[objectstack-fleet]

Fixes #25937

Clause-②: no
Metadata-protocol: none

What

A user field's person object is now always sys_user in the console, matching the spec contract from #24952 (PR #25074): FieldSchema refuses a user field whose reference names any object but sys_user, and referenceTargetOf resolves every user field to sys_user whatever the field carries.

• ui/packages/fields/src/index.tsx, UserCellRenderer: the read gate's object was field.reference || 'sys_user'. It is now the constant 'sys_user', and the renderer no longer reads field at all. The JSDoc is rewritten: it said the person's object is "the field's reference".
• ui/packages/fields/src/widgets/UserField.tsx: the picker's target was meta?.reference || 'sys_user'. It is now 'sys_user', with the comment rewritten to match.
• ui/packages/fields/src/__tests__/userCell.readGate-10535.test.tsx: the crm_member case flips. A { type: 'user', reference: 'crm_member' } field is now gated by the sys_user policy, and its drawing is byte-equal to a plain { type: 'user' } field under the same policy. A crm_member policy no longer reaches it. The header bullet and the test title no longer say the person's object is the field's reference. The retired reference_to case is unchanged and still passes.
• scripts/sdui-manifest.record.json: re-recorded with node scripts/gen-sdui-manifest-node.mjs, because ui/packages/fields/src is a registry source the record digests.
• .changeset/25937-user-cell-sys-user.md: @object-ui/fields patch.

The route is the type's constant, not a call to referenceTargetOf. That helper reads the field's reference carrier first and throws when the carrier is unreadable (referenceCarrierOf), so it does not belong in a render path. objectui also does not import the spec's field helpers.

Behaviour change to note: which policy gates a stored foreign reference

The renderer read gate (withoutDeniedFields) is keyed by object name. A stored object saved before the spec refusal can still carry a user field with a foreign reference, for example crm_member. The cell used to gate that field by the crm_member policy. It now gates it by the sys_user policy. That is the object the runtime expands the field into (referenceTargetOf), so the cell now hides exactly what the served row's own object denies. The picker also searches sys_user for such a field now, not the foreign object. This is the card's intent: a link to another object is a lookup.

Verification

All readings were taken at head 11a85a02, after main was merged in at c8cb510a, on a shared box.

• cd ui && pnpm exec vitest run --maxWorkers=2 packages/fields/ under the verify lock: Test Files 277 passed | 1 skipped (278), Tests 4290 passed | 7 skipped (4297), VERDICT command-exit 0.
• pnpm --filter @object-ui/fields type-check (tsc --noEmit && tsc -p tsconfig.test.json; the test config compiles __tests__): VERDICT command-exit 0.
• eslint over the three edited ui files: 0 errors. The 152 warnings were already there.
• Ablation, one leg, with the fix committed first. scripts/ablation-replace.mjs put the old read back in place of const personObject = 'sys_user';, that is field.reference || 'sys_user'. The tool reported the anchor going 1 to 0 and the blob going 2ac4abd3f41c to 644362b7ff75. Result: userCell.readGate-10535.test.tsx 1 failed | 6 passed. The flipped case failed at :164: expected … not to contain 'Amy Lin', because the crm_member field was no longer gated by the sys_user policy. On restore, the blob was back to the HEAD blob 2ac4abd3f41c and git diff HEAD was empty. The green leg at the same head: 7 of 7 passed.
• The test imports ../index (source), so the ablation needs no dist/ rebuild.
• node scripts/gen-sdui-manifest-node.mjs (under the lock, exit 0) re-recorded only inTree.registrySourcesSha256. sdui.manifest.json is byte-identical: sha256 1f6e1ccb925a…, 106 components. node scripts/check-sdui-manifest.mjs passes.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gave 46 commands, and all 46 exited 0. pnpm check:type-check-debt hit a 300 s local timeout on its first run and passed on the rerun, with no surplus. --ran reconciliation: 46 derived, 46 run, 0 NOT-MEASURED, 0 UNRUN.
• node scripts/check-changeset-fixed.mjs: in sync. Its roster sits under .changeset/, which this PR touches.
• Full dogfood: not run. The title has no ! and Clause-② has no (narrowing) arm.

Acceptance notes

• LookupCellRenderer's comment in ui/packages/fields/src/index.tsx still lists UserField among the readers that read reference. That is now stale, because UserField fixes the target. The comment sits outside this card's declared file region (UserCellRenderer only), so this PR leaves it alone. Carrier: none.
• RecordMetaFooter's UserRef (ui/packages/plugin-detail) still builds reference: fieldDef?.reference || 'sys_user' for audit fields. When the field is typed user, the cell renderer now ignores that reference, so nothing visible changes. Observation only.

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:ui seat 2 · session_01SMps7wq7rBTk53e8KTSEup · 2026-10-26T10:14Z · head 11a85a02

1. 形态: draft PR → main, assigned to os-steve. The first content line is Fixes #25937, which is right because the whole card lands here. No other closing keyword appears. Clause-②: no and Metadata-protocol: none each open their own line in the PR body and in the changeset. no is correct: nothing is exported or accepted that wasn't before, and the console now reads the user type the way the spec already defines it (spec(data) 18.x: refuse a user field whose reference names an object other than sys_user, and resolve every user field to sys_user (the refusal half of #24808) #24952).
2. 前提实测: the seat read the diff at this head.
   • UserCellRenderer's person object is the constant 'sys_user' (the field prop is no longer read).
   • UserField normalizes reference: 'sys_user'.
   • A legacy body that still carries a foreign reference is now gated by the sys_user policy. The runtime expands the field into sys_user, so that policy is the right one. This is the narrower reading, and no row of another object is exposed.
   • The flipped crm_member case pins it, and the retired reference_to case is unchanged.
3. 门禁 check-runs: none yet. GitHub reports the PR as mergeable=false / dirty (the manifest record conflicts with main), so no pull_request run has started. Landing waits on a conflict-free head with Lint & Repo Gates and TypeScript Type Check at success, and every other check green.
4. 接受的偏差:
   • The first commit used --no-verify before the clone's hooks were registered (core.hooksPath unset), so no hook was actually skipped. Later commits ran them.
   • The ui tests ran through the ui workspace's vitest. Neither changes the diff.
5. 范围外去向: two observations, both left unfiled.
   • The LookupCellRenderer comment (~L2566) still lists UserField among the readers of reference. It is a stale comment outside the claimed region, and it can ride the next card that edits that region.
   • RecordMetaFooter's UserRef still builds a reference that the cell now ignores. Nothing visible changes.
6. 落地条款: no governed path, +50/−24, root .changeset/ patch for @object-ui/fields. A merge of main that only resolves the conflict and re-records the manifest keeps this ACCEPT.

[objectstack-fleet]

Seat 2 · head update · 2026-10-26T10:53Z

Patch round at head b7b9d521. The seat read the three-dot diff against main.

• Main was merged in (95204415, no rebase), and scripts/sdui-manifest.record.json was re-recorded twice: after the merge and after the plugin-grid edit.
• Amendment 6413913258: RELATIONAL_META_READ_SET.reference readers ALL_THREE → CELL_AND_LOOKUP_EDITOR, a one-line change. It is the only change in relationalMetaKeys.ts, and ObjectGrid.tsx is untouched.
• The file list is the 5 accepted files plus the amended relationalMetaKeys.ts.

The dev ran the derivation test 14/14 locally, the full plugin-grid suite 248/248 files, and check-sdui-manifest exit 0. ACCEPT 6413530615 carries over to b7b9d521. Landing waits on CI being green at this head.

Out of scope, accepted with no carrier: the LookupCellRenderer comment in fields/src/index.tsx (~2566) still lists UserField as a reference reader. It is a stale comment only, so it can be fixed alongside the next card that touches that region.

[objectstack-fleet]

Seat 2 · 2026-10-26T16:44Z · CI red that is not this PR's

Test UI (9/16) fails ui/packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts:161 with expected 48 to be 47 (check-run 121703010847). This PR touches fields, plugin-grid and their records, not app-shell. On main, #26005 added sharing to ObjectSchema, and every ui PR's merge ref fails this guard the same way.

The fix is #26231 (#26218), which is in the merge queue now. Nothing is ported here, so this PR's diff stays as accepted. After #26231 merges, this PR's patch round (in progress) merges main again and CI re-runs.

[objectstack-fleet]

Seat 2 · head update · 2026-10-26T17:18Z

Patch round at head 02986dd2 (was b7b9d521): merge of origin/main at df8aac41, with the record conflict resolved to main's, then a re-record under the lock. Only sources/fields.json and sources/plugin-grid.json move; the global record and sdui.manifest.json are unchanged. No product or test logic changed since the ACCEPT (6413530615).

check	reading
check-sdui-manifest	exit 0 (27 packages)
Console build	exit 0, 71/71 tasks
fields + plugin-grid suites	528 files / 6532 tests passed
dispatch gates	47 derived, 47 run, all exit 0
line	plugin-grid #26030 ✓ → #26033 ✓ → this; fields #26062 ✓ → this
drift	no commit on main touches fields, plugin-grid or their sources records since 81bba6c3; git merge-tree clean
governance	NOT governed, 78 lines

Seat's route: auto-merge. #26217 (#25942 step 2) follows on the plugin-grid line.