chore(objectui): bump the console pin past objectui `39a3e91fad` — it carries objectui#11636 (objectui#11092), which unlocks #20318

[objectstack-fleet]

Unblocks: #20318

Filed by the triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U. It is the foreseen follow-up of a blocked card whose unlock is the install face, the same shape as #21772. ⛔ Not a claim, ⛔ not a dispatch.

Why

#20318 (the flow launcher and runner header read the flow's translated label) waits on objectui#11092, and the cross-repo unlock reads .objectui-sha, not objectui's main:

card	waits for objectui	merge on objectui main	in .objectui-sha 9dfaca654311?
#20318	PR #11636, which fixes objectui#11092	39a3e91fad	no: the pin is 4 commits behind main

objectui#11092 closed completed, so the blocker the audit reads is closed while the install face still lacks the fix.

The step

• Bump .objectui-sha to an objectui main commit at or after 39a3e91fad, through scripts/bump-objectui.sh and the pin gates, as chore(objectui): bump the console pin past objectui c096f03 — it carries objectui#11611, #11614 and #11619, which unlock #21714, #21765 and #21768 #21772 did (PR chore(objectui): bump the console pin to 9dfaca654311 (carries objectui#11611, #11614 and #11619) #21800).
• The range also carries objectui c4c506b9e2 (RestApiConfigSchema constrains api.version with a regex the REST server never runs — the seam casts instead of parsing, so api.version: '' is accepted and mounts the whole API at /api// #11637, objectui#11170), 22ddcd5c54 (driver-sql: boolean aggregands need a lowering cast on PG (+ a MySQL min/max presentation check) — the ruled false/true + arithmetic answers are unproducible on the PG face #11635, objectui#11095) and 1c2e2c46c8 ([finding] os lint now demands flows.* translation keys and warns the author for writing them — #11615's new bucket collides with the planned liveness row's authorWarn #11624, objectui#11396). Their objectstack-side readers are re-measured by check:objectui-pin-citations in the same PR.
• After it lands, i18n: the flow launcher and runner header read translation.flows.<flow>.label (1 key) #20318 is unlocked by the triage audit (Blocked-by: this card).

Grade

tooling · priority:p3 (it inherits #20318's p3) · domain:devx · area:devpath · pm:queue. The first line carries Unblocks: (triage-duties.md line 34).

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 60
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-21807-objectui-pin-bump (cut from origin/main 18c7dfd2e6)
Worktree: objectstack-issue-21807
Domain: domain:devx
Seat: domain:devx#1
File surface: the card's step, on the route of #21772 / PR #21800 and #21696 / PR #21710.

• .objectui-sha, moved through scripts/bump-objectui.sh to objectui main at claim time, at or after 39a3e91fad. The pin at the claim ref is 9dfaca6543.
• The records the bump's own gates require, regenerated with the repo's tooling and never by hand:
  • every asserting pin citation the bump moves, re-measured with check:objectui-pin-citations --verify-anchors;
  • the lockstep and SDUI manifest records.
• One bump .changeset. It answers the ADR-0087 disposition for each declared-breaking entry in the range, measured, not read from the card's list.
• A short browser smoke of the console at the new pin, on the surfaces the range touches: the flow launcher and the runner header label (objectui#11092), plus whatever the range's other landings change.
• ⛔ No objectui edit. ⛔ No ride-along code change beyond what the bump's gates require. ⛔ No release act; version PR chore: version packages #21352 is the maintainer's.

Stop on a breach and explain it in the report. That includes a gate that needs a code change outside the bump's records, and a smoke that cannot run. In either case, report the exact blocker, not a partial PASS.
Container & model: M (pin bump, generated records, changeset, one browser smoke), mode:subagent, model: opus
Clause-②: no
Thread-read: none
Serial constraints cleared: board read at 2026-10-05T04:51Z. No open PR touches .objectui-sha. #21772 (PR #21800) has landed. Release ordering is the maintainer's: #21772 already moved the pin ahead of the 17.7.0 version PR, and this bump is the next step on that same line.

Priority rule 3 reading: domain:devx has no open P0/P1. This is a p3 that unblocks #20318. A .changeset is a review face, so a same-form contract-review record on the landing head is owed before enqueue.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21807,
  "status": "done",
  "branch": "claude/issue-21807-objectui-pin-bump",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21827",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "head_sha": "e40526e564d9ed123f5d40d6a0d7b646fdbfadbf",
  "new_pin": "0abd4f9f8769fc4c19ad2f96707684876f74c09f",
  "range_count": "5 commits, 0 merges (9dfaca654311..0abd4f9f8769); 5 changesets: 3 releasing, 2 release-nothing; highest level minor",
  "summary": "The .objectui-sha pin moves from 9dfaca654311 to 0abd4f9f8769, which was objectui main at 2026-10-05T04:53:29Z and is past 39a3e91fad. It moved through scripts/bump-objectui.sh with OBJECTUI_ROOT set to a read-only scratchpad clone. The 54 asserting pin citations were re-measured: no cited objectui file is among the range's 50 changed paths. The three count-bearing records and the migration corpus counts were re-taken with their own methods, after first reproducing the 9dfaca654 numbers. The SDUI manifest, its record and the lockstep record were regenerated with repo tooling, and a console minor changeset plus a spec patch changeset were written. The Console was built clean at the pin with the spec-injection check passing. The browser smoke shows the runner header and the completion toast naming the flow by its translated label (zh-CN) and by its served label (en).",
  "files_changed": [
    ".changeset/console-0abd4f9f8769.md",
    ".changeset/objectui-pin-citations-0abd4f9f8769.md",
    ".objectui-sha",
    "content/docs/references/ui/view.mdx",
    "packages/sdui-parser/objectui-lockstep.json",
    "packages/spec/src/data/api-methods-batch-conformance.test.ts",
    "packages/spec/src/kernel/functional-completeness.ts",
    "packages/spec/src/migrations/entries/semantic/18.kernel-health-check-and-hot-reload-durations-unit-in-key.ts",
    "packages/spec/src/migrations/entries/semantic/18.kernel-runtime-config-timeout-unit-in-key.ts",
    "packages/spec/src/migrations/entries/semantic/18.logging-durations-unit-in-key.ts",
    "packages/spec/src/migrations/entries/semantic/18.system-metrics-jsdoc-durations-unit-in-key.ts",
    "packages/spec/src/migrations/entries/semantic/18.system-tracing-otel-exporter-durations-unit-in-key.ts",
    "packages/spec/src/migrations/entries/semantic/18.tenant-schema-cache-ttl-unit-in-key.ts",
    "packages/spec/src/migrations/registry.ts",
    "packages/spec/src/ui/action-outcome-messages.test.ts",
    "packages/spec/src/ui/action.zod.ts",
    "packages/spec/src/ui/component.test.ts",
    "packages/spec/src/ui/component.zod.ts",
    "packages/spec/src/ui/dataset.zod.ts",
    "packages/spec/src/ui/view.zod.ts",
    "scripts/sdui-manifest.record.json",
    "sdui.manifest.json"
  ],
  "breaking_entries": [],
  "breaking_note": "No commit subject in the range carries an exclamation mark (the grep exits 1), and no changeset declares major or the breaking annotation. check-adr-0087-registration reports 'this PR adds no declared-breaking changeset'. objectui#11170 (c4c506b9e) declares Clause-② yes (narrowing). It is answered in the PR body as not-required: it is objectui's own validator reach, no ObjectStack-authorable key moves, and this repo's manifest is generated without slotsFor (0 slots keys).",
  "gates_run": [
    {
      "cmd": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (127 commands, each run at e40526e564)",
      "result": "127/127 exit 0; --ran: 127 derived, 127 run, 0 NOT-MEASURED, 0 UNRUN"
    },
    {
      "cmd": "OBJECTUI_ROOT=clone check-objectui-pin-citations.ts --verify-anchors",
      "result": "exit 0; 54 asserting match 0abd4f9f8; 7 anchor content assertions verified"
    },
    {
      "cmd": "pnpm check:sdui-lockstep (after gen:sdui-lockstep)",
      "result": "exit 0; 214 lines blob 0131f27cf86d, 25 codes, predicate 76c18fb95d1f unchanged"
    },
    {
      "cmd": "OBJECTUI_ROOT=clone node scripts/check-sdui-manifest.mjs --require-objectui",
      "result": "exit 0; 107 components, sha256 f95d406a584e, version 17.7.0 confirmed at pin"
    },
    {
      "cmd": "pnpm check:console-sha / check:console-injection / check:objectui-bump",
      "result": "all exit 0 (bump self-test 20 assertions across 5 cases)"
    },
    {
      "cmd": "check-adr-0087-registration --base origin/main; check-changeset-no-major --base origin/main",
      "result": "exit 0 both"
    },
    {
      "cmd": "pnpm --filter @objectstack/spec check:generated (after --fix regenerated view.mdx)",
      "result": "exit 0, 15 artifacts current"
    },
    {
      "cmd": "pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2",
