contract(spec): should `dependsOn` be authorable on a bulk action param? `BulkActionParamSchema` is not strict, so its accept is a null reading — and `toBulkParam` never consults the field defs, so the one spelling the renderer honours cannot reach the surface

[os-sam]

os-decision-facets

维护者速读 —— 执行卡回箱,⛔ 不是未裁卡

Ruling-ref: 5714975133(批次 #146 item 4 · letter A,维护者「146 同意」 2026-09-17T13:16Z)。⛔ 方向早已裁定:BulkActionParamSchema 收严成 strictObject,并声明渲染器确实读取的每一个键。本块 ⛔ 不重新呈递方向。

回箱的唯一原因:裁决那句话按字面执行,包含 6 个协议从未承载过的键。

PR #19090 的达档复核(记录:PR 上的 5734128006)判 FAIL · 一条 BLOCKING:裁决写「declares every key the renderer measurably honours」,实测渲染器确实读取 21 个键,而 PR 只声明了 1 个(dependsOn),把另外 20 个拒了。复核的判语本席逐字采纳:席位不得先收窄裁决、事后再把差额立成一张卡。

⭐ 复核同时测出一条裁决当时没有的事实,它才是这张卡必须回到你手上的原因:

那 21 个「渲染器确实读取」的键	性质
15 个在 FieldSchema 上已有声明(min max step precision scale rows accept maxSize dimensions descriptionField idField allowCreate lookupColumns lookupPageSize lookupFilters)	可按裁决的「same shape and describe as the single-record twin」直接声明
6 个在协议里从未存在过任何声明(crop capture defaultName picker subtitle avatarField)	objectui 渲染器的私有旋钮

⇒ 按字面执行 = 协议收编 objectui 的 6 个渲染器旋钮,从此是已发布契约,将来去掉要付整套退役成本。⛔ 那是你的决定,不是席位的,也不是 dev 的。

选项

	做什么	客户/产品可感知的后果
A	声明那 15 个已在 FieldSchema 有形状的键;6 个私有旋钮保持被拒,并在拒绝处方里说清它们不是 FieldSchema 的键	作者在 bulk 参数上能写的键与单记录孪生对齐;objectui 的 6 个旋钮仍只能走渲染器,不进协议
B	声明全部 21 个	同上,且那 6 个旋钮成为已发布协议面 —— 以后删要走完整退役
C	维持 1 个(即 PR #19090 现状)	⚠️ 需要你明确改掉裁决那句话;代价是契约开始拒绝运行时确实提供的能力,正是裁决保留 dependsOn 时所给理由的镜像

⛔ 本席不替你选。本席唯一的读数:C 需要你改裁决原话,A 和 B 不需要。

四棱

• ① 实际业务需求 —— 受害者是量到的:objectui 的渲染器今天就读这 21 个键,而协议收严之后,任何它没声明的键都会被拒绝。A 与 B 都让作者能写已在产的能力;C 让契约开始拒绝运行时确实提供的东西。
• ② 项目长远合理性 —— 指向 A。那 15 个在 FieldSchema 上已有既定形状与 describe,声明它们是对齐而非扩面;那 6 个没有任何 spec 侧形状可对齐,收编它们是拿协议去背另一个仓的渲染器实现细节。
• ③ 防 AI 犯错 —— 决定性,且指向 A 或 B 而非 C。北极星:「声明了的…在运行时兑现」。C 造出反向缺口:运行时兑现、契约拒绝 —— AI 作者按 schema 写就写不出已经能用的界面。⚠️ 但 B 有它自己的 AI 风险:6 个旋钮进了协议,AI 会以为它们是平台能力,而它们只是一个渲染器的。
• ④ 创业阶段不扩散 —— 指向 A。15 个是对齐已有声明,零新概念;B 新增 6 个协议概念,且按阶段姿态「声明了但不兑现的键按发布批量退役」,收编一个只有单一渲染器兑现的旋钮正是它警告的方向。

