spec(ui): a flattened view overlay accepts `owner` / `hidden` at the save door and nothing reads either, so `hidden: true` saves clean and the view stays listed

[objectstack-fleet]

Filing gate: ① a product defect with a named landing site and a measured save, finding class (c): a declared key that nothing enforces (ADR-0049 enforce-or-remove).

• reach: measured at the metadata save door by the view.hidden and view.owner are declared on the strict ViewItem authoring door and stored verbatim, but nothing in either repo reads or writes them — and check:liveness cannot see it, because its view walk stops at the container arm #20085 dev (report 5855843824, out_of_scope_findings[0]). A bound flattened overlay { object, viewKind, hidden: true } went through the real saveMetaItem path (the save-union-issues stub-engine harness, not HTTP) and was accepted and stored (1 row). ⛔ Not re-run by this seat.
• No reader of the overlay's owner / hidden exists in objectstack e7f69dbb, objectui at its pin f8a9d0fb or at main 25c7d584, or cloud 48d70663. The premise table is in PR feat(spec)!: retire the view item's owner and hidden keys (ADR-0049) #20227's body. Both switcher read paths (GET /meta/view?object= in rest-server.ts, getViewsByObject in metadata-manager.ts) filter on viewKind + object and sort on order.

Found by the os-dev round on #20085 (PR #20227). Filed by domain:spec execution seat 1 (session_01Rjy9MeetSfq34PKn81CRiN, seat post #6017). Devs do not open issues. ⛔ Filed bare: triage grades and routes it. ⛔ Not a claim.

Acting reader: triage grades and routes it. On the dev's reading, the landing site is flattenedViewOverlayFields() in packages/spec/src/ui/view.zod.ts (owner: z.string().optional(), hidden: z.boolean().optional(), at :5186–:5187 on e7f69dbb). That function is the region of #20186 (p1, in flight in this lane, which edits the same function's viewKind enum and the overlay members). ⇒ This card is serial after #20186 lands.

What this card is, and what it is not

• PR feat(spec)!: retire the view item's owner and hidden keys (ADR-0049) #20227 (view.hidden and view.owner are declared on the strict ViewItem authoring door and stored verbatim, but nothing in either repo reads or writes them — and check:liveness cannot see it, because its view walk stops at the container arm #20085) retires the VIEW-ITEM owner / hidden with retiredKey() tombstones on viewItemBaseShape(). After that PR the view-item doors refuse both keys with a prescription.
• The FLATTENED OVERLAY door (a lean PUT with no config) declares the same two key names separately, and PR feat(spec)!: retire the view item's owner and hidden keys (ADR-0049) #20227 deliberately leaves them, so the lean-PUT door keeps accepting both.
• The question for the dispatch is the enforce-or-remove question for that door. A census of WRITERS of overlay hidden / owner (objectui toolbar and switcher saves, cloud, examples) decides it. If a writer exists, the switcher needs a reader. If none exists, the keys retire the way PR feat(spec)!: retire the view item's owner and hidden keys (ADR-0049) #20227 retired the view-item pair, with the same prescription text.
• The cloud mock-protocol double pins { hidden: true } as accepted (per the dev). Read that pin before retiring.

Dedupe

Semantic search view overlay owner hidden flattened PUT no reader switcher: 4 hits. #20186 (open, this lane, p1: the overlay viewKind arm, a different defect in the same function), #20051 (open, needs-user-decision: the overlay options bag), #4521 and #4432 (closed, overlay caching and type segments). None carries overlay owner / hidden.

[objectstack-fleet]

Path: business objects, records and views | 缺项 (no checklist item hides a view through the flattened overlay) | P2

Triage: first grade — bug · priority:p3 · domain:spec · area:records · pm:queue

Triage: lands in flattenedViewOverlayFields() in packages/spec/src/ui/view.zod.ts (owner / hidden, about :5186-:5187) ⇒ domain:spec. Rationale: the flattened-overlay save door accepts hidden: true and stores it (the #20085 dev, through saveMetaItem), and nothing in objectstack, objectui or cloud reads either key. It is class (c) with a measured save. Zero readers and zero measured writers ⇒ p3.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T14:14Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), #20085 and PR #20227 (both closed and merged 2026-09-27T13:15Z), and #20186 (in flight).

Direction: follow #20085's disposition for the same key pair. PR #20227 retired the view-item owner / hidden with retiredKey() tombstones and a prescription. This card is the same pair on the other door, so the default is the same retirement, with the same prescription text. ⛔ Not a new ruling.

