Repository navigation
spec(ui)+metadata save: judge a flattened view overlay's top-level options.KIND with the strict per-kind schema and persist the PARSED body — the door half of objectui#10380 #20051
Description
Activity
分诊首次定级：
priority:p2·bug·domain:spec·pm:queue—— 维护者已裁定 A（objectui#10380）：保存视图时，扁平覆盖层顶层options.KIND要按各视图类型的严格校验来判，越界键按名字拒绝；存储改为存校验后的结果；落地前普查已存的视图Path:
packages/spec/src/ui/view.zod.ts（第 5636 行ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()，列表覆盖成员）·packages/metadata-protocol/src/protocol.ts（第 15479 行saveMetaItem，原样持久化请求体）Triage: lands in
packages/spec(the door) plus the metadata save inpackages/metadata-protocol⇒domain:spec(the ruled door half leads; the persistence change travels with it),bug,priority:p2,pm:queue; rationale: ruling A on objectui#10380 (batch #223 item 5a, maintainer 「其他同意」, relayed by the director seat) — today a top-leveloptionsbag passes the door unjudged, is persisted verbatim and rendered, so a stored view carries keys the strict schemas refuse and renders two ways; p2 as on objectui#10380, which now waits on this card.分诊席 #6015，2026-09-25T00:26Z。⛔ 不认领、不派发。本席读完了卡面（本卡尚无评论），也读了 objectui#10380 上总调度席位的裁决评论（5824043998），并在 objectstack
origin/main2274894cc4上核对。本席核对
view.zod.ts第 5636 行是ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()。本席定级 objectui#10380 时它在第 5619 行，之后有提交落地，行号变了，内容不变。saveMetaItem在packages/metadata-protocol/src/protocol.ts第 15479 行。
定级说明
p2，与 objectui#10380 一致：严格校验被绕过，存下来的视图带着契约会拒绝的键，同一个视图在两个页面上显示不同。不涉及权限或数据损坏。
执行要点（照裁决 A）
- 门口判定：扁平覆盖层上的每个
options.KIND都按对应类型的严格校验来判，越界键按名字拒绝，和直接写的效果完全一样。options.map这条有意保留的旧路径，在它自己那种类型的校验允许的范围内继续接受。 - 存解析后的结果：
saveMetaItem不再存原始请求体，没经过判定的内容一律进不了存储。 - 落地前先普查：已存的视图里有多少带顶层
options.*、都是哪些键。结果写到 objectui#10380 和更新说明里；新判定下会失败的行要逐个点名，并写明修法。 - 钉子：直接写和包在
options里写的越界键，得到相同的拒绝；合法的options.KIND能原样往返；持久化的内容等于解析结果。 - 之后：objectui#10380 解锁，objectui 只需配合，让同一个存储视图在接口页和对象页显示一致。
Generated by Claude Code
Claim: PM loop round 1
Session:session_01QcAS3qiYYZNezaxZxaUdMV
Account:os-project-manager(the seat's linked user asGET /useranswers it; the card's assignee)
Branch:claude/issue-20051-view-overlay-options-kind-door
Worktree:objectstack-issue-20051
Domain:domain:spec
Seat:domain:spec#2(seat post #18549)
File surface:packages/spec/src/ui/view.zod.ts, the flattened list-overlay door region only (the member built asListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()and the overlayoptionshandling), plus its tests underpackages/spec/src/ui/;packages/metadata-protocol/src/protocol.ts(saveMetaItem: persist the parsed body) plus its tests; generated artefacts regenerated, never hand-edited;.changeset/.packages/metadata-protocolis adomain:enginepackage; the persistence half rides this card per triage5824570052, and this seat owes the cross-seat notice (stop on breach; explain in the report)
Container & model:M/L,mode:subagent,model: default judgment tier(dispatch-gates.mjs --tierat8d1f7ab: 「no path-derived mandate … floor · default · ceiling」; a ruled cross-package door with design judgment; the at-tier contract review runs before enqueue in an isolated subagent)
Clause-②: no
Thread-read: 5824570052
Serial constraints cleared: read at 2026-09-27T02:37Z —Open-PR census (6 open PRs besides the release PR): none touches view.zod.ts or metadata-protocol/src/protocol.ts. In-flight claims (seat 1: #19867, #19543, #19856; seat 5: #19938, #19886, #19731, #18459, #17707; engine: #20135 core, #20055 turso; cli: #20129 rest-server; this seat: #19965, #19870) name neither file. Same-day churn: 8d1f7ab (merged today) touched view.zod.ts; 586934e (2026-09-25) touched protocol.ts saveMetaItem's page path.
