fix(cli)!: the JSX page gate's console manifest fallback resolves through @objectstack/console/package.json, so a project without its own manifest gets full component checking

[objectstack-fleet]

Fixes #19922
Clause-②: no

What this changes

resolveSduiManifest() (packages/cli/src/utils/sdui-manifest.ts) is the one resolver os validate, os compile / os build and os lint use to arm the JSX page gate. os dev and os start run compile before they boot when dist/objectstack.json is missing or --compile is passed, and dev's default watch mode reruns it when a watched file changes. The resolver's second place to look, the copy @objectstack/console ships as dist/sdui.manifest.json, asked Node for that file by its own subpath. The console's exports map publishes ./package.json alone, so the resolve threw ERR_PACKAGE_PATH_NOT_EXPORTED, a catch swallowed it, and every project with no sdui.manifest.json of its own had its kind: 'html' pages checked at parse level only.

The fallback now resolves @objectstack/console/package.json from the CLI's own location (import.meta.url, the CLI's declared dependency in the same fixed release group) and joins dist/sdui.manifest.json to its directory, through a new consoleSduiManifestPath(origin). The console's exports stays closed. resolveSduiManifest(cwd, consoleOrigin) gains an optional origin, used only by the pins.

The old module header handed one decision to whoever made this leg reachable: what a broken shipped copy should do. It now gets the project leg's rule. A shipped copy that is present but cannot be read or parsed is unusable (new source: 'console'), and the command is refused with exit 1, naming the file, with the remedy "reinstall @objectstack/console". It is never read as "not found". With no page to check it is read by nothing and not refused, the same as the project leg.

This round (the seat's unlock record 5890591366 on #19922)

The ledger entry ui-html-page-div-refused landed on main (#20592, PR #20610), and Version Packages #17076 consumed .changeset/sdui-manifest-one-producer.md. This round:

1. Merged origin/main at f1e921ab8e (a merge, not a rebase; merge commit f9cb969f44). One conflict: .changeset/sdui-manifest-one-producer.md, modify/delete, resolved in favour of main's deletion. build-json-failure-conversions.e2e.test.ts and validate-json-failure-conversions.e2e.test.ts auto-merged: main changed other regions of both, and the box fixture line and its docblock sentence survived. The branch's delta against main is exactly the 7 intended files. main has since gained one commit (cd901d7a5f), which touches none of them.

2. The correction moved into this PR's changeset. The released note is @objectstack/console 17.5.0, patch entry 28ce612. A new paragraph goes through its closing paragraph one sentence at a time:

   • two sentences stop being true with this release: the file is no longer "only present in the tarball", and the CLI fallback no longer "keeps parse-level validation";
   • two still hold: exports is unchanged.

   No CHANGELOG.md, no content/docs/releases/ and nothing under packages/spec/ is edited.

3. The ADR-0087 marker now reads not-required (already-registered ui-html-page-div-refused) with its reason. The gate's verdict: "check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition … not-required (already-registered)", exit 0.

4. Two sentences re-measured and corrected:

   • "the html-tier renderer still renders div" was false. At the pinned objectui dd3f7e1be3, read with git show from the sibling checkout (nothing checked out, nothing edited):

     • packages/components/src/renderers/layout/page.tsx:487-488 builds the html compile's whitelist from getKnownTypes() minus deprecationFor(t, 'html');
     • packages/components/src/renderers/basic/div.tsx registers div with deprecated.surfaces: ['json', 'html'];
     • nameHtmlTierReplacement turns the resulting forbidden-tag into a refusal naming the replacement.

     That pin shipped in @objectstack/console 17.5.0: its CHANGELOG entry 3cf6449 says a kind:'html' page that authors a div "is refused at compile time, and the error names box". The changeset now says the console has refused div since 17.5.0, and that what is new is every other tag the manifest does not declare. The console's html compile accepts every non-deprecated registered component, while the manifest declares the public contract plus the html intrinsics. Measured below with avatar.