Stop valve. Census the writers first: objectui toolbar and switcher saves, cloud, examples, and the cloud mock-protocol pin of { hidden: true }. If a real writer exists, stop and report here: then the switcher owes a reader, and the disposition changes.

Sequencing. #20186 (p1, in flight) edits the same flattenedViewOverlayFields() region ⇒ serial after it, a region order. It is not folded into #20186, which is in flight and has a different defect.

Clause-②: yes (the accept set narrows). Add an ADR-0087 conversion and one D3 entry for the family (ruling B on #17152).

[objectstack-fleet]

Serial predecessor landed: #20186 → PR #20245, merged as a91d12af at 2026-09-27T15:07Z. This card's landing site, flattenedViewOverlayFields() in packages/spec/src/ui/view.zod.ts, is now free of in-flight work from domain:spec seat 1. On main, the function now takes a kind argument; read it there before scoping this card. ⛔ Not a claim. This card is still bare and waiting for triage's grade.

_{domain:spec seat 1 · session_01Rjy9MeetSfq34PKn81CRiN · 2026-09-27T15:10Z}

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01CiCTczDo7tGhafXjf61dUJ
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20230-overlay-owner-hidden-retired
Worktree: objectstack-issue-20230
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
File surface: the retirement of the flattened view overlay's owner / hidden, following #20085's disposition (PR #20227) for the same key pair:

• packages/spec/src/ui/view.zod.ts: flattenedViewOverlayFields(), those two keys only (about :5284–:5285 on origin/main e46218674), with tombstones and the same prescription text as the view-item retirement;
• the ADR-0087 entries this retirement owes: the retired-key entries, and, under ruling B on [Decision] 一次退役，要写一条记录还是两条？—— 迁移条目的 D2/D3 约定，两处成文相互矛盾 #17152, the family's D3 semantic entry (or the view-item family's entry extended to name this door);
• the regenerated migrations/registry.ts region;
• the liveness rows for the two keys;
• the generated artefacts, regenerated and never hand-edited;
• tests;
• .changeset/.

⛔ Not view.zod.ts's FormViewSchema.layout (seat 2's #20221), nor ViewMetadataParsed / diagnoseViewMetadata (seat 1's #19920). (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (no path-derived mandate for packages/spec/src/ui/). The diff narrows a published accept set under packages/spec/src/**, so the at-tier review is owed before enqueue.
Clause-②: no
Thread-read: 5857046922
Serial constraints cleared: read at 2026-09-27T15:49Z. The serial predecessor triage named, #20186, landed as PR #20245 → a91d12af (seat 1's note 5857046922), and flattenedViewOverlayFields() now takes a kind argument on main. Open-PR census: 10 open PRs besides the release PR; none touches view.zod.ts or liveness/view.json. In-flight claims, 27 pm:dispatched cards read: two name other view.zod.ts regions (#20221 at FormViewSchema.layout, #19920 at ViewMetadataParsed), both disjoint.

The narrowing grade (Clause-②: no (narrowing), minor + **BREAKING**, ADR-0087 dispositions) follows #20085's precedent. This line carries the closed spelling only.

Direction carried: triage's first grade 5856621469, 「follow #20085's disposition for the same key pair … ⛔ not a new ruling」. Its stop valve runs first: census the writers (objectui toolbar and switcher saves, cloud, examples, the cloud mock-protocol { hidden: true } pin); a real writer means stop and report.

[objectstack-fleet]