      "result": "668 files, 19261 passed, 1 todo"
    },
    {
      "cmd": "pnpm --filter @objectstack/spec typecheck",
      "result": "exit 0"
    },
    {
      "cmd": "@objectstack/sdui-parser test + typecheck",
      "result": "14 files 225 passed; typecheck exit 0"
    },
    {
      "cmd": "@objectstack/lint vitest",
      "result": "119 files 5627 passed"
    },
    {
      "cmd": "@objectstack/metadata-protocol src/protocol.runtime-authoring-gate.test.ts",
      "result": "70 passed"
    },
    {
      "cmd": "@objectstack/cli unit: src/utils/sdui-manifest.test.ts test/validate-build-gate-parity.test.ts",
      "result": "2 files 79 passed; integration tier declared to CI"
    },
    {
      "cmd": "eslint --no-inline-config --format json on 15 changed TS files",
      "result": "15 files, 0 errors, 0 warnings; population eslint.config.mjs:971, no type-aware linting (:328)"
    }
  ],
  "console_pin_gate_local": "PASS. turbo build of the client and spec closures, then pnpm objectui:build (mode 3, a clean shallow clone at the pin), under the verify lock: exit 0 in 10m51s. The log shows the bundle canary import/jobs present, the single-zod canary {major:4,minor:6,patch:5}, 'Console bundle carries THIS tree's @objectstack/spec, and only it' (the spec-injection check passes), and 'dist ready (64232 KB) from objectui@0abd4f9f8769'.",
  "smoke": {
    "flow_label": "PASS. en: the trigger answers 200 paused with flowLabel 'Reassign Task'. The runner header line reads 'Reassign Task', the dialog title is still the screen title 'New Assignee', the API name is not shown, and the toast reads 'Flow \"Reassign Task\" completed'. zh-CN, with a temporary held bundle entry flows.showcase_reassign_wizard.label (restored to HEAD blob f0517049b565, git diff HEAD empty, dist rebuilt, 0 hits): the header reads '重新分配任务' and the toast reads '流程「重新分配任务」已完成'. The showcase bundle declares no flows translations of its own.",
    "other": "objectui#11640/#11628: the External Datasource panel lists customers and orders (7 columns each). Refresh catalog shows the snapshot time, and Run validation renders 'All 2 objects match the remote schema.' with no render error. objectui#11624/#11396: the project workspace master-detail form renders, and Add task opens the child's inline form (14 fields). objectui#11637/#11170: the three kind:'html' pages render with no compile or validation text. objectui#11635/#11095: the three dashboards render, with the ops tiles at 2/1/2/1,090,000. The invalidation re-read is NOT MEASURED: an out-of-band REST PATCH does not travel the console's bus, and that landing is test and doc only.",
    "console_errors": "0 page errors. The failed loads are 401 GET /api/v1/auth/get-session (pre-login probe), one unattributed 404 per load (root /favicon.ico answers 404), and 404 GET /api/v1/meta/datasource/showcase_external?state=draft (draft probe, no draft).",
    "blocker": null
  },
  "changesets": [
    {
      "file": ".changeset/console-0abd4f9f8769.md",
      "bump": "@objectstack/console minor"
    },
    {
      "file": ".changeset/objectui-pin-citations-0abd4f9f8769.md",
      "bump": "@objectstack/spec patch"
    }
  ],
  "tests": "See gates_run. All were run at head e40526e564 (the final commit). The smoke ran on a Console built at the pin.",
  "mcp_calls": "0",
  "api_writes": "3 — git push to claude/issue-21807-objectui-pin-bump (not REST); relay pr_create POST /repos/objectstack-ai/objectstack/pulls (PR #21827, body read back identical, 17434 bytes); relay comment POST /repos/objectstack-ai/objectstack/issues/21807/comments (this report)",
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed — sdui-parser lockstep walk depth. objectui#11170 gives objectui's validateTree a slot walk (slotElements plus the comp?.slots loop), and this repo's port has none (git grep slots packages/sdui-parser/src: 0). The walk fires only for a manifest built with slotsFor, and this repo's committed manifest carries none, so the save gate and objectui's parser agree on it. But objectui's kind:'html' compile (getJsxManifest) is built with slotsFor, so a slot-held invalid node could fail the renderer compile while the save gate accepts it. check:sdui-lockstep cannot see walk depth. No public-door reach was measured, so this sits in Acceptance notes. Dedupe words: sdui lockstep slots, validateTree slot walk, nodeSlotsFor, getJsxManifest slotsFor"
  ],
  "breaches": [],
  "open_questions": [],
  "notes": "objectui main moved to 59917c4b2 (objectui#11639) after the pin was read; it is not in this range. main moved 3 commits past the branch base (#21810, #21808, #21809). merge-tree is clean, and the merged tree keeps 1 and 6 citations at the new pin in the two overlapping files. No merge was made. No label, assignee, ready flag or auto-merge was written."
}

