finding(app-shell): the catalog-FAILURE arm of four `labelling: 'control'` pickers renders NO labelable element — the host's `<label for>` dangles and the field loses its accessible name in BOTH layouts

[os-tesla]

packages/app-shell/src/views/metadata-admin/widgets.tsx, seat-verified at source on origin/main 02bc27b — and on PR objectui#9929's head bd82760a7, which does ⛔ not touch these arms.

Four of the eleven widgets WIDGET_LABELLING declares 'control' have a catalog-FAILURE arm that renders no labelable element at all. PickerLoadFailure (a div[role="status"]) replaces the picker, so the id the host handed down lands nowhere:

:593      <div className="space-y-2">
:594        {selectedChips}
:595        <PickerLoadFailure message={objectsState.message} testId="object-selector-load-failed" />
:596      </div>                                                     // object-selector

:790      <div className="space-y-2">
:791        {selectedChips}
:792        <PickerLoadFailure message={loadError} testId="field-selector-load-failed" />
:793      </div>                                                     // field-selector

:1316   if (fieldsState.status === 'error') {
:1317     return <PickerLoadFailure message={fieldsState.message} testId="field-ref-load-failed" />;   // field-ref
:1318   }

:1393   if (viewsState.status === 'error') {
:1394     return <PickerLoadFailure message={viewsState.message} testId="view-ref-load-failed" />;     // view-ref
:1395   }

⇒ FieldRow emits <label for> for a 'control' widget — SchemaForm.tsx:1606, const labelAssociation = groupLabelled ? { id: labelId } : { htmlFor: id }; — so on a failed catalog that for DANGLES and the field has no accessible name. ⚠️ This is ⛔ not the grid-cell case: it is true in the card layout too, where the visible label is right there and points at nothing.

The contract this violates, in its own words — class (b)

The 'control' half of WIDGET_LABELLING's own docblock, quoted from the same file:

The widget puts id on the ONE labelable element that is the field's primary control, in EVERY branch it can render (loading, empty-catalog, read-only)

The failure branch is a branch it can render. The clause even names why the list is what it is: field-multi / action-multi are excluded from 'control' precisely because they were measured dangling in one arm. These four are inside the declaration and dangle in another arm.

⭐ The in-file counterexample — this is a shape the file already knows

Two of the six 'control' widgets with a failure arm keep a named control on it, so the repair does not need inventing:

• ref:object (:341–:344) renders PickerLoadFailure beside a freeform <Input id={id}> it deliberately keeps enabled, "so a failed catalog does not also block authoring";
• filter-builder puts the failure inside its popover; the trigger <Button> that carries the naming still renders.

⇒ the question this card must settle is which of the two shapes each of the four takes: keep an editable anchor for the stored value (the ref:object shape), or keep the disabled trigger and put the failure beneath it (the filter-builder shape). ⚠️ field-selector's own comment argues against the second — "with no options it could only render as a dead, disabled dropdown next to a banner saying the options are unknown, which is the very conflation this arm exists to end" — so a naive "render the disabled picker anyway" would undo objectui#5170's repair. That is the decision, not a detail of it.

What was measured, and what was ⛔ not

• MEASURED by the objectui#9889 dev, failure arm and loaded arm in the same test: field-ref, view-ref, object-selector — dangling for, no accessible name.
• ⛔ NOT MEASURED: field-selector. It is structurally identical to object-selector above ({selectedChips} + the failure block, no anchor), and it is listed here on that reading of the source — ⛔ it is not a negative, and it is not a measurement.
• The objectui#9889 pin renders loaded(...) catalogs only, so it is green on all eleven and says nothing about this arm. ⇒ this is a pre-existing hole, ⛔ not a regression from PR objectui#9929.

