feat(spec, metadata-protocol): each _drafts row carries the draft body's own label, or null

[objectstack-fleet]

Fixes #22200
Clause-②: yes (widening: a new field on a published response schema)

What changes

Each row of the pending-drafts list (GET /api/v1/meta/_drafts, the runtime's GET /metadata/_drafts, client.meta.listDrafts()) now carries label: the draft body's own top-level label, as authored, or null when the body declares none. It is never the machine name standing in for a missing label.

• Contract (packages/spec/src/api/protocol.zod.ts): ListDraftsResponseSchema rows gain label: I18nLabelSchema.nullable(), required on the wire, with a describe that says it is the body's own label and never a name fallback.
• Producer (packages/metadata-protocol/src/sys-metadata-repository.ts): SysMetadataRepository.listDrafts reads the label off the sys_metadata row it already fetches (draftBodyLabel), so there is no second query. The declared return gains label: I18nLabel | null.
• Pass-through (packages/metadata-protocol/src/protocol.ts): ObjectStackProtocolImplementation.listDrafts declares the same member and passes the repository's rows through unchanged. The docblock on the publish batch's closure read, which listed the six header members, now lists seven.

The maintainer's direction on objectstack-ai/objectui#11862, quoted by the card: 「所有地方以标签为主，机器名只作为次要信息」. The producer carries the label; consumers do not each fetch one. Triage's grade, quoted: "Each _drafts row carries the draft body's own label, or null"; "Add a row whose draft body declares no label and reads null, never a fallback."

Measurements behind the shape (each PM hypothesis, measured on this branch's base 238222d8c)

H1: holds, with one refinement. listDrafts calls engine.find('sys_metadata', { where, context }) with no field projection, so the whole row is in hand. The body is NOT a column of its own: sys_metadata has no label column (packages/metadata-core/src/objects/sys-metadata.object.ts); the label lives inside the metadata textarea column, stored as JSON text (an already-parsed object on a JSON-column dialect). So the producer parses row.metadata once per draft row, through the same storedRowBody reader rowToItem uses. No second query.

Label spelling per metadata type, read from getMetadataTypeSchema(type) over every DEFAULT_METADATA_TYPE_REGISTRY entry (built packages/spec/dist, z.toJSONSchema, input side):

top-level label shape	types
plain string	object, field, hook, picklist, mapping, flow, job, datasource, translation, email_template, doc, book, permission, position, capability, agent, tool, skill
I18nLabel (string or inline locale map)	view (container and view items), page, dashboard, app, action, report, dataset
no label key	seed, api (rows read null)
no schema	external_catalog (any stored label is judged by I18nLabelSchema)

No registered type spells its display label title or nests it. Off-registry: connector, sharing_rule and webhook spell it label (string); analytics_cube spells it title and its schema refuses label with guidance to title, so a cube draft reads null (see Acceptance notes).

No ADR-0087 conversion rewrites a top-level label (packages/spec/src/conversions/registry.ts: the only label entries are the nested datasource.external.label removal and fixtures), so the stored spelling is already the canonical one and reading it raw needs no conversion replay.

H2: holds; no third file moves. Both faces serve the protocol's return whole: packages/rest/src/rest-server.ts GET ${metaPath}/_drafts ends in res.json(result), and packages/runtime/src/domains/meta.ts _drafts ends in deps.success(data). packages/client/src/index.ts meta.listDrafts types its answer as the spec's ListDraftsResponse. packages/rest and packages/runtime are untouched.

