[pm:seat] domain:ui — objectui execution seat

[os-sales]

Seat registration post for the domain:ui lane (objectui execution seat), created under the maintainer's 2026-08-21 ruling that split objectui cards three ways (domain:devx / domain:spec / domain:ui, the last being the only new label). This lane had no seat post until then.

Body is authoritative; title and assignee are derived views. Single writer: the sitting seat PM. Comments are audit only and never carry state.

1. Current PM

• Session: session_012u2pRjcqAYtoEjgr3wwhnK
• Seat: domain:ui @ objectstack-ai/objectui (execution seat — claims, dispatches, reviews, lands in this lane only)
• Posture: round 11 resolved 5/5 (3 merged, 2 enqueued); between rounds
• Batch size: 5 — raised from the default 3 by maintainer instruction, 2026-08-21: 「任务很多，并发保持5」. Standing for this lane until changed.
• R1 11:56Z→13:00Z · R2 13:03Z→13:50Z · R3 13:53Z→14:51Z · R4 14:55Z→15:47Z · R5 15:52Z→16:54Z · R6 16:50Z→17:45Z · R7 17:50Z→18:37Z · R8 18:44Z→19:38Z (5/5) · R9 20:18Z→21:46Z (6 cards / 5 PRs, through a container restart) · R10 22:10Z→23:51Z (3 landed, 1 held, 1 carried, through a second restart) · R11 2026-08-22 00:05Z→01:15Z (5/5)

Lane job description lives in the skill (references/lanes/), not here — pointer, not a hand-copied relay.

2. Inherited ledger

Taken over from session_014zHsbJoTkTZeJQ5DLbRXrE, dark since 2026-08-21T10:43Z after losing the GitHub API write path. Mutex cleared before round 1: no prior seat post, no open-round marker, no live Claim: newer than one round.

Its three in-flight cards had all merged with nothing recording it — cleared in round 1:

card	PR	landed	disposition
#5424	#5555	11:05Z	→ needs-user-decision (access-control gate; maintainer floor)
#5034	#5558	11:05Z	→ pm:queue. Residual is clause-②; also carries Blocked-by: #4989, so not dispatchable until that ruling lands.
#5522	#5559	11:35Z	comment only — assignee qq9340100 is not this seat

Two deferral targets were phantom cards (objectui#5548, objectstack#10741 — 404, control-probed). objectstack#10805 filed for the orphaned p0 security remainder of #5522.

3. Hot-file serial queue

No round in flight. Round 11's holds are released: apps/console/src/components/FormPage.tsx + packages/app-shell/src/views/metadata-admin/** + packages/app-shell/src/index.ts (#5596), apps/console/src/hooks/useBranding.ts (#5368, deleted), packages/core/src/evaluator/ExpressionEvaluator.ts (#5580), packages/types/src/theme.ts (#5489), packages/app-shell/src/utils/paramToField.ts (#5312).

⛔ packages/core/src/actions/** remains held by the open draft #5644, which is not landing (see §6).

Round 12 first pick: #5344 — deferred from round 11 only because it lives in packages/app-shell/src/views/metadata-admin/inspectors/ and #5596 was editing that directory's barrel. That collision is now cleared.

4. Landing ledger

Rounds 1–11: forty-nine cards resolved, forty-eight PRs merged or enqueued. Zero rework landed, zero red CI, zero re-runs issued, zero failed escalations. Two cards landed-and-blocked (#5521, #5544): the PR merged, the card's residual is upstream. One card held for the maintainer (#5611).

Rounds 1–4 (fifteen cards): #5431/#5561 · #5553/#5563 · #4629/#5566 · #4568/#5568 · #5554/#5570 · #4998/#5572 · #4787/#5573 · #5521/#5575 · #5477/#5579 · #5363/#5578 · #5557/#5582 · #5562/#5584 · #5564/#5585 · #5428/#5588 · #5321/#5589.

Round 5 (five): #5399/#5592 · #5544/#5593 · #5542/#5597 · #5492/#5598 · #5476/#5599. #5544's premise was falsified and the PR landed as a pin, not the remedy.

Round 6 (five): #4620/#5604 · #4187/#5603 · #4282/#5609 · #4622/#5602 · #4596/#5606. #4282's any narrowing was attempted and backed out — three real TS2339s on overrideNotice, filed as #5611.

Round 7 (five PRs, six issues): #4765/#5614 · #4559+#4966/#5615 · #4319/#5616 · #4611/#5617 · #5610/#5618.

Round 8 (five — first round selected for user-visible defects over prose): #5583/#5621 · #5594/#5624 · #5586/#5626 · #5587/#5628 · #5574/#5629. Highlights: two icon maps, not one, failing differently (BarChart3 === ChartColumn is true, so only record membership catches a retired alias); leak sweep 23 → 181 targets, 119 of 158 leak, all ledgered; a dev declined a fold on the merits and gave #5596 its best input.

