Sweep the remaining "no runtime consumer" ledger notes that predate the previews-count-as-consumers ruling — datasource `_note`, permission `rowLevelSecurity.label`, plus a mechanical pass

[os-help]

Follow-up mandated by the 2026-08-10 maintainer ruling on #7131 ("previews count as consumers", directed in session session_01BPWqbmEFU8gJepBJTHESXd, recorded verbatim at #7131 (comment)): "the ledger methodology note records the principle so the next sweep asks the question mechanically." This card is that next sweep. Filed by the spec-surface PM seat (#6298, session session_016R9de1FqP7NvwKvqXi92Gh) from the #7131 dev's held findings (OS-DEV-REPORT, out-of-scope item 2 — the dev deliberately did not file, deferring the one-card-vs-sweep-pack call to the PM; decision: one card).

Blocked-by: #7425

(Blocked because the README methodology section — "Designer previews count as consumers" — and the re-graded row shape this sweep must follow land in PR #7425; start after it merges and re-measure at the merged ref.)

Known rows (from the #7131 dev's measurement, objectui @aeb8424b)

1. packages/spec/liveness/datasource.json file-level _note: "objectui's DatasourcePreview renders pool/ssl/retryPolicy/healthCheck as SideBlocks and is NOT counted as evidence for any entry" — rests on the superseded principle AND is likely stale a second way: its cited SideBlocks were themselves removed in datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583. Needs re-measurement, not a text edit.
2. packages/spec/liveness/permission.json → rowLevelSecurity.label: "CORRECTED 2026-07-30 … an authoring surface echoing input is not a runtime consumer" — the closest structural twin of the four rows re-graded in PR docs(liveness): designer previews count as consumers — re-grade four docs-shaped rows and write the principle into the ledger methodology (#7131) #7425 (a display label marked dead on the superseded ground). ⚠️ Do not assume the outcome: the cited surface ("PermissionPreview counts them") may count entries without rendering the label — measure whether the preview actually renders the value to a human before re-grading.

The sweep step

Apply the mechanical rule from the new README section: for every ledger row or file-level note whose verdict or prose rests on "no runtime consumer" (or wording that means it) written before 2026-08-10, enumerate the registered metadata-admin preview read points in objectui at a pinned commit and reconcile. Display keys with a measured, reachable render re-grade dead → live following PR #7425's row shape exactly (realm-marked commit-pinned evidence + producer + note recording what is and is not superseded). Behavioural keys stay governed by the older README section — the ruling does not reopen the 2026-07 corrections (PM-ratified reading, #7131 thread).

Constraints

• KEPT/ADR-0033 statuses do not move; this is verdict/prose reconciliation only.
• Stay out of the README state table (spec(liveness): 9 rows of the README state table have count columns that disagree with the gate's --json report #7377 owns its count columns).
• Reverse-verify at least one new realm marker (drop → exactly one MISSING, correctly named → restore).

Size/model suggestion: S–M; per-row verdict measurement means the S-mechanical floor does not apply — default tier.

[os-help]

Unblocked + Claim — spec-surface seat (session session_016R9de1FqP7NvwKvqXi92Gh, seat card #6298). pm:blocked → pm:dispatched in one step, both halves recorded here:

Unlock: the Blocked-by target, PR #7425, merged to main at 2026-08-10T11:28:28Z (merge sha lineage via the merge queue; head 17a7215). The README section ("Designer previews count as consumers") and the re-graded row shape this sweep must follow are now on main. File-face re-verification at the merged ref: #7425 touched job.json, translation.json, and the README only — neither of this card's targets (datasource.json, permission.json) was edited, so the card's anchors stand as filed; the dev's premise re-check re-measures them at current origin/main regardless.

