[finding] the CLI's `@objectstack/console` manifest fallback can never resolve: `resolveSduiManifest()` asks for `@objectstack/console/dist/sdui.manifest.json`, but the console's `exports` map publishes only `./package.json`

[os-support-ai]

Filing gate: ① a defect with a named landing site: the lookup in packages/cli/src/utils/sdui-manifest.ts (resolveSduiManifest), or the exports map of packages/console/package.json. The fix belongs at the producer, ⛔ not in a lenient consumer fallback. Finding class (a).

Found by the os-dev round on #17735 (PR #19921), and filed by the domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017). ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.

What happens

Re-read by this seat on origin/main beac798026:

• packages/cli/src/utils/sdui-manifest.ts resolves '@objectstack/console/dist/sdui.manifest.json' through createRequire(import.meta.url).resolve(…), inside a try.
• packages/console/package.json exports is {"./package.json":"./package.json"} (files: dist, README.md, CHANGELOG.md).

The implementing round's probe, in scratch node_modules carrying the console's package.json: that resolve throws ERR_PACKAGE_PATH_NOT_EXPORTED. Controls: the same subpath resolves on a package with no exports map, and '@objectstack/console/package.json' resolves. The try/catch swallows the throw.

⇒ The declared fallback, 「the manifest shipped inside @objectstack/console」, is dead code.

Reach

• Today: published console tarballs 17.0.0, 17.3.0 and 17.4.0 carry no sdui.manifest.json at all (the round's reading), so the fallback has nothing to find either way.
• After PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 lands: build-console.sh copies the tracked manifest into packages/console/dist/. The file then ships, and the CLI still cannot reach it. A project with no manifest of its own silently gets no fallback in os validate / build / lint.

Suggested shape (⛔ not a ruling)

Either add a ./dist/sdui.manifest.json subpath to the console's exports, or resolve @objectstack/console/package.json and join the path from its directory. The first publishes the file as an addressable surface; the second keeps exports closed. Either way, add a pin that fails when the fallback cannot resolve.

Dedupe

MCP issue search in this repo, closed included, at 2026-09-23T19:40Z: resolveSduiManifest console exports map sdui.manifest.json ERR_PACKAGE_PATH_NOT_EXPORTED fallback returned 11 hits. None is this defect: the nearest are #10138 (pnpm sdui:manifest ENOENT before a console build) and #17736 (docs naming the wrong producer).

Dedupe words: console exports map sdui.manifest.json · ERR_PACKAGE_PATH_NOT_EXPORTED resolveSduiManifest · CLI console manifest fallback unreachable

---

Generated by Claude Code

[objectstack-fleet]

Blocked-by: #17735

定级 pm:blocked · priority:p2 · bug · domain:cli —— CLI 从 console 包里取 manifest 的兜底路径永远走不通;PR #19921 一旦开始发这个文件,问题就会露出来

Path: studio-authoring

Triage: lands in packages/cli/src/utils/sdui-manifest.ts (resolveSduiManifest, :36 resolves @objectstack/console/dist/sdui.manifest.json) or the producer's exports map in packages/console/package.json (only ./package.json is exported) ⇒ domain:cli; rationale: the resolve throws ERR_PACKAGE_PATH_NOT_EXPORTED and a try swallows it, so the declared fallback is dead code; harmless today (no published console tarball carries the file), but once PR #19921 (#17735) ships the manifest, a project without its own manifest still silently gets no fallback in os validate / build / lint — the validation an AI author relies on quietly does not run ⇒ p2; blocked behind #17735 because the fix and its pin need the file to ship.

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T20:20Z。本席读完了卡面(本卡尚无评论)。

本席的读数(origin/main beac798026)

• packages/cli/src/utils/sdui-manifest.ts:28 先找项目自己的 sdui.manifest.json,:36 再兜底找 '@objectstack/console/dist/sdui.manifest.json'。
• packages/console/package.json:exports = {"./package.json": "./package.json"},files = dist、README.md、CHANGELOG.md。
• ⇒ 这个子路径不在 exports 里,Node 会拒绝解析。抛错与控制组都是实现轮的探测,本席没有重跑。PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 尚未落地。

判定

• 业务后果:
  • 今天:已发布的 console 包里本来就没有这个文件,兜底找不到也无所谓。
  • PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 落地后:文件发出去了,CLI 却仍然拿不到。一个自己没有 manifest 的项目,在 os validate / build / lint 里悄悄失去了对照检查,没有任何提示。
• p2:它决定了 [finding] the tracked root sdui.manifest.json and the browser dump differ on the fields the parity gate consumes (18 of 57 components; dataSource missing on 15 in the root artefact) — the gate's verdict set is identical under both today, which is the configuration in which the drift is least visible #17735 的工作(发出 manifest)对 CLI 用户是否真的生效。北极星「优先级」第 3 条(防 AI 犯错):该做的校验悄悄没做。
• 修法方向(⛔ 不是裁定,卡面已写):
  • 或者在 console 的 exports 里加 ./dist/sdui.manifest.json;
  • 或者先解析 @objectstack/console/package.json,再从它的目录拼出路径。
  • 两种都要加一个钉:兜底解析不到就失败。卡面写明修在生产方,⛔ 不要在消费方加宽松兜底。
• Blocked-by: #17735(本条第一行,供解锁扫描):等 PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 落地、文件真的发出去之后再做,钉才有东西可钉。

---

Generated by Claude Code

[objectstack-fleet]

Unblock re-derivation: pm:blocked → pm:queue · 2026-09-24T23:56Z

Acting on the maintainer's instruction. Provenance: who — the maintainer; verbatim — 「帮我排查一下 blocked 卡片，哪些需要更新状态帮我更新。」; where — the maintainer's chat with session session_013RWUA7bNq5bRhehLPqXwMg, 2026-09-24. ⛔ Not a claim and not a dispatch: the card returns to its lane's take order. Candidate surfaced by check-half-states.mjs H19 on this sweep.

• Blocker: [finding] the tracked root sdui.manifest.json and the browser dump differ on the fields the parity gate consumes (18 of 57 components; dataSource missing on 15 in the root artefact) — the gate's verdict set is identical under both today, which is the configuration in which the drift is least visible #17735 closed completed on 2026-09-24; its PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 is merged.
• Double-check ① — latest conversion comment 5802293920 names exactly that condition.
• Double-check ② — no merged PR has referenced this card since that comment.
• Re-derived, the defect is now reachable: PR fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921's own body says the console package will now ship sdui.manifest.json, but its exports still exposes only ./package.json, so the CLI cannot read it. Confirmed on origin/main: packages/console/package.json exports is {"./package.json": "./package.json"}, and packages/cli/src/utils/sdui-manifest.ts still resolves @objectstack/console/dist/sdui.manifest.json.

State: pm:blocked → pm:queue; domain:cli, priority:p2 unchanged; no assignee.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 8 (serial)
Session: session_01TnPAC1UsTGfHPXVUCL6iLn
Branch: claude/issue-19922-console-manifest-fallback
Worktree: objectstack-issue-19922
Domain: domain:cli
Seat: domain:cli#1
File surface: packages/cli/src/utils/sdui-manifest.ts (the @objectstack/console fallback resolution only), its tests under packages/cli/test/ or beside the source, any hand-written packages/cli/** README or content/docs/** line the change makes false, and one .changeset/19922-*.md. packages/console/** (its exports map included), packages/cli/src/utils/console.ts (importing its existing exports is fine) and packages/spec/** are read-only. packages/cli/CHANGELOG.md and package.json belong to the Version Packages PR. Stop on breach and explain in the report
Container & model: M, mode:subagent, model: default judgment tier (this act's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/cli/src/utils/sdui-manifest.ts answered: no path-derived mandate). A dead fallback in a published CLI's validation path, with a route choice that must keep a sibling package's exports closed and a pin that must fail on a real regression, so it gets the default judgment tier.
Clause-②: no
Thread-read: 5824269229
Serial constraints cleared: the maintainer's order in this seat's session (「继续派发」) moves the lane on once a card's PR is in the merge queue: R7's PR #20100 (#20071) is in the merge queue (its timeline carries added_to_merge_queue), and its surface (packages/runtime standalone-stack, the cli restart-acceptance test) shares no file with this one. The file lists of all 8 open PRs were read in this act. None touches packages/cli/src/utils/sdui-manifest.ts, packages/cli/src/utils/console.ts or packages/console/**; the Version Packages PR #17076 owns the CHANGELOG and package.json versions, outside this surface. The seat post's queue head #19328 stays fenced behind the open draft PR #19637. The NORTH-STAR 优先级 3 pre-pick read at aa04ea29: the domain:cli pm:queue holds no open P0/P1

Taken 2026-09-25T05:19Z, origin/main aa04ea29. Clause-②: no: the claimed route keeps the console's exports closed. It resolves the shipped manifest the way packages/cli/src/utils/console.ts already resolves this static-asset package: @objectstack/console/package.json plus a join. So no published surface moves. Adding a ./dist/sdui.manifest.json subpath to the console's exports would publish a new addressable surface, yes (widening), and ⛔ that is not this claim. A dev who finds it the only true route stops and reports. The dev posts no second claim; this comment is its identity.

[objectstack-fleet]

os-dev-report

{
  "issue": 19922,
  "status": "needs_decision",
  "branch": "claude/issue-19922-console-manifest-fallback",
  "pr": null,
  "session": "session_01TnPAC1UsTGfHPXVUCL6iLn",
  "premise_still_valid": true,
  "summary": "The card's premise holds on aa04ea29 and the ruled fix works: in a scratch node_modules carrying the REAL packages/console/package.json, createRequire(...).resolve('@objectstack/console/dist/sdui.manifest.json') throws ERR_PACKAGE_PATH_NOT_EXPORTED (CJS and ESM forms), while resolving '@objectstack/console/package.json' and joining dist/sdui.manifest.json returns the file; npm pack and pnpm pack --dry-run over that package.json + .gitignore both list dist/sdui.manifest.json, and `pnpm run release` reruns build-console.sh, whose last step copies the tracked repo-root manifest in. I stopped before writing code because the route's premise 'a dead fallback is made live, and no accepted input moves' is FALSIFIED: the manifest the fallback would load (byte-identical to the tracked repo-root sdui.manifest.json) rejects the intrinsic div and a tags, and with it reachable the repo's own examples/app-showcase flips from exit 0 to exit 1 on os validate, os compile (the step os dev and os start spawn) and os lint, 200 errors each (100 jsx-forbidden-tag + 100 jsx-unknown-component) over 3 of 3 in-tree kind:'html' pages. That is exactly the 200 rows packages/lint/src/sdui-jsx-baseline.json carries, which its header calls 'none is a real authoring mistake', recording 'What the html tier's legal vocabulary IS remains a producer-side question (objectui)'. So landing the fix arms a gate with known false positives. Locally, os dev refuses to boot the default showcase ('Compile failed') on any checkout with a built packages/console/dist, and no CI job compiles the showcase with a console dist present (the console-pin job ends after saving the dist; showcase-smoke boots `serve --dev`, which runs no authoring rules), so CI stays green over it. At the next release, every manifest-less customer project whose html pages use intrinsic tags newly fails validate/build/dev/start. That narrows what the published CLI accepts, so it is not a patch with no moved input. For when the decision lands, the fix is ready: resolve '@objectstack/console/package.json' from the CLI's OWN location (import.meta.url, the declared, fixed-group-locked dependency). From the showcase cwd that resolve is MODULE_NOT_FOUND under pnpm, so a cwd origin would make the gate's strength depend on hoisting. resolveConsolePath() brings a five-candidate list, a version-mismatch warn and a drift callback that the ruling excludes. The fix joins dist/sdui.manifest.json and adds the smallest optional origin parameter for the pin. The pin reads the real console package.json through the resolver, which turbo covers (measured below). No PR and no code; the branch is pushed empty.",
  "tests": "No code written, so no unit run and no ablation. Measurements, all on aa04ea29 in worktree ../objectstack-issue-19922: (1) scratch probe, real console package.json: `OLD threw: ERR_PACKAGE_PATH_NOT_EXPORTED` (require and ESM createRequire(import.meta.url)); `NEW: true {\"probe\":true}`; node v22.22.2. (2) `npm pack --dry-run --json --ignore-scripts` exit 0, files = CHANGELOG.md, README.md, dist/index.html, dist/sdui.manifest.json, package.json; `pnpm pack --dry-run` exit 0 lists dist/sdui.manifest.json. The dist is a stand-in: a real console build is NOT MEASURED (it needs an objectui checkout and build). (3) Build: `os-verify-lock.sh -c 'pnpm exec turbo run build --filter=@objectstack/cli... --concurrency=2'` printed `VERDICT command-exit 0`, 57/57; `--filter='@objectstack/example-showcase^...'` printed `VERDICT command-exit 0`, 61/61. (4) examples/app-showcase, no manifest reachable: os validate exit 0, os compile exit 0, os lint exit 0; the validate output's 106 lines match manifest, parse-level, jsx and sdui zero times. (5) Same, with a temporary project manifest `cmp`-identical to the tracked root file (the bytes build-console.sh ships), removed by trap: os validate exit 1 `Author-time rules failed (200 issues)`; --json errors 200 = {jsx-forbidden-tag: 100, jsx-unknown-component: 100}; os compile exit 1 `Author-time rules failed (200 issues)`; os lint exit 1 `200 error(s)`. Afterwards `git status --porcelain` printed 0 lines. Ledger per page: showcase_capability_map 80, showcase_command_center_jsx 58, showcase_start_here 62. (6) Origin: from the examples/app-showcase cwd, resolve('@objectstack/console/package.json') gives MODULE_NOT_FOUND; from packages/cli/dist it gives realpath packages/console/package.json. (7) Turbo coverage of a pin that reads the console package.json through the resolver, from `turbo run test --filter=@objectstack/cli --dry=json`: @objectstack/console#build command NONEXISTENT, hash cbd8b52f89dfeace, inputs include package.json; cli#build dependencies include console#build; cli#test dependencies = [cli#build].",
  "gates": {
    "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack": "exit 2 · 'dispatch-gates: this branch changes nothing against origin/main (merge base aa04ea296) — nothing to derive.'",
    "gates-from-pm.txt (62 commands)": "NOT RUN, reason: derived from the EXPECTED paths; the branch carries no diff",
    "pnpm lint (lane addition)": "NOT RUN, reason: no diff, so no file to lint"
  },
  "line_budget": "n/a",
  "files_changed": [],
  "deviations": [
    "Stopped at needs_decision on a stop condition the order did not name: os-dev.md 'when to stop' covers an under-specified public-contract decision, and here the decision is what the published CLI's JSX gate rejects. The named stop valve ('the exports subpath is the only true route') is NOT met: the package.json route is measured to work.",
    "PM SUGGESTED ROUTE premise falsified by measurement: 'no accepted input moves' (see summary and tests (5)).",
    "Write budget: 1 REST write used (this comment). No pr_create; no label-write, since there is no PR to assign.",
    "Measurement scratch: a temporary examples/app-showcase/sdui.manifest.json lived only for the trap-guarded runs (git status clean afterwards). Gitignored build outputs in the worktree went with the worktree removal."
  ],
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/19922/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). The empty-branch `git push` is not a REST write.",
  "open_questions": [
    {
      "question": "Should resolveSduiManifest()'s console fallback go live now? The manifest it would load rejects the intrinsic div and a tags that 3 of 3 in-tree html pages use: 200 errors on the showcase; os validate, compile and lint go from exit 0 to 1; os dev and os start refuse to boot on a fresh compile wherever packages/console/dist is built. packages/lint/src/sdui-jsx-baseline.json records those findings as non-mistakes pending a producer-side (objectui) ruling on the html tier's legal vocabulary.",
      "options": [
        "A. Land #19922 now as ruled (package.json-relative resolve + pin). Business need: real (every manifest-less project, every scaffold), but the measured harm is immediate. The repo's default dev app stops compiling for anyone with a built console (the AGENTS.md frontend-debug loop, the dogfood and checklist skills), invisibly to CI, and at release customers' intrinsic-tag html pages newly fail build. Long-term: right mechanism, wrong order: the consumer arms before the producer's vocabulary is settled. Anti-AI-error: a strict gate is the right direction, but one that rejects pages the renderer accepts teaches authors to route around it (stub a project manifest, avoid html pages). Startup focus: no new surface, but the changeset cannot be the planned patch 'no accepted input moves'. The published CLI's accepted set narrows, so the claim's Clause-②: no needs re-judging (likely yes (narrowing), BREAKING, with a migration line).",
        "B. Hold #19922 behind the html-tier vocabulary decision (Blocked-by that card), then land the measured fix unchanged. The blocker resolves one of two ways: the producer declares the intrinsic tags the renderer accepts (regenerate the manifest; the ledger's 200 rows go stale and are deleted), or the maintainer rules them illegal and the showcase's 3 pages are rewritten to public-tier blocks (the ledger ratchets to zero). Business need: keeps the fix's value without shipping false positives, and the fix is fully specified here, so the later round is cheap. Long-term: contract-first: the producer settles, then the consumer arms. Anti-AI-error: once armed, the gate rejects only real mistakes and is trusted; a loud gate with 200 known false positives is the opposite. Startup focus: no new gate or surface; the cost is the fallback staying dead (and silent) a while longer.",
        "C. Land the fix plus a showcase rewrite in one PR (the ledger goes to zero, and intrinsic tags are treated as illegal). This decides the vocabulary question by consumer fiat although the ledger assigns it to objectui, and it grows scope into examples (200 sites over 3 pages). Customers' intrinsic-tag pages still newly fail at release, so A's Clause-② question stays open.",
        "D. Retire the console fallback (ADR-0049 remove arm): delete the dead branch and keep only the project manifest. This is honest about today, but it discards what #19921 shipped the file for. Manifest-less projects never get component/prop checking, and the console ships a file nothing reads. Weakest on the anti-AI-error axis."
      ],
      "recommendation": "B. It is the only option in which the live gate rejects only real mistakes (anti-AI-error). The producer's contract settles before the consumer arms it (long-term, contract-first), and nothing new is added (startup focus). The business cost is delay only, and the fix is measured and ready. Not offered: downgrading fallback-sourced findings to warnings. That is the lenient consumer path the ruling excludes."
    },
    {
      "question": "Whenever the fix does land: the pending, unreleased '.changeset/sdui-manifest-one-producer.md' (@objectstack/console patch) still ends by saying the CLI's JSX-page manifest fallback 'catches the error and keeps parse-level validation, as before'. That sentence is false from the fix's merge on, unless a release consumes the changeset first. The file is outside this claim's file surface.",
      "options": [
        "A. The implementing round's claim adds that changeset's final paragraph to its file surface, and the round rewrites it (a reader locates the file from @objectstack/console/package.json, as the CLI fallback now does).",
        "B. Leave it: it was true when written and compiles into the console CHANGELOG as history."
      ],
      "recommendation": "A, if the changeset is still unreleased when the fix lands. The console CHANGELOG ships inside the tarball as the text an upgrading agent greps, and a sentence that is false on the day it publishes is the case the RELEASE-OWNED row of AGENTS.md exists for."
    }
  ],
  "out_of_scope_findings": [
    "class: b · evidence: the CLI JSX gate degrades to parse-level silently. On aa04ea29 in examples/app-showcase with no manifest reachable, os validate exits 0, and its 106 output lines match manifest, parse-level, jsx and sdui zero times. Contract text (AGENTS.md, Route & surface ownership, rule 3): 'a verifier that silently degrades (reusing a stale build, skipping a check it could not run) is worse than no verifier, because it reports success. Prefer failing to falling back.' Seam: cli:resolveSduiManifest() returns undefined → runtime:validateJsxPages parse-only branch (packages/lint/src/validate-jsx-pages.ts) → consumer: os validate/build/lint output, none of which states the degradation. Holds with or without the #19922 fix (no project manifest and no resolvable console). Dedupe words: `JSX gate parse-level silent degradation` · `resolveSduiManifest undefined no notice` · `os validate SDUI manifest absent silent`",
    "carrier: the seat, as the Blocked-by target of open_questions[0] option B. The html-tier vocabulary question is already on record in the header of packages/lint/src/sdui-jsx-baseline.json (ui#6779 ratchet-to-zero; producer side objectui); this report does not file it. Dedupe words: `html tier intrinsic tags div a public-tier manifest` · `sdui-jsx-baseline ratchet-to-zero showcase html pages` · `jsx-forbidden-tag div is not an allowed component`",
    "carrier: the round that lands #19922 · noted, not filed. packages/cli/src/utils/scaffold-validate.ts:118-121 says a fresh scaffold resolves 'the copy shipped in @objectstack/console'; that is false while the fallback is dead and becomes true with the fix. Separately, the header of packages/lint/src/validate-jsx-pages.ts still says full manifest validation is not wired ('when that is wired, thread it through compile() here'), although it is. Carrier: none (承接者:无) · noted, not filed."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Blocked-by: #20112

In-seat review of the needs_decision report 5827453121: HOLD. The claim is released with a reason, and the card goes to pm:blocked on #20112

_{domain:cli execution PM seat #6024 · session session_01TnPAC1UsTGfHPXVUCL6iLn · 2026-09-25T05:49Z · read on GitHub and origin/main fa00ebf4}

The dev stopped correctly. No code, no PR, and the branch was pushed empty. The order's named stop valve did not fire: the package.json route works. Instead the dev falsified the PM's route premise, "a dead fallback is made live, and no accepted input moves" (order, PM SUGGESTED ROUTE). The seat owns that premise, and it was false.

Re-read at source by the seat:

• The ledger. packages/lint/src/sdui-jsx-baseline.json's header says the public tier "deliberately declares no intrinsic HTML tags (… div/a/p absent …)". It says the three shipped html pages author with div/a, that "none is a real authoring mistake", and that "What the html tier's legal vocabulary IS remains a producer-side question (objectui)".
• The shipped file. scripts/build-console.sh ships the repo-root sdui.manifest.json in the console's dist (:5, :277-282).
• The dev's measurement. With that file reachable, examples/app-showcase goes from exit 0 to exit 1 on os validate / os compile / os lint, with 200 errors: the ledger's 200 rows. os dev and os start spawn os compile.

⇒ Making the fallback live now arms a gate with 200 known false positives. The repo's default dev app would stop compiling wherever a console dist is built, invisibly to CI. At the next release, every manifest-less customer project with intrinsic-tag html pages would newly fail. That narrowing is not what this card or its grading asked for.

Decision: the report's option B (hold).

• The question that has to be settled first is filed as [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112, a [Decision] card for the director's batch. Its options:
  • A: the producer declares the html tier's intrinsic vocabulary;
  • B: intrinsic tags are ruled illegal and the showcase is rewritten;
  • C: the console fallback is retired.
• The seat reads A, ⛔ not a ruling.
• Option C here (the fix plus a showcase rewrite) would decide the vocabulary by consumer fiat, and D (retire) discards what fix(sdui-manifest): one producer from objectui's built tree; retire the declaration-parity ratchet and the browser dump #19921 shipped. Neither is this seat's to pick.
• ⛔ Downgrading fallback-sourced findings to warnings is the lenient consumer path triage excluded, so it is not offered.

The fix is measured and ready for the round that takes this card after #20112 is ruled:

• Route. Resolve @objectstack/console/package.json from the CLI's OWN location (import.meta.url, the declared, fixed-group dependency), then join dist/sdui.manifest.json.
  • Probe on the real console package.json: the old subpath throws ERR_PACKAGE_PATH_NOT_EXPORTED (CJS and ESM); the new route returns the file.
  • npm pack --dry-run / pnpm pack --dry-run list dist/sdui.manifest.json.
• Not the cwd origin. From the showcase cwd under pnpm, that resolve is MODULE_NOT_FOUND, so the gate's strength would depend on hoisting.
• Not resolveConsolePath(). It brings five candidates, a version-mismatch warning and a drift callback.
• Pin. It reads the real console package.json through the resolver. Turbo's @objectstack/console#build inputs include package.json, and cli#build depends on it.
• The declaration depends on the ruling:
  • under [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112 A, the claim's Clause-②: no and patch hold;
  • under [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112 B, it is no (narrowing), minor, BREAKING, with a migration line.
• Carry into that round's claim:
  • .changeset/sdui-manifest-one-producer.md's last paragraph, if it is still unreleased. It says the fallback "catches the error and keeps parse-level validation, as before", which becomes false the day the fix merges. Add it to the file surface (report question 2, answer A).
  • packages/cli/src/utils/scaffold-validate.ts:118-121 becomes true with the fix. No edit is needed, but re-read it.

Out-of-scope findings:

• class (b) → filed [finding] os validate / compile / lint validate JSX pages at parse level only when no SDUI manifest resolves, and say nothing: the author-time JSX gate silently degrades #20113: with no manifest reachable, the JSX gate degrades to parse-level and says nothing. That contradicts AGENTS.md, Route & surface ownership, rule 3 ("Absence must be loud"). It is independent of [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112's ruling.
• Noted, not filed: packages/lint/src/validate-jsx-pages.ts's header still says full manifest validation is "not wired", although it is (comment drift, another lane's file).

State, in the same stroke as this comment: pm:dispatched → pm:blocked, and the assignee is cleared. The claim 5827232012 is released: this comment is its end state. The empty branch claude/issue-19922-console-manifest-fallback stays for the round that takes the card.