feat(spec): declare ./contracts browser-reachable — links no zod, real objectui consumers

[qq9340100]

Fixes#10397

Promotes "./contracts" from unjudged to browserReachable in
packages/spec/browser-reachable-entries.json (#10398's ledger for
check:browser-reachable-entries), mirroring the ./meta-spelling reference
pattern exactly: a why and a measured-empty externals: [].

Both premises re-verified before editing

(a) real consumer — objectui client-shipped code reaches ./contracts.
Re-grepped objectui @ origin/main (9bd753682, fetched fresh — #10398
merged <1h before this card was dispatched). The triage grading's four named
non-test sites all still hold, each inspected directly:

• packages/app-shell/src/views/ScreenView.tsx — re-exports ScreenFieldSpec
  verbatim, docblock: "The screen-pause contract is OWNED by
  @objectstack/spec/contracts".
• packages/app-shell/src/views/metadata-admin/external/api.ts — imports
  GenerateDraftOpts, ObjectDraft, RemoteTable, SchemaValidationResult.
• packages/components/src/share/ShareDialog.tsx — imports ShareLink,
  ShareLinkAudience, ShareLinkPermission.
• packages/auth/src/types.ts — re-exports TenancyPosture.

— plus non-test re-exports/consumers in packages/core/src/utils/dataset-format.ts,
packages/data-objectstack/src/index.ts, packages/types/src/data.ts and
packages/types/src/index.ts (export type * as Contracts). All client-shipped
packages, not test-only — the surface is broader than the grading measured.

(b) ./contracts links no zod, zero externals. Rebuilt @objectstack/spec
fresh (pnpm --filter @objectstack/spec build, exit 0) and, before touching
the ledger, inspected the built dist/contracts/index.mjs / index.js
directly: 12,723 bytes (matches the issue's measurement at 0bfbeb70c
exactly), zero zod/zod/* occurrences, zero import/require specifiers
of any kind in either format half — fully self-contained. Confirmed again
through the gate's own instrument after the ledger promotion (below).

Reverse verification — both legs, real mutation on disk

Both legs ran with the ledger promotion already in the working tree (before
the commit below), so ./contracts was DECLARED for both:

leg	mutation confirmed on disk	gate result
inject import { z } from 'zod'; export const __ablationProbe10397 = z.string(); into packages/spec/src/contracts/index.ts, rebuild	grep -c "from 'zod'" in the source file 0 → 1; rebuilt bundle grew 12,723 → 12,864 B and now names zod (1× ESM, 2× CJS via direct grep)	red — './contracts' is DECLARED browser-reachable but its built graph links 'zod' (via dist/contracts/index.mjs) and the same for index.js
git checkout HEAD -- packages/spec/src/contracts/index.ts, rebuild	grep back to 0; bundle restored to exactly 12,723 B, 0 zod/import/require occurrences	green again — 2 declared browser-reachable entries link no zod; 34 bundle(s) scanned, 30 zod link(s) seen elsewhere (instrument calibrated); exports map fully classified

A stray untracked packages/spec/json-schema.manifest/contracts.json appeared
during the mutated build (gen:schema auto-detected the probe's runtime zod
schema — a byproduct of the ablation, never git-tracked) and was deleted
before the restore rebuild; git status is clean except the one intended
ledger line throughout.

Changeset

skip-changeset — same reasoning as #10398: the diff is only
packages/spec/browser-reachable-entries.json, a repo-only ledger not in
@objectstack/spec's published files field (dist, json-schema,
liveness, prompts, llms.txt, README.md, src/**/*.zod.ts,
CHANGELOG.md, api-surface, spec-changes.json). Nothing published moves.

Gates

node scripts/pm/dispatch-gates.mjs (no paths, derived from the real diff at
the final commit) named 9 local famil(ies) — check:empty-state,
check:liveness, check:merge-driver, check:slot-lookup,
check:strictness-ledger, check:type-source-resolution,
check:variant-docs, check-dev-prereqs.mjs, check-affected-docs.mjs —
run at commit c01d1159e; verdict lines and completion status in the report.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/browser-reachable-entries.json) — pages documenting those are invisible to this run

Coarse fallback — 122 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4544be260082de5ad652de06d8eaae8d763cd05a → packageMentionDocs.