fix(spec,cli): walk a slotted page's slots and a tabs panel's items[].children, and give dashboard global filters a bundle group - #16883

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/cli, @objectstack/platform-objects, @objectstack/spec, touching 15 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/spec/api-surface/system.json, packages/spec/export-origins/system.json, packages/spec/liveness/translation.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/validating-metadata.mdx (via globalFilters (symbol, a field of interface DashboardLike), globalFilters (literal, a string literal in collectExpectedEntries; a string literal in translationDataShape))
• content/docs/ui/dashboards.mdx (via globalFilters (symbol, a field of interface DashboardLike), globalFilters (literal, a string literal in collectExpectedEntries; a string literal in translationDataShape))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via globalFilters (symbol, a field of interface DashboardLike), globalFilters (literal, a string literal in collectExpectedEntries; a string literal in translationDataShape))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 99117135566a93d57576dcce6e5f00361fa1a81f && git checkout 99117135566a93d57576dcce6e5f00361fa1a81f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin aa5152d1ad4194293c4550a844da7a83475697d6 205fff6c74414e5268e96932d178295ab68b1224 && git checkout -B drift-repro aa5152d1ad4194293c4550a844da7a83475697d6 && git merge --no-ff 205fff6c74414e5268e96932d178295ab68b1224

node scripts/docs-audit/affected-docs.mjs --json aa5152d1ad4194293c4550a844da7a83475697d6

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs aa5152d1ad4194293c4550a844da7a83475697d6 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

⛔ Blocked, and this is the seat saying so once rather than leaving a red unattended — 2026-09-08T13:51Z

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x.

What is red, and why it is a fair red

Check Changeset fails on head af0593780 (two runs, same reason). The gate's own words:

⛔ This PR declares clause-② YES and grades a package it grew `patch`.

   .changeset/i18n-slotted-pages-and-global-filters.md
     - @objectstack/cli: patch   ← this PR moves @objectstack/cli's packages/*/src/**
     - @objectstack/platform-objects: patch   ← this PR moves @objectstack/platform-objects's packages/*/src/**

⇒ The changeset declares Clause-②: yes and grades two packages whose src/** this diff moves as patch, while the maintainer ruling of 2026-09-04 (decision batch #35, on #15294) requires at least minor for a purely additive widening of a published surface.

⭐ The gate is right and the declaration is the part that is correct. packages/spec/api-surface/system.json moves +3 — that is the definition of widening a published surface, and it is why this card was dispatched at CONTRACT_REVIEW_TIER in the first place. So the fix is the gate's route 1: raise those two entries, having first measured per package what actually widened. ⛔ Not route 2, and emphatically not the thing the gate itself forbids — "Do not add a tolerance here to route around a declaration that says something its author did not mean."

Why it is not fixed in this comment

The claude-fable-5-1 capacity for this account is exhausted — the dev was resumed with the diagnosis above and terminated on HTTP 429: "You've reached your Fable limit. Switch to another model, or manage usage credits."

That leaves no route that is both available and legal:

• ⛔ PM never writes code. The changeset is the dev's to push; a comment describing the fix is not a fix.
• ⛔ A below-tier corrective push cannot be compensated right now. 「降档施工的补偿控制 = 复核席跑契约复审档」, and 「契约复核 ⛔ 不适用额度耗尽豁免降档:豁免对象是派发,复核正为补偿低档派发而存在」. Dispatching this at claude-opus-5 would owe an at-tier review that cannot be commissioned for the same reason the dispatch cannot. The exemption covers dispatch, never the review that exists to compensate it.

⇒ This PR parks on tier capacity. ⛔ It is not abandoned and it is not waiting on review — it is waiting on one thing a person controls, and it resumes the moment fable capacity returns: raise the two levels, push, then the at-tier contract review this diff owes for widening api-surface/system.json.

What is already established, so the next dev re-derives none of it

The build itself was at tier — the dev's transcript carries 165 harness-stamped "model" values, all claude-fable-5-1 (plus 2 <synthetic>, which are harness-generated and not a model), and zero of any other value. ⇒ 强制条款② is satisfied at the build; only the corrective push is affected by the outage.

Docs drift is clean, measured by this seat (⛔ do not re-derive): content/docs/releases/** is touched 0 times against a positive control of 4 content/docs/ paths this diff does touch; and neither flagged page is falsified — content/docs/deployment/validating-metadata.mdx treats globalFilters as a validation subject (filter fields resolving against a widget's dataset object) and content/docs/ui/dashboards.mdx as a schema shape. Neither enumerates translatable bundle groups and neither claims global filters are untranslatable, so a diff that adds a translation group for them contradicts nothing there. The translation-facing page that should carry the new capability, content/docs/ui/translations.mdx, is already in the diff.

Everything else on this head is green: 35 checks, Check Changeset the only failure.

The per-package readings the next push still owes

• @objectstack/cli — packages/cli/src/utils/i18n-extract.ts (+30/−7). Does the extractor now emit keys it did not emit before? If yes that is consumer-visible behaviour and minor is required, not stylistic.
• @objectstack/platform-objects — 6 added lines in each of en.ts / es-ES.ts / ja-JP.ts / zh-CN.ts. New bundle keys in that package's published output is additive widening.

If a measurement shows one of them genuinely publishes nothing new, that is route 2 — a producer-side correction stated with its reading, ⛔ never a level bump used to silence the gate.

⛔ Still draft, ⛔ not enqueued, ⛔ auto-merge unarmed, needs:contract-review stays.

Generated by Claude Code

Contract review (claude-fable-5-1, isolated seat) — PR #16883 @ af0593780

Verdict: CHANGES REQUIRED — the code delivers the card; the changeset does not yet satisfy two of the repo's own declared rules, and one of them is already red in CI on this head. Both fixes are confined to .changeset/i18n-slotted-pages-and-global-filters.md. One test gap is recorded.

Governed-surface check: none of the 20 changed files is under docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md or content/docs/releases/** (git diff --stat origin/main...refs/review/16883, 20 files enumerated; docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is a regenerated ledger, not ADR space). Governed Surface Queue Guard green.

Findings

1. blocking — Check Changeset is red on this head, twice, and the reason is real. Jobs 102087757106 (opened) and 102087861929 (labeled) both fail on the LEVEL axis of scripts/check-changeset-no-major.mjs: "This PR declares clause-② YES and grades a package it grew patch — @objectstack/cli: patch ← moves packages/*/src/**; @objectstack/platform-objects: patch ← moves packages/*/src/**." The declaration is right (the spec accept set and the published index both widen — packages/spec/api-surface/system.json +3), so route 1 applies: raise both to minor. Substantively the CLI does widen its output surface (packages/cli/src/utils/i18n-extract.ts:1325-1344 is a new emitter family, :1362-1377 newly offers pages.<n>.title/subtitle for a slots.header), and the four Setup bundles carry a new key. The PR body says the LEVEL axis was "not measured locally — no PR payload"; the script's own header (check-changeset-no-major.mjs:20-27) documents --event <payload.json> for exactly that offline run, so this was measurable before opening.

2. blocking — a breaking change on a published export is shipped without the BREAKING banner or an ADR-0087 disposition. walkAddressedPageComponents is published (api-surface/system.json:842 on origin/main), and its return changes from PageLike['regions'] to AddressedPageRoots (packages/spec/src/system/i18n-resolver.ts:1735-1738); the PR's own open question 2 concedes "a third party reading the return as an array breaks on upgrade." The launch-window convention the changeset invokes for minor is the same rule that makes the banner mandatory: check-changeset-no-major.mjs:61-69 — "the mandatory information carriers for breaking-ness in the meantime are the BREAKING banner … and the ADR-0087 migration-ledger disposition … they are the only signal there is" — restated in pr-automation.yml:672-674. The changeset body contains no BREAKING token (grep count 0) and no <!-- adr-0087: … --> marker, so check-adr-0087-registration passed it as "1 non-breaking changeset" — green by silence, which is the shape that gate exists to refuse. The cited CHANGELOG precedent (packages/spec/CHANGELOG.md:8384-8395, a required-parameter tightening) also carried no banner; that is a precedent, not the rule. Fix: keep minor, add a **BREAKING** (return shape) line naming the one-line migration already written, plus one marker from CATEGORIES (check-adr-0087-registration.mjs:467-473) — the gate self-checks the choice.

3. record — the CLI's new globalFilters emitter has no test. git grep -E 'globalFilters|globalFilterKey' refs/review/16883 -- packages/cli/test exits 1; the only CLI test touched (packages/cli/test/platform-page-i18n-parity.test.ts) pins slots/tabs walk parity and the slots.header route, not finding B. check:i18n-walk-parity measures at top-level group granularity (11 declared at the ref: objects, apps, messages, globalActions, dashboards, datasets, pages, flows, settings, metadataForms, settingsCommon; ledger messages/settingsCommon/settings, LEDGER_CEILING = 3; 8 walked) — dashboards was already walked, so a sub-group emitter can drift silently. M1–M4 ablate the spec side only. One pin asking collectExpectedEntries for dashboards.<n>.globalFilters.<name>.label / .options.<value>, the field-keyed case, and nothing for an optionsFrom filter would close it.

4. record — the alias claim in the PR body/changeset overstates the mirror. GlobalFilterSchema (packages/spec/src/ui/dashboard.zod.ts:787) aliases choices/values → options and title → label; items → options and text/name → label are not on it (text/title/name → label are the option-row aliases at :819, and name is a real key on the filter). The code comment in translation.zod.ts:776-779 names only choices/values and title/name, and is accurate; the PR body's "choices / values / items" is not. Aliases on a strictObject reject with a hint and do not widen the accept set — Clause-② yes rests on the new globalFilters key itself, which is correct. Dashboard-level filters/globalFilter do mirror DashboardSchema (dashboard.zod.ts:892). optionsFrom keyless is stated in both the schema docblock and the changeset.

5. record — file surface vs. the claim. The claim's Zone-1 surface was i18n-resolver.ts, translation.zod.ts, their tests, plus tooling-demanded regeneration. Nine of the 20 files sit outside it: the CLI extractor + its test (forced by the parity gate for the walk half; the globalFilters emitter is new function, not regeneration), the platform-objects extract config + 4 bundles, the showcase bundle, the hand-written content/docs/ui/translations.mdx rows, and the changeset. Each is explained in the report/PR body as the claim required ("stop on breach; explain"). Recorded, not contested.

6. observation — schema premises hold at the ref. PageSchema.slots: closed 7-slot strictObject, each z.union([PageComponentSchema, z.array(PageComponentSchema)]) (page.zod.ts:739-756). GlobalFilterSchema.name "defaults to field", field required (dashboard.zod.ts:801-804). PageTabsProps.items[].children: z.array(z.unknown()) (component.zod.ts:758) and PageAccordionProps.items[].children (:1762). Depth cap, ancestors cycle guard and the translatePage stops at region-level components, so copy on components nested in another component's properties.children is authorable but never resolved — 4 KPI labels stay English on hotCRM's zh-CN landing page #12961 arbitration are structurally unchanged — walkComposition charges a panel one level exactly as children, and the root-level id set now includes slot entries with the same root-wins-outright rule (i18n-resolver.ts:1747-1767).

7. observation — consumer set measured. In-repo consumers of the old signature: translatePage (updated to destructure, :1987) and the CLI extractor (enumeration-only, :1079, :1366); no other. objectui at the pinned .objectui-sha 53ded82b: git grep for walkAddressedPageComponents|AddressedPageRoots|GlobalFilterLike|globalFilterKey exits 1 (0 hits); positive control pickLocalized hits 51 files. Finding 2 is therefore about third parties, not the console.

8. observation — the resumption note is credible from the history. Every test edit is in the predecessor's three wip commits; origin/main did not touch the three test files between the branch point c5ea982d9 and the merged c930f8597, the merge 718bff099 left them byte-identical to the branch side, and af0593780 touches only the changeset and the extract config. d535eaf56 (11:12Z) contains the two assertion edits that exist — fixture count 9→8 with a corrected composition comment, and fallbackChain: ['en'] per i18n: metadata label lookup falls through to the en bundle on a zh-CN workspace — localeChain defaults fallbackChain to ['en'] and ignores i18n.fallbackLocale, so an authored Chinese label loses to a courtesy English bundle #14882 — both fixture/option corrections, not weakened expectations. Nothing was edited away after f3e92ee1c. No .skip/.only/.todo added.

9. observation — bundles are real translations and the keys match the authored filters. platform-objects system_overview authors field: 'created_at' with no name (system_overview.dashboard.ts:236-244) → created_at key; es Rango de fechas, ja 日付範囲, zh-CN 日期范围. Showcase region (amer/emea/apac) and task_status (backlog/todo/in_progress/in_review/done) match revenue-pulse.dashboard.ts:38-50 / ops-dashboard.dashboard.ts:61-79; zh-CN rows are translated, not copied. No content/docs/releases/** edit. Strictness-ledger count 350→351 is consistent with one new strictObject.

10. observation — open question 1 is answered correctly by the PR and should be said plainly to the maintainer. The tab strip's own items[].label remains reachable only by inline locale map (pinned as BOUNDARY); the card's headline "7 tab labels" is therefore delivered for the panels' contents, not the strip labels. Option A is consistent with the ruled route; no action here, but the card's acceptance line should be read with that qualification.

11. observation — CI on af0593780 at 14:05Z. All conclusions green (Build Core, Test Core 1–6, Type Check ×4, Dogfood ×5, Temporal Conformance, Build Docs, Part-of guard, single-claim guards, Spec property liveness) except Check Changeset ×2 failure (finding 1) and Lint & Repo Gates still in_progress — that job carries check:i18n*, check:api-surface, check:export-origins, check:strictness-ledger; its verdict was not available at review time. No commit carries a Refs # / closing trailer; the PR body carries Fixes #16772 alone.

Maintainer-only merge: yes. The PR widens a published contract in three ways (a new bundle key group, three new index exports, a breaking return shape on a published function), the card carries needs:contract-review, and the Clause-② carrier is the review seat's to clear — none of which a landing author may self-serve. It is also a draft with a red required-shape check.

Generated by Claude Code

Seat concurs with the director seat's review, and corrects its own blocker comment — 2026-09-08T14:11Z

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x. This supersedes the scope of my comment 5586219596, which named one blocker. There are two, and I missed the more serious one.

⭐ Finding 2 is real, and I verified it myself rather than concurring on the report

⇒ A breaking change to a published export, graded minor, with neither of the two mandatory breaking-ness carriers. check-adr-0087-registration passed it as "1 non-breaking changeset" — green by silence, which is precisely the shape that gate exists to refuse.

⚠️ Why this seat missed it, stated plainly because the reason generalises

I read packages/spec/api-surface/system.json +3 / −0 and concluded "purely additive widening". That reading was true and irrelevant: api-surface/*.json lists exports by name and kind, so an entry reading walkAddressedPageComponents (function) does not move at all when that function's return type changes. The artifact I used as my safety check is structurally blind to in-place signature changes — it proves additions, never the absence of a modification.

⭐ The durable form, going into the handover: an api-surface diff of +N/−0 answers "what was added". It does not answer "what changed shape". A breaking change can and did pass it with a clean −0. ⚠️ And #16045 is the open card that already says this out loud — "@objectstack/spec pins 5309 exports by name-and-kind but only 27 by signature — 99.5% of the ratified surface passes green through a shape change". This PR is a live instance of that card's thesis, and I had read that card's title in this lane's own enumeration two hours ago without connecting it.

The PR's own open question 2 conceded the point in its body — "a third party reading the return as an array breaks on upgrade" — and I did not read that far before writing my blocker note.

Corrected parking record for this PR

⛔ It needs more than the level bump I described. On the reviewing seat's findings, both blocking and both confined to .changeset/i18n-slotted-pages-and-global-filters.md:

1. Raise @objectstack/cli and @objectstack/platform-objects from patch to minor (the red Check Changeset, now failing on 3 runs of the same head — ⛔ re-runs of a diagnosed failure, so no second blocker comment is owed for them).
2. Keep minor and add a **BREAKING** (return shape) line naming the one-line migration, plus one <!-- adr-0087: … --> marker from CATEGORIES — the gate self-checks the choice.

And per the reviewing seat: maintainer-only merge. The PR widens a published contract three ways — a new bundle key group, three new index exports, and a breaking return shape on a published function — and ⛔ the Clause-② carrier is the review seat's to clear, not a landing author's. So even once the changeset is fixed, ⛔ this seat does not enqueue it.

The blocker on getting there is unchanged: the claude-fable-5-1 capacity for this account is exhausted (HTTP 429 — "You've reached your Fable limit"), the fix is a dev's to push, and ⛔ a below-tier corrective push cannot be compensated because 「契约复核 ⛔ 不适用额度耗尽豁免降档」. It resumes when fable capacity returns.

Also recorded from that review, ⛔ not re-derived

Finding 3 — the CLI's new globalFilters emitter has no test, and check:i18n-walk-parity measures at top-level group granularity where dashboards was already walked, so a sub-group emitter can drift silently. That is a real coverage hole and belongs in the same push. Finding 4 — the PR body's alias list (choices/values/items) overstates what GlobalFilterSchema actually aliases; the code comment is accurate and the body is not.

⭐ Thanks to the director seat for the catch. ⛔ Its review stands as this PR's at-tier reading of head af0593780; ⚠️ a PASS — or in this case a CHANGES REQUIRED — binds to a head, so the corrected head will need its own.

Generated by Claude Code

Director seat adoption record — summon #20, session_01Tep4AYXZvyBA7jsvne5KZV (os-bill), 2026-09-09T06:59Z. The verdict below is adopted verbatim from an isolated contract-review subagent (explicit model = CONTRACT_REVIEW_TIER). Transcript tier check before adoption: every harness-stamped model field in the subagent transcript reads claude-fable-5-1 (64 stamps, no other value). Head re-read at posting time = 7b942e760f, unchanged since the review. ⛔ This seat takes no release action on this carrier (no ready flip, no auto-merge, no enqueue, no label write): the owning seat (domain:spec / consolidated seat (claim 5594626301)) adopts this verdict verbatim or discards it, and acts per the state machine.

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #16883 @ 7b942e760f318cfeb093bd0b5d9b63b7a609e734

Verdict: PASS WITH FINDINGS

Increment re-derived as git diff ee2cb6b40...7b942e760 (merge-base of origin/main 854639b31 and the head; 21 files, +1110/−113). Interdiff against the prior-reviewed increment (c930f8597...af0593780): the only source-side change is the new file packages/cli/test/i18n-extract.test.ts (+90) plus the changeset text; the merge ec85cc77 brought into packages/cli/src/utils/i18n-extract.ts exactly main's own 46-line hunk (byte-identical to c930f8597..ee2cb6b40 on that file — no conflict residue), and 2a347ac7 regenerated one line of content/docs/references/api/protocol.mdx. No contract code moved since af0593780, so the prior review's walk/schema/consumer readings carry forward; each was spot-re-derived below on the head, not inherited.

Owed items from the prior review

Prior review = PR comment 5586444993 (os-zhuang, CHANGES REQUIRED @ af0593780); card record 5586461521; seat concurrence 5586497592.

Derived judgments

• Public surface moves in three independent ways — Clause-②: yes is right. (a) A new authorable strict group on the published translation payload: translation.zod.ts:778-790 dashboards.<name>.globalFilters.<key>{ label?, options?: Record<string,string> } — a bundle carrying it was refused by the strict object before (pinned by the CONTROL: … 17.3-shaped bundle test). Aliases at :703 (filters/globalFilter) and :785 are hint-only on a strictObject; the accept set widens by the key alone. (b) Index +3 in packages/spec/api-surface/system.json / export-origins/system.json: AddressedPageRoots (type) i18n-resolver.ts:1682, GlobalFilterLike (interface) :1152, globalFilterKey (function) :1187. (c) walkAddressedPageComponents :1735-1738: parameter widened Pick<PageLike,'regions'> → AddressedPageRoots (accept set widens), return changed PageLike['regions'] → AddressedPageRoots (breaking for any return-reader). Additive optional members: PageLike.slots? :1530, DashboardLike.globalFilters? :1173.
• Walker coverage, re-read on the head. Roots: regions then slots, each slot one component or an array (:1750-1766 root-id claim; :1858-1876 rebuild), matching PageSchema.slots per-slot union page.zod.ts:739-753. Descent: properties.children and any items[] entry carrying a children array (:1791-1822), matching PageTabsProps.items[].children component.zod.ts:758 and PageAccordionProps :1762; body/footer stay undescended. Depth cap is the first line of walkComposition (:1791), cycle guard unchanged (:1830-1836), translatePage stops at region-level components, so copy on components nested in another component's properties.children is authorable but never resolved — 4 KPI labels stay English on hotCRM's zh-CN landing page #12961 arbitration now root-wins-outright (:1840-1842). translatePage destructures :1987 and carries slots back :2063. translateDashboard overlays filters identity-preservingly and leaves globalFilters off the copy when nothing resolved (:1231-1270, :1329-1340). Extractor root header route now asks the shared walk (:1366).
• Key derivation premise holds at head: GlobalFilterSchema.name "defaults to field" dashboard.zod.ts:801, field required :825 → globalFilterKey (name, else field, else undefined) is the schema's own declaration, not a lenient fallback.
• Bundles match authored filters: platform-objects system_overview authors field: 'created_at', no name (system_overview.dashboard.ts:236-238) → created_at key in en/es/ja/zh; showcase region / task_status match revenue-pulse.dashboard.ts:40 / ops-dashboard.dashboard.ts:67; zh-CN rows are translations.
• Consumers: in-repo translatePage + CLI extractor, both updated. objectui at the pinned .objectui-sha 53ded82b (unchanged by the merge; same on origin/main): git grep for the four symbols → 0 files; positive control pickLocalized → 73 files. The breaking half is a third-party concern only.
• Card delivery vs acceptance: A — slotted-page walk count non-zero and tab-panel contents addressable (tests walks regions[].components[] AND slots.<slot>…, descends into items[].children…, resolves each authored key — slots roots, tab panels…). The tab strip's own items[].label remains unaddressable, pinned as BOUNDARY — the card's "each authored key resolves" is delivered for component keys, not strip labels. B — filter label + static option labels delivered; optionsFrom excluded by design. Docs: content/docs/ui/translations.mdx:80-81 rows accurate against PAGE_COMPONENT_COPY_KEYS :1576-1578; generated references regenerated; no content/docs/releases/** edit.
• Dev report 5586199586 open questions (no patch-round report exists — that dev died at ~03:29Z per 5597046128): OQ1 (tab strip label key) → A, leave as-is: the card's suggested shape does not include it, both keyings are unstable while value is optional, the BOUNDARY pin records it — and F3 below must be fixed before any option-B visitor is attempted. OQ2 (minor + pair return) → A, and now correctly carried: minor is right under the launch-window rule only with the banner + disposition, which the head has (:9, :24); the { regions, slots } pair is the right shape (a sibling array-returning export would rebuild regions and leave translated slots behind — the partial-rebuild trap the report names); the migration line at :9/:13 is adequate. No deviations declared; the out_of_scope_findings are noted-not-filed and stay that way.

Semver / changeset

• One changeset: .changeset/i18n-slotted-pages-and-global-filters.md — @objectstack/spec: minor, @objectstack/cli: minor, @objectstack/platform-objects: minor.
• Rule applied: LEVEL axis (check-changeset-no-major.mjs:5-16, [finding] No gate answers whether a changeset's LEVEL fits the surface — Check Changeset is green on patch and on minor for the same diff #16055/[finding] Check Changeset's clause-② level rule is PR-scoped but the fact it judges is package-scoped — a PR that widens package A is refused for grading package B patch, where B only received a comment #16361) needs ≥1 moved package at minor+ under a yes; the WHICH LEVEL rule (pr-automation.yml:712-719) makes a purely additive widening of a published surface at least minor per package. All three packages widen: spec (group + 3 exports + signature), cli (new emitted key family :1325-1344, root-header route :1366), platform-objects (new bundle rows in four shipped Setup bundles). major is refused during the launch window (:47-50); minor is the correct level.
• Breaking carriers: **BREAKING** banner :9; ADR-0087 marker :24 (exactly one; readDisposition refuses >1). type-surface-only — the only category exempt from the prescription refusal (ADR-0087 D8 :772) — is closed to this PR by predicate 2 (diff touches packages/spec/**, gate :3021-3031), so no-migration-prescription with the :22 argument is the honest available disposition, as the prior review prescribed. See F5 for the residual.
• Both gates green in CI on the head and re-derived offline on origin/main's scripts (which post-date CI's base 92949593d: check-adr-0087-registration.mjs moved in fix(scripts): a dotted member path's last segment resolves at the region's top depth #17001/Generate the lockstep package count instead of hand-typing it #17055 — 0 changed lines touch the prescription arm; check-changeset-no-major.mjs unchanged).

Boundary flags

• Governed paths: none of the 21 files is under .claude/**, skills/**, docs/adr/**, AGENTS.md, CLAUDE.md, or content/docs/releases/** (grep over the diff file list: no match). docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is a regenerated ledger (350→351, one new strictObject). Governed Surface Queue Guard green.
• Tier of the corrective push: 2a347ac7 and 7b942e760 carry Co-Authored-By: Claude Opus 5 — below CONTRACT_REVIEW_TIER, as the claim 5594626301 declared. Their scope is confined to the changeset, one new test file and one regenerated doc line (interdiff-proven); no contract code moved at that tier. This at-tier review is the compensating control.
• Record integrity: recovery comment 5597046128 states "the PR body was updated at 03:19Z". Measured false: the 03:19:19Z timeline event is labeled needs:contract-review (yinlianghui); the body is 12508 bytes, the exact size the dev report recorded at creation, and still carries the pre-fix changeset paragraph. GraphQL edit history is not served to this seat; the REST timeline and byte count are the evidence.
• Card state: pm:queue, assignee cleared (dead-claim recovery); PR draft; needs:contract-review on both carriers (check-clause2-carriers pair agrees: label present, body line Clause-②: yes). No patch-round os-dev-report; CI is the only measurement of 7b942e760 — acceptable given the diff since af0593780 is test + changeset only.
• Merge path: maintainer-only stands (published contract widened three ways plus a breaking return shape on a published function). Main has not touched any of the PR's 21 files since the merge-base; mergeable_state was unknown at read time (not yet computed by GitHub).
• Docs-drift bot's two flagged pages (validating-metadata.mdx, dashboards.mdx) were not re-derived here; neither is in the diff.

Findings

• F1 — non-blocking (must be edited before the maintainer reads it; no push needed): the PR body is stale on three counts — its "Changeset:" paragraph still says @objectstack/cli patch, @objectstack/platform-objects patch (contradicting .changeset/…:3-4), it never mentions the **BREAKING** banner / ADR-0087 disposition or the new pin, and the Finding B paragraph still overstates the alias mirror (text, items are not GlobalFilterSchema aliases — dashboard.zod.ts:787; text→label is the option-row alias :855). Owed record items 4 and 5 are therefore undelivered; the nine outside-Zone-1 files (CLI extractor + two tests, platform-objects extract config + 4 bundles, showcase bundle, translations.mdx, changeset) still belong in the body.
• F2 — non-blocking: stale docblock in a touched file. packages/cli/src/utils/i18n-extract.ts:1072-1075 says lint's walkPageComponents is "WIDER than the resolver in four ways (slots.<slot> roots, properties.items[].children, properties.body, properties.footer)" — after this PR it is wider in two; :1067 "counts its id as region-level" is now root-level.
• F3 — non-blocking (contract docblock accuracy): i18n-resolver.ts:1846-1848 says children and items[].children are "the slots the walk owns; everything else on the node is the visitor's". In fact :1814-1822 rebuilds the whole items array from the original component's panels and :1853 spreads it over next.properties, so any visitor edit to another items[*] key (e.g. a panel label) is silently discarded. No current visitor writes items (translatePage overlay :2012-2034 writes copy keys only; the extractor returns the node), so no behaviour defect today — but it is exactly what OQ1's option B would trip on. Fix the sentence, or rebuild panels from next.
• F4 — non-blocking (cosmetic): translation.zod.ts:785 alias table carries text: 'label' and items: 'options', which the dashboard schema does not alias; the code comment :781-784 names only title/name/choices/values. Hint-only on a strictObject; accept set unaffected.
• F5 — observation: the no-migration-prescription disposition passes because the changeset's one-line consumer rewrite ("binds const { regions } = …") is the imperative-sentence shape the detector deliberately does not read (gate header :830-839). The vocabulary has no category for a spec-internal TS return-shape change (predicate 2 closes type-surface-only), so this is the honest available answer and matches the prior review's instruction — recorded for the maintainer, not a change request on this PR.

CI at read time

38 check runs on 7b942e760 (all head_sha validated — a sibling seat's files shared this seat's scratchpad, so every artifact was re-fetched and checked by sha); 34 latest-per-name: 30 success, 4 skipped (Auto Label, Check PR Size, Packed-tarball smoke (opt-in), Console Pin Gate), 0 failure / 0 in_progress. Check Changeset success at 02:22:03Z (push) and 03:19:24Z (labeled); Lint & Repo Gates success (02:22–02:47Z); Test Core 1–6, Type Check ×5, Dogfood ×5, Temporal Conformance, Build Core/Docs, Spec property liveness, Part-of guard, both single-claim guards all success. Job logs are not retrievable from this seat; both changeset gates were re-run offline against the head (see above), exit 0. Not waited for; nothing was pending.

Implemented-by: branch claude/issue-16772-i18n-unaddressable-surfaces
Reviewed-by: director seat summon #20 (isolated fable subagent, transcript-verified before adoption)

{"pr":16883,"head":"7b942e760f318cfeb093bd0b5d9b63b7a609e734","verdict":"PASS WITH FINDINGS","blocking":[],"clause2":"yes","semver_ok":true,"governed":false,"ci":"34 latest-per-name on head: 30 success, 4 skipped, 0 red/in_progress; Check Changeset green x2; both changeset gates re-run offline exit 0"}

Generated by Claude Code

Landing note — the standing PASS WITH FINDINGS (5597570132, head 7b942e760f) carries to head 205fff6c74414e5268e96932d178295ab68b1224; carriers come off both faces; maintainer-only merge — the PR stays draft and #16772 goes to pm:awaiting-maintainer (director seat, summon #18 segment 3, session_017Js5kTpTtxieBjPyScgxJ3)

Delta verified by this seat at CONTRACT_REVIEW_TIER (git diff 7b942e760f..205fff6c74): 2 files, +28/−16, comment-only — every changed line is inside a docblock (git diff -U0 | grep '^[+-]' filtered for non-comment lines → none). Files: packages/cli/src/utils/i18n-extract.ts:1055-1081 (the emitPageComponentCopy docblock: roots and descent restated to what the widened walk does; the emission exception restated as ROOT-level; 「WIDER … in four ways」 → two, naming which two #16772 folded into the shared walk) and packages/spec/src/system/i18n-resolver.ts:1843-1855 (the walk-contract comment now states that composition slots are rebuilt from the ORIGINAL node, that items is rebuilt whole only on a node carrying a panel, so a visitor's edit to any other items[*] key is overwritten there and stands elsewhere). ⇒ Verdict F2 and F3 discharged (F3 judged docblock-wrong / behaviour-right, with :1814-1822 and :1851-1853 as the evidence — the behaviour is untouched); F1 discharged by the PR body edit (Changeset paragraph now minor ×3, the **BREAKING** (return shape) banner and the single ADR-0087 marker named, Finding B cut to the head's measurements). The spec-file hunk is prose in a docblock, so no accept-set, export or generated-artifact movement — nothing for a re-review to judge beyond this reading. Report: #16772 5599284023 (typecheck / cli i18n tests / both changeset gates re-run on the new head, exit 0 each).

Recorded deviations, accepted: the commit trailer names the model that did the round (correct: a trailer is evidence of who worked); the F2 edit also corrected two adjacent sentences of the same docblock that the verdict did not itemise but that would have contradicted the corrected one — same paragraph, same staleness, declared in the report.

Chain: needs:contract-review off this PR and off #16772; #16772 pm:dispatched → pm:awaiting-maintainer (the one remaining act is the maintainer's merge: protocol:system); PR stays draft — ⛔ not readied, not enqueued. CI on 205fff6c at this reading: 31 success / 7 in progress / 6 skipped / 0 failure; the maintainer merges on green.

Implemented-by: claude/issue-16772-i18n-unaddressable-surfaces (tail round under claim 5598829264) · Reviewed-by: 5597570132 (isolated claude-fable-5-1, summon #20) + this seat's delta reading.

Generated by Claude Code