[objectstack-fleet]

Requested by Elon · project thread

Fixes #27858
Fixes #27859
Fixes #27863
Part of #27869

Clause-②: no
Metadata-protocol: none
Skills-docs: none — git grep of skills/** and content/docs/** for the four touched strings ("temporary password was generated", "copy it now", "Preferred language for this user", all_users) has zero hits.

维护者速读

• 改了什么：设置 → 用户的四处界面文案与布局：创建用户/设置密码的结果框只在生成了临时密码时才提示「立即复制」；用户详情页显示已保存的语言和封禁状态与原因；用户列表加「已封禁」「平台角色」两列；「语言」字段的说明改为它决定界面语言（四种语言包同改）。
• 为什么改：HotCRM 18.2.0 设置走查发现管理员看到的是错的或缺的状态：手输密码后仍被要求复制不存在的密码、被封禁的用户看起来正常、列表上认不出封禁用户和管理员、语言说明只说通知。
• 风险与回滚：只改 platform-objects 的 sys_user 元数据、详情页定义和翻译包，无契约、无存储、无接口变化；回滚即还原本 PR。
• 先看：packages/platform-objects/src/identity/sys-user.object.ts（结果框与列表列）、packages/platform-objects/src/pages/sys-user.page.ts（Details 分区）、packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts。
• 两分钟验证：pnpm --filter @objectstack/platform-objects exec vitest run --maxWorkers=2 src/identity/create-user-result-dialog-copy.test.ts src/pages/sys-user-details-tab.test.ts src/identity/sys-user-list-status-role-columns.test.ts src/identity/sys-user-locale-help.test.ts，预期 4 个文件全绿。
• 需要你做的：无，席位落地。

What changes

One commit per card, all on the platform's own sys_user metadata in @objectstack/platform-objects:

1. Setup → Create User with a typed password still shows "If a temporary password was generated, copy it now" (#27521 row 12) #27858 — Create User / Set Password result. Both result dialogs drop their dialog-level description ("If a temporary password was generated, copy it now — it is shown only once and never stored."). ActionSchema.resultDialog has no per-outcome copy, so that sentence showed on both outcomes, including a typed password, where nothing was generated. The instruction is now the label of the temporaryPassword field ("Temporary password: copy it now, it is shown only once and never stored"). The dialog skips a field whose path is absent from the response, and the endpoint returns temporaryPassword only when it minted one, so the line shows exactly when there is a password to copy. The zh-CN, ja-JP and es-ES packs carry the same change (description leaves dropped by pnpm i18n:extract, field labels translated by hand).
2. Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859 — user record, Details tab. The details renderer draws only authored sections, and none named locale, while banned, ban_reason and ban_expires were in hideFields. locale joins the Identity section, and a new Account Status section (inline labels in all four locales) carries banned, ban_reason and ban_expires.
3. Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863 — Users list. all_users gains banned and role columns after email_verified.
4. French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869 (part) — Locale help. sys_user.locale's help now says it is the language the user sees the interface in as well as their notifications (the console applies it to the whole UI through useUserLocale). Source and all four shipped packs.

What this PR does not carry, and who does

• French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869 stays open (Part of). Seat ruling in the seat-1 thread: (a) the English "Invalid password" refusal is a plugin-auth refusal, and it goes with Create User with Email empty says "Either email or phoneNumber is required" and the dialog marks nothing required (#27521 row 10) #27857's PR; (b) French sys_user labels need French as a fifth platform locale (platform-objects ships en / zh-CN / ja-JP / es-ES only, and HotCRM declares the same four), and the silent fallback is service-i18n's. Both are reported as findings for the seat to file.
• The role label (Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859 / Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863 "reads through its label"). sys_user.role stays Field.text, so the highlight and the new Role column show the stored value (user, admin). A label needs Field.select, which changes the column the SQL driver emits (text gives TEXT; select falls to the default varchar(255)), and schema-drift would read existing deployments as a narrow_varchar. Seat ruling A: this half is carried by its own card, which the seat files at ACCEPT.

Tests

• New pins: sys-user-list-status-role-columns.test.ts (Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863), sys-user-locale-help.test.ts (French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869). Rewritten: create-user-result-dialog-copy.test.ts (Setup → Create User with a typed password still shows "If a temporary password was generated, copy it now" (#27521 row 12) #27858, both actions, all four packs). Extended: sys-user-details-tab.test.ts (Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859).
• pnpm --filter @objectstack/platform-objects test: Test Files 102 passed (102), Tests 1445 passed (1445). typecheck: exit 0.
• Ablations (one per row, each through scripts/ablation-replace.mjs, restored to the HEAD blob, git diff HEAD empty afterwards):
  • Setup → Create User with a typed password still shows "If a temporary password was generated, copy it now" (#27521 row 12) #27858: set_user_password regains a description → set_user_password: no dialog-level description red (1 failed / 8 passed).
  • Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859: locale dropped from the Identity section → 2 failed / 3 passed.
  • Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863: banned, role dropped from all_users → pins the default list columns red (1 failed / 1 passed).
  • French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869: the old notifications-only source help restored → the source description names the interface red (1 failed / 4 passed).

Acceptance notes

• The role label half (above) and French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869's (a) and (b) halves are reported in the card report for the seat to file or carry.
• role in the new list column reads the raw stored value until the role-label card lands.

Verification

All local readings are on head 24220933.

Derived gate families: 58 of 59 exit 0, 1 NOT MEASURED

• node scripts/pm/dispatch-gates.mjs --commands derived 59 families from the 11 changed paths (merge base bc496bf7d). Each ran after the build closure turbo run build --filter=@objectstack/cli --filter=@objectstack/platform-objects plus the nine other i18n-bundle packages check:i18n names (exit 0).
• 58 families exit 0, including check:i18n, check:i18n-stale-fill, check:page-declaration-shape, check:published-files, check:closing-keyword-parity, check:nul-bytes and check-plugin-teardown-shape --self-test (pinned commit fetched).
• NOT MEASURED: check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET: it needs every package's dist; CI builds the whole tree).
• check:dts-closure and check:sourcemap-no-sources-content swept the 62 built packages only; CI sweeps the whole tree.
• dispatch-gates --ran: "59 derived famil(ies) accounted for — 58 run, 1 NOT-MEASURED", exit 0.
• pnpm lint (eslint . --no-inline-config): exit 0.

CI check-runs on this PR are the authority for every family CI runs.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request. (a seat fold: one card per commit)
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cwXFwjU2YZW2dRuZZt

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects, touching 8 documentable anchor(s).

17 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a.

⛔ 3 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 anchor(s) matched too much of the corpus to be a work list: sys_user (symbol, 48 pages), created_at (literal, 41 pages)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8971c36e034b15126979535d9f6678f912d36607 — the merge of head 476454f599e6c35bdc0d7580a9ef81a27f527177 into base 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8971c36e034b15126979535d9f6678f912d36607 && git checkout 8971c36e034b15126979535d9f6678f912d36607
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a 476454f599e6c35bdc0d7580a9ef81a27f527177 && git checkout -B drift-repro 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a && git merge --no-ff 476454f599e6c35bdc0d7580a9ef81a27f527177

node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk

Seat ACCEPT · PR #28065 · head 476454f599e6c35bdc0d7580a9ef81a27f527177 · 2026-10-30T12:58Z

维护者速读

• 改了什么:设置 → 用户的四处界面:创建用户/设置密码的结果框只在真的生成了临时密码时才提示「立即复制」;用户详情页显示已保存的语言、封禁状态与原因;用户列表加「已封禁」「平台角色」两列;「语言」字段说明改为它决定整个界面的语言(四种语言包同改)。
• 为什么改:HotCRM 18.2.0 设置走查(Setup → Create User with a typed password still shows "If a temporary password was generated, copy it now" (#27521 row 12) #27858、Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859、Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863,French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869 的一部分):管理员手输密码后仍被要求复制不存在的密码,被封禁的用户看起来正常,列表上认不出封禁用户和管理员。
• 风险与回滚:只改 platform-objects 的 sys_user 元数据、详情页和翻译包;无契约、无存储、无接口变化。回滚即 revert。
• 先看:sys-user.object.ts 的结果框与列表列,sys-user.page.ts 的 Details 分区。
• 两分钟验证:设置 → 用户,手输密码创建一个用户:结果框不再提示复制;封禁一个用户:详情页显示封禁与原因,列表「已封禁」列为是。
• 需要你做的:无(按本席落地授权落地)。平台角色列暂显示存储值 user/admin,已另立卡 platform-objects: the Setup user screens show the raw stored platform role (user, admin) because sys_user.role is a text field #28105。

席位核对

• Shape: draft → main, Fixes #27858, Fixes #27859, Fixes #27863, Part of #27869 (fold, one commit per card). 11 files, +194/−66, all packages/platform-objects/src/ plus one changeset. check-governed-merges --pr 28065: NOT governed.
• Declarations: Clause-②: no, Metadata-protocol: none, Skills-docs: none (zero hits for the four touched strings).
• Claims: fold head claim on Setup → Create User with a typed password still shows "If a temporary password was generated, copy it now" (#27521 row 12) #27858; the member claims on Setup → user record: Details hides the saved Locale and ban state, and Platform Role reads lowercase "user" (#27521 row 13) #27859 and Setup → Users list has no Status (banned) or Role column, so a banned user or an admin cannot be spotted from the list (#27521 row 15) #27863 were amended by the seat to the Claim: + Session: + Branch: spelling so the closing-target guard reads them (it was red on the first head for that reason; green now).
• Tests: 4 pins (2 new, 1 rewritten, 1 extended), one ablation per row, each red then restored to the HEAD blob.
• Accepted deviation — PR body correction (the relay cannot re-edit a PR body): Verification reads head 24220933 with "58 of 59, 1 NOT MEASURED". The final head is 476454f5 (a plain merge of origin/main, no other change): platform-objects 1445/1445; all 59 derived families exit 0, check:dual-build-cjs-loads now measured; --ran "59 run, 0 NOT-MEASURED"; pnpm lint exit 0 (card thread readings).
• Gate check-runs on this head: 48, every one success or a path-filter skip, 0 failed — including PR-body guards, Test Core 8/8, Type Check, Lint & Repo Gates, Check Changeset.
• Findings filed at this ACCEPT (seat ruling A in the seat-1 thread): platform-objects: the Setup user screens show the raw stored platform role (user, admin) because sys_user.role is a text field #28105 (the role reads through a label without a storage change: Field.text → select would read as narrow_varchar), i18n: French is not a platform locale, so a user whose locale is fr reads English sys_user labels (Home feed field labels) #28107 (French as a platform locale — French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869 (b)), service-i18n: a missing translation falls back to the fallback locale, then to the key, with no signal #28109 (service-i18n falls back silently — French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869's "loudly" half). French user sees English: "Invalid password", untranslated sys_user labels in Home feed, misleading Locale help (#27521 row 22) #27869 (a), the English "Invalid password", rides Create User with Email empty says "Either email or phoneNumber is required" and the dialog marks nothing required (#27521 row 10) #27857's PR from this thread.
• Landing: non-governed, under the maintainer's landing grant for this seat term (2026-10-30 10:20Z, seat-1 thread). Ready + auto-merge through the relay.

ACCEPT