[objectstack-fleet]

Fixes #23734

Clause-②: no

The spec half of objectstack-ai/objectui#12521 ruling 6203721639 (letter B, maintainer 「B (推荐)」): deriveRecordFlowSurface now derives, for a field-heavy task flow on desktop, a bounded modal (size: 'auto', so the renderer's lg / xl bound applies); a mobile posture keeps the full-screen modal.

What changed

• packages/spec/src/data/record-surface.ts: the task-flow arm. When the base derivation says 'page' (field-heavy, or mobile), a task flow (create / edit / child-create / child-edit) answers { container: 'overlay', surface: 'modal', size } with size: 'full' only for viewport: 'mobile' and size: 'auto' otherwise. No new parameter, export or type member: the mobile posture was already the viewport input, and RecordFlowSurface.size was already 'auto' | 'full'. The docblock states the viewport split and the no-subtable-split reading, and carries a dated amendment line on the Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 statement it cites (the original D1 sentence is kept, not rewritten).
• packages/spec/src/data/record-surface.test.ts: the pins that asserted size: 'full' for a heavy desktop task flow are flipped to assert size: 'auto' (heavy task flows, the fat child-edit child, the pageThreshold case, now a full toEqual). Added: an explicit viewport: 'desktop' leg, heavy-on-mobile stays 'full', and a heavy form with an embedded line-items table (a repeater field) takes the same bounded modal on desktop and full-screen on mobile.
• .changeset/23734-heavy-flow-bounded-modal.md: @objectstack/spec minor, BREAKING line with the FROM / TO table and the one-line fix (navigation.size: 'full' or FormView.modalSize: 'full' for an object that genuinely needs full-screen on desktop), ADR-0087 disposition not-required (no-migration-prescription).

Premise measured first (ruling item 2)

The ruling asked whether #2604 D1 chose full-screen for a field-heavy task flow with an embedded child or line-items table. Read on objectstack#2604 (design comment 4884632356, the D1 table and its scope note):

| 'page'(字段多) | 整页 route | 全屏 modal(size:'full')—— 同样大画布 + overlay 返回语义 |

(此处"子表" = 详情页 related list(relatedList,#2594);表单内写侧 inlineEdit 网格本就与父表单原子提交,不在本设计范围。)

D1 sized task flows by authorable field count alone, and its own scope note puts the in-form inlineEdit (line-items) grid outside the design. The derivation's input is the object def, so it never sees an embedded grid either. D1 therefore never chose full-screen for that case: the split the ruling conditions on does not apply, and the bounded modal covers every field-heavy desktop task flow. A test states this. No fork is reported to objectui#12521.

Consumers swept

git grep -n "deriveRecordFlowSurface" across the repo (packages, examples, content/docs, skills): the only callers are record-surface.ts and its test. The other hits are the generated api-surface / export-origins rosters (unchanged: no export moved) and content/docs/releases/v12.mdx (release-owned, not edited). The console consumer (objectui AppContent.tsx, keyed on size === 'full') is in objectui#12521 / objectui PR 12546; no objectui file is touched here.

Verification (at c5defce)

• pnpm --filter @objectstack/spec build :: exit 0; pnpm --filter @objectstack/spec typecheck :: exit 0.
• pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/data/record-surface.test.ts :: 15 passed.
• pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 (whole package) :: 21808 passed, 1 todo, exit 0.
• pnpm --filter @objectstack/spec check:generated :: all 14 generated artifacts up to date (no regeneration needed: the docblock is not a .describe()).
• Ablation, two legs, through scripts/ablation-replace.mjs (anchor hit x1, blob changed, restored to the HEAD blob with git diff HEAD empty): size forced to 'full' everywhere: 4 failed / 11 passed; size forced to 'auto' everywhere: 2 failed / 13 passed (the mobile legs).
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 84 derived commands, run locally with exit codes recorded; --ran reconciliation: 84 accounted, 83 run, 1 NOT MEASURED. Three gates first exited 3 on prerequisites (shallow clone, unbuilt @objectstack/formula / @objectstack/objectql) and were re-run green after fetching the pinned fixture commit and building those two packages. NOT MEASURED: pnpm check:dual-build-cjs-loads (needs every package's dist; CI runs it).

Acceptance notes

• skills/objectstack-ui/rules/navigation.md (Record Presentation, "Surface (page vs drawer)") says a field-heavy object opens create/edit/detail as a full page. That was already inexact before this change (create/edit has been a full-screen modal since Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604), and it is now a bounded modal on desktop. Not edited here: skills/** is a governed surface outside this card's claimed file surface. Drift only, no runtime or authoring consequence (the paragraph tells authors not to set the surface). Carrier: none.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01FaR7ExTuo2XxtaZH3xKJ1e

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 1 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v12.mdx (via deriveRecordFlowSurface (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 142 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a869ea6362e2f44daeedc557b848493fd33f9020 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 52e5667f2bfd93b74ddf543e380afd1ed7824162 — the merge of head c5defce712d8e260a240495af34faecd899a21e0 into base a869ea6362e2f44daeedc557b848493fd33f9020, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 52e5667f2bfd93b74ddf543e380afd1ed7824162 && git checkout 52e5667f2bfd93b74ddf543e380afd1ed7824162
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a869ea6362e2f44daeedc557b848493fd33f9020 c5defce712d8e260a240495af34faecd899a21e0 && git checkout -B drift-repro a869ea6362e2f44daeedc557b848493fd33f9020 && git merge --no-ff c5defce712d8e260a240495af34faecd899a21e0

node scripts/docs-audit/affected-docs.mjs --json a869ea6362e2f44daeedc557b848493fd33f9020

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a869ea6362e2f44daeedc557b848493fd33f9020 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT · PR #23747 @ c5defce712d8e260a240495af34faecd899a21e0 (#23734) · domain:spec seat 1 · os-elon-musk · session session_01HjR8RUwTPQ3TgbfKihmxp9 · 2026-10-15T23:59Z

Reviewer of record. Every item below was checked against GitHub and origin/main, not against the report (6204694396).