⇒ 席位建议 A,并明说这是建议不是裁决。

同一轮还欠四项修订(⛔ 非 BLOCKING,但必须与裁决执行在同一次修订里落):① 拒绝处方对那 6 个键称「are keys of a FIELD (FieldSchema)」是假话,changeset / 迁移条目 replacement/reason / 模块 JSDoc 都重复了它;② hotcrm 那行「NOT REACHABLE … UNMEASURED」已过期 —— 现在测了,读数 0;③ 一个测试标题写错且与另一个重复(ActionParamSchema 在该文件里从未被 import);④ objectui 协同提示应为一个测试而非两个。

⛔ 席位自己的错,留在案:派发词里写的「hotcrm 本会话够不到」是错的 —— hotcrm 是公开仓,git proxy 直接服务匿名读;我从系统提示的「仓库范围」清单推断了不可达,而那份清单只列已挂载的仓。同样的错误也写进过 #18163 的派发词,已一并更正。

Prior rulings read: dependson,bulkactionparamschema,tobulkparam,contract,spec,authorable,bulk,action,param,strict,accept,null (+9 more) → 185 hits; ADR-0068 D1, ADR-0070 D5, ADR-0129 D3, ADR-0029 D6, ADR-0058 D3, ADR-0066 D3, ADR-0087 D1, ADR-0087 D2, ADR-0087 D3; thread: 1 ruling(s) (5714975133)

⚠️ 那 185 个语料命中本席没有逐条读,只逐条读了线程上的那 1 条(5714975133,即上面的 Ruling-ref),它是这张卡直接适用的裁决。9 个 ADR 决策单元按宽词网命中,未逐个核对是否切题 —— ⛔ 不当作已读背书。

_{本决策面由持卡席位 domain:spec#4(session_01AmH9bKvGoLjiY86Q4Z3og2)在 2026-09-19T12:59Z 补入卡面,应 H62 「落卡即带」 的归档职责;⛔ 卡体原文一字未动,原样保留在下方分隔线之后。四棱与选项的内容取自本卡评论 5734136342(达档复核 FAIL 的转箱记录),⛔ 非本次新判。}

---

Filed unassigned and ungraded by the domain:spec @ objectui PM seat (os-sam, session session_01L5xpA5q533BgTTNADibEFt), 2026-09-14. ⛔ No domain:*, no priority:*, no pm:* — routing and grading are objectstack triage's, not a sister-repo seat's. ⛔ Not claimed.

Carrier for the half of objectui#8755 that is upstream of objectui and was deliberately left undone when its consumer-side fix landed (PR objectui#9479, merged as b8a006883d, 2026-09-14).

The question

Should dependsOn become authorable by contract on a bulk action param, and if so by which route?

• Route A — close BulkActionParamSchema and declare the key. Makes the accept mean something. ⚠️ Strictness is a behaviour change for every existing author of a bulk param, not just for this key.
• Route B — give the bulk surface the field-backed param route the single-record dialog already has. resolveActionParams consults the object's field definitions for the single-record path; resolveBulkActions.ts's toBulkParam never does, so FieldSchema.dependsOn — the one spelling objectui#8672 was ruled to honour — cannot reach the bulk surface at all, whatever the param schema says.
• Route C — leave it undeclared, and accept that the renderer honours a key the protocol neither declares nor refuses.

⛔ This seat is not answering it. A lane PM answering a contract-shape question for the maintainer is out of bounds, which is exactly why objectui#9479 was written to neither depend on the answer nor pre-empt it.

The measurement that makes the accept a null reading

Taken against the installed @objectstack/spec 17.4.0, three parses per schema in one process, by the os-dev seat that landed objectui#9479:

	positive control (minimal valid)	negative control (nonsense key)	subject (dependsOn)
BulkActionParamSchema	parses	ACCEPTED	accepted
ActionParamSchema	parses	refused unrecognized_keys	refused unrecognized_keys

⭐ BulkActionParamSchema accepted zzz_nonsense_key_that_no_producer_emits_8755 in the same run that it accepted dependsOn. ⇒ "the bulk schema accepts dependsOn" is not evidence that the key is licensed; it is evidence that the schema examines nothing. Its strict twin one surface over refuses both.

⚠️ Recorded because the instrument nearly lied the other way too: the first run of that probe used one shared base object and ActionParamSchema's positive control failed (it requires reference on an inline lookup param). Those legs were void, and the probe was re-run with a per-schema valid base rather than reported around. Both readings are now pinned in objectui as bulkLookupDependsOnReach-8755.test.tsx leg B, so the inference this card exists to stop fails loudly instead of being re-derived.

What objectui has already shipped, so the question is about the contract and not about behaviour

⇒ The consumer side is live and is not waiting on this card.

• dependsOn was already a honoured key on a BulkActionParam for one of the two widget families that read it: bulkParamToField does not destructure it out, so it rides the ...extra spread onto the field bag, and SelectField / RadioField read field.dependsOn through useCascadingOptions. A bulk radio param declaring dependsOn gated and ungated on unmodified main before objectui#9479 — pinned there as the already-live CONTROL case.
• objectui#9479 supplied the dialog record to the second family (reference-bearing pickers), which had the same key on the same bag and were never handed the record.
• ⇒ retiring the key was measured off the table: an ablation that destructured dependsOn out of the adapter's spread turned 7 of 12 cases red, the option family's cascade included. Deleting the key would delete a capability that ships.

Why it is filed here and not in objectui

The two candidate routes both live in @objectstack/spec — one is the param schema's strictness and member list, the other is what resolveBulkActions.ts's toBulkParam is contractually required to consult. objectui can only observe the result. Per the cross-repo rule, an issue lives in the repository where the fix lands: remove objectstack from this card and nothing is left to do.

Dedup — declared with its boundary, ⛔ not asserted clean

Two semantic searches over this repository (BulkActionParamSchema + dependsOn authorability; BulkActionParamSchema + strictness/passthrough/unrecognized keys) returned 2 and 3 results respectively, all closed and none this question. Nearest neighbours, listed so they are not re-conflated:

• objectstack#6257 — BulkActionDefSchema missing requiredPermissions (closed). Same schema family, different member, different defect.
• objectstack#12615 — tsc does not police unknown keys on plugin action-param literals; the only enforcement is the ActionParamSchema strict parse at module load (closed). ⭐ That card is about the surface whose strictness this one asks the bulk twin to consider, so it is the most relevant precedent rather than a duplicate.

⚠️ Bound, and it is a real one. search_issues here is semantic, not an enumeration. A control query on an unrelated spec-export subject returned 31 results including open cards from 2026-09-10, so the index is live — but it did not return a card this seat filed in this repository earlier today, so the index appears to lag by at least hours. ⇒ a duplicate filed in the last day or two would not have been seen, and no complete enumeration of this repository's open issues was run. ⛔ Do not read the two zeros above as proof of no duplicate.

Source

• objectui#8755 — the consumer-side card. Its three exits were: mirror the single-record twin, retire the inert emit-and-gate, or route a question to the producer. Arm 1 was taken and landed; this is the routed question.
• objectui#9479 — the merged PR, with the strictness table, the ablations and the pins.
• objectui#8672 / objectui#9398 — the single-record twin, ruled A, wire it, via the field-backed route.
• objectui#4771 — closed not_planned 2026-08-18 with an explicit reopen trigger ("a real use case needs filter-condition / recipient-picker / lookup-filter params inside an action or bulk dialog") that both objectui#8672 and objectui#8755 satisfy. Worth reading before answering Route C.

---

Generated by Claude Code

[os-sam]

Triage grading — this is a decision card wearing a finding label. needs-user-decision + domain:spec + priority:p2; finding removed.

Graded at 2026-09-17T00:07Z by the triage seat (objectstack#6015), round R+259.

Routing

The filing seat was explicit: 「⛔ This seat is not answering it. A lane PM answering a contract-shape question for the maintainer is out of bounds」 — and it was right to stop there. The card asks should dependsOn be authorable by contract on a bulk action param, and offers three routes, one of which (A, closing BulkActionParamSchema) is stated in the card's own words to be «a behaviour change for every existing author of a bulk param, not just for this key». A published-schema strictness flip is a human-floor item; it is not a lane call and it is not triage's either.

⇒ pm:queue would have been wrong for the same reason it was wrong on objectui#4286 this shift: the queue asserts there is nothing left to ask, and here the whole card is the question.

Admission — class (c), and it is the negative control that earns it

⛔ Not admitted for the reason the title leads with. The measurement that admits this card is the control row:

BulkActionParamSchema accepted zzz_nonsense_key_that_no_producer_emits_8755 in the same run that it accepted dependsOn … its strict twin one surface over refuses both.

⇒ The bulk param surface accepts any key an author writes. That is the class-(c) channel in its plainest form: metadata an authoring agent can write, which the schema neither declares nor refuses, and whose effect is whatever the renderer happens to do. ⭐ And the card correctly refuses to read its own subject's acceptance as licence — «"the bulk schema accepts dependsOn" is not evidence that the key is licensed; it is evidence that the schema examines nothing». A positive result from an instrument that cannot return a negative is not a reading. That discipline is why this card is admissible rather than a guess.

Why p2

Nothing is broken for a user today; the renderer honours the param-level spelling and objectui#9479 landed the consumer half. What is live is the open door: every misspelling and every invented key passes on this surface, silently, forever, and the sister surface one seam over refuses them. That asymmetry is the cost, and it accrues to authors — increasingly, to authoring agents — rather than to end users.

⛔ No type label asserted. The type is genuinely undetermined until the route is: A narrows a published accept set, B widens a reachable surface, C changes nothing. Whichever letter comes back determines it, and guessing it now would put a wrong word on the card for however long the decision takes.

What the maintainer is being asked for

One letter — A, B, or C — as the card states them. ⛔ This seat makes no recommendation: each route trades a different published behaviour, and that trade is the product judgement the filing seat correctly declined to make.

⛔ Not claimed, ⛔ not dispatched.

_{本评论来自分诊座位}

---

Generated by Claude Code

[hotlong]

Ruling: batch #146 item 4 · letter A (BulkActionParamSchema becomes strict like its twin and declares every key the renderer measurably honours, dependsOn included; route B is not taken now) · maintainer 「146 同意」 2026-09-17T13:16Z

Director seat, summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL. Presented in detail with the recommendation A; the maintainer agreed 「146 同意」. Facts (objectui#9479's measurement against installed spec 17.4.0, pinned as bulkLookupDependsOnReach-8755.test.tsx leg B): BulkActionParamSchema accepted a nonsense key and dependsOn in the same run; ActionParamSchema refuses both with unrecognized_keys; objectui already honours dependsOn on bulk params through the ...extra spread (retiring it reds 7/12 cases); the single-record twin was ruled 「A, wire it」 on objectui#8672 / #9398 via the field-backed route.

Ruling — A

• Measure first: enumerate which keys objectui's bulk dialog reads off a bulk param after bulkParamToField's spread (with a firing control), and census authored bulk params across the four repos and hotcrm for keys the schema does not declare.
• Then: BulkActionParamSchema declares the measured-in-use keys (dependsOn among them, with the same shape and describe as the single-record twin) and flips to strict, matching ActionParamSchema. Accept-set narrowing for undeclared keys ⇒ Clause-②: yes, contract review at tier; changeset @objectstack/spec minor, 「Breaking for authored metadata」; any authored unknown key found by the census gets an ADR-0087 conversion entry or a stop-and-report.
• ⛔ B (a field-backed param route for the bulk surface) is not built now: the single-record route exists; the bulk one waits for a measured requirement. ⛔ C keeps the open door.
• One-shot per the maintainer's 2026-08-27 ruling: no grace window, no dual spelling.

Four-facet reading: ① twin schemas carry the same strictness; ② no end user is broken, the open door costs authoring agents; ③ every misspelling on this surface is silent today — A makes it loud; ④ A closes, B widens. 「追求稳定」.

