[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Requested by Sales · project thread

Fixes #30614

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:page.zod.ts 中 app 页面 record 绑定的 describe 与 PageRecordBindingSchema TSDoc,以及组件 visibleWhen 的 describe 与 TSDoc,改写为控制台的真实行为,并重新生成参考页。
• 为什么改:旧文案说"渲染器尚未实现、record 不绑定",而控制台早已读取它;照文案写元数据的作者和 AI 会放弃一个能用的绑定。
• 风险与回滚:仅文案,无键、形状、默认值或导出变化;回滚即 revert 本 PR。
• 先看:packages/spec/src/ui/page.zod.ts(四处文案:PageRecordBindingSchema TSDoc、record describe、组件 visibleWhen TSDoc 含其「Measured on the renderer」段、visibleWhen describe)、content/docs/ui/pages.mdx(手写指南 record 行)、packages/spec/liveness/page.json(两条说明)。
• 两分钟验证:git grep -n "Planned in the renderer\|faulting predicate renders\|configEvaluationScope" -- packages/spec/src/ui/page.zod.ts content/docs ':!content/docs/releases' 预期零命中(在 4afb995 实测退出码 1、无输出)。
• 需要你做的：无，席位落地。

What changes

• packages/spec/src/ui/page.zod.ts, the PageRecordBindingSchema TSDoc: the "Planned in the renderer" paragraph is replaced by what the console does. The binding is read once per page open (the first row under sort, under the caller's identity); every component's visibleWhen sees that row as record; a record block that binds its own row still provides that row to its own subtree; and the three states a predicate sees (pending: the body is not drawn; no row, or a read the server refuses as forbidden (403): record is null; any other failure: the body is not drawn). A page drawn through interfaceConfig.source reads no binding (round 2).
• The same file, the record key's .describe(): the same reading, in one string. The parse half is unchanged and still stated: type: 'app' only (checkPageRecordBindingPlacement), a strict one-row shape with no limit.
• The same file, the component visibleWhen TSDoc and .describe() (round 2, review escalation): "a faulting visibleWhen renders the component ... a gate that never gates" (TSDoc), "a faulting predicate renders the component, so such a gate never gates" and, for hasCapability on a host with no capability list, "a faulting predicate renders the component" (describe) now say the console withholds the component. data.total > 0 and data.total == 0 both hide it. The advice that the page's row is record is kept.
• The same file, the visibleWhen TSDoc's "Measured on the renderer" paragraph (round 3, delta review 6672431263). It named configEvaluationScope, which does not exist under ui/, and said record is added "only when the page has a row — on an app page, once the renderer mounts the page's record binding". It now names buildNodeEvaluationScope and says record is the page's row: the record a record page opens, or the row an app page's record binding reads, null when that read finds no row or is refused as forbidden.
• content/docs/references/ui/page.mdx: regenerated by gen:docs, never hand-edited.
• content/docs/ui/pages.mdx :63, the hand-written record row of the Pages guide: "Planned in the renderer: until the console mounts it, record stays unbound on an app page" is replaced by the describe's reading, in the same words, kept as one table cell (round 1). A grep of content/docs outside releases/ for "stays unbound" and "Planned in the renderer" now finds no hit.
• packages/spec/liveness/page.json, the props.regions note (round 3): the [120] PageComponent.visibleWhen read point named SchemaRenderer.tsx#configEvaluationScope with record "only when the page has a row". It now names ui/packages/react/src/SchemaRenderer.tsx#buildNodeEvaluationScope (noting the old name at objectui @1fb1ced36243) and states the same record reading as the TSDoc.
• packages/spec/liveness/page.json, the props.record note: its last sentence said this describe and TSDoc were stale. This PR makes that false, so it now says they state the same reading.
• .changeset/30614-page-record-binding-describe.md: @objectstack/spec patch, which also names the Pages guide row.

Every sentence was checked against the readers on origin/main b8929f486: ui/packages/app-shell/src/views/PageView.tsx (appPageRecordBinding, AppPageRecordGate, AppPageRecordRead with $top: 1 and $orderby from sort), ui/packages/app-shell/src/providers/ExpressionProvider.tsx#PageRecordScope, ui/packages/react/src/SchemaRenderer.tsx#buildNodeEvaluationScope, and the pin ui/packages/app-shell/src/views/__tests__/PageView.appPageRecord-12931.test.tsx.

Tests

No behaviour changes, so there is no new test and no ablation. The @objectstack/spec page suites pass, spec typecheck passes, and check:generated reports all 14 artifacts up to date.

Acceptance notes

• Two old sentences beyond "Planned in the renderer" were also false against the console, and were replaced as part of stating the three states. The TSDoc said zero rows or a refused row "leaves record unbound: a predicate reading it faults, and a faulting visibleWhen renders the component". The describe said "No row, no record: the predicate faults and the component renders". On main, AppPageRecordRead binds record as null for both cases (pinned by the 0-row and 403 cases of the pin test). Separately, SchemaRenderer.tsx#visibilityFaultOutcome now fails a declared visibleWhen closed on a fault, so "renders" is no longer the verdict. The new text does not describe the fault verdict of a field read on a null record, because no test pins it.
• packages/spec/liveness/page.json, the props.record note: its last sentence ("The schema's own describe() and TSDoc still say 'Planned in the renderer' — stale prose left for a spec change") was made false by this PR. It now reads "The schema's own describe() and TSDoc state this same reading." It ships (liveness is in the package's files), the claim's file surface was amended to hold it (6670237155), and check:liveness is green.
• content/docs/ui/pages.mdx :63 carried the same stale sentence and is fixed in round 1, under the amended claim (6670237155). The Pages guide row was already silent on the no-row verdict, so only the "Planned in the renderer" sentence was false there. It gains the three states the describe states, and no claim the describe does not make.
• Round 2 (contract review 6671102362, PASS, should-fix S1-S3 and the escalation; claim amendment 6671162776):
  • S1: "a refused read" is narrowed to "a read the server refuses as forbidden (403)". Only 403 / PERMISSION_DENIED / FORBIDDEN classify forbidden (ui/packages/react/src/utils/error-message.ts). A 401, a 400 or rejected read, and api-disabled land in the failed-read state.
  • S2: the TSDoc drops "and the failed-read state stands in its place". An unresolved view, a refused filter or no adapter draws the gate's own panel (ElementDataSourceGate.tsx). The TSDoc now agrees with the describe: any other failure draws no page body.
  • S3: an app page that also sets interfaceConfig.source is drawn as InterfaceListPage outside AppPageRecord (PageView.tsx), so it reads no binding. One clause in both texts, and no refinement.
  • Escalation: since objectui#13299, visibilityFaultOutcome (SchemaRenderer.tsx) answers a declared visibleWhen that faults with false, pinned by SchemaRenderer.nodeVisibilityFailClosed-13299.test.tsx and SchemaRenderer.visibleWhenRecordBinding.test.tsx ("WITHHOLDS the block").
  • Grep of packages/spec/src/** (non-test) and the hand-written content/docs/** for "faulting predicate renders", "faulting visibleWhen renders" and "never gates": only the page.zod.ts sites carried the false claim. The other hits (automation/schemaless-node-config.zod.ts decision condition, ui/action.zod.ts pressed, data/object.zod.ts disabledWhen fail-soft, kernel/public-auth-features.ts, two migration entries) carry no visibility fault-renders claim and are untouched.
  • Round 2b: content/docs/ui/pages.mdx :63 now matches the round-2 describe word for word on the two points, with "no row, or a read the server refuses as forbidden (403), binds record as null" and "A page drawn through interfaceConfig.source reads no binding". It is still one table cell and adds no other claim.
  • Not changed: the ui/packages/app-shell/src/providers/ExpressionProvider.tsx PageRecordScope docblock still states the fail-soft verdict (no ui/ change).
• packages/spec/src/ui/page.zod.ts keeps "re-read when the bound object is written": AppPageRecordRead keys its read on useDataInvalidation(object), so it is still true beside "once per page open".

Verification

Local gates, round 3 (head 4afb995, after merging origin/main at 606df50)

• turbo run build --concurrency=2: lock VERDICT command-exit 0, 119/119 tasks.
• gen:docs && check:generated && vitest run over the page suites && typecheck (spec): lock VERDICT command-exit 0. "All 14 generated artifacts are up to date" (no regenerated diff: the edited paragraph is TSDoc only). Test Files 10 passed (10), Tests 572 passed (572). check:test-typecheck: OK.
• eslint --no-inline-config packages/spec/src/ui/page.zod.ts: exit 0.
• dispatch-gates --commands --repo objectstack-ai/objectstack: 97 commands, all exit 0 on the first pass (check:liveness among them). --ran: "97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN".
• check-changeset-no-major --base origin/main: "This diff introduces no major bump".
• The two-minute grep in 维护者速读: exit 1, no output.

Local gates, round 2b (head 0aeb81b, after merging origin/main at 8f4aaf7)

• turbo run build --concurrency=2: lock VERDICT command-exit 0, 119/119 tasks.
• pnpm --filter @objectstack/spec check:generated: exit 0, "All 14 generated artifacts are up to date".
• dispatch-gates --commands --repo objectstack-ai/objectstack: 97 commands, all exit 0 on the first pass (check:doc-authoring, check:doc-anchors, check:doc-frontmatter, check:docs-single-h1 and check:docs-redirects among them). --ran: "97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN".
• check-changeset-no-major --base origin/main: "This diff introduces no major bump".

Local gates, round 2 (head f7299af, after merging origin/main at 4533101)

• turbo run build --concurrency=2: lock VERDICT command-exit 0, 119/119 tasks.
• gen:docs && check:generated && vitest run over the page suites && typecheck (spec): lock VERDICT command-exit 0. "All 14 generated artifacts are up to date". Test Files 10 passed (10), Tests 572 passed (572). check:test-typecheck: OK.
• eslint --no-inline-config packages/spec/src/ui/page.zod.ts: exit 0.
• dispatch-gates --commands --repo objectstack-ai/objectstack: 97 commands, all exit 0 on the first pass. --ran: "97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN".
• check-changeset-no-major --base origin/main: "This diff introduces no major bump".

Local gates, round 1 (head 03429fc, after merging origin/main)

• turbo run build --concurrency=2: lock VERDICT command-exit 0, 119/119 tasks.
• pnpm --filter @objectstack/spec check:generated: exit 0, "All 14 generated artifacts are up to date".
• dispatch-gates --commands --repo objectstack-ai/objectstack: 97 commands, all exit 0 on the first pass, check:doc-authoring, check:doc-anchors, check:doc-frontmatter and check:docs-single-h1 among them. --ran: "97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN".
• check-changeset-no-major --base origin/main: "This diff introduces no major bump".

Local gates, round 0 (head 2529918)

All read at head 2529918f4, exit codes captured before any pipe.

• pnpm --filter @objectstack/spec build: lock VERDICT command-exit 0.
• pnpm --filter @objectstack/spec gen:docs && pnpm --filter @objectstack/spec check:generated: exit 0. "All 14 generated artifacts are up to date". The first check:generated run named content/docs/references/** stale. That page is regenerated in the second commit.
• vitest run over src/ui/page*.test.ts (9 files) and src/ui/object-refinement-check-exports.test.ts: Test Files 10 passed (10), Tests 572 passed (572).
• pnpm --filter @objectstack/spec typecheck: exit 0.
• eslint --no-inline-config packages/spec/src/ui/page.zod.ts: exit 0.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 97 commands, all exit 0. Six first exited 3 (PREREQUISITE NOT MET, unbuilt workspace packages). They were re-run after turbo run build and exited 0.
• --ran reconciliation: "97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN".
• check-changeset-no-major --base origin/main: "This diff introduces no major bump".
• Local-only: check:dev-prereqs exit 0, check:skill-frame-freshness exit 0.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01L6bhgTqqeHSwZYJmApbDCa

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 2 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/liveness/page.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/frontend/data-source.mdx (via PageComponentSchema (symbol, a top-level const))
• content/docs/protocol/objectui/layout-dsl.mdx (via PageComponentSchema (symbol, a top-level const), PageSchema (symbol, a top-level const))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PageComponentSchema (symbol, a top-level const))
• content/docs/releases/v17/17-7.mdx (via PageComponentSchema (symbol, a top-level const))
• content/docs/releases/v18/18-3.mdx (via PageSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/liveness/page.json) — pages documenting those are invisible to this run
• the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 170 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ab44ec94b0362bafdf5f610b1d121655cd39a5fa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 59e105a1751507576b1f14f42eb6606f13b38f39 — the merge of head 4afb99547e411b9793d78f83a4f4e6a47c25facb into base ab44ec94b0362bafdf5f610b1d121655cd39a5fa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 59e105a1751507576b1f14f42eb6606f13b38f39 && git checkout 59e105a1751507576b1f14f42eb6606f13b38f39
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ab44ec94b0362bafdf5f610b1d121655cd39a5fa 4afb99547e411b9793d78f83a4f4e6a47c25facb && git checkout -B drift-repro ab44ec94b0362bafdf5f610b1d121655cd39a5fa && git merge --no-ff 4afb99547e411b9793d78f83a4f4e6a47c25facb

node scripts/docs-audit/affected-docs.mjs --json ab44ec94b0362bafdf5f610b1d121655cd39a5fa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ab44ec94b0362bafdf5f610b1d121655cd39a5fa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Contract-review-claim: session_01L6bhgTqqeHSwZYJmApbDCa · head 03429fc · 2026-11-05T22:12Z

Full review at CONTRACT_REVIEW_TIER (published schema face: ui/page.zod.ts; TSDoc and .describe() text only), run by an isolated at-tier subagent of this seat.

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 03429fcd863c4f31223f1c9b56b74d0791656b3f
Local-runs: none
Scope: packages/spec/src/ui/page.zod.ts + ui/packages/app-shell/src/views/PageView.tsx, ui/packages/app-shell/src/providers/ExpressionProvider.tsx, ui/packages/react/src/SchemaRenderer.tsx, ui/packages/app-shell/src/views/tests/PageView.appPageRecord-12931.test.tsx, packages/spec/liveness/page.json, ui/packages/react/src/utils/error-message.ts, ui/packages/react/src/element-data-source/ElementDataSourceGate.tsx, ui/packages/react/src/hooks/useFilterScope.ts, ui/packages/react/src/hooks/useResolvedFilter.ts, packages/formula/src/cel-engine.ts

Inputs: card #30614 (body, triage 6666559971, claim 6669354257 and its amendment 6670237155, dev reports 6670194967 and 6670864581); PR #30663's body, file list and net diff against the merge-base f4d568ba1 at the head; the head's check-runs. Head files read at 03429fcd8; the cited console code read at origin/main b77c160a0. The rest of the diff (packages/spec/liveness/page.json note, content/docs/ui/pages.mdx :63, the regenerated content/docs/references/ui/page.mdx, the changeset) is the lane seat's ACCEPT at TIER_DEFAULT; the liveness note and the pin test are read here to judge the hits file, never reviewed.

Check-runs on the head, read at 2026-11-05T22:23Z: 69 of 69 completed, 60 success, 9 skipped (opt-in harnesses, matrix placeholders, the schedule gate), 0 failed, 0 pending; the last completed at 2026-11-05T22:14Z. All ten required contexts are success: Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Lint UI, Type Check UI, Test UI, Build & E2E UI, Live E2E UI. Check Changeset and the PR-body guards ran twice (the second after the seat's body refresh at 22:13Z); both success both times. Spec property liveness: success.

① Derived judgments

• The page.zod.ts hunks (+10/-6) touch two things only: the PageRecordBindingSchema TSDoc block (:845-862 at head) and the record key's .describe() string (:2007). The schema body (:863-884: strictObject, surface, history, aliases, guidance, the four keys object / view / filter / sort), checkPageRecordBindingPlacement (:1739-1756), its superRefine attachment (:2257) and the exports PageRecordBinding / PageRecordBindingParsed (:2304, :2310) are byte-identical to the merge-base. No key, shape, default, refinement or export moves. Right.
• Accept set: unchanged. The parse half the text still states is true at head: type: 'app' only (:1742-1744 returns on app, refuses the rest at ['record']), the strict one-row shape, and limit refused through guidance.limit (:876). Right.
• Derived artifacts the text feeds: content/docs/references/ui/page.mdx is in the diff with the describe reproduced in the record row, and TypeScript Type Check (which carries check:docs, check:api-surface, check:authorable-surface) is success, so no other artifact is stale. Right.
• packages/spec/liveness/page.json: the props.record note's last sentence changes from "still say Planned in the renderer, stale prose" to "state this same reading". The note's three states and the describe's three states now agree in substance (pending: no body; no row or refused read: null; any other failure: no body). check:liveness is a pure source audit and Spec property liveness is success. Right, and inside the amended surface.
• No ui/ file in the diff, as the claim rules. Right.

② Semver level

@objectstack/spec patch, Clause-②: no, Metadata-protocol: none on both the changeset and the PR body, and they match what the diff publishes: the diff changes no key, accepted value, metadata type, requirement, meaning or default of anything an author writes, so the kind is none, and under the repo's classifier none takes patch (scripts/check-changeset-no-major.mjs :2052, "none: the level is patch, full stop"; AGENTS.md Post-Task Checklist step 3). No REST or API surface is widened or narrowed, so Clause-②: no with no arm is right. Check Changeset: success. Right.

③ Boundary flags

• liveness/page.json edited (dev flag, round 0). Answered: the amendment 6670237155 holds it in the surface; the sentence it replaced was made false by this PR's own change; the replacement is true at head (①). Accepted.
• Two more sentences replaced beyond the two the card named. The dev says both are false on main; confirmed on the tree. AppPageRecordRead (PageView.tsx :243-254) binds record as null for an empty answer and for a forbidden rejection, pinned by the 0-row case (test :292-305, record == null shown, record != null hidden) and the 403 case (:307-315, no failed-read state, scope { ...AMBIENT, record: null }). visibilityFaultOutcome (SchemaRenderer.tsx :845-855) answers a declared visibleWhen that faults with false (withheld), so "a faulting visibleWhen renders the component" is no longer the verdict. The card's own "Wanted" asked for the sentences to say what the console does; a true three-state statement cannot keep "leaves record unbound" and "the component renders" beside it. Answered: right to replace.
• No fault-verdict claim for a field read on a null record. Answered: the pin test's 0-row case asserts only record == null / record != null, never the record.plan gates, so no pin exists; on the tree the verdict would be "withheld" (the engine faults a selection on an absent receiver, packages/formula/src/cel-engine.ts :1705 "No such key"; a declared predicate that faults is withheld, SchemaRenderer.tsx :1376-1379), and asserting it needs a ui/ pin the claim forbids. The silence is right for this PR. Escalation below.
• ExpressionProvider.tsx PageRecordScope docblock stale (dev, noted not filed). Confirmed: :376-379 says a field read on the null row "faults, which a fail-soft visibleWhen renders — the same verdict the spec gives an unbound row". Both halves are stale against visibilityFaultOutcome. Escalated, with the next item.
• Out-of-scope finding, this review, same family (class a, a false published sentence) — for the seat to file as one card. The hits file itself still states the fail-soft verdict the console reversed: the visibleWhen describe at head page.zod.ts :770 says, three times, that a faulting predicate "renders the component" ("such a gate never gates"), and its TSDoc at :746-747 says the same. On main a declared predicate that faults is withheld (SchemaRenderer.tsx :845-855, :1362-1382). These sentences are outside the card's named locations and outside this PR's hunks, so they are not a finding on this diff; but with record now stated as null on no row, an author who reads :2007 and then :770 is told that record.plan != 'free' on no row renders the component, which is the verdict this PR just removed. One card should carry :746-747, :770, the ExpressionProvider.tsx :376-379 docblock, and the missing ui/ pin (the 0-row case asserting the record.plan gates). Dedupe words: "faulting predicate renders the component", "fail-soft visibleWhen", visibilityFaultOutcome, objectui#13299.
• content/docs/ui/pages.mdx :63 (dev, round 0 out-of-scope). Folded into this PR in round 1 under the amendment; the lane seat's ACCEPT. Nothing to answer here.
• Dev open_questions: empty in both rounds. The PR body is not judged; the tree is.

④ Design judgment

hits file: packages/spec/src/ui/page.zod.ts. Each sentence of the new TSDoc (:852-861) and describe (:2007), against the console on origin/main b77c160a0:

• "read once per page open." AppPageRecordRead reads in one effect keyed on [dataSource, object, readKey, filterKey, sortKey, invalidationNonce, attempt] (:232-262); the pin counts exactly one find per open with $top: 1 (test :217-228). A re-render does not re-read (the key is the query's strings, :261). A query-string change does not re-read (params only reaches context, :551). The filter scope that could re-key the read is the session's currentUserId / currentOrgId (and a recordId no app page host has), useFilterScope.ts :92-99, useResolvedFilter.ts :134-139, so a page variable write does not re-key it. True. The kept sentence "re-read when the bound object is written" (:857) is also true (useDataInvalidation(object) :226) and the re-read is in place, the row staying on screen (:243-247), so it does not contradict "pending: body not drawn", which is the first read's state. Observation, no finding: the page host stays mounted across a page-name change, so a second app page with a byte-identical binding re-uses the first page's row with no second read; no pin measures it and no sentence turns on it.
• "the first row under sort, under the caller's identity." $orderby from the landed sort (:236), firstRow takes index 0 (:110-114), the adapter is the page's own useAdapter() (:334, :508). True.
• "Every component's visibleWhen on the page sees that row as record." PageRecordScope spreads the ambient bag plus record (ExpressionProvider.tsx :399-403); buildNodeEvaluationScope spreads the ambient scope first (SchemaRenderer.tsx :704-711) and every node's memo builds from it (:1345-1347); pinned (test :263-272). True for the page body PageView draws through SchemaRenderer. See finding 3 for the branch it does not cover.
• "a record block that binds its own row still provides that row to its own subtree." boundRecord is useRecordContext()?.data (:1256-1257), written after the ambient spread only when it is a non-array object (:707-709), so a block's row wins under it and a null page row is not shadowed by an empty one. True, and the kept :706-710 sentence (a block's dataSource binds record for neither its siblings nor its own visibleWhen) stays consistent: the block's own node is evaluated in the parent's context.
• "pending, where the page body is not drawn until the read settles." current is null until a read for this key lands, and the spinner stands alone (:264-271); pinned (test :274-290). The gate's own loading panel while a named view resolves (ElementDataSourceGate.tsx :933-935) is also no body. True.
• "no row or a refused read, where record is null, so absent and not-yours read the same." 0 rows: firstRow returns null (:110-114). Refused: classifyLoadError(err) === 'forbidden' binds { status: 'loaded', row: null } (:250-255). Pinned (test :292-315). True for what the console calls refused. Finding 1 below.
• "any other failure, where the page body is not drawn" (both texts) "and the failed-read state stands in its place" (TSDoc only). A rejection that is not forbidden lands status: 'failed' and draws DataErrorState with Retry and no body (:272-306); a network error with no answer is in that set (classifyLoadError :395 falls to network; pinned, test :381-390 TypeError('Failed to fetch')). The describe's half is true for everything. Finding 2 on the TSDoc's second half.
• Parse half (kept). "Only on type: 'app' — refused on every other page type" (:1739-1756), the strict one-row shape (:863), "There is no limit" (:876). True; and appPageRecordBinding reads the binding on type: 'app' only (PageView.tsx :88-91), pinned (test :248-261).
• Sentences left in place. :706-707 "a page with no binding has no row, so record is unbound there": AppPageRecord returns the children with no gate, read or scope (:138-139), pinned (test :232-246). True, no contradiction. The :746-747 / :770 fail-soft sentences are outside the hunks and are escalated in ③; the new text makes no verdict claim, so nothing in the hunks contradicts them, and nothing in them contradicts the hunks' three states.

Findings on the hits file, none must-fix:

1. should-fix — "a refused read" is wider than what binds null. page.zod.ts :858-859 (TSDoc) and :2007 (describe). On main only a 403, PERMISSION_DENIED or FORBIDDEN answer is forbidden (ui/packages/react/src/utils/error-message.ts :387); a 401 / UNAUTHORIZED (:388), a 400 or rejected request (:394), and an object whose enable block withholds the read (api-disabled, :386) all land in the failed-read state with no body. An author reads "refused" as any refusal; name it ("a read the server forbids, 403") so a 401 is not read as null. The TSDoc's "not-yours" gloss already points there; the describe has no gloss.
2. should-fix — the TSDoc's "the failed-read state stands in its place" holds for a rejected read only. page.zod.ts :860-861. A named view that does not resolve, a refused filter, or no adapter draws the gate's own panel, not the failed-read state with Retry (ElementDataSourceGate.tsx :920-932, PageView.tsx :123-127 says so). The describe's "any other failure draws no page body" (:2007) is exactly right; say that in the TSDoc too, or name the gate panels.
3. should-fix — an app page that also carries interfaceConfig.source never reads its binding. page.zod.ts :852-853 and :2007 say the console reads it once per page open; PageView.tsx :485-496 draws InterfaceListPage outside AppPageRecord, so on that page the binding is not read and record stays unbound. No refinement ties interfaceConfig to type: 'list' (head :2098, and none of the seven checkPage* checks names it), so the spec accepts the pair. Either say "a page drawn through interfaceConfig reads no binding" or, on its own card, refuse the pair at parse. Low: the pair is not a page an author writes on purpose.

No must-fix: every new sentence is true of the tree it describes, the set an author needs is present for the page PageView draws through SchemaRenderer, the parse-half sentences stay true, and no sentence left in place contradicts the new ones.

Implemented-by: claude/issue-30614-page-record-describe
Reviewed-by: session_01L6bhgTqqeHSwZYJmApbDCa

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0aeb81b248ebff824a73a18474c408f870cef33d
Local-runs: none
Scope: packages/spec/src/ui/page.zod.ts + ui/packages/app-shell/src/views/PageView.tsx, ui/packages/react/src/SchemaRenderer.tsx, ui/packages/react/src/utils/error-message.ts, ui/packages/react/src/element-data-source/ElementDataSourceGate.tsx, ui/packages/app-shell/src/views/tests/PageView.appPageRecord-12931.test.tsx, ui/packages/react/src/tests/SchemaRenderer.nodeVisibilityFailClosed-13299.test.tsx, ui/packages/react/src/tests/SchemaRenderer.visibleWhenRecordBinding.test.tsx, ui/packages/react/src/tests/SchemaRenderer.dataRootUnbound-9308.test.tsx, ui/packages/app-shell/src/providers/tests/hasCapability-13006.render.test.tsx, packages/spec/liveness/page.json, packages/spec/src/automation/schemaless-node-config.zod.ts, packages/spec/src/ui/action.zod.ts, packages/spec/src/data/object.zod.ts, packages/spec/src/kernel/public-auth-features.ts

Delta of record 6671102362 (PASS at 03429fcd8), which stands for everything this record does not re-judge. The head moved by five commits: the origin/main merges 45331010a and 8f4aaf7ca, the round-2 text 0171a111d, the regenerated reference f7299af59, and the Pages guide row 0aeb81b24. Net against the merge-base 4bf9a2d7e: the same five files, +29/-15; page.zod.ts +14/-10. Inputs: card #30614's amendment 6671162776 and the r2 / r2b reports 6671708952 and 6672253067; the PR body as refreshed at 23:33Z, its file list and the net diff; the head's check-runs. Head files read at 0aeb81b24; the console code and pins read at origin/main 426116995.

Check-runs on the head, read at 2026-11-05T23:38Z: 69 of 69 completed, 60 success, 9 skipped (opt-in harnesses, matrix placeholders, the schedule gate), 0 failed, 0 pending; the last completed at 2026-11-05T23:34Z. All ten required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Lint UI, Type Check UI, Test UI, Build & E2E UI, Live E2E UI. Check Changeset and the PR-body guards ran twice (the second after the 23:33Z body refresh), success both times; Spec property liveness success. Nothing was pending.

① Derived judgments

• The page.zod.ts hunks are four text sites and nothing else: the component visibleWhen TSDoc (:746-748), its .describe() (:769), the PageRecordBindingSchema TSDoc (:846-861) and the record key's .describe() (:2007). Every schema body, refinement, superRefine attachment and export is byte-identical to the merge-base. No key, shape, default, refinement or export moves. Right.
• The reference page is regenerated for all three changed rows (record, and visibleWhen twice: the component and the region's component list); TypeScript Type Check (check:docs, check:api-surface, check:authorable-surface) is success. Right.
• Both merges are clean: git diff-tree --cc prints no hunk for 45331010a or 8f4aaf7ca; main changed none of the five PR files in either window; each PR file's blob is identical between each merge and its branch parent. No hand-resolved hunk in a PR file. Right.
• content/docs/ui/pages.mdx :63 (lane seat's file, read for parity only): the cell now carries the describe's two round-2 points in its words, "no row, or a read the server refuses as forbidden (403), binds record as null" and "A page drawn through interfaceConfig.source reads no binding", as one cell with no other claim. Parity holds.

② Semver level

Unchanged and still right: @objectstack/spec patch, Clause-②: no, Metadata-protocol: none on the changeset and the PR body. The round-2 hunks change the stated verdict of a faulting predicate in prose only; the key, its accepted values and the renderer's behaviour are what they were on main, so nothing an author writes changes and none takes patch (scripts/check-changeset-no-major.mjs :2052). The changeset body now also names the visibleWhen sentences and the Pages guide row. Check Changeset: success.

③ Boundary flags

• S1 (6671102362 finding 1): adopted. :858-859 and :2007 now say "a read the server refuses as forbidden (403)". classifyLoadError answers forbidden for 403 / PERMISSION_DENIED / FORBIDDEN only (error-message.ts :387) and AppPageRecordRead binds { status: 'loaded', row: null } on exactly that answer (PageView.tsx :250-255); a 401, 400 or api-disabled lands in the failed-read state. True, and the pages guide and changeset say the same.
• S2 (finding 2): adopted. The TSDoc's last clause is "any other failure, where the page body is not drawn" (:860-861), the describe's is "any other failure draws no page body" (:2007); neither names the failed-read state, so the gate's own panels (ElementDataSourceGate.tsx :920-935) are covered. True.
• S3 (finding 3): adopted as one clause in both texts, "A page drawn through interfaceConfig.source reads no binding" (:854-855, :2007). PageView.tsx :485-496 draws InterfaceListPage outside AppPageRecord. No refinement was added, as the record allowed; the spec still accepts the pair. True.
• Escalation (6671102362 ③, folded in under amendment 6671162776): every "renders the component … never gates" in the visibleWhen TSDoc and describe now says "withholds … both hide it", the hasCapability sentence included. Checked against the tree: visibilityFaultOutcome (SchemaRenderer.tsx :845-855) answers a declared SHOW predicate that faults with false; the memo returns that verdict on both the production and the dev branch (:1453-1474, :1498-1514). Pins: nodeVisibilityFailClosed-13299 (a) a faulting visibleWhen withholds its node, (b) every leg, (c) controls; visibleWhenRecordBinding :263-275 "WITHHOLDS the block" on an unbound record.*; dataRootUnbound-9308 leg 7 (:187-196), a data.* visibility gate with no api binding is withheld, which is the "data.total > 0 and data.total == 0 both hide it" sentence; hasCapability-13006.render :142-159, a missing or absent capability list faults and the node is withheld, which is the hasCapability sentence. data is absent from the memo's scope unless an api binding answered (:1299-1300, :1309), so the read faults rather than resolving undefined. All true.
• The dev's untouched grep sites, each read at head: schemaless-node-config.zod.ts :208-209 is an inert config.condition on a decision node, "never gates anything" because nothing reads it, not a fault verdict; action.zod.ts :1747 is pressed, display-only, "never gates, greys or routes the action"; object.zod.ts :1419-1424 and :1486 / :1489 are the row CRUD override's visibleWhen (already "Fail-closed") and disabledWhen ("Fail-soft"), an enablement verdict on a different key and surface, and SchemaRenderer.tsx :1380-1382 keeps form rules fail-open by design; public-auth-features.ts :426-428 and :490-492 say what a blank composed gate does "where the consuming surface is fail-soft" and "where it is fail-closed", naming neither for the page component; the two migrations/entries/semantic/18.* sentences are historical. None is the "faulting visibleWhen renders the component" sentence. Confirmed.
• PR body quotes against the tree. The round-2 quotes are verbatim in the tree: "a read the server refuses as forbidden (403)", "A page drawn through interfaceConfig.source reads no binding", "data.total > 0 and data.total == 0 both hide it", the hasCapability "withholds", and "The row the page is about is record" kept at :748. One body claim does not hold at the head: finding 2 below.
• Still open for the seat's card (from 6671102362 ③, narrowed by this PR): the ui/packages/app-shell/src/providers/ExpressionProvider.tsx PageRecordScope docblock :376-379 still states the fail-soft verdict, and no ui/ pin asserts the record.plan gates on 0 rows. Both are ui/ and outside the claim; the r2 and r2b reports carry them as noted-not-filed. The page.zod.ts half of that card is now done in this PR.
• Dev open_questions: empty in r2 and r2b. The r2 deviation (pages.mdx lagging the describe) is closed by r2b (①).

④ Design judgment

hits file: packages/spec/src/ui/page.zod.ts. The round-0/1 sentences re-read at the new head stand as 6671102362 ④ judged them. The round-2 sentences, each against the tree, are in ③ above: all true. Then the two widened texts as wholes, for anything now inconsistent:

• visibleWhen describe (:769): "component rendered only when TRUE" agrees with "withholds"; "(none without one; a block's own dataSource binds no record for its siblings)" agrees with :2007 and with the buildNodeEvaluationScope precedence (:704-711); the api binding paragraph ("decided once the read answers") agrees with the memo's early return while a binding is in flight (:1352-1356). Consistent.
• visibleWhen TSDoc: :740-748 and :750-759 consistent with the describe. One untouched paragraph is not: finding 1.
• PageRecordBindingSchema TSDoc and record describe: the three states, the interfaceConfig.source clause and the parse half read the same in both and in the pages guide. Consistent.

Findings, none must-fix:

1. should-fix (low) — page.zod.ts :730-736, the untouched "Measured on the renderer" paragraph of the visibleWhen TSDoc. It says "configEvaluationScope composes this surface's evaluator … adding record (only when the page has a row — on an app page, once the renderer mounts the page's record binding) and page". No symbol named configEvaluationScope exists under ui/ on origin/main 426116995; the one builder is buildNodeEvaluationScope (SchemaRenderer.tsx :699). "Once the renderer mounts" is the pending tense the rest of the text no longer uses, and "only when the page has a row" now sits beside :2007's "no row … binds record as null": the builder writes its own record only for a row (:707-709), but on a bound app page with no row the ambient bag already carries record: null (ExpressionProvider.tsx :402). Name the builder and state the mounted binding; one sentence.
2. should-fix — PR body, not the tree (lane seat's). The 维护者速读 two-minute check, git grep -n "Planned in the renderer\|never gates" -- packages/spec/src/ui/page.zod.ts content/docs ':!content/docs/releases', is said to return zero hits; at 0aeb81b24 it returns three, the regenerated pressed rows in content/docs/references/data/object.mdx :510, references/kernel/metadata-plugin.mdx :354 and references/ui/action.mdx :62 ("Display only — it never gates, greys or routes the action", the sense the dev rightly left alone). A maintainer who runs it gets a false alarm. Drop "never gates" from the pattern or exclude references/. The same block's "先看 … 两处文案" now under-counts the four text sites. Body prose only.

No must-fix: every round-2 sentence is true of the tree it describes and pinned there, the three should-fixes of 6671102362 are adopted as written, the parse-half sentences stay true, both merges are clean, and the Pages guide row matches the describe.

Implemented-by: claude/issue-30614-page-record-describe
Reviewed-by: session_01L6bhgTqqeHSwZYJmApbDCa

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4afb99547e411b9793d78f83a4f4e6a47c25facb
Local-runs: none
Scope: packages/spec/src/ui/page.zod.ts + ui/packages/react/src/SchemaRenderer.tsx, ui/packages/app-shell/src/providers/ExpressionProvider.tsx, ui/packages/app-shell/src/views/PageView.tsx, ui/packages/app-shell/src/views/tests/PageView.appPageRecord-12931.test.tsx, packages/spec/liveness/page.json, packages/spec/scripts/liveness/check-liveness.mts, packages/spec/scripts/liveness/evidence.mts

Delta of records 6671102362 (PASS at 03429fcd8) and 6672431263 (PASS at 0aeb81b24), which stand for everything this record does not re-judge. The head moved by two commits: the origin/main merge 606df50ea and the round-3 text 4afb99547. Net against the merge-base ab44ec94b: the same five files, +35/-20; round 3 itself is page.zod.ts +5/-4 (one paragraph) and liveness/page.json +1/-1 (one note). Inputs: the r3 report 6672940944 on card #30614; the PR body as refreshed at 00:11Z, its file list and the net diff; the head's check-runs. Head files read at 4afb99547; the console code read at origin/main 447226b22.

Check-runs on the head, read at 2026-11-06T00:17Z after a first poll at 00:13Z found one still in progress: 69 of 69 completed, 60 success, 9 skipped (opt-in harnesses, matrix placeholders, the schedule gate), 0 failed, 0 pending; the last completed at 2026-11-06T00:14Z. All ten required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Lint UI, Type Check UI, Test UI, Build & E2E UI, Live E2E UI. Check Changeset ran twice (the second after the 00:11Z body refresh, the one the first poll caught in progress), success both times; Spec property liveness success. Nothing was left pending.

① Derived judgments

• The round-3 page.zod.ts hunk is the "Measured on the renderer" paragraph of the component visibleWhen TSDoc (:730-737) and nothing else: no describe string, schema body, refinement or export moves, and gen:docs had nothing to regenerate (the reference page is unchanged since 0aeb81b24). Right.
• The merge 606df50ea is clean: git diff-tree --cc prints no hunk; main changed none of the five PR files between the merge-base and its second parent; every PR file's blob is identical between the merge and its branch parent 0aeb81b24. No hand-resolved hunk in a PR file. Right.
• The r3 liveness change is the props.regions note's [120] PageComponent.visibleWhen read point. check:liveness scans evidence and producer (check-liveness.mts :905-921) and never reads note, so the note's spelling is prose the gate neither resolves nor refuses; it is green on that count alone. The spelling the dev chose, ui/packages/react/src/SchemaRenderer.tsx#buildNodeEvaluationScope, is the in-repo symbol-anchor form evidence.mts resolves for a pointer (check-liveness.mts :82-83 retires the objectui: realm in favour of it; :102-104 symbol anchors), and the same form the row's own props.record evidence already uses; the parenthetical "(named configEvaluationScope at objectui @1fb1ced36243)" follows the note's stated convention for points last read in the objectui tree (the sha is cited five more times in that note; it is not an object in this clone, as the convention says). Valid form, and true: the symbol is at SchemaRenderer.tsx :699. Right.

② Semver level

Unchanged and still right: @objectstack/spec patch, Clause-②: no, Metadata-protocol: none on the changeset (unchanged in r3) and the PR body. A TSDoc paragraph and a ledger note change nothing an author writes, so none takes patch (scripts/check-changeset-no-major.mjs :2052).

③ Boundary flags

• 6672431263 finding 1 (the "Measured on the renderer" paragraph): adopted. The paragraph now names buildNodeEvaluationScope, drops "once the renderer mounts" and "only when the page has a row", and says record is "the page's row: the record a record page opens, or the row an app page's record binding reads, null when that read finds no row or is refused as forbidden". Judged in ④.
• The dev's deliberate choice to keep "unbound" for a page with no binding, rather than "null": right on the tree. AppPageRecord returns the children with no gate, read or scope when the page declares no binding (PageView.tsx :139), so no PageRecordScope is mounted and the ambient bag has no record key; pinned by the control (test :232-246, 'record' in scope is false). null is published only by a mounted scope (PageView.tsx :307, ExpressionProvider.tsx :402), which needs a binding. The r3 sentence conditions null on "that read", the binding's read, so it makes no claim about a page with none; :706-707 ("a page with no binding has no row, so record is unbound there") and the describe's "(none without one …)" (:769) stay true and consistent with it, and with :2007, which speaks only of a page with a binding. Consistent.
• 6672431263 finding 2 (PR body): adopted. The two-minute grep is now Planned in the renderer\|faulting predicate renders\|configEvaluationScope over page.zod.ts and content/docs with releases/ excluded; run against the head tree it returns no hit (exit 1). configEvaluationScope survives only inside liveness/page.json as the tagged historical name, outside the grep's paths, as the body says. The 先看 line names the four page.zod.ts text sites (the PageRecordBindingSchema TSDoc, the record describe, the visibleWhen TSDoc with its "Measured on the renderer" paragraph, the visibleWhen describe), the Pages guide row and the two liveness notes. Both body claims hold at the head.
• PR body quotes against the tree: the round-3 quotes of the new paragraph and of the regions note are verbatim in the tree.
• Dev open_questions: empty. The r3 deviation (narrowing the coordinator's "null when there is none" to the binding's read) is the choice judged right above. Still open for the seat's card, unchanged: the ExpressionProvider.tsx PageRecordScope docblock :376-379 and the missing ui/ pin for the record.plan gates on 0 rows.

④ Design judgment

hits file: packages/spec/src/ui/page.zod.ts. The round-3 paragraph (:730-737), sentence by sentence against origin/main 447226b22:

• "buildExpressionScope builds the ambient scope — current_user, user, ctx.user, os.user, features, and nothing else": unchanged, ExpressionProvider.tsx :200. True.
• "buildNodeEvaluationScope composes this surface's evaluator from it": the memo builds its evaluator from buildNodeEvaluationScope(predicateScope, boundRecord, pageVariables) (SchemaRenderer.tsx :1345-1347), whose first root is the ambient spread (:704-705). True; the symbol exists (:699).
• "adding record (the page's row: the record a record page opens, or the row an app page's record binding reads, null when that read finds no row or is refused as forbidden) and page": the composed scope carries exactly that record. On a record page the row arrives as boundRecord from RecordContextProvider and is written after the ambient spread (:707-709); on a bound app page the row, or null, arrives in the ambient bag from PageRecordScope (ExpressionProvider.tsx :402) fed by AppPageRecordRead (PageView.tsx :243-255, :307), and the builder's conditional write leaves null in place rather than shadowing it (:707-709, pinned: test :292-315). page is :710. True of the composed scope. Observation, no finding: the builder itself writes record only for a bound row and never writes null; the null reaches the evaluator through the spread of the ambient bag. The paragraph describes the scope the evaluator gets, which is what an author needs, and the mechanism is the renderer's own.
• "The one root added beside those is the api data source's data, below": predicateScope carries data only once an api binding answered (:1299-1300). True.
• Against the rest of the two texts: the new paragraph agrees with :2007 (three states, null on no row or a forbidden refusal), with :746-748 (a faulting visibleWhen withholds), with :706-710 (unbound with no binding; a block's row binds for its own subtree only) and with the describe's "(none without one …)". Nothing left in place contradicts it.

Findings: none. No must-fix and no should-fix: the round-3 paragraph is true of the tree, names a symbol that exists, uses the tense the rest of the text uses, leaves "unbound" exactly where the tree binds nothing, and both body claims hold at the head.

Implemented-by: claude/issue-30614-page-record-describe
Reviewed-by: session_01L6bhgTqqeHSwZYJmApbDCa

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

维护者速读

• 改了什么:page.zod.ts 中 app 页面 record 绑定的 describe 与 PageRecordBindingSchema TSDoc,以及组件 visibleWhen 的 describe 与 TSDoc,改写为控制台的真实行为,并重新生成参考页。
• 为什么改:旧文案说"渲染器尚未实现、record 不绑定",而控制台早已读取它;照文案写元数据的作者和 AI 会放弃一个能用的绑定。
• 风险与回滚:仅文案,无键、形状、默认值或导出变化;回滚即 revert 本 PR。
• 先看:packages/spec/src/ui/page.zod.ts(四处文案:PageRecordBindingSchema TSDoc、record describe、组件 visibleWhen TSDoc 含其「Measured on the renderer」段、visibleWhen describe)、content/docs/ui/pages.mdx(手写指南 record 行)、packages/spec/liveness/page.json(两条说明)。
• 两分钟验证:git grep -n "Planned in the renderer\|faulting predicate renders\|configEvaluationScope" -- packages/spec/src/ui/page.zod.ts content/docs ':!content/docs/releases' 预期零命中(在 4afb995 实测退出码 1、无输出)。
• 需要你做的：无，席位落地。

席位意见：契约复审三轮都 PASS。第一轮提了三处措辞：被拒的读只算 403；其他失败不画页面主体；走 interfaceConfig.source 的页面不读绑定。它还指出同一文件里 visibleWhen 的旧说法"出错的条件会显示组件"自 objectui#13299 起已经反了，实际是隐藏。席位把这几处都并进了本 PR。第二轮又找出一句引用了不存在的 configEvaluationScope 的渲染器说明，第三轮改掉，复审无遗留。ui 侧 ExpressionProvider.tsx 的一段注释和一个 0 行用例钉子不另立卡（理由见下）。

席位核对 — ACCEPT · domain:spec#3 · head 4afb99547e411b9793d78f83a4f4e6a47c25facb

• Shape: 5 files (+35 −20), draft, base main, first card reference Fixes #30614. Five rounds: r0, r1, r2, r2b and r3, with three merges of origin/main, none rebased.

  • Hand-written, all in packages/spec/src/ui/page.zod.ts:
    • the PageRecordBindingSchema TSDoc;
    • the record .describe();
    • the component visibleWhen TSDoc, including its "Measured on the renderer" paragraph;
    • the visibleWhen .describe().
  • Also hand-written: the record row of content/docs/ui/pages.mdx, the props.record and props.regions notes in packages/spec/liveness/page.json, and the changeset.
  • Regenerated: content/docs/references/ui/page.mdx.
  • No key, shape, default, refinement, export or ui/ change.

• Premise measured: at origin/main b8929f48, page.zod.ts :856 and :2003 still said "Planned in the renderer: until the console mounts this binding, record …". PR fix(spec): the page liveness ledger grades the app page record binding live, citing its console readers #30611 had already regraded every props.record.* liveness row to live, from the console readers (PageView.tsx AppPageRecordRead, ExpressionProvider.tsx PageRecordScope, SchemaRenderer.tsx buildNodeEvaluationScope). The review then found that the visibleWhen texts' "a faulting predicate renders the component" had been reversed by objectui#13299 (visibilityFaultOutcome fails a declared show predicate closed). That is pinned at SchemaRenderer.nodeVisibilityFailClosed-13299.test.tsx and visibleWhenRecordBinding.test.tsx :263.

• Gates:

  • CI on this head: 69 runs over 65 names; newest per name 56 success, 9 skipped, 0 red. check-expected-skips was not run because no checkout here has node_modules (it imports yaml). I compared the 9 skipped names instead: each is in the skip sets that check-expected-skips passed today on PRs fix(lint)!: the remaining field-name indexes judge an object as served, so a read or write of a field an objectExtensions entry adds is not refused (#30471) #30533 and fix(spec,core): resolve locales through the platform table's read aliases, so a zh-TW / zh-HK reader gets zh-Hant #30601. Spec property liveness is green.
  • Dev round 3 (report 6672940944, on 4afb99547):
    • 97 derived gate families, 97 run, 0 NOT-MEASURED, after a full build (119/119);
    • page suites: 10 files, 572 tests passed;
    • typecheck and check:test-typecheck OK;
    • check:generated up to date, with no regenerated diff;
    • eslint --no-inline-config exit 0; check:liveness 0;
    • check-changeset-no-major: no major bump.
      The body's two-minute grep exits 1 with no output at this head.
  • Merge: git merge-tree against main 447226b22 merges clean.
  • No ablation, because no behaviour changed. No dogfood battery: no ! and no (narrowing) arm.

• Contract review:

  • 6671102362 on 03429fcd8: PASS, Served-tier: CONTRACT_REVIEW_TIER, no must-fix, three should-fix and one escalation:
    • S1: a refused read is 403 only;
    • S2: the TSDoc's "failed-read state" holds for a rejected read only;
    • S3: an app page drawn through interfaceConfig.source never reads its binding;
    • escalation: the visibleWhen fault sentences.
      The seat adopted all of them, and claim amendment 6671162776 folded the escalation in.
  • Delta 6672431263 on 0aeb81b24: PASS. All four were landed true. It raised two more should-fix: the "Measured on the renderer" sentence named a non-existent configEvaluationScope in the pending tense, and the body's grep claim was false. Both were adopted in r3.
  • Delta 2 6673057879 on 4afb99547: PASS, no findings. It found:
    • the renderer sentence is true of the composed scope, and "unbound" is kept for a page with no binding (AppPageRecord mounts no scope, pinned);
    • the liveness read point uses the symbol-anchor form evidence.mts resolves;
    • merge 606df50ea is clean;
    • the body grep and 先看 line are true.

• Declarations: Clause-②: no, Metadata-protocol: none, @objectstack/spec patch, the same in the body and in the changeset. The text now states what the console already does, and no accept set or authored key's meaning moves. TSDoc and .describe() in src/**/*.zod.ts ship in the published declarations, so the patch is owed.

• Accepted deviations:

  • The file surface was widened twice by claim amendment: 6670237155 (liveness/page.json, content/docs/ui/pages.mdx) and 6671162776 (the visibleWhen fault sentences). Each was the same false-sentence family in the same reading, folded in rather than filed as one-sentence cards.
  • r0 also replaced "no row leaves record unbound / the component renders", which is false on main (AppPageRecordRead binds null).
  • The new text makes no claim about the fault verdict of a field read on a null record, because no ui pin asserts it.
  • In r3 the dev narrowed the suggested "null when there is none" to the app-page binding, because a page with no binding leaves record unbound. Delta 2 confirmed that.
  • The dev's grep sites outside page.zod.ts (schemaless-node-config.zod.ts :209, action.zod.ts :1747, object.zod.ts disabledWhen, public-auth-features.ts, the historical migration entries) were left as they are. They use other senses, and delta 2 confirmed it.
  • mcp_calls: 0 in every round.

• Carried: nothing filed. Two items were dropped:

  • The ExpressionProvider.tsx PageRecordScope docblock (≈:376-379) still states the fail-soft verdict. It is an unpublished ui/ comment, and the spec and the code it describes both say "withheld".
  • No ui/ pin asserts the record.plan gates on 0 rows. The two halves are pinned separately: null on no row (PageView.appPageRecord-12931 :292-315) and a faulting declared predicate is withheld (nodeVisibilityFailClosed-13299).

  Neither leaves a published sentence false, and neither has a measured user cost. The ui lane picks them up the next time it touches PageRecordScope.

• Landing: not governed (check-governed-merges --pr 30663: 0 of 5 paths, 55 lines ≤ 3000). The hand-off is pr_ready plus automerge_enable, through the merge queue.

---

Generated by Claude Code