H3: holds. Seven types declare label as I18nLabelSchema (string or inline locale map such as { en, 'zh-CN' }). What the producer does with each shape:

• plain string: carried verbatim.
• inline locale map: carried verbatim, not resolved. The route takes no locale, so resolving here would be the producer choosing a language for the reader; the reader resolves it the way it resolves every other I18nLabel (resolveI18nLabel in @objectstack/spec/ui, or objectui's pickLocalized).
• absent / null: null.
• any other stored value (a number, an array, the retired key-reference form): null. I18nLabelSchema.safeParse is the judge, so the declared field never carries a shape its own type rules out. Draft saves are schema-validated (resolveOverlaySchema in saveMetaItem), so this is reachable only for rows stored before a type's schema was enforced on save, or for a type with no registered schema.
• stored bytes that do not parse: null, and the draft stays listed. This is lockHead's answer for the same bytes, in the same file, for the same reason: a header listing must not become a parse failure. The draft stays visible and discardable, while every read of its body still fails loudly.

Landing and surface

The landing matches the claim's surface, plus one test file outside it, named here with its reason:

• packages/objectql/src/sys-metadata-repository-list-drafts.test.ts is a test of SysMetadataRepository.listDrafts that lives in packages/objectql. Its finding: /meta/_drafts serves DRAFT object schemas unmasked — the one ADR-0106 outlet left uncovered #6599 disclosure pin asserted exactly six header keys, so it goes red on any seventh. It now names seven keys. Its fixture now carries the body in the metadata column the repository actually reads, beside the two older spellings, so the whole-payload sweep covers the real column. It asserts the label arrives while every field-level secret stays off the wire. Its docblock said the routes had "no capability gate"; both routes now gate on mayReadPendingDrafts, so that sentence is corrected.
• Declared cross-lane files: packages/metadata-protocol (domain:engine), declared by the seat on [PM seat] domain:engine — ⏳ vacant #6367.

Tests

Readings at head 317b208be. Every run went through scripts/pm/os-verify-lock.sh on a shared box. The full report comment on the card carries the rest.

• @objectstack/spec tests:
  • project local, all 8 shards: 625 files, 18713 passed, 1 todo, 0 failed;
  • project repo, shard 1/2: 27 files, 399 passed. The report states the reading for shard 2/2, or NOT MEASURED with the reason;
  • typecheck (tsc, scripts and the test layer) exits 0.
• @objectstack/metadata-protocol tests: the whole suite has 221 files passed and 3 skipped, with 28287 tests passed and 19 skipped. typecheck exits 0.
• @objectstack/objectql: sys-metadata-repository-list-drafts.test.ts has 7 passed. typecheck (with the test layer) exits 0.
• @objectstack/rest: the 18 test files that name _drafts have 906 tests, all passed. packages/rest itself is unchanged.
• Gates: node scripts/pm/dispatch-gates.mjs --commands was re-derived after the change and gave 113 families. All 113 were run, every one exited 0, and --ran reports "113 derived famil(ies) accounted for — 113 run, 0 NOT-MEASURED". pnpm --filter @objectstack/spec check:generated --fix regenerated only content/docs/references/api/protocol.mdx, and check:docs re-checked green.

What the new pins cover:

• @objectstack/spec: the schema pin "ListDraftsResponseSchema declares the pending-drafts body" now carries a string label, an inline-locale-map label and a no-label row reading null. It also pins that a row omitting label is refused at drafts.0.label.
• @objectstack/metadata-protocol (sys-metadata-repository-14938-list-drafts-updated-at.test.ts, which shares its pinned engine double): the declaration-keyed CONFORMS table gains label, so every existing case also checks it. New #22200 cases cover:
  • a label written through the real put(..., { state: 'draft' }) and read back;
  • a body with no label, which reads null, not the name;
  • a locale map carried verbatim;
  • a JSON-column body;
  • three off-spec labels, each reading null;
  • torn stored bytes, which read null while the draft stays listed;
  • ObjectStackProtocolImplementation.listDrafts passing the label through, its response parsed by ListDraftsResponseSchema with every member preserved, and exactly seven header keys with no body residue.
• Ablation, run once and not committed, through scripts/ablation-replace.mjs: the producer line label: draftBodyLabel(row), was replaced by the forbidden fallback label: row.name ?? null,. All 10 #22200 cases went red and the 8 #14938 cases stayed green. The file was restored to its HEAD blob and git diff HEAD was empty.
• Reverse type verification: a ListDraftsResponse literal without label, planted in a metadata-protocol test file, fails tsc with TS2741: Property 'label' is missing. So the consumer reads the rebuilt spec .d.ts. The file was restored to its HEAD blob.

