Repository navigation
app-shell: the exported DefaultLoginPage and DefaultRegisterPage still offer generic sign-up under the invite_only audience posture (the objectui#11691 defect, on the published default pages) #11705
Description
Filing gate ①: a product defect with a named location and a named producer.
Reader: the objectstack-wide triage seat's first touch (grade and route), then the domain:ui execution seat that claims it. The fix lands in @object-ui/app-shell's exported default auth pages.
Dedupe: mcp__github__search_issues on objectstack-ai/objectui, closed included: "DefaultLoginPage DefaultRegisterPage sign up link invite_only audience posture app-shell default auth pages" gives 9 hits. None of them is this defect:
- objectui#11691 is the console's own pages (this card's sibling, in flight);
- objectui#11634, finding(app-shell): the exported DefaultLoginPage maps no sign-in refusal code, so a wrong password or an unverified email shows the server's raw English #11058, finding(app-shell): DefaultRegisterPage passes no errorMessages to RegisterForm, so every sign-up refusal (user-exists and the audience gate codes) shows the server raw English message — the objectui#10998 family on the exported page #11030, console: a refused self-registration shows the server's raw English message — RegisterPage maps only USER_ALREADY_EXISTS to localized text #10998, Post-login landing ignores
isDefault— cold sign-in always lands on/_console/home(and AppManagementPage's Disable / Set-as-default are client-only stubs) #4233, fix(auth): env 登录页首次加载缺 SSO 按钮 — auth config race 让 SSO-only 用户卡死在密码墙 #2625 and Login page: support phone number + password sign-in #2416 are closed, and each covers a different defect; - objectui#11649 is a different surface.
The positive control for the query: finding(app-shell): the exported DefaultLoginPage maps no sign-in refusal code, so a wrong password or an unverified email shows the server's raw English #11058 and finding(app-shell): DefaultRegisterPage passes no errorMessages to RegisterForm, so every sign-up refusal (user-exists and the audience gate codes) shows the server raw English message — the objectui#10998 family on the exported page #11030 are earlier cards on these same two exported pages.
What happens
/api/v1/auth/config states the sign-up rule in two keys: emailPassword.disableSignUp and features.audiencePosture. Under the default invite_only posture the server keeps disableSignUp: false on purpose, so that a pending invitee can still register. It refuses an uninvited sign-up with 403 SELF_REGISTRATION_CLOSED. objectui#11691 (PR objectui#11703) makes the console's own /login and /register read both keys.
@object-ui/app-shell also publishes DefaultLoginPage and DefaultRegisterPage, and these still read disableSignUp alone.
- Reach, named producer:
examples/console-starter/src/App.tsxroutesDefaultLoginPageat/loginandDefaultRegisterPageat/register. - Measured by the objectui#11691 dev with a throwaway render probe, not committed (report on objectui#11691):
- With
audiencePosture: 'invite_only'anddisableSignUp: false,DefaultLoginPagerenders the "Sign up" link andDefaultRegisterPagerenders the full form, which the server then refuses. - The control leg,
disableSignUp: true, hides the link.
- With
Done when
- The exported default pages offer generic sign-up only where the server would accept it, by the same rule the console pages use after objectui#11691 lands. One decision serves both apps, with no second copy of the predicate.
- The pins cover
invite_onlywith no "Sign up", an invitation redirect still reaching registration,openunchanged, anddisableSignUp: truehiding everything.
Related: objectui#11691 (its decision, apps/console/src/pages/auth/signUpOffer.ts in PR objectui#11703, could be lifted into a package both apps import). Not dispatchable before objectui#11691's PR lands, because that PR settles the rule this card follows.
Dedupe words: DefaultLoginPage audiencePosture · DefaultRegisterPage invite_only sign up · app-shell default auth pages sign-up posture · console-starter register invitation only
Filed by the domain:ui execution seat 2 (session_01FngvPpdrnhHMdHHq6vwwju) from the out-of-scope findings of objectui#11691's dev report. ⛔ Not graded or routed here; ⛔ not a claim.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 6, 2026
Path: ② the capabilities an end user meets in the app — sign-in and registration | 缺项 (no item asserts the published default auth pages follow the audience posture) | P2
Triage: first grade —
bug·priority:p2·domain:ui·area:identity·pm:blocked. The exported default pages make the same sign-up decision as the console, through one shared functionTriage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-06T07:58Z. ⛔ Not a claim, ⛔ not a dispatch.Triage: lands in
@object-ui/app-shell's exportedDefaultLoginPageandDefaultRegisterPage⇒domain:ui; rationale: they readdisableSignUpalone, where the server states the rule in two keys (objectui#11691). Their named producer isexamples/console-starter/src/App.tsx.Blocked-by: #11691
decideSignUpOffer, including the first-owner window ruled on that card). Move it to a module both can import, rather than copying it.invite_onlywith an owner, the default login page shows no generic "Sign up"; an invitation redirect and a no-owner deployment still show it;disableSignUp: truehides everything.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
Path: ② the capabilities an end user meets in the app — sign-in and registration | 缺项 | P2
Unlock:
pm:blocked→pm:queue. objectui#11691 landed the shared decision this card reusesTriage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-06T09:06Z. ⛔ Not a claim, ⛔ not a dispatch.daa7caff4aonmain, and objectui#11691 closedcompleted.apps/console/src/pages/auth/signUpOffer.tsexportsdecideSignUpOffer, withneedsBootstrapProbe,audienceAdmitsUninvitedSignUpandisInvitationRedirectbeside it.apps/console, which a package cannot import, so the first step is moving it to a module both the console and@object-ui/app-shellimport. ⛔ No second copy of the rule. The console's pins from PR objectui#11703 stay green through the move.invite_onlywith an owner, the default login page shows no generic "Sign up";disableSignUp: truehides everything.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
Unblocked:
Blocked-by: objectstack-ai/objectui#11691is closed. PR objectui#11703 landed asdaa7caf, sopm:blocked→pm:queuedomain:uiexecution seat 2 ·session_01FngvPpdrnhHMdHHq6vwwju· 2026-10-06T09:07Z. ⛔ Not a claim.pm:blockedtransition, triage's first grade6011978580("the shared decision lands with PR objectui#11703, and this card reuses it").daa7caf, an ancestor oforigin/main.apps/console/src/pages/auth/signUpOffer.ts, atdaa7caf.DefaultLoginPage/DefaultRegisterPagewith the same decision, with no second copy of the predicate. Lifting it into a package both apps import is this card's own work, not an upstream one.pm:blocked→pm:queue. Grade,domain:uiandarea:identityunchanged.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
Claim: PM loop round 1
Session:
session_01FngvPpdrnhHMdHHq6vwwjuAccount:
os-justinBranch:
claude/issue-11705-default-auth-pages-postureWorktree:
objectui-issue-11705Domain:
domain:uiSeat:
domain:ui#2File surface: the exported default auth pages
packages/app-shell/src/console/auth/LoginPage.tsxandRegisterPage.tsx(DefaultLoginPage/DefaultRegisterPage); the shared decisionapps/console/src/pages/auth/signUpOffer.tsmoved to one module bothapps/consoleand@object-ui/app-shellimport, together with the bootstrap-status probe it reads (apps/console/src/components/setupEntry.ts'suseBootstrapStatus/BootstrapStatus) if the move needs it; the console pages' re-pointed imports (apps/console/src/pages/auth/LoginPage.tsx,RegisterPage.tsx); the tests beside them, objectui#11691's pins moved or re-pointed with no assertion weakened; the receiving package's README/barrel; and.changeset/11705-*.md(stop on breach; explain in the report)Container & model:
M,mode:subagent,model: opus(dispatch-gates --tier --repo objectstack-ai/objectui: no path-derived mandate; default tier)Clause-②: yes
Thread-read: 6013031064
Serial constraints cleared:
noneblocking. No open PR touches these files: objectui#11706 holdsapp-shell's metadata-admin and studio-design files, notconsole/auth/**, and objectui#11069 is CLI wiring. objectui#11691's PR objectui#11703 landed asdaa7caf, the base this card builds on. The in-flight objectui#11675 holdsplugin-calendar/plugin-timelineonly. Read 2026-10-06T09:31Z.Why
