[objectstack-fleet]

Requested by Warren · project thread

Fixes #29579

Clause-②: yes (widening)
Metadata-protocol: added

维护者速读

• 改了什么:referenceNameVisible 的说明改为写明下发的名字是 ADR-0079 显示名(nameField,否则 displayNameField,否则推导的标题字段),并列全五种下发 Record # 兜底的情形;下发值 { id, name, readRefused: true } 有了具名 schema,并入展开后 lookup 值的联合;引擎的类型改为从它派生。
• 为什么改:这个值发给读不到目标记录的人,公开文字必须准确说明暴露了什么;旧说明只写 nameField、只列了三种兜底,下发形状在 spec 里没有名字。
• 风险与回滚:不改任何行为;联合里原有的开放记录成员本就接受这个值,所以没有值的判定变化。回滚即 revert 本 PR。
• 先看:packages/spec/src/data/field-value.zod.ts(新 schema 与联合);packages/spec/src/data/field.zod.ts(说明文字);packages/objectql/src/engine-reference-name-visible.ts(类型派生)。
• 两分钟验证:pnpm --filter @objectstack/spec exec vitest run src/data/field-value.test.ts,预期全绿,含新用例「a reader refused the target of a referenceNameVisible field reads the NAMED name-only value」。
• 需要你做的:批准两个名字后再合并:新导出 ReferenceNameOnlyValueSchema / ReferenceNameOnlyValue,以及 readRefused 作为声明的键(triage 6587041711 要求合并前获维护者批准)。

What changes

• packages/spec/src/data/field-value.zod.ts. New closed ReferenceNameOnlyValueSchema (strictObject): id (a ReferenceIdValueSchema record id), name (non-empty string), readRefused: true. Type ReferenceNameOnlyValue is its z.input type. valueSchemaFor(def, 'expanded') for the reference types is now ReferenceIdValueSchema | ReferenceNameOnlyValueSchema | z.record(z.string(), z.unknown()). It is a read form only; the stored form stays ReferenceIdValueSchema.
• packages/spec/src/data/field.zod.ts. The referenceNameVisible JSDoc and .describe():
  • item 1: the name is the ADR-0079 D4 display name resolveRecordDisplayName answers (nameField, else displayNameField, else the derived title field), no longer "the target object's nameField value";
  • item 2: the Record # floor cases are now all five that objectql's servableNameField serves (field-level security, maskingRule, formula hop, an explicit pointer (or its displayNameField alias) at a column neither title-typed nor autonumber, no usable field-level answer), plus the ADR-0079 floor every reader gets (no resolvable or no non-empty name);
  • the describe names ReferenceNameOnlyValueSchema.
• packages/objectql/src/engine-reference-name-visible.ts. The hand-written ReferenceNameOnlyValue interface is gone; the module imports the type from @objectstack/spec/data (the module already imported @objectstack/spec/data at run time, so the edge exists). No behaviour change.
• Regenerated. content/docs/references/** (field.mdx, object.mdx, system/migration.mdx carry the field describe; field-value.mdx gains the section; index.mdx counts 1604 → 1605), api-surface, export-origins, declaration-map, json-schema.manifest, authorable-surface/data.json, and the strictness-ledger counts.
• Ledgers. dropped-refinements.baseline.json gains data/ReferenceNameOnlyValue site id (the build named it: the ReferenceIdValueSchema refine does not project, the same as the data/ReferenceIdValue row); type-alias-convention.pin.test.ts 818 → 819 isomorphic pins; strictness-ledger.test.ts field-value sites 4 → 5.
• Changeset. @objectstack/spec minor. @objectstack/objectql carries none: built dist/ holds 0 hits for the new import comment against 1 for a sibling string (positive control); the type is erased and the module is not re-exported.

Declarations, measured

• Clause-②: yes (widening). The PR adds two exports (ReferenceNameOnlyValueSchema, ReferenceNameOnlyValue) and three authorable-surface rows, which is a widening of the published surface (precedent FileRefusedValueSchema, 02d9f69). No value's parse verdict moves: the expanded reference union already held z.record(z.string(), z.unknown()), which accepts { id, name, readRefused: true }.
• Metadata-protocol: added. The build writes three new rows into the authorable-surface shard packages/spec/authorable-surface/data.json: data/ReferenceNameOnlyValue:id, :name, :readRefused. That is the claim's measurement and its stated arm. The value is served, never written: the stored form refuses it (test bad({ type: 'lookup' }, { id, name, readRefused: true })).

Tests

All at head 0d181d41, against a spec dist/ rebuilt from this tree.

• pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/data/field-value.test.ts src/data/field-reference-name-visible.test.ts src/type-alias-convention.pin.test.ts scripts/strictness-ledger.test.ts → Test Files 4 passed (4), Tests 69 passed (69).
• pnpm --filter @objectstack/spec typecheck, pnpm --filter @objectstack/objectql typecheck → exit 0.
• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 → Test Files 541 passed (541), Tests 10493 passed (10493).
• pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/data-reference-name-visible.test.ts (the served-value end-to-end suite of PR feat(objectql): a referenceNameVisible lookup or user field names a target the reader is refused, on $expand (#29460) #29576) → Tests 23 passed (23).

