spec: retire the `page` member of the list-view `type` enum and its `pageName` mount — enforce-or-remove, the objectui render half was never built (maintainer 2026-09-09 「撤」)

[os-bill]

Filed by the director seat (summon #20, session_01Tep4AYXZvyBA7jsvne5KZV, GitHub os-bill) executing a maintainer ruling. domain:spec set by the mechanical rule 凡触 packages/spec 一律转 spec 座位; triage corrects if it disagrees.

Ruling (who / verbatim / where)

Maintainer, live PM chat with the director seat, 2026-09-09T05:3xZ, on decision batch #107 item 1 (objectui#8429) after two questions — what a type: 'page' list view is, and when the requirement was decided and whether it is valuable. Presented options: A finish the objectui delegating mount · 撤 retire the enum member from spec under enforce-or-remove · D park with the current-state pin. Reply, verbatim: 「撤」.

Governing text: the 2026-08-29 ruling on #13216 (direction 1: a page member on the view type enum, render delegated to the page renderer — landed on the spec side as PR #13372 d23dc08a; the objectui mount half never landed, objectui#8429); ADR-0049 enforce-or-remove; the four-axis principle 「已发布零消费的能力不因沉没成本获得豁免」 (SKILL.md 〈升级与决策〉); packages/spec/liveness/view.json /props/list/children/type/note and /props/list/children/pageName/*.

What is measured (2026-09-09, origin/main c0e4bc74+)

• packages/spec/src/ui/view.zod.ts:1848 — 'page' in the ListViewSchema.type enum; :1946-1970 pageName; :1632-1720 checkListViewPageMount + the three refusal messages (VIEW_PAGE_MOUNT_NEEDS_PAGE_NAME, VIEW_PAGE_NAME_NEEDS_PAGE_TYPE, VIEW_PAGE_MOUNT_HAS_COLUMNS), attached at :2138, :3720, :4633 (three list-view doors).
• packages/spec/src/stack.zod.ts#validateCrossReferences — the build-time page-name existence branch; packages/lint/src/validate-view-page-refs.ts#validateViewPageRefs — the CLI / publish-gate resolution (runtimeTypes: ['flow','view']).
• packages/spec/liveness/view.json — the pageName rows and the type note quoted above.
• Real usage: zero authored type: 'page' list views in this tree or any consuming app the seats can read (objectui#8429's census; the 25 in-tree type: 'page' hits are app nav items, a different key that stays). objectui's ListView maps page → grid with a warn (declared ≠ enforced).
• Direction 3 of [feature] Give runtime-published custom pages an end-user entry point: a page view type on objects, or nav registration at publish time #13216 (command-palette indexing of published pages, PR feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages #14249) is not part of this retirement and stays. Direction 2's design card [Design] 运行时发布的页面能否注册进代码定义 app 的导航?—— #13216 方向 2 的授权设计(反转 app.allowOrgOverride=false 与否) #13620 is untouched.

Deliverable — follow .claude/skills/spec-property-retirement end to end

1. Remove 'page' from the list-view type enum on every door that carries it (ListViewSchema, ObjectListViewSchema, ListViewOverlayWireSchema and any mirror), remove pageName, checkListViewPageMount and its three messages, the validateCrossReferences branch and validateViewPageRefs (or narrow them to what remains), and every docblock / VIEW_HISTORY line that describes the mount — replace with the standard tombstone naming this card and the ruling.
2. Liveness ledger: retire the pageName rows and rewrite the type note; regenerate every generated baseline / form / skill reference the playbook lists (⛔ never by hand).
3. ADR-0087: a stored view with type: 'page' or a pageName key is refused by name at rehydration and by os migrate meta (zero producers ⇒ not-required / refuse-by-name per the playbook's route choice; the dev records the route and its reason in the changeset).
4. Docs: every content/docs/** mention of the page view type / pageName on views is removed or rewritten (the nav-item type: 'page' docs are a different key and stay).
5. Pins: a refusal pin per door (type: 'page' refused; pageName refused as unknown key), and the liveness/enum ratchets green.
6. Changeset: @objectstack/spec (and @objectstack/lint if touched) minor with the BREAKING banner under the launch-window convention, naming what an author loses and the tombstone.

Dispatch shape: Clause-②: no — an accept-set narrowing / retirement (#16349 direction), ordinary tier; the path arm hits (packages/spec/src/**) so the in-seat contract review at CONTRACT_REVIEW_TIER is on record before enqueue per SKILL.md 〈入队与落地〉.

Downstream

objectui#8429 becomes the objectui half — retire UNDRAWABLE_VIEW_KINDS.page, the normalizeListViewSchema warn arm and the PR #8684 current-state pin once the spec release carrying this removal is installable (cross-repo unlock criterion = 消费方可安装, not merged). It carries Blocked-by: objectstack-ai/objectstack#<this card>.

Dedupe: #13216 (closed, the ruling that added the member), #13100 (closed, the finding), #13620 (direction 2 design card — different question); no open card asks for this removal.

[os-bill]

Claim: PM loop — domain:spec seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-10T03:20Z. Dispatching one os-dev on branch claude/issue-17063-retire-list-view-page-member. Container & model: mode:subagent, claude-opus-5.

File surface (region level): packages/spec/src/ui/view.zod.ts (the enum member, pageName, checkListViewPageMount and its three refusal messages at the three list-view doors), packages/spec/src/stack.zod.ts (validateCrossReferences' page-name branch), packages/lint/src/validate-view-page-refs.ts, packages/spec/liveness/view.json, plus whatever the retirement kit itself requires (tombstones, RETIRED_*_BY_MAJOR rows, an ADR-0087 disposition, regenerated artefacts) and the changeset.

Clause-②: no

Declared no on the direction, ⛔ not from the armchair: a retirement narrows the accept set — a member leaves an enum and an authorable key is removed. Nothing becomes newly acceptable and no new public capability appears.

⚠️ But I expect this to be contested mechanically, and the dev is ordered to measure it rather than inherit my word. packages/spec/src/** is a declared surface for check-widening-tells, and a retirement adds rows to RETIRED_KEYS_BY_MAJOR / RETIRED_DEFS_BY_MAJOR — a new member of a closed set, which is the T2 tell's own shape. So the mechanical reading may well come back adverse while the semantic direction stays no. The dev runs both probes (--declaration no and --declaration yes) plus --pair, reports all three, and ⛔ stops rather than working around a disagreement — the SEAT moves the declaration, ⛔ never the dev.

⭐ This card gets an at-tier contract review either way, and that is a seat decision independent of the clause-② axis. Tonight two PRs in this lane returned REWORK on exactly this class — a narrowing of authorable, stored metadata — and both times the defect was in the stored-row consequence and the ADR-0087 disposition, never in the code. ⛔ I am not declaring yes to buy a review; I am declaring what I measure and ordering the review on its own merits.

