[objectstack-fleet]

Fixes #21216
Clause-②: yes

What changed

validateTranslationReferences (packages/lint/src/validate-translation-references.ts) is the rule behind translation-target-unknown, and os validate, os build and os lint all run it. It now judges every keyed child of an action's translation entry against what the action declares. Both addresses are covered: objects.OBJECT._actions.ACTION and globalActions.ACTION. Before this change the walk (checkActionParams) judged params.NAME and nothing else.

bundle key	judged against	code · level	the runtime read it mirrors
params.NAME	params[].name, falling back to field	translation-target-unknown · error (unchanged)	translateActionParams
outcomeMessages.OUTCOME	the keys of the action's outcomeMessages	translation-target-unknown · error (new)	resolveActionOutcomeMessages
resultDialog.fields.PATH	each literal resultDialog.fields[].path	translation-target-unknown · error (new)	resolveActionResultDialog, and objectui's actionResultDialog
params.NAME.options.VALUE	a declared param's inline options[].value	translation-option-key-unknown · warning (new)	translateActionParams, and objectui's actionParamOptionLabel

• No second vocabulary. Undeclared outcomes and result-field paths reuse params' own code and severity. Option keys reuse the code and severity a field's options key already gets (checkOptionKeys), including the "keyed by the display label, rename it to the value" diagnosis. The module's Severity note explains why option keys stay warnings: such a key names something real, and the fix is a rename.
• Where the declared sets come from (runtime read sites, on packages/spec/src/system/i18n-resolver.ts):
  • resolveActionOutcomeMessages loops over Object.keys(action.outcomeMessages). When the action declares no outcomeMessages, it returns undefined before reading any bundle key. So for such an action every bundle outcome is unread, and the lint refuses each one.
  • resolveActionResultDialog maps over the declared fields[] and looks up fields[field.path]. With no resultDialog it reads nothing. With a dialog that declares no fields, it reads no label. objectui's useObjectLabel.actionResultDialog uses the same keys.
  • Param options are judged only against an inline options array. The spec resolver overlays only that array. objectui resolves param.options first and falls back to the referenced field's options, so an authored array wins. A field-backed param with no inline array gets its list from the field when the dialog renders. This rule does not re-derive that inheritance, so those keys are deliberately left unjudged.
• A result-field path is one literal key, dots included, so the finding's config path brackets it: resultDialog.fields["client.ghost"]. localePath now uses the same memberPath helper, and its output is byte-identical.
• Coverage pin. The test file gets a twin of the object-branch coverage pin. It reads the action translation shape off ObjectTranslationDataSchema and TranslationDataSchema (both addresses), down into params.NAME.* and resultDialog.*, and holds that key set equal to a classification ledger. Every reference-checked key needs a ghost that reports at both addresses. When the next keyed group joins the shape with no leg, this pin fails. That gap is how outcomeMessages shipped unjudged.

Measured at the public door (os validate --json)

The probe stack is a defineStack app with delete_probe (bound, declares outcome archived, params reason, and mode with inline option fast), reveal_probe (bound, resultDialog.fields[].path = client.secret), check_probe (object-less, outcome up_to_date) and reveal_global (object-less, path token). Its zh-CN bundle carries each declared key and one undeclared sibling. The CLI closure was built at each tree.

key in the bundle	before, be5a83cf (clean main)	after, ac847edd / dd39cf54
_actions.reveal_probe.resultDialog.fields["client.ghost"]	no finding	translation-target-unknown error
globalActions.reveal_global.resultDialog.fields.ghost_token	no finding	translation-target-unknown error
_actions.delete_probe.outcomeMessages.restored	no finding	translation-target-unknown error
globalActions.check_probe.outcomeMessages.stale	no finding	translation-target-unknown error
_actions.delete_probe.params.mode.options.slow	no finding	translation-option-key-unknown warning
_actions.delete_probe.params.not_a_param (control: the door is reached)	translation-target-unknown error	unchanged
declared archived, up_to_date, client.secret, token, fast, reason (controls)	no finding	no finding

Consumers whose verdict could move (direction: downstream of @objectstack/lint)

• os validate --json over the four example apps, after the change: app-crm exit 0, app-todo exit 0, app-showcase exit 0, app-multi-package exit 0. Each has 0 findings on an outcomeMessages, resultDialog.fields or params.NAME.options path, and 0 translation-rule findings at all. These legs judged nothing before this change, so any finding on those paths would have been new.
• The bundle @objectstack/platform-objects ships (SetupAppTranslations: 4 locales, 50 objects) was run through the rule. It carries 64 resultDialog.fields keys and 44 param-option keys, and none of them is flagged. It carries 0 outcome keys. Docs and skills/** hold no translation bundle with these keys. No published bundle needed a fix.

