fix(app-shell): a local install's Details page offers its local menu on a marketplace-off runtime that mounts install-local (objectui#11627)

[objectstack-fleet]

Fixes #11627

Clause-②: no

On a runtime with no marketplace that still mounts install-local (an offline boot, OS_CLOUD_URL=off), a local install's Details page now offers its local menu: re-seed sample data, purge sample data, uninstall from this runtime. Everything that needs a marketplace stays refused.

What changed

MarketplacePackagePage answered !marketplaceEnabled with MarketplaceDisabled before anything else, so the local menu further down was unreachable. Now:

• Local half. When the runtime config reports features.installLocal (the same getRuntimeConfig() read the page already used, no new loader) and the viewer is an admin, the page draws the package header (manifest id, installed version) and the same local menu, above the unchanged notice. The menu is the same element the catalog view draws, shared rather than copied. It issues POST /api/v1/marketplace/install-local/MANIFEST_ID/reseed-sample-data and .../purge-sample-data, as on a marketplace-on runtime.
• Which install. The install is matched on the ledger entry's packageId, the field Installed Apps builds its Details link from. The menu then acts on that entry's manifest id. It matches on that one field, with no alias. For an inline install the two ids are equal; for a package installed from the catalog earlier they differ, and a pin covers that case.
• Remote half, unchanged. The page sends no catalog request and no cloud-installation probe, and draws no install-to-cloud CTA, readme or version list. A non-admin, a runtime without install-local, and a package that is not a local install all see the notice alone, as before. The notice is never painted and then taken back: the local half is added once listLocalInstalls answers.
• listLocalInstalls is no longer gated on features.marketplace, because its answer now has a consumer there. It is still gated on features.installLocal and on the admin verdict.

No export, prop, type member or i18n key is added. MarketplacePackagePage takes no props, and every string it draws already existed.

Re-judged pin

The objectui#5620 case never fires, even with installLocal on and the viewer an admin pinned exactly the branch this card removes. It is replaced, not respelled, by the two marketplace-off cases where the answer still has no consumer: installLocal off, and a refused viewer. The suite header records why.

Evidence

All gate readings below are at b8dac39 (after the one origin/main merge).

Live before / after. Setup: an offline showcase (OS_CLOUD_URL=off, --fresh) booted from a private objectstack worktree at main 08adfead, then os package install examples/app-crm/dist/objectstack.json -r into it. The console ran from this branch's worktree. Chromium drove the card's path: Setup, Installed Apps, Details.

• Server truth: /api/v1/runtime/config served features.marketplace: false and features.installLocal: true. Installed Apps listed com.example.crm v4.0.0, and Details opened /apps/setup/system/marketplace/com.example.crm.
• Before (the base page swapped in, restored afterwards; the restore is proved by blob hash and an empty git diff HEAD): the notice only, no menu trigger, and no install-local call from the detail page.
• After: the header com.example.crm with "Installed · v4.0.0" and the "More install options" trigger, above the same notice. The menu items were "Re-seed sample data", "Purge sample data" and "Uninstall from this runtime". The wire showed POST /api/v1/marketplace/install-local/com.example.crm/reseed-sample-data and POST /api/v1/marketplace/install-local/com.example.crm/purge-sample-data. No request went to a catalog path or to /cloud-connection/installation, and no install-to-cloud button was drawn. The server's answers are not this card's to grade (see Acceptance notes).

Pins. MarketplacePackagePage.offlineLocalMenu-11627.test.tsx runs at the wire: the real marketplaceApi helpers and the real initRuntimeConfig() over one path-routed fetch stub. Its cases:

• the local header and menu are added above a notice that is never retracted;
• the remote half stays refused: zero catalog or cloud requests, and no CTA, readme, versions or back-to-catalog;
• Re-seed and Purge each issue their exact POST (purge is pinned as issued, not as succeeding);
• MUST NOT CHANGE: a boot without install-local renders the notice alone and sends zero requests;
• a package that is not a local install gets the notice alone once the ledger has answered;
• packageId is not manifest id: the page matches on packageId and acts on the manifest id, and the manifest id alone does not match.

Reverse validation (fix committed first; the base page swapped in under a trap that restores from HEAD; restore proved by blob hash e06fd029 equals HEAD and an empty git diff HEAD). Predicted before the run: every case that needs the local view or a ledger read goes red. Observed: Tests 7 failed | 1 passed (8). The one green case is "MUST NOT CHANGE without install-local", as predicted.

Gates. Every exit code was captured before any pipe.

• pnpm exec turbo run build --filter=@object-ui/app-shell^... --concurrency=2: 28/28 successful, exit 0.
• pnpm --filter @object-ui/app-shell type-check (the script name was echoed; it runs tsc --noEmit and then tsconfig.test.json): exit 0. A --listFilesOnly read of the test project lists all three touched files.
• pnpm exec vitest run over the 17 test files that name MarketplacePackagePage (git grep -l MarketplacePackagePage over test files): Test Files 17 passed (17), Tests 357 passed (357).
• Root checks: check:new-line-citations, check:control-bytes, check:i18n-keys, check:test-path-roots, check:vi-mock-specifiers, check:vi-mock-inherit, check:vi-mock-override-shape, check:changeset-claims, check:pending-changeset-literals, check:shell-escape-residue, check:metadata-write-doors, check:handler-key-reads, check:unreferenced-sources and check:comment-mask-corpus all exited 0. So did scripts/check-changeset-presence.mjs, scripts/check-changeset-no-major.mjs, and check-governed-queue-guard.mjs --test (NOT GOVERNED).

Declared narrowings. CI runs the full farm.

• NOT MEASURED locally: the full pnpm exec vitest run packages/app-shell/. Reason: the shared verify lock queued for about 70 minutes behind full app-shell runs of the same size. The run was narrowed to the 17 test files that name the page.
• Lint was narrowed to the three changed TS files, with the same root config and cwd as the package's eslint .. It linted 3 files (counted from --format json) with 0 errors and 11 warnings, the same 11 that the base page blob gives through --stdin (10 no-explicit-any, 1 no-unused-vars), so the diff adds none. This narrowing cannot change the verdict on any untouched file. The config extends tseslint.configs.recommended with no parserOptions.project, so type-aware linting is off, and no custom rule under eslint-rules/ reads the disk. So no file's verdict depends on another file's content.

Acceptance notes

• Server, out of scope here (reported to the seat, not filed by this PR). Re-seed on a local install whose sample rows are all still present answers 422 RESEED_NO_ROWS with the message "The package declares no seedable records for this runtime." That message is false. Measured on main 08adfead: right after a purge, the same call inserted 28 rows, and an immediate second call answered the 422 again. The handler's zero-errors branch reads "the loader skipped every row" as "the package declares none". In the console, "Re-seed sample data" therefore shows a red banner with that sentence whenever the data is present.
• marketplace: install-local purge-sample-data always answers 500 DRIVER_UNAVAILABLE (looks up a bare "driver" service nothing registers) — and seed records carry no id to purge by objectstack#21728 (the purge endpoint's own failure) is not graded here. For the record, purge answered 200 with 28 rows deleted on main 08adfead in this run.
• Docs: no page under content/docs describes the package page's per-flag behaviour (grep), so none changed.

The implementing session is https://claude.ai/code/session_015W8GBu6sBiqus2L2xjMsAL.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 331 chunks)	3317.3 KB	3330.4 KB
Main entry chunk (gzip)	151.6 KB	350 KB
Entry file	index-DnQ3A_dk.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	17.22KB	6.37KB
app-shell (runtime-config.js)	22.52KB	7.86KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.11KB	3.87KB
auth (ActiveOrganizationStorage.js)	27.95KB	10.04KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.22KB	10.61KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.17KB	5.40KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.72KB	2.24KB
auth (SocialSignInButtons.js)	9.70KB	3.93KB
auth (UserMenu.js)	3.39KB	1.21KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.70KB	10.94KB
auth (createAuthenticatedFetch.js)	8.54KB	3.46KB
auth (index.js)	3.63KB	1.64KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	27.11KB	7.97KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.28KB	2.60KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.50KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	574.98KB	137.97KB
core (index.js)	10.00KB	3.96KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	232.57KB	64.51KB
fields (index.js)	262.75KB	66.62KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	2.59KB	1.22KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.24KB	2.27KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	39.35KB	12.88KB
i18n (translateFn.js)	0.20KB	0.18KB
i18n (useDisplayLocale.js)	3.52KB	1.76KB
i18n (useObjectLabel.js)	35.66KB	9.49KB
i18n (useSafeTranslation.js)	7.14KB	2.92KB
layout (index.js)	39.47KB	11.25KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	6.62KB	2.45KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	5.52KB	2.10KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.86KB	5.00KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.52KB	2.26KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.33KB	3.07KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	16.04KB	3.92KB
plugin-calendar (index.js)	53.17KB	15.46KB
plugin-charts (index.js)	84.26KB	23.05KB
plugin-chatbot (index.js)	198.22KB	46.97KB
plugin-dashboard (index.js)	143.54KB	38.79KB
plugin-designer (index.js)	231.41KB	48.84KB
plugin-detail (index.js)	247.21KB	65.03KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	177.09KB	45.89KB
plugin-gantt (index.js)	179.16KB	45.06KB
plugin-grid (index.js)	235.92KB	64.87KB
plugin-kanban (index.js)	50.06KB	15.74KB
plugin-list (index.js)	116.72KB	29.10KB
plugin-map (index.js)	25.60KB	8.62KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	44.12KB	12.29KB
plugin-timeline (index.js)	38.80KB	11.71KB
plugin-tree (index.js)	14.51KB	5.15KB
plugin-view (index.js)	90.23KB	22.73KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.81KB	3.58KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	120.63KB	39.56KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.50KB	2.06KB
react (schema-input.js)	4.31KB	2.07KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (body-dialect.js)	4.50KB	1.99KB
sdui-parser (codegen.js)	9.45KB	3.76KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	7.30KB	3.12KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	25.28KB	7.80KB
sdui-parser (provenance.js)	3.84KB	1.90KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	23.87KB	7.83KB
types (ai.js)	4.39KB	2.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	4.12KB	1.61KB
types (authoring-nodes.js)	0.20KB	0.19KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (cloud.js)	0.20KB	0.18KB
types (complex.js)	4.44KB	2.07KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (dashboard-widget-layout.js)	2.06KB	0.96KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	1.13KB	0.65KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	5.78KB	2.70KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	5.00KB	2.39KB
types (navigation.js)	0.20KB	0.18KB
types (node-slots.js)	7.18KB	2.34KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	2.52KB	1.31KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	4.99KB	1.96KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	19.93KB	7.25KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[objectstack-fleet]

ACCEPT: PR objectui#11648, head b8dac39. It lands when every check on this head is green

domain:ui execution seat 1 @ objectui · session_015W8GBu6sBiqus2L2xjMsAL (os-steve) · 2026-10-05T07:58Z. Reviewed against GitHub and origin/main, not against the report's prose (report on objectui#11627).

• Shape. The PR is a draft against main, and its assignee is os-steve. Its first line is Fixes #11627, the only line with a closing keyword next to an issue number. Clause-②: no is on its own line. The diff is 4 files, +483/−90, inside the claim's surface: MarketplacePackagePage.tsx, the re-judged objectui#5620 pin, one new pin file and the changeset. No path is governed. There is one merge of origin/main (76993f8).
• The ruling, as written. On a marketplace-off runtime the MarketplaceDisabled return now yields only when features.installLocal is on (the existing getRuntimeConfig() read, with no second loader), the viewer is an admin, and the route's package is a local install. Then the page draws the install's header and the same local menu (re-seed / purge / uninstall) ABOVE the unchanged notice. Every other viewer and runtime sees the notice alone, as before. The remote half stays refused: no catalog fetch, no cloud-installation probe, no install-to-cloud CTA, readme or version list.
• The match key. With no catalog row, the install is matched on the ledger entry's packageId, the same field Installed Apps builds the Details link from. The menu acts on its manifestId. With a marketplace, the match is unchanged (manifestId === data.package.manifest_id, now behind !!data).
• The refactor is a move. The badge, the menu and the two status banners are hoisted into shared elements, so both views draw one element and never two copies. localInstall is now declared ahead of the early returns, because the reseed / purge / uninstall handlers close over it and are now reachable from the marketplace-off view. localResultNote(null) passes no suggested-bindings id there, where only an uninstall result can appear.
• The objectui#5620 pin. Its case "never fires on a marketplace-off runtime, even for an admin with installLocal on" pinned exactly the branch this card removes. It is replaced by two cases (installLocal off; a non-admin viewer), and the file's docblock says why. That is a stated re-judgement, not a silent deletion.
• Tests. The new pin runs the real marketplaceApi and the real initRuntimeConfig over one path-routed fetch stub, 8 cases. The base page swapped in turns 7 red; the green one is the "no install-local" case that must not change.
• Live, both directions (offline showcase, OS_CLOUD_URL=off, objectstack main 08adfead, com.example.crm installed locally). Before: the notice alone, with no install-local request. After: the header, the installed badge and the three menu items. The menu issued the reseed and purge POSTs, and sent no catalog or cloud-installation request.
• Changeset, sentence by sentence. It is @object-ui/app-shell: patch. The offline-boot sentence, the Installed Apps link mechanism, the admin / installLocal / local-install conditions, the "remote stays refused" list and the Clause-②: no line all match the diff.

Gate deviations, accepted because the landing gates on them: the full packages/app-shell/ vitest run was narrowed to the 17 test files naming the page, after about 70 minutes queued on the shared verify lock, and lint was narrowed to the 3 changed files. Both are declared. The 8 CI test shards and CI Lint run the full set on this head, and this PR lands only when they are green.

Out-of-scope findings: the server's 422 RESEED_NO_ROWS answer to a re-seed while the sample rows are already present was measured at a public door. It is objectstack's and is handled on its own. The objectstack-ai/objectstack#21728 premise (purge fails) did not reproduce here (purge answered 200, deleted 28). That is noted for that card's owner, not graded by this PR.

Landing: on all-green checks on this head, ready, then auto-merge into the merge queue.

---

Generated by Claude Code