Clause-②: yes: the decision moves out of the privateapps/consoleinto a published package (@object-ui/app-shellor a package it already imports), so at least one new export reaches a built entry. The exported default pages also change published behaviour underinvite_only. The dev reads the built declarations and reports which surface moved.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
os-dev-report
{ "issue": 11705, "status": "done", "branch": "claude/issue-11705-default-auth-pages-posture", "pr": "https://github.com/objectstack-ai/objectui/pull/11711", "session": "session_01FngvPpdrnhHMdHHq6vwwju — the dispatching seat's id (this is a subagent run)", "premise_still_valid": true, "summary": "DefaultLoginPage and DefaultRegisterPage now call decideSignUpOffer, objectui#11691's decision, so under invite_only with an owner the login page shows no generic \"Sign up\" and the register page says registration is by invitation (auth.register.errors.selfRegistrationClosed) before any form. An invitation redirect and a deployment with no owner still get the link and the form, open, email_domain and no-posture are unchanged, and disableSignUp: true hides everything; both pages now carry ?redirect= between /login and /register. The decision (apps/console signUpOffer.ts) and the bootstrap probe it reads (useBootstrapStatus / BootstrapStatus out of setupEntry.ts) moved unchanged into @object-ui/app-shell and are exported from its entry; the console's pages and setupEntry import them from there, and the console copy is deleted with no shim. app-shell was chosen over @object-ui/auth because the decision also reads app-shell's invitation route and a REST probe, and app-shell already owns the default pages, the refusal-copy maps and the accept-invitation page. Draft PR objectui#11711 (head 54cb036) is assigned to os-justin.", "tests": "At 54cb036 unless marked; f133f3c is source-identical to 54cb036 except packages/app-shell/README.md. (1) app-shell new pins, verbose run at f133f3c: signUpOffer-11691.test.ts 5/5 and defaultPagesFollowPosture-11705.test.tsx 11/11 ('Test Files 2 passed (2) · Tests 16 passed (16)'); the whole auth dir: 'Test Files 5 passed (5) · Tests 30 passed (30)'. (2) app-shell narrowed set at 54cb036: the 17 test files that read the barrel or name a touched module (git grep-derived; includes the auth dir): 'Test Files 17 passed (17) · Tests 91 passed (91)'. The full app-shell suite (1029 test files) is NOT MEASURED. Reason: I stopped my own run after 30m27s holding the shared lock with two agents queued. Its lock line read 'VERDICT command-exit 0' after the SIGTERM, but vitest printed no summary, so that 0 is not a measurement. The suite is declared to CI. (3) console, apps/console/src/pages/auth/ + components/SetupRoute.test.tsx at 54cb036: 'Test Files 12 passed (12) · Tests 82 passed (82)', including the 11 kept posture pins and 15 SetupRoute cases. (4) objectui#11691's 16 pins: the 5 decision cases moved, and their describe block and configFor helper are byte-identical to BASE (python compare: True/True). The 11 page pins stayed, and that block is byte-identical to BASE (True). No assertion changed. The moved decision code and probe body equal BASE once comments and imports are stripped (True/True). (5) type-check at f133f3c: app-shell exit 0 (tsconfig.test.json --listFilesOnly lists both new test files; positive control registerRefusalCodes-11030 is listed too), auth exit 0, console exit 0 on the second run. The first console run (exit 2, 23 errors) was a precondition miss: all 23 errors were five unbuilt plugins outside app-shell's closure. After building the console closure it was exit 0. (6) lint at 54cb036: auth, console and app-shell all exit 0 with 0 errors. Their warnings are pre-existing, and none is on a line this PR adds. (7) reverse verification at f133f3c, fix committed first: BASE's two default pages were written over the tree with git checkout BASE. On disk, decideSignUpOffer counted 4/3 at HEAD and 0/0 mutated, and the pre-fix 'disableSignUp === true' counted 1/1. The tests import the pages relatively, so they read src/ and no build leg was needed. Result: 'Tests 7 failed | 4 passed (11)', exactly the registered prediction (red: login owner/invitation/no-owner; register notice/invitation flow/no-owner/disableSignUp-redirect bounce; green controls: login open+email_domain, no posture, disableSignUp; register open). Restore was git checkout HEAD: hashes match the HEAD blobs (54a750ff, c13fa1b0) and git diff HEAD is 0 bytes. Direction observed: turned red. (8) doc-snippets coverage control: a broken copy of the new README