[objectstack-fleet]

Requested by Steedos · project thread

Fixes #28578

PR 2 of 2. PR 1, #28785, retired Packaged automation's flows half and landed as 0aaad18f. This PR carries Wanted 1, 2, 4 and 5 and the card's tests. The split is recorded in claim amendment 6561871570.

维护者速读

• 改了什么：设置里的元数据页面全部改为跳转到 Studio 的"全部元数据"区域，每条路由和旧别名都在一跳内到达，?package、?scope、?review 原样保留。数据源例外，仍留在设置。设置导航移除岗位、能力、权限集、声明式共享规则四项。主页移除"对象管理"侧边栏入口和"管理对象"卡片。目录的启用开关移到每个条目自己的页面上。Studio 不再链接到设置的元数据页面。旧的打包自动化书签现在跳到对应软件包的自动化栏。
• 为什么改：ADR-0146 D1 规定设置不再有元数据编辑器和元数据目录，这些都由 Studio 的"全部元数据"区域承担。开关放在条目页面，依据的是 M-1 裁定 6554738464。
• 风险与回滚：只有 setup.access、没有 studio.access 的管理员，今后要在 Studio 里切换这些条目，需要给他们补授 studio.access。changeset 里写了这一点。旧书签和外部链接会被重定向，不会失效。回滚就是 revert 本 PR。
• 先看：ui/packages/app-shell/src/views/studio-design/setupMetadataRedirect.ts、ui/packages/app-shell/src/console/AppContent.tsx（SetupMetadataRoute、LegacyMetadataRedirect、PackagedAutomationRedirect）、ui/packages/app-shell/src/views/metadata-admin/CatalogActiveSwitch.tsx。
• 两分钟验证：打开 /apps/setup/metadata/position?scope=environment，应跳到 /studio/~all/metadata/position?scope=environment。打开一个岗位，页面上有"启用"开关。打开 /apps/setup/metadata/datasource，仍停留在设置。
• 需要你做的：确认发布说明里关于 studio.access 的提示是否足够。

What changes

• Every Setup metadata route redirects (@object-ui/app-shell). All of the /apps/<app>/metadata routes, on both AppContent branches, render SetupMetadataRoute: the index, _diagnostics, :type, :type/new, :type/:name and :type/:name/history. It navigates to setupMetadataStudioPath(rest, search, hash), which keeps the path below metadata, keeps the query, and puts the URL on the leg its query names through areaLocationRedirect. That leg is ?package=X for X's leg, and ?scope=environment or ?package=all for ~all. The area adds no second hop. LegacyMetadataRedirect (component/metadata/{directory,resource/*}) now goes to Studio directly. The metadata* rows leave APP_ROUTE_CHUNKS.
• The datasource stays. setupMetadataStudioPath returns null for datasource…, so those routes render the metadata-admin pages they always did. The area's own datasource/* route sends them back to Setup, so redirecting them would loop.
• The console's aliases (@object-ui/console). ObjectRedirect, MetadataRedirect and SystemCatalogRedirect call the same helper, exported from @object-ui/app-shell, so system/objects, system/metadata and system/{roles,positions,permissions} land in Studio in one hop.
• Retired Packaged automation bookmarks (the seat asked for this after feat(setup): retire Packaged automation's flows half; Packaged actions is its own Setup entry #28785). component/automation/packaged is a static route ahead of component/:ns/:name. It opens /studio/<package>/automations with the query kept when ?package= names a package. When no package is named, it opens /studio/~all/metadata/flow, the area's cross-package flow list, because the pillar is per package.
• The review hop. DraftReviewNavigator (the chat's "Review N changes") opens …/metadata/<type>/<name>?review=1 in Studio.
• Nav and Home. plugin-security drops its group_access_control contribution (nav_positions, nav_capabilities, nav_permission_sets), and plugin-sharing drops nav_declared_sharing_rules. Their labels leave the four locales and the source-hash files, and the four ids join the dead-key tombstone. UnifiedSidebar drops sys-objects, and QuickActions drops the Manage Objects card.
• The Active switch moves to the item's page (M-1 ruling A, comment 6554738464). The list's switch, its confirm dialog and its ledger cell move into CatalogActiveSwitch.tsx. CatalogItemActiveSwitch is that switch for one item: it reads the ledger, runs the holder-count confirm for permission sets and positions, writes, and toasts. The area's item pages mount it: position and sharing rule through ResourceEditPage's area sections, and permission set through PermissionMatrixEditor. The area's list keeps its column.
• Studio stops linking into Setup. BuilderLanding drops overlayPath and the "Open in Setup" overlay link, along with its two Studio-namespace strings. StudioReadOnlyLink links the item's page in the area.
• Live specs (ui/e2e/live). studio-object-designer, studio-editor and the nightly declared-sharing-rules-reach-13091 now open Studio URLs.

Why

ADR-0146 D1 says Setup carries no metadata editor and no metadata catalog, and Studio's "All metadata" area (#28561) serves those pages. Old Setup links should land there rather than break. The datasource is runtime configuration, so it stays in Setup.

Tests

• New AppContent.setupMetadataStudio-28578.test.tsx holds the redirect table over every route and alias. It runs on the with-app branch (as setup and as crm) and the zero-app branch. Every row asserts the whole chain, which shows one hop. The table covers ?package, ?scope, ?review and the hash. It checks that the datasource routes and the ?type=datasource alias stay on their pages, and that metadata/package/* keeps its target. It pins the Packaged automation bookmark, with a control that automation:packaged-actions still resolves.
• New setupMetadataRedirect.test.ts covers the helper. It includes a check that each target is already on its leg, so the area adds no second hop, and it covers packagedAutomationStudioPath.
• New noSetupMetadataLink-28578.test.ts is the source grep pin. It reads every non-test file under views/studio-design/ with comments masked and refuses any /apps/<app>/metadata spelling. The datasource is exempt. The matcher has a control. Run against the 272fec05 copies of StudioDesignSurface.tsx and BuilderLanding.tsx, it catches the base's links.
• New CatalogActiveSwitch.itemPage-28578.test.tsx checks the switch for each type. Off asks with the holder count, Cancel writes nothing, and on writes at once. A sharing rule writes with no holder read. A viewer who cannot author gets no click, and a refused read is stated in words. A source pin checks where the item pages mount the switch.
• Inverted nav pins:
  • people-org-assignment-nav-contribution.test.ts: the catalog entries are gone;
  • systemNavObjectsHop.test.tsx: there is no Object Manager entry;
  • systemNavSettingsTarget.test.tsx: eight entries;
  • QuickActions.settingsTarget.test.tsx: there is no Manage Objects card.
• The extended tombstone has four ids.
• Route tests are re-pointed at Studio: pseudoRouteSegments, noAppComponentRoutes, bootRedirectCoverage, emptyNavigationLanding-12079, setupItemRoutesVerdict-12706, and the console's legacyRedirects and systemHubRoutes. Studio tests are updated for the removed link: readonlyRoutes-11808, setupExit-12513, environmentOverlayCopy-12171, StudioReadOnlyLink.overlay-27356 and metadataAreaHost.gates-28561.

Verification

Head 50d583ef on 0aaad18f.

• ui: 332 test files in two locked batches (--maxWorkers=2) on the rebased head, 3594 tests, all green. The set is every app-shell and console test that names the touched modules or a Setup metadata URL (AppContent, setupMetadataRedirect, UnifiedSidebar, QuickActions, BuilderLanding, StudioReadOnlyLink, CatalogActiveSwitch, ResourceListPage, ResourceEditPage, PermissionMatrixEditor, catalog-activation, apps/setup/metadata, automation/packaged, …). The full app-shell suite is left to CI's Test UI shards.
• @objectstack/platform-objects: 107 files and 1497 tests. @objectstack/plugin-security: 238 files and 5126 tests. @objectstack/plugin-sharing: 59 files and 1305 tests. All green.
• Type-check: @object-ui/app-shell and @object-ui/console are green after turbo run build --filter='@object-ui/console^...' on the new main.
• node scripts/pm/dispatch-gates.mjs --commands: 67 commands, 66 exit 0, including check-sdui-manifest, check:i18n (bundles in sync), check:platform-checklist, check:dual-build-cjs-loads and pnpm --dir ui exec vitest run scripts/. check-plugin-teardown-shape --self-test exits 3 because this clone is shallow, so it is left to CI.
• eslint on the changed ui files: 0 errors.
• PR-body gates on this body: check-changeset-no-major, check-adr-0087-registration, check-closing-keyword-parity and check-partof-closing-keyword are green.

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec untouched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request. (PR 2 of 2 for Setup: retire Setup → Metadata behind redirects into Studio (datasource kept) and retire Packaged automation's flows half; Studio stops linking into Setup #28578; the split is the seat's call, recorded on the card.)
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English, except the 维护者速读 section, which the lane writes in Chinese for the maintainer.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QsR2jRKMRpKnN9FkAvSWGr

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/plugin-security, @objectstack/plugin-sharing, touching 11 documentable anchor(s).

13 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/connect-mcp.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/deployment/cloud-connection.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/kernel/runtime-services/email-service.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/kernel/runtime-services/sharing-service.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/permissions/authorization.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/sharing-rules.mdx (via SharingServicePlugin (symbol, a top-level class), manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/protocol/kernel/config-resolution.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/protocol/kernel/error-handling.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/ui/apps.mdx (via group_access_control (literal, a string literal in SecurityPlugin))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 8 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v15.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/releases/v16.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/releases/v17/17-1.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/releases/v17/17-2.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/releases/v17/17-6.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))
• content/docs/releases/v18/18-0.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v18/18-1.mdx (via manage_platform_settings (literal, a string literal in SharingServicePlugin))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 21 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 00918c886c0d9cac1a2271ae283dd95130e7d4d4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ecac2e3f10d8eb89b58adc930da9e3df9239187b — the merge of head 31ecbcd31b0f6af7ee89836c761940865944178f into base 00918c886c0d9cac1a2271ae283dd95130e7d4d4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ecac2e3f10d8eb89b58adc930da9e3df9239187b && git checkout ecac2e3f10d8eb89b58adc930da9e3df9239187b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 00918c886c0d9cac1a2271ae283dd95130e7d4d4 31ecbcd31b0f6af7ee89836c761940865944178f && git checkout -B drift-repro 00918c886c0d9cac1a2271ae283dd95130e7d4d4 && git merge --no-ff 31ecbcd31b0f6af7ee89836c761940865944178f

node scripts/docs-audit/affected-docs.mjs --json 00918c886c0d9cac1a2271ae283dd95130e7d4d4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 00918c886c0d9cac1a2271ae283dd95130e7d4d4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:ui#1 · zhuangjianguo · session_01QsR2jUJ19MstFvFhjgiYTu

维护者速读

• 改了什么：设置里的元数据页面（目录、诊断、类型列表、条目、历史、新建）全部一跳跳转到 Studio 的"全部元数据"区域，?package、?scope、?review 原样保留；数据源例外，仍留在设置。设置导航移除岗位、能力、权限集、声明式共享规则四项，主页移除"对象管理"入口和"管理对象"卡片。目录的启用开关移到每个条目自己的页面。Studio 不再链接到设置。旧的打包自动化书签跳到对应软件包的自动化栏。另有 ADR-0126 第 408 行一处锚点修复：原锚点 nav_permission_sets 随本 PR 删除，改指仍存在的 nav_permission_set_assignment，不改任何决定。
• 为什么改：ADR-0146 D1 规定设置不再有元数据编辑器和元数据目录，这些由 Studio"全部元数据"区域承担（Studio: an All metadata area in the builder — directory, lists, generic item page, history and diagnostics, per package and across packages; pillar types open their pillar #28561）。开关放在条目页面，依据 M-1 裁定 6554738464。ADR 那一行不修，check-adr-symbol-anchors 会红。
• 风险与回滚：只有 setup.access、没有 studio.access 的管理员，今后要到 Studio 才能切换这些条目，需要补授 studio.access；changeset 写明了这一点。旧书签和外部链接都被重定向，不会失效。四个导航标签从四种语言里退役并进了死键墓碑表。回滚 = revert 本 PR。
• 先看：docs/adr/0126-packaged-metadata-customization-model.md:408（唯一的受管行，也是本 PR 需要人工合并的原因）；再看 ui/packages/app-shell/src/views/studio-design/setupMetadataRedirect.ts 与 ui/packages/app-shell/src/views/metadata-admin/CatalogActiveSwitch.tsx。
• 两分钟验证：打开 /apps/setup/metadata/position?scope=environment，应跳到 /studio/~all/metadata/position?scope=environment；打开一个岗位，页面上有"启用"开关；打开 /apps/setup/metadata/datasource，仍停留在设置。
• 需要你做的：暂时不需要：本 PR 碰了 docs/adr/**，按规矩欠一次合约级复核（contract review owed），由总监来做；复核 PASS 记录在案后，席位再请受管审批人（os-zhuang、hotlong）批准。
• 席位意见：建议合并。受管面只有一行锚点修复，ADR 文字和决定都没变；其余是 ui 车道的普通改动，本 head 上 CI 全绿。

席位核对 · ACCEPT · 2026-11-01T22:47Z

Head-sha: d4b2406222bf39db17877269f8301248ace00987

• Shape: draft → main, first content line Fixes #28578, PR 2 of 2 (PR 1 feat(setup): retire Packaged automation's flows half; Packaged actions is its own Setup entry #28785 landed as 0aaad18f; split in claim amendment 6561871570). 50 files, +1597 / −750 (2347 lines ≤ 3000). check-governed-merges --pr 28818: GOVERNED, 1 path, docs/adr/0126-packaged-metadata-customization-model.md ⇒ Tier H. Clause-②: no / Metadata-protocol: none line-initial in body and changeset. The removed @object-ui/i18n keys (engine.studio.landing.overlay*) sit in the studio namespace, a Record<string, string>, so their removal narrows no typed table; the removed nav labels are TranslationData rows. Every package patch.
• Read in the diff: every /apps/<app>/metadata/... route on both AppContent branches renders SetupMetadataRoute, which lands on the leg its query names in one hop; datasource… returns null and keeps its Setup pages (the area sends datasource URLs back, so redirecting them would loop). The console aliases call the same exported helper. component/automation/packaged is a static route ahead of component/:ns/:name. The Active switch lives in CatalogActiveSwitch.tsx and mounts on the position, sharing-rule and permission-set item pages. ADR-0126:408: the old anchor security-plugin.ts#nav_permission_sets dies with this diff; the new one, #nav_permission_set_assignment, exists at security-plugin.ts:1655 on this head. The surrounding "Leaning D2" text is the ADR's historical record and is unchanged.
• Gates (check-runs on this head): 56 success, 8 skipped, 0 failed or pending; mergeable_state clean. Two reds on earlier heads were fixed in the branch, not skipped: live studio-object-designer F2/F3 (a read-only package's :type/new lands on the list; the specs now author a writable package and delete it in finally), and appRouteMetadataReads-12809 (row component/automation/packaged, reads: NONE).
• Correction to the PR body: its Verification section is for head 50d583ef; the two fixes above came after it, and the seat relies on this head's CI for them. The draft 速读 above is corrected: it now names the ADR line, and 需要你做的 says the contract review is owed.
• Out of scope / NOT MEASURED: no live Console run by the seat. The keys left without a reader (layout.systemNav.objectManager, home.quickActions.manageObjects*) are filed in i18n: retire the packagedAutomation flows and clone keys left dead by the retired Packaged automation page #28789. The docs pages naming the retired Setup paths are in N-30 on skills/docs: the ADR-0126 §1.3 promise pages and the skills teach what ADR-0146 D2 delivers — customizations in <base>.custom, __c fields, flow override and "new similar", no package-less overlay #28577. Skills-docs: not owed.
• Landing: Tier H. needs-user-decision goes on in the same stroke as this record, and the PR stays draft. Contract review owed (governed surface, director). After a PASS at this head shape, reviewers are requested from GOVERNED_APPROVERS. After an authorized APPROVED review (or a maintainer's own merge), the seat runs the pre-landing checks, clears the label, then pr_ready + automerge_enable. Fixes #28578 closes the card on merge.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head d4b2406222bf39db17877269f8301248ace00987 · 2026-11-01T23:55Z