Ruling-ref: objectstack-ai/objectui#10380 comment 5824043998
Scope, restated from the dev contract: 「范围 = 这张 issue,别无其它。」
os-dev-report
{
"issue": 20051,
"status": "needs_decision",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV",
"premise_still_valid": true,
"summary": "Done in draft PR #20183 (first linePart of #20051): the door half of ruling A and the stored-row census. The persistence half needs a decision (Q1). The flattened list overlay member now declaresoptions. Eachoptions.KIND(kanban, calendar, gantt, gallery, timeline, chart, map, tree, derived from the shape) is judged key by key by that kind's own strict block, so an out-of-contract key is refused by name with the direct spelling's code and message at pathoptions.KIND.options.foois refused atoptions. The form overlay pinsoptionsabsent: without that pin a column-less list body the list overlay refused would be accepted by the form member. The objectuioptions.mappin stays accepted and round-trips. H1 and H2 were both confirmed on 8d1f7ab:optionswas stripped unjudged, andsaveMetaItemstored the request body with the bag byte for byte. Persistence half not implemented. Scoping it toviewis clean in code, but measured through the real save, persisting the parse output would strip console round-trip state that objectui reads back (isPinned/sortOrderon flat overlays,visibilityon ViewItem rows). It would also destroy a column-less list overlay that the form arm accepts, and it reverses ADR-0005 addendum (c), a Tier H surface (Q1). Census: objectstack @8d1f7ab has 0 view bodies with anoptionskind bag. objectui at pin f8a9d0fb0 and main c3a26ccda has 28 bag literals plus the finding's probe: 17 pass, 12 fail, and every failure is an out-of-contract key by name. Of those, 8 model stored or authored views: 5 pass, and 3 fail onoptions.kanban.groupField(write groupByField, ObjectView.tsx docblock),options.calendar.dateField(write startDateField, ObjectView.calendarAliasRefused-8355.test.tsx:203) andoptions.timeline.metaFields(delete it). 21 are renderer-level ListView props: 12 pass, and 9 fail on legacy spellings objectui already refuses. Production sys_metadata rows: NOT MEASURED, the store is unreachable from this container.",
"tests": "Suites at 62be049. specvitest run --project local: 541 files, 15819 passed. New pin file src/ui/view-overlay-options-bag.test.ts: 22 passed, re-run at 1c6a4eb (comment-only edit): 22 passed. metadata-protocol full: 188 files, 2689 passed, 19 skipped. rest narrowed to the 17 view/meta-save files: 510 passed, incl. new meta-view-overlay-options-bag.test.ts (real RestServer + real protocol + SQLite: 422 INVALID_METADATA and 0 stored rows for both spellings; 200 with the options.map row unchanged). runtime narrowed to the 29 files reaching the save: 510 passed. typecheck spec/metadata-protocol/rest: exit 0 (the metadata-protocol and rest runs are on a dist rebuilt after a killed build; see deviations). Reverse verification, committed first (135027d): base view.zod.ts swapped in (on-disk grep -c ListViewOverlayOptionsSchema = 0), then the pin file: 19 failed, 3 passed (the three controls). Restore by git checkout HEAD: hash-object b4c9089ff4 equals the HEAD blob, git diff HEAD is empty. Before-state probe at 8d1f7ab through the real saveMetaItem (stub engine): the options.timeline.metaFields overlay saved success=true and the row equalled the authored body. NOT MEASURED: red leg of the metadata-protocol/rest pins against a base dist (needs two extra spec rebuilds).",
"gates": "At 1c6a4eb, dispatch-gates --repo objectstack-ai/objectstack --ran: 89 derived, 87 exit 0, 2 NOT MEASURED (pnpm check:dual-build-cjs-loads :: exit 3 and pnpm check:type-check-debt :: exit 3, both PREREQUISITE NOT MET, need the whole-repo build). Five spec gates first answered exit 3 (dist older than the final comment-only commit). They were re-run on a spec dist built from 1c6a4eb: check:api-surface, check:dual-source-exports, check:entry-nameability, check:exported-any and check:generated all exit 0 ('All 15 generated artifacts are up to date'). eslint --no-inline-config, narrowed to the 6 changed .ts files: all in population (--print-config resolves), --format json counts 6 files with 0 errors and 0 warnings, and eslint.config.mjs enables no type-aware linting (its own comment says so). check:nul-bytes exit 0; check:migration-registry exit 0.",
"line_budget": "n/a: no skills/** in the diff",
"deviations": [
"PR first line isPart of #20051, not the dispatch'sFixes #20051: the persistence half goes to the decision box, and the contract forbidsFixeson such a card.",
"Ruling item 2 (persist the parsed body) is not implemented. Stopped per H3 and the contract; see Q1.",
"The door judgesoptions.KINDkey by key (.partial()of the kind's strict block) rather than the whole block with its required keys. Measured: the whole block refused the per-key underlay bags objectui pins (ObjectView.namedViewProtocolKeys-8980), so the route changed per the ruling's intent (out-of-contract key refused by name; C ruled out). See Q2.",
"The form overlay pinsoptionsabsent, outside the ruling's literal subject. Without it, the form arm accepted the bag the list overlay refused (measured on the unpinned change).",
"File surface beyond the claim line: packages/spec/src/migrations/entries/semantic/18.view-overlay-options-bag-judged.ts plus the regenerated registry.ts region (the ADR-0087 registration the breaking changeset needs, precedent .changeset/17499-groupbyfield-non-padded.md); docs/audits/2026-07-unknown-key-strictness-ledger.counts.md (regenerated, +1 strict site); packages/rest/src/meta-view-overlay-options-bag.test.ts (the consumer test the dispatch requires). The metadata-protocol cases ride the already-pinned engine double in protocol.graft-folded-form-sections.test.ts, so the engine-double ledger is untouched.",
"The claim'sClause-②: nois copied verbatim into the PR body and the changeset. The diff is an accept-set narrowing, so the changeset declares breaking viafix(spec)!:and**BREAKING**with ADR-0087registered view-overlay-options-bag-judged. See Q3.",
"An outertimeout 595around one os-verify-lock call killed a turbo build mid-run and left packages/spec/dist without .d.ts. It surfaced as TS7016 in a typecheck. Spec was rebuilt, then the typechecks and pins were re-run (all exit 0). Nothing was committed from that state.",
"Declared narrowings: rest tests narrowed to 17 files; runtime to the 29 files that reach the save (grep shows 0 view bodies carryingoptionsin them); eslint to the 6 changed .ts files. CI runs the full sets."