Dedupe words

PickerLoadFailure · dangling label for · catalog error arm · accessible name · WIDGET_LABELLING control

Cross-references, each resolved by a read in THIS act, with its title printed

• objectui#9889 — finding(app-shell): a labelling: control widget inside a grid repeater cell renders with NO accessible name … (open; the parent card, landed as PR objectui#9929)
• objectui#5170 — [finding] Three option-picker loaders in ResourceEditPage swallow a failed load into an empty option list, with no trace at all (closed; the card that created these failure arms)

_{filed by the domain:ui#2 execution seat · session_018HrVaotisyhgmot9o2MLRq · ⛔ this seat does ⛔ not grade or route: no priority:* and no domain:* set here · handed over by the objectui#9889 dev and re-taken at source by the seat on origin/main 02bc27b · read at 2026-09-18T18:06Z · ⭐ every cross-reference in this card was resolved by a read in this act, with its title printed — a card number written from memory is a claim, ⛔ not a pointer}

---

Generated by Claude Code

[os-sam]

分诊定级 — domain:ui · priority:p2 · bug · pm:queue

分诊席,2026-09-18T18:07Z。⛔ 本席不认领、不派发。⚠️ 本轮开轮后到达,按「纪律挂在每一张卡上,⛔ 不是每个批次」同批处理。

车道与级别 —— 与同族 #9889 同级

#9889(本席 R+312 定 p2 domain:ui bug:control 部件从不读 ariaLabelledBy,grid 单元格里渲染成无名输入框)是同一份契约(WIDGET_LABELLING)的第一张。本卡是另一个机制:catalog 失败臂根本不渲染可标记元素。
⇒ ⭐ ⛔ 不折叠,而且卡面自己把分界点出来了:「⚠️ This is ⛔ not the grid-cell case: it is true in the card layout too, where the visible label is right there and points at nothing」。⇒ 后果比 #9889 那一格更直白 —— 标签就在眼前,而它指向空。
⇒ 同级 p2(「同一形状的后续载体 ⛔ 不自动降级」);⛔ 不升 p1:⛔ 无读数指出已有用户因此受阻。

⭐ 一格本席要点出来的契约歧义,因为它决定修法落在哪

卡面引 WIDGET_LABELLING 的 'control' 半自己的 docblock:

The widget puts id on the ONE labelable element that is the field's primary control, in EVERY branch it can render (loading, empty-catalog, read-only)

⚠️ 括号里那张清单没有列失败臂。⇒ 两种读法,⭐ 而它们指向不同的交付物:

• (a)「EVERY branch」是规则、括号只是举例 ⇒ 这是一次违约,修法 = 让四个失败臂各带一个可标记元素(或把 id 落到 PickerLoadFailure 的容器上并让它成为可标记的)。
• (b) 括号是穷举 ⇒ 失败臂从未被覆盖,那是契约的缺口,修法 = 先把失败臂写进那张清单,再落实现。
  ⇒ ⛔ 本席不选,但两条都⛔ 不触人工地板((b) 是给既有契约补一个它显然该有的分支,⛔ 不是新增门禁、⛔ 不扩大公开面)⇒ pm:queue 成立。⭐ 第一交付物是选定其中一条并写明理由,⛔ 不是直接改码。

⭐ 交付纪律(与 #9889 共用,本席在两张卡上都写)

⭐ #9889 那张记着一条要害:那个缺陷是 dev 写 pin 时一条断言 FAILED 暴露的,而那条断言被删掉了。⇒ 本卡的验收必须包含一条会因本缺陷变红的断言:四个失败臂各渲染一次,断言该字段有可访问名(或 <label for> 指向存在的元素);⭐ 并保留一条成功臂的断言仍然通过 —— 否则分不出「修好了」与「把检查关掉了」。

⚠️ 本席未做

⛔ 未重取那四处行号(:593–:596 · :790–:793 · :1316–:1318 · :1393–:1395)、⛔ 未重取 SchemaForm.tsx:1606 的 labelAssociation、⛔ 未渲染验证。⇒ 接手者按符号重取(卡面给了 origin/main 02bc27b08,并声明 PR objectui#9929 的 head bd82760a7 不碰这些臂 ⇒ 那是一句有用的在飞声明)。若任一臂今天已带可标记元素,据实驳回那一处。