   • "objectstack compile (which dev and start run first)" was inexact. It now says exactly when they run it: dev.ts:319 compiles on flags.compile or a missing artifact, and dev.ts:383 re-runs it in watch mode; start.ts:228-232 has the same condition.

Premise and hypotheses, measured

Round-1 readings (on f11b5f20a2) are kept where they still hold. Round-2 readings are on 77338a7186: Node v26.7.0, macOS.

• H0 (premise holds). On unmodified f11b5f20a2, a real os init project with a kind: 'html' page rooted in div passes os validate, os compile and os lint at exit 0. Each prints only the parse-level notice, and it does so even with a cmp-identical copy of the tracked manifest at packages/console/dist/sdui.manifest.json. From packages/cli/dist, the old subpath throws ERR_PACKAGE_PATH_NOT_EXPORTED.

• H1 (the route finds the file in both layouts).

  • Workspace: consoleSduiManifestPath() answers packages/console/dist/sdui.manifest.json.
  • Installed package: npm pack of packages/console with a stand-in dist lists dist/sdui.manifest.json. Extracted under a scratch node_modules, the old subpath throws ERR_PACKAGE_PATH_NOT_EXPORTED from a sibling CLI origin, while resolveSduiManifest answers resolved.

• H2 (Clause-② arm: narrowing). Round 2, merged tree, with the console copy present (cmp-identical stand-in):

  • a div page gives exit 1 (jsx-forbidden-tag, jsx-unknown-component);
  • a box page gives exit 0, with no findings;
  • an avatar page gives exit 1 (jsx-forbidden-tag, jsx-unknown-component).

  With no copy, all three exit 0 with the notice only. avatar is registered at the pin (renderers/data-display/avatar.tsx:17) and not deprecated, so the console's html compile renders it and nothing refused it before this change. That is the narrowing the (narrowing) arm and BREAKING rest on.

  • ⚠️ Round 1 misread this half. It took "the renderer still renders div" from ruling A's reading, which predates objectui#10757, instead of reading the pin. The pin had landed on main (chore(objectui): bump the console pin to dd3f7e1be356 (carries the injected-client boot fix) with the showcase div→box and trash-icon follow-through #20436) before round 1 ran. For div, this change moves a refusal the 17.5.0 console already gives at render time to author time. The arm still holds because of the undeclared tags.
  • CLI fixtures the live fallback newly refuses (round 1, with the console copy present): 23 tests went red across build-json-failure-conversions.e2e (5), validate-json-failure-conversions.e2e (4) and jsx-gate-manifest-notice.e2e (14). lint-conversion-notices.e2e stayed green, but its page is refused too. The three conversion fixtures moved from div to box. The notice file's 14 manifest-less cases are skipped by name where the CLI's own console copy exists. They run in the CI job, which builds no console, and their rules are pinned hermetically in src/utils/sdui-manifest.test.ts.
  • Examples: only examples/app-showcase carries html pages (three).

• H3 (shipped pages stay clean), round 2, merged tree. main brought a regenerated sdui.manifest.json carrying tier: 'html' marks (feat(sdui-parser): the manifest marks the html tier's intrinsic tags tier: 'html', ported from objectui's lockstep copy #20582).

  • validate-jsx-pages.production-witness.test.ts: 5/5 pass.
  • examples/app-showcase with the console copy present: exit 0 on os validate / os compile / os lint, with zero jsx-* / sdui/* findings.

• H4 (ablation, round 1), through node scripts/ablation-replace.mjs in WRAP mode:

  • the anchor resolve(CONSOLE_PACKAGE_JSON) went 1 → 0, and resolve(CONSOLE_SDUI_MANIFEST) (the old subpath) 0 → 1;
  • 4 console-leg pins went red ("expected undefined to be defined");
  • restore: the blob is back at the HEAD blob be1f8d4ad33e, and git diff HEAD is empty.

