fix(platform-objects): decide the lifecycle panel and the email-template sample per leaf — the whole remainder of #19403

[huangyiirene]

Part of #19403

Clause-②: no

Round 10 of #19403, and it takes the whole remainder: every leaf in
packages/platform-objects/src/apps/translations/*.metadata-forms.generated.ts
that still echoed its en source in any locale.

The remainder this round took — re-measured on base 236cec19a

family	en leaves	zh-CN	ja-JP	es-ES
object.fields.lifecycle.storage	8	0	8	8
object.fields.lifecycle.archive	8	0	8	8
object.fields.lifecycle.ttl	6	0	6	6
object.fields.lifecycle.retention	4	0	4	4
object.fields.lifecycle.class	2	0	2	2
object.fields.lifecycle.reclaim	2	0	2	2
object.fields.lifecycle (label + helpText)	2	0	2	2
email_template.fields.variables.helpText	1	0	1	1
total	33	0	33	33

33 en leaves x 2 locales = 66 locale-leaves. Every count is this round's own
reading, taken before a word was written, and it reproduces the dispatch table exactly.

Census, before and after — with the control moving the other way

reading	before	after
en string leaves / .label leaves	893 / 538	893 / 538
POSITIVE CONTROL, .label genuinely translated (zh-CN)	538	538
POSITIVE CONTROL, .label genuinely translated (ja-JP)	522	538
POSITIVE CONTROL, .label genuinely translated (es-ES)	522	538
per-locale .label echoes	0 / 16 / 16	0 / 0 / 0
every string leaf echoing, per locale	0 / 33 / 33	0 / 0 / 0
the card's headline predicate (echoes in ALL THREE)	0	0

Echoes down 33 in each of two locales while the control rises 16 in each, same
population, same run: a discrimination, not a parser matching everything.

The remainder this round LEAVES — 0, and it is 0 for BOTH predicates

This card has been bitten twice by the difference, so both are stated:

• all-three predicate (a leaf echoing in zh-CN AND ja-JP AND es-ES): 0.
  It also read 0 before this round, over 33 leaves a Japanese author was reading
  in English. That zero carried no information.
• per-locale predicate (a leaf echoing in at least one locale): 0, and this
  is the one that had something to say.

Per locale and per family: zh-CN 0, ja-JP 0, es-ES 0; every family
in the table above reads 0 / 0 / 0. The new ledger asserts both readings on the
live tree, and proves they are different questions on a synthetic catalog where
the all-three predicate returns 0 while the per-locale one returns 1 — so the
property holds whatever the tree contains.

The judgement, which is the whole card

An echo is not automatically a defect, so all 66 are decided per leaf with the
verdict, the per-locale reason and the en source they were judged against, in
object-lifecycle-panel-echo-decisions.test.ts. Every verdict came out
translate; the reasons record what each rendering was derived FROM.

zh-CN's answers were used as EVIDENCE, not as a translation. They prove the
two other locales were unauthored fills and they settle what each leaf means;
the Japanese and Spanish words come from each locale's own authored twins, and
every row says which of the two it leaned on. Three rows record a deliberate
departure from zh-CN, with the reason:

• lifecycle.storage.label — zh-CN expands it to 存储策略; an exact authored twin
  for the bare word sits in this same panel's section heading
  (object.sections.advanced.description = ストレージ / almacenamiento), and
  expanding would leave the child row storage.strategy holding its parent's word.
• lifecycle.class.helpText — zh-CN replaces "rows" with 数据; the schema statement
  is about rows specifically and both target locales have an authored word for it.
• lifecycle.archive.after.label — zh-CN writes 归档时点 (a point in time); the
  schema types the value as a duration literal, so both locales name an AGE and share
  a head noun with retention.maxAge, which ADR-0057 requires it to EQUAL.

One schema key, one rendering — what was copied, and where nothing existed

22 of the 33 rows copy an authored twin, asserted per locale against the live
catalogs (56 locale assertions) so the two positions can only ever move together.
The sharpest ones:

row	authored twin	ja-JP	es-ES
lifecycle.archive.to.label	object.fields.datasource.label	アーカイブ先データソース	Fuente de datos de archivado
lifecycle.ttl.field.label	object.fields.fields.summaryOperations.field.label	タイムスタンプフィールド	Campo de marca temporal
lifecycle.archive.keep.label	lifecycle.retention.label, this ledger's own row	アーカイブ保持期間	Retención en archivado
email_template.variables.helpText	email_template.fields.fromOverride.helpText	**例: **[{ … }]	**Ejemplo: **[{ … }]

The other 11 rows say NO TWIN EXISTS rather than leaning on one. Probed and
stated: shard, telemetry, cold store, driver and the disk-space sense of
space have zero authored renderings in either catalog, in either locale. Two of
those rows also record a near twin that was looked up and refused: Japanese
領域 is spent on the layout-region sense in this catalog
(page.sections.layout.description, app.fields.areas.label), so reusing it for
disk space would collide two concepts on one word.

One refusal is asserted in the suite so nobody leans on it later:
sys_oauth_resource.fields.access_token_ttl.label ("Access Token TTL") is
byte-identical in all three locales and reads like a standing decision to keep
TTL verbatim. It is an unauthored fill in every locale, zh-CN included — it
carries a provenance row in all three companions. The TTL decision rests on
zh-CN's own authored answers and on round 7's landed machine-token treatment.

Machine tokens kept verbatim, with a predicate that can say NO

19 tokens x 3 locales = 57 assertions: ADR-0057, record, audit, TTL,
created_at, expires_at, retention.maxAge, h/d/w/y, "30d", "1d", "7y",
SQLite, DROP, O(1) and the multiplication sign. The guard is a Unicode
word-boundary predicate, and the suite proves it can fail on these very strings.

Round 9's recorded limit is now executable rather than prose. The suite asserts
all four halves: a substring guard LIES on kana (キャンセル contains セル); this
predicate does not make that mistake; it pays with an UNDER-REACH (a genuine
standalone セル inside running Japanese, このセルを編集, is MISSED); and it only
sees a kana token that happens to be delimited. Sound and incomplete on kana — and
the suite also asserts that every token this ledger guards is Latin, a digit-unit
literal or a dotted path, so the limit does not bite here.

The phantom-translation trap, asserted three ways

objectForm declares no label on any of the sixteen lifecycle fields (asserted,
all sixteen), so every en label here is humanizeFieldPath of the path — and one
is WRONG English: lifecycle.ttl humanizes to "Ttl", whose correct English is the
initialism "TTL" that the form's own helpText and LifecycleSchema's own TSDoc
both spell.

Correcting it would differ in bytes, satisfy the echo predicate in all three locales,
drop this card's census by a leaf and tell a Japanese author nothing. It is not done
here and it discharges nothing. The suite asserts the two English spellings differ,
that no rendering is either of them, and that the initialism survives as a token in
all three. It is written up in full in the Acceptance notes below. Round 8's
Api Enabled is the same producer and is still unfiled; this is its second instance.

ADR-0057 was read at the live schema before a word was rendered

Five it blocks assert the claims the renderings rest on, each with its refusal leg:
LifecycleClassSchema's five members (so record and audit are values an author
types, not words); §3.1 (a record class with a policy is refused) and §3.5 (a
non-record class with none is refused); archive.after must EQUAL retention.maxAge
(a mismatch is refused, the aligned pair parses); LIFECYCLE_DURATION_REGEX accepts
30d/1d/7y and refuses 30 days, 30 天 and 30 días; and storage is a COUNT
plus a GRANULARITY (shards min 2 refused at 1, unit enum refused at quarter,
strategy literal refused at merge).

The instrument — populations DERIVED, never hand-listed

Two populations, two shape predicates:

1. The lifecycle root is found by SCHEMA SHAPE. LifecycleSchema.shape has six
   keys; the population is the one form composite whose DIRECT children are exactly
   those six. It follows a rename of the form field, grows when ADR-0057 grows, and
   can be wrong in a way a startsWith('lifecycle') walk never could. 32 leaves.
2. The email rows are found by WIDGET — widget: 'json' on emailTemplateForm,
   which reaches exactly two fields and four leaves.

Controls. OUTWARD: 94+ leaves of these two forms are excluded, five object paths
and three email paths asserted by name, and nothing excluded echoes anywhere.
INWARD: 3 of the 4 email-json leaves are NOT decided here and come back
NON-ECHOING in the same walk — and one of those three is the exact structural twin
the decided row copies from. One leaf of a matched pair authored by a translator and
the other left as a byte copy: one leaf cannot be a decision and a fill at once.
DARK: fed the en catalog, the derived predicate flags every leaf of both populations.

Three-leg pin, carried from rounds 8 and 9: every row is held equal to the live
bundle, to the en source, AND to the form declaration that manufactures it (a
helpText to the form's own text, a label to the form declaring NONE).

Round 8's deferral is DISCHARGED, and its bound TIGHTENED in the same act

DEFERRED_SUBTREE = 'lifecycle' with RECORDED_DEFERRAL = 32 is not deleted —
the shape stays, because it is the dark control that made this population visible.
The 32 leaves moved out of the deferral into decided rows, withinRecorded(0) holds,
and round 9's two legs (oldBound unfalsifiable, shrink-only) are kept exactly as
they were.

Tightened, not weakened: with the deferral empty, the inDeferral skip in round
8's ratchet would let a NEW lifecycle echo through unnoticed, and <= 32 over a true
value of 0 can no longer fail. Two lines now pin the exact reading beside the
shrink-only bound — the hole round 10 created by discharging the deferral, closed by
round 10. Ablation A1 reds them on the live tree.

Two landed assertions this diff falsified — repaired in place, declared, none weakened

report-form-echo-decisions.test.ts (round 9) drew the POSITIVE half of its
provenance discrimination from the metadataForms. slice, and survived only because
ja-JP and es-ES still carried this round's 33 leaves. Emptying that slice made
toBeGreaterThan(0) false in two of the three locales.

The repair is round 9's own precedent applied to round 9's own file: draw the
positive sample from a population this card does not touch. The objects. slice
still carries hundreds of echoing leaves in every locale, so the composer now shows a
real positive AND a real negative in all three locales, where before it managed
it in two. The contract assertion is untouched — what moved is the SAMPLE DRAW, not
the claim. Ablation A2 reds it.

Regeneration — pnpm i18n:extract, never by hand

Values were authored by hand (the documented seam for translated-locale strings);
the structure was regenerated with pnpm i18n:extract.

Idempotence control, taken first: a no-op pnpm i18n:extract on the untouched
base rewrote all 11 files and left git status --porcelain empty over the whole
tree. Every later diff is therefore attributable to the edits.

No keys added, none removed, proved on full flattened key sets over all four
bundles of both catalogs:

reading	result
key set before / after	9832 / 9832 lines, diff exit 0, 0 delta
skeleton summary, all four locales	2458 of 2533 — objects 1565, metadataForms 893, unchanged
NEGATIVE CONTROL, one key ADDED	equality reads false, delta 1
NEGATIVE CONTROL, one key REMOVED	equality reads false, delta 1

Second witness — the metadataForms.-prefixed companions, as SET EQUALITY

The provenance tables key under a metadataForms. prefix the bundles do not carry
(asserted), and hold an entry exactly while a leaf is still a byte copy of the source.

locale	rows before	rows after	dropped	added	metadataForms. rows remaining
zh-CN	362	362	0	0	0
ja-JP	416	383	33	0	0
es-ES	425	392	33	0	0

Set equality against "exactly my N leaves" reads true in all three, every dropped
key carries the prefix, and the perturbed-expectation control reads false in both
directions (+1 and -1).

One disclosure: for zh-CN the expected-drop set is empty, so the -1 perturbation
is a no-op and reads true. That is recorded as a vacuous leg, not counted as a
control; the +1 direction still fires for zh-CN, and both directions fire for the
two locales that moved.

Ablations — 6, each proved on disk, 18 assertions reddened

Mutation proved by anchor count plus blob hash; restore proved by blob hash and a
whole-tree git status --porcelain, which read clean after every one.

#	mutation	red assertions
A1	revert ja-JP lifecycle.reclaim.label to its en source	4
A2	re-add one metadataForms. row to ja-JP's provenance table	3
A3	reword the authored twin object.fields.datasource.label in es-ES	1
A4	strip the TTL token from ja-JP lifecycle.ttl.label	2
A5	declare a label on the ttl composite in objectForm (spec, rebuilt)	2
A6	revert zh-CN lifecycle.archive.label to its en source	6

A1 reds round 8's newly tightened bound on the live tree, which the old <= 32 never
could. A2 reds three assertions across three different ledgers. A3 reds the copy
assertion with the exact message es-ES object.fields.lifecycle.archive.to.label no longer contains its twin object.fields.datasource.label. A6 reds the sibling-evidence
leg and five others.

A5 crosses a package boundary, so it carries the build discipline: @objectstack/spec
resolves through its exports to dist and packages/platform-objects declares no
vitest alias for it. Mutate, turbo run build --force --filter=@objectstack/spec,
ablation-dist-preflight packages/spec 'TTL__ABLATION__' (hits in
dist/browser/data/index.js and others), then the suite. The marker did not
pre-exist in dist (checked before mutating). The restore leg rebuilt and ran the
preflight with --absent: "marker absent from all 216 built files" and "working
tree clean against HEAD". No ablation was re-run until something landed and no
mutation was left on disk.

Verification

reading	result
pnpm --filter @objectstack/platform-objects test	883 passed / 883, 54 files
pnpm --filter @objectstack/platform-objects typecheck	OK — tsc --noEmit, scripts project, and check:test-typecheck
derived gate families (scripts/pm/dispatch-gates.mjs)	60 derived / 60 run / 0 NOT MEASURED / 0 exit 3
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0 — population 6983 files read from eslint's own config via --format json, 0 errors, 0 warnings
pnpm --filter @objectstack/spec check:generated	all 15 generated artifacts up to date

All of the above were re-run on the final merged head 0cfec25d2, after the merge
below. pnpm lint ran over the entire population, so no narrowing was claimed and
none is owed.

Two families exited 3 on the pre-merge sweep — pnpm check:i18n and
pnpm check:dual-build-cjs-loads, both PREREQUISITE NOT MET (unbuilt dist/),
which is "nothing was measured", not a pass. Both discharged by a full
turbo run build --concurrency=2 (74/74 tasks) and re-run to exit 0:
check-i18n-bundles: OK (9 packages, all bundles in sync, no undeclared authoring keys) and check:dual-build-cjs-loads over 104 entry points / 620 CJS files. On the
post-merge sweep neither reached exit 3 at all.

Changeset — patch, and the diff really publishes

Probed against the built files[] set (dist, README.md, CHANGELOG.md), 67
files, 26.5 MB. Round 9's escape reading replicates and extends: the same build
spells the same characters two different ways.

probe	spelling found in dist
U+30C7 (デ), U+5BB9 (容)	UPPER-CASE \uXXXX only — raw ABSENT
U+00F3 (ó)	raw AND an UPPER-CASE \xNN escape — two spellings, one build
whole ja-JP label データライフサイクル	UPPER-CASE \uXXXX
whole es-ES label Ciclo de vida de los datos	raw
NEGATIVE CONTROL, a string not in the package	false raw AND false escaped

Every probe was built from the character itself (codePointAt then padded hex in
both cases and both widths), never typed by hand — a hand-typed raw probe reads a
FALSE ZERO for the Japanese strings here.

Merge with origin/main

Merged immediately before the final push. origin/main moved from 236cec19a to
5c5b67fc4 (one commit, #19595), and nothing it brought touches this region —
git diff --name-only over the two refs returns no path under
packages/platform-objects/src/apps/translations/ or packages/spec/src/data/object.form.ts.

Two-legged proof: base 236cec19a != 5c5b67fc4 (TRUE), and
git merge-base --is-ancestor origin/main HEAD exits 0, with a control leg on the
known ancestor 236cec19a also exiting 0. The merge was clean, left no os-regen
deferral, and because it moved packages/spec the spec was rebuilt and
check:generated re-run (15/15 up to date) before anything else was believed.

Acceptance notes

1. lifecycle.ttl ships the wrong English — class (a), reachable today, and this
round could not file it. Written out in full so a taker needs nothing else.

• Producer. objectForm (packages/spec/src/data/object.form.ts) declares no
  label on the lifecycle.ttl composite. walkFormField
  (packages/cli/src/utils/i18n-extract.ts, the pushEntry for
  metadataForms.TYPE.fields.PATH.label) therefore emits
  humanizeFieldPath('lifecycle.ttl'), which lower-cases everything after the first
  letter of the path leaf and yields "Ttl".
• Reproduction. humanizeFieldPath('lifecycle.ttl') === 'Ttl', and the shipped
  en.metadata-forms.generated.ts carries object.fields["lifecycle.ttl"].label === "Ttl". The same file's helpText one line down reads "Per-row TTL expiry" and
  LifecycleSchema's TSDoc spells TTL too, so the panel disagrees with itself on
  screen. Correct English: "TTL".
• Warning one, for whoever fixes it. Correcting the English satisfies the echo
  predicate in every locale and drops this card's census by a leaf while translating
  nothing. It must not be counted as discharging a translation row — round 8 recorded
  the identical shape on enable.apiEnabled ("Api Enabled" / "API Enabled"), which
  is the same producer and still unfiled.
• Warning two, for whoever picks the fix site. The fix belongs in objectForm
  (label: 'TTL' on that composite), not in humanizeFieldPath. Teaching the
  humanizer an initialism list would silently change every other humanized label across
  all nine packages' bundles and would re-fill en leaves translators have already
  answered against the old spelling.
• Dedupe words: humanizeFieldPath initialism · Ttl label wrong English ·
  objectForm declares no label lifecycle · Api Enabled humanize ·
  metadata form label capitalisation.

2. *.objects.generated.ts carries its own echoing population — 362 / 383 / 392
echoing against 1203 / 1182 / 1173 translated. Re-measured here and unchanged. It has
no taker (承接者:无), which is why it is written down rather than assumed to be
someone's, and it is out of this card's stated population.

3. zh-CN renders lifecycle.storage.label and lifecycle.storage.strategy.helpText
with the same string (存储策略), so in Chinese the composite and its child tooltip
read identically. Noted, not filed: it is a landed decision of an earlier hand on a
leaf this round does not own, both strings are authored, and nothing is an echo. The
ja-JP and es-ES renderings keep parent and child distinguishable, as the English does.

4. The generated-bundle merge hazard — git check-attr merge reads unspecified
for these paths, so two branches adding keys merge clean with one side silently lost.
Re-measured, not acted on: the card body already rules it an AGENTS.md decision.

Route

Draft, and it stays draft. Part of #19403, not a closing keyword: whether the card
closes is a reading the PM seat takes at the landing, against the trunk, with the
census. Nothing is armed and auto-merge is not set.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects, touching 3 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/email-templates.mdx (via email_template (symbol, a field of const object esESMetadataForms; a field of const object jaJPMetadataForms))
• content/docs/concepts/metadata-lifecycle.mdx (via email_template (symbol, a field of const object esESMetadataForms; a field of const object jaJPMetadataForms))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5c5b67fc4140f76ca3158acea9e0845d9eebfad8 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1fffe7b09f1afafe6f1f444c2b679f93fe8fc6b2 — the merge of head 0cfec25d27147558f6d380950e135f8d109a55e9 into base 5c5b67fc4140f76ca3158acea9e0845d9eebfad8, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1fffe7b09f1afafe6f1f444c2b679f93fe8fc6b2 && git checkout 1fffe7b09f1afafe6f1f444c2b679f93fe8fc6b2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5c5b67fc4140f76ca3158acea9e0845d9eebfad8 0cfec25d27147558f6d380950e135f8d109a55e9 && git checkout -B drift-repro 5c5b67fc4140f76ca3158acea9e0845d9eebfad8 && git merge --no-ff 0cfec25d27147558f6d380950e135f8d109a55e9

node scripts/docs-audit/affected-docs.mjs --json 5c5b67fc4140f76ca3158acea9e0845d9eebfad8

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5c5b67fc4140f76ca3158acea9e0845d9eebfad8 → pass the list as
args.docs, on the commit named under Which tree this was computed on.