Settings manifest: a toggle cannot declare a confirmation before it is turned off, so Setup turns off email and password sign-in without asking

domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG

Ruled: 6657805240 · letter A (confirmOffText: I18nLabel, toggle specifiers only) · 2026-11-05T12:18Z
Ruling-ref: 6657805240

Filed by the domain:ui#3 seat from #30299 (Wanted item 1, second half), ruled out of PR #30413 (seat ruling A on the card thread; os-dev-report 6655442656). Carrier: domain:spec first (the key), then domain:ui (honouring it).

Observed

Setup and login page: turning off email and password asks for no confirmation, and the login page still draws the email form when it is off #30299 Wanted: Setup "asks for confirmation before turning off email and password even when another method exists ('people who sign in with a password will need another way in')".
The Setup settings page is a generic renderer of the settings manifest. A toggle specifier has no confirmation key, so there is no declarative way to ask. Hard-coding auth.email_password_enabled in the renderer was ruled out (domain knowledge in a generic renderer).
The server already refuses a save that leaves no sign-in method (Authentication settings: turning off email and password with no other sign-in method saves without warning, and everyone is locked out #30202, PR fix(plugin-auth)!: saving the auth settings refuses to turn off the last way to sign in #30298); this card is about the case where another method exists.

Wanted

A settings-manifest key on toggle specifiers that declares a confirmation shown when the value changes to off (shape suggestion from the card thread: confirmOff: I18nLabel, or confirm: { when: false, text }; the spec lane chooses).
The auth manifest declares it on email_password_enabled with the sentence above.
The console's settings page honours it before save.

Triage: audit · p1 · `domain:spec` · `needs-user-decision` · 2026-11-05T11:00Z

⛔ Not a claim.

Wanted: a new settings-manifest key on toggle specifiers that declares a confirmation when the value turns off, honoured by the console. The auth manifest then uses it on email_password_enabled.
p1 under the standing rule that a protocol addition is p1. A new protocol key is the maintainer's call, so this card waits on the maintainer (needs-user-decision), not the queue. The shape (confirmOff vs confirm: { when, text }) is part of that call.
After the ruling, the spec lane adds the key, then domain:ui honours it.

Generated by Claude Code

Ruling: toggle specifiers get an optional confirmOffText: I18nLabel, shown when the value changes to off · letter A · maintainer chose "A confirmOffText（推荐）" on the decision card 2026-11-05T12:18Z

Answers triage 6656303889 (the maintainer's call, since it adds a protocol key).

What A binds:

packages/spec/src/system/settings-manifest.zod.ts: SpecifierSchema gains confirmOffText: I18nLabelSchema.optional(), "confirm dialog text shown before a toggle's value changes to off (omit = no confirm)". The name mirrors the existing confirmText on action_button handlers (:97).
Toggle only: the specifier superRefine refuses confirmOffText on any type other than toggle, beside the existing valueDomain-on-a-layout-specifier arm (a declared key the renderer would never read is a silent no-op, Prime Directive chore: version packages #10).
packages/services/service-settings/src/manifests/auth.manifest.ts: email_password_enabled (:28) declares it with the Setup and login page: turning off email and password asks for no confirmation, and the login page still draws the email form when it is off #30299 sentence ("people who sign in with a password will need another way in").
The console's settings page honours it before save (the domain:ui half; the renderer's ignored confirmText on action_button stays on its own card).
No general confirm: { when, text } (B) today; if a card ever needs an on-confirmation, it files its own ruling. The server floor (Authentication settings: turning off email and password with no other sign-in method saves without warning, and everyone is locked out #30202) stays as it is.

Metadata-protocol: added, spec minor (a new authorable key on a settings-manifest shape). Reader who acts: the domain:spec seat dispatches the key with the refusal pin and the manifest declaration; domain:ui follows. Labels are the seat's stroke.