Tests

All runs are at ac847edd. The lint source in dd39cf54 is byte-identical; that commit adds only the changeset.

• pnpm --filter @objectstack/lint test: 119 files / 5517 passed.
• pnpm --filter @objectstack/lint typecheck (tsc plus check:test-typecheck): exit 0. The test-layer ledger holds 2 files / 6 errors, unchanged.
• pnpm --filter @objectstack/cli exec vitest run --project unit, at dd39cf54, in two shards: 122 files / 1861 passed, then 121 files / 1578 passed. The integration tier is left to CI, because no integration-tier file or spawn entry is touched.
• New in validate-translation-references.test.ts: 15 cases. An undeclared outcome is refused at _actions.ACTION and at globalActions.ACTION. Declared outcomes pass at both addresses (the control). An action with no outcomeMessages has every outcome refused. The same three shapes cover resultDialog.fields, including the bracketed dotted path. Param options cover a value miss, a label key, a param with neither options nor field, the field-backed skip, and an undeclared param reported once. The coverage pin adds 3 cases.

Reverse verification (committed first, then mutated through scripts/ablation-replace.mjs in WRAP mode, with a restore trap; every restore was proven by blob hash equal to HEAD and an empty git diff HEAD):

• Leg A drops the outcomeMessages and resultDialog.fields calls: 7 failed / 142 passed. Those are the 6 refusal cases plus the coverage pin's "backs every reference-checked claim". The 2 control cases stay green.
• Leg B disables the param-options call: 3 failed / 146 passed. Those are the 2 option warnings plus the coverage pin.
• The direction is turned red, as expected. The suite reads src through a relative import, so no dist/ leg applies. The door probe's @objectstack/lint dist was checked with scripts/ablation-dist-preflight.mjs @objectstack/lint checkActionResultDialogFields: the marker is present in 4 built files and the tree is clean.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 60 families from the merge base be5a83cf, and all 60 were run at dd39cf54. --ran reports 60 run, 0 NOT-MEASURED, 0 UNRUN, and every exit is 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: 8 unrelated packages had no dist/). After a turbo build of those 8, it was re-run and exited 0. The derivation flagged a stale tree: origin/main is 4 commits ahead, and scripts/check-route-envelope.mjs and scripts/engine-double-contract.pinned.json changed upstream. Neither family reads the files this PR edits. The 6 value-bearing CI-only invocations (shard attestation, test completeness, check-issue-citations --census) are NOT MEASURED here because they are CI-only.

ESLint was narrowed to the two edited files. Their population comes from eslint's own config: --print-config resolves a config for each. The JSON output reports 2 files, 0 errors and 0 warnings. Type-aware linting is not enabled (eslint.config.mjs sets no parserOptions.project), so this diff cannot change the verdict on any untouched file.

Acceptance notes

Both of these were measured at the door with a second probe and reported to the PM rather than fixed here.

• A bound action's globalActions.ACTION key is refused with "This key is never read". translateAction (via lookupActionField) and objectui's actionSuffixes both fall back to globalActions.ACTION for a bound action, and that probe's label resolves. So the lint's message and the resolvers disagree, and this PR touches neither side.
• _actions.ACTION.resultDialog.title, .description and .acknowledge on an action that declares no resultDialog pass silently, and nothing reads them. These are leaf copy on an undeclared node, not a keyed child, so the coverage pin classifies resultDialog as a container and this PR leaves them unjudged.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

12 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 434c6c7cab6aee9c5587e680d7eeeb445a756714 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ab0aa4e7e151aa4b51e194d94d0736f66510d945 — the merge of head dd39cf5405645b240b36b7aba5f35bdfc66b20cd into base 434c6c7cab6aee9c5587e680d7eeeb445a756714, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ab0aa4e7e151aa4b51e194d94d0736f66510d945 && git checkout ab0aa4e7e151aa4b51e194d94d0736f66510d945
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 434c6c7cab6aee9c5587e680d7eeeb445a756714 dd39cf5405645b240b36b7aba5f35bdfc66b20cd && git checkout -B drift-repro 434c6c7cab6aee9c5587e680d7eeeb445a756714 && git merge --no-ff dd39cf5405645b240b36b7aba5f35bdfc66b20cd

node scripts/docs-audit/affected-docs.mjs --json 434c6c7cab6aee9c5587e680d7eeeb445a756714

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd39cf5405645b240b36b7aba5f35bdfc66b20cd
Local-runs: none

PR #21258 for card #21216. The head is the tip of claude/issue-21216-action-translation-keyed-children (fetched, sha confirmed); the net diff reviewed is origin/main... that ref: 3 files, +604/-22. Inputs: the card body and all five comments (5937261840 triage, 5939443403 unlock, 5941298378 claim, 5942505415 dev report, 5942526356 seat answer), the PR body and file list, and the head's check-runs. Read-only throughout: declared sets and read sites were verified on origin/main with git show, and the sibling at the .objectui-sha pin 31971ff1. Rendered 2026-10-01T23:35Z.

① Derived judgments

Accept-set changes the diff implies, each judged against the triage direction (5937261840) and the runtime read sites:

1. outcomeMessages.OUTCOME under _actions.ACTION and globalActions.ACTION, judged against the keys of the action's own outcomeMessages, translation-target-unknown at error — RIGHT. resolveActionOutcomeMessages (packages/spec/src/system/i18n-resolver.ts) iterates Object.keys(action.outcomeMessages) and returns undefined before any bundle read when the action declares none; translateAction is its only caller; no other reader of these bundle keys exists in this repo (packages/cli/src/utils/i18n-extract.ts is a producer) or in objectui at the pin (zero hits). So every outcome key on an action without outcomeMessages is unread, and refusing each one is sound. Code and level are params' own, as the direction asked; no second vocabulary.
2. resultDialog.fields.PATH, judged against the literal resultDialog.fields[].path, same code and level — RIGHT. resolveActionResultDialog returns action.resultDialog untouched when it is absent (nothing read), maps only the declared fields[] by path, and reads no label when fields is omitted (ActionSchema.resultDialog.fields is optional, described "Omit to dump full JSON", so the finding's JSON sentence is TRUE). objectui useObjectLabel.actionResultDialog returns spec when it is undefined and indexes the fetched fields node by the literal path. The gap was real on main: the action walk there has exactly one leg (checkActionParams), which is consistent with the dev's door probe at be5a83cf. A dotted path is one member; memberPath brackets it, matching how both resolvers index.
3. params.NAME.options.VALUE, judged against a declared param's inline options[].value as String(value), translation-option-key-unknown at warning with the label-versus-value diagnosis — RIGHT, and it belongs to this family: an option map is a record keyed by a declared name. translateActionParams overlays String(opt.value) over the inline array and nothing else. Field-backed params with no inline options are left unjudged by design — CORRECT and necessary: objectui's useConsoleActionRuntime runs resolveActionParams (field inheritance) and then actionParamOptionLabel over the resolved p.options, so those bundle keys ARE read in the console; refusing them would be a false positive, and judging them would re-derive the inheritance inside lint. The no-options-and-no-field map warns once, mirroring checkOptionKeys' "declares no options" branch. Severity: the seat's answer A (5942526356) is right — the module's Severity note (ADR-0072 D1) keeps the option shape at warning and the field leg is the one vocabulary for it; B would judge one key shape two ways.
4. Reach of the new legs — RIGHT: they run only after the action key resolved at its address. A bound action under globalActions and an object-less action under _actions still take the orphan continue, so the new legs add no new disagreement with the resolvers (③, class b).
5. localePath through memberPath — output byte-identical (identifier → .locale, otherwise ["locale"]). RIGHT.
6. Public surface of @objectstack/lint — exports unchanged (validateTranslationReferences, the two rule ids, TranslationRefFinding); ActionEntryContext is module-private. No packages/spec file is touched, so no regenerated artifact is owed. The accept-set that moves is the authoring door's: three key shapes, two at error, one at warning. RIGHT.
7. The coverage pin — a TEST, not a new gate. It is an it block inside the existing suite, the twin of the lint: validate-translation-references has no _tabs leg — an authored key naming a filter-preset tab that does not exist warns nobody #13835 object-branch pin in the same file; it adds no check script, CI job, hook, patrol row or ratchet, and dispatch-gates derives no new family from it. 「新增门禁默认否」 governs gates; a pin inside an existing test family is ordinary test work, and the pin reads the spec shape through the @objectstack/spec/system dependency edge the lint: validate-translation-references has no _tabs leg — an authored key naming a filter-preset tab that does not exist warns nobody #13835 pin already uses. Its ledger matches the schema on main: 15 keys (label, description, confirmText, successMessage, outcomeMessages, params, params.*.label, params.*.helpText, params.*.placeholder, params.*.options, resultDialog, resultDialog.title, resultDialog.description, resultDialog.acknowledge, resultDialog.fields), and globalActions is built by the same actionTranslationSchema factory, so the bound-equals-global assertion holds. Its new container kind is where ③ class c sits.
8. Census, re-read at the code — RIGHT. @objectstack/platform-objects generated bundles: 16 resultDialog.fields keys per locale (user.email, user.phoneNumber, temporaryPassword twice, totpURI twice, backupCodes four times, client.client_id, client.client_secret, client_secret, dnsRecordType, dnsRecordName, dnsRecordValue), each matching a declared path on sys_user, sys_two_factor, sys_oauth_application or sys_sso_provider, 64 over four locales; 11 param-option keys per locale (link_social.provider 7, create_oauth_application.type 4), all declared inline, 44 over four locales; 0 outcome keys. app-showcase's action entries carry label, successMessage and param label/helpText only; app-crm, app-todo and app-multi-package ship no action translation entry. Nothing published is newly refused.

Finding messages, each sentence TRUE against the read sites: "Only the outcomes the action declares are translated, so this copy is never shown" (the resolver's loop); "declares no outcomeMessages at all, so nothing reads this map" (the early return); "declares no resultDialog, so nothing reads this label" (if (!spec) return spec); "it renders the whole response as JSON" (the schema's describe); "The resolver looks the option up by value" (String(opt.value) here, o.value in objectui).

② Semver level

.changeset/21216-action-translation-keyed-children.md: '@objectstack/lint': minor, body carrying Clause-②: yes with no arm — the same declaration as the PR body and the claim. RIGHT. @objectstack/lint 17.5.0 is a published package; the diff adds no export and removes none; what moves is that the authoring door refuses more. House precedent for exactly this shape: #21204 (card #21131, the options sibling, unconsumed-widget-option) shipped minor with Clause-②: yes; the #20553 door refusal is minor; #16310's promotion of this very rule to error sits under 17.5.0's Minor Changes. Not (narrowing): no published schema or API accepts less — TranslationDataSchema still parses the key, the lint judges it. Not skip-changeset. Check Changeset on the head: success. No ADR-0087 marker is owed (not breaking).

Changeset prose, sentence by sentence: "os validate, os build and os lint now check…" TRUE (the rule runs inside reference-integrity-suite, which runAuthoringRules executes in validate.ts, in compile.ts which build.ts wraps, and in lint.ts); "Before this, only params.NAME was checked" TRUE; "the same code and level an undeclared params key already gets" TRUE; "translateAction overlays only the outcomes the action declares" TRUE; "The label lookup is keyed by each declared field's path, dots included" TRUE; the bracketed config path TRUE (memberPath); "the code and level a field's options key already gets" TRUE; "names the stored value when the key is a display label" TRUE; "warned once, because nothing reads it" TRUE; the field-backed inheritance sentence TRUE (objectui resolveActionParams, then actionParamOptionLabel); "fails os validate with exit 1 … os build refuses it" TRUE (error-severity authoring findings exit 1 in validate.ts and compile.ts); "The option-key warning changes an exit code only under --strict" TRUE for os validate (the final exit is 1 only when flags.strict is set and the warnings list is non-empty, otherwise 0) and os lint (--strict: fail on warning-severity findings too); the examples-and-platform-objects sentence TRUE (census, ① item 8).

PR-body prose: the table and the four "where the declared sets come from" bullets match the code; "localePath … byte-identical" TRUE. The Tests, Reverse verification and Gates sections are the dev's own runs and are not re-run here; the head's check-runs are the gate verdicts (③).

