docs(plugin-spec): use the page's own @vendor/* placeholder in the peerDependencies examples

[os-try-charles]

Fixes #18417

What changed

Both peerDependencies examples on content/docs/protocol/kernel/plugin-spec.mdx pinned
'@objectstack/ui': '^2.0.0' — a package that is declared in neither this repo nor the npm
registry. Both sites now read '@vendor/ui': '^2.0.0'. The block stays, the range stays, the
two proposal-only disclaimers stay.

-    '@objectstack/ui': '^2.0.0',     (full manifest example)
+    '@vendor/ui': '^2.0.0',
-  '@objectstack/ui': '^2.0.0',       (Dependency Types, section 3 "Peer Dependencies")
+  '@vendor/ui': '^2.0.0',

Two lines, one file. Sites were located by content, not by line number.

Why this arm (D), and why it invents nothing

Triage chose arm D — keep the block, move the name to the page's own placeholder form.
Reproduced independently on this branch, tree objectstack-ai/objectstack at
84ba4a847600dbecb55fcd2e31322ada19496f58 (the branch base), file counts taken from the page
itself:

reading	value
@vendor/email on the page	2 — one of them in the same code block, on the sibling optionalDependencies key, five lines above the defect
@vendor/analytics on the page	1
any package.json in the repo declaring a @vendor/* name	0 — so @vendor/* really is a placeholder family
firing control, same scan: "name": "@objectstack/core"	packages/core/package.json — the scan reaches
npm registry @vendor/ui	HTTP 404
npm registry @vendor/email (the name the page already ships)	HTTP 404 — the new name is exactly as inert as the convention it joins
npm registry @objectstack/core (firing control)	HTTP 200

The page's other convention — @objectstack/* names a package that exists — was measured per
name rather than assumed: core, spec, cli each resolve to a real packages/*/package.json;
ui resolved to nothing, which is this card.

Arms B (name a real package) and C (delete the block) were both ruled out by triage, and A is the
defect itself. D is the only arm that satisfies both of the page's existing conventions at once.

The one page convention that looked like a third one, and why it does not conflict

@objectstack/testing (3 occurrences, Plugin Testing section) is also declared nowhere and is
also 404 on npm — so the page does tolerate an inert @objectstack/* name in one place. It is not
a counter-example to D:

• its warn callout sits five lines above its first use and disclaims the package, verbatim:
  "there is no such published package today"; the two peerDependencies disclaimers disclaim the
  manifest key (the schema declares it) and say nothing about the package. Different subject;
  the precedent does not reach this site.
• following that precedent here would mean asserting on the page that an @objectstack/ui package
  is planned — inventing a fact, which is the objection that ruled out arm B.
• the page's own prose for this key reads "Use for large dependencies (React, Vue) that should be
  shared across plugins" — a third-party shared library, which is precisely what @vendor/* marks,
  and precisely what @mycompany/* (the reader's own org, 3 names on the page) does not.

No third convention conflicts with D, so this does not go back to triage.

The follow-on delivery item triage proposed is NOT owed — reasoning

Triage suggested bringing the first example at line 71 inside the reach of the proposal-only
callout, on the premise that the nearest disclaimer is roughly 355 lines later. That premise does
not hold, twice over:

1. There are two proposal-only statements on this page, and the earlier one names
   peerDependencies explicitly ("The displayName / author / license / homepage /
   optionalDependencies / peerDependencies / metadata / config / marketplace keys above are
   proposal-only — the schema declares none of them"). It sits 112 lines after the first
   example, not 355.
2. Stronger: the code block that contains the first example opens on its own first line with
   "src/manifest.ts — proposed authoring wrapper (see the callout below for the fields
   ManifestSchema actually declares today)". The pointer is already inside the block, above the
   defect.

A reader hitting line 71 is therefore inside a block that announces itself as a proposal and points
at the callout that grades it. Adding a third synonymous disclaimer to one page would be a new
defect, not a repair, so nothing further is added here.

Verification

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 39
  families for this change set. All 39 were run; reconciliation with --ran reports
  39 derived, 39 run, 0 UNRUN.
• 34 were green on the first pass. Five refused as PREREQUISITE NOT MET against an unbuilt tree
  (check:doc-formula-expressions, check:doc-security-posture, check:docs-transcript-drift at
  exit 3; check:docs and check:skill-examples at exit 1 with prerequisite text). After building
  @objectstack/spec, @objectstack/lint..., @objectstack/formula and @objectstack/client-react...,
  all five re-ran at exit 0. check:skill-examples is the one that actually reads this page's fenced
  TypeScript: "258 prose examples type-check across 3 surface(s)".
• Exit codes were captured before any pipe, per the gates' own instruction.
• Control-byte self-scan over the edited file: grep -naP for the control range returns exit 1, no
  matches.
• No ablation is offered: this diff adds no guard and changes no executable behaviour, so there is
  nothing whose failure could be demonstrated.

Changeset

skip-changeset, measured rather than assumed: of the 70 non-private workspace packages, 0
carry a files[] entry matching content or docs; positive control on the same scan, 70 ship a
dist entry. Nothing published moves, so no released package takes a version bump from this diff.

Acceptance notes

• @objectstack/testing is inert in the same way @objectstack/ui was, at 3 sites in the Plugin
  Testing section. It is already disclaimed in place by its own callout, and that section is held by
  the epic docs + scaffold: plugin-spec.mdx stops promising the non-existent @objectstack/testing and points at @objectstack/verify; the create-objectstack blank template ships a test story (epic hotcrm#1579, step 5b) #15952, so it is left alone here — noted, not filed.

---

Generated by Claude Code