fix(app-shell): Studio read-only packages stop advertising writability they do not have (#4036 B-half)

[yinlianghui]

Part of #4036 — the B-half only. The card stays open: the A-half (whether the 15 overlay-allowed types become individually editable in Studio) is still pending upstream, and this PR leaves every gate exactly as policy-consistent as it found it.

The ruling this implements

objectstack-ai/objectstack#5768, maintainer half-ruling of 2026-08-06 — quoted verbatim and untranslated:

已放行(可拆 sub-issue 先行,不等 A):

• B 半边:「可写」徽标与「含未保存改动」等误导 affordance 修正——策略、能力、显示三者对不上的显示侧先收敛到当前实际策略(一刀切只读)。

The policy the display is being made to cohere with, from the 裁决 comment in the same thread: Studio 维持包级只读.

So this is display-side only. No enable/disable gating, no save/publish path, and no part of the read-only policy is touched. The A-half review must find the surface exactly as it is today.

Two captions that contradicted the controls beside them

1. The access header badge advertised "writable" above 207 disabled checkboxes

/studio/:pkg/access rendered a permission set's title row as ... · Security · writable · ... while all 207 permission checkboxes and Save below it were disabled with the read-only-package tooltip. Both renderings answer the same question — can you write this? — from different inputs:

• the controls read !!resolved.allowOrgOverride && !readOnly, i.e. the type registry AND the host package gate, which is the right answer;
• the badge read entry.allowOrgOverride alone. permission is one of the overlay-allowed types, so that flag is true and the badge said "writable" in every package, read-only or not.

PageShell now accepts a readOnly host gate that dominates the type-level flag, and the Studio Access pillar passes the same value it already hands the matrix's own controls. The tooltip names the package as the reason by reusing the engine.studio.pkg.readonly* wording the Studio top bar and the identity strip already use for this gate, rather than inventing a second spelling for one screen. The badge slot became a single WritabilityBadge component because it was duplicated verbatim in the compact and hero headers — precisely the shape that lets a gate be honoured in one header and forgotten in the other.

2. The Data → Form layout caption claimed unsaved changes that could not exist

In a read-only package the form tab read Draft layout — your unsaved changes with Save draft disabled and no draggable element on the surface at all. The mechanism was not a stale diff: the caption was selected by formMode === 'layout' — a tab selector — so it asserted pending edits on every clean layout tab, read-only or not, while the component's real dirty flag sat a few lines below driving the preview warning. The claim now renders only for real local edits on a surface that can save them; a neutral Draft layout caption (engine.studio.data.form.layoutBadgeClean, added to both locale tables) covers every other case, so the caption still names what you are looking at.

Sweep for the same shape

Same-shape means "a display that answers a gate question from an input that is not the governing gate". On these screens there was nothing else:

• the Access pillar chrome and the OWD overview panel already branch on readOnly for their own affordances;
• the OWD panel's unsaved badge and the form tab's preview warning are already derived from real edit state (dirty / hasDraft), not from a tab selector;
• the metadata directory and resource-list badges read the type registry alone, which is the whole truth in those screens — they are not package-scoped, so there is no host gate for them to disagree with. Different-shaped, correct as they stand.

Tests, and the reverse verification

Two new suites, 9 tests. Predicted directions were written down before the fix was removed, and the run matched exactly: 4 red, 5 green.

Reverting only the four source files to origin/main and keeping the tests:

× read-only package: the header does NOT claim the set is writable
AssertionError: expected [ 'writable', 'History' ] to not include 'writable'
× read-only package: the header reports read-only, naming the package as the reason
AssertionError: expected [ 'writable', 'History' ] to include 'read-only'
× read-only package: no unsaved-changes claim where nothing can be saved
× writable package, nothing edited yet: still no claim
Tests 4 failed | 5 passed (9)

The 5 that stay green are green on purpose, and one of them is an inverted case worth naming rather than dressing up as a red:

• writable package with real unsaved edits: the claim renders passes before and after. Pre-fix the caption was a constant claim, so of course it renders once you really edit. It is not a red-first test — it is the anti-deletion pin: without it, "suppress the false claim" could be satisfied by deleting the claim outright, taking the caption from always-lying to never-telling.
• three are control pins on the gating: a read-only package still disables every checkbox, still offers no Save, and still exposes no add-field affordance; a writable package keeps both. A red there would mean this PR had loosened the policy the B-half ruling explicitly preserves — so they must stay green, and they do.

