fix(app-shell): honour dependsOn on a field-backed lookup action param (#8672)

[os-tesla]

Fixes #8672

Implements the director-seat ruling A — wire it (comment 5635652871, decision batch #115, maintainer verbatim 「同意」 on 1A·2A·3B·4A·5A, 2026-09-11).

What changed

1. ActionParamDialog supplies the live record to the reference-bearing pickers.
The supply site was CASCADE_OPTION_WIDGET_TYPES.has(field.type) ? { dependentValues: values } : {} — the option-widget family only. A lookup is in none of it, so LookupField fell through to the SchemaRendererContext tail that objectui#7206 measured as unconditionally {}, dependenciesMissing could never clear, and the trigger was disabled forever while prompting for the field the user had just filled. The dialog now ORs a second family beside the first, in a named predicate paramNeedsDependentValues() that carries the two grounds.

2. resolveActionParams reads the declared spelling. dependsOn: field.depends_on → dependsOn: field.dependsOn, and the depends_on member leaves RuntimeField. This is the spelling defect objectui#9130 built, rendered and then deliberately left for this ruling.

The two halves ship together because either alone is a regression — honouring the declared spelling while the dialog fed option widgets only is exactly what #9130 measured and refused to ship. The comment at the read site says so, so they cannot be split again.

⚠️ Clause-② — what accept-set widened

resolveActionParams's field-backed reader. Before this PR a resolved ActionParamDef.dependsOn could only be produced by an object field def carrying depends_on. After it, the accepted input is a field def carrying dependsOn.

Both directions of that swap are deliberate and asymmetric to the file's five sibling lookup keys, which keep their snake legs ranked behind the declared one:

• widened to dependsOn — @objectstack/spec 17.4.0's FieldSchema declares it, so declining it would be objectui refusing a protocol-declared key (「以 objectstack 协议为准」, the ruling's stated reason for rejecting arm B).
• narrowed by dropping depends_on — FieldSchema refuses that spelling by name (suggesting dependsOn), so no document that parses can carry it, and objectui#7357 already retired the renderer-side twin in LookupField. The siblings' snake legs are kept for producers that could still emit them; this key has none to protect. Keeping it would have left this resolver the last reader of a spelling the protocol rejects — the consumer-side tolerance AGENTS.md #0.1 bans.

⚠️ The reachable-input set therefore does not merely grow: a def carrying only depends_on now resolves dependsOn: undefined where it used to resolve a value. Pinned in both directions in leg C, including a def declaring both spellings.

Unchanged on purpose

• ActionParamSchema still refuses dependsOn written inline on a param. The ruling says so in as many words; the honoured route is the field-backed one. Leg B is the fence that keeps it there.
• CASCADE_OPTION_WIDGET_TYPES gains no member. That set is shared verbatim with the object form's cascade-CLEAR loop and with plugin-grid's BulkActionDialog, and its members mean "this widget's offered option set is re-resolved by resolveCascadingOptions" — which a lookup has none of. Adding lookup would have changed two surfaces this card never measured and decided objectui#4771's open boundary for them. The OR-beside shape is what the object form has shipped all along (needsDataSourceWiring on its own line beside the CASCADE_OPTION_WIDGET_TYPES line), and it is guarded by an assertion in leg A so a later "simplification" into a shared-set member goes red.
• BulkActionParamSchema is untouched, per the ruling.

The three measurements the ruling left to the implementer

① Which record does the dialog hold? values — its own in-progress param values, and there is no second candidate to rank against it. The grid's ctx.pendingRow ?? ctx.row shape exists because the grid has a persisted row to merge staged edits into; this dialog is not scoped to a record at all. Its option widgets have resolved against that same values since objectui#3765, so ruling A's "or the dialog's equivalent" is values, whole.

② Is plugin-grid's BulkActionDialog covered by this change? ⛔ No — it needs its own card, and the defect there is real. Measured: its supply site is the same CASCADE_OPTION_WIDGET_TYPES-only shape, and bulkParamToField spreads the param's remaining keys onto the field bag verbatim (...extra, with dependsOn not among the destructured keys), so a dependsOn on a bulk lookup param does reach LookupField and does raise the permanent gate. BulkActionParamSchema being non-strict is what lets it get that far. Not fixed here: plugin-grid is outside this card's declared file surface, and the PM seat recorded on 2026-09-09 that "the bulk-action twin is filed separately" — so a card may already exist. See the report for the dedupe-channel state.

③ Which surface did objectui#7165 fix? The grid's inline cell editor — ObjectGrid's renderCellEditor, which passes dependentValues={ctx.pendingRow ?? ctx.row} to FieldEditWidget (started by #7165 as ctx.row, finished by #7188), pinned in plugin-grid/src/__tests__/gridDependentValues-7165.test.tsx. That is precisely the reader relationalMetaKeys.ts's LOOKUP_EDITOR_ONLY names. ⇒ the note on its dependsOn row — "The grid supplies no dependent values, so that gate is permanent" — is stale, measured. ⛔ Not corrected here: plugin-grid is outside this card's file surface and the dispatch says to stop on breach and explain. Handed to the PM in the report.

PM mechanical assumptions (ZONE 2)

#	assumption	verdict
1	ActionParamDialog lives in packages/app-shell/src/hooks/useConsoleActionRuntime.tsx	❌ FALSIFIED. It lives in packages/app-shell/src/views/ActionParamDialog.tsx; useConsoleActionRuntime.tsx only imports and renders it, and is one of three consumers (with RecordDetailView and MetadataTypeActions). Followed the code.
2	CASCADE_OPTION_WIDGET_TYPES is in packages/core/src/evaluator/optionRules.ts	✅ confirmed
3	packages/fields/src/index.tsx needs no edit (held by objectui#8695)	✅ confirmed, and not edited. LookupField is not in that file — it is packages/fields/src/widgets/LookupField.tsx — and neither was touched: its dependentFilter / dependenciesMissing chain is used exactly as it already exists.
4	PR #8749 landed the CURRENT SHAPE, NOT CONTRACT pins	✅ confirmed — file and docblock present as described

Tests

Rewritten per the ruling's instruction that the CURRENT SHAPE, NOT CONTRACT pins go red and be rewritten. Legs A and C are now contract pins; leg B is unchanged; leg D is new and is the one the ruling makes possible — the end-to-end route from an object field def through resolveActionParams into the rendered dialog and out to the picker's query, asserting both that the gate lifts and that the parent's value reaches the query as a hard $filter (the declared param sees one candidate, the control param sees both).

Every leg keeps a lit control, including the negative one that an empty parent still gates — the fix supplies a record, it does not delete the gate.

Local verification — all on final head 5ac7369

run	verdict
pnpm exec vitest run …lookupDependsOnReach-8672.test.tsx	command-exit 0 — 14/14
blast radius (both paramToField suites, all resolveActionParams suites, all ActionParamDialog suites, the form's form-dependent-values, plugin-grid's bulkActionDialogRecord / gridDependentValues-7165 / lookupPickerKeys-7154, core/src/evaluator)	command-exit 0 — 31 files / 616 tests passed
pnpm --filter @object-ui/app-shell --filter @object-ui/core type-check	command-exit 0, zero error TS lines (each package runs tsc --noEmit && tsc -p tsconfig.test.json, so the test program is inside the check)
pnpm --filter '@object-ui/app-shell^...' build (dependency closure)	command-exit 0
pnpm lint (repo-wide, turbo run lint, 47/47 projects)	command-exit 0 — ⛔ no narrowing was declared or needed
check-changeset-presence · check-control-bytes · check-new-cross-file-line-citations · check-governed-queue-guard --test <paths>	exit 0 each; the citation gate prints 0 new citation(s), the governed guard prints NOT GOVERNED

The three plugin-grid / components suites are in that list as controls on the untouched shared set: they read CASCADE_OPTION_WIDGET_TYPES directly, so they would notice a member added to it.

Acceptance notes

A fifth carrier of the pre-ruling snake spelling (found by CI, fixed here)

packages/app-shell/src/utils/expandableFamily.identity-5874.test.ts asserted through PICKER_KEYS that the resolver emits camel dependsOn, while its shared field() fixture authored depends_on. The two agreed only while the resolver read the snake spelling; with the read on the declared key the fixture produced nothing and the loop went red on three of the four members (parent_deal, assignee, parent_node). The fixture moved, not the resolver — FieldSchema declares dependsOn and refuses depends_on by name. ⛔ No dual read was restored, no assertion weakened, nothing skipped. The fixture's other rows stay snake, which the resolver genuinely reads.

⚠️ Three more PICKER_KEYS members are camelCase-only, and this fixture authors all three in snake

@objectstack/spec's field.zod.ts states, in the lookup-picker block, which keys objectui's picker reads camelCase-only. It names four: displayField, descriptionField, lookupFilters and dependsOn — against three that keep a surviving snake alias in LookupField (lookupColumns, lookupPageSize, allowCreate, each read as snake-then-camel).

⇒ besides dependsOn, the camel-only set intersects PICKER_KEYS in displayField, descriptionField and lookupFilters, and the fixture authors each of them snake (display_field, description_field, lookup_filters).

Those three do not fail today, and the reason is worth stating precisely: resolveActionParams still dual-reads them (field.displayField ?? field.display_field ?? field.reference_field, and so on) — legs objectui#7435 kept deliberately, for a document stored before the key was tightened and for a host adapter outside this repo. So the resolver normalises snake to camel on the way out and the end-to-end path is intact; the camel-only rule bites only at LookupField, which the resolver never hands a snake key.

The latency is therefore conditional, not present: if any of those three legs is ever retired the way dependsOn's just was, these fixture rows fail in exactly the same way and for exactly the same reason. ⛔ Not widened into this PR — retiring a read is a change with its own evidence, which is the same line objectui#7435 drew.

⚠️ One correction to the round's framing, recorded rather than passed over: lookup_filters is not among the spellings the picker legitimately accepts. It survives on the resolver's kept leg alone.

Reverse verification — two ablations, each from the committed tree

Both mutations were proved on disk before the run (anchor counts in both directions plus git hash-object against the HEAD blob, an empty hash treated as failure), both restored under trap … EXIT INT TERM with absolute paths, and each restore proved by state (git diff HEAD --quiet), not by an exit code.

⚠️ No rebuild is involved and none is owed: both mutated modules are reached by the pin file through relative source imports (./ActionParamDialog, ../utils/resolveActionParams), not through a package exports into dist, so the "green because dist is stale" hazard does not apply to either leg.

• ABL-1 — paramNeedsDependentValues() reduced to the option-widget family (the pre-ruling shape) ⇒ 4 red: leg A "LIFTS the gate", leg A "re-gates when the parent is CLEARED", and both leg D tests. Leg A's negative control stayed green, which is correct — the pre-ruling shape also gates an empty parent.
• ABL-2 — the resolver put back on field.depends_on ⇒ 5 red: all three leg C subjects and both leg D tests.

⇒ Each half is measured on its own, and leg D is red for either — which is the evidence for the claim above that the two halves may not be split.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_011QreXiyMEqKLN4U5daMPVa

---

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

⚠️ Console Performance Budget — gauge not trustworthy

The eager closure was measured, but one of the ceilings it is measured against no longer means what it names, so this run carries no pass/fail verdict for the performance budget.

This is not a budget violation. Nothing grew: the half marked below is a verdict about the gauge, and a ceiling that has stopped measuring anything can neither clear a bundle nor condemn one.

Step	Outcome
Build packages	success
Check console performance budget	failure

Which half objected:

Eager-closure half	Verdict
Aggregate closure ceiling	✅ pass
Per-chunk ceilings	✅ pass
Ceiling sensitivity (headroom)	⚠️ broken gauge
Ceiling freshness (checkout vs. base branch)	✅ pass

⚠️ A broken gauge half is a verdict about the ceiling, not about the bundle: that line has drifted out of range of the regression it exists to catch, or the report behind it cannot be trusted. It does not say anything grew. The Check console performance budget step log carries the ceiling and the number it was compared against.

Reason: The entry chunk measured 144.3 KB, but the eager-closure half of this gate returned no trustworthy VERDICT: the report could not be read, a ceiling has drifted out of range of the regression it must catch, or (objectui#6245) a ceiling was replaced on the base branch after this checkout was made. The step log says which. This is not a passing budget — and it is not a size regression either.

See the workflow run for details.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	16.69KB	6.21KB
app-shell (runtime-config.js)	20.68KB	7.36KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	502.02KB	115.16KB
core (index.js)	8.52KB	3.41KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	211.58KB	58.68KB
fields (index.js)	247.89KB	62.50KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.22KB	2.26KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	32.15KB	10.49KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	34.34KB	9.17KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.83KB	10.95KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	4.39KB	1.66KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.52KB	4.88KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.24KB	2.16KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.39KB	3.10KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	14.81KB	3.63KB
plugin-calendar (index.js)	49.25KB	13.99KB
plugin-charts (index.js)	71.34KB	19.90KB
plugin-chatbot (index.js)	195.34KB	46.51KB
plugin-dashboard (index.js)	131.22KB	34.59KB
plugin-designer (index.js)	215.94KB	44.33KB
plugin-detail (index.js)	253.46KB	65.85KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	136.77KB	34.17KB
plugin-gantt (index.js)	166.95KB	41.04KB
plugin-grid (index.js)	211.66KB	57.50KB
plugin-kanban (index.js)	46.00KB	14.30KB
plugin-list (index.js)	112.58KB	27.65KB
plugin-map (index.js)	20.64KB	6.86KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	43.41KB	11.93KB
plugin-timeline (index.js)	30.07KB	8.74KB
plugin-tree (index.js)	9.55KB	3.32KB
plugin-view (index.js)	84.42KB	20.79KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	96.00KB	31.71KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.63KB	2.18KB
react (schema-input.js)	4.25KB	2.04KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	6.58KB	2.74KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	5.66KB	2.50KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (kanban-quick-add.js)	3.89KB	1.87KB
sdui-parser (parse.js)	25.28KB	7.80KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	14.82KB	4.99KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	1.00KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.93KB	1.49KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.74KB	2.25KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	4.73KB	2.28KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	14.04KB	5.36KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[github-actions]

⚠️ Console Performance Budget — gauge not trustworthy

The eager closure was measured, but one of the ceilings it is measured against no longer means what it names, so this run carries no pass/fail verdict for the performance budget.

This is not a budget violation. Nothing grew: the half marked below is a verdict about the gauge, and a ceiling that has stopped measuring anything can neither clear a bundle nor condemn one.

Step	Outcome
Build packages	success
Check console performance budget	failure

Which half objected:

Eager-closure half	Verdict
Aggregate closure ceiling	✅ pass
Per-chunk ceilings	✅ pass
Ceiling sensitivity (headroom)	⚠️ broken gauge
Ceiling freshness (checkout vs. base branch)	✅ pass

⚠️ A broken gauge half is a verdict about the ceiling, not about the bundle: that line has drifted out of range of the regression it exists to catch, or the report behind it cannot be trusted. It does not say anything grew. The Check console performance budget step log carries the ceiling and the number it was compared against.

Reason: The entry chunk measured 144.3 KB, but the eager-closure half of this gate returned no trustworthy VERDICT: the report could not be read, a ceiling has drifted out of range of the regression it must catch, or (objectui#6245) a ceiling was replaced on the base branch after this checkout was made. The step log says which. This is not a passing budget — and it is not a size regression either.

See the workflow run for details.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	16.69KB	6.21KB
app-shell (runtime-config.js)	20.68KB	7.36KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	502.02KB	115.16KB
core (index.js)	8.52KB	3.41KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	211.58KB	58.68KB
fields (index.js)	247.89KB	62.50KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.22KB	2.26KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	32.15KB	10.49KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	34.34KB	9.17KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.83KB	10.95KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	4.39KB	1.66KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.52KB	4.88KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.24KB	2.16KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.39KB	3.10KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	14.81KB	3.63KB
plugin-calendar (index.js)	49.25KB	13.99KB
plugin-charts (index.js)	71.34KB	19.90KB
plugin-chatbot (index.js)	195.34KB	46.51KB
plugin-dashboard (index.js)	131.22KB	34.59KB
plugin-designer (index.js)	215.94KB	44.33KB
plugin-detail (index.js)	253.46KB	65.85KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	136.77KB	34.17KB
plugin-gantt (index.js)	166.95KB	41.04KB
plugin-grid (index.js)	211.66KB	57.50KB
plugin-kanban (index.js)	46.00KB	14.30KB
plugin-list (index.js)	112.58KB	27.65KB
plugin-map (index.js)	20.64KB	6.86KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	43.41KB	11.93KB
plugin-timeline (index.js)	30.07KB	8.74KB
plugin-tree (index.js)	9.55KB	3.32KB
plugin-view (index.js)	84.42KB	20.79KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	96.00KB	31.71KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.63KB	2.18KB
react (schema-input.js)	4.25KB	2.04KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	6.58KB	2.74KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	5.66KB	2.50KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (kanban-quick-add.js)	3.89KB	1.87KB
sdui-parser (parse.js)	25.28KB	7.80KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	14.82KB	4.99KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	1.00KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.93KB	1.49KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.74KB	2.25KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	4.73KB	2.28KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	14.04KB	5.36KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-tesla]

Clause-② in-seat contract review — PASS

domain:ui execution seat, session_011QreXiyMEqKLN4U5daMPVa (os-tesla), 2026-09-13T14:1xZ. This is the in-seat clause-② review the entry gate requires before this PR may be queued. Non-spec seat ⇒ default judgement tier plus the gates; this comment is the record the label strip cites.

What widened, stated plainly. resolveActionParams now honours field.dependsOn on a reader that previously ignored it. That is an accept-set widening on that reader ⇒ the claim's Clause-②: yes is correct, ⛔ not an over-declaration.

Is the widening inside the declared contract? Verified against the contract source on objectstack/origin/main, ⛔ not against the report and ⛔ not from the installed package (this checkout has no node_modules, and an earlier grep there returned a zero its own control word proved was a DEAD grep, not a negative):

packages/spec/src/data/field.zod.ts:1464   dependsOn: z.array(z.union([z.string(), strictObject({…
packages/spec/src/data/field.zod.ts:1423   … and `dependsOn` — are read camelCase-only, so a snake_case spelling of
packages/spec/src/data/field.zod.ts:1426   … (no dual read); `dependsOn` lost its own later,

⭐ Control word on the same file, same grep: referenceTo → 1 hit ⇒ the readings above are live, ⛔ not a dead path.

⇒ Two consequences, both matching the diff:

1. dependsOn is declared by FieldSchema, so honouring it is an implementation catching up to the protocol — the standing ruling that the protocol is the source of truth requires exactly this, and ruling A said ⛔ not B for this reason.
2. The contract is camelCase-only with no dual read, so dropping the field.depends_on read (and the depends_on member of RuntimeField) is pulling the reader back to the declared contract — ⛔ not a second widening, and ⛔ not a narrowing the contract forbids.

Scope of the widening: confined to this reader. The shared CASCADE_OPTION_WIDGET_TYPES gained no member (see the ACCEPT on objectui#8672 for the verification), so no other consumer's accept set moved. packages/spec/** is untouched by this diff — objectui declares nothing new.

Gates: repo-wide turbo run lint 47/47 exit 0, type-check across both packages exit 0 (test program included), changeset presence exit 0, governed-queue-guard --test NOT GOVERNED. ⇒ PASS; needs:contract-review is stripped citing this comment.

---

Generated by Claude Code

[os-tesla]

Bundle Analysis red here is the same standing ui-components debt — ⛔ not this PR's

domain:ui PM seat, session_011QreXiyMEqKLN4U5daMPVa (os-tesla). Third occurrence this round; recording it per PR as queueing with a red non-required check requires.

Every budget in the job passes. The single ❌ is the checker's gauge verdict (exit 2): the ui-components row's headroom has fallen under its 0.10x floor. The gate's own output states the row is "a standing debt that predates this change", that the verdict is "NOT an accusation that your diff spent the bytes", and that "there is therefore nothing here for this pull request to 'fix'" — with both greening edits (raise the ceiling, raise the allowance) ⛔ forbidden.

Taken where the gate directs: objectui#9251 (the open decision on the chunk) with objectui#9204 as the implementation row. Both already exist and are held by the seat working that chunk ⇒ ⛔ no duplicate filed. This PR's diff is packages/app-shell/** + packages/core/src/evaluator/optionRules.ts (comment-only) + a changeset; it ⛔ edits neither ceiling nor allowance.

performance-budget.yml declares only push and pull_request — ⛔ no merge_group — and the workflow's own comment records that it "cannot hold the merge queue". Outside the 9-check required set.

---

Generated by Claude Code

[github-actions]

⚠️ Console Performance Budget — gauge not trustworthy

The eager closure was measured, but one of the ceilings it is measured against no longer means what it names, so this run carries no pass/fail verdict for the performance budget.

This is not a budget violation. Nothing grew: the half marked below is a verdict about the gauge, and a ceiling that has stopped measuring anything can neither clear a bundle nor condemn one.

Step	Outcome
Build packages	success
Check console performance budget	failure

Which half objected:

Eager-closure half	Verdict
Aggregate closure ceiling	✅ pass
Per-chunk ceilings	✅ pass
Ceiling sensitivity (headroom)	⚠️ broken gauge
Ceiling freshness (checkout vs. base branch)	✅ pass

⚠️ A broken gauge half is a verdict about the ceiling, not about the bundle: that line has drifted out of range of the regression it exists to catch, or the report behind it cannot be trusted. It does not say anything grew. The Check console performance budget step log carries the ceiling and the number it was compared against.

Reason: The entry chunk measured 144.4 KB, but the eager-closure half of this gate returned no trustworthy VERDICT: the report could not be read, a ceiling has drifted out of range of the regression it must catch, or (objectui#6245) a ceiling was replaced on the base branch after this checkout was made. The step log says which. This is not a passing budget — and it is not a size regression either.

See the workflow run for details.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	16.69KB	6.21KB
app-shell (runtime-config.js)	20.68KB	7.36KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	502.02KB	115.16KB
core (index.js)	8.52KB	3.41KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	211.58KB	58.68KB
fields (index.js)	247.89KB	62.50KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.22KB	2.26KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	32.15KB	10.49KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	34.34KB	9.17KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.83KB	10.95KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	4.39KB	1.66KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.52KB	4.88KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.24KB	2.16KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.39KB	3.10KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	14.81KB	3.63KB
plugin-calendar (index.js)	49.25KB	13.99KB
plugin-charts (index.js)	71.34KB	19.90KB
plugin-chatbot (index.js)	195.34KB	46.51KB
plugin-dashboard (index.js)	131.22KB	34.59KB
plugin-designer (index.js)	215.94KB	44.33KB
plugin-detail (index.js)	253.46KB	65.85KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	136.77KB	34.17KB
plugin-gantt (index.js)	166.95KB	41.04KB
plugin-grid (index.js)	211.66KB	57.50KB
plugin-kanban (index.js)	46.00KB	14.30KB
plugin-list (index.js)	112.58KB	27.65KB
plugin-map (index.js)	20.64KB	6.86KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	43.41KB	11.93KB
plugin-timeline (index.js)	30.07KB	8.74KB
plugin-tree (index.js)	9.55KB	3.32KB
plugin-view (index.js)	84.42KB	20.79KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	96.00KB	31.71KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.63KB	2.18KB
react (schema-input.js)	4.25KB	2.04KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	6.58KB	2.74KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	5.66KB	2.50KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (kanban-quick-add.js)	3.89KB	1.87KB
sdui-parser (parse.js)	25.28KB	7.80KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	14.82KB	4.99KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	1.00KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.93KB	1.49KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.74KB	2.25KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	4.73KB	2.28KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	14.04KB	5.36KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped