fix(spec): author-facing describes and refusals drop service-interface names, ruling dates and foreign example ids

[objectstack-fleet]

Part of #22093
Clause-②: no

Wording only: no schema, key, type, export or error-code change. Patch changeset for @objectstack/spec, @objectstack/service-automation and @objectstack/platform-objects. objectui#11785 is the Studio half (splitting an author message from the detail); this PR changes the server-side strings only. The card keeps two named remainders, listed under "Remainder of the card and its route" below.

What changed

Form help and refusals that an author reads no longer carry service-interface names (IXxxService.method()), ruling dates ("maintainer ruling DATE", "ruled DATE") or another product's example ids. The rationale they carried moves into the code comment beside each string. Each describe and refusal still states the rule, why it exists and the repair.

How "author-facing" was measured (instrument and radius)

Studio reaches these strings through five routes. I measured each one at a543e244f:

Route	What Studio renders	Instrument
R1	/meta/types schema: every DEFAULT_METADATA_TYPE_REGISTRY type, derived as metadata-protocol derives it (z.toJSONSchema, unrepresentable: 'any', with the io: 'input' retry)	Every description in all 27 type schemas
R2	/meta/types form: all 17 METADATA_FORM_REGISTRY layouts	Every description / helpText / label / placeholder / hint
R3	The package dialog, which derives its form from ManifestSchema client-side (objectui package-schema.ts)	Every description
R4	The flow inspector, which reads node configSchema from GET /api/v1/automation/actions	An AST string scan of every file that declares a configSchema (13 files)
R5	Refusals read at a door	An AST scan of every string literal in packages/spec/src (1284 files, 80190 string parts, comments excluded)

The class patterns were: interface \bI[A-Z]\w*(Service\|Driver\|Engine\|…)\b; ruling \bruling\b\|\bruled\b\|\b20\d\d-\d\d-\d\d\b; foreign steedos\|superset\|salesforce\|apache\|airtable\|….

Positive control: both strings the filer measured are found.

• The notify Template help is found by R4 at service-automation/src/builtin/notify-node.ts:203, as both an interface hit and a ruling hit. The spec copy is found by R5 at io-node-config.zod.ts:250.
• com.steedos.crm is found by R5 at manifest.zod.ts:283.

R1 to R3 found neither string (needle count 0). So the Studio-rendered Template help is produced by the service-automation descriptor, not by the spec describe. That is why the producer side is changed too.

After the change, R1 to R3 hold no interface, ruling or foreign-id hit. The one exception is the "Airtable parity" wording (see Acceptance notes). The needles II18nService, IEmailService, com.steedos.crm and maintainer ruling count 0. The R5 hit count drops by 22.

Every string changed

Lines are at a543e244f. Before is the internal reference that was removed; After is what replaced it. No changed string carried a tracker number, so no tracker number moved.

