feat(runtime,metadata-protocol,client,console): Studio publish takes a change note; item history names the person - #28422

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/client, @objectstack/metadata-protocol, @objectstack/runtime, touching 3 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via handlePackagesRequest (symbol, a top-level function))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via publishPackageDrafts (symbol, a method of class ObjectStackProtocolImplementation))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3dd1566002a43bdd29d794a5593b744c2b2d27b9 && git checkout 3dd1566002a43bdd29d794a5593b744c2b2d27b9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 380a1078f153e628eeef2285a75bcf060df35905 5d035cf37ef8b022b0acbf016f107328495eebd7 && git checkout -B drift-repro 380a1078f153e628eeef2285a75bcf060df35905 && git merge --no-ff 5d035cf37ef8b022b0acbf016f107328495eebd7

node scripts/docs-audit/affected-docs.mjs --json 380a1078f153e628eeef2285a75bcf060df35905

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 380a1078f153e628eeef2285a75bcf060df35905 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:ui#5 · os-sales · session_01L6bhgUhKx1XHzkoikGjRB4

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 5d035cf37ef8b022b0acbf016f107328495eebd7
Local-runs: none
Scope: packages/runtime/src/domains/packages.ts, packages/client/src/index.ts, ui/packages/data-objectstack/src/metadata-client.ts + packages/metadata-protocol/src/protocol.ts, packages/rest/src/rest-server.ts

① Derived judgments

The face is the Clause-②: yes (widening) declaration alone: no file under packages/spec/src/** and no governed path is in the diff (check-governed-merges --pr 28422: 0 of 25 paths governed). What widens: POST /packages/:id/publish-drafts now reads a string message from its body (any other type sends no note, no 400), and @objectstack/client packages.publishDrafts opts gain message?: string; MetadataClient.publishPackageDrafts options pick 'backfill' | 'message' off that type. The protocol request type already declared message (protocol.ts ≈L23787), so the method's accept set is unchanged; only the per-item note now reads it, with the old sentence as the fallback when it is absent or empty.

② Semver level

patch for all six packages, as the changeset declares: a new optional key on a request body and an optional opts member, no removal. opts.actor stays in the SDK type (@deprecated), so no caller fails to compile. Behaviour change on the door: a body actor is now ignored and the authorized context's userId is recorded (no user id ⇒ no actor), which is the tightening item 2 of #28406 asks for, not a widening.

③ Boundary flags

resolvePackageWriteActor reads context.executionContext.userId, the same context requireManageMetadata judged on this request, and returns it only as a non-empty string: the rule RestServer.resolveMetaWriteActor (rest-server.ts ≈L3070) holds for the /meta write doors. Only publish-drafts reads it; the six sibling doors still read body.actor and are carried by #28414, as the card's "Not here" says. No other door, schema or published type moves. Item 4 (a request schema in packages/spec) is left on the card for the spec lane (split note 6543345540).

Implemented-by: session_01L6bhgUAnBEBqJCebezxh8P
Reviewed-by: session_01L6bhgUhKx1XHzkoikGjRB4

VERDICT: PASS

Generated by Claude Code

domain:ui#5 · os-sales · session_01L6bhgUhKx1XHzkoikGjRB4

ACCEPT · 2026-10-31T14:06Z
Head-sha: 5d035cf

席位核对

1. Shape: 25 files (+819 / −23): the publish-drafts door in packages/runtime/src/domains/packages.ts (forwards a string message, records the authorized userId, ignores a body actor), the per-item note in publishPackageDrafts (packages/metadata-protocol/src/protocol.ts), the SDK opts in packages/client/src/index.ts, MetadataClient.publishPackageDrafts, the note field in DraftChangesPanel.tsx, actor names and notes in HistoryPanel (ResourceHistoryPage.tsx, new historyActors.ts), i18n, four new test files, one moved pin, one patch changeset. Inside claim 6543324409; packages/spec/src/** and StudioDesignSurface.tsx untouched. Part of #28406, no closing keyword. Not governed, 842 lines (check-governed-merges --pr 28422).
2. Premise, measured at claim: the door passed body.actor and backfill, never message; protocol.ts hard-coded publish app package '<id>' on every history row; the panel printed the raw id. The diff fixes each at its site.
3. Contract: Clause-②: yes (widening), declaration face only; TIER_DEFAULT review record by this seat, PASS on this head (6544420721).
4. Gates (check-runs on this head): 67 runs, 57 success, 10 skipped by design (opt-in / scheduled / docs), 0 other; Test Core, Test UI, Lint & Repo Gates, TypeScript Type Check, Check Changeset, Governed Surface Queue Guard success. The dev's local battery: dispatch-gates --commands 67/67, 0 NOT MEASURED after the prerequisites were built; five ablations each red then restored.
5. Deviations accepted: Metadata-protocol: none in place of the claim's yes (the changeset gate's vocabulary is added | narrowed | semantic | none, and no metadata author's input changes); the publish-review keys land in all ten locale packs (all-locales-key-parity.test.ts); usePublishAllDrafts.ts unchanged (neither of its surfaces has a review step). At the seat's request the zh hint was set in full-width punctuation (5d035cf3, one line) and the PR body's Verification now carries the re-run readings.
6. Out of scope: the six sibling package doors' actor (runtime: the package doors record whatever actor the request body names — publish, save, discard, revert, rollback, reassign and duplicate write a caller-chosen name into metadata history #28414); item 4, the request schema in packages/spec (split note 6543345540).
7. Changeset, read sentence by sentence: patch for six packages; each paragraph (note reaches every history row, empty keeps the old sentence, actor is the signed-in caller with NULL for a system context, opts.actor kept deprecated, Studio note field and history names) is true against the diff.
8. Landing: pr_ready + automerge_enable through the relay, MERGED confirmed, then the partial-landing release of Studio: publishing takes a change note and item history names the person — the note reaches publish-drafts, the actor is the session user, and it is shown by name, not id #28406 to pm:queue with item 4 named as the remainder.

Generated by Claude Code