fix(service-settings)!: remove the Feature Flags page whose four toggles changed nothing - #30272

📓 Docs Drift Check

This PR changes 6 package(s): @objectstack/cli, @objectstack/mcp, @objectstack/platform-objects, @objectstack/plugin-security, @objectstack/service-datasource, @objectstack/service-settings, touching 22 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/cli/README.md, packages/mcp/src/connect-ui.ts, packages/services/service-datasource/src/admin-routes.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/connect-mcp.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/api/client-sdk.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/data-modeling/drivers.mdx (via sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/deployment/cli.mdx (via sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), setup.access (literal, a string literal in readPermission))
• content/docs/deployment/cloud-connection.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/deployment/environment-variables.mdx (via sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/kernel/contracts/cache-service.mdx (via feature_flags (literal, a string literal in namespace))
• content/docs/permissions/capabilities.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/permissions/delegated-administration.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/permissions/permission-sets.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/permissions/system-context.mdx (via readPermission (symbol, a field of const object featureFlagsSettingsManifest), sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), setup.access (literal, a string literal in readPermission))
• content/docs/protocol/kernel/config-resolution.mdx (via readPermission (symbol, a field of const object featureFlagsSettingsManifest), sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), writePermission (symbol, a field of const object featureFlagsSettingsManifest), setup.access (literal, a string literal in readPermission), setup.write (literal, a string literal in writePermission))
• content/docs/ui/apps.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/ui/audience-based-interfaces.mdx (via setup.access (literal, a string literal in readPermission))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via readPermission (symbol, a field of const object featureFlagsSettingsManifest), writePermission (symbol, a field of const object featureFlagsSettingsManifest), setup.write (literal, a string literal in writePermission))
• content/docs/releases/v17/17-3.mdx (via sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-5.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/releases/v17/17-6.mdx (via setup.access (literal, a string literal in readPermission))
• content/docs/releases/v18/18-1.mdx (via sys_setting (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 02f084bf16ccb44db778d972e6ead6eb1bfaa291 && git checkout 02f084bf16ccb44db778d972e6ead6eb1bfaa291
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 959c26be1f4179202b0ed42f58076190d4d590d5 74c2ef82638a525260943246260fcd7f2fd6902a && git checkout -B drift-repro 959c26be1f4179202b0ed42f58076190d4d590d5 && git merge --no-ff 74c2ef82638a525260943246260fcd7f2fd6902a

node scripts/docs-audit/affected-docs.mjs --json 959c26be1f4179202b0ed42f58076190d4d590d5

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 959c26be1f4179202b0ed42f58076190d4d590d5 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1d8e7702a7da24550c1b3f350426d8a03730a2f9
Local-runs: none
Scope: hits — packages/services/service-settings/src/index.ts, packages/services/service-settings/src/manifests/feature-flags.manifest.ts, packages/services/service-settings/src/manifests/index.ts, packages/services/service-settings/src/settings-service-plugin.ts, packages/services/service-settings/src/translations/en.ts, packages/services/service-settings/src/translations/es-ES.ts, packages/services/service-settings/src/translations/ja-JP.ts, packages/services/service-settings/src/translations/zh-CN.ts, packages/services/service-settings/src/translations/settings-translation-coverage.test.ts, packages/services/service-settings/src/settings-service.test.ts, packages/services/service-settings/src/settings-branding-posture.pin.test.ts, packages/services/service-settings/src/settings-help-business-words.pin.test.ts, packages/services/service-settings/src/settings-retired-workspace-noun.pin.test.ts, packages/services/service-settings/src/settings-visibility-declaration.pin.test.ts, packages/platform-objects/src/apps/setup-nav.contributions.ts, packages/platform-objects/src/apps/translations/en.ts, packages/platform-objects/src/apps/translations/es-ES.ts, packages/platform-objects/src/apps/translations/es-ES.source-hashes.ts, packages/platform-objects/src/apps/translations/ja-JP.ts, packages/platform-objects/src/apps/translations/ja-JP.source-hashes.ts, packages/platform-objects/src/apps/translations/zh-CN.ts, packages/platform-objects/src/apps/translations/zh-CN.source-hashes.ts, packages/plugins/plugin-security/src/objects/default-permission-sets.ts, packages/services/service-datasource/src/admin-routes.ts, packages/mcp/src/connect-ui.ts, docs/qa/platform-checklist/areas/platform-core.json + packages/services/service-settings/package.json, packages/services/service-settings/src/settings-routes.ts, packages/services/service-settings/src/settings-service.ts, packages/services/service-settings/src/settings-service.types.ts, packages/services/service-settings/src/sys-secret-orphan-report.ts, packages/plugins/plugin-security/src/upgrade-impact-report.ts, packages/cloud-connection/src/runtime-config-plugin.ts, packages/core/src/security/resolve-authz-context.ts, packages/cli/src/utils/organization-ownership-apply.ts, packages/platform-objects/src/system/sys-setting.object.ts, packages/platform-objects/src/apps/translations/{en,es-ES,ja-JP,zh-CN}.objects.generated.ts, packages/spec/src/kernel/index.ts, packages/spec/src/kernel/public-auth-features.ts, ui/apps/console/src/pages/settings/SettingsHub.tsx, ui/packages/i18n/src/locales/en.ts, ui/packages/i18n/src/locales/de.ts, docs/adr/0007-settings-manifest-and-kv-store.md, docs/adr/0049-no-unenforced-security-properties.md, docs/adr/0087-metadata-protocol-upgrade-contract.md (addendum D9), scripts/check-adr-0087-registration.mjs (readFromBlock, predicate 3), .changeset/30204-feature-flags-namespace-removed.md (read for ②). Prose faces (content/docs/**, the two README.md files) not reviewed.

Reviewed at 2026-11-05T04:42Z against card #30204 (body and comments 6648454483, 6648715176, 6649695459), PR #30272 (body, file list, net diff against merge base bb86ff96cc6e) and the check-runs on this head. Read-only: no worktree, build, test or gate run.

Check-runs on this head. Success: Governed Surface Queue Guard, Lint · ESLint, Lint · docs & code guards, Lint · scoped · tooling self-tests, Type Check · source gates, Dogfood Regression Gate, Live E2E UI, Test UI, Build Docs, Check Changeset (first run), Check Documentation Links, Flag docs affected by code changes, PR-body guards (both), Plan Test Core shards, Spec property liveness, Auto Label, Check PR Size, filter. Still pending (in_progress, no conclusion): Build Core; Check Changeset (second run — the job that carries Require an ADR-0087 disposition on a declared-breaking changeset and check-changeset-no-major); Lint · CI, release & engine gates; Lint · PM dispatch-gates; Lint · repo & tooling gates; Lint · scoped · query-options erasure; Lint · scoped · slot lookup & corpus; Test Core 1/8 through 8/8; Type Check · consumer gates; Type Check · debt ledger; Type Check · workspace. Skipped by paths filter: Lint UI, Type Check UI, Build & E2E UI, Build UI Deps, UI Published Artifacts, Dogfood Verify CLI, Temporal Conformance, the opt-in harnesses. No check-run has failed. Those pending conclusions are gate verdicts this record does not supply.

