[objectstack-fleet]

Requested by Tesla · project thread

Fixes #32838

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：数据模型类的保存提示（advisory）现在也有给最终用户看的一句话，11 种平台语言都有：自动编号格式 2 条、外部对象列表视图的排序与搜索各 1 条、数据集基于“像平台对象但没人提供”的对象 1 条，共 5 条规则 id；规则 id、message、hint 一字不变。
• 为什么改：按 lint: every save-door advisory rule carries a localized user sentence (67 rule ids in 36 rule files remain after the security posture), per ruling C on #32440 #32835 / spec: user-facing refusal and advisory text is in the request locale (userMessage locale rule, advisory user text field), per ruling C on #32440 #32655 已落地的做法（裁决 6819749037 选 C），中文 Studio 里保存对象、列表视图、数据集时看到的仍是英文提醒；现在由出提醒的规则自己按用户语言出文案。卡片表里 10 条中有 5 条保存时根本不会返回（只在命令行跑，或属于 os lint 的最佳实践检查），它们没有用户文案，原因写在验收说明里。
• 风险与回滚：只新增文案和发现对象上的一个可选字段，外加自动编号规则的注册适配器把这个字段透传出来；保存接口现在还不填 userMessage（那是 server: userMessage producers and the save door compose user-facing text in requestLocale (ruling C on #32440, layer 2) #32656），所以所有返回内容不变。@objectstack/lint 按 patch 发版。回滚即 revert。
• 先看：packages/lint/src/lint-autonumber-formats.user-text.ts（两条自动编号提示、两种写法的各语言文案）、packages/lint/src/validate-object-references.ts（只在数据集基础对象这一处带参数）、packages/lint/src/finding-user-text.data-model.test.ts。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/finding-user-text.data-model.test.ts，应见 20 个测试全绿，其中三条是从发布门（对象写入、视图写入、数据集写入）拿到的提示渲染成能被 RuntimeAuthoringIssueSchema 解析的 userMessage。
• 需要你做的：无，席位落地。

What changes

Layer 1 of #32654 for the data-model advisories, in the pattern #32655 landed (validate-security-posture.user-text.ts, finding-user-text.test.ts), under ruling record 6819749037 (option C).

Re-measured first. The card's table (10 ids in 6 files, a static-scan upper bound) was checked by running each warning push site of the six files through runRuntimeAuthoringRules on origin/main 5c005e0e, with object, view (flattened overlay and container), dataset, page and flow writes:

Rule file	Door-reaching advisory ids (write)	Not reaching the door
lint-autonumber-formats.ts	autonumber-unrecognized-token, autonumber-references-optional-field (object)	—
validate-sortable-fields.ts	sort-field-unprovisioned (object, view)	page-field-unprovisioned reaches it on a page write, but is validate-page-field-bindings.ts's id (#32840)
validate-searchable-fields.ts	searchable-field-unprovisioned (object, view)	—
validate-object-references.ts	object-reference-unregistered-platform (dataset, the base-object site)	the field, view, action, dashboard-filter and navigation sites
data-model-rules.ts	—	unique/double-declaration, unique/legacy-organization-composite, field/select-missing-options, relationship/master-detail-required, relationship/association-inline-edit
validate-record-title.ts	—	title-unresolvable

The seat agreed to cover the five and name the rest (surface amendment on the card). See Acceptance notes for each reason.

packages/lint.

• Four catalogs, new, beside their rules, each in all 11 PLATFORM_LOCALE_TAGS and in the console's terms from ui/packages/i18n (object, field, Auto Number, record number, required, list view, external object, sort, searchable fields, dataset, remote table):
  • lint-autonumber-formats.user-text.ts: the two autonumber ids. autonumber-unrecognized-token has one arm per kind (unknown-token, second-counter), as the rule's message does.
  • validate-sortable-fields.user-text.ts: sort-field-unprovisioned, addressed to the list view.
  • validate-searchable-fields.user-text.ts: searchable-field-unprovisioned, one arm per role (canonical, the object's own searchable fields; narrowing, a list's search fields), as the rule's message does.
  • validate-object-references.user-text.ts: object-reference-unregistered-platform, addressed to the dataset.
• Push sites: lint-autonumber-formats.ts sets userTextParams at both warning sites; checkSortDeclaration and checkSearchableFieldList set it at their unprovisioned-anchor sites (so every caller of those cores carries it); validate-object-references.ts sets it at the dataset base-object site only, through an optional check argument. Each finding interface gains userTextParams?. Rule ids, message and hint are unchanged.
• authoring-rules.ts: the lintAutonumberFormats registry adapter re-maps each field and dropped userTextParams; it now spreads it when present (one line, the same as lint: the automation writes: approvals, flows, hooks, actions and email templates advisories carry a localized user sentence (27 rule ids in 11 rule files), per ruling C on #32440 #32836's lintFlowCredentialLiterals line). No other entry changes.
• finding-user-text.ts: FINDING_USER_TEXT_CATALOG merges the four catalogs via mergeUserTextCatalogs.
• No new export: the catalogs stay internal, as SECURITY_POSTURE_USER_TEXT is.

Changeset. .changeset/32838-advisory-user-text.md, @objectstack/lint patch, with Clause-②: no and Metadata-protocol: none. Precedent followed: #32837 (PR #33118), the sibling sub-card, declared none and patch for the same lint-only change, reading #32790 (the #32655 PR): its added came only from the @objectstack/spec key RuntimeAuthoringIssueSchema.userMessage, and it shipped the lint half as patch. This PR moves no spec key and no accepted value.

Not in this PR. The save door composing userMessage (#32656) and the console rendering it (#32657). Until #32656 lands, every save and publish response is byte-identical.

Tests

Counts from the tree at f4ce7b50 (branch point main 5c005e0e). The head 4605d6ef merges main 5b2ec820 through scripts/pm/os-regen-merge.sh (one incoming commit, #33122 in packages/spec stack.zod.ts; none touches packages/lint; no conflict; no generated artifact left to regenerate). After the merge: pnpm --filter @objectstack/spec build, then check:generated (all 14 artifacts up to date), and the three user-text pin files, 72 passed (72), VERDICT command-exit 0.

• packages/lint/src/finding-user-text.data-model.test.ts (new, 20 tests):
  • exact coverage: each of the four catalogs holds exactly its door-reaching ids, each in exactly the 11 platform locales; all are the entries FINDING_USER_TEXT_CATALOG serves; the five ids are pinned by value;
  • the six ids the door never returns have no catalog entry;
  • every push site rendered from the rule's real findings (7 cases: both autonumber token arms, the optional-field site, the list-view sort site, both search roles, the dataset site): severity warning, the exact params, every locale truthy, no undefined or template residue, every interpolated name present, and no English stand-in in any non-English locale;
  • the two token arms and the two search roles render apart in every locale;
  • zh-Hans and en spot checks on the Auto Number sentence;
  • no params where the finding is not door advice: an autonumber error, the page-sort page-field-unprovisioned warning, and an object field's lookup site of the object-reference rule;
  • from the runtime gate to the wire field: an object write's autonumber advisory (through the registry adapter), a view write's sort and search advisories, and a dataset write's object-reference advisory come out of runRuntimeAuthoringRules with their params, and the rendered userMessage (zh-CN, fr-FR, ja-JP requests) parses under RuntimeAuthoringIssueSchema beside the unchanged rule id and message.
• pnpm --filter @objectstack/lint test: Test Files 204 passed (204), Tests 8654 passed, 5 skipped (8659), VERDICT command-exit 0.
• pnpm --filter @objectstack/lint typecheck (tsc --noEmit and check:test-typecheck), then build: VERDICT command-exit 0.
• Consumer reading (@objectstack/metadata-protocol, which runs the gate on every save; closure built with pnpm --filter '@objectstack/metadata-protocol^...' build): Test Files 337 passed, 7 skipped (344); Tests 22799 passed, 36 skipped (22835); VERDICT command-exit 0.

Ablations (committed first at f4ce7b5, mutated through scripts/ablation-replace.mjs, restored to the HEAD blob)

#	Mutation	Observed
1	authoring-rules.ts: drop the userTextParams spread in the lintAutonumberFormats adapter	1 failed, 19 passed (the object-write gate case)
2	validate-object-references.ts: drop { dataset: dsName } at the dataset site	2 failed, 18 passed (the dataset render case and the dataset-write gate case)
3	validate-searchable-fields.ts: drop userTextParams at the unprovisioned site	4 failed, 16 passed (both role cases, the arms case, the view-write gate case)

Each mutation landed (anchor 1 → 0, blob changed) and each restore read blob == HEAD and git diff HEAD is empty.

Acceptance notes

• Five card ids stay on the English fallback, by measurement. unique/double-declaration and unique/legacy-organization-composite are registered CLI_ONLY with RUNTIME_OBJECT_ADVISORY_VOLUME, and so is title-unresolvable (validateRecordTitle). field/select-missing-options, relationship/master-detail-required and relationship/association-inline-edit are emitted only by lintDataModel, the os lint best-practice sweep, which has no registry entry: no write reaches them. A sentence the door can never render would be declared but not delivered. Parent lint: every save-door advisory rule carries a localized user sentence (67 rule ids in 36 rule files remain after the security posture), per ruling C on #32440 #32835 allows naming such ids with the reason they stay on the English fallback.
• page-field-unprovisioned is left to lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840. validate-sortable-fields.ts pushes it at its page-sort site (a page write returns it), but its constant, its other push site and so its catalog belong to validate-page-field-bindings.ts, which is lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840's table; a rule id has one catalog owner. lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840's catalog must also set userTextParams at the page-sort site in validate-sortable-fields.ts (checkPageSortDeclaration); a pin here asserts that site carries none today.
• Object-reference sites other than the dataset carry no params. The rule runs at the door on flow and dataset writes; only a dataset's base object is on the written item. A flow write's objects, views, actions, dashboards and apps are context on both sides of the differential, so those findings cancel (measured: a flow write over context with a sys_-prefixed lookup target returns none, and an object write does not dispatch the member).
• Agent-written non-English sentences, for the native-review round. All non-English sentences in the four new catalogs are agent-written: 10 locales (zh-Hans, zh-Hant, es, ar, fr, pt-BR, ru, de, ja, ko) × 5 entries, 7 sentences per locale counting arms (autonumber-unrecognized-token ×2, autonumber-references-optional-field, sort-field-unprovisioned, searchable-field-unprovisioned ×2, object-reference-unregistered-platform). Points worth a native reader's eye: the console has no translated "Auto Number" label outside en and zh (engine.fieldType.autonumber), so the other locales use a plain term ("numeración automática", "Autonummernfeld", "自動採番", "자동 번호", …); de uses the console's "Datensatz" for both dataset and record, which is why the dataset sentence speaks only of data ("keine Daten") and the Auto Number sentences say "Datensatznummer"; Korean particles are written in the dual form (을(를), 이(가)) because the name is interpolated; the external-object clause reuses the wording of the landed dashboard-filter-field-unprovisioned sentences.
• API names, not labels, as the security catalog does (its N3, accepted): the rule is a pure function of the stack with no label lookup in the request's language.
• New test file, not finding-user-text.test.ts. The pins sit in finding-user-text.data-model.test.ts, as lint: the dashboards, charts and widgets advisories carry a localized user sentence (11 rule ids in 3 rule files), per ruling C on #32440 #32837's sit in finding-user-text.dashboards.test.ts, so parallel sibling cards do not collide; the shape is the same.
• lint: the automation writes: approvals, flows, hooks, actions and email templates advisories carry a localized user sentence (27 rule ids in 11 rule files), per ruling C on #32440 #32836 (PR fix(lint): the approval and flow advisories a flow save returns carry a user sentence in every platform locale #33120, open) also adds lines to finding-user-text.ts; whichever lands second merges main and keeps every catalog line. lint: the object_extension publish door runs no field-formula judgment, so a computed field os build refuses still publishes through PUT /meta/object_extension #33072 edits validate-expressions.ts; this PR does not touch it.
• Ruling grep over the surface (ruling|Ruling-ref|maintainer|⛔): hits in validate-object-references.ts (9, resolution-ladder and ADR-0130 notes), validate-sortable-fields.ts (3, type-list notes), validate-searchable-fields.ts (1), finding-user-text.ts (2, ruling record 6819749037 and the one-locale-list rule), authoring-rules.ts (63, registry entries); none constrains a user sentence or the adapter line.

Verification

Local subset at f4ce7b50, derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (62 families), every line run with stdin closed and its exit code captured before any pipe, then reconciled with --ran (again on the merged head 4605d6ef, same 12 paths): 62 derived, 62 run, 0 NOT-MEASURED (a derived zero: all 62 recorded an exit code, none is 3). All 62 exit 0. The record is spec-seat-2/r2026-11-13/out/32838-gates-ran-f4ce7b50.list in the project files.

Four families needed a prerequisite before their reading

• node scripts/check-plugin-teardown-shape.mjs --self-test: its pinned fixture commit 621a4876 was fetched first (shallow clone).
• pnpm check:dual-build-cjs-loads, pnpm check:lean-entry-closure: exit 3 PREREQUISITE NOT MET (no dist); exit 0 after a full pnpm turbo run build.
• pnpm check:type-check-debt: run after the same full build, outside the 10-minute foreground limit; exit 0. pnpm check:dts-closure read exit 0 both before and after it.

node scripts/check-cli-command-ids.mjs (run after editing the catalogs): exit 0, 1322 command-id literals resolve. node scripts/check-nul-bytes.mjs: exit 0.

CI runs the rest of the farm on this PR; its check-runs are the reading for every family outside the local subset.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 17 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/validating-metadata.mdx (via AUTHORING_RULES (symbol, a top-level const object))

What this run could not see

• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5b2ec820c8abca113eae23745f71331f55ec7aed → packageMentionDocs.

Which tree this was computed on

This run read content/docs from b323a8a3c952575e3675e363d4e5755d01f74d10 — the merge of head 4605d6ef3740fec8a664784c882fe0fc5383c498 into base 5b2ec820c8abca113eae23745f71331f55ec7aed, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin b323a8a3c952575e3675e363d4e5755d01f74d10 && git checkout b323a8a3c952575e3675e363d4e5755d01f74d10
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5b2ec820c8abca113eae23745f71331f55ec7aed 4605d6ef3740fec8a664784c882fe0fc5383c498 && git checkout -B drift-repro 5b2ec820c8abca113eae23745f71331f55ec7aed && git merge --no-ff 4605d6ef3740fec8a664784c882fe0fc5383c498

node scripts/docs-audit/affected-docs.mjs --json 5b2ec820c8abca113eae23745f71331f55ec7aed

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5b2ec820c8abca113eae23745f71331f55ec7aed → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

维护者速读

• 改了什么：数据模型类的 5 条 lint 提示（自动编号格式 2 条、外部对象列表视图的排序与搜索各 1 条、数据集基对象 1 条）在运行时保存对象、视图、数据集时会带上用户可读的一句话（11 种平台语言）；规则 id、message、hint 和 CLI 输出都不变。authoring-rules.ts 只加了一行，把参数透传给运行时门禁。
• 为什么改：非英语 Studio 里这些提示原来只显示英文；与 lint: the dashboards, charts and widgets advisories carry a localized user sentence (11 rule ids in 3 rule files), per ruling C on #32440 #32837、lint: the automation writes: approvals, flows, hooks, actions and email templates advisories carry a localized user sentence (27 rule ids in 11 rule files), per ruling C on #32440 #32836 和安全类提示同一做法。
• 风险与回滚：只加文案和参数，@objectstack/lint patch，Clause-②: no；回滚即 revert。
• 先看：packages/lint/src/lint-autonumber-formats.user-text.ts 和 finding-user-text.ts 的合并列表。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 src/finding-user-text.data-model.test.ts，预期 20 条全绿。
• 需要你做的：无，席位落地。非英语句子由 agent 写，已列出等母语复核。

席位意见：可以落地。

席位核对

ACCEPT · seat domain:spec#2 · head 4605d6ef · 2026-11-13T17:30Z

1. Shape: Fixes #32838, draft, base main, 12 files, +886/−1; changeset .changeset/32838-advisory-user-text.md (@objectstack/lint patch). Clause-②: no, Metadata-protocol: none, matching claim 6858401007, amendment 6858508915 (the lintAutonumberFormats adapter line) and dev report 6859456351.
2. Premise: spec: user-facing refusal and advisory text is in the request locale (userMessage locale rule, advisory user text field), per ruling C on #32440 #32655's pattern; lint: the dashboards, charts and widgets advisories carry a localized user sentence (11 rule ids in 3 rule files), per ruling C on #32440 #32837 (PR feat(lint): dashboard and report advisories carry a localized user sentence #33118) and lint: the automation writes: approvals, flows, hooks, actions and email templates advisories carry a localized user sentence (27 rule ids in 11 rule files), per ruling C on #32440 #32836 (PR fix(lint): the approval and flow advisories a flow save returns carry a user sentence in every platform locale #33120) use the same catalog list. The dev re-measured through runRuntimeAuthoringRules: 5 of the card's 10 ids reach the publish door (object, view and dataset writes). The other 5 are named with reasons in the changeset and Acceptance notes: three run only on the CLI (unique/double-declaration, unique/legacy-organization-composite, title-unresolvable), and three belong to the os lint best-practice sweep. page-field-unprovisioned's page-sort site in validate-sortable-fields.ts is left to lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840, whose order and claim 6859188621 name it.
3. Review: dispatch-gates --tier: no path-derived mandate (packages/lint only, no narrowing), so this is the seat's own review of record. It read the code diff: the four catalog imports and the merge list; the adapter's conditional spread; the params at the push sites (autonumber object, field, token, kind / ref; sort and search object, field, role; object reference dataset plus the resolved object, set only at the dataset base-object site the door reaches). The new test drives the real gate for all three write types (runRuntimeAuthoringRules with object, view, dataset).
4. Gates / check-runs: dev: lint 204 files / 8654 tests, metadata-protocol 337 files / 22799 tests, 62/62 derived gates exit 0 (32838-gates-ran-f4ce7b50.list); 3 ablations red as expected (adapter spread, dataset params, searchable params). CI on 4605d6ef: 66 runs, 55 success, 11 skipped, 0 failed. K = 2 (fix(lint): the approval and flow advisories a flow save returns carry a user sentence in every platform locale #33120, feat(storage,mcp): an upload link for a file field of a record not yet created #33123); git merge-tree against main 67188849 is clean, fix(lint): the approval and flow advisories a flow save returns carry a user sentence in every platform locale #33120's catalog lines and this PR's sit side by side in finding-user-text.ts.
5. Accepted deviations and out-of-scope findings: the 5 unreachable ids stay on the English message. Agent-written non-English sentences are listed for the native-review round. The page-sort site is lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840's (carrier noted, not filed). lint: the pages, forms, navigation and translations advisories carry a localized user sentence (9 rule ids in 8 rule files), per ruling C on #32440 #32840 edits finding-user-text.ts and validate-sortable-fields.ts too, so it merges main after this lands.
6. Landing: not governed, 887 changed lines. The seat readies the PR and arms auto-merge under the maintainer's standing words 「车道经理应该使用 pm-dispatch 技能审核和落地pr」. On MERGED: lint: the the data model: objects, fields, sorting, search, record titles and autonumbers advisories carry a localized user sentence (10 rule ids in 6 rule files), per ruling C on #32440 #32838 closes via Fixes; pm:dispatched comes off.