[objectstack-fleet]

Fixes #23933

Clause-②: no (narrowing)

What this does

Ruling B on #23892 (record 6216295104, the maintainer's 「同意」), items 2 and 3. The install-local plugin's "Installed Apps" entry (nav_marketplace_installed in MARKETPLACE_INSTALLED_UI_BUNDLE) now opens Setup › Packages filtered to Source = marketplace, and the bundle no longer ships the separate marketplace_installed page. The label ("Installed Apps") and icon (package-check) are unchanged. MarketplaceInstallLocalPlugin still registers the bundle at kernel:ready exactly as before, so without the plugin there is still no entry (cloud ADR-0009).

Landing point: packages/cloud-connection/src/marketplace-ui.ts, the producer the card names. marketplace-install-local-plugin.ts and packages/cli/scripts/check-app-nav-i18n.mjs did not need to change.

Measured before writing (objectui at the pinned .objectui-sha 5e15928b4631)

• Blocker cleared. git merge-base --is-ancestor 9d857c998c 5e15928b4631 exits 0. objectui#12675's merge is an ancestor of the pin, and exit 0 needs no control leg.

• H1, the spelling. At the pin, packages/app-shell/src/views/metadata-admin/packageSource.ts declares PACKAGES_SOURCE_PARAM = 'source' and PACKAGE_SOURCES = ['code', 'marketplace', 'authored']. readSourceFilter refuses an unknown, empty or repeated value by name. The Setup app's route segment is setup. objectui#12675 published two spellings that open the same page:

  • the URL /apps/APP/component/developer/packages?source=marketplace;
  • for a Setup nav item, { type: 'component', componentRef: 'developer:packages', params: { source: 'marketplace' } }. The console's resolveHref sends a component item's params as the query string, and objectui's resolveHref.test.ts pins that.

• Route taken: the component spelling, not the suggested url one. Four reasons:

  1. The spec's UrlNavItemSchema describes an "external or absolute URL", and validate-nav-target-refs treats url as "external by definition". ComponentNavItemSchema is the type for a first-party console component.
  2. Setup's own "Packages" entry (nav_packages) is a component entry on the same developer:packages.
  3. The link takes its app segment from the app it renders in, so /apps/setup is never spelled out in the entry.
  4. It is the nav-item spelling objectui#12675 published.

  MARKETPLACE_BROWSE_UI_BUNDLE's url entry targets a console route (system/marketplace), not a registered component, so it is no precedent for this target.

• H2, the actions. H2 holds, with one correction to its list. The Installed Apps list (InstalledListWidget.tsx at 9d857c998c^) had exactly two row actions: Details, and Uninstall on local installs only. Update and the sample-data Re-seed / Purge menu were never on that list; they are on the package page that Details opens. At the pin, Packages rows whose Source is marketplace carry both actions (MarketplaceRowActions.tsx, shown only with features.installLocal and to a workspace admin), and the marketplace:installed-list widget only redirects to the filtered Packages URL. So the bundle stops carrying the page in this PR.

• H3, the export surface. I compared @objectstack/cloud-connection's dist/index.d.ts before (at 2bcaefba9) and after:

  • The export list is identical: 40 names, order-insensitive. MarketplaceInstalledPage was never re-exported from index.ts.
  • Outside the MARKETPLACE_INSTALLED_UI_BUNDLE declaration, nothing else differs (comments stripped; string-literal unions compared order-insensitively, because TypeScript reorders their members).
  • The bundle's own published type does change. It loses pages (the full page shape), and its nav item goes from { id; type; pageName; label; icon } to { id; type; label; componentRef; params: { source: string }; icon }. I declare it here for the seat's contract review before the queue.

• content/docs. git grep -n -i "installed apps\|marketplace_installed\|installed-list\|marketplace/installed" -- content/docs ':!content/docs/releases/**' finds nothing. As a control, the same tree mentions marketplace in more than 10 files. The group table in content/docs/ui/setup-app.mdx names the Apps group's entries generically ("marketplace and Cloud Connection — cloud-connection"), which stays true. No docs page changes.

Changes

1. packages/cloud-connection/src/marketplace-ui.ts:
   • the entry is retargeted to the filtered Packages view;
   • MarketplaceInstalledPage and the bundle's pages are removed;
   • the bundle's version goes from 0.2.0 to 0.3.0, and its description is updated to match;
   • the header comment says what each of the two entries opens.
2. packages/cloud-connection/src/marketplace-installed-ui-entry.pin.test.ts (new) holds the card's pins. It boots a real ObjectKernel with ObjectQLPlugin, lets the plugin's own kernel:ready registration run, and reads the merged Setup app through the metadata protocol:
   • Plugin present: group_apps serves nav_marketplace_installed as { type: 'component', componentRef: 'developer:packages', params: { source: 'marketplace' }, label: 'Installed Apps', icon: 'package-check' }, with no pageName.
   • Plugin present: the page listing has no marketplace_installed. Control: the same listing includes the Cloud Connection bundle's cloud_connection_settings.
   • Plugin absent: the same composition has no such entry. Control: nav_cloud_connection is read from the same group.
   • The bundle has no pages key and exactly that one item.
3. packages/cloud-connection/src/canonical-expression-envelopes.test.ts: the retired page leaves this package's envelope-gate population. The population floor moves from 2 to 1 to match; the two-way check between the scan and the list still requires them to be equal. The downgrade-control case for the retired page is removed with the page. In vitest.config.ts, one comment that counted "two pages" is updated.
4. .changeset/23933-installed-apps-packages-filter.md: patch for @objectstack/cloud-connection and @objectstack/platform-objects.

