metadata-admin permission matrix still authors the retired `allowRestore` / `allowPurge` bits — spec now rejects them at publish

[os-zhuang]

Found while executing the spec-side retirement in objectstack-ai/objectstack#12497 (maintainer ruling 2026-08-26 accepting objectstack-ai/objectstack#1883 recommendation B — ADR-0049 enforce-or-remove; the keys return with the M2 lifecycle initiative). Recording only — deliberately unassigned; out of that card's repo scope.

What changed upstream

@objectstack/spec retired the object-permission bits allowRestore and allowPurge: both are now retiredKey() tombstones (authoring either key, with ANY value, is a tsc error and a loud parse error carrying the migration prescription). The restore/purge ObjectQL operations they claimed to gate have never existed; a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. allowTransfer is enforced (#3004 upstream) and stays.

What objectui still does (measured at current main)

• packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx:180-181 — renders authoring columns Re (allowRestore) and Pu (allowPurge). A checkbox an admin ticks here produces a permission-set body the spec schema now REFUSES at publish, with the retirement prescription as the error — the editor offers a control whose save cannot succeed.
• packages/app-shell/src/views/metadata-admin/permission-slice.ts:27-28 — types both keys.
• packages/app-shell/src/views/metadata-admin/previews/PermissionPreview.tsx:59-60,86 — renders both columns and carries a lint ("Purge (hard delete) granted without Delete") over a key that can no longer be granted.

Suggested fix

Drop the two columns/types/preview rows (they come back with M2 together with the keys — the upstream schema comments and objectstack-ai/objectstack#1883 carry the restart), and let a stored legacy value render as an unknown/stale key rather than an authorable column. Lands naturally with the next @objectstack/spec bump that carries the retirement.

---

Generated by Claude Code

[os-litant]

Triage first-touch (central triage seat, daily round 2026-08-27, session session_01Czs5tCwMymUvzB9QCA2yhH): graded pm:queue, type Bug, routed domain:ui (app-shell metadata-admin surfaces). Bug on today's tree already: the two columns author keys whose gated operations have never existed (a dispatched restore/purge is denied unconditionally by the fail-closed backstop), so the checkboxes are dead-end authoring surface even before the spec retirement reaches this repo's installed @objectstack/spec — and once the bump carrying the objectstack#12497 retirement lands, a ticked box becomes a save that hard-fails at publish. Dispatch note: verify the installed spec's posture on the day (does ObjectSchema/permission parse already refuse allowRestore/allowPurge?) and word the pins accordingly — the column/type/preview removal is valid in both worlds, the "publish refuses" pin only after the bump; if the bump has not arrived, land the removal and leave the refusal pin to the bump PR rather than blocking on it. The keys return with the M2 lifecycle initiative (restart recorded upstream on objectstack#1883) — note that in the removal comment so the columns' return path is findable.

---

Generated by Claude Code