Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot

Filing-gate category ① (a defect with a measured reach) and ③ (a maintainer direct order). Verbatim, 2026-10-16: the option 「两条都做」, which reads "框架立一张 p0 卡（我认领、派云端会话）：内核构建遇到已安装、已存储的旧元数据里被退役的声明时，按过渡窗口只警告、不拒绝启动；发布时照样拒". The maintainer also directed earlier: 「相关任务都提到最高优先级」.

Reader: the cloud#2899 executor (the maintainer's local session) claims it and dispatches a cloud developer session today. Downstream, cloud's next pin bump carries the fix (cloud#2868).

Dedupe (gh api search/issues total_count, closed issues included):

MisplacedDefaultPageError: 2 (feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places #23708, the change itself; spec: PageTypeSchema says home is "the platform-level landing page" and utility a "floating utility panel", but the landing is the first navigation item and both types render as ordinary inline pages #23610, its spec question).
isDefault home page refused installed package kernel: 12.
retired declaration installed artifact kernel build refuse transition: 34.
None asks for a transition for already-installed packages. The HotCRM-side change is After objectstack#23610 and objectui#12462 ship: sales_home_page drops isDefault and renames its sidebar regions, and one lead.actions.ts comment is corrected hotcrm#2120, shipped in HotCRM 5.0.0.

What happens

a69a40a572 (#23708, feat(spec)!, merged 2026-10-16 02:00Z) refuses isDefault: true on any page that is not a bound record page. The refusal fires when a kernel builds from an installed package, not only when a package is authored or published.

HotCRM 4.0.1, the version installed across hosted environments, declares isDefault: true on its type: 'home' page sales_home_page. On cloud's staging at framework f7e836da1ed3 (it contains a69a40a572, because it had to contain objectstack#23843's fix ae4dfafa15), every environment with HotCRM 4.0.1 installed fails its kernel build:

[KernelManager] kernel build failed {"environmentId":"9930e6cf-…","err":{"name":"MisplacedDefaultPageError","message":"Page \"sales_home_page\" of package \"app.objectstack.hotcrm\": `isDefault: true` is refused on a `type: 'home'` page: it marks the default record page of an object, and nothing reads it on any other …"}}

Reach:

Staging: 10 of 36 environments have HotCRM 4.0.1 installed, and each one is unserved.
Production: the 5 demo environments hold HotCRM 4.0.1, so production cannot take a framework pin that contains a69a40a572 until each one is upgraded.
Not measured: environment-authored (AI-built) pages stored in tenant databases with the same shape would fail the same way. Whether any exist was not measured.

Why the ordering matters: a69a40a572 sits before ae4dfafa15 on main, so cloud has no pin that has the remote-ceremony fix without this refusal.

Workaround in use: upgrading an environment's HotCRM to 5.0.0, which declares no isDefault on its home page. That is per environment and does not cover customer-authored metadata.

Wanted

An already-installed package or stored metadata item carrying a declaration a newer spec retires must not brick the environment's kernel. The lane picks the mechanism, likely the ADR-0087 transition pattern:

refuse at authoring, save and publish (unchanged);
on load of an installed or stored item, drop or ignore the retired declaration with a named warning (MisplacedDefaultPageError becomes a load-time advisory), so the kernel builds.

Apply the same review to the other load-time refusals in the same commit (closed template set, regions). If contract-first rules out any load-time tolerance, return needs_decision with the alternatives instead of building one.

Acceptance:

a kernel built from HotCRM 4.0.1's published bundle (marketplace pkgv of 4.0.1, or the v4.0.1 tag's dist/objectstack.json) boots, with the named warning;
the same page saved or published through the authoring door is still refused;
an ablation of the load-time path turns the boot red.

Related: #23708, #23610, objectstack-ai/hotcrm#2120, objectstack-ai/cloud#2868, objectstack-ai/cloud#2899.

Claim: PM loop round 1 (maintainer direct dispatch)
Session: local_6eb9ec2e-0e3f-410b-9123-9dab7a337b9e (the maintainer's local session, as PM); the developer is a cloud Claude Code session titled "p0 #23904: installed pages must not brick kernels"
Account: hotlong (the card's assignee)
Branch: claude/issue-23904-load-tolerance
Worktree: objectstack-issue-23904 (cloud session)
Domain: domain:spec (the refusal lives in packages/spec/src/ui/page.zod.ts and its load path; triage may re-route)
Seat: not a registered seat: the maintainer's local executor acting as PM on the maintainer's order
File surface: the load-time path of the page checks a69a40a572 added (packages/spec/src/ui/page.zod.ts and where the kernel or metadata loader applies them), their tests, one .changeset/*.md (stop on breach; explain in the report)
Container & model: M, mode:cloud, top tier
Clause-②: yes (a refusal at load becomes a named warning; authoring and publish doors unchanged)
Responsibility: a69a40a572 is this repository's | no platform path loads an installed package that predates it | every hosted environment with HotCRM 4.0.1 installed (10 staging, 5 production) fails its kernel build (measured on staging)
Thread-read: none
Serial constraints cleared: none known on the page schema's load path

Maintainer's orders (2026-10-16, local session, verbatim): the option 「两条都做」 (this card is its framework half) · 「在 objectstack-ai/objectstack 开云端会话处理 #23904」.

Release: the claim above (local_6eb9ec2e…, branch claude/issue-23904-load-tolerance) is withdrawn before any developer started. No branch was pushed and no code was written. The cloud developer session could not be launched from the maintainer's local session.

The maintainer's order, verbatim (2026-10-16): 「23904 你开不了云端会话就等车队处理」. This card returns to pm:queue at priority:p0 for the fleet. It carries no domain:* yet: the refusal is packages/spec/src/ui/page.zod.ts (#23708) on the kernel's load path, so triage routes it. The body's Wanted and Acceptance stand: load-time refusals of retired declarations in installed or stored items become named warnings, authoring and publish still refuse, HotCRM 4.0.1's published bundle boots, and an ablation proves it.

Downstream: cloud's next pin bump carries the fix (objectstack-ai/cloud#2868). Production v18 waits on it, and on cloud#2868 round 11 for HotCRM's catalog-name conflict.

Triage: P0 routed, `domain:spec` · `priority:p0` and `target:v18` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:44Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

The lane is domain:spec. The refusal MisplacedDefaultPageError is packages/spec/src/ui/page.zod.ts (a69a40a572, feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places #23708), and the ADR-0087 transition pattern the card asks for is spec's. packages/spec belongs to the spec seat. The withdrawn claim 6215481679 read it the same way.
- Where the kernel or metadata loader applies the check (packages/core / packages/objectql / packages/metadata*), the claim declares those files on the cross-domain exception path. ⛔ It does not split into a second card: one PR.
Why P0 stands: the reach is measured. 10 of 36 staging environments are unserved, and production cannot take a framework pin that contains a69a40a572 while its 5 demo environments hold HotCRM 4.0.1. The maintainer ordered 「相关任务都提到最高优先级」, and per 6215629596 the fleet now takes it: 「23904 你开不了云端会话就等车队处理」.
For the claiming seat: Clause-②: yes, as the withdrawn claim declared (a load-time refusal becomes a named warning; the authoring and publish doors are unchanged).
- If contract-first rules out any load-time tolerance, return needs_decision with the alternatives, as the card says. ⛔ Do not build one in that case.
- Acceptance as written: HotCRM 4.0.1's published bundle boots with the named warning, the authoring door still refuses, and an ablation turns the boot red.
Downstream: cloud's next pin bump carries the fix (objectstack-ai/cloud#2868).

Claim: PM loop round 14 (second shift, priority:p0, ahead of batch 2) · 2026-10-16T13:23Z · installed and stored pages carrying a declaration #23708 retired must not stop a kernel build; the authoring, save and publish doors keep refusing
Session: session_01LFqdRsuM5nkqoJdHd5ztVk (the seat; the dev is a cloud session whose draft PR carries its own session link)
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23904-installed-page-load-warning (new; the withdrawn claim's claude/issue-23904-load-tolerance was never pushed and is not reused)
Worktree: objectstack-issue-23904
Domain: domain:spec (triage 6215783095); the engine files below are on the cross-domain exception path triage named, one PR
Seat: domain:spec#2 (seat post #18549)
File surface (paths on origin/main 11fea6b000 or later; stop on a breach and explain it in the report):

packages/objectql/src/registry.ts: the two MisplacedDefaultPageError throws a69a40a572 added (the package door refuseDefaultRecordPageConflicts, about :2717, and the per-item package registration, about :4652) and the error class beside them, only as far as the load-time path needs.
packages/spec/src/ui/page.zod.ts and packages/spec/src/ui/default-record-page.ts: the three refusals a69a40a572 added (isDefault off a bound record page, the closed template set with full-width retired, checkPageRegionPlacement), only where a load path applies them.
packages/spec/src/conversions/** and packages/spec/src/migrations/entries/**, only if the measured mechanism is an ADR-0087 load-path conversion entry.
The stored-metadata and kernel-build paths that parse or register a page (packages/metadata*, packages/core), only where measurement shows the refusal fires there.
Their tests, a fixture of HotCRM 4.0.1's published page shape, the liveness rows the change moves, generated artifacts through their generators, and one .changeset/23904-*.md.
⛔ Not skills/**, docs/adr/**, content/docs/releases/** or .claude/**. ⛔ Not HotCRM or cloud (their halves are After objectstack#23610 and objectui#12462 ship: sales_home_page drops isDefault and renames its sidebar regions, and one lead.actions.ts comment is corrected hotcrm#2120 and objectstack-ai/cloud#2868).
Container & model: M, mode:cloud (a cross-package load path proved by booting a kernel from a published bundle), model: CONTRACT_REVIEW_TIER (reason: the maintainer's own claim 6215481679 on this card set "top tier" for this P0; dispatch-gates --tier: no path-derived mandate, Clause-② suspect on packages/spec/src/**). Review: a contract review at CONTRACT_REVIEW_TIER before the queue, because the load door's accept set widens.
Clause-②: yes (a load-time refusal becomes a named warning; the authoring, save and publish doors are unchanged)
Responsibility: a69a40a572 (feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places #23708) is this repository's, landed by this seat | no platform path loads an installed package or stored page that predates it | every hosted environment with HotCRM 4.0.1 installed fails its kernel build: 10 of 36 staging environments measured, and the 5 production demo environments block the framework pin (card body)
Thread-read: 6215783095
Ruling-ref: the maintainer's words in the card body, quoted there: the option 「两条都做」 (framework half: "内核构建遇到已安装、已存储的旧元数据里被退役的声明时，按过渡窗口只警告、不拒绝启动；发布时照样拒") and 「相关任务都提到最高优先级」; in this seat's chat, 2026-10-16: 「23904 现在派」
Serial constraints cleared:
priority:p0 goes ahead of batch 2, on the maintainer's 「23904 现在派」. This seat's other two sessions ([maintainer] validate: the field-no-consumers warning is one 856-character line, printed by validate, build and dev alike — one-line verdict + rule: id + a pointer to the full reasoning (os explain, which today takes only schema names) #22161 slices 18 and 19) have reported and are landing; they touch packages/lint only.
All 16 open PRs' file lists were read in this act. None touches page.zod.ts, default-record-page.ts, packages/objectql/src/registry.ts, packages/metadata* or the kernel boot.
In-flight spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543 (os-elon-musk, claim 6214417833) edits one entry of packages/spec/src/conversions/registry.ts and the conversion suites. If this card's mechanism adds an entry there, the entries are disjoint and whichever lands second merges main. The P0 is not held for it.

os-dev-report

{
 "issue": 23904,
 "status": "done",
 "branch": "claude/issue-23904-installed-page-load-warning",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/23962",
 "session": "session_016MPJ3Y2xUTT42wq9ZiK3MR",
 "premise_still_valid": true,
 "summary": "Mechanism: the ADR-0087 D2 transition, not a registry tolerance switch. Two retired D2 entries (page-is-default-off-record-page-removed, page-template-full-width-to-default; toMajor 18, retiredAfter 17.7.0) that data at rest replays, plus the versioned artifact window opened at the kernel's package registration door (ObjectQL.registerApp / the manifest service) for a body that declares engines.protocol, so an installed HotCRM 4.0.1 body converts with a named warn instead of MisplacedDefaultPageError. Measured: the cloud failure named the registry's own error, which the strict body parse (resolveArtifactPackageOrder) would have pre-empted with a Zod issue at pages.N.template, so the failing chain registers flat bodies with no parse and no artifact file door before the registry; PM premise 2 held on the artifact file doors and failed on that chain, hence the door. Authoring, save and publish doors unchanged (parse refuses); a range-less body (code-registered) and a body with a floor newer than every retirement are still refused at the registry. Reviewed the other two #23708 refusals with the objectui pin daeb77fc84dd: full-width is byte-identical to default (D2 added); unregistered template names and unplaced regions have no lossless rewrite (not converted; the registry never judged them; the strict-parse doors keep refusing them, and HotCRM 4.0.1 is refused at those doors anyway on three ADR-0055 controlled_by_parent objects, a refusal older than #23708). Artifact: built from the v4.0.1 tag with its pinned 17.7.0 toolchain (no dist committed; release API 403 to this session), trimmed to manifests + full pages as the fixture.",
 "tests": "All under os-verify-lock, exit codes captured before any pipe. spec: vitest run src/conversions src/migrations src/ui/page-default-and-region-placement.test.ts src/ui/page.test.ts src/ui/default-record-page.test.ts src/stack-default-record-page.test.ts src/ui/object-refinement-check-exports.test.ts (first run 1155 passed / 2 failed: the #23708 pins of 'no D2 conversion for stored rows', repinned to the new behaviour; rerun of that file 35 passed) + scripts/conversions-major18-merge.test.ts, src/conversions/retired-after.census.test.ts, stored.test.ts, the two new entry tests, conversions.test.ts: 'Test Files 6 passed (6) / Tests 344 passed (344)'. metadata-core: pnpm test exit 0 (artifact-forward-conversion*.test.ts 357 passed after the fixture fix). objectql: registry-installed-package-retired-page-declarations + registry-default-record-page 'Test Files 2 passed (2) / Tests 30 passed (30)'; plus artifact-load-path, registry-artifact-co-ownership, registry-security-catalog-namespace, protocol-install-package, manifest-service-residual-objects exit 0. metadata plugin-artifact-forward-conversion exit 0; runtime app-plugin-artifact-forward-conversion, standalone-stack-option-b-forward-conversion, load-artifact-bundle.granted-permissions exit 0; cloud-connection marketplace-install-local-bundle, -hot-loaded exit 0. Typecheck spec, metadata-core, objectql exit 0. Ablations (both rebuilt/on-disk proven, commit first): (a) D2 entry line deleted from step 18 via ablation-replace --delete --hold, anchor 1 to 0, spec rebuilt: boot test 4 failed / 4 passed (the 4 conversion cases red, 4 refusal controls green); restored via git checkout HEAD, blob 2e91e262 == HEAD, rebuilt, dist preflight present in 8 built files, 8 passed. The mutated-leg --absent preflight exited 4 because the id is also prose in the edited D3 entry (dist/migrations 2 hits remained; the 6 conversion-dist files had lost it: 8 to 2). (b) registration door guard replaced by an unconditional return (src-resolved): 4 failed / 4 passed, restored blob d45112dd == HEAD, git diff HEAD empty.",
 "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 94 families at 9fad187b; each run sequentially with exit captured before any pipe (scratch ran.list); --ran reconciliation: '94 derived, 92 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3), 0 UNRUN', exit 0. Non-zero: check-engine-split-ratio.mjs --days 90 exit 2 (shallow clone, refuses the window: not a finding); check-plugin-teardown-shape.mjs --self-test exit 3 (prerequisite: unshallow clone); pnpm check:dual-build-cjs-loads exit 3 (prerequisite: every package's dist; only the cloud-connection closure was built here). The four spec dist gates (check:api-surface, check:dual-source-exports, check:entry-nameability, check:exported-any) first exited 3 on a stale dist stamp (a test file under src edited after the build) and were rerun on the rebuilt dist: exit 0 each ('public API surface + factory signatures unchanged'). check:yaml-examples appeared in the second derivation and ran: exit 0. check:adr-0087-registration --base origin/main exit 0 (marker: registered page-is-default-off-record-page-removed, page-template-full-width-to-default); check:changeset-no-major, check:empty-changeset, check:spec-changes, check:upgrade-guide, check:liveness, check:docs, check:authorable-surface exit 0. pnpm --filter @objectstack/spec check:generated green after gen:liveness-counts (0 shards rewritten). check-nul-bytes OK. CI families beyond the derived set (Test Core incl. test:repo, Build Core, TypeScript Type Check lanes, dual-build) are the PR's check-runs: in_progress at report time, not re-run locally.",
 "line_budget": "changed lines 2266 (+2235 / -31) across 14 files, under the 3000-line human-merge threshold (dispatch-gates reading); 1380 of the additions are the committed HotCRM 4.0.1 pages fixture (60 KB JSON)",
 "deviations": [
  "HotCRM 4.0.1's artifact was built in the read-only clone (/home/user/objectstack-ai/hotcrm, tag v4.0.1, pnpm install + pnpm build with its pinned @objectstack/cli 17.7.0) in the foreground WITHOUT os-verify-lock: a sister repo's CLI build, not this repo's build/test.",
  "Local verification scope narrowed and declared: spec ran the conversions, migrations, ui page/default-record-page subsets and the step-18 merge test, not the whole spec suite; objectql ran a registry/artifact/manifest-door subset of its 409 test files; test:repo (vitest repo project), the full spec and objectql suites and the repo-wide lint are CI's on the PR.",
  "check:dev-prereqs / check:skill-frame-freshness scan forms not run locally (derived list named only check:dev-prereqs --self-test, exit 0).",
  "The mutated-leg ablation-dist-preflight --absent exited 4 (id string also present as D3-entry prose in dist/migrations); the dist evidence of the mutation is the preflight hit count 8 to 2 plus the red suite; the restore leg's preflight exited 0.",
  "The two liveness notes were first mis-placed by a scripted edit (text landed in a neighbouring status value; caught by gen:liveness-counts refusing) and corrected in commit b6eb12a4 against the base file.",
  "Cloud's KernelManager source was not readable (objectstack-ai/cloud is private to this session); its load chain is inferred from the error name and the in-repo doors, see open_questions.",
  "Clones of objectstack-ai/hotcrm (v4.0.1) and objectstack-ai/objectui (at the pin) were made read-only under /home/user/objectstack-ai for measurement and are removed at the end of the run."
 ],
 "files_changed": [
  ".changeset/23904-installed-page-retired-declarations-convert-at-load.md",
  "packages/metadata-core/src/artifact-forward-conversion.test.ts",
  "packages/metadata-core/src/artifact-forward-conversion.ts",
  "packages/objectql/src/__fixtures__/hotcrm-4.0.1-published-pages.artifact.json",
  "packages/objectql/src/engine.ts",
  "packages/objectql/src/plugin.ts",
  "packages/objectql/src/registry-installed-package-retired-page-declarations.test.ts",
  "packages/spec/liveness/page.json",
  "packages/spec/src/conversions/page-is-default-off-record-page-removed.test.ts",
  "packages/spec/src/conversions/page-template-full-width-to-default.test.ts",
  "packages/spec/src/conversions/registry.ts",
  "packages/spec/src/migrations/entries/semantic/18.page-is-default-off-record-page-refused.ts",
  "packages/spec/src/migrations/entries/semantic/18.page-template-closed-region-unplaced-refused.ts",
  "packages/spec/src/ui/page-default-and-region-placement.test.ts"
 ],
 "mcp_calls": "3 GitHub MCP reads: issue_read get #23904, issue_read get_comments #23904, pull_request_read get #23962; plus 1 claude-code-remote add_repo (read probe for objectstack-ai/hotcrm, nothing attached). No MCP writes.",
 "api_writes": "2 relay strokes (scripts/pm/fleet-write/dispatch.mjs, objectstack-fleet[bot]): pr_create (POST /repos/objectstack-ai/objectstack/pulls draft + POST /issues/23962/assignees, run 38917262697, read back 14635 bytes identical) and this report comment (POST /repos/objectstack-ai/objectstack/issues/23904/comments). git push x4 to the branch (not REST). Zero label writes (dispatch budget), zero PATCH.",
 "open_questions": [
  {
   "question": "Does cloud's KernelManager register installed packages through manifest.register / ObjectQL.registerApp (the door this PR opens the window at) or through protocol.installPackage / registry.installPackage directly (not covered)? The error name says the registry threw with no strict body parse before it, which fits the former; the cloud source could not be read.",
   "options": [
    "A: verify on cloud#2868's pin bump by booting a 4.0.1 environment on staging; if it still fails, the chain is the direct installPackage one",
    "B: also open the window inside SchemaRegistry.installPackage (objectql) so every caller converts, at the cost of a second conversion per registration and of code-registered bodies with a range converting there too",
    "C: open it at the two direct callers (service-package sys_packages hydration, protocol.installPackage) in a follow-up card"
   ],
   "recommendation": "A, then C as its own card if A fails or regardless for the hydration seam (ADR-0087 addendum names every rehydration seam): B duplicates the door inside the registry primitive, which is the second-judge shape the ADR forbids."
  },
  {
   "question": "Unregistered template names (centered, utility-bar) and regions a template does not place (left_sidebar, right_sidebar) stay unconverted, so the strict-parse artifact doors (os start --artifact, createStandaloneStack) keep refusing a 17.x-built artifact that carries them, while stored rows warn and serve. Should the artifact door take the stored-row posture (warn + serve) for shapes with no lossless rewrite?",
   "options": [
    "A: leave as is: the D2 scope is lossless rewrites, the artifact door's post-conversion refusal is the recorded policy, and HotCRM 4.0.1 is refused at that door anyway on three ADR-0055 controlled_by_parent objects older than #23708",
    "B: change the artifact door to warn and serve what fails the parse after conversion (an ADR-0087 addendum decision)"
   ],
   "recommendation": "A: no measured producer needs the artifact file door for 4.0.1 (the measured chain is the registry), B is a door-policy change for the maintainer, and the unregistered-name mapping would rewrite shapes a conversion cannot positively name."
  },
  {
   "question": "Should the registration door's window also open for a body with NO declared range (today: left untouched, refused as before), as the artifact file doors do (converted-undeclared)?",
   "options": [
    "A: no, keep range-less = code-registered = strict (as landed)",
    "B: yes, align with the file doors' undeclared amnesty"
   ],
   "recommendation": "A: a range-less manifest at this door is a plugin's hand-built manifest with an author, and the registry's refusals are the only judge such metadata ever meets (axis 3); every built artifact declares its range."
  }
 ],
 "out_of_scope_findings": [
  "class: b · reach: not measured live; code path: packages/services/service-package/src/index.ts boot hydration calls registry.installPackage(rec.manifest) for sys_packages rows, and packages/metadata-protocol protocol.installPackage (POST /api/v1/packages) does the same, both bypassing registerApp, so a stored package record carrying a retired page declaration still meets MisplacedDefaultPageError there (hydration catches it: the package is silently absent after restart) · Seam: spec:ADR-0087 addendum 2026-07-31 (every stored-row rehydration seam replays the FULL chain) → runtime:service-package hydration loop | consumer: SchemaRegistry.installPackage · dedupe: sys_packages hydration conversion, installPackage replay chain, rehydrate retired declaration · carrier: none (seat to file)",
  "class: b · reach: not measured; code path: packages/cloud-connection/src/marketplace-install-local-plugin.ts hands the fetched bundle to manifest.register (now converted there) but bindArtifactHandlers and applySideEffects read the raw ledger entry (hooks, jobs, translations unconverted) · Seam: spec:ADR-0087 artifact window (#12772) → runtime:marketplace-install-local-plugin.ts side readers | consumer: the artifact handler binder and translation replay · dedupe: marketplace install forward conversion, ledger rehydrate convert, bindArtifactHandlers raw manifest · carrier: none",
  "carrier: objectstack-ai/hotcrm#2120 (shipped 5.0.0) · noted, not filed: HotCRM 4.0.1's artifact also carries template centered / utility-bar, left_sidebar / right_sidebar regions, and three controlled_by_parent objects without a required master_detail (ADR-0055), so it is refused at the strict-parse artifact doors independently of this card"
 ]
}

os-dev-report

{
 "issue": 23904,
 "round": 2,
 "status": "done",
 "branch": "claude/issue-23904-installed-page-load-warning",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/23962",
 "head": "6c52a63b",
 "session": "session_016MPJ3Y2xUTT42wq9ZiK3MR",
 "premise_still_valid": true,
 "summary": "Patch round for the contract review FAIL (PR comment 6218504915): both red Test Core shards were this PR's, read from the job logs. Shard 1/6 (spec, job 117028249972): src/shared/retired-key-removal-version.pin.test.ts > 'every entry retired after the newest published stable release is joined to its prescriptions' — AssertionError 'retired after 17.7.0, the newest published stable release: add each to JOIN in this file ... expected [ …(2) ] to deeply equal []' (the two new D2 entries had no JOIN row; the pin also requires each prescription to name the release the entry derives, @objectstack/spec 18). Shard 5/6 (objectql, job 117028250035): src/default-record-page-save-door.test.ts, 4 cases on both kernel topologies — 'a home page with isDefault: true, ALREADY stored: the read serves the row as stored' (expected undefined to equal true) and 'the retired full-width template, ALREADY stored' (expected 'default' to equal 'full-width'): #23610's pins that a stored row reads back unconverted, which this PR's data-at-rest conversion changes by design. Fixes (commit 6c52a63b): (1) JOIN rows for page-is-default-off-record-page-removed (the parse refusal at isDefault for a home page and for an unbound record page) and page-template-full-width-to-default (the enum refusal at template); (2) misplacedDefaultPageRefusal (packages/spec/src/ui/default-record-page.ts) now names the release in both variants — '… is refused on a type home page since @objectstack/spec 18: …' / '… bound to no object since @objectstack/spec 18: …' — the sentence the parse, the save door and the registry door all print; every existing pin asserts the prefix up to 'page' / 'object' or a contained fragment, so none moved; (3) the save-door stored-row cases now carry a served shape: the isDefault and full-width rows read back converted through applyConversionsToStoredItem (flag absent / template default), the unplaced-region row as stored, and saving the row as stored stays refused 422. No door moved in this round; sections ①–③ of the review stand. Neither failure is red on main (both files are this PR's own subject: the JOIN rule fires only for entries this PR adds, and the save-door pins fail only once the conversion exists).",
 "tests": "Under os-verify-lock, exit captured before any pipe, at 6c52a63b after pnpm --filter @objectstack/spec build (exit 0) and the objectql dependency closure build (exit 0). Quick repin check: spec vitest run retired-key-removal-version.pin.test.ts page-default-and-region-placement.test.ts page-is-default-off-record-page-removed.test.ts → 'Test Files 3 passed (3) / Tests 81 passed (81)'; objectql vitest run default-record-page-save-door.test.ts registry-default-record-page.test.ts registry-installed-package-retired-page-declarations.test.ts → 'Test Files 3 passed (3) / Tests 64 passed (64)'. FULL suites, the two CI shards reproduced locally: pnpm --filter @objectstack/spec test → exit 0, 'Test Files 687 passed (687) / Tests 20915 passed | 1 todo (20916)'; pnpm --filter @objectstack/objectql test → exit 0, 'Test Files 435 passed (435) / Tests 8221 passed (8221)' (lock held 698s for the whole script). metadata-core artifact-forward-conversion.test.ts and typecheck spec / objectql: see tc readings below. No ablation this round: no tested behaviour of the fix changed, only pins and one sentence.",
 "tc": "Under the lock at 6c52a63b: pnpm --filter @objectstack/spec typecheck exit 0; pnpm --filter @objectstack/objectql typecheck exit 0; metadata-core artifact-forward-conversion.test.ts Test Files 1 passed / Tests 197 passed",
 "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack re-derived at 6c52a63b: 94 families (same set as round 1); each run sequentially after the full suites, exit captured before any pipe; --ran reconciliation: '94 derived, 92 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3), 0 UNRUN', exit 0. Non-zero: check-engine-split-ratio.mjs --days 90 exit 2 (shallow clone, not a finding); check-plugin-teardown-shape.mjs --self-test exit 3 and pnpm check:dual-build-cjs-loads exit 3 (prerequisites: unshallow clone / every package's dist), both CI's. All four spec dist gates (api-surface, dual-source-exports, entry-nameability, exported-any) exit 0 on this head's dist; check:adr-0087-registration, check:empty-changeset, check:changeset-no-major, check:spec-changes, check:upgrade-guide, check:liveness, check:docs, check:authorable-surface, check:yaml-examples exit 0. CI at 6c52a63b: the PR's check-runs, in_progress at report time.",
 "line_budget": "round-2 delta +41 / -11 in 3 files (default-record-page.ts sentence + docblock, the JOIN rows, the save-door repin); PR total stays under the 3000-line human-merge threshold",
 "deviations": [
  "The worktree had been removed after round 1 per the clean-up rule; it was recreated from the pushed branch (git worktree add on the existing local branch) and the dependency closure rebuilt before any test.",
  "The two CI job logs were read with the GitHub MCP get_job_logs tool as the PM asked; each exceeded the tool's inline size and was grepped from the saved result file for FAIL / AssertionError lines.",
  "Gate union re-derived and rerun at the new head; the spec dist gates read a dist built from this head's src in the same locked script (no stale stamp this time)."
 ],
 "files_changed": [
  "packages/objectql/src/default-record-page-save-door.test.ts",
  "packages/spec/src/shared/retired-key-removal-version.pin.test.ts",
  "packages/spec/src/ui/default-record-page.ts"
 ],
 "mcp_calls": "This round 4 GitHub MCP reads: get_job_logs 117028249972, get_job_logs 117028250035, issue_read get_comments #23962 (the review 6218504915), plus the ToolSearch load; no MCP writes. Round-1 count stands at 3 reads + 1 add_repo probe.",
 "api_writes": "This round: git push x1 (6c52a63b) and 1 relay stroke for this report comment (POST /repos/objectstack-ai/objectstack/issues/23904/comments). Zero label writes, zero PATCH, no PR body edit (the PR body's 'Readings taken at 9fad187b' line is now one commit behind; the seat may note it — the dev does not PATCH).",
 "open_questions": [],
 "out_of_scope_findings": []
}

Landed · PR #23962 → `d050a8fc63` (`Fixes #23904`, `priority:p0`) · `domain:spec` seat 2 · `os-bill` · session `session_01LFqdRsuM5nkqoJdHd5ztVk` · 2026-10-16T17:11Z

probe	reading
PR object	merged 2026-10-16T17:06Z out of the merge queue, as squash `d050a8fc63` on parent `b25d98a46f`
`origin/main`	`git merge-base --is-ancestor d050a8fc63 origin/main` → exit 0
merged vs reviewed head	the squash tree `8edc0ad094` equals `git merge-tree --write-tree b25d98a46f 6c52a63bd1` (the clean merge of its parent with the reviewed head). The two patch-ids differ, `0e3ed1b3` against `12ee4a28`, because `main` changed three of this PR's files after its base `11fea6b000`. They are `conversions/registry.ts`, `retired-key-removal-version.pin.test.ts` and `artifact-forward-conversion.test.ts`, and they merged clean
queue branch	no `gh-readonly-queue/main/pr-23962-*` ref remains
card	closed `completed` by `Fixes #23904`; `pm:dispatched` cleared in this act

What holds on main now.

An installed package or stored page that carries a declaration feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places #23708 retired is converted forward on load, with a named warning, instead of stopping the kernel build:
- isDefault: true off a bound record page is deleted;
- template: 'full-width' becomes default.
Where the conversion runs:
- ObjectQL.registerApp and the manifest service, for a body that declares engines.protocol;
- sys_metadata rows, through the ADR-0087 data-at-rest replay.
os validate, os build, the metadata save door and publish refuse exactly as before. The refusal sentence now names "since @objectstack/spec 18".
HotCRM 4.0.1's published pages boot in the pinned test with the named warning.

Chain:

claim 6216456972, on the maintainer's 「23904 现在派」
reports 6217917388 (round 1) and 6219350488 (round 2)
contract review FAIL 6218504915 (red Test Core shards only), then PASS 6219729876
seat ACCEPT 6219754551
the queue was armed only after the lane's main-red fix, Console pin does not build on main: objectui daeb77fc imports checkPageComponentViewData, deleted from spec by #23784 #23908 / PR chore(objectui): move the console pin to f8267df93aba, past the spec deletion of checkPageComponentViewData #23973, had merged (skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998 rule 3).

Still owed, outside this repository's merge:

The cloud side. objectstack-ai/cloud#2868's pin bump has to boot a staging environment that holds HotCRM 4.0.1, and the boot has to show the named warning. That boot is the only proof that the hosted KernelManager takes the registerApp door, so it is the proof this card's reach is closed.
Doors outside this window. sys_packages hydration, POST /api/v1/packages and the marketplace install's side readers are Package doors outside #23904's window still meet a retired page declaration unconverted: sys_packages boot hydration and POST /api/v1/packages call registry.installPackage directly, and the marketplace install's side readers read the raw ledger entry #23974. It is a P0 suspect, and the knock to triage is 6218576497 on [PM seat] triage (objectstack-wide) — 🟢 Routine · session_01AavokzJ5DndAwitDXvKy4U · trig_01NcnCtMS2tH46nUg1a5TaMJ (hourly) · state = body + the round records newer than it #6015.

Generated by Claude Code

Navigation Menu

Repository navigation

Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904

What happens

Wanted

Triage: P0 routed, `domain:spec` · `priority:p0` and `target:v18` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:44Z

Landed · PR #23962 → `d050a8fc63` (`Fixes #23904`, `priority:p0`) · `domain:spec` seat 2 · `os-bill` · session `session_01LFqdRsuM5nkqoJdHd5ztVk` · 2026-10-16T17:11Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904

Description

What happens

Wanted

Activity

hotlong commented on Oct 16, 2026

hotlong commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Triage: P0 routed, domain:spec · priority:p0 and target:v18 stand · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T12:44Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Landed · PR #23962 → d050a8fc63 (Fixes #23904, priority:p0) · domain:spec seat 2 · os-bill · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-16T17:11Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: P0 routed, `domain:spec` · `priority:p0` and `target:v18` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:44Z

Landed · PR #23962 → `d050a8fc63` (`Fixes #23904`, `priority:p0`) · `domain:spec` seat 2 · `os-bill` · session `session_01LFqdRsuM5nkqoJdHd5ztVk` · 2026-10-16T17:11Z