[objectstack-fleet]

Fixes #24265

Clause-②: yes (widening)

Summary

An app page can now declare the row it is about: PageSchema.record, a one-row query { object, view?, filter?, sort? }. Every component visibleWhen on the page reads that row as record, which is already a contract-bound root on this surface. The count and the tier are both fields on that row: a summary roll-up and the bound object's own plan field. No new expression root is added, the lint's declared roots do not move, and nothing only the control plane could fill is named.

The renderer half is objectstack-ai/objectui#12931. Until the console mounts the binding, record stays unbound on an app page, exactly as before. The liveness ledger grades the key planned, citing the parse-time refusal as its code pointer.

The card's three questions, measured

All objectstack readings are on origin/main a422f04fe. All objectui readings are on objectui main 79cb8c03eb.

Q1: the root for an app page's bound row → the existing record, given a page-level binding

Measured:

• SchemaRenderer's configEvaluationScope (packages/react/src/SchemaRenderer.tsx) binds record from RecordContext (boundRecord = recordContext?.data) and binds page from page variables. It binds nothing else.
• On an app page, the only provider of that context is a record block's own one-row binding (plugin-detail/src/renderers/recordBinding.tsx, BoundRecordScope). That provider wraps the block's body, so neither the block's own visibleWhen nor a sibling's ever sees the row. H2 holds: "the row its page binds" was not a page-level concept at all. What actually existed was "a row one block binds, private to that block".
• PageVariableSchema.source names an interactive writer, such as element:record_picker or element:text_input, which write a selection. No block publishes data into a variable (H3, measured).

Option	Business need	Long-term	Hard for AI to get wrong	Startup focus
A. PageSchema.record → existing record root (chosen)	Serves the ruled pull directly: the environments page binds the organisation row, and both the count and the tier are fields on it	Same root ADR-0089 D1 names for runtime surfaces. Reuses the record blocks' one-row semantics (first row by sort, read as the caller, re-read on write), so the renderer gets no second path	Strict shape. limit, id and recordId are refused with prescriptions. The key is refused on every non-app page. Still a planned window until objectui#12931 lands, the same posture as ElementApiDataSourceSchema and the former print row	One key that reuses an existing shape. No new root, no lint change, no new gate
B. A bound block publishes its row into page.NAME	Same reach, but only when a block that shows the row exists	Changes what source means (selection writer → data publisher). A variable is empty until the block loads, which gives a second timing model	Two writers with two meanings under one key	Needs renderer work in every row-bearing block
C. A new root (bound.* or similar)	Same reach	A third row spelling beside record and data, against ADR-0089 D1's per-layer root	A new root the lint, formula and editor must all learn	Widest surface; the card prefers not to add one

Q2: tier without a cloud-only root → a field on the bound row, not features

Measured (H4):

• features.X already passes the lint, because features is in @objectstack/formula's SCOPE_ROOTS.
• objectui fills features from /api/v1/auth/config .features, in AppContent.tsx and RecordFormPage.tsx.
• That object is PUBLIC_AUTH_FEATURES (packages/spec/src/kernel/public-auth-features.ts). It is a closed, drift-guarded registry of deployment-level auth-capability flags, served to anonymous clients by plugin-auth's getPublicConfig().
• It is the same for every organisation and every viewer. Server-side, @objectstack/formula's buildScope does not fill it at all.

So an organisation's plan in features would need a per-organisation flag that open plugin-auth cannot know. Only the control plane could fill it, which is exactly the card's ⛔. Promoting features to contract-bound would be spec text only, but it would still not carry a tier. The answer is record.plan != 'free' (or whatever field the bound object carries). The visibleWhen docblock, its describe and the pages guide now say outright that a plan is not features.*. features stays ambient and unpromoted.

Option	Business need	Long-term	Hard for AI to get wrong	Startup focus
A. A field on the bound row (chosen)	The plan is data the control plane already owns on its organisation row	The platform supplies the mechanism and the app supplies the field, which matches the app/platform boundary	One place to read row data (record). Docs refuse the features reading by name	No new surface
B. Promote features, map the plan to flags	Would need a per-org, per-session flag in a deployment-level anonymous registry	Breaks the registry's meaning, and the drift guard ties every key to getPublicConfig()	An AI reads features as deployment config and the plan as org data, two meanings under one root	Cloud-only fill, which the card forbids

Q3: the count → a summary roll-up on the bound row, through Q1's root

summary is a spec field type (data/field.zod.ts). "A second environment exists" is record.environment_count > 1 on the organisation row. This needs no root and no spec change beyond Q1. The docblock names the pattern.

ADR check (H5)

• ADR-0068 D1 governs the user object only. Its Non-goals fence record / org / env namespaces out. Nothing here touches current_user.
• ADR-0089 D1: runtime record surfaces bind record. That is the root this uses, unchanged.

