@object-ui/app-shell 11.4.0 → 11.5.0

package/CHANGELOG.md

@@ -1,5 +1,183 @@
 # @object-ui/app-shell — Changelog
 
+## 11.5.0
+
+### Minor Changes
+
+- 544d8eb: Add the app → Studio reverse bridge (ADR-0080): workspace admins see a "Design in Studio" entry in the app top bar that deep-links to the running app's owning package on the Studio design surface (`/studio/:packageId/data`). Hidden for non-admins and for apps with no owning package; package writability stays server-side (read-only packages open as browse-only).
+- 6fffd3d: Client-side data-invalidation bus — refresh data, don't rebuild UI (objectui#2269 P1).
+
+  - `@object-ui/react` gains the bus: `notifyDataChanged({objectName, recordId?})`, `useDataInvalidation(objectName, recordId?)` (reader nonce), `subscribeDataChanges`, and `useMutationInvalidationBridge(dataSource)` which fans every dataSource write (`MutationEvent`) onto the bus. The bus also dispatches the legacy `objectui:related-changed` window event, so pre-bus listeners keep working.
+  - The `key={refreshKey}` remount of `RecordDetailView` (AppContent) and the `key={actionRefreshKey}` remount of `DetailView` (RecordDetailView) are GONE: record data now refetches in place via the bus — scroll, collapsed sections, tabs and in-progress inline edits survive every save/action/undo. All nine action-success bumps became precisely-scoped `notifyDataChanged` calls; undo/redo use the operation's own `objectName`/`recordId`.
+  - `RelatedCountStore` is wired to the bus (tab count badges refetch after any change to their object) and its `useSyncExternalStore` snapshot is now a monotonic version — previously it returned the same `Map` reference, so `emit()` never re-rendered subscribers and invalidations left badges stale; `useRelatedCountVersion()` is exported and drives the probe effect's re-fetch.
+  - app-shell also gains the reserved URL-param registry (`urlParams.ts` — `form`/`formObject`/`formLink`/`tab`/`recordId`/`palette`/`shortcuts` constants replace scattered string literals) and AGENTS.md Commandment #8 (UI-state classification: state that must survive a data refresh may never live only in an uncontrolled component).
+
+- 9255686: Record detail tabs are URL-addressable (`?tab=`) and survive subtree remounts (objectui#2257, ADR-0054 C3).
+
+  - `buildDefaultTabs` emits STABLE semantic tab values (`details` / `related:<child>` / `related` / `activity` / `history`) instead of leaving the renderer to synthesize index-derived ones.
+  - `PageTabsRenderer` honors `item.value`, a host-provided `schema.defaultTab` (validated against actual tabs) and `schema.onTabChange`; index fallback kept for authored schemas without values.
+  - app-shell `RecordDetailView` restores the active tab from `?tab=` and writes it back with `replace` (tab switches never stack history), via the pure `withPageTabsUrlSync` page-tree injector (never mutates authored/memoized page schemas). Legacy `DetailView.autoTabs` wired to the same contract (`defaultTab`/`onTabChange`).
+  - Fixes the tab strip resetting to Details after save-refresh remounts (`refreshKey`-style) and dev-StrictMode URL churn; enables `?tab=` deep links; invalid values fall back to Details.
+
+- 6c1ad9e: Record task flows open as derived overlays with lossless return (framework#2604, extends framework#2578).
+
+  - **Create/Edit never route** — the global record form is URL-driven (`?form=new` / `?form=<id>`): browser Back closes the overlay with the origin (list scroll/filters, detail state) intact; field-heavy objects derive a full-screen modal (`modalSize:'full'`) via the new `deriveRecordFlowSurface` mirror in plugin-view, light ones keep the auto-sized modal. `editMode:'page'` opt-in unchanged.
+  - **Save invariant** — _edit never moves you_ (origin refetches in place); _create lands on the new record's detail_ on its derived surface (drawer over the still-intact list for light objects, detail route for heavy), with `replace:true` so Back skips the transient form entry.
+  - **Subtable child create/edit = overlay over the parent detail, never a route** — related-list New/Edit push `?form=…&formObject=<child>&formLink=<fk>:<parentId>`; the one global overlay pre-links the parent (refresh-safe), sizes to the CHILD object, and on save stays on the parent while only the child's related lists refetch. ModalForm now forwards `initialValues` into its master-detail (subforms) branch so pre-links survive for children with inline line items.
+
+- fbec4e1: feat(studio): pick a connector action from the chosen connector (no more hand-typed action ids)
+
+  In a flow's **Connector Action** node, the `actionId` field was a free-text box
+  (`sendMessage · send` placeholder) — a typo silently produced a node that fails
+  at run time. It was left as text because a connector's actions have "no flat
+  catalog"; but each connector already advertises its actions in the runtime
+  descriptors (`GET /api/v1/automation/connectors` → `{ name, actions:[{key,label}] }`).
+
+  `actionId` is now a **picker of the chosen connector's actions**, resolved from
+  the sibling `connectorId` (mirroring how `object-field` lists the fields of its
+  resolved object). New reference kind `connector-action` + `connectorSource` on
+  `FlowReferenceSpec`; `useConnectorActionOptions` fetches the descriptors and
+  `resolveConnectorName` reads the connector from the node's `connectorConfig`. Like
+  every reference in the designer it stays an **editable combobox** — with no
+  connector chosen (or none installed) it degrades to free text with a hint
+  ("Choose a Connector above to list its actions" / "Actions of <connector>.").
+
+  Closes the last critical hand-typed-identifier gap in flow-node config (the
+  object / field / flow / role / connector / template references were already
+  pickers). Unit-tested (`resolveConnectorName`, `connectorActionsToOptions`).
+
+- 7a6837c: Studio package-create dogfood follow-ups (objectstack-ai/framework#2615):
+
+  - Read-only packages now gate authoring affordances client-side (Add field, New object/flow/permission set, nav Edit, Save draft, Publish, Create app) with a "switch to a writable package" hint, instead of letting doomed edits pile up until the server 422s (objectui#2259). Records stay fully usable; the field inspector opens read-only.
+  - New fields auto-derive their API name from the label while still auto-named — now also for the Data pillar's generic `field_N` names, so relabeling "New field" to "Status" yields a `status` column instead of `field_2` forever (objectui#2260).
+  - Publish is review-then-confirm: the header button opens the pending-changes panel, whose footer "Publish N change(s)" fires the atomic package publish; panel entries expand to a per-item field/property diff against the live version (objectui#2261).
+  - Create app can scaffold navigation from the package's objects (checkbox, on by default): one spec-valid object menu item per object, closing the "fresh app has zero nav" dead-end (objectui#2262).
+
+- 5ed8d2d: feat(studio): automation enable/disable switch + live status in the Automations rail
+
+  The Automations pillar showed only an icon + label per flow, and no way to turn a
+  flow on or off — so an author couldn't tell whether an automation was live, or
+  stop one without deleting it (the header even said "Off by default · review before
+  enabling", but nothing reflected or controlled it). UX eval #6.
+
+  - **Live status dot** on every flow in the rail — a green "On" / gray "Off",
+    fetched from the engine's `GET /api/v1/automation/_status` (persisted `status`
+    is intent; this is what's actually enabled + bound to its trigger). Refetched
+    after a publish; degrades silently on an older backend. A flow the engine
+    doesn't know yet (never published) shows no dot — the amber "unpublished draft"
+    chip already covers that.
+  - **Enable/Disable switch** in the flow header. It flips the flow's deployment
+    `status` (active ↔ obsolete) and saves the draft immediately; the change goes
+    live when the package is published (so "review before enabling" is preserved).
+    Pairs with framework's engine-side gate (`obsolete`/`invalid` → not bound).
+
+  New `engine.studio.auto.*` i18n keys (en + zh). Unit-tested (`FlowStatusDot`:
+  enabled→On, disabled→Off, no-state→nothing, bound-vs-unbound tooltip). Verified in
+  a live browser: the rail shows a green "On" against every showcase flow and the
+  header switch reads "Enabled".
+
+- 70c4a3f: Studio package-create dogfood follow-ups (framework#2615 — P2 wizard + P3 polish):
+
+  - **Package-id wizard feedback.** The three package wizards (switcher create,
+    landing create, landing duplicate) share a new `PackageIdInput`: illegal
+    characters are still normalized away, but no longer silently — a notice
+    says what was removed — a reverse-domain format hint shows while the id
+    doesn't parse, and a CJK-only name that yields no id suggestion is told to
+    type one manually instead of leaving the id box mysteriously empty.
+  - **Records-grid duplicate "Actions" column.** A field literally named
+    `actions` is now dropped from the Studio grid's data columns, so it no
+    longer collides with the always-pinned row-actions column (it stays
+    editable in the form designer).
+  - **Record-create verb consistency.** The `ObjectView` toolbar create button
+    resolved a hardcoded English "Create"; it now uses the same
+    `console.objectView.new` ("New" / 新建) key as the runtime object pages so
+    Studio and the running app agree.
+  - **Branded cold-load splash.** The console's pre-auth loading gate rendered a
+    bare "Loading…"; it now shows the branded, boot-safe `LoadingScreen`.
+  - **Picklist option editor.** Value/label inputs and CJK option labels no
+    longer truncate — the six controls that shared one cramped row are split
+    into a two-row layout so the inputs get the full panel width.
+  - **Draft-save confirmation.** The Data pillar's "Save draft" now shows a
+    success toast and a "last saved HH:MM" indicator, matching the App and
+    Automations pillars.
+
+### Patch Changes
+
+- ec6bb16: Studio Automations rail now shows authored-but-unpublished (draft) flows.
+
+  The Automations pillar loaded its rail with `client.list('flow', …)` only, which
+  returns published/active metadata — so a flow authored (saved as a draft) but not
+  yet published was invisible in the rail, even while the "Changes · N" counter
+  showed a pending draft existed. Every sibling pillar (Data / Interfaces / Access)
+  already merged `client.listDrafts`; Automations was the sole outlier.
+
+  The published ∪ draft merge is extracted into a shared, unit-tested
+  `loadPackageSurfaces` helper and adopted by the Automations pillar, which also now
+  re-reads on `publishNonce` so drafts that go live collapse back into the published
+  rail after a package publish. A draft-only flow now appears in its rail (badged
+  "Unpublished draft"), is selectable, and loads its draft body for editing —
+  matching the other pillars. Fixes the empty-rail report for writable-base packages
+  whose flows are all still drafts.
+
+- 4fbf910: Stop double-firing action toasts on record-detail script actions and the delete handler.
+
+  `ActionRunner.handlePostExecution` already surfaces a result's `error` as a toast
+  (and a success toast unless `silent`). Two handlers ALSO toasted themselves while
+  returning `{success:false, error}` (or a non-`silent` success), so on a runner
+  seeded with `onToast` the same message fired twice:
+
+  - **`RecordDetailView` `serverActionHandler`** (script actions): the HTTP/inner-fail
+    branch and the catch branch each called `toast.error` before returning the error.
+    #2177 fixed the twin in `useConsoleActionRuntime` (interface pages) but not this
+    copy, so record-detail script-action failures (e.g. a `RECORD_LOCKED` from an
+    approval-locked record) still showed the error twice for everyone on the published
+    console bundle. Both branches now return the error and let the runner toast it once.
+
+  - **`useObjectActions` `delete` handler** (ObjectView list/detail deletes): kept its
+    richer localized toast (label + description, or the bulk succeeded/failed summary)
+    and now returns WITHOUT `error` on failure so the runner doesn't re-toast it, and
+    marks successful deletes `silent` so the runner doesn't append a second generic
+    "Action completed successfully" toast.
+
+  Adds `useObjectActions.test.tsx` asserting exactly one toast on delete
+  success / failure / partial-bulk-failure.
+
+- 6f15e43: test(studio): extend the create-conformance gate to the inline pillar creators
+
+  `createConformance.test.ts` guards that every authorable type's default
+  create-form output passes spec validation — catching the recurring "the designer
+  emits a minimal shape the spec rejects, so create→save 422s" dead-end family. But
+  it read only the metadata-admin registry, so the Studio's **inline** "New X"
+  creators (Data → object, Automations → flow, Interfaces → app, Access →
+  permission) — which build their skeletons directly in `StudioDesignSurface.tsx`,
+  bypassing the registry — were **uncovered**. A future edit to one of those shapes
+  could turn its "New" button into a silent dead-end with nothing to catch it.
+
+  Extracted the four inline skeletons into pure, exported builders
+  (`studio-design/skeletons.ts`) consumed by BOTH the pillars and a new gate block,
+  so the test can't drift from what the "New" button actually emits. No behavior
+  change — the builders return the byte-identical skeletons. The gate now covers all
+  create paths (registry + inline); the four inline skeletons validate clean.
+
+- Updated dependencies [544d8eb]
+- Updated dependencies [6fffd3d]
+- Updated dependencies [9255686]
+- Updated dependencies [fae75e2]
+- Updated dependencies [1072701]
+  - @object-ui/i18n@11.5.0
+  - @object-ui/react@11.5.0
+  - @object-ui/components@11.5.0
+  - @object-ui/types@11.5.0
+  - @object-ui/data-objectstack@11.5.0
+  - @object-ui/fields@11.5.0
+  - @object-ui/layout@11.5.0
+  - @object-ui/plugin-editor@11.5.0
+  - @object-ui/auth@11.5.0
+  - @object-ui/collaboration@11.5.0
+  - @object-ui/core@11.5.0
+  - @object-ui/permissions@11.5.0
+  - @object-ui/providers@11.5.0
+
 ## 11.4.0
 
 ### Minor Changes

package/README.md

@@ -152,6 +152,15 @@ for each metadata type. Every type has a pure-renderer **preview** that doubles
 as its **designer** when given `editing` + `onPatch` props — no backend round
 trip is required to edit a draft.
 
+### App → Studio reverse bridge
+
+Inside a running app, workspace admins get a "Design in Studio" entry in the
+top bar (`AppHeader`) that deep-links to the app's owning package on the Studio
+design surface (`/studio/:packageId/data`). It is the reverse of the builder's
+"Open app" bridge (ADR-0080): the entry only renders for admins and only when
+the app has an owning package (`_packageId`), and package writability stays a
+server-side concern — a read-only package opens in Studio as browse-only.
+
 ### Studio package scope
 
 Studio treats the selected package as the authoring scope. The package selector

package/dist/chrome/KeyboardShortcutsDialog.js

@@ -9,12 +9,13 @@ import { useEffect, useMemo } from 'react';
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, } from '@object-ui/components';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { useUrlOverlay } from '../hooks/useUrlOverlay';
+import { KEYBOARD_SHORTCUTS_PARAM } from '../urlParams';
 export function KeyboardShortcutsDialog() {
     const { t } = useObjectTranslation();
     // URL-addressable (?shortcuts=1) so the dialog is deep-linkable and openable
     // from the header Help menu, not only via the `?` keyboard accelerator (ADR-0054
     // C1/C2/C3).
-    const { open, setOpen, toggleOverlay } = useUrlOverlay('shortcuts');
+    const { open, setOpen, toggleOverlay } = useUrlOverlay(KEYBOARD_SHORTCUTS_PARAM);
     const shortcutGroups = useMemo(() => [
         {
             title: t('console.shortcuts.groups.general'),

package/dist/console/AppContent.js

@@ -8,13 +8,13 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * AuthGuard, AdapterProvider, MetadataProvider, theme/toaster, /home, /login,
  * /organizations) is provided by `createConsole` from @object-ui/app-shell.
  */
-import { Routes, Route, Navigate, useNavigate, useLocation, useParams } from 'react-router-dom';
+import { Routes, Route, Navigate, useNavigate, useLocation, useParams, useSearchParams } from 'react-router-dom';
 import { useState, useEffect, useCallback, useRef, lazy, Suspense, useMemo } from 'react';
 import { useAssistant } from '../assistant/assistantBus';
 import { ModalForm } from '@object-ui/plugin-form';
 import { Empty, EmptyTitle, EmptyDescription, Button } from '@object-ui/components';
 import { toast } from 'sonner';
-import { useActionRunner, useGlobalUndo } from '@object-ui/react';
+import { useActionRunner, useGlobalUndo, useMutationInvalidationBridge, notifyDataChanged } from '@object-ui/react';
 import { useObjectTranslation, useObjectLabel } from '@object-ui/i18n';
 import { useAuth } from '@object-ui/auth';
 import { useMetadata } from '../providers/MetadataProvider';
@@ -23,7 +23,9 @@ import { usePreviewDrafts } from '../preview/PreviewModeContext';
 import { PreviewDraftEmptyState } from '../preview/PreviewDraftEmptyState';
 import { ExpressionProvider, evaluateVisibility } from '../providers/ExpressionProvider';
 import { useTrackRouteAsRecent } from '../hooks/useTrackRouteAsRecent';
-import { resolveRecordFormTarget, resolveFormViewLayout, resolveNavigateCreateUrl, resolveNavigateEditUrl } from '../utils/recordFormNavigation';
+import { resolveRecordFormTarget, resolveFormViewLayout, resolveNavigateCreateUrl, resolveNavigateEditUrl, resolvePostCreateTarget } from '../utils/recordFormNavigation';
+import { deriveRecordSurface, deriveRecordFlowSurface } from '@object-ui/plugin-view';
+import { RECORD_FORM_PARAM, RECORD_FORM_OBJECT_PARAM, RECORD_FORM_LINK_PARAM } from '../urlParams';
 import { matchAppBySegment } from '../utils/appRoute';
 import { resolveHref } from '@object-ui/layout';
 import { ExpressionEvaluator } from '@object-ui/core';
@@ -45,6 +47,7 @@ const ReportView = lazy(() => import('../views/ReportView').then(m => ({ default
 const SearchResultsPage = lazy(() => import('../views/SearchResultsPage').then(m => ({ default: m.SearchResultsPage })));
 const RecordFormPage = lazy(() => import('../views/RecordFormPage').then(m => ({ default: m.RecordFormPage })));
 const ComponentNavView = lazy(() => import('../views/ComponentNavView').then(m => ({ default: m.ComponentNavView })));
+const ObjectDataPage = lazy(() => import('../views/ObjectDataPage').then(m => ({ default: m.ObjectDataPage })));
 // Metadata admin — mounted under /apps/:app/metadata. Lives at the top
 // level so URLs read like a normal nested resource (RFC-style) instead of
 // piggy-backing on the legacy ComponentRegistry fan-out.
@@ -201,30 +204,80 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
             navigate(`/apps/${seg}/component/developer/packages`, { replace: true });
         }
     }, [activeApp?.name, appName, location.pathname, navigate]);
-    const [isDialogOpen, setIsDialogOpen] = useState(false);
-    const [editingRecord, setEditingRecord] = useState(null);
+    // #2604 — the create/edit overlay is URL-driven (`?form=new` / `?form=<id>`),
+    // not component state: the record form is a TASK overlay over the origin
+    // route, and putting its open-state in the URL makes browser Back close the
+    // overlay (returning to the intact origin) instead of abandoning the route
+    // with the overlay marooned on top. Same pattern as the detail drawer's
+    // `?recordId=…` (useUrlOverlay / ADR-0054 C3). Open pushes a history entry;
+    // every close strips the param with `replace` so no stale reopen-entry stays
+    // ahead in history.
+    const [searchParams, setSearchParams] = useSearchParams();
+    const recordFormParam = searchParams.get(RECORD_FORM_PARAM);
+    // #2604 D3 — child-task extension of the record-form URL contract:
+    // `formObject` names the object the form edits when it is NOT the route's
+    // object (a subtable child opened over its parent's detail); `formLink`
+    // ("field:id") pre-links the parent on create. Keeping the whole task in
+    // the URL means Back closes the overlay and a refresh reopens it still
+    // correctly parent-linked — no transient component state to lose.
+    const formObjectParam = searchParams.get(RECORD_FORM_OBJECT_PARAM);
+    const formLinkParam = searchParams.get(RECORD_FORM_LINK_PARAM);
+    const editingRecord = useMemo(() => (recordFormParam && recordFormParam !== 'new' ? { id: recordFormParam } : null), [recordFormParam]);
+    const formLinkValues = useMemo(() => {
+        if (!formLinkParam)
+            return undefined;
+        const i = formLinkParam.indexOf(':');
+        if (i <= 0)
+            return undefined;
+        return { [formLinkParam.slice(0, i)]: formLinkParam.slice(i + 1) };
+    }, [formLinkParam]);
     const [refreshKey, setRefreshKey] = useState(0);
+    const isDialogOpen = !!recordFormParam;
+    // Close the record-form overlay by stripping `?form` in place. Reads the
+    // LIVE location (not the hook's render-time snapshot) so it stays a no-op
+    // when a success handler already navigated away in the same tick (the
+    // post-create redirect below).
+    const closeRecordForm = useCallback(() => {
+        const sp = new URLSearchParams(window.location.search);
+        if (!sp.has(RECORD_FORM_PARAM) && !sp.has(RECORD_FORM_OBJECT_PARAM) && !sp.has(RECORD_FORM_LINK_PARAM))
+            return;
+        sp.delete(RECORD_FORM_PARAM);
+        sp.delete(RECORD_FORM_OBJECT_PARAM);
+        sp.delete(RECORD_FORM_LINK_PARAM);
+        setSearchParams(sp, { replace: true });
+    }, [setSearchParams]);
     const { execute: executeAction, runner } = useActionRunner();
+    // objectui#2269 — bridge every dataSource write (create/update/delete →
+    // MutationEvent) onto the invalidation bus, ONCE for the whole console.
+    // Readers (record detail, related lists, count badges) refetch in place;
+    // nothing is remounted for a data refresh.
+    useMutationInvalidationBridge(dataSource);
     useGlobalUndo({
         dataSource: dataSource ?? undefined,
         onUndo: (op) => {
             toast.info(`Undo: ${op.description}`, { duration: 4000 });
             setRefreshKey(k => k + 1);
+            // Precisely-scoped invalidation — UndoableOperation carries the target
+            // (objectName + recordId), so detail readers refresh in place too.
+            if (op?.objectName)
+                notifyDataChanged({ objectName: op.objectName, recordId: op.recordId });
         },
         onRedo: (op) => {
             toast.info(`Redo: ${op.description}`, { duration: 3000 });
             setRefreshKey(k => k + 1);
+            if (op?.objectName)
+                notifyDataChanged({ objectName: op.objectName, recordId: op.recordId });
         },
     });
     useEffect(() => {
         runner.registerHandler('crud_success', async (action) => {
-            setIsDialogOpen(false);
+            closeRecordForm();
             setRefreshKey(k => k + 1);
             toast.success(action.params?.message ?? 'Record saved successfully');
             return { success: true, reload: true };
         });
         runner.registerHandler('dialog_cancel', async () => {
-            setIsDialogOpen(false);
+            closeRecordForm();
             return { success: true };
         });
         // Page-mode navigation handlers — declarative counterparts to the
@@ -274,7 +327,7 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
         // `flow` handler on this top-level useActionRunner — it lives on a
         // different ActionRunner instance and would never be invoked from the
         // record/list action buttons.
-    }, [runner, navigate, appName]);
+    }, [runner, navigate, appName, closeRecordForm]);
     useEffect(() => {
         if (!dataSource)
             return;
@@ -296,8 +349,15 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
         objectNameFromPath = '';
     }
     const currentObjectDef = allObjects.find((o) => o.name === objectNameFromPath);
+    // The object the record-form overlay edits: the route's object by default,
+    // or the `formObject` child override (#2604 D3 — subtable child task opened
+    // over its parent's detail).
+    const formObjectDef = formObjectParam
+        ? allObjects.find((o) => o.name === formObjectParam)
+        : currentObjectDef;
+    const isChildFormTask = !!formObjectParam && formObjectParam !== currentObjectDef?.name;
     const handleCrudSuccess = useCallback(() => {
-        const label = currentObjectDef ? objectLabel(currentObjectDef) : t('common.record', { defaultValue: 'Record' });
+        const label = formObjectDef ? objectLabel(formObjectDef) : t('common.record', { defaultValue: 'Record' });
         executeAction({
             type: 'crud_success',
             params: {
@@ -306,10 +366,45 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
                     : t('form.createSuccess', { object: label, defaultValue: `${label} created successfully` }),
             },
         });
-    }, [executeAction, editingRecord, currentObjectDef, objectLabel, t]);
+    }, [executeAction, editingRecord, formObjectDef, objectLabel, t]);
     const handleDialogCancel = useCallback(() => {
         executeAction({ type: 'dialog_cancel' });
     }, [executeAction]);
+    // #2604 save invariant — *edit never moves you; create takes you to the
+    // record you made.* Edit save: the origin route is untouched (crud_success
+    // bumps refreshKey → origin refetches in place). Create save: land on the
+    // new record's detail, on ITS derived surface — a light object's detail is
+    // the drawer over the still-intact list; a heavy one is the detail route.
+    // `replace: true` swaps out the transient `?form=…` entry so Back returns
+    // to the pre-create origin.
+    const handleRecordFormSuccess = useCallback(async (saved) => {
+        // Child task (#2604 D3): the parent detail must stay EXACTLY as it was —
+        // active tab, scroll, everything. So do NOT go through crud_success;
+        // the child's open related lists refetch on their own via the
+        // invalidation bus (#2269): the dataSource write already emitted a
+        // MutationEvent that the bridge fans out — no manual notify needed.
+        if (isChildFormTask) {
+            const label = formObjectDef ? objectLabel(formObjectDef) : t('common.record', { defaultValue: 'Record' });
+            toast.success(editingRecord
+                ? t('form.updateSuccess', { object: label, defaultValue: `${label} updated successfully` })
+                : t('form.createSuccess', { object: label, defaultValue: `${label} created successfully` }));
+            closeRecordForm();
+            return;
+        }
+        handleCrudSuccess();
+        if (editingRecord || !currentObjectDef)
+            return;
+        const target = resolvePostCreateTarget({
+            objectName: currentObjectDef.name,
+            baseUrl: appName ? `/apps/${appName}` : (activeApp?.name ? `/apps/${activeApp.name}` : ''),
+            pathname: location.pathname,
+            search: window.location.search,
+            surface: deriveRecordSurface(currentObjectDef),
+            recordId: saved?.id ?? saved?._id,
+        });
+        if (target.kind !== 'none')
+            navigate(target.url, { replace: true });
+    }, [handleCrudSuccess, isChildFormTask, formObjectDef, editingRecord, currentObjectDef, appName, activeApp?.name, location.pathname, navigate, closeRecordForm, objectLabel, t]);
     // Track recent items on route change.
     useTrackRouteAsRecent({
         pathname: location.pathname,
@@ -330,8 +425,16 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
             navigate(target.url);
             return;
         }
-        setEditingRecord(record);
-        setIsDialogOpen(true);
+        // Open the overlay via the URL (pushes one history entry → Back closes
+        // the overlay, origin intact). `new` = create; a record id = edit.
+        const rawId = record?.id ?? record?._id;
+        const sp = new URLSearchParams(window.location.search);
