fix(spec)!: judge a flattened list view overlay's legacy options bag at the view write door (door half of #20051)

[objectstack-fleet]

Part of #20051

Clause-②: no

This PR carries the door half of ruling A (objectui#10380, comment 5824043998, maintainer 「其他同意」) and the stored-row census. The persistence half (ruling item 2, "the metadata save persists the parsed body") is not in this PR. It is returned to the PM as a decision, with the readings below, so #20051 stays open for that half.

What changes

ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip(), the list overlay member of ViewMetadataSchema (packages/spec/src/ui/view.zod.ts), now declares options:

• Each options.KIND is judged by the kind's own block schema: kanban, calendar, gantt, gallery, timeline, chart, map and tree. The judge uses the same closed key set, the same per-key schemas and the same unknown-key message as the direct spelling, so an out-of-contract key is refused by name. Only the path gains the options. prefix. The kinds are derived from the shape's own type enum and blocks, not listed by hand.
• The bag is judged key by key (.partial()). objectui's ListView reads options.KIND as a per-key underlay of the top-level block, with the top-level block winning per key. A bag that carries only the keys the top-level block leaves to it is therefore legal config, and objectui pins that population (ObjectView.namedViewProtocolKeys-8980.test.tsx, "the merge is per-key, not wholesale"). Measured first with the full block schema: it refused those bags for required keys they never meant to carry. See decision Q2.
• The bag is closed. options.foo and options.grid are refused by name at options. They are no longer dropped.
• The form overlay pins options absent. Without this, a column-less, type-less list body that the list overlay refused over its bag is accepted by the form overlay member and stored unjudged. That was measured on the change before the pin was added.

The legacy options.map bag that objectui pins (InterfaceListPage.mapConfig.test.tsx, "CONTROL: the legacy options.map bag is still forwarded on its own path", .objectui-sha f8a9d0fb0) stays accepted and round-trips.

Also in this PR: an ADR-0087 semantic entry view-overlay-options-bag-judged (protocol 18, packages/spec/src/migrations/entries/semantic/, with the regenerated registry.ts region), the strictness-ledger counts (one new strict site), and the changeset (minor, breaking, registered).

Measured before the change (origin/main @ 8d1f7ab)

• H1, the door. On a flat list overlay, timeline.metaFields gives success=false with unrecognized_keys at timeline. options.timeline.metaFields gives success=true, and options is absent from the output. options.foo, options.kanban.groupField and the options.map pin were also all success=true with options stripped.
• H2, the save. Through the real saveMetaItem (stub engine), a flat overlay carrying options.timeline.metaFields gave success: true, and the stored row equalled the request body byte for byte, options included. saveMetaItem stores the request body. The parse output is used only for three grafts (operator spellings, groups to sections, and the page type default from 586934e).
• A pre-existing fall-through. A column-less, type-less body with viewKind: 'list' is accepted by the form overlay member. { viewKind: 'list', sort, searchableFields } parses as { type: 'simple', viewKind: 'list', … }. With timeline.metaFields written directly on such a body, the union also answers success=true. See Acceptance notes.

Stored-row census (ruling item 3)

• objectstack @ 8d1f7ab (examples, dogfood, fixtures, tests): a multi-line search finds 0 view bodies with an options bag holding a kind block. Authored views go through the strict authoring shape, which has always refused options.
• objectui, at the pin f8a9d0fb0 and at main c3a26ccda: 28 options bag literals, plus the finding's own probe body, were judged by this change. 17 pass and 12 fail. Every failure is an out-of-contract key refused by name, and none fails for a missing key.

class	rows	pass	fail: key, and fix
models a stored or authored view (console-merged listViews entry, named view)	8	5	plugin-view ObjectView.tsx docblock options.kanban.groupField: write groupByField. ObjectView.calendarAliasRefused-8355.test.tsx:203 options.calendar.dateField: write startDateField (that test pins the alias as refused on objectui's side already). The finding's options.timeline.metaFields: delete it (objectui#10222 retires the read).
renderer-level ListView props (never reach this door)	21	12	groupField, groupBy, dateField, metaFields, object-bound chart keys (xAxisField, yAxisFields, aggregation). These are the legacy spellings objectui's own refusal pins already retire.

• Production sys_metadata rows: NOT MEASURED. No deployment's store is reachable from here. A stored row that fails is still read and served exactly as stored. It is refused only on its next save, and the refusal names the key.

Decision needed: the persistence half (ruling item 2)

Scoping "persist the parse output" to view is clean in code: it is one branch in saveMetaItem, which already branches on view. What it does to stored bytes was measured through the real saveMetaItem on 8d1f7ab, comparing the stored body against the view schema's parse output:

body	what the parse output drops or adds
console personalization overlay (isPinned, sortOrder, row ids)	strips isPinned, sortOrder, sort[].id and filter[].id
ADR-0005 addendum (c) auxiliary keys	strips isPinned, sortOrder and objectName
ViewItem record with the switcher's row state	strips visibility, the inner keys of columnState it does not declare, and config.sort[].id
flat form overlay	strips isPinned and sortOrder
column-less list overlay (the form-arm fall-through)	destroys the view: strips sort and searchableFields, and adds type: 'simple'
legacy exportOptions: ['csv']	rewrites it to { formats: ['csv'] } and adds type: 'grid'
a timeline block	adds scale: 'week'

objectui reads isPinned, sortOrder and visibility back from stored rows: ObjectView.tsx VIEW_ROW_STATE_KEYS and the switcher's tab state, and ViewTabBar groups tabs on visibility. The row ids are re-stamped on load, so losing them is harmless. ADR-0005 addendum (c) records the opposite decision ("The persisted document is the original request.item, NOT parsed.data"), and three pins in this repo guard it. The options, cost and recommendation are in the PM report. The short form:

• B (recommended): keep the store as it is. The door half above already makes every stored options bag one the door judged.
• A: persist the parse output. Its prerequisites are the form-arm fix, declaring every console round-trip key on each wire face, and an ADR-0005 amendment (Tier H).
• C: graft only the parsed options onto the stored body.

Acceptance notes

• The form-arm fall-through above is a pre-existing defect of the same class. It is reported to the PM for filing, not fixed here: the fix, whether per-arm viewKind literals or list-only guards on the form member, is a design choice with no pinned form. This PR closes it only for bodies that carry options.
• The ViewItem record member (.strip()) also drops a top-level options unjudged. It is not judged here. objectui's mergeViewsIntoObjects reads a record's config only, so no render reach was found.
• The claim's Clause-②: no carries no (narrowing) arm, although this diff is an accept-set narrowing. The changeset declares breaking through fix(spec)!: and **BREAKING** and registers its ADR-0087 entry, so the gate judges it as breaking either way.

Tests and gates

The suites ran at 62be049ab8. The one later commit, 1c6a4eb17a, edits a comment in the new spec pin file, and that file was re-run there (22 passed). The gate union ran at 1c6a4eb17a on a spec dist built from that commit.

• packages/spec, full --project local: 541 files, 15819 tests passed. New pin file src/ui/view-overlay-options-bag.test.ts: 22 tests. Reverse verification swapped the base view.zod.ts in, with the on-disk marker count at 0: 19 failed, 3 passed (the three controls). Restore was proved by git hash-object equal to the HEAD blob and an empty git diff HEAD.
• packages/metadata-protocol, full: 188 files, 2689 tests passed. The save-door pins sit in protocol.graft-folded-form-sections.test.ts, on its engine double that is already pinned: refusal INVALID_METADATA/422 with no row written, and the options.map row round-trips.
• packages/rest, narrowed to the 17 files that PUT or read view bodies: 510 tests passed, including the new meta-view-overlay-options-bag.test.ts, which runs the real RestServer over the real protocol on SQLite. It asserts 422 with code: INVALID_METADATA and an empty store for both spellings, and 200 with an unchanged stored bag.
• packages/runtime, narrowed to the 29 files that reach the save: 510 tests passed.
• typecheck: spec, metadata-protocol and rest all exit 0. check:generated: all 15 artifacts current.
• dispatch-gates --ran: 89 derived. 87 exit 0. 2 are NOT MEASURED (check:dual-build-cjs-loads, check:type-check-debt, exit 3, PREREQUISITE NOT MET: they need the whole-repo build CI runs).
• eslint, narrowed to the 6 changed .ts files: all 6 are in the config's population (--print-config resolves), --format json counts 6 files with 0 errors and 0 warnings, and eslint.config.mjs enables no type-aware linting, so the diff cannot move a verdict on an untouched file.
• NOT MEASURED: the red leg of the metadata-protocol and rest pins against a base dist (it needs two extra spec rebuilds). The base behaviour at that door is the H2 reading above.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 7 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/kernel/services-checklist.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/protocol/objectui/index.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))
• content/docs/ui/forms.mdx (via /api/v1/meta/view/:name (route, a path literal in semantic; a path literal in surface))

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 207 client-bound route-ledger rows — the other 153 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 153: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 98 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 471f1dfaf516190d2193cf72ca157a20586fd0de — the merge of head 2526e4052e742ee2f2d9a6a93c2e653efb093e1f into base 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 471f1dfaf516190d2193cf72ca157a20586fd0de && git checkout 471f1dfaf516190d2193cf72ca157a20586fd0de
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a 2526e4052e742ee2f2d9a6a93c2e653efb093e1f && git checkout -B drift-repro 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a && git merge --no-ff 2526e4052e742ee2f2d9a6a93c2e653efb093e1f

node scripts/docs-audit/affected-docs.mjs --json 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0bd11261efd82e05fa09a574ff86ab9a0c6ce33a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 150/150 CONTRACT_REVIEW_TIER
Head-sha: 1c6a4eb17af762af0174f0f6ef578d37199d8238

① Derived judgments

1. Every options.KIND is judged, and the kinds are derived from the shape — PASS.
   • listViewKindBlocks() intersects overlayTypeValues(ListViewShapeSchema) with the shape's blocks: kinds calendar, chart, gallery, gantt, kanban, map, timeline, tree, with additionalProperties: false.
   • A probe over the head view.zod.ts:
     • options.timeline.metaFields → unrecognized_keys at options.timeline, with a message byte-identical to the direct timeline.metaFields;
     • options.foo → unrecognized_keys at options;
     • options: null or [] → invalid_type.
   • On origin/main all of these parsed, with options stripped (H1 confirmed).
2. .partial(), key by key — PASS.
   • No refusal is lost for a key that is present: options.gallery.cardSize=huge, options.chart.values=[], options.chart.chartType=radar, options.tree.defaultExpandedDepth=-1, options.map.zoom=99, a padded options.kanban.groupByField, options.kanban.limit (guidance) and options.gantt.interactions.drag (alias). Each is refused at the same sub-path with the same message as the direct spelling.
   • Only a required-key omission differs, by design; objectui pins that population (ObjectView.namedViewProtocolKeys-8980.test.tsx:281-293).
   • Residual, non-blocking: at f8a9d0fb0, ListView.tsx:170,206 reads options.chart and options.tree wholesale. So the changeset sentence 「the renderer reads the bag as a per-key underlay」 is over-general for those two kinds. The view.zod.ts docblock correctly names only the six spreading kinds.
3. The form overlay pins options absent — PASS.
   • A form without options, or with options: undefined, parses. {}, null and a bag are refused.
   • No legitimate writer sends it: objectui saves go through viewEnvelope or buildPersistedViewBody (app-shell ObjectView.tsx:1065-1073).
   • Admitted side effect: a column-less list body carrying a legal bag is now refused at columns (a branch tie). No console path produces such a body.
4. Legitimate saves — PASS.
   • The options.map pin body (InterfaceListPage.mapConfig.test.tsx:155-161) parses, and the bag is kept.
   • objectstack census: 0 kind-bearing bags outside the new tests.
   • The objectui census selection is not reproducible from the body (49 / 59 raw hits against 「28 literals」), but its named failures check out: plugin-view ObjectView.tsx:743 options.kanban.groupField, and calendarAliasRefused-8355.test.tsx:203 options.calendar.dateField.
5. Sentence truth — PASS.
   • protocol.ts:16110-16150 at head stores the request body (after the two existing grafts), and no sentence claims parsed persistence.
   • Imprecision only: the spec test docblock's 「a legal options.KIND … round-trips」 holds at the store; the parse output adds block defaults.
6. ADR-0087 route and registry — PASS.
   • A semantic D3 entry is the right route: which key a refused row meant is the author's call, so there is no lossless conversion.
   • The registry region equals the entry file verbatim and sits in id order.
   • The ledger strictObject( count goes 57→58, which matches counts.md.
   • CI at head: 39 check runs, none failed.

② Semver level

Correct: minor + fix(spec)!: + **BREAKING** + adr-0087: registered view-overlay-options-bag-judged, under check-changeset-no-major and the ADR-0087 amendment (pre-GA breaks ship minor). Clause-②: no is the right value, since the card widens neither the accept set nor the public surface. The gate reads it as breaking from the other signals.

③ Boundary flags

• Persistence half returned to the PM: sound. Ruling item 2 collides with ADR-0005 addendum (c) and three pins, and the card stays open under Part of.
• Form-arm fall-through: pre-existing and confirmed; filed as spec(ui): a flattened viewKind: 'list' view overlay with no columns is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186.
• A ViewItem record's top-level options dropped unjudged: confirmed; no render reach found.
• Clause-② arm absent: acceptable.
• Production sys_metadata rows NOT MEASURED: honest. Ruling item 3 wanted stored rows, and only a repository census was possible from this container.
• Red leg of the protocol / rest pins against a base dist NOT MEASURED: acceptable, because the spec-level probe and the save-path source establish the base behaviour.

Implemented-by: claude/issue-20051-view-overlay-options-kind-door
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Merge-queue kick-out — PR #20183 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T07:28Z

• Reason: github-merge-queue[bot] dequeued this PR at 2026-09-27T07:27Z with MERGE_CONFLICT. Head 1c6a4eb17a is unchanged.
• The conflict, read by git merge-tree --write-tree origin/main 1c6a4eb17a on origin/main d7c024133e: exactly one path, packages/spec/src/migrations/registry.ts. Both sides add an ADR-0087 registration to its generated region, this PR's and the one PR feat(spec): a stored record-form filter at the rule-array doors converts to the rule array where lossless — D2 page-component-filter-record-to-rule-array (#17321) #20175 (decision: should the losslessly mappable subset of the record-form filter get a real D2 conversion, or is "stored rows keep loading, re-saving is refused" the final answer? #17321) merged as d7c024133e. packages/spec/src/ui/view.zod.ts auto-merges.
• Disposition (landing-operations.md, a base missing a merged change): merge main into this branch, re-run pnpm --filter @objectstack/spec gen:migration-registry on the merged tree, and assert both registrations are present. ⛔ Never hand-resolve the generated hunk. ⛔ No rebase and no force-push. After that come check:migration-registry and a new commit, then a push. ⛔ Re-queueing unchanged would not help: the conflict is real.
• Review consequence: registry.ts is a mixed file, deliberately outside merge=os-regen (see .gitattributes). So the merge commit is not a pure-regeneration hop, and the record 5853517076 does not carry forward. A fresh at-tier record on the new head comes before the PR is re-queued.
• When: the merge goes out as soon as one of this seat's batch slots frees; all 5 are in flight now. Until then the PR stays out of the queue, and auto-merge is off.

[objectstack-fleet]

Contract review

Served-tier: 65/65 CONTRACT_REVIEW_TIER
Head-sha: 2526e4052e742ee2f2d9a6a93c2e653efb093e1f

① Derived judgments

1. Merge integrity (a)-(c) — PASS, from git. Head unmoved. (a) git diff --name-status 0bd11261ef..2526e405 vs 8d1f7ab7..1c6a4eb17a: identical 8-file lists; per-file diff-of-diffs (index/hunk lines dropped) SAME for all six hand-written files, view.zod.ts included; DIFFER only registry.ts, counts.md. (b) PR-only commits since the old head: two merges, 69c7f3100c (registry.ts only, +41) and 2526e405 (counts.md only, 12/12). Registry delta vs base is the same 41-line entry block, now in id order before view-pagination-page-size-default-50; counts delta is the same +1 (ui/ 179→180, strict 169→170, view.zod.ts 61→62) on main's new totals (453). Head registry: 255 ids, 0 duplicates, each entry file's id exactly once, all 25 entries main added since the fork present. CI at head: "Migration registry matches its entry files" and "Check the strictness ledger matches the code" both success. (c) Main's only view.zod.ts change in 8d1f7ab7..0bd11261ef is pageSize .default(25)→.default(50) (l.1109), outside every PR hunk; the rule-array work touched migration entries only; the 2 commits after the base touch none of view.zod.ts, protocol.ts, migrations. No old-record item rests on a moved line; each below was re-probed anyway.

2. Every options.KIND judged, kinds derived — PASS. listViewKindBlocks() (view.zod.ts:5644) = overlayTypeValues(ListViewShapeSchema) ∩ shape blocks. Probe on head spec, zod 4.6.1: kinds calendar,chart,gallery,gantt,kanban,map,timeline,tree, additionalProperties:false; enum minus kinds = grid; blocks named after an enum value = kinds. options.timeline.metaFields → unrecognized_keys at options.timeline, keys:[metaFields], message byte-equal to the direct spelling; options.foo → unrecognized_keys at options; null/[]/'map'/1 → invalid_type. Base control on main's spec at 0bd11261ef: every one ACCEPTED with options absent from output.

3. .partial() key by key — PASS. zod 4.6.1 .partial() throws on refinements (probed), and all eight blocks carry 0 checks direct and wrapped, so nothing is dropped silently. 17 present-key cases (groupField, dateField, limit, padded groupByField, cardSize:huge, chartType:radar, values:[], legacy chart keys, defaultExpandedDepth:-1, parentField:7, zoom:99/0, interactions.drag, gantt.scale, calendar.view) plus 8 unknown-key cases: 0 parity failures. Only required-key omission differs, which the ruling's C-rejection and the objectui per-key pin (namedViewProtocolKeys-8980.test.tsx:281, same at c3a26ccda) justify.

4. Form overlay pins options absent — PASS. Plain form, options: undefined, and a form with isPinned/sortOrder/sections parse; {}, null, a bag → refused at options with the list-view prescription. Base control: form + bag ACCEPTED (stripped); column-less list body + bag ACCEPTED via the form arm — the fall-through the pin closes. No writer sends it: objectui saves go through buildPersistedViewBody/viewEnvelope (no options); objectstack src has no form body with a kind-keyed bag.

5. Legitimate saves — PASS. options.map pin body parses, bag kept; partial kanban underlay parses; console-shaped bag parses; options: {} accepted. Residual: a column-less list body with a LEGAL bag now refuses at columns (before: taken by the form arm as type:'simple'); no producer found. kanban:{groupByField} without columns refuses identically at head and base (pre-existing).

6. Sentence truth — PASS, two imprecisions. saveMetaItem (protocol.ts:16199-16208) stores request.item after exactly the three grafts named; no read-side parse of a view exists; no sentence claims parsed persistence. Imprecise, not false: (i) changeset "the renderer reads the bag as a per-key underlay" is over-general — ListView.tsx reads options.chart (l.206) and options.tree (l.3370) wholesale at the pin and at objectui main; the view.zod.ts docblock names only the six spreading kinds. (ii) spec-test docblock "round-trips" holds at the store; parse output adds defaults (options.timeline gains scale:'week'). Residual: ListView.tsx:3005 (pin) / :3216 (main) spreads schema.options?.grid into grid props — an unjudged channel with no schema; refusing options.grid (disclosed in FROM→TO) is the only ruling-consistent choice; 0 literals in either repo.

7. ADR-0087 route + generated files — PASS. 0087 D2 (l.153) sends what cannot be converted to D3, fed by "semantic changes authored" (l.175); which key a row meant is the author's, so semantic is right. Registry/counts: item 1. strictObject( in view.zod.ts 57→58.

② Semver level

Correct. minor + fix(spec)!: + **BREAKING** + adr-0087: registered view-overlay-options-bag-judged. check-changeset-no-major.mjs:47 "During the launch window we ship breaking changes as minor"; check-adr-0087-registration.mjs:634-641 reads bang and BREAKING as breaking signals, so the arm is redundant; AGENTS.md:1074 makes the arm optional. Clause-②: no is right — nothing widens. CI "Require an ADR-0087 disposition on a declared-breaking changeset": success.

③ Boundary flags

• Persistence half returned to the PM: sound — card stays open under Part of (CI "Part-of PR must not also close its card" success); ADR-0005 (c) and its pins collide with ruling item 2.
• Form-arm fall-through: pre-existing (base control), filed as spec(ui): a flattened viewKind: 'list' view overlay with no columns is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 (open).
• ViewItem record drops top-level options unjudged: TRUE at head and base (probed); outside the ruled door.
• Clause-② arm absent: acceptable (②).
• Production sys_metadata rows NOT MEASURED: honest; repository census only.
• Red leg of protocol/rest pins NOT MEASURED: acceptable — base behaviour established by the schema-level control and the store-site read.
• objectui census "28 literals / 17 pass / 12 fail" not reproducible from the body (50 raw regex hits at f8a9d0fb0, 60 at c3a26ccda); the named failures check out.

Implemented-by: claude/issue-20051-view-overlay-options-kind-door
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: PASS

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 36310592557 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (5/6) — 失败步骤: Run this shard's tests

  @objectstack/client:test:  FAIL  src/auth-login-register-envelope.test.ts > [#17234] auth.login / auth.register deliver the SessionResponse envelope they declare > ① the declared envelope is delivered
    ↳ 失败原因: @objectstack/client:test: Error: Test timed out in 5000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/auth-login-register-envelope.test.ts — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Queue kick-out 2, new signature — PR #20183 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T10:12Z

• Signature: the queue build 36310592557 failed in Test Core (5/6) › @objectstack/client › src/auth-login-register-envelope.test.ts › [#17234] … ① the declared envelope is delivered › register() parses as the declared envelope, with the payload under data. First error: Test timed out in 5000ms (:273). A timeout, not an assertion.
• Ledger: no queue-flake-anchor issue exists for this file. The triage comment 5854919639 reports it as first seen, with 0 other failed queue builds in 24 h. ⇒ A new signature, so under landing-operations.md ⛔ no re-queue on sight.
• The three facts for one re-queue:
  • ③ First error is a timeout: holds.
  • ② The queue base's same shard is green: holds. Base af32cf9a0e's own queue build 36310549644 passed Test Core (5/6). The PR head's own CI also passed Test Core.
  • ① The failing file's import closure is disjoint from the diff: does not hold strictly. The test imports @objectstack/objectql and @objectstack/spec/api, which reach the spec barrel that carries ui/view.zod.ts. The register path has no call into the view-overlay door, but the fact is about the static closure, so it is not met.
• Initial reading: most likely a load or timing cliff on a heavy auth register() path, not this PR's regression. That is NOT MEASURED yet.
• Next: a read-only diagnosis is running. It runs the one test 8× on base af32cf9a0e and 8× on base+PR, then compares pass counts and register() durations. PR-caused ⇒ back to the claimant. Not PR-caused ⇒ one re-queue, with the measurement recorded here. The same signature a second time ⇒ stop, and it goes to the next seat.

[objectstack-fleet]

Diagnosis of queue kick-out 2, then one re-queue · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T10:55Z

This follows the plan in 5854946276: measure first, then at most one re-queue.

• The measurement was a read-only local reproduction of the one failing file, packages/client/src/auth-login-register-envelope.test.ts, run 8× in each of two trees.
  • BASE = af32cf9a0e, the queue build's base.
  • MERGED = BASE plus this PR's head 2526e4052e, merged locally as 577902de97 and never pushed.
  • Results: 8/8 pass in BASE and 8/8 pass in MERGED, with zero timeouts. The register() duration was 1074 / 1257 / 1390 ms (min / median / max) in BASE and 1075 / 1245 / 1413 ms in MERGED. The distributions overlap completely.
  • The machine was 4 cores, with the load climbing from 2.9 to 5.5 during the runs.
• Budget: vitest's default 5000 ms, not overridden in packages/client/vitest.config.ts. A normal register() uses about 20–28% of it. The time goes to the ObjectQL + SqliteWasmDriver bootstrap and better-auth's first sign-up setup.
• This PR's static link: the spec api barrel re-exports protocol.zod, which imports ui/view. It adds no measured per-call cost, and the medians agree within noise.
• The same signature, independently: PR fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207, which shares nothing with this PR but the base, failed its own PR-side Test Core (5/6) on this exact test at 10:26Z (5855068736 on fix(spec)!: a dataset or measure filter with a list inside a nested relation is refused on save (#20080) #20207). Of the last 50 merge_group CI runs, only this one failed with this signature.
• Verdict: NOT PR-CAUSED. It is a timing cliff under CI load. Fact ① (the static import closure) is now answered by measurement rather than by the closure alone.
• Action: ONE re-queue of the unchanged head 2526e4052e. Its same-head at-tier record 5854622689 (PASS 65/65) stands. It merges cleanly against current main 3875ae6773 (checked without the merge driver). If the same signature ejects it again, it stops, and it goes to the next seat.
• The test's time budget under CI concurrency belongs to packages/client. This seat only records the hit here, ⛔ adds no flake-table row, and leaves the ledger to the queue-triage workflow's cross-PR anchor.

[objectstack-fleet]

Landing record — PR #20183 merged through the merge queue at 2026-09-27T11:17Z as 6a4aec71d5 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T11:18Z

• Verified by content on origin/main: 6a4aec71d5 is an ancestor.
  • The ADR-0087 entry packages/spec/src/migrations/entries/semantic/18.view-overlay-options-bag-judged.ts is present, and its id is registered once in registry.ts.
  • The [#20051] judged-bag docblock is in packages/spec/src/ui/view.zod.ts.
  • view-overlay-options-bag.test.ts (spec) and meta-view-overlay-options-bag.test.ts (rest) are on main.
• Review chain: ACCEPT 5853397704; two merge-only rounds after the first kick-out (MERGE_CONFLICT); a fresh at-tier PASS on the merged head. The second kick-out was the client register() 5000ms timeout, diagnosed NOT PR-caused in 5855216065 and re-queued once.
• Card: spec(ui)+metadata save: judge a flattened view overlay's top-level options.KIND with the strict per-kind schema and persist the PARSED body — the door half of objectui#10380 #20051 stays open. The PR body's first line is Part of #20051, and the body carries no closing keyword. The door half is landed; the persistence half moves to the maintainer's decision box in this window, with 5853397704 as the analysis.
• Closing-keyword audit: since 11:05Z the repo closed only this PR and PR docs(spec): the currency-chain text states the fixed-mode condition — spec sites 5–10 of the currency-mode closure #20217. No issue was closed.
• Region order released: spec(ui): a flattened viewKind: 'list' view overlay with no columns is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 was region-serial behind this PR in the flattened-overlay union of view.zod.ts. It is seat 1's claim 5855239789, and that claim's serial wait is now cleared.