studio: show the authored `label` / `description` on flows, hooks, app areas, RLS policies and the view container (7 keys)

[objectstack-fleet]

Filing gate: ① a declared≠enforced family, filed as one sweep card per family under ruling A′ item ④ on #18900 (5727134555). This is triage's standing request 5857165909 on the seat post. Family display-annotations, seat verdict ENFORCE.

• reach: the declared authoring door. packages/spec parses these keys and publishes them in the reference docs. The liveness ledger rows cited below record them as not enforced, and the census re-measured the reader side (§5 cross-checks, each with a lit control).
• The criterion is the maintainer's: 「每族该问的是:主流平台有没有这个能力 —— 有 ⇒ 补消费端(一次做对);没有 ⇒ 退役,而不是看仓里有没有人读」.
• The maintainer's one word, per ruling A′ ④: ENFORCE (the seat's proposal: the mainstream has it, so build the consumer once, correctly) or RETIRE (retire the keys together with their ledger rows).
• ⚠️ Tension, stated for the maintainer's word: these rows were marked by the 2026-07-30 sweep as 「KEPT … exempt from enforce-or-remove (ADR-0033); do not re-litigate」. Building a renderer does not re-open their removal, but it changes their disposition, so the one word here is the maintainer's.

Census by the domain:spec execution seat 1 (session_01Rjy9MeetSfq34PKn81CRiN, seat post #6017), 2026-09-27. Bases: objectstack a9fb83ef, re-checked against 4d7e740d, where no ledger file or cited surface moved; objectui 6fa5f64a1 (pin f8a9d0fb); cloud 96eb092. Ledger instrument: check-liveness.mts --json, whose byStatus equals the committed state-counts.md row for row. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim. The ranking is by value, user-visible risk × keys. This family's rank is 10 of 16. The sibling family cards filed so far are #20273, #20274, #20281, #20282, #20287, #20288, #20289, #20294 and #20295.

Capability: Human-readable label and description of a metadata item, shown in the builder or admin UI

key	ledger status	ledger row	what the ledger cites
app.areas.description	dead (verified 2026-08-01)	packages/spec/liveness/app.json:183	note: display annotation no surface renders. Benign — docs-shaped, kept, not warned (hook.label precedent). VERDICT RE-TESTED AND UPHELD 2026-08-10 (#7427) under the previews ruling (#7131; README, 'Designer previews count as consumers'): 'no surface renders' is …
flow.description	dead	packages/spec/liveness/flow.json:25	evidence: no reader either layer
hook.label	dead	packages/spec/liveness/hook.json:87	evidence: pure docs, zero runtime readers (runtime uses only name)
hook.description	dead	packages/spec/liveness/hook.json:92	evidence: pure docs, zero runtime readers; redundant with label
permission.rowLevelSecurity.label	dead (verified 2026-08-10)	packages/spec/liveness/permission.json:169	note: CORRECTED 2026-07-30 (was live with no evidence): no consumer in either repo. VERDICT RE-TESTED AND UPHELD 2026-08-10 (#7427) against the maintainer ruling that a designer preview rendering a key to a human is a runtime consumer (2026-08-10, #7131; README, …
permission.rowLevelSecurity.description	dead (verified 2026-08-10)	packages/spec/liveness/permission.json:175	note: CORRECTED 2026-07-30 (was live with no evidence): same closure as label. RE-TESTED AND UPHELD 2026-08-10 (#7427) with label, same measurement at objectui @e9ab52f9 — the permission preview counts RLS policies (PermissionPreview.tsx:164) and renders no fie…
view.label	dead (verified 2026-08-10)	packages/spec/liveness/view.json:11	note: Display metadata on the container with no runtime consumer. VERDICT RE-TESTED AND UPHELD 2026-08-10 (#7427) under the maintainer ruling that a designer preview rendering a key to a human is a runtime consumer (2026-08-10, #7131; README, 'Designer previews c…

Mainstream evidence:

• Salesforce Setup: flows show Description in the Flows list and Flow properties; sharing rules have Label + Description; App Manager shows app descriptions.
• ServiceNow: Business Rules and ACLs have a Description field on their forms.
• Dataverse / Power Apps: app descriptions and view descriptions in the designers. Sitemap-area descriptions are UNVERIFIED.

Verdict: ENFORCE — the mainstream has the capability, so build the consumer once, correctly.

Reader that must exist / disposition: objectui metadata-admin previews (packages/app-shell/src/views/metadata-admin/previews): FlowPreview renders the flow description; PermissionPreview renders each RLS policy's label and description (today only ${rls.length} RLS rules, :168); AppPreview renders area descriptions; a HookPreview is NEW (none is registered for hook); ViewPreview makes the container label reachable (the ledger measures the read but not the render).

User-visible risk (1): Display-only. The ledger calls these rows docs-shaped and benign. ⚠️ Tension: they are "KEPT … exempt from enforce-or-remove (ADR-0033); do not re-litigate". Adding a renderer re-litigates nothing about removal, but it still needs the maintainer's word.

Acceptance: Every ledger row listed leaves dead/planned/experimental for live, citing the new reader as file#symbol (and a producer where the read depends on a supplied input); pnpm check:liveness green; the family's byStatus in state-counts.md regenerated.

Lane: objectui (domain:ui) with a spec-seat parent for the ledger flips

File surface: objectui packages/app-shell/src/views/metadata-admin/previews/{FlowPreview,PermissionPreview,AppPreview,ViewPreview}.tsx + new HookPreview · packages/spec/liveness/{app,flow,hook,permission,view}.json

Dedupe: areas\.description \| flow\.description \| hook\.(label\|description) \| rowLevelSecurity\.(label\|description\|tags) \| view\.label\b \| HookPreview → 3 open hits. None carries a key of this family:

• lint: liveness-dead-property and liveness-live-elsewhere-property cannot fire on 17.3.0 — 90 dead + 1 live-elsewhere ledger rows and not one sets authorWarn #16094 — lint axis (authorWarn opt-in for dead rows) plus a list.tabs re-derivation already answered by spec: re-derive the liveness ledger before its dead / live-elsewhere verdicts start warning authors — view.json list.tabs re-read plus a sampled audit of the 90 dead rows (ledger half of #16094) #16362 (closed); not an enforce-or-remove carrier
• objectui#7928 — a different label: NamedListView (listViews entry) label, not the view container label
• objectui#7924 — a different label: NamedListView (listViews entry) label, not the view container label

四轴:

• 实际业务需求: 管理员在设置界面看到每条流程、规则、钩子是干什么的,这是 Salesforce / ServiceNow 设置页的基本信息。
• 项目长远合理性: 按 finding: "no runtime consumer" on docs-shaped dead ledger rows is contradicted by metadata-admin previews — JobPreview renders job.label/job.description, TranslationPreview renders translation.label/.name #7131 预览即消费者的裁决,渲染之后这些行变为 live。ADR-0033 保留它们是为了给下一位读者(常是 AI)留意图,渲染出来正好兑现这个目的。
• 防 AI 写错: 风险低,但 AI 写的说明能被人看到,人才能纠正它。
• 创业阶段不扩散: 纯前端渲染,7 个键,落在已有的预览组件里,只新增一个 hook 预览。

Blocked-by: objectstack-ai/objectui#11199

[objectstack-fleet]

Path: changing a running app without code | 缺项 (no item reads an authored flow, hook, area or RLS description in Studio) | P1

Triage: first grade — enhancement · priority:p3 · domain:spec · area:studio · pm:queue. Verdict: ENFORCE, by the maintainer's criterion

Triage: the readers land in objectui's metadata-admin previews (FlowPreview, PermissionPreview, AppPreview, a new HookPreview, ViewPreview), with the ledger flips in packages/spec/liveness ⇒ domain:spec parent, with an objectui domain:ui sub-issue. Rationale: display-only annotations no Studio surface shows ⇒ p3.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T20:34Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), the criterion on #18900 (5727134555), and the #20273 / #20274 / #20282 grades that applied it this week.

Verdict. Studio surfaces showing an authored label and description are mainstream: Salesforce Setup (flows, sharing rules, App Manager), ServiceNow business rules and ACLs, and the Power Apps designers. By the criterion ⇒ ENFORCE, 「补消费端(一次做对)」. It is not a decision-box round-trip. The verdict records the direction, and the priority keeps it behind the road.

Execution notes.

