decision(objectql): a navigationContributions[].group that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer?

Part of #14122 (measured by #14454 item 2, pinned in PR #14549).

What was measured

SchemaRegistry.applyNavContributions (packages/objectql/src/registry.ts, the else branch under if (c.group)): when a package contributes navigation items into a group id that the target app does not declare, the items are appended at the app's top level. Nothing throws, nothing carries an ADR-0112 code/status, and there is no console.warn / console.error. The only trace is one this.log(...) line, gated at logLevel info/debug. At OS_REGISTRY_LOG=warn — the level the objectql test config selects (#13517) — the relocation is completely silent while still happening.

The authoring door cannot catch it either: navigationContributions appears in no validateCrossReferences rule, and the group id names a node in an app the contributing package does not own.

Pins (record today's behaviour, no runtime change): packages/objectql/src/registry-nav-contribution-group-semantics.test.ts — PROPOSITION 2 (DOES NOT HOLD AS POSED), PROPOSITION 2 (visibility), PROPOSITION 2 (authoring door). Ablation on #14549 confirmed the pins go red when the branch drops items instead of relocating.

Why it matters

#14122 §4 feared a vanishing contribution. A relocated one is worse for the named consumer (hotcrm's 17-node navigation conversion, hotcrm#1449): the entry is present, a smoke test passes, and the information architecture has silently changed. A typo'd group id is exactly the error an AI author emits.

Options

	Option	Cost	What it buys
A	Refuse at install: reject the contribution with an ADR-0112 envelope when the target app declares no such group	Introduces an ordering constraint — `registerAppNavContribution` deliberately does not require the target app to exist yet, and the merge is a read-time fold precisely so registration order does not matter; also breaks any package contributing into an optional group	The loudest signal, before any user sees a moved menu
B	Keep relocating, upgrade the trace to `console.warn` (or a real diagnostic) so it survives `OS_REGISTRY_LOG=warn`	One-line change to an existing log call; no new refusal, no ordering constraint	The failure is noticed at the point it happens; still not a gate
C	No platform change; hotcrm's conversion asserts its own merged nav tree equals the pre-split tree	A test in the consumer repo	Catches the regression for the one measured consumer only

Four-axis reading (PM seat, for the maintainer to confirm or overrule)

平台长期一致性 — A is the contract-first shape in the abstract, but it trades away the order-independence the read-time fold was designed for; B keeps the design and fixes the observability gap.
实测业务拉力 — the only measured consumer (hotcrm 17-node conversion) needs the mis-aim to be noticed; B delivers that at the point of failure, C delivers it in the consumer's own suite.
AI agent 抗错性 — a typo'd group id today yields a silently different IA; B makes it visible without inventing a refusal an author must learn to suppress.
创业阶段范围纪律 — B changes one log call, C adds one consumer test; A adds a new refusal surface and a registration-order rule.

Recommendation: B now, C alongside in hotcrm. If the maintainer wants the gate rather than the signal, A is the shape — and it should then also cover the app-does-not-exist case, which is equally unchecked today.

Not release-gating for the ADR-0130 chain: the behaviour is unchanged from before the epic and no packaged product depends on navigationContributions yet.

Maintainer ruling recorded — B + C: the relocation stays but becomes a real diagnostic that survives `OS_REGISTRY_LOG=warn`, plus a compile-time check when both sides share one artifact; hotcrm asserts its own merged tree (hotcrm#1456)

Director seat (objectstack #12708), summon #10, session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-02.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, 2026-09-02, replying to decision batch #13 in which this card was item 5 with the recommendation B + C (fallback A), matching the PM seat's four-axis reading on the body. Verbatim reply: 「同意」.

Ruled: B + C.

B (platform). SchemaRegistry.applyNavContributions keeps relocating a contribution whose group names no group in the target app to the app's top level (the read-time fold stays order-independent; contributions into optional groups keep working), but the trace becomes a real diagnostic: an ADR-0112-shaped entry carried in the app's diagnostics and emitted at warn, naming the contributing package, the app, the missing group id and the relocated items, so it is visible at OS_REGISTRY_LOG=warn and in os doctor / boot output. In addition, when the contributing package and the target app are composed into one artifact (composeStacks), os build checks the group id at compile time and reports the same diagnostic loudly there, where an AI author sees it first. No refusal is added; the runtime fold is unchanged.
C (consumer). hotcrm's navigation conversion (hotcrm#1449) asserts in its own suite that the merged tree equals the pre-split tree, with an ablation control: hotcrm#1456 (pm:queue).