],
"files_changed": [
".changeset/20051-view-overlay-options-bag-judged.md",
"docs/audits/2026-07-unknown-key-strictness-ledger.counts.md",
"packages/metadata-protocol/src/protocol.graft-folded-form-sections.test.ts",
"packages/rest/src/meta-view-overlay-options-bag.test.ts",
"packages/spec/src/migrations/entries/semantic/18.view-overlay-options-bag-judged.ts",
"packages/spec/src/migrations/registry.ts",
"packages/spec/src/ui/view-overlay-options-bag.test.ts",
"packages/spec/src/ui/view.zod.ts"
],
"mcp_calls": "0",
"api_writes": "3: relay dispatches via scripts/pm, each POST /repos/objectstack-ai/objectstack/dispatches. (1) pr_create, executed as POST /repos/objectstack-ai/objectstack/pulls, gave PR #20183 (draft), run 36299889172. (2) label-write --assign os-project-manager, executed as POST /repos//issues/20183/assignees, run 36299920613, read back MATCHES. (3) this os-dev-report comment, executed as POST /repos//issues/20051/comments. Plus git push to the branch (not REST).",
"open_questions": [
{
"question": "Q1. Ruling item 2 says 'the metadata save persists the parsed body'. Measured through the real saveMetaItem on 8d1f7ab, parsing then persisting aviewbody changes the stored bytes as follows. It strips isPinned and sortOrder from flat list and form overlays, sort[].id and filter[].id from console personalization PUTs, objectName (ADR-0005 addendum (c)'s own example),visibilityand the undeclared columnState inner keys from ViewItem rows. It destroys a column-less, type-less list overlay that the form arm accepts: sort and searchableFields are stripped and type 'simple' is added. It rewrites exportOptions ['csv'] to { formats: ['csv'] } and materializes defaults (type 'grid', timeline scale 'week'). objectui reads isPinned, sortOrder and visibility back from stored rows (ObjectView.tsx VIEW_ROW_STATE_KEYS, ViewTabBar visibility grouping). ADR-0005 addendum (c) records the opposite decision, and three pins guard it (objectql protocol-meta.test.ts 'preserves Studio-only auxiliary fields verbatim', and two GUARDs in metadata-protocol protocol.graft-folded-form-sections.test.ts). How should the persistence half proceed?",
"options": [
"A. Persist the parse output forviewas ruled. Prerequisites: (1) close the form-arm fall-through first, or it destroys rows; (2) declare every console round-trip key on each wire face (isPinned/sortOrder on the flattened overlays, visibility on the overlays and ViewItem rows; confirm objectName) or they are silently lost; (3) amend ADR-0005 addendum (c) (Tier H); (4) flip the three GUARD pins and align objectui. Cost: large and multi-surface. Gain: no undeclared top-level key reaches storage forview.",
"B. Keep the store as is (ADR-0005 (c) stands). After PR #20183 the door judgesoptions, so every storedoptionsbag is one the door judged and legal, and the finding's render path is closed. The residue is other undeclared top-level keys stored unread. Cost: none now. The wider invariant can be its own card later with A's prerequisites.",
"C. Graft the parsedoptionsonto the stored body (a third graft beside graftNormalizedOperators and graftFoldedFormSections). The storedoptionsthen equals its parse output and everything else stays verbatim. Cost: small. Gain: only defaults and transforms inside the kind blocks, which the door already judged."
],
"recommendation": "B, on the four axes. Real business need: measured, no reachable corpus holds a storedoptionsrow, and the door alone closes the render hole the card is about. Literal A would drop per-user state the console writes and reads back (pins, order, visibility) on the next save. Long-term soundness: B keeps ADR-0005 (c) and PD#12 (the door is where the contract bites); A is contract-first only once its four prerequisites land, and until then it is a data-loss change. Preventing AI authoring errors: A adds no loudness. It turns 'stored but unread' into 'silently dropped' on a 200, and only closing the members would be louder, which ADR-0005 and #4001 decline for wire round-trip keys. B and A both give the loud 422 foroptions.KINDjunk. Startup focus: B is already done; A spreads across spec, protocol, ADR and objectui. If the maintainer wants the invariant, file A as its own card with the prerequisites, the form-arm fix first."
},
{
"question": "Q2. The ruling saysoptions.KINDis 'judged by the kind's strict schema'. Should the kind's required keys apply to the legacy bag?",
"options": [
"Key by key (implemented): eachoptions.KINDis.partial()of the kind's strict block. The closed key set, the per-key schemas and the unknown-key message are kept; required keys are not asked of the underlay.",
"Whole block: the bag must satisfy the kind's full schema, required keys included. This is a one-line change in listViewKindBlocks."
],
"recommendation": "Key by key. objectui's ListView mergesoptions.KINDas a per-key underlay of the top-level block, with the top-level block winning, and objectui pins bags that carry only the keys the top-level block leaves to them. Measured: the whole block refused those, so 8 more census rows fail and all of them fail for missing keys, which is the 'breaks today's legacy writes' cost the ruling cited against C. Every out-of-contract key is still refused by name either way."
