Tracking: Studio-authored metadata that's declared but never wired at runtime (the 'silently does nothing' family)

[os-zhuang]

The pattern (tracking / umbrella)

A recurring, high-severity class surfaced by the online-authoring push and the publish-rebind consumer audit: a business user authors metadata in the Studio, publishes it, and it's stored + shown as live — but the runtime never actually WIRES it, so it silently does nothing (often not even after a restart). Code-reading and mocked unit tests pass; only a real-runtime probe reveals it (the #2560 lesson). This is the same silent-failure theme as the just-shipped #4 (inline validation) and #6 (enable/disable) work — "you authorized it, it quietly doesn't take effect."

This issue consolidates the remaining members of that family into one place, now that the first fix has landed and established the pattern.

✅ Fixed — the template

• Authored hooks never executed their body — Authored (Studio) hooks never execute their body — no bodyRunner on the metadata-service bind path #2588, fixed by fix(objectql,runtime,metadata-protocol): execute authored (Studio) hook bodies — default bodyRunner + live rebind (#2588) #2596 (2d567cbc7): wired the engine's default bodyRunner (+ functions) into the metadata-service hook-bind path and rebinds live on publish. This is the reference implementation for the rest below.

🔴 Open — same "declared-but-not-wired" family

1. Authored actions' handler may never run — UNVERIFIED, untracked (the reason for this issue).
   executeAction reads a boot-populated this.actions Map filled only from the app manifest via registerAction; objectql does not load action metadata at boot. So a Studio-authored action (a script/body action) is likely dead at runtime — the exact parallel of the hooks gap, and not covered by the hooks fix (fix(objectql,runtime,metadata-protocol): execute authored (Studio) hook bodies — default bodyRunner + live rebind (#2588) #2596 touched the hook-bind path only). Next step: runtime-probe it (author a script action into a writable base, publish, invoke via run_action / a flow action node, check before/after/restart). If broken, fix by reusing the fix(objectql,runtime,metadata-protocol): execute authored (Studio) hook bodies — default bodyRunner + live rebind (#2588) #2596 bodyRunner wiring for the action path.

2. Authored translations never reach the i18n runtime — Authored (Studio) translations never reach the i18n runtime — only static bundles are loaded #2591. loadTranslations is called only with static bundles (app bundle.translations, plugin translations/); nothing reads translation metadata items into service-i18n (getMetaItems({type:'translation'}) → 0). translation is allowRuntimeCreate:true but unwired → a Studio-authored translation is a dead-end on publish AND after restart.

3. Sharing rules created at runtime don't bind until restart — Sharing rules created at runtime don't bind their hooks until restart (bindRuleHooks is boot-only) #2592. Enforcement reads sys_sharing_rule rows live, but the hook binding (bindRuleHooks, sharing-plugin.ts:201) is boot-only. Different trigger from the rest: authoring a rule is a data insert, so metadata:reloaded never fires → needs a sys_sharing_rule data-change rebind.

✅ Proven-fine — do NOT chase (audit, runtime-verified)

validation rules, object definition edits, action schema, report_schedule, and permission-sets / RLS / FLS all go live on publish without restart (read live per-request, not boot-cached). Confirmed by adding a field to an already-cached object and publishing → the new field was accepted without a restart.

Related but distinct (cross-reference — separate work, already tracked)

• Automation run-history observability follow-ups (retention / discoverable Runs surface / durable run detail) — Automation run observability — follow-ups (retention, discoverable Runs surface, durable run detail) #2585.
• Studio rail doesn't list published metadata for writable-base packages — task_8dd7c8a0 (in progress).
• App-nav item authoring is off-spec (kind/path not in the discriminated-union spec; runtime resolveHref ignores it) — objectui chore: version packages #2245.

Reusable runtime-verify harness

The decisive method for any "authored X takes effect at runtime" claim: com.example.ops (an unregistered writable-base package) + a probe object/hook/action + POST /packages/:id/publish-drafts + a before / after / restart check. Code-reading and mocked tests pass while the real runtime is broken — always probe the running server.

Suggested sequencing

1. Verify + (if broken) fix authored actions' handler — most likely the biggest remaining hole, and reuses the fix(objectql,runtime,metadata-protocol): execute authored (Studio) hook bodies — default bodyRunner + live rebind (#2588) #2596 bodyRunner wiring.
2. i18n translations (Authored (Studio) translations never reach the i18n runtime — only static bundles are loaded #2591).
3. Sharing-rule data-change rebind (Sharing rules created at runtime don't bind their hooks until restart (bindRuleHooks is boot-only) #2592).

Each is a real feature-fix with its own design surface (e.g. "should authored actions/hooks run sandboxed JS?" — a security gate), not a generic metadata:reloaded subscription.

[os-zhuang]

All three open items in this family shipped in #2608 (4f5b791), each runtime-verified against a live showcase server with the before/after/restart harness described above:

1. Authored actions' handler never ran — CONFIRMED broken, now fixed. The probe reproduced the gap exactly as hypothesized (POST /actions/... → Action not found for a published action row). Fixed by reusing the fix(objectql,runtime,metadata-protocol): execute authored (Studio) hook bodies — default bodyRunner + live rebind (#2588) #2596 template: default QuickJS action runner installed by AppPlugin (engine.setDefaultActionRunner, opt-out OS_DISABLE_AUTHORED_ACTIONS=1) + resyncAuthoredActions in ObjectQLPlugin (kernel:ready / metadata:reloaded / action+object mutations; artifact-wins filter; covers standalone action rows AND actions embedded in authored object rows). Verified live: body executes on publish and after restart.
2. i18n translations (Authored (Studio) translations never reach the i18n runtime — only static bundles are loaded #2591) — closed by the PR. Note for the audit record: the first cut wired only service-i18n and the runtime probe caught it doing nothing, because dev/standalone stacks run the kernel's in-memory i18n fallback — the fix now covers both adapters via a shared sync in core (wireAuthoredTranslationSync), with clear-then-reload delete semantics verified live.
3. Sharing-rule data-change rebind (Sharing rules created at runtime don't bind their hooks until restart (bindRuleHooks is boot-only) #2592) — closed by the PR. Verified live: first runtime rule for an object with zero boot-time rules produced a sys_record_share row on the next matching insert, no restart.

Residual (not chased here): standalone authored action items execute via the REST route but aren't discoverable via MCP run_action/list_actions, since those resolve declarations from object.actions — same declaration-surfacing gap as the Studio-rail listing work (task_8dd7c8a0). Object-embedded authored actions are covered on both surfaces.

---

Generated by Claude Code