Retire the allowRestore / allowPurge columns from the metadata-admin permission matrix

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-sales]

Fixes#6595

Drops the two retired object-permission bits from the metadata-admin permission matrix: the authoring columns, the typed fields, the preview rows, and the now-unreachable "Purge (hard delete) granted without Delete" lint. allowTransfer is enforced upstream (objectstack#3004) and is untouched — it stays a column, and every pin below asserts that in the same render so the removals cannot pass for the wrong reason.

Both removed keys gated restore / purge ObjectQL operations that have never existed: a dispatched restore/purge is denied unconditionally by the evaluator's fail-closed destructive-operation backstop. Every tick of those checkboxes wrote a grant no runtime has ever read. @objectstack/spec retired both as retiredKey() tombstones (objectstack#12497; maintainer ruling 2026-08-26 accepting objectstack#1883 recommendation B, ADR-0049 enforce-or-remove).

The return path is named at every site the removal touched — permission-slice.ts, PermissionMatrixEditor.tsx, previews/PermissionPreview.tsx, and both new pins: the keys come back with the M2 lifecycle initiative, whose restart is recorded upstream on objectstack#1883.

The one thing measured on the day: the installed spec's posture

The card's premise splits into a part that is true either way and a part that depends on a bump that has not arrived. Measured 2026-08-27 against the installed @objectstack/spec17.2.0, by running real ObjectPermissionSchema.safeParse calls with a control key:

allowRestore ACCEPTED
allowPurge ACCEPTED
allowTransfer ACCEPTED
bogusKey REFUSED unrecognized_keys: ["definitelyNotAKey"]

The control is what makes this falsifiable: the schema IS strict and DOES refuse unknown keys, and it still accepts both retired keys. permission.zod-Bwl7_K0U.d.ts agrees at the type level (allowRestore: z.ZodDefault(z.ZodBoolean)).

So the bump has not reached this repo, and this PR does what that implies:

• The removal lands — valid in both worlds, since the gated operations have never existed.
• The "publish refuses it" pin is NOT taken. It belongs to the bump PR. Nothing here blocks on the bump, and no pin is bumped as a rider.
• A stored legacy value is carried through, not stripped. It is no longer modelled and no longer authorable; it rides through save untouched, exactly as any key this editor does not model does. Stripping today would delete stored data the schema still honours. Once the bump lands and a carried value becomes a body the schema refuses, strip-on-load becomes correct — objectui#4644's resolution for indexed. The pin recording today's posture says so in its own header, so the bump PR replaces it deliberately rather than deleting a red.

The card's line references were stale, and its site list was incomplete

Line numbers were re-derived by name rather than trusted. The three constructs the card named were all real (at 180-181, 27-28, 59-60/86 — unchanged). But a fourth site reads these keys and the card did not list it:

packages/app-shell/src/views/metadata-admin/i18n.ts carries the two column tooltips in both locale tables — perm.action.restore / perm.action.purge in ENGINE_STRINGS_EN and ENGINE_STRINGS_ZH. Removing the columns without them would have left four dead keys in a pack whose EN/ZH halves must stay in step. Removed in both locales; the pack is the engine.* carve-out, so no pack gate reaches it either way.

Three prose sites were also carrying the removed columns as fact and are corrected: the editor's header comment (lifecycle (Transfer / Restore / Purge)), the column-legend note (Tr/Re/Pu/VA/MA), the fixed-column count (object + 9 CRUD + bulk, now 7 — the min-w floor is deliberately unchanged, so the grid simply has more room), and the preview's capability list plus its two legend lines.

Tests

Two new pin files, PermissionMatrixEditor.retiredLifecycleKeys.test.tsx and previews/PermissionPreview.retiredLifecycleKeys.test.tsx, following the shape PermissionAdvancedFacets.retiredKeys.test.tsx set for the RLS priority tombstone: pin the key SET, not the absence of two keys, because a set assertion is what stops a retired key drifting back in beside a live one. They cover the column set, the checkbox surface, what reaches the wire (the "Grant all" seed, whose key set is the real product of this change), the dropped lint measured on a draft that still trips the lints that stayed, and the carry-through of a stored legacy value.

Reverse verification — direction predicted before running: RED. Restoring the two columns, the two preview rows and the lint on top of the committed fix turns all 7 new pins red (Test Files 2 failed (2) · Tests 7 failed (7)); every one of them fails, so none was passing for an unrelated reason. Mutation confirmed on disk by anchored grep counts (short: 'Re'=1, long: 'Purge'=1, purge-lint=1) plus blob hashes differing from the HEAD blobs — not a bare diffstat. Restore leg proven the same way: git hash-object reproduces both HEAD blobs byte-for-byte and git diff HEAD is empty. No rebuild leg applies — both pins import their subject by relative source path (./PermissionMatrixEditor, ./PermissionPreview), so no dist/ sits in the resolution path.

Union re-run after the final commit, at 005a792:

check	result
19 permission test files (whole surface, not just the new pins)	Test Files 19 passed (19) · Tests 90 passed (90)
@object-ui/app-shell type-check	green — tsc --noEmit and tsc -p tsconfig.test.json
check-changeset-presence	✅ 6 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)
check:control-bytes	✅ check-control-bytes: OK (scanned 5455 tracked text file(s); skipped 85 binary)
check:i18n-keys	green — every in-scope call-site key resolves against the en pack
check:i18n-drift	No en value changed in this range
check:i18n-dead-keys	report-only gate, exit 0

The type-check claim is measured, not assumed: tsc -p tsconfig.test.json --listFiles lists both new test files, so the green covers them rather than excluding them.

Lint was narrowed deliberately, and here is why the narrowing loses nothing.eslint --no-inline-config --format json over the 6 changed files reports errorCount 0 (27 warnings, all pre-existing patterns; --max-warnings is deliberately unset repo-wide, per lint.yml's own note). The population is read from eslint's own resolution — it returned exactly 6 result objects, so all 6 are in scope and none was ignored. And the invariance holds by construction: eslint.config.js enables no type-aware linting (no project / projectService / parserOptions.project), so a file's verdict depends only on its own contents and the config — this diff cannot move the verdict on any file it does not touch. CI runs the repo-wide pnpm lint regardless.

Out-of-scope findings, filed rather than fixed here

• objectui#6605 — the matrix's four bulk buttons (R / CRUD / All / None) replace the object row instead of merging, silently deleting allowExport, readScope and writeScope, which the local ObjectPerm does not model. The sharpest shape: clicking All can widen effective read access by deleting a readScope: own narrowing. Different defect class from this card (those keys are live and enforced), so it is not touched here.
• objectui#6606 — the permission authoring shapes are absent from PAYLOAD_SHAPES in check-designer-field-key-parity.mjs, so the very class this card instantiates is invisible to that gate on the permission surface. This card arrived as a hand-written upstream referral, not from CI.

Neither is addressed in this PR; both remain open.

Fence

Every edit is inside packages/app-shell/src/views/metadata-admin/ plus one .changeset/ file. Nothing under studio-design/ was read for edit or touched — the sibling round's region is untouched.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3235.4 KB	3266.6 KB
Main entry chunk (gzip)	157.0 KB	350 KB
Entry file	index-CTzDHwYr.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	11.89KB	4.50KB
app-shell (runtime-config.js)	20.61KB	7.35KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.01KB	114.64KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	173.10KB	47.96KB
fields (index.js)	238.89KB	60.02KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.85KB	12.89KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.60KB	44.82KB
plugin-dashboard (index.js)	133.48KB	34.49KB
plugin-designer (index.js)	212.80KB	43.15KB
plugin-detail (index.js)	245.29KB	62.39KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	131.78KB	32.19KB
plugin-gantt (index.js)	165.16KB	40.33KB
plugin-grid (index.js)	201.66KB	54.58KB
plugin-kanban (index.js)	53.11KB	14.62KB
plugin-list (index.js)	112.86KB	27.54KB
plugin-map (index.js)	20.09KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.51KB	11.94KB
plugin-timeline (index.js)	26.72KB	7.71KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	85.87KB	21.12KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	65.97KB	21.98KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	2.44KB	1.21KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.72KB	2.24KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped