chore(objectui): bump the console pin to e420df310f5b (carries objectui#11163 and objectui#11199)

[objectstack-fleet]

Fixes #20949

Clause-②: no (narrowing)

Bumps the console pin: .objectui-sha db11afd4967c -> e420df310f5b, objectui origin/main HEAD at bump time (2026-09-30T22:03Z). The pin's apps/console/package.json is @object-ui/console 17.6.0, the same version the old pin carried (npm view @object-ui/console dist-tags answers latest: 17.6.0).

Containment (objectui merge-base --is-ancestor C e420df310f5b, private full clone, rev-parse --is-shallow-repository = false)

commit	subject	result
f4ed2387e9	record:related_list reads its declared actions (objectui#11163, PR objectui#11263)	exit 0, contained
f8334f8777	the permission editor's RLS policy list draws each policy's label and description (objectui#11199, PR objectui#11215)	exit 0, contained
control db11afd4967c (old pin)		exit 0, contained (90 commits behind the new pin)
negative control: e420df310f5b as ancestor of db11afd4967c		exit 1

On main: git branch -r --contains e420df310f5b lists origin/main, and merge-base --is-ancestor e420df310f5b origin/main exits 0.

Riders: objectui#11270 and objectui#11253 are not in the range (0 hits in the db11afd4967c..e420df310f5b log). So the three rider texts on #20949 (comment 5920572123) are not due at this pin.

What changed

• .objectui-sha and .changeset/console-e420df310f5b.md, written by scripts/bump-objectui.sh (@objectstack/console minor). The range has 87 releasing changesets. 5 of them are declared breaking, and all 5 are on objectui's own packages (see "Resolved since the first report").
• sdui.manifest.json and scripts/sdui-manifest.record.json, from node scripts/gen-sdui-manifest-node.mjs (no arguments): 107 components, @object-ui/core 17.6.0.
• packages/sdui-parser/objectui-lockstep.json, from pnpm gen:sdui-lockstep against the pin's own checkout: 214 grammar-region lines, 25 diagnostic codes on objectui's side.
• The @objectstack/sdui-parser port the lockstep demands. This is the seat's ruling A on Bump .objectui-sha past objectui f4ed2387e9 (objectui#11163, related-list actions), which also carries objectui#11199: unblocks #20936 and #20299 #20949 (5923109668), which widened the claim's surface. It mechanically mirrors objectui 6f864cf62 (objectui#8285).
  • packages/sdui-parser/src/kanban-quick-add.ts is deleted.
  • Its wiring in validate.ts and its four barrel exports in index.ts (checkKanbanQuickAdd, INERT_QUICK_ADD, QUICK_ADD_HOST_TYPES, QUICK_ADD_KEY) are removed.
  • __tests__/inert-quick-add.test.ts is rewritten for the new state, as objectui rewrote its own pin: an authored quickAdd on object-kanban draws the prop walk's own unknown-prop warning, and the barrel no longer publishes the four names.
  • There is no new diagnostic.
  • No other workspace package imports the four names (git grep, 0 hits outside packages/sdui-parser). @objectstack/lint and @objectstack/metadata-protocol import only compile, parseJsx and types.
  • .changeset/sdui-parser-retire-inert-quick-add.md declares the export removal: minor, **BREAKING** under the launch-window convention, a ! summary and Clause-②: no (narrowing).
  • pnpm check:sdui-lockstep now exits 0: the copy agrees with objectui at e420df310f5b on all 25 codes.
• The 49 asserting pin citations in packages/spec/src, re-measured at the new pin (next section). Also the regenerated packages/spec/src/migrations/registry.ts and content/docs/references/ui/view.mdx, and .changeset/objectui-pin-citations-e420df310f5b.md (@objectstack/spec patch). The FormField.span describe and six migration-entry descriptions ship the pin sha, so the text change publishes.
• pnpm objectui:build at the new pin built objectui against this tree's client and spec. It found no API break against framework code: 34 of 34 objectui dependency builds succeeded, with 0 TypeScript errors.
• origin/main was merged three times through scripts/pm/os-regen-merge.sh, at e32638aeac, b1da822c0f and 62ec639b04.
  • The first two overlapped only on the generated registry.ts, and gen:migration-registry reproduced the merged file byte for byte.
  • The third overlapped on component.zod.ts and component.test.ts (feat(spec,lint): one derived list of page-component slot positions, read by all three page walks (#20940) #20961's slot positions). It text-merged cleanly, and check:objectui-pin-citations still reads 49 asserting citations matching.
  • After each merge check:generated read every artifact current, so no regeneration commit was owed.