Option A (refuse at install with an ordering constraint) is not taken; if a gate is ever wanted it must also cover the app-does-not-exist case.

Execution: domain:engine lane (packages/objectql registry; compile-time half in packages/spec composeStacks or the cli build step, implementer's call, one PR), S. Clause-② no (no accept-set change; a diagnostic is added). Pins: the three PROPOSITION 2 pins from PR #14549 are inverted on visibility (the diagnostic is present at warn), the relocation pin stays; a build of examples/app-multi-package with one typo'd group id prints the diagnostic; hotcrm's assertion is that repo's.

Labels set by the director seat so the card is claimable: domain:engine, priority:p2; triage may re-grade.

State transition, same stroke: needs-user-decision → pm:queue. Ledger: objectstack director seat post #12708, summon #10.

Generated by Claude Code

Claim record — session `session_01UHvF5hyiZjnCyExFnfQB8m`, branch `claude/issue-14553-nav-group-relocation-diagnostic`

Posting the identity record for this card. All agents share one GitHub identity, so the assignee field cannot say who holds a card; the branch name plus the session id above is the identity bit.

Comments were re-read before any code was written: the only comment on this card was the director seat's ruling (5518065119), with no prior claim from another session, so this was not taken.

Two half-states worth recording rather than silently repairing:

The card arrived with no assignee. That is a PM-side half of the claim (labels were set, pm:queue applied); a dev seat never writes the assignee field, so it is reported here rather than filled in.
This record is being posted at PR time rather than before the first edit, which is the ordering the repo playbook asks for. It cost nothing here — no second session was working this card, and the branch was pushed empty as a landing marker before the first edit — but the deduplication value of a claim comment is in being early, so the deviation is stated instead of glossed.

Work is complete and open as a draft: #14920. Structured report follows in the next comment.

