CURATED_CAPABILITY_LABELS has drifted from PLATFORM_CAPABILITIES — `manage_sharing` silently loses its localized label

[yinlianghui-tw]

Found while taking the measurement for #5899 (see PR #6284 for the full population). Filed unassigned as an observation, for PM triage. Not fixed there — out of that card's scope.

The defect

packages/fields/src/widgets/CapabilityMultiSelectField.tsx:82:

/**
 * objectui#2600 B5 — the curated platform capabilities are a FIXED, known set
 * …
 * (Mirrors @objectstack/spec/security `PLATFORM_CAPABILITIES`.)
 */
const CURATED_CAPABILITY_LABELS = new Set([
 'manage_users', 'manage_org_users', 'manage_metadata',
 'manage_platform_settings', 'setup_access', 'setup_write', 'studio_access',
]);

It is used at line 157:

const norm = name.replace(/\./g, '_');
if (CURATED_CAPABILITY_LABELS.has(norm)) return t(`capability.label.${norm}`);
return byName.get(name)?.label || name;

The Set has 7 members. @objectstack/spec@17.2.0's PLATFORM_CAPABILITIES has 8:

manage_users manage_org_users manage_metadata manage_platform_settings
setup.access setup.write studio.access manage_sharing

Normalized (dots → underscores, which is what labelFor does), the difference is exactly one member: manage_sharing is missing from the local Set. The dotted-vs-underscore spellings are not drift — that transform is deliberate and performed at the call site.

Consequence: manage_sharing falls through to byName.get(name)?.label, i.e. the English label the sys_capability registry serves, and is never localized — while the seven capabilities beside it in the same picker are. That is the exact class the Mirrors comment was written to guard against.

Why nothing caught it

scripts/check-spec-symbol-derivation.mjs rule 2 exists to flag precisely this — a declaration whose doc comment claims spec alignment with no compile-time tie behind it. It could not see this one: both of its scanners skip non-exported declarations, and CURATED_CAPABILITY_LABELS is module-local. That hole is #5899's subject; with the export filter relaxed, this declaration is one of only two additional rule-2 findings in the whole tree, and the only one with measured drift.

Fix shape (not prescribing — this needs the same judgement #5899 does)

Derive the set from the spec instead of restating it, e.g. build it from PLATFORM_CAPABILITIES.map(c => c.name.replace(/\./g, '_')). That both closes today's gap and makes the next spec addition arrive automatically — and it retires the unbacked claim at the same time. If a curated subset is genuinely wanted (i.e. some platform capability should deliberately keep its registry label), that intent needs writing down, because the comment currently says the opposite.

Measured on a76b18cf2 against @objectstack/spec@17.2.0.

Related: #5899 (the instrument hole that hid it), PR #6284 (the census).

[yinlianghui-tw]

Triage: pm:queue + domain:ui, type Bug, S — measured drift with a user-visible consequence (manage_sharing un-localized beside seven localized siblings in the same picker), and the local comment's own Mirrors claim is the intent record: the set is supposed to equal PLATFORM_CAPABILITIES. Fix = the card's derivation shape (build the set from PLATFORM_CAPABILITIES with the dot→underscore transform at one site), which retires the unbacked restatement and makes the next spec addition arrive automatically. ⛔ If implementation surfaces a real reason for a curated subset (some capability deliberately keeping its registry label), stop and report — that intent contradicts the current comment and needs writing down, not silently encoding. Independent of #5899 (the instrument hole); do not wait on it.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round R1 (wave 2 — the maintainer raised concurrency to 5 mid-round)
Session: session_011SfZeFWrhGLHmfq61xbz4q
Branch: claude/issue-6285-capability-labels-derive-from-spec
Worktree: objectui-issue-6285
Domain: domain:ui
File surface: packages/fields/src/widgets/CapabilityMultiSelectField.tsx and its tests (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (standing maintainer order — Fable quota exhausted, Opus is the lane default)
Clause-②: no — a local label Set in a widget starts deriving from the spec symbol it already claims to mirror. No contract schema is touched, no accept set moves, no public surface widens.
Serial constraints cleared: verified by file, ⛔ not by package name. ⚠️ PR #6292 is open on packages/fields — but on src/index.tsx, and I probed it: packages/fields/src/index.tsx contains zero references to CURATED_CAPABILITY_LABELS or PLATFORM_CAPABILITIES. The whole defect lives in src/widgets/CapabilityMultiSelectField.tsx. Disjoint. ⚠️ Still branch from a freshly fetched main — #6292 may land while you work. The four other cards in flight this wave are on packages/components/src/renderers/action/, packages/plugin-designer, examples/schema-catalog + apps/site, and packages/plugin-gantt — all disjoint.

Stale-premise check — run against origin/main @ ba306e3

• ✅ CURATED_CAPABILITY_LABELS still declared at CapabilityMultiSelectField.tsx:82 and still read at :157.
• ✅ The Mirrors @objectstack/spec/security PLATFORM_CAPABILITIES claim is still in the doc comment at :80 — with no compile-time tie behind it, which is the whole defect.
• ✅ The resolved spec is 17.2.0, matching the version the card measured against.
• ⚠️ Re-derive the membership delta yourself. The card measures 7 local vs 8 in spec, with manage_sharing as the single missing member. That was measured on 08-25 against 17.2.0; ⛔ do not inherit the count — read PLATFORM_CAPABILITIES out of the installed package and diff it.
• ⚠️ The card's context references finding(tooling): check-spec-symbol-derivation.mjs skips every non-exported declaration, so the #5652 mirrors it was cited to catch were invisible to both rules #5899 and PR docs(tooling): state check-spec-symbol-derivation's export-filter boundary, with the measured population #6284; docs(tooling): state check-spec-symbol-derivation's export-filter boundary, with the measured population #6284 is no longer in the open-PR list, so it has landed or closed. Check what it changed in scripts/check-spec-symbol-derivation.mjs before assuming the gate still cannot see this declaration.

裁决 (binding)

Derive the set from the spec rather than restating it. The doc comment already claims the mirror relationship; make the code honour the claim instead of asserting it. That closes today's manage_sharing gap and makes the next spec addition arrive automatically.

⛔ Do not fix this by adding 'manage_sharing' to the literal. That repairs today's single instance and leaves the unbacked claim — and the next spec addition — exactly where they are. Restating a spec symbol by hand is the defect; a hand-patched restatement is the same defect with a fresh timestamp.

Premise fork — stop and report, ⛔ do not improvise: if you measure that a curated subset is genuinely intended (i.e. some platform capability must deliberately NOT be localized here), then deriving-and-filtering is a different shape and the filter needs a stated, checkable rule. Report that rather than silently picking either the full mirror or a hand-list.

PM 机制假设 (verify — rebut freely)

1. Confirm the dotted-vs-underscore transform is deliberate, as the card states (name.replace(/\./g, '_') at the call site, so spec's setup.access becomes setup_access). If you derive from the spec you must apply the same normalisation, or you will silently drop three members that currently work. ⭐ This is the most likely way to ship a regression here.
2. Confirm the localized keys actually exist for every derived member — capability.label.manage_sharing must be a real i18n key, or you will trade a missing translation for a raw key string on screen. ⛔ Do not assume the key exists because the capability does.
3. scripts/check-i18n-call-site-keys.mjs:731 registers this symbol as an i18n vocabulary source (kind: 'set'). Deriving it changes it from a literal to a computed value — check that gate still reads it, and report if the derivation makes it unreadable to the scanner.

Read-channel clause (⭐ ⛔ do not drop it — it is what keeps this lane affordable)

git first (free; the clone is shallow, so git fetch --deepen=500 origin before any merge-base/A...B work), then the rendered issue page at https://github.com/objectstack-ai/objectui/issues/6285, whose embedded JSON payload carries the raw body and every comment — extractor ready at /home/user/pmtools/gh_issue.py. Reserve MCP/GraphQL for writes, plus the one dedup search before filing an out-of-scope finding, explicitly exempt. ⚠️ That page does not serve issue search, lags by minutes (⛔ never re-read your own fresh write through it), and ⛔ must never be used to size a lane.

⛔ Leave the PR draft. Do not mark ready, enqueue, or enable auto-merge — the PM lands it.

---

Generated by Claude Code

[os-support-ai]

Dev claim (os-dev subagent, distinct from the PM claim above).

Session: session_011SfZeFWrhGLHmfq61xbz4q — subagent os-dev, dispatch wave 2. (Same session id as the PM comment: this lane runs the developer as a subagent inside the PM session, so the id cannot separate us; this comment is the agent-side claim, the one above is the PM-side one.)
Branch: claude/issue-6285-capability-labels-derive-from-spec (pushed empty at 7ccb53a9 as the write-route probe before the first edit)
Worktree: objectui-issue-6285, branched from a freshly fetched origin/main @ 7ccb53a9 (PM measured ba306e3; ba306e3 is an ancestor of 7ccb53a9, so this is strictly newer).
Assignee untouched.

Premise re-derivation against origin/main @ 7ccb53a9 (not inherited from the card)

• CONFIRMED — CURATED_CAPABILITY_LABELS declared at CapabilityMultiSelectField.tsx:82, read at :157, Mirrors @objectstack/spec/security PLATFORM_CAPABILITIES claim at :80.
• CONFIRMED — resolved spec is @objectstack/spec@17.2.0.
• CONFIRMED by re-measurement (not inherited): PLATFORM_CAPABILITIES has 8 members; the local Set has 7; after the dot -> underscore transform the delta is exactly manage_sharing.
• CONFIRMED — the dotted/underscore transform is deliberate (name.replace(/\./g, '_') at the call site).
• MEASURED, and it answers PM assumption 2 in the negative: capability.label.manage_sharing does not exist. Seven keys in packages/fields/src/widgets/useFieldTranslation.ts and seven in each of the ten packs under packages/i18n/src/locales/. So the derivation on its own trades a missing translation for a raw key on screen; the key has to be authored in 11 files as part of the fix.
• MEASURED — PR docs(tooling): state check-spec-symbol-derivation's export-filter boundary, with the measured population #6284 landed as c1a91b842 docs(tooling): state check-spec-symbol-derivation's export-filter boundary in its header. Documentation only; the export filter is unchanged, so the gate still cannot see this module-local declaration.
• MEASURED — scripts/check-i18n-call-site-keys.mjs registers this symbol as kind: 'set', and readVocabulary requires new Set([<string literals>]). A computed initialiser returns null there, which is reported as unreadable-vocabulary (a hard finding, deliberately never absorbed). So the derivation forces that family entry to change.

One finding the card could not have carried — bundle cost, measured

@objectstack/spec/security is not in the console's eager graph today. Marginal cost of adding that subpath to a graph that already holds the spec root, measured here with the repo's own esbuild (browser platform, minified):

spec root alone 1,393,644 bytes min / 398,100 gzip
spec root + spec/security 1,574,596 bytes min / 455,547 gzip
delta +180,952 min / +57,447 gzip

scripts/check-eager-closure-budget.mjs leaves 45,102 bytes gzipped of headroom. packages/fields declares sideEffects: true and re-exports this widget from its barrel, so a static import here is a candidate for the eager closure. A console before/after build is running now to settle whether the closure actually grows; the report will carry the reading either way. If it does grow, this is a fork the ruling did not anticipate, and the report will state it rather than improvise around it.

No body truncation found on the card: the issue body and both comments round-trip complete through the rendered page's embedded JSON payload.

Generated by Claude Code

---

Generated by Claude Code