Out-of-surface changes, declared and kept in their own commit 867b780a1

These files are outside the claim's file surface. Retiring the page makes each of them wrong, and their tests fail without the change:

• packages/platform-objects/src/apps/translations/ (domain:engine files): the pages.marketplace_installed entry leaves en.ts, zh-CN.ts, ja-JP.ts and es-ES.ts, and its two recorded hashes leave the three *.source-hashes.ts files. Without this, the pages.* default-locale parity check reports pages.marketplace_installed as an orphan. The nav label nav_marketplace_installed keeps all four translations.
• packages/cli/test/platform-page-i18n-parity.test.ts: the bundle no longer has a pages key to read, which would otherwise be a type error and an orphan. The population is now the two remaining plugin pages plus the record pages, and the floors move from 5 to 4 to match. The synthetic red-shape sample keeps its shape and is now labelled as a fixture.

Tests (head 4013e2b0d)

• pnpm --filter @objectstack/cloud-connection test: Test Files 51 passed (51), Tests 600 passed (600). pnpm --filter @objectstack/cloud-connection typecheck: exit 0. --listFiles shows both edited or new test files in the program.
• pnpm --filter @objectstack/platform-objects test: Test Files 73 passed (73), Tests 1136 passed (1136). typecheck: exit 0, and check:test-typecheck is OK.
• pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 on the 9 unit-tier files that read @objectstack/cloud-connection or the Setup translations: 9 passed, 217 tests. pnpm --filter @objectstack/cli typecheck, after pnpm turbo run build --filter=@objectstack/cli --concurrency=2 (61/61 tasks): VERDICT command-exit 0. The integration tier is left to CI.
• pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/platform-app-object-entry-views.test.ts, which composes this bundle: Tests 51 passed (51).
• Ablation of the new pin. It is a one-time check, and no ablation file stays in the tree. The pin's subject resolves through source (a relative import, with @objectstack/objectql aliased to src), so no leg needed a rebuild. Each leg ran through scripts/ablation-replace.mjs, which confirms the anchor hit and that the restored file's blob equals HEAD. Both legs went red, as predicted:
  • Leg A: the filter spelled source: 'installed'. Result: 2 failed, 2 passed (the served entry and the bundle shape). Restored blob f1e918e05ae7 equals HEAD.
  • Leg B: the bundle ships a marketplace_installed page again. Result: 2 failed, 2 passed (no page served, and the bundle has no pages). Restored blob equals HEAD.
  • Leg B's first attempt never ran. ablation-replace refused it because the anchor was contained in the replacement (anchor count 1 → 1). It was redone with an anchor that does not overlap the replacement.

Gates (head 4013e2b0d)

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 64 commands, and all 64 exit 0.
  • check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: 10 packages had no dist/). After pnpm turbo run build --filter='!@objectstack/docs' --concurrency=2 (76/76 tasks) it was re-run and exited 0.
  • --ran: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN, exit 0.
• Also run:
  • pnpm check:app-nav-i18n: exit 0 ("11 contributor(s), 4 locale(s), 2 app(s) — setup: 53 merged nav id(s), account: 12 merged nav id(s)").
  • node scripts/check-platform-checklist.mjs --changed-from origin/main: exit 0 (1 anchor judged, 0 lost).
  • pnpm exec eslint --no-inline-config over the 12 changed .ts files: exit 0, no output.
  • check:page-declaration-shape: exit 0, 34 page entries (35 at the base).

#23803 item 4 (the Setup count)

This PR adds and removes no nav id. Under ruling B the entry stays; only its target moves, and the pin asserts the bundle's items are exactly nav_marketplace_installed. Measured: check:app-nav-i18n's composition merges 53 Setup nav ids at 4013e2b0d, groups included.

Who lands last is not decided yet. #23890 (item 1, the single audit entry) is in flight: claimed 2026-10-17T15:59Z by domain:services#1. Whichever of the two lands second checks the count.

Item 4's 39 was set while "Installed Apps retires" was still an option. Under ruling B the entry stays, so #23803's own arithmetic (43, minus 2 for item 3, minus 1 for item 1) gives 40. platform-core.json's "45 Setup destinations" also stays with item 4.

Acceptance notes

• Stale QA text (no gate fails). One item in docs/qa/platform-checklist/areas/platform-core.json still describes the retired page:

  • its source line reads "MARKETPLACE_INSTALLED_UI_BUNDLE → nav_marketplace_installed + the marketplace_installed page owned by install-local";
  • its step "boot B: open the Installed Apps page — the installed CRM entry renders with its manifest identity" and its clause "Installed Apps is a real console" describe the old page.

  The anchor it cites (marketplace-ui.ts#MARKETPLACE_BROWSE_UI_BUNDLE) still resolves, and the steps still pass against the filtered Packages list. Carrier: none (承接者:无); it needs a domain:devx edit.

• Not measured in a browser (from reading objectui). The sidebar picks its highlighted item by pathname only (objectui NavigationRenderer's itemMatchScore). On the filtered view, "Packages" and "Installed Apps" share a path, so the tie goes to tree order, and "Installed Apps" may not be the one highlighted. The same is true for either spelling of the entry.