Reverse verification: the engine type follows the spec schema

One-shot, not kept. node scripts/ablation-replace.mjs changed the spec schema's name: z.string().min(1) to name: z.number() (anchor 1 → 0, blob e91212ba468a → e122c5983b7e), then rebuilt spec and type-checked objectql:

spec-build-exit 0
objectql-typecheck-exit 2
src/engine-reference-name-visible.ts(147,26): error TS2322: Type 'string' is not assignable to type 'number'.

Line 147 is the served.set(id, { id, name: resolveRecordDisplayName(...), readRefused: true }) call, so the engine reads the type from the rebuilt spec .d.ts. Restored (blob hash equals HEAD, git diff HEAD empty), spec rebuilt, objectql typecheck exit 0, check:generated all 14 current.

Acceptance notes

• packages/objectql/src/engine.ts (the private serveReferenceNames docblock, ~L13860) still says the floor is served "when field-level security keeps that field from the caller", one case of five. It is a private method's comment that does not ship (0 hits in objectql dist/index.d.ts), and the module header of engine-reference-name-visible.ts already lists all of them. Not in this claim's file surface; left as is.

Verification

Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 0d181d41 (19 paths vs merge base 81cd9eb0e).

• 107 derived, 106 run with exit 0, 1 NOT MEASURED. --ran reconciliation: ✓ dispatch-gates --ran: 107 derived famil(ies) accounted for — 106 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3).
• NOT MEASURED: pnpm check:dual-build-cjs-loads (exit 3, PREREQUISITE NOT MET: it needs every package built). Left to CI.
• node scripts/check-plugin-teardown-shape.mjs --self-test first exited 3 (shallow clone could not read its pinned positive control); after git fetch origin 621a4876… it exits 0 (48 cases pass).
• pnpm --filter @objectstack/spec check:generated → ✓ All 14 generated artifacts are up to date.
• node scripts/check-platform-checklist.mjs --changed-from origin/main (an exported interface left a module) → OK — 2 anchored file(s) in the change set, 9 anchor(s) judged, 0 lost.
• origin/main at 5bd615eff merges cleanly (git merge-tree exit 0); none of its commits since the base touch this diff's files.
• Families CI runs (lint, Test Core, type-check lanes) are CI's run on this PR.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is CI's run.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

Maintainer approval

Warren approved the new public names ReferenceNameOnlyValueSchema, ReferenceNameOnlyValue and readRefused as named, with Metadata-protocol: added kept: 「全部批准」 on the decision card 「六个命名/措辞全部按推荐批准吗？」 in the project thread "Decide pending spec name approvals", 2026-11-03 00:08Z. Recorded on this PR in seat comment 6591825483.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbahxR9HAJnTs7UKhmn

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/spec, touching 5 documentable anchor(s). ⚠️ 6 changed file(s) yielded no anchor (packages/spec/api-surface/data.json, packages/spec/authorable-surface/data.json, packages/spec/declaration-map/data.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/external-datasources.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/field-types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/validation-rules.mdx (via FieldSchema (symbol, a top-level const), valueSchemaFor (symbol, a top-level function))
• content/docs/deployment/troubleshooting.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/validating-metadata.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/getting-started/quick-reference.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/kernel/contracts/data-engine.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/backward-compatibility.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectql/types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectui/concept.mdx (via FieldSchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via FieldSchema (symbol, a top-level const), valueSchemaFor (symbol, a top-level function))
• content/docs/releases/v17/17-1.mdx (via FieldSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 6 changed file(s) yielded no anchor (packages/spec/api-surface/data.json, packages/spec/authorable-surface/data.json, packages/spec/declaration-map/data.json, …) — pages documenting those are invisible to this run
• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 101 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 170 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5b2dbcc768333bcc62c672144fcf0feb694495ca — the merge of head 70dd701ebef21d4308a049722739980ab66f8d23 into base 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5b2dbcc768333bcc62c672144fcf0feb694495ca && git checkout 5b2dbcc768333bcc62c672144fcf0feb694495ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f 70dd701ebef21d4308a049722739980ab66f8d23 && git checkout -B drift-repro 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f && git merge --no-ff 70dd701ebef21d4308a049722739980ab66f8d23

node scripts/docs-audit/affected-docs.mjs --json 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 33ee9aa1a0f5273ea9f4d51bfface58d3885ec4f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0d181d4145a22f1170df2328feb87b77922f8d23
Local-runs: none
Scope: packages/spec/src/data/field-value.zod.ts, packages/spec/src/data/field.zod.ts + packages/objectql/src/engine-reference-name-visible.ts (servableNameField, serveReferenceNames), packages/spec/src/data/display-name.ts (resolveDisplayField, resolveRecordDisplayName, isTitleEligible), docs/adr/0079-record-display-name.md (D4–D6), packages/spec/src/data/field-value.test.ts, packages/spec/src/data/field-reference-name-visible.test.ts, packages/spec/dropped-refinements.baseline.json + packages/spec/scripts/lib/dropped-refinements.ts, packages/spec/authorable-surface/data.json, .changeset/29579-reference-name-only-value.md, scripts/check-changeset-no-major.mjs (the gate the declaration pair is judged by)

Inputs read: card #29579 body + its 3 comments (triage 6587041711, claim 6588872858, dev report 6589979343); PR #29623 body, 19-file list, net diff against merge base 81cd9eb0e9; the 42 check-runs on the head. The rest of the diff (generated references, api-surface / export-origins / declaration-map / json-schema.manifest shards, strictness-ledger counts, pin-count tests) is the lane seat's ACCEPT at TIER_DEFAULT; it was read to judge the hits, not reviewed.