Acceptance notes (observations; not filed)

• analytics_cube drafts read label: null. CubeSchema spells its display name title and refuses label with guidance to title. This PR reads only label, the field the ruling names. A per-type display-key mapping would be a second vocabulary for the producer to keep in step, so it is not added here. Reach is not measured: no cube draft producer was found in this repository. Carrier: none.
• An empty-string label ('') is carried as ''. It is the body's own value and passes I18nLabelSchema. Whether a reader treats it as absent is the reader's choice.
• objectui's half stays on studio: machine names and raw ids shown where a label exists — Explain access principal, permission-set list, nav editor items, Changes panel objectui#11862. MetadataDraftHeader in @object-ui/data-objectstack follows after the pin bump that carries this field. No objectui change is made here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/spec, touching 6 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via listDrafts (symbol, a method of class ObjectStackProtocolImplementation; a method of class SysMetadataRepository))
• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), SysMetadataRepository (symbol, a top-level class))
• content/docs/ui/apps.mdx _(via /api/v1/meta/drafts (route, the route ledger binds it to client method meta.listDrafts))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 440bed63e731117bc194166fea3eec3d923ad2c6 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 347b3754f4f14d93827bcb46dd6335a63f890887 — the merge of head 98a5aef8dcd71f0cd0c5ac6a866b1c133df06866 into base 440bed63e731117bc194166fea3eec3d923ad2c6, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 347b3754f4f14d93827bcb46dd6335a63f890887 && git checkout 347b3754f4f14d93827bcb46dd6335a63f890887
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 440bed63e731117bc194166fea3eec3d923ad2c6 98a5aef8dcd71f0cd0c5ac6a866b1c133df06866 && git checkout -B drift-repro 440bed63e731117bc194166fea3eec3d923ad2c6 && git merge --no-ff 98a5aef8dcd71f0cd0c5ac6a866b1c133df06866

node scripts/docs-audit/affected-docs.mjs --json 440bed63e731117bc194166fea3eec3d923ad2c6

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 440bed63e731117bc194166fea3eec3d923ad2c6 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

CI on 317b208be1, two red Test Core shards · domain:spec seat 2 (#18549) · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T16:51Z. The dev is still in flight on #22200.

• Test Core (6/6): not this PR's. No test failed. The shard-timing drift step reads 2512.7s measured vs 1609.1s predicted (1.56x, red past 1.5x). The overshoots are @objectstack/runtime 1.68x, plugin-security 1.57x and driver-sql 1.56x, packages this diff does not touch; check-test-completeness reports every scheduled test accounted for. This is a slow runner, not the dataset or this change.
• Test Core (2/6): one timeout, being measured. packages/spec/src/integration/connector-author-shape.test.ts:194 ("compiles every full connector example verbatim") timed out at 60000ms; the other 18721 spec tests passed in a run whose imports took 402s. The dev times that test on main and on this head under the shared verify lock before reporting. If this PR slows the compile probe, the fix lands here; ⛔ the timeout is not raised and the test is not skipped.
• Re-run: this seat has no re-run op (the relay carries none). The next push to this branch, a fix or a merge of main, re-runs both shards.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 81cd9291bc383e6fc64e39e130d1dd0dde543015
Local-runs: none

Inputs read: card #22200 (body and all 5 comments: triage 6054566832, claim 6060635187, dev reports 6065161975 and 6065768152, the seat's accept 6065790260), PR #22323 (body, 8-file list, the net diff 28bff18d0..81cd9291b, +311/−17), the 35 check-runs on the head, and on origin/main AGENTS.md (Prime Directives #2, #12, #14; Post-Task Checklist step 3; "Touched packages/spec"), ADR-0087, packages/spec/src/ui/i18n.zod.ts, the two _drafts routes, the SDK client, the route ledgers, sys-metadata-repository.ts (storedRowBody, rowToItem, lockHead), the conversions registry, the three docs the drift check named, and the objectui sibling's MetadataDraftHeader. Nothing was built, run or re-run; the one gh api …/jobs/…/logs call was a read that returned no bytes (blob host not reachable) and was answered instead from the job's step conclusions and the check-run annotations.

① Derived judgments

Every accept-set and public-surface change the diff implies, each judged:

1. ListDraftsResponseSchema rows gain label: I18nLabelSchema.nullable(), required (packages/spec/src/api/protocol.zod.ts:1801). Accept set: a row without the key is now refused at drafts.0.label; a row whose label is a string, an inline locale map of strings, or null is accepted. Right. The ruling's "reads null, never a fallback" needs the key present, so required-nullable is the honest shape and .optional() would have re-opened the ambiguity. Who parses it today: nobody on the wire. REST GET /api/v1/meta/_drafts ends in res.json(result) (rest-server.ts:5930), the runtime _drafts door in deps.success(data) (domains/meta.ts:1855), the SDK meta.listDrafts() in unwrapResponse (a cast, client/src/index.ts:2050), and both route ledgers name the schema as describe-only transcription with conformance pinned in protocol.test.ts. So the schema's narrowing lands only on the one producer this repo owns (judgment 3), and every reader gains a member. The type-level consequence for a downstream that builds a ListDraftsResponse literal (TS2741 without label) is the one the dev's reverse check measured and the changeset's "required on the wire" states.
2. protocol.mdx regenerated (summary row and nested-shape row both carry label). Right: gen:docs output, not hand-written; api-surface/ records export existence only and no export was added, so no api-surface move was owed; the JSON-schema/authorable-surface manifests cover metadata types, not API response schemas. The TypeScript Type Check job, which holds every spec artifact gate, is green on the head.
3. Producer draftBodyLabel(row) (sys-metadata-repository.ts:223-232, used at :1383). Reads storedRowBody(row) — the same reader rowToItem uses, so the same metadata column — then I18nLabelSchema.safeParse(body?.label); null on refusal and on a parse throw. Right on each branch:
   • never the machine name — the function never references row.name; the dev's ablation (label: row.name ?? null) turned all 10 new cases red;
   • no second query — the engine.find call is unchanged and unprojected; the cost added is one JSON.parse per draft row, at console scale;
   • a locale map carried verbatim — the route takes no locale, and resolveI18nLabel (@objectstack/spec/ui) / pickLocalized (objectui) exist on both sides;
   • off-spec stored label → null is not a PD Add comprehensive test suite for Zod schema validation #12 consumer fallback: it is the declared "absent" answer for a shape the field's own type cannot carry, at the read door this repo owns; draft saves are schema-judged (resolveOverlaySchema, protocol.ts:793), so the branch is reachable only for pre-enforcement rows or unregistered types; and no ADR-0087 conversion rewrites a top-level label (the registry's only label entries are the nested datasource.external.label removal and fixtures), so the raw spelling the header reads is the one rowToItem serves too;
   • torn bytes → null with the draft still listed mirrors lockHead (sys-metadata-repository.ts:2188-2197 on the head) line for line: a header listing must not become a parse failure, and every body read still fails loudly.
4. Protocol pass-through (protocol.ts:22705-22734): declared return gains label: I18nLabel | null; getOverlayRepo() returns SysMetadataRepository, so { drafts } carries the widened rows with no runtime line moved; I18nLabel was already imported at :154. The publish batch's closure docblock now lists seven header members. Right.
5. Boundaries of the new import edges. api/protocol.zod.ts already pulled ../ui/view.zod, so ../ui/i18n.zod adds no entry-closure edge; sys-metadata-repository.ts imports a value from @objectstack/spec/ui, which protocol.ts in the same package already does, on a declared dependency. Right; Lint & Repo Gates and the four Type Check jobs are green.
6. Disclosure boundary (finding: /meta/_drafts serves DRAFT object schemas unmasked — the one ADR-0106 outlet left uncovered #6599) held. Exactly one body member leaves. Both key-count pins now say seven, and the objectql sweep still asserts fields, option values and the formula stay off the wire — now against the real metadata column as well as the two older spellings. These are the only two tests on main that pin the header's key set (searched: no other updatedBy key list exists in packages/**/*.test.ts). Right, and the out-of-surface objectql test file is the consequence the seat accepted.
7. Pinned sibling. objectui's MetadataDraftHeader is a plain interface and listDrafts casts res.json(); nothing parses strictly, so the extra key is harmless at the pin, Console Pin Gate skipped on path, and the objectui widening stays on studio: machine names and raw ids shown where a label exists — Explain access principal, permission-set list, nav editor items, Changes panel objectui#11862. Right.
8. Hand-written docs. client-sdk.mdx, metadata-lifecycle.mdx and ui/apps.mdx name the route or the gate only; none enumerates the row's fields, so none is falsified. Right.
9. Two edge values carried as authored — '' (named in the PR) and the empty map {} (not named; same class, z.record admits it). Both are the body's own value under I18nLabelSchema; the reader resolves. Observation, no change owed.

② Semver level

Changeset .changeset/22200-drafts-header-label.md: @objectstack/spec minor, @objectstack/metadata-protocol minor, body carrying Clause-②: yes (widening); the PR body carries Clause-②: yes (widening: a new field on a published response schema); the claim says the same. Matches what the diff publishes. For every reader of the public surface the change is additive; the accept-set narrowing (the key is required) falls only on the producer this repo owns, which is the internal-contract case PD #12 describes. AGENTS.md step 3: yes takes at least minor — met; no (narrowing) arm, no removal, no rename, so no migration text or ADR-0087 disposition is owed. skip-changeset does not apply and is not applied. No changeset is owed to @objectstack/objectql (test-only), rest, runtime or client (untouched; the client's return type follows spec). Check Changeset is green on the head. The five changeset sentences (what a client reads, its shape, when null, where from, unchanged) each match the diff as read in ①.

Clause-②: yes (widening) — agreed.

③ Boundary flags

• open_questions: [] in both dev reports. Nothing to answer.
• Dev deviations (round 1, six): out-of-surface objectql pin — accepted, ① item 6; protocol.ts type-only — confirmed, ① item 4; sharded spec runs — superseded by the head's check-runs; no labels written — consistent with the dispatch; attribution trailer form — AGENTS.md's, not a contract matter; CI 2/6 timeout — Test Core (2/6) is green on this head, closing that flag. Round 2: none.
• out_of_scope_findings (carrier none): analytics_cube drafts read label: null because CubeSchema spells its display name title — consistent with the ruling's own word (label), and a per-type display-key map would be a second vocabulary; reach unmeasured; acceptance note is the right carrier. Empty-string label carried — the reader's choice on objectui#11862. I add the empty-map sibling (① item 9) to the same note.
• Check-runs on the head, 35 read on 2026-10-08 after the 6/6 job completed at 17:52:55Z: 31 success, 2 skipped (Console Pin Gate, Packed-tarball smoke, both path/opt-in), 2 failure: Test Core (6/6) and its aggregate Test Core. On 6/6 the steps "Run this shard's tests" and "Test completeness guard" are success; the only failed step is "Check this shard's timing drift" (partition-test-shards.mjs --check-drift, reds past 1.5x measured/predicted), and the aggregate reds because that shard published no attestation. The log itself was not reachable (blob host), so the per-package ratios on this head are unread. The seat's reading on finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014 (6065689519, open, p2, domain:devx) measured the same shard at 1.52–1.56x on three unrelated PRs the same day, one comments-only, with the overshoots in runtime, plugin-security and driver-sql — none in this diff — and this PR's packages (spec at 1134.86s is its own shard's heaviest) are not on that shard. Escalated, not a contract defect: the gate verdict on the head is red and the landing rule needs every check green; the seat holds no re-run op, so the path is finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014's dataset refresh (the maintainer workflow_dispatch its triage names) or a re-run of 6/6 after it. The contract review does not substitute for that green.
• No governed surface in the file list (none of docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, NORTH-STAR); Governed Surface Queue Guard green.