Full ladder, all from the repo root:

• pnpm exec vitest run --maxWorkers=2 packages/app-shell/src/views/metadata-admin/ packages/app-shell/src/views/studio-design/ → 164 files / 1638 passed, 1 skipped. The PageShell refactor touches every metadata-admin page's chrome, so the sweep is the whole consumption radius of the changed component, not just the two new files.
• build closure first (--filter '@object-ui/app-shell^...' build), then both tsc projects: tsc --noEmit → exit 0, tsc -p tsconfig.typetests.json → exit 0.
• eslint on the six changed files → 0 errors, 38 warnings, all pre-existing and byte-identical on origin/main (react-hooks/* on untouched effects, plus one unused Button import in PageShell.tsx that origin/main carries at the same line — not introduced here, and out of scope for this PR).
• gates: check-control-bytes OK, check-i18n-call-site-keys OK, check-i18n-en-drift (0 en values changed), check-changeset-presence / -fixed / -no-major OK.

A changeset is included: the copy is user-visible.

Continuation note

The original agent on this card was killed by a host restart mid-implementation, leaving six uncommitted files in the worktree and nothing pushed. This PR inherits that work after judging each hunk against the ruling: all six were kept as correct, with the changeset added (it was missing) and the reverse verification and full ladder run here for the first time.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Aug 11, 2026 5:47pm

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	29.5 KB	350 KB
Entry file	index-lBgfifzU.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	9.56KB	3.59KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	8.92KB	3.41KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	22.10KB	4.37KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.13KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.64KB	2.21KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	35.76KB	9.11KB
auth (createAuthenticatedFetch.js)	4.37KB	1.69KB
auth (index.js)	2.35KB	1.07KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	4.91KB	0.87KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.07KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.65KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	489.12KB	108.41KB
core (index.js)	3.04KB	1.15KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	150.04KB	39.79KB
fields (index.js)	228.37KB	56.62KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.32KB	1.77KB
i18n (index.js)	3.01KB	1.22KB
i18n (pickLocalized.js)	1.70KB	0.83KB
i18n (provider.js)	16.38KB	5.47KB
i18n (useDisplayLocale.js)	2.33KB	1.20KB
i18n (useObjectLabel.js)	27.59KB	6.63KB
i18n (useSafeTranslation.js)	4.52KB	1.96KB
layout (index.js)	38.98KB	10.85KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	8.75KB	3.06KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	3.67KB	1.12KB
permissions (evaluator.js)	4.41KB	1.44KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.55KB	0.71KB
plugin-ai (index.js)	15.71KB	3.79KB
plugin-calendar (index.js)	45.23KB	12.45KB
plugin-charts (index.js)	62.18KB	17.67KB
plugin-chatbot (index.js)	180.33KB	42.79KB
plugin-dashboard (index.js)	121.56KB	31.56KB
plugin-designer (index.js)	210.91KB	42.67KB
plugin-detail (index.js)	238.95KB	59.76KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	114.58KB	27.68KB
plugin-gantt (index.js)	164.14KB	39.98KB
plugin-grid (index.js)	188.00KB	49.94KB
plugin-kanban (index.js)	48.60KB	13.41KB
plugin-list (index.js)	110.10KB	26.74KB
plugin-map (index.js)	18.05KB	5.80KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	40.60KB	10.58KB
plugin-timeline (index.js)	26.21KB	7.52KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.03KB	20.55KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.71KB	3.53KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.67KB	2.37KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	23.71KB	7.96KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.23KB	0.66KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	4.09KB	1.74KB
sdui-parser (index.js)	4.47KB	2.03KB
sdui-parser (parse.js)	10.04KB	2.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	4.69KB	1.48KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	3.05KB	1.52KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped