@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+fix(app-shell): a team made in Setup no longer reads as managed by an outside identity provider, and a header action's write shows on the page's related lists and their counts at once
+
+Clause-②: no
+Metadata-protocol: none
+
+- The `better-auth` note (the Identity tag's tooltip, and the Setup record header's object-label note) read "Managed by the identity provider" / 「由身份提供方管理」, which told the maker of a hand-made team that the row came from elsewhere and was not theirs to change. It now reads "Written through the built-in identity service" / 「经内置身份服务写入」, and its body says these records are created and changed with the actions on the page or through sign-in, invitation and security flows, all of which go through that service. The values change in all ten language packs; no key is added or removed.
+- A record-page action that declares `refreshAfter: true` (an `api` action such as a team's Add Member, a server action, a flow, a declared operation) now refreshes the record AND every related list the page shows: the lists refetch and their tab and card counts re-count. It used to refresh the record alone, so a team's members tab read 0 beside a list of 2 until a later row action on that list.
+- Nothing to do on upgrade.
@@ -155,13 +155,17 @@ const VARIANTS: Record<VariantKey, Variant> = {
       "Immutable audit log. Rows cannot be created, edited, or deleted from the UI — they're written by the platform when events occur. Use Export to download for compliance review.",
     tone: 'border-zinc-300/60 bg-zinc-50 text-zinc-900 hover:bg-zinc-100 dark:border-zinc-500/40 dark:bg-zinc-950/40 dark:text-zinc-100',
   },
+  // objectstack#30337 — the note holds for every row of the bucket, a team an
+  // admin made in Setup included: the built-in identity service writes the
+  // rows, and the page's own actions are how to change them. It names no
+  // outside provider: nothing here says the row came from elsewhere.
   'better-auth': {
     icon: ShieldAlert,
     i18nKey: 'betterAuth',
     short: 'Identity',
-    title: 'Managed by the identity provider',
+    title: 'Written through the built-in identity service',
     body: (display) =>
-      `This object's schema is owned by ${display}. Direct edits bypass password hashing, session validation, two-factor checks, and audit hooks. Manage these records through your authentication provider's sign-in, invitation, and security flows instead.`,
+      `This object's schema belongs to ${display}, the platform's built-in identity service. Create and change these records with the actions on this page, or through sign-in, invitation and security flows; every one of them goes through that service. Editing the table directly would bypass password hashing, session validation, two-factor checks and audit hooks.`,
     tone: 'border-amber-300/60 bg-amber-50 text-amber-900 hover:bg-amber-100 dark:border-amber-500/40 dark:bg-amber-950/40 dark:text-amber-100',
   },
 };
 
@@ -8,6 +8,7 @@ import '@testing-library/jest-dom/vitest';
 import { describe, expect, it } from 'vitest';
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
+import { I18nProvider } from '@object-ui/i18n';
 import { ManagedByBadge } from '../ManagedByBadge';
 
 describe('ManagedByBadge — the explanation is reachable from the keyboard (objectstack#27521)', () => {
@@ -26,3 +27,40 @@ describe('ManagedByBadge — the explanation is reachable from the keyboard (obj
     expect(screen.queryByTestId('managed-by-badge')).toBeNull();
   });
 });
+
+/**
+ * objectstack#30337 item 1 — a team an admin made in Setup carries the
+ * `better-auth` tag, and its note read 「由身份提供方管理」 / "Managed by the
+ * identity provider": to its maker that says the row came from somewhere else
+ * and is not theirs to change. The bucket is right (the identity service owns
+ * the table and every write goes through it); the words were not. The note
+ * now says what holds for every such object, a hand-made team included: the
+ * built-in identity service writes the rows, and this page's actions are how
+ * to change them.
+ */
+describe('ManagedByBadge — the identity note is true of a team made here (objectstack#30337)', () => {
+  const openNote = async () => {
+    await userEvent.tab();
+    return (await screen.findByRole('tooltip')).textContent ?? '';
+  };
+
+  it('English: names the built-in identity service and the page\'s actions, not an outside provider', async () => {
+    render(<ManagedByBadge managedBy="better-auth" />);
+    const note = await openNote();
+    expect(note).toContain('Written through the built-in identity service');
+    expect(note).toContain('the actions on this page');
+    expect(note).not.toContain('identity provider');
+  });
+
+  it('Chinese: the same note, from the zh pack', async () => {
+    render(
+      <I18nProvider config={{ defaultLanguage: 'zh', detectBrowserLanguage: false }}>
+        <ManagedByBadge managedBy="better-auth" />
+      </I18nProvider>,
+    );
+    const note = await openNote();
+    expect(note).toContain('经内置身份服务写入');
+    expect(note).toContain('本页上的操作');
+    expect(note).not.toContain('身份提供方');
+  });
+});
@@ -54,10 +54,13 @@ import { MetadataCtx, notifyDataChanged, useMutationInvalidationBridge } from '@
 import { RelatedCountStore } from '@object-ui/components';
 import type { DataSourceMutationEvent } from '@object-ui/types';
 
+// The page's authenticated fetch. Answers nothing (a bare `vi.fn()`) unless a
+// test gives it an implementation: only the header-action describe does.
+const authFetchSpy = vi.hoisted(() => vi.fn());
 vi.mock('@object-ui/auth', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   useAuth: () => ({ user: { id: 'u1', name: 'Ada', image: null }, activeOrganization: null }),
-  createAuthenticatedFetch: () => vi.fn(),
+  createAuthenticatedFetch: () => authFetchSpy,
 }));
 
 vi.mock('@object-ui/collaboration', async (importOriginal) => ({
@@ -192,7 +195,7 @@ function makeBackend() {
       return () => listeners.delete(cb);
     },
   };
-  return { ds, rollup };
+  return { ds, rollup, lines };
 }
 
 type FakeDataSource = ReturnType<typeof makeBackend>['ds'];
@@ -203,9 +206,9 @@ function ConsoleHost({ dataSource, children }: { dataSource: unknown; children:
   return <>{children}</>;
 }
 
-function renderPage(ds: FakeDataSource) {
+function renderPage(ds: FakeDataSource, objects: readonly unknown[] = OBJECTS) {
   const metadata = {
-    objects: OBJECTS,
+    objects,
     pages: [],
     loading: false,
     error: null,
@@ -222,7 +225,7 @@ function renderPage(ds: FakeDataSource) {
           <Routes>
             <Route
               path="/apps/:appName/:objectName/record/:recordId"
-              element={<RecordDetailView dataSource={ds} objects={OBJECTS} onEdit={() => {}} />}
+              element={<RecordDetailView dataSource={ds} objects={objects as typeof OBJECTS} onEdit={() => {}} />}
             />
           </Routes>
         </ConsoleHost>
@@ -243,9 +246,9 @@ const figureShown = (figure: number) => {
   return text.includes(plain) || text.includes(grouped);
 };
 
-async function settledPage() {
+async function settledPage(objects: readonly unknown[] = OBJECTS) {
   const backend = makeBackend();
-  renderPage(backend.ds);
+  renderPage(backend.ds, objects);
   await waitFor(() => expect(parentReads(backend.ds)).toBe(1));
   await screen.findByText('Seat licence');
   await waitFor(() => expect(figureShown(backend.rollup())).toBe(true));
@@ -354,3 +357,77 @@ describe('RecordDetailView — a child write in a related list refreshes the par
     expect(parentReads(ds)).toBe(3);
   });
 });
+
+/**
+ * objectstack#30337 item 3 — the reverse direction: a HEADER action on the
+ * parent writes its children, and the page's related lists and their counts
+ * follow at once.
+ *
+ * The reported reach: a team's 「添加成员」 header action (`type: 'api'`,
+ * `refreshAfter: true`) adds a membership row server-side. The page then said
+ * 团队成员 0 on its tab while the list, read when the tab opened, held 2 rows;
+ * only a later row action on the membership list (which posts the CHILD's
+ * name) brought the count to the truth.
+ *
+ * Mechanism: `refreshAfter` is "refresh the view after execution" (the spec's
+ * own description), and on a record page the view is the record AND its
+ * related lists. The page used to post only this record's change, so the
+ * child's lists and the count store (both keyed on the CHILD object) never
+ * heard of the write. An `api` action is opaque — the client cannot know which
+ * objects its target wrote — so the page refreshes what it shows: this record
+ * and every child object it lists.
+ */
+describe('RecordDetailView — a header action with `refreshAfter` refreshes the related lists and their counts (objectstack#30337)', () => {
+  const ACTION_DOOR = `/api/v1/actions/${PARENT}/add_line`;
+  const parentWithAction = {
+    ...parentObject,
+    actions: [
+      {
+        name: 'add_line',
+        label: 'Add line',
+        objectName: PARENT,
+        type: 'api',
+        target: '/api/v1/quotes/add-line',
+        recordIdParam: 'quoteId',
+        locations: ['record_header'],
+        refreshAfter: true,
+      },
+    ],
+  };
+  const objectsWithAction = [parentWithAction, childObject, unrelatedObject];
+
+  afterEach(() => {
+    authFetchSpy.mockReset();
+  });
+
+  it('the click adds a child server-side; the list shows it and the count reads 3, with one parent read', async () => {
+    const backend = await settledPage(objectsWithAction);
+    const { ds, lines } = backend;
+    await waitFor(() => expect(RelatedCountStore.get(CHILD, PARENT, RECORD_ID)).toBe(2));
+    authFetchSpy.mockImplementation(async (url: string, init?: RequestInit) => {
+      if (String(url).endsWith(ACTION_DOOR) && init?.method === 'POST') {
+        lines.push({ id: 'l-3', name: 'Support plan', quantity: 1, unit_price: 500, [PARENT]: RECORD_ID });
+        return new Response(JSON.stringify({ success: true, data: {} }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return undefined;
+    });
+
+    await act(async () => {
+      await userEvent.click(screen.getByRole('button', { name: 'Add line' }));
+    });
+
+    await waitFor(() => expect(authFetchSpy.mock.calls.map((c) => String(c[0]))).toContain(ACTION_DOOR));
+    await screen.findByText('Support plan');
+    await waitFor(() => expect(RelatedCountStore.get(CHILD, PARENT, RECORD_ID)).toBe(3));
+    // The record and its children are refreshed by one dispatch batch: the
+    // parent row is read once more, not once per object.
+    await waitFor(() => expect(parentReads(ds)).toBe(2));
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 50));
+    });
+    expect(parentReads(ds)).toBe(2);
+  });
+});
@@ -192,14 +192,14 @@ describe('RecordDetailView — Setup record pages carry the managed-by note on t
     await mountRecord('com.objectstack.setup', 'better-auth', AUTHOR);
 
     expect(badges()).toEqual([]);
-    expect(headerNote()).toEqual({ label: 'Organization', note: 'Managed by the identity provider' });
+    expect(headerNote()).toEqual({ label: 'Organization', note: 'Written through the built-in identity service' });
   });
 
   it('Setup addressed by its app name (`setup`) reads the same', async () => {
     await mountRecord('setup', 'better-auth', AUTHOR);
 
     expect(badges()).toEqual([]);
-    expect(headerNote()).toEqual({ label: 'Organization', note: 'Managed by the identity provider' });
+    expect(headerNote()).toEqual({ label: 'Organization', note: 'Written through the built-in identity service' });
   });
 
   it('CONTROL — a business-app record page still draws the floating badge for an author, and no chip note', async () => {
 
@@ -982,6 +982,22 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   const notifyRecordChanged = useCallback(() => {
     if (objectName) notifyDataChanged({ objectName, recordId: pureRecordId || undefined });
   }, [objectName, pureRecordId]);
+  // objectstack#30337 — what `refreshAfter: true` refreshes: the spec's "refresh
+  // the view after execution", and on this page the view is the record AND its
+  // related lists. An action's target may write the CHILDREN (a team's Add
+  // Member writes a membership row), and the client cannot know which objects
+  // it wrote, so the page refreshes every child object it lists as well: their
+  // lists refetch and their counts (keyed on the child) re-count. Read through
+  // a ref because the child set is derived further down this component; one
+  // synchronous dispatch batch, so the record is still read once (the
+  // child-write subscription below and this record's own nonce bump together).
+  const pageChildObjectsRef = useRef<string[]>([]);
+  const notifyViewChanged = useCallback(() => {
+    notifyRecordChanged();
+    for (const child of pageChildObjectsRef.current) {
+      if (child !== objectName) notifyDataChanged({ objectName: child });
+    }
+  }, [notifyRecordChanged, objectName]);
   // Manual refresh (objectui#3460) — the producer for `RecordContext.refresh`,
   // which `page:header` turns into the ⟳ button at the end of the header row.
   //
@@ -1686,7 +1702,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
           if (!door.res.ok) return apiActionRefusalResult(door.res, door.json, `HTTP ${door.res.status}`, language);
           const answer = readApiActionDoorSuccess(door, `Action "${action.name}"`);
           if (!answer.ok) return { success: false, error: answer.error };
-          if (action.refreshAfter === true) notifyRecordChanged();
+          if (action.refreshAfter === true) notifyViewChanged();
           return { success: true, data: answer.data, reload: action.refreshAfter === true };
         }
 
@@ -1793,7 +1809,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
           return apiActionRefusalResult(res, errBody, `HTTP ${res.status}`, language);
         }
         const data = await res.json().catch(() => ({}));
-        if (action.refreshAfter === true) notifyRecordChanged();
+        if (action.refreshAfter === true) notifyViewChanged();
         return { success: true, data, reload: action.refreshAfter === true };
       }
 
@@ -1889,7 +1905,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
 
       const shouldRefresh = action.refreshAfter === true;
       if (shouldRefresh) {
-        notifyRecordChanged();
+        notifyViewChanged();
       } else if (undo) {
         // Even when refreshAfter isn't set, reflect the change so the user sees
         // it (and the subsequent Undo) on the open record.
@@ -1988,7 +2004,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
       if (judged.followUp?.kind === 'refusal') {
         setFlowRefusal({ open: true, title: action.label, message: judged.followUp.message });
       }
-      if (judged.refresh) notifyRecordChanged();
+      if (judged.refresh) notifyViewChanged();
       return judged.result;
     } catch (error) {
       return { success: false, error: (error as Error).message };
@@ -2009,8 +2025,8 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   // `action.recordId`; header/more actions carry none and use this page's id.
   // The env ref keeps the handler instance stable across renders (authFetch is
   // memoized once) while the thunks read the live record/object.
-  const serverActionEnvRef = useRef({ objectName, pureRecordId, notifyRecordChanged, t, navigate });
-  serverActionEnvRef.current = { objectName, pureRecordId, notifyRecordChanged, t, navigate };
+  const serverActionEnvRef = useRef({ objectName, pureRecordId, notifyViewChanged, t, navigate });
+  serverActionEnvRef.current = { objectName, pureRecordId, notifyViewChanged, t, navigate };
   const serverActionHandler = useMemo(
     () => createConsoleServerActionHandler({
       fetch: authFetch,
@@ -2019,7 +2035,7 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
       resolveRecordId: (action) => ({
         recordId: (action as { recordId?: unknown }).recordId ?? serverActionEnvRef.current.pureRecordId ?? undefined,
       }),
-      onRefresh: () => serverActionEnvRef.current.notifyRecordChanged(),
+      onRefresh: () => serverActionEnvRef.current.notifyViewChanged(),
       // SPA route hop for a handler-returned `openIn: 'self'` — react-router's
       // own `navigate`, matching the shared console runtime.
       navigate: (url: string) => serverActionEnvRef.current.navigate(url),
@@ -2298,6 +2314,8 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
   );
   useEffect(() => {
     const childObjects = JSON.parse(relatedChildObjectsKey) as string[];
+    // What `notifyViewChanged` refreshes besides this record (objectstack#30337).
+    pageChildObjectsRef.current = childObjects;
     if (childObjects.length === 0) return;
     return subscribeDataChanges((change) => {
       if (childObjects.some((child) => dataChangeMatches(change, child))) {
 
@@ -1017,8 +1017,8 @@ const ar = {
     },
     betterAuth: {
       short: "الهوية",
-      title: "يديره مزوّد الهوية",
-      body: "مخطط هذا الكائن مملوك لـ {{provider}}. التعديلات المباشرة تتجاوز تجزئة كلمات المرور والتحقق من الجلسات وفحوصات المصادقة الثنائية وخطافات التدقيق. أدر هذه السجلات عبر تدفقات تسجيل الدخول والدعوة والأمان لدى مزوّد المصادقة.",
+      title: "يُكتب عبر خدمة الهوية المدمجة",
+      body: "مخطط هذا الكائن مملوك لـ {{provider}}، خدمة الهوية المدمجة في المنصة. أنشئ هذه السجلات وعدّلها بالإجراءات في هذه الصفحة أو عبر تدفقات تسجيل الدخول والدعوة والأمان؛ فكلها تمر عبر هذه الخدمة. أما تعديل الجدول مباشرة فيتجاوز تجزئة كلمات المرور والتحقق من الجلسات وفحوصات المصادقة الثنائية وخطافات التدقيق.",
     },
   },
   kanban: {
 
@@ -908,8 +908,8 @@ const de = {
     },
     betterAuth: {
       short: "Identität",
-      title: "Vom Identitätsanbieter verwaltet",
-      body: "Das Schema dieses Objekts gehört {{provider}}. Direkte Änderungen umgehen Passwort-Hashing, Sitzungsvalidierung, Zwei-Faktor-Prüfungen und Audit-Hooks. Verwalten Sie diese Datensätze über die Anmelde-, Einladungs- und Sicherheitsabläufe Ihres Authentifizierungsanbieters.",
+      title: "Über den integrierten Identitätsdienst geschrieben",
+      body: "Das Schema dieses Objekts gehört {{provider}}, dem integrierten Identitätsdienst der Plattform. Legen Sie diese Datensätze mit den Aktionen auf dieser Seite oder über Anmelde-, Einladungs- und Sicherheitsabläufe an und ändern Sie sie dort; alle laufen über diesen Dienst. Direkte Änderungen an der Tabelle würden Passwort-Hashing, Sitzungsvalidierung, Zwei-Faktor-Prüfungen und Audit-Hooks umgehen.",
     },
   },
   kanban: {