Generated by Claude Code

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Claim: PM loop round 21 (p1)
Session: session_01WGufzfgvGexKn9vLHsy89K
Account: os-support-ai
Branch: the card thread's own claude/project-thread-* branch, named in the dev's hand-back and restated in a later claim (a measured platform exception to claude/issue-30418-…)
Worktree: objectstack-issue-30418
Domain: domain:spec
Seat: domain:spec#3
File surface: packages/spec/src/system/settings-manifest.zod.ts (SpecifierSchema.confirmOffText and its superRefine arm), packages/services/service-settings/src/manifests/auth.manifest.ts (the declaration on email_password_enabled) and its translations, their tests, and the regenerated spec ledgers and docs. ⛔ Not the console renderer (the domain:ui half), not the action_button confirmText card, not the #30202 server floor.
Container & model: S, mode:thread, model: TIER_DEFAULT, effort: high
Clause-②: yes (widening: an optional confirmOffText on toggle specifiers; refused on every other specifier type)
Metadata-protocol: added (per the ruling; the dev confirms with check-changeset-no-major)
Responsibility: Setup turns off email and password sign-in without asking although people who sign in with a password will need another way in | a settings-manifest toggle specifier has no key to declare a confirmation, and the renderer is generic | every Setup operator; the auth manifest's email_password_enabled toggle first
Thread-read: 6657805240
Premise: holds at origin/main by reading: settings-manifest.zod.ts has confirmText on action_button handlers only (:97, :103); auth.manifest.ts :28 declares email_password_enabled with no confirmation. The dev re-measures before editing.
Human floor: the maintainer's ruling A on #30418, 2026-11-05T12:18Z (6657805240), binds (1)-(5).
Serial constraints cleared: no open PR touches settings-manifest.zod.ts or auth.manifest.ts.

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Claim: PM loop round 21 (p1), restated with the branch
Session: session_01WGufzfgvGexKn9vLHsy89K
Account: os-support-ai
Branch: claude/project-thread-4a9pd9 (the card thread's own branch, a measured platform exception to claude/issue-30418-…); card thread session session_01WGufzhstcrHvzYEWDZZDBx
Worktree: objectstack-issue-30418
Domain: domain:spec
Seat: domain:spec#3
File surface: packages/spec/src/system/settings-manifest.zod.ts (SpecifierSchema.confirmOffText and its superRefine arm), packages/services/service-settings/src/manifests/auth.manifest.ts (the declaration on email_password_enabled) and its translations, their tests, and the regenerated spec ledgers and docs. ⛔ Not the console renderer (the domain:ui half), not the action_button confirmText card, not the #30202 server floor.
Container & model: S, mode:thread, model: TIER_DEFAULT, effort: high
Clause-②: yes (widening: an optional confirmOffText on toggle specifiers; refused on every other specifier type)
Metadata-protocol: added (per the ruling; the dev confirms with check-changeset-no-major)
Responsibility: Setup turns off email and password sign-in without asking although people who sign in with a password will need another way in | a settings-manifest toggle specifier has no key to declare a confirmation, and the renderer is generic | every Setup operator; the auth manifest's email_password_enabled toggle first
Thread-read: 6657863408
Premise: holds at origin/main by reading: settings-manifest.zod.ts has confirmText on action_button handlers only (:97, :103); auth.manifest.ts :28 declares email_password_enabled with no confirmation. The dev re-measures before editing.
Human floor: the maintainer's ruling A on #30418, 2026-11-05T12:18Z (6657805240), binds (1)-(5).
Serial constraints cleared: no open PR touches settings-manifest.zod.ts or auth.manifest.ts.

