[objectstack-fleet]

Requested by Warren · project thread
Fixes #27404

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:Setup 权限集展开对象后的字段行,不再列出平台记账列(__search、organization_id、owning_business_unit_id),判据沿用 Studio 数据栏的 isStudioHiddenSystemField(system 且 hidden)。
• 为什么改:原来字段行列出合并定义里的全部字段并按名排序,“Search Index (__search)” 排在第一,管理员看到的是平台内部列而不是对象自己的字段。
• 风险与回滚:只改显示与批量按钮的作用范围,保存写法不变;已存有条目的记账列照旧显示;回滚即还原 PermissionMatrixEditor.tsx 一个文件。
• 先看:PermissionMatrixEditor.tsx 里 FieldsSubTable 的 offered 过滤;同文件 ensureFields 带上 system/hidden;PermissionMatrixEditor.systemFields-27404.test.tsx。
• 两分钟验证:pnpm --dir ui exec vitest run packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.systemFields-27404.test.tsx,预期 5 passed。
• 需要你做的:无,席位落地。

What changes

• FieldSummary keeps the served definition's system and hidden marks; ensureFields reads them as booleans (=== true, the spec declares both z.boolean()).
• FieldsSubTable draws the offered rows: every field except one isStudioHiddenSystemField holds for, imported from views/studio-design/studioHiddenSystemField.ts (untouched). No second predicate, no name list.
• A bookkeeping column the set already carries an entry for still draws as written: an entry in the draft, or in the last loaded/saved set (baselineFieldKeys, set where the dirty baseline is re-anchored). So a Clear on such a row keeps the row on screen until that save lands.
• The count, the filter threshold, the empty state and the three bulk shortcuts read the offered rows, so Read-only all / Write all / Clear never write an entry for a column the admin cannot see.
• The row-condition editor's fieldNames stays the full field list, so a when naming a left-out column is not linted as unknown. loadObjectFields (the RLS CEL editor) is untouched: it feeds lint and autocomplete only and offers no picker.

Why

The ruling on the card: the platform's bookkeeping columns are the fields where system AND hidden hold together (isStudioHiddenSystemField, objectui#11780); they are dropped from offered field lists, and a value already stored against one still draws as written (objectui#13152 CONTROL). This editor was the one field list that did not apply it.

Tests

New PermissionMatrixEditor.systemFields-27404.test.tsx (package door, served definition with __search and organization_id marked system + hidden, owner_id system only, internal_notes hidden only):

• __search and organization_id are not offered; the count reads 4 / 4.
• CONTROL: the author-hidden field and the system owner_id still draw, rows in name order.
• CONTROL: a stored __search entry draws as written (Read off, a rule, not inherited).
• CONTROL: Clear on that stored row keeps it until the autosave lands; the saved body has no __search entry, after which the column is no longer offered.
• Read-only all writes entries for the four offered fields only.

Ablation (fix committed first, scripts/ablation-replace.mjs on the predicate term of the offered filter, replaced by true ||): anchor 1 → 0, all 5 tests red, restore verified blob == HEAD and git diff HEAD empty. The three CONTROL cases go red too, because each pins the exact row list, which the ablation widens.

Acceptance notes

• Once a save drops the last stored entry for a bookkeeping column, the row leaves the list (on the package door, at autosave). That is the ruling read literally: nothing is stored any more, so nothing is drawn as written.
• The predicate is imported from studio-design/, as FlowReferenceField in this same metadata-admin/ tree already does.
• os-dev exception: the PR template's headings are folded into the os-dev section order.

Verification

Local gates on the final head

Head 59c93806 (origin/main c5d4634 merged in), derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack; --ran reconciliation: 34 derived, 34 run, 0 NOT-MEASURED, 0 UNRUN.

node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0
node scripts/check-adr-0087-registration.mjs --self-test :: exit 0
node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-empty-changeset.mjs --base origin/main :: exit 0
node scripts/check-empty-changeset.mjs --self-test :: exit 0
node scripts/check-sdui-manifest.mjs :: exit 0
node scripts/check-sdui-manifest.mjs --self-test :: exit 0
node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0
node scripts/release-pending-publish.mjs --self-test :: exit 0
pnpm --dir ui exec vitest run scripts/ :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm check:changeset-gate-self-tests :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:pm-changeset-deadline-census :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:skill-identifier-liveness :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:undeclared-dep-imports :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0
pnpm --filter @object-ui/app-shell run type-check :: exit 0
pnpm --dir ui exec eslint (both touched files) :: exit 0 (0 errors)
pnpm --dir ui run check:new-line-citations :: exit 0 (0 new citations)
pnpm --dir ui exec vitest run (52 files naming PermissionMatrixEdit) :: exit 0 (Test Files 52 passed, Tests 362 passed)

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (no spec change)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (eslint on both touched files: 0 errors)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (the 维护者速读 block is the os-dev Chinese summary)
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#2 · os-warren · session_01JQwxbXpF772qWJjojJvRXw

席位核对

ACCEPT · domain:ui#2 · session_01JQwxbXpF772qWJjojJvRXw · head 59c93806b0 · 2026-10-29T07:01Z

席位意见：Setup 权限集展开对象后的字段行不再列出平台记账列（system 且 hidden，isStudioHiddenSystemField），已存有条目的记账列照旧按存值显示；批量按钮只作用于显示的行；保存写法与行条件编辑器的字段名表不变。

1. Diff read: 3 files, +219 / −6.
   • ensureFields keeps system and hidden as strict booleans.
   • FieldsSubTable's offered filter imports the Data rail's own predicate, so there is no second predicate and no name list.
   • A field with an entry in the draft, or in the last loaded or saved set (baselineFieldKeys, re-anchored in resetDraftBaseline), still draws. So Clear on a stored bookkeeping row keeps the row until the save lands.
   • The count, the filter threshold, the empty state and the bulk shortcuts read offered. The CEL fieldNames stay the full list, and loadObjectFields is untouched.
2. Checked against the order (Setup › Permission set: the field-level rows list platform bookkeeping columns, so "Search Index (__search)" sorts first #27404, row 9 of Setup and Studio: suggestions from a full HotCRM browser pass on 18.2.0: user onboarding, packaged automation state, run-now for scheduled flows, admin lists, and Studio entry, field table, flow inspector wording and one designer per item #27356): the change applies the ruling (objectui#11780 predicate, objectui#13152 stored-value CONTROL) to the one field list that lacked it. The edit is confined to PermissionMatrixEditor.tsx, and no save path moves.
3. Tests and proof: 5 new tests, with CONTROLs for the author-hidden field, the system-only owner_id, a stored __search entry and Clear-until-save. The predicate ablation turns all 5 red, and the restore leaves the blob equal to HEAD. 52 editor files pass 362/362, type-check exits 0, and 34/34 derived gates exit 0 on the merged head.
4. Accepted deviations: no PR assignees, because os-dev.md since pm-dispatch(review): a PR reaches a human only after the seat's ACCEPT and a same-head contract PASS: no seat assignee at the draft open, the approver request is the seat's hand-off, a PR landed owing a review is re-reviewed with findings filed as cards #27385 (c5d4634) bans them and that wins over the order. The changeset adds @object-ui/console patch beside app-shell (the app-shell precedent). The template headings are folded.
5. Shape: Fixes #27404, Clause-②: no, Metadata-protocol: none. Not governed: no skills/**, spec or CI path is touched, and there is no contract-review face, so it lands on CI plus this read.
6. Landing clause: all check-runs on 59c93806 concluded (44 success, 11 skipped, 0 failed). The seat readies and arms now and tracks the PR to MERGED.