wip(sdui-manifest): retire the parity ratchet and the browser dump; console ships the tracked manifest

The node generator's output over objectui's built tree at the pin and the
browser dump over the same tree are cmp-identical, so the dump retires:
build-console.sh copies the tracked sdui.manifest.json into the console dist.
The declaration-parity gate, its test, baseline and helper are deleted, with
the lint and cut-rc steps. The manifest is regenerated at the pin and the
JSX witness ledger drops its three rows that went stale with it.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013RDBh5DqXd2xnLwvHLgLFr

Author: claude

.claude/hooks/guard-process-kill.selftest.sh

@@ -124,8 +124,8 @@ echo "== the teardown AGENTS.md itself prescribes: the port is one YOU picked ==
 expect allow 'kill $(lsof -ti tcp:38421)'
 expect allow 'kill $(lsof -ti tcp:3000) 2>/dev/null'
 
-echo "== pgrep -P / -s select by a handle the caller owns — live in two tracked scripts =="
-# scripts/publish-smoke.sh kill_tree() and scripts/gen-sdui-manifest.sh sdui_live_pids().
+echo "== pgrep -P / -s select by a handle the caller owns — legitimate teardown shapes =="
+# scripts/publish-smoke.sh kill_tree() uses -P; -s was the retired gen-sdui-manifest.sh's.
 # A rule that reddened these would be routed around within the hour.
 expect allow 'for child in $(pgrep -P "$pid"); do kill "$child"; done'
 expect allow 'pgrep -s "$leader" | xargs kill'

.claude/hooks/guard-process-kill.sh

@@ -53,8 +53,8 @@
 #                                                                you picked, not a name
 #   pgrep -P "$pid" / pgrep -s "$leader" — even piped into a kill: the selector is a parent
 #                                          or session handle the caller owns, and both are
-#                                          live in scripts/publish-smoke.sh and
-#                                          scripts/gen-sdui-manifest.sh
+#                                          legitimate teardown shapes (scripts/publish-smoke.sh
+#                                          uses the first)
 #   pkill -P "$pid" / pkill -s "$sid"    — the same selectors on pkill, with NO pattern
 #                                          operand. Add a pattern and it is blocked again.
 #   pgrep -f foo / ps aux | grep node    — a READ. Nothing dies; look all you like. But a
@@ -243,7 +243,7 @@ check_killall() {
 # --- does this segment select processes by NAME? (pgrep with a bare pattern operand) -----
 # Returns 0 = yes, this is a name-pattern selector. `pgrep -s "$leader"` and
 # `pgrep -P "$pid"` consume their argument and leave no operand behind, so they answer 1 —
-# which is what keeps scripts/publish-smoke.sh and scripts/gen-sdui-manifest.sh legal.
+# which is what keeps scripts/publish-smoke.sh's `pgrep -P` teardown legal.
 is_name_selector() {
   [ "$HEAD" = "pgrep" ] || return 1
   local n=${#W[@]} i=$((HEAD_I + 1))

.github/workflows/cut-rc.yml

@@ -405,42 +405,11 @@ jobs:
       - name: Verify the Console dist stamp matches the pin
         run: pnpm check:console-sha
 
-      # ────────────────────────────────────────────────────────────────────────
-      # ADR-0082 D4 declaration-parity ratchet — the mandatory SECOND HALF of
-      # every pin move (#5960), run here against the pin as COMMITTED.
-      #
-      # ⚠️ Since #10134 this lane no longer moves the pin, so this is no longer
-      # "the second half of a move this run performed" — the move, and the
-      # ratchet that belongs to it, happen on the manual bump PR. Kept anyway,
-      # and deliberately: the ratchet is an on-demand gate by decision (ADR-0082
-      # addendum), which means "unrun" is its live failure mode, and a bump PR
-      # that skipped it leaves a divergence that reaches a release unnoticed.
-      # This is the last place before publish that can still say so. It writes to
-      # a gitignored path and asserts against the committed baseline, so it adds
-      # no file to the version commit; on a pin that already ratcheted it simply
-      # passes.
-      #
-      # Installing a Playwright browser is fine HERE. The #5960 ruling that keeps
-      # the ratchet off CI is about not putting an objectui build plus a browser
-      # download on every matching PR; this workflow runs a handful of times a
-      # month, on purpose, and has already built the console two steps above.
-      # ────────────────────────────────────────────────────────────────────────
-      - name: Install a Playwright browser for the manifest dump
-        run: |
-          # The dump runs INSIDE objectui's build tree (gen-sdui-manifest.sh does
-          # `pushd $BUILD_ROOT` and drives objectui's own playwright), so the
-          # browser must be installed against THAT workspace. `pnpm exec
-          # playwright` from the framework root resolves nothing — playwright is
-          # not a framework dependency.
-          BUILD_ROOT=".cache/objectui-${OBJECTUI_SHA:0:12}"
-          if [ ! -d "$BUILD_ROOT" ]; then
-            echo "::error::expected objectui build tree at ${BUILD_ROOT} (created by 'pnpm objectui:build'). Cannot install the browser the ratchet needs."
-            exit 1
-          fi
-          pnpm --dir "$BUILD_ROOT" exec playwright install chromium-headless-shell
-
-      - name: 'Declaration-parity ratchet at the committed pin (ADR-0082 D4)'
-        run: pnpm sdui:manifest
+      # No SDUI manifest step follows. The console dist built above already
+      # carries the TRACKED repo-root sdui.manifest.json (build-console.sh copies
+      # it), whose freshness against the pin the required lint job holds on every
+      # PR; the ADR-0082 D4 declaration-parity ratchet that used to run here, and
+      # the Playwright browser it needed, are retired.
 
       # ────────────────────────────────────────────────────────────────────────
       # PRE-VERSION GATES. Every one of these reads `.changeset/*`, so all of them

AGENTS.md

@@ -155,11 +155,11 @@ pull its build into `packages/console/`.
 Other scripts: `objectui:bump` (pull only), `objectui:build`, `objectui:clean`. ⛔ Never hand-edit
 `packages/console/dist/` or `.cache/objectui-*/` — regenerated.
 
-**Moving the pin has a second half: regenerate the committed manifest** — `node scripts/gen-sdui-manifest-node.mjs
---objectui-version {the @object-ui version the new pin ships}`; `scripts/check-sdui-manifest.mjs` reds until you do.
-ADR-0082 D4's spec↔registry declaration-parity ratchet reads that tracked artefact, so it gates **every PR**, not a
-pin bump alone. `pnpm sdui:manifest` is the separate browser dump of objectui's own registry (needs Playwright
-chromium); `objectui:bump` and `objectui:refresh` print it. Full procedure: `docs/releases-maintenance.md`.
+**Moving the pin has a second half: regenerate the committed manifest** — `pnpm objectui:build`, then
+`node scripts/gen-sdui-manifest-node.mjs`, which reads objectui's BUILT tree at the pin (never an npm install, whose
+version string names an older commit) and takes no arguments; `scripts/check-sdui-manifest.mjs` reds until you do.
+`objectui:bump` and `objectui:refresh` print the step, and the console build ships that same tracked file in
+`packages/console/dist/`. Full procedure: `docs/releases-maintenance.md`.
 
 **Fast iteration on `../objectui` src (no commit/refresh loop):** run objectui's own console dev server —
 `cd ../objectui && pnpm --filter @object-ui/console dev` (Vite on **:5180**, HMR). Its `/api` proxy targets
@@ -755,18 +755,6 @@ Principles the wrapper encodes (its own output is the authority on detail):
   a name, with accepted cases in the shrink-only, hand-edited
   `dual-source-exports.baseline.json`.
 
-**`check:react-declaration-parity` compares two DECLARATIONS, not a declaration against an
-implementation** — the props the spec zod schema declares vs the inputs the objectui
-registry config declares. Its `spec-only` / `registry-only` / `missing` signals are real;
-just don't read it as proof anything renders. Its right-hand side is the **tracked
-repo-root `sdui.manifest.json`** and its record `scripts/sdui-manifest.record.json`, which
-the required lint job's `scripts/check-sdui-manifest.mjs` checks OFFLINE only — existence,
-shape, sha256 vs the record, record pin vs `.objectui-sha`; its version-vs-pin leg runs
-only where an objectui checkout is in hand, so lint prints `NOT CHECKED` by design.
-`lint.yml` runs THIS gate `--strict` against it on every PR; it still **exits 1** with no
-usable manifest and `check:generated` files it `EXTERNAL_INPUT_REQUIRED` because that
-aggregate hands it none. ⛔ Do not "fix" a red by re-adding a skip.
-
 Two generators have **no** gate at all — `gen:openapi` and `gen:sbom`. Nothing verifies
 their output is current; the wrapper reports that each run rather than staying silent.
 
@@ -1100,7 +1088,7 @@ Both non-handshake shapes, and how to classify and probe your own:
    so a removal or rename the pinned sibling still imports turns `main` red for every PR in the repo the moment it
    merges — "retire the surface" and "leave the sibling untouched" cannot both hold. A ruling that authorizes such a
    removal therefore implicitly authorizes the objectui-side fix and the pin bump as part of the same landing (the
-   bump's `sdui:manifest` second half included — see the Frontend section). Pre-merge check for any removal or rename
+   bump's manifest-regeneration second half included — see the Frontend section). Pre-merge check for any removal or rename
    of an exported surface: does the pinned sibling import what you are removing? `git grep` it in `../objectui` at the
    pinned SHA before merging.
 5. **Touched `packages/spec`? Regenerate and commit its artifacts before pushing** — § *Touched `packages/spec`*

docs/audits/2026-06-react-blocks-conformance.md

@@ -20,6 +20,11 @@
 > "frontend-only" as "the registry declared an input the spec did not", not as
 > "the component accepts it". Evidence about the render path comes from
 > objectui's `public-block-binding-reach.test.tsx`; see the ADR-0082 addendum.
+>
+> **Retired (2026-09-18, maintainer ruling on #17735).** `check:react-declaration-parity`,
+> its script, test and baseline, and the `pnpm sdui:manifest` browser dump no longer
+> exist; the commands below are a record of how this audit ran, not something to
+> run. The status line on ADR-0082 decision 4 carries the ruling.
 
 **Question** (raised in review): we can't guarantee the frontend (objectui)
 components actually implement the props the backend spec protocol declares —