fix(plugin-audit): the activity list opens newest first, without platform rows, under a plain name - #30230

Requested by Bill · project thread

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

Fixes #30036

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：首页「查看全部动态」打开的列表默认按时间从新到旧，只列人对业务记录做的改动；元数据、迁移、用户与成员（含登录戳）、签名密钥这些平台行移到同页「全部条目」视图；标题改为「动态」，描述改成白话。
• 为什么改：经理点进去想看「今天发生了什么」，看到的是乱序的原始表，夹着平台内部行，标题还和 CRM 自己的「活动」撞名。
• 风险与回滚：只改 sys_activity 的声明（两个列表视图、标签、描述）和译文，不删数据、不改写入；回滚即撤销本 PR。
• 先看：packages/plugins/plugin-audit/src/objects/sys-activity.object.ts（默认视图的过滤条件与排除名单）、sys-activity-default-view.integration.test.ts。
• 两分钟验证：pnpm dev:crm 登录后新建一个客户，点首页「查看全部动态」，应只见刚才的客户行且最新在上；切到「全部条目」能看到登录戳、签名密钥与迁移行。
• 需要你做的：无，席位落地。

Proposed title wording (acceptance 4)

The object label becomes Activity Feed (zh-CN 动态, ja-JP アクティビティフィード, es-ES Feed de actividad), with the default view titled Recent activity (zh-CN 最近动态) and the second view All entries (zh-CN 全部条目). In the CRM this reads 「动态 / 最近动态」 beside the app's own 「活动」 sidebar entry, and matches the Home link's own word 「查看全部动态」. One overlap to weigh: the Studio capability toggle enable.feeds is also rendered 动态 in zh-CN; it labels a switch on the object form, not a page, so I kept 动态 here. If you prefer to keep them apart, 动态流 is the alternative.

What changes

packages/plugins/plugin-audit/src/objects/sys-activity.object.ts (the platform half the triage routed here) declares two list views on sys_activity, plus a new label and description:

• recent, declared first. Both doors (Home's 查看全部动态, HomePage.tsx, and the bell's Activity tab, InboxPopover.tsx) open /apps/APP/sys_activity with no view named, and the Console then opens the first declared view (ObjectView.tsx: requested view, then the reader's pinned view, then an isDefault view, then views[0]). So the doors needed no change and no ui/** file is touched. The view sorts timestamp descending and filters:
  • actor_id is not null: a person acted. A system write leaves the actor null (ADR-0118 D1): the migration ledger, platform settings written at boot, seeds.
  • object_name not in: the metadata store (sys_metadata, sys_metadata_history, sys_metadata_commit, sys_metadata_audit), the data-migration ledger (sys_migration, sys_migration_journal), and every object the identity domain declares, derived from the exports of @objectstack/platform-objects/identity (sys_user, sys_member, sys_organization, sys_invitation, sys_session, sys_jwks, teams, business units, OAuth and SCIM objects, …). The metadata-store names are spelled out, because check:platform-object-tenancy-census loads every object file from source and cannot evaluate @objectstack/metadata-core's root entry (its only export of those definitions); the new test holds them equal to the definitions' own names, so a rename reds there.
• all: every row the reader may read, newest first, no filter.
• Label Activity Feed, description "What people did to records recently, newest first: who created, changed or deleted what. Entries are kept for 14 days." (the 14 days is the object's own lifecycle.retention.maxAge).
• Translations in the zh-CN / ja-JP / es-ES bundles (hand-written leaves; check-i18n-bundles --write regenerated en and dropped the source-hash entries for the re-translated leaves).

Why the identity domain is excluded by object rather than by actor (measured on fresh pnpm dev:crm boots, see Verification): the sign-in stamp (Updated User "Dev Admin": Last Login At and Last Login IP), the first signing-key mint (Created 签名密钥 (JWKS)) and an administrator adding a person (Created User "Mia Member", Created Member "ID (member)") are all written under a person's own id, not as the system, and the added person can read the last two. The only column that tells a sign-in stamp from a profile edit is changed_fields, and parent-field-query-guard.ts refuses a filter on that column for any reader withheld a field anywhere, so a default view naming it would 403 for members. Consequence: an administrator's edits to users, members and organizations are in all, not recent.

Rows stay where they are (acceptance 2, second sentence): nothing is deleted and nothing changes in what is written. An administrator reaches every excluded row in two places: the all view on the same page, and the compliance ledger sys_audit_log (Setup's audit log), which holds its own row for each CRUD-mirrored write (measured: sys_migration create, sys_user update, sys_platform_setting create, sys_platform_setting_audit create are all on the ledger).

