feat(spec)!: retire the list view's own tabs key; named presets are listViews entries

[objectstack-fleet]

Part of #20301

Clause-②: no (narrowing)

Stage 1 of a staged card: the list view's own tabs key only. #20301 remains open for its second key, the view container's body name, which waits until cloud's writer stops sending it (triage note 2). This PR does not touch the container's name.

What

ListViewSchema.tabs (and the same key on ObjectListViewSchema, a view item record's list config, and the flattened list overlay at PUT /api/v1/meta/view) is retired under ADR-0049 enforce-or-remove. The triage verdict was RETIRE under the maintainer's family criterion: named-view switching is mainstream and is already delivered here by listViews, rendered by the saved-view switcher (ViewTabBar).

• Tombstone. tabs becomes a retiredKey() tombstone inside ListViewShapeSchema only, beside the pageName tombstone on the same strict shape. Authoring it is a tsc error (input type never) and a parse error that carries the prescription: delete the key, and move each tab to a named listViews entry (tab name becomes the entry key, label the entry label, its filter rules join the view's own filter, copy columns).
• ADR-0087. D2 conversion view-list-tabs-removed (protocol 18, retired from the load path) strips the key from every list payload in stack.views[], in all three persisted spellings. D2 chosen: the delete is lossless in pixels because nothing ever read or drew the key, so a stored view row replays without it at every rehydration seam and re-saves through the strict write door instead of being refused there over a key that never had an effect. One D3 entry, list-view-tabs-retired, per ruling B on [Decision] 一次退役，要写一条记录还是两条？—— 迁移条目的 D2/D3 约定，两处成文相互矛盾 #17152, with no tracker number in any author-shown field. RETIRED_KEYS_BY_MAJOR[18] gains ui/ListView:tabs and ui/ObjectListView:tabs. Declared boundary (same as the three sibling list-view conversions): an object's own listViews is reached by no conversion, so such an object is refused at its own door.
• Ledger. The row view.json /props/list/children/tabs stays dead (tombstone discipline), re-verified 2026-09-27, with a REMOVED note. The stale view/list.tabs row leaves undrilled-containers.baseline.json (the tombstone is no longer a container, which check:liveness reported).
• Kit. The metadata form's tabs repeater leaves with the key; the extracted form-label bundles are regenerated (pure deletion, 4 files). Reference docs, authorable-surface/ui.json (two rows become [RETIRED]) and the migration registry are regenerated by their generators. The published objectstack-ui skill's list-view rules stop teaching the key. layout-dsl.mdx stops pointing ViewTab at list views. Changeset: @objectstack/spec minor, BREAKING, FROM to TO table.
• Tests that pinned the retired acceptance were flipped or re-pointed: view.test.ts drops "should accept list view with tabs" and the key from the full-parity fixture; two wire-door tests move their tab carrier to the surviving userFilters.tabs.

ViewTabSchema is not retired: the page-only userFilters.tabs preset bar reuses it and renders. Pinned as a boundary.

Measured first (premise holds)

