@@ -0,0 +1,15 @@
+---
+'@object-ui/components': patch
+'@object-ui/i18n': patch
+---
+
+fix(components): a refused submit moves focus to the first invalid field and no longer toasts the field list over the dialog's title
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** A submit refused by field validation, on the client or by the server's `fields[]`, raised an error toast naming the fields ("Please check the highlighted fields: First name, Last name, Company…") on top of the message already written under each input. The toast cut its list after three names, and in a record create / edit dialog it was drawn over the title row.
+- **Now.** The form raises no toast for a refusal that every field carries inline. It scrolls to the first invalid field in form order and focuses it, and first activates that field's tab when it is on a background tab. The message under each input is the whole report.
+- **A field with nothing drawn to carry it.** When the server rejects a field that has no drawn input, for example one on a tab or section a `visibleWhen` predicate hides, the form shows the form-level banner and its toast with the server's sentence, the same path a rejection naming an unknown field already takes. The hidden tab is not activated.
+- **Earlier outcomes retire.** A refusal on the client now takes down the previous attempt's banner and toast, and a clear-on-hide notice, as an attempt that passes validation already did. Before, the refusal toast replaced them under the form's outcome id.
+- **`validation.formInvalid` removed.** The toast's sentence ("Please check the highlighted fields: {{fields}}") had no other reader, so it leaves the form's default map and all ten `@object-ui/i18n` locale packs. `validation.formInvalidJoiner` stays: the clear-on-hide notice, the faulted-`visibleWhen` refusal and the option-group hint still join field labels with it. A host bundle that overrides `validation.formInvalid` can drop the entry; nothing reads it.
@@ -0,0 +1,16 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/console': patch
+'@object-ui/i18n': patch
+---
+
+fix(app-shell,console): an invitee who opens the invitation link signed out is greeted for the invitation, offered "Create an account and join" first, and the accept page names the inviter
+
+Clause-②: yes
+Metadata-protocol: none
+
+- **Login page.** A signed-out visitor arriving at `/login?redirect=/accept-invitation/ID` used to see the returning-user card ("Welcome back · Sign in to continue your work") with a small "Sign up" link under the form. Both login pages (the console's own and `DefaultLoginPage`) now title the card "Accept your invitation · Use the email address the invitation was sent to." Where the server offers sign-up to this visitor, a full-width "Create an account and join" link (the new `InvitationSignUpPrompt` export) sits above the sign-in form in place of the small link. With sign-up switched off, the visitor gets the invitation header and the sign-in form only.
+- **Register page.** From an invitation redirect, both register pages title the form "Create an account to join" and ask for the address the invitation was sent to, because only that account can accept it.
+- **Accept page.** `DefaultAcceptInvitationPage` shows an "Invited by" row with the inviting member's email, which `GET /organization/get-invitation` already returns as `inviterEmail`. That route returns no inviter name.
+- **Not in this change.** The signed-out pages name no organization, inviter or invited address, and do not prefill the email. The only invitation read the server serves answers a signed-out caller `401`, so a preview for signed-out visitors needs a new server read first.
+- New locale keys in all ten packs: `auth.login.invitationTitle`, `auth.login.invitationDescription`, `auth.login.invitationSignUpButton`, `auth.login.invitationSignInDivider`, `auth.register.invitationTitle`, `auth.register.invitationDescription`, `organization.accept.invitedBy`.
@@ -0,0 +1,14 @@
+---
+'@object-ui/plugin-map': patch
+'@object-ui/i18n': patch
+---
+
+fix(plugin-map): a map whose style or tiles fail to load shows the record list with a translated notice, instead of a grey canvas under an English alert
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@object-ui/plugin-map`:** when MapLibre reports a style or tile load failure (an intranet or proxied deployment that cannot reach the tile host, an unreachable style URL), the map view now removes the map and lists its records in its place, the same list a browser without WebGL2 already got: searchable, and each row opens the record the way its marker did. A "Try the map again" button brings the map back. The notice above the list keeps MapLibre's reason and names a remedy that exists: a view with its own map style is told to check that URL, and a view on the public default style is told to ask an administrator to set a map style for the view. It no longer says the markers are "listed in the search box" or asks for a "custom map style for production use" setting that does not exist. That notice, the WebGL2 notice, the list's label and empty text, and the "records excluded for missing or invalid coordinates" count now read the translation bundle, so a zh-CN console shows them in Chinese.