  The pins import the subject from src/, so no dist/ sits on that path. This round changed no source or test file.

Tests, at 77338a7186

• The whole CLI unit project (--project unit --maxWorkers=2) with a real-path TMPDIR: 234/234 files, 3347/3347 tests. With the default macOS TMPDIR: 232/234. The 2 files are published-subpath-console.pin and published-subpath-hook-body.pin, 5 cases comparing /var against /private/var. They are host-only and untouched here.

• pnpm --filter @objectstack/cli typecheck (tsc --noEmit plus check:test-typecheck): exit 0.

• The four touched nightly *.e2e files (OS_TEST_TIERS=nightly --project integration):

  • with the console copy present: 53 passed, 14 skipped;
  • without it (the CI state): 67/67 passed.

  The rest of the integration layer is declared to CI.

Gates, at 77338a7186

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 63 derived, the same 63 as round 1. All 63 exit 0, and --ran reconciled "63 run, 0 NOT-MEASURED (a DERIVED zero — all 63 recorded an exit code and none of them is 3)". check:dual-build-cjs-loads first answered PREREQUISITE NOT MET, then exit 0 after building its eight missing packages.
• check-adr-0087-registration --base origin/main, check-empty-changeset --base origin/main (it now reads "No changeset from the merge base modified or deleted by this diff") and check-changeset-no-major --base origin/main: all exit 0.
• Roster rows that could apply, all exit 0: check-changeset-fixed, check-sdui-manifest (plus --self-test), check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check:cli-examples-parity, check:published-readme-exports, check:scaffold-emission-policy, check:console-injection.
• pnpm lint (full repo, not narrowed): exit 0, no output.
• node scripts/check-issue-citations.mjs --base origin/main: exit 0.
• check:nul-bytes: exit 0, plus a control-byte scan of the 7 changed files: 0.

Declared narrowing — verification ran UNLOCKED. scripts/pm/os-verify-lock.sh
could not take the shared verify lock on this host: no usable flock. The shared
verify lock is declared Linux-only (flock is util-linux, and a stock macOS does
not ship it), so the command below was run directly, without the lock —
a declared narrowing, not a silent one. No serialization guarantee held for this
run, nor for any sibling agent in this container while it ran.

every build, test, typecheck, ablation and `pnpm lint` command named above

Acceptance notes

• Where the div → box prescription reaches an upgrader. The CLI's refusal text does not carry it: the gate answers "is not an allowed component" / "is not a known component", from @objectstack/sdui-parser (parse.ts). The upgrade guide does not carry it either: packages/spec/scripts/build-upgrade-guide.ts:78 loops majors up to PROTOCOL_MAJOR, PROTOCOL_VERSION is 17.0.0, and docs/protocol-upgrade-guide.md does not name ui-html-page-div-refused. What does carry it:
  • this changeset's FROM → TO table;
  • the console's own render-time refusal, which names box;
  • objectstack migrate meta --from 17. Measured on a stack with a div page, it lists the entry as one of 242 "manual change(s) require your judgment", headed "⚠ [protocol 18] kind:'html' page source …", with box as the replacement, and exits 0.
• The ledger entry's own why text (packages/spec/src/migrations/entries/semantic/18.ui-html-page-div-refused.ts, the spec seat's file) still says "objectstack compile (which dev and start run first)", the phrasing corrected here. Noted, not edited.
• Release order, flagged by the seat in 5890591366: Version Packages PR chore: version packages #20639 carries the ledger entry's changeset. If it merges before this PR, the ledger row ships one release ahead of the CLI refusal it describes.
• packages/cli/src/utils/scaffold-validate.ts (the note at :128-:133) was re-read. It is true now, so it is not edited. A pre-existing imprecision stays as it was: os init reads the invoker's directory, which may carry its own sdui.manifest.json (this repository's root does).
• Comment drift outside this claim, noted only:
  • .github/workflows/lint.yml (:899) and scripts/check-sdui-manifest.mjs (:28-30, :240) still say resolveSduiManifest() degrades to parse-only silently;
  • the header of packages/lint/src/validate-jsx-pages.ts still calls manifest validation "not wired";
  • docs/qa/platform-checklist/areas/studio-authoring.json describes the showcase tree as flex/div/a.
• The five macOS-only published-subpath-* failures come from a tmpdir() path compared with the real path that module resolution returns. They are host-specific.
• Measurement scaffolding was all in scratch, or in this worktree's gitignored packages/console/dist/, with each stand-in trap-removed. git status --porcelain printed 0 lines after every run.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

