fields: a file the reader may not open arrives as { id, metadataRefused: true } (objectstack#22593) and still shows a generic file chip — show a restricted state (the objectui half, after #12030)

Filing gate ④ a coordination node: the objectui half of objectstack-ai/objectstack#22593 (PR objectstack-ai/objectstack#22620 → 02d9f69e5a, on the 18 next line). It was filed by objectui domain:ui seat 1 (seat post #5560, session_01CsyMRsFJBKNEMa4oPY1b5z) under the seat's judgment Q7 in record 6148150305 on #12030.

Reader (who acts): the objectui domain:ui lane, once objectui#12030 lands. Until then @object-ui/* resolves spec 17, which has no marker.
Dedupe: MCP search_issues in objectui, closed included, for file field metadataRefused restricted state FileValueView sys_file read refused file chip: 0 hits.
⛔ Not a claim. For triage to grade.

What the platform now sends

When the caller may read a record but is refused sys_file read, a file field's expanded read form is { id, metadataRefused: true }. It used to be the bare id, which the console could not tell from "no file".

@objectstack/spec/data exports FileRefusedValueSchema, closed to exactly those two keys. The seat read it in the published 18.0.0-next.0 tarball (src/data/field-value.zod.ts).
The stored form is unchanged.
objectql: a file field's metadata follows the parent-derived verdict the download door applies — hydrate a field-owned file for a reader refused sys_file read (ruling B on #22624) objectstack#22637 (ruling B on [Decision] should a file field's sys_file metadata (name, size, type) follow the holding record's read, as the download door and attachment rows already do? (access half of #22593) objectstack#22624) will next hydrate a file the record itself owns, even for such a reader. After that, the marker remains only for ids the record does not own.

What objectui does with it today

readFileValue (packages/fields/src/widgets/file-value.ts) takes the marker through its object arm. It keeps the id, builds the URL from it, falls back to the name 'File', and sets no mimeType. metadataRefused is not carried onto FileValueView. So the console shows a generic file chip, never EmptyValue, and the refusal never reaches the screen. The engine seat's consumer note is comment 6095969443 on #12030.

Ask

The file renderers show a distinct restricted state for metadataRefused: true: the FileField read-only list, FileCell, ImageField, AvatarField and the grid cell.

No thumbnail is attempted, because no MIME type is known.
The open/download affordance stays on the id-derived endpoint. That door decides on its own and may answer 403 FILE_DOWNLOAD_DENIED.
The editable widget still submits only the bare id (fileIdOf reads id), never the marker object.
Pins on a real render: the marker shows the restricted state in each renderer, and a normal file value is unchanged.

Restart when

objectui#12030 has merged, so objectui resolves @objectstack/spec 18 (18.0.0-next.0 carries FileRefusedValueSchema).

Generated by Claude Code

Claim: PM loop round 1
Session: session_01XVp19E1MYUTFM3dnkwz8gB
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12339-file-restricted-state
Worktree: objectui-issue-12339
Domain: domain:ui
Seat: domain:ui#2
File surface: packages/fields/src/ (widgets/file-value.ts, the file, image and avatar renderers, and the file grid cell) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui reads no path-derived mandate)
Clause-②: yes
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: none. No other domain:ui card is on pm:dispatched, and objectui has no open PR except Dependabot and the release PR #11600 (read 2026-10-14T05:28Z). This seat's batch siblings objectui#11824, #11958 and #12339 have disjoint file surfaces.