① Derived judgments

1. Removed public export featureFlagsSettingsManifest — right. At the merge base it is reachable from @objectstack/service-settings's one published entry: package.json exports["."] maps to dist/index.d.ts / dist/index.js, generated from src/index.ts, whose line 164 re-exported the name from ./manifests/index.js (line 8 there). At head it is absent from both barrels and the declaring file is deleted. Repo-wide git grep at base and head finds no importer outside packages/services/service-settings itself (three of its own test files, all rewritten in this diff); ui/, examples/, apps/, packages/qa import nothing of it. The compiler-carried break lands only on an external host; the changeset names it.
2. builtinSettingsManifests 10 → 9 — right, and a behaviour change on a still-exported aggregate. The plugin defaults to it (settings-service-plugin.ts:201), so every host on the default slate loses the namespace at boot. Named in the changeset's FROM line. The three count pins that read the aggregate (settings-visibility-declaration 10→9 with a reason, settings-retired-workspace-noun floor 10→9, settings-translation-coverage floor 10→9) move with it; the 96-predicate pin is unchanged because the removed manifest declared no visible.
3. The four settable keys feature_flags.ai_enabled / kanban_swimlanes / realtime_cursors / inline_comments — removed, accept set to nothing, right. With no manifest registered, SettingsService.getManifest, get, getMany, getNamespace, set, setMany, resetNamespace all refuse through UnknownNamespaceError (code: SETTINGS_UNKNOWN_NAMESPACE, settings-service.types.ts:561); the REST door maps that class to 404 UNKNOWN_NAMESPACE on GET, PUT and action (settings-routes.ts:312, 373, 433). The changeset's wire and in-process codes match the tree. Pinned by the new test no longer serves the retired feature_flags namespace, which registers every built-in manifest with OS_FEATURE_FLAGS_AI_ENABLED=true in the env.
4. The namespace itself — removed, right. GET /api/settings lists service.listManifests(ctx) only (settings-routes.ts:277), so the hub no longer offers it. Side effect not named anywhere: feature_flags was the only manifest with category: 'Beta' / beta: true, so the hub's Beta category disappears with it — harmless, consistent with the ruling.
5. Setup nav entry nav_settings_feature_flags with 4 locale labels and 3 source-hash rows — removed, right. The entry carried no permission gate, so it was served to every Setup reader and pointed at a URL that now 404s; removing it with the page is what the seat amendment (option A) ordered. No remaining reference under packages/ or ui/ (source, tests, generated bundles). settings-branding-posture.pin.test.ts re-anchors its ordering control on nav_settings_lifecycle, the real last platform-objects Configuration entry at head. The platform-objects.test.ts:515 pin is a floor, not a count.
6. Locale bundles — settingsBuiltinTranslations and the four exported locale objects lose the feature_flags block — right. service-settings carries no generated bundle, so no regeneration was owed there.
7. OS_FEATURE_FLAGS_* environment variables and stored sys_setting rows become inert — right, and tolerated by every path that walks stored rows. upgrade-impact-report.ts:85-86, 672-681 deliberately does not judge a stored setting whose namespace no manifest registers; sys-secret-orphan-report.ts:326 classes an unknown (namespace, key) as unattributable and never throws (the manifest declared no encrypted specifier anyway); organization-ownership-apply.ts's settings-move step selects by scope = 'global', never by manifest (the manifest was scope: 'tenant'); cloud-connection/runtime-config-plugin.ts:1276 reads branding alone; resolve-authz-context.ts:3017 reads localization alone. No list-all, export or sync path resolves an arbitrary stored namespace through getManifest.

② Semver level

• patch on @objectstack/service-settings and @objectstack/platform-objects — right. Post-Task Checklist step 3: the level follows the metadata-protocol kind alone; Metadata-protocol: none takes patch, and a breaking non-protocol change ships patch with its BREAKING banner and ADR-0087 disposition. check-changeset-no-major forbids major in any case. Both bumped packages are the two whose published behaviour moves; the comment-only edits in mcp, plugin-security, service-datasource and the cli README line publish no behaviour and need no bump (dev deviation 2, accepted).
• Metadata-protocol: none — right. No spec key, accepted value, metadata type or authorable spelling changes; a settings key is an administrator's saved value, and the nav entry is shipped platform metadata, not an authorable key. Clause-②: no (narrowing) is present and identical on the PR body and the changeset.
• ADR-0087 disposition not-required (runtime-export-retired @objectstack/service-settings#featureFlagsSettingsManifest) — right, judged against D9's three predicates. Predicate 1 (retired-from-entry): shown in ① item 1. Predicate 2 (no-metadata-surface): at base the operand is declared in manifests/feature-flags.manifest.ts, not a *.zod.ts, not under packages/spec/src/contracts/, not an object definition, not a Zod projection, and no metadata surface references it in code. Predicate 3 (from-operands-named): readFromBlock reads one FROM side, the code span featureFlagsSettingsManifest between FROM and TO on the body's last line — exactly the marker's operand. The "Removed keys" bullet carries no FROM/TO pair, arrow or mapping table, so it is left to the residual prescription detector; the dev reports that gate green on both local heads, and its CI verdict is the pending second Check Changeset run.
• The dev's deviation on the FROM block (keys moved to a "Removed keys" bullet, FROM line names the export only) — forced and correct. D9 predicate 3 refuses any FROM operand the marker does not name as out of range, and a settings key is neither operand kind (package#Export or package#Type.member), so a per-key FROM line was never admissible under this category. The TO side ("drop it from the host's SettingsServicePlugin({ manifests }) list") is the one-line host fix a removal owes, and the BREAKING banner names both affected parties.