① Derived judgments

• New public exports ReferenceNameOnlyValueSchema (const) and ReferenceNameOnlyValue (type) from @objectstack/spec/data — api-surface/data.json +2, export-origins +2, declaration-map +2, json-schema.manifest +1. Right: a closed strictObject of id (ReferenceIdValueSchema), name (z.string().min(1)), readRefused (z.literal(true)), built exactly as the FileRefusedValueSchema precedent (same helper, same surface/history wiring, same read-only docblock). The isomorphic pin (818 → 819) is right: no default, no transform, z.input equals z.infer.
• valueSchemaFor(def, 'expanded') for the reference types becomes z.union([ReferenceIdValueSchema, ReferenceNameOnlyValueSchema, z.record(z.string(), z.unknown())]). Accept set unchanged — right. The open z.record member already accepted every object the strict member accepts; the strict member precedes it, and a zod 4 union answers with the first member that parses, so { id, name, readRefused: true } now parses through member 2 with byte-identical output (no transform on either side). An expanded record that happens to carry exactly id, name, readRefused: true (a narrow $select on a target with such a column) takes member 2 instead of member 3 — same output, same verdict. A wider object ({ id, name, readRefused: true, owner }) fails the strict member on unrecognized_keys and falls through to z.record — same verdict as before (the new test pins the strict schema alone refusing it, and ok(...) through the union is not asserted for that case, which is fine). A non-string id ({ id: 42, ... }) falls through to z.record — same verdict. The only observable change is on inputs that already failed (a number, a boolean on an expanded lookup): the invalid_union issue now carries three branch issue sets instead of two. Error detail, not a verdict. multiple: true wraps the same element union in z.array, so the per-element claim holds.
• The stored form stays ReferenceIdValueSchema alone — right, and pinned by bad({ type: 'lookup' }, { id, name, readRefused: true }).
• referenceNameVisible describe + JSDoc (field.zod.ts ~L1733–1782): names the ADR-0079 D4 order (nameField, else displayNameField, else derived title) and resolveRecordDisplayName; names ReferenceNameOnlyValueSchema; lists five Record # floor cases plus the missing/empty-name floor. Judged right against servableNameField and the resolver — see ④.
• objectql engine-reference-name-visible.ts: the hand-written interface ReferenceNameOnlyValue goes; the type is import typed from @objectstack/spec/data, which the module already imports at run time. Type-only, erased; the module is not re-exported from the objectql entry (grep: engine.ts imports serveReferenceNames only). No published objectql surface moves. Right.
• authorable-surface/data.json +3 rows (data/ReferenceNameOnlyValue:id, :name, :readRefused): the mechanical reachability walk over exported object schemas, exactly as data/FileRefusedValue:id / :metadataRefused already sit in the same shard. Right as a measurement; what it entails for the declaration pair is ②.
• dropped-refinements.baseline.json +1 row (data/ReferenceNameOnlyValue, site id): right. ReferenceIdValueSchema's .refine (the embedded-record text guard) is a custom check with no JSON-schema projection; nested under the new export it is observed at path id, mirroring the existing data/ReferenceIdValue row at site ''. The ledger is hand-edited by design ("a new gap has to be a reviewed line in a diff") — this is that reviewed line. Consequence worth stating: the published JSON schema for ReferenceNameOnlyValue.id is wider than the runtime (it does not refuse {/[-prefixed text), the same gap ReferenceIdValue already carries.
• Generated references (field-value.mdx gains the section; field.mdx, object.mdx, system/migration.mdx carry the new describe; index count 1604 → 1605): consistent with the source; check:generated all 14 current per the dev; Spec property liveness check-run success.

② Semver level

Wrong as declared, and the gate says so: Check Changeset on this head concluded failure — annotation "metadata-protocol added contradicts clause-② no" (verdict contradiction, reason added-under-no). That check-run conclusion is the gate verdict and is read as such.

What the gate requires on THIS diff, read from scripts/check-changeset-no-major.mjs:

• The diff moves packages/spec/authorable-surface/data.json (+3 rows). That path is in PROTOCOL_BASELINE_ROOTS, so a declared Metadata-protocol: none is refused (none-baseline-moved: "none declared while the diff moves an authorable-surface/ … shard — a protocol change the ratchet can see → exit 1"). Option B of the dev's open question (none + spec patch) is therefore not available: it trades one red for another.
• Metadata-protocol: added beside Clause-②: no is refused (contradiction). The gate's own remedy text: "Clause-②: yes (plus (widening) if you like) beside added, or a kind that is not added beside no" — and narrowed/semantic are false here.
• So the only pair this diff can carry is Clause-②: yes (widening) + Metadata-protocol: added, with @objectstack/spec: minor (which the changeset already has).

