[pm:seat] domain:ui @ objectui — 🟢 session_01KbJQ1y1J12nZxYzFWhP8Q3 (os-sam) · R1 · FORCED TAKEOVER 04:33Z on maintainer instruction · inherited 4 live dev PRs · ⚠️ #7577 awaiting contract review · 2 half-states to repair

[os-sales]

Seat registration post for the domain:ui lane — the objectui execution seat (maintainer ruling 2026-08-21, the three-way split of objectui cards into domain:devx / domain:spec / domain:ui).

Body is authoritative; title and assignee are derived views. Single writer: the sitting seat PM. Comments are audit only and never carry state. Position description lives in the pm-dispatch skill (the domain:ui row of its domain table); this post carries current state only. Successor: /pm-dispatch ui@objectui, read this post first, then only the comments later than this body's last edit.

1. 当前 PM — current seat

status	🟢 sitting — session_01KbJQ1y1J12nZxYzFWhP8Q3, GitHub identity os-sam, sat 2026-09-04T04:33Z. Session configured claude-opus-5
⚠️ how this seat was taken	FORCED TAKEOVER on an explicit maintainer instruction — 「强制接管 domain:ui」, given ~04:30Z after this session presented the seat as live and named the risk. Full record, including all four mutex readings: comment 5535698078
previous seat	session_01EMrWaQw3XS5DxTHxp4yRyC (os-project-manager), sat 2026-09-02T14:32Z. ⛔ Never signed off, and was MEASURABLY ALIVE at takeover — last write 04:20Z, four dev PRs pushed within ten minutes. This is not a stale-claim reclaim and must not be cited as one
in flight (inherited)	#7577/#5928 · #7596/#7077 · #7595/#7593 · #7473/#7462. See §2
batch / timers	R1, mode:subagent. ⚠️ Re-arm the check-in as the FIRST action of every tick

⚠️ Identity correction on record: the takeover comment above states this seat's identity as os-project-manager. That is wrong — GitHub recorded the comment under os-sam, which is this seat's actual identity. The body is authoritative. This matters because GOVERNED_APPROVERS attribution and the governed-merge audit both read the acting login, and because os-sam is itself the holder of an owed stale claim (#4795, §2).

2. 继承台账 — inherited ledger

⛔ Everything in this section was produced by the previous seat. It is inherited as-is, not re-reviewed and not re-dispatched. Readings are mine, taken 2026-09-04T04:25–04:35Z.

In flight — 4 live dev PRs, three pushed within ten minutes of the takeover

PR	card	state, measured 04:32Z	this seat's obligation
#7577	#5928	DRAFT, needs:contract-review, head 306924df4, updated 04:31Z	⚠️ Patch round on the director REWORK verdict 5534398423, adopted verbatim, awaiting contract review. Clause-②: yes. ⛔ Not ready-flipped, not enqueued, carriers not stripped, until reviewed at CONTRACT_REVIEW_TIER. Landing is this (the dispatching) seat's, not the director's
#7596	#7077	ready, updated 04:22Z	⚠️ half-state: card read pm:queue + unassigned at 04:25Z with this PR open. Repair before anything else touches it
#7595	#7593	ready, updated 04:22Z	⚠️ half-state: card carries bug + domain:ui and no pm-state label at all at 04:25Z with this PR open
#7473	#7462	ready, updated 04:23Z	⛔ #7462 is not in the open domain:ui set — lane ownership unconfirmed. Confirm before acting; it may belong to domain:devx or domain:skills

⚠️ The two half-states are the exact defect the previous seat recorded against itself twice (§4). A card reading unclaimed with a PR against it is an open invitation to duplicate work.

Landed by the previous seat (inherited, verified where stated)

R1: #7349→#7377 · #7182→#7381 (Clause-② yes) · #7004→#7384 · #6810→#7395 · #7212→#7409.
R2: #7453 · #7457 · #7468 · #7456 · #7451 · #7464 · #7447 · #7489 (177afeba1) · #7467 (20cb8db9b) · #7471 (77cb489b4) · #7442 (48c19bd48) · #7400 (e8c553bcb) · #7498 (0dc2c9324) · #7500 (04a67b9dc) · #7491 (e17605309).
#7228 → PR #7591 MERGED 2026-09-04T03:54:25Z (verified by me on the PR object: merged: true, merged_at set). #7221 closed by its own criterion.

⚠️ Awaiting the maintainer — 3 open, ⛔ do NOT rule any

card	state
#6121	previous seat recommends A1, which is what PR #7487 already contains
#7486 / #7479	lazy-load the ten locale catalogues (option C) — structural follow-up to #7399
#7205	⚠️ RULED but unexecutable. Maintainer ruled B refined 2026-09-02 (「7205 B，其他同意」/「7205 只有在 studio 中才是设计元数据，前端界面只是使用。」). The ruling comment 5508052099 is truncated by the sanitizer — direction survives, execution section and state-transition line are gone. Repost requested twice. ⛔ Three seats have now declined to dispatch from a partial ruling. Held.

Queue / cards

• Dispatchable domain:ui pm:queue, unclaimed (from the 04:25Z whole-lane read, 131 open): finding(types/app-shell): 8 more hand-written select-option shapes remain after #6887 — and the derivation gate is structurally blind to the whole class #7014, finding(plugin-grid/app-shell): the record-title key exists in THREE spellings, and lookup_filters/lookupFilters in two — one concept, several names, each only reconciled with itself #7021, finding(plugin-grid, fields): the snake_case half of the lookup dialect — display_field, description_field, lookup_filters, id_field — is refused by the strict FieldSchema, so no spec-compliant producer can emit it #7155, Clicking a column header silently persists an org-wide view overlay carrying the entire view definition — no save gesture, no indication #7205(held), 8 zod-mirror drifts need a per-key ruling — renderer readings attached (groups B and C of #5927) #6033, Locate the consumer of a registration's icon meta before extending the icon gate to it — zero read points in objectui AND objectstack, so two suspect spellings stay undetermined #5936, finding(types): BaseSchema's [key: string]: any leaves every component schema open, so a "declare the surface" fix can never reject a misspelled TOP-LEVEL key #5155, [Decision] ObjectMapConfigSchema 要不要 .strict() —— 类型面的保证只保护 TS 作者,而 AI 产出的 metadata 恰恰不带类型 #5157, [Decision] CarouselSchema.opts is declared as an OPEN record while the docs declare a two-key shape — narrowing it needs a census of authored embla option bags (deferred ruling carried out of #6150) #6952, [Decision] Server parity for current_user.can(object, verb) — ADR-0068 requires the aliases to evaluate identically on client, server-formula and server-RLS, and #4421 phase 1 ships client-only #6941, finding(core): ValidationEngine is a second validation vocabulary with zero consumers and no barrel export #6964, Studio: render advisories on the BATCH publish door ("publish whole app") — blocked until objectstack#9343 stops discarding them server-side #6965, clientValidation spec-skew cures rest on stale premises: the flow node-type shim is unreachable and sharing_rule’s edit-door opt-out was measured on 17.0.0-rc.5 #6982, finding(types): three more type names are declared twice with disagreeing shapes — FormField, MarkdownSchema, KanbanSchema — and one doc asserts FormField is declared once #6172, 决策：#7391 在 @object-ui/react 唯一入口上发布了 5 个符号，而裁定 a′ 写的是「the constant is internal」——就地追认、迁 core、还是收回？ #7508, [finding] 响应式词汇的两个零消费表面:useResponsiveConfig 生产零调用者(page.components[].responsive 因此实际未生效)、MobileComponentConfig 零消费者 #4773, Handover for the next domain:ui execution-seat PM — what will burn you, what I got wrong, and what is waiting #7233/Handover for the next domain:ui execution-seat PM — measured traps, open state, and two rulings you may want to overturn #7089 (handover docs). ⚠️ Each still needs the per-card stale-premise check; this is a label reading, not a dispatch list.
• pm:dispatched, assigned, older: 46 exported type names carry a second authority — 42 of them are named by no family card #6349 (updated 2026-09-03T23:44Z) · burn-down: 119 ledgered DOM-attribute leaks in packages/components/src/renderers/**, grouped by mechanism #5632 (2026-09-03T22:08Z) · finding(views): the gantt and timeline branches still fabricate date-axis field names on all three faces — and app-shell's own #3129 note certifies them as already fixed #7070. Liveness unestablished by me — check before reclaiming.
• Stale claims owed: ⚠️ 除 content 外没有任何文本键既被求值又被读回 —— statistic.value / card.title / button.label 无法绑定表达式 #4795 (os-sam — this seat's own identity).
• pm:retriage awaiting triage: retire(types): EventHandlersSchema — 公开导出的 z.record(z.string(), z.function()),每个值 JSON 不可作者、无任何组合消费、census 与 parity 台账双双结构性不可见(ADR-0049 enforce-or-remove) #6910, finding(types): DropdownMenuSchema.trigger declares a single SchemaNode while its zod mirror, its sibling ContextMenuSchema, and its own shipped defaultProps all use the array form #7081, [finding] 「同一 en 字符串必须同一译文」不能做成门禁:281 组共享 en 值里 164 组至少有一个包刻意分开译 —— 记下分母,并点出其中两组像是笔误 #3880, Tighten data-objectstack's envelope-tolerant row extraction to the single post-unwrap spelling — after objectstack#13079's ruled convergence lands #7028. (finding(components): button-group implements no selection, and never wires the per-button onClick / disabled it declares — the catalog authors 29 keys nothing reads #7077 has since moved to pm:queue.)
• Decision box: 16-card "unchecked" worklist was retired as a phantom by the previous seat's audit (comment 2026-09-02T21:27Z). ⛔ Do not re-run it as an inventory.

3. 热文件串行队 — hot-file serial queue

file / resource	order	verdict
packages/types	#5928 / PR #7577 (in flight, contract review)	serial — the rename touches zod/base.zod.ts, the published zod/index.zod.ts barrel and zod-mirror-parity.test.ts
packages/components, schema-catalog corpus	#7077 / PR #7596 (in flight)	serial
packages/plugin-detail	#7593 / PR #7595 (in flight)	serial
console eager closure	✅ OPEN	#7399's A′ landed; framework ~60 KB against 71,000, i18n-locales carries the catalogue. ⛔ The old "byte-neutral is a selection criterion" rule is retired
packages/plugin-gantt	free	#7228 landed as 1735f6150 via PR #7591
packages/plugin-charts/**	free	⚠️ #7248 (claude/issue-7248-scatter-y-domain) may still be live on the scatter arm
packages/plugin-list, packages/plugin-view	free	#7500 landed; #7499 is the next card on both
packages/core, scripts/	free

4. 说明 — notes

Standing orders: decision card before any pop-up · governed surfaces draft-only · enqueue requires EVERY check green (⛔ not the required subset) · ⛔ no backfill pm:* strips on cards closed by earlier seats.

⭐⭐ This seat displaced a live one. Two duties follow. (a) ⛔ Do not treat any inherited artifact as abandoned — the previous seat may still push, and its dev subagents certainly may. (b) Anything in flight that the takeover comment's table missed — a dev running with no PR yet — is invisible to every reading available to me. Re-check the lane for new claude/ branches before dispatching into a hot file.

⭐⭐ Clause-② landing is the DISPATCHING seat's, not the director's. 「交付后复核由派发席在席内完成……PASS ⇒ 同席剥标、ready、auto-merge」. The director seat's role is optional post-hoc audit. An opus seat is not at tier and must commission a claude-fable-5 reviewer — but it lands the result itself. ⚠️ The previous seat held #7471 for 2.5 hours on the opposite belief and nearly commissioned a duplicate review.

⭐⭐ Verify a commissioned review's tier before adopting it, then adopt VERBATIM or void entirely. Grep the subagent transcript for the harness-stamped model on every verdict-producing turn. ⚠️ A naive fallback-marker grep produces false positives — one hit was the word "overloaded" inside a source comment the reviewer was reading.

⭐⭐ Carrier defects are a pattern — three distinct shapes in one shift. (a) card-side Clause-② machine-invisible because no comment matched CLAIM_COMMENT_MARKER (/^\s*>?\s*Claim(?:ed)?\s*:/mi); (b) gate label on neither carrier; (c) on the PR only. ⇒ Every dispatch requires the machine spelling Clause-②: yes at line start in the claim comment and the label on both carriers. ⚠️ A fourth instance is a card, not another one-off repair.

⭐⭐ scripts/pm/check-clause2-carriers.mjs CANNOT RUN in an MCP-only session — exit 2, "the pair could not be formed, so nothing about it was judged". Its own output says that is ⛔ not a clearance. A hand label-check covers strictly less: it is structurally blind to a missing claim-line spelling, which is exactly how (a) survived.

⭐⭐ Count the declaration form, never the word. A raw word-count read 1 → 1 and looked like a floor had survived; the residual was inside the new comment documenting the retirement. Every zero needs a control that fires; every probe must be built from the artifact, not the prose. ⚠️ The previous seat recorded being caught by this three times, most expensively when a ^export (const|function|…) probe returned 0 against a file that exports via a trailing export { … } block — turning a published duplicate into a phantom "unreferenced copy" (#7397).

⭐⭐ A ruling that names an artifact may be satisfied BY MECHANISM — a changeset is how a CHANGELOG statement "becomes" true. ⛔ Flagging a deviation you have not made is not harmless caution: it puts a phantom item in the maintainer's queue.

⭐ A stop-condition in a triage comment outranks the card's own recommendation. Dispatch with the stop-condition intact and the recommendation marked conditional, ⛔ never as pre-authorisation.

⭐ A count inside a ruling deserves no more credit than a count inside a file header. Measured three times in one night: a parity header saying 160 where the expression evaluates to 154; a triage saying "six of seven" where the table holds seven; a card saying "five keys of phantom drift" where the measurement is 8 unmirrored + 0 narrower. All three sat in prose no gate reads.

⭐ git worktree add with a bare branch name resolves the LOCAL ref, not origin/+branch. A stale local branch in the shared checkout silently checks out an older commit — measured, the shared checkout sat on d4c6a86a1 while main was a27d153c2. Always pass the origin/ form and verify with git rev-parse HEAD.

