[objectstack-fleet]

Requested by Warren · project thread
Fixes #26840

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:Studio 包内的访问矩阵现在也列出该包的草稿对象,并在行上标出「(草稿)」;草稿对象的字段也能展开。
• 为什么改:原来只列已发布对象,新包的对象都是草稿时矩阵显示「0 个对象」,首次发布前无法配置权限。
• 风险与回滚:只改包作用域下的三处读取(对象列表、字段读取两处),环境作用域不变;回滚即 revert 本 PR。
• 先看:PermissionMatrixEditor.tsx 的对象列表读取与 readObjectDefinition;新测试 PermissionMatrixEditor.draftObjects-26840.test.tsx。
• 两分钟验证:pnpm --dir ui exec vitest run packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.draftObjects-26840,预期 5 个测试全绿。
• 需要你做的:无,席位落地。

What changes

• Under a packageId, the matrix lists its objects through MetadataClient.withPreviewDrafts(true) (the ?preview=draft door the object picker's useObjectCatalog uses), so a package whose objects are all drafts lists them instead of "0 objects".
• A row served from its pending draft (_draft: true, the picker's signal) carries the picker's draft mark: a muted data-draft-marker span reading engine.inspector.draftSuffix ("(draft)" / "(草稿)"), in both the page table and the Studio layout. No new marker, no new i18n key.
• The two per-object definition reads (field rows in ensureFields, and loadObjectFields for the RLS and field-condition CEL editors) go through the same door under a packageId, via one helper readObjectDefinition. Without it a draft-only object expands to "no fields".
• Environment scope (Setup catalog, no packageId) keeps the published reads unchanged; only the package door authors drafts. Pinned by a test that asserts no preview read and no draft row there.
• Test doubles that mount the matrix under a package gain withPreviewDrafts() { return this; } (the Studio tests' existing precedent); five typed doubles widen FakeClient to => unknown because that method returns the client, not a promise.

Why

Triage ruling 6450953786: list draft objects too (with preview=draft), badged as drafts, so a new package can be secured before its first publish.

Tests

• New: PermissionMatrixEditor.draftObjects-26840.test.tsx, 5 tests: a draft-only object is listed and badged (page and Studio layouts); a published object has no badge; toggling the draft object's Read writes objects.a_invoice.allowRead into the set draft (mode: 'draft', packageId: 'app.a'); its fields come from its draft; the environment door keeps the published list.
• Scoped run (every app-shell test that mounts the matrix: 41 importers of PermissionMatrixEditPage plus 35 StudioDesignSurface tests naming the Access pillar, 73 files after dedupe): Test Files 73 passed, Tests 690 passed.
• pnpm --filter @object-ui/app-shell run type-check: exit 0.
• Ablation (scripts/ablation-replace.mjs, anchor hit 1 to 0, blob f8f9c813 to 36feb5f1 and back, git diff HEAD empty after restore): replacing the package-door list read with plain client.list turns 4 of the 5 new tests red; the environment-door test stays green, as it should.

Acceptance notes

• PR fix(app-shell): an expression field shows the draft's server verdict at its own path #26999 (Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858) edits this same file and was still open when this PR was opened; origin/main was merged into this branch twice, the last time at 3230bdbf.
• A published object with a pending draft is also served with _draft: true and so carries the draft mark, the same as in the object picker.
• The full app-shell suite (1,816 files) was not run locally; it belongs to CI. The scoped set above is every file that mounts the matrix.

Verification

Derived gates (dispatch-gates --commands) and their exits are in the os-dev report on #26840.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (CI)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (@object-ui/app-shell is private: skip-changeset)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (except the six-line maintainer brief the dispatch order asks for in Chinese)

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbYLTHkXTxBf89Sud8r

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · seat domain:ui#1 · session_01JQwxbZeBv2y91towxasSUT · head 1df85590 · 2026-10-28T03:54Z

席位意见：包作用域下的访问矩阵改走草稿叠加读取，草稿对象能列出、能展开字段、能授权，行上用对象选择器同款的「(草稿)」标记；环境作用域不变。

1. Shape: Fixes #26840; 30 files, +277/−9: PermissionMatrixEditor.tsx +53/−9 (the object list, one readObjectDefinition helper for the two per-object reads, ObjectSummary.draft, the row mark in both layouts), one new test file (5 tests), and one- or two-line withPreviewDrafts additions to the fake clients of 28 existing test files. Labelled skip-changeset (@object-ui/app-shell is private).
2. Premise measured: the seat read the source diff on the head. Under a packageId, the list and both definition reads (ensureFields, loadObjectFields, whose deps gain packageId) go through client.withPreviewDrafts(true); the environment door keeps client.list('object', {}) and client.get. A row is marked only when the item carries _draft === true, the same signal and the same data-draft-marker + engine.inspector.draftSuffix span as inspectors/ObjectPicker.tsx ≈L439, so there is no second marker and no new key. The tests cover the list and mark (page and Studio layouts), the grant written into the set draft, the draft object's fields, and the unchanged environment read. Ablation (dev): dropping the door turns 4 of 5 red.
3. Gates / check-runs: PR check-runs on 1df85590: 43 success, 15 skipped, 0 failure; mergeable_state clean. Dev's local run: 24/24 derived gates exit 0, app-shell type-check 0, and 73 matrix-mounting files (690 tests) green.
4. Accepted deviations: the full 1,816-file app-shell suite was narrowed to the 73 files that mount the matrix, and CI ran the affected set. The 28 test-double edits outside PermissionMatrixEditor.tsx only add withPreviewDrafts to fakes. PR fix(app-shell): an expression field shows the draft's server verdict at its own path #26999 (Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858, same file) is still open after a queue pop; a seat trial merge of the two heads is clean.
5. Out of scope: none found. Skills-docs: none — UI editor only.
6. Landing: not Tier H; the seat readies and arms auto-merge.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40637014766 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test UI (11/16) — 失败步骤: Run the ui tests (shard 11/16)

  × the package door draws the `*` entry too, and its save keeps the stored `*` entry 1047ms
  FAIL   dom  packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.objectGrantInherited-27010.test.tsx > every object-row control writes only what the admin sees change (objectstack#27010)
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.objectGrantInherited-27010.test.tsx — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)