[objectstack-fleet]

Fixes #28082

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:只改一条 dogfood 断言。api-action-door-forward 里「关掉 Ban User 后经动作入口调用」那条用例,原来要求 409 提示里出现系统表名 sys_metadata_activation,现在改为要求提示是 meta: GET /meta/object serves which packaged actions are switched off beside the item, and the disabled-action refusal reads as a plain sentence #27842 裁定的白话句子(点名「Setup › Packaged automation」),并且不许出现该表名。
• 为什么改:feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 落地后入口回的是给终端用户看的白话句子,不再点名系统表,这条旧断言因此让 main 的 Dogfood Regression Gate (3/3) 持续变红。产品行为是对的,错的是断言。
• 风险与回滚:仅测试文件,不发布任何包;409、ACTION_DISABLED 代码和「用户没被封禁」三条断言原样保留。回滚即还原本 PR。
• 先看:packages/qa/dogfood/test/api-action-door-forward.dogfood.test.ts 第 176–184 行(唯一改动处)。
• 两分钟验证:pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/api-action-door-forward.dogfood.test.ts(先建依赖闭包),预期 8/8 全绿;在 main 上同一命令预期第 178 行失败。
• 需要你做的:无,席位落地。

What changes

packages/qa/dogfood/test/api-action-door-forward.dogfood.test.ts, the ban_user OFF answers 409 ACTION_DISABLED through the door case. The message assertion that pinned the ledger table name now pins the sentence the engine actually returns (packages/objectql/src/action-activation.ts, describeDisabled, reached through ObjectQL.describeDisabledAction from disabledActionRefusal in packages/runtime/src/action-execution.ts):

• the message starts with This action is turned off for this deployment. ;
• it contains An administrator can turn it on again under Setup › Packaged automation;
• it does not contain sys_metadata_activation.

The 409 status, the ACTION_DISABLED code and the not-banned assertions are unchanged. The shape copies the sibling helper expectDisabledSentence in packaged-action-disabled-dispatch-live.dogfood.test.ts, which #27964 already flipped.

This is a deliberate pin flip. Nothing is skipped, marked todo, retried or quarantined.

Tests

The same file, run both ways under the verify lock after building the dogfood dependency closure (pnpm --workspace-concurrency=2 --filter '@objectstack/dogfood^...' build, VERDICT command-exit 0).

Before the flip (origin/main f6adf48): exit 1, fails at L178

× the switch holds: ban_user OFF answers 409 ACTION_DISABLED through the door and the user is NOT banned
AssertionError: expected 'This action is turned off for this de…' to contain 'sys_metadata_activation'
Expected: "sys_metadata_activation"
Received: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or you can use another action."
 ❯ test/api-action-door-forward.dogfood.test.ts:178:50
 Test Files  1 failed (1)
      Tests  1 failed | 7 passed (8)
os-verify-lock: VERDICT command-exit 1

After the flip (1b2c59b): exit 0

 Test Files  1 passed (1)
      Tests  8 passed (8)
os-verify-lock: VERDICT command-exit 0

Typecheck

pnpm --filter @objectstack/dogfood run typecheck: VERDICT command-exit 0. tsc --noEmit --listFiles in the package lists the edited test file (1 hit), so the typecheck covers it.

Acceptance notes

• Grep of packages/qa/dogfood for other refusal-message pins on sys_metadata_activation or on the pre-meta: GET /meta/object serves which packaged actions are switched off beside the item, and the disabled-action refusal reads as a plain sentence #27842 wording (is disabled —, activation ledger, Re-enable the packaged action, author your own action): none besides L178. The other sys_metadata_activation hits are ledger-table reads (const LEDGER, ql.find(...), SQL fixtures). packaged-action-disabled-dispatch-live already pins the new sentence. packaged-activation-ledger-reach and mcp-system-object-action-exposure assert only the code and status.
• The dogfood shards do not run on pull_request or merge_group. This PR's first CI dogfood reading is main's push battery after the merge. The local before/after readings above are the evidence for this file.

Verification

Local subset at 1b2c59be8f (git rev-parse --short HEAD), derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (51 commands, exit 0). Each command's exit code was written to disk before any pipe.

• 50 of 51 exit 0.
• pnpm check:dual-build-cjs-loads exits 3, PREREQUISITE NOT MET. It reads every package's built dist/, and seven packages outside this diff's closure have none. NOT MEASURED locally, reason: no full workspace build. CI's Lint & Repo Gates runs it.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran.list exits 0 and reconciles: 51 derived famil(ies) accounted for — 50 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3).

No changeset: the diff changes one test file in a private package (@objectstack/dogfood, "private": true) and publishes nothing, hence skip-changeset. The families CI runs over the whole tree, the type-check lanes and test:repo are left to this PR's check-runs.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a → packageMentionDocs.

[objectstack-fleet]

domain:devx#2 · os-justin · session_01QSeKYmTYfaPbLQD4BJfomW

席位核对 — ACCEPT · domain:devx#2 · head 1b2c59be8f · 2026-10-30T12:53Z

维护者速读

• 改了什么：dogfood 测试 api-action-door-forward.dogfood.test.ts 里有一条断言要求「action 已关闭」的报错消息含有账本表名 sys_metadata_activation，现在改为按 meta: GET /meta/object serves which packaged actions are switched off beside the item, and the disabled-action refusal reads as a plain sentence #27842 裁定的句子判：消息以「This action is turned off for this deployment.」开头，写明管理员可以去 Setup › Packaged automation 重新开启，并且不含表名。409、ACTION_DISABLED 和「用户没被封禁」三条断言不变。
• 为什么改：feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 合入后，main 的 Dogfood Regression Gate 3/3 每次必红（p0 锚卡 main red (Dogfood Regression Gate 3/3) since 3e0fd7a8 (#27964): the api-action door dogfood pin still expects sys_metadata_activation in the disabled-action sentence that #27842 rewrote #28082）。产品行为是对的，过时的是测试里这条断言。
• 风险与回滚：只改一个测试文件（+6/−1），不动产品代码。回滚 = 还原本 PR。
• 先看：L178 那几行。
• 两分钟验证：本地跑 pnpm --filter @objectstack/dogfood exec vitest run test/api-action-door-forward.dogfood.test.ts：改前 1 个失败、7 个通过，改后 8 个全过。
• 需要你做的：无。席位落地。

席位意见：合入。这是止血用的有意翻转断言，不是跳过测试；新断言还多了一层保护：表名不许再出现在给最终用户的句子里。合入后由 main push 的 dogfood 分片给出 CI 证明。

Shape: draft → main, Fixes #28082. 1 file, +6/−1. Label skip-changeset. Non-governed; the seat lands it. Report 6523001281, claim 6522157979. The PR assignee is os-justin, the card's assignee: os-dev.md wins over the dispatch's "no assignees", and the seat accepts that deviation.

Checked against the code:

• Sentence: describeDisabled at packages/objectql/src/action-activation.ts:311-315 returns "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or you can use another action." The runtime's disabledActionRefusal (action-execution.ts:~990) carries it to the door.
• Only message pin: the seat's own grep at claim and the dev's wider grep (old-sentence fragments included) both find L178 as the only refusal-message pin in packages/qa/dogfood. Every other sys_metadata_activation hit is a ledger-table read. packaged-action-disabled-dispatch-live already pins the new sentence.
• Two directions: at f6adf4800e (main), the file exits 1 at :178:50 and receives the ruled sentence (1 failed, 7 passed). At 1b2c59be8f it exits 0 (8/8).

Gates: on head 1b2c59be8f, 51 check-runs: 33 success, 18 skipped, 0 failure; mergeable_state: clean. check-expected-skips --pr 28095: OK, all 18 skips are in main's roster (exit 0). check-governed-merges --pr 28095: NOT governed, 7 changed lines. Dev's union: 51 derived, 50 run (exit 0), 1 NOT-MEASURED (check:dual-build-cjs-loads exit 3, no dist for 7 packages outside the closure; CI's Lint & Repo Gates ran it green). The dogfood typecheck exits 0 and lists the edited file.

Out of scope: none. Skills-docs: n/a (Metadata-protocol: none).

Landing: non-governed, 7 changed lines. In this act the seat readies the PR and arms auto-merge. Dogfood shards do not run on pull_request or merge_group by design, so the proof is main's push run after the merge: the seat reads Dogfood Regression Gate (3/3) there before it calls main green. On merge, Fixes #28082 closes the card.

---

Generated by Claude Code