Generated by Claude Code

os-dev-report

{
  "issue": 14553,
  "status": "done",
  "branch": "claude/issue-14553-nav-group-relocation-diagnostic",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14920",
  "premise_still_valid": true,
  "summary": "B (platform) half of the B+C ruling. RUNTIME: applyNavContributions still relocates a contribution whose group names no group in the target app (fold unchanged, order-independent, optional groups keep working, no refusal added); the info-gated log line becomes an ADR-0038 BuildIssue-family record naming the contributing package, the app, the missing group id and the relocated items, carried on the app via the new registry.getAppNavDiagnostics(appName) and announced through a new level-aware warn(), so it survives OS_REGISTRY_LOG=warn. De-duplicated once per registry per distinct mis-aim, because the fold runs on every read of the app; a silent deployment keeps the record. COMPILE-TIME: os build asks the same question over a composed artifact through the SAME imported predicate (packages/cli/src/utils/nav-contribution-groups.ts), reporting in the text face and in --json under navigationGroupDiagnostics, without refusing. Two recorded deviations from the literal ruling wording, both measured: (1) 'carried in the app's diagnostics' is a registry-side per-app list, NOT the protocol's _diagnostics envelope -- protocol.ts reads `item?._diagnostics ?? computeMetadataDiagnostics(t, item)`, so pre-stamping would suppress the app's spec-validation verdict, and MetadataValidationResult.warnings[] is {path,message} with no code under a closed schema, making an ADR-0112-shaped entry there an accept-set widening that clause-2 rules out; (2) the code is lowercase and gets NO ledger entry -- ADR-0112 D6c on all four of its tests. PM-side half-state: the card arrived with no assignee (labels were set); reported, not filled in, and work proceeded.",
  "tests": "ALL exit codes captured by redirect-then-read, never across a pipe; gate verdicts quoted from each gate's own printed line. (1) pnpm --filter @objectstack/objectql test -> exit 0, 'Test Files 267 passed (267) / Tests 4595 passed (4595)'. (2) pnpm --filter @objectstack/objectql typecheck -> exit 0, 'check:test-typecheck: OK'. (3) pnpm --filter @objectstack/cli exec vitest run src/utils/nav-contribution-groups.test.ts -> exit 0, 8/8. (4) GATE UNION re-run on the FINAL head 2ab7f8695 with a clean tree, family derived by `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (64 commands): 57 green, 0 findings, 7 NOT MEASURED -- check-test-completeness (3), check-half-states (3), check:dual-build-cjs-loads (3, 'PREREQUISITE NOT MET ... nothing was measured'), check:type-check-debt (3, PREREQUISITE NOT MET), check:i18n (1, 'Nothing was checked'), check:i18n-coverage (1, 'Nothing was measured'), check:skill-examples (1, 'packages/client-react/dist holds no .d.ts'). Each self-declares its unmet prerequisite and refuses a verdict; none read as a pass. (5) check:dispatcher-error-vocabulary -- THE ANSWER THE DISPATCH ASKED FOR: it DOES land on that governed surface, as shape 'objlitconst', so its lowercase delegation to check:error-code-casing does NOT reach this position and a classification row was required; added as verdict 'foreign-vocabulary' / door 'none' with D6c evidence; gate now 'scope: ... 61 unregistered code-stamping site(s) found; 61 classified', exit 0. NO ERROR_CODE_LEDGER registration -- D6c: diagnostics codes stay lowercase and out of the ledger. check:error-code-casing exit 0 with no EXEMPT_FILES entry needed (the literal is a const declaration, not beside a `code` token). (6) THREE gates went red on my own work and were FIXED, not exempted: check:test-source-alias (a dist-resolved first load inside a clocked window -> module-top side-effect import, production import stays lazy); check:doc-authoring (a tracker id inside runtime string prose -> moved to an adjacent comment, per the 2026-08-12 ruling); check-system-context-census (pure line rot from the registry edit -> repaired with its own --fix, one doc anchor 464->475). (7) ABLATION A, runtime, source-resolved: removed ONLY the warn() emission, leaving the record -> 2 pins red (visibility, once-per-mis-aim) and the relocation pin stayed GREEN, which is what proves it pins the fold and not the log. Mutation confirmed on disk BEFORE the run (emission sites 1->0, injected marker count 1, blob c0699cf0->3e66307f); restored via `git checkout HEAD --` with an ABSOLUTE path, blob back to c0699cf0 == the HEAD blob, `git diff HEAD` empty, 0 markers left; restored leg 10/10 green. (8) ABLATION B, compile-time, DIST-RESOLVED (@objectstack/objectql is a KNOWN_UNALIASED_TEST_IMPORTS entry for @objectstack/cli): neutered checkNavContributionGroups, REBUILT objectql, `node scripts/ablation-dist-preflight.mjs @objectstack/objectql <marker>` reported the marker present in 4 built files -> 5 pins red; restored, REBUILT again, preflight --absent reported it gone from all 14 built files and the whole tree clean -> 8/8 green. Both legs rebuilt and both proven in dist. TWO FALSE MEASUREMENTS were caught by that discipline rather than by luck, and both are recorded because either would have produced a confident wrong reading: `grep -c` read the empty brackets in my anchor as a regex character class and reported 0 sites on a mutation that HAD landed (fixed with grep -cF); and the first ablation marker was written as a `//` comment, which the bundler strips, so the preflight VOIDED the run because the marker survived only in sourcemaps. (9) NOT MEASURED, declared narrowings: `pnpm --filter @objectstack/cli typecheck` -- 111 errors, 0 of them in the three files this PR touches, 96 of them TS2307 'Cannot find module' against sibling packages with no dist/ (client, rest, runtime, setup, verify, console, account); prerequisite is a 57-package build closure. And a spawned `os build` over examples/app-multi-package was NOT run, for that same closure. The narrowing is declared, and made as small as available: a pin runs the fixture through the identical normalizeStackInput + ObjectStackDefinitionSchema chain compile.ts runs and hands result.data to the derivation exactly as the command does, in both directions, so what is unexecuted is only the printWarning/printBulletList rendering of an already-pinned list.",
  "mcp_calls": "8",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

os-dev-report

Supersedes the earlier report on this card: the --json payload shape changed under review, and CI has since gone fully green. The JSON below is the current state.

