decision(objectql): a `navigationContributions[].group` that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer?

[hotlong]

Part of #14122 (measured by #14454 item 2, pinned in PR #14549).

What was measured

SchemaRegistry.applyNavContributions (packages/objectql/src/registry.ts, the else branch under if (c.group)): when a package contributes navigation items into a group id that the target app does not declare, the items are appended at the app's top level. Nothing throws, nothing carries an ADR-0112 code/status, and there is no console.warn / console.error. The only trace is one this.log(...) line, gated at logLevel info/debug. At OS_REGISTRY_LOG=warn — the level the objectql test config selects (#13517) — the relocation is completely silent while still happening.

The authoring door cannot catch it either: navigationContributions appears in no validateCrossReferences rule, and the group id names a node in an app the contributing package does not own.

Pins (record today's behaviour, no runtime change): packages/objectql/src/registry-nav-contribution-group-semantics.test.ts — PROPOSITION 2 (DOES NOT HOLD AS POSED), PROPOSITION 2 (visibility), PROPOSITION 2 (authoring door). Ablation on #14549 confirmed the pins go red when the branch drops items instead of relocating.

Why it matters

#14122 §4 feared a vanishing contribution. A relocated one is worse for the named consumer (hotcrm's 17-node navigation conversion, hotcrm#1449): the entry is present, a smoke test passes, and the information architecture has silently changed. A typo'd group id is exactly the error an AI author emits.

Options

	Option	Cost	What it buys
A	Refuse at install: reject the contribution with an ADR-0112 envelope when the target app declares no such group	Introduces an ordering constraint — registerAppNavContribution deliberately does not require the target app to exist yet, and the merge is a read-time fold precisely so registration order does not matter; also breaks any package contributing into an optional group	The loudest signal, before any user sees a moved menu
B	Keep relocating, upgrade the trace to console.warn (or a real diagnostic) so it survives OS_REGISTRY_LOG=warn	One-line change to an existing log call; no new refusal, no ordering constraint	The failure is noticed at the point it happens; still not a gate
C	No platform change; hotcrm's conversion asserts its own merged nav tree equals the pre-split tree	A test in the consumer repo	Catches the regression for the one measured consumer only

Four-axis reading (PM seat, for the maintainer to confirm or overrule)

1. 平台长期一致性 — A is the contract-first shape in the abstract, but it trades away the order-independence the read-time fold was designed for; B keeps the design and fixes the observability gap.
2. 实测业务拉力 — the only measured consumer (hotcrm 17-node conversion) needs the mis-aim to be noticed; B delivers that at the point of failure, C delivers it in the consumer's own suite.
3. AI agent 抗错性 — a typo'd group id today yields a silently different IA; B makes it visible without inventing a refusal an author must learn to suppress.
4. 创业阶段范围纪律 — B changes one log call, C adds one consumer test; A adds a new refusal surface and a registration-order rule.

Recommendation: B now, C alongside in hotcrm. If the maintainer wants the gate rather than the signal, A is the shape — and it should then also cover the app-does-not-exist case, which is equally unchecked today.

Not release-gating for the ADR-0130 chain: the behaviour is unchanged from before the epic and no packaged product depends on navigationContributions yet.

[os-project-manager]

Maintainer ruling recorded — B + C: the relocation stays but becomes a real diagnostic that survives OS_REGISTRY_LOG=warn, plus a compile-time check when both sides share one artifact; hotcrm asserts its own merged tree (hotcrm#1456)

Director seat (objectstack #12708), summon #10, session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-02.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, 2026-09-02, replying to decision batch #13 in which this card was item 5 with the recommendation B + C (fallback A), matching the PM seat's four-axis reading on the body. Verbatim reply: 「同意」.

Ruled: B + C.

• B (platform). SchemaRegistry.applyNavContributions keeps relocating a contribution whose group names no group in the target app to the app's top level (the read-time fold stays order-independent; contributions into optional groups keep working), but the trace becomes a real diagnostic: an ADR-0112-shaped entry carried in the app's diagnostics and emitted at warn, naming the contributing package, the app, the missing group id and the relocated items, so it is visible at OS_REGISTRY_LOG=warn and in os doctor / boot output. In addition, when the contributing package and the target app are composed into one artifact (composeStacks), os build checks the group id at compile time and reports the same diagnostic loudly there, where an AI author sees it first. No refusal is added; the runtime fold is unchanged.
• C (consumer). hotcrm's navigation conversion (hotcrm#1449) asserts in its own suite that the merged tree equals the pre-split tree, with an ablation control: hotcrm#1456 (pm:queue).