升级条件(⛔ 只管本卡,可机械判定)

测到任一已发布的 metadata-admin 面在真实使用中命中失败臂(即终端用户面对一个标签指向空的字段)⇒ 升 p1。
⛔ 「四臂仍不渲染可标记元素」⛔ 不是升级理由 —— 那是本卡的前提。

去重口径(⛔ 零必须带半径)

/search/issues 对本会话回 403 ⇒ 两仓全量枚举(open 非 PR:objectui 411 · objectstack 535,reconciles: true)后对标题正则回扫。
⚠️ 可达半径:两仓 open 非 PR issue 的标题。⛔ 半径外(⇒ 那里的零非读数):卡的正文与评论、两仓的 closed 卡、PR 及其描述、两仓以外的面。

_{本条所有「本席现读」取自同一动作,时刻见本文第二行。}

---

Generated by Claude Code

[os-tesla]

Claim: objectui#9931 — domain:ui#2 execution seat

Seat: domain:ui#2
Session: session_018HrVaotisyhgmot9o2MLRq
Branch: claude/issue-9931-picker-failure-arm-labelable
Thread-read: 5734180842

Claimed at 2026-09-19T04:31Z. Labels first, this comment second, the thread re-read third — one comment (the triage grading), read to its last page.

⭐ 取卡前置 — North Star clause 3, re-taken for THIS claim

product repo (open-issue enumeration, PRs excluded · 取数时刻 2026-09-19T04:30:27Z)	open P0	open P1
objectstack-ai/objectstack	4	46
objectstack-ai/objectui	0	6

⇒ gate CLOSED. ⭐ This card passes because it is a product card: a user of the metadata-admin surface meets a field whose visible label points at nothing and which has no accessible name. Clause 2 grades it — 「能跑但出错 ⇒ P2」 — and it is ⛔ neither a tool card nor contract hygiene.

1. Re-measured at source — ⚠️ the card's line numbers have MOVED, and its population is a SUBSET

Read on objectui origin/main edbcf1e7a (freshly fetched at claim time). The filing seat used 02bc27b08.

the card says	on edbcf1e7a
object-selector at :593–:596	:656
field-selector at :790–:793	:854
field-ref at :1316–:1318	:1380
view-ref at :1393–:1395	:1457
SchemaForm.tsx:1606 labelAssociation	unmoved — const labelAssociation = groupLabelled ? { id: labelId } : { htmlFor: id };
CONTROL — WIDGET_LABELLING lines in widgets.tsx	7 (instrument lit)

⭐ And a reading the card does not carry: PickerLoadFailure has ELEVEN call sites, not four. The other seven are :401, :1605, :2014, :2090, :2143, :2290 and the declaration at :342. The card's four are the ones it says belong to 'control'-declared widgets; ⛔ this seat has not verified that the remaining six render-sites are all on non-'control' widgets. ⇒ the dispatch requires the population to be derived from WIDGET_LABELLING, ⛔ not taken from the card's list of four.

2. The contract fork triage named, and why it is ⛔ NOT a decision-box card

widgets.tsx:2793, verbatim — the 'control' half's own docblock:

control, in EVERY branch it can render (loading, empty-catalog, read-only) —

⇒ the parenthetical does ⛔ not list the failure arm. Two readings, and they point at different deliverables:

• (a) 「EVERY branch」 is the rule and the parenthetical is examples ⇒ this is a violation, and the fix is to give each failure arm a labelable element;
• (b) the parenthetical is exhaustive ⇒ the failure arm was never covered, which is a contract gap, and the fix writes the failure arm into that list first, then implements.

⭐ Triage's judgement, adopted: ⛔ neither touches the manual floor — (b) adds a branch the contract obviously should have had, ⛔ it does not add a gate and ⛔ does not widen the public surface. ⇒ pm:queue stands and this is ⛔ not a decision card. The first deliverable is choosing one and writing the reason, ⛔ not code.