• Saved links to the old page. A favourite, recent item or bookmark that stored the old page address /apps/setup/page/marketplace_installed now opens a missing page. The changeset tells users where to go instead. objectui's marketplace:installed-list widget and its legacy system/marketplace/installed route keep redirecting until objectui#12733.

• Spec still declares the widget type. packages/spec still declares marketplace:installed-list (in the component-type vocabulary and in its ComponentPropsMap row), but after this PR nothing in this repo authors it. Retiring it is a domain:spec question to pair with objectui#12733. It is not done here, because spec paths are held off for this card.

• Historical mentions left as they are. The headers of scripts/check-page-declaration-shape.mjs and packages/cli/scripts/check-app-nav-i18n.mjs name MarketplaceInstalledPage and marketplace_installed in past measurements. They are left unchanged.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cloud-connection, @objectstack/platform-objects, touching 8 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/cloud-connection/vitest.config.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/deployment/install-modes.mdx (via navigationContributions (symbol, a field of const object MARKETPLACE_INSTALLED_UI_BUNDLE))
• content/docs/getting-started/examples.mdx (via navigationContributions (symbol, a field of const object MARKETPLACE_INSTALLED_UI_BUNDLE))
• content/docs/permissions/authorization.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/permissions/permission-metadata.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/permissions/permission-sets.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/permissions/positions.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/permissions/profiles.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/protocol/kernel/i18n-standard.mdx (via navigationContributions (symbol, a field of const object MARKETPLACE_INSTALLED_UI_BUNDLE))
• content/docs/protocol/kernel/plugin-spec.mdx (via navigationContributions (symbol, a field of const object MARKETPLACE_INSTALLED_UI_BUNDLE))
• content/docs/protocol/objectui/layout-dsl.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/ui/apps.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/ui/pages.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/ui/print-pages.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/ui/setup-app.mdx (via navigationContributions (symbol, a field of const object MARKETPLACE_INSTALLED_UI_BUNDLE))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/releases/v13.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/releases/v15.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/releases/v17/17-0.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/releases/v17/17-5.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))
• content/docs/releases/v17/17-7.mdx (via isDefault (symbol, a field of const object MarketplaceInstalledPage))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/cloud-connection/vitest.config.ts) — pages documenting those are invisible to this run
• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 7 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8a88901be1c317e2e078e6d29f21efcae5b9485e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d5787abe5ca3f1e6d582818d97636f7073bdf622 — the merge of head 22c7afb9a2ea30838c018a565bec6db7ed6178b2 into base 8a88901be1c317e2e078e6d29f21efcae5b9485e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d5787abe5ca3f1e6d582818d97636f7073bdf622 && git checkout d5787abe5ca3f1e6d582818d97636f7073bdf622
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 8a88901be1c317e2e078e6d29f21efcae5b9485e 22c7afb9a2ea30838c018a565bec6db7ed6178b2 && git checkout -B drift-repro 8a88901be1c317e2e078e6d29f21efcae5b9485e && git merge --no-ff 22c7afb9a2ea30838c018a565bec6db7ed6178b2

node scripts/docs-audit/affected-docs.mjs --json 8a88901be1c317e2e078e6d29f21efcae5b9485e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 8a88901be1c317e2e078e6d29f21efcae5b9485e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4013e2b0d08d295b42939466a3cd2f22eb45d7a9
Local-runs: none
Scope: packages/cloud-connection/src/marketplace-ui.ts, packages/cloud-connection/src/marketplace-installed-ui-entry.pin.test.ts, packages/cloud-connection/src/canonical-expression-envelopes.test.ts, packages/cloud-connection/vitest.config.ts, packages/cli/test/platform-page-i18n-parity.test.ts, packages/platform-objects/src/apps/translations/en.ts, packages/platform-objects/src/apps/translations/zh-CN.ts, packages/platform-objects/src/apps/translations/ja-JP.ts, packages/platform-objects/src/apps/translations/es-ES.ts, packages/platform-objects/src/apps/translations/zh-CN.source-hashes.ts, packages/platform-objects/src/apps/translations/ja-JP.source-hashes.ts, packages/platform-objects/src/apps/translations/es-ES.source-hashes.ts + .changeset/23933-installed-apps-packages-filter.md (the prose face, read for ②), packages/cloud-connection/src/index.ts, packages/cloud-connection/package.json (the exports map), packages/cloud-connection/src/marketplace-install-local-plugin.ts (the kernel:ready registration, main :687), packages/spec/src/ui/app.zod.ts (ComponentNavItemSchema, :660-666), packages/lint/src/validate-nav-target-refs.ts, packages/platform-objects/src/apps/setup-nav.contributions.ts (nav_packages, :51), packages/spec/src/system/translation.zod.ts (pages, :1093), packages/cli/scripts/check-app-nav-i18n.mjs (:393), packages/qa/dogfood/test/platform-app-object-entry-views.test.ts (:147), docs/qa/platform-checklist/areas/platform-core.json (:1951-1999), scripts/pm/clause2-line.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs; objectui at the pinned 5e15928b4631: packages/app-shell/src/views/metadata-admin/packageSource.ts, packages/app-shell/src/views/metadata-admin/PackagesPage.tsx (:1118), packages/layout/src/NavigationRenderer.tsx (resolveHref, :935-), packages/app-shell/src/console/marketplace/InstalledListWidget.tsx (:32), packages/app-shell/src/console/marketplace/MarketplaceRowActions.tsx

Read: card #23933 (body and all three comments, the dispatch's os-dev-report 6237251180 included), ruling record 6216295104 on #23892 (letter B, the maintainer's 「同意」), PR #24200's body and file list, the net diff of 4013e2b0d against main (merge base 2bcaefba9, 13 files, +306/-122), and the check-runs on the head. Read-only: nothing built, run or re-run here; the objectui pin was read with git show at 5e15928b4631 (9d857c998c, objectui#12675's merge, is its ancestor — is-ancestor exit 0, re-measured).

① Derived judgments

Accept sets — none move. The diff touches no packages/spec path, no Zod schema, no HTTP door and no governed path; nothing the runtime accepts from an author changes. Right.

Public-surface changes the diff implies, each judged:

• D1 — the entry's target, page to component. nav_marketplace_installed becomes { type: 'component', componentRef: 'developer:packages', params: { source: 'marketplace' } }, label and icon unchanged. ComponentNavItemSchema (app.zod.ts:660-666) declares componentRef: z.string() and params: z.record(z.string(), z.unknown()).optional(), so the shape is on-spec; validate-nav-target-refs treats component as a non-rule (an unregistered ref renders a named diagnostic) and url as "external by definition", so the component spelling over the suggested url one is the right type for a first-party console component, and it is the spelling Setup's own nav_packages already uses on the same developer:packages (setup-nav.contributions.ts:51). At the pin, packageSource.ts declares PACKAGES_SOURCE_PARAM = 'source' and PACKAGE_SOURCES = ['code', 'marketplace', 'authored'], PackagesPage.tsx:1118 reads searchParams.getAll(PACKAGES_SOURCE_PARAM) through readSourceFilter (an unknown or repeated value is refused by name), and resolveHref's component branch serialises a nav item's params as the query string — so the entry opens /apps/APP/component/developer/packages?source=marketplace, the card's pin 2. The new pin test reads the entry back from a real kernel's metadata protocol after the plugin's own kernel:ready registration, with the plugin-absent control and a positive control (nav_cloud_connection) in the same group. Right.
• D2 — the page retirement. Ruling B item 2 retires the separate view "once the filtered view serves its actions". At the pin MarketplaceRowActions.tsx carries exactly Details and Uninstall on a marketplace row (Uninstall on local installs, shown with features.installLocal to a workspace admin), and InstalledListWidget.tsx:32 only redirects to packagesHref(basePath, 'marketplace'); the old list carried those same two actions (H2's correction is a reading of objectui, not a new claim). The condition holds, so dropping MarketplaceInstalledPage and the bundle's pages key is the ruled move. MarketplaceInstalledPage was a module-level export never re-exported from index.ts and the package's exports map has only ., so no published export NAME leaves. Right.
• D3 — the exported bundle's declared shape narrows. MARKETPLACE_INSTALLED_UI_BUNDLE is exported from the package entry (index.ts:82, unchanged). Its value type loses the pages member and its nav item drops pageName for componentRef + params. A TypeScript consumer reading MARKETPLACE_INSTALLED_UI_BUNDLE.pages stops compiling; the three in-repo readers (the cli parity test, the envelope gate, the dogfood composition — the last reads only the manifest) are updated or unaffected. The change itself is right and is the ruling's consequence; what is wrong is how the changeset classifies it — see ②.
• D4 — the wire narrows. GET /api/v1/meta/page stops listing marketplace_installed and /apps/setup/page/marketplace_installed opens nothing; a stored favourite, recent item or bookmark on that address breaks (the changeset's own "What to do" line prescribes the new address, and the dev lists it as an acceptance note). The retirement is ruled and right; the classification is the same ② finding.
• D5 — the bundle's own version, 0.2.0 to 0.3.0, and its description. Nothing in the repo pins the manifest id with a version (0 hits outside the file and the CHANGELOG), and the shape of the bundle did change. Right.
• D6 — the translation bundle. pages.marketplace_installed leaves en, zh-CN, ja-JP, es-ES and its two rows leave each *.source-hashes.ts; nav_marketplace_installed keeps all four labels. TranslationData.pages is z.record(...) (translation.zod.ts:1093), so this is a value removal keyed to a page that no longer exists, not a type change; without it the pages.* parity verdict reports an orphan. Right.
• D7 — the gate populations. canonical-expression-envelopes.test.ts keeps the two-way scan-equals-list check and moves its anti-vacuity floor 2 to 1; platform-page-i18n-parity.test.ts moves its floors 5 to 4 and keeps the red-shape sample as a labelled fixture. Floors follow the population they guard; the equalities that give the verdict its teeth are untouched. Right. vitest.config.ts is a comment edit. Right.
• D8 — untouched by design. MARKETPLACE_BROWSE_UI_BUNDLE, marketplace-install-local-plugin.ts (the registration at :687 still registers the bundle at kernel:ready, so no plugin, no entry — cloud ADR-0009 holds), check-app-nav-i18n.mjs (:393 still passes the bundle into the nav roster; its line-54 comment is a historical measurement), and the spec's marketplace:installed-list row (the widget still exists and redirects at the pin; retiring the type pairs with objectui#12733 in the spec lane). Right, and each is inside the claim's hold-offs.
• D9 — content/docs. 0 hits for the page across content/docs outside releases, with 54 files carrying the control word marketplace (re-measured at origin/main). The card's docs clause is satisfied with no docs change. Right.

② Semver level

The changeset's level and Clause-②: line do not match what the diff publishes — this is the FAIL.

The committed .changeset/23933-installed-apps-packages-filter.md grades @objectstack/cloud-connection and @objectstack/platform-objects patch and declares Clause-②: no with no arm; the PR body carries the same Clause-②: no. no is true (nothing widens). But the diff narrows a published surface in two places the repo's own vocabulary names: a member of an exported declaration leaves (MARKETPLACE_INSTALLED_UI_BUNDLE.pages, D3 — check-adr-0087-registration.mjs's runtime-export-retired category exists exactly for "a retired member of an exported type" that "declares breaking truthfully"), and a served metadata page leaves the wire (D4), for which the changeset itself writes a consumer prescription. clause2-line.mjs defines the arm so that a diff which "NARROWS a published accept set answers no truthfully — and a narrowing is a breaking change"; AGENTS.md: (narrowing) is BREAKING, and a breaking changeset carries its migration and exactly one ADR-0087 disposition marker. The precedents in packages/cloud-connection/CHANGELOG.md (18.0.0-next.1 to next.3) spell this class fix(...)!: + Clause-②: no (narrowing) + a marker, at minor (the launch-window convention check-changeset-no-major.mjs enforces: breaking ships as minor, never major). Option A's argument — the constant is an output and its readers are in-repo tests — is a statement about who is known to read it, not about what the package publishes; the d.ts and the metadata wire are both published.

What must change (a patch round can carry it verbatim):

1. .changeset/23933-installed-apps-packages-filter.md line 2: '@objectstack/cloud-connection': minor (line 3, @objectstack/platform-objects, may stay patch — the fixed group versions in lockstep — or move to minor with it; either is right).
2. Same file line 6: feat(cloud-connection)!: Setup's "Installed Apps" entry opens Setup › Packages filtered to marketplace installs, and the separate Installed Apps page is no longer shipped — the ! is the precedent spelling for a declared-breaking summary.
3. Same file line 8: Clause-②: no (narrowing).
4. Same file, body: add exactly one ADR-0087 disposition marker, as the HTML comment the gate's header prints — adr-0087: not-required (runtime-export-retired @objectstack/cloud-connection#MARKETPLACE_INSTALLED_UI_BUNDLE.pages) ... followed by the why: the retired operand is a member of a published runtime export whose break reaches a TypeScript consumer through the compiler; the page it carried was plugin-registered in-memory metadata at kernel:ready, never a stored row, no spec key, authorable spelling or stored shape moves, so objectstack migrate meta has nothing to rewrite. Beside it, one rewrite line naming exactly that operand, in the arrow form the category reads: - \MARKETPLACE_INSTALLED_UI_BUNDLE.pages` -> delete(the bundle carries no page; its entry is read fromnavigationContributions). Keep the existing "What to do" sentence for the retired page address as plain prose (it is the FROM-to-TO mapping AGENTS.md asks for, and it carries no arrow or table for the detector to read as a second prescription). The gate re-verifies the category's three predicates on its run; if it refuses, its text names the next step — registered` would need a spec-lane conversion entry, which the claim holds off and the facts do not call for.
5. PR feat(cloud-connection): "Installed Apps" opens Setup Packages filtered to Source = marketplace #24200 body line 3: Clause-②: no (narrowing) — Check Changeset and the queue guard read the body's line against the changeset's.

③ Boundary flags

• Open question 1 (H3, keep no or no (narrowing)): B. Answered in ②, with the exact edits.
• Open question 2 (surface breach in 867b780a1: amend or drop the retirement): A. The eight files (the four locale files, the three *.source-hashes.ts, the cli parity test) are forced by a retirement the ruling orders and the pin measures as served; they are mechanical, isolated in one commit and declared. The claim's file surface is amended by the seat, not by this record; dropping the retirement (B) would ship a page that only redirects, against ruling B item 2.
• Route differs from the PM's suggestion (component, not url): right, for the reasons in D1; the suggestion was a hint on the claim, not the ruling.
• H2 corrected (Details and Uninstall, not update/uninstall/reseed/purge): read and confirmed at the pin (MarketplaceRowActions.tsx header; the sample-data menu lives on the package page Details opens). The ruling's retirement condition is about the view's own actions, and those are served.
• Pre-push refusal, amended unpublished commit; gate-runner timeouts with re-runs; the objectui ref fetched into refs/os-dev/... and deleted; origin/main moved under the worktree and was not merged (the diff is read here against merge base 2bcaefba9, 13 files): process notes, none leaves a mark in the diff.
• Two stray *.pid files at the dev container's filesystem root: outside the repository; nothing in the tree.
• test:repo not run locally: CI's Test Core is the verdict — all six shards and the aggregate concluded success on this head.
• Out-of-scope findings, carrier none, noted not filed: the stale QA text in platform-core.json (its source line and step 3 describe the retired page; the anchor resolves and the steps still execute against the filtered list) is a domain:devx prose fix and not a defect under Prime Directive chore: version packages #10 — a note is the right carrier; the spec's marketplace:installed-list row pairs with objectui#12733; the sidebar-highlight tie is an inference, not measured, and is the same for either spelling; the broken saved links are D4 and are the ② finding. The Setup navigation: one audit entry, Packages and Installed Apps agree, User Preferences and Identity Links leave the main nav #23803 item-4 arithmetic (40, not 39, under ruling B) is for whichever card lands last.
• Check-runs on 4013e2b0d, all concluded at posting: 40 runs, 34 success, 6 skipped (the opt-in and full-battery jobs), 0 failed — Build Core, the seven Test Core runs, the five type-check lanes (workspace, source gates, consumer gates, debt ledger, TypeScript Type Check), the eight Lint lanes, Governed Surface Queue Guard, the four claim guards, Dogfood Regression Gate, Check Documentation Links, Check PR Size, Auto Label, and Check Changeset. Check Changeset is green against the no/patch declaration as written, which is consistent with ②: the gates grade the declaration they are given, and the arm is what makes the ADR-0087 gate ask for the marker. The PASS a patch round earns needs every check green on its own head.

Implemented-by: claude/issue-23933-installed-apps-packages-filter
Reviewed-by: session_01QyoWKK9RwUNxBxmevy9Neb

VERDICT: FAIL

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 22c7afb9a2ea30838c018a565bec6db7ed6178b2
Local-runs: none
Scope: packages/cloud-connection/src/marketplace-ui.ts, packages/cloud-connection/src/marketplace-installed-ui-entry.pin.test.ts, packages/cloud-connection/src/canonical-expression-envelopes.test.ts, packages/cloud-connection/vitest.config.ts, packages/cli/test/platform-page-i18n-parity.test.ts, packages/platform-objects/src/apps/translations/en.ts, packages/platform-objects/src/apps/translations/zh-CN.ts, packages/platform-objects/src/apps/translations/ja-JP.ts, packages/platform-objects/src/apps/translations/es-ES.ts, packages/platform-objects/src/apps/translations/zh-CN.source-hashes.ts, packages/platform-objects/src/apps/translations/ja-JP.source-hashes.ts, packages/platform-objects/src/apps/translations/es-ES.source-hashes.ts + .changeset/23933-installed-apps-packages-filter.md (the prose face, the one file this round moved, read line by line for ②), packages/cloud-connection/src/index.ts (:82), packages/cloud-connection/package.json (the exports map), packages/cloud-connection/src/marketplace-install-local-plugin.ts (:687), packages/objectql/src/plugin.ts (the manifest service, :653), packages/spec/src/ui/app.zod.ts (ComponentNavItemSchema, :660-666), packages/lint/src/validate-nav-target-refs.ts, packages/platform-objects/src/apps/setup-nav.contributions.ts (:51), packages/spec/src/system/translation.zod.ts (:1093), packages/cli/scripts/check-app-nav-i18n.mjs (:393), packages/qa/dogfood/test/platform-app-object-entry-views.test.ts (:147), docs/qa/platform-checklist/areas/platform-core.json (:1951-1999), scripts/pm/clause2-line.mjs, scripts/check-adr-0087-registration.mjs (the runtime-export-retired predicates, :3991-4110), scripts/check-changeset-no-major.mjs, .github/workflows/pr-automation.yml (the changeset-check job, :243, :897-898, :976-977, :1127); objectui at the pinned 5e15928b4631: packages/app-shell/src/views/metadata-admin/packageSource.ts, packages/app-shell/src/views/metadata-admin/PackagesPage.tsx (:1118), packages/layout/src/NavigationRenderer.tsx (resolveHref, :935-), packages/app-shell/src/console/marketplace/InstalledListWidget.tsx (:32), packages/app-shell/src/console/marketplace/MarketplaceRowActions.tsx

This record supersedes record 6237704217 (FAIL on the previous head 4013e2b0d) for the head it names. Read: the patch commit 22c7afb9a against 4013e2b0d (ONE file, .changeset/23933-installed-apps-packages-filter.md, +7/−3; a --stat of the two heads with .changeset/ excluded prints nothing, so every code, test and translation path is byte-identical to the head record 6237704217 judged), the net diff against main at merge base 2bcaefba9 (13 files, +310/−122; origin/main has since moved to 8a88901be, the merge base has not), PR #24200's body (line 3 now Clause-②: no (narrowing)), the card's edited claim 6236359709 (its Clause-②: line now carries the arm; the file-surface line is as first written) and the dev's delta report 6237782586, ruling record 6216295104, and the check-runs on this head. Read-only: nothing built, run or re-run here; the dev's local gate readings in 6237782586 were not taken as evidence.

① Derived judgments

Unchanged from record 6237704217, because the paths that carry them did not move — restated so this record stands on its own:

• Accept sets — none move. No packages/spec path, no Zod schema, no HTTP door, no governed path; nothing the runtime accepts from an author changes. Right.
• D1 — the entry's target, page to component with componentRef: 'developer:packages', params: { source: 'marketplace' }, label and icon unchanged: on-spec (ComponentNavItemSchema, app.zod.ts:660-666, params is z.record(z.string(), z.unknown()).optional()), the same spelling as Setup's own nav_packages (setup-nav.contributions.ts:51), the right type over url (validate-nav-target-refs: component is a non-rule with a named diagnostic, url is "external by definition"), and the spelling objectui published at the pin (packageSource.ts PACKAGES_SOURCE_PARAM = 'source' with the closed code / marketplace / authored; PackagesPage.tsx:1118 reads it through readSourceFilter; resolveHref's component branch serialises params as the query string). Pinned from a real kernel through the metadata protocol, with the plugin-absent control. Right.
• D2 — the page retirement is ruling B item 2's "once the filtered view serves its actions", and at the pin it does: MarketplaceRowActions.tsx carries exactly Details and Uninstall, InstalledListWidget.tsx:32 only redirects. MarketplaceInstalledPage was never re-exported from index.ts and the exports map has only ., so no published export NAME leaves. Right.
• D3 — the exported bundle's declared shape narrows (MARKETPLACE_INSTALLED_UI_BUNDLE loses its pages member; its nav item drops pageName for componentRef + params). The change is the ruling's consequence and is right; its classification is now right too — ②.
• D4 — the wire narrows (GET /api/v1/meta/page stops listing marketplace_installed; /apps/setup/page/marketplace_installed opens nothing). Ruled; the changeset prescribes the new address. Right.
• D5 — bundle version 0.2.0 to 0.3.0 and description: nothing pins the id with a version; the shape changed. Right.
• D6 — translations: pages.marketplace_installed leaves the four locales and the two rows leave each *.source-hashes.ts; TranslationData.pages is a z.record (translation.zod.ts:1093), so a value removal keyed to a page that no longer exists, and nav_marketplace_installed keeps its labels. Right.
• D7 — gate populations: floors 2 to 1 and 5 to 4 follow the populations; the scan-equals-list equality and the arrayContaining check stay. Right.
• D8 — untouched by design: MARKETPLACE_BROWSE_UI_BUNDLE, the kernel:ready registration (:687, so no plugin, no entry — cloud ADR-0009), check-app-nav-i18n.mjs (:393), the spec's marketplace:installed-list row (pairs with objectui#12733). Right, inside the hold-offs.
• D9 — content/docs: 0 hits against 54 control files. Right.

② Semver level

The changeset now matches what the diff publishes, and the Clause-②: line is right. Each of record 6237704217's five items, verified on the committed file and the live PR:

1. Line 2 '@objectstack/cloud-connection': minor — the launch-window level for a declared-breaking change (check-changeset-no-major.mjs: breaking ships as minor, never major). Line 3 '@objectstack/platform-objects': patch — right as well: the fixed group versions in lockstep, and that package's change is a value removal keyed to the retired page.
2. Line 6 feat(cloud-connection)!: … — the precedent spelling (cloud-connection CHANGELOG 18.0.0-next.1 to next.3).
3. Line 8 Clause-②: no (narrowing) — no is true (nothing widens), the arm names the narrowing (D3, D4). The narrowing face is therefore the face this review is owed on, at CONTRACT_REVIEW_TIER; no schema and no governed path are in the diff.
4. Line 10, exactly one ADR-0087 marker: adr-0087: not-required (runtime-export-retired @objectstack/cloud-connection#MARKETPLACE_INSTALLED_UI_BUNDLE.pages) with its why. Judged against the category's three predicates, by name, from the trees — not from the dev's gate line:
   • retired-from-entry: MARKETPLACE_INSTALLED_UI_BUNDLE is reachable from the package entry at the merge base and at HEAD (index.ts:82, unchanged); at the base its value type carries pages (marketplace-ui.ts:92, pages: [MarketplaceInstalledPage]), at HEAD it does not. Holds.
   • no-metadata-surface: at the merge base the operand is declared in no *.zod.ts, no packages/spec/src/contracts/** file and no object definition, and none references it — a word-bounded grep over exactly those three kinds returns 0; its six code hits are the plugin, the package index, the cli nav-roster script, the page-shape gate's header and the QA checklist JSON, none a metadata surface. Holds.
   • from-operands-named: line 12 is the one rewrite line, MARKETPLACE_INSTALLED_UI_BUNDLE.pages -> delete, naming exactly the marker's operand; the body's only other consumer instruction (line 20, the retired page's address) is plain prose with no arrow and no table. Holds.
   • The marker's why is accurate: the bundle reaches the engine through the manifest service (packages/objectql/src/plugin.ts:653) into the in-memory registry at kernel:ready, never as a stored row, and no spec key, authorable spelling, object definition or stored shape moves, so objectstack migrate meta has nothing to rewrite — the category the gate built for exactly this class (a retired member of a published runtime export, delivered to a TypeScript consumer by the compiler).
   • The gate of record is CI's Check Changeset (changeset-check, pr-automation.yml:243), which runs check-empty-changeset, check-adr-0087-registration --base MERGE_BASE and check-changeset-no-major --base MERGE_BASE (:897-898, :976-977, :1127); its conclusion on this head is in the check-run line below.
5. PR feat(cloud-connection): "Installed Apps" opens Setup Packages filtered to Source = marketplace #24200 body line 3 reads Clause-②: no (narrowing) (read live), the same as the changeset and the card's claim; Check Changeset and the queue guard read a consistent declaration.

The migration AGENTS.md asks of a breaking changeset is carried: the pages member's rewrite line, and the FROM-to-TO for the retired page address in the "What to do" sentence. Right.

③ Boundary flags

• Delta report 6237782586 — open_questions: [], out_of_scope_findings: []; one deviation (the worktree was recreated from the branch at 4013e2b0d after the round-0 cleanup and pnpm install --frozen-lockfile run in it): process, no mark in the diff. The report's "PR body untouched" sentence was true at its write time; the body's line 3 carries the arm now.
• Record 6237704217's answers stand: Q1 (H3) → B, executed by this round; Q2 (surface breach in 867b780a1) → A. The claim's Clause-②: line was amended by the seat; its file-surface line still names the original surface, so the amendment naming the eight forced files (four locale files, three *.source-hashes.ts, the cli parity test) is a seat act still owed before the queue — a property of the claim comment, not of this diff, and not a FAIL item.
• Carried notes, unchanged: the stale QA text in platform-core.json (domain:devx, carrier none, a note is the right carrier under Prime Directive chore: version packages #10); the spec's marketplace:installed-list row pairs with objectui#12733; the sidebar-highlight tie is an unmeasured inference true of either spelling; Setup navigation: one audit entry, Packages and Installed Apps agree, User Preferences and Identity Links leave the main nav #23803 item 4's count (40 under ruling B) is for whichever card lands last.
• Check-runs on 22c7afb9a, all concluded at posting: 40 runs, 34 success, 6 skipped (Build Docs, Console Pin Gate, the dogfood shard matrix and Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance — the opt-in and full-battery jobs), 0 failed. Green: Build Core; Test Core and its six shards; the five type-check lanes (workspace, source gates, consumer gates, debt ledger, TypeScript Type Check); the eight Lint lanes and Lint & Repo Gates; Governed Surface Queue Guard; the four claim guards; Dogfood Regression Gate; Check Documentation Links; Check PR Size; Flag docs affected by code changes; Auto Label; and Check Changeset, which is the run that grades the (narrowing) arm, the minor level and the ADR-0087 marker's three predicates against the merge base — success on this head is the gate verdict for ② item 4. Every check is green on the head this record names.

Implemented-by: claude/issue-23933-installed-apps-packages-filter
Reviewed-by: session_01QyoWKK9RwUNxBxmevy9Neb

VERDICT: PASS

[objectstack-fleet]

席位核对 — ACCEPT · PR #24200 at 22c7afb9a (#23933)

domain:cli seat 2 · marchtian · session session_01QyoWKK9RwUNxBxmevy9Neb · 2026-10-17T18:10Z · holder of claim 6236359709 (Ruling-ref: 6216295104), amended as 6237304324. The dev's reports are comments 6237251180, 6237782586 on #23933, and the seat reviewed them against this PR, not the reports' own account.

1. Shape. Draft → main. The first line is Fixes #23933, the only closing keyword in the body. Clause-②: no (narrowing) is line-initial in the body (edited by the seat as the review's item 5), in the changeset and in the claim. The assignee is marchtian. 13 files, inside the amended surface. check-governed-merges.mjs --pr 24200: NOT governed, 432 changed lines.

2. Contract review of record. CONTRACT_REVIEW_TIER, narrowing face, an isolated agent given no seat reasoning:

   • FAIL 6237704217 on 4013e2b0d (② only: the changeset's level, !, (narrowing) arm and ADR-0087 marker);
   • PASS 6238299658 on 22c7afb9a, the current head. Both were read at source, and Head-sha: matches.

   Patch round 1 changed only the changeset (+7 / −3). The record judged the ADR-0087 runtime-export-retired marker's three predicates from the trees.

3. Premise and ruling. Ruling B items 2–3 are executed:

   • the entry retargets to developer:packages with params: { source: 'marketplace' }, objectui#12675's published spelling at the pin 5e15928b4631;
   • the separate page retires, because the filtered view serves its actions (Details, Uninstall), as measured at the pin and confirmed by the record;
   • "no plugin, no entry" holds: the kernel:ready registration is unchanged.

4. Check-runs on head 22c7afb9a at this act: 34 success, 6 skipped, 0 other (40 runs). check-expected-skips --pr 24200: OK. Check Changeset is green with the breaking declaration.

5. Accepted deviations:

   • the forced platform-objects translation edits and the cli parity test, amended into the surface and declared on [PM seat] domain:engine — ⏳ vacant #6367 (6237310730, no objection);
   • the route differs from the order's suggestion (component, not url), judged right by the record;
   • H2 corrected: the old page carried Details and Uninstall only.

   Changeset, read sentence by sentence: each bullet matches the diff and the record's D1–D6. "GET /api/v1/meta/page stops listing it" is D4, now declared breaking. The "What to do" address mapping stays prose.

6. Out of scope, all noted and not filed:

   • the stale QA text in platform-core.json (a domain:devx prose fix);
   • the spec's marketplace:installed-list row, which pairs with objectui#12733;
   • a sidebar-highlight inference, not measured;
   • Setup navigation: one audit entry, Packages and Installed Apps agree, User Preferences and Identity Links leave the main nav #23803 item 4's arithmetic (40 under ruling B), for whichever card lands last.

7. Landing. Ordinary queue landing, armed in this act. Fixes #23933 closes the card on merge, and the seat strips pm:dispatched in the same act. objectui#12733 (pm:blocked on this card) is unblocked once this lands.

---

Generated by Claude Code