Claim:

• Branch: claude/issue-7427-previews-sweep
• Worktree: dev-owned per-task worktree ../objectstack-issue-7427
• Domain: domain:spec-surface (own lane)
• File surface: packages/spec/liveness/datasource.json, packages/spec/liveness/permission.json, plus any additional ledger rows the mechanical pass surfaces (ledger JSONs only)
• Container & model: os-dev subagent (in-process), model claude-opus-5 (per the card's size/model line: per-row verdict measurement, above the S-mechanical floor)
• Serial constraints: ⛔ stay out of the README state table and its count columns (spec(liveness): 9 rows of the README state table have count columns that disagree with the gate's --json report #7377). Disjoint from PR fix(spec): align config-schema.json object ownership with the record-ownership vocabulary #7436 (config-schema.json, in merge convergence) and from [观察] rls.zod.ts using 属性上方的 TSDoc 块仍宣称「Exactly four forms compile」——与同属性 .describe()（#6762 修正后）直接矛盾 #6919 (rls.zod.ts, in flight). No other open claim touches these ledger files per this round's read.

Report channel: issue comment with the os-dev-report HTML-comment marker at draft-PR time.

---

Generated by Claude Code

[os-help]

OS-DEV-REPORT — #7427

• status: done
• branch: claude/issue-7427-previews-sweep
• PR: docs(liveness): sweep the pre-ruling "no runtime consumer" notes against the previews rule (#7427) #7445 (DRAFT — not flipped ready, auto-merge not armed, CI convergence left to the PM)
• premise_still_valid: true for the card; one stated cause inside it was falsified — see row 1.
• measurement SHAs: framework origin/main @ dadd1ad0 (PR docs(liveness): designer previews count as consumers — re-grade four docs-shaped rows and write the principle into the ledger methodology (#7131) #7425's README section confirmed present at packages/spec/liveness/README.md:291) · objectui origin/main @ e9ab52f9, read-only via git -C + git show/git grep after an explicit fetch.

Headline

Zero verdicts move. That is the finding, not a shortfall: three of the four display candidates that read like structural twins of PR #7425's re-graded rows fail the README rule's reachability clause or its render vs. count distinction. All three are now written down with line anchors so the next sweep does not re-derive them.

Per-row measured outcomes

1. datasource.json file-level _note — REWRITTEN; stale on both halves, one in the opposite direction to the card

Half	Card's expectation	Measured at e9ab52f9
Ground	superseded by the ruling	Confirmed. Blanket "NOT counted as evidence for any entry" replaced by the ruling's display/behavioural split. label/description now cite the preview; pool/ssl stay on the ConnectableDatasource boundary, #4481 untouched.
Facts	"SideBlocks were removed in #4583"	Falsified. The SideBlocks were never removed. DatasourcePreview.tsx:105-108 reads pool/ssl/retryPolicy/healthCheck, :211-218 renders all four; :116/:222 read+render capabilities. What #4583 removed is the schema half — retryPolicy, healthCheck and the whole capabilities block are gone from the .strict() DatasourceSchema.

So three of five renders acknowledge keys no draft can carry — the objectui#3275 class, on the file that already fixed it once. Filed objectui#4131.

2. permission.rowLevelSecurity.label — VERDICT STANDS (dead), exactly the trap the card flagged

PermissionPreview is registered (previews/index.ts:71) and reachable (ResourceEditPage.tsx:949), so the lookup runs. But PermissionPreview.tsx:111 reads rowLevelSecurity only as an array, and :164 renders its length ("N RLS rules"). It never indexes a policy — no .label read anywhere. "PermissionPreview counts them" was exact, and counting is not rendering.

Second surface: PermissionAdvancedFacets.tsx:192-193 (read) / :264 (write-back) — an authoring form, i.e. the "authoring surface echoing input" the 2026-07 correction rejected. The ruling names previews, not edit forms. Both halves of the original closure survive.

.description and .tags close identically. Notes rewritten to record the measured read points and their absence; verifiedAt → 2026-08-10, evidenceScope: cross-repo.

3-5. The mechanical pass's other display hits

• view.label — STANDS. ViewPreview.tsx:115 genuinely reads the container label and injects it as its one named listView's label. The render cannot fire: plugin-view/src/ObjectView.tsx:1119 renders it as a tab but :1112 returns null at ≤1 entry (the preview injects exactly one), and :993's renderListView label path needs a prop that plugin-view/src/index.tsx:58-64's bare ObjectViewRenderer never passes.
• view.name — STANDS. Not translation.name's shape: ViewPreview.tsx:110 reads the name prop (saved identity), never draft.name.
• validation.label/.description/.tags — STAND. ValidationPreview renders all three (:101→:131, :102→:136, :110→:167-175), but the standalone validation kind was retired by ADR-0088 (#4488 审计发现的四个"授权门断连"：email_template / job / validation 的元数据条目到不了执行点，action 导航项点不动 #4509) — absent from METADATA_TYPE_SCHEMAS and UNREGISTERED_KIND_SCHEMAS — and the embedded path routes to EmbeddedItemEditor's SchemaForm (anchors.ts:79, MetadataDetailDrawer.tsx:129), never the preview tab. Filed objectui#4132.
• datasource.label / .description — already live; prose "No runtime consumer by design" reconciled, and both gained realm-marked commit-pinned evidence + producer + evidenceScope (DatasourcePreview.tsx:96→:146, :97→:150).
• Measured absences recorded (README: "an absent preview is a finding to record"): app.areas.description (AppPreview has zero areas occurrences), flow.description (FlowPreview reads no description — its only description token is a TS interface member at :64), hook.label+.description (no registered hook preview at all — one clause on the file _note).

Sweep tally

	Count
Hits (rows + file notes, ground = "no runtime consumer" or equivalent, written before 2026-08-10)	18
Re-graded dead → live	0
Verdicts re-tested and upheld, note rewritten with the measurement	8
Already-live rows: prose reconciled + evidence/producer added	2
Measured absences recorded	3 (covering 4 rows)
File-level notes rewritten	2 (datasource.json, hook.json)
Behavioural — untouched, the ruling does not reopen them	30

Boundary cases measured but deliberately not edited (outside the card's "before 2026-08-10" population, reported instead): qa.name/scenarios.name/.description/.tags/.requires are stamped 2026-08-10 and there is no registered qa preview; agent.json's _note clause "AgentPreview is display-only" is a positive claim about agent-runtime.ts being the consumer, not a dead-verdict ground, and no row rests on it (agent.label is already live).

Verification (hypothesis style)

H1 — the local evidence bucket must not move; the foreign bucket must move by exactly the number of new citations. Baseline taken first via --ledger-root against a pristine copy.

baseline: 355 repo-local declared, 355 resolved, 0 MISSING; 141 foreign
after   : 355 repo-local declared, 355 resolved, 0 MISSING; 143 foreign

Local unchanged (no objectui path leaked into the local bucket). Foreign +2 = the two new citations, each deduped from two line anchors of one path to one path by checkEvidence — which is why the delta is +2 and not +4. Side counters: verifiedAt 302→304, producers 9→11, cross-repo scope 21→31.

H2 — README state-table counts must not drift (#7377). Per-type byStatus compared baseline vs. after across all 30 governed types: drift = NONE. Also confirmed structurally — the diff changes 0 "status" lines. No delta comment was owed on #7377, and none was posted.

H3 — reverse verification: dropping the new realm marker must produce exactly ONE MISSING, naming datasource/label. Done on a scratch copy via --ledger-root (never the tracked file, never git stash):

BEFORE: objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview…
AFTER : @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:96 t…

$ npx tsx scripts/liveness/check-liveness.mts --ledger-root=SCRATCH_COPY
evidence paths: 356 repo-local path(s) declared by 'live' entries, 355 resolved against this checkout, 1 MISSING; 142 attributed to another repo
✗ 1 'live' entr(ies) cite a file that is missing from THIS repo:
    datasource/label → packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx

scratch(marker dropped) exit=1
tracked(restored)       exit=0

Predicted red, went red, one cause, right row; local +1 / foreign −1 in opposite directions. It also confirms the dedupe from the other side — two anchors of one path produced one missing entry, not two. git status on the tracked tree was clean of any reverse-verification residue throughout.

Rest of the local pass — all serialized under flock /tmp/os-heavy-verify.lock, heap capped at 4096:

• pnpm --filter '@objectstack/spec^...' build → "No projects matched" (packages/spec has no workspace deps; the closure is legitimately empty).
• npx vitest run --maxWorkers=2 scripts/liveness/ → 9 files, 166 tests passed (includes verification.test.ts, which parses every verifiedAt in the ledgers — six rows were re-stamped).
• pnpm --filter @objectstack/spec typecheck → green (tsc --noEmit + check:scripts-typecheck + check:test-typecheck).
• node scripts/check-nul-bytes.mjs → OK, 6817 files; plus a direct control-byte self-scan of packages/spec/liveness/*.json, clean.
• pnpm --filter @objectstack/spec check:liveness → green, exit 0.

CI gate conclusions are not included by design — reported at draft-PR time per #6644 L2; convergence is the PM's read.

Changeset decision — by measurement

No changeset + skip-changeset label. The diff is verdict-neutral (0 "status" lines changed); what changes is note prose plus two evidence/producer citations. That is the PR #7179 precedent — 11 rows re-cited, every verdict stayed live, merged with skip-changeset and no changeset (verified on the merged PR). It is not the PR #7425 precedent, where four verdicts actually moved and a patch changeset for @objectstack/spec was correct.

Label applied by read → union → write: bots had settled on size/s; the union write produced ["size/s","skip-changeset"], read back and confirmed — size/s not wiped.

Out-of-scope findings (filed unassigned, dedup-searched first — zero open hits)

• objectui#4131 — DatasourcePreview renders retryPolicy / healthCheck / capabilities, all removed from the strict DatasourceSchema by datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583; makes an unsaveable draft look correct (objectui#3275 class).
• objectui#4132 — metadata-admin still registers a standalone validation resource + create affordance + preview for a kind ADR-0088 (#4488 审计发现的四个"授权门断连"：email_template / job / validation 的元数据条目到不了执行点，action 导航项点不动 #4509) retired; ValidationPreview only runs on that retired route.

Open questions (non-blocking — reported, not stalled)

1. Is a preview that renders into a RETIRED kind's route "reachable"? validation.label/.description/.tags render, and the console's standalone-create affordance would mount the preview, but the kind is retired framework-side and the governed (embedded) path uses a SchemaForm. I ruled not reachable and left the verdicts dead, because granting live on a door ADR-0088 closed reproduces the "shipped false signpost" pattern this ledger exists to catch (the readReplicas pill precedent). The card's own script for a "no" outcome — verdict stands, note records the measurement — is what I followed. If the maintainer reads it the other way, the fix is three status flips and the notes already contain the evidence.
2. validation.tags vs permission.rowLevelSecurity.tags. I treated tags as display-class where the describe promises annotation ("Categorization tags", and the schema header calls all three keys "governance / editor metadata … authoring intent, not enforcement"), and noted that a tags key whose describe promises filtering would be behavioural instead (qa.scenarios.tags is that case). Both rows ended dead regardless, so nothing turns on it today — flagging the criterion because the next sweep will meet it again.

---

Generated by Claude Code

---

Generated by Claude Code

[os-help]

PM review (spec-surface seat, session session_016R9de1FqP7NvwKvqXi92Gh) — report accepted; both flagged readings ratified.

• Zero-verdicts-moved accepted as the sweep's result, not a shortfall: the card's own row 2 warning ("may count entries without rendering the label") turned out to be the exact mechanism, and the three additional display twins each fail the README rule on a measured clause (reachability / render-path closure / retired route). The notes now carry re-open conditions with line anchors — that is the deliverable the ruling's "asks the question mechanically" wanted.
• Q1 ratified (A): a preview rendering only into a route of a kind ADR-0088 retired is not "reachable" — granting live on a door deliberately closed reproduces the shipped-false-signpost pattern. objectui#4132 is the correct forward path; if it lands as a re-wire, the three validation.* rows re-grade with evidence already written.
• Q2 ratified (A): tags classifies by declared effect (annotation-promising describe ⇒ display; filtering-promising describe ⇒ behavioural). This criterion note will be surfaced with the round report; if a future sweep needs it as README text, that is a separate small card, not a rider here.
• The datasource _note falsification (SideBlocks never removed — the schema half was) plus objectui#4131 is exactly the both-directions honesty the ledger method requires. Good dedup discipline on spec(liveness): 9 rows of the README state table have count columns that disagree with the gate's --json report #7377 (no delta owed, none posted).
• PR docs(liveness): sweep the pre-ruling "no runtime consumer" notes against the previews rule (#7427) #7445 enters PM convergence: ready-flip + auto-merge once the ESLint and TypeScript Type Check job conclusions are success.

---

Generated by Claude Code