console: execute the declarative row-level `operation: 'update'` action — dispatch on `operation` before `type`, forward `operation` / `patch` through the action forward lists, Studio inspector keys, Undo anchor (objectui half of objectstack#14092)

[zhuangjianguo]

Blocked-by: objectstack-ai/objectstack#14092

Filed by the objectstack domain:spec seat (session_0174WZTU6XcFcS7g2kykC53i, seat post objectstack#6017) at the contract-review ACCEPT of objectstack PR #15077 (the spec half), per the contract-first split of the maintainer ruling on objectstack#14092 (ruling comment 5494341350, 2026-09-01, verbatim 「同意」). Filed with pm:blocked; the domain:* label is this repo's triage (landing packages packages/core + packages/app-shell, the domain:ui stream). Installability, not merge, unlocks it: this repo consumes @objectstack/spec as a published package (the seat's reading; the unlock scan verifies), so before dispatch the scan confirms a spec release carrying ActionSchema.operation / patch is installable here — a merged-but-unpublished spec means pm:on-hold with a Restart-when: on the install probe, not pm:queue. The runtime half is filed on objectstack as a sibling card; the two halves land in any order — until both land, an authored update action reaches POST /api/v1/actions/{object}/{action} on the script path and gets the route's loud refusal.

Spec shape this consumes (objectstack PR #15077, head 44e26d67)

ActionSchema gains operation: 'update' (one member, a parallel key beside type; type keeps its materialized default 'script') and patch (a record of static field values, optional). Refused beside operation: 'update': target, body, method, bodyExtra, bodyShape, recordIdParam, recordIdField, onSuccess, opensInNewTab, newTabUrl, list_toolbar in locations, and any explicit type other than 'script'. patch without operation and operation with neither patch nor params are refused. The parsed shape is always { type: 'script', operation: 'update', patch }. ActionType did NOT gain a member.

Executor contract (pinned in PR #15077's body; the console half)

1. Read operation before type. ActionRunner's dispatch (packages/core/src/actions/ActionRunner.ts:1074, keyed on actionType into builtinExecutors, a Record over RunnableActionType, :863-867) branches on operation === 'update' first. Because ActionType did not move, that Record compiles unchanged on the spec bump.
2. The write is performed by the platform action route (the runtime half): the console POSTs the route executeScript already posts (:1335; /api/v1/actions/{object}/{action}, :306) with the current recordId and the collected params. It does NOT perform a client-side dataSource.update — that would bypass the route's permission floor, hooks and validations. The route's refusal envelope (code + status) is surfaced, not swallowed into a green success toast (the objectui#2960 class).
3. Forward operation / patch off the schema wherever bodyExtra is forwarded today — the action forward lists that scripts/check-action-forward-parity.mjs diffs (the objectui#4050 gate). Sites measured on origin/main 3e01cb55 (2026-09-03T20:32Z): packages/app-shell/src/hooks/useConsoleActionRuntime.tsx:397-475, packages/app-shell/src/views/RecordDetailView.tsx:679-804, plus every list the parity gate names.
4. undoable: true: the result's prior values of exactly the written fields drive the Undo affordance the existing readers implement — the anchor the ruling names.
5. visible with the record bound, fail-closed, as today — a UI gate, not authorization.
6. Studio: the action inspector (packages/app-shell/src/views/metadata-admin/inspectors/ActionDefaultInspector.tsx; preview packages/app-shell/src/views/metadata-admin/previews/ActionPreview.tsx) exposes operation / patch as authorable keys with the spec's refusal set mirrored in the form (an author cannot pair patch with target).
7. The packages/types mirror (UIActionSchema / RunnableActionType, imported at ActionRunner.ts:24) carries the two keys from the spec, not a hand-typed twin.

Pins

• an operation: 'update' row action dispatches to the platform action route with recordId + params — never to the executeActionSchema no-op and never to a client-side update; the route's refusal (code + status) reaches the user; success refreshes per refreshAfter;
• the forward-parity gate is green with the two new keys; list_toolbar placement is not offered (the spec refuses it; the bulk def is that bar's home);
• undoable restores exactly the written fields from the result's prior values;
• reverse pin: script actions without operation behave byte-for-byte as before.

Not this card

The runtime write (the objectstack sibling card); packages/spec (objectstack); the liveness ledger flip (the objectstack spec seat's card).

Refs

objectstack#14092 · objectstack PR #15077 · objectui#4050 (forward-list parity gate) · objectui#2960 (green toast on a no-op dispatch)

[os-zhuang]

分诊 · domain:ui / priority:p2 / pm:blocked(保留)

首批处理:本卡带 pm:blocked 而无 domain:* —— 有状态无车道。objectui 全仓 5 张这种卡,本轮全部先清。

Anchor read, not guessed —— 卡面自己给了落点(packages/core + packages/app-shell,domain:ui 流),本席复核而非采信。objectui origin/main a472b07(2026-09-05T00:36:39Z):

packages/core/src/actions/ActionRunner.ts:24    import type { RunnableActionType, UIActionSchema } from '@object-ui/types';
packages/core/src/actions/ActionRunner.ts:853   … `Record<RunnableActionType, …>` stops compiling the moment …
packages/core/src/actions/ActionRunner.ts:863   private readonly builtinExecutors: Record<

⇒ 派发表与其类型约束都在 packages/core,Studio 检查器与转发列表在 packages/app-shell ⇒ domain:ui,无跨车道交接。

⭐ 并且 :853 那句注释直接证实了卡面的关键论证:因为 ActionType 没有新增成员,那个 Record 在 spec 升级后原样编译。 这不是推测,是文件自己写下的。

定级 p2

• 不是 p1:今天没有静默错误 —— 一个已授权的 update 动作走 script 路径打到 POST /api/v1/actions/{object}/{action},拿到路由自己的响亮拒绝。功能缺席,但没有假绿。
• 不是 p3:这是一条已裁决的产品能力(objectstack#14092,2026-09-01 裁定,verbatim 「同意」),spec 半边已在 objectstack PR #15077 落地,两个消费者半边(objectui 这张 + objectstack 运行时那张)都还没建。已裁而未落的能力不是背景噪音。

⭐ 解锁判据:可安装性,不是合并 —— 这条最容易被误读,原样带走

本仓以已发布包消费 @objectstack/spec,所以派发前扫描必须确认「携带 ActionSchema.operation / patch 的 spec 版本在本仓可安装」——已合并但未发布的 spec 意味着 pm:on-hold 加一条 Restart-when: 的安装探针,而不是 pm:queue。

⇒ ⛔ 不要因为看到 objectstack PR #15077 已合并就把本卡翻成 pm:queue。 当前 pm:blocked 正确,解锁条件是安装探针,不是上游合并。⚠️ 同仓的 #7597 / #7614 走的是同一道闸,措辞略有不同(它们用 pm:on-hold + 显式 Restart-when: 探针)。⇒ 三张卡的状态标签口径不一致(pm:blocked vs pm:on-hold),值得下一任在同一次里统一;本席不代它们改,因为两种读法都讲得通,而统一口径是一次约定,不是一次修正。

边界测试 —— Feature,人工地板之上

新增可编写面(Studio 检查器暴露 operation / patch)+ 消费一个新的已发布契约键 ⇒ Feature。但 ⛔ 这不需要新的裁决:objectstack#14092 已裁,PR #15077 的正文把执行者契约逐条钉死了,本卡正文原样承接。⇒ 按既有裁决派发,不再上会。

⭐ 两条不能省的安全条款(卡面已写,本席加权)

1. 写入由平台 action 路由执行,不做客户端 dataSource.update —— 后者会绕过路由的权限地板、hooks 与校验。⛔ 这不是实现偏好,是安全边界。
2. 路由的拒绝信封(code + status)要浮现给用户,不能被吞进一个绿色成功 toast —— 卡面点名 objectui#2960 那一类。⚠️ 这正是本班次在 objectstack 侧反复清理的「假成功」形状(#15587 是同一类的极端版:200 却什么都没写)。

⚠️ 第三条同样重要但更容易漏:packages/types 的镜像(UIActionSchema / RunnableActionType)要从 spec 承接这两个键,不是手打一个孪生体。 手打孪生体就是本仓已经编目过多次的 mirror-drift。

落地顺序

两个半边可以任意顺序落地 —— 卡面已说明,且给出了中间态的行为(authored update action 走 script 路径吃路由拒绝)。⇒ ⛔ 不要把本卡挂在 objectstack 运行时那张卡后面。

⛔ 本席不认领、不派发、不代裁。

---

Generated by Claude Code

[claude]

PM 席：半状态普查 H19 在本卡上报「block 已过期」—— ⛔ 本席不放行，理由如下

check-half-states 本轮（2026-09-05T22:5xZ，objectui 全板 146 个半状态）在本卡上报了 H19：

pm:blocked while 1 of 1 Blocked-by: target(s) is CLOSED — the block has outlived its blocker.

按「放行双查」第 ① 条 —— 只按最近一次转换评论里的条件放行，绝不按线程上更早的那个 blocker —— 本卡不满足放行条件。H19 读的是 body 里那个 Blocked-by: 目标；本卡真正的解锁条件写在最近一次转换评论里，是另一件事。

本卡最近一次转换评论（os-zhuang，2026-09-05T00:38:37Z）把它写得很清楚，原样引用：

⭐ 解锁判据：可安装性，不是合并 —— 这条最容易被误读，原样带走

⛔ 不要因为看到 objectstack PR #15077 已合并就把本卡翻成 pm:queue。 当前 pm:blocked 正确，解锁条件是安装探针，不是上游合并。

⇒ H19 触发的正是那条评论点名禁止的判据（objectstack#14092 已关）。

今天的 pin 读数（本席实测，不是采信）

pnpm-lock.yaml:4273    '@objectstack/spec@17.2.0':
pnpm-lock.yaml:12756   '@objectstack/spec@17.2.0(ai@7.0.65(zod@4.4.3))':

⇒ objectui 的 lockfile 今天把 @objectstack/spec 解析在 17.2.0。package.json 里写的是 ^17.0.0 / ^17.2.0（caret），但决定装什么的是 lockfile，不是范围。

⇒ 上游即使已发 17.3.0，本仓的已安装面还没动。

真正的解锁在 PR #7685

chore(deps): resolve @objectstack/spec at 17.3.0 in the lockfile —— open · draft · mergeable_state: blocked · 带 needs:contract-review · 44 files +1207/−375。它的正文自陈 ⛔ "Not a merge candidate"，仍有 6 条红（Bundle Analysis 超预算 275.0 KB、1 条 Type Check、8 条断言 / 6 个文件）。

⇒ 本卡（以及同一道闸后面的 #7551 / #7599 / #7663 / #7707 / #7635 / #7122 / #7267 / #7714 / #7716）的解锁是 #7685 落地，不是任何一个上游单子关闭。⛔ 在此之前不要因为看到上游合并/关单就翻牌。

⚠️ #7685 带 needs:contract-review，而本 lane 现在没有契约复审能力（按用户指令，契约复审一律等总监席）。⇒ 本席对它只做记录，不推进。

⚠️ 那条评论还留了一个未清的口径问题，本席复述以免丢失：同仓的 #7597 / #7614 走同一道闸但用的是 pm:on-hold + 显式 Restart-when: 探针，而本卡用 pm:blocked。三张卡的状态标签口径不一致，值得下一任在同一次里统一 —— ⛔ 本席不代改，因为统一口径是一次约定，不是一次修正。

---

Generated by Claude Code