③ Boundary flags

• PR body: "the cloud repository is not readable from this seat, so a reader there is not ruled out" — escalated to the seat. A cloud-side read of feature_flags.* through the settings client or REST would now get SETTINGS_UNKNOWN_NAMESPACE / 404 UNKNOWN_NAMESPACE. Before landing, grep objectstack-ai/cloud for feature_flags, FEATURE_FLAGS_ and featureFlagsSettingsManifest; the tree here is clean either way.
• PR body: "Skills-docs: follow-up skills(objectstack-platform): plugin-development.md still lists a feature_flags settings manifest with ai_enabled / OS_FEATURE_FLAGS_*; PR #30272 removes that namespace #30275" for skills/objectstack-platform/references/plugin-development.md:354-356 — stated by the dev, not verified here (that issue is outside this review's inputs). The skill text still names the feature_flags manifest as the home for org-tunable toggles; skills/** is Tier H and was outside the dev's surface. The seat confirms the follow-up exists.
• Report deviation 1 (changeset FROM block) — answered in ②: right.
• Report deviation 2 (no bump for comment-only packages) — answered in ②: accepted.
• Report deviation 3 (model-free trailer pair on the thread branch) — a commit-message matter, not a tree matter; noted, nothing to judge here.
• Report deviation 4 and dogfood_battery (one red in permission-set-clone-door.dogfood.test.ts, also red with this diff reverted; attributed to 490d136 / fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222; carrier [Decision] Every non-admin member of a new app sees "no permission" for comments and activity on records they can read #30108 seat 2) — not this PR's. The control leg the dev ran is the right shape (same file, 19 source files restored to origin/main, force-rebuilt). Escalated only as: the seat confirms the main-red is on that lane's board before this PR arms the queue (AGENTS.md main-red convention). The head's Dogfood Regression Gate check-run is green.
• open_questions: [] — nothing to answer.
• out_of_scope_findings — the four listed are agreed (the dogfood red; the skills reference; docs.objectos.ai's FEATURE_FLAGS_AI_ENABLED; ADR-0007's worked example). On ADR-0007: its decision is the manifest-plus-KV mechanism; Example 3 and Phase 1 item 10 use feature_flags as an instance, so removing that instance reverses no recorded decision and no amendment is owed under Prime Directive 13. Three more that the report does not list — see ④ should-fix 2, 3 and 4 (two stale packages/spec comments, the console's Settings-hub subtitle, the sys_setting.namespace field description).
• Acceptance notes on packages/spec test fixtures and the console SettingsField.infoBanner-12671.test.tsx using feature_flags as a self-contained string — agreed: none imports the removed manifest, and each passes on its own fixture.

④ Design judgment

Judged against the card's ruling ("Remove the four toggles, and the settings page if it is left empty. A flag comes back with the feature that reads it."), ADR-0049 enforce-or-remove, and the code each hunk cites. The premise re-checked on this head: git grep for the four keys across packages/, ui/, examples/, apps/, scripts/ (source and tests, generated bundles included) finds no reader — only the new pin, the ADR-0007 example, dated audit prose, and fixture strings in spec/console tests that never touch the manifest. AppHeader.tsx's aiAssistant is a label key; the console's features map comes from /api/v1/auth/config. The ruling's second sentence is honoured: nothing was wired, all four were removed, and the then-empty page (a beta banner and two empty groups) went with them.