},
{
"question": "Q3. The claim line readsClause-②: nowith no arm, and the diff is an accept-set narrowing. Amend the claim line toClause-②: no (narrowing)?",
"options": [
"A. Amend it toClause-②: no (narrowing)in the claim, the PR body and the changeset (seat write).",
"B. Leave it. The changeset already declares breaking via the!summary and**BREAKING**, so check:adr-0087-registration judges it as breaking."
],
"recommendation": "A, because the arm is the declaration the gate reads without prose (#16421), and the precedent narrowing .changeset/17499-groupbyfield-non-padded.md carries it. The dev copied the claim verbatim and did not invent the arm."
}
],
"out_of_scope_findings": [
"class: a · reach: public door, PUT /api/v1/meta/view (saveMetaItem), gives a wrong 200. A flattened body with viewKind 'list' and nocolumnsand no listtypeis refused by the list overlay member and then ACCEPTED by the form overlay member (FormViewSchema.extend(flattenedViewOverlayFields()).strip(); the shared viewKind enum admits 'list'). Its list keys are stripped unjudged and the body is stored verbatim. The direct spellingtimeline.metaFieldson such a body is therefore accepted, not refused. · evidence: measured on 8d1f7ab. diagnoseViewMetadata({name,object,viewKind:'list',sort:[...]}) gives success with branch formOverlay and parse output {type:'simple', viewKind:'list', ...}. The same body with timeline {startDateField,titleField,metaFields} and no columns gives union success=true. saveMetaItem probe (stub engine): success=true for the sort/searchableFields body. If the parse output were ever persisted (Q1 option A), such rows would be destroyed. PR #20183 closes it only for bodies carryingoptions. · Seam: spec:VIEW_METADATA_MEMBERS.formOverlay (flattenedViewOverlayFields viewKind enum shared by both overlay arms) → runtime:saveMetaItem · dedupe words: 'form overlay accepts viewKind list' · 'column-less list overlay falls through to form arm' · 'flattened overlay viewKind arm mismatch' · 'view union form member list body'",
"carrier: the persistence decision on #20051 (Q1). ViewItemWireSchema (member 1, top-level .strip()) drops a record's top-leveloptionsunjudged, and saveMetaItem stores it verbatim. objectui mergeViewsIntoObjects reads only a record'sconfig(applyViewItem via viewItemBody), so no render reach was found. Noted, not filed (PR #20183 Acceptance notes)."
]
}
Generated by Claude Code
ACCEPT (door half) — PR #20183 at head
1c6a4eb17a·domain:specseat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T06:29ZSeat review against GitHub, not the report:
- Shape: draft, base
main, first linePart of #20051, and no closing keyword anywhere; docs(ai):toolmetadata has a reference and no guide — and the guide has to say when NOT to author one (ADR-0109) #10222 and [finding] Two PASSING@objectstack/runtimetests printAcquire connection errorand ~150 ERROR-levelsql-driver DATABASE_ERRORlines into the shared Test Core log — they were adopted verbatim as a p1 flake signature #10380 appear in prose only.Clause-②: nois line-leading. - Delivered:
- Ruling item 1 (
5824043998): eachoptions.KINDon the flattened list overlay is judged by that kind's strict block, and an out-of-contract key is refused by name with the direct spelling's code and message. - Ruling item 3: the census (objectstack 0 rows; objectui 28 bag literals, 12 failing, each by a named key). Production
sys_metadatarows: NOT MEASURED. - The legacy
options.mappin stays accepted.
- Ruling item 1 (
- File surface amendment to claim
5852017412(recorded here, ⛔ not a second claim):packages/spec/src/migrations/(the ADR-0087 D3 entryview-overlay-options-bag-judgedplus its regenerated region);docs/audits/2026-07-unknown-key-strictness-ledger.counts.md(regenerated, +1 strict site);packages/rest/src/meta-view-overlay-options-bag.test.ts(the consumer test the order asked for);- the form overlay's
optionspin inview.zod.ts, which closes a fall-through the change would otherwise open.
- Q2 (key by key vs whole block): accepted as implemented, key by key. The ruling's own rationale rejected C because it 「breaks today's legacy writes without a census」. The whole-block reading measured 8 more failing rows, all for missing required keys, while every out-of-contract key is refused by name either way. This is recorded here for the maintainer's veto; a switch is a one-line change.
- Q3 (Clause-② arm): no amendment. A narrowing need not declare
yes, and the changeset's!and**BREAKING**banner already carry the break tocheck-adr-0087-registration. - Next: at-tier contract review (clause-② path limb).
needs:contract-reviewgoes on the PR in this act.
Out-of-scope findings: the form overlay accepting a
viewKind: 'list'body → filed #20186.ViewItemWireSchemadropping a top-leveloptionsunjudged → rides the persistence decision below (no render reach found).