That pair is also the honest one, not merely the one that greens. The dev measured Clause-② on the accept-set half only ("z.record already accepted the value") and that half is correctly no. But the line asks two things — 「本卡放宽接受集或扩大公开面吗」 (does the card widen the accept set OR enlarge the public surface) — and this diff enlarges the public surface by two exports (api-surface/data.json +2). The precedent is on file: the FileRefusedValueSchema entry (02d9f69, spec CHANGELOG) declared Clause-②: yes for exactly this move — a served-only read form given a named export and joined into the expanded union.

• Changeset .changeset/29579-reference-name-only-value.md: @objectstack/spec: minor — right for added. Body prose is accurate (read form only; open member already accepted the value; which name; when withheld). Its Clause-②: no line must change with the PR body's: AGENTS.md puts both declarations in both carriers, and the gate re-reads the PR body on edited but the changeset only on push.
• No objectql changeset: accepted. The objectql hunk is a type-only import in a module no entry point re-exports; objectql is a tsup-bundled package, so the emitted dist/ carries no new byte (the dev's 0-hit / 1-hit positive-control measurement is consistent with the gate's own note that a bundled module nothing reaches contributes no emitted byte). The gate grades a moved package with no entry as neither offender nor raised, so with the pair corrected its verdict is discharged (spec minor raised, objectql ungraded). Not the "bug fix in a released package" case that AGENTS.md says must take patch.
• Clause-②: line, corrected: yes (widening). Metadata-protocol: added. Level minor on spec. ADR-0087 disposition: not owed (no narrowing arm, nothing breaking).

③ Boundary flags

• Dev open question (keep added vs none): answered above — A, keep added, and the gate additionally requires Clause-②: yes (widening) beside it. none is refused by none-baseline-moved; the AGENTS.md sentence "what a metadata author can write" is read by the gate through the authorable-surface ratchet, and that ratchet counts every exported object schema's keys, served-only forms included (FileRefusedValue rows sit beside the new ones). The triage's own reading agrees: "declaring the served shape on the contract is a protocol addition, so p1".
• Dev flag — engine.ts private serveReferenceNames docblock (~L13860) names one floor case of five: confirmed on main (engine.ts:13863). Private, not emitted, outside this card's file surface and outside hits. Escalated as a carrier-none note for the server lane; not a finding on this PR.
• Dev deviation — dropped-refinements row added "because the build refused without it": that is the ratchet working as designed (a new dropped site must be a reviewed line); judged right in ①.
• Dev deviation — Clause-② measured no: wrong by the gate and by the line's second clause; must-fix in ④.
• Names needing maintainer approval before merge (triage 6587041711, claim 6588872858): ReferenceNameOnlyValueSchema / ReferenceNameOnlyValue / readRefused as a declared key. Not a reviewer's call; escalated to the maintainer with the summary below. The names are consistent with the sibling precedent (FileRefusedValueSchema / FileRefusedValue / metadataRefused) and with the engine's prior exported interface name, so approval does not reopen the design.
• Seat freeze (packages/metadata-protocol/src/protocol.ts, packages/spec/src/api/protocol.zod.ts, packages/spec/src/identity/protocol.ts until 06:00 UTC 3 Nov): none of the 19 files touches them. No engine behaviour change: confirmed, the objectql hunk is type-only.
• Check-runs still in_progress at review time (Test Core 1–8, Build Core, Type Check workspace / consumer gates / debt ledger, Lint lanes, Live E2E UI, Build Docs): their conclusions are not read as PASS here; this record's verdict rests on Check Changeset: failure and on ④, and does not need them.

④ Design judgment

packages/spec/src/data/field.zod.ts — the referenceNameVisible describe, against servableNameField (objectql, head L213–238) and ADR-0079 D4–D6. The served value goes to a reader who cannot read the target, so every word of exposure was checked against the code:

• Which name. servableNameField reads resolveDisplayField(targetSchema) = nameField ?? displayNameField ?? deriveDisplayField(fields) (display-name.ts:233), and serveReferenceNames passes only { id, [thatField] } to resolveRecordDisplayName (engine L145–147), which reads the same field. The describe's "its object's nameField, else its displayNameField, else the derived title field" is exactly D4. Holds.
• Floor case 1, FLS: getReadableFields(referenceObject, caller) not including the field → undefined (L233–234). Describe: "when the reader may not read that field". Holds.
• Floor case 2, maskingRule: L226. Holds.
• Floor case 3, formula hop: def.type === 'formula' && this.formulaReadsReference(...) (L227). Describe: "it is a formula reading through another reference". Holds.
• Floor case 4, explicit pointer at a column neither title-typed nor autonumber: L225 !isTitleEligible(def) && def.type !== 'autonumber'. A derived field is title-eligible by construction (D5), so only an explicit pointer reaches this branch — the describe's word "explicit" is accurate, and autonumber as the one non-text explicit primary is D5. A non-text formula pointer is caught by the same line and is covered by the same clause. An explicit pointer at a column that does not exist (def undefined, L223) also floors; the describe's wording covers it (such a column is neither title-typed nor autonumber) and the closing clause covers it. Holds.
• Floor case 5, no usable field-level answer: security not usable (L229), no getReadableFields (L231), or it throws (L235). Describe: "no field-level answer can be had for the reader". Holds.
• Missing/empty-name floor: resolveDisplayField undefined → servableNameField undefined → shown = { id } → Record #id; a resolvable field whose value is null/blank → isEmptyish → Record #id (display-name.ts:262–271, D6). Describe: "A target with no resolvable or no non-empty name reads as the same floor, as it does for every reader." Holds.
• Exposure bound. "Nothing else of the target": the engine's name read projects ['id', nameField] or ['id'] (L127) and the served object is built from id and the resolver output only (L147); the schema is closed. Holds. The describe's new sentence "the name field is read only where nothing the security layer owns must be computed" is the module header's own statement (L52–61). Holds.
• The existing spec pin (field-reference-name-visible.test.ts L172–186) still passes on the new text (nameField, { id, name, readRefused: true }, no #NNNN, the three bounds) — but it pins none of what this card changed. See should-fix 1.