9 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 25 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 89801cd9634c51930bb3d2f29f478c7c6ebae0ff → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 923b24dc84e747a1ea88054a938dc8a8a9aff811 — the merge of head 77338a718672e62e4fe91e1df3dba43486b094bb into base 89801cd9634c51930bb3d2f29f478c7c6ebae0ff, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 923b24dc84e747a1ea88054a938dc8a8a9aff811 && git checkout 923b24dc84e747a1ea88054a938dc8a8a9aff811
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 89801cd9634c51930bb3d2f29f478c7c6ebae0ff 77338a718672e62e4fe91e1df3dba43486b094bb && git checkout -B drift-repro 89801cd9634c51930bb3d2f29f478c7c6ebae0ff && git merge --no-ff 77338a718672e62e4fe91e1df3dba43486b094bb

node scripts/docs-audit/affected-docs.mjs --json 89801cd9634c51930bb3d2f29f478c7c6ebae0ff

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 77338a718672e62e4fe91e1df3dba43486b094bb
Local-runs: none

Inputs read: card #19922 (body and all 13 comments, the rulings 5884397563 and 5890591366 included), ruling A on #20112 (5852014527) and that card's later comments, PR #20589 (body, 7-file list, the net diff against main at f1e921ab8e), the check-runs on 77338a7186, the pinned objectui dd3f7e1be3 through gh api …/objectui/contents/…?ref=dd3f7e1be3 (renderers/layout/page.tsx, renderers/basic/div.tsx, renderers/data-display/avatar.tsx, renderers/form/checkbox.tsx), and on main: sdui.manifest.json, packages/console/{package.json,CHANGELOG.md}, packages/cli/package.json, packages/spec/src/migrations/entries/semantic/18.ui-html-page-div-refused.ts, packages/spec/scripts/build-upgrade-guide.ts, packages/spec/src/kernel/protocol-version.ts, scripts/check-adr-0087-registration.mjs, .changeset/config.json. Gate scripts and workflow files were read in the worktree as references, nothing was run.

Check-runs on 77338a7186, read 2026-09-29T13:37:57Z, newest run per name: 34 names, 34 completed, 0 in progress, 0 failure — 29 success, 5 skipped (Auto Label and Check PR Size re-runs, Build Docs, Console Pin Gate, Packed-tarball smoke: all path- or opt-in-gated). Check Changeset (the pr-automation job that runs check-empty-changeset, check-adr-0087-registration and check-changeset-no-major) is success at 13:27:05Z; Lint & Repo Gates, all four Type Check lanes, Build Core, Test Core 1/6–6/6, Dogfood Verify CLI, the three Dogfood Regression shards and Temporal Conformance are success. PR head at the read: 77338a7186, mergeable_state: clean, draft.

① Derived judgments

1. The accept set of os validate, os compile / os build and os lint narrows, and the diff declares it — right. With no project sdui.manifest.json, the JSX page gate now reads the copy @objectstack/console ships (packages/cli/src/utils/sdui-manifest.ts, resolveSduiManifest → consoleSduiManifestPath), so kind: 'html' pages that used to pass at parse level are refused for any tag or prop the manifest does not declare. The three commands are the only callers (validate.ts:433, compile.ts:472, lint.ts:979), and dev / start inherit it through the compile they spawn (dev.ts:319 needsCompile = !flags.artifact && (flags.compile || !existsSync(artifactPath)); dev.ts:838 in the watch loop; start.ts:228-232). Declared as BREAKING with a FROM → TO table (② below).
2. A second, smaller narrowing is declared too — right. A console copy that is present but unreadable or unparseable used to fall through to absent (parse level, exit 0); it now returns unusable with source: 'console' and the command exits 1. The changeset's paragraph "A damaged install is refused, not skipped" carries it.
3. The absent notice's second lookedAt entry changes from the package specifier to the absolute path of the console copy (or the package-relative name when @objectstack/console itself does not resolve) — right, not a contract move. The notice's anchor is the rule id sdui/jsx-parse-level-only, which is unchanged; the AuthoringFinding key set and info severity are unchanged (unit-pinned).
4. No published surface of @objectstack/cli moves — right. The CLI's exports are ., ./console, ./hook-body, ./package.json, and src/index.ts re-exports command classes only; utils/sdui-manifest.ts is internal. The renamed constant (CONSOLE_SDUI_MANIFEST_SPECIFIER → CONSOLE_SDUI_MANIFEST), the new export consoleSduiManifestPath(origin?), the optional second parameter of resolveSduiManifest(cwd, consoleOrigin?) and the source member on the unusable variant are internal; the only importer of the old constant was the unit file, updated in this diff.
5. @objectstack/console's exports stays closed — right. packages/console/** is untouched; exports on main is {"./package.json": "./package.json"}. The route resolves the one subpath the console exports and joins dist/sdui.manifest.json, the same strategy packages/cli/src/utils/console.ts:199-203 (resolveConsolePath, strategy 1) already uses for this static-asset package.
6. os init's scaffold self-check (scaffold-validate.ts:94-98) now sees the console copy where present — right, no new refusal. It reads resolved only and hands undefined otherwise, which the module header documents as init's own decision. The built-in templates author no html page; the only html pages in tree are the showcase's three, already box (chore(objectui): bump the console pin to dd3f7e1be356 (carries the injected-client boot fix) with the showcase div→box and trash-icon follow-through #20436).
7. Three conversion e2e fixtures move from div to box — right. Their subject is the JSON-failure conversion exit, not the tag; with a console copy present the div page would add a jsx-forbidden-tag error those exits are not about. The jsx-gate-manifest-notice.e2e fixtures keep div on purpose (its MANIFEST declares div, and its manifest-less cases are the ones skipped; ③.7).
8. The changeset's two cleared sentences — both right against the pin. (a) At dd3f7e1be3, page.tsx:487-488 builds the html compile's whitelist as getKnownTypes() minus deprecationFor(t, 'html'); div.tsx registers div with deprecated.surfaces: ['json', 'html'] and a replacement that names box; nameHtmlTierReplacement (page.tsx) appends that replacement to the forbidden-tag refusal. The console 17.5.0 CHANGELOG entry 3cf6449 records the range that contains it (objectui 39b8d5102: a kind:'html' page that authors div "is refused at compile time, and the error names box"). So "the console has refused a div on a kind: 'html' page since 17.5.0 … naming box" is exact. (b) "dev and start run compile before they boot when dist/objectstack.json is missing or --compile is passed, and dev's default watch mode reruns it when a watched file changes" matches dev.ts:319, dev.ts:383 (watchActive = flags.watch !== false && …, the loop at :691-886 re-spawns compile on change/add) and start.ts:228-232. Residual, not a fault: neither command compiles when an artifact is named by --artifact, OS_ARTIFACT_PATH or OS_ARTIFACT_URL, and start also treats a home-directory dist/objectstack.json as present (start.ts:650-657); the sentence no longer overstates and no gate or consumer reads it.

② Semver level

• Changeset .changeset/19922-console-manifest-fallback.md: '@objectstack/cli': minor; summary fix(cli)!: …; **BREAKING for kind: 'html' pages in projects without their own manifest.**; Clause-②: no (narrowing); the ADR-0087 marker adr-0087: not-required (already-registered ui-html-page-div-refused) … with a reason. Three breaking signals (the !, the banner, the arm) agree, so the gate reads it as declared-breaking and the disposition is owed and present.
• Level minor — right. BREAKING ships as minor under the launch-window guard (check-changeset-no-major.mjs refuses major; the console's own 17.x entries carry "BREAKING (shipped as minor)" for the same reason). @objectstack/cli and @objectstack/console are in the one fixed group (.changeset/config.json), so the CLI that reads the file and the console that ships it release together.
• Clause-②: no (narrowing) — the arm, the direction and the level are right, and on the evidence the dev now gives, not on round 1's. This diff adds no key to any published payload (value no), and it narrows a published accept set (arm narrowing): before it, a manifest-less project's html page using a registered, non-deprecated tag the manifest does not declare was refused by nothing — the CLI checked at parse level and the console's html compile whitelists every known, non-html-deprecated type. Verified at the pin: avatar (renderers/data-display/avatar.tsx:17, registered in ui, no deprecated) and checkbox (renderers/form/checkbox.tsx:70, registered in ui, no deprecated); both ABSENT from sdui.manifest.json on main (107 entries: 59 public plus 48 tier: 'html' intrinsics, deprecated on none); div ABSENT; box PRESENT with inputs className and children. So the live fallback refuses what the console renders, which is the narrowing. For div alone the change moves a refusal the 17.5.0 console already gives at render time to author time, and the changeset says exactly that. The FROM → TO table is right: row 1, div … to box "which takes the same className and children", matches box's declared inputs and the registration's own replacement text ("the one drop-in swap: same element, your className verbatim"); row 2 covers every other undeclared tag or prop generically, which is the honest shape (the set is the manifest, not a list).
• The Clause-②: line on the PR body reads Clause-②: no (the claim's declaration, 5883713897, copied as the dispatch requires). The value is right for the level axis (check-changeset-no-major stands down on no, and the changeset is minor anyway); the ADR-0087 gate reads the arm from the changeset, where it is. The body carries no arm — the seat owns the body write and may carry no (narrowing) into it as it carried yes (widening) into feat(sdui-parser): the manifest marks the html tier's intrinsic tags tier: 'html', ported from objectui's lockstep copy #20582's; no gate turns on it.
• The correction paragraph on the released @objectstack/console 17.5.0 patch entry 28ce612 — each verdict right, quoted verbatim from packages/console/CHANGELOG.md on main: (1) "For now the file is only present in the tarball." — no longer true from this release: the CLI reads it. (2) "This package's exports map exposes ./package.json and nothing else, so resolving @objectstack/console/dist/sdui.manifest.json through exports fails with ERR_PACKAGE_PATH_NOT_EXPORTED." — still true, exports unchanged. (3) "Anything that resolves through exports cannot read the file yet." — still true; the CLI resolves the exported ./package.json and joins the path, which is what the changeset says a reader must do. (4) "That includes the CLI's JSX-page manifest fallback, which catches the error and keeps parse-level validation, as before." — true of the 17.5.0 CLI, false from this release. Two no longer true, two still true, as the seat's unlock record asked. The PR edits no CHANGELOG.md, nothing under content/docs/releases/ and nothing under packages/spec/** (7 files: the changeset, sdui-manifest.ts, its unit file, four packages/cli/test/*.e2e.test.ts). The DELIBERATE CORRECTION of .changeset/sdui-manifest-one-producer.md is gone with that file (consumed by Version Packages chore: version packages #17076, merge resolved for main's deletion), and check-empty-changeset answers "No changeset from the merge base modified or deleted" — Check Changeset success confirms.
• The ADR-0087 marker not-required (already-registered ui-html-page-div-refused) — right. The gate's already-registered arm requires every named id to resolve at HEAD and to exist at the merge base (check-adr-0087-registration.mjs:143-146; R5 refuses an id the diff itself adds). 18.ui-html-page-div-refused.ts is on main from 7510663c87 (spec(migrations): register the ADR-0087 semantic ledger entry for the html-tier div refusal that #19922's live console fallback brings to manifest-less projects (div → box) #20592 / PR feat(spec): register the ADR-0087 semantic entry ui-html-page-div-refused (#20592) #20610), before this branch's merge base f1e921ab8e, and this diff touches nothing under packages/spec/; the marker's reason names the migration channel (objectstack migrate meta --from 17, box for div). Check Changeset on this head is success, which is the gate's own answer.

③ Boundary flags

The brief's seven questions.

1. Resolution in both layouts, exports closed, legitimacy — yes on all three. consoleSduiManifestPath(origin = import.meta.url) resolves @objectstack/console/package.json (the one exported subpath) with createRequire(origin) and joins dist/sdui.manifest.json. Workspace: from packages/cli/src/… (tsx via bin/run-dev.js) or packages/cli/dist/… (tsc, ESM-only: type: module, exports default only, build is tsc -p tsconfig.build.json), Node resolves the CLI's own node_modules/@objectstack/console symlink to its real path, so the answer is packages/console/dist/sdui.manifest.json — the unit pin "locates the CLI's own @objectstack/console dependency, whether or not it is built" asserts the owner package.json is @objectstack/console. Installed: the pin builds node_modules/@objectstack/console/{package.json (the REAL console package.json, so the real exports map), dist/sdui.manifest.json} and resolves from node_modules/@objectstack/cli/dist/index.js, answering resolved / absent (absolute path) / unusable. @objectstack/console is a runtime dependencies entry of @objectstack/cli (workspace:*, same fixed group), so the CLI resolving its own declared dependency from its own location is the legitimate route, and it is deliberately not cwd (under pnpm a project that does not depend on the console cannot resolve it; the gate's strength would then depend on hoisting).
2. Damaged copy refused, never not-found; no page, left alone — yes. resolveSduiManifest returns readManifestFile(consoleManifest, 'console') unconditionally once the file exists (the old code returned it only when resolved and fell through to absent otherwise); read errors (EISDIR, EACCES), invalid JSON and a missing components map all yield unusable with the absolute path; resolveJsxGateManifest prints PATH is not a usable SDUI component manifest: REASON plus the hint "It is the copy @objectstack/console ships, so that install is damaged: reinstall @objectstack/console" and throws SduiManifestRefusalError (reportedToStderr, no minted code), which each command's catch-all turns into exit 1. Pinned: source: 'console', the path, the message and the remedy (unit); exit 1 with the file in the --json error and on stderr (the e2e's malformed cases, which use a project manifest and are not skipped). With no page the JSX gate checks, countJsxGatePages is 0 and the function returns { sduiManifest: undefined, notices: [] } before the unusable branch — pinned ("unusable with nothing to check: not read by anything, so not refused").
3. The (narrowing) arm, BREAKING and minor — right; see ② for the pin reading. The dev's round-2 correction is sound: div was already refused by the 17.5.0 console at render time (page.tsx:487-488 plus div.tsx's deprecated.surfaces), and the narrowing rests on registered, non-deprecated, undeclared tags (avatar, checkbox verified at the pin and absent from main's manifest). The arm, the level and the FROM → TO table stand.
4. The correction paragraph — each of the four verdicts right; no CHANGELOG.md, no content/docs/releases/, no packages/spec/** edited. Detailed in ②.
5. The marker — right with the entry on main; the two re-measured sentences — exact, with the one residual named in ①.8(b) (artifact-by-flag/env exclusions and start's home-directory candidate), which is not a fault of the sentence as a changeset reader needs it.
6. The Acceptance note on where the prescription reaches an upgrader — true. Not the CLI refusal text: it is @objectstack/sdui-parser's "is not an allowed component" / "is not a known component" (read-only here; the dev's measured output). Not the upgrade guide: build-upgrade-guide.ts:78 loops major from the floor to PROTOCOL_MAJOR, and PROTOCOL_VERSION is 17.0.0, so the step-18 entry is outside the loop (the spec seat read the same). What carries it: the changeset's FROM → TO table (this PR); the console's render-time refusal, which names box through nameHtmlTierReplacement and the registration's replacement; and objectstack migrate meta --from 17, whose entry ui-html-page-div-refused names box in its replacement (dev measured "242 manual change(s)", the spec seat measured --from 16 replaying to 18 — two independent runs, consistent with the entry text on main).
7. The tests — the skips hide nothing from CI. The 14 skipped cases (8 in "no manifest, kind:html pages" plus 6 package-carried notice rows) skip only where consoleSduiManifestPath() exists on disk, i.e. a checkout with a built console. No CI tier has that: packages/console has no build script (only prepublishOnly), so turbo's build closure never produces packages/console/dist; Console Pin Gate is the only job that restores or saves that dist and it runs no tests (it is skipped on this PR anyway); test-nightly-tiers.yml mentions no console; Test Core runs under OS_TEST_TIERS=queue, which excludes *.e2e.test.ts by name, so these four files run nightly on main only, where all 67 cases run (the dev's "without it: 67/67"). The hermetic twins in src/utils/sdui-manifest.test.ts cover the resolver rules those 14 read (one info notice with the count and every place looked, the package-carried count, printJsxGateNotices's tag and hint, the refusal, silence with nothing to check). Precision residual, not a fault: three command-face facets — exit 0 under --strict, no new top-level --json key, os lint's passed/failing/suggestions/total — are pinned by the e2e alone (in nightly), so the header's "every rule they pin is also pinned hermetically" is exact for the resolver and slightly over-stated for the faces. The skip is skipIf/it.skipIf by name, so a skipped run reports the count, not a green.