{
  "issue": 14553,
  "status": "done",
  "branch": "claude/issue-14553-nav-group-relocation-diagnostic",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14920",
  "premise_still_valid": true,
  "summary": "B (platform) half of the B+C ruling, at head 799d57e15 with CI fully green. RUNTIME: applyNavContributions still relocates a contribution whose group names no group in the target app -- fold unchanged, order-independent, optional groups keep working, no refusal added. The info-gated log line becomes an ADR-0038 BuildIssue-family record naming the contributing package, the app, the missing group id and the relocated items; carried on the app via the new registry.getAppNavDiagnostics(appName) and announced through a new level-aware warn(), so it survives OS_REGISTRY_LOG=warn. De-duplicated once per registry per distinct mis-aim (the fold runs on every read); a silent deployment keeps the record. COMPILE-TIME: os build AND os validate answer the same question over a composed artifact through the same imported predicate, reporting in the text face and in --json under the EXISTING `warnings` key. PAYLOAD SHAPE CORRECTED UNDER REVIEW: the first cut added a top-level `navigationGroupDiagnostics` key and two standing pins refused it by name ('adds NO new top-level key to the payload -- this fills a declared key, it is not a new surface'); #11643 and #11727 each faced that choice and filled `warnings`, and a third pin in the same file requires that nothing rides in build that validate does not also report -- which is why validate computes the same list. No gate was edited to get green. Two recorded deviations from the literal ruling wording, both measured: (1) 'carried in the app's diagnostics' is a registry-side per-app list, NOT the protocol's _diagnostics envelope -- protocol.ts reads `item?._diagnostics ?? computeMetadataDiagnostics(t, item)`, so pre-stamping would suppress the app's spec-validation verdict, and MetadataValidationResult.warnings[] is {path,message} with no code under a closed schema, making an ADR-0112-shaped entry there an accept-set widening that clause-2 rules out; (2) the code is lowercase and gets NO ledger entry -- ADR-0112 D6c on all four of its tests. PM-side half-state: the card arrived with no assignee; reported, not filled in.",
  "tests": "CI ON HEAD 799d57e15: FULLY GREEN -- 37 check runs, 35 success + 2 deliberate skips (Console Pin Gate, Packed-tarball smoke), zero failures. That includes `Lint & Repo Gates` (the whole check:* farm), all six `Test Core` shards plus the aggregate, `TypeScript Type Check`, all four Type Check jobs, all three Dogfood Regression shards plus the aggregate, Dogfood Verify CLI, Temporal Conformance, Build Core and Build Docs. THE ONE CI FAILURE THIS PR PRODUCED, and how it was settled: on head d47ad8961 `Test Core (1/6)` went red -- 2 failed / 2748 passed -- on `build-json-advisory-parity.e2e.test.ts` and `build-json-undeclared-key-parity.e2e.test.ts`, both on the assertion 'adds NO new top-level key to the payload'. Reproduced LOCALLY FIRST (after building the 57-package cli dependency closure): 2 failed | 12 passed, diff naming `+ \"navigationGroupDiagnostics\"`. Fixed by filling the declared `warnings` key and by making `os validate` compute the same list, NOT by editing either assertion: 14 passed after, same two files, same command. A fourth pin then fired locally -- #12047's `the order lives at ONE site`, which matches validate's five warningsSoFar() members as CONTIGUOUS source text -- and was satisfied by APPENDING after the five rather than loosening its regex; a comment at the site records that and says not to loosen it. All 7 build/validate JSON payload pin files then green locally: 67 tests. LOCAL, all on the final head: `pnpm --filter @objectstack/objectql test` exit 0 (267 files / 4595 tests); `pnpm --filter @objectstack/objectql typecheck` exit 0; `pnpm --filter @objectstack/cli exec tsc --noEmit` exit 0 -- measured for real once the closure was built, having been NOT MEASURED earlier; `pnpm --filter @objectstack/cli --project unit` exit 0 (165 files / 2176 tests). GATE UNION, family derived by `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (64 commands), clean tree: 57 green, 0 findings, 7 NOT MEASURED locally -- each self-declares an unmet prerequisite and refuses a verdict; CI satisfies all of them and its `Lint & Repo Gates` is green. check:dispatcher-error-vocabulary -- THE ANSWER THE DISPATCH ASKED FOR: the code DOES land on that governed surface, as shape `objlitconst`, so the gate's lowercase delegation to check:error-code-casing does not reach this position and a classification row WAS required; added as verdict `foreign-vocabulary` / door `none` with D6c evidence; gate reports 61 sites found / 61 classified, exit 0. NO ERROR_CODE_LEDGER registration -- D6c: diagnostics codes stay lowercase and out of the ledger. THREE gates went red on my own work and were FIXED, not exempted: check:test-source-alias (a dist-resolved first load inside a clocked window -> module-top side-effect import, production import stays lazy); check:doc-authoring (a tracker id in runtime string prose -> moved to an adjacent comment, per the 2026-08-12 ruling); check-system-context-census (pure line rot from the registry edit -> its own --fix, one doc anchor 464->475). ABLATION A, runtime, source-resolved: removed ONLY the warn() emission -> 2 pins red (visibility, once-per-mis-aim) while the RELOCATION pin stayed green, which is what proves it pins the fold and not the log; mutation confirmed on disk before the run (emission sites 1->0, marker count 1, blob c0699cf0->3e66307f), restored via `git checkout HEAD --` with an ABSOLUTE path, blob back to c0699cf0 == the HEAD blob, `git diff HEAD` empty, 0 markers left, restored leg 10/10 green. ABLATION B, compile-time, DIST-RESOLVED (@objectstack/objectql is a KNOWN_UNALIASED_TEST_IMPORTS entry for @objectstack/cli): neutered checkNavContributionGroups, REBUILT, ablation-dist-preflight confirmed the marker present in 4 built files -> 5 pins red; restored, REBUILT again, preflight --absent confirmed it gone from all 14 built files and the whole tree clean -> green. Both legs rebuilt, both proven in dist. TWO FALSE MEASUREMENTS were caught by that discipline rather than by luck: `grep -c` read the empty brackets in my anchor as a regex character class and reported 0 sites on a mutation that HAD landed (fixed with grep -cF); and the first ablation marker was a `//` comment, which the bundler strips, so the preflight VOIDED the run because it survived only in sourcemaps. DECLARED NARROWING: a raw `os build` over examples/app-multi-package could not be run in this worktree -- the CLI aborts at load time with PREREQUISITE-style errors naming spec exports absent from this base's dist, a pre-existing source/dist skew unrelated to this diff (the tree was restored and verified byte-identical after the attempt). The equivalent end-to-end coverage is the seven JSON payload pin files, which spawn the REAL cli binary over real fixtures and assert the payload.",
  "mcp_calls": "38",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #14925: the `packages/spec` describe() for `navigationContributions[].group` documents the omitted case but not the mis-aimed one; that one string is embedded in ~14 generated artifacts, so extending it pulls the spec regeneration family into a PR scoped to an objectql/cli diagnostic"
  ]
}

Generated by Claude Code

os-dev-report

Final. Supersedes the two earlier reports on this card: the --json payload shape changed under review, four prose sentences this PR falsified itself were corrected, and CI is green on the final head d22e7541d.

{
  "issue": 14553,
  "status": "done",
  "branch": "claude/issue-14553-nav-group-relocation-diagnostic",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14920",
  "premise_still_valid": true,
  "summary": "B (platform) half of the B+C ruling, head d22e7541d, CI fully green. RUNTIME: applyNavContributions still relocates a contribution whose group names no group in the target app -- fold unchanged, order-independent, optional groups keep working, no refusal added. The info-gated log line becomes an ADR-0038 BuildIssue-family record naming the contributing package, the app, the missing group id and the relocated items; carried on the app via the new registry.getAppNavDiagnostics(appName) and announced through a new level-aware warn(), so it survives OS_REGISTRY_LOG=warn. De-duplicated once per registry per distinct mis-aim (the fold runs on every read); a silent deployment keeps the record. AUTHORING-TIME: os build AND os validate answer the same question over a composed artifact through the same imported predicate, reporting in the text face and in --json under the EXISTING `warnings` key. Two recorded deviations from the literal ruling wording, both measured: (1) 'carried in the app's diagnostics' is a registry-side per-app list, NOT the protocol's _diagnostics envelope -- protocol.ts reads `item?._diagnostics ?? computeMetadataDiagnostics(t, item)`, so pre-stamping would suppress the app's spec-validation verdict, and MetadataValidationResult.warnings[] is {path,message} with no code under a closed schema, making an ADR-0112-shaped entry there an accept-set widening that clause-2 rules out; (2) the code is lowercase and gets NO ledger entry -- ADR-0112 D6c on all four of its tests. PM-side half-state: the card arrived with no assignee; reported, not filled in.",
  "tests": "CI ON HEAD d22e7541d: FULLY GREEN -- 37 check runs, all complete, zero failures (2 deliberate skips: Console Pin Gate, Packed-tarball smoke). Includes `Lint & Repo Gates` (the whole check:* farm), all six `Test Core` shards plus the aggregate, all four Type Check jobs, every Dogfood shard plus the aggregate, Dogfood Verify CLI, Temporal Conformance, Build Core and Build Docs. THE ONE CI FAILURE THIS PR PRODUCED, and how it was settled without weakening a gate: on head d47ad8961 `Test Core (1/6)` went red -- 2 failed / 2748 passed -- on build-json-advisory-parity.e2e.test.ts and build-json-undeclared-key-parity.e2e.test.ts, both on 'adds NO new top-level key to the payload -- this fills a declared key, it is not a new surface'. REPRODUCED LOCALLY FIRST (after building the 57-package cli dependency closure): 2 failed | 12 passed, diff naming + \"navigationGroupDiagnostics\"; 14 passed after the fix, same two files, same command. Fixed by filling the declared `warnings` key -- NOT by editing either assertion. #11643 and #11727 each faced that choice and filled `warnings`; a third pin in the same file requires that nothing rides in build that validate does not also report, which is why os validate computes the same list. A FOURTH pin then fired locally -- #12047's `the order lives at ONE site`, which matches validate's five warningsSoFar() members as CONTIGUOUS source text -- and was satisfied by APPENDING after the five rather than loosening its regex; a comment at the site records that and says not to loosen it. All 7 build/validate JSON payload pin files green: 67 tests. FOUR PROSE SENTENCES THIS PR FALSIFIED ITSELF, found in review and fixed (exactly the class the docs-drift bot says it cannot detect): the published setup-app.mdx documented the deleted key; the changeset named it (and the changeset is this PR's input to the release notes); nav-contribution-diagnostics.ts claimed the file is registered in check-error-code-casing's EXEMPT_FILES when it is not (the code is REFERENCED at the stamp, the objlitconst shape, so that gate never sees the value); and the vocabulary row's own `why` string carried the dead key. LOCAL, all on the final head: objectql test exit 0 (267 files / 4595 tests); objectql typecheck exit 0; `pnpm --filter @objectstack/cli exec tsc --noEmit` exit 0 with 0 errors -- measured for real once the closure was built, having been NOT MEASURED earlier; cli unit project exit 0 (165 files / 2176 tests). GATE UNION, family derived by `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (64 commands), clean tree: 57 green, 0 findings, 7 NOT MEASURED locally -- each self-declares an unmet prerequisite and refuses a verdict; CI satisfies all of them and its Lint & Repo Gates is green. check:dispatcher-error-vocabulary -- THE ANSWER THE DISPATCH ASKED FOR: the code DOES land on that governed surface, as shape objlitconst, so the gate's lowercase delegation to check:error-code-casing does not reach this position and a classification row WAS required; added as verdict foreign-vocabulary / door none with D6c evidence; 61 sites found / 61 classified, exit 0. NO ERROR_CODE_LEDGER registration and no EXEMPT_FILES entry. THREE gates went red on my own work and were FIXED, not exempted: check:test-source-alias (a dist-resolved first load inside a clocked window -> module-top side-effect import, production import stays lazy); check:doc-authoring (a tracker id in runtime string prose -> adjacent comment, per the 2026-08-12 ruling); check-system-context-census (pure line rot from the registry edit -> its own --fix). ABLATION A, runtime, source-resolved: removed ONLY the warn() emission -> 2 pins red (visibility, once-per-mis-aim) while the RELOCATION pin stayed green, which is what proves it pins the fold and not the log; mutation confirmed on disk before the run (emission sites 1->0, marker count 1, blob c0699cf0->3e66307f), restored via `git checkout HEAD --` with an ABSOLUTE path, blob back to c0699cf0 == the HEAD blob, git diff HEAD empty, 0 markers left, restored leg 10/10 green. ABLATION B, compile-time, DIST-RESOLVED (@objectstack/objectql is a KNOWN_UNALIASED_TEST_IMPORTS entry for @objectstack/cli): neutered checkNavContributionGroups, REBUILT, ablation-dist-preflight confirmed the marker present in 4 built files -> 5 pins red; restored, REBUILT again, preflight --absent confirmed it gone from all 14 built files and the whole tree clean -> green. Both legs rebuilt, both proven in dist. TWO FALSE MEASUREMENTS were caught by that discipline rather than by luck: `grep -c` read the empty brackets in my anchor as a regex character class and reported 0 sites on a mutation that HAD landed (fixed with grep -cF); and the first ablation marker was a `//` comment, which the bundler strips, so the preflight VOIDED the run because it survived only in sourcemaps. DECLARED NARROWING: a raw `os build` over examples/app-multi-package could not be run in this worktree -- the CLI aborts at load time naming spec exports absent from this base's dist, a pre-existing source/dist skew unrelated to this diff (the tree was restored and verified byte-identical after the attempt). The equivalent end-to-end coverage is the seven JSON payload pin files, which spawn the REAL cli binary over real fixtures and assert the payload.",
  "mcp_calls": "51",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #14925 (with a follow-up comment correcting it for the final shape): the `packages/spec` describe() for `navigationContributions[].group` documents the omitted case but not the mis-aimed one; that one string is embedded in ~14 generated artifacts, so extending it pulls the spec regeneration family into a PR scoped to an objectql/cli diagnostic"
  ]
}