Option A (refuse at install with an ordering constraint) is not taken; if a gate is ever wanted it must also cover the app-does-not-exist case.

Execution: domain:engine lane (packages/objectql registry; compile-time half in packages/spec composeStacks or the cli build step, implementer's call, one PR), S. Clause-② no (no accept-set change; a diagnostic is added). Pins: the three PROPOSITION 2 pins from PR #14549 are inverted on visibility (the diagnostic is present at warn), the relocation pin stays; a build of examples/app-multi-package with one typo'd group id prints the diagnostic; hotcrm's assertion is that repo's.

Labels set by the director seat so the card is claimable: domain:engine, priority:p2; triage may re-grade.

State transition, same stroke: needs-user-decision → pm:queue. Ledger: objectstack director seat post #12708, summon #10.

---

Generated by Claude Code

[hotlong]

Claim record — session session_01UHvF5hyiZjnCyExFnfQB8m, branch claude/issue-14553-nav-group-relocation-diagnostic

Posting the identity record for this card. All agents share one GitHub identity, so the assignee field cannot say who holds a card; the branch name plus the session id above is the identity bit.

Comments were re-read before any code was written: the only comment on this card was the director seat's ruling (5518065119), with no prior claim from another session, so this was not taken.

Two half-states worth recording rather than silently repairing:

• The card arrived with no assignee. That is a PM-side half of the claim (labels were set, pm:queue applied); a dev seat never writes the assignee field, so it is reported here rather than filled in.
• This record is being posted at PR time rather than before the first edit, which is the ordering the repo playbook asks for. It cost nothing here — no second session was working this card, and the branch was pushed empty as a landing marker before the first edit — but the deduplication value of a claim comment is in being early, so the deviation is stated instead of glossed.

Work is complete and open as a draft: #14920. Structured report follows in the next comment.

---

Generated by Claude Code

[hotlong]

os-dev-report

{
 "issue": 14553,
 "status": "done",
 "branch": "claude/issue-14553-nav-group-relocation-diagnostic",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14920",
 "premise_still_valid": true,
 "summary": "B (platform) half of the B+C ruling. RUNTIME: applyNavContributions still relocates a contribution whose group names no group in the target app (fold unchanged, order-independent, optional groups keep working, no refusal added); the info-gated log line becomes an ADR-0038 BuildIssue-family record naming the contributing package, the app, the missing group id and the relocated items, carried on the app via the new registry.getAppNavDiagnostics(appName) and announced through a new level-aware warn(), so it survives OS_REGISTRY_LOG=warn. De-duplicated once per registry per distinct mis-aim, because the fold runs on every read of the app; a silent deployment keeps the record. COMPILE-TIME: os build asks the same question over a composed artifact through the SAME imported predicate (packages/cli/src/utils/nav-contribution-groups.ts), reporting in the text face and in --json under navigationGroupDiagnostics, without refusing. Two recorded deviations from the literal ruling wording, both measured: (1) 'carried in the app's diagnostics' is a registry-side per-app list, NOT the protocol's _diagnostics envelope -- protocol.ts reads `item?._diagnostics ?? computeMetadataDiagnostics(t, item)`, so pre-stamping would suppress the app's spec-validation verdict, and MetadataValidationResult.warnings[] is {path,message} with no code under a closed schema, making an ADR-0112-shaped entry there an accept-set widening that clause-2 rules out; (2) the code is lowercase and gets NO ledger entry -- ADR-0112 D6c on all four of its tests. PM-side half-state: the card arrived with no assignee (labels were set); reported, not filled in, and work proceeded.",
 "tests": "ALL exit codes captured by redirect-then-read, never across a pipe; gate verdicts quoted from each gate's own printed line. (1) pnpm --filter @objectstack/objectql test -> exit 0, 'Test Files 267 passed (267) / Tests 4595 passed (4595)'. (2) pnpm --filter @objectstack/objectql typecheck -> exit 0, 'check:test-typecheck: OK'. (3) pnpm --filter @objectstack/cli exec vitest run src/utils/nav-contribution-groups.test.ts -> exit 0, 8/8. (4) GATE UNION re-run on the FINAL head 2ab7f8695 with a clean tree, family derived by `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (64 commands): 57 green, 0 findings, 7 NOT MEASURED -- check-test-completeness (3), check-half-states (3), check:dual-build-cjs-loads (3, 'PREREQUISITE NOT MET ... nothing was measured'), check:type-check-debt (3, PREREQUISITE NOT MET), check:i18n (1, 'Nothing was checked'), check:i18n-coverage (1, 'Nothing was measured'), check:skill-examples (1, 'packages/client-react/dist holds no .d.ts'). Each self-declares its unmet prerequisite and refuses a verdict; none read as a pass. (5) check:dispatcher-error-vocabulary -- THE ANSWER THE DISPATCH ASKED FOR: it DOES land on that governed surface, as shape 'objlitconst', so its lowercase delegation to check:error-code-casing does NOT reach this position and a classification row was required; added as verdict 'foreign-vocabulary' / door 'none' with D6c evidence; gate now 'scope: ... 61 unregistered code-stamping site(s) found; 61 classified', exit 0. NO ERROR_CODE_LEDGER registration -- D6c: diagnostics codes stay lowercase and out of the ledger. check:error-code-casing exit 0 with no EXEMPT_FILES entry needed (the literal is a const declaration, not beside a `code` token). (6) THREE gates went red on my own work and were FIXED, not exempted: check:test-source-alias (a dist-resolved first load inside a clocked window -> module-top side-effect import, production import stays lazy); check:doc-authoring (a tracker id inside runtime string prose -> moved to an adjacent comment, per the 2026-08-12 ruling); check-system-context-census (pure line rot from the registry edit -> repaired with its own --fix, one doc anchor 464->475). (7) ABLATION A, runtime, source-resolved: removed ONLY the warn() emission, leaving the record -> 2 pins red (visibility, once-per-mis-aim) and the relocation pin stayed GREEN, which is what proves it pins the fold and not the log. Mutation confirmed on disk BEFORE the run (emission sites 1->0, injected marker count 1, blob c0699cf0->3e66307f); restored via `git checkout HEAD --` with an ABSOLUTE path, blob back to c0699cf0 == the HEAD blob, `git diff HEAD` empty, 0 markers left; restored leg 10/10 green. (8) ABLATION B, compile-time, DIST-RESOLVED (@objectstack/objectql is a KNOWN_UNALIASED_TEST_IMPORTS entry for @objectstack/cli): neutered checkNavContributionGroups, REBUILT objectql, `node scripts/ablation-dist-preflight.mjs @objectstack/objectql <marker>` reported the marker present in 4 built files -> 5 pins red; restored, REBUILT again, preflight --absent reported it gone from all 14 built files and the whole tree clean -> 8/8 green. Both legs rebuilt and both proven in dist. TWO FALSE MEASUREMENTS were caught by that discipline rather than by luck, and both are recorded because either would have produced a confident wrong reading: `grep -c` read the empty brackets in my anchor as a regex character class and reported 0 sites on a mutation that HAD landed (fixed with grep -cF); and the first ablation marker was written as a `//` comment, which the bundler strips, so the preflight VOIDED the run because the marker survived only in sourcemaps. (9) NOT MEASURED, declared narrowings: `pnpm --filter @objectstack/cli typecheck` -- 111 errors, 0 of them in the three files this PR touches, 96 of them TS2307 'Cannot find module' against sibling packages with no dist/ (client, rest, runtime, setup, verify, console, account); prerequisite is a 57-package build closure. And a spawned `os build` over examples/app-multi-package was NOT run, for that same closure. The narrowing is declared, and made as small as available: a pin runs the fixture through the identical normalizeStackInput + ObjectStackDefinitionSchema chain compile.ts runs and hands result.data to the derivation exactly as the command does, in both directions, so what is unexecuted is only the printWarning/printBulletList rendering of an already-pinned list.",
 "mcp_calls": "8",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code