Round 9 (six cards, five PRs — first container restart): #5612+#5613/#5634 · #5595/#5635 · #5590/#5636 · #5622/#5638 · #5607/#5639. Highlights: a 2×2 truth table whose wide column carries its own negative control; four cited line numbers drifted +53 to +103; the #5542 pin inverted, not deleted; the local percent normalisation deleted, not repaired, with the card's proposed shape positively ruled out.

Round 10 (five cards — second restart): #5372/#5641 (22:41Z) · #5591/#5643 (23:33Z) · #5577/#5645 (23:51Z) · #5611/#5644 HELD · #5596 carried to R11. Highlights: a dev corrected this seat's governed-surface ruling; a dev disproved a claim this seat inserted into its own dispatch; a dev caught a probe of its own that could not fail (vi.mock on an unresolvable path silently no-ops).

Round 11 (five cards, five PRs — third dev-loss event, this one harmless):

card	PR	outcome	note
#5580	#5649	merged 01:09:10Z	Disproved the card, not just fixed it. The card said "not a defect — every statement in that block is true"; the checker binds the prose link to the module-level fail-soft export at :405, inside the sentence calling it "the throwing sibling". Also falsified this seat's .js-byte-identical prediction and proved the semantics point better than asked — 10 changed emitted lines, 0 non-comment — rather than reaching for the forbidden --removeComments.
#5489	#5650	merged 01:09:10Z	Every consumer sweep carried a positive control (AnyComponentSchema 0 vs BaseSchema 131; theme 0 of 659 registered keys vs tooltip 1; "type":"theme" 0 vs "type":"form" 98). ADR-0087 answered in both directions. The acceptance test that pinned the dead shape VALID was inverted to prove it REFUSED. Two ablation legs failing in opposite directions on different assertions. Filed #5647, #5648.
#5368	#5651	merged 01:09:27Z	Corrected this seat's clause-② premise — apps/console IS published as @object-ui/console; the conclusion survives by a stronger route. Caught trap #4 twice, once inside its own PR-body audit ((fix|close|resolve)[sd]? cannot match Fixes). Found the guide edit was mandatory, not optional. Found sibling agents' vitest processes and killed only its own by PID after checking /proc/PID/cwd.
#5596	#5653	enqueued 01:15Z	Console pins read both types back out of the exported buildSections signature rather than naming them, so a re-inlined copy fails even if it agrees on every key the day it is written. Stale dist still carried the old hand-written interfaces — caught before it produced a false reading. Filed #5652 (a third mirror in packages/react, already drifted).
#5312	#5655	enqueued 01:15Z	The in-source lockstep comment was false in both senses — the two faces shared no object and had already split by one member (tree). Pinned by identity, not membership, because every membership assertion is satisfied by the member-identical private copy this PR removes — a value check would have passed on the defect. Four legs. Filed #5654 (which arrived unlabelled; this seat added finding + domain:ui so it would not sit outside every queue).

Findings filed this session, unassigned for triage: #5565, #5567, #5569, #5576, #5577, #5580, #5581, #5590, #5591, #5595, #5596, #5605, #5607, #5608, #5611, #5612, #5613, #5619, #5620, #5623, #5625, #5627, #5630, #5631, #5632, #5633, #5637, #5642, #5647, #5648, #5652, #5654, objectstack#10805, objectstack#10928. Eighteen filed by this session have since been graded and worked.

5. Notes

• Quota: Fable 5 exhausted for this seat as of 12:35Z (measured). Continuations run at opus. Clause ② is not relaxed by this — round 10 held a green, well-verified PR (feat(core): declare overrideNotice on ActionDef, then narrow both param handlers' action?: any #5644) rather than land past it.

• ⛔ CLAUSE ② — the line. Three cards in two rounds landed on both sides of it:

  Derived from an authority → repair (not tripped). Hand-typed with no authority to derive from → a new contract decision (TRIPPED).

  • Cleared: [finding] The SAME drift class one level up: FormViewSpec and FormSectionSpec are each hand-declared twice (console + app-shell), and #5542 only converged the leaf #5596 (derived from @objectstack/spec's FormSection/FormView; check-spec-symbol-derivation.mjs sanctions the form), finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312 (derives from core's EXPANDABLE_FIELD_TYPES), ThemeComponentSchema (type: 'theme') declares a component kind no renderer implements — dead surface, retire alongside objectstack's ThemeSchema authoring-surface retirement #5489 (executes a verbatim maintainer ruling), components: record-picker's emptyText drops the inline-locale-map arm the contract admits, and the audit tracking it (#4163) is closed #5590 (spec already accepted the value), Console FormPage (the standalone /forms and internal FormView renderer) never evaluates visibleWhen/visibleOn — objectui#2212 was fixed in the OTHER form renderer #5594 / finding: apps/console/src/hooks/useBranding.ts is a deprecated hook with zero callers — dead file, not just a dead key #5368 (not reachable).
  • Tripped: overrideNotice is produced, read, and declared nowhere — it blocks narrowing the param handlers' action?: any #5611 — the dev said it themselves, "Hand-typed string precisely because there is no spec field to derive from".
  • A conditional clearance must be stated as conditional. [finding] The SAME drift class one level up: FormViewSpec and FormSectionSpec are each hand-declared twice (console + app-shell), and #5542 only converged the leaf #5596 was cleared on the condition the shape stayed derived, with instructions to stop and report if it drifted to hand-typed keys. It stayed derived.
  • ⛔ Reachability is measured, never grepped. export * propagates a symbol without naming it, so a grep for the symbol in a barrel returns zero and means nothing. ActionDef reaches the published entry through an unbroken export * chain (ActionRunner.ts → actions/index.ts:9 → index.ts:33 → exports["."].types). Contrast refactor(app-shell): one isAiStudioEnabled() accessor for features.aiStudio, replacing two inline spellings #5645, where the barrel uses named re-exports and genuinely omits the accessor — verified by dist/index.d.ts being sha256-identical.

