Approver membership-tier select hardcodes three tiers — `delegated_admin` is not offered and a stored value renders "(invalid)"

[os-elon]

Found while implementing objectstack-ai/objectstack#9806 (framework ruling: ORG_MEMBERSHIP_LEVELS is now derived from BUILTIN_MEMBERSHIP_ROLES, so the org_membership_level approver vocabulary is the whole four-value sys_member.role set — owner / admin / delegated_admin / member). Out of that card's scope (objectui is a separate repo); filed unassigned. Source read only at 7260a1ed4439 — nothing measured in a running Studio.

The stale copies

packages/app-shell/src/views/metadata-admin/inspectors/FlowReferenceField.tsx:169 hand-spells the tier options:

• ORG_MEMBERSHIP_LEVEL_OPTIONS = Owner / Admin / Member (three values), with a doc comment attributing the set to better-auth ("only ever accepts these three"). delegated_admin is ObjectStack's own ADR-0105 D8 addition, enforced on sys_member.role since it landed.
• The strict select for kind === 'org-membership-level' (same file, ~line 646) renders only this hardcoded list — the server-published enum source (source: { source: 'enum', values } from APPROVER_VALUE_SOURCES, the framework#3508 follow-up annotation this same file already carries for record lookups) is not consulted on the enum path.

Consequences once the four-value vocabulary is live server-side:

1. delegated_admin cannot be picked — the picker offers a quarter less than the column stores and the framework schema publishes.
2. A stored { type: 'org_membership_level', value: 'delegated_admin' } row renders as delegated_admin (invalid) — actively mislabeling a spec-valid, runtime-resolvable approver.

Secondary echoes of the three-value list, same repo:

• inspectors/flow-node-config.ts:634 — picker label 'Organization membership (owner/admin/member)'.
• inspectors/flow-node-config.ts:59 — comment "enum (owner/admin/member) rendered as a STRICT select".

Suggested direction (not prescriptive)

Prefer the schema's own published enum (resolveRefKind's source.values) when present — the precedence rule the file already states for record lookups — and keep the hardcoded list only as the fallback for a server predating the annotation; update the fallback and the labels to the four-value set either way. Test fixtures that pin values: ['owner', 'admin', 'member'] (FlowReferenceField.sources.test.tsx:83-96) are fixture inputs, not refusal pins, but any new preference logic should pin that a server-published four-value enum wins over the fallback.

Framework-side derivation and pins: objectstack-ai/objectstack#9806 (spec ORG_MEMBERSHIP_LEVELS = BUILTIN_MEMBERSHIP_ROLES, wire projection APPROVER_VALUE_SOURCES.org_membership_level.values now four values).

---

Generated by Claude Code

[os-warren]

Triage: stays in objectui (packages/app-shell/.../FlowReferenceField.tsx + flow-node-config.ts); type bug — once the server publishes the four-value vocabulary, the picker under-offers and renders a spec-valid stored approver as "(invalid)". Not blocked: upstream objectstack-ai/objectstack#9806 closed today (PR #9942 merged 09:54Z) — spec ORG_MEMBERSHIP_LEVELS is now derived from BUILTIN_MEMBERSHIP_ROLES. Queued.

Note for the claimer: this repo's spec pin may not yet cover #9942 — the fix direction (prefer the server-published enum via resolveRefKind's source.values, keep the hardcoded list only as pre-annotation fallback, update fallback + labels to four values) is pin-agnostic, but any pin asserting the four-value projection needs the bumped spec; declare the fork window in the PR body if the pin lags, per the standing pin discipline.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round 16

Session: session_01RV6yuVCxymHYE16PL9vQkE
Branch: claude/issue-5309-membership-tier-server-enum
Worktree: objectui-issue-5309
Domain: repo:objectui
File surface: packages/app-shell/** — FlowReferenceField.tsx + flow-node-config.ts + their tests (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Clause-②: no — the picker starts offering a value the server already publishes; nothing in objectui's own contract widens. It stops under-offering, which is the declared-vs-enforced repair.
Serial constraints cleared: packages/app-shell is free. In-flight: #5254 (form-field resolution, surface being located), #5266 (apps/console), plus PR #5319 (packages/plugin-view) and PR #5320 (packages/core + scripts/check-doc-snippet-types.mjs) awaiting merge. ⚠️ If #5254's located surface reaches packages/app-shell, stop and report.

The defect

The approver membership-tier select hardcodes three tiers. delegated_admin is not offered, and a spec-valid stored value renders "(invalid)" — a user staring at a legitimately-saved approver being called invalid.

Not blocked — verified upstream

Upstream objectstack-ai/objectstack#9806 closed today, PR #9942 merged 09:54Z: spec ORG_MEMBERSHIP_LEVELS is now derived from BUILTIN_MEMBERSHIP_ROLES.

⚠️ The pin trap triage flagged — read this before writing any test

This repo's spec pin may not yet cover #9942.

The fix direction is pin-agnostic and that is deliberate:

• prefer the server-published enum via resolveRefKind's source.values;
• keep the hardcoded list only as a pre-annotation fallback;
• update that fallback and the labels to the four values.

But any pin asserting the four-value projection needs the bumped spec. So:

1. Measure whether this repo's pin covers #9942 before writing tests. ⛔ Do not assume either way — check.
2. If the pin lags, ⛔ do not write a pin that asserts the four-value projection (it will be red for reasons that have nothing to do with your change). Write what is assertable now, and declare the fork window in the PR body per the standing pin discipline.
3. ⛔ Do not bump the spec pin in this PR. A pin bump is never a rider — it goes through the dedicated bump script with its override and lockfile, as its own change.

Verification

• Re-derive on current origin/main first.
• Pin what is pin-agnostic: that the picker prefers source.values when the server publishes them, and that the hardcoded list is reached only as fallback. That much holds regardless of pin state.
• Cover the reported symptom: a stored delegated_admin must stop rendering "(invalid)" once the four-value vocabulary is available.
• Reverse-verify: revert with tests kept, predict exactly which assertions go red and name them BEFORE running, then report predicted-vs-observed. Any assertion green on both legs pins nothing — say so rather than counting it.
• Counter-probe every zero with a known-present neighbouring term.
• ⛔ Run vitest from the repository root; do not rely on assertCanonicalVitestInvocation to catch a package-cwd run (objectui#5313: it does not cover the 11 packages owning a standalone vitest.config.ts).
• State whether a build artifact sits between your edit and the thing under test — this reads a value published by @objectstack/spec, so check whether that leg resolves through a built artifact.

Changeset: patch on @object-ui/app-shell. ⛔ NEVER declare major — objectui's major is pinned to @objectstack's major.
⛔ Do not edit content/docs/releases/, docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md.

---

Generated by Claude Code

[os-support-ai]

{
 "issue": 5309,
 "status": "done",
 "branch": "claude/issue-5309-membership-tier-server-enum",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5327",
 "premise_still_valid": true,
 "summary": "Confirmed on origin/main @ 6e6884aad: FlowReferenceField.tsx hand-spelled ORG_MEMBERSHIP_LEVEL_OPTIONS as owner/admin/member and the org-membership-level branch never consulted resolveRefKind's source.values. The picker now resolves its vocabulary through a new exported membershipLevelOptions(source): the server-published enum wins and is used verbatim (order included); the local list survives only as the pre-annotation fallback and is now DERIVED from BUILTIN_MEMBERSHIP_ROLE_OPTIONS in @objectstack/spec/identity, which that package documents as 'the picker's vocabulary' and ships with labels; an unknown tier is humanized rather than shown as a raw token; a published-but-empty enum falls back instead of rendering an empty strict select. PIN TRAP MEASURED, and it does not bind: this repo pins @objectstack/spec@17.0.0 (lockfile-exact) whose APPROVER_VALUE_SOURCES.org_membership_level still publishes exactly ['owner','admin','member'] and exports no ORG_MEMBERSHIP_LEVELS, so objectstack#9942 is NOT in this pin and nothing here asserts that projection. But the SAME pin already carries BUILTIN_MEMBERSHIP_ROLES/BUILTIN_MEMBERSHIP_ROLE_OPTIONS as the full four values with labels including Delegated Admin, so deriving the fallback from upstream's own #9806 source makes the fix and every test assertable TODAY with no bump. No spec pin bump is in this PR. Label echoes in flow-node-config.ts updated; the type-picker label became 'Organization membership tier' rather than being re-spelled with four values, since enumerating a vocabulary inside a label is the same staleness class this card is about. In-flight #5254 was checked before starting: its surface is packages/components/** and does not reach packages/app-shell, so no breach.",
 "tests": "All results at final head 528bfe5f1; vitest run from the REPOSITORY ROOT throughout. (1) New FlowReferenceField.membershipTier.test.tsx: 'Test Files 1 passed (1) / Tests 11 passed (11)'. (2) inspectors dir: 'Test Files 55 passed (55) / Tests 609 passed | 1 skipped (610)'. (3) Full packages/app-shell/: 'Test Files 450 passed (450) / Tests 4343 passed | 1 skipped (4344)' (ran at 0ea615898; source tree identical to 528bfe5f1, only a changeset .md added after). (4) pnpm --filter @object-ui/app-shell type-check clean, script name echoed so it really ran; it FIRST failed with TS2307 'Cannot find module @object-ui/react' until pnpm --filter '@object-ui/app-shell^...' build ran the dependency closure -- and that failing run's exit code read 0 through the pipe while the output said 'Exit status 2', so the verdict was read from output, not the code. (5) lint: 0 errors (2476 pre-existing package-wide warnings); the 3 warning sites in the touched file are at lines 383/423/461, outside every diff hunk (hunks: 40, 159-227, 690-708). (6) Gate union re-run AT 528bfe5f1: check:control-bytes, check:spec-symbols, check:esm-specifiers, check:phantom-deps, check:self-import, check-changeset-no-major -- all PASS. objectui has no scripts/pm/dispatch-gates.mjs, so the set was derived by hand from the changed paths. REVERSE VERIFICATION -- four legs, predictions written down BEFORE each run, all four matched EXACTLY. A wholesale revert would delete the exported membershipLevelOptions and break the file's import (every test red, discriminating nothing), so each half was ablated separately then together. Leg A (server enum ignored) predicted 4 red -- verbatim-order, NARROWER, humanizes, server-says-outside -- observed exactly those 4. Leg B (fallback re-hardcoded to three) predicted 3 red -- derived-fallback, delegated_admin-on-fallback, DOM-no-source -- observed exactly those 3, and its DOM dump contains the literal reported symptom 'delegated_admin (invalid)'. Leg C (empty-vocabulary guard dropped) predicted 1 red -- empty-select fallback -- observed exactly that 1. Leg A+B (combined = origin/main behaviour) predicted 7 red -- adds DOM-server-publishes-enum -- observed exactly those 7. ABLATION REBUILD: no rebuild was needed or performed on any leg, and this is verified rather than assumed -- the root vitest.config.mts aliases every @object-ui/* specifier to that package's src/, and the test imports './FlowReferenceField' RELATIVELY, so vitest transforms the edited source directly and no app-shell dist participates; the RED results are themselves proof the source edit reached the test, since a stale artifact would have returned green. The one artifact in the path is @objectstack/spec's published node_modules dist, which has no vitest alias and IS the pin under test -- exactly what production consumes; I do not build it. Each leg was restored with git checkout HEAD -- FILE from the committed fix and the restore verified byte-identical (git status --porcelain empty) before the next run; the restored tree re-ran green at 11/11. ASSERTIONS THAT PIN NOTHING, stated rather than counted: 'still flags genuinely dirty legacy data' (sales_manager) is green on all four legs -- it guards against a fix-by-deletion of the (invalid) affordance, not against this regression, and is annotated as such in the test; 'falls back for a source that is not an enum at all' is green on all four legs and pins only the type narrowing. Every other assertion is red on at least one leg. Counter-probe: toContain('delegated_admin') is paired with not.toContain('sales_manager') on the same array so the positive assertion is shown capable of failing. Note leg A vs A+B on 'still flags a value the SERVER says is outside its vocabulary': red under A but GREEN under A+B, because with the three-value list the tier genuinely is outside the vocabulary and the flag is right for the wrong reason -- which is why the combined leg is reported rather than leg A alone.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Notes for the PM, outside the machine-read block:

• No follow-up issue filed. The only thing worth flagging is that this repo's @objectstack/spec pin (17.0.0) lags objectstack#9942 by design-of-timing, not by defect — that is the normal state between an upstream merge and a release bump, and this PR is deliberately pin-agnostic so no follow-up is owed. When the pin does bump, APPROVER_VALUE_SOURCES.org_membership_level becomes four-valued on its own and nothing in this PR needs revisiting.
• Changeset present (patch on @object-ui/app-shell), so the skip-changeset question is moot; no label was created or applied in this repo.
• Reported at draft-PR time per the standing contract; CI was still converging (mergeable_state: unstable) and was deliberately not waited on.

---

Generated by Claude Code