• Shape:
  • Draft, base main. The body's first line is Fixes #23734, and no other card number sits beside a closing keyword (the only other # cites are Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604, objectui ones and #23734 itself).
  • Clause-②: no, matching the claim 6204183287.
  • 3 files, +73/−11, none on a governed path, far under the 3,000-line line.
  • Assignee os-elon-musk, the card's.
• Ruling item 1 (6203721639), read in the diff: record-surface.ts:165-:167 answers size: opts.viewport === 'mobile' ? 'full' : 'auto' in the task-flow page arm. view and the light arm are untouched. No parameter, export or type member was added: RecordFlowSurface.size was already 'auto' | 'full', and viewport was already an input of deriveRecordSurface.
• Ruling item 2, the premise, re-read by the seat: Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 design comment 4884632356 was created at 2026-07-05T02:56Z. Its line 17 maps 'page' to 「全屏 modal(size:'full')」 by field count, and its scope note puts the in-form inlineEdit grid outside the design. The seat takes the dev's reading A (the open_questions entry): D1 never chose full-screen for a heavy form with an embedded line-items table, so the split does not apply and no fork goes to objectui#12521. A split would also need an input the derivation does not have.
• Tests (diff read):
  • The three old size: 'full' desktop pins flip to toEqual(... size: 'auto'). They assert the new value, and none was deleted.
  • New legs: explicit viewport: 'desktop', heavy on mobile stays 'full', and a heavy form with a repeater line-items field takes 'auto' on desktop and 'full' on mobile.
  • The reported ablation runs both directions: forcing 'full' gives 4 red, forcing 'auto' gives 2 red (the mobile legs).
• Changeset, sentences checked against the diff: @objectstack/spec minor, with the BREAKING line. The FROM → TO table matches the code row for row: create/edit/child-create/child-edit on desktop go full → auto, and viewport: 'mobile' is unchanged. The one-line remedy names navigation.size: 'full' / FormView.modalSize: 'full'. The ADR-0087 disposition is not-required (no-migration-prescription). Whether the HTML-comment spelling satisfies check:adr-0087-registration is read off the Check Changeset / Lint & Repo Gates runs, not assumed.
• Accepted deviation: the docblock's present-tense "task flows map the derived 'page' to a FULL-SCREEN MODAL" became a dated historical line ("Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 (2026-07-05) mapped … full-screen modal on every viewport") plus the dated amendment line naming the ruling. The seat reads the ruling's 「⛔ not rewritten」 as "D1's decision stays on record with its date": the restated line does that, the date is verified above, and a verbatim present-tense sentence would now be false shipped prose.
• Out of scope: skills/objectstack-ui/rules/navigation.md:131 (the report's acceptance note) is filed as skills(objectstack-ui): navigation.md says a field-heavy object opens create/edit as a "full page"; the platform derives a modal for create/edit, bounded on desktop once #23734 lands #23753 for domain:skills. It is a published sentence, and skills/** is Tier H.
• CI on this head at this act: 25 success, 6 skipped, 8 in progress (Test Core (1/6)-(6/6), Type Check · consumer gates, Type Check · workspace). They are not yet read as green.
• Before the queue: a CONTRACT_REVIEW_TIER contract review (face packages/spec/src/**), run by an isolated at-tier reviewer, and every check green on the head. Then the seat flips ready and arms auto-merge.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c5defce712d8e260a240495af34faecd899a21e0
Local-runs: none
Scope: packages/spec/src/data/record-surface.ts + packages/spec/src/data/record-surface.test.ts, .changeset/23734-heavy-flow-bounded-modal.md, packages/spec/src/ui/view.zod.ts (navigation.size and FormView.modalSize, the override keys the docblock and the changeset name), packages/spec/src/data/field-group-layout.ts (FIELD_GROUP_SYSTEM_FIELDS, the count the new repeater pin rests on), objectui packages/app-shell/src/console/AppContent.tsx:1195-1207 at the sibling checkout f96f771140 (the consumer keyed on size === 'full')

Inputs read: card #23734 body and all 5 comments (the os-dev-report 6204694396 included), objectui#12521 ruling 6203721639, #2604 design comment 4884632356, the PR body, its file list, the net diff against main at this head, and the check-runs on this head. Not read, per the brief: the seat's own ## 席位核对 comment on the PR. Check-runs read at 2026-10-16T00:18Z.