---

Generated by Claude Code

[objectstack-fleet]

Landed: PR #21827 → 8832655af2, verified on origin/main by content at 2026-10-05T07:22Z.

• 18 of the 22 files on main are blob-identical to the landing head e40526e564, among them .objectui-sha, both changesets, sdui.manifest.json, scripts/sdui-manifest.record.json, packages/sdui-parser/objectui-lockstep.json and view.mdx.

• The other 4 were also edited on main after the branch base 18c7dfd2e6:

  • component.zod.ts (feat(spec): the object-form runtime form field declares the grid widget's eight camelCase keys (#21768) #21825);
  • component.test.ts (test(spec): re-point object-metric icon citation to index.tsx:299 #21808, feat(spec): the object-form runtime form field declares the grid widget's eight camelCase keys (#21768) #21825);
  • registry.ts, api-methods-batch-conformance.test.ts (test(spec): the first data/ file group's test titles state each cited decision in words instead of a tracker number (stage 15) #21810, fix(plugin-security)!: on the write doors, a row the caller cannot read answers what a nonexistent id answers #21812).

  For each, git diff <merge-base> <head> and git diff 8832655af2^1 8832655af2 carry the same stable patch-id, so this PR's change landed intact on top of theirs.

• .objectui-sha on main reads 0abd4f9f8769fc4c19ad2f96707684876f74c09f: objectui main at 2026-10-05T04:53Z, past 39a3e91fad. The range is 5 commits and no merges, from 9dfaca654311.

• Changesets:

  • @objectstack/console minor. The range holds no ! commit and no major. objectui#11170's Clause-②: yes (narrowing) is objectui's own validator reach and moves no ObjectStack-authorable key.
  • @objectstack/spec patch, for citation text only.

• Gates (dev, at the head):

  • 127 of 127 derived gates exited 0;
  • --verify-anchors passed (54 citations);
  • spec 19261 tests passed;
  • the local Console Pin Gate equivalent passed, with the spec-injection check reading "THIS tree's @objectstack/spec, and only it".

• Smoke: the flow runner header and the completion toast name the flow by its translated label: "Reassign Task" in en, 重新分配任务 in zh-CN. That is the reader i18n: the flow launcher and runner header read translation.flows.<flow>.label (1 key) #20318 waits on (objectui#11092 / [finding][spec] Nine flat "rewrite existing sources automatically" sites remain across three published CHANGELOGs — outside #9734's line-specific authorization #11636). The range's other surfaces render, with 0 page errors.

Contract review (review faces: .changeset/**, non-test packages/spec/src/**, content/docs/**): PASS on landing head e40526e564 (5989128397). CI was green, and the merge queue passed.

Unlocks: #20318 (domain:spec, pm:blocked on this card). The triage audit releases it; this seat does not write on it.

Noted, not filed: objectui#11170 gives objectui's validateTree a slot walk that this repo's packages/sdui-parser port lacks. It has no reach today, because the committed manifest carries no slots and the save gate does not pass slotsFor. It becomes a lockstep gap the day this repo's manifest is built with slots.

pm:dispatched removed.

Seat domain:devx#1 · session_01VDtqoecgES7ScQYGbFVDRv

---

Generated by Claude Code