Generated by Claude Code

ACCEPT — PR #14920, driven to the queue

Reviewer of record: PM seat, maintainer direct-dispatch channel (maintainer asked this session to assess the open PR set and land what is landable, live chat 2026-09-04). Readings taken against GitHub at 2026-09-04T04:40Z, PR head d22e7541d4664ead7d1f089101c294f1926d05b4.

Checklist

Item	Reading
PR shape	non-draft, base `main`, first line `Fixes #14553`, `mergeable_state: clean`
Path surface (`get_files`)	15 files across `packages/objectql`, `packages/cli`, `packages/runtime`, `examples/app-multi-package`, `content/docs/{permissions,ui}`, `.changeset/`. No governed path; `content/docs/releases/**` untouched
Clause ②	path limb not hit (no `packages/spec/` in the diff); declaration limb `no`*, set by the director-seat ruling itself (comment 5518065119: "Clause-② no (no accept-set change; a diagnostic is added)"). The dev's deviation 1 shows the rule was applied rather than recited — the `_diagnostics` envelope route was rejected because* it would have been an accept-set widening
Checks	41 check runs, all `completed`, zero failure; `Spec property liveness` and `Governed Surface Queue Guard` both green
Changeset	present — `@objectstack/objectql` patch + `@objectstack/cli` patch
Report	complete `os-dev-report`, `status: done`, `premise_still_valid: true`, `open_questions: []`

Spot-checks against the diff and the ruling, not the narrative

The ruling is implemented, not reinterpreted. B was "the relocation stays but becomes a real diagnostic surviving OS_REGISTRY_LOG=warn, plus a compile-time check when both sides share one artifact, no refusal added". The diff keeps the fold (registry.ts), adds nav-contribution-diagnostics.ts with one resolution and one wording, and lands the authoring-time half in packages/cli/src/utils/nav-contribution-groups.ts — the ruling's own "implementer's call, one PR". Exit codes stay zero on both commands.
The CI failure this PR produced was fixed at the code, not at the gate. Two standing pins refused a new top-level navigationGroupDiagnostics key by name; the fix filled the declared warnings key and made os validate compute the same list, which a third pin independently required. A fourth pin (the order lives at ONE site) was satisfied by appending rather than loosening its regex. No assertion was edited. This is the single most important thing to verify on a PR that went red and came back green, and it holds.
Both ablations are real and both directions proven. Runtime leg: removing only the warn() emission reddens the visibility and once-per-mis-aim pins while the relocation pin stays green — which is what proves the pins bind the fold and not the log. Compile-time leg was run dist-resolved with rebuilds on both sides (@objectstack/objectql is a KNOWN_UNALIASED_TEST_IMPORTS entry for @objectstack/cli), with ablation-dist-preflight confirming marker presence in 4 built files and absence from all 14 after restore. Two false measurements were caught by that discipline and are recorded rather than buried.
The prose was re-checked against the code. The PR falsified four of its own sentences when the payload key was removed and fixed all four, including the changeset — which would otherwise have shipped a dead key name into the release notes. The 4 release-owned pages were left untouched and checked for factual error anyway.
Deviation 2 accepted: lowercase code, no ERROR_CODE_LEDGER row, ADR-0112 D6c on all four of its tests, with check:dispatcher-error-vocabulary carrying a foreign-vocabulary/door none classification row. The first guess (check:error-code-casing EXEMPT_FILES) was measured wrong and corrected — the code is referenced, not quoted, at the stamp.