③ Boundary flags

Dev deviations (5942505415), each answered:

1. Options leg at translation-option-key-unknown/warning against the claim's literal translation-target-unknown — raised as open question 1; the seat answered A (5942526356); concur (① item 3). Closed.
2. Not merged with origin/main — now 6 commits behind (434c6c7c; 4 at report time). None of the six touches the three edited files, i18n-resolver.ts, translation.zod.ts or action.zod.ts; the only upstream packages/lint change is validate-preset-comparands.* in 3dc33b2d; the PR reads mergeable: true. The declared sets the legs judge against are unchanged upstream. Accepted; the merge group re-judges the merged tree.
3. Lint suite and typecheck at ac847edd, head adds only the changeset — verified: git diff --stat ac847edd dd39cf54 is the one changeset file. Closed.
4. ESLint narrowed to the two edited files — the head's Lint & Repo Gates check-run is the authority, and it concluded success (below). Closed.
5. No labels written; needs:contract-review is not on the PR (labels: documentation, size/l, tests, tooling), so nothing is owed on PASS. Closed.
6. Worktree cleanup — not visible in the diff; no finding.

Open question 1 — answered by the seat; closed as above.

Out-of-scope findings:

• Class b (a bound action filed under globalActions): CONFIRMED pre-existing at the code. On main, lookupActionField, lookupActionResultDialogNode, lookupActionParamNode and resolveActionOutcomeMessages all fall back to globalActions.ACTION for a BOUND action on an object-scoped miss, and objectui actionSuffixes documents the same fallback, while the lint's orphan text says "never read" and its pin ("tells an object-bound action filed under globalActions where it belongs") predates this PR; the translation.zod.ts docblock sides with the lint ("object-less"). This PR touches neither side and reaches no new leg there. ESCALATED to the seat as its own card: which side moves is a contract-first ruling, not a dev's call. Not a defect of this PR.
• Class c (resultDialog.title, description, acknowledge on an action that declares no resultDialog): CONFIRMED unread — resolveActionResultDialog returns spec (undefined) and objectui actionResultDialog returns spec when it is undefined. May this PR leave it out? YES. The card's closeout clause is "one walk judges every KEYED child of an action's translation entry against its declaration"; these three are leaf prose under a fixed key, not a record keyed by a declared name, and the pin states the classification (resultDialog container, its leaves leaf-copy) instead of burying it. But it is a class (c) authoring trap with reach measured at the door, and this PR closes the family card, so "named into lint: os validate never judges a translation bundle's _actions.ACTION.outcomeMessages.OUTCOME keys against the outcomes the action declares — an undeclared outcome's copy passes clean and is never read #21216's family, not a point card" would leave it with no carrier. ESCALATED: the seat files a card for it; the triage's no-point-card bar covered the keyed-children positions only. The natural shape is one leg refusing the whole resultDialog node when the action declares none, beside the fields message that already says "declares no resultDialog".

Docs, outside this review's gate (prose is the seat's ACCEPT, per contract-review.md) and noted for it: the rule table in content/docs/protocol/kernel/i18n-standard.mdx has no row for the three new key shapes, and skills/objectstack-i18n/SKILL.md enumerates the refused kinds without "outcome" and "result field". Neither sentence is false; both are now incomplete. The claim's file surface named only generated rule-docs pages, and these are hand-written; skills/** is Tier H. A follow-up, not a FAIL.

Check-runs on dd39cf54, read at 2026-10-01T23:34Z: 34 check runs, 31 success and 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), each skipped by its own path filter), 0 failed, 0 in progress. The last to conclude were Lint & Repo Gates (23:28Z), Type Check · workspace and TypeScript Type Check (23:28Z), and the six Test Core shards with their rollup (23:23Z to 23:34Z); Check Changeset, Governed Surface Queue Guard, Build Core, Dogfood Regression Gate, Dogfood Verify CLI and Temporal Conformance are success. Every check on the head is green; the conclusions above are the gate verdicts this record relies on, with nothing run locally.

Implemented-by: claude/issue-21216-action-translation-keyed-children
Reviewed-by: session_01UtnxvdiN376GF3sgXwAw4d

VERDICT: PASS