sdui-parser: port inert-quick-add and member-type-mismatch from objectui, re-record the lockstep and bump the pin

[os-try-charles]

Fixes #17645

Clause-②: yes

Executes the director-seat ruling in card comment 5714974800 (decision batch #146 item 3), maintainer's verbatim 「146 同意」 — letter A: port inert-quick-add and member-type-mismatch into this repo's packages/sdui-parser, re-record the lockstep and bump the pin in the same PR.

Ported from

repo	objectstack-ai/objectui (READ-ONLY clone in the dispatch container)
revision	cfcc17d9dd04ebb80c092cacb4f4034425f51b29, 2026-09-14T11:40:39Z
path	packages/sdui-parser/src/{kanban-quick-add.ts,validate.ts,types.ts,index.ts,codegen.ts}

⚠️ That clone is 3 days older than the card's own reading (the card measured objectui on 2026-09-16). What that means for the lockstep record is stated under "What the record cannot see" below — it is a real bound, not a formality.

What each code actually guards

A reviewer should be able to tell a real port from a string copied across an enum. Neither code is a new red gate: both are warnings, so compile().ok — the save gate's pass/fail — is unchanged and a page that saves today still saves.

inert-quick-add (objectui#8285)

quickAdd on the object-kanban tag reaches no control. The Quick Add button is gated on both halves of a pair — quickAdd and an onQuickAdd handler — and onQuickAdd takes a FUNCTION, which no page on this tier can write (this tier parses, it never executes; a handler attribute draws forbidden-attr) and which the board substitutes none of its own for.

It replaces the diagnostic the prop walk used to emit for that key rather than joining it. The old reading was unknown-prop, "has no prop quickAdd" — false against the published contract, because ComponentPropsMap for that tag does publish quickAdd. An author who checked the spec found the warning contradicted, concluded the manifest was behind the spec, and kept a key that will never do anything; it also could not be told apart from a typo. Two diagnostics for one mistake is the shape checkMemberTypes already refuses, so this one continues the walk.

It is asked ahead of the declaration lookup on purpose: the claim is about the render path, which a declaration cannot change, so declaring quickAdd must not silently disarm it. Three things it deliberately does NOT fire on — a falsy value (the renderer's own gate is quickAdd && onQuickAdd, so the author got what they wrote), a braced value this tier never evaluates (opaque here), and any tag outside the one surviving host registration. Each has a control row in the tests.

member-type-mismatch (objectui#8067)

The coarse type check one level down, over the member kind an input declares. type: 'array' said a value was a list and stopped there, so a member that drifted from the contract was invisible to every layer that reads a declaration.

This is the half that makes it a port and not a string: the code needs a key that did not exist in this copy at all. The change brings ManifestInput.of and all three of its readers:

• the validator — any declared arm accepting a member clears it; a member no arm accepts is reported, as ONE diagnostic naming every offending position, at error severity when an enum arm is present and warning otherwise;
• the serializer — manifestFromConfigs canonicalizes of exactly as it canonicalizes type, and publishes NO of for an input that declares none (routing undefined through canonicalizeInputType, whose no-arms fallback is 'string', would make every array in every manifest claim string members it was never told it had);
• the codegen — a declared member kind narrows the emitted element type, so the .d.ts an author type-checks against and the manifest gate agree.

The member walk runs only once the CONTAINER kind was accepted, so a wrong container draws one diagnostic and not two.

Counts, each with a firing control

Base for every diff reading: 51297e9ee17db23f50d38c1431f5a4dcc47632ff.

Diagnostic codes — 26 = 26, sets identical element-for-element. Measured with the gate's own AST extractor (fingerprintOf), both trees, before and after:

	before	after
this repo	24	26
objectui @ cfcc17d	26	26

The delta was exactly inert-quick-add and member-type-mismatch — matching the card's 26/24 reading, so acceptance item 4 is met and nothing was absorbed.

The grammar region did not move across the pin hop. This repo's parse.ts region and objectui's at cfcc17d are both 214 lines, blob 0131f27cf86dbabec09b4ae55ae131403667e7e9 — byte-identical, and identical to what the old record held at 53ded82bf. So the pin bump ports no grammar change.

of declarations in the tracked manifest: 0 of 339 inputs. FIRING CONTROL on the same file: the term "inputs" occurs 57 times in sdui.manifest.json, and git diff BASE HEAD -- sdui.manifest.json | grep -c '"inputs"' reads 0 — the whole-file diff is 0 bytes. So the zero is a reading about the tree, not an artifact of this diff. The discriminating contrast: the same grep for of?: over git diff BASE HEAD -- packages/sdui-parser/src reads 2, so the term is one this diff really moves where it moved it.

⚠️ Read that 0-of-339 honestly: member-type-mismatch has no firing input in today's shipped manifest, because that manifest is generated from the PUBLISHED @object-ui/* 17.6.0 packages, which predate the of declarations. It is NOT inert — objectui's SOURCE at cfcc17d declares of in 38 places (e.g. the tabs and panels items inputs in containers.tsx), so those flow in at the next publish+pin, and the reader is pinned here through the real serializer rather than a hand-built fixture. Without this port, this repo's save gate would silently accept member drift that objectui's renderer reports.

objectui was never written to. git status --porcelain in that clone: 0 files. HEAD still cfcc17d9dd04ebb80c092cacb4f4034425f51b29.

Ablation ledger

Three ablations, each through scripts/ablation-replace.mjs — anchor declared and required to HIT, before/after anchor counts, git hash-object blob ids either side, restore proven by blob == HEAD AND an empty git diff HEAD, with an EXIT/INT/TERM trap. The tests resolve the subject through src (a relative intra-package import, no dist hop), which is why these run without a rebuild — measured: the suite passed before dist existed in this worktree at all.

#	mutation	anchor	blob	result
1	disarm checkKanbanQuickAdd's key guard	1 → 0	0d5131868ace → 99d89132858e	4 failed / 8 passed
2	make the validator's member check read no declared arms	1 → 0	156a264073f7 → 5cb7912d7f54	7 failed / 14 passed
3	make the codegen narrow no member type	1 → 0	76a7d654f1fd → ba55afbc8c19	3 failed / 18 passed

In each case the failures were exactly the SUBJECT rows and every control row stayed green — which is the split the control rows exist to produce. A first attempt at ablation 1 was REFUSED by the tool because the replacement still contained the anchor (count 1 → 1, "not the declared drop"); it is recorded here because the refusal is the tool working, and the run that produced the reading above is the corrected one.

The pin bump, and its second and third halves

.objectui-sha: 53ded82bf7a494f54e344e19099dbf00854b8694 → cfcc17d9dd04ebb80c092cacb4f4034425f51b29.

Second half — the manifest — is done and is a no-op in content. node scripts/gen-sdui-manifest-node.mjs --objectui-version 17.6.0 regenerates sdui.manifest.json byte-identical: sha256 49211fee7792cf51 before and after. Both pins ship @object-ui/* 17.6.0, so the published registry inputs did not move; only the record's objectuiSha and generatedAt follow the pin. check-sdui-manifest is green.

Third half — check:objectui-pin-citations — is RED and is NOT closed by this PR. See "Acceptance notes".

What the record cannot see

check-sdui-lockstep compares this tree against a VENDORED record of objectui's side. It can see this copy drifting from the recorded objectui state; it cannot see objectui moving AFTER the record was taken. This record was taken at cfcc17d (2026-09-14) — and the card's own reading of objectui is from 2026-09-16. Anything that landed in objectui's packages/sdui-parser in those two days is outside this record and outside this PR's evidence. The gate says so itself on every green run, and only a later pin bump brings the question back. The container's objectui clone is shallow with exactly one commit, so this cannot be narrowed here.

Gates

scripts/pm/dispatch-gates.mjs derived 67 families for this diff; re-derived after git fetch and the list was IDENTICAL, so the tool's STALE TREE warning does not move the answer. Reconciled with --ran recording every exit code: 67 derived, 64 run, 3 NOT-MEASURED, 0 UNRUN (exit 0).

