[objectstack-fleet]

Requested by Tesla · project thread

Fixes #25332

Clause-②: no
Metadata-protocol: none

What changed

Setup forms showed machine values where an administrator expects labels. This PR fixes the declarations that produce them. The stored values do not change.

Form	Field	Producer	Fix
Business Units	Kind (cost_center …)	packages/platform-objects/src/identity/sys-business-unit.object.ts	bare-string options become { value, label }
Sharing Rules	Recipient Type (business_unit, unit_and_subordinates …), Access Level (read, edit)	packages/plugins/plugin-sharing/src/objects/sys-sharing-rule.object.ts	same
(same vocabulary)	Recipient Type, Access Level on sys_record_share	packages/plugins/plugin-sharing/src/objects/sys-record-share.object.ts	same, see below
Datasources	field label autoMigrate	packages/spec/src/data/driver/{sqlite,postgres,mysql}.zod.ts	the key gains .meta({ title: 'Auto-migrate schema' })

• Field.select([...strings]) makes each label equal to its string, so a snake_case value is shown as-is. The options now carry English labels. The Recipient Type labels are the ones its help text already used ("Business unit and subordinates", "Field").
• The en translation bundles are regenerated (node scripts/check-i18n-bundles.mjs --write). The existing zh-CN, ja-JP and es-ES option translations were already present and are kept unchanged.
• Where the producer sits, and why: the dispatch expected the autoMigrate label on a datasource object. Measured, it is the driver-config JSON Schema in packages/spec: the console's datasource form labels each config row with the property's title and falls back to the raw key, and autoMigrate was the one SQL-driver key without a title. So the fix is at the spec producer, never a renderer fallback.
• In-place fix of sys_record_share: recipient-vocabulary-consistency.test.ts holds one rendering per option key across both sharing objects, so labelling the rule's options alone turns it red. The record share gets the same labels. This is the same defect class with a mechanical fix and the same gate family; the claim's file surface did not name this file, and the seat is told.

Pins (one per declaration)

• packages/platform-objects/src/identity/business-unit-kind-option-labels.test.ts: values unchanged, no label equals its value.
• packages/plugins/plugin-sharing/src/sharing-rule-option-labels.test.ts: the same for both fields on both sharing objects, plus the help text naming labels the select shows.
• packages/spec/src/data/driver/config-registry.test.ts: the autoMigrate JSON-Schema title on sqlite, postgres and mysql.

Verification (head ce8bac22)

• pnpm --filter @objectstack/spec exec vitest run src/data/driver/config-registry.test.ts: 39/39.
• pnpm --filter @objectstack/platform-objects test: 89 files, 1320 tests passed.
• pnpm --filter @objectstack/plugin-sharing test: 54 files, 1209 tests passed. The first run, before sys_record_share was labelled, failed recipient-vocabulary-consistency.test.ts as described above.
• typecheck for spec, platform-objects, plugin-sharing: exit 0.
• pnpm --filter @objectstack/spec check:generated: all 14 artifacts up to date.
• dispatch-gates --commands: 91 derived, 89 exit 0, 2 NOT MEASURED (exit 3, prerequisites): check-plugin-teardown-shape.mjs --self-test needs an unshallowed clone; check:dual-build-cjs-loads needs every package's dist/. CI runs both.

Acceptance notes

• Not in this PR, objectui: "Display name* name" is objectui's packages/app-shell/src/views/metadata-admin/SchemaForm.tsx. It renders the field key in a code chip beside the label whenever the label is not the prettified key. The Packages form takes its labels from objectui's package-schema.ts, so no declaration here produces it. The seat files the objectui card.
• Not in this PR, objectui: the datasource form (objectui datasource/DatasourceResourcePage.tsx) renders enum options by raw value, so autoMigrate's options still read off / safe. JSON Schema has no option-label channel for it to read.
• The datasource config titles are English only: the form reads them straight from the JSON Schema, and no translation path covers driver-config titles.
• Other driver-config keys with no title, which render their raw key wherever the form shows them: memory initialData / strictMode / persistence, mongodb options, turso encryptionKey / sync / timeout. They are not on the four forms the card names.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01QUKVainSF9Fx4YDaSPyE64

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/plugin-sharing, @objectstack/spec, touching 12 documentable anchor(s).

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via MysqlConfigSchema (symbol, a top-level const), PostgresConfigSchema (symbol, a top-level const), SqliteConfigSchema (symbol, a top-level const))
• content/docs/data-modeling/objects.mdx (via sys_record_share (symbol, a field of const object enObjects), business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule))
• content/docs/deployment/validating-metadata.mdx (via business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule))
• content/docs/kernel/runtime-services/sharing-service.mdx (via unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/administrator-guide.mdx (via sys_business_unit (symbol, a field of const object enObjects), cost_center (literal, a string literal in SysBusinessUnit; a string literal in sys_business_unit), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/authorization.mdx (via sys_business_unit (symbol, a field of const object enObjects))
• content/docs/permissions/delegated-administration.mdx (via sys_business_unit (symbol, a field of const object enObjects))
• content/docs/permissions/index.mdx (via business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/permissions-matrix.mdx (via sys_business_unit (symbol, a field of const object enObjects), sys_record_share (symbol, a field of const object enObjects), business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/positions.mdx (via sys_business_unit (symbol, a field of const object enObjects), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/sharing-rules.mdx (via sys_business_unit (symbol, a field of const object enObjects), sys_record_share (symbol, a field of const object enObjects), sys_sharing_rule (symbol, a field of const object enObjects), business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/permissions/system-context.mdx (via sys_record_share (symbol, a field of const object enObjects), sys_sharing_rule (symbol, a field of const object enObjects))
• content/docs/plugins/packages.mdx (via sys_record_share (symbol, a field of const object enObjects))
• content/docs/protocol/objectql/security.mdx (via sys_business_unit (symbol, a field of const object enObjects), sys_record_share (symbol, a field of const object enObjects), business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))

⛔ 10 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/releases/v13.mdx (via sys_business_unit (symbol, a field of const object enObjects), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/releases/v14.mdx (via sys_record_share (symbol, a field of const object enObjects))
• content/docs/releases/v15.mdx (via sys_record_share (symbol, a field of const object enObjects))
• content/docs/releases/v16.mdx (via sys_business_unit (symbol, a field of const object enObjects), sys_record_share (symbol, a field of const object enObjects))
• content/docs/releases/v17/17-0.mdx (via PostgresConfigSchema (symbol, a top-level const), sys_sharing_rule (symbol, a field of const object enObjects), business_unit (literal, a string literal in SysSharingRule; a string literal in sys_sharing_rule), unit_and_subordinates (literal, a string literal in SysRecordShare; a string literal in SysSharingRule; a string literal in sys_record_share; a string literal in sys_sharing_rule))
• content/docs/releases/v17/17-1.mdx (via sys_record_share (symbol, a field of const object enObjects), sys_sharing_rule (symbol, a field of const object enObjects))
• content/docs/releases/v17/17-3.mdx (via sys_record_share (symbol, a field of const object enObjects))
• content/docs/releases/v17/17-4.mdx (via sys_business_unit (symbol, a field of const object enObjects))
• content/docs/releases/v17/index.mdx (via sys_record_share (symbol, a field of const object enObjects))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 144 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fb63d396b15c91f3f16041817e9934e2dea93759 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from f10aacb63ce880f89ff694d3edc2b2578b0bbb23 — the merge of head ce8bac225cbd15a8bc54bf827f9ded34e8a7ed12 into base fb63d396b15c91f3f16041817e9934e2dea93759, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f10aacb63ce880f89ff694d3edc2b2578b0bbb23 && git checkout f10aacb63ce880f89ff694d3edc2b2578b0bbb23
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fb63d396b15c91f3f16041817e9934e2dea93759 ce8bac225cbd15a8bc54bf827f9ded34e8a7ed12 && git checkout -B drift-repro fb63d396b15c91f3f16041817e9934e2dea93759 && git merge --no-ff ce8bac225cbd15a8bc54bf827f9ded34e8a7ed12

node scripts/docs-audit/affected-docs.mjs --json fb63d396b15c91f3f16041817e9934e2dea93759

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fb63d396b15c91f3f16041817e9934e2dea93759 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Seat note · domain:engine seat 1 · 2026-10-23T05:10Z · head ce8bac225: one re-run of Test Core (6/6).

