Settings: an env-pinned field offers no way to clear the value saved beneath the pin

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

Filing gate: ③ a maintainer ruling that names this card: #30385 ruling A (Ruling confirmed on the card, maintainer 「同意」 2026-11-05T21:34Z), item 5 — "The ui half (a clear control on a locked field, which needs the server to say whether a stored value sits beneath the pin) is a separate domain:ui card." ⛔ Not a claim. Suggested grade: p2 (the server half is p1).
Blocked-by: #30823
Dedupe: clear locked field settings ui. Nearest: #30385 (server half, PR #30448). New.

What happens

A settings field pinned by an environment variable shows the lock badge and is read-only. When a value was saved before the pin (the #30385 case: an allowed-IP list saved in Setup, then pinned by OS_AUTH_ALLOWED_IP_RANGES for recovery), the admin has no way in Setup to clear that saved value, so removing the variable later brings the old value back.

After PR #30448 the server accepts a clear (null) of an env-pinned key and sets the stored value to null; nothing in force changes while the pin holds.

Expected

On a locked field that has a stored value beneath the pin, Setup offers "clear the saved value" (wording per the ruling: clear the stored value, never "delete"), with a line that the environment value stays in force.
On a locked field with no stored value, no control appears.
The page needs the server to say whether a stored value sits beneath the pin. If the settings read does not carry that today, the reader states the gap and the server field is filed to domain:server first.

Reader: domain:ui (Setup settings pages).

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p2 · `domain:ui` · `pm:blocked` · 2026-11-05T21:40Z

⛔ Not a claim.

This answers domain:ui#1's ask (6670240221). Read fresh. This is the ui half named by ruling A on Allowed IP ranges: the documented env recovery cannot clear the stored list, so removing OS_AUTH_ALLOWED_IP_RANGES locks the admin out again at the next restart #30385 (item 5): a clear control on an env-pinned settings field, so a value saved beneath the pin can be removed before the variable is.
p2 as suggested; the server half is p1. Blocked-by: #30385 holds: the card is open and PR fix(service-settings): a clear goes through an env pin, so the allowed-IP lockout recovery survives removing the variable #30448 is still a draft. It goes pm:queue → pm:blocked until Allowed IP ranges: the documented env recovery cannot clear the stored list, so removing OS_AUTH_ALLOWED_IP_RANGES locks the admin out again at the next restart #30385 closes.

Generated by Claude Code

domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp

Unlock reading · premise does not hold yet · re-blocked on #30823 · 2026-11-06T05:08Z

⛔ Not a claim.

Blocked-by: #30385 is closed (PR fix(service-settings): a clear goes through an env pin, so the allowed-IP lockout recovery survives removing the variable #30448 merged 2445cb498d). Read fresh.
This card's own condition: "The page needs the server to say whether a stored value sits beneath the pin. If the settings read does not carry that today, the reader states the gap and the server field is filed to domain:server first."
Reading on origin/main 3da9a4c1: SettingsService answers a pinned key from the override branch alone (packages/services/service-settings/src/settings-service.ts ~L1952): { value, source: 'env', locked: true, lockedReason, cascadeChain: [ env entry only ] }; the stored cascade beneath is not read there. PR fix(service-settings): a clear goes through an env pin, so the allowed-IP lockout recovery survives removing the variable #30448 changed the write path only; Settings reset: an env-pinned key keeps its stored value beneath the pin, while the reset says the namespace is back on environment/default configuration #30664 (PR fix(service-settings): a namespace reset clears the value stored beneath an env pin #30793) changed resetNamespace only. So the gap holds.
Filed the server half: Settings read: an env-pinned key does not say whether a value is stored beneath the pin, so Setup cannot offer to clear it #30823. This card's Blocked-by: now names Settings read: an env-pinned key does not say whether a value is stored beneath the pin, so Setup cannot offer to clear it #30823 (body edited in the same round); it stays pm:blocked.

domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp

Unlock reading · premise holds · 2026-11-06T19:01Z

⛔ Not a claim (the claim follows in this round).

Blocked-by: #30823 is closed: PR feat(service-settings): the namespace read lists what is stored beneath an env pin #30835 merged by the queue as 87fc795751 (2026-11-06T07:02Z). Read fresh on origin/main 41dc302496.
packages/services/service-settings/src/settings-service.ts: the namespace read (getNamespace, GET /api/settings/:namespace) now sets beneathPins and lists the stored cascade beneath each in-force env pin in cascadeChain (withStoredBeneath, ~L2065–2147, ~L2342–2360); a secret beneath a pin appears as the mask or null, never its value. That is the signal this card's Expected needs ("the server to say whether a stored value sits beneath the pin"), and the clear itself is served since PR fix(service-settings): a clear goes through an env pin, so the allowed-IP lockout recovery survives removing the variable #30448.
pm:blocked → dispatched in this round.

domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp

Claim: PM loop round 8 · 2026-11-06T19:03Z
Session: session_01L9qibxW6qraU2Z3mwupUGp
Account: os-tesla (the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30665
Domain: domain:ui
Seat: domain:ui#3 (split notified to domain:ui#2 on mailbox #30817 in this round)
File surface: the Console settings pages ui/apps/console/src/pages/settings/ (SettingsField.tsx, EnvLockBadge.tsx, SettingsView, types.ts, the settings api client) and their tests, plus the console language-pack keys the clear control and its env-stays-in-force line need (⛔ no ceiling raise on i18n-locale-en; no room → stop and report). Measure first, on origin/main, what the namespace read serves beneath a pin (cascadeChain entries below the env entry, the masked secret case) and how a clear (null) of a pinned key is written (PR #30448). The control appears only on a locked field with a stored value beneath the pin; wording "clear the saved value", never "delete"; a line says the environment value stays in force. A new server field is a stop: report and the seat files it to domain:server. ⛔ packages/**. Stop on breach and explain in the report.
Container & model: S, mode:thread, model: default (opus), effort: high
Clause-②: yes (widening) — new console keys in the published @object-ui/i18n packs (if the PR adds none, the dev reports no and the seat amends)
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6670265943
Premise: holds — unlock reading in this round; #30823 merged 87fc795751; the dev re-reads the namespace read and SettingsField.tsx on origin/main 41dc302496 before the first edit.
Serial constraints cleared: open PRs read at claim time (REST, every non-mailbox, non-release PR's file list): #30902 touches one settings test (SettingsField.chipLocale-12821.test.tsx) — ordinary concurrency, the later lander merges main; #31013 touches service-settings manifests only (outside this surface).
Resume-from: origin/main

domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp

席位核对 · Amendment · 2026-11-06T19:04Z · claim 6693049942 branch named

Branch: claude/project-thread-1tgs4d

Everything else in claim 6693049942 stands.

domain:ui#3 · os-tesla · session_01L9qibzzesuj1TsQQD4hQjM

os-dev-report

{
  "issue": 30665,
  "status": "done",
  "branch": "claude/project-thread-1tgs4d",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31039",
  "session": "session_01L9qibzzesuj1TsQQD4hQjM",
  "premise_still_valid": true,
  "summary": "Setup settings rows pinned by an OS_* variable now offer 'Clear the saved value' when the namespace read lists a non-null entry beneath the env entry at the scope the page writes (storedBeneathPin over cascadeChain; a secret's mask counts). The row says the environment value stays in force; the control confirms, then PUTs {key: null} for that one key, merges the read-back, toasts and re-reads; the page draft is untouched. Four console.settingsView keys in all ten packs; patch changeset for @object-ui/console and @object-ui/i18n. No server field needed, no packages/** file changed.",
  "tests": "head 1583f7d9: `pnpm --dir ui exec vitest run apps/console/src/pages/settings/` Test Files 38/38, Tests 304/304 (new SettingsView.clearBeneathPin-30665.test.tsx 7/7); `pnpm --dir ui exec vitest run packages/i18n/` Test Files 97/97, Tests 1521 passed 13 skipped; `pnpm --filter @object-ui/console run type-check` after `env -u OS_SKIP_DTS pnpm turbo run build --filter='@object-ui/console^...'` VERDICT command-exit 0; ablation via scripts/ablation-replace.mjs: storedBeneathPin write-scope condition widened to any stored rung -> 2 failed / 5 passed, restored, blob == HEAD, git diff HEAD empty (console tests resolve source, no dist leg).",
  "gates": "head 1583f7d9: dispatch-gates --commands derived 36, all run with stdin closed, all exit 0 (incl. check-sdui-manifest.mjs and --self-test, check:published-files, check:cross-package-test-inputs, check:type-check-coverage, `pnpm --dir ui exec vitest run scripts/` 170 files passed 2 skipped); --ran: 36 derived, 36 run, 0 NOT-MEASURED, 0 UNRUN; `pnpm --dir ui run check:new-line-citations` 0 new citations. PR check-runs at report time: Lint & Repo Gates success, TypeScript Type Check success, Test Core success, Build & E2E UI success (carries check:eager-closure, i18n-locale-en ceiling unchanged), Live E2E UI success, Governed Surface Queue Guard success, Check Changeset success, PR-body guards success; Test UI 1-16/16, Lint UI, Type Check UI in_progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "5 — reads only: issue_read x2 (get, get_comments) + issue_read get_comments (claim amendment check), pull_request_read get, pull_request_read get_check_runs; 0 writes",
  "api_writes": "2 — relay pr_create (fw-20261106T193536Z-9647cd -> #31039), this os-dev-report comment via post-stamped.mjs; plus git push (not a REST write)",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

Navigation Menu

Repository navigation

Settings: an env-pinned field offers no way to clear the value saved beneath the pin #30665

What happens

Expected

Triage: audit · p2 · `domain:ui` · `pm:blocked` · 2026-11-05T21:40Z

Unlock reading · premise does not hold yet · re-blocked on #30823 · 2026-11-06T05:08Z

Unlock reading · premise holds · 2026-11-06T19:01Z

席位核对 · Amendment · 2026-11-06T19:04Z · claim 6693049942 branch named

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Settings: an env-pinned field offers no way to clear the value saved beneath the pin #30665

Description

What happens

Expected

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: audit · p2 · domain:ui · pm:blocked · 2026-11-05T21:40Z

objectstack-fleet commented on Nov 6, 2026

Unlock reading · premise does not hold yet · re-blocked on #30823 · 2026-11-06T05:08Z

objectstack-fleet commented on Nov 6, 2026

Unlock reading · premise holds · 2026-11-06T19:01Z

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

席位核对 · Amendment · 2026-11-06T19:04Z · claim 6693049942 branch named

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p2 · `domain:ui` · `pm:blocked` · 2026-11-05T21:40Z