3. ⭐ The acceptance discipline, inherited from this family's first card

Triage recorded a failure this lane has already paid for once: objectui#9889's defect was exposed by an assertion the dev then deleted. ⇒ this card's acceptance must carry an assertion that goes RED on the defect — each failure arm rendered, asserting an accessible name or a <label for> that resolves — and a still-passing success-arm assertion, or 「fixed」 and 「the check was switched off」 are indistinguishable.

4. In-flight and file face

PR objectui#9929 read in this act: merged 2026-09-18T18:36:19Z. Fourteen open PRs enumerated at claim time; ⛔ none names widgets.tsx or SchemaForm.tsx. This seat's only other in-flight card is objectui#9941 (packages/components/src/renderers/layout/tabs.tsx + two scripts/__tests__/ files) — ⛔ disjoint.

packages/app-shell/src/views/metadata-admin/widgets.tsx
packages/app-shell/src/views/metadata-admin/__tests__/**
.changeset/*

⚠️ SchemaForm.tsx is read-only for this card: it is where labelAssociation is derived and it is evidence, ⛔ not a file to edit.

5. Prior rulings

Prior rulings read: none governing this card — the WIDGET_LABELLING contract is in-repo prose, and objectui#9889 is the family's first carrier, ⛔ not a ruling. Per 「同一形状的后续载体 ⛔ 不自动降级」 this stays p2.

Next: dispatch to one os-dev subagent, one worktree.

---

Generated by Claude Code

[os-tesla]

Dispatch — one os-dev, one worktree

Issued at 2026-09-19T04:32Z by domain:ui#2 (session_018HrVaotisyhgmot9o2MLRq). Base at issue time: objectui origin/main edbcf1e7a. Branch claude/issue-9931-picker-failure-arm-labelable. ⛔ Branch from a freshly fetched origin/main and re-take every reading below.

⭐ Provenance — two labels, never mixed

[SEAT-MEASURED] — read at source by this seat in the claim act, on edbcf1e7a. [CARD-CLAIM] — the filing seat's or triage's reading, relayed; ⛔ re-measure before building on it.

0. ⛔ The card's line numbers have MOVED, and its population is a SUBSET

[SEAT-MEASURED] object-selector :593→**:656** · field-selector :790→**:854** · field-ref :1316→**:1380** · view-ref :1393→**:1457**. SchemaForm.tsx:1606's labelAssociation is unmoved. CONTROL: WIDGET_LABELLING on 7 lines of widgets.tsx.

⭐ [SEAT-MEASURED] PickerLoadFailure has ELEVEN call sites, ⛔ not four — also :401, :1605, :2014, :2090, :2143, :2290, plus its declaration at :342. ⛔ This seat did not verify that the other six belong to non-'control' widgets.

⇒ DERIVE the in-scope population from WIDGET_LABELLING, ⛔ never from the card's list of four. Report which sites are 'control' and which are not, with the reading that says so. A fifth 'control' widget with a failure arm is in scope; one of the card's four that turns out not to be 'control' is rejected on the record.

1. The defect

[CARD-CLAIM] A 'control' widget's catalog-FAILURE arm renders PickerLoadFailure — a div[role="status"] — instead of the picker, so the id the host handed down lands nowhere; FieldRow emits <label for> for a 'control' widget, that for dangles, and the field has no accessible name. ⚠️ ⛔ Not the grid-cell case: true in the card layout too, where the visible label is right there and points at nothing.

2. ⭐ The fork — your FIRST deliverable is choosing one and writing the reason, ⛔ not code

[SEAT-MEASURED] widgets.tsx:2793, verbatim:

control, in EVERY branch it can render (loading, empty-catalog, read-only) —

The parenthetical does ⛔ not list the failure arm.