block went red, 'TS2353 ... notAKey does not exist in type SignUpOfferContext', exit 1. Restored by hash, diff 0. (9) eager closure: console vite build at HEAD and with BASE sources written back (trap-restored, hashes verified, git status porcelain 0). Both have 331 of 2451 eager chunks; raw +4 bytes, gzip +77 bytes. check:eager-closure reads 'Console eager closure is 3323.3 KB gzipped across 331 of 2451 chunks (budget: 3330.4 KB, headroom: 7.0 KB)' at HEAD, against headroom 7.1 KB at BASE. (10) built declarations: app-shell dist/index.d.ts re-exports decideSignUpOffer, needsBootstrapProbe, isInvitationRedirect, SignUpOffer, SignUpOfferContext, useBootstrapStatus and BootstrapStatus. audienceAdmitsUninvitedSignUp is in dist/console/auth/signUpOffer.d.ts but not on the entry (grep exit 1; positive control signUpRefusalMessages hits 1).", "gates": [ { "cmd": "pnpm --filter @object-ui/app-shell type-check", "exit": 0, "head": "f133f3c" }, { "cmd": "pnpm --filter @object-ui/auth type-check", "exit": 0, "head": "f133f3c" }, { "cmd": "pnpm --filter @object-ui/console type-check (after turbo build --filter=@object-ui/console^...)", "exit": 0, "head": "f133f3c" }, { "cmd": "pnpm --filter @object-ui/auth lint", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm --filter @object-ui/console lint", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm --filter @object-ui/app-shell lint", "exit": 0, "head": "54cb036" }, { "cmd": "turbo run build --filter=@object-ui/auth --filter=@object-ui/app-shell", "exit": 0, "head": "f133f3c" }, { "cmd": "pnpm exec vitest run packages/app-shell/ (17 barrel/touched-module files)", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm exec vitest run apps/console/src/pages/auth/ apps/console/src/components/SetupRoute.test.tsx", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm exec vitest run packages/app-shell/ (full, 1029 files)", "exit": "NOT MEASURED — stopped after 30m27s holding the lock, declared to CI", "head": "f133f3c" }, { "cmd": "pnpm check:eager-closure (after console vite build)", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:i18n-keys", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:phantom-deps", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:self-import", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:unreferenced-sources", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:side-effects-array", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:esm-specifiers", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:spec-symbols", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:published-tsconfig-exclude", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:readme-exports (prerequisites built)", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:doc-snippets (closure built)", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:new-line-citations", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:control-bytes", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:changeset-claims", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:pending-changeset-literals", "exit": 0, "head": "54cb036" }, { "cmd": "pnpm check:test-path-roots", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-changeset-no-major.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-changeset-presence.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-changeset-fixed.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-type-check-coverage.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-vi-mock-override-shape.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "node scripts/check-lint-coverage.mjs", "exit": 0, "head": "54cb036" }, { "cmd": "CI on PR head 54cb036 (one read after PR open, not polled)", "exit": "in_progress — 42 check runs: 21 success, 3 skipped, 18 in_progress, 0 failed at read time", "head": "54cb036" } ], "mcp_calls": "0 — no MCP GitHub tool was called", "api_writes": "3, each through the fleet relay (one POST /repos/objectstack-ai/objectstack/dispatches each, executed as objectstack-fleet[bot]): (1) pr_create, POST /repos/objectstack-ai/objectui/pulls, which opened objectui#11711 as a draft (read-back: 9437 bytes sent, 9437 stored, identical); (2) label-write for the PR assignee, POST /repos/objectstack-ai/objectui/issues/11711/assignees with os-justin, no label change (read-back: MATCHES the target); (3) this os-dev-report comment, POST /repos/objectstack-ai/objectui/issues/11705/comments, via post-stamped.mjs. Not REST writes: 3 git pushes (empty branch, f133f3c, 54cb036).", "line_budget": "not applicable: the diff touches no skills/**, .claude/**, AGENTS.md, CLAUDE.md or docs/adr/** (not governed) and no line-budgeted ledger. Diff vs BASE da35453: 14 files, +739/-184.", "files_changed": [ ".changeset/11705-default-auth-pages-posture.md", "apps/console/src/components/setupEntry.ts", "apps/console/src/pages/auth/LoginPage.tsx", "apps/console/src/pages/auth/RegisterPage.tsx", "apps/console/src/pages/auth/__tests__/signUpFollowsPosture-11691.test.tsx", "apps/console/src/pages/auth/signUpOffer.ts (deleted; moved to packages/app-shell/src/console/auth/signUpOffer.ts)", "packages/app-shell/README.md", "packages/app-shell/src/console/auth/LoginPage.tsx", "packages/app-shell/src/console/auth/RegisterPage.tsx", "packages/app-shell/src/console/auth/signUpOffer.ts", "packages/app-shell/src/console/auth/bootstrapStatus.ts", "packages/app-shell/src/console/auth/__tests__/signUpOffer-11691.test.ts", "packages/app-shell/src/console/auth/__tests__/defaultPagesFollowPosture-11705.test.tsx", "packages/app-shell/src/index.ts", "packages/auth/src/types.ts" ], "deviations": [ "File surface: packages/auth/src/types.ts is outside the claim's surface. Its audiencePosture doc comment, which ships in dist/types.d.ts, named apps/console's pages/auth/signUpOffer.ts, the file this move deletes. The edit is comment-only and now names app-shell's decideSignUpOffer. This is a conflict between the order's 'stop on breach' and os-dev.md's rule that a published text this round makes false must be fixed. os-dev.md binds, so I fixed it and declare it here and in the PR. The seat may want to add that path to the claim's file surface.", "Declared narrowing: app-shell's full package suite (1029 test files) is not run locally. My run held the shared lock 30m27s with two agents queued, so I stopped it by its PID and ran the 17 files that read the barrel or name a touched module instead. CI runs the full suite. Process note for the PM: os-dev.md's 'affected package runs its own pnpm test' does not fit app-shell under the shared lock.", "NOT MEASURED, then measured: the first console type-check (exit 2) and the first check:readme-exports (exit 1, '8 self-import(s) could not be judged') were both precondition misses (unbuilt closure packages). Both were re-run green after building, and are listed as such in gates.", "PR body precision, for the seat to amend if wanted (I do not PATCH): the 'Verification, at head 54cb036' heading also covers the type-check, build, verbose-16 and ablation readings, which were taken at f133f3c. f133f3c differs from 54cb036 only by packages/app-shell/README.md, which no tsconfig program or build reads. Suggested wording: 'Verification (head 54cb036; type-check, builds and the reverse verification at f133f3c, which differs only by packages/app-shell/README.md)'.", "Attribution: commits end with the model-free trailer pair (Claude-Session + 'Co-authored-by: Claude'), per objectui AGENTS.md. The harness reminder's model-named Co-Authored-By line and its PR footer lines were not used: AGENTS.md and os-dev.md take precedence by the reminder's own precedence sentence, and the PR footer is os-dev.md's session-URL form.", "Default pages after success: still navigate('/') and ignore ?redirect=. This is unchanged on purpose to keep the scope to the card, and recorded as an Acceptance note." ], "open_questions": [], "out_of_scope_findings": [ "carrier: 承接者:无 · noted, not filed — DefaultLoginPage / DefaultRegisterPage navigate to / after a successful sign-in or sign-up and never honour ?redirect=, so an invitee bounced by DefaultAcceptInvitationPage lands on / rather than back on the invitation. No in-repo producer mounts both (examples/console-starter has no /accept-invitation route) and nothing was measured through a public door, so it is not class a. In PR Acceptance notes. Dedupe words: DefaultLoginPage redirect after sign-in · DefaultRegisterPage onSuccess navigate root · accept-invitation default pages redirect", "carrier: 承接者:无 · noted, not filed — apps/console/src/pages/auth/SetupPage.tsx still runs its own GET /auth/bootstrap-status fetch beside useBootstrapStatus (pre-existing duplication, untouched). This is a static read, an observation only. In PR Acceptance notes. Dedupe words: SetupPage bootstrap-status duplicate probe · useBootstrapStatus SetupPage" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
ACCEPT: PR objectui#11711 at
54cb036(Fixes #11705). The at-tier contract review is owed before enqueuedomain:uiexecution seat 2 ·session_01FngvPpdrnhHMdHHq6vwwju(os-justin) · 2026-10-06T10:48Z. Dev report:os-dev-reporton this card.Shape: draft, base
mainatda35453, first lineFixes #11705, and the body has no other closing keyword.Clause-②: yesis at the start of a line. 14 files, +739/−184. No governed path, nocontent/docs/releases/edit.File surface amended:
packages/auth/src/types.tsis added to the claim's surface. The edit is comment-only: theaudiencePosturedoc comment ships in@object-ui/auth'sdist/types.d.tsand namedapps/console/src/pages/auth/signUpOffer.ts, which this PR deletes. The seat accepts the fix in place, per os-dev's rule that published text a round makes false is corrected in that round.Seat's own reading of the diff:
decideSignUpOffer,needsBootstrapProbe,isInvitationRedirect,audienceAdmitsUninvitedSignUpmove fromapps/console/src/pages/auth/signUpOffer.tstopackages/app-shell/src/console/auth/signUpOffer.ts(a git rename).useBootstrapStatus/BootstrapStatusmove fromsetupEntry.tsto./bootstrapStatus.ts. Both bodies are unchanged apart from comments and imports. The console copy is deleted with no shim, and the console pages and/setupentry import from@object-ui/app-shell. That is one decision with no second copy, as the card and triage direct.DefaultLoginPagehandsLoginFormaregisterUrlonly onform, carrying?redirect=.DefaultRegisterPagebouncesclosedto/login(keeping?redirect=), renders nothing onpending, and onby-invitationrendersauth.register.errors.selfRegistrationClosedbefore any form.Clause-②: yes. The arm is widening, as the changeset states.audienceAdmitsUninvitedSignUpships indist/and stays off the entry.Done-when, checked against the pins:
defaultPagesFollowPosture-11705.test.tsxrenders the shipped pages over a realAuthProvider/createAuthClientwith onlyfetchstubbed. Six login cases and five register cases cover:invite_onlywith an owner: no link, and an explanation instead of the form;open/email_domain: unchanged, with no probe;disableSignUpalone decides;disableSignUp: true: everything is hidden, and an invitation redirect is bounced.objectui#11691's five decision cases moved byte-identical, and its eleven page pins stayed byte-identical (dev's compare).
Changeset (
@object-ui/app-shell:minor), checked sentence by sentence against the diff:index.ts;Tests and gates (dev, measured):
pages/auth/+SetupRoute.test.tsx(82) is green.Seat's observation, Acceptance note, not blocking:
DefaultRegisterPagegates its probe on!user, as the console page does. A visitor who is already signed in and opens/registerunderinvite_onlytherefore stays onpendingand sees an empty layout. Before this PR that visitor got the form. The console page redirects a signed-in visitor away, so this only reaches the default page, and only for a signed-in visit to/register.Out-of-scope findings (2), Acceptance notes, none filed:
navigate('/')after success and ignore?redirect=(no in-repo producer mounts both with/accept-invitation);SetupPage's own duplicatebootstrap-statusfetch (pre-existing, static read).PR body: the seat amends the "Verification" heading to name both heads (
f133f3cdiffers from54cb036only bypackages/app-shell/README.md), per the dev's report.Owed before enqueue: the at-tier contract review, and CI green on
54cb036.needs:contract-reviewis hung on the PR in this stroke.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
Landed: PR objectui#11711 →
main7e2d5b0, verified by content.Fixesclosed this carddomain:uiexecution seat 2 ·session_01FngvPpdrnhHMdHHq6vwwju(os-justin) · 2026-10-06T11:29Z.The merge. Squash
7e2d5b0went through the merge queue, with one parent,da35453, and is an ancestor oforigin/main. 14 files, +739/−184. Its diff against the parent is byte-identical to the PR's net diff (md505a2291c…on both). Contract review6014912328PASS, on the landed head54cb036.Content check against the first parent:
da354537e2d5b0decideSignUpOfferinpackages/app-shell/src/index.tspackages/app-shell/src/console/auth/signUpOffer.tspresentapps/console/src/pages/auth/signUpOffer.tspresent (the console copy)decideSignUpOfferin the defaultLoginPage.tsxregister-by-invitationin the defaultRegisterPage.tsxClosures.
Fixes #11705closed this card as completed at the merge. No other issue closed in the landing window.pm:dispatchedcomes off in this stroke.The review's residue:
DefaultRegisterPageunderinvite_onlygets an empty layout, because the probe is gated on!user. The named producer isexamples/console-starter's unguarded/register.?redirect=after a successful sign-in or sign-up. No in-repo producer mountsDefaultAcceptInvitationPagebeside them, so it has noreach:, and it stays in the PR's Acceptance notes.SetupPage's duplicatebootstrap-statusfetch, a pre-existing static read.Generated by Claude Code
fix(app-shell): the exported default auth pages follow the audience p…