Pin-citation re-measure

Each record was handled in the same way. Its anchors were mapped through the db11afd4967c..e420df310f5b diff of the file each one cites, and each anchor was re-read at the new pin. Line hashes and corpus counts were taken again with the method the record names: git hash-object of the cited block, and git grep -o -F over the tracked tree. Only after that were the pin and the moved numbers updated. Each record keeps its earlier hops as history. check:objectui-pin-citations now reports 49 asserting citations matching e420df310 and 7 anchor content assertions verified against objectui at the pin.

Records whose CLAIMS moved, not only their numbers. These want a human read:

• action:* rows (component.zod.ts): objectui#11168 slice 1 rewrote all four registrations' inputs.
  • action:button now publishes 27 of its 29 keys, all but endpoint and undoable. It used to publish 7.
  • action:menu now publishes size and visible.
  • action:group no longer publishes its group-level name, and publishes the primitive's four sizes.
  • The three publication sentences are corrected. action:icon's label is now read five times, where the record said four: objectui#11212 added a fault label.
• New, recorded and not declared: objectui#11182 has action:group and action:menu consume the host's evaluated disabled verdict. So a properties.disabled on either block now greys it out at render, while their strict rows refuse the key at save. The docblocks say so. Declaring the key is a contract decision, not a pin re-measure.
• object-kanban limit: objectui#9853 renamed the default DEFAULT_KANBAN_LIMIT to DEFAULT_KANBAN_FETCH_BATCH_SIZE. It is still 100. The query line changed on the anchor itself.
• object-kanban quickAdd records: objectui#8285 and objectui#11234 landed objectui's half of the retirement. The board now renders an internal KanbanBoardCore, which reads neither key. So ObjectKanban.tsx names quickAdd and onQuickAdd 2 times each, all four in the comments that record the cut, where the records said 0. The records also now say that the schema-only kanban-ui block they point to was retired in objectui (objectui#8257), long before this pin.
• object-tree: objectui#8348 moved the tree's rung-1 call from the undeclared arm to view-data. It also dropped the ?? schema.data fallback from the host-data read. So the renderer and the row now agree on a bare array. The "WIDER than this row" sentences are dated to the pin where they held.
• object-map: one sentence said an authored data array still reaches the renderer through the React props channel. That has been false since objectui#9571, which predates db11afd4967c. objectui's own docblock was only corrected on this hop, so the record is corrected now. The sort record said the registration declares no sort input. objectui#8220 now declares one, in the same array form, and also on object-gantt and object-timeline.

Files: component.zod.ts, component.test.ts, view.zod.ts, dataset.zod.ts, functional-completeness.ts, api-methods-batch-conformance.test.ts, the six migrations/entries/semantic/18.* entries, and the regenerated registry.ts and view.mdx. No key, default, enum member or export moves.