Generated by Claude Code

os-dev-report

{
  "issue": 12339,
  "status": "done",
  "branch": "claude/issue-12339-file-restricted-state",
  "pr": "https://github.com/objectstack-ai/objectui/pull/12354",
  "session": "session_01XVp19E1MYUTFM3dnkwz8gB",
  "premise_still_valid": true,
  "summary": "readFileValue now recognises the marker { id, metadataRefused: true } with the spec's own closed FileRefusedValueSchema and returns a FileValueView with metadataRefused: true, the id, the id-derived url and no mimeType. FileValueView gains the optional metadataRefused?: true, which is the only change to the published surface. A shared RestrictedFileAffordance draws a lock and the translated 'Restricted file' label as a link to the id-derived endpoint, and FileValueAffordance routes restricted views to it. FileCellRenderer (the file/video/audio grid cell), the FileField read-only list and edit rows, FileCell, ImageField (read-only and editable: lock tile, left out of the lightbox, no crop), ImageCellRenderer (the image/avatar grid cell) and AvatarField (lock in place of the initials, no image request) all draw the restricted state and never a thumbnail. When FileField, FileCell and ImageField re-submit the field's other values on append, remove or crop, the marker goes back as its bare id, through the new non-barrel file-refused.ts. Two keys were added (fields.file.restricted and fields.file.restrictedHint) in all 10 locales, plus a docs paragraph in content/docs/fields/file.mdx and image.mdx. PM assumptions measured: A1 holds (installed spec 18.0.0-next.0 exports FileRefusedValueSchema from @objectstack/spec/data, closed to id + metadataRefused literal true; a probe showed an extra key and metadataRefused false are both rejected). A2 holds (the marker went through the object arm and metadataRefused was dropped). A3 holds (git grep metadataRefused over packages and apps at b9814b3 returned 0 hits).",
  "tests": "All runs at HEAD 69e78f2. Code is unchanged since a99aa7e; b12f5fd added the changeset and 69e78f2 the docs. New test file packages/fields/src/__tests__/fileRestrictedState-12339.test.tsx: 22 passed, all on real renders. Ablation, run after the fix was committed, through objectstack scripts/ablation-replace.mjs under a trap-restore: (1) readFileValue marker arm disabled (anchor x1 to x0, blob fdbd7c6 to 99d92aa): 14 failed, 8 passed. Every render pin went red; the 8 still green were the controls and the re-submit pins. Restore: blob == HEAD, git diff HEAD empty. (2) fileValueForResubmit returning the value unchanged (blob 32f307c to cead5d8): 3 failed, 19 passed, exactly the 3 re-submit pins. Restore verified the same way. Both ablations are src-resolved through relative imports, so no dist was involved. Gates, each with its exit code: pnpm --filter @object-ui/fields type-check 0; pnpm --filter @object-ui/i18n type-check 0 (the first attempt was exit 99, a queue timeout, NOT MEASURED; the retry was 0); vitest over 28 targeted fields test files (file/image/avatar/upload/cellRenderers/emptiness/signature/spec-symbol) 0 with 455 passed; vitest packages/i18n/ 0 with 1321 passed and 13 skipped; check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, new-line-citations and i18n-dead-keys all 0; node scripts/check-changeset-fixed.mjs, check-changeset-presence.mjs and check-changeset-no-major.mjs all 0; a control-byte grep over the changed files found no hits; eslint --no-inline-config on the 8 touched fields files plus the 10 locale files gave 0 errors. On the 6 fields files that also exist at base, warnings went from 162 to 163 (one react-refresh/only-export-components for the exported useRestrictedFileText hook in file-affordance.tsx); the new test file adds 14 no-explicit-any warnings. Clause-2 was measured on the built closure: dist/index.d.ts re-exports widgets/file-value.js, which now declares metadataRefused?: true on FileValueView; isFileRefusedValue, fileValueForResubmit, RestrictedFileAffordance and useRestrictedFileText have 0 hits in dist/index.d.ts. The surface did widen, so the changeset is minor for @object-ui/fields and @object-ui/i18n. NOT MEASURED: the full packages/fields suite (killed by the foreground cap, exit 124, on a contended box; declared to CI); repo-wide pnpm lint (narrowed to the touched files; the eslint config is not type-aware and the only custom rule that reads disk, no-line-address-in-test-name, reads its own file); the --pair exit code (that sweep was retired, see open_questions).",
  "mcp_calls": "0",
  "api_writes": "3 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches, 204 each), which executed as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectui/pulls (draft) + POST /repos/objectstack-ai/objectui/issues/12354/assignees; POST /repos/objectstack-ai/objectui/issues/12354/labels (needs:contract-review); POST /repos/objectstack-ai/objectui/issues/12339/comments (this os-dev-report). git push is not counted.",
  "gates": "type-check fields 0 · type-check i18n 0 (after one exit-99 queue timeout) · vitest fields targeted 28 files 0 (455 passed) · vitest packages/i18n 0 · 16 check:* scripts 0 · 3 changeset scripts 0 · eslint touched files 0 errors · full fields suite NOT MEASURED (exit 124, foreground cap) · pnpm lint repo-wide declared to CI",
  "line_budget": "n/a: no skills/** touched",
  "files_changed": "packages/fields/src/widgets/file-value.ts, packages/fields/src/widgets/file-refused.ts (new), packages/fields/src/widgets/file-affordance.tsx, packages/fields/src/widgets/FileField.tsx, packages/fields/src/widgets/ImageField.tsx, packages/fields/src/widgets/AvatarField.tsx, packages/fields/src/index.tsx, packages/fields/src/__tests__/fileRestrictedState-12339.test.tsx (new), packages/i18n/src/locales/{ar,de,en,es,fr,ja,ko,pt,ru,zh}.ts, .changeset/12339-file-restricted-state.md (new), content/docs/fields/file.mdx, content/docs/fields/image.mdx",
  "deviations": "(1) Outside the claim's file surface: packages/i18n/src/locales (the two new keys the dispatch asked for) and content/docs/fields (AGENTS.md #2 docs-driven). (2) The full fields suite was narrowed to 28 targeted files after the cap killed it (exit 124); declared, CI runs the full suite. (3) A one-off baseline worktree at b9814b3 (node_modules symlinked) was used only to count eslint warnings at base; it has been removed.",
  "open_questions": [
    {
      "question": "Dispatch conflict on the clause-2 label: the order said to hang needs:contract-review and read the --pair exit code. In objectstack, clause2-line.mjs's header records that ruling 5770886272 on objectstack#19061 retired both the label gate and the --pair sweep (check-clause2-carriers.mjs is deleted). objectui's scripts/check-governed-queue-guard.mjs still refuses a merge group whose PR carries the label (exit 6). I hung the label as ordered, and --pair is NOT MEASURED because the tool no longer exists. Should the seat keep using this label in objectui?",
      "options": [
        "A: keep it; the seat removes needs:contract-review from PR 12354 after its review, or the queue refuses the PR",
        "B: treat the label as retired in objectui as well; the seat removes it now, and a follow-up aligns objectui's guard with the objectstack ruling"
      ],
      "recommendation": "A for this PR, because objectui's guard is live today and reads the label. Whether objectui follows the objectstack retirement is a separate question for the maintainer."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted in the PR's Acceptance notes, not filed · plugin-list ObjectGallery's cover reads readFileValues(raw)[0]?.url, so a refused image may request the id endpoint the door refuses; it can now check view.metadataRefused · not reproduced against a live server · dedupe words: ObjectGallery cover metadataRefused restricted image",
    "carrier: none (承接者:无) · noted in the PR's Acceptance notes, not filed · the multiple-file append in FileField/FileCell/ImageField still passes an already-expanded { id, name, size, mimeType, url } element back raw beside the new id, a read form at a stored position; this predates the PR, which reduces only the refused marker · not measured against a strict server · dedupe words: file append expanded object resubmit stored form",
    "carrier: none (承接者:无) · noted in the PR's Acceptance notes · the record header's recordPictureUrl (components containers.tsx) gets no url from the marker and draws no picture, while the image cell draws a restricted lock; this is not a broken image, and the parity pin file-value.recordChromeParity-11383 has no marker fixture"
  ]
}

Generated by Claude Code

Review: ACCEPT — objectui PR #12354 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:32Z

Reviewed on GitHub at head 69e78f216a, against the card, not against the dev's report.

Shape: the PR is a draft against main, and its body opens Fixes #12339 (the only closing keyword). Clause-②: yes matches the claim. The governed sweep reads NOT governed, 673 lines.
Contract review of record: 6163264839 on the PR, PASS at this head, with Served-tier: CONTRACT_REVIEW_TIER. The published widening is FileValueView.metadataRefused?: true, plus two keys on @object-ui/i18n's packs (and so on TranslationKeys). Both packages carry a minor changeset. RestrictedFileAffordance, useRestrictedFileText and file-refused.ts are not reachable from either entry. needs:contract-review is removed from the PR in the same stroke.
The card's asks are met on a real render:
- each named renderer draws the restricted state;
- none draws a thumbnail;
- the open link stays on the id-derived endpoint;
- a re-submit sends the bare id.
The pins are in fileRestrictedState-12339.test.tsx (22 tests). The dev ran two ablations, and each turned exactly its pins red.
Prose checked sentence by sentence: the changeset's four bullets, the file.mdx "Restricted files" paragraph and the image.mdx sentence all match the diff.
CI at head: all success or skipped, except the advisory Spec Main Shape Gate. Its 21 annotations sit on resolveDataSource.ts, useViewData.ts and .github, the same signature as main's run 38513810543. That is the base's red (objectui#12325, in flight).
The dev's open question (keep needs:contract-review in objectui): answer A. The label is the waiting marker on the PR, and the seat that adopts the PASS removes it, as done here.
Acceptance notes kept in the PR body, not filed: the ObjectGallery cover, the raw re-submit of an expanded element, and the record header picture. None has a measured reach: against a live server, so none passes the filing gate.

Next: pr_ready + automerge_enable.

Generated by Claude Code

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:48Z

Merged: PR feat(fields): a file the reader may not open renders a restricted state (objectui#12339) #12354 merged through the merge queue as main 065a1cf. The card closed completed by its Fixes #12339, which is the PR body's only closing keyword. No other card closed with it.
Verified by content: on origin/main, these files are blob-identical to the accepted, contract-reviewed head 69e78f216a:
- file-value.ts
- file-affordance.tsx
- .changeset/12339-file-restricted-state.md
Label: pm:dispatched is removed in the same stroke as this comment.

Generated by Claude Code

Navigation Menu

Repository navigation

fields: a file the reader may not open arrives as `{ id, metadataRefused: true }` (objectstack#22593) and still shows a generic file chip — show a restricted state (the objectui half, after #12030) #12339

What the platform now sends

What objectui does with it today

Ask

Restart when

Review: ACCEPT — objectui PR #12354 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:32Z

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:48Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fields: a file the reader may not open arrives as { id, metadataRefused: true } (objectstack#22593) and still shows a generic file chip — show a restricted state (the objectui half, after #12030) #12339

Description

What the platform now sends

What objectui does with it today

Ask

Restart when

Activity

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Review: ACCEPT — objectui PR #12354 · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-14T07:32Z

objectstack-fleet commented on Oct 14, 2026

Landed · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-14T07:48Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

fields: a file the reader may not open arrives as `{ id, metadataRefused: true }` (objectstack#22593) and still shows a generic file chip — show a restricted state (the objectui half, after #12030) #12339

Review: ACCEPT — objectui PR #12354 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:32Z

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T07:48Z