[objectstack-fleet]

Requested by Tesla · project thread
domain:ui#2 · os-tesla · session_01L9qibwKGwfa8bd6GQV8vHC

Fixes #30325
Supersedes #30545 (same reviewed diff, resumed from claude/project-thread-o1qmt2@816df8503f on this thread's own branch; its strings now live in the lazy marketplace namespace).

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：市场应用详情页点「安装」（装进本运行时）不再立刻开装，先弹控制台自己的确认框，写明会加入几个对象、几个权限集、几条示例记录，以及装后会建议把哪个权限集授予所有已登录用户；确认框里再点「安装」照原样安装，「取消」什么都不装。示例数据仍默认加载。行为与 feat(console): a marketplace app's Install confirms what it adds before it installs #30545 已过席位复核的版本完全相同。
• 为什么改：Marketplace install starts on one click, with no view of what it will add #30325 实测：HotCRM 一点安装就直接 处理中…，一次加了几十个对象、权限集和 369 条示例记录，管理员事先看不到。feat(console): a marketplace app's Install confirms what it adds before it installs #30545 当时被首屏英文语言包的体积上限挡住；perf(i18n, app-shell)!: the marketplace pages' strings leave the eager language packs for a lazy marketplace namespace #30640 把市场文案搬进按需加载的 marketplace 文案包后，本 PR 把确认框的 11 条文案也放进那里，首屏语言包一个字节都不增加。
• 风险与回滚：只改前端；数字取自页面原本就在读的同一份版本 manifest（install-local 实际安装的也是它），不新增请求；读不到 manifest 时确认框如实说读不到，安装照常可用。首屏 i18n-locale-en 57,003 / 60,000 gz，与 main 相同，上限未动。回滚即还原本 PR。
• 先看：ui/packages/app-shell/src/console/marketplace/installPreview.ts（计数口径）、MarketplacePackagePage.tsx 的 doInstallLocal / runInstallLocal 与新 AlertDialog、ui/packages/i18n/src/namespaces/marketplace/en.ts 的 install.preview 段。
• 两分钟验证：pnpm --dir ui exec vitest run packages/app-shell/src/console/marketplace/__tests__/MarketplacePackagePage.installPreview-30325.test.tsx packages/app-shell/src/console/marketplace/__tests__/installPreview-30325.test.ts，预期 12 个用例全绿。
• 需要你做的：无，席位落地。
• 席位意见：ui 席 2 对照 head 5d7d5c34 复核：确认框行为与 feat(console): a marketplace app's Install confirms what it adds before it installs #30545 已复核版本相同，计数只读页面原有的同一份 manifest，不新增请求；11 条文案进按需加载的 marketplace 文案包，首屏英文包 57,003 / 60,000 gz、上限未动。marketplaceApi.ts 与 installPreview.ts 不在 @object-ui/app-shell 入口导出，marketplace 命名空间只导出无键类型的目录，故 Clause-② no 成立，不欠契约复审。同意落地。

What changes

The behaviour is the one PR #30545 carried and the seat reviewed on its diff; this PR resumes that branch at 816df8503f, merges origin/main (which now holds PR #30640, the lazy marketplace namespace), and moves the confirm's strings into that namespace. Nothing else in the reviewed diff changed.

• The confirm. The package page's local Install (doInstallLocal) now opens an AlertDialog instead of posting at once. It names the package, then lists Objects / Permission sets / Sample records as label and number, a note that sample records load with the app and can be cleared from this page afterwards, and one line per permission set the install will suggest granting to Everyone (nothing is granted until an administrator accepts). Its Install calls runInstallLocal, the unchanged install body (modes, result notes, refusals all as before); Cancel installs nothing. Reinstall gets the same confirm with a reinstall title.
• Where the counts come from (installPreview.ts, a pure reader). The page already read GET /api/v1/marketplace/packages/ID/versions/latest/manifest for installModes; that body is what install-local fetches and installs. marketplaceApi.ts exposes the body read (getServedPackageBody) and the mode reader as a pure function (declaredInstallModesOf), and the page derives both the modes and the preview from the ONE read. Objects (list or name-keyed map), permission sets (only a LIST of named sets), sample records (top-level data[] seed datasets, "up to N" when a dataset is env- or locale-scoped), suggested grants (sets declaring isDefault: true, ADR-0090 D5), across every package body the artifact carries.
• Sample-record count, read one way with After installing an app, say how much sample data was loaded and offer clearing it right there #30323. Before install: the declared seed records above. After install: sampleRecordsLoaded reads the install answer's seeded.
• Unreadable manifest. The confirm says what the package adds could not be read and the install result will say what loaded; its Install still installs.
• Strings, now lazy. marketplace.install.preview.* (11 keys) sit in ui/packages/i18n/src/namespaces/marketplace/LANG.ts for all ten languages, inside each catalogue's install group right after unmanagedIgnored, text byte-identical to feat(console): a marketplace app's Install confirms what it adds before it installs #30545's. The eager packs (src/locales/LANG.ts) are exactly origin/main's. Studio's packages page does not read these keys (the confirm is drawn only by MarketplacePackagePage, which renders under MarketplaceNamespaceGate), so none belongs in the resident set; marketplaceNamespaceBoundary.test.ts holds that. atMost stays on the count-neutral list of count-families-11445.test.ts.
• Merge. The only hand resolution in MarketplacePackagePage.tsx is the import block: main's multi-line sampleDataNotice.js import kept, the installPreview.js import added above it.
• Changeset. .changeset/30325-install-confirm-what-it-adds.md, @object-ui/app-shell and @object-ui/i18n patch; its Strings line now names the namespace.

Branch: the harness-assigned claude/project-thread-7yy8nl, not claude/issue-30325-*; the card is #30325 (claim 6677784267).

Tests

• MarketplacePackagePage.installPreview-30325.test.tsx (6 cases, real marketplaceApi over a stubbed fetch) and installPreview-30325.test.ts (6 cases), as in feat(console): a marketplace app's Install confirms what it adds before it installs #30545, now resolving their strings through the namespace frame.
• Existing local-install tests click the confirm after Install (credentialStep-27238, dependencyMissing-25792, installMode-12288, protocolCheckSkipped-30326, sampleDataNotice-30323, servedTruth-12098, walledCatalogPackageRefusal-7611). No assertion changed. The whole console/marketplace/ directory, including the tests main added since feat(console): a marketplace app's Install confirms what it adds before it installs #30545's base, passes on this head.
• The positive control was feat(console): a marketplace app's Install confirms what it adds before it installs #30545's (page restored to its base with the new tests kept: 6 failed / 6); the page source is unchanged here apart from the import merge, so it was not re-run.

Acceptance notes

• Eager budget, no ceiling raise. Console CI=true vite build on ff5d4116cf: i18n-locale-en reads 57,003 gzip bytes against the 60,000 ceiling (headroom 2,997), the same reading perf(i18n, app-shell)!: the marketplace pages' strings leave the eager language packs for a lazy marketplace namespace #30640 recorded for main; PER_CHUNK_GZIP_CEILINGS untouched. The confirm's strings ship in the lazy i18n-ns-marketplace-LANG chunks (the en one contains "Reading what this package adds"; the eager i18n-locale-en chunk does not).
• Live measurement. Not re-run on this head; feat(console): a marketplace app's Install confirms what it adds before it installs #30545's live run (real showcase stack with a stand-in control plane: the confirm read 3 / 2 / 13 and the install answer seeded 13) covers the unchanged behaviour. The string move is covered by the namespace frame tests, which render the page through the lazy catalogue.
• Same class, not in this PR (from feat(console): a marketplace app's Install confirms what it adds before it installs #30545, carried to the seat there): the catalog page's organization-package Install (MarketplacePage.tsx doOrgInstall) also posts install-local on one click with no confirm (read in code, not run).

Verification

All on head 5d7d5c349a unless noted (ff5d4116cf differs from it only in the changeset text).

Readings

• pnpm --dir ui exec vitest run packages/app-shell/src/console/marketplace/ packages/i18n/ (on ff5d4116cf, under the verify lock): 152 files passed, 1992 tests passed, 13 skipped; VERDICT command-exit 0.
• pnpm --dir ui check:eager-closure (on ff5d4116cf): exit 0, i18n-locale-en 57,003 gz / 60,000.
• pnpm --dir ui run check:i18n-keys, check:i18n-dead-keys, check:eager-locale-catalogues, check:spec-symbols, check:control-bytes, check:new-line-citations; node scripts/check-i18n-en-drift.mjs --base origin/main (from ui/): exit 0 each.
• pnpm --filter @object-ui/i18n run type-check, pnpm --filter @object-ui/app-shell run type-check (after a declaration build of @object-ui/app-shell^...): exit 0 each.
• eslint --no-inline-config on the 23 changed ui source and test files: 0 errors.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 35 derived families, each exit 0 (pnpm --dir ui exec vitest run scripts/: 170 files, 4979 tests passed); --ran: 35 derived, 35 run, 0 NOT-MEASURED, 0 UNRUN.
• Change size: 24 files, +663 / -11.

[objectstack-fleet]

domain:ui#2 · os-tesla · session_01L9qibw7DekEe3wx5f3zphf

席位核对 · ACCEPT · 2026-11-06T06:54Z · head 5d7d5c349a

Seat domain:ui#2 reviewed the diff of its own dispatch (claim 6677784267 on #30325, card thread session_01L9qibwKGwfa8bd6GQV8vHC; the code is the thread's, resumed from domain:ui#6's reviewed branch o1qmt2@816df850).

1. Shape: 24 files, +663 / -11: the local Install opens an AlertDialog that counts objects, permission sets and sample records from the version manifest the page already reads (installPreview.ts), and names the permission sets the install will suggest for Everyone; its Install runs the install as before. 11 marketplace.install.preview.* keys in all 10 languages of the lazy marketplace namespace. Fixes #30325, Supersedes #30545 (closed 6678584193).
2. Premise measured: the old head's only red was check:eager-closure (60,113 / 60,000 gz); after PR perf(i18n, app-shell)!: the marketplace pages' strings leave the eager language packs for a lazy marketplace namespace #30640 (d996c381), i18n-locale-en reads 57,003 / 60,000 with no ceiling raise.
3. Gates / check-runs: 55 runs on this head: 43 success, 11 skipped, 1 red, PR-body guards, whose only failing step is "No other open PR may claim the same issue" against feat(console): a marketplace app's Install confirms what it adds before it installs #30545, now closed; this body edit re-runs it. Report 6678538448: marketplace + i18n vitest 152 files / 1,992 passed; type-check app-shell + i18n 0; 35 derived gates exit 0.
4. Accepted deviation: none.
5. Out of scope / Skills-docs: none filed; Metadata-protocol: none, Skills-docs: not owed. Serial: the 11 keys sit in the pt / zh namespace files that i18n phase 2 (Console UI): ui/packages/i18n reads PLATFORM_LOCALES, adds zh-Hant, and moves pack keys to table tags #30511's PR re-tags; that thread carries them (notified).
6. Landing: check-governed-merges --branch: 0 of 24 paths governed, 674 changed lines → Tier S path. Clause-②: no (no entry export, the namespace exports no key-typed catalogue): no contract review owed. Landing on the maintainer's standing word 「按 pm-dispatch 审过的pr你可以自主落地」 (2026-10-30T14:20Z) and 「ui 车道跟进一下 3小时内没更新的pr和已派发的issue，接手处理。」 (2026-11-06T05:20Z): relay pr_ready, then automerge_enable once PR-body guards reads green.