Housekeeping. The card's earlier half-state (arrived at pm:queue with no assignee while a finished PR was open) was already corrected by the domain:engine seat, comment 5530268294. On merge, Fixes #14553 closes the card and every pm:* label comes off in the same stroke.

Not blocking, tracked: out-of-scope finding filed as #14925 (the packages/spec describe() for navigationContributions[].group has the same documentation gap the page had) — correctly kept out of this diff, since that one string is embedded in ~14 generated artifacts and would pull the spec regeneration family into an objectql/cli card.

Verdict: ACCEPT → ready, auto-merge armed, queue owns it from here. Tracking to MERGED.

Generated by Claude Code

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

Closing pull request: fix(objectql,cli): a navigation contribution relocated past a missing group now says so, at warn and at build time #14920, merged.
Closing commit c351a84dae, merged into main.
Left untouched: priority:p2, domain:engine — ownership, priority and outcome are not state claims.
The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34005012908 · trigger schedule

Generated by Claude Code

fix(plugin-security): make a permission-set name collision reach the …

feat(cli): os build / os validate report a permission-set name collision

fix(plugin-security): a permission-set name collision now reaches the…

cli: `os build` / `os validate` report a permission-set name collisio…

test(cli): derive the build/validate gate roster from what the comman…

fix(cli): nav-contribution-groups imports the artifact package-id own…

Navigation Menu

Repository navigation

decision(objectql): a `navigationContributions[].group` that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer? #14553

What was measured

Why it matters

Options

Four-axis reading (PM seat, for the maintainer to confirm or overrule)

Maintainer ruling recorded — B + C: the relocation stays but becomes a real diagnostic that survives `OS_REGISTRY_LOG=warn`, plus a compile-time check when both sides share one artifact; hotcrm asserts its own merged tree (hotcrm#1456)

Claim record — session `session_01UHvF5hyiZjnCyExFnfQB8m`, branch `claude/issue-14553-nav-group-relocation-diagnostic`

ACCEPT — PR #14920, driven to the queue

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

decision(objectql): a navigationContributions[].group that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer? #14553

Description

What was measured

Why it matters

Options

Four-axis reading (PM seat, for the maintainer to confirm or overrule)

Activity

os-project-manager commented on Sep 2, 2026

Maintainer ruling recorded — B + C: the relocation stays but becomes a real diagnostic that survives OS_REGISTRY_LOG=warn, plus a compile-time check when both sides share one artifact; hotcrm asserts its own merged tree (hotcrm#1456)

hotlong commented on Sep 3, 2026

Claim record — session session_01UHvF5hyiZjnCyExFnfQB8m, branch claude/issue-14553-nav-group-relocation-diagnostic

hotlong commented on Sep 3, 2026

hotlong commented on Sep 3, 2026

hotlong commented on Sep 3, 2026

zhuangjianguo commented on Sep 4, 2026

ACCEPT — PR #14920, driven to the queue

github-actions commented on Sep 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

decision(objectql): a `navigationContributions[].group` that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer? #14553

Maintainer ruling recorded — B + C: the relocation stays but becomes a real diagnostic that survives `OS_REGISTRY_LOG=warn`, plus a compile-time check when both sides share one artifact; hotcrm asserts its own merged tree (hotcrm#1456)

Claim record — session `session_01UHvF5hyiZjnCyExFnfQB8m`, branch `claude/issue-14553-nav-group-relocation-diagnostic`