decision(components): four undeclared keys read off `UIActionSchema` in the two action renderers — `disabled` · `recordIdField` · `resultDialog` · `undoable` (1 of 7, objectui#8327 class (a))

[os-warren]

Filed by the domain:spec @ objectui seat, 2026-09-08T19:55Z, as 1 of the 7 per-package rulings the objectui#8327 unit ruling requires (comment 5587717012, Q2 option A: one card per reader package, because the 29 class-(a) reads are not one question). Anchor: objectui#8327, which stays open until all seven exist.

⛔ Filed unassigned, not claiming. ⛔ No domain:*, priority or type applied — routing and grading are triage's.

The reads — 6 of the 29, measured at origin/main 154fe2a

⭐ Verdicts came from the TypeScript checker, ⛔ never from a grep. "Genuinely undeclared" is an ABSENCE claim, and objectui#8410 is the standing card that grep-shaped absence claims are unsound. Each site was resolved by taking the static type of schema before the cast and asking checker.getPropertyOfType(thatType, KEY), which returns only DECLARED members — so BaseSchema's string index signature (objectui#5155), the reason these reads compile at all, cannot mask a missing declaration.

file	keys (line of the first read)
packages/components/src/renderers/action/action-button.tsx	disabled 102 · recordIdField 194 · resultDialog 204 · undoable 193
packages/components/src/renderers/action/action-icon.tsx	disabled 83 · resultDialog 140

Evidence, both files: not a declared member of UIActionSchema & { type: string; className?: string | undefined; ac….

⇒ Four distinct keys, six read sites, one declaring type. Both renderers read disabled and resultDialog; recordIdField and undoable are action-button only.

The question

Each key owes one of these, and ⛔ the answer is not automatically "declare it":

• Declare it on UIActionSchema — it is a real authoring surface the renderer honours, and the type face is simply behind.
• Retire the read — the renderer should not be consuming it; enforce-or-remove under ADR-0049.
• Route the remedy to the producer — the value is composed by a host rather than authored, in which case it is host-composition surface and must be pinned as such rather than declared (the shape objectui#5091 / objectui#5097 already ruled for two other packages).

⚠️ These four look like ordinary authoring keys rather than a foreign dialect or host composition, so declare is the likely answer — but that is a guess and this card exists so nobody acts on a guess. Whoever rules should say, per key, which of the three it is and why.

⛔ What this card must not become

• ⛔ Not rows in undeclared-but-consumed-keys-6150.test.ts. objectui#8327's whole finding is that filing them there is a published-type widening wearing the costume of bookkeeping — that ledger's header now says so in its own words.
• ⛔ Not folded into objectui#8347. spec(types)!: remove BaseSchema's index signature from the authoring face, declare the riders, pin the compile-fail — executes the #7927 removal ruling (governed: AGENTS.md #0.1) #8347 inherits the same defect: one answer forced onto three different questions.
• ⛔ Declaring a key is a published-type widening on @object-ui/types ⇒ Clause ② applies to whatever lands, with needs:contract-review on card and PR.

Refs

objectui#8327 (the census and the unit ruling; the full per-key table with evidence is at its comment 5587605667) · objectui#8410 (why the checker, not a grep) · objectui#5155 (the index signature that lets these compile) · objectui#8347 (the declaration card whose blast radius this population corrects) · ADR-0049.

[os-litant]

Triage — objectui#8327 family (8 cards). domain:spec · pm:queue. ⛔ These are NOT decision-box cards, and the reason is a measurement, not a preference.

Taken 2026-09-10T13:39Z (clock read in the same call that posts this).

The ruling that governs all eight

Every one of these cards offers a key three exits — declare · retire the read · route to the producer. ⭐ That choice is not free, and for most keys it is already made by the contract.

packages/types in this repo is a mirror, not an authority: objectql.ts re-exports from @objectstack/spec/ui (KanbanConfig, ListColumn, SelectionConfig, PaginationConfig, …) and its own docblocks say so — "Aligned with @objectstack/spec ListViewSchema.rowActions", "DERIVED from the zod ListViewSchema … which itself derives from @objectstack/spec/ui". ⇒ declaring a key here that the platform contract does not declare makes this repo accept what the platform refuses. SKILL.md settles that direction outright:

协议为基准:spec 与代码不一致默认改代码对齐;改协议单独立卡,⛔ 不作缺陷卡的选项。

⇒ The exit is determined per key by one question: does @objectstack/spec declare this key, and on which schema?

• declared in spec ⇒ align the mirror. That is restoring declared = enforced, a named non-escalating class. Mechanical.
• not declared in spec ⇒ ⛔ "declare" is off the table on this card. The exit is retire-the-read or route-to-producer. Also mechanical.

Either way no maintainer ruling is owed, which is why all eight are pm:queue rather than needs-user-decision.

The screening measurement — with both controls

Word-frequency over packages/spec/src/ui/ on objectstack origin/main:

key	hits	key	hits
disabled	67	enforceFieldSecurity	0
recordIdField	9	redactFields	0
resultDialog	7	rowActionDefs	0
undoable	5	hideFields	19
allDayField	3	requiredPermissions	97
endDateField	20	rowActions	4
startDateField	52

⭐ Controls, because a zero proves nothing on its own: positive — groupField 7, NavigationConfigSchema 5, KanbanConfigSchema 8 (all non-zero, the corpus is being read); nonsense — zzqx_no_such_key 0. ⇒ the three zeros above are readings.

⚠️ What this screening does and does not establish. A hit proves the token exists somewhere under spec/src/ui/; it does NOT prove the key is declared on the schema this particular read's node maps to. ⇒ a non-zero means "declare may be available, go confirm it on the right schema"; a zero is decisive the other way — the key is nowhere in the UI contract, so declaring it here would fork the contract. Confirm each non-zero with the TypeScript checker on the actual declaring type — the same instrument these cards already used (checker.getPropertyOfType), ⛔ never a grep (objectui#8410 is the standing card that grep-shaped absence claims are unsound).

---

This card — components, 4 keys / 6 sites off UIActionSchema

All four screen non-zero in the UI contract (disabled 67 · recordIdField 9 · resultDialog 7 · undoable 5). ⇒ "declare" is plausibly available for each — but confirm on the actual declaring type before writing anything, because the screening cannot tell disabled on an action from disabled on some unrelated schema, and 67 hits is exactly the kind of number that invites a wrong assumption.

⇒ Per key: confirm against spec's action schema with the checker. Declared there ⇒ align the mirror. Absent there ⇒ retire the read or route to producer; ⛔ do not declare it here.

Size/model suggestion: M — the diff is small per key, the per-key confirmation is the work.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 2026-09-10T13:39Z · 本评论来自分诊座位}

---

Generated by Claude Code

[claude]

Claim: PM loop round 9
Session: session_01L5xpA5q533BgTTNADibEFt
Branch: claude/issue-8648-ui-action-four-undeclared-keys
Worktree: objectui-issue-8648
Domain: domain:spec
File surface: packages/types/src/ui-action.ts (and its zod mirror if the per-key verdict reaches it), packages/components/src/renderers/action/ for a retire-the-read verdict, plus packages/types/src/__tests__/ and one changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier — ⛔ no --tier output is quoted; this container has no tier tool (ls scripts/pm/shows no tier/size/model script), and triage's own line readsSize/model suggestion: MClause-②: yes Thread-read: 5619607236 Serial constraints cleared:none — #9309 (PR #9540, held at gate ②) holds packages/types/src/objectql.ts and #8800 is a measurement-only dispatch touching no declaration face. Neither intersects packages/types/src/ui-action.ts or packages/components/src/renderers/action/`

---

⛔ The scope and the decision rule are triage's, quoted rather than summarised

Triage comment 5619607236 settles the exit per key, and settles it against the card's own guess:

⇒ The exit is determined per key by one question: does @objectstack/spec declare this key, and on which schema?

• declared in spec ⇒ align the mirror … Mechanical.
• not declared in spec ⇒ ⛔ "declare" is off the table on this card. The exit is retire-the-read or route-to-producer. Also mechanical.
  Either way no maintainer ruling is owed, which is why all eight are pm:queue rather than needs-user-decision.