Neither ADR is contradicted.

What changed

• packages/spec/src/ui/page.zod.ts:
  • PageRecordBindingSchema (strict; aliases plus limit / id / recordId guidance).
  • PageSchema.record with aliases (boundRecord, recordBinding, recordSource, dataSource).
  • checkPageRecordBindingPlacement: refuses record unless type: 'app', with a separate sentence for a record page. It is exported and attached by identifier like the six sibling checks.
  • The visibleWhen docblock and describe: the row's meaning, the sibling limit, and count/plan as fields, not features.
  • PageRecordBinding / PageRecordBindingParsed type aliases.
  • The schema is declared after PageComponentSchema. That ordering keeps the generated skills/objectstack-ui/references/_index.md (a governed path) byte-identical.
• Tests:
  • object-refinement-check-exports.test.ts adds the new export: six fixtures (app accept, no binding, home, record, untyped default, list), attachment counts and barrel identity.
  • metadata-form-zod-reconciliation.test.ts adds a root ledger entry for record (planned, on the print precedent).
• Ledgers:
  • liveness/page.json adds a record row, planned, drilled to object / view / filter.{field,operator,value} / sort.{field,order}.
  • dropped-refinements.baseline.json gets the new ui/PageRecordBinding site, ui/Page's first ViewFilterRule site moved from interfaceConfig.filterBy to record.filter, and totals 237 / 768.
• Generated by their generators: authorable-surface, api-surface, export-origins, declaration-map, json-schema.manifest, liveness/state-counts, the strictness-ledger counts, and content/docs/references/**.
• content/docs/ui/pages.mdx: the record property row and the visibleWhen row.
• .changeset/24265-app-page-record-binding.md: @objectstack/spec minor, with the Clause-② line.

Not touched: packages/lint (the root set did not move: record and page were already declared), packages/formula, objectui, .objectui-sha, rule-explanations.ts, component.zod.ts, content/docs/releases/.

Verification

These runs were on head a150ec532f. CI then went red there in @objectstack/metadata-protocol: the census in protocol.meta-types-degenerate-derivation.test.ts pinned 25 top-level page properties. Patch round 1 (03b3e5ad4b, report 6247697989) moved that census to 26 for record. The merge of main after PR #24270 (6480ad0b6, with its regeneration commit 88dbe419) followed. The head's check-runs are its verification. Contract review PASS 6248097604 read that head.

• pnpm --filter @objectstack/spec build exited 0. check:generated reported "All 14 generated artifacts are up to date".
• pnpm --filter @objectstack/spec test (local project): 693 files, 21015 passed, 1 todo.
• pnpm --filter @objectstack/spec test:repo: 68 files, 1125 passed.
• pnpm --filter @objectstack/spec typecheck exited 0.
• node scripts/pm/dispatch-gates.mjs --commands: 111 derived commands, all run, all exit 0. Seven first exited 3 on prerequisites (an unbuilt closure, a shallow clone). They exited 0 after pnpm --filter '@objectstack/lint...' --filter '@objectstack/client-react...' --filter '@objectstack/objectql...' build, a full turbo run build and git fetch --unshallow. --ran reconciliation: 111 derived, 111 run, 0 NOT-MEASURED, 0 UNRUN.
• check-changeset-no-major --event with this body: no major bump, and the level axis accepts Clause-②: yes (widening) with @objectstack/spec at minor. scripts/pm/clause2-line.mjs reads the same line from this body and from the changeset.
• check:liveness is green, with the record row planned and drilled.
• Ablation, run through scripts/ablation-replace.mjs with a trap restore. The type === 'app' accept arm of checkPageRecordBindingPlacement was changed so it can never match. object-refinement-check-exports.test.ts then failed exactly the accepting fixture ("a record binding on an app page": expected [ 'record' ] to deeply equal [], 1 failed / 251 passed). The file was restored with blob == HEAD and an empty git diff HEAD.

Acceptance notes

• content/docs/ui/pages.mdx's visibleWhen row used to say "Legacy alias visibility is accepted but deprecated per ADR-0089". At 18 the key is a retiredKey() tombstone. Patch round 1 corrected the row: the retired spelling is refused at parse (ADR-0089 D2). This was review flag F1.
• No lint finding is added for record.* read on an app page that declares no binding. Adding a gate defaults to no, and the predicate faults open there exactly as before.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_012SGQNHx8abCKZKoyj2VQym

