test(app-shell): a walled catalog-package install, upgrade or uninstall refusal reaches the operator with its posture-naming reason (objectui#7611 item 2)

[objectstack-fleet]

Part of #7611
Clause-②: no

This PR covers item 2 of the card's release record (comment 6158162134) and nothing else: package install, upgrade and uninstall under a wall, in the console. The card stays open for items 1, 3 and 4. The seat's claim is comment 6158502886.

Result

The console already shows the walled refusal's reason on every path that can receive it. The release record called this "not measured", so I measured it first. Each install, upgrade and uninstall gesture shows the door's posture-naming sentence verbatim. The PR is pins only. No source file changes, and the changeset has empty frontmatter.

The refusal's wire shape, read at objectstack 4806b18aea

objectstack W2 (objectstack-ai/objectstack#22935, merge 4806b18aea, carried by @objectstack/* 18.0.0-next.0) refuses two things below the platform-operator rung under group / isolated: an install or upgrade of a package that carries security catalog items, and the uninstall of such a package.

install-local (@objectstack/cloud-connection, refuseWalledCatalogPackage) refuses on two requests:

• POST /api/v1/marketplace/install-local, for an install and also an upgrade, with VERB Installing;
• DELETE /api/v1/marketplace/install-local/MANIFEST_ID, for an uninstall, with VERB Uninstalling.

403
{ "success": false,
  "error": { "code": "FORBIDDEN",
             "message": "VERB \"MANIFEST_ID\" is refused: the package carries security catalog items. VERDICT",
             "details": { "manifestId": "MANIFEST_ID", "catalogItems": [ { "type": "TYPE", "name": "NAME" } ] } } }

DELETE /api/v1/packages/:id (@objectstack/runtime, refuseWalledCatalogPackageDelete) answers through the dispatcher's deps.error(message, 403), so buildApiError derives the code from the status (standardErrorCodeForHttpStatus):

403
{ "success": false,
  "error": { "code": "PERMISSION_DENIED",
             "message": "Deleting package \"PACKAGE_ID\" is refused: the package carries security catalog items. VERDICT",
             "httpStatus": 403 } }

VERDICT is the sentence from walledCatalogWriteVerdict (@objectstack/metadata-core). It is written for the first catalog type the package declares, checked in this order: position, permission set, capability. For example:

Creating, changing or deleting a permission set requires the platform operator: this deployment runs the 'group' tenancy posture, where the security catalog is shared by every organization (ADR-0131 D3). Holding the manage_metadata capability inside an organization does not admit it. An organization's administrators assign the catalog's positions and permission sets to their own members instead.

No posture field. Neither envelope carries one. The posture appears only in the message. An upgrade goes to the same door as an install: the door checks both the incoming and the installed manifest, and answers with the Installing sentence.

The console's paths, measured

Each case renders the real component. A stubbed fetch answers a real Response carrying the exact envelope above, with status text Forbidden. Each case runs under both group and isolated. marketplaceApi is not mocked.

Gesture	Console path	Request	What the operator reads
install	package page, Install (installLocal)	POST install-local	the door's sentence, verbatim
upgrade	package page, Reinstall over an installed older version (3.2.0, latest 4.0.1)	POST install-local: no version is named, so the door installs latest over the installed one	the door's sentence, verbatim
uninstall	package page, local menu, Uninstall from runtime (uninstallLocal)	DELETE install-local/MANIFEST_ID	the door's sentence, verbatim
uninstall	Installed Apps, the row's Uninstall (uninstallLocal)	same	the door's sentence, verbatim; the row stays
install	catalog page, Your organization, Install (installLocal with versionId: 'latest')	POST install-local	the door's sentence, verbatim
delete	Packages page, package sheet, Delete app (apiJson)	DELETE /api/v1/packages/:id	the door's sentence plus (PERMISSION_DENIED)
install	Packages page, Import (apiJson, manifest inline)	POST install-local	the door's sentence plus (FORBIDDEN)

None of the five marketplace cases shows Forbidden, HTTP_403 or a bare FORBIDDEN. Neither Packages page case shows Forbidden or this page's own fallback, Request failed (403). The marketplace pins assert that each gesture's success sentence is absent, and that each request left the browser with the expected method, path and body.