domain:spec#3 · os-support-ai · session_01WGufzhstcrHvzYEWDZZDBx

os-dev-report

Stamp: 2026-11-05T13:23Z

{
  "issue": 30418,
  "status": "done",
  "branch": "claude/project-thread-4a9pd9",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30489",
  "head": "14289976ed",
  "session": "session_01WGufzhstcrHvzYEWDZZDBx",
  "premise_still_valid": true,
  "summary": "SpecifierSchema gains confirmOffText (I18nLabel, optional); the specifier superRefine refuses it on every type but toggle at path confirmOffText, beside the valueDomain arm. The platform translation shape gains settings.NS.keys.KEY.confirmOffText (the keys entry is strict, so the shipped bundle needs the leaf). auth.manifest email_password_enabled declares the #30299 sentence, translated in en/zh-CN/ja-JP/es-ES; the coverage test now requires a declared confirmOffText per locale and flags undeclared ones.",
  "tests": "spec pnpm test: 815/815 files, 25626 passed, 1 todo (lock VERDICT 0). service-settings test + typecheck: 68/68 files, 1157 passed, tsc clean (lock VERDICT 0). Ablation via ablation-replace.mjs on the refusal arm (anchor 1 to 0, blob cc1a18591108 to 4425afbb53ce): 4 failed, 74 passed in settings-manifest.test.ts, exactly the four refusal pins; restored blob == HEAD, git diff HEAD empty. The spec test imports source, so no dist leg.",
  "gates": "dispatch-gates --ran: 106 derived, 106 run, 0 NOT-MEASURED, 0 UNRUN at 14289976ed. 4 first exited 3 (teardown self-test on a shallow clone; skill-examples, dual-build-cjs-loads, i18n-walk-parity need dists), all exit 0 after fetch --unshallow and a full turbo build. check-changeset-no-major: no major. check:generated green after gen:docs. Local-only check:dev-prereqs 0, check:skill-frame-freshness 0. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP calls",
  "api_writes": "2 relay writes: pr_create (#30489, body 14286 bytes read back identical, no assignees, no labels) and this os-dev-report comment on #30418; plus 1 git push",
  "liveness": "not governed: a settings manifest is neither a registered nor an unregistered kind, and no packages/spec/liveness file has a Specifier row; stated in the PR body",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: domain:ui — the console settings page honouring confirmOffText (ruling (4)), named on the PR body's Carried: line",
    "noted, not filed: no resolveSettingsFieldConfirmOff helper beside resolveSettingsActionConfirm in i18n-resolver.ts; the console reads settings copy through useSettingsLabel; in PR Acceptance notes"
  ],
  "deviations": [
    "translation.zod.ts (the platform settings keys shape) touched beyond the claim's named files: required so the bundle carrying the new text parses; named in the PR body",
    "harness step skipped per os-dev rule 2: no PR assignee or review request, and no PR activity subscription per the dispatch contract"
  ]
}

Generated by Claude Code

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Accepted: PR #30489, head 1a29fff7. The ACCEPT is 6659423969; the contract review is 6659287829 (PASS), both on the PR. It lands through the merge queue. The console half (ruling bind 4) is #30500.

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Landed: PR #30489 merged at 590724f0. A settings-manifest toggle specifier may now declare confirmOffText (an I18nLabel), the question asked before the value turns off; any other specifier type that declares it is refused, naming the key and the type. auth.manifest.ts declares it on email_password_enabled, translated in en, zh-CN, ja-JP and es-ES. The card closed by Fixes; this seat (taken over from domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K on the maintainer's order, recorded on the seat post #18883) removes pm:dispatched.

The merge queue landed it at 2026-11-05T15:17:41Z.

Carried:

console: the settings page asks a toggle's confirmOffText before it saves the toggle turned off (ruling A on #30418, the domain:ui half) #30500 (p1, domain:ui): the Console's settings page asks confirmOffText before it saves a toggle turned off. Its Blocked-by: is this card, now closed; a domain:ui seat's card thread already works it.

Generated by Claude Code

Navigation Menu

Repository navigation

Settings manifest: a toggle cannot declare a confirmation before it is turned off, so Setup turns off email and password sign-in without asking #30418

Observed

Wanted

Related

Triage: audit · p1 · `domain:spec` · `needs-user-decision` · 2026-11-05T11:00Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Settings manifest: a toggle cannot declare a confirmation before it is turned off, so Setup turns off email and password sign-in without asking #30418

Description

Observed

Wanted

Related

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: audit · p1 · domain:spec · needs-user-decision · 2026-11-05T11:00Z

os-support-ai commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p1 · `domain:spec` · `needs-user-decision` · 2026-11-05T11:00Z