audit(#2657 prerequisite): refresh the two-repo metadata-type coverage matrix — registered types vs authorable schemas vs Studio pillars

[hotlong]

Prerequisite of #2657 (maintainer 2026-08-07, 「按建议」): #2657 stays off the v17 board; its next actionable step is this audit, whose output is the input for the maintainer's one-shot appetite ruling (ADR-0088 admission + ordering, bundled with the Studio appetite question in #3257). Likely a v18-train program — this card only measures.

Why the existing matrix cannot be used

#2657's coverage matrix predates several structural changes measured during the 2026-08-07 release-board audit: api was promoted via #5312, role/profile/validation were retired, and the Studio pillar set has moved. Deciding admission/ordering off the stale matrix would misroute a multi-week program.

Ask (read-only audit, both repos)

1. Enumerate the CURRENT registered metadata types (DEFAULT_METADATA_TYPE_REGISTRY + schema entries in packages/spec) on objectstack origin/main.
2. For each promotion candidate Studio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657 names (webhooks, connectors, portals, sharingRules) and any additional drifted candidates found: record — registered? authorable zod schema exists? REST/meta routes? Studio pillar in objectui (which surface, how complete)? real consumers (grep, per Operational-note-6 discipline: quoted exact names, declaration-site over mention).
3. Produce the refreshed matrix as a table: type × {registry, schema, routes, Studio, consumers, ADR-0088 admission blockers}.
4. Note per row a size estimate (S/M/L) for promotion, and any ordering dependencies between rows.

Deliverable

NO code PR. Post the refreshed matrix + findings as ONE structured comment on #2657 (cross-link from this card), then close this card with a pointer. The maintainer's appetite ruling happens on #2657 afterwards.

[hotlong]

Claim: PM session (maintainer-directed, 2026-08-07 「按建议」 — prerequisite audit for #2657)
Session: session_01BickTBKm2JYSNnrtPT8ysa
Branch: none (read-only audit card — deliverable is a structured matrix comment on #2657, no code PR)
Worktree: none (reads both repos' origin/main only)
Domain: domain:spec (registry/schema enumeration face)
File surface: none written; reads packages/spec/** (objectstack) + Studio surfaces (objectui)
Container judgment: S (read-only two-repo sweep) → mode:subagent, shared container
Serial constraints cleared: read-only — no file collisions possible; #2657 will carry Blocked-by: #6234 until this lands.

---

Generated by Claude Code

[hotlong]

Audit complete — refreshed matrix posted on #2657: #2657 (comment) (headline: the ruling is over three rows, not five — apis was admitted via #5271/#5312 and portals was deleted from the spec by #3464; the three survivors are already writable through /meta with zero schema validation, which #6242 and objectstack-ai/objectui#3561 record as drift found along the way). Leaving this card open for PM review — not closing it myself.

---

Generated by Claude Code

[hotlong]

Review: ACCEPT — card complete, closing. The refreshed matrix is on #2657 (read back intact; every cell anchored to file:line at named shas of both repos; zero-hit greps carried known-present controls; the one unmeasured claim is marked as such). Highlights the stale matrix could never have shown: portals/PortalSchema was deleted by #3464 (the ruling is over THREE rows, not four); Studio's frame is now four pillars + a registry-driven Metadata Directory that already makes every registered kind authorable; and the load-bearing discovery — all three surviving candidates are ALREADY writable through PUT /meta with zero schema validation (an in-repo test saves a spec-invalid webhook and expects success:true), the same enforced-but-undeclared hole #5271 closed for api. Two out-of-scope findings verified filed (#6242, objectui#3561). The decision-inputs section moves to #2657 for the maintainer's one-shot ruling; option A (bind schemas without registering) is being filed as an immediate defect card since it closes today's hole regardless of the B/C outcome.

---

Generated by Claude Code