fix(app-shell): pair-added permission sets read Custom in the Studio Access header - #29835

Requested by Steedos · project thread
Fixes #29809

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：Studio「权限」中，定制包（.custom）里的权限集（「新建类似」复制的，或在定制包里新建的）头部标签不再显示「包内置」，而是与左侧列表的「新增」一致，显示自定义标签。
• 为什么改：管理员打开自己复制的权限集，头部却说它是包内置的，无法判断这是谁的权限集、升级包时会不会被覆盖。
• 风险与回滚：只改头部标签选哪个词，判据取自左侧列表已用的定制标记（customizationMarks.ts），不新增读取；基础包自带的权限集、被定制的基础包权限集仍显示「包内置」；Setup 与元数据管理页不传标记，行为不变。回滚即还原本 PR。
• 先看：PermissionMatrixEditor.tsx 的 shippedByPackage 一行；StudioDesignSurface.tsx 中 Access 宿主传入 customizationMark 的一行；StudioDesignSurface.accessPairCopy-29674.test.tsx 新增的三个用例。
• 两分钟验证：cd ui && pnpm exec vitest run packages/app-shell/src/views/studio-design/StudioDesignSurface.accessPairCopy-29674.test.tsx -t 29809，应见 3 个用例通过（复制件、定制包新建件为自定义，基础包权限集为包内置）。
• 需要你做的：无，席位落地。

What changes

• The provenance rule (PermissionMatrixEditor.tsx): shippedByPackage was !!packageId || codeIsArtifact. The pair's package door supplies a packageId, so every set a base's .custom pair holds read "Package" in the Studio header while the rail marked the same row "Added". It is now customizationMark !== 'added' && (!!packageId || codeIsArtifact). Both badge sites (the page badge and the Studio header chip) still read that one value; no badge string, legend or key is touched.
• The mark comes from the host (StudioDesignSurface.tsx, AccessPillar): a new optional page prop customizationMark (type CustomizationMarkKind from customizationMarks.ts). The pillar passes railMarks?.markOf(...) for the open set, the same call the rail row's RailCustomizationMark makes, so the rule is the one customizationMarks.ts holds (ADR-0146 D3) and is not derived a second time.
• Unchanged: a set the read-only base ships still reads Package; a customized base set (a served override) still reads Package, since the base ships it; Setup's permission page and the metadata admin pass no mark.

Tests

• StudioDesignSurface.accessPairCopy-29674.test.tsx, one new top-level describe in the existing real-client harness (real StudioDesignSurface, AccessPillar and PermissionMatrixEditPage over the real metadata client and a fetch stub; base read-only, pair writable):
  • a New similar copy in the pair: the header chip reads Custom and the rail row carries the added mark;
  • a set created in the pair (its draft only, listed from the pair's drafts): the same;
  • CONTROL: the base's own set reads Package and its rail row carries no mark.
• StudioDesignSurface.accessTabs-12456.test.tsx (the Package pin for a package's own set) stays green, unchanged.
• Ablations, each through scripts/ablation-replace.mjs with the on-disk proof and a proven restore to HEAD:
  • the rule back to !!packageId || codeIsArtifact: the two pair cases red, the control green;
  • the host passing customizationMark={null}: the two pair cases red, the control green.

Acceptance notes

• While the base's customization read is in flight, or after it fails, the rail draws no mark, so the header keeps its previous answer (Package) for a pair set. The two agree; no fallback to the row's addedIn was added, since that would be a second copy of the rule (seat ruling on the plan).
• The chip's words are untouched here. The card Studio zh-CN: one word left per state after #29705 — 已关闭 vs 已停用, 自定义 vs 定制, and Access's perm.badge.custom #29729 renames the Custom badge's text, and whichever PR lands second merges main.
• Not measured live: no dev server run. The real-client harness drives the surface end to end; the card measured the rail's "Added" live on 601832b1a6, and an added mark now decides the header regardless of the layered code reading.

Verification

Generated by Claude Code