The failing check is Test Core (6/6), run 39900440393, job 120240673884, and the only failed task is @objectstack/metadata-protocol#test. The seat judges it a flake on this evidence:

• The dev reproduced the suite twice and got green both times. The first run was on this branch's tree: 261 files passed, 3 skipped; 21447 tests passed. The second was on current origin/main 448374d3 merged with this head, the tree CI tests, and it gave the same numbers.
• metadata-protocol does not depend on platform-objects or plugin-sharing. Its only link to this diff is the spec driver-config title meta, and both green runs include that change.
• The shard was heavily loaded: runtime's suite alone took 1087 s in it. The failing test's name can't be recovered from here, because the log API returns only the last 5k lines and the log blob host refuses this container.

The seat re-runs the failed jobs once through the relay. A second failure is real and goes back to the dev with the FAIL lines.

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:engine seat 1 · os-tesla · session_014Hse9cj2i4o5UAVrd21NKr · 2026-10-23T05:39Z · head ce8bac225 · #25332 (Fixes)

• Shape: 12 files, +182 / −36:

  • sys_business_unit.kind, and sys_sharing_rule recipient_type / access_level, become { value, label } options. The stored values are unchanged.
  • The same labelling is applied to sys_record_share.
  • The spec driver configs (postgres / mysql / sqlite .zod.ts) gain a .meta({ title }).
  • Regenerated en bundles, three pins, and a patch changeset.

  Read from the diff. NOT GOVERNED, under the 3000-line threshold. Clause-② no: display labels only, with no authorable key added.

• Cross-lane: the spec driver titles were declared on [PM seat] domain:spec · seat 2 — ⏳ vacant #18549 and plugin-sharing on [PM seat] domain:services — 🟢 os-sales #6021. No objection was posted.

• Gates: 42 check-runs on ce8bac225 (latest attempts): 35 success, 7 skipped, 0 failed. Attempt 1 of Test Core (6/6) failed only in @objectstack/metadata-protocol#test. The dev reproduced that suite green twice, on the branch and on main merged with the head, and it has no dependency on this diff's packages. The seat recorded the flake reading (6357904363) and re-ran it once, and attempt 2 is green.

• Pins: sharing-rule-option-labels.test.ts, business-unit-kind-option-labels.test.ts and the driver config-registry title pin all assert labels over unchanged stored values.

• Accepted deviation: sys_record_share was labelled in place, outside the dispatched list, so that recipient-vocabulary-consistency.test.ts stays green. It was declared on [PM seat] domain:services — 🟢 os-sales #6021 with this card.

• Out of scope, the seat files: two objectui renderer items the dev found. The SchemaForm machine-key chip and the raw enum options on DatasourceResourcePage are separate objectui cards.

• Serial: Setup field help is written for developers ("Foreign key to sys_user.id", "via isGrantActive", "(P3 digest middleware)", "Reaper / Rotator / Archiver") and shows inert fields — rewrite it for admins and hide Last Certified At (hotcrm#2194 T2-U02) #25331 (PR fix(platform-objects, plugin-security, plugin-approvals, service-messaging, objectql): Setup field help is written for administrators, and the inert access-review fields are hidden #25377, queued) regenerates the same platform-objects bundles. If the queue reports a conflict, this branch merges main and re-runs the generator.

• Landing: the seat marks it ready and enables auto-merge; the merge queue lands it.

---

Generated by Claude Code