⭐ The sanitizer eats the left angle bracket in bodies AND in ruling comments, and an unclosed fragment takes everything after it to the end — inline backticks do not protect it. Measured to have destroyed the executable half of a maintainer ruling (#7205). Spell path placeholders in words or use a fenced block, then read the posted text back.

⭐ os-verify-lock.sh lives in objectstack, NOT in objectui (objectui/scripts/pm/ holds only check-half-states.mjs). The lock is container-level by design; a second copy would mean no lock. ⇒ Dispatch orders must name objectstack's absolute path.

Lane facts kept because they still bite: dispatch-gates.mjs --tier is a FLOOR, never a clearance · get_comments defaults to 15/page, so a card's LATEST ruling can hide on a later page · landing is verified by content with a live control, never by a PR head sha · $? after a pipe is the LAST command's · get_job_logs returns only the TAIL — ask for 400+ · happy-dom never fires container-size effects · list_issues with two labels returns the UNION · vitest runs from the repo ROOT (a package-directory run is refused, objectui#3378) · a PR body's attribution footer is stripped on every PATCH · search_issues needs a control query that must hit; dev containers get 403 on GET /search/issues · a 502 from the tool transport does NOT mean the GitHub write failed — read back before retrying · enable_pr_auto_merge echoes an empty method even when SQUASH applies · confirm enqueue positively via git ls-remote origin for the gh-readonly-queue/main/pr-N-* ref, and ⚠️ cd into the repo first — a bare git call fails and a naive guard prints a misleading "(queue empty)".

[os-sales]

Audit probe — angle-bracket survival through this write path

Not lane state. Posted to measure, precisely, which angle-bracket forms survive a body written through the GitHub MCP tools, because the seat post currently asserts a mechanism ("the GitHub body sanitizer strips angle-bracket-delimited content") that a counter-observation contradicts: dependabot's PR bodies (#4945, #4958) carry hundreds of literal HTML tags intact. If those survive and mine do not, the variable is the write path, not GitHub. This comment will be read back and the result recorded; it can be deleted afterwards.

Five forms, each on its own line, each labelled so a missing one is identifiable by its label alone:

• A · HTML comment:
• B · JSX tag in prose:
• C · TS generic in prose: Array<{ a: string }>
• D · bare comparison in prose: a < b and c > d
• E · pre-escaped entity: <div>

Fenced block, same five:

A <!-- os-dev-report -->
B <div className="x">
C Array<{ a: string }>
D a < b and c > d
E &lt;div&gt;

Inline code spans: A <!-- os-dev-report --> · B <div className="x"> · C Array<{ a: string }> · D a < b > c

Control (must survive, proves the comment itself landed): ZZCONTROL-SENTINEL-5560.

---

Generated by Claude Code

[os-sales]

Audit note — round 7, cross-repo finding raised for the maintainer's attention. Seat post body is authoritative; this comment records one item ahead of the round-close rewrite because it names a production-affecting shape in the other repo, outside this seat's lane.

objectstack-ai/objectstack#10928, filed by the #4765 dev while measuring the installed spec. Unassigned and unlabelled — deliberately, because it is an objectstack card and neither the labelling nor the grading is this seat's to do.

The shape: UniqueScopeSchema's rejection message calls 'organization' "the explicit spelling of true" on both surfaces. Measured against installed GA 17.0.0, that is false on one of them — on a declared index, bare true is the positional spelling of 'global', not 'organization'. The helper readout is unambiguous:

value	isUniqueDeclared	isGlobalUnique	isOrganizationUnique
true	true	false	false
'global'	true	true	false
'organization'	true	false	true

Bare true sets neither scope flag, so no organization key part is prepended — which is precisely what makes it 'global' on that surface.

Why it is worth the maintainer's eye rather than the queue's. An author refused on that key is told by the error message itself to write 'organization'. Doing so silently changes materialization — the driver prepends the NULL-safe organization key part — on an index that may already exist on deployed databases. That is the unannounced reinterpretation the #8323 ruling and the #5082 sequencing exist to prevent, arriving through the error text rather than through a schema change.

Duplicate-searched before filing (two searches, objectstack repo). Nearest prior art is #8463 / PR #8512, which corrected the same field-vs-index divergence on a different artifact — isOrganizationScopedUnique's JSDoc in driver-sql — not on the shared error map.

Relevance to this lane, and why it changed a fix here. The same divergence is why #5614 does not uniformly rewrite unique: true: at field level bare true is not deprecated at all ("stays valid indefinitely … no trap" per the spec's own prose), so harmonizing both occurrences would have shipped a fresh piece of false guidance on a card whose entire purpose is stopping exactly that. The dev caught this by measuring rather than by following the card, and the card is better for it.

---

Generated by Claude Code