fix(metadata-protocol,spec)!: a saved view stores the parsed value of every key its body carried, and a ViewItem record's top-level options is refused by name (stage iv of #20051)

[objectstack-fleet]

Fixes #20051
Clause-②: no

Stage (iv), the last stage, of ruling 甲 (5856781584, confirmed 5856866699), carried out under letter B of ruling 5910106571. Maintainer verbatim: 「同意 批次 #256」. The stored-row census stays waived: 「20051 不考虑现有的数据」 (5909085121). The at-tier contract review is the domain:spec seat's, and it is owed before this PR is enqueued. This PR carries no review record of its own.

What changes

1. A saved view stores the parsed value of every key its body carried. saveMetaItem now stores projectStorableViewBody(request.item, parsed.data, reparse) for view, where it used to store the request body with two grafts. The rules:

• An undeclared key is dropped. Every key the console reads back is declared (VIEW_CONSOLE_ROUND_TRIP_KEYS), so nothing it needs is lost.
• A declared key keeps its parsed, normalized value.
• A moved key is stored under its canonical spelling: groups → sections, and visibleOn → visibleWhen (never grafted before).
• A schema default the author did not write is not stored. This is ADR-0087's storable rule, the one flows follow.

Keys that are moved and defaults look alike in the parse output, so the projection re-parses the body it built. A key the parse added is kept only when the re-parse does NOT reproduce it. The loop ends when the stored body re-parses to exactly the save's parse. If it does not converge, the fallback stores the whole parse output: no key is lost, and a warning is logged once per view. Nothing in today's view schema reaches that fallback.

The projection is gated on singularType === 'view', the same way the flow branch is. Every other type keeps its body verbatim with the two grafts. Both grafts still serve other types: ViewFilterRuleSchema is reused by page, component and skill schemas, and FormViewSchema by component, sharing and field schemas. A page save stays pinned verbatim here as the control.

2. A ViewItem record's top-level options bag is refused by name (Q3 = A). It is pinned absent on both ViewItemWireSchema arms. The response is 422 INVALID_METADATA at options, with the prescription to write config.KIND. It uses z.never(), not the form overlay's z.undefined(), because ViewItemWire.json is published on its own and undefined has no JSON Schema form. With z.undefined() the build refused ("1 previously published schema(s) disappeared"). The ADR-0087 disposition is registered view-item-options-bag-refused, a new step-18 semantic entry.

3. ADR citation. The five "ADR-0005 §Validation" citations in protocol.ts now cite ADR-0005 appendix (c), the "Addendum — 2026-05-16 (c): spec validation on overlay save". The same goes for the one in view.zod.ts. scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json gains ADR-0005 and ADR-0087 with the invariant. No docs/adr/** file is edited.

Measured before the change (the console's own writes at .objectui-sha db11afd4967c, through the real saveMetaItem)

• W1 to W5, the toolbar saves of sort, density, hidden fields, column widths and inline edit: the parse adds type: 'grid'. Now none is stored. W1 also stops storing its sort row id.
• W6b, the saved-view toolbar toggle, which writes the whole tab back: id and objectName are no longer stored.
• W7 to W9, config save, create, pin, set-default, reorder and rename: stored unchanged.
• Form overlay: it no longer stores sharing.enabled: false or the section collapsible / collapsed / columns defaults.
• Why letter B beats A, measured by ablation 2 below: storing parsed.data whole would have minted toolbar rows that FAIL their own re-save. A column-less patch carrying the grid default is refused as "sets type but lists no columns".

Pins

• Re-judged in one round (the full-repo sweep):
  • metadata-protocol protocol.graft-folded-form-sections.test.ts: the two GUARDs and the coexistence case.
    • The Studio round-trip GUARD moves to the list overlay, where the keys are declared. It now covers every key VIEW_CONSOLE_ROUND_TRIP_KEYS maps to listOverlay.
    • The form overlay now drops isPinned / sortOrder (undeclared there) and keeps isDefault.
    • "A form with canonical sections is stored as authored": no section default, no sharing.enabled, and no undeclared isPinned.
  • objectql protocol-meta.test.ts: the declared round-trip keys are stored, and objectName is dropped (object carries the binding).
  • objectql protocol-publish-rollback.test.ts: the diff's added key is the declared rowHeight, and the undeclared extra never reaches a version.
  • objectql protocol-view-identity-overlay.test.ts: the sort row id is not stored.
  • spec view-union-retirement-prescription.test.ts: the never-leaf population admits a closed two-entry family of pinned-absent refusals. Each entry must be reached and must match its curated text.
• New, in the same metadata-protocol file on its pinned engine double:
  • W1 to W5 store no type.
  • An undeclared key is dropped (id, objectName, a form-only layout).
  • A declared key keeps its normalized value (exportOptions, operator).
  • A key moved inside a moved key is stored canonical, with no default beside it.
  • The persisted body parses to exactly what the save parsed.
  • A record's options is refused on both arms, asserting envelope code + status + path + message, with 0 rows written.
  • The page control.
  • Four structural cases for the helper.
• New in spec view-overlay-options-bag.test.ts: the record refusal on both arms, plus a control.
• The card body's three pins still stand:
  • A direct and an options-wrapped out-of-contract key get the same refusal (door-half block).
  • A legal options.map round-trips.
  • The persisted body equals the parse result: the new parse-equivalence pin.

Evidence (head 41913270bf)

• Suites, locked runs:
  • metadata-protocol full: 191 files, 2819 passed, 19 skipped.
  • objectql full: 345 files, 6778 passed.
  • rest full: 237 files, 4641 passed, 99 skipped.
  • spec src/ui + src/migrations: 97 files, 3560 passed. The whole spec local project also ran before the origin/main merge, all green once the retirement-population pin was re-judged.
  • runtime, the 19 files that save or read a view: 990 passed.
• Typecheck: spec, metadata-protocol, objectql and lint all exit 0. The spec run chains check:scripts-typecheck and check:test-typecheck.
• Ablation 1 (the view branch disabled, and the record refusal renamed away, with dist/ rebuilt and ablation-dist-preflight markers present in both packages):
  • metadata-protocol file: 9 red, 40 green.
  • objectql's three re-judged files: 3 red.
  • spec: 4 red. One of them is the population pin reading the renamed leaf.
  • Restore: blob equals HEAD for both files, markers absent from both dist/, and git status --porcelain empty.
• Ablation 2 (store parsed.data whole, which is option A): 20 red of 49 in the metadata-protocol file, all five toolbar pins among them. Restored to the HEAD blob.
• Gates: dispatch-gates --commands --repo objectstack-ai/objectstack derived 125.
  • 123 exit 0. check:engine-split-ratio first refused on the shallow clone and passed after fetch --shallow-since. check:skill-examples first refused on a missing client-react dist and passed after building it.
  • NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt, both exit 3 PREREQUISITE NOT MET (they need a whole-repo build; CI runs it).
  • --ran reconciliation: 0 UNRUN.
  • check:generated: all 15 artifacts current; content/docs/references/ui/view.mdx was regenerated.
• eslint (narrowed):
  • Measured over the 15 changed .ts files; each resolves under eslint --print-config.
  • --no-inline-config --format json: 15 files, 0 errors, 0 warnings.
  • eslint.config.mjs enables no type-aware linting (its own comment says so), so this diff cannot move a verdict on an untouched file.

Docs follow-up (Tier H, separate PR for the maintainer's hand)

ADR-0005 must change in three places:

1. The Status line clause: "and the storage switch itself is the ruling's last stage, not yet landed — see the amendment note under that addendum's persisted-document bullet".
2. Appendix (c): "⚠️ Ruled, not yet in force: the storage switch is the ruling's last stage and has not landed, so today saveMetaItem still stores the request body (request.item)."
3. Appendix (c)'s bullet "The persisted document is the parsed body (parsed.data) once every round-trip key is declared". Under letter B it becomes: the parsed value of every key the body carried, with no schema default materialised.

Acceptance notes

• Other types. resolveOverlaySchema validates every type getMetadataTypeSchema registers, not only view and dashboard, and all of them still store the request body. Widening the projection is its own decision.
• An objectui read-side drop, present today and independent of this PR. objectui's adapter flattens a ViewItem record in listViews and keeps only config plus name / label / isDefault. A saved view's toolbar toggle writes that tab back whole, so it rewrites the row without isPinned / sortOrder / visibility / columnState. This is a code read at the pin, not measured in a browser. Its carrier is objectui#11013, the objectui card on aligning console reads.
• Other stale citations. "ADR-0005 §Validation" is still cited outside the files this PR touches (for example packages/metadata-core/src/injected-system-columns.ts:132 and three objectql object-roundtrip test headers). Those stay for the next change that touches them.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/spec, touching 14 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation), /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/deployment/validating-metadata.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/cluster.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/services-checklist.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation), /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/permissions/authorization.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/protocol/objectui/index.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/ui/forms.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 138 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 72f8c3820154c69cdf9faa6f887dc544e4c4b823 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3c9bd02f49c574bd820e35ed9bcb41e4a3097829 — the merge of head 9924c95b0b603c34729ac2706d48b6bb7d7ff24b into base 72f8c3820154c69cdf9faa6f887dc544e4c4b823, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3c9bd02f49c574bd820e35ed9bcb41e4a3097829 && git checkout 3c9bd02f49c574bd820e35ed9bcb41e4a3097829
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 72f8c3820154c69cdf9faa6f887dc544e4c4b823 9924c95b0b603c34729ac2706d48b6bb7d7ff24b && git checkout -B drift-repro 72f8c3820154c69cdf9faa6f887dc544e4c4b823 && git merge --no-ff 9924c95b0b603c34729ac2706d48b6bb7d7ff24b

node scripts/docs-audit/affected-docs.mjs --json 72f8c3820154c69cdf9faa6f887dc544e4c4b823

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 72f8c3820154c69cdf9faa6f887dc544e4c4b823 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9924c95b0b603c34729ac2706d48b6bb7d7ff24b
Local-runs: none

Inputs read: card #20051 (body and all 26 comments, rulings 甲 5856781584 / 5856866699, the maintainer's record 5909085121 「20051 不考虑现有的数据」, the director's ruling 5910106571 on Q2 = B / Q1 = A / Q3 = A, the dev's reports 5909437934, 5912512351, 5912995677); PR #20868 body, its 19-file list, and git diff origin/main... at this head; the check-runs on this head. Claims verified against origin/main (ADR-0005 appendix (c) at docs/adr/0005-metadata-customization-overlay.md:312, ADR-0087 addendum 2026-08-01b at docs/adr/0087-metadata-protocol-upgrade-contract.md:506, VIEW_CONSOLE_ROUND_TRIP_KEYS at packages/spec/src/ui/view.zod.ts:6260, the flow branch of saveMetaItem at packages/metadata-protocol/src/protocol.ts:16738) and against objectui at the pin db11afd4967c (runtime-metadata-persistence.ts viewEnvelope, ObjectView.tsx buildPersistedViewBody / VIEW_ROW_STATE_KEYS / getListViewConfigKeys, data-objectstack/src/index.ts viewItemObjectName and the listViews flatten).

Check-runs on this head, read 2026-09-30T14:18Z: 35 runs. 32 success, 2 skipped (Console Pin Gate: no .objectui-sha move; Packed-tarball smoke: opt-in), 1 in_progress: Lint and Repo Gates. Test Core (all six shards and the aggregate), Build Core, Build Docs, the four Type Check jobs, Check Changeset, Governed Surface Queue Guard, Spec property liveness, Dogfood gates and Temporal Conformance all read success. The runs on 41913270 were cancelled by the push and are not counted. Landing waits for the one run still in progress to read green.

① Derived judgments

1. @objectstack/spec accept set NARROWED: ViewItemWireSchema, both arms, gains options: z.never({ error }).optional() through viewItemWireFields(), which is spread into exactly the two arms (view.zod.ts:5324, :5328 on the branch) and nowhere else. A ViewItem record ({ name, object, viewKind, config }) carrying a top-level options is now refused at path options with the curated prescription (move each options.KIND to config.KIND); an absent key still parses. The narrowing reaches VIEW_METADATA_MEMBERS.viewItem, the viewItem branch of ViewMetadataSchema, the published ViewItemWire.json (not: {}), the ViewItemWire type (options?: never) and the two regenerated rows in content/docs/references/ui/view.mdx. RIGHT: Q3 = A as ruled and as the seat answered (5909486308). Verified at the pin that no console write puts the bag on a record: viewEnvelope returns { name, object, viewKind: 'list', label, config }, the config-save filters keys to SpecListViewSchema.shape plus VIEW_ROW_STATE_KEYS, and the whole-tab toolbar write is the FLAT overlay shape (no config), judged by listOverlay, not by this member. The list overlay's options: ListViewOverlayOptionsSchema (:6181) and the form overlay's z.undefined() refusal (:6213) are untouched, so the door half (PR fix(spec)!: judge a flattened list view overlay's legacy options bag at the view write door (door half of #20051) #20183) and objectui's options.map pin stand. z.never over the form overlay's z.undefined is RIGHT for a member published on its own as JSON Schema (undefined has no JSON Schema form; Build Core is green on this head, which is where "a previously published schema disappeared" would have refused).

2. @objectstack/spec public surface WIDENED, registry only: one new step-18 semantic entry view-item-options-bag-refused (entries/semantic/18.view-item-options-bag-refused.ts plus the generated region of registry.ts). RIGHT: ruling 甲 item 4 requires the ADR-0087 disposition; a semantic (D3) entry rather than a conversion is right because which of two spellings of one block the author meant is not mechanical; step 18 matches the 18.ui__ViewItemWire__owner / __hidden retired-key entries already in the tree (spec is at 17.5.0). The changeset's marker adr-0087: registered view-item-options-bag-refused names it. Its strings carry no tracker number.

3. @objectstack/metadata-protocol stored shape CHANGED for view only; the door's accept set is unchanged (same schema.safeParse gate, same 422 envelope). saveMetaItem now stores projectStorableViewBody(request.item, parsed.data, reparse) when singularType === 'view': the parsed value of every key the body carried, undeclared keys dropped, schema defaults not materialised, moved keys under their canonical spelling (groups to sections, visibleOn to visibleWhen), sort[].id dropped (it is stripped inside the parse preprocess at view.zod.ts:6682, so the projection sees it as a key the parse did not keep). RIGHT under letter B (5910106571): views join the rule ADR-0087 addendum 2026-08-01b records for flows ("storable excludes schema defaults, and this is load-bearing"), and the gate mirrors the existing singularType === 'flow' branch. Every other type keeps request body plus the two grafts plus the page type default. RIGHT: the ruling names views; ViewFilterRuleSchema and FormViewSchema are reused by page, component, skill, sharing and field schemas, so the grafts still have consumers, and widening the projection to dashboard and the rest is its own decision (noted in the PR's acceptance notes, as Prime Directive chore: version packages #10 asks).

4. projectStorableViewBody is exported from protocol.ts for its sibling test but is NOT re-exported from packages/metadata-protocol/src/index.ts (verified on the branch), so the package's public entry does not widen; no api-surface artifact tracks it. The helper's own invariant is the right one: the stored body must re-parse to exactly the save's parse (a GET then PUT is judged the same), bounded at 8 rounds, key-move detection by re-parse evidence rather than a hand list. The converged: false fail-safe stores parsed.data whole and warns once per type|name. Log level judged against AGENTS.md "Degradation log levels": after the fallback, everything the author wrote has landed (normalised) and the row is served as stored, so the system is not "looking normal while a claimed persist did not land"; this is a functional degradation (that row's defaults pinned), warn is RIGHT, and it is an if arm rather than a catch around a durability callee, so check:durability-log-level owes nothing. The message states consequence and fix and carries no tracker number. Unreachable by today's view schema; pinned through the production seam registerMetadataTypeSchema('view', …) with the built-in restored in finally.

5. objectui consequences at the pin, derived from the diff: console-written keys that no longer reach a stored row are sort[].id (W1, W7), and a top-level id and objectName (W6b, the whole-tab toolbar write). Every reader falls back: viewItemObjectName reads data.object, then object, then objectName; viewRowId prefers name; the sort and filter builders mint a fresh row id. object is present on the W6b body because normalizeViewMetadata runs with the registry baseline before the parse. The five row-state keys the console writes (isDefault, isPinned, sortOrder, visibility, columnState) and _isOverride are each declared in VIEW_CONSOLE_ROUND_TRIP_KEYS and kept; the re-judged list-overlay GUARD asserts every key that record maps to listOverlay. RIGHT: Q1 = A as ruled; nothing the console reads back is lost. Console Pin Gate skipped correctly (no pin move) and no objectui change is owed for this landing.

6. Pins, each read in the diff: the three verbatim-save pins re-judged rather than flipped (graft-folded coexistence and GUARD moved from a form overlay, where the keys are undeclared, to the list overlay; protocol-meta "preserves Studio-only auxiliary fields verbatim" now asserts the declared keys stored and objectName dropped with object carrying the binding); publish-rollback (rowHeight declared, extra never reaches a version) and view-identity-overlay (sort row id not stored); the ruling's named pins (W1 to W5 store no type; form stores no sharing.enabled and no section defaults; undeclared key dropped; declared key keeps its normalised value); nested moved key; parse-equivalence over toolbar, flat form, record and container bodies; the record options refusal on both arms with envelope code, status, path, message and zero rows written; the page control; the helper's arms (a) to (d) driven directly; the warn dedupe. The card body's three pins hold: the direct and wrapped refusal and the options.map round-trip are the door half's, on main; "the persisted body equals the parse result" is, under letter B, the parse-equivalence pin. view-union-retirement-prescription §2 admits a closed two-entry pinned-absent family, each entry required to be reached and to match its curated text, so the never-leaf population stays lit. RIGHT.

7. Comment-only re-citations from "ADR-0005 §Validation" (a heading the ADR does not have) to "ADR-0005 appendix (c)" in protocol.ts and view.zod.ts, and scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json gaining ADR-0005 and ADR-0087 with the stage (iv) invariant. RIGHT: the code cites what the ADR says (Prime Directive [WIP] Add Chinese version of the documentation #13). No docs/adr/**, .claude/**, skills/**, AGENTS.md or CLAUDE.md path is in the file list, so this is not a governed diff; the Governed Surface Queue Guard reads success. The at-tier record is owed by the path limb (packages/spec/src/** non-test), and this is it.

8. Generated artifacts: view.mdx regenerated and in the diff; JSON schemas and the api surface are build outputs, not tracked (verified by git ls-tree); registry.ts's generated region is in the diff beside its entry. Build Core and Build Docs read success on this head.

② Semver level

Changeset .changeset/20051-persist-parsed-view-body.md: @objectstack/metadata-protocol: minor, @objectstack/spec: minor, **BREAKING** banner, Clause-②: no (narrowing), one adr-0087: registered … marker, a FROM to TO table, the one-line fix, and an existing-rows section quoting the maintainer verbatim. It matches what the diff publishes: spec narrows a wire accept set and adds a registry entry; metadata-protocol changes what a view save stores. The level is RIGHT under ADR-0087's launch-window section as amended 2026-09-13: "Pre-GA, a metadata-facing retirement or break ships minor, carrying the **BREAKING** banner and its ADR-0087 disposition entry", which is also how ruling 甲 item 4 spells stage (iv). @objectstack/objectql and @objectstack/lint change tests only and publish nothing, so no changeset is owed for them. check-adr-0087-registration reads the arm from the changeset (readClause2Line(parsed.body)), and Check Changeset reads success on this head.

Clause-②: line: the PR body carries Clause-②: no, the changeset carries Clause-②: no (narrowing). Judged: not a conflict. The value is no in both and is truthful (nothing widens the accept set; the one new function is not on the package entry; the registry entry is the disposition the narrowing owes), the arm is optional per AGENTS.md Post-Task item 3, and it sits in the one text the gate that reads arms reads. The widening-tells gate recognises z.never( as a refusing value opener (REFUSING_RETURN), so the added options key line declines T1 rather than firing under no.

③ Boundary flags

Every dev flag and every open_questions entry, answered:

• Q1, Q2, Q3 of 5909437934: answered by the director's ruling 5910106571 (B; A; A) and implemented as ruled; open_questions: [] in both final reports.
• Clause-② spelling (no on the PR, no (narrowing) in the changeset): answered above, not a conflict.
• Moved keys found by re-parse evidence rather than a named list: RIGHT within ruling B's "one projection replacing two grafts"; the convergence invariant, not the detector, is what the stored row is held to, and it is pinned. One corner named for the seat, not blocking: when a moved container has a dropped sibling key of the same shape (soleMovedFrom finds more than one candidate), the moved value is stored whole, so that container's nested defaults are pinned although the row still re-parses to the parse. No console write at the pin produces that shape. Carrier: the next change to projectStorableViewBody; a pin for that corner would close it.
• The fail-safe arm stores parsed.data whole; ablation 2 on this card showed that for a column-less toolbar patch that shape is refused on re-save ("sets type but lists no columns"), so the warning's "re-save the view" prescription could itself be refused in that arm. Loud to the caller (a 422), unreachable today, pinned. Noted, not blocking.
• z.never() rather than z.undefined() and the re-judge of the retirement-prescription population: RIGHT, see ① 1 and 6.
• File surface beyond the claim line (migrations entry and regenerated registry, view.mdx, spec tests, objectql pins, comment-only test headers): each is either what ruling 甲 item 4 requires, what Post-Task item 5 requires, or a pin the sweep found; none is scope growth.
• Process notes (a JS-only closure build repaired before typecheck, one single-file run re-run under the lock, the origin/main merge via os-regen-merge.sh, the shared .git deepened for the engine-split gate, no dogfood reading owed, a test block moved and strengthened in the patch round, the warn-dedupe pin riding the graft-folded file's engine double): nothing committed from an unclean state; no action owed.
• Out-of-scope findings: other types stay verbatim (carrier none, noted in the PR; the ruling names views); the objectui listViews flatten drops isPinned / sortOrder / visibility / columnState before the whole-tab write (present today, independent of this PR, carrier objectui#11013, code read only); stale "§Validation" citations in files this PR does not touch (carrier: the next change to those files). Each has a named carrier or is prose only; consistent with Prime Directive chore: version packages #10.
• Docs follow-up: ADR-0005's Status line, the "Ruled, not yet in force" marker and the parsed.data bullet go stale the moment this lands, until the seat's separate Tier H PR for the maintainer's hand. That sequencing is what ruling 5910106571 prescribes; no docs/adr/** edit here is right.
• The stored-row census: waived by the maintainer (5909085121), so it is not a landing gate for this PR; a stored record carrying a top-level options is served as stored and refused only on its next save, which the changeset and the D3 entry both say.
• Not escalated: nothing here needs the maintainer's word beyond what the three rulings already gave.

Implemented-by: claude/issue-20051-persist-parsed-view-body
Reviewed-by: session_018fxqvRJW12TaHC7DUQ89Y6

VERDICT: PASS