fix(platform-objects): one decision, one dialog — carry identity confirm questions on description (#7309)

[claude]

Closes #7309 (partially — see Scope split below; the showcase 4 are a different surface and are deliberately not touched).

What changed

The console action runner chains confirmation then param collection, both awaited, so an action declaring confirmText and params opened two sequential dialogs for one click — nothing sent until the second, while the first already read as "the action ran".

Following the maintainer's 2026-08-10 ruling on #7278 (shipped in PR #7592): the confirm question moves to the action's top-level description (#7367), which the param dialog renders under its title, and confirmText is dropped. 14 action sites converted, all in packages/platform-objects/src/identity/:

object	actions
sys_user	ban_user, delete_my_account, disable_two_factor, generate_backup_codes
sys_oauth_application	enable_oauth_application, disable_oauth_application, rotate_client_secret, delete_oauth_application
sys_two_factor	disable_two_factor, regenerate_backup_codes
sys_account	unlink_account
sys_organization	change_slug
sys_sso_provider	delete_sso_provider
sys_team_member	remove_team_member

Every question moves verbatim — no warning reworded, none dropped. confirmText is left in place on param-LESS actions (delete_organization, leave_organization, impersonate_user), where the confirm is the only dialog and stripping it would delete the user's only warning.

rotate_client_secret collapses three dialogs to two: one param dialog (question + client_id), then the existing post-run resultDialog that reveals the new secret. That reveal is output shown once after the rotation, not a second pre-run decision, so it stays.

Census — the card's prose was wrong, its table was right

Re-derived on current main (098b629) with a brace-depth block parse over non-test *.ts, requiring confirmText and params: [ at the same nesting level inside one object. 18 sites, not the 16-in-platform-objects the title and prose claim:

area	measured
packages/platform-objects/src/identity/**	14
examples/app-showcase (bulkActionDefs)	4
packages/plugins/plugin-approvals	0 — #7278 landed

The card's table (14) is correct; its prose (16) overcounts by 2. The card's own arithmetic confirms it: the stated total of 20 equals 14 + 4 + 2, not 16 + 4 + 2 (= 22). After this PR the platform-objects count is 0.

Schema probe — both nodes open, no fork

Re-run on current main; the strictness controls prove the probe bites:

ActionSchema: action.description                => success=true
ActionSchema: description + params              => success=true
Translation:  _actions.{action}.description     => success=true
Translation:  globalActions.{action}.description => success=true
Translation:  bogus key (control)               => success=false  unrecognized_keys
ActionSchema: bogus key (control)               => success=false  unrecognized_keys

The translation node — flagged unverified on the card — is closed. Translated confirm questions are authorable, so no translation-side workaround was needed or invented.

Scope split: the showcase 4 are a different surface

Not touched, and not a diff-size decision. The 4 showcase sites are bulkActionDefs, which validate against BulkActionDefSchema, not ActionSchema. Measured:

• BulkActionDefSchema rejects description (unrecognized_keys) — the approvals: sys_approval_request.approval_reject / approval_recall declare both confirmText and params, so one decision opens two sequential dialogs #7278 remedy has no slot on this surface.
• It is not the same defect. Per the schema's own contract, a bulk def renders one dialog: params are "inputs collected once before the run", confirmText is "shown above the affected-record summary", and a required param "blocks the Confirm button" — params and confirm share one dialog, so confirmText + params is the intended pairing here.

Applying the remedy would therefore delete a real warning from a mass-mutation surface and gain nothing. This has a consequence for #7428: its authoring-time guard must be scoped to ActionSchema and must not fire on bulkActionDefs, or it lands red on 4 correct sites. Flagging for sequencing rather than widening this card.

Translation carryover

The en / zh-CN / ja-JP / es-ES bundles move the same 14 leaves by hand. os i18n extract treats a renamed key as a new gap and this repo extracts with --fill=default, which seeds English over curated translations — invisible to check:i18n, whose fresh extract would agree with the English it just wrote. Same trap #7278 hit; pinned the same way.

Tests — the consequence, in both directions

A grep for the absence of confirmText is not enough; the risk is that a genuine warning quietly disappears. Reverse-verified — both go red:

• deleting ban_user's warning outright → red ("the confirm question was dropped, not moved — the user now gets a param dialog with no warning at all")
• restoring confirmText alongside params → red (the two-dialog pairing)

Destructive wordings are pinned phrase-by-phrase on ban_user, delete_my_account, rotate_client_secret, delete_oauth_application. Over-application is pinned too: the param-less neighbours must keep confirmText.

Measured gate results

gate	result
pnpm build	exit 0
pnpm lint	clean
typecheck (platform-objects)	clean
check:i18n	9 packages, all bundles in sync
check:i18n-coverage	12 configs, 660 baselined, none new
check:empty-changeset / no-major / adr-0087-registration	pass
check:nul-bytes	7139 files scanned, OK
platform-objects tests	339 passed (15 files)
cli tests	1182 passed (109 files)
spec tests	9947 passed, 1 pre-existing failure

The spec failure is api-methods-batch-conformance flagging sys_api_key — a file this branch does not touch, and the diff contains zero apiMethods occurrences. Pre-existing on main, not introduced here.

One measured finding, reported not fixed

actionLooksDestructive (packages/runtime/src/action-execution.ts:620) treats confirmText as a destructiveness signal. Dropping the key flips 6 of 14 actions from "destructive" to not (generate_backup_codes, regenerate_backup_codes, change_slug, and the three non-delete oauth actions) — they had no mode: 'delete' or variant: 'danger' to fall back on.

Latent, not live. Its only caller is summarizeAction, reached only from MCP listActions, which is gated twice over: it fails closed on sys_* objects (all 14 qualify) and requires ai.exposed === true (false on all 14). So nothing changes today. It is left unfixed deliberately — declaring ai: { requiresConfirmation: true } on non-exposed system actions would add dead metadata to an unreachable path. Worth its own card: a heuristic keyed off UI dialog copy now has one fewer signal.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YbeQws2wekpZRPEGs1HKWt

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 11, 2026 6:20pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects.

2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/plugins/packages.mdx (via @objectstack/platform-objects)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.