• What is true, stated first: a list view's own tabs has no reader, and objectui's TabBar, the one component that would draw it, has zero production mounts. userFilters.tabs is a different key with the same element type (z.array(ViewTabSchema)): objectui's UserFilters passes it to TabFilters, which renders it in production as a page list's preset bar, and it stays.
• objectui at the pin f8a9d0fb (.objectui-sha): git grep -E for a TabBar JSX mount = 10 hits in 2 files, both test files (components/__tests__/TabBar.i18nLabel.test.tsx, __tests__/icon-seam-fallbacks-5935.test.tsx); every TabBar import is a test's. Lit control, same instrument and corpus: a ViewTabBar JSX mount in production source = 1 file, packages/app-shell/src/views/ObjectView.tsx (views={viewTabItems}, built from objectDef.listViews). No production .tabs read of a list view anywhere in packages/*/src at the pin. objectui's type mirror (types/src/objectql.ts, tabs?: ListViewSchema['tabs']) and its zod twin import the spec field by reference, so the tombstone flows in on the next pin bump, the pageName precedent; no export is removed here, so the Console Pin Gate build is unaffected.
• This repo at base 4e0f72e8d: zero list-view tabs authorings in examples/ or in platform sources (the 2 tabs: hits in examples/ are a page userFilters preset bar and a record-page slot); control: listViews: authored in 9 example files. The one published skill example that taught the key (skills/objectstack-ui/rules/list-views.md) is corrected here. No platform writer sends it.
• Readers in this repo: two author-time reference walks read the key off RAW input (packages/lint/src/validate-list-view-field-refs.ts#checkTabs, computeViewReferenceDiagnostics in packages/metadata-protocol/src/metadata-diagnostics.ts). Neither draws a tab bar; the ledger already graded them as not delivering the key's effect. Left in place, see Acceptance notes. packages/lint/src/validate-capability-references.ts:186 (a generic rec.tabs walk) does NOT reach a list view: its walk starts at stack.apps[*] and descends only an app node's navigation / areas / tabs / children / items, so it never visits a view. A third reader, found by CI and not by the pre-change census: the derived reference-site index behind findReferencesToMeta (the Studio "Used by" panel) walks each type's schema, and listViews.*.tabs[].view (a ViewTab naming a list view) was the ONLY property under object spelled as a view reference. With the key retired the walk finds none, so a view's "Used by" scan no longer reads object rows. Measured by an ablation of the tombstone over the object input schema: 1 view-spelled path now (listViews.*.navigation.view, itself retired), 2 with the tombstone removed (plus listViews.*.tabs[].view). No such reference is authorable any more; a stored object row still carrying one is refused at its own door (no conversion reaches an object's listViews).
• hotcrm's inert-key test (lint: liveness-dead-property and liveness-live-elsewhere-property cannot fire on 17.3.0 — 90 dead + 1 live-elsewhere ledger rows and not one sets authorWarn #16094) is inherited, NOT MEASURED here (out of this seat's repo scope). Cloud: NOT MEASURED here; the card's census at cloud 96eb092 names cloud writers for view.name only.

Ablation (the tombstone is what shuts every door)

Run on committed HEAD 74f8ab9727 with node scripts/ablation-replace.mjs (wrap mode, restore armed on EXIT/INT/TERM) against packages/spec/src/ui/view.zod.ts:

• mutation landed on disk: anchor tabs: retiredKey( x1 to x0, replacement (tabs back to a plain ViewTab array, the tombstone parked on a dummy key) x0 to x1, blob b64e9996f3fc to 90f0a141e429;
• vitest run src/ui/view-list-tabs-retirement.test.ts: 11 failed, 18 passed (29). Red: the refusal at all seven doors, the empty-array pin, the prescription pin, the parse-channel half of the tsc pin, and the object-door boundary. Still green, as expected: the D2 conversion, registration, form, userFilters.tabs boundary and absence pins, which do not depend on the tombstone. Direction observed: turned red;
• restore proven by bytes, not exit code: blob after restore b64e9996f3fc equals the HEAD blob, git diff HEAD empty, tombstone anchor count 1, mutant count 0.

The tsc door is proven by the positive run: check:test-typecheck is green with an @ts-expect-error on the tabs line of a defineView call, and an unneeded directive is itself a TS2578 in that same program. It was not separately ablated under tsc.