+- **`@object-ui/i18n`:** eight new `element.map.*` keys in all ten packs.
+
+What to do: nothing. A deployment-wide map style setting is not part of this change.
@@ -0,0 +1,17 @@
+---
+'@object-ui/i18n': patch
+---
+
+chore(i18n): delete 92 message keys nothing reads from all ten locale packs
+
+Clause-②: yes (TranslationKeys narrows by 92 unread members; patch per the #4730 retirement precedent)
+Metadata-protocol: none
+
+`ui/scripts/check-i18n-dead-keys.mjs` listed 122 keys with no call site and no textual occurrence anywhere in the repository. 92 of them are deleted from `ar`, `de`, `en`, `es`, `fr`, `ja`, `ko`, `pt`, `ru` and `zh`; no key is renamed or added, and no screen changes, because no code asked for any of them. The largest groups are `appDesigner.*` (20 keys), `report.*` (9), `publicForm.*` (8), `table.*` (7) and `layout.appSwitcher.*` (7).
+
+Two groups the script also listed stay:
+
+- 28 `_one` / `_other` plural forms (`preview.changes.typeCount.*`, `notifications.arrivalMany` / `arrivalRepeats`, `fields.relativeDate.overdue`). Their base keys are called with `count`, and i18next reads the plural form, so they are in use.
+- `console.ai.agentLabels.dataChat` and `metadataAssistant`, which the pack keeps on purpose for external overrides.
+
+`TranslationKeys` (`typeof en`) and the other pack objects' types lose the 92 members. A host that reads one of them by property gets a type error; nothing in this repository does, and no `t()` call anywhere asks for one.
@@ -0,0 +1,87 @@
+---
+'@objectstack/account': patch
+'@objectstack/cli': patch
+'@objectstack/client': patch
+'@objectstack/client-react': patch
+'@objectstack/cloud-connection': patch
+'@objectstack/connector-imap': patch
+'@objectstack/connector-mcp': patch
+'@objectstack/connector-openapi': patch
+'@objectstack/connector-rest': patch
+'@objectstack/connector-slack': patch
+'@objectstack/console': patch
+'@objectstack/core': patch
+'@objectstack/driver-memory': patch
+'@objectstack/driver-mongodb': patch
+'@objectstack/driver-sql': patch
+'@objectstack/driver-sqlite-wasm': patch
+'@objectstack/driver-turso': patch
+'@objectstack/embedder-openai': patch
+'@objectstack/formula': patch
+'@objectstack/hono': patch
+'@objectstack/knowledge-memory': patch
+'@objectstack/knowledge-ragflow': patch
+'@objectstack/lint': patch
+'@objectstack/mcp': patch
+'@objectstack/metadata': patch
+'@objectstack/metadata-core': patch
+'@objectstack/metadata-fs': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/objectql': patch
+'@objectstack/observability': patch
+'@objectstack/organizations': patch
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-approvals': patch
+'@objectstack/plugin-audit': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-dev': patch
+'@objectstack/plugin-email': patch
+'@objectstack/plugin-hono-server': patch
+'@objectstack/plugin-pinyin-search': patch
+'@objectstack/plugin-security': patch
+'@objectstack/plugin-sharing': patch
+'@objectstack/plugin-webhooks': patch
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+'@objectstack/sdui-parser': patch
+'@objectstack/service-analytics': patch
+'@objectstack/service-automation': patch
+'@objectstack/service-cache': patch
+'@objectstack/service-cluster': patch
+'@objectstack/service-cluster-redis': patch
+'@objectstack/service-datasource': patch
+'@objectstack/service-i18n': patch
+'@objectstack/service-job': patch
+'@objectstack/service-knowledge': patch
+'@objectstack/service-mailbox': patch
+'@objectstack/service-messaging': patch
+'@objectstack/service-package': patch
+'@objectstack/service-print': patch
+'@objectstack/service-queue': patch
+'@objectstack/service-realtime': patch
+'@objectstack/service-settings': patch
+'@objectstack/service-sms': patch
+'@objectstack/service-storage': patch
+'@objectstack/setup': patch
+'@objectstack/skills': patch
+'@objectstack/spec': patch
+'@objectstack/studio': patch
+'@objectstack/trigger-api': patch
+'@objectstack/trigger-record-change': patch
+'@objectstack/trigger-schedule': patch
+'@objectstack/types': patch
+'@objectstack/verify': patch
+'create-objectstack': patch---
+
+chore(packages): publishing metadata — per-format types in `exports`, declared `sideEffects`, and a README for the 18 published packages without one
+
+Clause-②: no
+Metadata-protocol: none
+
+Measured on a fresh `origin/main` build of all 73 published packages outside `ui/`, each staged as `npm pack` would ship it, with publint 0.3.25 and @arethetypeswrong/cli 0.18.5. Before: 73 of 73 packages carried at least one publint message and 48 carried an attw problem. After: 3 packages carry a publint message and 16 carry an attw problem, each remaining class needing a change this one deliberately does not make — an export-map shape change, or a dual-build fix in `@objectstack/core`.
