[objectstack-fleet]

Requested by Warren · project thread

Fixes #29374

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:动作/流程被关闭时用户看到的那句提示,改为指向现在真实存在的位置(动作 → Setup › Packaged Actions;流程 → Studio 里该包的 Automations);权限文档里指向已退役 Setup 页面的步骤一并改到现在的位置。
• 为什么改:N-28 已退役 Setup › Packaged automation 和 Setup → Access Control 下的 Positions / Permission Sets,文档和报错提示仍把人送去不存在的页面。
• 风险与回滚:只改文字,错误码 ACTION_DISABLED / FLOW_DISABLED 不变,机器读的是码不是句子;回滚即 revert 本 PR。
• 先看:packages/types/src/packaged-item-turned-off.ts(句子本体)、content/docs/permissions/administrator-guide.mdx(步骤改写最多)、两份待发布 changeset 的引文改动。
• 两分钟验证:pnpm --filter @objectstack/types exec vitest run src/packaged-item-turned-off.test.ts,预期 6/6 通过,动作句含 Setup › Packaged Actions,流程句含 Automations in Studio。
• 需要你做的:无,席位落地(注意 Check Changeset 的 empty-changeset 门禁会因改动两份既有待发布 changeset 保持红,见下方 Acceptance notes,需确认)。

What changes

Item 3: the turned-off sentence, by kind (packages/types/src/packaged-item-turned-off.ts). The sentence both refusal engines send (describeTurnedOffPackagedItem) named the retired Setup › Packaged automation page. It now names where each switch is:

• Action: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged Actions, or you can use another action." The switch is the Setup entry nav_packaged_actions (packages/platform-objects/src/apps/setup-nav.contributions.ts, label Packaged Actions). No action-clone offer, as before.
• Flow: "This flow is turned off for this deployment. An administrator can turn it on again in its package's Automations in Studio, or copy it there under a new name." The flow's switch and New similar (the clone door) are on the flow in the package's Automations pillar (ui/packages/app-shell/src/views/studio-design/FlowItemMoreMenu.tsx, setupMetadataRedirect.ts packagedAutomationStudioPath), so the "copy it there" clause stays true.

The doc comment no longer calls the page live and explains the two per-kind parts (where, and meanwhile). Plain language, no ADR or tracker number in the runtime string.

Item 2: docs steps, each confirmed in code (content/docs/permissions/):

• administrator-guide.mdx Step 3 (was :107): a position's holders are assigned on Setup → People & Organization → Position Holders (nav_position_holders, packages/plugins/plugin-security/src/security-plugin.ts; page ui/packages/app-shell/src/views/setup/PositionHoldersPage.tsx). That page's Add writes user_id and position only (PositionHoldersSection.tsx), so the step now says a business-unit anchored assignment is created as a User Position row directly, with business_unit_id.
• administrator-guide.mdx direct grants (was :117): Setup → People & Organization → Permission Set Assignment (nav_permission_set_assignment; PermissionSetAssignmentPage.tsx renders the same AssignedUsersSection, titled Assigned Users). Studio's item page shows a link to this Setup page rather than the section (SetupAssignmentsLink.tsx), so Setup is where the task is done.
• administrator-guide.mdx matrix editor (was :151) and access-recipes.mdx:50: Studio → All metadata → Permission Set, then open the set (PermissionMatrixEditor.tsx, which carries the When (edit) column, perm.field.when).
• administrator-guide.mdx "Where is everything": definitions and the on/off switch of positions, permission sets and capabilities are in Studio → All metadata; who holds them is the two Setup people pages.
• authorization.mdx (was :251-253): the catalog list is Studio's All metadata area, /studio/~all/metadata/permission?scope=environment, and the old Setup address redirects there (same wording as permission-sets.mdx:386-387).

Item 1: the sweep in other words. Extra hits added here: authorization.mdx:33 (capabilities "extended by admins in Setup") and :419-420 (the on/off switch now sits on the item's page in Studio's All metadata area, per the plugin-security comment above its nav contributions), delegated-administration.mdx:55 (the Delegated Admin Scope block is in the permission set editor, PermissionAdvancedFacets.tsx, now in Studio), capabilities.mdx:124, :272 (a capability's label is shown to the administrator who grants it, no longer "in Setup"), and data-modeling/analytics.mdx:149 (Setup › Datasets: a dataset is metadata, every Setup metadata URL other than a datasource redirects into Studio's All metadata area, setupMetadataStudioPath, and no Setup navigation entry names datasets). skills/**: zero hits, so this PR touches no governed surface.

Item 5: the six pinned tests follow the new sentence. flow-activation-ledger.test.ts's status-disabled check now asserts the message carries no turn-on remedy at all (not.toContain('turn it on again')), which still holds whatever page the remedy names. The types test gains one case per kind: the sentence never names Packaged automation.

Pending changesets. .changeset/27842-disabled-actions-served.md and .changeset/27966-flow-disabled-plain-sentence.md are unreleased and quoted the old sentence verbatim; left as they were, the 18.3.0 CHANGELOG would publish a sentence this PR makes false. Only the quoted sentence (and, in 27966, "switched off under Setup › Packaged automation" → "an administrator switched off") changes. The devx seat accepted this widening on the claim (comment 6580761426).

Platform checklist (docs/qa/platform-checklist/areas/), after #29438 landed and main was merged: api-backend.packaged-action-disabled-dispatch (acceptance[0] clause and verify, acceptance[6] verify) and automation.packaged-flow-disable-durable (acceptance[1] clause and verbatim verify, negative[3]) re-point their remedy phrase to the new sentence, and the two TRANSITIONAL known gaps that promised this re-point are retired. Revisions 13 and 10, history rows added.

Patch changeset on @objectstack/types.

Why

N-28 (#28578) retired Setup's metadata catalog (Positions, Permission Sets, capabilities, every metadata type except datasource) and the Setup › Packaged automation page (ADR-0146 D1, D4, D11; M-1 ruling 6554738464). A person refused a switched-off action or flow was told to send an administrator to a page that no longer exists, and an administrator following the permissions docs looked for menus that are gone.

Tests

• Unit, on the merged head: @objectstack/types packaged-item-turned-off.test.ts 6/6, @objectstack/objectql action-activation.test.ts 22/22, @objectstack/runtime domains/action-activation-dispatch.test.ts 12/12, @objectstack/service-automation flow-activation-ledger.test.ts 49/49, @objectstack/types typecheck clean. @objectstack/types rebuilt first (downstream tests read its dist).
• Dogfood: api-action-door-forward.dogfood.test.ts and packaged-action-disabled-dispatch-live.dogfood.test.ts, 2 files, 18/18 (head 53a942a, before the main merge, which did not touch the sentence or these files).
• Reverse check: restoring the old action remedy in packaged-item-turned-off.ts (via scripts/ablation-replace.mjs, mutation proven on disk, restored to the HEAD blob) turns two types cases red: the byte-for-byte action sentence and the new "never names Packaged automation" case.

Acceptance notes

• administrator-guide.mdx:216 (| Sharing rules, record shares | Setup → Access Control |) still matches the card's Re-check grep and is left as is: it is correct. @objectstack/plugin-sharing still contributes Sharing Rules and Record Shares to Setup's group_access_control (packages/plugins/plugin-sharing/src/sharing-plugin.ts).
• The other remaining Re-check hits are intended: authorization.mdx:254 and permission-sets.mdx:387 name the old /apps/setup/metadata/permission address only to say it redirects to Studio; packaged-item-turned-off.ts:24 is the doc comment saying the page is retired; packages/spec/src/api/protocol.zod.ts:755 is item 4, split to spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446 (domain:spec) and not touched here.
• check-empty-changeset stays red by design: this PR rewrites two pending release notes that it made false. That is its DELIBERATE CORRECTION case, which asks for confirmation on the PR rather than a restore; restoring them would publish the false sentence.
• Not changed, noted: other pending changesets describe the old page as history (27842-disabled-actions-beside-item.md, which belongs with spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446's spec line, 28044-…, 27504-…, 27378-…, 27521-…, 29139-…); ui/packages/** code comments that name the old page (out of scope per the card); ui/packages/app-shell/src/views/studio-design/datasetCreate.tsx still says "Setup › Datasets" in a comment.

Verification

Derived gate list: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at head ac19230, run locally and reconciled with --ran; results and the CI check-runs are in the os-dev-report comment on #29374. Docs build and the link check run in CI (Build Docs, check-links.yml); this PR adds and moves no links.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec untouched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (lint runs in CI)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (the 维护者速读 block is the maintainer summary the dispatch asks for)

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/types, touching 4 documentable anchor(s).

21 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 94d3e2543488fceda39fbfe88036bb6887037390.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 101 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 94d3e2543488fceda39fbfe88036bb6887037390 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d62b649b32d6753615f343f0821ab4ef296276c8 — the merge of head 6a1dd2e1fd8926d82bc9fdac3e655519f874c44e into base 94d3e2543488fceda39fbfe88036bb6887037390, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d62b649b32d6753615f343f0821ab4ef296276c8 && git checkout d62b649b32d6753615f343f0821ab4ef296276c8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 94d3e2543488fceda39fbfe88036bb6887037390 6a1dd2e1fd8926d82bc9fdac3e655519f874c44e && git checkout -B drift-repro 94d3e2543488fceda39fbfe88036bb6887037390 && git merge --no-ff 6a1dd2e1fd8926d82bc9fdac3e655519f874c44e

node scripts/docs-audit/affected-docs.mjs --json 94d3e2543488fceda39fbfe88036bb6887037390

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 94d3e2543488fceda39fbfe88036bb6887037390 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract-review-claim: session_01JQwxbaBjisxkQo9hht9bFB · head ac19230 · 2026-11-02T16:17Z

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ac192301fa9af8f256c360b87dee985e9f3ca8f5
Local-runs: none
Scope: packages/types/src/packaged-item-turned-off.ts, packages/types/src/packaged-item-turned-off.test.ts, packages/objectql/src/action-activation.test.ts, packages/runtime/src/domains/action-activation-dispatch.test.ts, packages/services/service-automation/src/flow-activation-ledger.test.ts, packages/qa/dogfood/test/api-action-door-forward.dogfood.test.ts, packages/qa/dogfood/test/packaged-action-disabled-dispatch-live.dogfood.test.ts, .changeset/27842-disabled-actions-served.md, .changeset/27966-flow-disabled-plain-sentence.md, .changeset/29374-turned-off-sentence-names-live-pages.md, docs/qa/platform-checklist/areas/api-backend.json, docs/qa/platform-checklist/areas/automation.json, content/docs/permissions/administrator-guide.mdx, content/docs/permissions/authorization.mdx, content/docs/permissions/access-recipes.mdx, content/docs/permissions/capabilities.mdx, content/docs/permissions/delegated-administration.mdx, content/docs/data-modeling/analytics.mdx + packages/objectql/src/action-activation.ts, packages/services/service-automation/src/engine.ts, packages/services/service-automation/src/subflow-guards.ts, packages/platform-objects/src/apps/setup-nav.contributions.ts, packages/platform-objects/src/apps/setup.app.ts, packages/platform-objects/src/apps/studio.app.ts, packages/platform-objects/src/apps/translations/en.ts, packages/platform-objects/src/pages/sys-user.page.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/objects/sys-user-position.object.ts, packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/spec/src/api/protocol.zod.ts, ui/packages/app-shell/src/views/setup/PackagedActionsPage.tsx, ui/packages/app-shell/src/views/setup/PackagedActionsSection.tsx, ui/packages/app-shell/src/views/setup/PositionHoldersPage.tsx, ui/packages/app-shell/src/views/setup/PermissionSetAssignmentPage.tsx, ui/packages/app-shell/src/views/setup/packagedFlowLedger.ts, ui/packages/app-shell/src/views/metadata-admin/PositionHoldersSection.tsx, ui/packages/app-shell/src/views/metadata-admin/SetupAssignmentsLink.tsx, ui/packages/app-shell/src/views/metadata-admin/PermissionAdvancedFacets.tsx, ui/packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx, ui/packages/app-shell/src/views/metadata-admin/metadataAreaHost.ts, ui/packages/app-shell/src/views/studio-design/setupMetadataRedirect.ts, ui/packages/app-shell/src/views/studio-design/metadataArea.ts, ui/packages/app-shell/src/views/studio-design/FlowLedgerSwitch.tsx, ui/packages/app-shell/src/views/studio-design/FlowItemMoreMenu.tsx, ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx, ui/packages/app-shell/src/console/AppContent.tsx, ui/packages/i18n/src/namespaces/studio/en.ts, ui/packages/core/src/utils/action-activation.ts, content/docs/permissions/permission-sets.mdx, scripts/check-empty-changeset.mjs, .github/workflows/pr-automation.yml, .changeset/config.json

Inputs: card #29374 body and all three comments (triage 6580463328, claim 6580761426, os-dev-report 6582133604); PR #29476 body, its 18-file list and the net diff; the check-runs on the head (all 65 completed at review time: 56 success, 8 skipped, 1 failure, Check Changeset). The recogniser's --paths on this file list decides no face (no schema, no governed path), so hits is empty and the Scope above lists every path of the diff plus the cited code; the brief asks for CONTRACT_REVIEW_TIER and that is the tier served. The head's merge base with main is 0c640141; the brief's 8ca9dd7b is a later main commit (the PR's base.sha, and the base the CI job diffed the synthetic merge from), and the net diff is the same 18 files either way. origin/main moved after the head's merge; every cited file above is byte-identical between the head and current main except StudioDesignSurface.tsx (a later unrelated change, #29376), which was read at the head sha itself.

① Derived judgments

• The accept set is unchanged — right. No route, no schema, no permission and no envelope code moves. ACTION_DISABLED is still what ObjectQL.describeDisabled (action-activation.ts:317-319) is read for at both action doors, and FLOW_DISABLED is still what describeDisabledFlow (engine.ts:5206, body at subflow-guards.ts:54-62) is read for at the trigger, the direct run and the subflow guard; only the string describeTurnedOffPackagedItem returns changed. ui/packages/core/src/utils/action-activation.ts hides switched-off buttons from the served disabledActions names, never from the sentence, so no client parses the text.
• The public surface that changes is the refusal message text, by kind — named right in the PR body and the changesets. On the head, WHERE.action = under Setup › Packaged Actions, WHERE.flow = in its package's Automations in Studio, and the template is This KIND is turned off for this deployment. An administrator can turn it on again WHERE, MEANWHILE. The action sentence is therefore "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged Actions, or you can use another action." and the flow sentence "This flow is turned off for this deployment. An administrator can turn it on again in its package's Automations in Studio, or copy it there under a new name." Both are what the changesets and the checklist quote, byte for byte.
• The MEANWHILE clauses are unchanged — right. The action sentence still offers no clone (PackagedActionsSection.tsx header: no clone is chartered); the flow sentence still offers the copy.
• The six pinned tests follow the producer — right. types (byte-for-byte both kinds, plus a new not.toContain('Packaged automation') case per kind), objectql (byte-for-byte action), runtime door 1 (toContain of the new remedy), both dogfood pins (toContain of the new remedy; expectDisabledSentence still refuses the ledger name and any ADR), service-automation (LEDGER_SENTENCE and the execute-seam toBe, both byte-for-byte). The status-dimension check moved from not.toContain('Packaged automation') to not.toContain('turn it on again'): the status sentence is "Flow 'obsolete_flow' is disabled", so the check still separates the two dimensions, and it no longer depends on which page the remedy names — right, and stronger.
• The checklist re-points are right. api-backend packaged-action-disabled-dispatch acceptance[0] clause and verify and acceptance[6] verify now say Setup › Packaged Actions; automation packaged-flow-disable-durable acceptance[1] clause and its verbatim verify sentence and negative[3] now name the Studio Automations remedy; both TRANSITIONAL known gaps written by docs(qa): platform checklist items follow the Studio door after ADR-0146 (#28579 slice 1) #29438 said they would be re-pointed "in the same change" as the producer, and are retired here with revision 13 and 10 history rows. The automation verify string equals the producer's output exactly. The revision-12 and revision-9 history rows keep the old spelling as history, which is what a history row is. Lint & Repo Gates (which carries the checklist shape gate) is green.
• The doc comment on the producer no longer calls the page live — right, and it states the two per-kind parts (WHERE, MEANWHILE) in agreement with the code below it.
• The casing Packaged Actions matches the entry the reader sees: the Setup sidebar label is Packaged Actions (setup-nav.contributions.ts:64, translations/en.ts:79); the page heading under it reads Packaged actions (PackagedActionsPage.tsx). The sidebar entry is what a person navigates by, so the sentence names the right spelling.

② Semver level

• .changeset/29374-turned-off-sentence-names-live-pages.md: '@objectstack/types': patch — right. The diff publishes one changed string in @objectstack/types; @objectstack/objectql, @objectstack/runtime and @objectstack/service-automation re-read it from the dependency, and .changeset/config.json holds every one of them in the one fixed group with updateInternalDependencies: patch, so the consumers release with it. Nothing is added or removed from any public type.
• Clause-②: no — right, on the PR body and in the new changeset, with no (narrowing) arm. No declared capability is taken away at any consumer and no spec refusal is made real: the codes, the doors and the ordering are unchanged, and a machine reads the code. Metadata-protocol: none — right; packages/spec is untouched (item 4 is spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446).
• The two rewritten pending changesets keep their own frontmatter (27842: metadata-protocol, rest, objectql, runtime; 27966: service-automation, types, objectql) and their own Clause-②: lines; the PR changes one sentence of prose in each, no bump.

③ Boundary flags

DELIBERATE CORRECTION — per sentence. Check Changeset is red on the head and its log names exactly two rows, both M against the merge base: .changeset/27842-disabled-actions-served.md and .changeset/27966-flow-disabled-plain-sentence.md; the same log says the PR adds one declaring changeset and introduces no empty one. Neither row is a COLLISION: the files keep their card-numbered names and their whole bodies, and only a quoted sentence inside each changed. Both notes are still pending on main (no CHANGELOG carries the old sentence).

1. 27842-disabled-actions-served.md line 15, the quoted action sentence.
   • Before: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or you can use another action."
   • After: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged Actions, or you can use another action."
   • The new sentence is true of the code at this head: describeTurnedOffPackagedItem('action') returns exactly it, and ObjectQL.describeDisabled returns that for the REST and MCP action doors, as the note's bullet says. The old sentence was falsified by this PR: the producer no longer emits Packaged automation, and the types test now pins its absence. Correction confirmed.
2. 27966-flow-disabled-plain-sentence.md line 12, the lead-in clause.
   • Before: "A packaged flow switched off under Setup › Packaged automation is still refused FLOW_DISABLED, at every door that runs it"
   • After: "A packaged flow an administrator switched off is still refused FLOW_DISABLED, at every door that runs it"
   • The new clause is true at this head: the toggle door writes the ledger for packaged flows only (engine.ts:5676-5700), and describeDisabledFlow is read at the trigger, the direct run and the subflow guard. The old clause named the page ADR-0146 D11 retired; that was already false on the merge base (N-28, feat(setup): Setup's metadata pages open Studio's All metadata area; the catalog's Active switch moves to each item's page #28818, landed before this PR), so this PR does not falsify it, it corrects a clause that sits in the same bullet as the sentence it does falsify. Correction confirmed.
3. 27966-flow-disabled-plain-sentence.md line 12, the quoted flow sentence.
   • Before: "This flow is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or copy it there under a new name."
   • After: "This flow is turned off for this deployment. An administrator can turn it on again in its package's Automations in Studio, or copy it there under a new name."
   • The new sentence is true at this head: describeTurnedOffPackagedItem('flow') returns exactly it, and describeDisabledFlow (subflow-guards.ts:58) returns that for a ledger-disabled flow. Where it sends people is real, see ④. The old sentence was falsified by this PR. Correction confirmed.

So the answer to the dev report's open question is A: confirm the correction and land with Check Changeset red by design. B would publish, in the 18.3.0 CHANGELOG, a sentence naming a retired page as the one the product now serves.

Other flags in the os-dev-report, answered:

• out_of_scope_findings carrier spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446 for .changeset/27842-disabled-actions-beside-item.md and protocol.zod.ts:755 (the disabledActions description still says "under Setup › Packaged automation" at this head and generates content/docs/references/api/*.mdx): agreed, that is item 4 and the card split it to spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446. It remains a wrong page in published reference docs until spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446 lands; escalated there, not here.
• out_of_scope_findings carrier none: the other pending changesets (28044, 27504, 27378, 27521, 29139) describe the old page as history, and datasetCreate.tsx:17 names "Setup › Datasets" in a comment. Agreed: history is history, and code comments in ui/packages/** are the card's "Not here".
• NOT MEASURED locally (check-plugin-teardown-shape --self-test, check:dual-build-cjs-loads): both ride Lint & Repo Gates and Build Core, green on the head.
• Dogfood: the CI matrix shards are skipped on this head (path-filtered) and the aggregate Dogfood Regression Gate is green; the two dogfood pins were run locally at 53a942ac (18/18), the merge touched neither file nor the producer, and each edit is a toContain of a substring of the producer's exact output, so the pins cannot disagree with the code on this head.
• Test Core and Test UI shards, in progress when the dev reported: all now completed, success.
• The record's own sweep for the old sentence on the head finds it in nothing but history rows and the untouched protocol.zod.ts:755.

④ Design judgment

Does the new sentence send a person to a page that exists and does what the sentence says, per kind?

Action — Setup › Packaged Actions: holds. The Setup app's group_apps carries nav_packaged_actions, label Packaged Actions, component automation:packaged-actions (setup-nav.contributions.ts:64), bound to PackagedActionsPage, whose section does exactly one thing per packaged action: on/off for this deployment through the sys_metadata_activation ledger — the switch the refusal was written for. A type: flow action is switched there by its own name too (acceptance[6]). The sentence offers no clone, and the page has none.

Flow — its package's Automations in Studio, and copy it there under a new name: holds. The pillar is labelled Automations (StudioDesignSurface.tsx:491; engine.studio.pillar.automations). On an open flow of a read-only package with a served _status row, the header draws FlowLedgerSwitch (StudioDesignSurface.tsx:10669-10670, 10796), which flips the same ledger bit through POST /automation/NAME/toggle; a flow its pair overrides is switched by that row alone (#28570). The toggle door switches packaged flows only (engine.ts:5676-5700), and a packaged flow's package is read-only in Studio, so every flow that can carry the refusal has its switch where the sentence says. The copy is New similar in the flow's more-menu (FlowItemMoreMenu, drawn whenever packageId !== null, StudioDesignSurface.tsx:11250), the POST /automation/NAME/clone door with a new machine name and label, so "under a new name" is what the dialog asks for; it is disabled only when the caller cannot author metadata, with the reason in its title. A bookmark of the retired page lands on this pillar (PackagedAutomationRedirect, packagedAutomationStudioPath). Attempts to break it: a flow with no served _status row shows no ledger switch, but such a flow has no ledger row and so never carries this refusal; a package-less flow is never ledger-disabled (the toggle door refuses it by name) and gets the status sentence instead; for a read-only base the copy lands in the paired .custom package, which the dialog says (bodyPair) — "copy it there" still names the door the person uses.

The docs pages, against the code they now cite (prose, read for agreement only): Position Holders and Permission Set Assignment are nav_position_holders and nav_permission_set_assignment in group_people_org, label People & Organization (security-plugin.ts:1652-1656, setup.app.ts:67-69); the Studio item page links to them instead of drawing the sections (SetupAssignmentsLink). Position Holders' Add writes user_id and position only (PositionHoldersSection.tsx:274), so "no business-unit anchor" is true, and sys_user_position.business_unit_id exists (sys-user-position.object.ts:99). The catalog and the on/off switch of a position or a set are in Studio's All metadata area (/studio/~all/metadata/..., STUDIO_ALL_PACKAGES_SEGMENT = '~all'; security-plugin.ts comment: switched on its own page, a capability has no switch), and the old Setup address redirects there (setupMetadataStudioPath), the same wording permission-sets.mdx:385-387 already carried. The matrix editor's When column, the capabilities tab and the Delegated Admin Scope facet are all on that Studio editor (PermissionMatrixEditor.tsx:497, 3467; PermissionAdvancedFacets.tsx:48-50). Sharing rules and record shares stay under Setup › Access Control (sharing-plugin.ts:668-672), so the row left alone is right. Datasets: no Setup entry names them; Studio lists them (nav_datasets, studio.app.ts:210) and the All metadata area edits the dataset's page.

Findings

• should-fix — .changeset/27966-flow-disabled-plain-sentence.md line 13, the unchanged last bullet, still says "Only the last clause differs: a flow can be copied under a new name, and an action cannot". At this head the two sentences differ in two clauses, WHERE and MEANWHILE (the producer's own doc comment says so). The PR's stated reason for touching these notes is that the 18.3.0 CHANGELOG must not publish a sentence the PR made false; this one is such a sentence, one line below the two it rewrote. One phrase fixes it ("The where clause and the last clause differ"). It names no page and sends nobody anywhere, so it is not a must-fix.
• should-fix — content/docs/permissions/administrator-guide.mdx Step 3 says "create the User Position row directly with its business unit" without naming where that is done. The card asks each step to say where the task is done today; the place is the user's record page, Positions tab, whose New opens the assignment form with business_unit_id (sys-user.page.ts:245-265). Naming it is one clause.

No must-fix.

Implemented-by: claude/project-thread-8wildp
Reviewed-by: session_01JQwxbaBjisxkQo9hht9bFB

VERDICT: PASS

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Regen-provenance: 6582421319 · ac192301fa9af8f256c360b87dee985e9f3ca8f5 → 6a1dd2e1fd8926d82bc9fdac3e655519f874c44e · git diff --name-only → .changeset/27966-flow-disabled-plain-sentence.md, content/docs/permissions/administrator-guide.mdx

A prose-only hop: the record's two should-fixes, nothing else. The changed changeset sentence is confirmed sentence by sentence in the seat's ACCEPT.

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

维护者速读

• 改了什么:动作/流程被关闭时的提示句改为指向真实存在的位置(动作 → Setup › Packaged Actions;流程 → Studio 里该包的 Automations);权限文档里指向已退役 Setup 页面的步骤改到现在的位置;两条检查清单条目随之改指向并退役过渡期 knownGaps。
• 为什么改:N-28 已退役 Setup › Packaged automation 和 Access Control 下的旧页面,文档和报错仍把人送去不存在的页面。
• 风险与回滚:只改文字,错误码 ACTION_DISABLED / FLOW_DISABLED 不变;回滚即 revert。
• 先看:packages/types/src/packaged-item-turned-off.ts(句子本体),其次 content/docs/permissions/administrator-guide.mdx。
• 两分钟验证:pnpm --filter @objectstack/types exec vitest run src/packaged-item-turned-off.test.ts,预期 6/6 通过。
• 需要你做的:无。Check Changeset 按设计保持红(改写了两份待发布 changeset,见第 6 条),它不是必查项,席位带红落地。
• 席位意见:契约复审档复核 PASS(6582421319)逐句确认了两份被改写的 changeset;之后只加了一个散文提交(Regen-provenance 6582472184),其中改动的那句席位在下方逐句确认。

席位核对

ACCEPT · domain:devx#1 · head 6a1dd2e1fd8926d82bc9fdac3e655519f874c44e · 2026-11-02T17:00Z

1. Shape: 18 files (+100 / -58): the sentence in packages/types/src/packaged-item-turned-off.ts and its test, five pinned tests elsewhere, six content/docs pages, the two checklist items api-backend.packaged-action-disabled-dispatch (rev 13) and automation.packaged-flow-disable-durable (rev 10) with their TRANSITIONAL knownGaps retired, a new patch changeset, and the two pending changesets 27842-disabled-actions-served.md and 27966-flow-disabled-plain-sentence.md. Inside the claim (6580761426) and its accepted widening; the checklist half waited for PR docs(qa): platform checklist items follow the Studio door after ADR-0146 (#28579 slice 1) #29438 as the serial said.
2. Premise, measured: the contract reviewer read Setup's nav_packaged_actions → PackagedActionsPage (the per-action switch) and the flow switch FlowLedgerSwitch in Studio's Automations pillar, with New similar as the copy door (record 6582421319 ④). The seat read sys-user.page.ts:244–265 for the new administrator-guide Step 3: the user's Positions tab is a record:related_list over sys_user_position whose New opens the assignment form with business_unit_id among its columns.
3. Gates: local 94 derived, 91 exit 0, 2 NOT MEASURED (shallow clone; unrelated dists), 1 red by design (check-empty-changeset). CI on this head: 56 success, 8 expected skips, 1 red: Check Changeset, whose log names exactly the two M rows above and no A collision.
4. Accepted deviations: administrator-guide.mdx:213 left as is (still correct, explained in the PR body). Item 4 (the disabledActions describe in packages/spec) is out, split to spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446 for domain:spec.
5. Out of scope: none new. spec(protocol): the disabledActions describe text still sends admins to the retired Setup › Packaged automation page (item 4 of #29374) #29446 carries the spec half.
6. Landing, with the red: not governed, under 3000 changed lines, Clause-②: no. DELIBERATE CORRECTION confirmed, note by note. For the code-bearing diff: the same-head contract-review-tier PASS 6582421319 on ac192301 judged each rewritten sentence of both notes (answer A). The hop to 6a1dd2e1 touched prose only (Regen-provenance 6582472184), and its one changed release sentence is confirmed here. 27966-flow-disabled-plain-sentence.md, before: "Only the last clause differs: a flow can be copied under a new name, and an action cannot, so the action sentence still offers another action instead." After: "The two sentences differ in two clauses: where an administrator turns the item back on (an action under Setup › Packaged Actions, a flow in its package's Automations in Studio), and what can be done meanwhile (a flow can be copied under a new name, and an action cannot, so the action sentence offers another action instead)." The new sentence matches describeTurnedOffPackagedItem at this head (WHERE and MEANWHILE both vary by kind); the old one became false with this PR. Red-by-design, all three conditions: pr-automation.yml says to leave Check Changeset red for this class and that it is not a required context; the workflow runs on pull_request only, never merge_group; this comment records the gate and the reason. Seat lands it: pr_ready + automerge_enable.