• check:sdui-lockstep — green, both the gate and --self-test: byte-identical over 214 grammar lines and agreeing on all 26 codes. ⛔ The invariant was never relaxed to buy this: --update re-reads OBJECTUI's side only and never this tree's parser, so it cannot record "whatever we have now"; the green is the port being faithful.
• check:sdui-manifest — green (present, intact, fresh at the new pin).
• pnpm --filter @objectstack/sdui-parser test && … typecheck — green, 176 tests / 10 files.
• check:nul-bytes — green; plus a direct control-byte sweep over the changed files.
• check:dispatcher-error-vocabulary — was RED on this port and is now green; see "The one deliberate divergence".
• 3 families are NOT MEASURED, not passes: check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt each exited 3 = PREREQUISITE NOT MET (they need a full pnpm build), which is neither a pass nor a failure.
• check:query-options-erasure — green at 192s; an earlier 124 was this runner's own 150s timeout, not a finding.
• check:objectui-pin-citations — RED, deliberately left open. See below.

The one deliberate divergence from objectui

objectui stamps code: INERT_QUICK_ADD. This copy stamps the inline literal code: 'inert-quick-add' and keeps the exported constant. This is not drift and not a shortcut — it is the same documented divergence unconsumed-widget-option already carries next door: check:dispatcher-error-vocabulary's objlitconst shape must reduce a constant at a code: position to a literal, and its literal grammar cannot admit a kebab-case value, so the constant form is an unresolvable-constant finding that cannot be declared away. The gate caught this port doing it, which is the gate working.

⛔ It does not weaken the lockstep: that gate resolves an identifier at a code position through the package's own module-level constants, so both spellings reduce to the same code and the two copies still agree on all 26. A test row pins the literal equal to the constant so the two cannot drift apart.

Changeset

OWED, and measured rather than assumed — .changeset/17645-sdui-parser-lockstep-port.md, minor. The criterion is whether anything PUBLISHED moves: @objectstack/sdui-parser ships files: ["dist", …], and after a build both codes are present in the shipped bytes, against a negative control that reads zero everywhere:

symbol	index.js	index.mjs	index.d.ts
inert-quick-add	3	3	2
member-type-mismatch	1	1	0
checkKanbanQuickAdd	4	3	3
unconsumed-widget-option (positive control)	4	4	4
NEVER_SHIPPED_CONTROL_STRING (negative control)	0	0	0

That reading is also the answer to the Clause ② question the card asked to have re-judged if it measured otherwise: these codes DO reach a published surface, so the needs:contract-review declaration stands. The package's exported API grows by four symbols and one optional type key, which is why this is minor and not patch.

Acceptance notes

check:objectui-pin-citations is RED and this PR does not close it — this needs a decision.

The pin bump invalidates 26 packages/spec/** sources that cite .objectui-sha as "the pin this repo builds against" alongside hand-derived objectui file:line anchors. The gate refuses the cheap repair in terms: ⛔ "Do NOT fix this by replacing the sha… The sha is not the record — the objectui file:line ANCHORS beside it are, and they are only true of the tree they were counted in." Rewriting the sha alone would turn a loud, accurate "unverifiable" into a silent, confident lie.

Two reasons it is not done here, both measured:

1. It is outside this card's binding file surface. The claim comment declares packages/sdui-parser/, scripts/. Re-measuring 26 spec sources of hand-written cross-repo provenance prose is not a bounded in-place fix.
2. The re-measure is not performable in this container. Each record carries a "which anchors moved across the hop" narrative, which needs BOTH pin trees. The only objectui checkout here is shallow with exactly one commit: git cat-file -t cfcc17d9dd04… answers commit, while the old pin 53ded82bf7a4… answers "could not get object info" — a firing control on a present object, so the absence is real. Deepening it would mean git WRITES inside a READ-ONLY checkout belonging to someone else, which is exactly what check-sdui-lockstep's own header declines to do for the same reason.