Verification

Rework round 1, head 606046e96a. The at-tier review failed on the truth of two sentences; the retirement itself stood. (1) "The one component that reads a ViewTab[] has zero production mounts" was false, because userFilters.tabs is a ViewTab[] that TabFilters renders. It now reads: a list view's own tabs has no reader, and TabBar, the one component that would draw it, has zero production mounts; userFilters.tabs is read, rendered, and stays. Corrected in the changeset, the tombstone docblock in view.zod.ts, both retired-key entries, the conversion docblock, the step-18 rationale, the ledger note, the pin's header, and this body. (2) "examples, skills or platform sources" now reads "examples or platform sources", plus the note that the one published skill example that taught it is corrected here. main merged at d0003a10c7 with scripts/pm/os-regen-merge.sh: the hand-written registry tails conflicted with #20251 and both sides were kept, main's first. That also repaired a join from the previous merge that had dropped a period and space before this PR's rationale sentence. The object reference page was regenerated at 8845cb564e, and the prose corrections landed at c9f81fa132. main moved again (the RLS policy tags retirement) and was merged at 606046e96a, again keeping both registry tails, main's first; the migration registry regenerated byte-identically. Checks at c9f81fa132: spec build + check:generated all 15 up to date; check:liveness, check:adr-0087-registration, check-changeset-no-major, check-empty-changeset, check:doc-authoring, check:nul-bytes, check:issue-citations, spec docblock anchors, comment-mask adoption and check:cross-package-test-inputs all exit 0; the changeset's Clause-②: no (narrowing) line reads back as declared. Targeted spec tests at c9f81fa132: 5 files / 863 tests passed (view-list-tabs-retirement, conversions, migrations, view, retired-key-migrate-sentence). At 606046e96a: the source-reading spec gates (check:migration-registry, check:spec-changes, check:upgrade-guide, check:liveness, check:authorable-surface, check:docs), check-comment-mask-corpus and check:query-options-erasure all exit 0. The shared verify lock was not acquired for a local post-merge spec rebuild. CI on 606046e96a: 35 check runs, 33 success and 2 skipped, including TypeScript Type Check (the generated-artifact gates), Test Core 6/6 and Lint & Repo Gates. Derived gates at 606046e96a: 122, 114 run green, 8 NOT MEASURED. Five of those lost their build prerequisites when a local turbo rebuild was OOM-killed on the shared box: check:doc-formula-expressions, check:doc-security-posture, check:skill-examples, check:docs-transcript-drift and check:lean-entry-closure, all green at a3f8054dcc and covered by CI. The other three are check:i18n, check:dual-build-cjs-loads and check:type-check-debt.

CI repair round, head a3f8054dcc (main merged again at bfa765ca08, reference pages regenerated at c13e610ab5). Four consumer pins of the retired key, in packages the first round did not run, moved to the post-retirement truth, none weakened: repeater-row-properties.test.ts now asserts view:tabs ABSENT beside the two surviving view repeaters; object-lifecycle-panel-echo-decisions.test.ts positive control 608 to 598 (the repeater's label plus its nine row labels), with the reason in the pin's comment; protocol.graft-normalized-operators.test.ts keeps its view-filter leg and moves the nested ViewTab.filter leg to the surviving userFilters.tabs carrier; protocol.read-seam-empty-accumulator.test.ts reads the consulted source types from the derived index and pins object absent (see Measured first). Full suites at a3f8054dcc: @objectstack/platform-objects 55 files / 911 tests passed; @objectstack/metadata-protocol 189 files passed, 3 skipped (pre-existing) / 2736 tests passed; @objectstack/lint 112 files / 4640 tests passed; @objectstack/objectql metadata-diagnostics.test.ts 10 passed. Derived gates: 122, 119 run green, 3 NOT MEASURED (check:i18n: its CLI prerequisite build never acquired the shared lock, green at baa383008b on the same bundles; check:dual-build-cjs-loads; check:type-check-debt).

First round, at merged HEAD baa383008b unless stated.

