fix(spec,lint,metadata-protocol): correct the view container name ledger note; delete the unreachable list-view tabs walks - #21423

📓 Docs Drift Check

2 anchor(s) derived from 3 changed package(s); no hand-written page names any of them. ⚠️ 3 changed file(s) yielded no anchor (packages/spec/liveness/README.md, packages/spec/liveness/view.json, packages/spec/src/system/i18n-resolver.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 28e65c82c6bb56932e3f040e0e35a6b5a66fdd13 && git checkout 28e65c82c6bb56932e3f040e0e35a6b5a66fdd13
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ceb4a939b42f7c91ac8e9d371df34b8663d3f7bc 7ee481ef2d32a880bc533f9f02b0eadaeeea1e92 && git checkout -B drift-repro ceb4a939b42f7c91ac8e9d371df34b8663d3f7bc && git merge --no-ff 7ee481ef2d32a880bc533f9f02b0eadaeeea1e92

node scripts/docs-audit/affected-docs.mjs --json ceb4a939b42f7c91ac8e9d371df34b8663d3f7bc

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 7ee481ef2d32a880bc533f9f02b0eadaeeea1e92
Local-runs: none

Read at 2026-10-02T14:42Z by an isolated subagent of the seat session, against the card (#20301, body and all 24 comments), the PR body and file list (11 files, +88/−59), the net diff against main, and the head's check-runs. The scope of record is the re-scope 5953063959 as corrected by 5953104466. Every file claim below was re-read at the head with git show; nothing was built, run or re-run.

① Derived judgments

Accept set at every metadata door: unchanged — right. No view.zod.ts, no conversion, no tombstone, no door change in the file list. The two code deletions remove reads of a key the spec already refuses:

1. @objectstack/lint validateListViewFieldRefs — checkTabs(listView.tabs, …) deleted. Right. The rule enters AUTHORING_RULES through the validateReferenceIntegrity row (authoring-rules.ts:880, tier: 'gating', input: 'parsed', runtimeTypes includes view), and tabs is retiredKey( on ListViewShapeSchema (view.zod.ts:2886), the shape ListViewSchema, ObjectListViewSchema and the flattened overlay arm are built from — so on the parsed stack the key never reaches the walk. At the runtime write door the schema gate (resolveOverlaySchema().safeParse) refuses the key with its prescription; the deleted walk could at most have added a list-view-field-unknown finding under a key already refused. checkTabs stays defined and keeps its one caller, userFilters.tabs (:801). The header prose that listed tabs[].filter and tabs[].view as walked positions is corrected, and the test's exact-list HARD_CODED_FILTER_WALKS drops tabs.filter.field as that assertion requires.
2. @objectstack/metadata-protocol computeViewReferenceDiagnostics — the view?.tabs read deleted. Right. Its one production caller is getMetaItem (protocol.ts:9028), on the decorated served body: decorateMetadataItem runs computeMetadataDiagnostics, the schema re-parse that badges a tombstoned key with its prescription; a stored row replays the full chain including retired entries (applyConversionsToStoredItem), and an artifact body goes through applyArtifactForwardConversions with includeRetired: true (artifact-forward-conversion.ts:446), so the D2 view-list-tabs-removed strips tabs before the walk. The objectql test case is converted to the surviving userFilters.tabs read on the same unknown field — a negative case that file lacked — right.
3. packages/spec/liveness/view.json name row — status stays dead, note rewritten, verifiedAt moved to 2026-10-02. Right, and it is the published surface this PR changes (liveness is in @objectstack/spec files[]). Each claim in the note holds at the head: normalizeViewMetadata (protocol.ts:1220, name: saveName when the body has none) is called in saveMetaItem at :17256, ahead of the schema parse at :17361; hydrateOverlayIntoRegistry (:15962) returns false for a body without name (:15990); mergePackageAwareOverlay (:1808) skips a body without name and slots by body.name; registerMetadataCollections mints name: itemName (engine.ts:7010); the cited pin is view-container-runtime-expansion.test.ts:252 ({ ...leadContainer, name: 'crm_lead' }, "the write door has always stamped" at :248); the objectui pin at the head is 89cad75d55, as the note says. dead under the ledger README's definition ("authoring the property changes runtime behaviour") is the reading the correction 5953104466 ordered; no status moves, so state-counts is unchanged (Spec property liveness: success). The runtime-door divergence the note names is filed as finding(metadata-protocol): the runtime save door accepts a view container whose body name contradicts its row name and registers it under both keys; the two source registrars refuse the same document #21412 (pointer 5953132688).
4. liveness/README.md view cell and the list.tabs note — the same correction, and the record that the two walks were deleted. Right: the retirement skill's ledger discipline requires the README row to follow a ledger correction, and the only other site in the tree carrying the old attribution is the view.zod.ts comment flagged under ③.
5. i18n-resolver.ts comment — comment-only; its @objectstack/spec 17.5.0 cite is right (the stage-1 merge 6e3e5462c6 is listed under ## 17.5.0 in the spec CHANGELOG; the merge sat at 17.4.0 in package.json).
6. view-list-tabs-retirement.test.ts RESIDUE — dropping the two fixture files is forced by the set's own assertion (:559-560: every entry must still hold an offender). The fixtures that remain (userFilters: { fields, tabs }, userFilters: { element, tabs }) are not offenders under isOffendingKeySet (needs tabs beside a LIST_VIEW_SIBLINGS key in the same frame). Right.
7. Governed surfaces: none in the file list (no .claude/**, skills/**, docs/adr/**, AGENTS.md, CLAUDE.md, NORTH-STAR.md); Governed Surface Queue Guard: success. This record is owed by the dispatch's tier ceiling, not by Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14.
8. Scope of record: items 1–3 of 5953063959 as corrected by 5953104466 are each delivered; the prohibited acts (tombstone, conversion, door change, view.zod.ts key change) are absent; Fixes #20301 is the closing the correction kept. The card this PR closes must claim this branch and Part-of PR must not also close its card: both success.
9. Base: the PR's merge base is 6d67ad5eca; origin/main (22c2d6f4d5 at this read) has not moved on any of the 11 paths since it (git diff --stat over those paths is empty), so the declared non-merge carries no path risk here and CI's merge ref judges the rest.

Gate verdicts on the head, read at 2026-10-02T14:40Z: 24 success · 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)) · 7 in progress (Lint & Repo Gates, Test Core 1/3/4/5/6, TypeScript Type Check). Success includes Build Core, Check Changeset, Spec property liveness, Governed Surface Queue Guard, Type Check · source gates / consumer gates / debt ledger, Dogfood Regression Gate 1–3, Dogfood Verify CLI, Temporal Conformance, Test Core (2/6). An in-progress gate is an honest reading, not a pass: landing waits for the seven to finish green.

② Semver level

Right: three patch changesets, each with the line Clause-②: no, and no skip-changeset. @objectstack/spec ships liveness/ in files[], so the ledger note is a published change and skip-changeset would be wrong; @objectstack/lint and @objectstack/metadata-protocol change code whose behaviour is preserved on every input a door accepts. @objectstack/objectql changes one test file and its files[] is dist/README.md/CHANGELOG.md, so no changeset is owed. The no arm is right with no (narrowing)/(widening): nothing an author can write is newly accepted or newly refused, and no export is added or removed. No breaking changeset, so no ADR-0087 marker is owed; the dev's local check:adr-0087-registration and check-changeset-no-major read ✓, and Check Changeset on the head is success.

③ Boundary flags

open_questions: none. Deviations and findings in the dev's report 5954648905, each answered:

• README cell and list.tabs note corrected beside the name note — in scope: item 1 is "correct the ledger", and the README row follows a ledger correction by the retirement skill's rule. Answered.
• Lint header prose and test comments updated to the deletion — part of item 2. Answered.
• objectql case converted, not deleted — right; it is the surviving walk's only negative case in that file. Answered.
• Not merged with origin/main — measured above (⑨): no overlap on the 11 paths. Answered, no action.
• Commit trailers: the model-free pair — AGENTS.md's "Commit message" rule names exactly that pair; both commits carry it and nothing else. Answered, right.
• Labels; worktree removed — not contract matters. Answered.
• view.zod.ts lines 4720–4728 still say artifact-shipped containers and the validation sweep send the container name (out-of-scope finding, carrier "the next PR to touch that block, or none"). Verified at the head (:4722-4723): it is the one remaining site of the misattribution this PR corrects. Answered in part: the scope of record forbade a view.zod.ts KEY change, not a comment correction, so the fix was permissible but not ordered, and the comment's conclusion ("tombstoning them rejected shapes the platform itself writes") stays true with its first clause (saveMetaItem sends the name) the true one. Not blocking: no published surface, no accept-set effect, and the record of record (ledger row and README) now carries the correction and names the old attribution as a misread. Escalated to the seat: "or none" is not a carrier; name one — a comment-only follow-up on that block, or the finding(metadata-protocol): the runtime save door accepts a view container whose body name contradicts its row name and registers it under both keys; the two source registrars refuse the same document #21412 landing, which re-reads the container-name semantics.
• objectui tabs?: ListViewSchema['tabs'] mirror — carried from 5870707479 to the next pin bump; the pin is unchanged by this PR. Answered.

Implemented-by: claude/issue-20301-view-container-name-retired
Reviewed-by: session_01YDt3PzwfrkuFzUBF89WPmM

VERDICT: PASS

Generated by Claude Code