Boot at the new pin

• Build: scripts/build-console.sh ran at e420df310f5b with this tree's client and spec injected, and its VERDICT was command-exit 0.
  • The canary import/jobs is present.
  • assert-console-spec-injection passes: 22 of 22 injected-only descriptions are present, and all 6 published-only ones are absent.
  • chunk-membership.json reads client in vendor-objectstack.
  • The tracked manifest it shipped is recorded at this pin. The dist is 62660 KB.
• Server: examples/app-showcase booted with objectstack dev --ui --fresh --no-seed-admin --no-watch -p 41949 on the whole-workspace build of the merged tree. bootstrap-status answered hasOwner: false.
• Registration: headless Chromium (/opt/pw-browsers/chromium) opened /_console/setup and submitted the owner form.
  • bootstrap-status flipped to hasOwner: true.
  • In-page get-session returned the new owner with positions platform_admin, org_owner and everyone, and isPlatformAdmin: true.
  • The wizard exited to /_console/home, which lists Showcase and Setup.
• Second sign-in: a fresh context signed in through /_console/login.
  • Showcase opened /_console/apps/com.example.showcase/page/showcase_capability_map.
  • Setup opened /_console/apps/com.objectstack.setup/dashboard/system_overview.
  • Neither page showed a compile or render error.
• Errors: 0 page errors, 0 TypeError and 0 5xx across both passes.
• Non-2xx:
  • 401 GET /api/v1/auth/get-session before each sign-in.
  • 404 GET /api/v1/usage/storage, which Bump .objectui-sha past objectui a5841be351 (objectui#11028), which also carries objectui#11008 and objectui#10964 — the one pin move #20287, #20578 and #20293 wait on #20638's boot recorded at the old pin too.
  • The browser's implicit 404 /favicon.ico. The console's index.html declares an empty-href icon link, and that file is byte-identical at both pins.
• Note: a first drive from 127.0.0.1 was refused at sign-up with 403 (Better Auth: Invalid origin). The server publishes localhost, and the drive from localhost is the record above. That attempt wrote nothing; hasOwner stayed false.
• Teardown: only the four recorded PIDs were stopped. The port is free, and the --fresh tempdir went with the process.
• Not repeated after the sdui-parser port: the port touches nothing the console loads. build-console.sh injects only this tree's @objectstack/client and @objectstack/spec into the bundle. @objectstack/sdui-parser runs server-side, in the JSX-page save gate (@objectstack/lint, @objectstack/metadata-protocol). The change there is one diagnostic code for an authored quickAdd on object-kanban (inert-quick-add becomes unknown-prop, still a warning), which the registration and sign-in path never reaches.

Spec compatibility

objectui at e420df310f5b resolves every @objectstack/* package to 17.5.0 in its lockfile, the published latest. Its declared ranges top out at ^17.5.0. Its own CI on that commit concluded success for both Type Check and Spec Main Shape Gate. The first compiles against the installed 17.5.0 faces, and the second against objectstack main.

Here, objectui's dependency build ran against node_modules/@objectstack/spec 17.5.0 with 0 TypeScript errors. No objectui change in the range needs an unreleased spec.

Governed surface

None of the 25 changed paths is a row of GOVERNED_SURFACES in scripts/pm/check-governed-merges.mjs (governedPathsIn returns none). No release act was performed. The diff is 1950 changed lines, under the 5000-line human-merge threshold.

Resolved since the first report

Both answers are on #20949 in 5923109668.

1. ADR-0087 disposition, the maintainer's ruling 「not-required (推荐)」: .changeset/console-e420df310f5b.md now carries adr-0087: not-required (no-migration-prescription) in place of the bump script's placeholder. It is worded after Bump .objectui-sha past objectui a5841be351 (objectui#11028), which also carries objectui#11008 and objectui#10964 — the one pin move #20287, #20578 and #20293 wait on #20638's and fitted to this diff:
   • It names the paths this diff moves, and states that the diff adds, removes or renames no ObjectStack-authorable key.
   • It names the five declared-breaking entries as objectui's own surfaces: 52aad5cef, 615346d61, 6f864cf62, 3c13675e5 and 846cec0ef.
   • It notes that object-kanban.quickAdd is already registered on this side as page.component.object-kanban.quickAdd (spec(ui): ObjectKanbanProps.quickAdd is accepted-and-dropped on object-kanban — objectui ruled it retired; the tombstone is this repo's half #17260).
   • The sdui-parser changeset carries the same disposition, worded as the ObjectStack mirror of 6f864cf62.
   • check-adr-0087-registration --base origin/main exits 0: 2 declared-breaking changesets, each with a disposition.
2. check:sdui-lockstep code-drift inert-quick-add, the seat's ruling A: the port is above, and the gate exits 0.

Gates at head 62ec639b04: 125 derived, 125 run, 0 NOT-MEASURED, 0 unrun, and all 125 exit 0. The 11 artifact-roster gates whose roster sits in a touched directory also all exit 0.

• @objectstack/spec: tests 17211 passed and 1 todo, across 584 files; typecheck exit 0.
• @objectstack/sdui-parser: 217 tests passed across 13 files; typecheck exit 0.
• @objectstack/lint (its three JSX-page and lazy-deps suites): 20 tests passed.
• @objectstack/metadata-protocol: 2896 tests passed and 19 skipped.
• Whole-workspace build: 72 of 72 tasks.
• The rewritten inert-quick-add pin was reverse-checked once. With the three pre-port sources restored from b1da822c0f, 4 of its 6 rows go red. The false and braced-marker rows stay green, because the interim never fired for them. Restored, git diff HEAD is empty and both edited files' blobs equal HEAD's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/sdui-parser, @objectstack/spec, touching 21 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/sdui-parser/src/index.ts, packages/spec/src/kernel/functional-completeness.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/analytics.mdx (via DatasetMeasureSchema (symbol, a top-level const))
• content/docs/protocol/objectui/layout-dsl.mdx (via ComponentPropsMap (symbol, a top-level const object))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageTabsProps (symbol, a top-level const object))
• content/docs/releases/v17/17-1.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-3.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-4.mdx (via ComponentPropsMap (symbol, a top-level const object))
• content/docs/releases/v17/17-5.mdx (via ComponentPropsMap (symbol, a top-level const object), quickAdd (literal, a string literal in QUICK_ADD_KEY))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json, packages/sdui-parser/src/index.ts, packages/spec/src/kernel/functional-completeness.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 138 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9b0de7de73699771b69649bf7b507fbd2a842260 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 17bcde1e3f44e1826b7850ccf674947b8a4f5359 — the merge of head 62ec639b04ce6d882bc19dd58e0f2a0751fdc3c7 into base 9b0de7de73699771b69649bf7b507fbd2a842260, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 17bcde1e3f44e1826b7850ccf674947b8a4f5359 && git checkout 17bcde1e3f44e1826b7850ccf674947b8a4f5359
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9b0de7de73699771b69649bf7b507fbd2a842260 62ec639b04ce6d882bc19dd58e0f2a0751fdc3c7 && git checkout -B drift-repro 9b0de7de73699771b69649bf7b507fbd2a842260 && git merge --no-ff 62ec639b04ce6d882bc19dd58e0f2a0751fdc3c7

node scripts/docs-audit/affected-docs.mjs --json 9b0de7de73699771b69649bf7b507fbd2a842260

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 9b0de7de73699771b69649bf7b507fbd2a842260 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 62ec639b04ce6d882bc19dd58e0f2a0751fdc3c7
Local-runs: none

Inputs read: card #20949 (body and all 8 comments: rider note 5920572123, claim 5920977306, dev reports 5922301659 and 5923687781, rulings 5923109668 and 5923178576, the #20471 pointer 5923131205 and its answer 5923456598); PR #20990 body, its 25-file list, and git diff origin/main... at the head (+1234/-716 = 1950 lines, merge base 9b0de7de73); the 42 check-runs on the head; objectui at db11afd4967c and e420df310f5b from the local full clone, read-only (cat-file, show, merge-base, grep). The dispatching seat's conclusions were not used as evidence.

Gate verdicts on the head: all 42 check-runs completed, 39 success and 3 skipped (the Auto Label and Check PR Size re-runs after the body edit, and the opt-in packed-tarball smoke). Check Changeset ran twice; its latest run, after the body edit, concluded success. Lint & Repo Gates (the job that runs check:sdui-lockstep and check:objectui-pin-citations), Console Pin Gate, Governed Surface Queue Guard, Spec property liveness, every Type Check lane and every Test Core shard concluded success.

① Derived judgments

Pin target: right. e420df310f5b is objectui origin/main HEAD in the local full clone. merge-base --is-ancestor exits 0 for f4ed2387e9 (objectui#11163), f8334f8777 (objectui#11199), 6f864cf62 (objectui#8285) and the old pin db11afd4967c; the negative control (new pin as ancestor of the old) exits 1; rev-list --count over the range is 90, as the PR body says. The range log names neither objectui#11270 nor objectui#11253, so the three rider texts in 5920572123 are rightly not due at this pin. The pin's apps/console/package.json reads @object-ui/console 17.6.0.

Moved pin-citation claims: eight records re-read at e420df310f5b, every corrected sentence true.

• action:button (components/src/renderers/action/action-button.tsx): the registration's inputs at :414-551 publish 28 names, 27 of the row's 29 keys plus className; endpoint and undoable are absent from inputs and still forwarded inside :215-311. At db11afd49 the block published 8 names (7 plus className). objectui#11168 as recorded.
• action:menu: inputs at :432-460 now carry size and visible (absent at db11afd49 :410-419); :219 reads disabled: hostDisabled and :385 disabled={hostDisabled || loading}. objectui#11182 as recorded.
• action:group: inputs at :484-525 publish no name (the :40-42 comment says why) and size is the primitive's ['default', 'sm', 'lg', 'icon']; :159, :274 and :415 read hostDisabled. At db11afd49 name was published.
• action:icon: label is read at :109 (the objectui#11212 fault label), :165, :278, :287 and :293/:299: five reads, as corrected.
• object-kanban limit: ObjectKanban.tsx:97 declares DEFAULT_KANBAN_FETCH_BATCH_SIZE = 100 (DEFAULT_KANBAN_LIMIT at :88 on the old pin) and :722 reads $top: resolveRowLimit(schema.limit, DEFAULT_KANBAN_FETCH_BATCH_SIZE).
• object-kanban quickAdd: ObjectKanban.tsx spells quickAdd 2 times and onQuickAdd 2 times, all four inside the objectui#11234 comments (:1231-1234, :1616), against 0 and 0 at the old pin; :1641 spreads into KanbanBoardCore; no non-test 'kanban-ui' registration exists at the pin.
• object-tree: ObjectTree.tsx:634 passes 'view-data' ('undeclared' at :632 on the old pin) and :865 reads (rest as any).data with the ?? schema.data fallback gone; core/src/utils/record-source.ts:409 lists 'object-tree': 'view-data'.
• object-map: plugin-map/src/index.tsx:101 declares sort as type: 'array' (none at the old pin), plugin-gantt :149 and plugin-timeline :377/:389 likewise; ObjectMap.tsx's own docblock records objectui#9571 stopping the SchemaRenderer spread for object-arm blocks, so the corrected data sentence is true.

Published text: right, and true at the pin. The only .describe() that moves is FormField.span (view.zod.ts), and only its pin sha. Its claim re-read at the pin holds: plugin-form/src/autoLayout.ts is byte-identical to the old pin, WIDE_FIELD_TYPES at :58-69 is textarea, markdown, html, grid and richtext in both spellings, resolveColSpan is at :154, and fields/src/field-type-alias.ts:180 maps repeater to field:grid. The six semantic migration-entry descriptions move their pin sha and corpus counts; re-taken at the pin: 9800 tracked files (9546 at the old pin), timeout 1293, tenant 1235, TTL 181, @objectstack/spec 6024, the numbers the text now ships. registry.ts and view.mdx are their projections.

No key, default, enum member or export moves in packages/spec: verified. The component.zod.ts diff (647 lines) has 0 non-comment changed lines; component.test.ts, dataset.zod.ts, functional-completeness.ts and api-methods-batch-conformance.test.ts move comment lines only. The PR body's sentence is a measurement, not a claim.

The @objectstack/sdui-parser port: a faithful mirror, and a public-surface narrowing rightly declared. objectui 6f864cf62 name-status: D kanban-quick-add.ts, M index.ts (the same four names leave the barrel), M validate.ts (the same checkKanbanQuickAdd call site leaves the prop walk), M kanban-quick-add-8285.test.ts (rewritten, not deleted), plus comment lines in body-dialect.ts, a module this copy does not carry. The port deletes the module, the four barrel exports and the call site, and the lockstep re-record drops inert-quick-add from the code set, leaving 25. The package is published (publishConfig.access: public, npm latest 17.5.0), so removing four barrel names narrows a published surface. git grep on origin/main finds no importer of any of the four names, of kanban-quick-add or of inert-quick-add outside packages/sdui-parser; the packages/spec hits are the D2 id object-kanban-quick-add-removed. The accept set does not move: an authored quickAdd on the object-kanban tag drew one warning before and draws one warning after, and only its code changes. check:sdui-lockstep agrees: Lint & Repo Gates is success on the head.