• pnpm --filter @objectstack/spec build then check:generated: All 15 generated artifacts are up to date (migration registry, spec-changes, upgrade guide, authorable surface, api-surface, docs, liveness counts, test-typecheck and the rest).
• pnpm --filter @objectstack/spec typecheck: exit 0 (tsc, scripts typecheck, and test typecheck: 53 files / 255 errors / 142 pinned signatures held, unchanged).
• pnpm --filter @objectstack/spec test (local project): 554 files passed, 16426 tests passed, 1 todo.
• Repo project: full test:repo at 74f8ab9727: 34 files, 633 tests passed. After merging main again (the flattened-overlay owner / hidden retirement landed and conflicted only in the two hand-written registry tails; both sides kept), targeted rerun of the two repo-project retirement pins at baa383008b: 2 files, 47 tests passed. Declared narrowing: the other 32 repo-project files were not rerun after that merge; CI runs them.
• i18n: node scripts/check-i18n-bundles.mjs --write regenerated the four metadata-forms bundles; pnpm check:i18n exit 0.
• Derived gate families (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, reconciled with --ran): 121 derived, 119 run, 2 NOT MEASURED, 0 unrun. Named in the dispatch and green: check:liveness, check:migration-registry, check:generated, check:spec-changes.
• NOT MEASURED: check:dual-build-cjs-loads (exit 3, needs a full workspace build), check:type-check-debt (repo-wide tsc re-measure of every package exceeded the foreground cap on a shared box).
• check:dts-closure exit 1 on tree state, not on this diff: five packages this PR does not touch (cloud-connection, organizations, plugin-approvals, plugin-dev, verify) hold JS-only dist/ in this worktree after a shared turbo cache replay during an unrelated closure build; the same gate was exit 0 at 74f8ab9727 before that build. CI builds fresh.
• Lint, narrowed and proven: eslint --no-inline-config --format json over the 15 changed JS/TS files: 15 files, 0 errors, 0 warnings, none ignored. Population is pnpm lint (eslint . --no-inline-config, eslint.config.mjs); invariance: that config enables no type-aware linting (no parserOptions.project, stated in eslint.config.mjs), so this diff cannot move any untouched file's verdict.

Governed surface: Tier H

skills/objectstack-ui/rules/list-views.md is under skills/**, so this PR is Tier H: it lands only by the maintainer's hand or an authorized approval. No generated file under skills/** changed.

Readings for the skills/** edit (lines): the edited file 309 to 302 (net -7, pure deletion: the list-level tabs example and a rule that described a tab bar that never rendered, replaced by a 3-line listViews pointer). Whole pack, all 10 skills/**/SKILL.md: 4402 to 4402 (no SKILL.md edited).

Acceptance notes

Out of this card's file surface, noted and not filed (dead code class; carrier named):

1. The two author-time walks above still read a list view's tabs off raw input, and their test fixtures still author it (packages/lint/src/validate-list-view-field-refs.test.ts, packages/objectql/src/metadata-diagnostics.test.ts, plus the CLI's negative i18n pin packages/cli/test/i18n-tab-coverage.test.ts). After this PR the parse refuses the key first, so those branches are unreachable for valid input. The tree-scoped absence pin declares these three files as self-expiring residue: each is asserted to still hold an offender, so the day a follow-up deletes the walks, the pin forces the entry out. Carrier: none named.
2. packages/cli/src/utils/i18n-extract.ts and packages/lint/src/validate-translation-references.ts carry prose that says the list view's own tabs "has no reader"; still true, now for a stronger reason. Carrier: none named.
3. objectui at its next pin bump: types/src/objectql.ts keeps tabs?: ListViewSchema['tabs'] (becomes undefined-typed) and its parity tests may want the row updated. Carrier: the objectui pin-bump PR.

维护者速读(草稿)

改了什么
列表视图上的 tabs 字段被正式退役。以后在列表视图里写 tabs,类型检查和保存都会直接报错,错误信息会告诉作者改用 listViews(每个命名视图就是切换条上的一个页签)。存量数据里残留的这个字段,升级时会被自动删掉。

为什么改
这个字段一直能写、能存,但没有任何代码读它,界面上也从来没有画出过任何东西:本来要画它的那个页签组件在正式代码里一次都没被用上;真正显示在记录列表上方的页签条,是按 listViews 逐个列出的已存视图。页面筛选栏里的 userFilters.tabs 是另一个字段,照常显示,不受影响。同一个能力两种写法,其中一种完全无效,AI 和作者都容易写错。按“主流平台已有、本平台已交付 ⇒ 只保留一种写法”的判据退役。

风险与代价(含回滚)
属于破坏性变更:外部仓库里若有人写了这个字段,升级后会被拒绝(报错里带修改方法)。本仓示例与平台代码实测零使用,唯一教过这种写法的已发布技能示例已在本 PR 中改正;外部使用面未测量。存量数据自动清理,不影响任何已有画面。回滚:revert 本 PR 即可恢复该字段。

席位意见

你要做的
本 PR 触及已发布技能目录(skills/**),属于 Tier H,需要你本人批准后才能合并。

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/spec, touching 19 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/spec/authorable-surface/ui.json, packages/spec/liveness/view.json, packages/spec/src/migrations/entries/retired-keys/18.ui__ListView__tabs.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

9 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via isDefault (literal, a string literal in sections))
• content/docs/permissions/authorization.mdx (via isDefault (literal, a string literal in sections))
• content/docs/permissions/permission-metadata.mdx (via isDefault (literal, a string literal in sections))
• content/docs/permissions/permission-sets.mdx (via isDefault (literal, a string literal in sections))
• content/docs/permissions/positions.mdx (via isDefault (literal, a string literal in sections))
• content/docs/permissions/profiles.mdx (via isDefault (literal, a string literal in sections))
• content/docs/protocol/objectui/layout-dsl.mdx (via isDefault (literal, a string literal in sections))
• content/docs/ui/apps.mdx (via isDefault (literal, a string literal in sections))
• content/docs/ui/pages.mdx (via isDefault (literal, a string literal in sections))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via isDefault (literal, a string literal in sections))
• content/docs/releases/v13.mdx (via isDefault (literal, a string literal in sections))
• content/docs/releases/v15.mdx (via isDefault (literal, a string literal in sections))
• content/docs/releases/v17/17-0.mdx (via isDefault (literal, a string literal in sections))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/spec/authorable-surface/ui.json, packages/spec/liveness/view.json, packages/spec/src/migrations/entries/retired-keys/18.ui__ListView__tabs.ts, …) — pages documenting those are invisible to this run
• 10 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c745e2b896ba2c9382ecd208a40799a44226cddb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d564f7e7c4678aa81d86dda17119509af76860fd — the merge of head c1c3ec90ddbc149d1d1515f693a887961b893cc8 into base c745e2b896ba2c9382ecd208a40799a44226cddb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d564f7e7c4678aa81d86dda17119509af76860fd && git checkout d564f7e7c4678aa81d86dda17119509af76860fd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c745e2b896ba2c9382ecd208a40799a44226cddb c1c3ec90ddbc149d1d1515f693a887961b893cc8 && git checkout -B drift-repro c745e2b896ba2c9382ecd208a40799a44226cddb && git merge --no-ff c1c3ec90ddbc149d1d1515f693a887961b893cc8

node scripts/docs-audit/affected-docs.mjs --json c745e2b896ba2c9382ecd208a40799a44226cddb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c745e2b896ba2c9382ecd208a40799a44226cddb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 80/80 CONTRACT_REVIEW_TIER
Head-sha: a3f8054dccc3ff3814363139c34b0d50ef88ddb8

① Derived judgments

BLOCKING (item 6, changeset truth) — two sentences in .changeset/list-view-tabs-retired.md are false by the PR's own other statements:

• "the one component that reads a ViewTab[] (objectui's TabBar) has zero production mounts": objectui packages/plugin-list/src/UserFilters.tsx reads config.tabs (:225) typed ListViewSchema['userFilters']['tabs'] (:756), i.e. a ViewTab[], and renders it in production; the changeset itself says the preset bar renders. Fix: "the one component that reads a list view's own tabs". Same phrase in comments (view.zod.ts:2776, migrations/registry.ts x2, both retired-key entries, conversions/registry.ts:10574, test header) — align, non-blocking.
• "Zero list views in this repo's examples, skills or platform sources authored the key": at base skills/objectstack-ui/rules/list-views.md:127 authored tabs: [ in a list-view snippet (the hunk this PR deletes; ledger note and PR body admit it). Fix: "examples or platform sources; the one published skill example that taught it is corrected here".

1. Premise holds. objectui f8a9d0fb: <TabBar JSX = 10 hits, all in plugin-list/src/__tests__/icon-seam-fallbacks-5935.test.tsx and components/__tests__/TabBar.i18nLabel.test.tsx; zero production imports. Lit control: <ViewTabBar at app-shell/src/views/ObjectView.tsx:3242, fed from objectDef.listViews (:1787). In-repo: no production read of a list view's tabs except the raw-input author-time walks (below); examples/ tabs: = a record-page slot and task-triage.page.ts:35 userFilters.tabs; control listViews: in 9 example files. No platform writer sends it.
2. Refusal true at every door. retiredKey() = z.never({error}).optional() (retired-key.ts:113) inside ListViewShapeSchema; ObjectListViewSchema = shape .omit({userFilters}) (:4613) keeps it; flattened overlay is ListViewShapeSchema.extend (:5884). Pin covers 7 doors (ListView, ObjectListView, view.list, listViews.*, ViewItem config, ViewMetadataSchema PUT overlay, ObjectSchema.listViews) asserting invalid_type/expected never/path/prescription, each with a lit control; getMetadataTypeSchema('view') === ViewMetadataSchema pinned; tsc via @ts-expect-error under CI TypeScript Type Check. Page/component carriers: InterfacePageConfigSchema is its own strictObject with userFilters: UserFiltersSchema; page.zod.ts:882 tabs is a record slot — no such door exists. Guidance follows all five house conventions; 17.5.0 matches siblings (pageName :2296, owner :4857) with package at 17.4.0.
3. D2 lossless and reach declared. mapViewPayloads walks list/listViews/form/formViews, ViewItem config, flattened overlay; stripKeys copy-on-write; fixture 3 notices; idempotence and load-path retirement pinned. objects[].listViews.* unreached — same declared boundary as the three sibling conversions (registry.ts:9728, 9835, 10600). Read seams (database-loader.ts:825, protocol.ts:4782, objectql plugin.ts:2107) replay and do NOT parse, so a stored object row keeps its inert key and is served as before (nothing lost, nothing drawn); the strict write door refuses with the prescription on next save; os migrate meta --from 17 (chain.ts:85, replays by id, no retired filter) lists view edits only. Loud at write, not silent loss; out-of-repo population NOT MEASURED, stated. D3 list-view-tabs-retired: no #\d in surface/replacement/reason/acceptanceCriteria, pinned by the PR's test (the widened engine-guidance pin holds only engine-/ui-/plugin- prefixes, so it does not hold this id); content true to the mechanism.
4. Skills hunk. 309 → 302, pure deletion plus a 3-line listViews pointer; the replaced "tabs win over dropdowns" rule described a bar that never rendered. Remaining tabs in skills/**: userFilters element (page-only), record-page slot, relatedLayout, navigation.md:61 switcher tabs = listViews — none teaches the retired key. objectstack-i18n/SKILL.md:166 _tabs row describes a surviving translation key (flagged in ③).
5. Pins moved, none weakened. repeater-row-properties: carrier moved out plus dark assertions (view:tabs absent, no view:tabs.* rows). echo-decisions: 608 → 598 = repeater label + 9 row labels, matching 10 label: lines deleted per bundle. graft-normalized-operators: leg moved to userFilters.tabs plus two ride-through asserts. read-seam-empty-accumulator: remembered list replaced by the derived REFERENCE_SITES population plus explicit object absent. Consequence correct: object's only view-spelled site was listViews.*.tabs[].view; navigation.view is itself a tombstone (:2131); page stays a source via userFilters.tabs[].view. Complete under the index's exact-name rule.
6. Generated artifacts are generator-shaped (8 reference rows to never + [REMOVED], 2 nested-shape sections gone, 4 bundles −31 lines, 2 [RETIRED] rows, registry tails); CI Lint & Repo Gates, Spec property liveness, Check Changeset green at head. Changeset: minor, BREAKING, FROM → TO, one-line fix, adr-0087 marker — except the two false sentences above.

② Semver level

minor with BREAKING banner is correct: the accept set narrows (a parsed key becomes a refusal), nothing widens. Clause-②: no (narrowing) stands alone in the changeset and PR body; per scripts/pm/clause2-line.mjs that arm reads "not a widening, but breaking", AGENTS.md:1075 makes (narrowing) BREAKING, and check-changeset-no-major refuses major (CI Check Changeset green).

③ Boundary flags

• Container body name: correctly deferred — no ViewSchema.name edit; waits on cloud's service-ai writer per triage note 2.
• Dead author-time walks left: lint/src/validate-list-view-field-refs.ts:795 (checkTabs(listView.tabs…)), metadata-protocol/src/metadata-diagnostics.ts:231 (view?.tabs); a third generic rec.tabs walk at lint/src/validate-capability-references.ts:186 was not named by the PR. Their fixtures are the pin's self-expiring RESIDUE.
• objectui pin bump: packages/types/src/objectql.ts:2538 tabs?: ListViewSchema['tabs'] becomes undefined-typed; also objects.*._tabs (translation.zod.ts:385) now has no authorable object-level subject and no reader in either repo, yet the i18n skill row still teaches it — follow-up, not this card.
• git merge-tree --write-tree vs origin/main ab946560fd is NOT clean: content conflicts in packages/spec/src/conversions/registry.ts and packages/spec/src/migrations/registry.ts hand-written tails against feat(spec)!: retire currencyConfig.precision — a currency's decimal places are its currency's (ADR-0049) #20251 (currency-config-precision-removed); PR object reads mergeable_state: dirty; needs a main merge plus gen:migration-registry and gen:docs.

Implemented-by: claude/issue-20301-list-tabs-retired
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: FAIL

[objectstack-fleet]

Post-landing delta audit · PR #20357 merged at c1c3ec90dd without a record at that head · director seat (objectstack#12708, session_01AsCNgFBs8HCjwhyHQsFbx3) · 2026-09-28T14:24Z

What happened. The last contract-review record on this PR is the PASS 5866560959 at 606046e96a. os-zhuang approved at 2026-09-28T11:56Z on head b751fc7842. Five commits followed the PASS head (ec79ac04 and b4c624aa conflicted main merges, b751fc78 and 8ca08e04 regens, c1c3ec90 a clean merge; the last three after the approval), and the PR was merged through the relay at 2026-09-28T13:20Z (6e3e5462c6) with no record at c1c3ec90dd. Tier H (skills/**). Logged on the seat ledger as 漏网; this note is the audit the landing owed.

Measured (read-only: git diff <merge-base> <head> per file at both heads, index lines ignored):

• File list: 29 files at 606046e96a (merge-base df3ba164a5) and the same 29 at c1c3ec90dd (merge-base c745e2b896); no file added or dropped. skills/objectstack-ui/rules/list-views.md is byte-identical between the two.
• 17 files: PR-own diff byte-identical.
• 12 files: differ only by hunk offsets (the base moved) or by context lines that are main's own newer content: the three reference pages, the four generated form-label bundles (the same 31-line deletion at a new offset), undrilled-containers.baseline.json, vitest.repo-tests.json, and the two hand-written registry tails, where main's action-aria-removed and flow-decision-mode-inclusive-explicit entries now sit beside this PR's view-list-tabs-removed (both sides kept, main's first, as the earlier records describe).
• The one hand-resolved conflict, object-lifecycle-panel-echo-decisions.test.ts: the positive control moved from 598 to 623 because main's own count moved from 608 to 633 through other landings; this PR's delta is unchanged at −10, the ten label: leaves the retired repeater took with it.
• CI at c1c3ec90dd: 35 success / 4 skipped / 0 failure (the Type Check gates, Lint & Repo Gates, Spec property liveness and Test Core 6/6 included).

Verdict: the merged head's PR-own change equals the PASS head's change modulo base movement; nothing rode on the missing record. Residue for the fleet, not for this PR: objectui's Spec Main Shape Gate went red on every objectui PR when this landed (packages/types/src/__tests__/p1-spec-alignment.test.ts compiles against objectstack main); stop-the-bleed objectui#10987 → PR objectui#10992. That is the objectui residue the PASS record's ③ named, arriving through the shape gate rather than the pin bump.

Reviewed-by: session_01AsCNgFBs8HCjwhyHQsFbx3