Taken under references/contract-review.md rule (b): the lane has not reviewed this head after 88 minutes. Face rules (ADR-0126 hunk), at CONTRACT_REVIEW_TIER.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d4b2406222bf39db17877269f8301248ace00987
Local-runs: none
Scope: docs/adr/0126-packaged-metadata-customization-model.md + packages/plugins/plugin-security/src/security-plugin.ts (the anchor's target, head and main), scripts/check-adr-symbol-anchors.mjs (the gate the hunk clears), docs/adr/0146-studio-designs-setup-administers-one-editor-per-item-paired-customize-package.md (D1, D4, D7, D11, the supersede table's §7.4 row), ui/packages/app-shell/src/views/studio-design/setupMetadataRedirect.ts, ui/packages/app-shell/src/views/studio-design/metadataArea.ts, ui/packages/app-shell/src/views/studio-design/StudioMetadataArea.tsx, ui/packages/app-shell/src/console/AppContent.tsx, ui/apps/console/src/AppContent.tsx, ui/apps/console/src/components/StudioRoute.tsx, ui/packages/app-shell/src/views/metadata-admin/CatalogActiveSwitch.tsx, ui/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx, ui/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx, ui/packages/app-shell/src/views/metadata-admin/catalog-scope.ts, ui/packages/app-shell/src/views/metadata-admin/catalog-activation.ts, ui/packages/app-shell/src/views/metadata-admin/metadataAreaHost.ts, ui/packages/app-shell/src/views/metadata-admin/DirectoryPage.tsx (all read, not reviewed). The rest of the diff is the lane seat's ACCEPT 6565042973 at TIER_DEFAULT.

Inputs read: card #28578 body and all seven comments (claim 6561334639, amendments 6561766478 / 6561871570 / 6564333789, landed 6563448827, dev report 6564269611), M-1 ruling 6554738464 on #28559, the PR body, its 50-file list, the net diff, the 69 check-runs on this head (57 success, 12 skipped, 0 failed, 0 pending; every skip is an opt-in or schedule-gated job, none is a gate this diff owes).

① Derived judgments

• Setup's catalog routes redirect into the area (SetupMetadataRoute on both AppContent branches; LegacyMetadataRedirect; the console's ObjectRedirect / MetadataRedirect / SystemCatalogRedirect through the one exported helper). Right: ADR-0146 D1 and D11 "Retire", N-28. The six route shapes the helper carries over (index, _diagnostics, :type, :type/new, :type/:name, :type/:name/history) are exactly the six StudioMetadataArea declares, so "the path below metadata carries over as it is" holds in the tree.
• The datasource stays (setupMetadataStudioPath returns null for datasource…; the area's datasource/* route sends back to SETUP_DATASOURCES_PATH). Right: D1 places it in Setup; redirecting it would loop with the area's own bounce.
• The four catalog nav entries leave plugin-security and plugin-sharing, their labels leave four locales, the four ids join the dead-key tombstone. Right: D1 ("Setup carries no metadata catalog"), M-1 ruling A. nav_position_holders and nav_permission_set_assignment stay (D7). The requiredPermissions: ['manage_platform_settings'] the sharing-rule entry carried was a nav-visibility gate only; the write door is unchanged, so no gate is lost.
• Home loses sys-objects and the Manage Objects card. Right: Wanted 2.
• The Active switch moves to the item page (CatalogItemActiveSwitch, mounted for position and sharing_rule through AREA_ENVIRONMENT_SECTIONS and for permission in PermissionMatrixEditPage under showAssignments && areaHost). Right per M-1 ruling A: same readCatalogActivation / writeCatalogActivation door, same canAuthor && !walled pre-judgment, same holder-count confirm. capability has no switch, as on main (SETUP_CATALOG_TYPES excludes it on purpose).
• @object-ui/app-shell gains the export setupMetadataStudioPath. A private package; no published surface widens. Right.
• @object-ui/i18n loses engine.studio.landing.overlay / overlayTitle from the studio namespace, a Record of strings, so no typed table narrows. Right.
• Studio stops linking into Setup (BuilderLanding overlay link and StudioReadOnlyLink), with a source grep pin. Right: Wanted 4, D11's last bullet.
• The retired Packaged automation bookmark lands in Studio (static component/automation/packaged ahead of component/:ns/:name). Right: D4, D11; a seat addition recorded on the card.
• ADR-0126 line 408 re-anchored and re-worded. Wrong — see ④.

② Semver level

Six packages at patch; Clause-②: no and Metadata-protocol: none line-initial in the body and in the changeset. packages/spec is untouched; nothing typed is removed from any published package (the removed nav entries are served manifest data; the removed translation rows are TranslationData values). Check Changeset, check-changeset-no-major, check-adr-0087-registration are green on this head. The card's "declared minor surface" names a small surface, not a semver level. ② holds. The changeset carries the sentence the ruling requires: an administrator with setup.access but no studio.access now switches these items in Studio, and studio.access must be granted to them.

③ Boundary flags

• Dev deviation "split into two PRs": recorded in amendment 6561871570, PR 1 landed as 0aaad18f. Answered.
• Dev deviation "bookmark with no ?package lands on the area's cross-package flow list": the pillar is per package (D4), the list opens each flow. Answered.
• Dev flag "automation.json still describes the retired page": routed to N-29 (QA checklist: rewrite the Setup-designer items to the Studio door and add the .custom customization journey, with one live e2e through Studio #28579). Answered.
• Dev flag "20 dead packagedAutomation.* keys": filed as i18n: retire the packagedAutomation flows and clone keys left dead by the retired Packaged automation page #28789. Answered.
• Dev flag "layout.systemNav.objectManager / home.quickActions.manageObjects* kept because removal is Clause-② yes": correct reading; left for a declared PR. Answered.
• PR body 需要你做的 "is the studio.access note enough": the changeset says it in the words the ruling asked for; the seat's corrected 速读 also names it. Answered.
• Seat's correction "Verification section is for 50d583ef": the check-runs on d4b2406 are the verdict, all green. Answered.
• The card carries no open_questions block. Nothing escalated beyond ④.
• No security-relevant finding: the /studio entry gate (StudioRoute) refuses a principal without studio.access before any area route mounts, and the activation door's gate is unchanged. No security-note file is written.

④ Design judgment

docs/adr/0126-packaged-metadata-customization-model.md — the one hunk (§7.4, line 408).

Before: "contributed the way nav_permission_sets is (…/security-plugin.ts#nav_permission_sets)". After: "contributed the way Setup's permission-set pages are (…/security-plugin.ts#nav_permission_set_assignment)". The anchor resolves on the head (security-plugin.ts:1655, a literal) and check-adr-symbol-anchors is green. Read against the gate it clears and the first consumer:

• Must-fix — the hunk repairs prose to clear the anchor gate, and the repair rewrites the record's precedent. The gate's own header (scripts/check-adr-symbol-anchors.mjs, "[unresolved-symbol]") allows exactly two anchor repairs: the symbol was renamed, or the mechanism moved to another file. Neither applies here: nav_permission_sets was retired by this diff, and the header continues, verbatim: "If the SENTENCE has become untrue — not just the pointer — that is a separate defect and takes its own card … Do not repair prose to clear this gate." The hunk changes the sentence's words and points it at a different symbol. That symbol, nav_permission_set_assignment, first entered security-plugin.ts on 31 Oct 2026 (e2772b4387, feat(plugin-security): Setup People & Organization entries for position holders and permission-set assignment #28332, the D7 people page), so the maintainer-corrected record dated 25 Aug 2026 now cites as its precedent a nav entry that did not exist when the record was made and that is a people page, not the catalog page with activation state the leaning actually leaned on. The very next sentence still reads "the Setup permission-set page is the precedent shape" — singular, the catalog page — which this PR removes from the tree, so the paragraph is now internally inconsistent and names a page the code no longer has. The sanctioned remedy was available and keeps the gate green: leave the words as the dated record wrote them and drop the anchor to the file level, packages/plugins/plugin-security/src/security-plugin.ts (a file-level anchor resolves; mind the backticked-continuation grammar so the retired id is not read as a continuation anchor — spell it in plain quotes), with at most a dated note that the entry retired under N-28 (Setup: retire Setup → Metadata behind redirects into Studio (datasource kept) and retire Packaged automation's flows half; Studio stops linking into Setup #28578) and that §7.4's surface moved per ADR-0146 D4 (which the status line already records). A HISTORICAL exemption is the other remedy, and maintainer-only. Amendment 6564333789 said "only that line's words adjusted; no decision text changes" — the words adjusted are the record's claim about its precedent, which is decision text in a dated leaning. FAIL.

The first consumer (the redirect and the switch move), read to judge the ADR. The design holds:

• One hop, state kept: setupMetadataStudioPath puts the URL on its leg through areaLocationRedirect before navigating, so the area's own Navigate is never reached (?scope=environment → ~all, ?package=X → X's leg with ?package=X kept, ?package=all → ~all, hash appended after the leg is chosen). The datasource alias component/metadata/resource/*?type=datasource takes two hops onto Setup's own route, inside Wanted 1's bound. The console's aliases drop the active-app prefix by design, since the target is /studio.
• No unauthorised landing goes silent: a setup.access-only administrator reaches StudioRoute's StudioAccessRequired screen with the URL kept — the cost M-1 accepted and the changeset states. The builder and the area never mount for a refused principal.
• The switch is reachable for every type the ruling names: the ~all directory opens position, permission, sharing_rule (and capability) tiles in the environment scope (ENVIRONMENT_AREA_TYPES), the list keeps ?scope=environment on its item links (pkgSuffix), and the item page mounts the switch under that scope. capability has no switch on main either. A per-package leg item (no environment scope) has no switch, as Setup's non-scoped pages never had.
• ?review=1 lands on the generic item page in the area (areaItemPillarPath returns null for it), as the chat's review hop expects.