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 9 documentable anchor(s). ⚠️ 8 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-surface/ui.json, packages/spec/declaration-map/ui.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/self-hosting.mdx (via /api/v1/auth/config (route, a path literal in a comment in PageComponentSchema))
• content/docs/permissions/authentication.mdx (via /api/v1/auth/config (route, a path literal in a comment in PageComponentSchema))
• content/docs/permissions/sso.mdx (via /api/v1/auth/config (route, a path literal in a comment in PageComponentSchema))
• content/docs/protocol/objectui/actions.mdx (via /api/v1/auth/config (route, a path literal in a comment in PageComponentSchema))
• content/docs/protocol/objectui/layout-dsl.mdx (via PageComponentSchema (symbol, a top-level const), PageSchema (symbol, a top-level const))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageComponentSchema (symbol, a top-level const), /api/v1/auth/config (route, a path literal in a comment in PageComponentSchema))
• content/docs/releases/v17/17-0.mdx (via getConfig (sdk, the bare tail of client method auth.getConfig, bound to GET /api/v1/auth/config))
• content/docs/releases/v17/17-7.mdx (via PageComponentSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 8 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-surface/ui.json, packages/spec/declaration-map/ui.json, …) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 143 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a8733f1c77681137d25abb1c02b5c889b71c01e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9f7e67e43cba1caac54eaa82dbe02286f790647b — the merge of head 88dbe4191ecbaddd12b68193a6e286e2cb4b5a32 into base 7a8733f1c77681137d25abb1c02b5c889b71c01e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9f7e67e43cba1caac54eaa82dbe02286f790647b && git checkout 9f7e67e43cba1caac54eaa82dbe02286f790647b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7a8733f1c77681137d25abb1c02b5c889b71c01e 88dbe4191ecbaddd12b68193a6e286e2cb4b5a32 && git checkout -B drift-repro 7a8733f1c77681137d25abb1c02b5c889b71c01e && git merge --no-ff 88dbe4191ecbaddd12b68193a6e286e2cb4b5a32

node scripts/docs-audit/affected-docs.mjs --json 7a8733f1c77681137d25abb1c02b5c889b71c01e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7a8733f1c77681137d25abb1c02b5c889b71c01e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a150ec532fa85f2502c7c31c1bd0afced7a51b39
Local-runs: none
Scope: packages/spec/src/ui/page.zod.ts + packages/spec/src/ui/object-refinement-check-exports.test.ts, packages/spec/src/system/metadata-form-zod-reconciliation.test.ts, packages/spec/liveness/page.json, packages/spec/dropped-refinements.baseline.json, .changeset/24265-app-page-record-binding.md, content/docs/ui/pages.mdx, and on main: packages/spec/src/kernel/public-auth-features.ts, packages/spec/src/data/context-tokens.zod.ts, packages/lint/src/validate-visibility-predicates.ts, docs/adr/0068-unified-user-context-and-built-in-identity-roles.md, docs/adr/0089-unify-visibility-predicate-naming.md; objectui main 32b492b6: packages/app-shell/src/providers/ExpressionProvider.tsx, packages/react/src/SchemaRenderer.tsx, packages/plugin-detail/src/renderers/recordBinding.tsx

Inputs: card #24265 (body, claim 6246461293, dev report 6247235785), PR #24275 (body, its 16 files, the net diff against main 93b4acb), and the head's 39 check-runs, read at 2026-10-18T07:54Z. The head had not moved past a150ec5 at that read. The rest of the diff (the generated artifacts, content/docs/references/**, the strictness-ledger counts) is the lane seat's ACCEPT at TIER_DEFAULT.

① Derived judgments

1. PageSchema.record (PageRecordBindingSchema, strict { object, view?, filter?, sort? }): one new optional authorable key on ui/Page and four keys on the new ui/PageRecordBinding shape (authorable-surface/ui.json). RIGHT. The shape is ElementDataSourceSchema minus limit, with the same alias table; limit, id and recordId are refused through guidance with a prescription, so an AI that carries the component binding up to the page is refused loudly, never folded. On the key name, which the dev asked this review to judge: record equals the root it binds, and the component-level precedent (dataSource) is a list binding that happens to take one row for the record blocks, so reusing that name at page level would have carried the many-rows reading the page refuses. The four aliased spellings (boundRecord, recordBinding, recordSource, dataSource) fold onto it and collide with no PageSchema key or alias on main. The name stands.
2. No new expression root. RIGHT, and the load-bearing judgment of the card. record is already a contract-bound root of the page-component visibleWhen (the describe on main) and the runtime root ADR-0089 D1 names; the lint's declared set is @objectstack/formula SCOPE_ROOTS plus VIEW_PAGE_EXTRA_ROOTS (current_user, page), judged with no page-type derivation, so record.plan on an app page lints green today and packages/lint is correctly untouched. Nothing only the control plane can fill is named: the row is read through the data API every host serves, and the spec's own {current_org_id} context token (data/context-tokens.zod.ts, resolved on both sides of the wire) lets a binding filter select the caller's organisation row, which is what makes the ruled environments page servable from the platform alone.
3. checkPageRecordBindingPlacement: the key is refused on every page whose type is not app (the default is record, PAGE_TYPE_DEFAULT), with one sentence for a record page and one for a page with no row; exported from @objectstack/spec/ui, attached by identifier as the seventh PageSchema check, pinned by six fixtures and the declaration, attachment and barrel-identity counts in object-refinement-check-exports.test.ts; the dev's ablation of the accept arm failed exactly the accepting fixture. RIGHT: the rule and its pin land as one change.
4. The visibleWhen docblock and describe: record is the record a record page opens or the row an app page's binding reads; a block's own dataSource binds no record for its siblings or for its own gate; a count or a plan is a FIELD on the row, not features.*. RIGHT on the cited code: objectui's configEvaluationScope binds record only from RecordContext, and on an app page that context is provided only by BoundRecordScope around a record block's BODY (recordBinding.tsx); features is PUBLIC_AUTH_FEATURES, deployment-level flags served to anonymous clients by plugin-auth's getPublicConfig() under a key-set drift guard. The ambient-roots paragraph (features, os.user: renderer behaviour, not contract) is unchanged. One reading note, not a defect: the describe's "never features.*" is scoped to a plan; features.X remains the right root for the auth-capability gates that requiresFeature lowers to.
5. Public exports PageRecordBindingSchema, PageRecordBinding, PageRecordBindingParsed and checkPageRecordBindingPlacement (api-surface, export-origins, declaration-map), and the new published JSON schema ui/PageRecordBinding (json-schema.manifest). RIGHT, all additive.
6. dropped-refinements.baseline.json: one more schema and one more site (ui/PageRecordBinding at filter.element), and ui/Page's first ViewFilterRule site moving from interfaceConfig.filterBy.element to record.filter.element. RIGHT: no new refinement pattern is admitted; it is ViewFilterRuleSchema's existing rule reached through one more path, the same class as every other filter.element row, and the move is declaration order inside PageSchema.
7. Liveness: record and its six leaves planned, evidence at the parse refusal and the shape; state-counts/page.md planned 0 to 7; the metadata-admin form ledger gains an omit row for record on the print precedent. RIGHT as a grading: the parse half is live, the renderer half is the card's own sequencing (objectui#12931 is pm:blocked on this card), the same posture as ElementApiDataSourceSchema. See ③ F2 for the note's missing pointer.
8. Declaring PageRecordBindingSchema after PageComponentSchema so skills/objectstack-ui/references/_index.md stays byte-identical. RIGHT, and not a dodge: exportListDescription names the first five authorable exports in source order, so declared earlier the new schema would have displaced PageComponentSchema from that line, a worse index bought with a governed-path edit.
9. ADR-0068 D1 and ADR-0089 (the two prior decisions the claim named): neither is contradicted. ADR-0068 rules the user object only and its Non-goals fence record / org / env out; ADR-0089 D1 is the root this reuses, and its fail-open-at-render posture is what the "a faulting predicate renders the component" sentences restate.

② Semver level

.changeset/24265-app-page-record-binding.md: @objectstack/spec minor, body opening Clause-②: yes (widening), identical to the PR body's line. MATCHES what the diff publishes: one new optional authorable key and shape, four exports, one JSON schema file, four aliases; nothing removed, renamed or narrowed, and every existing page parses as before (the only new refusal fires on a key that did not exist). No ADR-0087 disposition marker is owed (not breaking). Check Changeset on the head: success.

③ Boundary flags

Dev deviations, each answered:

• D1 (test:repo run though not owed): no effect on the contract; noted.
• D2 (the liveness row drilled to its leaves instead of growing the undrilled-containers baseline; the dropped-refinements move): both the right direction, judged in ① 6 and 7.
• D3 (the primary checkout detached to check the claim's branch out in a worktree): the dev's own container, and the branch sat at origin/main a422f04fe, so no shared-tree hazard was realised. Noted.

open_questions (the card's three questions, delegated by the card to the seat and by the seat to the dev's measurement):

• Q1, the root for an app page's bound row. ANSWERED: A, the existing record bound by PageSchema.record, is right on all four axes (business need, long-term soundness, AI-error-proofing, startup focus): it serves the ruled pull directly, reuses ADR-0089 D1's root and the record blocks' one-row semantics, is strict and refused off app pages, and adds no root for the lint, the formula engine or the editor to learn. B would have given PageVariable.source a second meaning; C a third row spelling. The key-name question is judged in ① 1.
• Q2, the tier without a cloud-only root. ANSWERED: A, a field on the bound row (record.plan). features cannot carry it: PUBLIC_AUTH_FEATURES is a closed, deployment-level, anonymous registry whose served key set is drift-guarded against getPublicConfig(), so a per-organisation plan there is exactly the control-plane-only fill the card forbids. Promoting features to contract-bound stays undecided, as the dev wrote; nothing here needs it.
• Q3, the count. ANSWERED: A, a summary roll-up on the bound row read as record.FIELD; no root and no evaluator capability. A hand-off, not an escalation: the data half is the app's. The control plane's organisation object needs the roll-up and its plan field, and its environments page becomes a type: 'app' page carrying the binding (a {current_org_id} filter selects the caller's organisation). The card's Order names only objectui#12931; the cloud-side card is for the seat to route under the cross-repo rule. This review cannot read that repository.

Flags of my own:

• F1 (content/docs/ui/pages.mdx, the lane seat's ACCEPT): the visibleWhen cell this PR REWRITES still ends "Legacy alias visibility is accepted but deprecated per ADR-0089", false since 18, where visibility is a retiredKey() tombstone on the very schema this PR edits. The dev lists it as pre-existing drift; a sentence re-asserted in a rewritten cell is not pre-existing. One parenthetical deletion on the next push. The Zod text is the contract and is correct, so this does not move the verdict.
• F2 (packages/spec/liveness/page.json, row record): the planned note names the measurement and the flip condition but not the consumer card. The precedent planned rows (settledWhen, conditionalFormatting in liveness/field.json) name theirs; add objectui#12931 to the note on the next push, or when the row flips to live.
• F3 (the check-runs on this head, at the reading above): Lint & Repo Gates, Governed Surface Queue Guard, Spec property liveness, Check Changeset, Check PR Size, Build Docs, every Lint · lane and Type Check · source gates were success; Test Core (1 to 6 of 6), Build Core, Type Check · workspace, Type Check · consumer gates and Type Check · debt ledger were still in_progress. The contract verdict below is this review's; those conclusions are theirs, and the landing waits for all of them (the generated-artifact gates live in the type-check job).
• No escalation: no axis conflict, and no prior ruling or ADR answers any of the three questions differently.

Implemented-by: claude/issue-24265-app-page-predicate-roots
Reviewed-by: session_01TyRhWbVbbQpQJTDbW8VahJ

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 88dbe4191ecbaddd12b68193a6e286e2cb4b5a32
Local-runs: none
Scope: packages/spec/src/ui/page.zod.ts + packages/spec/src/ui/object-refinement-check-exports.test.ts, packages/spec/src/system/metadata-form-zod-reconciliation.test.ts, packages/metadata-protocol/src/protocol.meta-types-degenerate-derivation.test.ts, packages/spec/liveness/page.json, packages/spec/liveness/state-counts/page.md, packages/spec/dropped-refinements.baseline.json, packages/spec/authorable-surface/ui.json, packages/spec/api-surface/ui.json, packages/spec/declaration-map/ui.json, packages/spec/export-origins/ui.json, packages/spec/json-schema.manifest/ui.json, .changeset/24265-app-page-record-binding.md, content/docs/ui/pages.mdx; the merge topology (03b3e5a, the merge commit 6480ad0 against both parents 03b3e5a and 9822b05, and #24270 as 586705d); on main 9822b05: packages/spec/src/ui/default-record-page.ts, packages/spec/src/ui/view.zod.ts, packages/spec/src/shared/enums.zod.ts, packages/spec/src/kernel/public-auth-features.ts, packages/lint/src/validate-visibility-predicates.ts, packages/formula/src/cel-engine.ts, .gitattributes, docs/adr/0068-unified-user-context-and-built-in-identity-roles.md, docs/adr/0089-unify-visibility-predicate-naming.md; objectui 26323c4 (the sibling checkout): packages/react/src/SchemaRenderer.tsx, packages/plugin-detail/src/renderers/recordBinding.tsx, packages/app-shell/src/providers/ExpressionProvider.tsx

Inputs, read at 2026-10-18T09:12Z: card #24265 (body; comments 6246461293 claim, 6247235785 dev report, 6247697989 patch round 1 report; no round-2 report was on the card at this read), PR #24275 (body, its 17 files, the net diff against main at merge-base 9822b05), and the head's 40 check-runs. The head had not moved past 88dbe41 at this read. This record replaces comment 6247358877 (PASS on a150ec5) and is complete on its own; where the move left a judgment of that record untouched it is carried here by name. The remainder of the diff (content/docs/references/index.mdx, content/docs/references/ui/page.mdx, docs/audits/2026-07-unknown-key-strictness-ledger.counts/ui.md: generated, and read here as consistent with their sources) is the lane seat's ACCEPT at TIER_DEFAULT.

What moved since a150ec5, measured: the branch's own commits are 03b3e5a (three files: the metadata-protocol census, content/docs/ui/pages.mdx, liveness/page.json), the merge commit 6480ad0 (origin/main 9822b05 into the branch) and 88dbe41 (one file: authorable-surface/ui.json, three lines). packages/spec/src/ui/page.zod.ts is byte-identical between a150ec5 and this head.

① Derived judgments

1. PageSchema.record (PageRecordBindingSchema, strict { object, view?, filter?, sort? }): one new optional authorable key on ui/Page and four on the new ui/PageRecordBinding shape (authorable-surface/ui.json). RIGHT, carried from 6247358877 ① 1 on an unchanged hunk, re-read here: the shape is ElementDataSourceSchema (page.zod.ts:297) minus limit, with its alias table verbatim; limit, id and recordId are refused through guidance with a prescription. The key name record equals the root it binds; the four aliases (boundRecord, recordBinding, recordSource, dataSource) collide with no key or alias of PageSchema on main (grepped at 9822b05). Imports it needs (ViewFilterRuleSchema from ./view.zod, SortItemSchema from ../shared/enums.zod, PAGE_TYPE_DEFAULT from ./default-record-page) are present at the head.
2. No new expression root; packages/lint and packages/formula untouched. RIGHT, the load-bearing judgment of the card: record is in @objectstack/formula SCOPE_ROOTS (cel-engine.ts:131) and the lint adds VIEW_PAGE_EXTRA_ROOTS = ['current_user', 'page'] (validate-visibility-predicates.ts:775) with no page-type derivation, so record.plan on an app page lints green on main already. Nothing only the control plane could fill is named: the row is a data-API read every host serves.
3. checkPageRecordBindingPlacement: record is refused on every page whose type is not app (the default is PAGE_TYPE_DEFAULT, 'record', page.zod.ts:1697 and :1865), one sentence for a record page and one for a page with no row; exported, attached by identifier as the seventh PageSchema check, pinned by six fixtures and the declaration, attachment and barrel-identity counts in object-refinement-check-exports.test.ts (the "all seven exports" assertion). RIGHT: rule and pin land as one change; the dev's ablation of the accept arm failed exactly the accepting fixture (report 6247235785).
4. The visibleWhen docblock and describe (record is the record a record page opens or the row an app page's binding reads; a block's own dataSource binds no record for its siblings or its own gate; a count or a plan is a FIELD on the row, never features.*). RIGHT on the cited code, re-read at objectui 26323c4: configEvaluationScope binds record only from boundRecord = recordContext?.data (SchemaRenderer.tsx:656-664, :1137-1138); on an app page that context is provided only by BoundRecordScope around a record block's body (recordBinding.tsx:181-183); nothing in app-shell, react or plugin-detail reads a page-level record key; buildExpressionScope mounts features as renderer tier (ExpressionProvider.tsx:95-103). features is PUBLIC_AUTH_FEATURES, whose keys mirror plugin-auth's getPublicConfig() features literal under a drift guard (public-auth-features.ts:79-85): deployment-level, the same for every organisation. The ambient-roots paragraph is unchanged. Reading note, not a defect: "never features.*" is scoped to a plan; features.X stays the right root for the auth-capability gates.
5. Public exports PageRecordBindingSchema, PageRecordBinding, PageRecordBindingParsed, checkPageRecordBindingPlacement (api-surface, export-origins, declaration-map) and the published JSON schema ui/PageRecordBinding (json-schema.manifest; references index 1538 to 1539 schemas, ui 168 to 169). RIGHT, all additive.
6. The metadata-protocol census (CARD_PROPERTY_COUNTS.page 25 to 26, protocol.meta-types-degenerate-derivation.test.ts:324-327): RIGHT, a census naming the new key and not a loosened test. The file's own docblock convention records each such move as a declared key with its name (print 24 to 25 is the precedent, lines 305-310), and the new sentence names record; every other count and every derivation assertion is unchanged. The dev reproduced the red on a150ec5 (expected 26 to be 25) before moving the count.
7. The merge resolution (6480ad0, then 88dbe41), judged against both parents. Three files were changed on both sides between a422f04 and the head: dropped-refinements.baseline.json, liveness/page.json, authorable-surface/ui.json. All three carry both sides at the head, and nothing from feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270 is lost:
   • dropped-refinements.baseline.json: the only --cc hunk of the merge is the totals, resolved by hand to 239 / 771, which is the arithmetic: 236 / 767 at a422f04, +1 / +1 from this branch (237 / 768 at 03b3e5a), +2 / +3 from feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270 (238 / 770 at 9822b05). The net hunk against main is exactly this branch's: the totals, ui/Page's first ViewFilterRule site moving from interfaceConfig.filterBy.element to record.filter.element, and the new ui/PageRecordBinding site; feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270's three emptyState.link.url sites are untouched. RIGHT. build-schemas.ts holds this ledger equal to the generated set, and Build Core is success on the head.
   • liveness/page.json: the net hunk against main is exactly the record row (+66 / 0, so nothing of main's was removed), and the added-and-removed line set of main's own change to the file equals that of branch-to-head: main's side is fully present. RIGHT.
   • authorable-surface/ui.json: at the merge commit ALONE main's three rows (ui/RecordDetailsProps:emptyState, ui/RecordHighlightsProps:emptyState, ui/RecordQuickActionsProps:emptyState) were missing: the path is merge=os-regen (.gitattributes:139), and that driver's silent one-side drop is the case AGENTS.md Multi-agent discipline §11 describes. The regen commit 88dbe41 restored exactly those three lines and nothing else, so at the head the net hunk against main is this branch's five rows only and main's side is fully present. RIGHT, and the two-commit shape (merge as a deferral, a separate regeneration commit on the merged tree) is the prescribed one. check:authorable-surface and the other generated-artifact gates live in the TypeScript Type Check job, which is success on the head.
   • content/docs/references/ui/component.mdx was never in this branch's delta and equals main at the head. The other feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270 files (its changeset, component.zod.ts, its test) are byte-identical between main and the head. The per-file numstat of the branch's pre-merge delta (a422f04..03b3e5a) equals the net delta at the head (9822b05..88dbe41) for all 17 files.
8. Liveness and form ledgers: record and its six leaves planned, evidence at the parse refusal and the shape, the note now naming objectui#12931; state-counts planned 0 to 7, classified 35 to 42; the metadata-admin form ledger's omit row for record on the print precedent. RIGHT as a grading: the parse half is live, the renderer half is the card's own sequencing (objectui#12931 is pm:blocked on this card), the posture of ElementApiDataSourceSchema and the former print row. Spec property liveness is success on the head.
9. Declaring PageRecordBindingSchema after PageComponentSchema so skills/objectstack-ui/references/_index.md stays byte-identical: RIGHT, carried from 6247358877 ① 8 (the governed path is not in the file list; Governed Surface Queue Guard success).
10. ADR-0068 D1 and ADR-0089: neither contradicted. ADR-0068's Non-goals (line 100) fence record / org / env out of its scope; ADR-0089 D1 is the root this reuses, and D2 (alias then remove) is what the visibility tombstone at page.zod.ts:754 cites, so the pages guide's new sentence is consistent with the schema.

② Semver level

.changeset/24265-app-page-record-binding.md: @objectstack/spec minor, body opening Clause-②: yes (widening), identical to the PR body's line. MATCHES what the diff publishes: one new optional authorable key and shape, four exports, one JSON schema file, four aliases, one new parse refusal that fires only on a key that did not exist; nothing removed, renamed or narrowed, every existing page parses as before. No ADR-0087 disposition marker is owed (not breaking). The metadata-protocol change is a test file and publishes nothing. Check Changeset is success on the head.

③ Boundary flags

Dev deviations and open_questions:

• Round 0 D1 (test:repo run though not owed), D2 (liveness row drilled; dropped-refinements move), D3 (primary checkout detached in the dev's own container): answered in 6247358877 ③ and untouched by the move; carried. D2's two ledgers are re-judged above in ① 7 and ① 8 after the merge.
• Round 1: deviations: [], open_questions: [], nothing to answer.
• Q1 (the root), Q2 (the tier), Q3 (the count): ANSWERED A, A, A, carried from 6247358877 ③ on unchanged hunks and re-read here against the cited code in ① 2 and ① 4. Q3 remains a hand-off, not an escalation: the control plane's organisation object needs the roll-up and its plan field, and its environments page becomes a type: 'app' page carrying the binding; the card's Order names only objectui#12931, so the cloud-side card is the seat's to route under the cross-repo rule. This review cannot read that repository.
• F1 (pages.mdx visibility alias sentence) and F2 (the liveness note's consumer card) from 6247358877: FIXED at 03b3e5a, read in the diff (pages.mdx:211 now says the retired spelling is refused at parse, ADR-0089 D2; the record row's note names app pages: the predicate scope gains the bound row and the organisation's plan, so visibleWhen can follow tier and count (新建环境 on paid tiers, the 🔒 line on Free, the 生产 tag with a second environment) (ruling B on cloud#2774) objectui#12931). Closed.

Flags of my own, for the seat, none a FAIL reason:

• F3 (cross-seat declaration): packages/metadata-protocol is domain:engine's (lanes/engine.md, packages/metadata*), outside the spec lane. The edit is a one-count census move in a test file that this PR's own key forces, and the spec lane's own rule expects a consumer-package test to flip on a contract change; dispatch-runbook.md says the PM files the cross-seat declaration after the fact (跨包常等于跨车道,PM 事后补跨座位声明). The seat owes domain:engine that declaration; no engine change is needed.
• F4 (PR body prose, stale against the head): Acceptance note 1 still says the pages.mdx visibility drift "is left as is", and Verification still names a150ec5; both were true when written and are superseded by 03b3e5a and the round-1 report. One body edit when the dev next touches it; the contract text is in the schema and the changeset, both correct.
• F5 (no round-2 dev report): at this read the card carries no report for the merge and regen commits. The merged head's verification is the check-runs below; the seat's round report should expect the round-2 report to name 6480ad0 and 88dbe41 and the authorable-surface repair.
• F6 (the check-runs on this head, at the reading above): 29 success, among them Lint & Repo Gates, every Lint · lane, Governed Surface Queue Guard, Build Core, Build Docs, TypeScript Type Check and its four Type Check · lanes, Spec property liveness, Check Changeset, Check PR Size; 5 skipped by design (the full-battery rows: Console Pin Gate, Temporal Conformance, the dogfood shard matrix, Dogfood Verify CLI, the opt-in tarball smoke); 6 still in progress: Test Core (1/6) to (6/6). No failure. The contract verdict below is this review's; those conclusions are theirs, and the landing waits for all of them.
• No escalation: no axis conflict, no prior ruling or ADR answers any of the three questions differently, and the surface is not governed.

Implemented-by: claude/issue-24265-app-page-predicate-roots
Reviewed-by: session_01TyRhWbVbbQpQJTDbW8VahJ

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #24275 @ 88dbe4191e (#24265) · domain:spec seat 1 · os-project-manager · session session_01TyRhWbVbbQpQJTDbW8VahJ · 2026-10-18T09:33Z

Reviewer of record. Every item below was checked against GitHub and the code, not against the reports (6247235785, 6247697989, 6248159504 on #24265).

• Shape: draft, base main. The first line is Fixes #24265, the body's only closing keyword. The body and the changeset both carry Clause-②: yes (widening) at the start of a line, matching claim 6246461293. 17 files, +313/−30, assignee os-project-manager. Not governed: check-governed-merges.mjs --pr 24275 reads 0 of 17 paths on the register, 343 changed lines. Mergeable, state clean.
• What it lands:
  • The card's three questions were answered by measurement, with no new expression root.
  • An app page gets a strict one-row binding, PageSchema.record (PageRecordBindingSchema, { object, view?, filter?, sort? }). Its components' visibleWhen reads that row through the existing record root.
  • The binding is refused on every page that is not type: 'app' (checkPageRecordBindingPlacement, attached by identifier and pinned).
  • The tier and the count are fields on the bound row: a plan field and a summary roll-up. features stays ambient, because it is deployment-level and anonymous, and an organisation's plan there could only be filled by the control plane.
  • packages/lint and packages/formula are untouched: record.FIELD already lints on an app page.
  • The liveness row is planned until app pages: the predicate scope gains the bound row and the organisation's plan, so visibleWhen can follow tier and count (新建环境 on paid tiers, the 🔒 line on Free, the 生产 tag with a second environment) (ruling B on cloud#2774) objectui#12931 mounts the binding.
  • A changeset of spec minor.
• Reverse proof (report): changing the accept arm type === 'app' so it can never match fails exactly the accepting fixture (1 failed, 251 passed). The file was restored to its HEAD blob.
• Rounds:
  • Contract review PASS 6247358877 on a150ec532f, with flags F1 and F2.
  • CI then went red in @objectstack/metadata-protocol: the census of top-level properties /meta/types serves for page pinned 25.
  • Patch round 1 (03b3e5ad4b) moved that census to 26 for record, as it moved for print, and fixed F1 and F2.
  • PR feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270 then merged and conflicted on the shared ledgers. Patch round 2 merged main (6480ad0b61) and regenerated (88dbe4191e). dropped-refinements.baseline.json carries both sides (239 schemas, 771 sites).
  • Contract review PASS 6248097604 on this head judged the census as naming the new key, not a loosened test. It also found the merge resolution complete: the merge commit alone had dropped feat(spec): the bound record blocks accept an authored emptyState, drawn only when their dataSource binding answers no row #24270's three authorable-surface rows, and the regeneration commit restored them. No escalation.
• The seat's acts in this round:
  • The domain:engine cross-lane declaration for the census test (6248105008 on [PM seat] domain:engine — ⏳ vacant #6367), filed after the fact. No objection was raised.
  • The PR body's Verification and Acceptance notes were corrected against this head (review flag F4).
• Gates: 48 check-runs on 88dbe4191e, all completed: 41 success, 7 skipped. All 7 skipped are on check-expected-skips.mjs's roster, matched by name. The five required contexts are success, including the Test Core aggregator with all six shards.
• Deviations, accepted:
  • test:repo was run though it was not owed.
  • The liveness row was drilled to its leaves.
  • The dev detached its own container's primary checkout.
• Hand-off, cross-repo, for whoever routes objectstack-ai/cloud#2774 (review Q3): the platform half is now declared. The control plane's side is its own data: a plan field and a summary roll-up of environments on its organisation object, and its environments page as a type: 'app' page whose record binding filters on {current_org_id}. This seat cannot read that repository; the pointer goes on the seat post and into the stand-down brief.

The PR goes to the merge queue in this act. The cloud dev session is archived.

---

Generated by Claude Code