docs(plugin-detail): drop spec version stamps from the new prose; correct the pending objectui#10058 changeset (objectui#10224)

check:installed-pin-claims read "Through 17.4.0" in the gate pin's header
as a present-tense claim about the installed spec and failed it. The new
prose now names objectstack#18159 instead of a version, in the pin header
and in the registration comment, so the next spec bump has nothing to
restamp.

The pending objectui#10058 changeset says an unheld capability "hides the
whole bar" and quotes the contract's retired wording. It ships in the same
release as this change, which publishes the notice behaviour, so it gets a
dated, append-only correction in the shape objectui#8649 gave the sibling
objectui#10155 changeset. Its frontmatter and every earlier byte are
unchanged.

Claude-Session: https://claude.ai/code/session_01VhxTqosz7wn54ahqyxgERT
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/10058-quick-actions-capability-gate.md

@@ -42,3 +42,16 @@ REPORTED empty array is a real answer and gates strictly.
 
 `perms.can()` itself is untouched: no other caller moves, and the full
 before/after truth table of both stock providers is pinned as unchanged.
+
+**Correction, 2026-10-01 (objectui#10224).** The phrase "hides the whole bar"
+above is wrong about what the reader sees. When a declared capability is unheld or
+unrecognised, no action is drawn and an insufficient-permissions notice
+(`role="status"`) renders where the bar would be. That is what the contract's
+shared record-block `requiredPermissions` describe says: "this block does not
+render its content; wherever it would otherwise render, an
+insufficient-permissions notice takes its place". The `record:quick_actions`
+registration now publishes that describe verbatim, in place of "Hide the whole
+bar unless the user holds these permissions", and the contract wording quoted
+in the first paragraph is retired upstream (objectstack#18159). Everything
+else above stands: the capabilities the gate asks for, its fail-closed
+verdict, and the fail-open when capabilities are unreported.

packages/plugin-detail/src/index.tsx

@@ -876,10 +876,10 @@ ComponentRegistry.register('quick_actions', RecordQuickActionsRenderer, {
     // Implementing the fallback would be a behaviour expansion and needs its own
     // card; pinned by `recordQuickActionsInputs.actionNamesFallback.test.tsx`.
     { name: 'actionNames', type: 'array', of: 'string', description: 'Action names to expose, in order — resolved from the actions declared on the object. With no names (and no host-supplied actions) nothing is looked up and the bar renders its empty placeholder' },
-    // The contract's shared record-block describe, verbatim (`@objectstack/spec`
-    // 17.5.0, objectstack#18159): `record:quick_actions` carries the one text
-    // `record:details`, `record:highlights` and `record:related_list` share, and
-    // objectui#8649 already publishes it on those three. This input used to read
+    // The contract's shared record-block describe, verbatim (objectstack#18159):
+    // `record:quick_actions` carries the one text `record:details`,
+    // `record:highlights` and `record:related_list` share, and objectui#8649
+    // already publishes it on those three. This input used to read
     // "Hide the whole bar unless the user holds these permissions", which is not
     // what the renderer does: the gate reads the CAPABILITY set
     // (`perms.hasCapabilities`, objectui#10058), puts a `role="status"`

packages/plugin-detail/src/renderers/__tests__/record-quick-actions.requiredPermissions-gate.test.tsx

@@ -8,16 +8,16 @@
 
 /**
  * `record:quick_actions.requiredPermissions` — the BLOCK-LEVEL gate
- * (objectui#8071 slice 4). The installed contract (`@objectstack/spec` 17.5.0,
- * objectstack#18159) describes it with the one record-block describe this key
- * shares with `record:details`, `record:highlights` and `record:related_list`:
- * ALL the named capabilities must be held, and when one is missing "an
- * insufficient-permissions notice takes its place". The registration publishes
- * that describe verbatim, and the last block below re-reads it off the
- * installed spec (objectui#10224). Through 17.4.0 the contract said "Hide the
- * whole bar unless the current user holds every named permission on this
- * object", and the registration said "Hide the whole bar unless the user holds
- * these permissions"; neither named the notice the renderer draws.
+ * (objectui#8071 slice 4). Since objectstack#18159 the contract describes it
+ * with the one record-block describe this key shares with `record:details`,
+ * `record:highlights` and `record:related_list`: ALL the named capabilities
+ * must be held, and when one is missing "an insufficient-permissions notice
+ * takes its place". The registration publishes that describe verbatim, and the
+ * last block below re-reads it off the installed spec (objectui#10224). Before
+ * objectstack#18159 the contract said "Hide the whole bar unless the current
+ * user holds every named permission on this object", and the registration said
+ * "Hide the whole bar unless the user holds these permissions"; neither named
+ * the notice the renderer draws.
  *
  * ## What this file pins, and why it was rewritten (objectui#10058)
  *