待维护者裁决:持久化那一半(裁决 A 第 2 条「保存时存解析后的结果」)的前提被证伪
一句话问题:裁决 A 要求保存视图时存「校验后的结果」;实测这样做会在每次保存时悄悄删掉控制台自己写进去、之后又读回来的状态(置顶、排序位置、可见性),而 ADR-0005 附录 (c) 当初正是为保住这些字段才规定「存原始请求体」。
Governing text:ADR-0005 附录 (c) 原文 「The persisted document is the original
request.item, NOTparsed.data. Studio attaches auxiliary fields (isPinned,isDefault,sortOrder,objectName, …) that aren't in the canonical schema; storingparsed.datawould silently strip them on every save.」(git grep -n "The persisted document is the" origin/main -- docs/adr/0005-metadata-customization-overlay.md);裁决 A(objectui#103805824043998,维护者 「其他同意」)。两者方向相反。前提(带 re-check):dev 在
8d1f7ab经真实saveMetaItem测得,存解析结果会剥掉平铺覆盖体的isPinned/sortOrder、ViewItem 行的visibility、个性化 PUT 的sort[].id/filter[].id,并把exportOptions ['csv']改写成对象、补出默认值;objectui 从存储行读回isPinned/sortOrder/visibility(ObjectView.tsxVIEW_ROW_STATE_KEYS、ViewTabBar)。守护「原样保存」的 pin:git grep -n "preserves Studio-only auxiliary fields verbatim" origin/main -- packages/objectql与git grep -n "GUARD: Studio-only round-trip keys" origin/main -- packages/metadata-protocol。选项 做什么 客户能感到的后果 甲(A) 照裁决存解析结果 先修 #20186(表单分支吞下列表视图);把控制台回读的每个键在契约上声明;修订 ADR-0005 (c)(受管,需你批);翻转三条 GUARD pin 并让 objectui 对齐;最后才改存储 存储里的每个键都有契约、都被校验;代价大、跨 spec / 协议 / ADR / objectui 四处 乙(B) 维持原样存储 ADR-0005 (c) 不动;PR #20183 已让门口校验 options,渲染漏洞已堵零改动;残留:其它未声明的顶层键仍会被原样存下、无人读取 丙(C) 只把解析后的 options回填进存储体在现有两个 graft 旁加第三个 改动小;收益仅限 options内部的默认值与改写,门口已判过它业务直译:甲 = 「表单上每一格都要有定义,没定义的不许存」;乙 = 「表单收件时检查,但存档时连同便签一起原样归档」;丙 = 「只把其中一张表按标准格式重抄一遍再归档」。
四轴(业务立场)
- 长远合理性:两年后的平台应当是「存储即契约」——主流做法(Salesforce Metadata API 只存已声明字段,Hasura 应用 metadata 前先校验成形)都不存未声明的键;控制台要保存的界面状态应当是契约里声明过的键,而不是靠「原样存」的例外活着。甲是这个终态;乙把例外永久化;丙是半量。
- 实际业务拉动:今天无可达语料存有顶层
options行(objectstack 0 行;生产行未测);门口半已堵住卡面的渲染漏洞。拉动只决定甲的时序,不改方向。 - 防 AI 犯错:出错时谁看到什么——乙下,AI 写一个未声明的顶层键会收到 200、被原样存下、没人读(静默);甲在前置齐备后会对未声明键响亮拒绝;照裁决字面直接改存储(不做前置)则把「存下没人读」变成「200 后静默丢掉用户状态」,更糟。
- 创业阶段不扩散:乙零成本;甲是四处改动,应按「先 spec(ui): a flattened
viewKind: 'list'view overlay with nocolumnsis refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 → 声明回读键 → 修 ADR → 改存储」分期,而不是一次铺开。
os-decision-facets
① 项目长远合理性:甲收敛到「存储即契约」,消掉 ADR-0005 (c) 这一永久特例;乙保留特例;丙新增一个 graft 特例。
② 实际业务拉动:今天无人撞上(存量options行 0,生产未测);门口半已堵住渲染漏洞 ⇒ 甲可排后,不必现在做。
③ 防 AI 犯错:甲(前置齐备后)对未声明键响亮拒绝;乙对未声明键静默存下;照字面直接改存储会在 200 后静默丢状态,最差。
④ 创业阶段不扩散:甲需声明一批界面状态键(永久义务)并改 ADR;乙零新增;丙新增一个 graft。
Prior rulings read: persist parsed body,request.item,auxiliary fields,ispinned,overlay save,savemetaitem → 2 hits; ADR-0005 Decision §10, ADR-0094 D2; thread: none; repo: objectstack-ai/objectstack推荐:甲(分期执行);回退:乙。只看①选 甲;②③④ 是否翻转:否(② 只把甲排到 #20186 之后、按需开工,④ 只决定分四步走,都不改字母)。
置信缺口:生产sys_metadata里带未声明顶层键的视图行数未测;objectui 回读键的完整清单只测到isPinned/sortOrder/visibility/objectName,可能还有别的。裁后执行:
- 甲:本卡在门口半落地时转
needs-user-decision→ 按你的字母;甲则本席拆出「声明控制台回读键 + ADR-0005 (c) 修订」子卡(ADR 部分为 Tier H、等你批),排在 spec(ui): a flattenedviewKind: 'list'view overlay with nocolumnsis refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 之后,最后一张改存储并翻 GUARD pin。 - 乙:门口半落地即关本卡(completed),在 ADR-0005 (c) 旁不做改动;objectui#10380 解锁。
- 丙:派一轮小改动加第三个 graft,再关卡。
The card state moves
pm:dispatched→needs-user-decisionin the same stroke as the door half's landing, with this comment as the analysis.- Shape: draft, base
os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (mode:subagent, the PM's session; identity = the branch)",
"premise_still_valid": true,
"summary": "Merge-only round done. I merged origin/main 560b724 into the branch with os-regen-merge.sh and pushed a fast-forward, 1c6a4eb..69c7f31: merge commit 01e3c86 plus regeneration commit 69c7f31. No rebase, no amend, no force-push, and no edit to view.zod.ts, the tests, the entry file or the changeset. The one conflict, registry.ts, was measured before resolving. This PR's only hunk (41 lines) sits inside the os-generated semantic:18 region, and outside the generated regions its side is byte-equal to the merge base 8d1f7ab. So I took main's side, which keeps main's hand-written step18 rationale and its conversion id page-component-filter-record-to-rule-array, then regenerated the region from the merged entries/ with gen:migration-registry. That restored this PR's 41 lines byte-identical. WARNING: the PR is DIRTY again. origin/main moved after the merge (4db1bf1 #20194, 172b4cf #20199, 0bd1126 #20195), and GitHub reads mergeable=false / mergeable_state=dirty on head 69c7f31. A driver-free probe against 0bd1126 conflicts in exactly docs/audits/2026-07-unknown-key-strictness-ledger.counts.md; registry.ts merges clean there. A second merge is outside this round's ONE-merge scope, so I did not make it; see open_questions.",
"tests": "All at head 69c7f31. (1) Spec build under os-verify-lock: VERDICT command-exit 0, held 252s. git status was clean afterwards, so the build's gen:schema moved no tracked file. (2) pnpm --filter @objectstack/spec check:generated: EXIT 0, 'All 15 generated artifacts are up to date', read against a dist built in this worktree (declaration stamp 9f988cacaaf1 match). (3) check:authorable-surface: EXIT 0, 'Successfully generated 1549 schemas'. Its only other line is the informational 'authorable-surface.base.json trails the baseline at 560b724'; the anchor was not touched. (4) check:migration-registry: EXIT 0, 'src/migrations/registry.ts is current (253 semantic, 210 retired-key, 183 retired-def)', read both before the regeneration commit and at head. (5) Targeted tests, one locked run, VERDICT command-exit 0. spec: vitest run of src/ui/view-overlay-options-bag.test.ts, src/migrations/migrations.test.ts, src/migrations/retired-tables-not-floor-scoped.test.ts and src/migrations/spec-changes-surface-scope.test.ts gave 'Test Files 4 passed (4) / Tests 170 passed (170)'. metadata-protocol: src/protocol.graft-folded-form-sections.test.ts gave 'Test Files 1 passed (1) / Tests 19 passed (19)', matching the 19 declared. rest: src/meta-view-overlay-options-bag.test.ts gave 'Test Files 1 passed (1) / Tests 2 passed (2)', matching the 2 declared. The dependency closure for the last two suites (24 packages, spec excluded because it was already built) was built JS-only with OS_SKIP_DTS=1, exit 0. (6) pnpm check:nul-bytes: EXIT 0. (7) node scripts/check-adr-0087-registration.mjs --base 560b724: EXIT 0, 'registered view-overlay-options-bag-judged'. No ablation this round: merge only, no code change.",
"gates": [
"spec build (os-verify-lock): command-exit 0 @ 69c7f31",
"@objectstack/spec check:generated: EXIT 0, 15/15 current @ 69c7f31",
"@objectstack/spec check:authorable-surface: EXIT 0 @ 69c7f31",
"@objectstack/spec check:migration-registry: EXIT 0 @ 69c7f31",
"tests: spec 4 files/170, metadata-protocol 1/19, rest 1/2, all passed @ 69c7f31",
"check:nul-bytes: EXIT 0 @ 69c7f31",
"check-adr-0087-registration --base 560b724: EXIT 0 @ 69c7f31",
"registration presence: a quoted-exact git grep -F -c for the literal id line of each id in packages/spec/src/migrations/registry.ts, on the tree committed as 69c7f31, found each id exactly once. This PR's id: 'view-overlay-options-bag-judged'. Main's ids since the fork: 'cel-predicate-list-comparand-refused', 'cel-predicate-variable-root-comparand-refused', 'element-data-source-and-object-block-filter-rule-array', 'field-predicate-reference-traversal-refused', 'manifest-id-reverse-domain-required', 'object-grid-default-filters-rule-array', 'rls-check-on-select-or-delete-policy-refused', 'rls-predicate-array-comparand-refused', 'ui-report-joined-container-selection-refused', 'view-pagination-page-size-default-50'. The hand-written conversion id 'page-component-filter-record-to-rule-array' (from #20175) is at registry.ts:5329",
"GitHub mergeability after push: mergeable=false, mergeable_state=dirty (main moved; see open_questions)",
"CI on 69c7f31: not awaited (in_progress at report time; convergence is the seat's)"
],
"line_budget": "n/a",
"deviations": [
"Two commits, not one. The dispatch says 'push ONE merge commit'. os-regen-merge.sh, whose step order the dispatch makes authoritative, prescribes for this class-3 conflict: 'take either side to reach a committable state, commit the merge (step 3), then run its generator and commit that as its own commit'. The branch therefore carries ONE merge commit (01e3c86) and ONE regeneration commit (69c7f31), and the latter adds only this PR's 41 regenerated lines. I am reporting this conflict between the dispatch wording and the script, not choosing between them silently.",
"The worktree objectstack-issue-20051 did not exist. I recreated it on the existing local branch at the remote head 1c6a4eb (BASE); no claim was posted.",
"Driver-free probe: git clone --bare --shared refuses its local optimisation on this shallow clone and copied branch heads only, so the objects were missing. I built the equivalent by hand: a bare init with no merge driver, alternates pointing at the shared object store, and the shallow file copied. Merge-base 8d1f7ab resolved, and there was no merge.os-regen.driver in local or global config.",
"Verify lock: three foreground attempts with OS_VERIFY_LOCK_WAIT=300 (lowered so wait plus build fits the 10-minute cap) each ended at exit 99 / queue-timeout: NOT MEASURED, not red. After that I ran the locked build, and later the locked tests, as a background os-verify-lock wrapper under a stable slot with its PID recorded. I awaited each with one foreground 'tail --pid'. Both wrappers have exited, and nothing outlives the run.",
"Declared narrowing: locally I ran only the dispatch-named families plus the implicated ones (check:generated's 15 artifact gates, check-adr-0087-registration, check:nul-bytes). The remaining families that dispatch-gates.mjs --commands lists for the 8-file PR delta belong to CI. The test closure was built JS-only (OS_SKIP_DTS=1), and typecheck was not run locally; it is declared to CI.",
"check-adr-0087-registration took --base 560b724, the main actually merged, and not the moving origin/main, which had already advanced to 172b4cf and would have charged main's newer commits to this branch."
],
"files_changed": {
"new_head": "69c7f3100c72d9e86c5a94faa19b87f1663fa131",
"commits": [
"01e3c860c9 Merge origin/main (560b724); parents 1c6a4eb and 560b724; registry.ts resolved to main's blob d5f34bcc9a",
"69c7f3100c chore(spec): regenerate the migration registry on the merged entries; 1 file, +41"
],
"old_head_to_new_head": "131 files changed, +9720 / -647",
"from_main": "131 files, exactly the file set of 8d1f7ab..560b724 (0 extra, 0 missing). 129 are main-only and equal to main. view.zod.ts is +6/-1, main's delta auto-merged. registry.ts is +343/-32, identical to main's own registry.ts delta since the fork (+343/-32)",
"regenerated": "1 file: packages/spec/src/migrations/registry.ts. Merge to head is +41 / -0, byte-identical to the PR's pre-merge hunk (cmp exit 0). The text outside the generated regions is byte-equal to main's (cmp exit 0)",
"anything_else": "0 files",
"branch_delta_vs_merged_main": "The same 8 files as before the merge. Each hunk body hashes identical to its pre-merge delta. Six are identical blobs; view.zod.ts and registry.ts moved only by main's side"
},
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/20051/comments (this os-dev-report), through scripts/pm/post-stamped.mjs on its resolved route: transport dispatch, i.e. the fleet-write relay (one repository_dispatch whose workflow posts as objectstack-fleet[bot]). git push x1 went through write-pace --run (not a REST write). 0 label writes, 0 PR-body writes, 0 pr_create. Read-only REST GETs: PR #20183, issue comment 5853809566, #20051 comments.",
"open_questions": [
{
"question": "origin/main moved after this round's merge, and PR #20183 is DIRTY again (GitHub: mergeable=false). A driver-free merge-tree of 0bd1126 against 69c7f31 conflicts in exactly one path: docs/audits/2026-07-unknown-key-strictness-ledger.counts.md, a merge=os-regen generated counts file. This PR's +1 strict ui/ site (view.zod.ts 61 to 62, total 453 to 454) meets #20194's -1 automation/ strip site (execution.zod.ts 13 to 12, total 453 to 452) on the same total rows. registry.ts merges clean. Should a second merge be taken?",
"options": [
"A: one more merge-only round now. os-regen-merge.sh lets the driver defer the counts file, step 2 takes main's side (both sides edited it), and step 4 regenerates it (check:generated --fix, check:strictness-ledger). The merged totals are to be measured then, not assumed from the two deltas.",
"B: hold until main settles, then take the merge together with the at-tier review on the final head."
],
"recommendation": "A. The conflict is in a generated counts file only, and its resolution is fully mechanical by the same script. Each hour of waiting on the hot spec tree invites another collision. The fresh at-tier record the kick-out comment requires should be taken on the head after that merge, not on 69c7f31."