The DELETE /api/v1/packages/:id path (Zone 2, item 3). The console calls it from one place: PackageDetailSheet's Delete app on the Packages page (views/metadata-admin). That page also has a second door into install-local: Import, which posts the file's manifest inline. Both sit outside the claimed console/marketplace/ surface. Both are measured here in one new test file beside the page, and no source there changes.

Wording (Zone 2, item 4): verbatim, the existing convention. Three reasons:

• It is the convention. doInstallLocal already shows the install-mode refusals as sent ("each message names its own remedy, and the page has nothing to add to it"). Both uninstall callers show e.message. The Packages page shows the envelope through readEnvelopeFailureText.
• It reads well for a tenant admin. The sentence names the action and the package, the reason (security catalog items), the posture, who may do it (the platform operator), that the admin's own manage_metadata does not admit it, and what they can do instead.
• Localizing would need a server contract the console does not have. The install-local refusal shares its code, 403 FORBIDDEN, with the same door's missing-capability refusal, which ends requires the `manage_metadata` capability.. The DELETE /api/v1/packages/:id refusal carries only the status-derived PERMISSION_DENIED. So the console could tell a walled refusal apart only by parsing the server's prose. That is a second reading of the refusal, and the server's own sentence already does the job.

Tests

All runs are at head ef8ab4ae4.

• pnpm exec vitest run --maxWorkers=2 packages/app-shell/src/console/marketplace/ packages/app-shell/src/views/metadata-admin/PackagesPage.walledCatalogRefusal-7611.test.tsx → Test Files 34 passed (34), Tests 229 passed (229). That is the 32 existing marketplace suites, plus the new marketplace pin (11 tests) and the new Packages page pin (4 tests).
• pnpm --filter @object-ui/app-shell type-check echoes tsc --noEmit && tsc -p tsconfig.test.json and exits 0. tsc -p tsconfig.test.json --listFiles lists both new test files.
• Build of the dependency closure, turbo run build --filter=@object-ui/app-shell^...: exit 0. All 29 packages were cache hits.
• eslint, as a proven narrowing. First, the population comes from eslint's own config: --print-config on a new file resolves 119 rules, so the file is linted, and the changeset .md matches no files glob. Second, --format json reports 2 files, 0 errors and 0 warnings, both from the repo root with --no-inline-config and from packages/app-shell, the way its lint script runs. Third, untouched files are unaffected: the resolved config has parserOptions.project and projectService unset, so linting is not type-aware, and no rule under eslint-rules/ reads the filesystem. The diff adds two files and edits none, so it cannot change any other file's lint result.
• Repo checks, all exit 0: node scripts/check-changeset-presence.mjs (the changeset has empty frontmatter, which this gate accepts as a complete answer), pnpm check:changeset-claims, pnpm check:pending-changeset-literals, pnpm check:new-line-citations (0 new citations), pnpm check:control-bytes, pnpm check:test-path-roots, pnpm check:vi-mock-specifiers. Also derived from the workflows and run: check-changeset-fixed, check-changeset-no-major, check-changeset-overwrite, check-vi-mock-inherit, check-vi-mock-override-shape, check-lint-coverage, check-type-check-coverage, and pnpm check: unreferenced-sources / esm-specifiers / metadata-write-doors / handler-key-reads / self-import / i18n-keys / phantom-deps.
• NOT MEASURED: pnpm check:sdui-registration-pins. It exits 2 because there is no console build to read. It reads bundle-time registrations, and this diff ships no code.

Ablation (one leg, on the committed tree): run with objectstack's scripts/ablation-replace.mjs in wrap mode. It replaced readApiError's payload?.error?.message // the declared envelope with undefined. The anchor count went from 1 to 0, and the blob from 4fd74da91c1c to 922b64be38e3. The marketplace pin then ran at Tests 10 failed | 1 passed (11), which is the direction predicted beforehand. Each failure was Unable to find an element with the text: Installing "com.example.crm" is refused: …, with the page showing the bare FORBIDDEN: the exact shape of a dropped reason. The one pass is the harness CONTROL, which shows a bare form either way. The restore was proven: the blob after restore equals HEAD (4fd74da91c1c), git diff HEAD is empty, and the marker count is 0.

Acceptance notes

These are observations only. None is filed, and none has a carrier.

• uninstallLocal throws an Error with neither code nor status, while installLocal carries both. Both of its callers show only e.message, so nothing user-visible depends on it today.
• The install-local 403 lists the declared items in details.catalogItems. The console does not show them. The sentence already says the package carries security catalog items, so listing the items would be a feature request, not part of this item.
• CI: Spec Main Shape Gate is red on main and on every PR (advisory, owned by objectui#12325). OAuthConsentPage.public-client-12301 is a known timing flake (objectui#12344).

Files: packages/app-shell/src/console/marketplace/__tests__/walledCatalogPackageRefusal-7611.test.tsx, packages/app-shell/src/views/metadata-admin/PackagesPage.walledCatalogRefusal-7611.test.tsx, .changeset/7611-walled-package-refusal.md.

Implemented by the os-dev agent dispatched by the domain:ui#1 seat, session https://claude.ai/code/session_01CsyMRsFJBKNEMa4oPY1b5z.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 72 chunks)	3135.2 KB	3204.6 KB
Main entry chunk (gzip)	73.8 KB	350 KB
Entry file	index-DiEEQlHV.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	20.69KB	7.62KB
app-shell (runtime-config.js)	22.59KB	7.89KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.11KB	3.87KB
auth (ActiveOrganizationStorage.js)	27.95KB	10.04KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.22KB	10.61KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.40KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.72KB	2.24KB
auth (SocialSignInButtons.js)	9.70KB	3.93KB
auth (UserMenu.js)	3.39KB	1.21KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	41.19KB	11.12KB
auth (createAuthenticatedFetch.js)	8.54KB	3.46KB
auth (index.js)	3.63KB	1.64KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	27.26KB	8.03KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.28KB	2.60KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (commentAuthorship.js)	1.39KB	0.78KB
collaboration (index.js)	1.93KB	0.85KB
collaboration (useCollaborationTranslation.js)	6.50KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	590.37KB	142.27KB
core (index.js)	10.18KB	4.04KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	248.06KB	69.39KB
fields (index.js)	279.77KB	71.34KB
i18n (LocalizationContext.js)	2.92KB	1.42KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	2.59KB	1.22KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.52KB	2.39KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	39.35KB	12.88KB
i18n (translateFn.js)	0.20KB	0.18KB
i18n (useDisplayLocale.js)	3.52KB	1.76KB
i18n (useObjectLabel.js)	36.87KB	9.88KB
i18n (useSafeTranslation.js)	7.14KB	2.92KB
layout (index.js)	40.26KB	11.71KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	6.62KB	2.45KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	5.52KB	2.10KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	15.35KB	5.51KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.82KB	2.38KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.33KB	3.07KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	16.04KB	3.92KB
plugin-calendar (index.js)	55.05KB	16.09KB
plugin-charts (index.js)	84.72KB	23.27KB
plugin-chatbot (index.js)	201.72KB	48.07KB
plugin-dashboard (index.js)	143.63KB	38.79KB
plugin-designer (index.js)	233.77KB	50.02KB
plugin-detail (index.js)	258.58KB	68.21KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	178.42KB	46.26KB
plugin-gantt (index.js)	178.63KB	45.19KB
plugin-grid (index.js)	258.84KB	72.10KB
plugin-kanban (index.js)	53.23KB	16.71KB
plugin-list (index.js)	123.39KB	31.55KB
plugin-map (index.js)	27.24KB	9.03KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	46.66KB	13.13KB
plugin-timeline (index.js)	39.21KB	11.85KB
plugin-tree (index.js)	15.07KB	5.33KB
plugin-view (index.js)	92.11KB	23.27KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	12.07KB	3.68KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	120.63KB	39.56KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.50KB	2.06KB
react (schema-input.js)	4.31KB	2.07KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (body-dialect.js)	4.50KB	1.99KB
sdui-parser (codegen.js)	9.45KB	3.76KB
sdui-parser (dashboard-widget-options.js)	3.07KB	1.30KB
sdui-parser (index.js)	7.30KB	3.12KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	25.28KB	7.81KB
sdui-parser (provenance.js)	3.84KB	1.90KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	23.87KB	7.83KB
types (ai.js)	4.39KB	2.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	4.12KB	1.61KB
types (authoring-nodes.js)	0.20KB	0.19KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (cloud.js)	0.20KB	0.18KB
types (complex.js)	4.44KB	2.07KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (dashboard-widget-layout.js)	2.06KB	0.96KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	1.13KB	0.65KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	5.78KB	2.70KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	5.00KB	2.39KB
types (navigation.js)	0.20KB	0.18KB
types (node-slots.js)	7.18KB	2.34KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	2.52KB	1.31KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	4.99KB	1.96KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	19.93KB	7.26KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.48KB	3.50KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[objectstack-fleet]

Seat ACCEPT: objectui PR #12346 at ef8ab4a · domain:ui seat 1 · session_01CsyMRsFJBKNEMa4oPY1b5z · 2026-10-14T01:32Z

Verdict: ACCEPT. Reviewed on GitHub against the claim 6158502886 (item 2 of release record 6158162134 only) and the dev's report on the card.

• Clause-②: no holds. The diff adds two test files and an empty-frontmatter changeset, and no source byte moves. None of the three contract faces is touched, so no contract review is owed, and the PR lands in this same act.

• PR form.

  • Draft, base main, assignee zhuangjianguo.
  • Line 1 is Part of #7611, and line 2 is Clause-②: no.
  • No closing verb sits beside any number in the body or in the branch's commit messages, so the card stays open.

• Item 2, measured first, as the release record asked.

  • Both refusals were read from objectstack 4806b18aea under group and isolated:
    • install-local: 403 FORBIDDEN, the posture-naming sentence in error.message, and details.catalogItems;
    • DELETE /api/v1/packages/:id: 403 PERMISSION_DENIED.
  • Neither carries a posture field. The posture lives only in the sentence.
  • Fed to a real render, every console gesture shows the door's own sentence and never a bare status:
    • the package page's Install, Reinstall (the upgrade on an install-local runtime) and local Uninstall;
    • Installed Apps' Uninstall;
    • the catalog page's organization install;
    • the Packages page's Delete app (the one DELETE /api/v1/packages/:id caller) and Import.
  • So the PR is pins only, as the dispatch's Zone 3 allowed.

• Wording stays verbatim, the existing convention, and the seat agrees. The code alone cannot tell a walled refusal from the same door's missing-capability refusal (both 403), so localizing would mean parsing prose.

• Changeset, checked sentence by sentence. The frontmatter is empty, which is the right shape for a tests-only change in objectui (it has no skip-changeset label). Its prose names the seven gestures and says no executable code changed. Both are true of the diff.

• Tests.

  • The ablation replaced readApiError's declared-envelope read with undefined and predicted the direction. The result was Tests 10 failed | 1 passed (11), with the DOM showing a bare FORBIDDEN; the one pass is the harness control. The restore is blob-proven.
  • Under the lock at ef8ab4ae4: 34 files and 229 tests passed. @object-ui/app-shell type-check exits 0 and lists both new files. ESLint reports 0 / 0 as a proven narrowing.

• Declared deviations, accepted:

  • One new test file sits outside the claimed console/marketplace/ surface: views/metadata-admin/PackagesPage.walledCatalogRefusal-7611.test.tsx. The dispatch's Zone 2 item 3 directed measuring the console's DELETE /packages caller, and no source moved there.
  • The worktree was created from main 2722d33c54.

• Out of scope, agreed not filed: both are recorded in the PR's Acceptance notes, with no user-visible pull.

  • uninstallLocal's error carries no code or status.
  • The 403's details.catalogItems is not shown.

• CI on this head: 33 check-runs, every one completed: 29 success, 3 expected skips, and 1 red by design. Lint, Type Check, Repo Gates and Test are success, read off check-runs whose head_sha is ef8ab4ae4fb92c9698face61e7351639b01c835c.

  • Red by design: Spec Main Shape Gate. All three conditions hold:
    1. It is advisory and not in the required set.
    2. It runs no merge_group.
    3. The cause is objectstack PR #23160, and its consumer card is objectui#12325.
  • Its annotations on this head (run 115628658671) are identical to main's run on 72594f29ec (115425173959).

• check-governed-merges --pr: NOT governed, +479 / -0.

• Landing: pr_ready, then automerge_enable (the merge queue), in this act. After the merge, pm:dispatched comes off feat: Setup catalog pages read the registry (editable under single, read-only under a wall); assignment pages stay data pages; pickers list the registry (objectstack ADR-0131 D3/D7) #7611 by hand, because a Part of link does not close the card. The card then holds:

  • item 1 on the next next release carrying objectstack#23222 (66949b7729);
  • item 3 on objectstack#15196;
  • item 4, objectui#7205, to be read before the card closes.

Implemented-by: claude/issue-7611-walled-package-refusal (mode:subagent dev of this seat)
Reviewed-by: session_01CsyMRsFJBKNEMa4oPY1b5z

---

Generated by Claude Code