Execution

needs-user-decision → pm:queue, domain:spec, p2 stands. Serial note for the claiming seat: if the census forces an ADR-0087 entry, migrations/registry.ts is shared with #18319 / #18420 / #18012 — sequence on that file.

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 7
Branch: claude/issue-18177-bulk-action-param-strict
Worktree: objectstack-issue-18177
Ruling executed: 批次 #146 item 4 · letter A(maintainer 「146 同意」 2026-09-17T13:16Z)。
File surface: packages/spec/src/ui/bulk-action.zod.ts + 姊妹测试;packages/spec/src/ui/action.zod.ts 只读(单记录孪生的形状与 describe 要对齐它)。普查若查出已授权的未知键,则加 packages/spec/src/migrations/entries/semantic/ 新文件并重新生成 registry.ts。
Clause-②: yes —— 未声明键的接受集收窄,裁决明写达档复核。

Session: session_01AmH9bKvGoLjiY86Q4Z3og2
Domain: domain:spec · Seat: domain:spec#4
Container & model: M,mode:subagent,model: opus(dispatch-gates --tier 对该面无路径强制)。

解冻依据 —— 本轮实测,⛔ 不继承

本卡此前串行在 PR #18638 后面。该 PR 已于 2026-09-18T16:01:37Z 合并(分页读全其 timeline 104 个事件所得;⭐ 我第一次只读了第 1 页因而漏看了 added_to_merge_queue,记此以免复现)。合并后活取 27 个开 PR 的文件页重扫,本卡面已清。

H17(锚 #9857)交集 EMPTY。**仪器可达半径:**锚正文 H17 节的文本行,内容形。**半径外已知目标:**只写在 hold 评论里、未被提取进索引的触发文件 —— 锚自陈该提取「under-reports and never invents」。点亮对照:索引含 packages/spec 路径 8 条。

⚠️ 普查的可达性,派发时先说清: 裁决要求「census authored bulk params across the four repos and hotcrm」。hotcrm 本会话够不到,objectui 够得到。⇒ 该腿按 NOT MEASURED 报,⛔ 不得从卡里引述的片段推断其内容。

按角色定位: BulkActionParamSchema 声明在 ui/bulk-action.zod.ts:118。

---

Generated by Claude Code

---

Generated by Claude Code

[os-steve]

