chore: bump the console pin — 18 objectui commits behind, including the objectui#4096 row-action permission gate

[baozhoutao]

Linkage chore per the multi-repo coordination rule (accepted repo:objectui PR ⇒ file the console bump in the consuming repo).

objectstack-ai/objectui#4108 is merged (objectui main aeb8424, 2026-08-10T10:24:11Z): the list row kebab's built-in Edit/Delete, the grid bulk-delete bar, the non-grid (ListView) bulk delete and the related-list Create/Edit/Delete now AND the caller's own /me/permissions verdict (allowEdit / allowDelete) on top of the layers they already had. Fixes objectui#4096.

Task

Run the standard console refresh (scripts/bump-objectui.sh / pnpm objectui:refresh per repo convention) and land the .objectui-sha + packages/console bump.

Staleness reading (2026-08-10T10:30Z)

• .objectui-sha on origin/main: 8aad9fd50b16750aebdd294392ff79540f17cd32 (objectui fix(components): bind the row three ways on the four action renderers (#4075))
• objectui origin/main: aeb8424
• 18 commits behind, spanning the objectui#4096 gate above, the evalRowPredicate fault-reason/subject fix (objectui#3792 / [P3] Six flow-node config aliases bypass readAliasedConfig — no warning, no ledger, no retirement path #3796), the clientValidation wiring (objectui#3561), the object-grid filter key fix (objectui#4041) and a dependabot wave.

Why it matters beyond routine freshness

objectui#4096 is a user-facing permission-affordance repair on a destructive control — Delete rendered one click away from accounts the server answers 403 on. Server-side enforcement was already hard (403, DB unchanged), so nothing is unsafe today, but the bundled console keeps showing the misleading entry until this bump lands.

Standard pin-bump discipline applies: dedicated PR, no riders; .objectui-sha is a shared file — take the whole regen (hono override + lockfile) through the script.

Note for triage: no domain:* / repo:* label applied — routing labels are the triage seat's single-producer territory. Only pm:queue is set here. Single-card cap checked at filing time: #7268 (the previous console-bump card) is closed (2026-08-10T06:45Z) and no other open console-bump card exists.

[claude]

Triage: routed domain:devx (kept pm:queue — the filing seat correctly left routing to this seat).

• Routing rationale: the whole diff is the pin/refresh machinery — scripts/bump-objectui.sh regen, .objectui-sha, packages/console bump. Per the domain table, the console pin/refresh scripts are the scripts/ (gate-class) row ⇒ domain:devx.
• Stale-premise: still live and grown — origin/main @ b948a41 has .objectui-sha = 8aad9fd50b16, while objectui origin/main has moved past aeb8424 (now 1b6188d), so the gap now exceeds the 18 commits filed.
• Dedup: chore: bump the console pin to pick up objectui#4071 (approvals:inbox component ref) #7268 (previous bump card) closed 06:45Z today; no open PR bumps the pin (open-PR titles checked); the single-card cap holds. Clean.
• Standard pin-bump discipline per the card: dedicated PR, no riders, whole regen through the script.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 1 (devx seat, 2026-08-11 term)
Session: session_01GZKbx4xyF7U5WXj6ch49BM
Branch: claude/issue-7411-console-bump
Worktree: cloud session, own clone
Domain: domain:devx
File surface: .objectui-sha, packages/console/**, pnpm-lock.yaml + whatever scripts/bump-objectui.sh regenerates (hono override) — script-driven only, ⛔ no riders (stop on breach; explain in the report)
Container & model: M (regen + build verification), mode:cloud, model: opus
Serial constraints cleared: the pin is a shared, necessarily-conflicting file — checked at claim time: no open PR bumps it, no other claim names it; #7268 (previous bump card) closed 2026-08-10.

Re-pricing at claim time (stale-premise check, single-card cap ⇒ refresh not refile): the card's readings are 2026-08-10 data and both halves have moved. origin/main .objectui-sha is now 92c0b1f403f7e3323d25d9643c14572b87dab2a8 (bumped via 24d22f4, 2026-08-10 12:47Z) — the card's named payload objectui#4108 (the objectui#4096 permission gate) is ALREADY covered by the current pin. The chore stands anyway: objectui origin/main is at 6314e87 and the pin is now 43 commits behind, spanning user-facing fixes (address inline-edit objectui#4222/#4215, image maxSize objectui#4217, view-rename persistence objectui#4212, filter-panel overlay objectui#4214, gantt refusal messages objectui#4210/#4205, the global_nav retirement objectui#4169, and the action-renderer whitelist gate objectui#4207). Dispatch instructs the dev to re-derive the readings again at work time.

---

Generated by Claude Code

[huangyiirene]

{
  "issue": 7411,
  "status": "done",
  "branch": "claude/issue-7411-console-bump",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/7549",
  "premise_still_valid": true,
  "summary": "Re-derived both readings at work time (2026-08-11 ~04:55Z): origin/main .objectui-sha was still 92c0b1f403f7 and objectui main was 6314e87f2d49 — 43 commits behind, so the staleness premise held even though the card's named payload (objectui#4108 / the objectui#4096 gate) was already inside the old pin, exactly as the PM's claim comment re-priced it. Ran the whole regen through scripts/bump-objectui.sh with OBJECTUI_ROOT pointed at a fresh objectui clone; the script wrote .objectui-sha + the derived @objectstack/console changeset (minor; 27 releasing changesets of 30, 14 commits with no changeset, 1 declared-breaking) and made the commit in its own message shape, matching the previous bump 24d22f4. The only hand edit was the ADR-0087 disposition the generator deliberately leaves as `adr-0087: TODO`: the breaking entry is objectui#4169 (global_nav Studio designer surfaces), whose spec-side retirement is already on the ledger as the conversion `action-global-nav-location-removed` (landed with #7100 / #6888, present at the merge base), so the disposition is `not-required (already-registered action-global-nav-location-removed)` and the gate accepts it. Diff is the two-file shape only — no riders; packages/console/dist is gitignored, pnpm-lock.yaml needed no regen because no framework dependency changed. objectui#4169 was flagged as possible build signal: it produced none — the console built clean at the new pin and the ADR-0082 D4 ratchet found no new declaration divergence.",
  "tests": "All foreground, heavy steps under flock /tmp/os-heavy-verify.lock with NODE_OPTIONS=--max-old-space-size=4096. (1) `pnpm --workspace-concurrency=2 --filter '@objectstack/client^...' build` — needed first: the bare console build failed with `Cannot find module '@objectstack/spec/data'` etc. in the client dts step (toolchain trap 2), green after the dependency closure. (2) `bash scripts/build-console.sh` (OBJECTUI_ROOT=/home/user/objectui) — `✓ Bundle canary 'import/jobs' present`, `✓ @objectstack/console dist ready (51964 KB) from objectui@6314e87f2d49`. (3) `pnpm check:console-sha` — `✓ Console dist matches the objectui pin (objectui@6314e87f2d49)`; dist stamp read back byte-equal to .objectui-sha. (4) `pnpm check:objectui-pin-fresh` — self-test green + `✓ objectui pin is FRESH — .objectui-sha is objectui main (objectui@6314e87f2d49)`. (5) `node scripts/check-adr-0087-registration.mjs --base origin/main` — `✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition` / `not-required (already-registered)`. (6) `pnpm check:empty-changeset` (118 assertions + scan), `node scripts/check-changeset-no-major.mjs --base origin/main` (`✓ This diff introduces no major bump`), `pnpm check:objectui-changeset` self-tests — all green. (7) `pnpm sdui:manifest` (ADR-0082 D4 ratchet, the bump script's named next step) — first run hit the documented Playwright revision gap (`Executable doesn't exist at .../chromium_headless_shell-1234/...`, container ships 1194); applied the symlink shim from docs/releases-maintenance.md verbatim inside my own scratchpad and it then ran clean: `✓ no new DECLARATION divergence vs accepted baseline` (62 spec-only divergences, all pre-existing stock). (8) `node scripts/check-nul-bytes.mjs` — `OK (scanned 7001 text file(s) ... no raw ASCII control bytes)`. No package test suite applies: the committed diff is a pin file plus a changeset. CI on PR #7549: in_progress at report time — the PM owns convergence. No skip-changeset label: this PR carries a changeset; bots applied documentation / size/s / tooling.",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[huangyiirene]

ACCEPT — PR #7549 (all gate jobs green: ESLint, TypeScript Type Check, Check Changeset, Console Pin Gate, Console Pin Freshness).

Review record: changed files are exactly the no-rider two-file shape — .objectui-sha (92c0b1f4 → 6314e87f, re-derived at work time as instructed) + the script-generated @objectstack/console minor changeset. The one hand edit is the ADR-0087 disposition the generator leaves as TODO, resolved as not-required (already-registered action-global-nav-location-removed) — verified reasoning: the breaking entry in range is objectui#4169, whose spec-side retirement landed with #7100/#6888 and is already on the conversions ledger; this bump ships the console catching up, no new spec surface. Verification chain in the PR is complete and real (console dist stamp read back byte-equal to the pin; check:console-sha / check:objectui-pin-fresh / no-major / adr-0087 / D4 ratchet all green with pasted output). The objectui#4169 build-signal watch produced none — console built clean at the new pin.

Landing: flipping ready + arming auto-merge now (queue path — not a skills/ADR surface).

---

Generated by Claude Code