fix(app-shell): read the save-to-view grant through personalGrant and enter its write site (#30073)

Claude-Session: https://claude.ai/code/session_01QSeKYpFBMr917PmVkG9up7
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

ui/packages/app-shell/src/views/ObjectView.tsx

@@ -718,9 +718,11 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
     // shape is the same), then the reader's list state for it is cleared and
     // the list opens again on the saved view. A panel the fold cannot write
     // losslessly keeps the refusal Save as my view gives.
-    const canUpdatePersonalView = activeIsPersonal
-        && personalViews.status === 'ready'
-        && (!perms.isLoaded || perms.can(PERSONAL_VIEW_OBJECT, 'update'));
+    // The reader's own `sys_personal_view` rows: one grant read for Save as my
+    // view (create) and for Rename and 保存 (update).
+    const personalViewsReady = personalViews.status === 'ready';
+    const personalGrant = (action: 'create' | 'update') => !perms.isLoaded || perms.can(PERSONAL_VIEW_OBJECT, action);
+    const canUpdatePersonalView = activeIsPersonal && personalViewsReady && personalGrant('update');
     const handleSaveToPersonalView = async () => {
         if (!activeView || !activeIsPersonal) return;
         const built = buildPersonalViewConfig(objectDef.name, activeView, {
@@ -797,8 +799,6 @@ function ObjectViewInner({ dataSource, objects, onEdit, externalRefreshKey }: Co
     // one (`sys_personal_view` read and create), not to admins only; the name
     // is asked in `PersonalViewNameDialog`. A reader who cannot read the
     // list's own object is offered no Save: there is no list to keep.
-    const personalViewsReady = personalViews.status === 'ready';
-    const personalGrant = (action: 'create' | 'update') => !perms.isLoaded || perms.can(PERSONAL_VIEW_OBJECT, action);
     const listReadable = !perms.isLoaded || perms.can(objectDef.name, 'read');
     const [personalViewDialog, setPersonalViewDialog] = useState<{ mode: 'save' } | { mode: 'rename'; viewId: string } | null>(null);
     const openPersonalView = (id: string) => {

ui/packages/plugin-form/src/affordanceGrantMap-12082.test.tsx

@@ -739,6 +739,8 @@ const WRITE_SITES: Record<string, WriteSite> = {
     outOfFamily("the caller's OWN sys_personal_view row (Save as my view), offered behind perms.can(sys_personal_view, create) in ObjectView; the server keeps the rows owner-scoped; no record the caller browses is written"),
   'packages/app-shell/src/views/personalViews.ts :: usePersonalViews > rename :: update':
     outOfFamily("the caller's OWN sys_personal_view row (Rename), offered behind perms.can(sys_personal_view, update) in ObjectView; the server keeps the rows owner-scoped and fixes the owner; no record the caller browses is written"),
+  'packages/app-shell/src/views/personalViews.ts :: usePersonalViews > update :: update':
+    outOfFamily("the caller's OWN sys_personal_view row (保存, the list written back into the open personal view), offered behind the same perms.can(sys_personal_view, update) read as Rename in ObjectView; the server keeps the rows owner-scoped and fixes the owner; no record the caller browses is written"),
   // ── core ──
   'packages/core/src/actions/TransactionManager.ts :: TransactionManager > executeBatch :: batch':
     door('the action engine\'s transaction executor runs the operations its caller hands it'),