@@ -5,7 +5,7 @@
 fix(components): a half-typed `between` range in the filter builder shows itself as
 incomplete instead of being dropped with no signal (objectui#10061)
 
-Ruling batch #146 item 5 letter A (objectstack#18012) declares that while one bound of a
+Ruling batch #146 item 5 letter A (objectstack `176b03582`) declares that while one bound of a
 `between` pair is blank the condition is incomplete — **not emitted, and shown as
 incomplete in the UI**. The first half has been true since objectui#5025: every write
 path folds the row through the builder's own arity-aware `isFilterValueComplete`, so a
 
@@ -5,7 +5,7 @@
 fix(app-shell): the Studio dataset-filter inspector stores a `between` range as the
 spec's `$between`, with both bounds required (objectui#10062)
 
-Executes ruling batch #146 item 5 letter A (objectstack#18012): the `between` arm of the
+Executes ruling batch #146 item 5 letter A (objectstack `176b03582`): the `between` arm of the
 dataset-filter bridge maps once a both-bounds completeness rule exists, and one does. Until
 now a `Between` row in a dataset's or a measure's filter was dropped on every commit —
 inertly since objectui#9372, but dropped — so a date range could be drawn in the inspector
 
@@ -0,0 +1,23 @@
+---
+---
+
+Comment-only in `@object-ui/app-shell`, `@object-ui/components`, `@object-ui/core`,
+`@object-ui/data-objectstack`, `@object-ui/i18n`, `@object-ui/permissions`,
+`@object-ui/plugin-calendar`, `@object-ui/plugin-designer`, `@object-ui/plugin-detail`,
+`@object-ui/plugin-form`, `@object-ui/plugin-grid`, `@object-ui/plugin-kanban`,
+`@object-ui/plugin-list`, `@object-ui/plugin-tree`, `@object-ui/providers`,
+`@object-ui/react` and `@object-ui/types` (two console warnings in `@object-ui/app-shell`
+and `@object-ui/plugin-detail` are runtime text, declared separately below): docblocks and
+code comments that cited an `objectstack` issue or pull request which answers 404 now cite
+the commit in that repository that landed the change, written as objectstack and a
+9-character sha (objectui#10803, the seventh batch). Where the sentence already names that
+change's live pull request or commit, or dates the ruling it points at, the dead number is
+dropped instead, and one sentence cites this repository's own landing commit, because the
+fix it names landed here. Comments that named the apiMethods whitelist card as a bare
+number now read `objectstack#3391`, and the two that paired it with a second bare number
+read `objectstack#3546` for it: a bare number resolves to this repository, where both
+numbers are unrelated cards. None of these comment edits moves a claim or changes a code or
+type token. No published behaviour changes through them, so this declares no release.
+
+The same repair in the pending changesets that carried these citations is prose-only, and
+their frontmatter is byte-identical.
@@ -0,0 +1,17 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/plugin-detail': patch
+---
+
+fix(app-shell, plugin-detail): the unmapped activity type warnings no longer point at an objectstack issue that answers 404
+
+`@object-ui/app-shell` warns on the console, once per value, when a `sys_activity` row's
+`type` maps to no activity item type, and `@object-ui/plugin-detail`'s `[record:activity]`
+block does the same when it maps to no feed item type. Both messages said `sys_activity.type` is
+author-extensible with a pointer to an objectstack issue that answers 404 beside the
+ruling's date. A reader of a console warning has no repository to resolve a commit
+against, so the pointer is dropped rather than replaced: both now read "author-extensible
+(ruled 2026-08-24)" (objectui#10803).
+
+Nothing else in either message moves, and what renders, and when and how often each
+warning fires, are unchanged.
@@ -5,8 +5,8 @@
 
 The marketplace consent panel no longer promises confinement the runtime does not provide.
 
-`PluginDisclosure` introduced a code-bearing package's structured permission set with "On install, this package will be granted:". A list of grants on a security panel is read as a confinement promise — the complement assumed denied — and on this platform it is not. The consented set is persisted (`sys_package_installation.granted_permissions`), re-confirmed on a widening upgrade, and registered on the runtime's `PluginPermissionEnforcer` at load; it is queried by nothing, because `SecurePluginContext` has zero production construction sites and the fs/network gates have no caller at all (measured on objectstack `9bd4344e4`; objectstack#17147).
+`PluginDisclosure` introduced a code-bearing package's structured permission set with "On install, this package will be granted:". A list of grants on a security panel is read as a confinement promise — the complement assumed denied — and on this platform it is not. The consented set is persisted (`sys_package_installation.granted_permissions`), re-confirmed on a widening upgrade, and registered on the runtime's `PluginPermissionEnforcer` at load; it is queried by nothing, because `SecurePluginContext` has zero production construction sites and the fs/network gates have no caller at all (measured on objectstack `9bd4344e4`; recorded upstream in objectstack `aaacf1d5c`).
 
 `marketplace.disclosure.grantsIntro` now states a REQUEST — "This package requests:" — and a new `marketplace.disclosure.notEnforced` line beside the list says the set is recorded at install, re-confirmed if a later version asks for more, and not yet a runtime restriction. Both land in all ten locale packs; the `ja` value stays predicate-final so that pack's halfwidth-colon rule still decides it.
 
-The trust-tier badge is deliberately untouched: it is objectstack#11330's half of the same panel.
+The trust-tier badge is deliberately untouched: it is the trust-tier half of the same panel, which objectstack `a9ee98992` settled separately.
@@ -24,7 +24,7 @@ exists.
 **Undeclared → the closed dropdown is untouched**, which is half the change rather than a
 caveat. Those `options` are still exhaustive under objectstack#5131 (the sms/mail provider
 selects), and `localization.locale` had its domain declaration deliberately **rejected** in
-objectstack#6515 because its options *are* the shipped catalogs. Widening those to free
+objectstack `2fdb36eb9` because its options *are* the shipped catalogs. Widening those to free
 input would be a regression wearing this fix's clothes, so the two branches are pinned
 against each other from the specifier data rather than from a list of key names — a key
 that gains a domain server-side joins the right side of the pin with no edit here.
 
@@ -12,7 +12,7 @@ table (objectui#5878) and then built the `FeedItem` itself, ending in
 situations: a type the table maps to `undefined` **on purpose** (`commented` /
 `mentioned` / `login` / `logout`), and a type the table has never heard of. The
 second is an **author-extended** value — `sys_activity.type` is
-author-extensible (objectstack#11507 direction 4, ruled 2026-08-24), every
+author-extensible (objectstack `88b9d749a`, direction 4, ruled 2026-08-24), every
 column on that table is `readonly` so objectql never validates a write, and
 ADR-0052 §5b.2 forwards an author's `activityMilestones[].type` into it
 verbatim. So an activity that happened, was written and is queryable had no row
 
@@ -8,7 +8,7 @@ The permission matrix already locks a set a code package ships (the artifact
 tier: `isArtifactBackedLayer`, the client mirror of the server's
 `isArtifactBacked`), and its guidance offered only the pre-ruling remedies —
 edit the source artifact and redeploy, a new runtime set, the
-`OS_METADATA_WRITABLE` hatch. The ruled path (objectstack#11513, 「同意 第一步
+`OS_METADATA_WRITABLE` hatch. The ruled path (objectstack `e170b0ae5`, 「同意 第一步
 (创业阶段,Salesforce 式)」: lock the base, clone to customize) was never on the
 screen, and the metadata-door refusal a Studio save receives names only the
 pre-ruling remedies; the data door's refusal is the one that names the Clone
 
@@ -7,7 +7,7 @@ Retire the discovery-wire preview mode — the console no longer turns
 authentication off because a server said `mode: 'preview'` (objectui#6654).
 
 `@objectstack/spec` retired the `RuntimeMode` value `'preview'` and the whole
-`PreviewModeConfig` block (objectstack#11846). This console still read that
+`PreviewModeConfig` block (objectstack `0c2334f6c`). This console still read that
 surface back off the runtime discovery payload, which is a different layer from
 the retired compile-time type — so the consumption could not simply be assumed
 dead, and its removal was ruled deliberately (2026-08-29).
 
@@ -21,7 +21,7 @@ a `scheduled` meeting, a `login`, a nightly `system` rollup and an author's
   its own icon, label and notification toggle. Following
   `UNMAPPED_ACTIVITY_FEED_TYPE`'s precedent, an unrecognised value renders
   through it and is named once on `console.warn` rather than being dropped —
-  `sys_activity.type` is author-extensible (objectstack#11507 direction 4), so
+  `sys_activity.type` is author-extensible (objectstack `88b9d749a`, direction 4), so
   an unmapped value is real activity nobody has ruled on, not a mistake.
 - The built-ins that had no honest presentation among the four existing kinds —
   `system`, `completed`, `scheduled`, `login`, `logout` — now land in that