@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/console': patch
+---
+
+fix(setup): Position › Add holder's user picker shows each person's email beside their name
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** On a Setup position page, Add holder opened a user picker that drew one column, the user's name. An administrator could not tell two people of the same name apart, nor confirm the account before granting the position, although the holder list on the same page already shows each holder's email under the name.
+- **Now.** The picker draws a Name column and an Email column (`sys_user`'s `name` and `email`), and titles each person by `sys_user` as the registry serves it.
+- **Unchanged.** The picker still draws only the columns the caller may read: for a caller whose policy denies `sys_user.email`, the Email column is not drawn and the Name column stands alone. Choosing people still assigns the position by name, offers the active organization's members only, and skips anyone who already holds it.
@@ -0,0 +1,112 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#27410 — Add holder's user picker shows each person's email beside
+ * their name, as the holder rows do, so two people of one name can be told
+ * apart before either is granted the position.
+ *
+ * Pinned against the real `RecordPickerDialog` (not a stub), so what is read
+ * is the table the admin sees:
+ *
+ *  - the picker draws a name column and an email column;
+ *  - CONTROL: choosing a person still assigns the position BY NAME;
+ *  - CONTROL: under a loaded policy that denies `sys_user.email`, the picker's
+ *    own read rule leaves the name column alone — the section adds no check of
+ *    its own and reads the email no other way.
+ */
+import * as React from 'react';
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor, fireEvent, cleanup } from '@testing-library/react';
+import { PermissionProvider } from '@object-ui/permissions';
+import type { ObjectPermissionConfig } from '@object-ui/types';
+
+const users = [
+  { id: 'u_1', name: 'Ada Auditor', email: 'ada@example.com' },
+  { id: 'u_2', name: 'Sam Lee', email: 'sam.lee@example.com' },
+  { id: 'u_3', name: 'Sam Lee', email: 'slee@example.com' },
+];
+const assignments = [{ id: 'up_1', user_id: 'u_1', position: 'auditor' }];
+
+const adapter = {
+  find: vi.fn(async (object: string, query: any) => {
+    if (object === 'sys_user_position') {
+      return { data: assignments.filter((a) => a.position === query?.$filter?.position) };
+    }
+    if (object === 'sys_user') {
+      const ids: string[] | undefined = query?.$filter?.id?.$in;
+      const data = ids ? users.filter((u) => ids.includes(u.id)) : users;
+      return { data, total: data.length };
+    }
+    return { data: [] };
+  }),
+  create: vi.fn(async () => ({})),
+  delete: vi.fn(async () => ({})),
+};
+vi.mock('@object-ui/react', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  useAdapter: () => adapter,
+}));
+
+import { PositionHoldersSection } from './PositionHoldersSection';
+
+/** A policy under which `viewer` may not read `sys_user.email`. */
+const EMAIL_DENIED: ObjectPermissionConfig[] = [
+  {
+    object: 'sys_user',
+    roles: { viewer: { actions: ['read'], fieldPermissions: [{ field: 'email', read: false }] } },
+  } as ObjectPermissionConfig,
+];
+
+function cells(field: string): string[] {
+  return Array.from(document.querySelectorAll(`[data-lookup-cell="${field}"]`)).map((el) => el.textContent ?? '');
+}
+
+async function openPicker(): Promise<void> {
+  await waitFor(() => expect(screen.getByText('Ada Auditor')).toBeTruthy());
+  fireEvent.click(screen.getByRole('button', { name: /Add holder/ }));
+  await waitFor(() => expect(screen.getByTestId('record-row-u_3')).toBeTruthy());
+}
+
+beforeEach(() => {
+  adapter.find.mockClear();
+  adapter.create.mockClear();
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe('PositionHoldersSection — the picker shows email beside the name (objectstack#27410)', () => {
+  it('draws a name column and an email column', async () => {
+    render(<PositionHoldersSection name="auditor" />);
+    await openPicker();
+
+    const dialog = screen.getByTestId('record-picker-dialog');
+    expect(dialog).toHaveTextContent('Email');
+    expect(cells('name')).toEqual(['Ada Auditor', 'Sam Lee', 'Sam Lee']);
+    expect(cells('email')).toEqual(['ada@example.com', 'sam.lee@example.com', 'slee@example.com']);
+  });
+
+  it('CONTROL: choosing a person still assigns the position by name', async () => {
+    render(<PositionHoldersSection name="auditor" />);
+    await openPicker();
+
+    fireEvent.click(screen.getByTestId('record-row-u_3'));
+    fireEvent.click(screen.getByTestId('record-picker-confirm'));
+    await waitFor(() => expect(adapter.create).toHaveBeenCalledTimes(1));
+    expect(adapter.create).toHaveBeenCalledWith('sys_user_position', { user_id: 'u_3', position: 'auditor' });
+  });
+
+  it('CONTROL: a viewer who may not read email gets the name column alone', async () => {
+    render(
+      <PermissionProvider roles={[]} userRoles={['viewer']} permissions={EMAIL_DENIED}>
+        <PositionHoldersSection name="auditor" />
+      </PermissionProvider>,
+    );
+    await openPicker();
+
+    expect(cells('name')).toEqual(['Ada Auditor', 'Sam Lee', 'Sam Lee']);
+    expect(cells('email')).toEqual([]);
+    expect(screen.getByTestId('record-picker-dialog')).not.toHaveTextContent('slee@example.com');
+  });
+});
@@ -86,6 +86,17 @@ const asArray = (res: any): any[] => (Array.isArray(res) ? res : res?.data ?? []
 const personLabel = (u: any): string =>
   u?.full_name || u?.name || u?.display_name || u?.email || String(u?.id ?? '');
 
+/**
+ * objectstack#27410 — the picker shows what a holder row shows: the person's
+ * name and, beside it, their email, so two people of one name can be told
+ * apart before either is granted the position. `name` is the field `sys_user`
+ * declares as its `nameField`, and `email` is its login identity. The picker
+ * draws only the columns the caller may read (`RecordPickerDialog`'s own read
+ * rule), so for a caller who may not read `email` the name column stands alone.
+ */
+const PICKER_NAME_FIELD = 'name';
+const PICKER_EMAIL_FIELD = 'email';
+
 /**
  * The server's own sentence out of a refused call, or `''` when it gave none.
  * Read through `@object-ui/react`'s shared reader, the one place the adapters'
@@ -107,6 +118,8 @@ function useCopy() {
             empty: '还没有人持有此岗位。',
             loading: '加载中…',
             pickTitle: '选择要分配此岗位的组织成员',
+            nameColumn: '姓名',
+            emailColumn: '邮箱',
             noMembers: '本组织还没有可分配的成员。',
             membersFailed: '无法读取本组织的成员。',
             removeTitle: (who: string) => `将 ${who} 从此岗位移除？`,
@@ -124,6 +137,8 @@ function useCopy() {
             empty: 'Nobody holds this position yet.',
             loading: 'Loading…',
             pickTitle: 'Select organization members to assign this position to',
+            nameColumn: 'Name',
+            emailColumn: 'Email',
             noMembers: 'This organization has no members to assign yet.',
             membersFailed: 'Could not read the members of this organization.',
             removeTitle: (who: string) => `Remove ${who} from this position?`,
@@ -197,6 +212,12 @@ export function PositionHoldersSection({ name }: PositionHoldersSectionProps): R
   const canAdd = resolveAffordance('relatedNew', holdingSource).allowed;
   const canRemove = resolveAffordance('relatedRowDelete', holdingSource).allowed;
   const memberOrganization = membershipOrganization(activeOrganizationId, objects);
+  /**
+   * `sys_user` as the registry serves it, read from the metadata this section
+   * already holds: the picker's name column resolves each person's title by it.
+   */
+  const userSchema = ((objects ?? []).find((o) => (o as { name?: unknown } | null)?.name === 'sys_user') ??
+    null) as Record<string, unknown> | null;
 
   const load = React.useCallback(async () => {
     if (!adapter) return;
@@ -392,6 +413,11 @@ export function PositionHoldersSection({ name }: PositionHoldersSectionProps): R
           multiple
           dataSource={adapter}
           objectName="sys_user"
+          objectSchema={userSchema}
+          columns={[
+            { field: PICKER_NAME_FIELD, label: c.nameColumn },
+            { field: PICKER_EMAIL_FIELD, label: c.emailColumn },
+          ]}
           title={c.pickTitle}
           baseFilter={memberFilter}
           onSelect={() => {}}