The regenerated sdui.manifest.json and its record: right. They project the pin's 107 registrations; the console minor changeset carries them, as #20638's did, and no objectstack-authored surface moves through them.

Governed surface and size. check-governed-merges --pr 20990 (a read-only reader): 0 of 25 paths hit the 6-row register; 1950 changed lines (+1234/-716), under the 5000-line human-merge threshold. The PR body's numbers.

② Semver level

• .changeset/sdui-parser-retire-inert-quick-add.md: @objectstack/sdui-parser minor, **BREAKING**, a fix(sdui-parser)!: summary, and the arm no (narrowing). Right. scripts/pm/clause2-line.mjs reads no (narrowing) as "NOT a widening, but breaking" and yes as a widening; the port widens nothing, so the yes the ruling 5923109668 asked for would have declared a widening that does not exist. AGENTS.md: (narrowing) is BREAKING and ships minor under the launch window; check-changeset-no-major.mjs reads the arm as "a BREAKING change; during the launch window it ships minor". Precedent on origin/main: 20862, 20863, 20932, each minor + ! + no (narrowing) + not-required. The body carries the migration AGENTS.md demands of an export removal (match unknown-prop on quickAdd, delete the import, delete the authored key).
• .changeset/console-e420df310f5b.md: @objectstack/console minor, 87 releasing entries with 5 flagged **BREAKING** on objectui's own packages. Right: the bump script's shape and Bump .objectui-sha past objectui a5841be351 (objectui#11028), which also carries objectui#11008 and objectui#10964 — the one pin move #20287, #20578 and #20293 wait on #20638's level.
• .changeset/objectui-pin-citations-e420df310f5b.md: @objectstack/spec patch, Clause-② value no with no arm. Right. What publishes is one describe sentence's pin sha and six migration descriptions' sha and counts; nothing an author writes is admitted, refused, renamed or defaulted differently, so neither arm applies, and patch is the level a text correction in a released package takes.
• The PR body's Clause-② line reads no (narrowing) where the claim 5920977306 read no. Right. The claim predates ruling A, which widened the surface by the port; once the PR carries a declared narrowing the PR-scoped line must say so, and Check Changeset, the PR-scoped level axis with check-adr-0087-registration reading the arm, concluded success on it. The dev named the change as a deviation rather than making it silently.
• ADR-0087: both changesets carry exactly one adr-0087: not-required (no-migration-prescription) marker in the HTML-comment form the gate reads, and the maintainer's ruling 「not-required (推荐)」 and confirmation 「同意，sdui-parser 也按 not-required 处理」 are recorded on the card (5923109668, 5923178576). Each marker's text is accurate. The console marker names the paths the diff moves and states that the diff adds, removes or renames no ObjectStack-authorable key: true (0 non-comment lines in component.zod.ts, one describe sha, docblocks and generated projections). The sdui-parser marker states that what moves is the package's TypeScript surface and diagnostic payload and that quickAdd is already registered as page.component.object-kanban.quickAdd (spec(ui): ObjectKanbanProps.quickAdd is accepted-and-dropped on object-kanban — objectui ruled it retired; the tombstone is this repo's half #17260): true, migrations/entries/semantic/18.object-kanban-quick-add-retired.ts names that surface on origin/main. One boundary on the category is noted under ③.

③ Boundary flags

• Dev flag, the Clause-② spelling conflict with the dispatch: answered under ②; the dev's spelling is the right one.
• Dev flag, four barrel exports removed where the ruling named two: forced and minimal. objectui 6f864cf62 removed the same four, and QUICK_ADD_HOST_TYPES and QUICK_ADD_KEY were re-exported from the deleted module, so leaving them would not compile.
• Dev flag, the test rewritten rather than deleted: forced by the mirror (objectui modified its own pin rather than deleting it) and minimal: 6 rows, each asserting the post-port state (the walk's unknown-prop warning for true, false and the braced marker; no inert-quick-add for any value; ok unchanged; the four names absent from the barrel with checkDashboardWidgetOptions as the lit control). The reverse check the dev reports, 4 of 6 red with the pre-port sources restored, is the right non-vacuity evidence.
• Dev flag, the whole @objectstack/metadata-protocol suite run outside the verify lock: not forced (an empty filter) and harmless, a read-only test run whose result is a superset of what was owed; not a property of the diff. Noted.
• Dev flag, origin/main merged a third time with the component.zod.ts and component.test.ts overlap from feat(spec,lint): one derived list of page-component slot positions, read by all three page walks (#20940) #20961: forced (both files moved on main under this branch's own edits) and minimal: a text merge through os-regen-merge.sh, no regeneration owed (check:generated green), the merge commit carrying main's content only, and every gate on the merge head green.
• Dev flags from the first report (a private full objectui clone as OBJECTUI_ROOT; --no-commit bump with a hand commit for the trailer; the boot driven on the first merge only and from localhost after the 127.0.0.1 origin refusal; the boot not repeated after the port): precedent-backed (Bump .objectui-sha past objectui a5841be351 (objectui#11028), which also carries objectui#11008 and objectui#10964 — the one pin move #20287, #20578 and #20293 wait on #20638's accepted deviations) and reasoned. build-console.sh injects only @objectstack/client and @objectstack/spec into the bundle, and the port touches a server-side parser the registration path never reaches. Console Pin Gate is success on the head.
• open_questions: both from the first report are answered by rulings on the card (5923109668: disposition A and port ruling A; 5923178576: the sdui-parser disposition confirmed by the maintainer). The second report carries none.
• "New, recorded and not declared" (objectui#11182: action:group and action:menu honour a host-evaluated disabled their strict rows refuse at save): recording it in both docblocks and in the PR body, without declaring the key, is the right scope for a pin bump. Declaring disabled on two strict rows is a contract widening that the claim's surface excludes and that a Clause-②: yes card would carry. On filing: under os-dev.md a finding with no named producer and no measured wrong answer at a public door takes the carrier: form and goes to Acceptance notes, which is the form the dev used (承接者:无 · noted, not filed) and the seat endorsed. Escalated, not blocking: the renderer-versus-row split is an ADR-0049 declared-versus-enforced question on the domain:spec seat's own rows, and the next pin re-measure will re-read it; the seat should carry it in its ledger or fold it into the family card, and the PR body carries it under the re-measure section rather than a ## Acceptance notes heading.
• The ADR-0087 category on the sdui-parser changeset: no-migration-prescription is held by the gate's documented residual. The body's rewrite guidance is prose without arrow or table framing, the fix(service-package): classify a publish driver fault as 5xx and stop returning driver text as caller data (#8131) #8277 shape the gate's own header names, while AGENTS.md requires exactly that migration text for an export removal. The two rules pull apart on every published-export removal, not on this PR: runtime-interface-only cannot name a deleted symbol, unpublished is false, and already-registered would name the authored key's entry, not the TypeScript surface. The maintainer's confirmed ruling settles the disposition. Not a defect of this diff; noted for the gate's owner.
• Out-of-scope finding 1 (the quickAdd tombstone prescription steers authors to the retired kanban-ui block): filed by the seat for triage per 5923109668; this PR rightly qualifies only the docblock and leaves the runtime text alone.
• The [finding] the six ComponentPropsMap rows #20371 added cite about a hundred objectui anchors by line number alone: no quoted first line, so --verify-anchors checks none of their content #20471 pointer: rightly not taken (5923456598); check-objectui-pin-citations.ts is untouched.

Implemented-by: claude/issue-20949-bump-objectui-pin
Reviewed-by: session_018fxqvRJW12TaHC7DUQ89Y6

VERDICT: PASS