docs(adr-0026): spell the UI plugin package type ui, note the original ui-plugin

[objectstack-fleet]

Part of #16140

Clause-②: no

This PR executes ruling 5563454219 on docs/adr/0026-client-ui-plugin-distribution.md and nothing else. The ruling came from the director seat in decision batch #61 (option A); the maintainer's reply, verbatim, was 「同意」.

What changed

• Section 3.1 manifest example (:80): "type": "ui-plugin" is now "type": "ui".
• Section 3.7 prose (:170 on base, :176 after the note): type: ui-plugin is now type: ui.
• One note directly under the example records that ui-plugin was this proposal's original spelling and that the closed set (CORE_PLUGIN_TYPES) adopted ui. The ADR's argument, its Proposed status line and every other line are unchanged.

The diff is 1 file, +8 / -2. Two things are deliberately untouched:

• the pins packages/core/src/plugin-type-closed-set.test.ts and packages/rest/src/plugin-type-closed-set.pin.test.ts;
• [finding] plugin-hono-server still accepts the legacy ui-plugin type that PluginSchema refuses — an unreachable arm under ADR-0049 #15638, the runtime tolerance arm in plugin-hono-server. It remains open and is not addressed here.

Premise check (base ed4b655e5b)

• ADR-0026 line 3 reads **Status**: Proposed.
• ui-plugin occurs exactly twice in the file: at :80, inside the jsonc example, and at :170, in prose.
• CORE_PLUGIN_TYPES (packages/spec/src/kernel/plugin.zod.ts:90) is ui, driver, server, app, theme, agent, objectql. There is no ui-plugin.

Two of the card's readings have drifted since it was filed. Neither affects the ruling:

• The ManifestSchema.type enum is now at manifest.zod.ts:430, and ManifestSchema is now a strictObject, which refuses unknown keys.
• PluginSchema.safeParse({type:'ui'}) is no longer success=true: type: 'ui' now requires staticPath and slug (PLUGIN_UI_REQUIRED_KEY_MISSING). The reading on the type key itself still holds on both schemas.

Proof: the example against the built schema

The instrument is a throwaway probe, not committed. It takes the section 3.1 jsonc block from the committed file at each revision (git show REV:docs/adr/...) and strips the // comments that sit outside strings. It then parses the result with ManifestSchema and PluginSchema from a fresh pnpm --filter @objectstack/spec build of this branch, loaded through the package's exports map (packages/spec/dist/kernel/index.js, not src/). "Before" is base ed4b655e5b and "after" is e968910ad5.

The type key, on both schemas. The before leg is the firing control: the same instrument refuses it.

before  ManifestSchema {type:"ui-plugin"} -> ["type"] invalid_value
        PluginSchema   {type:"ui-plugin"} -> ["type"] invalid_value
after   ManifestSchema {type:"ui"}        -> no issue at ["type"]
        PluginSchema   {type:"ui"}        -> no issue at ["type"]

The example's keys whose values the current schema already accepts (id, version, type, integrity), parsed with ManifestSchema.pick of those keys:

before  success=false | ["type"] invalid_value
after   success=true

The whole example, as pasted, against ManifestSchema:

before  success=false, 6 issues: ["type"] invalid_value, ["name"] invalid_type,
        ["permissions"] invalid_union, ["engines"] unrecognized_keys [objectui, react],
        ["runtime"] invalid_value, [] unrecognized_keys [ui]
after   success=false, 5 issues: the same list without ["type"]
removed by the edit: ["type"] invalid_value        introduced by the edit: none

Acceptance notes

• This edit alone does not meet the ruling's general rule. The rule says any example under docs/adr/** that an author could paste must validate against the current schema. After this edit, ManifestSchema still refuses the section 3.1 example on five counts, and none of them is type:

  • runtime: "ui": PluginRuntimeSchema accepts only node, sandbox or worker. The example itself annotates this value "new tier".
  • engines.objectui and engines.react: PluginEnginesSchema declares only platform and protocol.
  • The top-level ui block is not a ManifestSchema key.
  • permissions.data and permissions.navigation: the structured branch declares only services, hooks, network and fs.
  • name is required by ManifestSchema, and the example never had it.

  The first four are schema extensions the proposal makes and that were never adopted. Correcting them would change what the ADR proposes, which the ruling does not authorise, so this PR leaves them alone and reports them to the seat as an open question.

• PluginSchema is not the example's schema, because the example is an .osplugin package manifest. PluginSchema is a non-strict z.object and strips the manifest's keys. On the after leg it trades the type refusal for PLUGIN_UI_REQUIRED_KEY_MISSING on staticPath and slug, which are runtime-plugin keys that a package manifest does not carry. This is recorded for completeness and is not a defect in the example.

• The same spelling survives in prose at docs/design/plugin-distribution.md:127 and :277 (type: ui-plugin). That file is outside this card's one-file write surface, so it is reported to the seat and not changed here.

Changeset

There is no changeset. skip-changeset is the right label, as the ruling says. Measured:

• 70 non-private package.json manifests scanned; 0 of their files[] entries reach docs/adr/.
• A string unique to this ADR's example (com.acme.signature-field) has 0 hits across the built @objectstack/spec dist/ and json-schema/. The positive control, PLUGIN_UI_REQUIRED_KEY_MISSING, has 16.

This PR does not write the label.

Gates (at e968910ad5)

node scripts/pm/dispatch-gates.mjs --commands derived 19 commands for this change set. All 19 were run, and each exited 0. check:doc-formula-expressions first stopped at PREREQUISITE NOT MET (exit 3, nothing measured); after building @objectstack/formula and @objectstack/lint it exited 0.

The dispatch-gates --ran reconciliation reads: "19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)". Selected verdict lines:

• check-adr-links: 690 relative link destination(s) under docs/adr/ resolve
• check-adr-symbol-anchors: 2122 anchors across 140 records resolve
• check-adr-anchors: OK
• check:doc-authoring: no growth
• check-nul-bytes: OK, no raw ASCII control bytes

No package source is touched, so no package build, test or typecheck is owed. The @objectstack/spec build served the proof only. Repo-wide scans such as pnpm lint run in CI.

Governed surface

docs/adr/** is tier H on the governed-surface register. This PR stays draft. It lands only by a human merge through GOVERNED_APPROVERS.

维护者速读(草稿)

改了什么:ADR-0026 §3.1 manifest 示例和 §3.7 正文里的包类型 ui-plugin 改成了 ui;示例下方加了一条注记,说明 ui-plugin 是本提案最初的拼写,闭集 CORE_PLUGIN_TYPES 后来采用的是 ui。只改这一个文件,+8/-2。

为什么改:执行第 61 批裁决的选项 A(您回复「同意」)。原来作者照抄示例时,type: "ui-plugin" 会同时被 ManifestSchema 和 PluginSchema 拒收。

风险与代价(含回滚):纯文档,不发布任何包,运行时零影响;回滚就是 revert 本 PR。有一点需要您知道:改完后 type 已经能通过,但整个示例仍会被 ManifestSchema 拒收 5 处,即 runtime: "ui"、engines.objectui/react、顶层 ui 块、permissions.data/navigation,以及缺少必填的 name。前四处是提案自己提出、至今未被采纳的 schema 扩展。因此光靠本 PR 还满足不了裁决附带的通则「可照抄的示例必须能通过当前 schema」,这一点已作为待决问题交给席位。

席位意见:

你要做的:审阅后合并(这是治理面,需要您本人或 GOVERNED_APPROVERS 批准)。另外请就上面剩下的 5 处拒收定一个方向。

---

Generated by Claude Code

---

Generated by Claude Code

[os-support-ai]

Contract review

VERDICT: PASS — nothing blocking. Head reviewed: e968910ad5c6e8112d3e6714aadd947e040416ec. Base main (ed4b655e5b).

Reading moment: this record was written at 2026-09-23T01:51Z. A contract-review record binds ONE head and one reading moment.

⚠️ This is the lane's contract-review record for a GOVERNED surface (docs/adr/**, tier H) — ⛔ not a landing authorization. The PR stays draft and lands only by a human merge through GOVERNED_APPROVERS; this seat will ⛔ not ready it, enqueue it or arm auto-merge on it.

Reviewed-by: isolated at-tier subagent dispatched by domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr), seat post #6017
Implemented-by: claude/issue-16140-adr-0026-ui-plugin-example

Tier — measured by the SEAT from the reviewer's transcript

CONTRACT_REVIEW_TIER on origin/main is claude-fable-5-1. Governing stamps 74 / 74 claude-fable-5-1; dark control empty; the fallback/overload sweep read in context is tool-schema text and repo prose — ⛔ none a notice. ⇒ AT TIER.

What was proven

• The ruling was executed exactly. One file, +8 / −2: :80 and the §3.7 prose now read ui; one six-line note records the original spelling. ui-plugin still appears twice at head — both inside the note, which is the ruling's own design. **Status**: Proposed and every other line unchanged; both pins byte-identical base → head; [finding] plugin-hono-server still accepts the legacy ui-plugin type that PluginSchema refuses — an unreachable arm under ADR-0049 #15638 untouched, and ⛔ no closing keyword anywhere (the first line reads Part of #16140).
• Every clause of the note is true — the ADR's first commit already carried ui-plugin ×2 (「originally spelled」), CORE_PLUGIN_TYPES is ui, driver, server, app, theme, agent, objectql (「adopted ui」), and the note's shape matches existing ADR notes.
• The type key now validates, with the before leg as the firing control: ManifestSchema and PluginSchema both refuse ui-plugin at base and accept ui at head; the { id, version, type, integrity } pick goes success=false → success=true.
• No changeset is owed: 70 non-private package.json, 0 files[] entries reach docs/adr; the ADR-unique string reads 0 in the built spec against a live positive control.
• Scope: one file.

The residue — a fact check, reproduced, and ⛔ not a verdict on the ruling

The reviewer reproduced the round's residue exactly: against the built ManifestSchema the whole §3.1 example goes from 6 issues to 5 — removed exactly [type] invalid_value, introduced none — and the five survivors are runtime: "ui", engines.objectui / react, the top-level ui block (ManifestSchema is a strictObject), permissions.data / navigation, and a missing required name, each located in manifest.zod.ts on origin/main. Whether option A is enough under the ruling's general rule is the maintainer's question, put on #16140 at 5787494422.

CI at this head

38 check runs, all completed. The seven required: Lint & Repo Gates, TypeScript Type Check, Test Core (and shards 1–6), Dogfood Regression Gate, Governed Surface Queue Guard success; Build Core and Temporal Conformance skipped by path filter (recorded as skipped, ⛔ not as pass). ⚠️ Check Changeset was red — the gate's own message: 「This PR adds no changeset … apply the 'skip-changeset' label」. Both route-2 discriminators hold (0 .changeset rows in the diff; no files[] reaches the path) and the ruling names skip-changeset as appropriate ⇒ the seat applied skip-changeset in this act; the job re-fires on the labeled event.

---

Generated by Claude Code