Implemented-by: claude/issue-22200-drafts-header-label
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 98a5aef8dcd71f0cd0c5ac6a866b1c133df06866
Local-runs: none

Inputs read, at 2026-10-09T11:07Z: card #22200 (body and all 6 comments: triage 6054566832, claim 6060635187, dev reports 6065161975 and 6065768152, the merge report 6079486284, the seat's accept 6065790260); PR #22323 (body, the 8-file list, its 7 commits, the net diff against main at da159f7 — the merge base of this head — +311/−17; its 3 issue comments, among them the earlier record 6065980475 on 81cd929; 0 reviews, 0 review comments); the 35 check-runs on the head. Read through git on fetched refs (refs/review/pr-22323-b, refs/review/pr-22323-main) and the REST API; nothing built, run or re-run. This head is a merge of main at da159f7 into the head the earlier record judged, plus one regeneration commit; it is judged on its own below.

① Derived judgments

1. The PR's own delta is unchanged. The added and removed lines of 28bff18d0..81cd9291b (the delta the earlier record judged) and of da159f74e..98a5aef8d (this head's) are identical: 328 lines each, a line-set diff of 0, the same 8 files. The merge commit 6247b16 carries exactly those 8 files against main and nothing else. So every judgment in 6065980475 ① items 1–9 stands on this head as written: the required-nullable label on ListDraftsResponseSchema rows (protocol.zod.ts), the producer draftBodyLabel reading the body through storedRowBody and judging it with I18nLabelSchema.safeParse (null on refusal and on a parse throw, never row.name), the protocol pass-through with its declared label: I18nLabel | null, the seven-key disclosure pins, and the untouched REST, runtime and SDK faces. Right.
2. main's feat(metadata-protocol)!: managed content is sealed — OS_METADATA_WRITABLE no longer opens an item a managed package ships (ADR-0131 D6, #15206 S2) #22401 (the managed-content seal) does not interact with what this PR publishes. Its hunks in sys-metadata-repository.ts are the import at :91 (managedItemSealedSentence in, packagedBaseRegimeSentence out) and the assertAllowed write door at about :1693–:1990; its hunks in protocol.ts sit at :44, :150, :11230, :15972–:17357, :20195–:20884 and :26657. None names listDrafts, storedRowBody, draftBodyLabel, rowToItem, lockHead or the _drafts route. At the head the PR's import (:84, I18nLabelSchema and I18nLabel from @objectstack/spec/ui) and main's (:91) stand adjacent; draftBodyLabel is at :223 and listDrafts at :1350–:1390, both byte-identical to the judged delta; protocol.ts keeps its I18nLabel import at :154 beside main's applyConversionsToFlow edit on the neighbouring line, and listDrafts at :22839. The seal judges WRITE intents (override-artifact falls through to the seal; runtime-only alone opens on the hatch) and is not conditioned on state: its reach on drafts is which draft rows can come to EXIST (a draft overlay onto an item a managed package ships is refused at the door), never what a listed row carries. The label still comes off the row's own body. Right — no interaction. Likewise main's rest-server.ts hunks (the auth: server-side auth.api.getSession reads renew the session without forwarding the renewed cookie, so the browser cookie expires before the session (split session) #22258 in-process session-read rule at :40 and :3023–:3220) leave the _drafts handler alone, and ui/i18n.zod.ts, runtime/src/domains/meta.ts, client/src/index.ts, the conversions registry and sys-metadata.object.ts did not move between the two bases.
3. The regenerated reference page is right. content/docs/references/** is merge=os-regen (.gitattributes:178). main's fix(spec): the submitBehavior property help carries no ruling date #22322 removed the ruling-date clause from the two submitBehavior help rows (protocol.mdx about :1746 and :1831). The merge commit 6247b16 kept the branch side of the page byte for byte (its diff against 81cd929 on that path is empty), so against main it carried 7 page lines: the PR's 3 plus that 2-row regression. The regeneration commit 98a5aef8d changes one file, that page, and exactly those two rows, restoring main's text. At the head the page differs from main by exactly the PR's own 3 lines (+2/−1): the drafts summary row and the nested-shape label row. gen:docs output, not hand-written; TypeScript Type Check, which holds check:docs and every other spec artifact gate, is green on the head. fix(spec): the submitBehavior property help carries no ruling date #22322's other page, references/ui/view.mdx, is untouched by the PR and took main's side with no second parent to drop. Right.
4. Accept set and public surface, restated for this head: one member added to a published response schema, required and nullable; one producer this repo owns widened to carry it; no export added, removed or renamed (api-surface/ unmoved, as its gate agrees); no route, query parameter or SDK method changed; no governed path in the file list. Every reader gains a key, and nothing a reader could send is refused that was accepted before. Right.

② Semver level

Changeset .changeset/22200-drafts-header-label.md, unchanged on this head: @objectstack/spec minor, @objectstack/metadata-protocol minor, body Clause-②: yes (widening); the PR body carries Clause-②: yes (widening: a new field on a published response schema); the claim says the same. Matches what the diff publishes: additive for every reader, the only narrowing (the key is required) landing on the producer this repo owns. yes takes at least minor — met; no (narrowing) arm, no removal or rename, so no migration text and no ADR-0087 disposition is owed; skip-changeset does not apply and is not applied. main's #22401 ships its own breaking changeset for metadata-protocol; that is main's declaration, not this PR's, and the two do not overlap. Check Changeset is green on the head.

Clause-②: yes (widening) — agreed.

③ Boundary flags

• open_questions: [] in all three dev reports. Nothing to answer.
• Merge-round notes (6079486284), each answered: (a) main moved past da159f7 after the merge (to 3ca71b6; fix(metadata-protocol)!: one reader of OS_METADATA_WRITABLE — the legacy OBJECTSTACK_METADATA_WRITABLE, removed in 11.0, no longer opens the hatch at the type listing #22440 touches both metadata-protocol files at lines far from the PR's hunks) — not an input here; the head's own check-runs ran on the merge ref into 440bed6 (the drift check's tree line), GitHub reads the PR as mergeable_state: clean, and the queue rebuilds against the main of the moment — the §10 second round, not this record's. (b) The merge commit message names the local branch with an -m81 suffix — cosmetic, history not rewritten. (c) A scratch file overwritten in the dev's own scratch area — not a contract matter. (d) Draft flag, body, labels and assignee untouched — consistent. The gate record was re-executed from scratch after a denied text edit rather than edited — the right way round.
• out_of_scope_findings: round 3 adds one, carrier none: os-regen-merge.sh's refusal text reads circular when the pre-commit hook refuses step 3 — polish, outside the filing classes; noted, and this round followed the script's documented collection point regardless. Rounds 1–2's two (an analytics_cube draft reads label: null because CubeSchema spells its display name title; an empty-string label carried as '') and the earlier record's empty-map sibling stay as acceptance notes.
• The earlier record's escalation is closed on this head: Test Core (6/6) and the aggregate Test Core are both success.
• Check-runs on the head, all 35 read in this act: 33 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in), both path/opt-in), 0 failure, 0 pending. The seven required contexts are each success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. No red, no pending.
• No governed surface in the file list (none of docs/adr/**, docs/NORTH-STAR.md, .claude/**, skills/**, AGENTS.md, CLAUDE.md); Governed Surface Queue Guard green.

Implemented-by: claude/issue-22200-drafts-header-label
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS