L6-UI: packaged actions on/off on the Setup packaged-automation page (ADR-0126 §8.2, ruling 3 — surface half)

[os-support-ai]

Part of objectstack-ai/objectstack#12150 (Epic: ADR-0126 implementation, v17 line — 17.x minor, maintainer-ruled).
Completes the surface-row deliverable of objectstack-ai/objectstack#12160 (closed by objectstack-ai/objectstack#12348, merged e5ce2ed0 — engine, ledger rows and both dispatch doors only; objectui was deliberately out of that PR's scope, so the UI half is this card, not scope creep).
Dispatch: coordinated under the objectstack#12150 program — ⛔ not from the general queue; the program dispatches on unlock (maintainer anti-preemption instruction, 2026-08-25, PM session session_01KWRU3s15AJz7PGW7a7wdCh). Contract: ADR-0126 §8 item 2 + amendment ruling 3, maintainer verbatim: 「动作 可能是需要开关的，因为有的 action 我不想启用。」 (#12049 comment 5408117664) — the disable half has first-party pull; §7.4 gives the page shape (the merged L5 page is the home, not a new page).

Deliverable

The existing Setup "packaged automation" page (#6301 · PR #6382, merged b362c1b, component ref automation:packaged) gains a packaged actions section beside the flows section:

• per packaged action: on/off for this scope — that is all the ledger knows; the page claims nothing more (absence-of-row = active);
• flip invokes the L6 write door POST /actions/_activation/:object/:action (feat(actions): durable packaged-action disable — same activation ledger, dispatch-time consult objectstack#12348); read state comes from the same sys_metadata_activation ledger (metadata_type: 'action');
• refusals surface the server's message verbatim — the §5 operator gate, the ambiguous-name 409 RESOURCE_CONFLICT naming the objects, and the no-ledger 503 SERVICE_UNAVAILABLE — no client-side softening, no retry loops (the objectui#6382 actionErrorDetail pattern);
• ⛔ NO clone for actions — not chartered (ADR §9; ruling 3 charters the switch only); the flows section keeps its clone, actions get none;
• ⛔ no drift/ancestry surface (§9) — no badges, no diff-vs-base;
• i18n: every new key lands in packages/i18n/src/locales/en.ts and all nine other packs (the objectui#3517 lesson — inline defaultValue is explicitly not a fix).

Acceptance

• Packaged actions listed with their activation state; disable/enable round-trip visible in the page;
• refusals verbatim (all three shapes above reachable in tests/mocks);
• flows section behavior unchanged; no new page, no Studio changes.

Refs: ADR-0126 §7.4/§8.2/§9 · objectstack#12160 · objectstack PR #12348 · objectui PR #6382 (the shape to follow)

[os-support-ai]

Claiming — dispatched under the objectstack#12150 program (standing autonomy ruling, maintainer, 2026-08-25, verbatim: 「继续自主完成所有开发」).

• Session: session_01KWRU3s15AJz7PGW7a7wdCh (PM session; implementation delegated to an os-dev agent under this session)
• Branch: claude/issue-6412-action-activation-ui
• Unlock condition satisfied: both halves this card composes are merged — the L6 doors (feat(actions): durable packaged-action disable — same activation ledger, dispatch-time consult objectstack#12348, e5ce2ed0) and the L5 page it extends (feat(app-shell): Setup page for packaged automation — on/off + clone (ADR-0126 §7.4) #6382, b362c1b).

---

Generated by Claude Code

[claude]

{
 "issue": 6412,
 "status": "done",
 "branch": "claude/issue-6412-action-activation-ui",
 "pr": 6415,
 "pr_url": "https://github.com/objectstack-ai/objectui/pull/6415",
 "head_sha": "924d10505be6bde9fda2539d5741bf4db21354c7",
 "premise_still_valid": true,
 "summary": "Setup > Packaged automation gains a packaged ACTIONS section beside its flows one (ADR-0126 §8 item 2, ruling 3). Per action: on/off only. State reads the sys_metadata_activation ledger's metadata_type:'action' rows through the generic data API list the object's own declaration sanctions for operability surfaces (apiMethods:['get','list']); absence of a row = active. Discovery mirrors the runtime's collectActionDeclarations - embedded actions[] from GET /meta/object plus standalone GET /meta/action items, object-embedded winning an <object>:<action> key clash - because listing only the first source would leave a packaged standalone action with no off-switch. Flips call POST /actions/_activation/:object/:action with exactly {enabled}; 'global' is the object segment for an object-less action. NO clone control and NO drift/ancestry surface, both pinned as absences (the ancestry pin feeds clonedFrom/baseVersion in via a response and asserts they never reach the DOM). Flows section behaviour unchanged; no new page, no router change, no new public export.",
 "files_changed": [
 "packages/app-shell/src/views/setup/PackagedActionsSection.tsx (new)",
 "packages/app-shell/src/views/setup/PackagedActionsSection.test.tsx (new)",
 "packages/app-shell/src/views/setup/packagedActions.ts (new)",
 "packages/app-shell/src/views/setup/packagedActions.test.ts (new)",
 "packages/app-shell/src/views/setup/PackagedAutomationPage.tsx (mod: section heading, renders the section, subtitle)",
 "packages/app-shell/src/views/setup/PackagedAutomationPage.test.tsx (mod: fake server answers the 3 new reads empty)",
 "packages/i18n/src/locales/{en,zh,ja,ko,de,fr,es,pt,ru,ar}.ts (9 new keys each + the changed subtitle)",
 ".changeset/6412-packaged-actions-activation.md (new)"
 ],
 "gates": {
 "vitest packages/app-shell/src/views/setup/ + packages/i18n/": "pass — 'Test Files 60 passed (60)' / 'Tests 968 passed (968)' at 924d105",
 "type-check (app-shell, i18n)": "pass — 'Scope: 2 of 47 workspace projects', both 'Done'; script name 'type-check' echoed so the filter was not a zero-match false green",
 "lint (app-shell, i18n)": "pass — '2680 problems (0 errors, 2680 warnings)'; zero findings attributable to the changed files",
 "check:i18n-keys": "pass — 'every literal inline defaultValue matches the value the pack serves'",
 "check:i18n-drift": "pass — '1 en value(s) changed ... 9 pack value(s) followed'",
 "check:control-bytes": "pass — 'OK (scanned 5308 tracked text file(s))'",
 "check:eager-closure": "pass — 3/3 chunk ceilings, weighed against a fresh turbo build of @object-ui/console (the gate refuses to score without one)",
 "changeset:check": "pass",
 "check-changeset-presence": "pass — '16 source file(s) of 2 released package(s) changed, and this change declares 1 changeset(s)'",
 "vitest packages/app-shell (full, 536 files)": "not-run — hit the container's ~10 min foreground cap (exit 143). DECLARED NARROWING (also in the PR body): ran every app-shell test file this diff can reach, derived by enumerating importers of the changed modules and consumers of the one changed en value. Only src/index.ts and services/builtinComponents.tsx reference the page outside views/setup/, neither has a test file, and packagedAutomation.subtitle has exactly one call site.",
 "CI (GitHub Actions)": "in_progress — reported at draft-PR time per the dispatch contract; not waited on"
 },
 "changeset": "added",
 "tests": "34 new tests across 2 new files (packagedActions.test.ts, PackagedActionsSection.test.tsx), all green; the 24 pre-existing setup tests stay green. Component tests cover: active-by-default render, disabled-when-the-row-says-so, disable/enable round-trip following the SERVER's answer, the global-segment path for an object-less action, and all three verbatim refusals (403 PERMISSION_DENIED §5 posture gate, 409 RESOURCE_CONFLICT naming the objects, 503 SERVICE_UNAVAILABLE no-ledger), each transcribed character-for-character from the runtime's own message builders. ABLATION: replaced the verbatim relay actionErrorDetail(json, fallback) with a function returning only the fallback. Mutation confirmed ON DISK by grepping for BOTH the removed and the injected text (removed 0 hits, injected 1 hit) before running - not by a diffstat. Predicted direction red; observed 'Tests 4 failed | 10 passed' (the three refusal shapes plus row isolation). Restore leg verified cmp-identical to the pre-ablation file. No rebuild was needed and none is claimed: the test imports ./PackagedActionsSection by relative path, so the module under test resolves from source, never through a package exports -> dist/.",
 "deviations": [
 "Dispatch said inline `defaultValue` is 'explicitly forbidden by the gate (objectui#3517)'. Measured otherwise: check-i18n-call-site-keys.mjs REQUIRES an inline default to match its `en` value byte-for-byte (the objectui#3810 rule), and the merged L5 page uses inline defaults at every call site. The #3517 lesson is that an inline default is not a SUBSTITUTE for the key existing in all ten packs. Followed the merged page's pattern exactly (inline default + real translations in all ten packs); check:i18n-keys is green.",
 "Changed one shipped `en` value: packagedAutomation.subtitle now reads 'Flows and actions ...'. The page now carries both sections, so the old lede under-described it. This triggered check:i18n-drift, which is satisfied - all nine packs moved in the same commit. Flows BEHAVIOUR is unchanged; the flows table also gained a sibling heading so the new section does not read as an afterthought.",
 "PR footer uses the session-URL form of the signature rather than the bare form the dispatch quoted, per the standing clause: the bare form is stripped by GitHub's body sanitizer on every subsequent edit. Read back after creation - the body is byte-identical to what was sent.",
 "Report JSON carries BOTH the dispatch's requested keys (pr/pr_url/head_sha/files_changed/gates/changeset/deviations/notes) and the standing report schema's keys (status/premise_still_valid/summary/tests/open_questions/out_of_scope_findings), so either parser finds what it reads."
 ],
 "open_questions": [],
 "out_of_scope_findings": [],
 "notes": "No issues filed - nothing I hit qualified as a defect. Two observations for the program, recorded here rather than as cards: (1) objectstack#12348 shipped the action activation WRITE door only; the engine holds listDisabledActions() but no route exposes it, so there is no `_status`-style read door for actions to mirror the flows half with. This is not a gap I worked around silently - the ledger object's own declaration sanctions the generic data API read for exactly this use ('Reads stay open so operability surfaces can answer what is disabled here?'), so the page uses the sanctioned read rather than inventing a client API layer. If the program later wants a read door, this section would move to it with no contract change. (2) The section's one self-authored refusal: a `hasMore` on the ledger read is treated as a LOAD FAILURE rather than rendered, because a dropped row reads as 'active' and a partial ledger would show a switched-off action as armed - the one direction this surface must not fail in. Worktree removed without --force, which is the proof nothing uncommitted was left behind."
}

---

Generated by Claude Code