• ⛔ MY BRIEFS CONTRADICTED THE SEAT POST THREE TIMES. This is one pattern, not three slips.

  1. "plugin-dashboard is ESM-only" — disproved on [finding] Two more comments still name #4163 as the live tracker for the multi-locale label editor; #4163 closed 2026-08-15 #5591 (it publishes dist/index.umd.cjs under exports['.'].require).
  2. "prose-only ⇒ .js byte-identical" — disproved on registerFunction JSDoc uses one name for two entities — the evaluateExpression method and the module-level export #5580; core builds with a bare tsc that preserves comments in the JS emit, a fact §5 already recorded as "removeComments": false.
  3. "apps/console is not a published package" — disproved on finding: apps/console/src/hooks/useBranding.ts is a deprecated hook with zero callers — dead file, not just a dead key #5368; it publishes as @object-ui/console, and §5 already held the right shape from Console FormPage (the standalone /forms and internal FormView renderer) never evaluates visibleWhen/visibleOn — objectui#2212 was fixed in the OTHER form renderer #5594.
  • Every time the conclusion survived and a dev caught it. The cause is constant: briefs written from memory instead of from this post. Countermeasure, standing: when a dispatch asserts a reachability or emit fact, it QUOTES the seat-post line rather than restating it.
  • The same failure has a second form: a fact and the claim drawn from it can be filed minutes apart and contradict each other — feat(core): declare overrideNotice on ActionDef, then narrow both param handlers' action?: any #5644's dev measured ActionDef's closure into warnOnUnknownActionKeys's dev-console message states a fact step 3 retired, and points the author at the wrong file #5642 at 22:36Z, then wrote "This widens nothing" at 22:38Z.

• ⛔ CONTAINER RESTARTS: mechanism measured. A Firecracker microVM the platform suspends and resumes from a snapshot — random: crng reseeded due to virtual machine fork, uptime reset. Not OOM (16 GB, 677 MB used, memory.max unlimited, no kill in dmesg); not disk (27 GB free). A resume restores the filesystem and kills the process tree. The seat cannot prevent it; the countermeasure is to make it cost nothing:

  1. Devs push before the long verification phase. Standing in every dispatch since round 11. In round 11 all five had pushed before dying.
  2. Devs post their report as an issue comment as well as returning it.
  3. Remove landed worktrees.
  • ⛔ Three dev-loss shapes, distinguished by the worktree: (a) worktree present with unpushed commits — work at risk, recover it (rounds 9, 10); (b) worktree removed cleanly, PR pushed — work complete on the remote, nothing at risk, verify the body and land (round 11 × 2); (c) PR pushed, report lost mid-delivery (fix(components): record_picker emptyText resolves the inline locale map its contract admits #5636). git worktree list is what tells them apart — check it before concluding anything.
  • nproc is 4 and the standing batch is 5. Contention is routine; shards ran 6–10 min in round 11.

• ⛔ "The remote branch has no commits" proves nothing was PUSHED, not that nothing EXISTS. Round 9's restart: this seat read branch SHAs equal to their creation base, concluded the work was gone, and told two re-dispatched devs to git worktree add -B. Both worktrees had survived, each carrying a complete implementation. Wrong twice over: -B would have destroyed the commit, and worktree add would have failed anyway. Standing rule: when a brief asserts a state, verify the state, not the brief.

• ⛔ A dev can die between pushing its PR and posting its report. Four instances now (fix(components): record_picker emptyText resolves the inline locale map its contract admits #5636, feat(core): declare overrideNotice on ActionDef, then narrow both param handlers' action?: any #5644, refactor(app-shell): one isAiStudioEnabled() accessor for features.aiStudio, replacing two inline spellings #5645, and both round-11 tails). A complete-looking PR body is not evidence the work finished: every "already filed" / "already posted" claim must be checked on the persistent surface. All held. finding(app-shell): ActionParamDialog's isLookupParam restates the picker family over RAW param spellings, so a degraded master_detail param loses the #3405 affordances #5654 arrived unlabelled — check that too; a finding with no labels sits outside every lane's queue.

• ⛔ A control probe must be scoped to the SAME thing as the probe, be capable of failing — and MEASURE that it can fail. Each control gets its own mutation leg. Round 11 added three refinements:

  • The choice of assertion is itself a control decision. finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312 pinned by identity, not membership, because every membership assertion is satisfied by the member-identical private copy the PR removes — a value check would have passed on the defect.
  • A leg whose direction differs is stronger than a leg that merely fails. ThemeComponentSchema (type: 'theme') declares a component kind no renderer implements — dead surface, retire alongside objectstack's ThemeSchema authoring-surface retirement #5489's two legs failed in opposite directions on different assertions (expected true to be false / expected false to be true).
  • Ablate every probe, not just the ones you doubt. refactor(app-shell): one isAiStudioEnabled() accessor for features.aiStudio, replacing two inline spellings #5645's vi.mock('../runtime-config') resolved to a nonexistent path, and vitest no-ops an unresolvable factory mock, so the probe sat green and could not fail. Only an ablation leg found it.
  • Also standing: a totality precondition (Two more retired lucide spellings reach the icons-record resolver — edit in DetailView's mobile Edit action, smile as the icon renderer's own default — and only one of the four resolver copies is pinned #5622) so a failed source parse cannot leave an assertion vacuously green; and stating in advance which legs are expected to stay green, rather than counting their silence as evidence (refactor(app-shell): one isAiStudioEnabled() accessor for features.aiStudio, replacing two inline spellings #5645, docs(core): qualify both evaluateExpression references in the registerFunction JSDoc #5649).

• ⛔ Five measurement traps, one shape: the measurement returns the expected answer for the wrong reason.

  1. gzip stores the source filename in its header — measure at the real dist/ path or feed via stdin.
  2. Equal byte count ≠ equal content — compare hashes.
  3. tsc is composite and skips emit entirely if tsconfig.tsbuildinfo survives — clear dist/ and the build info; check where it lives (round-10 and -11 cards found it outside dist/).
  4. grep -E metacharacters silently zero an anchor count, indistinguishable from "the text is absent". Assert pristine counts before mutating; use grep -cxF. Round 11 caught this twice in one task, once inside a dev's own PR-body audit.
  5. A stale or mutated artefact will be silently read by a later measurement. [finding] The SAME drift class one level up: FormViewSpec and FormSectionSpec are each hand-declared twice (console + app-shell), and #5542 only converged the leaf #5596's stale dist still carried the old hand-written interfaces. Sixth face: git checkout BASE -- PATH stages the base content, so a follow-up git checkout -- PATH restores from the index, not HEAD.
  • --removeComments proves zero program semantics and is INVALID for shipped-bytes claims. The better substitute, measured on registerFunction JSDoc uses one name for two entities — the evaluateExpression method and the module-level export #5580: diff the emitted files and count non-comment changed lines.
  • Mutating by insertion leaves the removed-text anchor unchanged by construction — record that as measured rather than smoothing the table (finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312).

• ⛔ The .d.ts criterion is scoped to PROSE-ONLY cards — and its .js half is now further narrowed. A behaviour card is the mirror image. And even on a prose-only card, .js moves where the package's tsc preserves comments (core, react) — re-measure per package. The authority is check-changeset-presence.mjs; never reason from a zero .d.ts delta to "no changeset owed". On a deletion card a dist/*.js that does not shrink can simply mean the removal was type-only — establish which before reading the unmoved bytes either way.

• ⛔ CONTAINER OPERATIONS — two findings from round 11, both standing guidance:

  1. Never pkill -f vitest. Five devs share one container; killing by process name destroys a sibling's in-flight run and surfaces in their task as an inexplicable flake hours later. Verify /proc/PID/cwd and kill by PID.
  2. A buffered test reporter loses everything on a foreground-cap kill. A 67-file run was SIGTERM'd with a buffered reporter that had written nothing. Use a streaming reporter so a cap kill cannot cost the findings.
  3. Related: a derived superset must be confirmed to have EXECUTED, not just derived. finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312 diffed TAP file names against the derived list — and the first comparison "found" 38 missing files that had all run, because apps/console reports paths relative to its own root.

• ⛔ An error can enter a carrier that replays itself. Two instances: finding(agent-protocol): HTML tags and comments are stripped from every issue/PR body written by an agent — the os-dev-report marker cannot survive, and code samples lose JSX silently #5581's effect on the standing dev instruction, and round 10's fallback check-in firing with the wrong governed-surface instruction after the error had been corrected everywhere else. When correcting an error, enumerate the carriers that will replay it. Also: delete a fired one-shot check-in whose instructions have gone stale rather than leaving it to re-run.

• ⛔ GOVERNED SURFACES — exactly four: AGENTS.md, CLAUDE.md, .claude/** (whole tree, incl. .claude/skills/**), docs/adr/**. Sole criterion: does the path start with .claude/. Root skills/** is NOT governed. This seat got it wrong in round 10 and a dev corrected it citing AGENTS.md, which documents the mistake in advance: 「往保守方向误判同样是误判」. Round 11 confirmed the stakes — Delete the deprecated zero-caller useBranding hook #5651 edits a published guide and would have been wrongly blocked.

• ⛔ My recurring PM error: I fence the thing being CHANGED rather than the thing being DELIVERED. Instances: Console home: the authoring / marketplace / setup cards ignore features.* and studio.access — two of them contradict a flag the server already sends as false #5521, [finding] A THIRD inline copy of the form-field authoring contract lives in apps/console FormPage.tsx — objectui#5040 converged only the app-shell two #5542 (an unsatisfiable fence), Studio's pre-publish security block names the offending object but cannot navigate to it — the Data pillar's ?surface= deep-link captures only at mount #5476, [core] Two comments still say formatPercent divides by 100 — true until #4590, false after it #4596. Countermeasure: name the artifact a reviewer will look at to see the card satisfied, and check it is inside the fence. Round 11 showed the dev side of it: finding: apps/console/src/hooks/useBranding.ts is a deprecated hook with zero callers — dead file, not just a dead key #5368's deletion emptied a directory that check-skills-paths.mjs resolves from disk, so the guide edit was mandatory — the card named one file, the deliverable was a repo that still passes its own gates.

• ⛔ A stop-condition is a proxy; it is discharged when the risk it proxies for is measured and disproven — provided the dev says so and puts it up for adjudication. finding: apps/console/src/hooks/useBranding.ts is a deprecated hook with zero callers — dead file, not just a dead key #5368 found apps/console published (my stated premise was false), did not stop, measured external reachability directly, and flagged it. Ruled correct. Ruling otherwise would teach devs to prefer compliance over evidence.

• A dispatch is a hypothesis; measurement outranks it. Eighteen devs have now corrected mine — six before round 8, four in round 8, two in round 9, three in round 10, and three in round 11 (registerFunction JSDoc uses one name for two entities — the evaluateExpression method and the module-level export #5580 on the .js prediction and the card's own verdict; finding: apps/console/src/hooks/useBranding.ts is a deprecated hook with zero callers — dead file, not just a dead key #5368 on the clause-② premise; finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312 on an in-source comment I told it to test).

• ⛔ Verify every citation on origin/main and report what you actually found. Every outcome has occurred: exact, wrong in both directions, stale-but-coincidentally-right, drifted +53 to +103, stale by +37 (registerFunction JSDoc uses one name for two entities — the evaluateExpression method and the module-level export #5580's :368 → :405, moved by docs(core): state the registerFunction case-fold on the method itself #5578), and byte-identical since filing proven by an empty git diff --stat.

• Read the whole comment thread before dispatching, every time. Round 11 added a new reason: plugin-form: navigateOnSuccess is mount-blind and says nothing when its destination is refused — the key has no ruling and its own contract question is still open #5034 carries Blocked-by: #4989 in its body while sitting in pm:queue — dispatching it would have forked a decision the card says must land first.

• A card's premise can be wrong in the card's own words (Console duplicates requests within one cold load (sys_user_preference ×3–×6, meta/object ×2, meta/view ×2) #5544), understated (components: record-picker's emptyText drops the inline-locale-map arm the contract admits, and the audit tracking it (#4163) is closed #5590, [plugin-dashboard] recordFields re-introduces the divide-by-100 round trip #4590 removed: 1.605 renders 1.60% where half-up is 1.61% #5607), or flatly false in its central claim (registerFunction JSDoc uses one name for two entities — the evaluateExpression method and the module-level export #5580). Re-derive the measurement, never re-run the card's script.

• A gate that derives its expectations from the code under test cannot fail on a deletion. check-action-forward-parity went 40 → 39 across fix(app-shell): title the param dialog from label alone #5609 and fix(app-shell): title RecordDetailView's param dialog from label alone #5618. Never present its green as independent confirmation of a removal.

• ⛔ finding(agent-protocol): HTML tags and comments are stripped from every issue/PR body written by an agent — the os-dev-report marker cannot survive, and code samples lose JSX silently #5581 is a READ-path defect. Bytes reach GitHub intact; the MCP tools that return a markdown body sanitize them on the way back. Confirmed four ways. A read-back through the same tool CANNOT discriminate — its implicit control is the lossy reader itself. Two round-11 devs each spent a round-trip reposting a report over this false signal. Moving "scan the raw REST body, don't repost" out of this post and into the dispatch text. Duplicate footers are server-side, appended on edit — leave them alone.

• Merge mechanics: direct merge_pull_request is refused with 405 Changes must be made through the merge queue. Path: flip ready → enable_pr_auto_merge (SQUASH). All eighteen round-8→11 PRs went that way.

• ⛔ check_suite.completed is NOT a gate reading — round 11 is the definitive demonstration. ~30 suite successes were delivered across five PRs while named jobs were still running; docs(core): qualify both evaluateExpression references in the registerFunction JSDoc #5649 alone had nine suite successes in hand while seven named jobs, including all four test shards, were still in_progress. Gate jobs are read by name; 22 runs, three always-skipped no-ops (Test (coverage), the unexpanded shard placeholder, dependabot). A green read is 19 success + those 3.

• Broken gauges, not failures: check-eager-closure-budget exits 2 locally until a console build writes its report — CI's own budget job passes (3785.8 KB against 3867.2 KB), confirming the local exit is a broken gauge. check-doc-snippet-types exits 1 until the workspace is built; ThemeComponentSchema (type: 'theme') declares a component kind no renderer implements — dead surface, retire alongside objectstack's ThemeSchema authoring-surface retirement #5489 re-derived its three ledger conditions by hand instead of skipping it. check-published-dist-tooling builds the whole workspace and routinely hits the 10-minute cap — CI owns it (2026-08-16 ruling on finding: 「已发布 dist 不得含 tooling 产物」今天没有任何门看得见 —— 判据必须是产物级的,而 CI 没有全仓 build #4846).

• ⚠️ In a fresh worktree, a type-check failure may be the unbuilt dependency closure — 340 cascading TS2307/TS2882 vanished after pnpm --filter '<pkg>^...' build.

• Footer form: session-URL in PR bodies, bare in comments.

• Report shape: dispatches from this seat extend the standard dev contract, never replace it.

• Commit trailer: keep Co-Authored-By: Claude, drop the model name. ⛔ No model identifier in any pushed artefact.

• Package-cwd vitest is refused by this repo's own guard (objectui#3378). All runs from the repo root.

• packages/app-shell has ~488 test files and its full suite exceeds the 10-minute foreground cap. The correct response is a provable superset read from the code, with the principle stated. Round 11 produced the best two examples: a 105-file reverse-import closure with three deliberate over-approximations (finding(app-shell): paramToField is now the LAST private copy of the reference-bearing rule — and its "moves in lockstep with plugin-grid" comment stopped being true #5312), and a mechanical classification of all 215 changed lines as type-only ([finding] The SAME drift class one level up: FormViewSpec and FormSectionSpec are each hand-declared twice (console + app-shell), and #5542 only converged the leaf #5596).

• objectui runs a merge queue. Slow ≠ red. No re-run has been issued this session and none was warranted.

• list_pull_requests reports merged: false alongside a populated merged_at. Trust merged_at + state, or get. get_status returns only legacy Vercel statuses.

• Mislabels reported to triage, not changed by this seat: five [Decision]-titled cards in pm:queue ([Decision] Should component-registry lookup normalise case? Two measured instances of "every node renders Unknown component type" #5247, [Decision] schema.onNavigate is a function value read off the grid schema — the fifth key #5091's ruling did not cover #5234, [Decision] ObjectMapConfigSchema 要不要 .strict() —— 类型面的保证只保护 TS 作者,而 AI 产出的 metadata 恰恰不带类型 #5157, [决策] objectui record:details 渲染器的双形状接缝:合成器产 title/descriptor-fields 与 spec 区块形状经裸 ?? 缝合,往哪个方向收 #4018, [决策] System Hub bespoke 卡片墙(SystemHubPage)是否按 #3655 选项 C 退场 #3743); 台账燃尽批次 8/8 · 被 objectstack#4171 阻塞的 any 擦除簇,3 符号——上游解除后处理(objectstack#4115) #3162 carries pm:queue while its body names an objectstack blocker.

• #3965 and #2762 carry non-agent assignees (yinlianghui, os-zhuang) — claimed, never touched.

6. Awaiting the maintainer

• overrideNotice is produced, read, and declared nowhere — it blocks narrowing the param handlers' action?: any #5611 / PR feat(core): declare overrideNotice on ActionDef, then narrow both param handlers' action?: any #5644 — clause ② tripped; a green, well-verified PR is held for a contract review this seat cannot supply. Gates green (19 + 3). The blocker, measured:
  • ActionDef is a closed surface — objectstack#4075 step 3 deleted [key: string]: any, and actionDef-closed-surface.test.ts pins that tsc rejects unknown keys at the construction site.
  • It is reachable from @object-ui/core's published entry (unbroken export * chain).
  • So overrideNotice is a tsc error to author today and compiles after — an accept/reject change on a reachable published type.
  • The in-file precedent does not cover it. description and the four navigation-alias keys were promoted while the index signature still existed, widening nothing. overrideNotice was created by fix(app-shell,console): an admin override reads as one — before the click and in the timeline #5196 on 2026-08-18, after closure, reaching its readers through dispatch as ActionDef.
  • console: an admin-override decision renders as an ordinary Approve — no affordance distinction, no confirm, and the via_override marker is never surfaced in any UI #5178's ruling is real and verified — the notice must be its own dispatch key (a translation bundle silently deletes the safety copy; reproduced under ablation). That settles that the key exists, not whether the closed interface should declare it.
  • The decision: (1) accept the widening — feat(core): declare overrideNotice on ActionDef, then narrow both param handlers' action?: any #5644 lands unchanged; or (2) prefer a narrower shape, e.g. carry the key on a host-composed type at the dispatch seam. Option 1 also establishes that a key may be added to the closed interface with no authority to derive from, which is the precedent description's own docblock says it does not set.
• Four more client sites still read the retired user.roles — role-addressed approvals and requiredRoles gates degrade silently at protocol 17 #5424 — access-control gate decides on the wrong input; fixing it blacks out preview mode (AuthProvider.tsx:240-247 emits no positions).
• RadioField 完全不读 multiple —— spec 允许 radio 带 multiple: true,实际静默渲染成单值 radio 组 #4015 — radio + multiple. Recommend C, fall back to B, explicitly not A.
• holdsStudioAccess is unreachable from @object-ui/app-shell, so the library's surfaces cannot share the console's one definition of "platform operator" #5576 — layering: may a library surface know "who is a platform operator"? Lean B, not adjudicated.
• [finding] maxToolRoundtrips is an authorable, documented chatbot key that reaches nothing — useObjectChat destructures it and never reads it #5605 — maxToolRoundtrips is an authorable, documented chatbot key that reaches nothing.
• skills/objectui/guides/i18n.md 两处把 label 规则归给 @objectstack/spec v4,仓内实测 ^17.0.0 —— agent 面上 13 个 major 的版本化石 #5081 — needs-user-decision. The guide (skills/objectui/guides/i18n.md:117,162) states as a rule the same falsehood docs(types): ui-action.ts no longer claims spec 17 narrowed I18nLabel to a plain string #5617 removed from packages/types. finding(types): ui-action.ts comment claims "In spec 17 I18nLabelSchema is z.ZodString" — false against the installed rc.6, and it nearly made a seat implement a no-op #4611's dev recommends stating the spec's two authorized forms and keeping the translation-bundle route as a recommendation. ⚠️ The earlier text here wrongly said skills/** is governed and human-merge-only. It is not — this card sits with the maintainer on its content, not on any merge restriction. Correction also posted on skills/objectui/guides/i18n.md 两处把 label 规则归给 @objectstack/spec v4,仓内实测 ^17.0.0 —— agent 面上 13 个 major 的版本化石 #5081.
• objectstack#10928 — cross-repo. UniqueScopeSchema's rejection message calls 'organization' "the explicit spelling of true" on both surfaces, but on a declared index bare true means 'global' — telling an author to write 'organization' silently changes materialization on live indexes.
• finding: ThemeSwitcherSchema / ThemePreviewSchema are the same dead component kind #5489 retires — theme-switcher and theme-preview are registered by nothing either #5647 — NEW (R11). After refactor(types)!: retire ThemeComponentSchema — the type: 'theme' component kind no renderer implements #5650, ThemeUnionSchema consists of precisely two unimplemented kinds (ThemeSwitcherSchema, ThemePreviewSchema), measured through the same registry pipeline with the same tooltip control. The 2026-08-21 ruling named neither, so extending the retirement needs its own ruling.
• [finding] A THIRD hand-written FormViewSchema mirror survives in packages/react's spec bridge, and it has drifted on three keys #5596 just measured #5652 — NEW (R11). packages/react's spec bridge holds a third hand-written mirror of the FormViewSchema contract, already drifted on columns, dependsOn, visibleWhen. [finding] The SAME drift class one level up: FormViewSpec and FormSectionSpec are each hand-declared twice (console + app-shell), and #5542 only converged the leaf #5596 converged the app-shell/console pair; this is what closes the family.
• burn-down: 119 ledgered DOM-attribute leaks in packages/components/src/renderers/**, grouped by mechanism #5632 — burn-down parent for 119 ledgered DOM-attribute leaks, filed unassigned and ungraded. This seat declined to decide the decomposition: packages/components is the repo's most-shared package and slicing 119 fixes across it is a planning call. Safe to defer — exact-set-equality-in-both-directions means a follow-up cannot half-land.
• ui:icon reads the SDUI identity key name as its lucide icon name, so any icon node that authors name renders nothing at all #5631 / Nothing checks that an icon: literal reaching a record-reading lucide resolver is a live icons key — four hand-copied resolvers, four local pins, no gate over the population #5633 — the icon-resolver family, two-thirds closed. ViewSwitcher renders NO icon for chart and gantt views: both icon names were dropped from lucide's icons record #5586 (R8) the wrong name; Two more retired lucide spellings reach the icons-record resolver — edit in DetailView's mobile Edit action, smile as the icon renderer's own default — and only one of the four resolver copies is pinned #5622 (R9) the wrong resolver table; ui:icon reads the SDUI identity key name as its lucide icon name, so any icon node that authors name renders nothing at all #5631 remains — the wrong schema key: ui:icon consults the SDUI identity key name, fails silently, and reads clean to a gate. Nothing checks that an icon: literal reaching a record-reading lucide resolver is a live icons key — four hand-copied resolvers, four local pins, no gate over the population #5633 is the missing repo-level gate over the whole population.
• components: record-picker's label and placeholder drop the same inline-locale-map arm emptyText just stopped dropping — one throws, the other silently renders English or nothing #5637 — label and placeholder on element:record_picker carry the same string | Record union components: record-picker's emptyText drops the inline-locale-map arm the contract admits, and the audit tracking it (#4163) is closed #5590 fixed for emptyText; label reaches o.en unconditionally and renders English to every locale.
• warnOnUnknownActionKeys's dev-console message states a fact step 3 retired, and points the author at the wrong file #5642 — warnOnUnknownActionKeys' dev-console message states a fact step 3 retired and points the author at the wrong file; following it edits only the inventory, the half-change the pin goes red on.
• content/docs/core/theme-schema.mdx teaches a schema that does not exist — six independent falsehoods, now including the type: 'theme' kind #5489 retires #5648 — theme-schema.mdx teaches a schema that does not exist: six independent falsehoods, five predating ThemeComponentSchema (type: 'theme') declares a component kind no renderer implements — dead surface, retire alongside objectstack's ThemeSchema authoring-surface retirement #5489.
• finding(app-shell): ActionParamDialog's isLookupParam restates the picker family over RAW param spellings, so a degraded master_detail param loses the #3405 affordances #5654 — ActionParamDialog's isLookupParam restates the picker family over raw param spellings while the degradation module tests resolved widget keys; the two sets are in no subset relation, and a targetless master_detail param degrades to text without the placeholder or help text fix(fields): 注册路径的全屏长文本对话框接上 i18n(#3404) #3405 added. Arrived unlabelled; this seat added routing labels only.

[os-sales]

Audit probe — angle-bracket survival through this write path

Not lane state. Posted to measure, precisely, which angle-bracket forms survive a body written through the GitHub MCP tools, because the seat post currently asserts a mechanism ("the GitHub body sanitizer strips angle-bracket-delimited content") that a counter-observation contradicts: dependabot's PR bodies (#4945, #4958) carry hundreds of literal HTML tags intact. If those survive and mine do not, the variable is the write path, not GitHub. This comment will be read back and the result recorded; it can be deleted afterwards.

Five forms, each on its own line, each labelled so a missing one is identifiable by its label alone:

• A · HTML comment:
• B · JSX tag in prose:
• C · TS generic in prose: Array<{ a: string }>
• D · bare comparison in prose: a < b and c > d
• E · pre-escaped entity: <div>

Fenced block, same five:

A <!-- os-dev-report -->
B <div className="x">
C Array<{ a: string }>
D a < b and c > d
E &lt;div&gt;

Inline code spans: A <!-- os-dev-report --> · B <div className="x"> · C Array<{ a: string }> · D a < b > c

Control (must survive, proves the comment itself landed): ZZCONTROL-SENTINEL-5560.

---

Generated by Claude Code

[os-sales]

Audit note — round 7, cross-repo finding raised for the maintainer's attention. Seat post body is authoritative; this comment records one item ahead of the round-close rewrite because it names a production-affecting shape in the other repo, outside this seat's lane.

objectstack-ai/objectstack#10928, filed by the #4765 dev while measuring the installed spec. Unassigned and unlabelled — deliberately, because it is an objectstack card and neither the labelling nor the grading is this seat's to do.

The shape: UniqueScopeSchema's rejection message calls 'organization' "the explicit spelling of true" on both surfaces. Measured against installed GA 17.0.0, that is false on one of them — on a declared index, bare true is the positional spelling of 'global', not 'organization'. The helper readout is unambiguous:

value	isUniqueDeclared	isGlobalUnique	isOrganizationUnique
true	true	false	false
'global'	true	true	false
'organization'	true	false	true

Bare true sets neither scope flag, so no organization key part is prepended — which is precisely what makes it 'global' on that surface.

Why it is worth the maintainer's eye rather than the queue's. An author refused on that key is told by the error message itself to write 'organization'. Doing so silently changes materialization — the driver prepends the NULL-safe organization key part — on an index that may already exist on deployed databases. That is the unannounced reinterpretation the #8323 ruling and the #5082 sequencing exist to prevent, arriving through the error text rather than through a schema change.

Duplicate-searched before filing (two searches, objectstack repo). Nearest prior art is #8463 / PR #8512, which corrected the same field-vs-index divergence on a different artifact — isOrganizationScopedUnique's JSDoc in driver-sql — not on the shared error map.

Relevance to this lane, and why it changed a fix here. The same divergence is why #5614 does not uniformly rewrite unique: true: at field level bare true is not deprecated at all ("stays valid indefinitely … no trap" per the spec's own prose), so harmonizing both occurrences would have shipped a fresh piece of false guidance on a card whose entire purpose is stopping exactly that. The dev caught this by measuring rather than by following the card, and the card is better for it.

---

Generated by Claude Code