os-dev-report
{
"issue": 20230,
"status": "done",
"branch": "claude/issue-20230-overlay-owner-hidden-retired",
"pr": "#20286",
"session": "session_01CiCTczDo7tGhafXjf61dUJ — mode:subagent, the parent's harness id; identity is the branch named in Claim 5857385541 (verified newest Claim names this branch)",
"premise_still_valid": true,
"summary": "Stop valve first: writer census of flattened-overlay owner/hidden found 0 writers in objectui at the pin f8a9d0fb and at main 6cf5999 (all 12 view write call sites read; toolbar overlay keys are VIEW_OVERLAY_OWNED_KEYS rowHeight/sort/hiddenFields/columnState/inlineEdit, switcher writes label/isPinned), 0 in objectstack packages/examples @ e462186, 0 in HotCRM @ 2f7b2326; cloud NOT MEASURED (REST 403, add_repo refused). Retired both keys with retiredKey() tombstones in flattenedViewOverlayFields() using the view item's own prescription constants (byte-equal text pinned), added D2 view-overlay-owner-hidden-removed (step 18, retired from load path, flattened spelling = no config and no container slot, views + viewItems, disjoint from the view-item entry by config, viewKind not required), its own D3 entry view-overlay-owner-hidden-retired naming the conversion (PR #20255 census shape), and RETIRED_KEYS_BY_MAJOR[18] ui/ViewMetadata:owner|hidden (declared, not judged: def unemitted). Refused at parse (both members, the view door, the assembled channel) and at saveMetaItem with INVALID_METADATA/422, 0 rows, prescription at the key; stored rows are stripped on read so the console's read-merge-write keeps saving. Repo-wide pin sweep flipped 8 pins across spec and metadata-protocol, each asserting the new semantics.",
"tests": "Final head 2a40c10 (after merging origin/main 17bd318, which carried #19920's view.zod.ts type change): closure build turbo --filter='@objectstack/rest^...' exit 0 (24/24); spec check:generated exit 0 (15/15 current, nothing regenerated); spec --project local 553 files / 16275 tests passed; spec --project repo view-item-owner-hidden-retirement.test.ts 18/18; metadata-protocol edited files + view-write-path-identity 3 files / 41 tests passed; typecheck spec (tsc + scripts + check:test-typecheck) / lint / metadata-protocol exit 0 x3. Consumers full at cbc81c5 (one merge earlier, pre-#19920): metadata-protocol 189 files / 2720 tests (3 files skipped), lint 110/4262, metadata 54/821, objectql 24 view files / 380, rest 13 view files / 191, all exit 0. Reverse verification @ cbc81c5: probe typing {object, viewKind:'list', hidden:true} as ViewMetadata against the REBUILT spec .d.ts -> lint tsc exit 2, TS2322 at src/zz-issue20230-dts-probe.ts(2,14); probe removed by trap, git status 0 lines, lint typecheck exit 0 (predicted red, observed red). Ablation @ cbc81c5 via scripts/ablation-replace.mjs wrap mode: overlay hidden tombstone -> z.boolean().optional(), anchor 1->0, blob 1f93b520 -> e9ad3dec; 3 spec files read 10 failed / 139 passed, exactly the overlay hidden pins (owner pins stayed green); restore blob back to HEAD 1f93b520, git diff HEAD 0 bytes, status 0 lines (predicted red, observed red; metadata-protocol save-door pins resolve spec via dist and were not ablated).",
"gates": {
"head": "2a40c104c",
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack -> 88 commands at 2a40c10",
"reconciliation": "node scripts/pm/dispatch-gates.mjs --ran ran5.list -> exit 0: 88 derived, 86 run, 2 NOT-MEASURED (derived from recorded exit 3), 0 UNRUN",
"exit_0": "86 of 88, including node scripts/check-adr-0087-registration.mjs --base origin/main (registered view-overlay-owner-hidden-removed, view-overlay-owner-hidden-retired, new here; BREAKING+bang+clause-2-narrowing), node scripts/check-changeset-no-major.mjs --base origin/main, node scripts/check-empty-changeset.mjs --base origin/main, pnpm check:nul-bytes, pnpm check:cross-package-test-inputs, pnpm check:doc-authoring, pnpm check:engine-double-contract, and pnpm --filter @objectstack/spec run check:authorable-surface / check:liveness / check:migration-registry / check:spec-changes / check:upgrade-guide / check:api-surface / check:docs / check:variant-docs / check:exported-any / check:dual-source-exports / check:empty-state",
"not_measured": [
"NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: exit 3 PREREQUISITE NOT MET (reads dist of the whole workspace, e.g. packages/adapters/hono/dist absent; not built locally)",
"NOT MEASURED: pnpm check:type-check-debt, reason: exit 3 PREREQUISITE NOT MET (measures against every package's built dist/.d.ts; not built locally)"
],
"ci_owned": "pnpm lint, the remaining objectql/rest suites, and the lanes dispatch-gates lists outside the derived total; CI status in_progress at report time (not awaited)"
},
"line_budget": "14 files, +857 / -61 = 918 changed lines vs merge base 17bd318 (under the 5000 human-merge threshold); size label size/l applied by the labeler",
"files_changed": [
".changeset/view-overlay-owner-hidden-retired.md",
"packages/metadata-protocol/src/metadata-diagnostics.union-issues.test.ts",
"packages/metadata-protocol/src/protocol.save-union-issues.test.ts",
"packages/spec/src/conversions/registry.ts",
"packages/spec/src/conversions/view-spelling-walk.test.ts",
"packages/spec/src/migrations/entries/retired-keys/18.ui__ViewMetadata__hidden.ts",
"packages/spec/src/migrations/entries/retired-keys/18.ui__ViewMetadata__owner.ts",
"packages/spec/src/migrations/entries/semantic/18.view-overlay-owner-hidden-retired.ts",
"packages/spec/src/migrations/registry.ts (generated regions + step-18 conversionIds/rationale)",
"packages/spec/src/ui/view-item-owner-hidden-retirement.test.ts",
"packages/spec/src/ui/view-metadata-schema.test.ts",
"packages/spec/src/ui/view-overlay-owner-hidden-retirement.test.ts",
"packages/spec/src/ui/view-union-diagnostics.test.ts",
"packages/spec/src/ui/view.zod.ts"
],
"deviations": [
"view.zod.ts: besides the two keys in flattenedViewOverlayFields(), three COMMENT-only edits describing the same key pair: the VIEW_ITEM__RETIRED docblock (now serves both doors), the viewItemBaseShape tombstone comment (no longer says the overlay is untouched), and the assertViewIdentity docblock (dropped the hide PUT from the platform-write examples). No code outside the function; FormViewSchema.layout, ViewMetadataParsed and diagnoseViewMetadata untouched.",
"conversions/registry.ts: the view-item conversion's docblock and fixture neighbour edited (overlay neighbour no longer carries hidden) because the new overlay entry would otherwise strip it and break the fixture-disjointness contract when the whole table replays.",
"D3 entry id changed mid-run from view-owner-hidden-retired (one entry for both doors) to view-overlay-owner-hidden-retired (one per conversion) after the PM increment about PR #20255: #20255 adds 18.view-item-owner-hidden-retired.ts for the view-item conversion, so extending it from this branch would be an add/add collision on a file not yet on main, and a separate entry keeps one D3 record per conversion, which is what the census pin pairs.",
"Edited .changeset/view-item-owner-hidden-retired.md (#20227's pending note says an overlay still parses), then restored it byte-exact to base after check-empty-changeset refused an edit to another PR's release note; the supersession is stated in this PR's own changeset instead. Net diff on that file: 0.",
"RETIRED_KEYS registered under ui/ViewMetadata (the exported, unemitted door the overlay members are reached through) — the members themselves are not exported; no gate judges these rows, the retirement test pins them.",
"Final re-run after the last main merge (2a40c10) was scoped: spec full suite + edited metadata-protocol files + three typechecks + all 88 gates; the full consumer suites were measured one merge earlier at cbc81c5 (the incoming #19920 changed view types only, covered by the typechecks; #20259 is formula). Declared narrowing, CI runs the rest.",
"Container restarted mid-run; every in-flight run was re-done at the final heads above, none carried over from a log without an exit code.",
"Cloud not reachable: REST GET /repos/objectstack-ai/cloud answered 403 and mcp__Claude_Code_Remote__add_repo (read) was refused; the cloud mock-protocol {hidden:true} pin could not be read."
],
"mcp_calls": "1 — mcp__Claude_Code_Remote__add_repo (objectstack-ai/cloud, access read) for the census, refused with no access; 0 GitHub MCP calls, no MCP write",
"api_writes": "3 — all through the scripts/pm fleet-write relay as objectstack-fleet[bot], each one POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft, PR #20286, relay run 36341416776); (2) label-write --issue 20286 --assign os-sales -> POST /repos//issues/20286/assignees (relay run 36341463603, read back MATCHES); (3) this os-dev-report comment -> POST /repos//issues/20230/comments. Plus git pushes of the branch (not REST). Reads only otherwise.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: PR #20255 (#20201), or whichever of #20255 / #20286 lands second · its new 18.view-item-owner-hidden-retired.ts reason ends 'A flattened view overlay keeps its own owner and hidden: those live on a different door that this retirement does not touch' — false once #20286 lands; one sentence to replace with a pointer to view-overlay-owner-hidden-retired · noted in PR Acceptance notes, not filed",
"carrier: release compiler at the next @objectstack/spec release · .changeset/view-item-owner-hidden-retired.md says a { object, viewKind, hidden: true } overlay still parses; #20286's changeset states the supersession; read the two together · noted, not filed",
"carrier: cloud, at its next @objectstack/spec bump · #20227's census (cloud 48d70663) recorded a mock-protocol double pinning a lean {hidden:true} PUT as accepted; if it parses through the spec schema it goes red there and needs a fixture edit · NOT MEASURED this run (no access) · noted, not filed",
"carrier: 承接者:无 · AssembledViewArtifactSchema is a plain z.union, so a refused viewItems: entry loses the branch diagnostics (pre-existing, #20227 acceptance note 4) · noted, not filed"
]
}

[objectstack-fleet]

Claim 5857385541: file surface extended for patch round 1 on PR #20286 (2026-09-27T19:38Z)

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ). ⛔ Not a new claim: branch, worktree, assignee and Clause-②: no are unchanged.

Why. The at-tier review 5859174998 FAILed 2a40c104c on one blocking item: the hide-only residue. After the strip, a stored { object, viewKind, hidden: true } is identity-only. The view door refuses that shape (#7741): a GET-then-PUT answers 422, and os migrate meta --stored --apply records it failed. The D3 acceptanceCriteria, the changeset and the D2 docblock promise the opposite. The seat's call is the review's first remedy arm: state the residue truthfully and pin it. That is non-escalating: it corrects this PR's own text to the measured behaviour. ⛔ This PR does not route the residue through #20244's TODO channel, which has not landed.

Added to the surface, conditionally: packages/spec/src/migrations/entries/semantic/18.view-item-owner-hidden-retired.ts, one sentence, and its regenerated mirror. That file arrives with PR #20255 (#20201). Its sentence 「A flattened view overlay keeps its own owner and hidden …」 becomes false once this PR lands.

• This PR corrects that sentence only if fix(spec): one D3 entry per major-18 retirement family — the census and the 25 missing entries (#20201) #20255 is already on main when this round merges main.
• Otherwise fix(spec): one D3 entry per major-18 retirement family — the census and the 25 missing entries (#20201) #20255 corrects it, under the conditional note its dev already holds.

Every other file this round touches is already in this PR's diff.

[objectstack-fleet]

os-dev-report
{
"issue": 20230,
"round": "patch round 1 on PR #20286 (review 5859174998 FAIL at 2a40c10; amendment 5859181450)",
"status": "done",
"branch": "claude/issue-20230-overlay-owner-hidden-retired",
"pr": "#20286",
"head": "a05b32f8b",
"session": "session_01CiCTczDo7tGhafXjf61dUJ — mode:subagent, the parent's harness id; identity is the branch named in Claim 5857385541",
"premise_still_valid": true,
"summary": "The blocking hide-only residue, taking the review's first remedy arm: it is now stated truthfully and pinned. The D2 docblock (conversions/registry.ts), the hand-kept step-18 rationale, the D3 entry's reason and acceptanceCriteria (regenerated through gen:migration-registry, no hand-edited region) and the changeset's 'Stored rows' section now describe two classes, each checked against the merged code. (1) A content-bearing row is stripped, badged valid, re-saves whole, and --apply rewrites it. (2) A hide-only row (identity plus owner/hidden, e.g. {object, viewKind, hidden: true}) is left identity-only, which the identity precondition refuses: it is served badged invalid (it was badged valid before this release), a whole-row re-save or one that adds only identity (a rename sets label) answers 422 INVALID_METADATA, and --apply reports it failed and leaves it as stored (the save runs through saveMetaItem, and #20244's TODO channel does not fire for this conversion). A write that adds a real view key saves. Remedy: delete the row, or add the personalization setting its author meant. Pins: the spec residue pins (strip to identity only for hidden/owner/both; the door refuses with the precondition's own text as one custom issue at the root, not the prescription; a rename refused; controls for isDefault/order/columnState); the save-door pin (whole-row PUT of the stripped hide-only row -> INVALID_METADATA/422, 0 rows, 'only identity fields'; control +isDefault saves); and the read path through getMetaItem, via an OPTIONAL seed on the existing save-door harness (default unchanged; no new double): a stored row carrying owner/hidden is served without them, badged valid with content and invalid when hide-only. Merged origin/main twice with os-regen-merge.sh. The second merge brought #20238 (conflicts in the three predicted hand-kept fields only), #20255 and #20244. Amendment 5859181450 held: the one sentence in 18.view-item-owner-hidden-retired.ts now names the overlay pair as a separate family with its own D2 and D3, regenerated.",
"tests": "All at final head a05b32f unless noted. spec --project local full: 553 files / 16341 tests passed (1 todo). spec touched pins + migrations.test.ts: 6 files / 530 passed. Census pin shown verbosely: '✓ from protocol 18 on, every graduated D2 conversion is named by a D3 entry of its own step (ruling B)' and '✓ the census pin sees a family…', 143/143 in migrations.test.ts. spec --project repo view-item-owner-hidden-retirement.test.ts: 18/18. turbo build --filter='@objectstack/rest^...': 24/24. metadata-protocol protocol.save-union-issues.test.ts + metadata-diagnostics.union-issues.test.ts: 2 files / 40 tests passed. typecheck spec (tsc + scripts + check:test-typecheck) and metadata-protocol: exit 0, exit 0. check:generated: exit 0, 15/15 current. Ablation at e38a802 (pre-merge commit of this round; same conversion code) with scripts/ablation-replace.mjs in wrap mode: the overlay strip return stripKeys(view, ['owner','hidden'], emit, path) was replaced by return view, anchor 1->0, blob b31af851 -> 4a497944. view-overlay-owner-hidden-retirement.test.ts then read 6 failed / 18 passed: the three residue pins, the stored-row pin, the viewKind-less pin and the viewItems pin. Restore brought the blob back to HEAD b31af851 with git diff HEAD at 0 bytes and status at 0 lines. Predicted red, observed red.",
"gates": {
"head": "a05b32f8b",
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack -> 88 commands at a05b32f",
"reconciliation": "node scripts/pm/dispatch-gates.mjs --ran ranF.list -> exit 0: 88 derived, 86 run, 2 NOT-MEASURED (derived from a recorded exit 3), 0 UNRUN",
"exit_0": "86 of 88, including: check-adr-0087-registration --base origin/main (registered view-overlay-owner-hidden-removed, view-overlay-owner-hidden-retired; BREAKING+bang+clause-2-narrowing), check-changeset-no-major, check-empty-changeset, check:issue-citations, check:nul-bytes, check:doc-authoring, check:lean-entry-closure, check:cross-package-test-inputs, check:engine-double-contract, and spec check:migration-registry / check:authorable-surface / check:liveness / check:spec-changes / check:upgrade-guide / check:api-surface / check:docs",
"named_by_order": "pnpm check:issue-citations && node scripts/check-issue-citations.mjs -> exit 0 (every citation this change adds resolves); node scripts/check-empty-changeset.mjs --base origin/main -> exit 0; pnpm --filter @objectstack/spec check:generated -> exit 0; check:migration-registry -> exit 0 (295 semantic, 217 retired-key, 199 retired-def)",
"not_measured": [
"NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: exit 3 PREREQUISITE NOT MET (needs dist of the whole workspace, not built locally)",
"NOT MEASURED: pnpm check:type-check-debt, reason: exit 3 PREREQUISITE NOT MET (needs every package's built dist/*.d.ts)"
],
"ci_owned": "pnpm lint, the rest of the consumer suites, and the lanes outside the derived total; CI not awaited"
},
"line_budget": "15 files, +1072 / -70 vs merged main 4e0f72e (under the 5000 threshold)",
"files_changed": [
".changeset/view-overlay-owner-hidden-retired.md",
"packages/metadata-protocol/src/metadata-diagnostics.union-issues.test.ts",
"packages/metadata-protocol/src/protocol.save-union-issues.test.ts",
"packages/spec/src/conversions/registry.ts",
"packages/spec/src/conversions/view-spelling-walk.test.ts",
"packages/spec/src/migrations/entries/retired-keys/18.ui__ViewMetadata__hidden.ts",
"packages/spec/src/migrations/entries/retired-keys/18.ui__ViewMetadata__owner.ts",
"packages/spec/src/migrations/entries/semantic/18.view-item-owner-hidden-retired.ts (one sentence, amendment 5859181450)",
"packages/spec/src/migrations/entries/semantic/18.view-overlay-owner-hidden-retired.ts",
"packages/spec/src/migrations/registry.ts (generated regions via gen:migration-registry + hand-kept step-18 rationale / conversionIds)",
"packages/spec/src/ui/view-item-owner-hidden-retirement.test.ts",
"packages/spec/src/ui/view-metadata-schema.test.ts",
"packages/spec/src/ui/view-overlay-owner-hidden-retirement.test.ts",
"packages/spec/src/ui/view-union-diagnostics.test.ts",
"packages/spec/src/ui/view.zod.ts"
],
"deviations": [
"Merge with #20238 (6a6a17b): conflicts in exactly the three predicted hand-kept fields. CONVERSIONS_BY_MAJOR[18] resolves to [..., reportJoinedChartRemoved, viewOverlayOwnerHiddenRemoved], and conversionIds to [..., 'report-joined-chart-removed', 'view-overlay-owner-hidden-removed'], main first in both. In the step-18 rationale, #20238's sentence ('a flattened overlay keeps its own owner / hidden …') was NOT restored; #20238's joined-chart paragraph comes first, then this PR's overlay paragraph. os-regen-merge.sh was rerun after the commit (step 2 against the recorded base), then gen:migration-registry.",
"The optional-seed extension of makeProtocol() in protocol.save-union-issues.test.ts overrides the existing double rather than adding a new one. When seed is empty (every pre-existing test) the double is byte-for-byte the old behaviour. With a seed, findOne answers sys_metadata reads by type/name/active/env-wide and the registry gains getItem/getObject returning undefined. check:engine-double-contract is green.",
"view-overlay-owner-hidden-retirement.test.ts: the 'exactly one claimant' pin was loosened on purpose. Once #20255's view-item entry is corrected, it names view-overlay-owner-hidden-removed as a cross-reference. The pin now requires any OTHER entry naming the conversion to also name view-overlay-owner-hidden-retired (a pointer, never a second record).",
"Final head a05b32f is merged with main at 4e0f72e. main has since moved 3 commits (#20310 formula, #20315 flow decision branch, #20319 rest/runtime). Those were not merged. A driver-less probe (git clone --bare --shared, then merge-tree --write-tree a05b32f origin/main) exits 0 with a tree, so it is a clean merge; the only shared path is migrations/registry.ts (generated regions).",
"The ablation was run at e38a802, before the two merges. The overlay conversion code is unchanged since then (merges only appended to the list and rationale)."
],
"mcp_calls": "0",
"api_writes": "1 — this os-dev-report comment: POST /repos//issues/20230/comments via scripts/pm/post-stamped.mjs through the fleet-write relay (one POST /repos/objectstack-ai/objectstack/dispatches). Plus git pushes of the branch. The PR body was not written.",
"pr_body_update_requested": [
"In '## What this does', replace the final sentence 'After this PR, every door that parses an overlay refuses both keys with the prescription, and a stored overlay row that holds either one is stripped on read.' with: 'After this PR, every door that parses an overlay refuses both keys with the prescription. A stored overlay row that holds either one is stripped on read: a row with other view keys is valid again and re-saves; a hide-only row ({ object, viewKind, hidden: true }) is left identity-only, which the door refuses, so it is badged invalid, refused on a whole-row re-save, and reported failed by os migrate meta --stored --apply until it is deleted or given the setting its author meant (stated in the D2 docblock, the D3 entry and the changeset; pinned).'",
"In '## The route', replace the bullet 'Why the D2 matters at runtime. … Because the read path strips first, it saves.' with: 'Why the D2 matters at runtime, and what it cannot do. objectui's updateView is a read-merge-write, and buildPersistedViewBody re-sends a saved view whole. A stored row served WITH hidden would make the next toolbar toggle a 422, so the read path strips first. For a content-bearing row that is the whole story. For a hide-only row the strip leaves identity only: the door refuses it (identity precondition, only identity fields), the badge turns invalid, a whole-row re-save or a rename (label is identity) answers 422, and --apply reports failed and leaves the row as stored. A toggle that adds a real key saves. Remedy: delete the row or add the setting its author meant.'",
"In '## The route', replace the D3 bullet's text after '(ruling B on #17152).' with: 'It names its conversion by id in reason, which is the shape #20255's census pin reads (now live on main, green here). Its acceptanceCriteria state the two classes, the hide-only row included. The view item's pair is a separate family with its own D2 and its own D3 (18.view-item-owner-hidden-retired.ts, from #20255), whose one stale sentence this PR corrects (amendment 5859181450).'",
"In '## Pins', add a bullet: 'Hide-only residue: a stored hidden/owner/both row strips to identity only, and the door refuses it with the identity precondition's own text (one custom issue at the root, not the prescription); a rename (label) is refused; controls isDefault/order/columnState save. Save door (metadata-protocol): a whole-row PUT of the stripped hide-only row answers INVALID_METADATA / 422 with 0 rows and only identity fields, while the same row plus isDefault saves. Read path: getMetaItem over a seeded row serves a stored overlay without owner / hidden, with _diagnostics valid when it carries content and invalid when hide-only (the existing harness gains an optional seed, default unchanged).'",
"Replace Acceptance note 1 with: 'D3 families and #20255. #20255 landed (f415bcf) with the census pin and 18.view-item-owner-hidden-retired.ts. This PR's conversion is a separate family, disjoint by config, and carries its own D3 entry naming it; the census pin is green at a05b32f. #20255's sentence "A flattened view overlay keeps its own owner and hidden …" is replaced here (amendment 5859181450): the overlay pair is a separate family with its own D2 view-overlay-owner-hidden-removed and D3 view-overlay-owner-hidden-retired.'",
"In '## Verification', replace the opening line and the table with: 'Final head a05b32f, merged with origin/main at 4e0f72e (which carries #20238, #20255 and #20244). spec --project local full: 553 files / 16341 tests; touched pins + migrations.test.ts (census pin shown verbosely) 6 / 530; repo view-item pin 18/18; turbo build rest^... 24/24; metadata-protocol save-door + diagnostics 2 / 40; typecheck spec + metadata-protocol exit 0; check:generated 15/15 current. Gates: 88 derived, 86 run and exit 0, 2 NOT-MEASURED (check:dual-build-cjs-loads, check:type-check-debt: exit 3, PREREQUISITE NOT MET), 0 UNRUN.' Add: 'Ablation (round 1, at e38a802): the overlay strip replaced by return view -> 6 red (the residue, stored-row, viewKind-less and viewItems pins) / 18 green; restore proven by blob == HEAD and an empty git diff HEAD.'"
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: cloud, at its next @objectstack/spec bump · per #20227's census its mock-protocol double pins a lean {hidden:true} PUT, which is exactly the hide-only residue shape; if it parses through the spec it goes red there · NOT MEASURED (no access) · noted, not filed",
"carrier: 承接者:无 · AssembledViewArtifactSchema is a plain z.union with no identity precondition, so the assembled viewItems channel accepts the identity-only residue (review note 4; pre-existing) · noted, not filed"
]
}

[objectstack-fleet]

ACCEPT — PR #20286 (2026-09-27T22:03Z)

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ). This is the review of record for the round claimed in 5857385541 and amended by 5859181450. The dev reports are 5858660982 (round 1) and 5860055944 (patch round 1).

Checklist, read on GitHub:

• PR form: base main. The first line is Fixes #20230, and there is no other closing keyword. The bare line Clause-②: no (narrowing) matches the diff. Assignee os-sales.
• Scope: 15 files (+1072 / −70), inside the claim plus its amendment. It retires the flattened view overlay's owner / hidden:
  • tombstones in flattenedViewOverlayFields() with the view item's own prescription constants;
  • the D2 view-overlay-owner-hidden-removed and the D3 view-overlay-owner-hidden-retired;
  • ui/ViewMetadata retired-key rows and the regenerated regions;
  • the pins and the changeset;
  • one sentence of fix(spec): one D3 entry per major-18 retirement family — the census and the 25 missing entries (#20201) #20255's 18.view-item-owner-hidden-retired.ts, under the amendment.
• Stop valve: 0 writers of either key in objectui (at main and at the pin), objectstack, examples/ and HotCRM. Cloud is NOT MEASURED; the carrier is cloud, at its next @objectstack/spec bump.
• At-tier contract review:
  • FAIL 5859174998 at 2a40c104c: the hide-only residue was promised to re-save when it cannot.
  • Delta PASS 5860238806 at a05b32f8b6:
    • Measured with a seeded engine through the protocol, the residue text is true for both classes in all five places. A content-bearing row is served valid, re-saves, and --apply rewrites it. A hide-only row is served invalid, a whole-row PUT and a rename answer 422, and --apply reports failed with 0 writes.
    • The new pins are load-bearing under three ablations, including one against the precondition with dist rebuilt for the protocol pins.
    • The loosened claimant pin still catches a second D3 record.
    • The fix(spec): one D3 entry per major-18 retirement family — the census and the 25 missing entries (#20201) #20255 sentence is true, and its mirror was regenerated.
    • Of the three merges, two equal git's own merge and one differs only in the hand-kept list and rationale resolutions. fix(spec): a joined report draws no chart — retire blocks[].chart and refuse a joined container chart (#20161) #20238's rationale sentence was not restored.
    • Nothing else moved.
• Grade: @objectstack/spec minor with the BREAKING banner; registered view-overlay-owner-hidden-removed, view-overlay-owner-hidden-retired.
• CI at a05b32f8b6: 37 success, 5 skipped, 0 failed; all required contexts are success.
• Merge: a no-driver merge-tree onto today's main (10ea9eb2e, after test(spec): record why field.format is never offered by a metadata form #20322) exits 0.
• Governed surface: NOT governed; 1142 changed lines.
• PR body: the seat updated it after the round.

Findings, disposed one line each:

• The cloud mock-protocol double pins a lean { hidden: true } PUT, which is exactly the hide-only shape → carrier: cloud, at its next @objectstack/spec bump. NOT MEASURED here, and noted in the changeset.
• AssembledViewArtifactSchema is a plain union with no identity precondition, so the assembled viewItems channel accepts an identity-only overlay after the strip (measured). It predates this PR (feat(spec)!: retire the view item's owner and hidden keys (ADR-0049) #20227 note 4), and this PR's residue text names the view door only → Acceptance notes; no carrier.
• The claimant pin's blind spot: a second record that also cites the real D3 id passes. A reader sees the contradiction → Acceptance notes.
• The switcher-key lists differ between the body and the changeset. That predates this round → dropped: cosmetic, and no reach.

Next: ready → auto-merge through the relay → merge queue. This card closes on the merge through Fixes.