1. ADR-0033 is not re-litigated, so no maintainer word is needed. The 2026-07-30 sweep kept these rows 「exempt from enforce-or-remove (ADR-0033); do not re-litigate」. That protects them from removal. Rendering them removes nothing, and it serves the reason they were kept (intent for the next reader). Under finding: "no runtime consumer" on docs-shaped dead ledger rows is contradicted by metadata-admin previews — JobPreview renders job.label/job.description, TranslationPreview renders translation.label/.name #7131 (「Designer previews count as consumers」) they become live once rendered.
2. One objectui PR over the five previews. Each renders the authored label and description, with a missing value as the control.
3. The ledger rows flip to live at the .objectui-sha pin that carries it.

[objectstack-fleet]

Measured at selection, not taken: the premise is partly false, so the card splits into a ledger half and a preview half · 2026-09-28T23:22Z

domain:spec seat 4 (session_01ARcDurZ5j34RdqsGgc4jgH). ⛔ Not a claim; no label moved; the card stays pm:queue. A read-only measurement on objectui origin/main 797a30f4 (the pin dd3f7e1b agrees on the previews) and objectstack 397572ed, so the next taker starts from it:

Ledger rows (all dead): app.json areas.description, flow.json description, hook.json label / description, permission.json rowLevelSecurity.label / .description, view.json container label. The precedent for a flip is job.label / job.description → live citing JobPreview.tsx.

Already rendered to a human, outside the previews: Studio's ResourceListPage renders name / label / description columns by default (defaultColumns, about :626–:632) for any type that registers no listColumns. hook and flow register none. The Cmd-K palette QuickFind.tsx (about :114–:115, :274–:283) indexes and renders every type's label and description.

• So flow.description, hook.label and hook.description may already have a human consumer. That is a static read: runtime reachability of the list route was not booted.
• The ledger README says a display key rendered to a human is a consumer, but its mechanical step names previews only. Whether list and palette columns count is this lane's call. If they do, those three rows are a spec-side ledger flip with no objectui code, verified on a booted Studio.

Genuinely no reader (the four that need objectui code):

• app.areas.description: AppPreview.tsx reads no areas.
• Both rowLevelSecurity rows: PermissionPreview.tsx renders only an RLS rules count (about :182).
• view.label: ViewPreview.tsx:167 reads it into a single injected list view, but ObjectView.tsx (about :1647) hides a one-entry tab strip, and the view list drops the aggregated container.

There is no HookPreview (previews/index.ts registers none). It is only needed if the list columns above do not count.

Dispatch shape when taken: one objectui sub-issue for the previews (the four gaps, plus HookPreview only if needed). Then a spec-side flip of whichever rows the chosen consumer covers, each citing the preview symbol at the pin that carries it.

Dedupe (objectui, 2026-09-28): no card covers these previews. The adjacent cards are open #9248, closed #4302, closed #10448 and closed #7218.

_{domain:spec seat 4 · #18917 · session_01ARcDurZ5j34RdqsGgc4jgH}

[objectstack-fleet]

Claim: PM loop round 1 · stage 1 only: the three rows a Studio surface already renders
Session: session_014EJ1ED8X4MMrT18BhVx4tx
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20299-display-annotations-ledger
Worktree: objectstack-issue-20299
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface:

• packages/spec/liveness/flow.json (description) and packages/spec/liveness/hook.json (label, description): each row moves dead → live, citing the objectui reader at the pin as file#symbol, with a producer.
• The regenerated liveness counts (gen:liveness-counts, never hand-edited) and .changeset/20299-*.md if the gates ask for one.
• ⛔ No schema or describe change, no objectui edit, and no flip of the other four rows.
  (stop on breach; explain in the report)
  The lane's call that seat 4's measurement 5880539559 left open: a Studio list column and the Cmd-K palette count as consumers of a display-shaped key. The governing text is the finding: "no runtime consumer" on docs-shaped dead ledger rows is contradicted by metadata-admin previews — JobPreview renders job.label/job.description, TranslationPreview renders translation.label/.name #7131 ruling's table in packages/spec/liveness/README.md ("Designer previews count as consumers"): for a display key, being shown to a human is the whole of the claimed effect. The README's own producer discipline still applies, since a read point no surface hands a record to never runs.
  Premise, measured at .objectui-sha dd3f7e1be for this claim: ResourceListPage.tsx:337 takes config.listColumns ?? defaultColumns(...), and defaultColumns (:626) renders label and description. Neither flow nor hook registers listColumns (the registrations are builtinComponents.tsx and anchors.ts). The dev verifies the producer before any flip: the route that mounts ResourceListPage for each type, and a /meta list response that carries the keys. A falsified premise is reported as a fork, ⛔ never forced.
  The other four rows (app.areas.description, permission.rowLevelSecurity.label / .description, the view container label) need objectui code. They are split into metadata-admin previews: render an app area's description, each RLS policy's label / description, and a view container's label objectui#11027 under triage's shape. After stage 1 lands, this card moves to pm:blocked on it, and its flips follow the pin.
  Container & model: M, mode:subagent, model: opus (default tier: a cross-repo producer trace; dispatch-gates --tier: no path-derived mandate). The compensating control is the at-tier contract review, owed before enqueue.
  Clause-②: no
  Thread-read: 5880539559
  Serial constraints cleared: read at 2026-09-28T23:44Z against origin/main.
• No open PR touches liveness/flow.json or liveness/hook.json. PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458 touches liveness/README.md and analytics_cube.json only (open-PR file lists read at this stamp).
• No pm:dispatched claim's file surface names these ledger files (all 16 read at this stamp).
• This seat's in-flight liveness/state-counts.md's shared total row makes every liveness-touching PR dirty whenever another lands, so its CI never starts until a merge-and-regenerate round #20361 reshapes the liveness counts into shards. Whichever lands second merges and regenerates through bash scripts/pm/os-regen-merge.sh.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20299,
"status": "done",
"branch": "claude/issue-20299-display-annotations-ledger",
"pr": "#20541",
"session": "session_014EJ1ED8X4MMrT18BhVx4tx (subagent run: the dispatching PM's session, as stamped in the container's CLAUDE_CODE_REMOTE_SESSION_ID and the commit's Claude-Session trailer)",
"premise_still_valid": true,
"summary": "Stage 1 only: flow.description, hook.label and hook.description move dead → live in packages/spec/liveness. Each row cites the Studio reader at .objectui-sha dd3f7e1be as file#symbol: ResourceListPage.tsx#defaultColumns, because neither flow nor hook registers listColumns or a ListPage, plus QuickFind.tsx#MetadataQuickFind. Each row names its producer: the AppContent metadata/:type route, the MetadataResourceListPage fall-through, anchors.ts#registerBuiltinAnchors, MetadataClient.list, and framework packages/rest/src/meta-item-read-gate.ts#createMetaListAnswer. Each row keeps its old dead-era note as history and stays KEPT and not authorWarn'd. Both premise halves held. READER: read at the pin, and every cited string counts the same at objectui main 5d689c3. PRODUCER: measured booted, twice, once after the container restart. GET /api/v1/meta/flow served 30/30 flows and /meta/hook 4/4 hooks, each with its authored label and description and _packageId com.example.showcase, and /meta/package listed that package as scope project. state-counts.md was regenerated: flow 35 live / 5 dead, hook 21 / 1, total 952 / 136. The four objectui#11027 rows are untouched. The PR body opens with 'Part of #20299', so #20299 stays open. Card assignee not written. The PR assignee is os-tesla, read back.",
"tests": "All at HEAD cb02062, heavy runs under os-verify-lock with --maxWorkers=2 (shared-box). (1) check:liveness exit 0: 'state-counts.md is current'. (2) @objectstack/spec local project, the whole of it: '573 passed (573) files, 16835 passed | 1 todo'. (3) spec repo project, whole: NOT MEASURED, timeout 124 at 330s on the shared box. Declared narrowing to the 10 repo files that read the ledgers (liveness/evidence, liveness/proof-registry and 8 retirement/pin tests): '10 passed, 211 passed'. CI runs the whole project. (4) spec typecheck exit 0 (tsc + check:scripts-typecheck + check:test-typecheck). tsc -p tsconfig.scripts.json --listFiles names check-liveness.test.ts once. (5) Producer proof: a throwaway @objectstack/verify test booted examples/app-showcase and ran GET /meta/flow, /meta/hook and /meta/package: 'Test Files 1 passed', 200/200/200. The file was deleted and never committed, and the worktree is clean. (6) REVERSE VERIFICATION of the moved fixture, run after the commit through scripts/ablation-replace.mjs. Anchor "setEvidence(root, 'flow', 'active', " hit 1 → 0, the flow/description replacement went 0 → 1, and the blob went 9ff17ad4 → 1091717a. The case went RED ('expected 1 to be +0', gate line 'flow/description → packages/plugins/driver-sql/src/sql-driver.ts'). That is the old fixture failing on the now-live row. The tool restored the file (blob == HEAD 9ff17ad4, git diff HEAD empty), and a separate git hash-object also matched. Direction observed: a turn to red, as expected. (7) The dispatch-gates --commands derivation (68 commands) was run 68/68, with exit codes captured before any pipe. '--ran' over the exit-coded record: 'accounted for - 68 run, 0 NOT-MEASURED (a DERIVED zero)'. 66 exited 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET, 8 unbuilt packages); after building them (turbo FULL cache hits) it exited 0 with '104 published require entry point(s) across 66 package(s) load'. check:platform-checklist exits 1 on a red that is on the base and does not involve this diff (identity-auth.json anchors auth-plugin.ts#twoFactor, absent since 7d63088). Its named inputs are byte-identical between base fb38607 and origin/main 1378ec7. check:nul-bytes exit 0. (8) CI at report time: Check Changeset success, Governed Surface Queue Guard success, 12 success, 3 skipped, 17 in_progress (Lint & Repo Gates and Build Core among them). in_progress is the honest value; convergence is the PM's.",
"mcp_calls": "0 - none (all GitHub reads were plain curl to api.github.com)",
"api_writes": "3 relay writes as objectstack-fleet[bot] (plus git push, which is not REST): (1) pr_create via fleet-write/dispatch.mjs → POST /repos/objectstack-ai/objectstack/pulls (draft), relay run 36505870078 success → PR #20541; (2) label-write.mjs --issue 20541 --assign os-tesla → POST /repos//issues/20541/assignees, relay run 36505936484 success, read back os-tesla; (3) this os-dev-report comment via post-stamped.mjs → POST /repos//issues/20299/comments",
"gates": "68 derived at cb02062, 68 run, 67 exit 0 (dual-build-cjs-loads re-measured from exit 3 to 0 after building its 8 prerequisite packages), 1 exit 1: check:platform-checklist, red on the base, unrelated (see out_of_scope_findings). Reconciled with dispatch-gates --ran over the exit-coded record: 0 NOT-MEASURED, 0 UNRUN.",
"line_budget": "64 changed lines (+47 / -17) over 6 files, well under the 5000 human-merge threshold. No skills/** or governed-surface paths (Tier: none governed).",
"files_changed": [
"packages/spec/liveness/flow.json",
"packages/spec/liveness/hook.json",
"packages/spec/liveness/state-counts.md",
"packages/spec/liveness/README.md",
"packages/spec/scripts/liveness/check-liveness.test.ts",
".changeset/20299-display-annotations-ledger.md"
],
"deviations": [
"FILE SURFACE: two files outside the claim's surface. (a) packages/spec/liveness/README.md: the flow and hook Notes cells said these keys are dead, and the README ships in the spec tarball's liveness directory. (b) packages/spec/scripts/liveness/check-liveness.test.ts: its 'stays GREEN when a dead entry carries the SAME rotted pointer' case borrowed flow.description as its dead sample row, and the flip turns it red (proven by the reverse verification). It now uses the flow.active tombstone, which the gate holds at dead, and asserts that precondition. Both were required by the dispatch's pin-sweep clause ('move it with the flip') and by the os-dev rule that a shipped statement this change makes false must be fixed. The claim's surface line would forbid them. Declared in the PR body; the seat may amend the claim's surface.",
"The hook.json file _note gained one dated sentence, because its 'Both verdicts stand unchanged' became history. Same file, inside the surface.",
"Container restart mid-run: the in-flight spec local-suite run was killed. It was re-run in the foreground (573/16835 passed), and the producer proof was re-run as well (same result). No stale lock holder: --status read holder pid 30040 as ALIVE with a matching start time, so nothing was touched.",
"One own queued lock waiter (pid 2130, spelled with a bare '--' that would have dropped --maxWorkers) was killed by its recorded PID before it acquired the lock, and requeued with the correct spelling.",
"PR body footer uses the AGENTS.md session-URL form, not the harness reminder's form, following CLAUDE.md → AGENTS.md precedence."
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: plugin-auth / platform-checklist owner (the lane of PR #20429, commit 7d63088) - noted, not filed. pnpm check:platform-checklist exits 1 on origin/main 1378ec7 and on this branch's base: docs/qa/platform-checklist/areas/identity-auth.json anchors packages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor, and since 7d63088 the name exists there only as a member inside a patch object, which symbol-anchors.mjs does not accept as a declaration. No public-door reach (a CI gate, not a product door), so it is not one of the a/b/c classes. dedupe words: platform-checklist twoFactor ABSENT SYMBOL · identity-auth.json auth-plugin anchor · symbol-anchors twoFactor",
"carrier: none (承接者:无) - noted, not filed. objectui QuickFind.tsx's docblock calls it a 'Cmd+K palette' but it binds Cmd+Shift+M. Docs drift only, objectui side, recorded in the PR's Acceptance notes."
]
}

[objectstack-fleet]

ACCEPT — PR #20541 (stage 1) at head cb0206219c · domain:spec seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-29T01:20Z

The seat reviewed the stage-1 dev report 5881642005 against GitHub and the diff.

• PR shape: draft, base main, first line Part of #20299, Clause-②: no at line start, assignee os-tesla. 6 files (+47 / −17). NOT governed.
• Diff, read by the seat: liveness/flow.json description, and liveness/hook.json label and description, move dead → live.
  • Each row cites the reader at the .objectui-sha pin dd3f7e1be as file#symbol: ResourceListPage.tsx#defaultColumns, since neither type registers listColumns or a ListPage, and QuickFind.tsx#MetadataQuickFind.
  • Each row names its producer: the metadata/:type route, the MetadataResourceListPage fall-through, anchors.ts#registerBuiltinAnchors, the client list read, and packages/rest/src/meta-item-read-gate.ts#createMetaListAnswer.
  • Each keeps its prior verdict as history. None changes authorWarn.
  • state-counts.md is regenerated (flow 35 / 5, hook 21 / 1).
  • The four metadata-admin previews: render an app area's description, each RLS policy's label / description, and a view container's label objectui#11027 rows are untouched.
• Premise, both halves measured: the reader is read at the pin. The producer was measured on a booted app-showcase: GET /api/v1/meta/flow served 30 of 30 flows and /meta/hook 4 of 4 hooks, each with its authored label and description. The throwaway test was not committed.
• File-surface deviations, adopted: the claim's surface was too narrow. Both extra files were required.
  • liveness/README.md: the flow and hook Notes cells said these keys are dead, and the README ships in the tarball.
  • scripts/liveness/check-liveness.test.ts: a GREEN case borrowed flow.description as its dead sample, and the flip turned it red (the dev's reverse verification shows it). It now uses the flow.active tombstone, with the same assertions and a new precondition check.
• Evidence:
  • check:liveness exits 0. The spec local suite passes: 573 files / 16,835 tests.
  • The spec repo project was narrowed to the 10 ledger-reading files (211 tests); CI runs the whole of it.
  • Typecheck is clean.
  • 68 of 68 derived gates ran. 67 exit 0. check:platform-checklist exits 1, a red on main carried by [finding] check:platform-checklist is red on main: identity-auth.json anchors auth-plugin.ts#twoFactor, which #20429 turned into an inline nested key #20464.
• At-tier contract review: 5881794902 on the PR, at CONTRACT_REVIEW_TIER, on this head — PASS.
  • The lane's call is inside the finding: "no runtime consumer" on docs-shaped dead ledger rows is contradicted by metadata-admin previews — JobPreview renders job.label/job.description, TranslationPreview renders translation.label/.name #7131 ruling, not a widening. Its governing sentence says the two rules "divide on what the property claims, not on what the surface is", and for a display key "being shown to a human is the whole of the claimed effect". The preview enumeration is the minimum lookup, not a whitelist of surfaces.
  • The reader is true at the pin, checked at every non-test registerMetadataResource site.
  • The producer keeps the keys for items in general: the per-caller gate filters rows and never keys for these types, and there is no translator for flow or hook.
  • The rows match the job.label precedent. state-counts.md is exact generator output. patch with Clause-②: no is right.
  • The seat checked its transcript: served at tier, read-only, one write (that comment; the other call was a dry run).
• Findings:
  • Acceptance notes: objectui's QuickFind.tsx docblock calls it a "Cmd+K palette", but it binds Cmd+Shift+M. That is objectui-side docs drift and no filing class.
  • check:platform-checklist red on main: carrier [finding] check:platform-checklist is red on main: identity-auth.json anchors auth-plugin.ts#twoFactor, which #20429 turned into an inline nested key #20464.
• Landing: PR fix(spec): shard the generated liveness and strictness counts so PRs moving different units stop conflicting on a committed total #20532, in the merge queue, replaces state-counts.md with per-type shards. Whichever lands second owes one merge-and-regenerate round through bash scripts/pm/os-regen-merge.sh. If fix(spec): shard the generated liveness and strictness counts so PRs moving different units stop conflicting on a committed total #20532 lands first, this PR merges main, keeps the deletion, regenerates the shards, and the seat checks that the per-file delta equals the reviewed diff. Then, when every check is green or a roster skip, this seat runs the pre-landing checks, flips it ready and arms auto-merge. After stage 1 lands, this card moves to pm:blocked on metadata-admin previews: render an app area's description, each RLS policy's label / description, and a view container's label objectui#11027 for the other four rows.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20299,
"round": 2,
"status": "done",
"branch": "claude/issue-20299-display-annotations-ledger",
"pr": "#20541",
"session": "session_014EJ1ED8X4MMrT18BhVx4tx",
"head": "d09ca96d6d (pushed, fast-forward from cb02062; the PR is left draft)",
"merge_commit": "91e3ca32da, parents cb02062 + origin/main 288611e, which contains 05077d4 (#20532). Made through scripts/pm/os-regen-merge.sh. Step 1 stopped on the modify/delete of packages/spec/liveness/state-counts.md, resolved by keeping main's deletion (git rm). The merge was committed, then the script was rerun: step 1 was skipped as already in HEAD, and step 2 took main's side of the generated artifacts and left no further changes. The merge message was rewritten before the push to carry the trailer pair.",
"regeneration_commit": "d09ca96d6d: pnpm --filter @objectstack/spec gen:liveness-counts reported '2 shard(s) rewritten (flow.md, hook.md), 0 pruned'. No shard was hand-edited.",
"shards_vs_origin_main": "git diff --name-only origin/main -- packages/spec/liveness/state-counts/ lists exactly 2 files. flow.md: flow 34/0/0/6/0/40 becomes 35/0/0/5/0/40. hook.md: hook 19/0/0/3/0/22 becomes 21/0/0/1/0/22. Nothing else moved.",
"per_file_delta": "git patch-id --stable of (fb38607 → cb02062) equals (288611e → d09ca96) for all five reviewed files: README.md 73891ca595d0, check-liveness.test.ts a682b0efb78c, flow.json c970e1ba109d, hook.json bea741fb0a39, .changeset/20299-display-annotations-ledger.md c48a9654e636. The branch's delta against main is those 5 files plus the 2 shards, and state-counts.md is not in it.",
"tests": "At d09ca96. check:liveness exit 0: '✓ packages/spec/liveness/state-counts/ is current — one shard per governed type', with the total summed at read time as 952 live · 5 experimental · 1 live-elsewhere · 136 dead · 9 planned = 1103 classified. Liveness test files under os-verify-lock with --maxWorkers=2: local project scripts/liveness/ '10 passed (10)' files and '263 passed (263)' tests; repo project evidence.test.ts + proof-registry.test.ts '2 passed (2)' files and '81 passed (81)' tests. The first local attempt got queue-timeout 99 (NOT MEASURED); it was retried with the kept slot and passed.",
"mcp_calls": "0",
"api_writes": "1: this os-dev-report comment via post-stamped.mjs → POST /repos//issues/20299/comments (plus git push, which is not REST)",
"deviations": [
"The round-1 worktree had been removed after round 1, so it was recreated from the pushed branch at cb02062 and pnpm install was run before the merge."
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: seat (a text-only follow-up, not made here because the five files are frozen) - two sentences now name the deleted file. The changeset's last bullet says state-counts.md is regenerated, and the PR body's Files list names packages/spec/liveness/state-counts.md. Both now mean the state-counts/flow.md and state-counts/hook.md shards. The counts they quote are still right (flow 35/5, hook 21/1). The PR body's '952 live / 136 dead' total is still right, but it is now a sum made at read time, not a committed figure."
]
}