Dev flags and open questions. Round 2 reports open_questions: []. Round 1's two questions were answered by the seat (5884397563: A and A) and executed as the unlock record (5890591366) redirected them: the ledger entry landed first (#20592 → marker already-registered), and the DELIBERATE CORRECTION moved into this changeset because #17076 consumed its target. Deviations, each judged: the round-1 misreading of "the renderer still renders div" is owned and corrected against the pin — right (above); the correction paragraph states two sentences still hold rather than inventing a fault — right; the PR body was not PATCHed (the dev's one body write was at creation) and the seat holds the replacement body — a seat mechanic, and the body as it stands has one closing keyword (Fixes #19922) and Clause-②: no on line 2; origin/main advanced by one commit (cd901d7a5f, none of the 7 files) and was not re-merged — mergeable_state reads clean at my read; the five macOS published-subpath-* cases are host-only (/var vs /private/var) and untouched — accepted, Linux CI green; the verify lock ran UNLOCKED on macOS (no flock) — declared, and every derived gate family is answered by the check-runs on this head, which is what this review reads.

Escalated, not blocking this head: (a) release order — Version Packages #20639 carries .changeset/20592-ui-html-page-div-refused.md; if it merges before this PR, the ledger row ships one release ahead of the CLI refusal it describes; the seat flagged it to the maintainer and does not touch release PRs; (b) the ledger entry's own why text (18.ui-html-page-div-refused.ts, spec seat's file) still says "objectstack compile (which dev and start run first)", the phrase this PR corrects in its own changeset — a packages/spec follow-up, out of this claim's surface; (c) comment drift the dev lists (lint.yml:899, check-sdui-manifest.mjs:28-30/:240, the validate-jsx-pages.ts header, the studio-authoring checklist wording) — Acceptance notes, no consumer reads them.

Implemented-by: claude/issue-19922-console-manifest-fallback
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS