickAdd` records:** objectui#8285 and
objectui#11234 landed objectui's half of the retirement. The board now
renders an internal `KanbanBoardCore`, which reads neither key. So
`ObjectKanban.tsx` names `quickAdd` and `onQuickAdd` 2 times each, all
four in the comments that record the cut, where the records said 0. The
records also now say that the schema-only `kanban-ui` block they point
to was retired in objectui (objectui#8257), long before this pin.
- **`object-tree`:** objectui#8348 moved the tree's rung-1 call from the
`undeclared` arm to `view-data`. It also dropped the `?? schema.data`
fallback from the host-data read. So the renderer and the row now agree
on a bare array. The "WIDER than this row" sentences are dated to the
pin where they held.
- **`object-map`:** one sentence said an authored `data` array still
reaches the renderer through the React props channel. That has been
false since objectui#9571, which predates `db11afd4967c`. objectui's own
docblock was only corrected on this hop, so the record is corrected now.
The `sort` record said the registration declares no `sort` input.
objectui#8220 now declares one, in the same array form, and also on
`object-gantt` and `object-timeline`.

Files: `component.zod.ts`, `component.test.ts`, `view.zod.ts`,
`dataset.zod.ts`, `functional-completeness.ts`,
`api-methods-batch-conformance.test.ts`, the six
`migrations/entries/semantic/18.*` entries, and the regenerated
`registry.ts` and `view.mdx`. No key, default, enum member or export
moves.

## Boot at the new pin

- **Build:** `scripts/build-console.sh` ran at `e420df310f5b` with this
tree's client and spec injected, and its VERDICT was command-exit 0.
  - The canary `import/jobs` is present.
- `assert-console-spec-injection` passes: 22 of 22 injected-only
descriptions are present, and all 6 published-only ones are absent.
  - `chunk-membership.json` reads `client` in `vendor-objectstack`.
- The tracked manifest it shipped is recorded at this pin. The dist is
62660 KB.
- **Server:** `examples/app-showcase` booted with `objectstack dev --ui
--fresh --no-seed-admin --no-watch -p 41949` on the whole-workspace
build of the merged tree. `bootstrap-status` answered `hasOwner: false`.
- **Registration:** headless Chromium (`/opt/pw-browsers/chromium`)
opened `/_console/setup` and submitted the owner form.
  - `bootstrap-status` flipped to `hasOwner: true`.
- In-page `get-session` returned the new owner with positions
`platform_admin`, `org_owner` and `everyone`, and `isPlatformAdmin:
true`.
- The wizard exited to `/_console/home`, which lists Showcase and Setup.
- **Second sign-in:** a fresh context signed in through
`/_console/login`.
- Showcase opened
`/_console/apps/com.example.showcase/page/showcase_capability_map`.
- Setup opened
`/_console/apps/com.objectstack.setup/dashboard/system_overview`.
  - Neither page showed a compile or render error.
- **Errors:** 0 page errors, 0 `TypeError` and 0 5xx across both passes.
- **Non-2xx:**
  - `401 GET /api/v1/auth/get-session` before each sign-in.
- `404 GET /api/v1/usage/storage`, which #20638's boot recorded at the
old pin too.
- The browser's implicit `404 /favicon.ico`. The console's `index.html`
declares an empty-href icon link, and that file is byte-identical at
both pins.
- **Note:** a first drive from `127.0.0.1` was refused at sign-up with
403 (Better Auth: `Invalid origin`). The server publishes `localhost`,
and the drive from `localhost` is the record above. That attempt wrote
nothing; `hasOwner` stayed false.
- **Teardown:** only the four recorded PIDs were stopped. The port is
free, and the `--fresh` tempdir went with the process.
- **Not repeated after the sdui-parser port:** the port touches nothing
the console loads. `build-console.sh` injects only this tree's
`@objectstack/client` and `@objectstack/spec` into the bundle.
`@objectstack/sdui-parser` runs server-side, in the JSX-page save gate
(`@objectstack/lint`, `@objectstack/metadata-protocol`). The change
there is one diagnostic code for an authored `quickAdd` on
`object-kanban` (`inert-quick-add` becomes `unknown-prop`, still a
warning), which the registration and sign-in path never reaches.

## Spec compatibility

objectui at `e420df310f5b` resolves every `@objectstack/*` package to
17.5.0 in its lockfile, the published `latest`. Its declared ranges top
out at `^17.5.0`. Its own CI on that commit concluded success for both
`Type Check` and `Spec Main Shape Gate`. The first compiles against the
installed 17.5.0 faces, and the second against objectstack `main`.

Here, objectui's dependency build ran against
`node_modules/@objectstack/spec` 17.5.0 with 0 TypeScript errors. No
objectui change in the range needs an unreleased spec.

## Governed surface

None of the 25 changed paths is a row of `GOVERNED_SURFACES` in
`scripts/pm/check-governed-merges.mjs` (`governedPathsIn` returns none).
No release act was performed. The diff is 1950 changed lines, under the
5000-line human-merge threshold.

## Resolved since the first report

Both answers are on #20949 in `5923109668`.

1. **ADR-0087 disposition, the maintainer's ruling** 「not-required
(推荐)」: `.changeset/console-e420df310f5b.md` now carries `adr-0087:
not-required (no-migration-prescription)` in place of the bump script's
placeholder. It is worded after #20638's and fitted to this diff:
- It names the paths this diff moves, and states that the diff adds,
removes or renames no ObjectStack-authorable key.
- It names the five declared-breaking entries as objectui's own
surfaces: `52aad5cef`, `615346d61`, `6f864cf62`, `3c13675e5` and
`846cec0ef`.
- It notes that `object-kanban.quickAdd` is already registered on this
side as `page.component.object-kanban.quickAdd` (#17260).
- The sdui-parser changeset carries the same disposition, worded as the
ObjectStack mirror of `6f864cf62`.
- `check-adr-0087-registration --base origin/main` exits 0: 2
declared-breaking changesets, each with a disposition.
2. **`check:sdui-lockstep` code-drift `inert-quick-add`, the seat's
ruling A:** the port is above, and the gate exits 0.

Gates at head `62ec639b04`: 125 derived, 125 run, 0 NOT-MEASURED, 0
unrun, and all 125 exit 0. The 11 artifact-roster gates whose roster
sits in a touched directory also all exit 0.
- `@objectstack/spec`: tests 17211 passed and 1 todo, across 584 files;
typecheck exit 0.
- `@objectstack/sdui-parser`: 217 tests passed across 13 files;
typecheck exit 0.
- `@objectstack/lint` (its three JSX-page and lazy-deps suites): 20
tests passed.
- `@objectstack/metadata-protocol`: 2896 tests passed and 19 skipped.
- Whole-workspace build: 72 of 72 tasks.
- The rewritten `inert-quick-add` pin was reverse-checked once. With the
three pre-port sources restored from `b1da822c0f`, 4 of its 6 rows go
red. The `false` and braced-marker rows stay green, because the interim
never fired for them. Restored, `git diff HEAD` is empty and both edited
files' blobs equal `HEAD`'s.

---
_Generated by [Claude
Code](https://claude.ai/code/session_018fxqvRJW12TaHC7DUQ89Y6)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/console-e420df310f5b.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/spec': patch
+---
+
+The spec's objectui citations, and the shipped description text that names the `.objectui-sha` pin (the `FormField.span` describe and six migration-entry descriptions), are re-measured against the new console pin, objectui `e420df310f5b`.
+
+Clause-②: no
+
+Several records were corrected rather than moved, because objectui changed what they describe on this hop: the four `action:*` registrations now publish the keys their rows declare, `endpoint` and `undoable` aside (objectui#11168), `action:group` and `action:menu` now apply a host-evaluated `disabled` that their rows do not declare (objectui#11182, recorded, not declared), the `object-kanban` default row cap is named `DEFAULT_KANBAN_FETCH_BATCH_SIZE` (objectui#9853), the board no longer forwards `quickAdd` (objectui#8285, objectui#11234), the `object-tree` ladder now judges `data` on the `view-data` arm its row declares (objectui#8348), and `object-map` / `object-gantt` / `object-timeline` now publish `filter` and `sort` inputs (objectui#8220). Two older statements that were already stale are also corrected: an authored `data` array on `object-map` no longer reaches the renderer through the React props channel (objectui#9571), and the `quickAdd` retirement record now notes that the schema-only `kanban-ui` block it points to is retired in objectui (objectui#8257). No key, default, enum member or export moves.

.changeset/objectui-pin-citations-e420df310f5b.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/sdui-parser': minor
+---
+
+fix(sdui-parser)!: the interim `inert-quick-add` diagnostic is retired, mirroring objectui `6f864cf62` (objectui#8285)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) This is the ObjectStack mirror of objectui `6f864cf62`, one of the five upstream declared-breaking entries the console pin bump to objectui `e420df310f5b` carries, and the port `check:sdui-lockstep` demands so both parser copies keep one diagnostic-code set. It removes no ObjectStack-authorable key: `@objectstack/spec` already refuses `quickAdd` on `object-kanban` by tombstone, registered as `page.component.object-kanban.quickAdd` (#17260), so no document changes shape and `objectstack migrate meta` has nothing to rewrite. What moves is this package's own TypeScript surface and diagnostic payload, stated below. -->
+
+**BREAKING**: shipped as `minor` under the launch-window convention. The save-time parser stops emitting the interim `inert-quick-add` warning for an authored `quickAdd` on `<object-kanban>`. The prop walk's own `unknown-prop` warning replaces it, so severity is unchanged and no page that saves today stops saving. The package's barrel no longer exports `checkKanbanQuickAdd`, `INERT_QUICK_ADD`, `QUICK_ADD_HOST_TYPES` or `QUICK_ADD_KEY`. A caller that matched on the `inert-quick-add` code should match `unknown-prop` on the `quickAdd` key instead, and an importer of those four names should delete the import: nothing replaces them. On the authored side, delete the `quickAdd` key: the spec refuses it by name.

.changeset/sdui-parser-retire-inert-quick-add.md

@@ -1 +1 @@
-db11afd4967cd9d39381c5e21dc2deec9d706204
+e420df310f5ba9526fd19d5fe65c2a52d6ac6d8c

.objectui-sha

@@ -213,7 +213,7 @@ Column footer summary configuration
 | **required** | `boolean` | optional | Required override |
 | **hidden** | `boolean` | optional | Hidden override |
 | **colSpan** | `integer` | optional | Absolute column span (1-4). The renderer clamps it to the form grid's current column count, so the cell starts at a real column boundary at every surface width and never overflows (`colSpan: 4` in a 3-column grid renders as 3); a `colSpan` within the column count renders as authored, and `colSpan: 1` emits no span class at all. |
-| **span** | `Enum<'auto' \| 'full'>` | optional (default: `"auto"`) | Relative field width. 'auto' (default — omit it): the renderer sizes the field from its widget type × the current column count — at the pin this repo builds against (`.objectui-sha` = `db11afd4967c`), only textarea, markdown, html, richtext and repeater resolve to the full column count (repeater reaches it through the wide `field:grid` widget it maps to). 'full': resolves to the form grid's full column count. How far down the container-query tiers that span is emitted is the renderer's, not this key's: at that same pin the renderer emits one clamped col-span class per multi-column tier (`@md:col-span-2 @2xl:col-span-3` for a 3-column grid), so the field takes the whole row at every multi-column tier, not just the widest. |
+| **span** | `Enum<'auto' \| 'full'>` | optional (default: `"auto"`) | Relative field width. 'auto' (default — omit it): the renderer sizes the field from its widget type × the current column count — at the pin this repo builds against (`.objectui-sha` = `e420df310f5b`), only textarea, markdown, html, richtext and repeater resolve to the full column count (repeater reaches it through the wide `field:grid` widget it maps to). 'full': resolves to the form grid's full column count. How far down the container-query tiers that span is emitted is the renderer's, not this key's: at that same pin the renderer emits one clamped col-span class per multi-column tier (`@md:col-span-2 @2xl:col-span-3` for a 3-column grid), so the field takes the whole row at every multi-column tier, not just the widest. |
 | **widget** | `string` | optional | Custom widget/component name (overrides type-based inference) |
 | **language** | `string` | optional | Code editor language (for type=code) |
 | **keyField** | `{ field?: string; label?: string \| Record<string, string>; placeholder?: string \| Record<string, string>; helpText?: string \| Record<string, string>; … }` | optional | Key column config for record-typed fields |
@@ -378,7 +378,7 @@ View filter rule
 | **required** | `boolean` | optional | Required override |
 | **hidden** | `boolean` | optional | Hidden override |
 | **colSpan** | `integer` | optional | Absolute column span (1-4). The renderer clamps it to the form grid's current column count, so the cell starts at a real column boundary at every surface width and never overflows (`colSpan: 4` in a 3-column grid renders as 3); a `colSpan` within the column count renders as authored, and `colSpan: 1` emits no span class at all. |
-| **span** | `Enum<'auto' \| 'full'>` | optional (default: `"auto"`) | Relative field width. 'auto' (default — omit it): the renderer sizes the field from its widget type × the current column count — at the pin this repo builds against (`.objectui-sha` = `db11afd4967c`), only textarea, markdown, html, richtext and repeater resolve to the full column count (repeater reaches it through the wide `field:grid` widget it maps to). 'full': resolves to the form grid's full column count. How far down the container-query tiers that span is emitted is the renderer's, not this key's: at that same pin the renderer emits one clamped col-span class per multi-column tier (`@md:col-span-2 @2xl:col-span-3` for a 3-column grid), so the field takes the whole row at every multi-column tier, not just the widest. |
+| **span** | `Enum<'auto' \| 'full'>` | optional (default: `"auto"`) | Relative field width. 'auto' (default — omit it): the renderer sizes the field from its widget type × the current column count — at the pin this repo builds against (`.objectui-sha` = `e420df310f5b`), only textarea, markdown, html, richtext and repeater resolve to the full column count (repeater reaches it through the wide `field:grid` widget it maps to). 'full': resolves to the form grid's full column count. How far down the container-query tiers that span is emitted is the renderer's, not this key's: at that same pin the renderer emits one clamped col-span class per multi-column tier (`@md:col-span-2 @2xl:col-span-3` for a 3-column grid), so the field takes the whole row at every multi-column tier, not just the widest. |
 | **widget** | `string` | optional | Custom widget/component name (overrides type-based inference) |
 | **language** | `string` | optional | Code editor language (for type=code) |
 | **keyField** | `{ field?: string; label?: string \| Record<string, string>; placeholder?: string \| Record<string, string>; helpText?: string \| Record<string, string>; … }` | optional | Key column config for record-typed fields |

content/docs/references/ui/view.mdx

@@ -6,23 +6,22 @@
   ],
   "objectui": {
     "repo": "https://github.com/objectstack-ai/objectui.git",
-    "rev": "db11afd4967cd9d39381c5e21dc2deec9d706204",
-    "revDate": "2026-09-29T18:01:28+00:00",
+    "rev": "e420df310f5ba9526fd19d5fe65c2a52d6ac6d8c",
+    "revDate": "2026-09-30T22:03:26+00:00",
     "source": "packages/sdui-parser/src",
     "files": [
       "packages/sdui-parser/src/body-dialect.ts",
       "packages/sdui-parser/src/codegen.ts",
       "packages/sdui-parser/src/dashboard-widget-options.ts",
       "packages/sdui-parser/src/index.ts",
       "packages/sdui-parser/src/input-type.ts",
-      "packages/sdui-parser/src/kanban-quick-add.ts",
       "packages/sdui-parser/src/parse.ts",
       "packages/sdui-parser/src/provenance.ts",
       "packages/sdui-parser/src/types.ts",
       "packages/sdui-parser/src/validate.ts"
     ]
   },
-  "recordedAgainstPin": "db11afd4967cd9d39381c5e21dc2deec9d706204",
+  "recordedAgainstPin": "e420df310f5ba9526fd19d5fe65c2a52d6ac6d8c",
   "grammarRegion": {
     "file": "packages/sdui-parser/src/parse.ts",
     "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",
@@ -39,7 +38,6 @@
     "forbidden-attr",
     "forbidden-tag",
     "inert-expression",
-    "inert-quick-add",
     "invalid-enum",
     "member-type-mismatch",
     "mismatched-tag",