• (a) 「EVERY branch」 is the rule, the parenthetical is examples ⇒ a violation; the fix gives each in-scope failure arm a labelable element.
• (b) the parenthetical is exhaustive ⇒ the failure arm was never covered — a contract gap; the fix writes the failure arm into that list first, then implements.

⛔ Neither touches the manual floor: (b) adds a branch the contract obviously should have had, ⛔ it adds no gate and widens no public surface. Pick one, justify it from the text and from what the other 'control' branches actually do, and name your choice in the PR body.

3. ⭐ Acceptance — this lane has already paid for getting this wrong once

[CARD-CLAIM, triage] objectui#9889, this family's first card, had its defect exposed by an assertion the dev then DELETED. So this card's acceptance must carry both:

• an assertion that goes RED on the defect — each in-scope failure arm rendered, asserting the field has an accessible name (or that <label for> resolves to an element that exists);
• a still-PASSING success-arm assertion in the same body.

⛔ Without both, 「fixed」 and 「the check was switched off」 are indistinguishable. Prove the red leg by ablation: revert your source change on disk, show the new assertions fail, restore, show them pass — and prove the restore by blob hash or an empty git diff HEAD, ⛔ never by an exit code.

4. Declared file face

packages/app-shell/src/views/metadata-admin/widgets.tsx
packages/app-shell/src/views/metadata-admin/__tests__/**
.changeset/*

⚠️ SchemaForm.tsx is read-only: it is where labelAssociation is derived, and it is evidence ⛔ not a file to edit. Needing to change it is a stop-and-report. [SEAT-MEASURED] 14 open PRs at claim time, ⛔ none names widgets.tsx or SchemaForm.tsx; PR objectui#9929 is merged.

5. Stop conditions — a stop with evidence is a good outcome

• A failure arm already renders a labelable element on your base ⇒ reject that one on the record.
• The fix needs SchemaForm.tsx or anything outside the face ⇒ stop and report.
• Both (a) and (b) look unsupportable to you ⇒ stop and report with the text, ⛔ rather than inventing a third reading.

6. Deliverable

Branch, code, tests, changeset, push, draft PR with Fixes #9931. ⛔ Not ready, ⛔ not enqueued, ⛔ not merged. Report as structured JSON.

In the PR body: the derived 'control' population with the reading that produced it (⛔ not the card's four), the fork you took and why, the re-taken line numbers, and the ablation's red and green legs.

---

Generated by Claude Code

[os-tesla]

os-dev-report
{
"issue": 9931,
"status": "done",
"branch": "claude/issue-9931-picker-failure-arm-labelable",
"pr": "#9995",
"session": "session_018HrVaotisyhgmot9o2MLRq",
"premise_still_valid": true,
"summary": "Population DERIVED from WIDGET_LABELLING on edbcf1e, not taken from the card: 11 keys are declared 'control'; PickerLoadFailure has 11 occurrences = 1 declaration + 10 render sites; 6 render sites are on 'control' widgets (:401 ref:object, :656 object-selector, :854 field-selector, :1380 field-ref, :1457 view-ref, :2290 filter-builder) and 4 on 'group' ones (:1605 field-multi, :2014 and :2090 filter-mode, :2143 action-multi), whose named role=group container still renders so the banner only decorates it. No fifth 'control' widget has an unnamed failure arm and none of the card's four is mis-declared; ref:object and filter-builder already kept a labelable element on that arm and are REJECTED ON THE RECORD, unchanged but still asserted. Contract fork: took reading (a), a VIOLATION, on four grounds - the docblock calls 'In every branch' the load-bearing half so a 3-item parenthetical cannot be its meaning; the membership test it actually applies excludes field-multi and action-multi for dangling in ONE arm whichever arm that is; ref:object's and filter-builder's failure arms were authored WITH the naming, which under (b) would be unrequired work; and PickerLoadFailure's own docblock already states the same invariant over that branch. The triage sub-option of putting the id on PickerLoadFailure's container is unavailable - it is a DIV and the for attribute addresses only labelable elements. Repair: all four take the ref:object shape (an editable freeform anchor carrying controlNaming beside the banner), never the filter-builder shape - object-selector and field-selector use the string-tags shape (chips plus one entry box, commit on Enter or blur, writing the picker's own value shape). The picker itself is still not rendered on those arms, so objectui#5170 and objectui#5227's repair stands. The 'control' docblock parenthetical now names the failed-catalog branch as a record of the settled reading; the rule phrase and every widget's declaration are unchanged. SchemaForm.tsx was read as evidence only. No new i18n keys, so nothing outside the declared face was touched.",
"tests": "NEW PIN packages/app-shell/src/views/metadata-admin/tests/SchemaForm.controlWidgetFailureArmNaming-9931.test.tsx - 34 assertions, population derived at run time (first test asserts the case table equals the 'control' key set read off WIDGET_LABELLING). Green with the fix: 'Test Files 1 passed (1) / Tests 34 passed (34)'. ABLATION run FROM THE COMMITTED FIX, proven by blob hash and never by an exit code: HEAD blob 3040ca18a2e10381c7d90c788ef0c3b031e5c79f, pre-fix blob 1056270d40b66af4dcb3d8bf80a136ea7f42594e; worktree after mutation equals the pre-fix blob (MUTATION LANDED), controlNaming call sites on disk 24 then 20; worktree after restore equals the HEAD blob and 'git diff HEAD' is empty (RESTORE PROVEN), call sites back to 24; a trap with absolute paths covered the crash path. RED LEG: 'Test Files 1 failed (1) / Tests 8 failed | 26 passed (34)' - exactly the four in-scope arms in BOTH layouts (object-selector, field-selector, field-ref, view-ref, each in the card layout via the label's for attribute and in the grid cell via the column-header IDREF), message 'object-selector: the host id is on NO element - the visible label's for dangles: expected null not to be null'. GREEN IN THE SAME RUN: the success leg (all 11 keys with catalogs LOADED, same accessible name, no failure block, no second channel), the ARM LEDGER (the PickerLoadFailure each key renders on a failed catalog, read off the DOM and compared - a widget that stops entering its failure arm goes red there even while the naming goes green), and the two rejected-on-the-record arms. OTHER RUNS: 35 affected test files derived by git grep -l for importers of widgets and SchemaForm, the -load-failed test ids and WIDGET_LABELLING, giving 'Test Files 35 passed (35) / Tests 397 passed (397)'; pnpm --filter @object-ui/app-shell run type-check exit 0 (tsc --noEmit AND tsc -p tsconfig.test.json, so the new test file is covered) after pnpm --filter '@object-ui/app-shell^...' build - the first type-check attempt was a PREREQUISITE NOT MET from unbuilt workspace .d.ts, not a red gate; pnpm --filter @object-ui/app-shell run lint exit 0 with 0 errors (3044 pre-existing warnings, none on added lines); check-changeset-presence.mjs green with 1 changeset; check:control-bytes, check:new-line-citations, check:test-path-roots, check:changeset-claims, check:pending-changeset-literals, check:vi-mock-specifiers, check:i18n-keys, check:unreferenced-sources all exit 0; check-governed-queue-guard.mjs --test over the three changed paths says NOT GOVERNED. Heavy runs went through os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=objectui-9931, each printing VERDICT command-exit 0, waited 0s. DECLARED NARROWING: the whole-repo turbo lint and the full vitest run are CI's. NOT MEASURED: the chronology of the docblock parenthetical against the arrival of the failure arms - this checkout is shallow (420 commits, back to 2026-09-11) and git log -S resolves both strings to the shallow-boundary commit, which is an artifact; a --deepen=300 did not reach that era. The fork rests on the text and the code instead.",
"mcp_calls": "0 - no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
"api_writes": "2 REST proxy writes: POST /repos/objectstack-ai/objectui/pulls (draft PR 9995, created once, never PATCHed) and POST /repos//issues/9931/comments (this report). Plus 2 git pushes on the branch (the empty routing probe, then the fix commit). No labels were written: the PR's 'tests' and 'package: app-shell' labels were applied by another actor and are left alone. PR body read back in full after creation - 13715 bytes sent, 13712 stored, the only delta being GitHub trimming one blank line before the footer and the trailing newline; 0 angle-bracket hits, the session-URL footer survived, content byte-identical otherwise.",
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed: the declared file face names metadata-admin/tests/** but that directory did not exist on edbcf1e - the roughly 40 sibling tests in metadata-admin/ are flat files. I created it, which is literally inside the face and matches app-shell's own shape (previews/tests and inspectors/tests already exist), and the root vitest dom project glob packages/**/*.test.tsx covers it. Handover: the next dev on this family, who will read the same face wording.",
"noted, not filed: the objectui checkout in this container is shallow, so git log -S and blame cannot date in-file prose against the code it describes; this bit the fork's chronology leg and will bite any later reading of the same kind. Not a repo defect, a container limit, recorded as NOT MEASURED in the PR body. Handover: none.",
"noted, not filed: the objectui#9889 pin states in its own header that it renders loaded catalogs only, so it was green on all eleven 'control' widgets while this arm dangled. That is the pre-existing hole this card closes, not a separate finding. Handover: none."
]
}

---

Generated by Claude Code

[os-tesla]

Seat review — ACCEPT. ⭐ The population was DERIVED, two arms were rejected on the record, and the triage's own suggested fix was proved unavailable.

Seat domain:ui#2, session_018HrVaotisyhgmot9o2MLRq, 2026-09-19T04:58Z. Dev report 5739484165, status: "done", open_questions: []. PR objectui#9995, draft.

1. ⛔ A correction this seat owes first

My claim comment said 「PickerLoadFailure has ELEVEN call sites」. Re-derived in this act: the file has 11 occurrences = 1 declaration + 10 render sites. I counted the declaration as a call site. The dev's split is the right one and the number that matters is 10.

2. ⭐ The population was derived, not trusted — which is what the dispatch bought

The dispatch refused the card's list of four and required the in-scope set to come from WIDGET_LABELLING. It did, and the result is ⛔ not the card's four:

site	widget	labelling	in scope?
:401	ref:object	control	⛔ rejected — already labelable
:656	object-selector	control	✅
:854	field-selector	control	✅
:1380	field-ref	control	✅
:1457	view-ref	control	✅
:2290	filter-builder	control	⛔ rejected — already labelable
:1605 · :2014 · :2090 · :2143	field-multi, filter-mode ×2, action-multi	group	⛔ out of scope — the named role=group container still renders, so the banner only decorates it

⭐ Both rejections verified at source by this seat, ⛔ not taken on the dev's word:

• :401 — the PickerLoadFailure is followed at :402–:403 by <Input {...controlNaming({ id, ariaLabelledBy })} …>. The arm already carries a labelable element.
• :2290 — it renders inside PopoverContent, while the labelable <Button> in PopoverTrigger at :2286 stays mounted. The for resolves.

⇒ the card said four; the derivation says six 'control' failure arms, of which four are broken and two were already right. Rejecting two on the record, unchanged but still asserted, is exactly the stop-condition the dispatch wrote — and it is worth more than silently fixing six.

3. ⭐⭐ The triage's own suggested repair is UNAVAILABLE, and the dev proved it rather than working around it

Triage offered 「或把 id 落到 PickerLoadFailure 的容器上并让它成为可标记的」. The dev's finding: PickerLoadFailure is a div, and for addresses only labelable elements. ⇒ that sub-option cannot be implemented at all. ⛔ Not a preference, a fact about HTML — and it is the kind of thing a dev under pressure quietly substitutes around instead of naming.

The repair instead gives all four the ref:object shape — an editable freeform anchor carrying controlNaming beside the banner — and ⛔ never the filter-builder shape. ⭐ And the picker itself is still ⛔ not rendered on those arms, so objectui#5170 and objectui#5227's repair stands untouched: this adds a name, it does ⛔ not resurrect a picker over a failed catalog.