+
+- **Types per module format.** On 38 manifests one `types` entry served both formats, so a TypeScript consumer importing the ESM build was handed the CJS declarations — every one of attw's 38 `FalseCJS`. Each `{types, import, require}` entry becomes `{import: {types, default}, require: {types, default}}` pointing at the declaration file the same tsup run already emits for that format. No subpath is added or removed, and no JavaScript target moves. `@objectstack/core` keeps its single `types` entry: its `.d.ts` and `.d.cts` declare the same classes with private members, so serving them per format gives a consumer that reaches `core` through both resolution modes two incompatible `ObjectKernel` types, which is `@objectstack/plugin-dev`'s declaration build (it awaits `import('@objectstack/objectql')` inside a CommonJS build). Its `FalseESM` therefore stays, measured and unfixed here.
+- **`sideEffects` on the 72 manifests that declared none**, read per package rather than set in bulk: `@objectstack/service-cluster-redis` registers its `redis` cluster driver at module load and `create-objectstack`'s bin reaches its program through a bare import, so both declare their entry files side-effectful; everything else is `false`.
+- **`publishConfig: { access: 'public' }`** on the 17 that had none, the value the other 56 already declare.
+- **`type`** on the 39 that shipped `.js` without declaring a format — every `.js` under their `dist/` was read first and is CommonJS, which is what the absent field already meant — **`engines.node >= 22.0.0`** on the 22 that had no `engines`, and **`repository.url`** as the full `git+https://` git URL on 71.
+- **A README for 18 published packages that had none**: one paragraph, the first import a reader writes, and a link to the package's docs page. They are the pages npm renders, and for these 18 npm rendered nothing.
@@ -167,12 +167,12 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 
 - 表未覆盖的包首次分诊时归类并走 PR 更新本表;新增或退役 `domain:*` 必须同批改本表。
 - 退役 `domain:*` 只退流通,对象保留;`domain:engine`/`domain:services`/`domain:cli` 读作 `domain:server`。
-- `domain:*` 只由分诊席产出,例外一:在飞卡衍生 sub-issue 承父卡域;无标签的卡 ⛔ 不得认领。
-- 预贴标签只是建议,队列与级别只由分诊落笔(例外一同承);无分诊审计评论 ⛔ 不得认领。
+- `domain:*` 只由分诊产出,两例外:sub-issue 承父卡域、main-red 锚卡;无标签的卡 ⛔ 不得认领。
+- 预贴标签只是建议,队列与级别只由分诊落笔;无分诊审计评论 ⛔ 不得认领;两例外豁免。
 - 跨域例外路径:拆不动的跨域单 PR 由分诊席指定一个车道 PM 认领,认领评论申报文件面。
 - 派发前在飞检查:读 `pm:dispatched` 卡认领评论申报的文件面,本地求交、不另发查询。
 - 跨域例外路径的范围加上该单文件面触及各域的在飞单;相交 ⇒ 排该 PR 之后串行或让行。
-- 跨域相交只经三条越界通道:跨域例外路径、认领席跟到底的越界面、接手无主阻塞项。
+- 越界只四通道:跨域例外路径、认领席跟到底的越界面、接手无主阻塞项、main-red 锚卡。
 - 合并队列是共享串行资源:车道买到的是并行编写,不是并行落地。
 - 谁发现 flake 谁修或立单,⛔ 不绕行。
 
 
@@ -7,7 +7,7 @@
 - 整车道一次读全,本地求交:`list_issues` 带 `labels: [domain:X]` + 最小字段拿回全车道 open 集。
 - 候选 = open、未 assign、无 `needs-user-decision`、无 `pm:retriage`;⛔ 排除三门皆无的 `tooling` 卡。
 - `tooling` 卡至多占一轮派发的 10%,溢出留积压、⛔ 不入 `pm:queue`;⛔ 无门禁无脚本强制。
-- 无分诊审计评论的卡不是候选,预贴 `pm:queue` 视同无;例外一的 sub-issue 承父卡首触。
+- 无分诊审计评论即非候选;例外:sub-issue 承父卡首触,main-red 锚卡见 `landing-operations.md`。
 - 已排队父单的 open sub-issue 自动是候选,`pm:epic` 父单的子树除外。
 - 每张候选读全文 + 全部评论,写派发词前做决策复读:评论读到最后一页。
 - 维护者裁决逐字引入派发词裁决分区作约束,无则写明无裁决。
@@ -37,7 +37,7 @@
 - 阻塞解除后延后单重定价:前一单派发词必答 #X 变简单、变难、不必要或无影响。
 - 派发后一单前用该回答重读它的选项与成本,⛔ 不沿用立单时那份。
 - 在飞卡衍生三分:不修它验收过不过;in-scope ⇒ 父卡 sub-issue,认领席自有、优先级继承。
-- 该 sub-issue 带父卡域与优先级直接派发,绕过分诊;sweep 事后扫,重复关 `duplicate`。
+- 该 sub-issue 与 main-red 锚卡各带域与级直接派发,绕过分诊;sweep 事后扫,重复关 `duplicate`。
 - 排队卡含他车道项 ⇒ 发现席自拆:新卡无 `domain:*`,首行 `carries item k of #N; #N keeps items …`。
 - 分诊首触定域可改判;拆出卡 ⛔ 不承父卡域(承域只及本车道 sub-issue),父卡余项照 `Fixes`。
 - 自在飞派发升级出的卡首行一句:本卡承哪一半、父卡留哪一半;缺此行不入队不入箱。
 
@@ -58,8 +58,6 @@
 - 落地评论 = 两个读数的探针表 + 一行状态变更(摘标/关卡/收口),⛔ 不复述 `## 席位核对`。
 - 契约复核 PASS 落地的 PR 到窗口时已 ready 且 auto-merge 在挂,见 `contract-review.md`。
 - 转 ready/入队前跑 `check-governed-merges.mjs --pr N`:受管面照两层;>3000 行(含生成物)照 Tier H。
-- 受管路径全在 `.claude/**` 者 Tier S:席内达档复核过落地前检两条即转正式入队。
-- Tier H(其余受管面)者:四件套留 draft 等人批,⛔ 不翻正式不入队;获授权批准后认领席落地。
 - ⛔ 两层不由席位批准;清标即落地同受此闸,漏判会被队列守卫在 merge group 里拒收。
 - 再读 `mergeable_state`:`dirty` ⇒ 先 merge `origin/main` 再挂;生成物在面上按 A 的固定序。
 - 挂 auto-merge 的同一动作里重测生成物漂移,⛔ 不复用更早的零;非零 ⇒ 按 A 的固定序。
@@ -79,8 +77,10 @@
 - MERGED 或关闭即退订,同刻把 `mode:cloud` 派的会话 `archive_session`。
 - 触发条件是卡终局且报告已收复核;⛔ 合并前不归档,误归档可 unarchive 但容器现场已失。
 - 暂停或交接时把在挂订阅清点进座位贴,⛔ 不留孤儿订阅。
-- main-red 约定①:p0 fix-forward 允许跳队,限 p0、机械、根因已核实的止血 PR。
-- 也可按既有 governed 例外由维护者人工直合一行修复;仅限 main-red 修复。
+- main-red 约定①:见主干/队列全量红的席位先找锚卡,无则立 p0 锚卡(门类 ①),域随失败面。
+- 认领并派止血,⛔ 不等分诊首触、不等维护者;首触事后补,可改域、⛔ 不改动作。
+- 首道止血 = 回退引入红的提交(主干末绿与首红之间找),根因另立卡。
+- p0 fix-forward 止血跳队,限机械、根因已核实;维护者可按 governed 例外人工直合一行修复。
 - main-red 约定②:一个失败 check 只锚一张卡,先立者赢,后见者评论到锚卡,⛔ 不另立。
 
 ## C. 依赖前棒才能转绿的 PR:draft 停放 + 签名级预期红清单
 
@@ -22,6 +22,7 @@
 - 裸卡数 >15 ⇒ 下一 fire 整轮改域分批集中模式,每批 ≤5 张同族卡,照样跑到清空。
 - 紧急卡直接分诊:维护者点名或 p0 嫌疑 ⇒ 立即起默认判断档分诊子代理,不等定时轮。
 - 紧急分诊的授权面 = 分诊本身,⛔ 不写码不认领;产出落卡,与定时轮分诊同格式同效力。
+- main-red 锚卡由席位先立先派,首触事后补作记录级:可改域,⛔ 不改动作,在飞照补。
 - 分类动作每张三选一,外加一个修复通道;裁定写方向、给六态之一。
 - 方向在 ADR/本卡裁决/不可重裁规则:贴 `check-prior-rulings.mjs` 的 `Prior rulings read:` 行,或不点。
 - `pm:queue` = 有具名落点或复现的具体缺陷,无可问之事;⛔ 工具/门禁修复不由此进。
@@ -67,15 +68,14 @@
 - 三类外首触关闭只清门前存量,关 not planned(不等批准可否决重开);三类内无证据拒收。
 - 三类内再过时前提检查,三选一:晋级 / 关闭 not planned / hold;判级只在此轮,不在立单时。
 - ⛔ 写入前对每张卡现读当前状态;任何列表快照读数一律作废。
-- ⛔ 带 `pm:dispatched`/assignee/open 或 merged PR 引用的卡不动;例外仅下三行:敲门在先。
+- ⛔ 带 `pm:dispatched`/assignee/open 或 merged PR 引用的卡不动;例外:下三行、main-red 锚卡首触。
 - 在飞活性复查:认领逾一天无自有产出(commit/PR/评论)⇒ 敲门一次,首行键 `Owned-24h re-check:`。
 - 敲门后 `RECLAIM_AFTER_HOURS = 12` 小时无答复 ⇒ `label-write.mjs --release` 一笔中继释放,贴不动。
 - 释放:`Release:` 评论(出处三件)+ `Resume-from:` 行 + `pm:dispatched`→`pm:queue` + 清 assignee。
 - 车道席可附证据/前提重验,⛔ 不定级不改标;每张卡欠一次分诊首触,车道 ⛔ 不自分诊。
 - 域分批与 sweep 打包晋级五条照用;每批约定与积压告警见 `references/dispatch-runbook.md`。
 - `pm:retriage` 每 fire 先答异议评论所求,答后同笔摘标;须维护者答的进收件箱,标照摘。
 - retriage 的异议判据认内容(有评论写明所求)⛔ 不认形状(有一条异议评论)。
-- 裁决恒归维护者人工:分诊只分析、推荐、入箱;⛔ 无代裁车道、置信门与 `auto-adjudicated`。
 - 人工地板(恒呈维护者):功能新增;ADR;协议/公开契约变化;破坏性或难回滚动作。
 - 人工地板同含:安全/权限边界;门禁削弱(降阈/删必查/抬上限/跳测);新增运行时第三方依赖;
 - 花费/配额/舰队形态/默认模型档位;新增必需门禁/hook/棘轮(卡具名所守契约与预期捕获)。