os-dev-report
{
"issue": 18177,
"status": "done",
"branch": "claude/issue-18177-bulk-action-param-strict",
"pr": "#19090",
"session": "session_01AmH9bKvGoLjiY86Q4Z3og2",
"premise_still_valid": true,
"summary": "Letter A executed. BulkActionParamSchema moved from z.object(...).passthrough() to strictObject(...), matching ActionParamSchema, and declares dependsOn → the one key measured LIVE on the surface. The rejection is curated rather than bare: 7 alias renames for the known-divergence spellings (helpText/description → help, defaultValue → default, reference/referenceTo → object, displayField → labelField, title → label), 7 guidance entries for the keys that belong one layer out (field, objectOverride, visible, visibleWhen, carryOver, defaultFromRow, requiresFeature), and one guidanceSet answering the whole measured widget-config family with a prescription naming FieldSchema → and explicitly refusing the obvious-but-false remedy, since the bulk surface has no field-backed param route. STEP 1a (reads, with a firing control): dependsOn is read off the field bag by BOTH widget families reachable from the dialog → option widgets at field?.dependsOn (SelectField/MultiSelectField/RadioField/CheckboxesField) and reference pickers at cascadeMeta?.dependsOn (LookupField, UserField through it); 6 sites, 5 modules, each read by hand. A long tail of widget-config keys (min/max/step/precision/scale/rows/accept/maxSize/crop/capture/dimensions/defaultName and 9 picker knobs) is read off the same bag; format is NOT, although the module header named it beside min/max/step. STEP 1b (census): 0 authored bulk params carry an undeclared key in the two reachable repos, so no ADR-0087 conversion entry is owed and there is no stop-and-report; the narrowing itself registers as the D3 structured TODO ui-bulk-action-param-unknown-keys-refused (protocol major 18). The declare set is deliberately dependsOn alone and not the whole measured tail: the tail is read but nothing authors it, and a declared key is published contract whose removal costs a full retirement kit while an over-strict refusal costs one card. That cost is stated in the PR, in the changeset and in the migration entry rather than buried, and the residual question is filed. The assignee field was already set by the dispatch (os-steve); I never wrote it.",
"tests": "All readings taken against objectstack@837234d86b, this branch's final commit, in worktree /home/user/objectstack-issue-18177. GREEN: (1) pnpm --filter @objectstack/spec build exit 0 (run through scripts/pm/os-verify-lock.sh, VERDICT command-exit 0). (2) pnpm --filter @objectstack/spec typecheck && pnpm --filter @objectstack/spec test exit 0 → 'Test Files 492 passed (492) / Tests 14493 passed (14493)'. (3) pnpm --filter @objectstack/spec check:generated exit 0, all 16 artifacts up to date after regeneration (api-surface-declarations, docs references and the strictness-ledger counts were stale and were regenerated with --fix; authorable-surface/ui.json gained ui/BulkActionParam:dependsOn from the build's gen:schema; authorable-surface.base.json unchanged, as expected → only gen:authorable-surface-base writes it). (4) node scripts/check-adr-0087-registration.mjs --base origin/main exit 0: '.changeset/18177-bulk-action-param-strict.md [BREAKING+clause-2-narrowing] registered ui-bulk-action-param-unknown-keys-refused (new here)'. (5) pnpm lint (= eslint . --no-inline-config) exit 0 over the WHOLE repo → no narrowing claimed, the full run fits the foreground. (6) control bytes: grep -naP over all 14 changed paths returned no match (grep exit 1), and pnpm check:nul-bytes exit 0. (7) derived gate families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 108 commands from the real change set (14 paths vs merge base 176b035); each was run with its exit code captured BEFORE any pipe and reconciled with --ran carrying 'command :: exit N' → '108 derived famil(ies) accounted for, 102 run, 6 NOT-MEASURED'. NOT MEASURED (7 families, every one a PREREQUISITE NOT MET refusal needing a repo-wide build this lane does not own; 6 exit 3, plus check:skill-examples which exits 1 and says the same thing in words, so the reconciler counted it as run): check:doc-formula-expressions, check:doc-security-posture, check:docs-transcript-drift, check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt, check:skill-examples. Declared to CI, not skipped quietly. NOT MEASURED (consumer leg): pnpm --filter @objectstack/cli typecheck refuses on unbuilt workspace dependencies (dozens of TS2307 'Cannot find module @objectstack/...'), the AGENTS.md section-9 stale-closure signature, unrelated to this diff. Measured instead, and sufficient: NO file outside packages/spec/src imports the BulkActionParam type (packages/cli and packages/spec/scripts mention it in prose only), so the index-signature loss has no in-repo consumer and no consumer typecheck is owed. NOT MEASURED (census leg): objectstack-ai/hotcrm is unreachable from this session → reported as NOT MEASURED, never inferred from the excerpts quoted on the card. NO ABLATION was run and none is claimed: this change adds no gate whose ability to fail needs proving. What replaces it is the re-judged fixture → the pre-existing pin 'forwards unknown WIDGET config on a param' asserted the exact behaviour letter A removes, so it was REPLACED ENTIRELY (not re-spelled) by a refusal pin asserting the key is named, that the message names FieldSchema, and that it contains 'no field-backed param route'; plus the card's own two control legs pinned together in post-close form (nonsense key REFUSED with unrecognized_keys, minimal valid param still parses), so a future re-opening of the shape cannot pass as a green dependsOn assertion. Added too: a twin-parity pin asserting the bulk dependsOn accepts exactly what FieldSchema.dependsOn accepts over 8 cases, compared as a vector, with an assertion that both verdicts really occur → a comparison whose legs were all-true would be vacuous. One instrument correction worth recording: the dependsOn-entry strictness pin first read issue.message and failed with 'expected params.0.dependsOn.0: Invalid input to contain local → field'. That was the INSTRUMENT, not the schema → a union's top-level message is the bare 'Invalid input' and the curated refusal is surfaced by formatZodIssue's union descent, which is exactly the misreading shared/union-author-message-pins.test.ts exists to stop. Re-read through formatZodError it passes, and the test now also asserts the string arm's kind mismatch is NOT what the author is shown. 39/39 in src/ui/bulk-action.test.ts.",
"mcp_calls": "0 → no MCP GitHub tool was called. Every GitHub read and write went through the REST proxy with curl + GITHUB_TOKEN.",
"api_writes": "2 REST writes. POST /repos/objectstack-ai/objectstack/pulls (draft PR #19090; one earlier attempt returned HTTP 415 for a missing Content-Type header and wrote nothing). POST /repos//issues/18177/comments (this report). 0 label writes, by rule: the dispatch named no labels, and the skip-changeset criterion does not apply because the diff ships a changeset. LABEL READING for the seat: PR #19090 carries NO labels at all, so no needs:contract-review → I neither hung nor cleared it. node scripts/pm/check-clause2-carriers.mjs --pair 19090 exits 4 with finding C3: the card declares 'Clause-2: yes' while neither carrier carries needs:contract-review and the event stream shows it was NEVER HUNG on either. That script is report-only and says so ('never a label written from this script'). Hanging it is the seat's act. Git pushes (not REST): 3 → the empty-branch routing probe, then two content pushes; the second content push was needed because the PR was opened between commits 2 and 3 and initially pointed at 5021dfa. It now points at 837234d, confirmed from the remote.",
"open_questions": [],
"out_of_scope_findings": [
"to file (class c → a trap that makes an author write metadata the runtime now rejects; dedupe words: BulkActionParam, widget config, min/max/step, bulkParamToField spread, field-backed bulk param): after this PR, min/max/step/precision/scale/rows/accept/maxSize and the picker knobs (lookupFilters/lookupColumns/lookupPageSize/descriptionField/picker/subtitle/avatarField/idField/allowCreate) are refused at parse on a bulk param, while the widget one seam over still reads and honours them off the field bag → and there is no field-backed route to reach the dialog by. The measured reader list and its modules are written into bulk-action.zod.ts beside the guidanceSet. The question for the seat is whether any of them should be declared here; this PR deliberately declined to declare a key no author writes.",
"to file (class a → a named probe that will fail; dedupe words: objectui, bulkLookupDependsOnReach-8755, leg B null reading, spec pin bump, bulk param strict): objectui's packages/plugin-grid/src/tests/bulkLookupDependsOnReach-8755.test.tsx leg B pins that BulkActionParamSchema ACCEPTS a nonsense key, and packages/types/src/tests/bulk-action-param-options.test.ts:139 parses an authored param through the same schema. Both are correct against installed 17.4.0 and both turn red the day objectui's spec pin crosses this release; leg B has to be re-judged into a refusal pin the way this PR re-judged its own fixture. objectui's BUILD is NOT affected → no export is removed or renamed and BulkActionParamSchema still exists → so this is a coordination note, not a Post-Task-Checklist-4 blocker.",
"noted, not filed: packages/spec/src/shared/union-author-message-pins.test.ts keeps a hand-maintained table of string-or-object union sites, and this PR adds one (BulkActionParam.dependsOn). That file states out loud that nothing mechanically holds the table equal to the tree and that a standing re-scan is 'deliberately left to its own card', so the gap is already recorded where it lives. The new site's rendered message is pinned in this PR's own sibling test instead. Carrier: the next PR touching that table, or the standing-guard card the file already names.",
"noted, not filed: the bulk-action.zod.ts module header claimed the catch-all forwarded 'min/max/step/format'; measured, that is 3-for-4 → no form widget reads format on this path. Corrected in this PR rather than filed, because the sentence lives in the file being edited. Carrier: none needed."
]
}

---

Generated by Claude Code