Pre-dispatch checks, run rather than assumed

• Action surface — git log origin/main on all four paths: newest touching view.zod.ts is 7936b29ce (feat(spec): export the object-level refinement checks the mirrored UI schemas run (#16489) #16697, exported object-level refinement checks), then 9c270bba0 (feat(spec)!: close the gantt/tree config .passthrough() windows and declare the ten renderer-read gantt keys (#15469) #16052), b548e438d, f502898a4. ⛔ None undoes this card's premise; the dev re-verifies the three measured line ranges on current origin/main before editing, because line numbers age (a sibling card's citations had drifted by up to 5,787 lines when re-measured tonight).
• Card-reference surface, read live — objectstack [feature] Give runtime-published custom pages an end-user entry point: a page view type on objects, or nav registration at publish time #13216 closed completed (the 2026-08-29 direction-1 ruling this reverses), PR feat(spec,lint,metadata-protocol): a page member on the view type enum — mount a published page on an object view #13372 closed/merged (the spec half that landed), and ⭐ objectui#8429 is OPEN, pm:blocked, domain:ui — the mount half that never landed and the reason this retirement exists. ⇒ A cross-repo obligation falls due at ACCEPT: once this lands, that card's premise is gone, and 规则 3 says the accepting seat files the follow-up in the consuming repo rather than leaving it to be noticed. ⛔ Not this round's edit; the seat's, at ACCEPT.
• Same-file serialisation — all four paths checked individually against every in-flight branch (#17257, #17267, #17249, #17146, #17283): clear on all four, no branch touches any of them.
• Lock — lock is free, queue: empty at 03:20Z ⇒ arrival depth 1, below LOCK_DEPTH_HOLD (2). No wait owed.
• Governed? ⛔ No. packages/spec/** and packages/lint/** are on no row of GOVERNED_SURFACES; ordinary queue landing applies. The dev measures it on the final path list anyway and reports the exit code.

The ruling is the spec, and the dev implements it, ⛔ does not relitigate it

Maintainer, 2026-09-09, decision batch #107 item 1, after two questions (what a type: 'page' list view is; when the requirement was decided and whether it is valuable). Options presented were A finish the objectui mount · 撤 retire under enforce-or-remove · D park with the current-state pin. Reply verbatim: 「撤」.

