[Epic] v17 bug focus — Seat B: console bugs (objectui + repo:objectui)

[hotlong]

Theme charter for the post-v17 priority regime — sibling of #8667 (Seat A: platform bugs). Filed by the (former) skills PM seat, session session_018WuTtyckQa1VcXwgd52JpN, on maintainer instruction. Authority rulings are quoted verbatim on #8667 and apply to both seats identically (scope = objectstack + objectui only; marker = target:v17; epics ordered by 「把两张主题卡（epic）开出来」).

Scope

The console/UI surface, spanning two trackers:

1. objectui repo — all open bug-labeled cards (9 at filing): metadata-admin declares an object "provided by an installed package, so it is read-only" even in a writable package — Studio treats the same object as editable and the server accepts the PUT objectui#4308, feat(plugin-hono-server)!: 删除 CRUD/discovery 便利面 —— 插件回归纯传输适配器（#4073 终点） #4296, 补上 defineHook():hook 的作者侧工厂(defineDatasource 范式),并修正 object.zod.ts 两处引用不存在函数的错误处方 #4269, fix(rest): GET /data/:object/export honours a search term #4230, docs(adr): ADR-0105 status flip — Phase 2 D8/D9 implemented; D8's role channel closed by ADR-0108 #4028, fix(driver-sql): Field.time 规范化存储 — HH:MM:SS[.fff] 墙钟文本，三方言统一 (#3994) #4020, docs(adr): ADR-0102 D3 (precompile WASM) — DEFERRED after API verification (#3297) #3318, plus the two already marked dispatched (fix(runtime,rest): advertise mcp only when it is actually serveable #4032, fix(i18n): clear the accumulated drift in the generated translation bundles #3670 — see orphan re-verification below).
2. objectstack repo — open bugs/P0s labeled repo:objectui: 详情页**页头动作**的 visible CEL:当前用户与 lookup 字段比不出来,且求值抛错静默 fail-open —— RecordDetailView 的求值面没被 #5149 的响亮化覆盖(17.0.0-rc.6) #8500, userActions.edit.visibleWhen 对详情页页头内建【编辑】不生效 —— 同一份声明里 delete 生效、edit 不生效(17.0.0-rc.6) #8499, console: accept-invitation page names neither the organization nor the role — the routed implementation is the thin duplicate, while the detailed one ships unrouted #8282, [finding] single-org users have no UI path to the workspace manage pages — the ?manage=1 avatar-menu entry the code describes does not exist #8096, [finding] workspace owner lacks manage_metadata in the EE multi-org deploy, but 构建应用 is a primary home CTA — dead-ends at submit #8270, recordIdField is not harvested into the grid's $select — sys_session "Revoke Session" reports success and revokes nothing #8018.

Workability rule is the same default flip as #8667: only target:v17 cards are workable; the PM nominates second-batch candidates on this epic and the maintainer approves before they enter the queue.

First batch (pending the maintainer's P0 rulings)

• 详情页**页头动作**的 visible CEL:当前用户与 lookup 字段比不出来,且求值抛错静默 fail-open —— RecordDetailView 的求值面没被 #5149 的响亮化覆盖(17.0.0-rc.6) #8500 — record-detail header action visible CEL fails against lookup fields and fail-opens silently (P0)
• console: accept-invitation page names neither the organization nor the role — the routed implementation is the thin duplicate, while the detailed one ships unrouted #8282 — accept-invitation page names neither organization nor role (P0)
• [finding] single-org users have no UI path to the workspace manage pages — the ?manage=1 avatar-menu entry the code describes does not exist #8096 — single-org users have no UI path to workspace manage pages (P0)
• [finding] workspace owner lacks manage_metadata in the EE multi-org deploy, but 构建应用 is a primary home CTA — dead-ends at submit #8270 — EE workspace owner lacks manage_metadata; the home-page primary CTA dead-ends (P0)
• REGRESSION: the console header bell panel is dead again — "No notifications" under both Unread and All while /api/v1/notifications returns 10 rows (#4110 / #4156 back on console 09987b68) objectui#4230 — REGRESSION: console header bell panel dead again while the API returns rows

Before dispatching anything — two mandatory pre-work items

1. Re-verify the 8 orphaned pm:dispatched cards in objectui (the repo:objectui lane seat, [PM seat] repo:objectui — 🟢 yinlianghui #6025, has been silent since 2026-08-10; its dispatches are unaccounted for): chore: raise the @objectstack/spec pin from ^17.0.0-rc.6 to 17.0.0 GA (lockfile resolution + green-keeping adaptations) objectui#4636, Import dry run green-lights a row the write then rejects: structured value shapes (address / location) are not pre-checked #4633, fix(runtime,rest): advertise mcp only when it is actually serveable #4032, fix(i18n): clear the accumulated drift in the generated translation bundles #3670, feat(plugin-hono-server): registerStandardEndpoints 默认翻 false —— 便利面改为显式 opt-in（#4073 第一步） #4280, feat(core,runtime): plugin ordering is a declared, kernel-enforced contract (ADR-0116, #4131) #4163, fix(spec,service-analytics): the matrix's token axis + its sixth consumer, and the dropped $between it found (ADR-0053 D-A3.1) #4109, docs(adr): propose ADR-0114 — layered master data: group template rows and organization overrides (ADR-0105 D10) #4036. loadMetaFromDb object branch reads record.packageId from a snake_case row — always undefined, every object overlay registers under the 'sys_metadata' sentinel at boot #4636 first — it raises the @objectstack/spec pin from ^17.0.0-rc.6 to 17.0.0 GA. Until it lands, every console-side bug verification runs against rc.6, so it gates the whole theme.
2. Grade the bare-card backlog the triage seat flagged three consecutive rounds (memo on [PM seat] repo:objectui — 🟢 yinlianghui #6025, 2026-08-13T05:54Z): 7 ungraded cards in objectui including feat(spec,lint)!: give bulkActionDefs a shape, and lint the aggregate name it references #4508 (needs-user-decision — chart null-category identity collisions, pending a maintainer sentence), datasource 是注册的 metadata type，却不在 liveness 账本的 GOVERNED 里 —— 两个 PR 手工挖出 6 个死键，正是因为没有闸门看着它 #4487, 读副本路由（read/write splitting）：真要做的话，从查询路径开始，而不是从 datasource 上加个字段（#4468 移除 readReplicas 后的正式立项位） #4479. Grade for one question only: is it a v17 bug? If yes, nominate for target:v17; if no, freeze.

Operating rules

Identical to #8667: WIP ≤3; pull order priority:p0 > pm:blocking > security > age; bug-fix PRs ride the normal merge queue with auto-merge allowed (objectui repo conventions and worktree-first per its own AGENTS.md/CLAUDE.md); claim discipline, os-dev dispatch protocol, model tiering, union-after-final-commit with quoted HEAD all unchanged. Round reports on this epic; the lane seat post #6025 stays ⏳ vacant and points here; the PM session registers with a claim comment and de-registers on stand-down.

Done means

Every in-scope target:v17 bug is closed (fixed, or ruled defer/void with the ruling recorded); the four console P0s carry an explicit maintainer disposition; the 8 orphaned dispatches are each closed out or cleanly re-dispatched; the 7-card grading backlog is zero.

[hotlong]

Claim: theme PM registration — Seat B (console bugs)

• Session: session_018x7oGZF6qqdUD1Km4e9n5a, model claude-opus-5
• Scope: this epic's charter — objectui repo bug cards + objectstack repo:objectui cards, workable only when carrying target:v17
• Basis: the maintainer's 2026-08-14 rulings quoted verbatim on [Epic] v17 bug focus — Seat A: platform bugs (objectstack) #8667, and the pointer left on the lane seat post [PM seat] repo:objectui — 🟢 yinlianghui #6025 (2026-08-14T10:58Z) directing whoever takes this theme to register here. Lane seat [PM seat] repo:objectui — 🟢 yinlianghui #6025 stays ⏳ vacant and is not being re-seated by this session.
• Starting posture: the two mandatory pre-work items before any dispatch — (1) re-verify the 8 orphaned pm:dispatched cards, loadMetaFromDb object branch reads record.packageId from a snake_case row — always undefined, every object overlay registers under the 'sys_metadata' sentinel at boot #4636 first since the spec-pin GA bump gates every console-side verification; (2) grade the bare-card backlog for the single question "is it a v17 bug?".
• Operating rules per charter: WIP ≤3, pull order priority:p0 > pm:blocking > security > age, claim-before-code with session + branch, per-task worktrees, model tiering.

De-registration will be posted here on stand-down.

---

Generated by Claude Code

[hotlong]

Pre-work item 1 — orphan re-verification: COMPLETE, and the charter's premise does not survive it

PM session session_018x7oGZF6qqdUD1Km4e9n5a. All 8 cards verified against GitHub (claim timestamps, remote branches via git ls-remote, PR merge states via the API). Headline: there are zero orphaned dev agents to reclaim. Re-dispatching this list as written would have put a second agent into two live worktrees.

The list is three different things wearing one label:

A. Two are LIVE work, not orphans — do not touch

card	evidence	age at charter filing
objectui#4636	claim comment 2026-08-14T10:09:10Z, session session_01RnQd8iMMUwXQEV1crFmQiQ; branch claude/issue-4636-spec-pin-ga not yet pushed	49 min before the epic was filed
objectui#4633	branch claude/issue-4633-catalog-regenerate live on remote; draft PR objectui#4637 opened 10:57:39Z	1 min before the epic was filed

Also live and not on the charter's list: draft PR objectui#4638 (claude/issue-8096-manage-entry, opened 10:59:31Z, updated 11:00:56Z) against console P0 #8096, and #8500 carries pm:dispatched from the same seat.

The lane seat #6025 was seated at 09:56Z and was dispatching continuously until ~11:00Z; the registry correction vacating it landed at 10:58:57Z. The charter swept pm:dispatched without reading claim timestamps, so it collected that seat's in-flight batch as orphans. Per the dispatch protocol 45 minutes is the probe threshold, never the death threshold, and #4636's claim is inside it — the only legitimate action on these is a liveness probe, not reclaim.

B. Five are ACCEPTed work with Part of remainders — bookkeeping debt, not dispatches

Each had its PR reviewed, accepted and merged; the card stayed open because the PR was Part of, and the protocol's paired write (drop pm:dispatched at MERGED, re-grade by what remains) was never made.

card	delivered	merged	what actually remains
#4032	PR #4358	✅	item 4 only — and it is now unblocked: objectstack#7862 closed, PR #8056 merged 2026-08-12 added the subCaption key the ruling required. Reaching it needs the GA spec pin, i.e. #4636.
#4280	PR #4318	✅	ConsoleLayout sidebar rider — explicitly reserved to the maintainer
#4163	PR #4208	✅ 2026-08-11T05:13Z	Part 2 (Studio authoring for inline locale maps) — triage already ruled this needs-user-decision on 2026-08-10
#4109	PR #4279	✅ 2026-08-11T11:01Z	nothing — Q1 was ruled A and accepted as delivered; the resolver-export half was split to #4280
#4036	PR #4341 (B half)	✅ 2026-08-11T17:57Z	A half — per-type product judgment on the 15 overlay-allowed types, routed to the spec/engine lane

C. One is a genuine stale dispatch — and it is decision-blocked, not dev-blocked

objectui#3670 — pm:dispatched since 2026-08-08, no branch, no PR, untouched for 6 days. But it does not want a dev: the card asks which object the Permissions count should target (sys_capability vs sys_permission_set — the same ambiguity #3655 left open) and, above that, whether SystemHubPage — which carries its own @deprecated marker — should be repaired at all rather than retired. Dispatching it as a rename would be answering a product question by writing code.

Actions taken now

Labels corrected to match reality (each card gets its own evidence comment):

• fix(runtime,rest): advertise mcp only when it is actually serveable #4032 → pm:blocked, Blocked-by: objectstack-ai/objectui#4636
• feat(core,runtime): plugin ordering is a declared, kernel-enforced contract (ADR-0116, #4131) #4163, feat(plugin-hono-server): registerStandardEndpoints 默认翻 false —— 便利面改为显式 opt-in（#4073 第一步） #4280, docs(adr): propose ADR-0114 — layered master data: group template rows and organization overrides (ADR-0105 D10) #4036 → needs-user-decision restored (each was already in that state before dispatch overwrote it — no new inbox items)
• fix(spec,service-analytics): the matrix's token axis + its sixth consumer, and the dropped $between it found (ADR-0053 D-A3.1) #4109 → closed as completed
• fix(i18n): clear the accumulated drift in the generated translation bundles #3670 → needs-user-decision (the one genuinely new escalation; card face in its own comment)
• loadMetaFromDb object branch reads record.packageId from a snake_case row — always undefined, every object overlay registers under the 'sys_metadata' sentinel at boot #4636, Import dry run green-lights a row the write then rejects: structured value shapes (address / location) are not pre-checked #4633 → left exactly as they are

Consequence for this round: no new dispatch

Inherited in-flight work is #4636, #4633, #8096, #8500 — already at or past the charter's WIP ≤3 cap, and none of it dispatched by this session. Opening new dev work on top would breach the cap and risk colliding with worktrees I did not create. This round therefore delivers pre-work only. The one decision that unblocks the most is #4636: the GA pin gates every console-side verification and #4032's last item.

---

Generated by Claude Code

[hotlong]

Pre-work item 2 — grading: COMPLETE. The named backlog had largely been worked already.

PM session session_018x7oGZF6qqdUD1Km4e9n5a. The charter inherited "7 ungraded cards" from the triage seat's 2026-08-13T05:54Z memo on #6025. Re-checked each against current state — five had moved since that memo was written:

card	state now	action
#4479	closed (delivered via PR #4562; follow-up #4564 also closed 2026-08-13)	none — carries a stale pm:dispatched, harmless on a closed card
#4527	closed	none
#4533	closed	none
#4520	closed	none
#4508	already graded → needs-user-decision (chart null-category identity collisions)	none — it is in your inbox, awaiting one sentence
#4487	already graded → pm:queue	none
#4526	finding, genuinely ungraded	graded → frozen

Plus one bare card filed after that memo: #4631 (three disagreeing declared surfaces per component type) — graded → frozen.

Both freezes are "not a v17 bug" under the charter's binary test, each with a named restart condition and triggering-file list on the card:

• chore: merge main into percent-scale-3136, regenerating the api-surface baseline (#4442) #4526 — the disclosed, fail-safe residue of PR spec 是否该建模 DecisionOutputDef.required？服务端今天就在强制它，而 spec 未声明 #4525: on a single kernel the console renders read-only where the server would accept. An honest lock, not a Save that 403s. Cannot be fixed without reopening the [verify] bootStack({ databaseFile }) 的数据活不过进程内重启 —— 表在、行没了，挡住冷启动类 e2e #4518 ruling that forbade the /discovery probe.
• feat(core): init 阶段取服务的声明契约改为强制 — check:init-service-contract 门禁 (#4471) #4631 — a contract-coherence design question, which this regime is deliberately not clearing. Noted on the card: the tooltip specimen inside it is a live authoring defect (TooltipSchema declares children, the renderer reads trigger; following the published interface renders blank and type-checks). The catalog half was fixed by PR sys_comment has no record-level authorization: any org member reads and writes comments on records they cannot see #4630; the type still teaches the wrong key. If a real author hits it, that is a narrow bug card, not this one unfrozen.

Correction to the charter's inventory: the grading debt was not 7 cards, and it is not zero either. What actually remains is a large finding pool in objectui — roughly two dozen open finding cards, most filed 2026-08-10 through 08-14 — which the charter does not mention. Under the standing discipline that is a 3–5 card first-touch budget per round, not a batch job. It is not a v17 blocker and I am not expanding scope to it without your say-so.

---

Round 1 close

Both mandatory pre-work items are complete. No dev dispatched, deliberately — inherited in-flight work (#4636, #4633, #8096, #8500) is already at or past the WIP ≤3 cap and none of it was dispatched by this session.

Board state for Seat B:

• Console P0s awaiting your disposition: 详情页**页头动作**的 visible CEL:当前用户与 lookup 字段比不出来,且求值抛错静默 fail-open —— RecordDetailView 的求值面没被 #5149 的响亮化覆盖(17.0.0-rc.6) #8500 (dispatched, in flight), console: accept-invitation page names neither the organization nor the role — the routed implementation is the thin duplicate, while the detailed one ships unrouted #8282, [finding] single-org users have no UI path to the workspace manage pages — the ?manage=1 avatar-menu entry the code describes does not exist #8096 (draft PR objectui#4638 open), [finding] workspace owner lacks manage_metadata in the EE multi-org deploy, but 构建应用 is a primary home CTA — dead-ends at submit #8270. Charter says all four need an explicit fix-in-17.x / defer-v18 / void ruling.
• Blocking everything else: objectui#4636 (spec pin → 17.0.0 GA). Until it lands, every console-side verification runs against rc.6 — and it now also gates fix(runtime,rest): advertise mcp only when it is actually serveable #4032's last item.
• Decision inbox, objectui side: feat(spec,lint)!: give bulkActionDefs a shape, and lint the aggregate name it references #4508, feat(core,runtime): plugin ordering is a declared, kernel-enforced contract (ADR-0116, #4131) #4163, feat(plugin-hono-server): registerStandardEndpoints 默认翻 false —— 便利面改为显式 opt-in（#4073 第一步） #4280, docs(adr): propose ADR-0114 — layered master data: group template rows and organization overrides (ADR-0105 D10) #4036, fix(i18n): clear the accumulated drift in the generated translation bundles #3670, os serve <config> cannot boot without a prebuilt dist/objectstack.json — dies with Service 'manifest' is async - use await #4085 — of which only fix(i18n): clear the accumulated drift in the generated translation bundles #3670 is new this round.

---

Generated by Claude Code

[hotlong]

Ruling batch applied (maintainer 2026-08-14, verbatim: 「同意」 on the six-item list). Seat B queue changes:

• console: accept-invitation page names neither the organization nor the role — the routed implementation is the thin duplicate, while the detailed one ships unrouted #8282 confirmed fix-in-17.x — route the rich, already-localized DefaultAcceptInvitationPage, delete the thin routed duplicate. target:v17 applied.
• The chart null-category bucket has two identity collisions: it merges a null group with an empty-string group, and collides with a stored value spelling the label objectui#4508 approved and queued — sentinel bucket identity alongside the display label, buildChartSeries + findChartSeriesRow in one combined dispatch. Now pm:queue + target:v17 on the objectui card.
• Status notes from live activity: [finding] single-org users have no UI path to the workspace manage pages — the ?manage=1 avatar-menu entry the code describes does not exist #8096 is delivered (PR fix(app-shell): restore the avatar menu "My Workspaces" entry objectui#4638 open, report on-card) and 详情页**页头动作**的 visible CEL:当前用户与 lookup 字段比不出来,且求值抛错静默 fail-open —— RecordDetailView 的求值面没被 #5149 的响亮化覆盖(17.0.0-rc.6) #8500 is claimed and in progress — both by an active session outside this seat; the seat's first action should be coordinating with (not duplicating) that work. [finding] workspace owner lacks manage_metadata in the EE multi-org deploy, but 构建应用 is a primary home CTA — dead-ends at submit #8270 was previously ruled option B and sits in pm:queue.

---

Generated by Claude Code

[hotlong]

Maintainer ruling (2026-08-14, verbatim, untranslated): 「或者 objectui 就继续让他处理吧。」

Effect on this epic's staffing: the console surface stays with the incumbent objectui lane PM (seat #6025, 🟢, seated 09:56Z — the session already carrying #4636, #4633, #8096, #8500). The separate theme-PM arrangement is dissolved: the 11:03Z Seat B registration (session session_018x7oGZF6qqdUD1Km4e9n5a) is released by this ruling — cleanly, since that session closed its round with zero dispatches of its own and both pre-work items delivered.

This epic remains the charter and the queue of record: the lane PM works the target:v17 set from here (#8282 · objectui#4508 · #8270, plus the P0s it already carries: #8500 in flight, #8096 in review) under the charter's rules (WIP ≤3, pull order priority:p0 > pm:blocking > security > age, target:v17 admission). Round reports may land here or on #6025 — one place consistently, the lane PM's choice. If the released theme session wakes again, its own re-read discipline will meet this ruling before it acts.

---

Generated by Claude Code