📓 Docs Drift Check

5 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 844eaeaea7ccb65a6a48859ac87db8960c1a048c && git checkout 844eaeaea7ccb65a6a48859ac87db8960c1a048c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0ee32edef5909be073ed6476b7ae864640afc19f db549a42c1cebf2a00eb3410e4d97427f4496d50 && git checkout -B drift-repro 0ee32edef5909be073ed6476b7ae864640afc19f && git merge --no-ff db549a42c1cebf2a00eb3410e4d97427f4496d50

node scripts/docs-audit/affected-docs.mjs --json 0ee32edef5909be073ed6476b7ae864640afc19f

Seat verdict — clause-② contract review at tier. PASS with advisories, zero must-fix.

Head: db549a42c1cebf2a00eb3410e4d97427f4496d50, confirmed unchanged since review. Readings 2026-09-10T17:53–18:03Z.

Landing pre-checks

⛔ Not enqueued yet, and ④ is why. Lint & Repo Gates is precisely where check-changeset-no-major.mjs and check-adr-0087-registration.mjs actually run — the two gates the review could only answer by READING their sources. A gate job's conclusion is the thing that lets a PR through; an aggregate reading is not. This lands when that job reports completed: success.

What the review settled

• The narrowing is exactly the one ruled. The shipped pattern is trim-equivalence: 24,000 generated cases, 0 divergences from s === s.trim(); lit control /^\S*$/ on the same harness shows 1152 divergences, so the harness can see a difference when one exists.
• It is not a .trim(). An accepted value returns byte-identical; a padded one returns success:false rather than a rewritten value. The only .trim() in the diff is inside the message builder computing the remedy.
• It did not adopt the machine-name grammar. owner.name parses under the shipped pattern and is refused by /^[a-z_][a-z0-9_]*$/ — that string is the one input on which the two candidate grammars disagree, and the shipped side accepts it.
• Zero in-tree fixtures redden. One padded grouping literal exists (view-grouping-query.test.ts, { field: ' ' }) and it never reaches a Zod parse. Lit control: 4566 non-padded field: literals across 780 files, so the near-zero is a genuine absence.
• minor is correct and major would be REFUSED. This is the one that resolves opposite to general semver instinct, and it is why the repo's own rule was the thing to read: during the launch window check-changeset-no-major.mjs refuses major outright, and the mandatory breaking-ness carriers are the BREAKING banner plus the ADR-0087 ledger disposition — both present. The registered (not already-registered) disposition is also the correct one for an id this diff adds.
• registry.ts is a regeneration, not a hand edit. All five fields byte-identical to the entry file (reason 1750 chars), pure +49/-0 insertion, landing at the bisect-exact index in the sorted generated region.

⚠️ Advisory 1 — the PR body under-declares the #17298 co-tenancy by one file, and it is the one that matters

The body says #17298 touches "all three of view.zod.ts, view.test.ts and registry.ts". It touches four of this PR's paths. The fourth is content/docs/references/ui/view.mdx — the only overlapping path routed merge=os-regen (.gitattributes:153).

The body's disjointness argument is a line-distance argument. Its figures are correct (:1629 and :3754 both re-measured) and it is sound for the three code files. It buys nothing on the mdx path, because that driver does not text-merge — and this seat has measured it exiting 0 while silently dropping one side.

Registry adjacency, the one conflict condition .gitattributes documents, does not apply: #17298 adds zero semantic:18 entries.

This is a reason to run the survivor probe after landing, ⛔ not a reason to hold.

Advisory 2 — the accept set is trim-equivalence, including Unicode

NBSP (U+00A0), ideographic space (U+3000) and a BOM (U+FEFF) are all refused as padding. That is correct and arguably the point, but neither the changeset nor the .describe() names the class — both say only "leading or trailing whitespace". No code change requested.

Advisory 3 — one sentence in the body is imprecise in mechanism

The body says the machine-name grammar was rejected because it "would have reddened an in-tree grouping fixture". That fixture would not have reddened: validate-list-view-field-refs.ts never parses through Zod (zero code hits for safeParse / .parse( / GroupingFieldSchema; lit control validateListViewFieldRefs = 1), so it never reaches the schema.

The conclusion is still right and is independently justified — owner.name is a legitimate authored field reference and the ruling said "non-padded". The shipped ledger reason text makes the correct argument and does not repeat the error, so nothing shipped is wrong. ⚠️ Noting it because I made the same claim in my own comment on #17360 and it was imprecise there too.

Post-landing probe — validated as discriminating

Dry-run on today's origin/main (change absent) reads A=0, B=0, C=0 with all three lit controls lit (1, 2, 1). A post-landing reading of 2 / 2 / 1 proves the landing; any zero with its control lit proves a drop.

(A) git grep -c 'GROUPING_FIELD_NON_PADDED_PATTERN' origin/main -- packages/spec/src/ui/view.zod.ts        expect 2
    lit: git grep -c 'export const GroupingFieldSchema' origin/main -- packages/spec/src/ui/view.zod.ts    expect 1

(B) ⭐ THE OS-REGEN SURVIVOR CHECK
    git grep -c -F 'NO leading or trailing whitespace: the name is compiled into the aggregate query verbatim'         origin/main -- content/docs/references/ui/view.mdx                                                 expect 2
    0 = the driver dropped this side; 1 = it half-merged. Either is a silent regression no gate reports.
    lit: git grep -c -F 'Group sort order' origin/main -- content/docs/references/ui/view.mdx              expect 2

(C) git grep -c "id: 'ui-list-view-grouping-field-padded-refused'" origin/main -- packages/spec/src/migrations/registry.ts   expect 1
    lit: git grep -c "id: 'ui-mcp-connect-agent-unknown-keys-refused'" origin/main -- .../registry.ts      expect 1

Once ④ reports green: clear needs:contract-review on both carriers (this PR and card #17360) with the four-step write, flip ready, enqueue.

Generated by Claude Code

Post-hoc contract review ADOPTED — WOULD HAVE CLEARED WITH NOTES, at tier (exact)

Posted by the domain:spec execution seat, session session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-13T08:20Z. ⚠️ This PR is already merged. Nothing below can be fixed by editing it; this is the at-tier coverage the PR never got, supplied after the fact, and it is here so the record says what was actually checked rather than what was assumed.

Why this review exists

Per #17915: a run of contract-review rounds this shift was dispatched below CONTRACT_REVIEW_TIER. Five merged PRs declared Clause-②: yes and had their needs:contract-review carriers cleared on the strength of a below-tier round. This PR is one of the five, and it is the one carrying a ! breaking change — so it was taken first.

Tier verified by the seat, from the transcript — not from the dispatch parameter

⛔ A model: dispatch parameter is configuration, not a reading. Census of the harness-stamped served-model field on every assistant turn of the round's own transcript (taken 2026-09-13T08:19:28Z):

CONTRACT_REVIEW_TIER read at scripts/pm/dispatch-gates.mjs:10176 → 'claude-fable-5-1'; comparison is exact, never a family or prefix floor. ⇒ at tier. The control is there so a census returning one value everywhere cannot be mistaken for an instrument that only ever returns that value.

The answer

No defect on origin/main attributable to this change. The breaking half is exactly the declared narrowing — the round proved trim-equivalence by exhaustion (14,641 four-char strings over an 11-symbol alphabet including NBSP / U+3000 / BOM: 0 divergences from s === s.trim()), with a lit control (/^\S*$/ on the same harness: 150 divergences) proving the harness can tell shapes apart. Migration story present and mechanically registered (check-adr-0087-registration.mjs exit 0, [BREAKING+bang] registered). Not yet in any released tag, so "customers may already depend on it" is not yet true of any installable release.

Two readings worth keeping for whoever next worries about this change:

• Stored padded views do not break boot. packages/objectql/src/registry.ts:3407-3427 — spec validation on register is "DIAGNOSTIC — deliberately not a gate ([P2] The spec contract stops at authored source — stored metadata is rehydrated unparsed, unconverted, and ungated #3903) … registered anyway"; the refusal lives on the write path (saveMetaItem → 422). That matches the ADR entry's "refused on its next authoring-path save", and it is the difference between a narrowing that bricks an existing tenant and one that merely blocks re-saving.
• Clause-②: yes was conservative, not forced. All three new identifiers (GROUPING_FIELD_RULING, GROUPING_FIELD_NON_PADDED_PATTERN, checkGroupingFieldName) are module-private; no new payload key; check-widening-tells.mjs exit 0. Per 「收窄仍是语义面，⛔ 不触条款②」 the mechanical limbs do not fire — but 「claim 拿不准 ⇒ 按 yes」 sanctions the declaration, and the spec lane requires the at-tier review for semantic-surface cards regardless. The declaration was right in direction; the round that cleared it was not at tier. Those are two different defects and only the second one was real.

Follow-ups — filed, not left as prose

Per the seat's own rule (⛔ an acceptance note with no named carrier is not a disposition), each got a card or an explicit "承接者:无":

1. ⚠️ Packed-tarball smoke (release candidate) has been failing on main since 00:30Z today — and the round caught the reading that makes it interesting: sha a9c6477904 succeeded at 23:54Z and failed at 00:30Z on the same sha. An advisory gate red on main is shared damage; filed.
2. scripts/openapi-self-consistency.test.ts is red in any /tmp-rooted worktree in this container (pnpm's relative symlinks resolve through /tmp; the test symlinks node_modules into an os.tmpdir() sandbox at :174-186). Every agent working out of the scratchpad hits this and must not read it as a main defect. Control that proves it is not this PR's: the identical 8 failures sit in a log dated 2026-09-10T15:13Z, before this PR merged at 18:29Z, and 0 of the failing files mention view or grouping. Filed.
3. The .describe() and the ADR entry say "whitespace" while the accept set is JS \S — NBSP, BOM and U+3000 are refused and undocumented. Filed to this lane.
4. A docs tension in the PM rulebook: this PR's body cites "objectui#8285 precedent ⇒ a spec narrowing declares yes", which is a per-card director ruling, while references/lanes/spec.md:19 says narrowing does not trip clause ②. Not a defect in this PR; filed to the skills lane.

The round's NOT MEASURED section is reproduced verbatim below and is not a formality — read it before treating this review as exhaustive.

All readings are in. Final report follows.

Post-hoc contract review — PR #17498 (fix(spec)!: refuse a padded grouping.fields[].field name at the producer)

Reviewer tier self-check (first finding). scripts/pm/dispatch-gates.mjs:10176 read at 2026-09-13T07:53:41Z: export const CONTRACT_REVIEW_TIER = 'claude-fable-5-1'; (docblock: comparison is EXACT, never a family/prefix floor). Harness-stamped served model in this transcript: claude-fable-5-1. Exact match — this review is at tier. (A model dispatch parameter was not used as the reading.)

Method facts. Merged squash commit f8e5790593e (parent 10da5c44e38, 2026-09-10 18:29Z; PR merged 18:55:32Z). PR head db549a42c1c. git merge-base head merge^ = 65ad77d5aea (07:54:43Z). git diff 65ad77d..db549a42 vs git diff f8e5790^..f8e5790: IDENTICAL ignoring index lines — 6 files, +323/−3. Today's origin/main = 225197cdbaf, 230 commits later; 13 of those touched the PR's files (incl. #17298, the co-tenant). Own detached worktree scratchpad/cr17498wt at 225197cdbaf, pnpm install --offline exit 0. Nothing written to GitHub; no branch touched; no stash; no kill.

Q1 — The breaking change, characterised exactly

Reading (tsx script against the worktree's view.zod.ts on origin/main, 07:57:28Z):

Trim-equivalence proven: 14,641 four-char strings over an 11-symbol alphabet (incl. NBSP/ideographic/BOM): 0 divergences from s === s.trim(); lit control /^\S*$/ on the same harness: 150 divergences. Message names the spelling and the remedy: … received " business_unit " … Write "business_unit". (ruled 2026-09-10.).

Which shipped shapes break: exactly stored list views whose grouping.fields[].field has leading/trailing whitespace. In-tree: git grep -P "field:\s*(['\"])(\s[^'\"]*|[^'\"]*\s)\1" origin/main -- packages apps examples content → 6 hits: 4 are the PR's own pins in view.test.ts, 1 is the negative fixture view-grouping-query.test.ts:507 ({ field: ' ' }, handed to compileListViewGroupQuery, never Zod-parsed), 2 are unrelated message strings (metadata-protocol/protocol.ts:13301, cli/test/metadata-type-schema-gate.test.ts:114). Lit control: line 507 matched by the same regex = 1. JSON "field": " …" = 0.

Migration story present: ADR-0087 semantic entry 18.ui-list-view-grouping-field-padded-refused (replacement = re-author, no .trim(); explicitly no lossless conversion, hand prescription); node scripts/check-adr-0087-registration.mjs --base 65ad77d --head db549a42 → exit 0 [BREAKING+bang] registered … (new here); changeset minor + **BREAKING** + FROM→TO table; check-changeset-no-major.mjs header (lines 5/47/55) confirms the launch-window minor convention. Boot is not broken by stored padded views: packages/objectql/src/registry.ts:3407-3427 — spec validation on register is "DIAGNOSTIC — deliberately not a gate (#3903) … registered anyway", refusal lives on the write path (saveMetaItem → 422) and reads carry _diagnostics. That matches the entry's "refused on its next authoring-path save". Not yet released: git tag --contains f8e5790593e → none; newest @objectstack/spec@17.4.0; the changeset is still pending among 271. So "customers may already depend" is not yet true of any installable release.

Verdict Q1: the breaking half is exactly the declared narrowing — no more, no less; migration story present and mechanically registered.

Q2 — Clause-② declaration

PR body column-0 line: Clause-②: yes — fixed **by the ruling**, not by the diff's size. (fixed spelling; check-clause2-carriers --pair 17498 exit 0 per the seat's record — not re-run by me).

Mechanical limbs, verbatim from the tree (07:59:09Z): .claude/skills/pm-dispatch/references/lanes/spec.md:19 「放宽接受集或扩大公开面的卡,不论多小,即条款②;收窄仍是语义面,不触条款②。」 and references/contract-review.md:13 「机械地板 claim 时可查树:新导出符号或已发布载荷上的新键恒 yes,锁契约复审档复核。」

Diff against them: new identifiers GROUPING_FIELD_RULING, GROUPING_FIELD_NON_PADDED_PATTERN, checkGroupingFieldName are all module-private (no export); api-surface/ui.json, declaration-map, export-origins not in the diff; no new payload key. node scripts/pm/check-widening-tells.mjs --declaration no --diff <pr diff> → exit 0 (3 files judged, no tell; 3 NOT MEASURED by construction: changeset, mdx, test). Self-test 269 cases pass.

Verdict Q2: neither limb forces yes; this is a narrowing, so clause ② does not fire mechanically. The yes is the card's conservative routing, which the rulebook sanctions (contract-review.md:6 「只定…保守方向,⛔ 非终审」, :9 「claim 拿不准 ⇒ 按 yes」; widening-tells never blocks yes) and the spec lane requires the at-tier review for semantic-surface cards regardless (core-rules.md:113). Declared correctly in direction. Note: the body and card cite "objectui#8285 precedent says a spec narrowing declares yes" — that is a per-card director ruling (batch #91 on objectui#8285), not the rulebook, and lanes/spec.md:19 says the opposite; a docs-only tension for the PM lane, not a defect here.

Q3 — Scope against the ruling

Ruling, verbatim from #17360: "C — refuse at the producer. GroupingFieldSchema.field gets a non-padded pattern (no leading/trailing whitespace; the same shape the field-name vocabulary already uses elsewhere in packages/spec if one exists — reuse it, do not invent a second), with a refusal message naming the field and the offending spelling. ⛔ Not .trim() … The harvester's trim on the objectui side stays as defence-in-depth … The sibling groupByField axis … is ⛔ not this card."

• Non-padded pattern, refusal by name + spelling: measured above ✓.
• "Reuse if one exists": on the merge base, packages/spec/src (non-test, non-migrations) has no non-padded name vocabulary — 6 hits for \S$|^\S|.trim() ===|leading/trailing whitespace, all blank-checks or .describe() text; the only candidate (/^[a-z_][a-z0-9_]*$/) is a different accept set (refuses owner.name, which packages/lint/src/validate-list-view-field-refs.test.ts authors). No second vocabulary invented ✓.
• Not .trim(): accepted values byte-identical, padded ones refused ✓.
• groupByField untouched: the only groupByField line in the diff is changeset prose; view.zod.ts:1031/1309/1432 still bare z.string() on main ✓.
• Changeset names objectui#7347 unblocking on the installable release ✓; minor + BREAKING + ADR-0087 ✓.
• Nothing beyond the ruling: 6 files; the one file outside the claim's declared face is content/docs/references/ui/view.mdx, the regenerated projection of the .describe() (lanes/spec.md:21 「产物随源走」) — check:docs exit 0 on today's main (222 generated files in sync).

Verdict Q3: in scope, every clause honoured, nothing extra shipped.

Q4 — Defect on main today?

Through os-verify-lock.sh (slot cr17498-posthoc, waited 226 s, held 331 s; the first turn ended while waiting — re-taken, the run had survived): turbo run test on 225197cdbaf:

The 8 spec failures are all scripts/openapi-self-consistency.test.ts — Cannot find module '/tmp/node_modules/.pnpm/tsx@4.23.12/…/cli.mjs': the test symlinks node_modules into an os.tmpdir() sandbox (lines 174–186) and pnpm's relative symlinks resolve through /tmp — a container artifact. Control: the identical 8 failures sit in this scratchpad's spec-full.log dated 2026-09-10T15:13Z, before the merge (18:29Z); 0 of the failing files mention view/grouping. Light gates on main: check:migration-registry 0 (206 semantic/168 retired-key/178 retired-def, current), check:spec-changes 0, check:authorable-surface 0, check:docs 0. Merge-queue full-suite run on the merge commit itself: run 34514657802, gh-readonly-queue/main/pr-17498-…, head f8e5790, success (lit control: 290 distinct pr- branches across the 300 runs scanned). PR-side: 43 check runs, all success/skipped.

Packed-tarball smoke: publish-smoke.yml, fired by workflow_run after Release on main. Failure streak from 2026-09-13T00:30Z (a9c6477904 succeeded at 23:54Z and failed at 00:30Z on the same sha), 8 fail/cancel through 07:38Z, in_progress on 225197cdba at 07:59Z. Successes on 09-12 21:21–23:54Z on descendants of #17498 (e.g. 9c44eed4cb). So it is not introduced by this PR; whether it is chronic-environmental is suggested by the same-sha flip but its cause is NOT MEASURED (logs not read).

Verdict Q4: no defect on main attributable to this change; the merged block is intact (probes A 2/1, B 2/2 — the os-regen mdx survived #17298 — C 1/1; block diff merged→main: 0 lines; entry and changeset byte-identical; pins #17360 2, BY NAME 1, IN_TREE_… 6).

Q5 — Cross-package blast radius

• Old describe text sites: exactly 2 files (view.zod.ts, view.mdx), both carrying the new suffix (2/2, 1/1).
• Snapshot fixtures: 0 __snapshots__/.snap files in the repo at all.
• authorable-surface/ui.json rows ui/GroupingField:field/order/collapsed unchanged; authorable-surface.base.json untouched; gate exit 0. Liveness ledger row (2026-06-viewschema-property-liveness.md:15) unaffected. Strictness ledger untouched (no new key). No numeric pin on semantic-entry counts found (20[3-7] near "semantic": 0 hits in tests/scripts/audits).
• GroupingFieldSchema consumers repo-wide: 10 files, all in spec + generated/ledger projections; no other package parses ListViewSchema at runtime (0 non-test parse sites outside spec).
• objectui (origin/main 69aa9c017, read-only): harvester trims (core/src/utils/__tests__/grouping-fields.test.ts:43-44), usableGroupingFields keeps the raw name (useGroupedData.ts:259-266), gallery reads item[f.field] raw, kanban falls back to schema.grouping.fields[0].field raw — the prose's mechanism holds today.

Verdict Q5: nothing outside packages/spec reddens; lint/rest/platform-objects green on today's main.

Q6 — Published invariants without backing

Backed: compileListViewGroupQuery groupBy column (view-grouping-query.ts:105,123); grouping_field_blank at path ['grouping','fields',index,'field'] (:341-347; status type 501|400 at :305); 「短期不考虑渐进」 present in SKILL.md (1 hit); objectui trim/raw reads (above); load-path diagnostic vs save-path 422 (registry.ts:3407-3427).

Notes (none a defect): (a) .describe()/mdx say "whitespace" while the accept set is JS \S — NBSP/BOM/U+3000 are refused, undocumented (the earlier review's Advisory 2, still unaddressed); (b) the .describe() on main asserts a consumer behaviour ("buckets every row into one empty group") — true of objectui today, stale the day objectui trims; (c) the entry's "50 occurrences / 19 files / 906 literals" is a historical TS-parser count I could not reproduce with the same predicate (grep approximation on the merge base: 43 grouping: { in 16 files) — plausible, not a contract invariant; (d) "decision batch #110 item 5 / 「其他同意」" is chat provenance — not measurable from the tree.

Overall verdict: WOULD HAVE CLEARED WITH NOTES

An at-tier review would have passed this head; the guarantee is now supplied. Follow-ups, none blocking: (1) docs-only — reconcile the "objectui#8285 precedent ⇒ narrowing declares yes" wording with lanes/spec.md:19 (carrier: PM skill seat); (2) docs-only — name the Unicode whitespace class in the .describe()/entry (carrier: domain:spec); (3) tooling — openapi-self-consistency.test.ts is red in any /tmp-rooted worktree in this container (not a main defect; carrier: devx); (4) the publish-smoke streak since 00:30Z today is unrelated to this PR but uninvestigated.

NOT MEASURED, by name: publish-smoke failure cause; the TS-parser harvest counts (50/19, 906) and the prior review's 24,000-case run (I ran my own 14,641); the REST saveMetaItem 422 by actual request; ViewMetadataSchema's union membership of ListViewSchema (not found in my grep window); check:api-surface / export-origins / declaration-map / dual-build-cjs-loads / type-check-debt gates; today's main push-CI conclusion; objectui#7347's current state and its consumer regression test (blocked on release); packages other than the four run.

维护者速读: 这条破坏性收窄(分组字段名带首尾空白即拒)与裁决完全一致,迁移登记与 changeset 齐全,今日 main 上 spec/lint/rest/platform-objects 四个包套件全绿(spec 的 8 个红是本容器 /tmp 工作树的路径伪影,合并前就有);未发现缺陷。Clause-②: yes 属保守申报(收窄本身不触条款②),方向无误。

Generated by Claude Code

Served-tier: 138/138 claude-fable-5-1

Verdict record in the ruled shape — post-hoc, WOULD HAVE CLEARED WITH NOTES

Re-posted by the domain:spec execution seat, session session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-13T08:26Z, to carry the Served-tier: line in the fixed spelling. The full review record is comment 5652185399 on this PR; it is unchanged and remains the substance. Per the ruling on #17915 (os-tesla, comment 5651924370, item 1), a verdict without the line is not a verdict — and a gate (item 2) cannot read the table my adoption comment put the reading in.

⚠️ This PR is already merged. This is the post-hoc at-tier coverage required by item 4 of that ruling, not a clearance — there is no carrier left to strip and ⛔ nothing here reopens or reverts anything.

⛔ The reading is not the dispatch model parameter, and ⛔ not a bare model-name token grepped from the transcript body — that looser probe has a documented false-positive mode that grows with adoption of this discipline (objectui seat, comment 5651573578 on #17915). This census parses each transcript line as JSON, keeps records whose type is assistant, and reads the structured message.model key.

Generated by Claude Code