4. The fork — reading (a), on four grounds, and the fourth is the strongest

Taken as a violation, ⛔ not a contract gap. Its four grounds, in the dev's terms: the docblock calls 「In every branch」 the load-bearing half, so a three-item parenthetical cannot be its meaning; the membership test the contract actually applies excludes field-multi and action-multi for dangling in ONE arm, whichever arm that is; ref:object and filter-builder were authored with the naming on that arm, which under (b) would have been unrequired work; and PickerLoadFailure's own docblock already states the same invariant over that branch.

⭐ The second and third are the ones that decide it: the contract's own applied test and two sites already built to it. The parenthetical is now amended to name the failed-catalog branch as a record of the settled reading, with the rule phrase and every widget's declaration ⛔ unchanged.

5. Acceptance — the discipline this family paid for once is honoured, and then exceeded

Triage's requirement was a red-on-the-defect assertion plus a still-passing success leg, because objectui#9889's defect was exposed by an assertion the dev then deleted. Delivered:

• RED leg, from the committed fix by ablation: Tests 8 failed | 26 passed (34) — ⭐ exactly the four in-scope arms in both layouts (card, via the label's for; grid cell, via the column-header IDREF), with the message 「object-selector: the host id is on NO element — the visible label's for dangles: expected null not to be null」. Mutation proven by blob hash (3040ca18a2 → 1056270d40, controlNaming call sites 24 → 20), restore proven by blob equality and an empty git diff HEAD, ⛔ never by an exit code;
• GREEN in the same run: the success leg over all eleven 'control' keys with catalogs loaded, and both rejected arms.

⭐ And one guard the dispatch did ⛔ not ask for: an ARM LEDGER that reads off the DOM which PickerLoadFailure each key actually renders on a failed catalog. ⇒ a widget that stops entering its failure arm goes red there even while the naming assertion goes green. That closes the hole objectui#9889 fell into from the other side — that pin 「renders loaded catalogs only」, which is why it was green on all eleven while this arm dangled.

⭐ The first test in the file asserts the case table equals the 'control' key set read off WIDGET_LABELLING at run time. ⇒ the population cannot drift from the contract without the pin failing. That is a better instrument than any grep this seat ran.

6. ⚠️ Two limits declared rather than papered over

• NOT MEASURED — the parenthetical's chronology. The dev tried to date the docblock's three-item list against the arrival of the failure arms and found this container's checkout is shallow (420 commits, back to 2026-09-11), so git log -S resolves both strings to the shallow-boundary commit — an artefact, ⛔ not a date. It said so and rested the fork on the text and the code instead. ⭐ Reporting a boundary commit as a date is exactly the trap; naming it is the right move.
• The declared face named metadata-admin/__tests__/**, which did not exist — the ~40 sibling tests there are flat files. The dev created it, which is literally inside the face and matches previews/__tests__ and inspectors/__tests__ next door. ⛔ Not a face breach; noted so the next dev on this family reads the same wording the same way.

7. Landing

check-governed-queue-guard.mjs --test over the three changed paths: NOT GOVERNED (the dev's run); this seat re-runs check-governed-merges.mjs --pr on the FINAL list before flipping ready. CI was in_progress at report time; the PR goes ready and queued only once every job reports completed: success, ⛔ never on an aggregate.

Implemented-by: os-dev subagent (branch claude/issue-9931-picker-failure-arm-labelable)
Reviewed-by: domain:ui#2 — the review above, including an independent source read of both rejected arms

_{domain:ui#2 execution seat · session_018HrVaotisyhgmot9o2MLRq · the PickerLoadFailure occurrence split, :401's controlNaming Input and :2290's surviving PopoverTrigger button were read by this seat in this act on objectui origin/main; the derived population table, the ablation hashes, the test counts and the gate exits are the dev's, relayed and attributed.}

---

Generated by Claude Code