packages/spec/src/data/field-value.zod.ts — ReferenceNameOnlyValueSchema against its first consumer (the engine) and the ruling. id is String(row.id) of a row the engine itself read (L142, L147), so it is a non-empty string and never {/[-prefixed — ReferenceIdValueSchema holds on every served value. name is resolveRecordDisplayName's answer: either a non-empty column value or Record #id with id set — never empty, so min(1) holds. readRefused is the literal true the engine writes. bareIdsOf (L85–90) only collects non-object elements and valueFor (L154–158) leaves objects untouched, so a record the caller already expanded is never overwritten by this value — the union's open member and the strict member describe disjoint producers. Tried to break it: a multiple: true field mixing a served value and a bare id parses per element (new test pins it); a wider object is refused by the strict schema alone and admitted by the union through the open member (correct: it is an expanded record, not this value). The one latent ambiguity — an expanded target record that genuinely has a readRefused column — predates this PR (the marker shipped in #29576) and the key name is the maintainer's to approve; it is not a finding against this schema.

Findings

• Must-fix 1 (FAIL). The declaration pair contradicts and the Check Changeset gate concluded failure on this head. Flip Clause-②: no → Clause-②: yes (widening) in BOTH the PR body and .changeset/29579-reference-name-only-value.md; keep Metadata-protocol: added and @objectstack/spec: minor. Do not take option B (none/patch): none-baseline-moved refuses it because the authorable-surface shard moves. One commit (the changeset) plus the body edit.
• Should-fix 1. packages/spec/src/data/field-reference-name-visible.test.ts pins the pre-spec(data): the referenceNameVisible describe names nameField where the engine resolves the ADR-0079 display name, lists three of its five name floors, and the served { id, name, readRefused } value has no named schema #29579 describe only. Add pins for what this card changed so the describe cannot drift back: displayNameField, ReferenceNameOnlyValueSchema, and one marker per floor case (e.g. maskingRule, formula reading through another reference, neither title-typed nor autonumber, no field-level answer, no non-empty name). Test-only; same PR or a follow-up.
• Should-fix 2. The JSDoc says "an explicit nameField (or displayNameField) points at a column …" while the shipped .describe() says "an explicit nameField points at …". resolveDisplayField honours either pointer, so the describe (the text that publishes) should carry the alias too, or say "an explicit title pointer". One clause.
• Noted, no fix owed here: the private engine.ts docblock (~L13860) names one floor case of five — server lane, carrier none.

Implemented-by: claude/project-thread-z15khz
Reviewed-by: session_01JQwxbahe4v7GBD94QeSnir (seat subagent)

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

Contract review — delta

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: aa107802f5ee54839685191e5f47980f7699c97b
Prior-head: 0d181d4145a22f1170df2328feb87b77922f8d23 — prior record 6590176512 (VERDICT: FAIL; must-fix 1, should-fix 1, should-fix 2)
Local-runs: none
Delta-scope: the one commit aa107802f ("spec(data): declare the new export as a widening, pin the display-name describe, name the displayNameField alias"), 6 files — .changeset/29579-reference-name-only-value.md, packages/spec/src/data/field.zod.ts, packages/spec/src/data/field-reference-name-visible.test.ts, regenerated content/docs/references/data/field.mdx, data/object.mdx, system/migration.mdx; plus the PR body's declaration lines. Compare 0d181d41...aa107802: ahead 1, behind 0. Nothing else moved: field-value.zod.ts, the engine module, the shards and ledgers are byte-identical to the reviewed head.

Closure

• M1 — declaration pair (closed). Changeset line Clause-②: no → Clause-②: yes (widening); Metadata-protocol: added and @objectstack/spec: minor kept. PR body carries Clause-②: yes (widening) / Metadata-protocol: added and a Declarations bullet naming the two exports, the three authorable-surface rows and the 02d9f69 precedent, while keeping the true statement that no value's parse verdict moves. That is exactly the pair the gate's own remedy text named and the only one this diff can carry (a moved authorable-surface/ shard refuses none). The changeset body's "Expanded lookup value" bullet now says what the declaration records; accurate.
• S1 — describe pins (closed). field-reference-name-visible.test.ts gains two cases on the JSON-schema projection's description: the D4 order string (nameField, else its displayNameField, else the derived title field) and ReferenceNameOnlyValueSchema; and one marker per floor case (the reader may not read that field, it declares a \maskingRule`, a formula reading through another reference, the explicit-pointer clause, no field-level answer can be had for the reader) plus the Record #floor and theno resolvable or no non-empty namefloor. Each literal was checked against the concatenated.describe()` string at this head and is a verbatim substring. The header comment's description of the key is updated to match.
• S2 — describe alias (closed). .describe() now reads "an explicit nameField (or its displayNameField alias) points at a column that is neither title-typed nor autonumber", matching the JSDoc and resolveDisplayField (nameField ?? displayNameField). The three reference pages that carry the field describe are regenerated with the same sentence; field-value.mdx is rightly untouched (its text did not change).

New findings

None. The delta is declaration lines, one clause of the shipped describe, test pins and regenerated prose; it introduces no schema, export, accept-set or behaviour change, and nothing in it is false against the code read for the prior record. The prior ① and ④ judgments stand on this head unchanged.

Check-runs reading (at review time)

• Success: filter, PR-body guards (claim · duplicate · Part-of · single-writer path), Auto Label, Governed Surface Queue Guard, Check Documentation Links, Check PR Size, Spec property liveness, Flag docs affected by code changes.
• In progress — not read as PASS: Check Changeset (two runs: the push and the body edited event; the prior head's failure was the contradiction verdict and the pair now reads what the gate's remedy named, so a success is expected but not yet observed), Build Core, Build Docs, Build UI Deps, Plan Test Core shards, Dogfood Regression Gate, Live E2E UI, Type Check · source gates / consumer gates / debt ledger / workspace, Lint · ESLint / PM dispatch-gates / repo & tooling gates / CI, release & engine gates / docs & code guards / scoped (tooling self-tests, slot lookup & corpus, query-options erasure).
• Skipped (opt-in or not applicable): Dogfood Verify CLI, UI Published Artifacts, Temporal Conformance, Dogfood Regression Gate shards, Packed-tarball smoke, 18.x upgrade harness, Schedule gate. One earlier PR-body-guards run shows cancelled (superseded by the rerun that concluded success).
• Standing condition: this delta verdict rests on the diff and the gate's own stated remedy; should Check Changeset or any lane conclude failure on aa107802, that conclusion is the gate verdict and this record does not override it.

Implemented-by: claude/project-thread-z15khz
Reviewed-by: session_01JQwxbahe4v7GBD94QeSnir (seat subagent)

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

维护者速读

• 改了什么:没有读权限的人展开 lookup 时，服务端返回的 { id, name, readRefused: true } 第一次有了正式名字 ReferenceNameOnlyValueSchema / ReferenceNameOnlyValue(从 @objectstack/spec/data 导出),引擎改用这个类型;referenceNameVisible 的说明改成名字取自 ADR-0079 的显示名(nameField,否则 displayNameField,否则推导的标题字段),并列全五种只给 Record # 的情况。
• 为什么改:这个值早已在线上返回，但规范里没有名字，字段说明也写错了名字来源、漏了情况(卡 spec(data): the referenceNameVisible describe names nameField where the engine resolves the ADR-0079 display name, lists three of its five name floors, and the served { id, name, readRefused } value has no named schema #29579)。
• 风险与回滚:没有任何值的解析结果改变;Clause-②: yes (widening)、Metadata-protocol: added、@objectstack/spec minor;回滚即 revert。
• 先看:packages/spec/src/data/field-value.zod.ts 新 schema;field.zod.ts 的 referenceNameVisible 说明。
• 两分钟验证:pnpm --filter @objectstack/spec exec vitest run src/data/field-value.test.ts src/data/field-reference-name-visible.test.ts,预期全过。
• 需要你做的:在决定卡上批准三个名字 ReferenceNameOnlyValueSchema、ReferenceNameOnlyValue、readRefused。批准后席位送入合并队列。
• 席位意见:首轮复核 FAIL(6590176512)已全部修好，增量复核 PASS(6590344726);CI 全绿;沿用 FileRefusedValueSchema / metadataRefused 先例，建议批准。

席位核对

ACCEPT · domain:spec#3 · head 43a7db69a4e2755b9bb333d69165511e964b178f · 2026-11-02T23:56Z

1. Shape: 20 files. The source change is field-value.zod.ts (+49: closed ReferenceNameOnlyValueSchema, joined into the expanded reference union ahead of the open record member) and field.zod.ts (the referenceNameVisible JSDoc and describe). The engine's engine-reference-name-visible.ts (−12) drops its hand interface for the spec import. Also in the diff: three test files, the regenerated reference pages and shards (api-surface, authorable-surface, declaration-map, export-origins, json-schema.manifest), the strictness counts doc, the dropped-refinements ledger, and the changeset (@objectstack/spec minor). Inside the claim (6588872858); no protocol.ts file touched.
2. Premise, measured: all three gaps were shown on main 81cd9eb0. The describe pins are verbatim substrings of the shipped .describe() string, as the delta reviewer checked. The dev's reverse verification broke the schema's name type, which turned the objectql typecheck red with TS2322; restoring it brought it back green.
3. Gates: dev derived 107 at 0d181d41, 106 exit 0, 1 NOT MEASURED (check:dual-build-cjs-loads, left to CI). The last commit 43a7db69 touches only dropped-refinements.baseline.json: the header totals 248 → 249 and 998 → 999, to match the entry this PR adds. That fixed the Test Core red at aa107802 (dropped-refinements.test.ts:370). The dev ran both ledger tests: 43 passed. It is a non-source file, so no new contract-review hit. On this head there are 65 check-runs: 57 success, 8 skipped, none failing. mergeable_state is clean.
4. Accepted deviations: none. The declaration pair Clause-②: yes (widening) with Metadata-protocol: added is the one the gate requires for a moved authorable-surface/ shard. The body says so, and also that no value's parse verdict moves.
5. Out of scope: the engine's behaviour is unchanged; only its type now comes from the spec. Skills-docs: not applicable.
6. Landing: not governed (check-governed-merges --pr 29623: NOT governed, 256 changed lines). Contract review at CONTRACT_REVIEW_TIER: the delta PASS (6590344726) covers every source file on this head. Gated on Warren's approval of the three names on the decision card. On approval the seat runs pr_ready + automerge_enable. If he asks for different names, the card goes back to pm:queue with Resume-from: claude/project-thread-z15khz@43a7db69.

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

Maintainer approval · 2026-11-03T00:11Z

Warren approved this PR's open item at 2026-11-03T00:08Z in the project thread "Decide pending spec name approvals". The card asked 「六个命名/措辞全部按推荐批准吗？」 and he picked 「全部批准」. The post above that card listed this PR's item as follows.

• spec(data): the name-only reference value a refused reader is served has a named schema, and referenceNameVisible says which name it carries #29623 (card spec(data): the referenceNameVisible describe names nameField where the engine resolves the ADR-0079 display name, lists three of its five name floors, and the served { id, name, readRefused } value has no named schema #29579): ReferenceNameOnlyValueSchema / ReferenceNameOnlyValue / readRefused. His words: 「批准」, with Metadata-protocol: added kept.

With this, the gate the seat ACCEPT named is met. The head is unchanged since the ACCEPT. The seat now readies this PR and arms auto-merge, and needs-user-decision is removed.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head 43a7db6 · 2026-11-03T00:23Z

Taken under (c): the spec lane's seats have stood down, and the head has waited 75 min after the lane's PASS (6590344726) on an earlier head. A delta review.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 43a7db69a4e2755b9bb333d69165511e964b178f
Local-runs: none
Scope: packages/spec/src/data/field-value.zod.ts (ReferenceNameOnlyValueSchema, valueSchemaFor), packages/spec/src/data/field.zod.ts (referenceNameVisible), packages/spec/dropped-refinements.baseline.json (the delta), .changeset/29579-reference-name-only-value.md, the generated references and surface ledgers + packages/objectql/src/engine-reference-name-visible.ts (serveReferenceNames, servableNameField)

Inputs read:

• The lane's records on this PR: 6590176512 (FAIL, 0d181d41) and 6590344726 (PASS, aa107802f5ee54839685191e5f47980f7699c97b).
• The delta git diff aa107802 43a7db69: one commit, packages/spec/dropped-refinements.baseline.json, 2 lines.
• The net diff against main for the cited files, the head's check-runs, and git merge-tree against today's origin/main.

Taken by triage under (c): domain:spec is stood down. The PASS of 6590344726 is adopted for everything this record does not restate.

① Derived judgments

• The delta: right. 43a7db69 raises the ledger's header totals by one each: publishedSchemasWithDroppedRefinements 248 → 249 and droppedRefinementSites 998 → 999. The body at the head counts 249 entries and 999 sites, so the header equals the body. main reads 248/998 today, so this PR adds exactly its one row. git merge-tree against origin/main reports no conflict.
• The new export, re-read (adopted from 6590344726 and confirmed).
  • ReferenceNameOnlyValueSchema is a strictObject of exactly three members: id (ReferenceIdValueSchema), name (a non-empty string) and readRefused (z.literal(true)).
  • valueSchemaFor(…, 'expanded') adds it to the reference union beside the open record member, which already accepted that value, so no value parses differently. The stored form stays the bare id.
  • The engine now imports the type from the spec instead of declaring its own copy.
• The describe matches the engine: right.
  • The name source is resolveRecordDisplayName: nameField, else displayNameField, else the derived title.
  • The five floor cases match servableNameField: field-level security withholds the name field; a maskingRule; a formula reading through a reference; an explicit name field that is neither title-typed nor autonumber; no field-level answer. Each returns undefined there, and the answer is then the Record # floor.
  • "Served on $expand" matches the module header: an unexpanded read keeps the stored id (ADR-0104 D1).
• Generated references and ledgers move together. The changed files include field.mdx, field-value.mdx, object.mdx, references/index.mdx and migration.mdx, plus the api-surface, authorable-surface, declaration-map, export-origins and json-schema.manifest ledgers. They are re-rendered and covered by the green generation gates below.
• Gate verdicts on this head: 60 success, 14 skipped, 0 failures, 0 pending (total_count: 74). mergeable_state: clean.

② Semver level

@objectstack/spec: minor, with Clause-②: yes (widening) and Metadata-protocol: added, on both the changeset and the PR body. That is M1 of 6590176512, closed in 6590344726. A new published export, and a new member of the expanded value union, is a widening at minor. Right.

③ Boundary flags

• ⛔ New public names (the named schema export and readRefused as a declared key) wait for the maintainer's approval (triage grading on spec(data): the referenceNameVisible describe names nameField where the engine resolves the ADR-0079 display name, lists three of its five name floors, and the served { id, name, readRefused } value has no named schema #29579). The PR body must quote that approval before entering the merge queue.
• This PR edits two generated or hand-kept count ledgers: dropped-refinements.baseline.json and docs/audits/2026-07-unknown-key-strictness-ledger.counts/data.md. Those are the queue-collision surfaces of anchors Queue-flake anchor: scripts/dropped-refinements.test.ts #29530 and Queue-flake anchor: scripts/strictness-ledger-doc.test.ts #29524. Before enqueueing, merge origin/main and re-derive both totals, then land serially (landing-operations.md §D).

④ Design judgment

Naming the shape turns an engine-private interface into the one contract both sides read, and its closedness is the guarantee the ruling needs.

Security, rule level: a reader refused the target is served exactly the referencing row's id, the target's display name (or its floor) and the refusal marker. Nothing else of the target is served. The served object is built with exactly those three keys, the schema is closed, and a field-level rule on the name field still yields the floor.

Tried to break it:

• A multiple: true field: served per element, as stated.
• A target with no resolvable name: the floor, as for every reader.
• An unexpanded read: the bare id, unchanged.

Must-fix: none.

Should-fix: none new.

VERDICT: PASS

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 41555445786 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Type Check UI — 失败步骤: Verify spec-named symbols are derived, not hand-written（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 36 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

席位核对

ACCEPT · domain:spec#3 · head 505d409df054a7e2e5dd2d4c71296ff29edb9e00 · 2026-11-03T01:48Z · delta on ACCEPT 6591585603 (43a7db69)

1. Shape: two commits on 43a7db69. 572533ac merges origin/main with no conflicts. 505d409d touches one file, ui/packages/fields/src/index.tsx (+12/−17): the local interface ReferenceNameOnlyValue is gone, and the file adds import type { ReferenceNameOnlyValue } from '@objectstack/spec/data'. The docblock now sits on the unchanged isReferenceNameOnly and says the spec owns the shape. The one ui file is a declared addition outside the claim's surface, made for the reason below.
2. Premise, measured: queue build 41555445786 ejected this PR on Type Check UI → check:spec-symbols. The UI's local interface, which landed on main in feat(fields, spec): show a referenceNameVisible lookup's served name as plain text, and offer its field-form row #29639 after this branch's base, now collides with the spec export this PR adds. The PR-side CI never saw both together. The dev reproduced the failure: the pre-fix file at the same tree exits 1 with the queue's exact line, and the fixed file exits 0 (1778 files scanned, 0 untriaged collisions).
3. Gates:
   • The dev's local runs all passed: ui fields type-check exit 0, the name-only render test (11 passed), and the spec ledger and value tests after the merge (98 passed). check:generated reports all 14 artifacts up to date.
   • On this head, the UI families now run and are green: Type Check UI, Lint UI, all 16 Test UI shards, Build & E2E UI and Live E2E UI, alongside every other required check. Readings at landing time: 65 check-runs, 58 success and 7 skipped (the opt-in families), none failing; mergeable_state clean.
4. Contract review: record-recognisers --brief-template --paths ui/packages/fields/src/index.tsx answers TIER_DEFAULT, so this diff has no contract-surface hit. The swapped interface has the same three members as the spec's closed schema. The at-tier PASS records 6590344726 (lane) and 6592026818 (triage) cover every spec source file, and those files are byte-identical on this head.
5. Out of scope: no change to the changeset, PR body declarations, schema or engine.
6. Landing: not governed. Warren's approval stands (6591825483). The seat re-arms automerge_enable.

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-warren · session_01JQwxbahe4v7GBD94QeSnir

席位核对

ACCEPT · domain:spec#3 · head 70dd701ebef21d4308a049722739980ab66f8d23 · 2026-11-03T02:37Z · delta on ACCEPT 6593303221 (505d409d)

1. Shape: this is a merge of origin/main into 505d409d and nothing else. The queue dropped the PR at 02:07Z with MERGE_CONFLICT. The cause is real: feat(spec): a flow start input can declare that it is the id of a record of a named object (objectName) #29571 (772b3565) moved the same dropped-refinements.baseline.json. Only the header conflicted; the body merged automatically.
2. Premise, measured: the header was re-derived by counting the merged body, not by adding the two sides' numbers (platform-readings: counts come from the merged source). The result is 250 entries and 1012 sites, so publishedSchemasWithDroppedRefinements is 250 and droppedRefinementSites is 1012. The seat re-counted the body at this head and the header equals it. The diff against main in that file is the two header numbers plus this PR's one data/ReferenceNameOnlyValue entry.
3. Gates:
   • Dev, after the merge: check:generated passes (all 14 artifacts up to date). gen:strictness-ledger rewrote nothing. The spec ledger, pin and value tests pass (98). pnpm --dir ui check:spec-symbols exits 0.
   • Seat: git merge-tree --write-tree origin/main 70dd701e exits 0.
   • On this head: 65 check-runs, 58 success and 7 skipped (opt-in families), none failing, the UI families included.
4. Contract review: no spec source file changed against 505d409d. The at-tier PASS records 6590344726 and 6592026818 still cover every spec source file.
5. Out of scope: no change to the changeset, the PR body, the schema, the engine or the UI.
6. Landing: not governed. Warren's approval stands (6591825483). The seat re-arms automerge_enable.

---

Generated by Claude Code