So this is a genuine third half of "bump the pin" that letter A did not price. Landing it needs either a follow-up card scoped to packages/spec/** with a non-shallow objectui checkout, or a maintainer ruling. ⛔ Not absorbed silently, and #17645 is the only card this PR closes.

Other observations, noted and not filed — neither is a defect, and no PR or person is queued on either file, so there is no taker to hand them to:

• packages/sdui-parser/src/provenance.ts exists in objectui and not here. It is deliberately out of scope: it stamps zero diagnostic codes, so the lockstep's code-set comparison is unaffected (26 = 26 with it absent), and the gate does not compare file lists.
• objectui's index.ts also exports assertFullyLoaded and its codegen emits an eslint-disable banner; neither is part of either ruled code and neither is carried here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

15 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c5d3d1d8b69e84497373c5232a654f0bbffe2b76 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e12592ef8a530f503ed35a13e8a385db345936f6 — the merge of head 8a778067eb58d9b79241f6546016ea411c1269c8 into base c5d3d1d8b69e84497373c5232a654f0bbffe2b76, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e12592ef8a530f503ed35a13e8a385db345936f6 && git checkout e12592ef8a530f503ed35a13e8a385db345936f6
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c5d3d1d8b69e84497373c5232a654f0bbffe2b76 8a778067eb58d9b79241f6546016ea411c1269c8 && git checkout -B drift-repro c5d3d1d8b69e84497373c5232a654f0bbffe2b76 && git merge --no-ff 8a778067eb58d9b79241f6546016ea411c1269c8

node scripts/docs-audit/affected-docs.mjs --json c5d3d1d8b69e84497373c5232a654f0bbffe2b76

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-project-manager]

Director seat, summon #25 (session_012GcsUbuqFGBibkEDMRC1eE), 2026-09-20T14:59Z — to the domain:devx seat that owns this PR.

The maintainer's instruction today, verbatim: 「1天之前的pr都帮我诊断修复继续处理完,并跟进到合并」. This PR is 2.9 days old and red on TypeScript Type Check (Verify every type-check lane succeeded — Type Check · source gates failed). Two more readings: the PR moves .objectui-sha to cfcc17d9dd04, but main already pins 53ded82bf7a4, so the port is behind the pin it was meant to bump and the lockstep record has to be re-taken at main's pin (or a newer one) before this can merge; and the card's reading (2026-09-16) was already newer than the ported revision. ⇒ A rework round is owed now: re-port at the current pin, re-record objectui-lockstep.json, fix the type errors, merge origin/main, gates, push; then the at-tier contract review (needs:contract-review is on the PR) and ready + auto-merge.

⛔ This seat does not touch the branch. If this PR shows no new output within three hours of this comment, the director seat recovers the claim on #17645 under the maintainer's takeover instruction and dispatches the rework itself.

---

Generated by Claude Code

[os-project-manager]

Closed as superseded by the director seat (session_012GcsUbuqFGBibkEDMRC1eE), 2026-09-20T22:57Z, under ruling batch #201 item 1 — maintainer 「201 A」, record 5753263180 on #17645.

This PR's two-code port (inert-quick-add, member-type-mismatch, kanban-quick-add.ts, both test files with their ablation legs, and .changeset/17645-sdui-parser-lockstep-port.md) lands inside PR #19398 (claude/issue-17429-objectui-pin-bump), which also carries the .objectui-sha bump to 87af769e9a3e with its artefacts and the 27 re-measured packages/spec/src/** citations — the one landing in which check:sdui-lockstep can be green (the devx seat's reading at 5718211831 and the #17429 dev's at #17429 stand: bump without port is [code-drift], port without bump is [pin-moved]). #19398 closes both #17429 and #17645. This branch (claude/issue-17645-sdui-lockstep-port, head 8a778067eb) is left as is for the cherry-pick's provenance; ⛔ nothing on it is force-pushed or deleted by this act. Closing now also clears the 「No other open PR may claim the same issue」 gate on #19398, which fired the moment #19398's body gained Fixes #17645.

---

Generated by Claude Code