And its screening, with both controls, over packages/spec/src/ui/ on objectstack origin/main: disabled 67 · recordIdField 9 · resultDialog 7 · undoable 5 — all four non-zero.

⚠️ Triage then says exactly what that screening does not establish, and this is the sentence to work from:

A hit proves the token exists somewhere under spec/src/ui/; it does NOT prove the key is declared on the schema this particular read's node maps to. ⇒ a non-zero means "declare may be available, go confirm it on the right schema" … Confirm each non-zero with the TypeScript checker on the actual declaring type — ⛔ never a grep.

⭐ disabled's 67 is singled out by triage as "exactly the kind of number that invites a wrong assumption". Treat it as the most dangerous of the four, not the safest.

The six sites, from the card

file	keys (line of the first read, at the card's sha 154fe2a — ⛔ re-derive)
packages/components/src/renderers/action/action-button.tsx	disabled · recordIdField · resultDialog · undoable
packages/components/src/renderers/action/action-icon.tsx	disabled · resultDialog

Four distinct keys, six read sites, one declaring type (UIActionSchema). The card's evidence came from checker.getPropertyOfType on the static type of schema before the cast, so BaseSchema's string index signature (objectui#5155) cannot mask a missing declaration. ⭐ Use that same instrument; ⛔ objectui#8410 is the standing card that grep-shaped absence claims are unsound.

⚠️ Pins that name this type — read them before you write

Measured by this seat on origin/main before dispatching: UIActionSchema appears in 8 test-tree files, three of them under packages/types/src/__tests__/:

• action-callback-retired-7068.test.ts:82 — carries 'UIActionSchema (objectui#5934); a success notice is successMessage. Retired under ADR-0049 '
• component-docs-retired-handler-keys-7340.test.ts:347 — "UIActionSchema.onSuccess is LIVE (the spec's navigation …)"
• content-channel-family-d-9256.test.ts:43 — names "the UIActionSchema arm of button"

⇒ as far as I read them, these pin callback/handler keys (onSuccess and the retired callback family) and not your four. ⛔ That is my reading, not a clearance: open all three and confirm per key before touching anything. A pin naming a key is a ruling in machine-readable form, and a card that walks into one gets vacated — this seat vacated objectui#9091 four hours ago for exactly that.

⚠️ My screening control was polluted, and I am telling you so you do not inherit it

I re-ran triage's nonsense control in this repo's test tree and zzqx_no_such_key returned 2 files, not 0 — because two other tests use that exact token as their negative control (detailRendererUndeclaredKeys-8649.test.ts:309, listViewNonAuthorKeys-8653.test.tsx:146). A nonsense word reused enough times stops being nonsense. Clean replacements measured here: qqzz_absent_token_9999 → 0, NoSuchSchemaXyzzy → 0. ⛔ Pick your own and verify it is zero in the corpus you are about to search, ⛔ never inherit one.

Clause-②: yes, and why it is declared before the verdict is known

The card states it: ⛔ "Declaring a key is a published-type widening on @object-ui/types ⇒ Clause ② applies to whatever lands, with needs:contract-review on card and PR." Per-key the answer may turn out to be retire-or-route, which would not widen — but references/contract-review.md:10 makes this declaration the conservative direction and ⛔ not a final finding. I have hung the carrier on this card and the PR must carry it. ⛔ You hang no label, add none, remove none.

⇒ If every key lands as retire-or-route and nothing widens, say so in the report; the seat re-reads the declaration against the diff at landing. ⛔ Do not re-declare it yourself.

⛔ What this card must not become — the card's own three fences

• ⛔ Not rows in undeclared-but-consumed-keys-6150.test.ts. objectui#8327's finding is that filing them there is a published-type widening wearing the costume of bookkeeping.
• ⛔ Not folded into objectui#8347.
• ⛔ Not one answer forced onto four keys. Say per key which of declare / retire-the-read / route-to-producer it is, and why, with the checker reading that decided it.

Deliverable

Worktree → code → tests → changeset → push → draft PR carrying needs:contract-review (which I hung; you do not). ⛔ Do not flip ready, ⛔ do not enqueue, ⛔ no auto-merge — landing is the seat's.

Report structured JSON: PR number and head sha, the per-key verdict with the exact checker.getPropertyOfType reading behind it, every premise of mine and of the card confirmed or refuted, your firing controls including the negative one you chose and verified, and CI as total / success / skipped / non-green plus whether total_count equals the returned array length.

Container hazards. /home/user/objectui is SHALLOW with a STALE origin/main; /home/user/objectstack is a shared primary checkout — ⛔ never fetch, checkout or cut a worktree in either; clone fresh into your own scratchpad subdirectory. ⛔ No git stash, ⛔ no git worktree prune, ⛔ never kill by process name, ⛔ never mutate the shared node_modules. ⚠️ scripts/pm/os-verify-lock.sh is not executable — invoke as bash <path>; a direct call exits 126, a reading about permissions and ⛔ not about anything you were measuring; ⛔ never chmod it. ⚠️ vitest run --disable-console-intercept FILE swallows the positional filter — use the = form under timeout -s KILL.

Measurement discipline. ⛔ grep -c counts lines, not occurrences. ⛔ A zero needs a same-subject control that fires. ⛔ A pathspec is not a corpus. ⛔ Never write "(no output above = clean)". ⛔ Never write a model identifier into any artifact.

⚠️ Test (shard 1/4) runs against a 20-minute ceiling; nine readings this shift span 661–1204 s. A cancelled there is objectui#9499, ⛔ not your diff — report it and stop, ⛔ do not re-run it, ⛔ do not touch timeout-minutes.

---

Generated by Claude Code

[os-sam]

os-dev-report

{
  "issue": 8648,
  "status": "done",
  "branch": "claude/issue-8648-ui-action-four-undeclared-keys",
  "pr": "https://github.com/objectstack-ai/objectui/pull/9543",
  "pr_number": 9543,
  "head_sha": "a1da4f875eae858a31935507f3bfa5972850b337",
  "premise_still_valid": true,
  "summary": "All four keys land as ALIGN THE MIRROR, each on its own reading. `UIActionSchema` now declares `disabled`, `recordIdField`, `resultDialog` and `undoable`, every one derived from the contract (`SpecAction['...']`, the form the file already uses for onSuccess / bodyExtra / bodyShape), and all eight read sites in action-button.tsx and action-icon.tsx are un-cast so the declaration is actually enforced. A new pin re-derives the contract side every run and goes red if a cast returns. Removing the read-side cast on `resultDialog` made the compiler name a SECOND defect the same `as any` had been hiding — @object-ui/core's `ResultDialogSpec` hand-copies the contract's block and has drifted on three I18nLabel members — which is outside this card's declared file surface, so it is filed as objectui#9542 and the write side carries a documented, pinned narrowing meanwhile. Something DOES widen here: four declarations land on a published @object-ui/types face, so Clause 2 is live and the seat's needs:contract-review is not a false alarm.",
  "per_key_verdict": {
    "disabled": {
      "verdict": "declare / align the mirror",
      "pre_cast_getPropertyOfType": "ABSENT on `UIActionSchema & { type: string; className?: string | undefined; actionType?: string | undefined; }` at action-button.tsx:126 and :303 and action-icon.tsx:99 and :203 (lines re-derived at 75fca9669, not the card's 154fe2a)",
      "spec_getPropertyOfType": "DECLARED on `Action` (z.input of spec's ActionSchema), type `string | boolean | { dialect: 'cel'|'cron'|'template'; source?: string; ast?: unknown; meta?: ... }`",
      "spec_inline_sibling": "ABSENT on InlineActionParsed — and spec's own packages/spec/src/ui/inline-action.test.ts asserts from the other side that `disabled` is not inline-authorable",
      "note": "triage singled this out as the most dangerous of the four. The 67/71-hit token screen says 'present' and decides nothing; the per-schema checker reading is what decided it."
    },
    "recordIdField": {
      "verdict": "declare / align the mirror",
      "pre_cast_getPropertyOfType": "ABSENT at action-button.tsx:218",
      "spec_getPropertyOfType": "DECLARED on `Action`, type `string | undefined`",
      "spec_inline_sibling": "ABSENT on InlineActionParsed"
    },
    "resultDialog": {
      "verdict": "declare / align the mirror",
      "pre_cast_getPropertyOfType": "ABSENT at action-button.tsx:228 and action-icon.tsx:156",
      "spec_getPropertyOfType": "DECLARED on `Action`, a strict object of title/description/acknowledge/format/fields",
      "spec_inline_sibling": "ABSENT on InlineActionParsed",
      "note": "un-casting the READ surfaced the @object-ui/core ResultDialogSpec drift; see out_of_scope_findings"
    },
    "undoable": {
      "verdict": "declare / align the mirror",
      "pre_cast_getPropertyOfType": "ABSENT at action-button.tsx:217",
      "spec_getPropertyOfType": "DECLARED on `Action`, type `boolean | undefined`",
      "spec_inline_sibling": "ABSENT on InlineActionParsed"
    }
  },
  "instrument": "One-off node+typescript program (kept in scratchpad, NOT committed): built a Program over the two renderer .tsx files plus a probe module, walked every PropertyAccessExpression whose base — after stripping parens and the AsExpression — is the identifier `schema`, took checker.getTypeAtLocation on that identifier (i.e. the static type BEFORE the cast) and called checker.getPropertyOfType(type, key). Same instrument on `declare const a: Action` / `ActionParsed` / `InlineAction` / `InlineActionParsed` from @objectstack/spec/ui and on `UIActionSchema`. Re-run AFTER the change: all eight sites report declared=true, hadCast=false, with the contract's own type.",
  "firing_controls": {
    "negative_control_token": "wwvv_nonexistent_key_8648 — CHOSEN FRESH and verified zero in the corpus actually searched: `git grep -l` over the whole tracked tree of my own clone returned 0 files. NOT inherited: the seat's warning is confirmed — zzqx_no_such_key returns 3 files in this tree, qqzz_absent_token_9999 returns 0.",
    "negative_control_in_the_checker": "getPropertyOfType(wwvv_nonexistent_key_8648) is false on all four types (spec Action, spec ActionParsed, spec InlineActionParsed, UIActionSchema) and at all eight read sites, before AND after the change",
    "positive_controls_checker": "`label` declared on all four types. `endpoint` and `enabled` declared on UIActionSchema and ABSENT on spec's Action — so the instrument is not merely reporting 'mirror equals contract'. `refreshAfter` declared on InlineActionParsed, which is exactly where two of the four card keys are absent.",
    "positive_control_corpus": "`UIActionSchema` -> 27 files via git grep -l in the same corpus (fires)",
    "runtime_census_controls_in_the_pin": "declaringActionSchemasOf('label') == ['ActionSchema','InlineActionSchema']; declaringActionSchemasOf('wwvv_nonexistent_key_8648') == []; both contract schemas assert-walkable with shape length > 2",
    "regex_controls_in_the_pin": "each negative source-text leg is paired with a control string that varies ONLY the claim (same read re-cast / un-cast), asserted true and false in the same test",
    "duplicate_search_control": "the ResultDialogSpec zero (total_count 0) is paired with an MCP search on the same subject shape that returned total_count 31 including this very card #8648"
  },
  "premises_confirmed_or_refuted": {
    "card: the four keys are not declared members of the pre-cast schema type": "CONFIRMED — checker.getPropertyOfType, all 8 sites, declared=false; controls label/endpoint fire",
    "card: the pre-cast static type is `UIActionSchema & { type: string; className?: string | undefined; ac...`": "CONFIRMED verbatim — checker.typeToString prints `UIActionSchema & { type: string; className?: string | undefined; actionType?: string | undefined; }`",
    "card: 6 read sites": "CONFIRMED as 6 (key,file) PAIRS; the actual count of read EXPRESSIONS is 8 — `disabled` is read twice in each renderer (the predicate and the declared-gate). Reported as a refinement, not a refutation.",
    "card: line numbers at 154fe2a": "REFUTED as current, exactly as the card warned. Re-derived at 75fca9669: action-button disabled 126 (card 102) / undoable 217 (193) / recordIdField 218 (194) / resultDialog 228 (204); action-icon disabled 99 (83) / resultDialog 156 (140). Second `disabled` read at action-button:303 and action-icon:203.",
    "card: declaring a key is a published-type widening on @object-ui/types, Clause 2 applies": "CONFIRMED and LIVE — four declarations landed on the published face. Also an ALIGNMENT in objectui#8649's sense: the accept set moves to the contract's and not past it.",
    "triage: all four screen non-zero under packages/spec/src/ui": "CONFIRMED with drift — re-run gives disabled 71 (triage 67), recordIdField 10 (9), resultDialog 8 (7), undoable 5 (5), with positive control groupField 7 and nonsense controls at 0. SEE caveat below: that reproduction was taken in the shared /home/user/objectstack checkout and is superseded.",
    "triage: a hit does not prove declaration on the schema the read's node maps to": "CONFIRMED and it MATTERED — InlineActionParsed declares label and refreshAfter but none of the four, so per-schema and per-token genuinely disagree on this card's subject.",
    "triage: the exit is declare when spec declares, retire-or-route when it does not": "APPLIED — spec declares all four on ActionSchema, so all four take the declare branch",
    "seat: UIActionSchema appears in 8 test-tree files": "CONFIRMED — git ls-files filtered to test paths, xargs grep -l returns exactly those 8",
    "seat: the three packages/types pins name callback/handler keys, not your four": "CONFIRMED by opening all three and grepping each for the four keys: action-callback-retired-7068 0 hits, content-channel-family-d-9256 0 hits, component-docs-retired-handler-keys-7340 1 hit and it is a FILE NAME (component-docs-disabled-inherited-7239.test.ts), not a ruling on the key. Also checked the tombstone ledger and packages/types/src/internal/retired-field-keys.ts: none of the four is tombstoned. No pin was walked into.",
    "seat: zzqx_no_such_key is polluted in this repo's test tree": "CONFIRMED — 3 files (the seat measured 2; the third is the card-family sibling that has since landed). qqzz_absent_token_9999 -> 0. I used neither.",
    "seat: os-verify-lock.sh is not executable, lives in objectstack, invoke as bash": "CONFIRMED — mode -rw-r--r--, used as `bash /home/user/objectstack/scripts/pm/os-verify-lock.sh` throughout; never chmod'd",
    "seat (corrected mid-task): /home/user/objectui is SHALLOW with a STALE origin/main": "REFUTED, and I confirm the coordinator's re-measurement independently — git rev-parse --is-shallow-repository -> false; local origin/main == 75fca9669 == the sha my fresh clone checked out. The real hazard is the WORKING HEAD 4f2d1f4a6, which is not an ancestor of origin/main (merge-base --is-ancestor exit 1, with control leg origin/main~50 exit 0). See readings_retaken.",
    "seat: Test (shard 1/4) 20-minute ceiling / objectui#9499": "NOT REACHED — no shard had a cancelled conclusion at report time; 10 checks still in_progress. Nothing re-run, timeout-minutes untouched."
  },
  "readings_retaken_after_the_coordinator_correction": {
    "what_was_taken_in_a_shared_checkout": "Two, and both are now corrected. (1) I read /home/user/objectui/AGENTS.md at the start, on the strength of the original dispatch wording. That tree is HEAD 4f2d1f4a6, NOT on main. (2) I reproduced triage's token screening and read spec's inline-action.test.ts in /home/user/objectstack, which measures is-shallow-repository -> TRUE and whose HEAD 5741ff1 is likewise not an ancestor of its origin/main 076bb97 (control leg origin/main~50 -> exit 0, so that negative is real).",
    "AGENTS_md_remedy": "Diffed the shared copy against `git show 75fca9669:AGENTS.md` in my own clone: 45 diff lines, and MATERIAL. main carries two rules the shared tree does not — rule #10 (never depend on useMemo/useCallback identity) and rule #11 (cite by CONTENT; a CROSS-FILE path:line is banned outright, gated by check:new-line-citations). I re-read main's text and complied: zero path:line citations anywhere in my diff (grep over the added lines and over the new file, exit 1 both), and `pnpm check:new-line-citations` reports `0 new citation(s)` at exit 0. main also restates the governed-surface rule as 'draft until an authorized approval, then the claiming seat lands it' — not applicable, my diff hits no governed surface.",
    "spec_screening_remedy": "The screening was only ever a SCREEN, and triage says so. Every VERDICT in this report comes from the checker over the INSTALLED @objectstack/spec@17.4.0 artifact inside my own clone's node_modules, never from the shared objectstack tree. The inline-authorability claim that corroborated it is now asserted directly in the committed pin, over that same installed artifact, so it no longer depends on any shared checkout.",
    "everything_else": "Every other tree reading — the renderers, packages/types, the pins, the gate scripts, package.json, tsconfigs — was taken in my own fresh clone of origin/main at 75fca9669 throughout."
  },
  "tests": "All heavy runs through `bash /home/user/objectstack/scripts/pm/os-verify-lock.sh -c ...` with OS_VERIFY_LOCK_SLOT=os-dev-8648; every VERDICT line quoted below is the lock's own. BUILD: turbo run build --filter='@object-ui/components^...' --filter='@object-ui/types^...' --concurrency=2 -> `Tasks: 7 successful, 7 total`, VERDICT command-exit 0. TESTS: pnpm exec vitest run packages/components/src/renderers/action/ -> `Test Files 19 passed (19)`, `Tests 299 passed (299)`, VERDICT command-exit 0. New pin alone: `Tests 16 passed (16)`. TYPE-CHECK: turbo run type-check --filter=@object-ui/types --filter=@object-ui/components -> `Tasks: 10 successful, 10 total`, VERDICT command-exit 0. The Equal legs are compiled ONLY by tsc -p tsconfig.test.json, so this run is the only thing that observes them. GATES (exit code captured before any pipe, each into its own redirect): check:changeset-presence 0 (`3 source file(s) of 2 released package(s) changed ... 1 changeset(s)`), check:new-line-citations 0 (`0 new citation(s), enforcement report-only`), check:action-forward-parity 0 (every declared surface `payload excess-property CHECKED`), check:control-bytes 0, check:spec-symbols 0 (`1384 files scanned against 5085 spec export names ... 0 untriaged collisions`), check:comment-mask-corpus 0, check:test-path-roots 0, check:handler-key-reads 0, check:changeset-claims 0. CONTROL-BYTE SELF-SCAN beyond the gate: grep -naP over all five changed files, exit 1 (no hit). LINT: repo-wide `pnpm exec eslint . --no-inline-config --format json`, exit 1 — 4998 files linted (count read from the json, not guessed), 95 errors and 13156 warnings, and ZERO of the 95 errors is in a file this branch touches; my four files report 0 errors (1 warning, a deliberate no-explicit-any on the `Equal` direction proof — the sibling pin objectui#8649 carries 2 of the same). The 95 are pre-existing repo state; ⛔ not measured against origin/main in a second full run, so they are reported as 'not mine', not as 'pre-existing' by measurement. ABLATION (from the COMMITTED state, script whose trap runs a RESTORE function on EXIT, INT and TERM, with absolute paths throughout (angle-bracket form spelled out as words because GitHub's sanitizer eats tag-shaped fragments)): Leg 1 deletes the `disabled` declaration from the mirror — source marker 1 -> 0 and injected marker 1 (both grepped, not inferred from the editor's exit code); `pnpm --filter @object-ui/types build` exit 0; DIST marker 1 -> 0, proving the mutation reached the artifact the pin reads; tsc -p tsconfig.test.json then exits 2 with 9 `error TS` — TS2339 on the type pins, TS2353 on the repro literal, and TS2339 at the renderer's own read site. Restore: `git checkout HEAD -- path` (never bare `git checkout --`), `git diff HEAD` empty, `git hash-object` on disk == `git rev-parse HEAD:path` (a15dc352d..., non-empty and equal), rebuild exit 0, dist marker back to 1. Leg 2 re-introduces the read-side cast in action-button.tsx — un-cast hits 1 -> 0, re-cast 1; the pin's source-text leg goes RED, `1 failed | 15 passed`; restore byte-identical (83edd648e...). Post-ablation: tree clean (`git status --porcelain` empty), pin green 16/16, type-check 9/9. DIRECTION: predicted 'turns red' for both legs before running; both did.",
  "ci": {
    "at": "read once at report time against head sha a1da4f875eae858a31935507f3bfa5972850b337",
    "total": 36,
    "success": 23,
    "skipped": 3,
    "non_green": 0,
    "in_progress": 10,
    "total_count_equals_returned_array_length": true,
    "note": "`total_count` 36 == returned check_runs array length 36. No cancelled conclusion on any shard, so objectui#9499 was not hit. ⛔ Did not wait for convergence and ⛔ did not poll — CI convergence is the PM's, not this seat's."
  },
  "mcp_calls": "5 — search_issues x2 (the duplicate check plus its firing control), issue_write x1 (filing objectui#9542), create_pull_request x1, add_issue_comment x1 (this report). Everything else went through unauthenticated repo-scoped REST reads, which returned 200; REST /search/issues returned 403 for both the claim and its control, so the duplicate check switched channel to one targeted MCP search, declared here.",
  "open_questions": [
    {
      "question": "The dispatch says the PR 'must carry needs:contract-review' AND, twice, that this seat hangs no label, adds none and removes none. Those cannot both be satisfied by me. PR #9543 currently carries `package: types`, `package: components`, `tests` (auto-applied by the repo's labeler, not by me) and does NOT carry `needs:contract-review`.",
      "options": [
        "A - the seat adds needs:contract-review to PR #9543 itself, which is what the no-label instruction implies and what keeps labels single-writer",
        "B - I add it, breaching an explicit and twice-repeated prohibition, and risk racing the size/package labeler's whole-set PUT"
      ],
      "recommendation": "A. The prohibition is explicit, absolute and repeated; 'must carry' is satisfiable by the seat and not by me. Flagged in the PR body's Acceptance notes too, so it cannot be missed at landing. Confirming the substance: something DOES widen — all four keys land as declare on a published @object-ui/types face — so Clause 2 is live, not a false alarm."
    }
  ],
  "out_of_scope_findings": [
    "filed as #9542: @object-ui/core's `ResultDialogSpec` claims in its own docblock to mirror the contract's `Action.resultDialog` and hand-writes title/description/acknowledge as `string` where the contract declares `I18nLabel` — so this repo refuses what the platform accepts, and ActionResultDialog renders the member straight into JSX. Surfaced by un-casting this card's `resultDialog` read: one `as any` was hiding two defects at once. Category (b), a declared-contract violation with the contract's own wording quoted. NOT fixed here: the repair spans @object-ui/core and @object-ui/app-shell, both outside this card's declared file surface, and its second half is a genuine i18n-resolution decision rather than a mechanical change. Duplicate search first (MCP, total_count 0, with a control returning 31).",
    "noted, not filed: `description`, `openIn` and `locations` are still read through `(schema as any)` in both action renderers although all three ARE declared members of `UIActionSchema` today. That is a different class from this card — a redundant cast over a PRESENT declaration, so the value arrives as `any` and the forward's type is unchecked, rather than a read with no declaration behind it. No reproducible defect and no contract violation, so it is neither (a) nor (b). Successor that will reach these forward blocks: the remaining cards of the objectui#8327 family, which are already queued and touch exactly these two files.",
    "noted, not filed: the objectui#8327 family's pattern of putting the whole ruling in one runtime-re-derived pin (objectui#8649's file) worked well enough here that I copied its shape, including its `objectShapeKeys` walker — and that walker as written cannot open a zod `preprocess`, because it follows `_def.in` only and a preprocess puts the object on `_def.out`. My copy is a breadth-first walk instead. Not filed against #8649: its own population is `ComponentPropsMap`, where the shape does not arise, so its reading is sound; this is a note for whoever copies it next. Successor: the next card in the family that needs a per-schema census."
  ]
}

---

Generated by Claude Code