spec(ui): record:details, record:highlights and record:related_list refuse requiredPermissions / enforceFieldSecurity / redactFields by name while objectui's renderers read and honour all three — requiredPermissions is declared on the sibling record:quick_actions and nowhere else (spec half of objectui#8649)

Unblocked 2026-09-23T15:11Z: objectstack-ai/objectui#10058 is closed and its fix is installable at .objectui-sha 62597c588072 (pin bump #19503). The earlier Blocked-by: line is retired; see the unblock comment.

Filed by the domain:spec @ objectui execution seat (session_01L5xpA5q533BgTTNADibEFt), 2026-09-14T08:03Z.

⛔ Filed unassigned. ⛔ No domain:*, priority or type applied — routing and grading are this repo's triage's. ⛔ Not a claim. ⛔ Not a ruling: the exit per key is this repo's to decide.

Same family and same shape as objectstack#17987 (spec half of objectui#8652), filed by this seat yesterday — a different element face, the same split verdict.

The split verdict

@object-ui/plugin-detail reads and honours three keys on the record:details, record:highlights and record:related_list blocks. @objectstack/spec declares none of the three on those blocks' props schemas, and all three schemas are strictObject.

⇒ an author who writes any of them is refused at parse, while the renderer honours the same document on the raw-node path. Neither half is wrong on its own; together they are a contract that cannot be satisfied by writing it down.

Measured — installed `@objectstack/spec@17.4.0`, both controls fired

These readings were produced by an independent contract reviewer re-deriving them from primary sources for objectui PR objectui#9469, not by the implementer, and not by this seat. Two instruments, each self-tested on known inputs before being pointed at the tree — A a parse probe (safeParse({[key]: 'x'}), read unrecognized_keys), B shape enumeration through zod's public .shape — agreeing on every key:

SELFTEST ok   A strict refuses nonsense          SELFTEST ok   B shapeKeys strict -> ["alpha","beta"]
SELFTEST ok   A strict accepts declared alpha    SELFTEST ok   B shapeKeys on non-schema -> null
SELFTEST ok   A loose does NOT refuse nonsense
--- instrument self-test passed ---

ComponentPropsMap entries: 45

requiredPermissions    A = ["record:quick_actions"]   B = ["record:quick_actions"]   agree=true
enforceFieldSecurity   A = []                         B = []                         agree=true
redactFields           A = []                         B = []                         agree=true
aria                   21 blocks   <- POSITIVE CONTROL     fields   7 blocks   <- POSITIVE CONTROL

record:details        ["columns","layout","sections","fields","hideFields","inlineEdit","showHeader","aria"]
record:highlights     ["fields","layout","aria"]
record:related_list   ["objectName","relationshipField","relationshipValueField","columns","sort",
                       "limit","filter","title","showViewAll","actions","add","aria"]
record:quick_actions  ["actionNames","requiredPermissions","location","align","inline","variant","size"]

node shape keys:      ["type","id","label","properties","events","style","className",
                       "responsiveStyles","visibleWhen","visibility","dataSource","responsive","aria"]

Cross-checked against the shipped source, over a corpus wider than any single file:

requiredPermissions occurs exactly once in src/ui/component.zod.ts — line 1654, inside RecordQuickActionsProps (1613–1661).
enforceFieldSecurity occurs zero times in the whole of spec/src/**.
redactFields appears only on non-UI schemas.

And the refusals, by name, on the record:related_list face with its base document legal on its own:

CONTROL+  +columns:["name"]        success=true                      (a key known to be accepted)
CONTROL-  +zzqx_no_such_key        success=false  unrecognized_keys ["zzqx_no_such_key"]
          +requiredPermissions     success=false  unrecognized_keys ["requiredPermissions"]
          +enforceFieldSecurity    success=false  unrecognized_keys ["enforceFieldSecurity"]
          +redactFields            success=false  unrecognized_keys ["redactFields"]
          baseline (no extra key)  success=true

⭐ The distinction that matters, and that a cheaper instrument gets backwards: requiredPermissions is declared by this contract — on the sibling block record:quick_actions, and on nothing else. A word-frequency or whole-file screen reads "present" and concludes the key is fine. Only a per-block census separates "declared somewhere in this file" from "declared on the block the renderer reads it off". It is also refused by the node envelope, so there is no node-level escape hatch either.

Why this is being filed now rather than left in a PR

objectui#9469 gives three of the twelve reads on those renderers a terminal exit and routes these three keys here rather than guessing. It carries Part of, not Fixes, precisely so objectui#8649 stays open — but until this card exists, nine of those twelve reads have no tracked carrier in either repo. That gap is what this card closes.

⛔ The objectui side is not waiting on this card to land its own half, and is not asking this repo to hurry. objectui#8649 will be moved to pm:blocked with a Blocked-by: line pointing here once its PR lands.

What has to be decided — per key, not as a batch

For each of requiredPermissions, enforceFieldSecurity, redactFields, on each of record:details / record:highlights / record:related_list:

Declare it on the props schema — the contract grows to admit what a renderer already honours; objectui then mirrors it. (This is what objectui#8652 was ruled, option B, filed as objectstack#17987.)
Rule it host-composition surface — the contract stays as it is, and @object-ui retires the reads with the behaviour change made deliberately and declared.

⛔ objectui cannot take either exit unilaterally. Declaring in packages/types alone would make that repo accept what this repo's save gate rejects; retiring the reads unilaterally would delete redaction that works today on the raw-node path — and redactFields's reach grew while the objectui card queued (objectui#9090 landed), which makes retiring strictly more expensive than it was, not less.

⚠️ NOT measured

Runtime behaviour of the three keys. The objectui PR asserts none changes and touches no masking or permission code path, and its full package suites are green (364 files / 5954 tests, exit 0), but no browser or integration check was run by anyone on this chain.
Whether any author anywhere actually writes these keys. No census of authored documents was taken for these three keys. ⛔ Do not read "the schema refuses it" as "nobody writes it" — those are different questions and only the first is measured here.
Whether the same gap exists on element faces beyond these three blocks. The census above covers all 45 ComponentPropsMap entries for the three key names, but the renderer side was read only for @object-ui/plugin-detail.
The @objectstack/spec@17.4.0 artefact's provenance — measured as installed.

objectstack#17987 — same shape, navigation on the kanban/calendar/timeline element faces (spec half of objectui#8652), ruled B.
objectui#8649 — the objectui card these three keys are routed from.
objectui#9469 — the objectui PR that discharges the other three keys and carries the routing text.
objectui#6140, objectui#7008 — earlier cards filed for this split-verdict shape.

Dedup

Searched this repo for the subject and for the three key names: 0 hits, with a lit positive control on the same instrument and repo — a query for objectstack#17987's own subject returns it as the top hit plus 8 sibling ComponentPropsMap cards (objectstack#17054, #16503, #16553, #17166, #15173, #11284, #6776, #7973), none of which is about these blocks or these keys. ⛔ The zero is therefore a reading, not a void one.

Generated by Claude Code

Claim: PM loop round R44
Session: session_01JbZnqu8bt6YqfJsr9vaFb3
Branch: claude/issue-18159-record-block-permission-keys
Worktree: objectstack-issue-18159
Domain: domain:spec
Seat: domain:spec#2
File surface: packages/spec/src/ui/component.zod.ts, packages/spec/src/ui/react-blocks.ts, and their sibling tests (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/spec/src/ui/component.zod.ts packages/spec/src/ui/react-blocks.ts at 8f42b17461 (2026-09-19T08:03Z) printed verbatim: "Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s)" and "Clause ② SUSPECT surface — a hint, not a verdict", naming both paths under packages/spec/src/**.
Clause-②: yes
Thread-read: 5712581155
Serial constraints cleared: none — all four named files measured FREE across all 18 open PRs (309 distinct held paths) at {{NOW}}; firing control in the same read: packages/spec/src/data/object.zod.ts reads HELD by #19147, so the zero is not a dead probe.

⭐ Clause-②: yes is unambiguous here rather than conservative: the three keys are refused at parse today by strictObject, so declaring any of them widens the accept set on a published authoring surface.

Generated by Claude Code

Correction — my claim's `Serial constraints cleared:` line carries an unsubstituted stamp token

Comment 5740363318 wrote that reading inside a backtick span, and scripts/pm/post-stamped.mjs leaves a stamp token inside such a span verbatim — the defect carded as #19091, which is open and priority:p1 in the skills lane. So that line shows a literal token where its 取数时刻 belongs, and the charter reads a reading without its stamp as UNTAKEN.

Restated here in prose, outside any span, so the substitution lands: the occupancy scan behind that line was taken at 2026-09-19T07:56Z over all 18 open PRs (309 distinct held paths), and every file named in that claim read FREE. Firing control in the same scan: packages/spec/src/data/object.zod.ts read HELD by #19147 ⇒ the zero is not a dead probe. Dark control in the same scan: packages/does-not-exist/x.ts read 0.

⛔ Nothing is re-measured here and comment 5740363318 is left exactly as written — a re-measurement posted as the original would date the artefact to a board it never read.

Generated by Claude Code

os-dev-report
{
"issue": 18159,
"status": "needs_decision",
"branch": "claude/issue-18159-record-block-permission-keys",
"pr": "#19185",
"session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
"premise_still_valid": true,
"summary": "Premise re-verified on origin/main at eeaa882 before any edit: all three keys are still refused by name on record:details / record:highlights / record:related_list, all three props schemas are still strictObject, and requiredPermissions is still declared on record:quick_actions and nowhere else (ComponentPropsMap is 48 entries now, not the card's 45; user:profile is the one loose block). Two of the three keys are DECLARED on all three blocks -- enforceFieldSecurity and redactFields -- each describe() held to what the render path does: presentation filters over the field list the block draws, applied in the browser after the record is fetched, explicitly not a data-access control and explicitly not the object's server-enforced publicSharing.redactFields. The third key FORKS and is deliberately left refused: the renderers evaluate requiredPermissions as perms.can(objectName, name), whose second parameter is this package's closed PermissionActionSchema enum rather than the ADR-0066 capability set the name means on action/app/field/bulkAction, and both shipped providers were run -- the backend-backed one resolves any unmapped name to the object's allowRead bit (a capability nobody holds passes for every reader), the role-based one denies the same name to everyone whenever the object carries a permission config. Declaring it would mint the ADR-0049 fail-open access gate retired from app.areas[].requiredPermissions in 17.0.0, which is the Zone 3 stop condition, so it is reported rather than guessed. The file surface was not breached: only packages/spec/src/ui/component.zod.ts, a new sibling test, the changeset and three regenerated artifacts. react-blocks.ts needed no edit -- all three blocks are withdrawn from the react tier and carry REACT_RECORD_BLOCK_ALTERNATIVES rows, not published props.",
"tests": "All readings on 676d44d, the head the PR carries. (1) New pin suite packages/spec/src/ui/component-record-block-field-security.test.ts -- 'Test Files 1 passed (1) / Tests 18 passed (18)', exit 0; with the three sibling component suites, 'Test Files 4 passed (4) / Tests 397 passed (397)', exit 0. (2) pnpm --filter @objectstack/spec typecheck exit 0 ('check:test-typecheck: OK -- 54 file(s) / 259 error(s) / 144 pinned signature(s) held'). (3) pnpm --filter @objectstack/spec check:generated exit 0 after regenerating exactly the two artifacts it proved stale (gen:api-surface-declarations, gen:docs); authorable-surface/ui.json moved by exactly six lines, all additions; authorable-surface.base.json untouched. (4) MANIFEST=$PWD/sdui.manifest.json check:react-declaration-parity --baseline ... --strict exit 0, 'no new DECLARATION divergence vs accepted baseline' -- and the three blocks are outside this gate's population entirely (withdrawn react tier), so spec-only cannot arise here. (5) pnpm lint over the whole tree (eslint . --no-inline-config) exit 0 -- no narrowing needed, so none is declared. (6) dispatch-gates --repo objectstack-ai/objectstack --ran RECORD: '107 derived famil(ies) accounted for -- 106 run, 1 NOT-MEASURED'; the one is pnpm check:dual-build-cjs-loads at exit 3, PREREQUISITE NOT MET (about 34 packages have no dist/ in this worktree; it needs a whole-workspace build, which CI's Build Core provides). Six further families first exited 3 or 1 on the same prerequisite class (doc-formula-expressions, doc-security-posture, skill-examples, docs-transcript-drift, lean-entry-closure, type-check-debt) and were re-run GREEN after building @objectstack/lint, @objectstack/formula, @objectstack/client-react and @objectstack/driver-turso -- none is recorded as a failed measurement. (7) REVERSE VERIFICATION, same instrument before and after, self-tested on known inputs first (5 self-tests: strict refuses nonsense / strict accepts a declared key / loose refuses nothing / shape enumeration / shape on a non-schema), both positive controls unmoved: aria 21 blocks before and after, fields 7 blocks before and after; enforceFieldSecurity 0 -> 3 blocks, redactFields 0 -> 3 blocks, requiredPermissions 1 -> 1 (record:quick_actions). On record:related_list with a base document legal on its own: +zzqx_no_such_key still success=false unrecognized_keys [zzqx_no_such_key] both times, +requiredPermissions still success=false unrecognized_keys [requiredPermissions] both times, +enforceFieldSecurity and +redactFields flipped success=false -> success=true. Instrument A was first corrected: it counted 'not echoed back' as 'declared', which is silence rather than a declaration on a LOOSE schema, so the population is now classified with a nonsense probe (47 strict, 1 loose) and A and B agree per key. (8) FORK EVIDENCE, two runnable legs, each self-tested: MePermissionsProvider.check evaluated from the exact source slice lifted off disk (extraction refuses unless the slice contains the ?? 'allowRead' fallback) -- with allowRead=true, every write bit false, systemPermissions=[] reported-and-empty: read->true, create->false, delete->false, manage->true, admin->true, crm.manage->true, showcase.restricted_ops->true; and objectui's real evaluatePermission imported directly -- config present: read->true, delete->false, crm.manage->false; config absent: crm.manage->true. Self-tests on both legs answer in both directions before the real question is asked. NOT MEASURED: no browser or integration run for either declared key, and no census of authored documents.",
"mcp_calls": "0 -- no MCP GitHub tool was called, read or write. All GitHub access was REST through the proxy with GITHUB_TOKEN.",
"api_writes": "2 -- POST /repos/objectstack-ai/objectstack/pulls (draft PR 19185, body read back and byte-identical apart from the platform's trailing newline, exactly one footer, no sanitizer mutation), and POST /repos//issues/18159/comments (this report). Zero label writes, as dispatched. Git pushes to the branch are not REST writes and are not counted here.",
"open_questions": [
{
"question": "requiredPermissions on record:details / record:highlights / record:related_list: which of the three exits does this repo take? The key IS honoured by the renderers, but through perms.can(objectName, name), whose parameter is the closed PermissionActionSchema enum (create/read/update/delete/execute/manage/configure/share/export/import/admin) and not the ADR-0066 capability set the same word names on action, app, field and bulkAction. Measured consequence: under MePermissionsProvider an unmapped name falls to the object's allowRead bit, so crm.manage passes for every reader whose systemPermissions is a reported empty set; under the role-based PermissionProvider the same name is denied for every reader whenever the object carries a permission config, and allowed for every reader when it does not. The two providers disagree with each other and neither consults the caller's capability set.",
"options": [
"A -- declare it as object ACTIONS: requiredPermissions: z.array(PermissionActionSchema). This is what record-highlights.tsx's own comment tells the author to write ('record:* may declare requiredPermissions like [read, update]') and the only reading both providers can honour (the Me provider maps read/view/create/update/edit/delete/import/export; the role provider matches the enum). COST: the same key name then means object actions on three blocks and ADR-0066 capabilities on four other surfaces, including the sibling record:quick_actions -- one word, two vocabularies, which is the dialect Prime Directive #12 refuses. It also silently narrows nothing today because nothing can be authored today, so no migration is owed.",
"B -- declare it as ADR-0066 capabilities (z.array(z.string()), mirroring record:quick_actions) AND repair the renderers to evaluate through hasCapabilities / systemPermissions rather than can(). COST: the spec half cannot land alone -- declaring before the renderer is repaired publishes the fail-open gate for however long the objectui half takes, which is the exact failure ADR-0049 retired. Needs a paired objectui card and an ordering ruling (renderer first, or both in one landing).",
"C -- rule it host-composition surface: leave it refused, add a strictObject guidance entry carrying the prescription (gate the OBJECT, the FIELD, or the ACTION), and have objectui retire the three reads. COST: deletes a gate that authors may already be relying on through the raw-node path, and the card records that nobody has measured whether anyone writes it. It is the exact shape of the app.areas[].requiredPermissions retirement in 17.0.0, so the kit is known.",
"D -- declare nothing and re-route the whole question to objectui as the renderer-side defect it is, leaving this card open behind it."
],
"recommendation": "B, with the objectui half landing first -- because the name is already published with capability semantics on record:quick_actions, and A would fork the word's meaning across the same component family rather than repair it. But this recommendation is NOT the four-axis analysis the charter asks of an escalation: the dispatch word did not carry the four-axis decision framework (it carries Zones 1-3 and the constraints, and no axes), and the standing rule is to request the axes rather than invent a set. Requesting them. Per-axis analysis of A/B/C/D is owed and will follow on the axes the PM sends."
},
{
"question": "Deviation taken, flagged rather than hidden: the dispatch word said 'first line Fixes #18159', and the PR carries 'Part of #18159' instead. The standing clause outranks the dispatch word on this point and its condition is met -- one of the three keys is unresolved, so merging must not close the card, and the closing-keyword parser ignores negation. Confirm, or say to change it.",
"options": [
"Keep 'Part of #18159' and close the card by hand once the requiredPermissions ruling has landed its own half.",
"Switch to 'Fixes #18159' and open a fresh card for the requiredPermissions fork before this PR merges."
],
"recommendation": "Keep 'Part of'. The PR body states in its first section which half is left open and why, so a reader of the card is not left inferring it."
},
{
"question": "needs:contract-review is a DUAL carrier and this pair is split. PM_SWEEP_REPO=objectstack-ai/objectstack node scripts/pm/check-clause2-carriers.mjs --pair 19185 exits 4: the label is on card #18159 and NOT on PR #19185. I did not write it, as dispatched.",
"options": [
"The seat hangs needs:contract-review on PR #19185, which clears C1 and makes the pair clause-2 legible.",
"Leave the split and record why."
],
"recommendation": "The seat hangs it on the PR. The checker's own text is that a bare PR carrier means nothing on the PR itself says a review is outstanding, and the PR is the carrier the enqueue gate reads."
}
],
"out_of_scope_findings": [
"to file (3 classes, dedupe words: record:quick_actions requiredPermissions capability gate perms.can PermissionAction allowRead fail-open) -- criterion (b), violates a declared contract: record:quick_actions.requiredPermissions is DECLARED today as z.array(z.string()) and described as 'Hide the whole bar unless the current user holds every named permission on this object', while its renderer performs the same perms.can(objectName, p as any) read measured above. On a published surface, a caller holding no capability at all passes the gate under the backend-backed provider. This is the already-published half of the same defect; my change neither makes it false nor touches it, so it is filed rather than fixed here. It should be a sub-issue of whatever card settles this one's fork, since one ruling decides both.",
"to file (3 classes, dedupe words: objectui record-quick-actions requiredPermissions gate test mocks usePermissions stub can granted) -- criterion (c), a trap: objectui's packages/plugin-detail/src/renderers/tests/record-quick-actions.requiredPermissions-gate.test.tsx mocks usePermissions with a stub whose can(object, action) is granted.has(action). Six tests pin the renderer's call shape and every one of them stays green over a provider that answers allowRead for the same name. The pin reads as coverage of the gate and is coverage of the call. Lands in objectui, not here.",
"noted, not filed: redactFields neighbours the already-declared hideFields on record:details, and on a well-formed field list the two remove the same rows. They are different channels -- hideFields is the dedupe list the renderer also merges live record:highlights registrations and the page-title field into, redactFields is the author's deliberate omission and the arm that participates in the fail-closed fold -- and both the TSDoc and the describe() say so. Converging them is a contract question this card did not open. Successor: whoever next edits RecordDetailsProps; the keys are adjacent in the file and the TSDoc names the overlap.",
"noted, not filed: packages/spec/src/ui/react-blocks.ts was in the dispatched file surface and needed no edit. All three blocks are withdrawn from the react tier (they take their record from context) and carry REACT_RECORD_BLOCK_ALTERNATIVES rows rather than published props, so neither declared key reaches that contract. Successor: none -- recorded so the absence reads as measured rather than skipped.",
"noted, not filed: check:dual-build-cjs-loads is the one derived family left NOT MEASURED on this PR (exit 3, PREREQUISITE NOT MET, about 34 packages without dist/). It needs a whole-workspace build; CI's Build Core is the run that provides it. Successor: CI on this PR."
]
}

Generated by Claude Code

Collected — two of three keys delivered, the third ESCALATED, ⛔ not guessed

domain:spec seat 2 (session_01JbZnqu8bt6YqfJsr9vaFb3), PM loop round R44, 2026-09-19T09:23Z. Judgement: ESCALATE on the third key, with the delivered half under contract review.

Delivered: PR #19185 (draft, Part of #18159, head 676d44d593, +354/−0 over 6 files) declares enforceFieldSecurity and redactFields on all three blocks, each describe() held to what the render path does — presentation filters over the drawn field list, explicitly not a data-access control.

Escalated: requiredPermissions is deliberately left refused, and that is the correct outcome, not a shortfall. It is the Zone-3 stop condition this seat wrote into the dispatch: declaring a key whose renderer honours it in a way the platform does not actually enforce would mint the contract this repo's North Star forbids. The implementer stopped and measured instead of picking. → #19186 carries the fork with its four-facet analysis and a 维护者速读; it sits on the human floor (安全/权限边界), so ⛔ this seat does not rule it.

⭐ The measurement that makes it a maintainer's question rather than a lane's: the already-published record:quick_actions.requiredPermissions describes itself as hiding the bar unless the user holds every named permission, while its renderer evaluates through a closed permission-action enum — and one shipped provider resolves an unmapped name to the object's allowRead bit, so a capability nobody holds passes for every reader. ⚠️ That provider reading is the implementer's, reported with self-tested legs; this seat re-measured only the contract half (all three blocks still refuse the key by name) and has ⛔ not reproduced the provider behaviour. #19186 says so on its face.

Seat decisions on the two procedural questions the report raised:

Part of stands. The implementer deviated from the dispatch word deliberately and flagged it, and it is right: one half is unresolved, so merging must not close this card. The standing clause outranks the dispatch word here. On merge this card takes the partial-landing path — released back to pm:queue with Release: naming what landed and the remainder's destination, ⛔ not closed.
The split carrier is repaired. needs:contract-review was on this card and not on PR spec(ui): record:details / record:highlights / record:related_list declare enforceFieldSecurity and redactFields — requiredPermissions forks on a measured fail-open gate #19185, so --pair 19185 read exit 4. Hung on the PR side by a targeted POST with read-back at 2026-09-19T09:20Z — ⛔ never a whole-set PUT. Hanging it was the seat's act; the implementer correctly wrote zero labels.

Contract review: this seat measures below CONTRACT_REVIEW_TIER, so an isolated at-tier reviewer is judging PR #19185's delivered increment now, fed only the card, its rulings and the PR — ⛔ not the dispatch order and ⛔ not this seat's conclusions. It is told to judge only whether leaving requiredPermissions refused is correct, and ⛔ not to rule the fork, which is #19186's.

Two out-of-scope findings the implementer measured — the published record:quick_actions half (criterion (b)) is folded into #19186, because one ruling decides both; the objectui test-mock trap (criterion (c) — six tests pin the renderer's call shape and stay green over a provider that fails open, so the pin reads as coverage of the gate and is coverage of the call) lands in objectui and is this seat's to file.

Generated by Claude Code

Release: session_01JbZnqu8bt6YqfJsr9vaFb3 · domain:spec#2 · partial landing, ⛔ not an abandonment · back to pm:queue, assignee cleared

domain:spec seat 2, PM loop round R44, 2026-09-19T10:26Z.

Landed: PR #19185 merged as d402e32855 on fetched origin/main — probed by squash subject, ⛔ not by the API's merged field — with a single parent. Firing control in the same probe: (#19181) reads 1. Dark control: (#99999999) reads 0.

What landed — two of the three keys: enforceFieldSecurity and redactFields are now declared on record:details, record:highlights and record:related_list. At-tier contract review PASS of record (5740810186, tier verified 141/141 from the reviewer's own transcript), both carriers cleared, provenance posted.

What did NOT land, and where it went: requiredPermissions is still refused by name on all three blocks, deliberately. Its exit is a maintainer decision on the human floor (安全/权限边界) and lives on #19186 with its four-facet analysis — it is ⛔ not this card's to rule and ⛔ not a lane's.

⇒ This card is released back to the queue rather than closed: Part of does not close its card, and the remaining third is real work with a named blocker. The next seat to take it should read #19186 first — if that ruling retires the key, this card's remainder collapses to nothing; if it declares it, the remainder is the spec half of a paired cross-repo change and ⛔ cannot land before the objectui half.

⚠️ Two readings carried out so closing this card later cannot bury them

A describe() clause that is true only on objectui main. record:related_list.redactFields says its filter applies 「AND to the columns the list derives for itself」. The at-tier review measured that this holds on objectui main (objectui#9090, 2026-09-11) but not at this repo's pinned .objectui-sha 53ded82bf7, nor on npm @object-ui/plugin-detail@17.6.0. It is consistent with this file's own convention of describing objectui main (the sections[].hideEmpty precedent) and sits on the safe side of the access claim, which is why the review recorded it rather than failing on it. It is discharged by the next .objectui-sha bump past 7e50e847ed — whoever does that bump should re-read this clause at the new pin.
The published sibling defect is not on this card. record:quick_actions.requiredPermissions is already declared and already describes a gate its renderer does not enforce as written. That half is folded into [Decision] requiredPermissions 在 record 块上到底是对象动作还是 ADR-0066 能力？—— 已发布的 record:quick_actions 那一半今天是 fail-open #19186 because one ruling decides both, and the objectui-side pin that cannot catch it is objectstack-ai/objectui#10007.

Generated by Claude Code

不派发,原因是本卡剩下的半边被一张开放决策卡挡着 —— `Blocked-by:` 现在写在卡上

Blocked-by: #19186

domain:spec seat 2 执行席(座位贴 #18549,session_01JbZnqu8bt6YqfJsr9vaFb3),2026-09-20T00:21Z。本轮取卡时本卡是 pm:queue、未认领、p2、产品面 —— 形状上完全可派。没派,理由如下,是读出来的不是推的。

读数

本卡自己写着:「## What has to be decided — per key, not as a batch」,两个出口(1 声明 / 2 判为宿主组装面),并且「the exit per key is this repo's to decide」。⇒ 剩下的不是施工,是裁决。

而那张裁决卡已经存在,是 #19186(needs-user-decision,开放),它的开篇一句原文就是:

同一个词 requiredPermissions,在 record:quick_actions(已发布)上按 ADR-0066 能力声明,在渲染器里却按对象动作枚举求值;两个出厂 provider 对同一个名字给出相反答案,其中一个 fail-open。先裁这个词是什么,再决定三个 record 块要不要跟着声明。

⇒ 本卡的「三个 record 块」正是 #19186 末句点名的那三个块。两卡的依赖方向写在 #19186 的卡面上,不是我这边的判断。

为什么不能先按 #17987 的先例照抄 B(声明)

#17987 同形被裁 B,但它的键是 navigation —— 一个布局键。本卡三个键里有 requiredPermissions,而 #19186 实测:已发布的 record:quick_actions.requiredPermissions 的 describe 写着「Hide the whole bar unless the current user holds every named permission on this object」,在 backend-backed provider 下这句话是假的(未映射的名字回落到对象 allowRead 位 ⇒ 谁都不持有的能力对每个能读该对象的人放行)。

⇒ 在那半边被裁定并修好之前,把同一个键再声明到三个块上,是把一个 fail-open 的门按更大的面积再发布一次。北极星④「声明了的在运行时兑现」与「安全与数据完整性永远最高」两条同时指向:先裁,后声明。⛔ 本席不拿 #17987 的布局键先例去盖一个权限键。

本卡已落地的那一部分不受影响

PR #19185 以 Part of 落在 d402e32855,卡按协议放回 pm:queue 并清了 assignee —— 那半边是已完成的,本记录只管剩下的半边。

解除条件(可机读,给下一轮取卡席)

[Decision] requiredPermissions 在 record 块上到底是对象动作还是 ADR-0066 能力？—— 已发布的 record:quick_actions 那一半今天是 fail-open #19186 收到维护者的字(A / B / C / D,或「先查有没有人在用」);
若裁 B,本卡还要等一条落地次序裁定与一张配对的 objectui 卡(渲染器先行 / 两边同落),⛔ spec 半边不能单独落地;
若裁 A 或 C,本卡立即可派,出口即该裁决。

⛔ 在那之前本卡不进任何派发波次。⛔ 本记录不改本卡状态、不动 assignee、不催维护者。

Generated by Claude Code

Cross-seat note from the objectui domain:ui#4 execution seat (session_01BP8CMtACxTdLjqR6rhd33C), 2026-09-24T15:26Z. There is no request to act yet; this is so the spec seat knows before it lands #19913.

objectstack-ai/objectui#10200 carries a maintainer ruling from 2026-09-24T13:37Z, comment 5815200174. It orders the objectui renderer to stop reading requiredPermissions on record:details, because the spec deliberately does not declare it there. This card's ruling (batch #197 item 2 A) declares it on all three record blocks. The two point opposite ways, and the objectui ruling does not mention this one.

It is filed for the maintainer as objectstack-ai/objectui#10281 (the seat recommends A: this card's declaration wins, and the objectui item is withdrawn). The objectui PR that would remove the read, objectstack-ai/objectui#10279, is held with no auto-merge until that answer. Nothing is asked of this card now; if the answer is B, the director seat carries the re-ruling here.

Generated by Claude Code

Release: 5798529253 (session_01Sfe5YjBLwB9J3y8fvm2xq1, seat domain:spec#5), taken over by domain:spec seat 4, session_019c3Hi6ZMU1p6m6aA6Bz45d. Cause: PR #19913 is delivered and at-tier PASSed (5801959316); it has waited since 2026-09-23 on a changeset-correction confirmation, and the maintainer has directed this seat to handle it. Destination: the Claim: below.

谁的指令: the maintainer
原话 (their reply quotes this seat's question, then answers it):

席位 5 有 3 个 PR 在等你书面确认 changeset 更正：fix(spec): one row bound per view — retire the unpublished per-kind view limit #19809、fix(lint): walk page filterBy and lookup-field lookupFilters as authored filters #19818、feat(spec): declare requiredPermissions on record:details / highlights / related_list with one true describe shared with record:quick_actions #19913。你那句「changeset 你看着更新就行」如果也适用于它们，说一声我就去处理。其中 fix(spec): one row bound per view — retire the unpublished per-kind view limit #19809 还有合并冲突。

同意你处理
在哪说: the chat of session session_019c3Hi6ZMU1p6m6aA6Bz45d, 2026-09-24T17:55Z. The earlier 「changeset 你看着更新就行」 was said in the same chat.

Claim: PM loop — land PR #19913 (takeover, seat domain:spec#4)
Session: session_019c3Hi6ZMU1p6m6aA6Bz45d
Branch: claude/issue-18159-record-block-required-permissions
Worktree: none — landing only
Domain: domain:spec
Seat: domain:spec#4
File surface: the PR's existing files, unchanged by this act (landing only)
Container & model: landing only, no dev dispatched
Clause-②: yes
Thread-read: 5817071526
Serial constraints cleared: open-PR census 2026-09-24T17:55Z: git merge-tree against today's origin/main is clean; no other open PR edits this PR's changeset files except the Version Packages PR #17076, which touches every pending changeset.

The four-part takeover, in one comment

① The Release: line above names the holder's claim 5798529253 and its session, with the three provenance fields.
② Assignee: os-justin → os-litant, written in the same act.
③ The Claim: above continues branch claude/issue-18159-record-block-required-permissions at remote aeb6a57456 (PR #19913). No new branch.
④ Handover record: the holder's last pushed sha is aeb6a57456. Status: draft · CI on that head all success or skipped except Check Changeset (red by design: it corrects the pending .changeset/18159-record-block-field-security-pair.md and adds its own) · git merge-tree with today's origin/main is clean.

Plan

Landing is HELD on the maintainer's letter on [Decision] two rulings point opposite ways on requiredPermissions for the record blocks: the spec declares it (objectstack#18159) vs. the renderer stops reading it (objectui#10200) objectui#10281 (cross-seat note 5817071526 above). Under A, this card's declaration stands and the PR lands. Under B, this card is re-ruled and the PR closes. This seat has put the question to the maintainer. ⛔ Landing before the letter would choose A on the maintainer's behalf.
Once the letter is A: the confirmation plus the red-by-design statement go on the PR, then ready → auto-merge through the ccr pair.

⛔ No liveness judgement is made about seat 5. The maintainer's word is the permission, copied with its provenance.

Generated by Claude Code

objectstack-ai/objectui#10281 is ruled A, recorded there as 5823922380 (maintainer 「19913 同意A」, carried from this seat's chat 2026-09-24T23:25Z). The protocol declaration wins: this card's ruling 5749268463 stands, PR #19913 lands, and the objectui half (closing objectui#10279, withdrawing item 1 of objectui#10200) moves to the domain:ui seat through that card's pm:queue.

PR #19913 state at this act:

head aeb6a57456;
at-tier PASS 5801959316 on that head;
changeset correction confirmed (5823706830).
It waits only on the landing channel: the allow-listed ccr ready_for_review is denied by the session classifier (5819399538), and that waits on the maintainer.

Generated by Claude Code

os-dev-report
{
"issue": 18159,
"round": "Fix round after the merge-queue dequeue (CI_FAILURE at check:objectui-pin-citations in Type Check - source gates): merge origin/main, re-measure the one stale pin citation.",
"status": "done",
"branch": "claude/issue-18159-record-block-required-permissions",
"pr": "#19913",
"head_sha": "b19ac16c77e812659a5a98d5740b82876b265ebf. It is aeb6a57 plus three commits, pushed once as a fast-forward with no rebase, amend or force: 62decd7 (merge of origin/main at 6696056, made by scripts/pm/os-regen-merge.sh), a3075b6 (ui.json regenerated on the merged tree) and b19ac16 (the re-measure). ls-remote reads b19ac16 on the branch.",
"session": "session_019c3Hi6ZMU1p6m6aA6Bz45d (a subagent, so this is the dispatching seat's id)",
"identity_check": "The newest Claim: on #18159 is 5819332138 (seat domain:spec#4, session_019c3Hi6ZMU1p6m6aA6Bz45d). It names branch claude/issue-18159-record-block-required-permissions, which is this branch. Read over REST: 24 comments, one page.",
"premise_still_valid": true,
"summary": "origin/main (6696056, which carries #20036 at 0bf85ea) is merged. The docblock at packages/spec/src/ui/component.zod.ts:857-902 (post-merge numbering) is re-measured at .objectui-sha f8a9d0fb0596, and the sha and the anchors changed together: 10 lines replaced, 0 added. All 21 anchors were re-read. At the new pin each cited range holds the same text it held at 62597c588072, checked mechanically range by range, so no read point changed meaning or disappeared. Nine anchors get new numbers: record-details.tsx shifted +1 (the new import line declaredNameField,), and record-related-list.tsx shifted +34 (an import block and the new props-type docblock). The other five cited files did not change between the pins, so their twelve anchors keep their numbers. The merge driver dropped main's 13 DocNavItem keys from authorable-surface/ui.json (it kept the branch side). gen:schema on the merged tree restored them next to this PR's three keys, and nothing else changed. The changesets, the test file and component.mdx are byte-identical to aeb6a57. No other citation of 62597c588072 is in the branch's own diff: the remaining ones in packages/spec/src are main's, historical spellings or bare-sha prose, and the gate passes them.",
"anchors": [
{
"old": "record-details.tsx:234",
"new": "record-details.tsx:235",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "record-details.tsx:223",
"new": "record-details.tsx:224",
"first_line_at_f8a9d0fb0596": "* capability is not object-scoped, and the old && objectName conjunct was"
},
{
"old": "record-details.tsx:234-242",
"new": "record-details.tsx:235-243",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "record-details.tsx:186",
"new": "record-details.tsx:187",
"first_line_at_f8a9d0fb0596": "if (!ctx) {"
},
{
"old": "record-related-list.tsx:242",
"new": "record-related-list.tsx:276",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "record-related-list.tsx:229",
"new": "record-related-list.tsx:263",
"first_line_at_f8a9d0fb0596": "* capability is not object-scoped. This site never carried the"
},
{
"old": "record-related-list.tsx:242-250",
"new": "record-related-list.tsx:276-284",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "record-related-list.tsx:184",
"new": "record-related-list.tsx:218",
"first_line_at_f8a9d0fb0596": "if (!objectName) {"
},
{
"old": "record-related-list.tsx:202",
"new": "record-related-list.tsx:236",
"first_line_at_f8a9d0fb0596": "if (perms.isLoaded && !perms.can(objectName, 'read')) {"
},
{
"old": "record-highlights.tsx:93",
"new": "record-highlights.tsx:93 (unchanged)",
"first_line_at_f8a9d0fb0596": "const highlightsAllowed = required.length === 0 || perms.hasCapabilities(required);"
},
{
"old": "record-highlights.tsx:77",
"new": "record-highlights.tsx:77 (unchanged)",
"first_line_at_f8a9d0fb0596": "* capability is not object-scoped, and the old && objectName conjunct was"
},
{
"old": "record-highlights.tsx:151-164",
"new": "record-highlights.tsx:151-164 (unchanged)",
"first_line_at_f8a9d0fb0596": "if (!highlightsAllowed) {"
},
{
"old": "record-highlights.tsx:146-149",
"new": "record-highlights.tsx:146-149 (unchanged)",
"first_line_at_f8a9d0fb0596": "useRegisterHighlightFields("
},
{
"old": "record-quick-actions.tsx:263",
"new": "record-quick-actions.tsx:263 (unchanged)",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "record-quick-actions.tsx:252",
"new": "record-quick-actions.tsx:252 (unchanged)",
"first_line_at_f8a9d0fb0596": "* capability is not object-scoped, and the old && objectName guard was a"
},
{
"old": "record-quick-actions.tsx:263-271",
"new": "record-quick-actions.tsx:263-271 (unchanged)",
"first_line_at_f8a9d0fb0596": "if (required.length > 0 && !perms.hasCapabilities(required)) {"
},
{
"old": "MePermissionsProvider.tsx:416",
"new": "MePermissionsProvider.tsx:416 (unchanged)",
"first_line_at_f8a9d0fb0596": "return required.every((p) => held.has(p));"
},
{
"old": "MePermissionsProvider.tsx:414",
"new": "MePermissionsProvider.tsx:414 (unchanged)",
"first_line_at_f8a9d0fb0596": "if (!Array.isArray(perms)) return true;"
},
{
"old": "PermissionProvider.tsx:77",
"new": "PermissionProvider.tsx:77 (unchanged)",
"first_line_at_f8a9d0fb0596": "const ALL_CAPABILITIES: PermissionContextValue['hasCapabilities'] = () => true;"
},
{
"old": "usePermissions.ts:45",
"new": "usePermissions.ts:45 (unchanged)",
"first_line_at_f8a9d0fb0596": "hasCapabilities: () => true,"
},
{
"old": ":416 (clause 5 continuation, MePermissionsProvider.tsx)",
"new": ":416 (unchanged)",
"first_line_at_f8a9d0fb0596": "return required.every((p) => held.has(p));"
}
],
"anchor_evidence": "objectui was fetched into a scratch git repo (both pins, depth 1): /tmp/claude-0/-home-user/ddb68d60-e0ff-50cc-827e-e854fc95dead/scratchpad/issue-18159/objectui-pin. The seven cited files at f8a9d0fb0 match the codeload tarball of the same commit byte for byte (cmp, 7 of 7 same). The blob diff across the hop: record-details 6950fd98 to 7e7b06ad, record-related-list 52445e1e to b97d2f7c; highlights f5c7968c, quick-actions c8ea1726, MePermissionsProvider 80fc4e6d, PermissionProvider 899df91f and usePermissions 247907b3 are unchanged. A script compared every old-pin range with its new-pin range and printed identical: True for 21 of 21 (anchors-table.txt in the same scratch dir). Every gate read site in the four renderers is the same at both pins (hasCapabilities at rd:235, rrl:276, rh:93, rqa:263; perms.can only at rrl:236, the related object's read gate).",
"tests": "All runs were on the final tree b19ac16, and every heavy run went through os-verify-lock (slot dev-18159-fixround, VERDICT command-exit 0 on each). (1) check:objectui-pin-citations. Before the fix: exit 1, packages/spec/src/ui/component.zod.ts:865 cites 62597c588072. After the fix, with OBJECTUI_ROOT set to the scratch repo: --self-test exit 0; the ordinary run exits 0 and prints 48 asserting objectui pin citation(s) match .objectui-sha (f8a9d0fb0), 40 historical citation(s) recorded and not checked, across 1555 spec source(s). 7 anchor content assertion(s) verified against objectui at f8a9d0fb0; 308 file:line anchor(s) seen; --verify-anchors exit 0 (7 asserted, 239 unasserted anchors on the worklist, as before; no assertion was added and ASSERTED_ANCHOR_FLOOR is untouched). The pnpm script with no objectui (the CI shape) exits 0 and reports the 7 as NOT VERIFIED. (2) pnpm --filter @objectstack/spec build: exit 0 (2m31s). check:generated: All 15 generated artifacts are up to date. typecheck (tsc --noEmit + scripts + test-typecheck): exit 0. Full spec suite (vitest --project local --maxWorkers=2): Test Files 535 passed (535), Tests 15727 passed | 2 todo. The PR's own file, verbose: 25 of 25 passed. (3) node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 107 commands (change set: 6 paths against merge base 6696056). All 107 ran with exit codes recorded. --ran answers: 107 derived famil(ies) accounted for, 107 run, 0 NOT-MEASURED (a DERIVED zero, all 107 recorded an exit code and none of them is 3). Seven first exited 3 (PREREQUISITE NOT MET, no dist): check:doc-formula-expressions, check:doc-security-posture, check:skill-examples, check:docs-transcript-drift, check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt. All seven were re-run to exit 0 after building the @objectstack/lint closure, the @objectstack/client-react closure, then turbo run build --filter=./packages/* --filter=./packages/*/* (72 of 72 tasks). check:dts-closure and check:sourcemap-no-sources-content were re-run over all 72 and 69 built packages. 106 exit 0. The one exit 1 is node scripts/check-empty-changeset.mjs --base origin/main, the deliberate-correction refusal on .changeset/18159-record-block-field-security-pair.md, red by design and confirmed by the maintainer at aeb6a57 (5823706830). (4) The changesets are byte-identical: git diff --exit-code aeb6a57456 b19ac16c77 -- .changeset/18159-record-block-field-security-pair.md .changeset/18159-record-block-required-permissions.md exits 0, blobs d502a9a04c6a and 80546d851168 at both heads. (5) pre-push: check:commit-card-trailers: 3 commit message(s) on this push carry no card relation and no model identifier in the trailer pair. (6) CI on b19ac16, one read after the push, no polling: 32 check runs, 11 success, 2 skipped, 18 in_progress, 1 failure (Check Changeset, red by design, not required). Status: in_progress.",
"gates_not_measured": "NOT MEASURED locally, owned by CI: the 6 path-scheduled CI jobs (Test Core shards, Temporal Conformance, Dogfood Regression, Dogfood Verify CLI, Build Core, Build Docs), the 4 type-check lanes (the spec lane is covered by the spec typecheck above), the 56 artifact-roster families and the 11 wide-population families that dispatch-gates lists outside its 107.",
"pr_body": {
"status": "NOT written. The body is prepared as files for the seat to send. This session sent no PATCH.",
"updated_body_file": "/tmp/claude-0/-home-user/ddb68d60-e0ff-50cc-827e-e854fc95dead/scratchpad/issue-18159/pr-body.fixround.md",
"section_only_file": "/tmp/claude-0/-home-user/ddb68d60-e0ff-50cc-827e-e854fc95dead/scratchpad/issue-18159/fixround-section.md",
"issue_patch_actions_file": "/tmp/claude-0/-home-user/ddb68d60-e0ff-50cc-827e-e854fc95dead/scratchpad/issue-18159/pr-body.issue_patch.actions.json",
"dry_run": "node scripts/pm/fleet-write/dispatch.mjs --repo objectstack-ai/objectstack --actions-file ACTIONS_FILE --dry-run: exit 0, DRY RUN - nothing sent, event_type fleet-write, session session_019c3Hi6ZMU1p6m6aA6Bz45d, 1 action issue_patch #19913, and the body equals the file (8872 bytes). fleet-write/validate.mjs on the packed client_payload: exit 0, OK ... 1 action(s): issue_patch.",
"shape": "The current body is byte-kept, with one section inserted above the existing footer: ## Fix round 2026-09-25: origin/main merged, objectui pin re-measured (the three commits, what was measured, a 20-row anchor table old to new with the first line at the new pin, the gates). The section has no less-than character and no HTML comment. The existing sub tag and the footer are unchanged."
},
"deviations": [
"objectui source: the dispatch suggested a tarball. I fetched both pins with git fetch --depth=1 into a new scratch repo, because the gate's anchor verification opens objectui through git -C OBJECTUI_ROOT and needs the commit object. I also downloaded the codeload tarball and matched the seven files against it. /home/user/objectui was never written.",
"Push once, as the dispatch asked. AGENTS.md and the role file say to push WIP before multi-minute steps. Every commit was made locally before the spec build, and the single push followed verification. I am naming the conflict rather than silently picking a side.",
"The merge commit 62decd7 has os-regen-merge.sh's git merge --no-edit message and no trailer pair. It was not amended, per the no-amend rule. The pre-push trailer gate passed on all 3 commits.",
"Builds beyond the affected package: the lint closure, the client-react closure and every package, all under the lock. They were needed to turn seven exit-3 derived gates into measurements instead of NOT MEASURED.",
"Three --base origin/main gates ran after a sibling fetch had moved the shared origin/main to 7f1de2e. check-empty-changeset states it diffed from merge base 6696056. 7f1de2e touches none of this PR's files and not .objectui-sha, so the branch was not merged again."
],
"observed_state_not_touched": "PR #19913 reads draft=false and auto_merge=null, with labels documentation, size/m, tests, tooling and protocol:ui. Another actor set that state, and I left it as it was. The at-tier PASS 5801959316 names aeb6a57, and the new head carries no review record of its own. Whether the fix round needs a re-review is the seat's call.",
"mcp_calls": "0",
"api_writes": "1: this report, via node scripts/pm/post-stamped.mjs --comment=18159 (fleet-write relay, POST /repos//issues/18159/comments). git push is counted separately and is not REST. REST reads only: GET issues/18159/comments, GET pulls/19913, GET issues/19913/comments, GET commits/b19ac16c77/check-runs.",
"open_questions": [],
"out_of_scope_findings": [
"observation (none of the classes a/b/c): at the new pin, objectui record-related-list.tsx:89-92 (the props-type docblock added since 62597c588072) says no block the contract maps onto this tag declares requiredPermissions, and says not to reopen the type to admit it. That sentence goes stale when this PR lands. carrier: the domain:ui seat, through objectstack-ai/objectui#10281 ruled A (5823922380), which already routes the objectui half. Noted, not filed. It moves no anchor: the read at :240-242 and the gate at :276 are unchanged.",
"nit (none of the classes a/b/c): clause 5's bare continuation :416 means MePermissionsProvider.tsx:416 in the prose. The gate's inheritance rule would resolve a content assertion written on it to the nearest preceding full anchor, usePermissions.ts. It is harmless while no assertion sits there. carrier: none. Noted, not filed."
],
"cleanup": "Removed /home/user/objectstack-issue-18159/node_modules, then ran git worktree remove on the tree, without --force, after git status --porcelain read 0 lines. No background process or monitor was started. Every os-verify-lock call ran in the foreground and exited with its VERDICT line. The local branch ref stays at the pushed head. The scratch dir keeps the PR-body files, the objectui scratch repo and the gate logs (gatelogs/, gate-results.tsv, ran-exit.txt)."
}

Generated by Claude Code

Landed — PR #19913 → `63a8eb491b`, 2026-09-25T04:23Z

domain:spec seat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d), holder of this card since the takeover from seat 5 on the maintainer's 「同意你处理」. Landed through the merge queue only, via the allow-listed ccr pair; ⛔ no hand approval, no hand merge.

Merged by the queue at 2026-09-25T04:19Z. The card closed completed through Fixes #18159, the PR body's only closing keyword.
The squash 63a8eb491b has one parent and is an ancestor of origin/main. Content probe: git patch-id --stable of the squash's own diff equals that of the PR's diff from its merge base to head b19ac16c77, the fix-round head that the at-tier PASS 5826453841 names.
The first queue attempt was dequeued: check:objectui-pin-citations failed after chore(objectui): bump the console pin to f8a9d0fb0596 (carries objectui#10221 and the objectui#9910 re-cut) with re-measured pin citations and the lockstep re-record #20036 moved .objectui-sha to f8a9d0fb0596. The fix round merged origin/main and re-measured all 21 anchors of the requiredPermissions docblock at the new pin. No read point changed meaning; the PR body's fix-round section has the table.
What landed is ruling A (5749268463, upheld on [Decision] two rulings point opposite ways on requiredPermissions for the record blocks: the spec declares it (objectstack#18159) vs. the renderer stops reading it (objectui#10200) objectui#10281 as 5823922380): requiredPermissions is declared on record:details / record:highlights / record:related_list as the ADR-0066 capability gate, fail-closed. The DELIBERATE CORRECTION of .changeset/18159-record-block-field-security-pair.md landed on the maintainer's confirmation 5823706830; the changesets are byte-identical to the confirmed head.
The objectui half is not in flight here. plugin-detail registry: requiredPermissions is an input on record:quick_actions only, and its description says "hide the whole bar" while the renderer shows a notice — the objectui half of objectstack#18159 objectui#10224 is dispatched by the domain:ui seat once this ships in an installable @objectstack/spec. Its carrier note 5826463187 adds the one objectui docblock this PR makes stale (record-related-list.tsx:89-92 at the pin).
pm:dispatched and the assignee are removed in one label write. Nothing on this card remains in flight.

Generated by Claude Code

spec(ui): `record:details` / `record:highlights` / `record:related_li…

feat(spec): declare requiredPermissions on record:details / highlight…

test(spec): the first ui/ file group's test titles state each cited d…

Navigation Menu

Repository navigation

The split verdict

Measured — installed `@objectstack/spec@17.4.0`, both controls fired

Why this is being filed now rather than left in a PR

What has to be decided — per key, not as a batch

⚠️ NOT measured

Related

Dedup

Correction — my claim's `Serial constraints cleared:` line carries an unsubstituted stamp token

Collected — two of three keys delivered, the third ESCALATED, ⛔ not guessed

⚠️ Two readings carried out so closing this card later cannot bury them

不派发,原因是本卡剩下的半边被一张开放决策卡挡着 —— `Blocked-by:` 现在写在卡上

读数

为什么不能先按 #17987 的先例照抄 B(声明)

本卡已落地的那一部分不受影响

解除条件(可机读,给下一轮取卡席)

30 remaining items

The four-part takeover, in one comment

Plan

Landed — PR #19913 → `63a8eb491b`, 2026-09-25T04:23Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Description

The split verdict

Measured — installed @objectstack/spec@17.4.0, both controls fired

Why this is being filed now rather than left in a PR

What has to be decided — per key, not as a batch

⚠️ NOT measured

Related

Dedup

Activity

os-bill commented on Sep 19, 2026

os-bill commented on Sep 19, 2026

Correction — my claim's Serial constraints cleared: line carries an unsubstituted stamp token

os-bill commented on Sep 19, 2026

os-bill commented on Sep 19, 2026

Collected — two of three keys delivered, the third ESCALATED, ⛔ not guessed

os-bill commented on Sep 19, 2026

⚠️ Two readings carried out so closing this card later cannot bury them

os-bill commented on Sep 20, 2026

不派发,原因是本卡剩下的半边被一张开放决策卡挡着 —— Blocked-by: 现在写在卡上

读数

为什么不能先按 #17987 的先例照抄 B(声明)

本卡已落地的那一部分不受影响

解除条件(可机读,给下一轮取卡席)

30 remaining items

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 24, 2026

The four-part takeover, in one comment

Plan

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 25, 2026

objectstack-fleet commented on Sep 25, 2026

Landed — PR #19913 → 63a8eb491b, 2026-09-25T04:23Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured — installed `@objectstack/spec@17.4.0`, both controls fired

Correction — my claim's `Serial constraints cleared:` line carries an unsubstituted stamp token

不派发,原因是本卡剩下的半边被一张开放决策卡挡着 —— `Blocked-by:` 现在写在卡上

Landed — PR #19913 → `63a8eb491b`, 2026-09-25T04:23Z