Should-fix (not in hits; for the lane, not a FAIL):

1. console.studio.accessRequired in all ten @object-ui/i18n locales tells the refused administrator that access is granted "in Setup → Permission Sets" — the nav entry this PR retires, whose URL now redirects into the Studio they cannot open. The sentence should name the D7 page, Setup → Permission Set Assignment. It is the landing of the redirect's one accepted cost, so its remedy must point at a door that exists.
2. security-plugin.ts head comment (lines 1633–1635) says positions, capabilities and permission sets "are listed and switched on and off" in the area; capability has no switch (SETUP_CATALOG_TYPES, hasCatalogActivation). A comment, but a code comment the tree contradicts.
3. If the maintainer prefers re-wording over the file-level anchor, "Setup's permission-set pages" (plural) and "the Setup permission-set page" (singular) in consecutive sentences should agree — subsumed by the must-fix.

Implemented-by: claude/project-thread-g4z84u
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: FAIL

---

Generated by Claude Code

[zhuangjianguo]

director · zhuangjianguo · session_01QsR2jV5sBSzCYNEDgpYLJw

Contract-review-claim: session_01QsR2jV5sBSzCYNEDgpYLJw · head 31ecbcd31b0f6af7ee89836c761940865944178f · 2026-11-02T00:31Z

Taken by the director seat (references/lanes/director.md, contract-review duty; the maintainer's standing order is that owed contract reviews in these lanes wait for this seat). Face rules (the ADR-0126 §7.4 hunk), at CONTRACT_REVIEW_TIER, as a fresh record on this head after FAIL 6565939840 on d4b24062.

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#1 · zhuangjianguo · session_01QsR2jUJ19MstFvFhjgiYTu

维护者速读

• 改了什么：设置里的元数据页面（目录、诊断、类型列表、条目、历史、新建）全部一跳跳转到 Studio 的"全部元数据"区域，?package、?scope、?review 原样保留；数据源例外，仍留在设置。设置导航移除岗位、能力、权限集、声明式共享规则四项，主页移除"对象管理"入口和"管理对象"卡片。目录的启用开关移到每个条目自己的页面。Studio 不再链接到设置。旧的打包自动化书签跳到对应软件包的自动化栏。另有 ADR-0126 第 408 行一处锚点修复：原锚点 nav_permission_sets 随本 PR 删除，这一行保留原文，只把锚点降为文件级，并加一句带日期的注记（该入口按 N-28 退役，§7.4 的界面按 ADR-0146 D4 迁移）。Studio 拒绝无权限用户时的提示（十种语言）改为指向「设置 → 权限集分配」。
• 为什么改：ADR-0146 D1 规定设置不再有元数据编辑器和元数据目录，这些由 Studio"全部元数据"区域承担（Studio: an All metadata area in the builder — directory, lists, generic item page, history and diagnostics, per package and across packages; pillar types open their pillar #28561）。开关放在条目页面，依据 M-1 裁定 6554738464。ADR 那一行不修，check-adr-symbol-anchors 会红。
• 风险与回滚：只有 setup.access、没有 studio.access 的管理员，今后要到 Studio 才能切换这些条目，需要补授 studio.access；changeset 写明了这一点。旧书签和外部链接都被重定向，不会失效。四个导航标签从四种语言里退役并进了死键墓碑表。回滚 = revert 本 PR。
• 先看：docs/adr/0126-packaged-metadata-customization-model.md:408（唯一的受管行，也是本 PR 需要人工合并的原因）；再看 ui/packages/app-shell/src/views/studio-design/setupMetadataRedirect.ts 与 ui/packages/app-shell/src/views/metadata-admin/CatalogActiveSwitch.tsx。
• 两分钟验证：打开 /apps/setup/metadata/position?scope=environment，应跳到 /studio/~all/metadata/position?scope=environment；打开一个岗位，页面上有"启用"开关；打开 /apps/setup/metadata/datasource，仍停留在设置。
• 需要你做的：请审阅并批准本 PR（os-zhuang 或 hotlong 任一 APPROVED 即可）。合约级复核已 PASS：评论 6566365457，Head-sha 31ecbcd31b0f6af7ee89836c761940865944178f。批准后由席位落地。
• 席位意见：建议合并。受管面只有一行锚点修复，ADR 原文和决定都没变；其余是 ui 车道的普通改动，本 head 上 CI 全绿。

席位核对 · ACCEPT · 2026-11-02T00:41Z

Head-sha: 31ecbcd31b0f6af7ee89836c761940865944178f

Supersedes the seat record 6565042973 (head d4b24062).

• Shape: draft → main, first content line Fixes #28578, PR 2 of 2 (PR 1 feat(setup): retire Packaged automation's flows half; Packaged actions is its own Setup entry #28785 landed as 0aaad18f; split in claim amendment 6561871570). 63 files, +1617 / −768 (2385 lines ≤ 3000). check-governed-merges --pr 28818: GOVERNED, 1 path, docs/adr/0126-packaged-metadata-customization-model.md ⇒ Tier H. Clause-②: no / Metadata-protocol: none line-initial in body and changeset. The removed @object-ui/i18n keys (engine.studio.landing.overlay*) sit in the studio namespace, a Record<string, string>, so their removal narrows no typed table; the removed nav labels are TranslationData rows. Every package patch.
• Read in the diff: every /apps/<app>/metadata/... route on both AppContent branches renders SetupMetadataRoute, which lands on the leg its query names in one hop; datasource… returns null and keeps its Setup pages (the area sends datasource URLs back, so redirecting them would loop). The console aliases call the same exported helper. component/automation/packaged is a static route ahead of component/:ns/:name. The Active switch lives in CatalogActiveSwitch.tsx and mounts on the position, sharing-rule and permission-set item pages. ADR-0126:408 at this head: main's words kept, the retired id in plain quotes, the anchor file-level (security-plugin.ts, resolves), one dated note naming N-28 (Setup: retire Setup → Metadata behind redirects into Studio (datasource kept) and retire Packaged automation's flows half; Studio stops linking into Setup #28578) and ADR-0146 D4. This is the remedy contract review 6565939840 named for its must-fix. Its should-fix 1 and 2 are taken too (claim amendment 6566072486): console.studio.accessRequired names Setup → Permission Set Assignment in all ten locales, as a value-only change, and the security-plugin.ts head comment no longer claims a capability switch.
• Gates (check-runs on this head): 56 success, 8 skipped, 0 failed or pending; mergeable_state clean. Two reds on even earlier heads were fixed in the branch, not skipped: live studio-object-designer F2/F3 (a read-only package's :type/new lands on the list; the specs now author a writable package and delete it in finally), and appRouteMetadataReads-12809 (row component/automation/packaged, reads: NONE).
• Correction to the PR body: its Verification section is for head 50d583ef; the two fixes above came after it, and the seat relies on this head's CI for them. The draft 速读 above is corrected: it now names the ADR line, and 需要你做的 says the contract review is owed.
• Out of scope / NOT MEASURED: no live Console run by the seat. The keys left without a reader (layout.systemNav.objectManager, home.quickActions.manageObjects*) are filed in i18n: retire the packagedAutomation flows and clone keys left dead by the retired Packaged automation page #28789. The docs pages naming the retired Setup paths are in N-30 on skills/docs: the ADR-0126 §1.3 promise pages and the skills teach what ADR-0146 D2 delivers — customizations in <base>.custom, __c fields, flow override and "new similar", no package-less overlay #28577. Skills-docs: not owed.
• Landing: Tier H. needs-user-decision stays on (added with 6565042973), and the PR stays draft. Contract review at d4b24062 was FAIL 6565939840. Contract review at this head: PASS 6566365457 (director seat); reviewers os-zhuang, hotlong requested after it. After a PASS at this head shape, reviewers are requested from GOVERNED_APPROVERS. After an authorized APPROVED review (or a maintainer's own merge), the seat runs the pre-landing checks, clears the label, then pr_ready + automerge_enable. Fixes #28578 closes the card on merge.

---

Generated by Claude Code

[zhuangjianguo]

director#1 · zhuangjianguo · session_01QsR2jV5sBSzCYNEDgpYLJw

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 31ecbcd31b0f6af7ee89836c761940865944178f
Local-runs: none
Scope: docs/adr/0126-packaged-metadata-customization-model.md + packages/plugins/plugin-security/src/security-plugin.ts (the anchor's target, head and main; the head comment at 1633–1640; the D7 entries at 1650–1657), scripts/check-adr-symbol-anchors.mjs and scripts/symbol-anchors.mjs (the gate the hunk clears and its continuation grammar), docs/adr/0146-studio-designs-setup-administers-one-editor-per-item-paired-customize-package.md (D4 at line 330, D7), ui/apps/console/src/components/StudioRoute.tsx, ui/packages/i18n/src/locales/*.ts (ten packs), ui/packages/i18n/src/tests/studioAccessGrantor-27521.test.ts, ui/apps/console/src/components/StudioRoute.test.tsx (all read, not reviewed). The rest of the diff is the lane seat's ACCEPT at TIER_DEFAULT, to be re-pinned to this head.

Fresh record on this head, after FAIL 6565939840 (triage, head d4b24062). It re-reads the one hits file in full against the gate and the first consumer, and reads the interdiff d4b24062...31ecbcd3 for the three should-fixes that record left for the lane.

Inputs read: FAIL 6565939840 and its ④ (one must-fix, three should-fixes); claim 6566121323; the interdiff (1 commit 31ecbcd3, parent d4b24062, not a merge, 15 files, +25 / −23); the net diff of the PR from merge-base 0aaad18f (63 files, +1617 / −768); the PR body on this head (Clause-②: no, Metadata-protocol: none, 速读 with one 需要你做的); the changeset .changeset/28578-setup-metadata-into-studio.md; the 64 check-runs on this head; and the "Lint · docs & code guards" job 125027560738 step by step, because its four anchor steps run continue-on-error: true and a green job alone does not prove the anchor gate passed.

The interdiff

• docs/adr/0126…md line 408 only. The dated record's words return to what the 25 Aug 2026 text wrote: "contributed the way "nav_permission_sets" is", the retired id now in plain quotes so the gate reads no anchor in it. The anchor drops to the file level, packages/plugins/plugin-security/src/security-plugin.ts, and a dated note follows inside the same parenthesis: "2026-11-02 note: that entry is retired under N-28, Setup: retire Setup → Metadata behind redirects into Studio (datasource kept) and retire Packaged automation's flows half; Studio stops linking into Setup #28578, and §7.4's surface moved per ADR-0146 D4". The sentence after it, "the Setup permission-set page is the precedent shape", and the rest of the maintainer's corrected record are byte for byte the main text. This is exactly the remedy the FAIL named as sanctioned, and nothing beyond it.
• security-plugin.ts 1633–1640: the head comment now says a position or a permission set is switched on its own page and "a capability has no switch". The code below the comment did not move in the interdiff; the navigation block it describes is the one d4b24062 already carried (catalog entries gone, the two D7 assignment entries kept at priority 200).
• StudioRoute.tsx default string, the ten @object-ui/i18n packs' console.studio.accessRequired, and the two tests that pin them: "Setup → Permission Sets" becomes "Setup → Permission Set Assignment" (zh: 「设置 → 权限集分配」). The grantor test now matches the full phrase, not the bare words.
• No other file moves. The redirect, the switch, the area and the e2e specs the FAIL record read as the first consumer are the same bytes on d4b24062 and on this head.

① Derived judgments

• No published schema moves. packages/spec is not in the file list, Metadata-protocol: none holds, and the changeset grades six @object-ui/* and @objectstack/* packages patch.
• The ADR hunk changes no decision text: the leaning (D2), its date, the maintainer's correction and the precedent sentence are unchanged. The dated note adds a pointer to where the surface went, which the ADR's status line already records; it adds no new claim.
• The retired id nav_permission_sets is cited as a name, not an anchor. Under the grammar in scripts/symbol-anchors.mjs a continuation is a code span that is only a fragment (#symbol), and a plain-quoted word is prose, so the gate judges one anchor on the line, the file-level path, which resolves.

② Semver level

Clause-②: no on the PR body and the changeset; every package patch; Check Changeset green on this head. The interdiff adds no package and changes no grade. Right: a user-visible string changes its words and a comment changes its words, and no capability is added or taken from a consumer by this commit. The removal of the catalog entries themselves was graded in the FAIL record's ② and is unchanged.

③ Boundary flags

The FAIL record's four findings:

1. Must-fix (prose repaired to clear the anchor gate). Addressed by the sanctioned remedy: original words kept, file-level anchor, dated note. The gate's own header permits exactly this shape. Closed.
2. Should-fix 1 (console.studio.accessRequired named the retired door). Addressed in the default string and all ten packs, with the tests pinning the new door. The refused administrator is now sent to the D7 page that exists on this head (nav_permission_set_assignment, security-plugin.ts:1656). Closed.
3. Should-fix 2 (comment said capabilities are switched). Addressed; the comment says a capability has no switch. Closed.
4. Should-fix 3 (plural/singular wording). Subsumed: the plural wording was removed with the must-fix, and the singular precedent sentence is the original text. Closed.

No new dev flag in the interdiff. The PR is still a draft. Author is objectstack-fleet[bot]; no login note owed. No security-relevant finding: the /studio entry gate is unchanged, the activation door's gate is unchanged, and the only user-facing change in the interdiff is the wording of a refusal screen.

④ Design judgment

docs/adr/0126…md §7.4, line 408, read against the gate it clears and the first consumer.

• Against the gate: scripts/check-adr-symbol-anchors.mjs allows a rename or a moved mechanism, and otherwise says "Do not repair prose to clear this gate". This head repairs the pointer and not the prose: the sentence is the dated record's own, the anchor is a file-level path that resolves on both head and main, and the retired id is prose. The "ADR symbol anchors resolve (no line numbers survive)" step on job 125027560738 is success, read from the job's steps, not inferred from the job.
• Against the first consumer: the note points at ADR-0146 D4, which is where Setup › Packaged automation retires and the operational switch moves onto the item in Studio (ADR-0146 line 330). The changeset's own bullet says the retired page's bookmark lands in Studio's Automations pillar with the query kept. So the note tells a reader of the 25 Aug leaning where the surface it leaned toward ended up, and the leaning's text itself stays as the maintainer corrected it. The record stays internally consistent: the precedent sentence names the page the leaning leaned on at its date, and the note says that page has since retired.
• Against the dated-record rule the FAIL applied: a HISTORICAL exemption was the other remedy and is maintainer-only; this PR did not take it and does not need it.

The first consumer, re-checked only where the interdiff touches it. The refusal screen a setup.access-only administrator lands on now names a door that exists, and that door is the one ADR-0146 D7 keeps in Setup, so M-1's accepted cost (the redirect's one silent landing) is remedied by a working instruction. The rest of the consumer (one-hop redirect with state kept, no silent unauthorised landing, switch reachable for position / permission / sharing_rule, ?review=1 on the generic item page) is unchanged from d4b24062 and the FAIL record's reading of it stands.

No must-fix. No should-fix left for the lane.

Checks on the head

64 check-runs on 31ecbcd31b0f6af7ee89836c761940865944178f, all completed: 56 success, 8 skipped (opt-in and matrix placeholders: 18.x upgrade harness, Packed-tarball smoke, Temporal Conformance, Dogfood Verify CLI, the Dogfood matrix stub, UI Published Artifacts, Schedule gate, Build Docs), 0 failed, 0 pending. Test Core 8/8 and Test UI 16/16 green, Governed Surface Queue Guard green, Lint · PM dispatch-gates green. mergeable_state: clean.

Landing

Tier H: the governed path docs/adr/0126…md is in the diff, so landing needs an APPROVED review from a GOVERNED_APPROVERS account (os-zhuang or hotlong) on top of this PASS. The lane seat re-pins its ACCEPT record and the 速读 to this head, keeps needs-user-decision, and requests the two reviewers; the maintainer's click is the approval. This seat approves nothing.

Implemented-by: claude/project-thread-g4z84u
Reviewed-by: session_01QsR2jV5sBSzCYNEDgpYLJw

VERDICT: PASS

---

Generated by Claude Code