+        sp.set(RECORD_FORM_PARAM, rawId != null && rawId !== '' ? String(rawId) : 'new');
+        // Top-level task on the route's own object — drop any stale child-task
+        // overrides (see the record-form URL contract above).
+        sp.delete(RECORD_FORM_OBJECT_PARAM);
+        sp.delete(RECORD_FORM_LINK_PARAM);
+        setSearchParams(sp);
     };
     const handleAppChange = (newAppName) => {
         navigate(`/apps/${newAppName}`);
@@ -395,12 +498,27 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
                                                 // overview instead of a blank `<Navigate to="">`.
                                                 const landing = resolveLandingRoute(activeApp, { currentUserId: user?.id ?? null });
                                                 return landing ? _jsx(Navigate, { to: landing, replace: true }) : _jsx(StudioHomePage, {});
-                                            })() }), _jsx(Route, { path: "metadata/package/*", element: _jsx(Navigate, { to: `/apps/${appName ?? activeApp.name}/component/developer/packages`, replace: true }) }), _jsxs(Route, { path: "metadata", children: [_jsx(Route, { index: true, element: _jsx(MetadataDirectoryPage, {}) }), _jsx(Route, { path: "_diagnostics", element: _jsx(MetadataDiagnosticsPage, {}) }), _jsx(Route, { path: ":type", element: _jsx(MetadataResourceListPage, {}) }), _jsx(Route, { path: ":type/new", element: _jsx(MetadataResourceEditPage, { createMode: true }) }), _jsx(Route, { path: ":type/:name", element: _jsx(MetadataResourceEditPage, {}) }), _jsx(Route, { path: ":type/:name/history", element: _jsx(MetadataResourceHistoryPage, {}) })] }), _jsx(Route, { path: ":objectName", element: _jsx(ObjectView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit, externalRefreshKey: refreshKey }) }), _jsx(Route, { path: ":objectName/new", element: _jsx(RecordFormPage, { mode: "create" }) }), _jsx(Route, { path: ":objectName/view/:viewId", element: _jsx(ObjectView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit, externalRefreshKey: refreshKey }) }), _jsx(Route, { path: ":objectName/record/:recordId", element: _jsx(RecordDetailView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit }, refreshKey) }), _jsx(Route, { path: ":objectName/record/:recordId/edit", element: _jsx(RecordFormPage, { mode: "edit" }) }), _jsx(Route, { path: "dashboard/:dashboardName", element: _jsx(DashboardView, { dataSource: dataSource }) }), _jsx(Route, { path: "report/:reportName", element: _jsx(ReportView, { dataSource: dataSource }) }), _jsx(Route, { path: "page/:pageName", element: _jsx(PageView, {}) }), _jsx(Route, { path: "component/:ns/:name/*", element: _jsx(ComponentNavView, {}) }), _jsx(Route, { path: "component/metadata/directory", element: _jsx(LegacyMetadataRedirect, { mode: "directory" }) }), _jsx(Route, { path: "component/metadata/resource/*", element: _jsx(LegacyMetadataRedirect, { mode: "resource" }) }), _jsx(Route, { path: "design/dashboard/:dashboardName", element: _jsx(DashboardDesignPage, {}) }), _jsx(Route, { path: "search", element: _jsx(SearchResultsPage, {}) }), _jsx(Route, { path: "create-app", element: _jsx(CreateAppPage, {}) }), _jsx(Route, { path: "edit-app/:editAppName", element: _jsx(EditAppPage, {}) }), _jsx(Route, { path: "system/marketplace", element: _jsx(MarketplacePage, {}) }), _jsx(Route, { path: "system/marketplace/installed", element: _jsx(MarketplaceInstalledPage, {}) }), _jsx(Route, { path: "system/marketplace/:packageId", element: _jsx(MarketplacePackagePage, {}) }), extraRoutes, _jsx(Route, { path: ":objectName/:maybeRecordId", element: _jsx(ShorthandRecordRedirect, {}) }), _jsx(Route, { path: "*", element: _jsx(RouteNotFound, {}) })] }) }) }) }), currentObjectDef && (_jsx(ModalForm, { schema: {
+                                            })() }), _jsx(Route, { path: "metadata/package/*", element: _jsx(Navigate, { to: `/apps/${appName ?? activeApp.name}/component/developer/packages`, replace: true }) }), _jsxs(Route, { path: "metadata", children: [_jsx(Route, { index: true, element: _jsx(MetadataDirectoryPage, {}) }), _jsx(Route, { path: "_diagnostics", element: _jsx(MetadataDiagnosticsPage, {}) }), _jsx(Route, { path: ":type", element: _jsx(MetadataResourceListPage, {}) }), _jsx(Route, { path: ":type/new", element: _jsx(MetadataResourceEditPage, { createMode: true }) }), _jsx(Route, { path: ":type/:name", element: _jsx(MetadataResourceEditPage, {}) }), _jsx(Route, { path: ":type/:name/history", element: _jsx(MetadataResourceHistoryPage, {}) })] }), _jsx(Route, { path: ":objectName", element: _jsx(ObjectView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit, externalRefreshKey: refreshKey }) }), _jsx(Route, { path: ":objectName/new", element: _jsx(RecordFormPage, { mode: "create" }) }), _jsx(Route, { path: ":objectName/view/:viewId", element: _jsx(ObjectView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit, externalRefreshKey: refreshKey }) }), _jsx(Route, { path: ":objectName/data", element: _jsx(ObjectDataPage, { dataSource: dataSource, objects: allObjects }) }), _jsx(Route, { path: ":objectName/record/:recordId", element: _jsx(RecordDetailView, { dataSource: dataSource, objects: allObjects, onEdit: handleEdit }) }), _jsx(Route, { path: ":objectName/record/:recordId/edit", element: _jsx(RecordFormPage, { mode: "edit" }) }), _jsx(Route, { path: "dashboard/:dashboardName", element: _jsx(DashboardView, { dataSource: dataSource }) }), _jsx(Route, { path: "report/:reportName", element: _jsx(ReportView, { dataSource: dataSource }) }), _jsx(Route, { path: "page/:pageName", element: _jsx(PageView, {}) }), _jsx(Route, { path: "component/:ns/:name/*", element: _jsx(ComponentNavView, {}) }), _jsx(Route, { path: "component/metadata/directory", element: _jsx(LegacyMetadataRedirect, { mode: "directory" }) }), _jsx(Route, { path: "component/metadata/resource/*", element: _jsx(LegacyMetadataRedirect, { mode: "resource" }) }), _jsx(Route, { path: "design/dashboard/:dashboardName", element: _jsx(DashboardDesignPage, {}) }), _jsx(Route, { path: "search", element: _jsx(SearchResultsPage, {}) }), _jsx(Route, { path: "create-app", element: _jsx(CreateAppPage, {}) }), _jsx(Route, { path: "edit-app/:editAppName", element: _jsx(EditAppPage, {}) }), _jsx(Route, { path: "system/marketplace", element: _jsx(MarketplacePage, {}) }), _jsx(Route, { path: "system/marketplace/installed", element: _jsx(MarketplaceInstalledPage, {}) }), _jsx(Route, { path: "system/marketplace/:packageId", element: _jsx(MarketplacePackagePage, {}) }), extraRoutes, _jsx(Route, { path: ":objectName/:maybeRecordId", element: _jsx(ShorthandRecordRedirect, {}) }), _jsx(Route, { path: "*", element: _jsx(RouteNotFound, {}) })] }) }) }) }), formObjectDef && (_jsx(ModalForm, { schema: {
                             type: 'object-form',
                             formType: 'modal',
-                            objectName: currentObjectDef.name,
+                            objectName: formObjectDef.name,
                             mode: editingRecord ? 'edit' : 'create',
                             recordId: editingRecord?.id,
+                            // Child create task (#2604 D3): pre-link the parent from the
+                            // `formLink` URL param (refresh-safe — the link survives).
+                            ...(formLinkValues && !editingRecord ? { initialValues: formLinkValues } : {}),
+                            // #2604 D1: create/edit follow the flow-surface derivation —
+                            // field-heavy → full-screen modal (the same big canvas the
+                            // detail page gets, with overlay return semantics); light
+                            // objects keep the existing auto-sized modal (ModalForm
+                            // infers from columns when modalSize is unset). Derived
+                            // default only — anything spread later (form view layout)
+                            // would win. Child tasks size to the CHILD object's def.
+                            ...(deriveRecordFlowSurface(formObjectDef, isChildFormTask
+                                ? (editingRecord ? 'child-edit' : 'child-create')
+                                : (editingRecord ? 'edit' : 'create')).size === 'full'
+                                ? { modalSize: 'full' }
+                                : {}),
                             // Honor the object's DEFAULT FORM VIEW: curated sections (field
                             // selection + order + grouping), `contentLayout: 'tabbed'` when the
                             // view is tabbed, and inline child collections (master-detail).
@@ -408,30 +526,31 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
                             // win over the flat `fields` list below; otherwise this resolves to
                             // {} and `fields` (every field, raw schema order) is used as before.
                             // `formType` stays 'modal' (the container). (#1890 / ADR-0050.)
-                            ...resolveFormViewLayout(currentObjectDef),
+                            ...resolveFormViewLayout(formObjectDef),
                             title: editingRecord
-                                ? t('form.editTitle', { object: objectLabel(currentObjectDef) })
-                                : t('form.createTitle', { object: objectLabel(currentObjectDef) }),
+                                ? t('form.editTitle', { object: objectLabel(formObjectDef) })
+                                : t('form.createTitle', { object: objectLabel(formObjectDef) }),
                             description: editingRecord
-                                ? t('form.editDescription', { object: objectLabel(currentObjectDef) })
-                                : t('form.createDescription', { object: objectLabel(currentObjectDef) }),
+                                ? t('form.editDescription', { object: objectLabel(formObjectDef) })
+                                : t('form.createDescription', { object: objectLabel(formObjectDef) }),
                             open: isDialogOpen,
-                            onOpenChange: setIsDialogOpen,
+                            onOpenChange: (open) => { if (!open)
+                                closeRecordForm(); },
                             layout: 'vertical',
-                            fields: currentObjectDef.fields
-                                ? (Array.isArray(currentObjectDef.fields)
-                                    ? currentObjectDef.fields
+                            fields: formObjectDef.fields
+                                ? (Array.isArray(formObjectDef.fields)
+                                    ? formObjectDef.fields
                                         .filter((f) => {
                                         if (typeof f === 'string')
                                             return true;
                                         return evaluateVisibility(f.visible, expressionEvaluator);
                                     })
                                         .map((f) => typeof f === 'string' ? f : f.name)
-                                    : Object.entries(currentObjectDef.fields)
+                                    : Object.entries(formObjectDef.fields)
                                         .filter(([_, f]) => evaluateVisibility(f.visible, expressionEvaluator))
                                         .map(([key]) => key))
                                 : [],
-                            onSuccess: handleCrudSuccess,
+                            onSuccess: handleRecordFormSuccess,
                             onCancel: handleDialogCancel,
                             showSubmit: true,
                             showCancel: true,
@@ -439,7 +558,7 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
                                 ? t('form.update', { defaultValue: t('common.save', { defaultValue: 'Save' }) })
                                 : t('form.create', { defaultValue: t('common.create', { defaultValue: 'Create' }) }),
                             cancelText: t('common.cancel'),
-                        }, dataSource: dataSource }, editingRecord?.id || 'new'))] })] }));
+                        }, dataSource: dataSource }, `${formObjectDef.name}:${editingRecord?.id || 'new'}`))] })] }));
 }
 function findFirstRoute(items, ctx) {
     if (!items || items.length === 0)

package/dist/console/ConsoleShell.js

@@ -26,9 +26,16 @@ import { FavoritesProvider } from '../context/FavoritesProvider';
 import { RecentItemsProvider } from '../context/RecentItemsProvider';
 import { UserStateAdaptersProvider, useAttachUserStateAdapters, } from '../context/UserStateAdapters';
 import { ThemeProvider } from '../chrome/ThemeProvider';
+import { LoadingScreen } from '../chrome/LoadingScreen';
 import { RemediationOverlay } from './RemediationOverlay';
+// The console's every pre-React / pre-auth gate (Suspense fallback, adapter
+// not ready, org/auth loading) renders this. It used to be a bare, unbranded
+// "Loading…" line — ~8s of blank chrome before the login redirect on a cold
+// /_console load (framework#2615 P3). Delegate to the branded, boot-safe
+// splash (logo + product name + step list) that the rest of the shell already
+// uses, so the cold load looks like the product from the first frame.
 export function LoadingFallback() {
-    return (_jsx("div", { className: "h-screen flex items-center justify-center text-sm text-muted-foreground", children: "Loading\u2026" }));
+    return _jsx(LoadingScreen, {});
 }
 /**
  * Provide a MODAL handler at the console ROOT — the same level the global

package/dist/context/CommandPaletteProvider.js

@@ -19,9 +19,10 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import { createContext, useContext, useEffect, useMemo, } from 'react';
 import { useUrlOverlay } from '../hooks/useUrlOverlay';
+import { COMMAND_PALETTE_PARAM } from '../urlParams';
 const CommandPaletteContext = createContext(null);
 export function CommandPaletteProvider({ children }) {
-    const { open, setOpen, openOverlay, closeOverlay, toggleOverlay } = useUrlOverlay('palette', {
+    const { open, setOpen, openOverlay, closeOverlay, toggleOverlay } = useUrlOverlay(COMMAND_PALETTE_PARAM, {
         alias: 'cmdk',
     });
     // ⌘K / Ctrl+K accelerator. Lives here (not in CommandPalette) so the command

package/dist/hooks/useObjectActions.js

@@ -58,14 +58,21 @@ export function useObjectActions({ objectName, objectLabel, dataSource, onEdit,
                         label: objectLabel || objectName,
                         defaultValue: `Deleted ${succeeded} ${objectLabel || objectName} records`,
                     }));
-                    return { success: true, reload: true };
+                    // `silent`: the handler already toasted the localized summary above;
+                    // without this the runner's post-execution hook adds a second, generic
+                    // "Action completed successfully" toast (double success toast).
+                    return { success: true, reload: true, silent: true };
                 }
                 toast.error(t('objectActions.bulkDeletePartial', {
                     succeeded,
                     failed,
                     defaultValue: `${succeeded} deleted, ${failed} failed`,
                 }));
-                return { success: false, error: `${failed} failed` };
+                // The toast above is the authoritative feedback (it carries the
+                // succeeded/failed summary the runner can't reconstruct). Return
+                // WITHOUT `error` so the ActionRunner post-execution hook — this runner
+                // has a toastHandler (onToast) — doesn't fire a second, duplicate toast.
+                return { success: false };
             }
             const recordId = action.params?.recordId ??
                 action.params?.record?.id ??
@@ -77,13 +84,18 @@ export function useObjectActions({ objectName, objectLabel, dataSource, onEdit,
                 await dataSource.delete(objectName, recordId);
                 onRefresh?.();
                 toast.success(t('objectActions.deleteSuccess', { label: objectLabel || objectName }));
-                return { success: true, reload: true };
+                // `silent`: handler owns the localized success toast above — suppress the
+                // runner's generic duplicate (see the bulk branch).
+                return { success: true, reload: true, silent: true };
             }
             catch (err) {
                 toast.error(t('objectActions.deleteFailed', { label: objectLabel || objectName }), {
                     description: err.message,
                 });
-                return { success: false, error: err.message };
+                // Keep the richer toast above (label + error description) and return
+                // WITHOUT `error` so the ActionRunner post-execution hook doesn't toast
+                // the raw message a second time. See the bulk branch for the rationale.
+                return { success: false };
             }
         });
         // Handler: navigate