① Derived judgments

1. Accept set: unchanged — right. No *.zod.ts, no .describe(), no object definition, no error code moves. The diff touches one function body and its docblock; the Zod contract is untouched. The authorable-surface, json-schema.manifest and api-surface shards are not in the file list, and the TypeScript Type Check run (which carries every packages/spec generated gate) is success, so none of them went stale.
2. Public surface: unchanged in shape — right. deriveRecordFlowSurface(def, flow, opts) keeps its signature; RecordSurfaceOptions.viewport was already 'mobile' | 'desktop'; RecordFlowSurface.size was already 'auto' | 'full'; no export is added, removed or narrowed. The export-origins and api-surface rosters are untouched, consistent with that.
3. The one behavioral change, read in the code — right, and exactly the ruling's letter B item 1. The task-flow arm now answers { container: 'overlay', surface: 'modal', size: opts.viewport === 'mobile' ? 'full' : 'auto' } where it answered size: 'full'. deriveRecordSurface says 'page' only for viewport: 'mobile' or an authorable count at/above the threshold, and the new ternary keys on the same opts.viewport === 'mobile' predicate, so the two derivations agree: desktop field-heavy → bounded modal ('auto'); any mobile task flow, light or heavy → 'full' as before; light desktop task flows (last return) and the view flow untouched. The pageThreshold override follows the same path (the flipped pin at record-surface.test.ts:130 is the right reading).
4. Clause-②: no for a published pure function's derived default, with a BREAKING changeset line — correctly declared. The criterion is whether the card widens the accept set or expands the public surface: it does neither, and it narrows neither, so no with no (widening)/(narrowing) arm is the honest spelling. What breaks is a consumer's reliance on one derived VALUE, which is exactly what the changeset's **BREAKING** token, FROM/TO table and one-line fix carry. The three places the line is read — the claim comment 6204183287 (line-start Clause-②: no), the PR body, and the changeset body the ADR-0087 gate reads — agree.
5. Ruling item 2 premise, read against the Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 text — correctly read; the split does not apply. D1's table keys every task flow on deriveRecordSurface(def) ('page'(字段多) → full-screen modal; 'drawer' → size:'auto'; mobile → full-screen modal), i.e. on field count alone, and the design's own scope note reads 「此处"子表" = 详情页 related list(relatedList,feat(spec): detail-page related-list tabs via relatedList: 'primary' (#2579) #2594);表单内写侧 inlineEdit 网格本就与父表单原子提交,不在本设计范围。」 D3 sizes a child overlay by the CHILD object's own count. Nowhere does D1 make a distinct full-screen choice FOR a heavy form carrying an embedded table; such a form was full-screen only because it was heavy. The ruling's conditional ("If Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 chose full-screen for it …") therefore does not fire: no subtable split, the bounded modal covers every field-heavy desktop task flow, and no fork is owed to objectui#12521. The docblock states this reading and the test at record-surface.test.ts:84-96 pins it (the repeater field is the one def-level spelling of an embedded table the derivation can see; countAuthorableFields counts it as one visible non-system field, so the def is at threshold plus one and the pin exercises the 'page' arm on both viewports). Observation, not a defect: D1's "subtable" is the view-side relatedList/inlineEdit grid, which never reaches the object def — the pin holds the no-split statement rather than modelling that grid, and the docblock says so.
6. The Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 note: amended with a dated line, not rewritten — holds. The docblock keeps D1's decision as a dated statement ("Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 D1 (2026-07-05) mapped a field-heavy task flow to a full-screen modal on every viewport.") and adds the dated amendment naming ruling 6203721639 (letter B). The rule sentence above it was reworded to describe the current derivation, which is the docblock's job; the D1 record itself is preserved as history, and the design comment on Design: record create/edit/subtable surface + return-flow model (follow-up to #2578) #2604 is untouched.
7. The override claim the docblock and the changeset make — verified in the cited code. navigation.size is z.enum(['auto','sm','md','lg','xl','full']).default('auto') (view.zod.ts:2376, aligned with FormView.modalSize), and FormView.modalSize is z.enum(['sm','default','lg','xl','full']) (view.zod.ts:4382), so "set navigation.size: 'full' (or FormView.modalSize: 'full')" names real keys that the renderer already lets win. objectui AppContent.tsx:1200-1206 spreads modalSize: 'full' only when the derived size === 'full' and spreads nothing otherwise, with the form view layout spread later, so the console needs no code for this change and an explicit size still wins — the card's downstream statement holds. The exact lg/xl bound a desktop 'auto' lands on is the renderer's (objectui PR test(cli): read back the port the e2e serve child actually bound, and fail loudly on a silent drift #12546), which the spec correctly leaves to it.
8. "The docs move with it" — satisfied vacuously, and said so. Outside record-surface.ts and its test, the only hits for the old rule are release-owned (content/docs/releases/v12.mdx, packages/spec/CHANGELOG.md, never edited in a code PR) and the governed skills/objectstack-ui/rules/navigation.md:131 sentence, which is carried by skills(objectstack-ui): navigation.md says a field-heavy object opens create/edit as a "full page"; the platform derives a modal for create/edit, bounded on desktop once #23734 lands #23753 (③).

② Semver level

• .changeset/23734-heavy-flow-bounded-modal.md: '@objectstack/spec': minor, a **BREAKING** token, the FROM/TO table and the one-line opt-in fix. minor is the launch-window spelling of a breaking change (check-changeset-no-major.mjs: a major is refused), and @objectstack/spec publishes, so skip-changeset would be wrong and is not used. Matches what the diff publishes: one derived default of one published function.
• Clause-②: no is on its own line in the changeset body, consistent with ① item 4; the level axis imposes no minimum for no.
• ADR-0087 disposition: exactly one marker, adr-0087: not-required (no-migration-prescription), with a why that says no key, spelling, stored shape or export moves and objectstack migrate meta has nothing to rewrite. That is the right category: nothing is for the ledger to project, the one-line fix is an opt-in for a host that wants the old posture rather than a rewrite every consumer must apply, and no registered/type-surface-only/runtime-interface-only claim fits a value change with no shape change. Gate reading on this head: the Check Changeset job (116732863881) is success, with step 13 "Require an ADR-0087 disposition on a declared-breaking changeset" success and step 15 "Guard against accidental major bumps (launch window)" success; Lint & Repo Gates success.

③ Boundary flags

• Dev deviation 1 (origin/main advanced one commit, 53646fc4, driver-sql only; not merged before opening): answered — the net diff against main at this head is exactly the three files, the check-runs ran on the PR merge ref, and the queue rebuilds on the merged generation. No action.
• Dev deviation 2 (model-free trailer pair on the commits): answered — that is the repo's own rule for an agent commit. No action.
• Dev deviation 3 (primary checkout briefly detached to free the branch, then restored): a container process note outside the diff; the report says it was restored. Nothing in the diff carries it. No action.
• open_questions[0] (is D1's field-count rule plus its scope note a clear "no full-screen choice for the embedded-subtable case"?): answered in ① item 5 — the reading is clear, the split does not apply, the implemented no-split derivation is the ruling's letter B as written; not escalated. The ruling asks for a report back only on a fork, and there is none; the landing seat may still relay the negative reading when it unblocks objectui#12521.
• out_of_scope_findings[0] (skills/objectstack-ui/rules/navigation.md:131 says a field-heavy object opens create/edit as a full page): governed skills/**, outside this card's file surface, correctly left untouched; the card's ACCEPT line records it filed as skills(objectstack-ui): navigation.md says a field-heavy object opens create/edit as a "full page"; the platform derives a modal for create/edit, bounded on desktop once #23734 lands #23753. Carried there.
• Dev-reported NOT MEASURED gate (pnpm check:dual-build-cjs-loads): covered on this head by Lint & Repo Gates success.
• Release note 6204273109 (co-shipping with spec(view): FormSectionSchema.columns drops default(1) — an undeclared section density is the renderer's (by available width), a declared one is the author's ceiling (objectui#12521 fork) #23740 to save objectui a second bump): a release-planning note with no scope change for this PR; nothing for this record, the answer belongs on spec(view): FormSectionSchema.columns drops default(1) — an undeclared section density is the renderer's (by available width), a declared one is the author's ceiling (objectui#12521 fork) #23740.
• Gate verdicts on this head at the reading above: Lint & Repo Gates success; TypeScript Type Check success; Build Core success; Governed Surface Queue Guard success; Check Changeset success; Spec property liveness success; Test Core shards 1/6, 2/6, 4/6, 5/6, 6/6 success, shard 3/6 still in progress; the full-battery jobs (Console Pin Gate, Temporal Conformance, dogfood shards, Build Docs) skipped on the PR run by design. The in-progress shard is recorded as in progress, not as a pass; the queue's all-green condition is the landing seat's to confirm before arming.

Implemented-by: claude/issue-23734-heavy-flow-bounded-modal
Reviewed-by: session_01HjR8RUwTPQ3TgbfKihmxp9

VERDICT: PASS

---

Generated by Claude Code