Acceptance

1. The page opened from these doors shows newest first by default.

recent is first and sorts timestamp desc. Browser: three accounts created about a second apart list as 远航贸易, 星河科技, 华东物流有限公司 (newest first). Test: `recent` serves only what people did to records, newest first.

2. Rows about platform internals (metadata history and drafts, migrations, a user's login stamps) are not in that default page. The rows stay available to an administrator on the audit surface.

Browser as admin: recent lists 3 rows; all lists 8, including the sign-in stamp, the JWKS mint, the migration and the two platform-setting rows. Drafts are sys_metadata rows and fall under the same exclusion. Audit surface: see above.

3. The description a reader sees says what the page is, in plain words.

Browser header: 「最近大家对记录做了什么，按时间从新到旧：谁新建、修改或删除了什么。条目保留 14 天。」

4. The page's title does not collide with an app's own 活动. The wording is the implementer's to propose on the PR.

Proposed above. Browser header: 「动态 / 最近动态」, with the CRM's own 「活动」 entry visible in the sidebar beside it.

5. A browser check as an admin and as a member.

Admin: as above. Member, after merging origin/main with #30108's PR #30222 (member_default now reads sys_activity): a user the admin created and gave the CRM's sales_rep position. Home shows the activity card and its 查看全部动态 link; the link opens recent: 3 rows, 创建了 客户 "远航贸易" / "星河科技" / "华东物流有限公司", newest first. ?view=all shows 5: the same three plus 创建了 成员 "ID (member)" and 创建了 用户 "Mia Member", the platform rows recent leaves out. The plain API read of the object (no view) returns the same 5 in no time order, which is the defect the default view closes.

Tests

• New packages/plugins/plugin-audit/src/sys-activity-default-view.integration.test.ts (9 cases): the declaration (first view is recent, both views sort timestamp desc, the excluded list equals the definitions' names, the identity objects measured writing under a person's id are in it, all carries no filter, the old description and label are gone), and on a real engine + driver-sqlite-wasm + AuditPlugin: the real CRUD mirror leaves actor_id null for a system write and the person for a person's; recent's own rules, lowered the way the Console lowers a view filter and parsed by the server's parseFilterAST, serve exactly the person's business rows newest first; all still lists the excluded kinds (sign-in stamp, metadata, signing key, member added, migration).
• Ablation, one rule at a time with scripts/ablation-replace.mjs --delete (run at 61bb8996; neither rule line has changed since): removing the actor_id rule → 1 failed / 7 passed; removing the object_name rule → 1 failed / 7 passed; both restores verified blob == HEAD.
• pnpm --filter @objectstack/plugin-audit test at 2110d932 (after merging origin/main): Test Files 71 passed (71), Tests 1137 passed (1137); pnpm --filter @objectstack/plugin-audit typecheck → exit 0.

Acceptance notes

• recent is the same cut as Home's activity card only as far as a query column can say it. Home narrows to the objects the reader's apps list (a client-side roster); a server-declared view cannot know that, so a person's edit of another platform object (a permission set, a setting) still appears in recent. The excluded list covers every platform row the card named plus the two measured on a fresh boot.
• System-written rows on business objects (a seed, an automation run as the system) are out of recent by the actor rule, as they are out of Home's card ("real human actions only").
• Screenshots: I have no image-hosting path through the relay, so the six screenshots (admin Home, admin recent, admin all, member Home, member recent, member all) are held with the seat; the readings above are the page text captured from the same runs.

Verification

node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0
node scripts/check-adr-0087-registration.mjs --self-test :: exit 0
node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-empty-changeset.mjs --base origin/main :: exit 0
node scripts/check-empty-changeset.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/check-tenant-audit-census.mjs :: exit 0
node scripts/check-tenant-audit-census.mjs --self-test :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
node scripts/ci/prune-turbo-cache.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0
node scripts/release-pending-publish.mjs --self-test :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm check:changeset-gate-self-tests :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:i18n :: exit 0
pnpm check:i18n-stale-fill :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:keyed-text-bounds :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:objectql-double-limit :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:platform-object-tenancy-census :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:registry-log-declared :: exit 0
pnpm check:rest-log-spy-declared :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:system-context-census :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:undeclared-dep-imports :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

Generated by Claude Code