⛔ Option A is not adopted, ⛔ option D is not adopted, and ⛔ the sunk cost of PR #13372 is not an argument — the governing four-axis principle is 「已发布零消费的能力不因沉没成本获得豁免」. ADR-0049 enforce-or-remove is the standing rule this executes.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 17063,
  "status": "done",
  "branch": "claude/issue-17063-retire-list-view-page-member",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17298",
  "premise_still_valid": true,
  "summary": "Retired the `type: 'page'` list-view mount under ADR-0049 enforce-or-remove, executing the 2026-09-09 「撤」 ruling. `pageName` is a retiredKey() tombstone on ListViewSchema + ObjectListViewSchema (ledger row KEPT as `dead`, per the playbook's route table); `'page'` leaves the type enum with its prescription on the enum's own error map keyed on issue.input (the in-file LIST_VIEW_EXPORT_PDF_RETIRED precedent — an enum-VALUE narrowing has no tombstone to hang one on). checkListViewPageMount + its three message constants, the stack.zod.ts cross-reference branch, @objectstack/lint's validateViewPageRefs / VIEW_PAGE_UNRESOLVED, view.form.ts's `page` section and its four i18n bundles all go with the mount; so does RuntimeStackContext.pages and the `page` row of CLOSURE_CONTEXT_KEY_BY_TYPE, because validateViewPageRefs was the ONLY runtime-crossed rule that read stack.pages and the runtime-gate docblock states the widening rule symmetrically. ADR-0087: a real D2, `view-page-mount-removed` (protocol 18), registered. TWO THINGS IN THE DISPATCH MEASURED FALSE — see `open_questions`: the clause-2 mechanical reading DISAGREES with `no` (3 T2 tells, all generated retirement-ledger rows), and check-governed-merges returns exit 3 GOVERNED (skills/** x2), not the predicted exit 0. Assignee was `os-bill`, set by the dispatch; I did not write it.",
  "tests": "ALL exit codes captured to disk before any pipe; scripts/pm/* run from an origin/main mirror (git archive origin/main scripts | tar -x; origin/main=a256f189), each byte-verified against `git rev-parse origin/main:PATH` — check-widening-tells 949e94fd, check-governed-merges 081df968, check-clause2-carriers 60b7562c, all identical. || BUILDS+TESTS (all under scripts/pm/os-verify-lock.sh, OS_VERIFY_LOCK_SLOT=issue-17063): spec build 0; spec test 0 (Test Files 470, Tests 13185 passed | 1 skipped); spec check:generated 0 (15/15 artifacts); lint typecheck+test 0 (101 files, 3683 passed | 5 skipped); metadata-protocol typecheck+test 0 (174 files, 2472 passed | 10 skipped); platform-objects test 0 (39 files, 561 passed). || SPEC SOURCE AUDITS (the five check:generated names as NOT run, plus the rest): check:liveness 0, check:empty-state 0, check:variant-docs 0, check:skill-examples 0 (first run exit 1 = PREREQUISITE NOT MET, client-react dist unbuilt = NOT MEASURED; re-run after building that closure), check:skill-refs 0, check:skill-docs 0, check:exported-any 0, check:dual-source-exports 0, check:duration-unit-keys 0, check:entry-nameability 0, check:yaml-examples 0. || REPO GATES: check:i18n RED FIRST (exit 1, `platform-objects DRIFTED (7)`) — regenerated with `node scripts/check-i18n-bundles.mjs --write`, diff is 44 PURE DELETIONS (the `page` section label/description + `pageName` label/helpText across en/es-ES/ja-JP/zh-CN + 3 source-hash bundles), re-run 0 `all bundles in sync`. An earlier attempt returned exit 3 PREREQUISITE NOT MET (CLI closure unbuilt) and is recorded as NOT MEASURED, not as green. check:doc-authoring 0, check:nul-bytes 0, check:cross-package-test-inputs 0, check:test-source-alias 0, check:stack-collection-maps 0, check:quick-reference-counts 0, check:corpus-claim-drift 0, check:published-files 0, check:type-check-coverage 0, check:i18n-stale-fill 0, check:objectui-changeset 0, check:pm-changeset-deadline-census 0, check-empty-changeset (self-test/base) 0/0, check-reference-carrier-shape (+self-test) 0/0, check-skills-token-ratchet 0, check-skill-line-ratchet 0, check-spec-docblock-symbol-anchors 0, check-comment-mask-adoption 0, check-comment-mask-corpus 0, check-closing-keyword-parity 0, release-rehearsal-clone --self-test 0. NOTE: `pnpm check:skills-token-ratchet` exits 254 ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL — that script name does not exist; the real invocation `node scripts/check-skills-token-ratchet.mjs` is the one that ran, exit 0. The 254 is a MISTYPED COMMAND, read as NOT MEASURED, not as a failure. || CHANGESET GATES, run POST-COMMIT because check-adr-0087-registration reads bodies from git: --self-test 0 (338 assertions), --base 0 — `1 declared-breaking changeset(s) ... [BREAKING] registered view-page-mount-removed (new here: view-page-mount-removed)`. check-changeset-no-major --self-test 0 / --base 0. || GATE DERIVATION: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (never a recalled list). Re-derived after the i18n commit and it GREW six entries (check-empty-changeset x2, release-rehearsal-clone --self-test, check:i18n-stale-fill, check:objectui-changeset, check:pm-changeset-deadline-census) — all six then run, all 0. The remaining families of its 121-line list are DECLARED TO CI AS A NARROWING, not claimed green. || ESLINT — a measured narrowing with all three pieces of evidence: (i) population read from eslint's own config, `pnpm exec eslint --no-inline-config --format json .` enumerates 6465 files; (ii) narrowed run linted 32 files (every surviving .ts/.tsx/.mjs/.mts in the diff; the 3 deleted paths cannot be linted), count read from --format json: 0 errors, 0 warnings, exit 0; (iii) invariance — one eslint.config.mjs, type-aware linting NEVER enabled for any file (no parserOptions.project, no typed @typescript-eslint rules), stated and positively controlled at eslint.config.mjs:327-335, so this diff cannot move any untouched file's verdict. Measured at 1e937111c, the branch's final commit. || ABLATION — each leg: mutate -> prove on disk (anchor count + injected marker count + git hash-object moved) -> run -> restore -> prove restore BY STATE. The spec unit suite imports ./view.zod as SOURCE (no dist hop, so no build/dist-preflight leg is owed). Leg 1 reinstate 'page' in the type enum: anchor 1->0, marker 0->1, hash 34f111fc -> c3c5d06b, 3 pins RED (the three door-parameterised `REFUSES type: 'page'`). Leg 2 reinstate `pageName: SnakeCaseIdentifierSchema.optional()`: anchor 1->0, marker 0->1, hash 34f111fc -> 6447f4e3, 6 pins RED. CONTROL unmutated: 13 passed 0 failed. RESTORE PROOF, both legs: `git checkout HEAD -- PATH` (never a bare `git checkout --`), then `git hash-object` == 34f111fcef274c7ade5543b195a884fe6abde7c4 == the `HEAD:packages/spec/src/ui/view.zod.ts` blob, AND `git diff HEAD -- PATH` empty. Never read from an exit code. trap on EXIT INT TERM with REPO_ROOT-absolute paths. ⚠️ THE FIRST ATTEMPT AT LEG 1 WAS A VOID READING and is reported as one: its landing check used `grep -cF` with a MULTI-LINE anchor, which counts lines not occurrences, so the guard mis-fired; the run was declared VOID and restored WITHOUT being read, and leg 1 above is the re-run with a single-line anchor. The mutation had in fact landed (the hash moved) — which is exactly why an untrustworthy landing check has to void the reading rather than be talked past. || STORED-ROW PROBE (with a lit control): applyConversionsToStoredItem('view', {type:'page', pageName:'sales_home', columns:[]}) -> {name,object,viewKind,columns:[]}, 2 notices both `view-page-mount-removed` at views[0].type and views[0].pageName; CONTROL a plain grid view -> unchanged, 0 notices. || CI at report time, NEWEST RUN PER CHECK NAME on head 1e937111c (31 check-runs, 31 distinct names): 11 completed/success (Auto Label, Check Changeset, Check Documentation Links, Check PR Size, Flag docs affected by code changes, Governed Surface Queue Guard, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, filter), 2 completed/skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 18 in_progress (Build Core, Build Docs, Dogfood Regression Gate 1-3/3, Dogfood Verify CLI, Lint & Repo Gates, Temporal Conformance, Test Core 1-6/6, Type Check x4). NOT green and not claimed green — in_progress is the honest value; I did not wait.",
  "mcp_calls": "1 — one targeted `search_issues` for the pre-file dedupe, after REST /search/issues returned 403 in this container (semantic /search/* is not on the REST channel; declared channel switch). Every other GitHub read and write went over container REST at zero MCP cost: card + comments read, branch push, PR create, PR body read-back, check-runs read. The finding was filed with `issue_write` — that is the 2nd MCP call; total 2.",
  "open_questions": [
    {
      "question": "CLAUSE ② — the mechanical reading DISAGREES with the declared `no`, and per the dispatch I stopped and reported rather than moving it. THREE READINGS, all on the finished diff (git diff MERGE_BASE...HEAD), all from the byte-verified origin/main mirror: (1) `check-widening-tells --declaration no` EXIT 4 — 3 tells; (2) `check-widening-tells --declaration yes` EXIT 0 — 'a `yes` already routes to contract review, so a tell on top of it decides nothing'; (3) `check-clause2-carriers --pair 17298` EXIT 4 — C5, 'card #17063 (delivering open PR #17298 (draft)) declares `Clause-②: no` while its diff carries 3 widening tell(s) ... Neither reading is overturned here: the declaration stands as written and the diff stands as pushed, and they disagree.' THE THREE TELLS BY NUMBER AND LINE, all T2 'a new member of a closed set (z.enum / union / an `as const` array) — the accept set gains a value': [1] packages/spec/src/migrations/registry.ts:5443 `+ 'view-page-mount-removed',`; [2] packages/spec/src/migrations/registry.ts:12757 `+ 'ui/ListView:pageName',`; [3] packages/spec/src/migrations/registry.ts:12791 `+ 'ui/ObjectListView:pageName',`. All three are GENERATED rows inside registry.ts's os-generated markers, emitted by gen:migration-registry from the three new files under src/migrations/entries/ — they are the retirement LEDGER growing, and each one exists because the accept set SHRANK. The PM predicted this exact shape in the claim comment. The declaration in the PR body is still `Clause-②: no`, byte-identical to comment 5612101866. ⛔ I have not moved it. Which does the seat want?",
      "options": [
        "A — leave `Clause-②: no` and record the disagreement as an explained exception in the claim (the tells are generated retirement-ledger rows; nothing becomes newly acceptable and no new public capability appears). The at-tier contract review the PM already ordered still happens on its own merits.",
        "B — the SEAT re-declares `Clause-②: yes` on the claim comment. `check-widening-tells --declaration yes` exits 0 and `--pair` would follow; the cost is that the clause-② axis then reads `yes` for a pure accept-set NARROWING, which is semantically backwards and sets that precedent for every future retirement (retirements always add RETIRED_*_BY_MAJOR rows).",
        "C — a tooling card: teach check-widening-tells that a `+` line inside registry.ts's os-generated retirement-ledger regions is a narrowing artefact, not a T2 tell. That is the only option that stops this recurring on every retirement, but it changes a governance checker and is not this card's to take."
      ],
      "recommendation": "A, with C filed separately by the seat if the pattern is judged systemic. The semantic direction is unambiguous — two authorable things left the accept set and nothing joined it — and B would make the clause-② axis report `yes` for the one change class that most clearly means `no`. But this is exactly the call the dispatch reserved to the seat, so I am not acting on my own recommendation: the PR ships declaring `no`, and the seat decides."
    },
    {
      "question": "GOVERNANCE — the dispatch's pre-flight is FALSE. `check-governed-merges.mjs --test` over all 48 diff paths returns EXIT 3, GOVERNED (the dispatch said 'expect exit 0, NOT governed; if 3, stop and report'). Two paths hit the register, both `skills/** — the published skills catalog`: skills/objectstack-ui/SKILL.md (the retired list-view `type` row — a surface the spec-property-retirement playbook explicitly requires touching) and skills/objectstack-ui/references/react-blocks.md (regenerated by gen:react-blocks; the #11705 generated-surface exception explicitly did NOT lift it — 'the generator declared no readable output manifest ... fail closed'). One hit governs the whole PR. The PM's own pre-dispatch note read only `packages/spec/**` and `packages/lint/**` and concluded 'ordinary queue landing applies' — that conclusion does not hold. Consequence: no seat may flip this ready, enqueue it, or arm auto-merge; a human merge is the review record (AGENTS.md Prime Directive #14). ⛔ Dropping the skills edit to dodge governance is not an option I will take — a published SKILL.md teaching a key that now refuses at parse is precisely the thing being retired.",
      "options": [
        "A — accept the governed classification and route this to a maintainer hand-merge, as the register demands.",
        "B — split the two skills paths into a separate follow-up PR so this one lands through the queue. ⛔ NOT RECOMMENDED: it ships a released skills catalog that teaches a removed key for however long the split PR waits, which is the false-compliance shape ADR-0049 exists to remove."
      ],
      "recommendation": "A. The governance hit is correct and the diff is correct; the dispatch's prediction was simply taken over a narrower path set than the retirement actually needs."
    }
  ],
  "out_of_scope_findings": [
    "filed as #17299: a retired-key prescription is NOT the top-level message at `PUT /api/v1/meta/view` — on ViewMetadataSchema a tombstone refusal is raised inside a union BRANCH, so the top-level message is zod's bare `Invalid input` and the prescription sits one level down. Measured with a control on origin/main: virtualScroll, striped and the two new #17063 refusals all read identically, so it is PRE-EXISTING house behaviour of that door and not something this PR introduces — which is why it is filed rather than repaired here. It is class (a): the house already ruled the shape a defect one key over (exportOptionsPdfUnionError, #8010, same file, verbatim 'the prescription raised inside a union BRANCH is buried in invalid_union sub-errors'). Searched before filing (one MCP search_issues, lit: 5 results); #6391 is the closest and is CLOSED and a different question (union discriminant / member export for consumer diagnosis, not prescription reachability). Filed unassigned and UNLABELLED, with a back-link. Carrier: whoever next retires a key on a view shape, and the reviewer of PR #17298.",
    "noted, not filed: `packages/lint/src/reference-integrity-suite.ts:337-341` — validatePageVisualizationBindings' comment says it takes the frozen `flow` default because it resolves against `stack.pages` and `stack.views`, 'neither of which the per-write snapshot carries'. `pages` WAS carried between #13216 and this PR, so that half-sentence was stale for that window; this PR removes `pages` again and makes it true once more. No action owed and no card: the rule's disposition never changed and `views` was always the load-bearing half of the reason. Carrier: nobody — the sentence is correct as of this commit.",
    "noted, not filed: the card body and the dispatch both state that 'objectui's ListView maps `page` -> `grid` with a warn' (from objectui#8429's census). The MAPPING is real and I re-measured it, but I could not find the WARN: `git grep UNDRAWABLE_VIEW_KINDS` returns nothing at the pinned .objectui-sha 53ded82b or at objectui main 3fbdd4a2d, and the mapping is instead the `default:` arm of the ListView switch sharing `case 'grid'` (packages/plugin-list/src/ListView.tsx:2495-2499), which logs nothing. `isListViewVisualization('page') === false` is the other half. The retirement does not depend on the warn either way, so the citation is recorded as imprecise rather than filed. Carrier: whoever writes objectui#8429's follow-up at ACCEPT, who will look for that symbol.",
    "noted, not filed: `check-governed-merges` reports that the #11705 generated-surface exception cannot lift skills/objectstack-ui/references/react-blocks.md because 'the generator ran clean but declared no readable output manifest'. My change to that file IS a pure `pnpm --filter @objectstack/spec gen:react-blocks` regeneration — exactly what the exception is described as passing — so the exception is currently unusable for the one generator it would most obviously serve. Not filed because I have not measured whether that is a gap in the generator or a deliberate fail-closed posture, and guessing between those is what the (a)/(b)/(c) bar exists to prevent. Carrier: the seat, at ACCEPT of this governed PR, which is the moment the exception's absence is actually paid for.",
    "noted, not filed: no conversion in packages/spec/src/conversions/registry.ts reaches `objects[].listViews.*` — `mapViewPayloads` walks stack.views[] only, and this is pre-existing (the view-export-options-pdf-removed precedent has the identical reach). It is stated as a coverage boundary in the new conversion's docblock, the changeset and the PR body rather than silently under-covering. Not filed as a defect because with zero measured producers there is nothing under-converted today, and widening the walk is a decision about every view-family conversion at once, not a rider on this one. Carrier: the next view-family D2 conversion.",
    "REMINDER, not a finding and NOT acted on: objectui#8429 is open, `pm:blocked`, `domain:ui` — the mount half that was never built, whose premise this retirement kills. ⛔ Nothing in objectui was filed, edited or touched. Per 规则 3 that cross-repo follow-up is the seat's at ACCEPT.",
    "SKILLS BUDGET READINGS (both required, reported because the diff touches skills/**): changed file skills/objectstack-ui/SKILL.md 306 -> 305 lines (-1, one table row: the retired `page` list-view type); tokens 3798 against ceiling 3815 (headroom 17, was 16). Whole published bundle skills/**/*.md 13532 -> 13531 lines (-1); token bundle total 150562, authored-ratcheted 139938/157098. Net DECREASE on both axes, so no budget is consumed and no ceiling moved. The generated skills/objectstack-ui/references/react-blocks.md is 115 -> 115 lines (one table cell narrowed) and 3129 tokens, generator-owned and not ratcheted.",
    "RETIREMENT SURFACES THE PLAYBOOK NAMES THAT I DID **NOT** DO, with reasons: (1) TREE-SCOPED ABSENCE PIN with a declared CROSS_PACKAGE_TEST_INPUTS radius — not added. The retired NAMES (checkListViewPageMount, validateViewPageRefs, VIEW_PAGE_UNRESOLVED) are EXPORTED symbols whose absence is already carried by three stronger, tree-wide mechanisms: the compiler (every importer fails to resolve), and two committed ratchets, packages/spec/api-surface/ui.json and packages/spec/export-origins/ui.json, both of which lost their rows in this diff and are gated by check:api-surface / check:export-origins. The retired VALUES (`type: 'page'`, `pageName`) are LIVE LEGITIMATE spellings on PageNavItemSchema with 30 authored occurrences in-tree, so a tree-scoped string-absence pin on them would be a false-positive generator, not a guard — the playbook's own warning that a broken absence assertion invites deleting the guard. What I added instead: a barrel-level runtime-namespace absence pin (`'checkListViewPageMount' in ui` is false, with the three surviving check exports as the lit control) and declaration/attachment COUNT assertions of 0 in object-refinement-check-exports.test.ts — counted rather than `toContain`-ed, because that file's own tombstone docblock names the retired check in prose on purpose and a mention is not a relapse. (2) RETIRED_DEFS_BY_MAJOR — not owed: no def is deleted, this is one enum value plus one key. (3) An orphan value schema — none: `pageName` was SnakeCaseIdentifierSchema, shared by PageSchema.name and PageNavItemSchema, so nothing is orphaned. (4) The four generated-surface ratchets: api-surface/ui.json and export-origins/ui.json DID move (an exported function left); authorable-surface/ui.json moved (the two rows gained `[RETIRED]`); json-schema.manifest/ did NOT move — which is the CORRECT reading for a tombstone route plus an enum-value narrowing, per the playbook's visibility table, and is stated so the zero is not mistaken for an omission. (5) packages/qa/dogfood's ADR-0058 expression-conformance ledger — no `covers` entry stranded: neither retired thing is an expression surface; check:generated and the spec suite both green.",
    "noted, not filed: spec-changes.json and docs/protocol-upgrade-guide.md show ZERO diff for this registration, and that is correct rather than a missed regeneration. Verified with a lit control: `grep -c turso-config-timeout-to-timeout-ms` and `memory-persistence-auto-save-interval-to-ms` — two sibling protocol-18 conversions already on main — both return 0 in each file too. The projection is cut at protocolVersion 17.0.0, so every major-18 registration is inert there until PROTOCOL_MAJOR bumps. gen:spec-changes and gen:upgrade-guide were both run (exit 0) and check:spec-changes / check:upgrade-guide are green inside check:generated."
  ]
}

---

Generated by Claude Code

[os-bill]

Seat ruling on both open questions — A and A. One of them is my error, and it is the more interesting one

domain:spec seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-10T04:37Z. PR #17298, head 1e937111c, draft, 48 files.

Q2 first — GOVERNED. My pre-flight was false, and the dev was right to refuse the way out.

I wrote in the claim: "⛔ No. packages/spec/** and packages/lint/** are on no row of GOVERNED_SURFACES; ordinary queue landing applies." Measured on the finished diff, ⛔ that is wrong — 2 of 48 paths hit the register, both skills/**:

skills/objectstack-ui/SKILL.md                        (the retired list-view `type` row)
skills/objectstack-ui/references/react-blocks.md      (regenerated by gen:react-blocks)

⇒ check-governed-merges --test = exit 3, GOVERNED. One hit governs the whole PR.

⭐ The error is instructive, not clerical: I ran the governed check over the paths the CARD named, not over the paths a retirement actually needs. The spec-property-retirement playbook — which my own order told the dev to follow — requires touching the published skills catalog, because a SKILL.md that teaches a key which now refuses at parse is exactly the falsehood being retired. So the governed classification was determined the moment the ruling said 撤; my pre-flight just never looked that far.

⛔ Option B (split the two skills paths out so this lands through the queue) is refused, and the dev refused it before I could — in the right words: "a published SKILL.md teaching a key that now refuses at parse is precisely the thing being retired." Splitting would ship a released catalog teaching a removed key for however long the split PR waited. That is the false-compliance shape ADR-0049 exists to remove, dressed as process hygiene.

⇒ A. ⛔ No seat flips this ready, enqueues it, arms auto-merge or approves it. Terminal state: a draft awaiting the maintainer's own hand merge. It owes a ## 维护者速读(草稿) with a 席位意见 this seat fills after the at-tier review returns.

Q1 — A: Clause-②: no stands, with the disagreement recorded rather than smoothed away

The mechanical reading disagrees, and the dev stopped and reported instead of moving it — which is the rule, and it held. Three T2 tells, every one of them a generated retirement-ledger row inside registry.ts's os-generated markers:

#	line	added row
1	registry.ts:5443	'view-page-mount-removed',
2	registry.ts:12757	'ui/ListView:pageName',
3	registry.ts:12791	'ui/ObjectListView:pageName',

⭐ Each of those rows exists because the accept set shrank. (⚠️ Two are generated ledger rows; the third is hand-maintained — see the correction at the end.) Two authorable things left it — an enum value and a key — and nothing joined. T2 fires on "a new member of a closed set" and cannot see that the closed set in question is the ledger of things removed.

⛔ B is refused on precedent grounds, not convenience. Re-declaring yes would make the clause-② axis report widening for the one change class that most clearly means narrowing, and — because every retirement adds RETIRED_*_BY_MAJOR rows — it would set that precedent for every retirement after this one.

⚠️ The honest cost of A, stated: check-clause2-carriers --pair 17298 reads exit 4 (C5) and will keep reading it, so this PR carries a standing adverse gate line. That is survivable here only because of Q2: --pair is an enqueue-legibility gate, and a governed PR is never enqueued — it ends in a hand merge. ⇒ On the next retirement that is not governed, A would collide with the seat's own landing pre-check ② and there would be no way through. Which is precisely why:

⇒ C is filed as its own card (⛔ not folded here — it changes a governance checker). Dedup was three complete label enumerations (finding 165, domain:devx 114, domain:skills 18) with zero hits.

What this round did that I want on the record

• ⭐ It voided its own ablation leg rather than talking past it. The first attempt's landing check used grep -cF with a multi-line anchor — which counts lines, not occurrences — so the guard misfired. The mutation had landed (the blob hash moved), and the dev declared the reading VOID and restored without reading it. An untrustworthy landing check has to void the reading, not be argued around. The re-run used a single-line anchor: leg 1 (reinstate 'page') → 3 pins red; leg 2 (reinstate pageName) → 6 pins red; unmutated control 13 passed / 0 failed; both restores proven by state (git hash-object back to the HEAD blob, git diff HEAD empty), ⛔ never by an exit code.
• The stored-row probe answers the question my order front-loaded, with a lit control: applyConversionsToStoredItem('view', {type:'page', pageName:'sales_home', columns:[]}) → the mount is gone and 2 notices, both view-page-mount-removed, at views[0].type and views[0].pageName; control (a plain grid view) → unchanged, 0 notices. ⇒ This is a real D2, not a D3 TODO — the honest disposition for a shape that can be losslessly rewritten, and the opposite call from the two cards tonight where D2 was impossible.
• The absence-pin reasoning is right and I endorse it. A tree-scoped string-absence pin on type: 'page' / pageName would be a false-positive generator, because PageNavItemSchema uses those exact spellings legitimately 30× in-tree — the playbook's own warning that a broken absence assertion invites deleting the guard. What replaced it: a barrel-level runtime-namespace pin ('checkListViewPageMount' in ui is false, with the three surviving check exports as the lit control) plus declaration/attachment count assertions of 0 — counted rather than toContain-ed, because that file's tombstone docblock names the retired check in prose on purpose and ⛔ a mention is not a relapse.
• Skills budget: skills/objectstack-ui/SKILL.md 306 → 305 lines, tokens 3798 against a 3815 ceiling; whole bundle 13532 → 13531. Net decrease on both axes ⇒ no budget consumed, no ceiling moved.
• check:i18n went red first (platform-objects DRIFTED (7)) and was fixed by regeneration, not by hand: the diff is 44 pure deletions across en / es-ES / ja-JP / zh-CN plus three source-hash bundles. An earlier run that exited 3 (CLI closure unbuilt) is recorded as NOT MEASURED, ⛔ not green.
• pnpm check:skills-token-ratchet exits 254 �� that script name does not exist; the real invocation is node scripts/check-skills-token-ratchet.mjs (exit 0). Recorded as a mistyped command ⇒ NOT MEASURED, ⛔ not a failure. Worth knowing before someone reads a 254 as a red gate.

Also filed by the round: #17299 — on ViewMetadataSchema a retired-key prescription is raised inside a union branch, so PUT /api/v1/meta/view answers a bare Invalid input at top level with the prescription one level down. Measured with a control showing virtualScroll, striped and both new refusals read identically ⇒ pre-existing house behaviour of that door, ⛔ not introduced here, which is why it was filed rather than repaired.

Next

An at-tier contract review is dispatched — as the claim committed, on its own merits and ⛔ independent of the clause-② axis, because this is a breaking retirement on authorable stored metadata. ⛔ needs:contract-review goes on both carriers; ⛔ the PR stays draft.

⛔ Correction (2026-09-10T04:56Z) — "all three are generated rows" is wrong for one of them

The at-tier review of PR #17298 caught it and I re-measured it myself at head 1e937111c:

• registry.ts:12757 / :12791 — inside <os-generated retired-key:18> (opened :10428). Generated, as stated.
• ⛔ registry.ts:5443 is NOT. The nearest os-generated marker above it is the closing </os-generated semantic:17> at :5055, so the line sits outside every generated region: it is the hand-maintained step18.conversionIds array.

The ruling is unchanged — the row still exists because the accept set shrank, nothing authorable joins any accept set, Clause-②: no still stands, and option A is still the call. What was wrong is the explanation, and it mattered: card #17300 proposed a fix keyed on the generated-region markers, which would have covered 2 of the 3 tells and left --pair adverse on every retirement that also registers a conversion — i.e. every D2 retirement. #17300 is corrected with the true target.

⭐ The mechanism of the mistake, worth more than the fact: the nearest marker above a line can be a CLOSING one, and a line outside every region then looks exactly like a line inside one. Neither the dev nor I checked which kind of marker each line sat under before calling all three "generated".

Corrected wording for the exception on record: two generated retirement-ledger rows plus the chain step's hand-maintained conversion-id list; none of the three adds an authorable value.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 17063,
  "status": "done",
  "branch": "claude/issue-17063-retire-list-view-page-member",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17298",
  "premise_still_valid": true,
  "summary": "Mechanical merge + regenerate round, no content change. origin/main was at 8c9bd8f51fe56bd32fa90a23aefda20c45ec496e when merged, READ FROM THE MERGE COMMIT'S SECOND PARENT (`git rev-parse be36a1419^2`), not from the moving ref. Merge base was ebf9a4891156a20d09889f6984b7d74d3b0301ce (14 commits on main, 2 on the branch). Two commits on top of 1e937111c: be36a1419 (the merge, no rebase / no amend / no force-push) and 59b2e5f0d (the regeneration). Head is now 59b2e5f0d29828619b9ac6fc304d56158610057c; PR #17298 reads mergeable: true, mergeable_state: blocked (required checks pending), no longer dirty. PR left draft, 48 files, labels untouched, no ready-flip / enqueue / auto-merge / review. FALSE PREMISE 1 in the order: registry.ts did NOT conflict. It text-merged cleanly and `check:migration-registry` reports it current with no regeneration needed. The files that DID lose a side are the pair routed to `merge=os-regen`, api-surface/ui.json and export-origins/ui.json, where the driver exited 0 and silently dropped MAIN's side: #17257's four new `Parsed` ui exports (ElementDataSourceParsed, ObjectCalendarPropsParsed, ObjectKanbanPropsParsed, ObjectMetricPropsParsed) were absent from the merge commit's copy of both files and are restored by 59b2e5f0d. That is the exact silent-loss shape this round exists to catch, caught in a file the order did not predict. FALSE PREMISE 2: the gates named bare, check:migration-registry / check:spec-changes / check:upgrade-guide / check:generated, are NOT root scripts; they live in packages/spec. Run bare they exit 254 with ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL 'Command not found', which is NOT MEASURED, not red. Correct spelling is `pnpm --filter @objectstack/spec check:...`; only check:i18n is a root script. FALSE PREMISE 3: the bundle line reading cannot stay 13531, see the skills section. ATTRIBUTION CONFLICT, flagged rather than chosen silently: the harness attribution block asks for `Co-Authored-By: Claude Opus 5 ...` plus a Claude-Session line; this dispatch orders a model-free trailer pair. I followed the dispatch on both commits (Claude-Session plus `Co-authored-by: Claude (noreply at anthropic.com)`), with no model identifier anywhere in either message.",
  "origin_main_at_merge": {
    "sha": "8c9bd8f51fe56bd32fa90a23aefda20c45ec496e",
    "read_from": "merge commit be36a1419608ab8d9b73cbb12e8b96d06b3a6dfd, second parent",
    "merge_base": "ebf9a4891156a20d09889f6984b7d74d3b0301ce",
    "commits_main_side": 14,
    "commits_branch_side": 2
  },
  "conflicts_and_resolutions": [
    {
      "path": "packages/metadata-protocol/src/protocol.runtime-gate-stored-universe.test.ts",
      "kind": "genuine text conflict, the only one git reported",
      "hunk_1": "the @objectstack/lint import. Base had a single line `import { VIEW_PAGE_UNRESOLVED } from '@objectstack/lint';`. The branch DELETED it with the rule; main WIDENED it to a 5-line import of DASHBOARD_FILTER_FIELD_UNKNOWN + VIEW_PAGE_UNRESOLVED + WIDGET_MEASURE_UNKNOWN (#16224). Resolved by taking main's widened import minus the member the branch retires. Not a guess: `git grep -c VIEW_PAGE_UNRESOLVED -- packages/lint/src` returns NOTHING on the merged tree, so keeping main's side verbatim would not compile.",
      "hunk_2": "the helper block after threeWidgetBoard. The branch deleted `pageMountView` (the mount it retires); main appended `filterBoard` (#16224) immediately after it. Resolved by keeping filterBoard and dropping pageMountView. `git grep pageMountView` returns nothing on the merged tree; filterBoard has 3 call sites, all inside main's new #16224 describe, which merged in intact."
    },
    {
      "path": "packages/spec/api-surface/ui.json",
      "kind": "merge=os-regen path, both sides edited, driver exited 0 and kept one side",
      "resolution": "os-regen-merge.sh step 2 applied after the fact: `git restore --source=origin/main` (WORKTREE only, never the index), then regenerated from the COMMITTED merge with `pnpm --filter @objectstack/spec build` then `gen:api-surface`. Staged diff inspected with `git diff --cached`, not `git diff`. Net effect vs the merge commit: +4 lines, exactly the four #17257 Parsed exports the driver had dropped, and nothing else."
    },
    {
      "path": "packages/spec/export-origins/ui.json",
      "kind": "merge=os-regen path, both sides edited, driver exited 0 and kept one side",
      "resolution": "same as above via gen:export-origins; +4 lines, the same four exports, nothing else."
    },
    {
      "path": "packages/spec/src/migrations/registry.ts",
      "kind": "NO conflict, contrary to the order's prediction",
      "resolution": "text-merged clean, carrying both sides' entries. Regenerated anyway from the committed merge (gen:migration-registry, 193 semantic / 167 retired-key / 116 retired-def) and the file came back byte-identical; `check:migration-registry` prints 'src/migrations/registry.ts is current'."
    },
    {
      "path": "packages/metadata-protocol/src/protocol.ts and packages/spec/src/kernel/functional-completeness.ts",
      "kind": "both sides edited, auto-merged clean",
      "resolution": "no hand resolution; the branch's own delta is proven byte-identical pre- and post-merge below."
    }
  ],
  "regeneration_chain": "Run ONLY after the merge was committed (be36a1419), never in MERGE state, so the authorable-surface anchor cannot roll back to the old fork point. Order: `pnpm --filter @objectstack/spec build` (168s under the shared lock), then gen:schema, gen:migration-registry, gen:export-origins, gen:api-surface, gen:spec-changes, gen:upgrade-guide, gen:liveness-counts, gen:react-blocks, gen:docs. Of the whole chain only the two ui.json shards moved; every other generated artifact this branch touches (migration registry, authorable surface, spec-changes, upgrade guide, liveness counts, react-blocks, the reference docs, the i18n bundles) regenerated byte-identical to the merged tree. `git status --porcelain` after the full chain listed exactly 2 modified paths. The pre-commit hook confirmed the hand-off: the merge commit recorded a DEFERRAL for 2 artifacts, and the regeneration commit printed 'deferred regeneration discharged, all artifacts current, marker cleared'.",
  "entry_survival": {
    "17257_landed_entry": {
      "id": "element-data-source-and-object-block-filter-rule-array",
      "reading": "PRESENT. 1 occurrence, registry.ts:6911, `id: 'element-data-source-and-object-block-filter-rule-array',`",
      "lit_control": "element-number-filter-rule-array, a THIRD step-18 semantic id known present in main: PRESENT, 1 occurrence, registry.ts:6991. The control MATCHED, so the instrument (a quoted-exact-name grep over the post-regeneration registry) is shown to fire, and a 0 on the target would have meant absence rather than a dead grep.",
      "dark_control": "the fabricated id `element-data-source-and-object-block-filter-rule-array-zzz-not-real`: 0 occurrences. The control matched NOTHING, so the pattern is shown not to match everything.",
      "byte_equality": "the registry region for that entry is byte-equal (modulo the generator's 4-space indent) to its entry file entries/semantic/18.element-data-source-and-object-block-filter-rule-array.ts: 7022 bytes reconstructed from the entry file and found verbatim in registry.ts. The lit control's own entry file reconstructs and matches too (4217 bytes)."
    },
    "this_prs_entry": {
      "id": "view-page-mount-removed",
      "reading": "PRESENT. 3 occurrences, the same 3 it had pre-merge: registry.ts:5443 (step18 conversionIds, hand-written, outside the markers) and registry.ts:12836 and :12870 (the D2 citation line inside each of the two retired-key entry comments). The two retired keys themselves are present at registry.ts:12837 `'ui/ListView:pageName',` and :12871 `'ui/ObjectListView:pageName',`.",
      "byte_equality": "PASS for both retired-key entries: the region in registry.ts is byte-equal modulo indent to entries/retired-keys/18.ui__ListView__pageName.ts (797 bytes) and entries/retired-keys/18.ui__ObjectListView__pageName.ts (809 bytes).",
      "byte_equality_dark_control": "the same 797-byte block with one token mutated (pageName becomes pageNameZZZ) is NOT found in registry.ts, so the byte-equality instrument is shown not to answer PASS for arbitrary text."
    }
  },
  "nothing_else_moved": {
    "path_set": "MEASURED EQUAL. `git diff --name-only 1e937111c HEAD` (what the merge brought in) = 78 paths; `git diff --name-only ebf9a4891 origin/main` (what main moved since the merge base) = 78 paths; `comm` both directions is EMPTY, not one extra path and not one missing. And `git diff --name-only origin/main HEAD` is still exactly the PR's own 48 paths, identical as a sorted list to the 48 captured before the merge.",
    "branch_only_files": "42 of the PR's 48 paths were touched by the branch and NOT by main. Blob hash at HEAD compared against the blob hash at 1e937111c for each: 42 checked, 0 differing (3 of the 42 are deletions and are still absent). LIT CONTROL for that loop: the same loop over the 6 both-touched paths reports 6 of 6 DIFFERING, so the 0 above is a reading, not a loop that cannot see a change.",
    "both_touched_files": "6 paths were touched by both sides. For each, the branch's OWN delta was compared pre- and post-merge as a normalized changed-line set (`git diff -U0 MERGE_BASE 1e937111c -- path` against `git diff -U0 origin/main HEAD -- path`, file headers stripped, sorted). 5 of 6 are IDENTICAL: protocol.ts (30 changed lines), functional-completeness.ts (17), registry.ts (38), api-surface/ui.json (1), export-origins/ui.json (1). The 6th, protocol.runtime-gate-stored-universe.test.ts (49 lines pre, 49 post), differs by EXACTLY ONE LINE and in exactly the shape the hand resolution implies: pre-merge the branch removed the whole line `-import { VIEW_PAGE_UNRESOLVED } from '@objectstack/lint';`, post-merge it removes the single member line `-    VIEW_PAGE_UNRESOLVED,` out of main's widened import. Same intent, adapted to main's new import shape; the full diff between the two normalized deltas is those two lines and nothing else."
  },
  "skills_readings": {
    "instrument": "line counts over `skills/`. The bundle number in the order is reproducible only as MD-ONLY (`git ls-tree -r skills` filtered to .md), which reads 13532 at the merge base and 13531 at 1e937111c, matching the order exactly. The all-files count of the same tree is 13589 / 13588.",
    "governed_file_lines": "skills/objectstack-ui/SKILL.md: 306 at the merge base, 306 on origin/main, 305 at 1e937111c, 305 at HEAD 59b2e5f0d. The branch's 306 to 305 survives the merge unchanged.",
    "governed_file_tokens": "3798 against a 3815 ceiling (-17), read from `node scripts/check-skills-token-ratchet.mjs` on the merged tree, the same pair the order quotes. Gate exit 0: 36 authored bundle files within their ceilings, 10 generator-owned files measured and not ratcheted.",
    "bundle": "FALSE PREMISE 3 and its correction. The bundle CANNOT still read 13531 post-merge and does not: md-only is 13530 at HEAD (all-files 13587). The extra -1 is MAIN's, not this branch's: a256f1896 ('docs(skills): cite the platform-tool registry instead of restating it') took skills/objectstack-ai/SKILL.md from 417 to 416 lines, and that file is the only skills/ path in main's 78-path moved set. Per-file attribution across the four refs (base / main / branch tip / HEAD): ai/SKILL.md 417 / 416 / 417 / 416; ui/SKILL.md 306 / 306 / 305 / 305; ui/references/react-blocks.md 115 / 115 / 115 / 115. So 13532 at the base, minus 1 for this branch, minus 1 for main, equals 13530, and THIS PR's own contribution to the published bundle is still exactly -1 line. No ceiling change is needed or made."
  },
  "gate_exit_codes": {
    "which_script_copy": "EVERY gate below ran from the branch worktree at 59b2e5f0d, and every one of its script blobs was byte-verified against origin/main first with `git hash-object` against `git rev-parse origin/main:PATH`: scripts/pm/check-governed-merges.mjs 081df968d, scripts/pm/check-clause2-carriers.mjs 60b7562c5, and their transitive local imports (scripts/pm/git-history.mjs 6c1b47423, scripts/import-prerequisite.mjs ef5f4df36, scripts/invoked-as.mjs 60700de08, scripts/pm/check-half-states.mjs 0ec90893d, scripts/pm/check-widening-tells.mjs 949e94fde), plus packages/spec/scripts/build-migration-registry.ts, build-spec-changes.ts, build-upgrade-guide.ts, check-generated.ts, build-api-surface.ts, build-export-origins.ts, scripts/check-i18n-bundles.mjs, scripts/check-skills-token-ratchet.mjs and scripts/check-nul-bytes.mjs. ALL MATCH. An independent copy extracted with `git archive origin/main scripts` piped into tar, into a scratch mirror, hashes identically for the two pm scripts, so the worktree copy IS the origin/main copy. The mirror itself cannot be the run root: check-governed-merges resolves governed checkouts from its own dirname and answers 'no governed repo could be audited, not one checkout resolved' from a bare scripts/ tree, which the script itself calls a failed sweep, not a clean window.",
    "exit_codes": [
      "pnpm --filter @objectstack/spec check:migration-registry -- exit 0 -- 'src/migrations/registry.ts is current (193 semantic, 167 retired-key, 116 retired-def)'",
      "pnpm --filter @objectstack/spec check:spec-changes -- exit 0 -- 'spec-changes.json is up to date.'",
      "pnpm --filter @objectstack/spec check:upgrade-guide -- exit 0 -- 'protocol-upgrade-guide.md is up to date.'",
      "pnpm --filter @objectstack/spec check:generated -- exit 0 -- 'All 15 generated artifacts are up to date.' packages/spec was BUILT first, so this is measured, not the stale-dist NOT MEASURED the order warns about",
      "pnpm --filter @objectstack/spec check:api-surface -- exit 0 -- 'public API surface + factory signatures unchanged'",
      "pnpm --filter @objectstack/spec check:export-origins -- exit 0 -- '5311 exports across 17 entry points resolve exactly as recorded'",
      "pnpm --filter @objectstack/spec check:authorable-surface -- exit 0",
      "pnpm --filter @objectstack/spec check:react-blocks -- exit 0",
      "pnpm check:i18n -- exit 0 -- 'OK (9 packages, all bundles in sync, no undeclared authoring keys)'. FIRST RUN WAS exit 3 = NOT MEASURED (no CLI dist), cleared by building the gate's own declared closure (cli + platform-objects + 5 plugins + 3 services, 57 turbo tasks) and re-running",
      "node scripts/check-skills-token-ratchet.mjs -- exit 0",
      "pnpm check:nul-bytes -- exit 0 -- 'scanned 8150 text file(s) ... no raw ASCII control bytes', plus a hand grep -naP for control bytes over every path in `git diff --name-only 1e937111c HEAD`: no hits",
      "pnpm check:merge-driver -- exit 0",
      "pnpm check:pm-widening-tells -- exit 0 (self-test, 218 cases)",
      "node scripts/pm/check-governed-merges.mjs --test (all 48 merged-diff paths) -- EXIT 3, GOVERNED, as intended and NOT a problem to fix. Verbatim: '1 of 48 path(s) hit the register after 1 generated-artifact lift(s) (5 surfaces, repo-agnostic).' / 'GOVERNED - a human merge is the review record for this PR (#9495 regime).' The hit is skills/objectstack-ui/SKILL.md, the published skills catalog; skills/objectstack-ui/references/react-blocks.md is lifted by the #11705 generated-surface exception as a pure regeneration byte-equal to gen:react-blocks recomputed on this tree",
      "node scripts/pm/check-clause2-carriers.mjs --pair 17298 -- EXIT 4 (C5), by design per the ruling on card #17063 and NOT a blocker; reported, not repaired. Verbatim: 'C5 - card #17063 (delivering open PR #17298 (draft)) declares `Clause-2: no` while its diff carries 3 widening tell(s)' at registry.ts:5443, :12837, :12871, all T2 (a new member of a closed set). The script states of itself 'Report-only: never a label written from this script'. No attempt was made to turn it into 0",
      "BARE `pnpm check:migration-registry` / `check:spec-changes` / `check:upgrade-guide` / `check:generated` -- exit 254, ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL 'Command not found'. Recorded as NOT MEASURED (a wrong script name that never reaches the gate body), not as red. See FALSE PREMISE 2"
    ]
  },
  "tests": "All heavy runs under `bash scripts/pm/os-verify-lock.sh` with OS_VERIFY_LOCK_SLOT=issue-17063; every verdict read from the wrapper's own VERDICT line, never a bare exit variable; every gate exit landed to disk before reading (`cmd redirected to a log, then EXIT captured`), never through a pipe. BUILDS (prerequisite, so nothing below is a NOT MEASURED 'Failed to resolve entry'): @objectstack/spec build VERDICT command-exit 0 (168s); the dependency closures of lint, metadata-protocol and platform-objects VERDICT command-exit 0 (214s); those three packages themselves VERDICT command-exit 0 (35s); the check:i18n closure VERDICT command-exit 0 (376s, 57 tasks). SUITES, run sequentially with each exit echoed, because a single `pnpm --filter A --filter B test --concurrency=2` forwards --concurrency to vitest and dies (first attempt exit 1, ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL, NOT MEASURED): @objectstack/spec Test Files 470 passed (470), Tests 13208 passed (13208), SPEC_EXIT=0. @objectstack/lint Test Files 101 passed (101), Tests 3688 passed (3688), LINT_EXIT=0. @objectstack/metadata-protocol Test Files 173 passed | 2 skipped (175), Tests 2486 passed | 10 skipped (2496), MP_EXIT=0 -- this is the suite carrying the hand-resolved file, green with main's whole #16224 describe running. TYPECHECK: spec, lint and metadata-protocol joined with && so the verdict covers all three, VERDICT command-exit 0 (82s). NO ABLATION in this round and none is owed: nothing here is a new guard, and no ablation or mutation script was run, so there is no trap/restore leg to report and no dist marker to preflight. DECLARED NARROWING: the repo-wide farm was NOT run locally. `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` derives 121 commands for this 48-path change set (78 pnpm, 43 direct node) on top of 40 artifact-roster families, 11 wide-population families and 6 path-scheduled CI jobs it explicitly declines to place. I ran the order's named set plus the families this round's own mechanics implicate (merge-driver, nul-bytes, skills token ratchet, widening-tells and four extra spec generated-artifact gates). The rest is CI's, on head 59b2e5f0d.",
  "ci_newest_run_per_check_name": "Read once from the check-runs endpoint for commit 59b2e5f0d29828619b9ac6fc304d56158610057c (per_page=100, http 200), reduced to the NEWEST run per check NAME by started_at, not the raw list and not the required subset. 31 runs, 31 distinct names, so no name had a stale duplicate. 11 success, 2 skipped, 18 in_progress, 0 failure, 0 cancelled, 0 timed_out. success: Auto Label, Check Changeset, Check Documentation Links, Check PR Size, Flag docs affected by code changes, Governed Surface Queue Guard, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, filter. skipped: Console Pin Gate, Packed-tarball smoke (opt-in). in_progress: Build Core, Build Docs, Dogfood Regression Gate 1/3 2/3 3/3, Dogfood Verify CLI, Lint & Repo Gates, Temporal Conformance (live PG + MySQL), Test Core 1/6 through 6/6, Type Check consumer gates / debt ledger / source gates / workspace. CI convergence is the PM's to read; no sleeping or polling was done after the push.",
  "pr_state_after_the_round": "PR 17298: state open, draft TRUE, mergeable TRUE, mergeable_state 'blocked' (required checks pending), head 59b2e5f0d29828619b9ac6fc304d56158610057c, base main, changed_files 48, labels unchanged [documentation, size/xl, tests, tooling, needs:contract-review, protocol:ui]. The 'dirty' this round was dispatched for is gone. No ready-flip, no enqueue, no auto-merge, no approving review, no label write, no PR body edit: the human merge is still the terminal step, and it is possible again.",
  "mcp_calls": "0 -- every GitHub read this round went over plain repo-scoped REST with curl (check-runs, the PR) and this report comment is posted the same way; check-clause2-carriers.mjs made 4 reads of its own with the same token",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the order predicted the registry.ts conflict and it did not happen; the real os-regen silent drop was in packages/spec/api-surface/ui.json and packages/spec/export-origins/ui.json. Carrier: the next dispatch writing a merge order for a spec retirement branch, where the prediction is worth re-deriving from .gitattributes rather than from the last incident. Not a defect in anything shipped.",
    "noted, not filed: `pnpm check:migration-registry` (and spec-changes / upgrade-guide / generated) are not root scripts, so a bare invocation exits 254 rather than naming the packages/spec spelling, and pnpm's own 'Did you mean check:query-options-erasure?' hint is actively misleading. Carrier: none, no PR or person is queued on this; the failure is loud (254 plus 'Command not found') and never a false green. Recorded so the next order spells them with --filter.",
    "noted, not filed: skills/objectstack-ai/SKILL.md lost a line on main inside the same window as this branch's own -1, so any published-bundle ratchet number quoted from before a merge is stale by construction. Carrier: none, this is arithmetic rather than a defect; the per-file attribution above is the durable form."
  ]
}

---

Generated by Claude Code