• packages/services/service-settings/src/manifests/feature-flags.manifest.ts, manifests/index.ts, src/index.ts — hold. The removal is total (declaration, aggregate, barrel), leaves no re-export behind an export *, and the comment in src/index.ts now names the manifests that remain.
• packages/services/service-settings/src/settings-service-plugin.ts — holds. The option doc now names builtinSettingsManifests instead of a list that was already stale; no behaviour change.
• packages/services/service-settings/src/translations/*.ts and settings-translation-coverage.test.ts — hold. The en.ts header now names the manifests it mirrors; the floor moved with the aggregate.
• packages/services/service-settings/src/settings-service.test.ts — holds. The new pin asserts the three faces of the refusal (aggregate, getManifest, get) with the retired env var set, so a re-registration or an env-only resurrection would red it. The rewritten tests keep their original purpose on ai.log_prompts (default false) and ai.trace_enabled (default true), which exist on aiSettingsManifest at head.
• settings-branding-posture.pin.test.ts, settings-help-business-words.pin.test.ts, settings-retired-workspace-noun.pin.test.ts, settings-visibility-declaration.pin.test.ts — hold; each count moves once with its reason written beside it. The business-words header keeps OS_FEATURE_FLAGS_AI_ENABLED as a historical example of the shape the sweep refuses, under a new line saying the namespace is gone — history, not a dead pointer.
• packages/platform-objects/src/apps/setup-nav.contributions.ts and translations/* (labels and source hashes) — hold. No dead link: the entry, its four labels and the three hashes leave together, and nothing under ui/ or packages/ names nav_settings_feature_flags.
• packages/plugins/plugin-security/src/objects/default-permission-sets.ts — holds. Comment only; the replacement list (branding, company, localization) is exactly the set of built-in manifests declaring readPermission: 'setup.access' at head. No permission set, seed or grant names the namespace anywhere in packages/.
• packages/services/service-datasource/src/admin-routes.ts, packages/mcp/src/connect-ui.ts — hold. Comment only; the texts no longer name a Setup page that does not exist.
• docs/qa/platform-checklist/areas/platform-core.json — does not hold; see must-fix 1.

Must-fix

1. docs/qa/platform-checklist/areas/platform-core.json is left self-contradictory inside the one item the diff edits. Item platform-core.settings-hub-roundtrip now says at line 788 "the 10 open-framework settings namespaces a stock boot serves: the 9 in builtinSettingsManifests", but line 796 still instructs "capture the visible manifests (the 11 open-framework namespaces above …)" and the scored clause at line 885 still reads "each of the 11 open-framework namespaces resolves GET /api/settings/:ns". A QA run scores that clause against a namespace that no longer exists. The hunk's own claim ("11 namespaces to 10, list and variants") is not what the tree says. Fix: change both 11 to 10 in that item (two numbers; check-platform-checklist does not read the prose, so nothing else moves).

Should-fix

2. packages/spec/src/kernel/index.ts:20-22 and packages/spec/src/kernel/public-auth-features.ts:21-23 both tell the reader that live runtime toggles "live on the feature_flags settings manifest (ADR-0007, env-overridable via OS_FEATURE_FLAGS_*)" — now false, and the only in-code pointer left to the retired manifest. packages/spec/** was outside the dev's surface and this is not in the report's out_of_scope_findings; file it as a follow-up (comment-only, no artifact regeneration owed).
3. ui/packages/i18n/src/locales/en.ts:2252 and de.ts:1825 — console.settingsHub.subtitle ("Configure your system, integrations, and feature flags."), rendered on the Settings hub header (SettingsHub.tsx:127), promises the page this PR removes. ui/ was outside the dev's surface and this is not in the report; file it as a follow-up (the SettingsHub.pageHeader-12553 test asserts the key, not the text).
4. packages/platform-objects/src/system/sys-setting.object.ts:119 — the namespace field's description "Manifest namespace (e.g. mail, branding, feature_flags)." ships in a package this PR bumps and in the four *.objects.generated.ts bundles. Drop the retired example and regenerate with node scripts/check-i18n-bundles.mjs --write (the translated-locale strings carry the same example, so each needs its one-word edit). Low; it is an "e.g.", not a claim.

Implemented-by: claude/project-thread-qzra6t
Reviewed-by: session_01Utp6CYVV6fcAQrNTDQRvPb

VERDICT: FAIL

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 74c2ef82638a525260943246260fcd7f2fd6902a
Local-runs: none
Scope: hits — docs/qa/platform-checklist/areas/platform-core.json, packages/cli/test/connect-agent-both-halves-wire.pin.test.ts, packages/platform-objects/src/system/sys-setting.object.ts, packages/platform-objects/src/apps/translations/en.objects.generated.ts, packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts, packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts, packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts + packages/platform-objects/src/apps/setup-nav.contributions.ts (entry count), packages/platform-objects/src/apps/translations/{es-ES,ja-JP,zh-CN}.source-hashes.generated.ts (provenance of the hand-edited help strings), packages/services/service-settings/src/manifests/storage.manifest.ts (the new example namespace), scripts/check-i18n-stale-fill.mjs (header). The whole-diff judgments of the record on 1d8e7702a7da24550c1b3f350426d8a03730a2f9 (comment 6649883787) stand for every file this delta leaves untouched; this record re-judges the delta alone and what it makes a claim about. Prose faces not reviewed.