#	Where	Reach	Before	After	Rationale now lives in
1	services/service-automation/src/builtin/notify-node.ts:203, notify configSchema.properties.template.description	R4: Studio notify Template help (filer-measured)	"else the deployment default (II18nService.getDefaultLocale()) … (maintainer ruling 2026-09-01). A producer-set payload.locale is not consulted."	"else the deployment default locale … The node's payload.locale is not consulted."	Comment above template: in the descriptor
2	spec/src/automation/io-node-config.zod.ts:250, NotifyConfigSchema.template describe	Reference docs and published JSON Schema; the contract row 1 mirrors	Same as row 1, with backticks	Same as row 1	TSDoc above template (it already named both; one sentence added)
3	spec/src/kernel/manifest.zod.ts:283, MANIFEST_ID_EXAMPLES	R5: every package-id refusal (filer-measured on POST /api/v1/packages)	'com.steedos.crm', 'org.apache.superset'	'com.acme.crm', 'org.example.help-desk'	Doc comment on the constant
4	manifest.zod.ts:305, manifestIdRefusal	R5: same doors	"Invalid package id 'VALUE' on manifest.id. Expected reverse-domain notation ('com.steedos.crm', 'org.apache.superset') — …"	"Invalid package id 'VALUE'. A package id (manifest.id) is written in reverse-domain notation, like 'com.acme.crm' or 'org.example.help-desk' — …", with the rule and suggestion arm unchanged	TSDoc on manifestIdRefusal
5	manifest.zod.ts:360-361, @example on id	TSDoc; held equal to row 3	com.steedos.crm, org.apache.superset	com.acme.crm, org.example.help-desk	(none)
6	spec/src/data/field.zod.ts:1142, required describe	R1: object, field	"(maintainer ruling 2026-08-18)"	Removed	TSDoc above required
7	field.zod.ts:1170, multiple describe	R1: object, field	"(maintainer ruling 2026-09-13), and on radio by the narrower 2026-08-22 ruling … (maintainer ruling 2026-08-18)"	"on any other type, radio included, is REFUSED at parse …"	TSDoc above multiple (new Declarability paragraph)
8	spec/src/ui/view.zod.ts:1175 / :1221, GROUPING_FIELD_RULING in the padded grouping-field refusal	R5: view save	"… (ruled 2026-09-10.)"	Removed, constant deleted	Comment where the constant was
9	view.zod.ts:3444, form-view field visibleWhen describe	R1: view	"refused at parse (ruled 2026-08-27):"	"refused at parse:"	TSDoc above
10	view.zod.ts:3655, section collapsible describe	R1: view	"(ruled 2026-09-18)"	Removed	The collapse-pair TSDoc (already records the ruling)
11	view.zod.ts:3663, section collapsed describe	R1: view	"(ruled 2026-09-18; refusing the combination at the declaration, and warning on it, were both rejected — nobody can depend on a section that cannot be opened)"	", so writing collapsed: true alone is a correct way to say "collapsed by default""	The collapse-pair TSDoc (already records the rejected letters)
12	view.zod.ts:3715, form-view section visibleWhen describe	R1: view	"(ruled 2026-08-27)"	Removed	TSDoc above
13	view.zod.ts:3959, SUBMIT_REDIRECT_RULING in seven submitBehavior.url refusals (:3988, :3993, :4003, :4010, :4018, :4029, :4039)	R5: form-view save	"(ruled 2026-08-11)"	Removed, constant deleted	Comment where the constant was
14	view.zod.ts:4097 / :4123, FORM_VIEW_FEATURES_RULING in the features.* predicate refusal	R5: form-view save	"scope root (ruled 2026-08-27)."	"scope root."	Comment where the constant was
15	view.zod.ts:4444, redirect-arm url describe	R1: view	"…successful submit. Ruled 2026-08-11: (1) …"	"…successful submit. (1) …"	The checkSubmitRedirectUrl comment
16	spec/src/ui/page.zod.ts:941 (kind) and :990 (source) describes	R1: page	"(ADR-0065; ADR-0080 amendment 2026-06-30)"	"(ADR-0065; ADR-0080)"	TSDoc above kind (new) and source (already)
17	spec/src/system/email-template.form.ts:19, Identity section help. Its three translated values in platform-objects/src/apps/translations/{zh-CN,ja-JP,es-ES}.metadata-forms.generated.ts:2183 are hand-written, and en is regenerated by pnpm i18n:extract	R2: email_template form	"Template identifier resolved by IEmailService.sendTemplate({ template: name, locale, ... })."	"Senders address this template by its name; the locale selects which language version of it is sent."	Comment above description:
18	spec/src/data/filter.zod.ts:475, null ordering comparand refusal	R5: filter validation	"Ruled 2026-09-01: a null ordering comparand is refused at the validation entrance."	Sentence removed	Builder TSDoc
19	filter.zod.ts:564, { $field } in a list position refusal	R5	"Ruled 2026-08-11: declared = enforced (ADR-0049)."	Sentence removed	Comment inside the builder
20	filter.zod.ts:589, null list member refusal	R5	"Ruled 2026-08-31: a null list member is refused at the validation entrance."	Sentence removed	Builder TSDoc
21	filter.zod.ts:801, blank $between bound refusal	R5	"Ruled 2026-09-17: a blank $between bound is refused at the validation entrance."	Sentence removed	Builder TSDoc
22	spec/src/ui/action.zod.ts:985, action description describe (added in patch round 1)	R1: action, in the authoring (io: 'input') derivation; the action Description help objectui#11785 measured	"(one dialog, not two —)": the dash an earlier strip of the cited ruling left dangling	"(one dialog, not two)"	Docblock above description (already cites the ruling; one sentence added)

The regenerated content/docs/references/** files follow from rows 2, 6, 7, 9 to 12, 15, 16 and 22.

Remainder of the card and its route

This PR delivers the card minus two named rows. It is therefore Part of #22093, and the card stays open for both.

1. The governed submitBehavior row.
   • What: view.zod.ts:4478, the top-level submitBehavior describe, keeps "(ruled 2026-08-11)".
   • Why it is not here: gen:react-blocks projects this describe into skills/objectstack-ui/references/react-blocks.md, which is a governed Tier H surface, so changing it here would make this whole sweep a Tier H landing. Measured: the regenerated skill file differs in exactly that one row.
   • Route: a separate Tier H draft PR carrying the one describe edit, the regenerated react-blocks.md row and its reference-docs row, landed on the maintainer's approval.
   • A comment beside the describe records the deferral.
2. The sys_email field help naming IEmailService.send.
   • What: packages/platform-objects, en.objects.generated.ts:2500 and :2508. The source is in the sys_email object definitions.
   • Why it is not here: open PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 regenerates the same four *.objects.generated.ts bundles, so folding it here would put two PRs on those bundles at once.
   • Route: the same class of edit, made after that PR lands.

Pins

• Refusal code is asserted with the sentence:

  • manifest.test.ts asserts invalid_format.
  • view-form-features-root.test.ts asserts custom.

• Negative pins on what the author reads. No interface name, ruling date or foreign id appears in:

  • io-node-config.test.ts
  • notify-node.test.ts, on the Studio-served descriptor text
  • manifest.test.ts. Its headline sentence carries no manifest.id, the key is still named as a locator, and there is no steedos/superset/apache.
  • filter.test.ts
  • view-form-features-root.test.ts
  • view-submit-redirect-url.test.ts

• Patch round 1: action-description.test.ts. It derives ActionSchema the way /meta/types serves it (io: 'input') and asserts three things about the description help:

  • it is present;
  • no dash is left dangling before a close paren;
  • it has no ruling date, service interface or tracker id.

• Pins that changed direction. These earlier pins asserted that the date was present:

  • view-submit-redirect-url.test.ts, 7 assertions: "cites the ruling so the refusal is traceable"
  • view-form-features-root.test.ts:68
  • filter.test.ts:644
  • io-node-config.test.ts:347 and its 2026-09-01 pin

  They are now negative pins. filter.test.ts:661 used the date as its discriminator between two messages. It now discriminates on the blank-bound headline.

• No whole-prose pin was added.

Where the ruling dates in refusals come from (lineage)

This PR reverses no ruling.

• The 2026-08-29 adjudication carried out [finding] Three ADJACENT customer-facing text populations in packages/spec still carry tracker ids — 539 literals the refusal-message strip deliberately did not touch #12522's charter (comment 5425845726): strip tracker ids, and keep ADR ids and migration commands. That charter does not mention ruling dates.
• "ADR ids, protocol versions, error codes and ruling dates stay" is PR Fifth Rule 3 population (function declarations) widened, censused ids stripped, and the gate states its own scan boundary; hot-reload refusal ids stripped #13298's own commit note (fd289be), not ruled text. The code comments that grew from it, saying the date is "what a refused author can act on", are rewritten here.
• Triage 6041940817 on this card directs that "rationale (interface names, dates, tracker ids) moves into code comments". This PR follows that direction for describes and refusals alike, and the seat confirmed it in patch round 1. ADR ids stay.

Tests and gates

Patch round 1, on the merged head 026204631.

• Merge: origin/main was merged at 54ace18c6 with bash scripts/pm/os-regen-merge.sh.
  • Merge commit 75cec8cd1, parents 34bf72933 and 54ace18c6. There were no conflicts.
  • Step 2 kept the branch's bytes of the 7 reference-docs files main had not moved.
  • The regeneration ran only after the merge commit (never in MERGE state). It reproduced main's side byte for byte; the only regenerated delta is the action row, in 3 docs files.
  • Main's landed migration entries are still present on the merged head. Three were checked by name: flow-edge-unresolved-or-repeated-refused, sys-presence-organization-column-retired and sys-job-organization-column-retired.
  • The delta against main is exactly this branch's 30 paths.
• Builds and regeneration, all under the verify lock:
  • pnpm --filter @objectstack/spec build passed.
  • gen:schema and gen:docs passed.
  • The service-automation^... closure build (spec excluded) passed.
• spec tests: pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 over 26 targeted files (round 0's 25 plus action-description.test.ts): 26 files, 2475 tests passed. This is a declared narrowing; CI Test Core runs the full suite.
• service-automation: notify-node.test.ts, 16 passed.
• platform-objects: src/apps/translations/*.test.ts, 24 files, 430 passed.
• Typecheck: @objectstack/spec typecheck passed.
• Generated artifacts: pnpm --filter @objectstack/spec check:generated reports all 15 generated artifacts up to date (react-blocks and api-surface included).
• Reverse verification, patch round 1 (one-off):
  • action.zod.ts went back to the 54ace18c6 bytes; landing confirmed by grep -c = 1.
  • 1 of 16 tests in action-description.test.ts went red: "carries no residue of a stripped reference".
  • The file was restored from HEAD, hash-identical to its HEAD blob, and the suite was green again (16 of 16).
• Reverse verification, round 0 (at 34bf72933):
  • The 5 touched sources went back to the a543e244f bytes.
  • 39 of 347 spec tests went red across all 5 changed spec test files, and 1 of 16 in notify-node.test.ts. Every red is a pin this PR added or flipped.
  • Restored byte-identical to HEAD.
• Lint: pnpm exec eslint --no-inline-config --format json over the 20 changed lintable files at 026204631: 20 files, 0 errors, 0 warnings.
  • Population: eslint.config.mjs matches **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus NEVER_LINTED.
  • Invariance: the config never enables type-aware linting (no parserOptions.project, see its note near line 328), so this diff cannot move the verdict on any file it does not touch.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 026204631 derived 113 families (30 paths against merge base 54ace18c6).
  • 109 run, all exit 0, each exit code captured before any pipe.
  • 4 NOT MEASURED, recorded as reasoned claims and read from CI on the landing head: check:skill-examples, check:dual-build-cjs-loads, check:i18n and check:type-check-debt. In round 0 each exited 3 (PREREQUISITE NOT MET). check:type-check-debt's re-measure is a 45-task workspace build and is not run outside the verify lock.
  • --ran reconciliation: 113 accounted, 109 run, 4 NOT MEASURED (claimed), 0 unrun.

Acceptance notes

• Measured but not changed, as outside the three classes or outside reach:
  • stack.zod.ts:458-459 (IJobService, IEmailService.sendTemplate): defineStack collection describes. R1 to R3 do not serve them, and they are not refusals.
  • Strings whose reader is a plugin, driver or API developer, for whom the interface is the contract they implement or call. None is in R1 to R3:
    • data-engine.zod.ts:165,190 (IDataEngine.find())
    • hook.zod.ts:1269 (IScopedContext)
    • query.zod.ts:429
    • the driver.zod.ts:287-388 refusals (IDataDriver)
    • automation-api.zod.ts:452
  • execution-context.zod.ts:441 ("the 2026-09-03 ruling"): preserveAudit is server-constructed and never authored.
  • plugin-rest-api.zod.ts:138 ("ruling record, 2026-09-01"): a tombstone on RestApiEndpointSchema. Its own comment records that nothing parses that schema outside its unit tests, so no door reaches it.
  • component.zod.ts:365 ("Since the console release of 2026-08-21 (c86185eb5)"): a release date and a commit sha, not a ruling.
  • Undated ruling words. These carry no date and no "maintainer ruling", so they fall outside the class as the seat scoped it:
    • action.zod.ts:1139 and :2157
    • page.zod.ts:93
    • view-grouping-query.ts:433
    • context.zod.ts:50
    • protocol.zod.ts:1681
    • endpoint-publish-gate.ts:368,416
    • the error-code-ledger.zod.ts notes
  • "Airtable parity" wording is the only R1 to R3 hit left: page.zod.ts:911, page.form.ts:113, view.form.ts:164, plus view.zod.ts:1706, page.zod.ts:647 and component.zod.ts:1766. It is a design note naming a competitor, not an example id.
  • Salesforce mentions in export.zod.ts:292 and object.zod.ts:1528 are comparisons, not ids.
  • src/migrations/**, about 1,240 dated or "ruling" hits: upgrade-guide records, not a form or a door.
  • manifest.zod.ts:546, TSDoc @example on dependencies (@steedos/plugin-auth): TSDoc only. packages/core/src/artifact-packages.ts:114 cites that exact example, so changing it moves a comment in core.
  • The sys_email field help naming IEmailService.send is the second named remainder; see "Remainder of the card and its route".
• objectui: it has no copy of any changed string at 9990f9e (grep for II18nService, IEmailService, steedos.crm, Invalid package id).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/service-automation, @objectstack/spec, touching 29 documentable anchor(s).

33 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 54ace18c669a776c7e849708039c7876ac534cee.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 139 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 54ace18c669a776c7e849708039c7876ac534cee → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7bd05e7d0dd0bccd68fc6e9c13c1e1a6c7637d9d — the merge of head 0262046319a13c871d5427ac8cc4181ce54a3c5e into base 54ace18c669a776c7e849708039c7876ac534cee, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7bd05e7d0dd0bccd68fc6e9c13c1e1a6c7637d9d && git checkout 7bd05e7d0dd0bccd68fc6e9c13c1e1a6c7637d9d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 54ace18c669a776c7e849708039c7876ac534cee 0262046319a13c871d5427ac8cc4181ce54a3c5e && git checkout -B drift-repro 54ace18c669a776c7e849708039c7876ac534cee && git merge --no-ff 0262046319a13c871d5427ac8cc4181ce54a3c5e

node scripts/docs-audit/affected-docs.mjs --json 54ace18c669a776c7e849708039c7876ac534cee

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 54ace18c669a776c7e849708039c7876ac534cee → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0262046319a13c871d5427ac8cc4181ce54a3c5e
Local-runs: none

Read-only review of PR #22125 against main at merge base 54ace18c6 (30 paths, +252/−115), card #22093 (body and all 7 comments), the PR body, its one bot comment, and the head's check-runs. Nothing built, run or re-run; the record template and the stamped-post relay were the only scripts invoked. Rendered 2026-10-07T23:40Z.

Check-runs on the head. First read at 2026-10-07T23:31:32Z: 46 runs, 45 completed (38 success, 7 skipped), 1 in_progress (a re-triggered Check Changeset). Re-read at 2026-10-07T23:35:34Z: 46 runs, all completed — 39 success, 7 skipped; newest run per name: 31 success, 4 skipped (Auto Label, Check PR Size, Packed-tarball smoke (opt-in), Console Pin Gate). No failure, no neutral, nothing pending. Governed Surface Queue Guard success; no path in the file list hits the GOVERNED_SURFACES register, so this record is owed on the packages/spec/src/** non-test path limb alone.

① Derived judgments

Accept-set: unchanged, and the PR says so correctly. Every edit is to a .describe() string, a refusal message string, a TSDoc or code comment, or a module-private constant. Checked one by one:

1. manifestIdRefusal (manifest.zod.ts): headline reordered to "Invalid package id 'VALUE'." with the key as a parenthetical locator in sentence 2; examples joined with " or ". Zod code stays invalid_format (pinned in manifest.test.ts); the regex MANIFEST_ID_PATTERN is untouched. Right — message only; the key is still named, which keeps the refusal-names-the-key contract the POST /api/v1/packages door depends on, and the changeset carries a matcher-migration sentence for anyone who matched the old "on KEY. Expected reverse-domain notation" wording. Right.
2. MANIFEST_ID_EXAMPLES value ['com.steedos.crm','org.apache.superset'] → ['com.acme.crm','org.example.help-desk']. This IS a public export: kernel/index.ts re-exports ./manifest.zod and the package publishes ./kernel; it sits in api-surface/kernel.json. The api-surface gate records name (kind) rows only, so the change is invisible to it by design, and because the tuple is as const its literal type narrows to the new strings. In-repo readers are manifest.zod.ts and manifest.test.ts only; the existing pin that every example matches the pattern still holds. Right at patch — the constant's contract is "the examples the refusal shows", the changeset names the old and new values, and no consumer reads the literals — but the PR body's "no … type … change" is one notch too absolute; the literal tuple type did move. Noted, not a defect.
3. Four filter.zod.ts builders (nullOrderingComparandMessage, listPositionFieldReferenceMessage, nullListComparandMemberMessage, blankRangeBoundMessage): one trailing "Ruled DATE: …" sentence dropped each; rule, reason and repair sentences intact; the ADR-0049 anchor and [spec] FieldReferenceSchema is declared in the $between endpoints but NO backend resolves a $field inside a list #7596 moved into the builder comment. Right. The re-pointed discriminator in filter.test.ts (not.toContain('A blank value is not a valid $between endpoint')) names the real headline of blankRangeBoundMessage at the head, so the negative pin is non-vacuous. Right.
4. view.zod.ts: GROUPING_FIELD_RULING, SUBMIT_REDIRECT_RULING, FORM_VIEW_FEATURES_RULING deleted — all three were module-private consts (no export), so no public surface moves; their dates and tracker ids now live in the comments where the constants were. The seven checkSubmitRedirectUrl refusals, the padded grouping-field refusal and the features.* root refusal keep rule + reason + repair; custom code pinned. Right.
5. Describes that lost a date or an interface name only: field required / multiple (the radio clause folded into "any other type, radio included" — same refusal set as before), form-view field and section visibleWhen, section collapsible / collapsed (the new "so writing collapsed: true alone is a correct way to say collapsed by default" restates what the describe already asserts), redirect-arm url, page kind / source (ADR ids kept, the 2026-06-30 amendment date moved to TSDoc), action description (dangling dash removed), notify template (spec describe and the service-automation descriptor stay mirrored). Right.
6. email-template.form.ts Identity help and its four *.metadata-forms.generated.ts leaves (en regenerated, zh-CN / ja-JP / es-ES hand-translated; the translations read as faithful renderings). Right.
7. Generated content/docs/references/** (9 files) follow the describes byte-for-byte on the merged head; Type Check · source gates (check:generated --reconcile-only) and Type Check · consumer gates (check:api-surface) are green. Right.
8. Negative pins added or flipped (interface \bI[A-Z]\w*Service\b, ruling \bruled\b|\bruling\b|\b20\d\d-\d\d-\d\d\b, tracker #\d{3,5}) across io-node-config.test.ts, notify-node.test.ts, manifest.test.ts, filter.test.ts, view-form-features-root.test.ts, view-submit-redirect-url.test.ts, action-description.test.ts (derived with io: 'input', the shape /meta/types serves). Each pairs with a positive pin so none can pass on an empty string. Right.
9. One downstream reader the PR did not list: docs/qa/platform-checklist/areas/cli.json (around lines 1539 and 1541) quotes the OLD headline verbatim — "Invalid package id '' on manifest.id. Expected reverse-domain notation …" — as a clause's expected refusal. Its verify text ("the reverse-domain refusal naming manifest.id with the received ''") still holds, but the quoted sentence is now stale and a literal runner would mis-score it. Not a gate, not a governed path, not in the dispatch's file surface. Escalated under ③.

Refusal codes, exports, keys, schemas and the strict-object key sets are unchanged throughout. Console Pin Gate skipped because the filter job reported no console paths changed — expected: nothing exported is removed or renamed, and the dev's grep of objectui at 9990f9e finds none of the changed strings.

② Semver level

.changeset/22093-author-strings-internal-refs.md: patch for @objectstack/spec (17.7.0), @objectstack/service-automation (17.7.0), @objectstack/platform-objects (17.7.0) — exactly the three published packages the diff touches (content/docs/** is not a package). Check Changeset green on the head. Patch is the right level: wording of describes and refusals, a module-private constant removal, and one public example-constant value change with no accept-set effect; the body names the manifest headline's matcher migration and the old/new example values, which is the disclosure a patch of this shape owes.

Clause-②: no — correct. No parse accepts or refuses anything it did not before, so neither (widening) nor (narrowing) applies; the PR body, the changeset body and the claim/triage all carry the same Clause-②: no.

③ Boundary flags

Dev flags and open questions, each with its answer:

• open_questions[0] (round 0): top-level submitBehavior describe at view.zod.ts still carries "(ruled 2026-08-11)" because gen:react-blocks projects it into skills/objectstack-ui/references/react-blocks.md (Tier H). Answered by the seat (6047193742, option A): separate governed draft PR on the maintainer's approval; this PR is Part of #22093, the deferral comment sits beside the describe, the body names the remainder. The Part-of PR must not also close its card and The card this PR closes must claim this branch guards are green. Verified in the diff.
• open_questions[1] (round 0): ruling dates removed from refusals, not only describes. Answered by the seat (6047193742, option A): triage 6041940817 directs rationale (interface names, dates, tracker ids) into code comments; the "ruling dates stay" wording is PR Fifth Rule 3 population (function declarations) widened, censused ids stripped, and the gate states its own scan boundary; hot-reload refusal ids stripped #13298's commit note, not a ruling; ADR ids stay. The PR body's lineage section now states this instead of a "reversal". Adopted as the seat's call within its tier; nothing in the inputs contradicts it.
• Round-1 report: open_questions: []. Deviations (worktree recreate on the existing branch; four exit-3 gate families read from CI; local spec suite narrowed to 26 files; gen ran inside the lock after the merge commit) — accepted by the seat (6048943433), and each has its CI answer on the head: check:i18n and check:skill-examples run in Type Check · consumer gates (success), check:type-check-debt in Type Check · debt ledger (success), check:dual-build-cjs-loads in Build Core (success); the full spec suite ran in Test Core and its six shards (all success).
• Out-of-scope findings carried by the seat as the card's second remainder (sys_email field help naming IEmailService.send, after PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 settles the bundles) and as acceptance notes ("Airtable parity" wording, @steedos/plugin-auth TSDoc). Consistent with the diff; no action here.
• Serial notes: PRs feat(spec)!: retire the flat string-list arm of manifest.permissions — the structured ADR-0025 block is the only form (#13458) #22094 (manifest.zod.ts, other region), feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103 (field.zod.ts / view.zod.ts), feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 (translation bundles) are ordinary concurrency; No other open PR may claim the same single-writer path green; the seat's read-only merge-tree against 15ec50e528 was clean.

Escalated to the seat (none blocks this verdict):

• E1 — stale QA clause. docs/qa/platform-checklist/areas/cli.json quotes the pre-change package-id headline (item ① 9). One clause revision with a revision entry, either folded onto this branch before landing (non-governed path, no single-writer conflict in the open-PR scan) or carried as a card. The seat decides which.
• E2 — hand-written docs restate the old Template help. content/docs/automation/email-templates.mdx (around lines 171–176) still names II18nService.getDefaultLocale() and "(maintainer ruling, 2026-09-01)" in prose that mirrors the describe this PR rewrote. It is a reader-facing docs page, not form help or a refusal, so it is outside the card's class; flagged so the seat can decide whether docs and help should read alike. content/docs/releases/v17/17-1.mdx carries the same phrase and is release-owned (read-only).

Implemented-by: claude/issue-22093-author-strings-internal-refs
Reviewed-by: session_01RPo7FUd6bSnAfkWMAKi848

VERDICT: PASS

---

Generated by Claude Code