Delta reviewed at 2026-11-05T05:22Z: git diff 1d8e7702a7da24550c1b3f350426d8a03730a2f9 74c2ef82638a525260943246260fcd7f2fd6902a, two commits (8dffea3, 74c2ef8), 7 files, +13 / -12, no changeset change, no package source other than one field description. Read-only: nothing built, run or re-run; no GitHub write.

Check-runs on this head. Every check-run is completed except the second Check Changeset run, still in_progress (its first run on this head concluded success; that job carries Require an ADR-0087 disposition and check-changeset-no-major, and the changeset is byte-identical to the one that passed on both heads). Success: Lint & Repo Gates, TypeScript Type Check, Test Core (and all eight shards — 1/8, red on the previous head, is green), Build Core, Governed Surface Queue Guard, Test UI, Live E2E UI, Dogfood Regression Gate, Build Docs, Check Documentation Links, Flag docs affected by code changes, PR-body guards (both), Plan Test Core shards, Spec property liveness, Auto Label, Check PR Size, filter, and every Lint · and Type Check · lane. Skipped by paths filter: Lint UI, Type Check UI, Build & E2E UI, Build UI Deps, UI Published Artifacts, Dogfood Verify CLI, Temporal Conformance, the opt-in harnesses. No check-run has failed. Of the ten required contexts, seven are success and three (Lint UI, Type Check UI, Build & E2E UI) are skipped by their paths filter.

① Derived judgments

1. Must-fix 1 of the previous record is closed. platform-core.json:796 now reads "the 10 open-framework namespaces above" and the scored clause at :885 "each of the 10 open-framework namespaces resolves GET /api/settings/:ns"; the item platform-core.settings-hub-roundtrip agrees with itself (fixture at :788, step at :796, clause at :885, variants list of 10). The only remaining "11" in the file (:762) is a dated change-record of QA run QA run · priority:P0 (23/23) · eeec88d1 · 2026-11-01 · 20 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #28545, history by construction. Right.
2. Should-fix 4 of the previous record is closed. sys-setting.object.ts:119 now gives mail, branding, storage; storage is a registered built-in namespace at head (storage.manifest.ts:11). en.objects.generated.ts carries the regenerated source text; the zh-CN / ja-JP / es-ES help leaves were edited by hand, which is the sanctioned path for a translated-locale value (AGENTS.md Documentation Guardrails: translated values are hand-written, editing one is fine, adding or dropping keys is drift — no key moved). None of the three *.source-hashes.generated.ts tables carries an entry for objects.sys_setting.fields.namespace.help, so the leaves are legacy-trusted translator text, not byte copies whose digest would now be stale; check:i18n and check:i18n-stale-fill are green on this head. Right.
3. New public-surface effect: none. No export, accept set, namespace, route, permission or nav entry changes in the delta. The one shipped-string change is the sys_setting.namespace field description (help text) in @objectstack/platform-objects, already bumped patch by the standing changeset; a help-string example needs no changeset line of its own.
4. connect-agent-both-halves-wire.pin.test.ts 33 → 32 — right, and the derivation the comment states holds on the tree. SETUP_NAV_CONTRIBUTIONS carries 23 nav_* entries at head (24 at the merge base, less nav_settings_feature_flags); 8 served groups + 23 contributions + the MCP entry = 32, on both assertions (:266, :290). This pin lives in packages/cli/test, outside the first head's surface and outside the dev's grep of count pins — it was the Test Core (1/8) red on 1d8e7702a, and it is the one pin of the Setup tree's total: a repo-wide grep of toHaveLength(32|33) and nav_settings_feature_flags over packages/**/*.test.ts and ui/**/*.test.ts(x) finds no other Setup-tree count. Test-only; @objectstack/cli publishes nothing from it and needs no bump.

② Semver level

Unchanged by the delta and still right: patch on @objectstack/service-settings and @objectstack/platform-objects, Clause-②: no (narrowing), Metadata-protocol: none, disposition not-required (runtime-export-retired @objectstack/service-settings#featureFlagsSettingsManifest) with the FROM line naming exactly that operand. The delta adds no published export, key or behaviour, so nothing in the changeset is owed a new line. The previous record's reading of ADR-0087 D9 predicates 1–3 is unaffected (the operand's base and head state did not move).

③ Boundary flags

• PR body "## Deviations from the order", bullets 1–3 — each matches the tree: the two 11 → 10 edits; the example namespace with regenerated en bundle and hand-edited translated leaves; the Setup-tree pin 33 → 32 with the comment's 24 → 23. Bullet 4 (FROM line names the export only) was judged right in the previous record's ②.
• PR body readings on 74c2ef8 (96 derived gate families, pnpm lint, cli pins, platform-objects 1514/1514, check:i18n, check:i18n-stale-fill) — consistent with the check-runs on this head, which are the verdicts of record; not re-run here.
• Previous should-fix 2 (two stale packages/spec comments) and should-fix 3 (console settingsHub.subtitle) — stated by the coordinator as filed on follow-up card spec + ui text still names the feature_flags settings namespace PR #30272 removes (kernel docblocks, the Settings hub subtitle) #30282; skills(objectstack-platform): plugin-development.md still lists a feature_flags settings manifest with ai_enabled / OS_FEATURE_FLAGS_*; PR #30272 removes that namespace #30275 (skills reference) stated as existing; the main-red permission-set-clone-door stated as tracked on main red: Dogfood Regression Gate (2/3) fails permission-set-clone-door after PR #30222 (member_default grants sys_comment) #30255. Those three cards are outside this review's inputs (card Feature flags: all four toggles have no reader, so turning them on does nothing #30204, PR fix(service-settings)!: remove the Feature Flags page whose four toggles changed nothing #30272, its diff and check-runs), so they are recorded as stated, not verified; neither stale comment is in this PR's surface and neither blocks it.
• Previous escalation (cloud repository not readable from the dev's seat; a cloud-side reader of feature_flags.* would now get SETTINGS_UNKNOWN_NAMESPACE / 404 UNKNOWN_NAMESPACE) — still open for the seat to clear before landing; the delta does not and cannot answer it from this repository.
• No new open question raised by the delta.

④ Design judgment

Judged against the card's ruling and ADR-0049 as before; the delta changes no behaviour, so the question is whether each hit holds against the code it cites.

• docs/qa/platform-checklist/areas/platform-core.json — holds. The item is internally consistent again; the Setup-destination total at :637 ("46 … recount from the payload each run") is a dated reading the file itself tells the runner to re-measure, so it is not a claim this diff falsifies.
• packages/cli/test/connect-agent-both-halves-wire.pin.test.ts — holds. Both counts and the comment's arithmetic are what the tree serves (8 + 23 + 1); the comment names the retirement that moved the count, beside the one that moved it before, so the next reader is sent to the measurement, not to a stale number.
• packages/platform-objects/src/system/sys-setting.object.ts and the four *.objects.generated.ts — hold. The example names a live namespace; the regeneration touched only the en leaf (rewritten from source) and the three translated leaves (hand-written values, no key added or dropped); no source-hash table claims those leaves as byte copies.

Must-fix: none. The previous record's one must-fix is closed in the tree.

Should-fix: none new. The two previous should-fix items that remain open (packages/spec/src/kernel/index.ts:20-22, packages/spec/src/kernel/public-auth-features.ts:21-23; ui/packages/i18n/src/locales/en.ts:2252, de.ts:1825) are outside this PR's surface and, per the coordinator, carried on #30282; they do not block this head.

Implemented-by: claude/project-thread-qzra6t
Reviewed-by: session_01Utp6CYVV6fcAQrNTDQRvPb

VERDICT: PASS

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

席位核对 · ACCEPT · head 74c2ef82 · 2026-11-05T05:23Z

Head-sha: 74c2ef8