}
],
"out_of_scope_findings": []
}
Generated by Claude Code
os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (mode:subagent, the PM's session; identity = the branch)",
"premise_still_valid": true,
"summary": "Second merge-only round (ruling A), done. I re-fetched main (still 0bd1126 at merge time), merged it with os-regen-merge.sh, and pushed a fast-forward, 69c7f31..2526e40: merge commit b48c0b5 (parents 69c7f31 and 0bd1126) plus regeneration commit 2526e40. No rebase, amend or force-push; no ready, auto-merge or label action; none of the PR's own content changed. As predicted, the only GitHub-side conflict was docs/audits/2026-07-unknown-key-strictness-ledger.counts.md. Locally the os-regen driver deferred it and silently kept the branch's side (blob 20cf62a2d0, total 454). Step 2 took main's side (70b6d05f51, total 452). The step-3 commit was refused by pre-commit as stale, which the script calls its designed collection point. gen:strictness-ledger then re-derived the file from the merged AST, and the MEASURED merged totals are 453 sites / 323 strict / 125 strip: main's 452/322/125 plus this PR's one strict ui/ site (view.zod.ts 61 to 62). I did not hand-edit any count. registry.ts text-merged cleanly this time and check:migration-registry confirms it is current (255 semantic, 196 retired-def). Its delta against main is still exactly this PR's 41 lines. After the push, GitHub's single mergeability read returned mergeable=null / mergeable_state=unknown, meaning not yet computed, so it is NOT MEASURED. main has since moved to 1c8b320 (#20191, #20187), and a driver-free merge-tree of that tip against 2526e40 merges CLEAN (exit 0); neither new commit touches any file in the PR delta. So the PR is not dirty.",
"tests": "All at head 2526e40. One locked run: VERDICT command-exit 0, held 399s. Inside it: spec build exit 0 (git status clean afterwards); spec vitest run of src/ui/view-overlay-options-bag.test.ts plus the three src/migrations tests (migrations, retired-tables-not-floor-scoped, spec-changes-surface-scope) gave 'Test Files 4 passed (4) / Tests 170 passed (170)'; the closure for the next two suites was built JS-only with OS_SKIP_DTS=1, exit 0; metadata-protocol src/protocol.graft-folded-form-sections.test.ts gave 'Test Files 1 passed (1) / Tests 19 passed (19)'; rest src/meta-view-overlay-options-bag.test.ts gave 'Test Files 1 passed (1) / Tests 2 passed (2)'. Unlocked gates on that built tree: check:generated EXIT 0, 'All 15 generated artifacts are up to date' (declaration stamp 979178fb9da0 match); check:authorable-surface EXIT 0, 'Successfully generated 1536 schemas', plus the informational 'base.json trails the baseline at 0bd1126' (anchor untouched); check:strictness-ledger EXIT 0, '...counts.md is current — 453 site(s) measured'; check:migration-registry EXIT 0, 'registry.ts is current (255 semantic, 210 retired-key, 196 retired-def)'; check:nul-bytes EXIT 0; check-adr-0087-registration --base 0bd1126 EXIT 0, 'registered view-overlay-options-bag-judged'. No ablation: merge only.",
"gates": [
"spec build (os-verify-lock): exit 0 @ 2526e40",
"@objectstack/spec check:generated: EXIT 0, 15/15 current @ 2526e40",
"@objectstack/spec check:strictness-ledger: EXIT 0, counts current at 453 sites @ 2526e40",
"@objectstack/spec check:authorable-surface: EXIT 0 @ 2526e40",
"@objectstack/spec check:migration-registry: EXIT 0 (255 semantic, 210 retired-key, 196 retired-def) @ 2526e40",
"tests: spec 4 files/170, metadata-protocol 1/19, rest 1/2, all passed @ 2526e40",
"check:nul-bytes: EXIT 0 @ 2526e40",
"check-adr-0087-registration --base 0bd1126: EXIT 0 @ 2526e40",
"registration presence (git grep -F -c on the committed tree 2526e40, packages/spec/src/migrations/registry.ts): all 26 present, each exactly once, 0 missing. This PR's 'view-overlay-options-bag-judged'. Main since the fork 8d1f7ab, 12 semantic ids: 'cel-predicate-list-comparand-refused', 'cel-predicate-variable-root-comparand-refused', 'element-data-source-and-object-block-filter-rule-array', 'export-job-family-retired', 'field-predicate-reference-traversal-refused', 'manifest-id-reverse-domain-required', 'object-grid-default-filters-rule-array', 'rls-check-on-select-or-delete-policy-refused', 'rls-predicate-array-comparand-refused', 'turso-config-transport-mismatch-refused', 'ui-report-joined-container-selection-refused', 'view-pagination-page-size-default-50'. Main's 13 retired-def entries: 'api/CreateExportJobRequest', 'api/CreateExportJobResponse', 'api/ExportJobProgress', 'api/ExportJobStatus', 'api/ExportJobSummary', 'api/GetExportJobDownloadRequest', 'api/GetExportJobDownloadResponse', 'api/ListExportJobsRequest', 'api/ListExportJobsResponse', 'api/ScheduleExportRequest', 'api/ScheduleExportResponse', 'api/ScheduledExport', 'automation/ScheduleState'. Main changed 0 retired-key entries. The hand-written conversion id 'page-component-filter-record-to-rule-array' is at registry.ts:5329",
"GitHub mergeability, one read after the push: mergeable=null, mergeable_state=unknown (not yet computed): NOT MEASURED",
"driver-free merge-tree of main 1c8b320 against 2526e40: exit 0, clean",
"CI on 2526e40: not awaited (convergence is the seat's)"
],
"line_budget": "n/a",
"deviations": [
"The merge commit b48c0b5 carries git's default message ('Merge remote-tracking branch ...') and no Claude-Session trailer pair. os-regen-merge.sh step 1 runs 'git merge --no-edit', which auto-commits, and the fence forbids amending. The pre-push trailer check passed on both commits.",
"The worktree was recreated at 69c7f31 for this round (it was removed after round 1), and removed again after the push. No claim was posted.",
"The presence grep's first pass extracted an empty id from the 13 retired-def files, which carry 'export const entry' and no 'id:'. An empty pattern matches every line, so those 13 rows read n=20250 and were INVALID, not a pass. I re-ran them with the entry value, and each came back n=1.",
"GitHub mergeability was read once, as ordered, and answered null/unknown. I did not poll it again. The substantive answer is the driver-free merge-tree against the current main tip, which runs GitHub's own no-driver condition.",
"Declared narrowing, as in round 1: only the dispatch-named gates plus check:strictness-ledger, check:nul-bytes and the ADR-0087 check ran locally. Typecheck and the other dispatch-gates families are declared to CI, and the test closure was built JS-only."
],
"files_changed": {
"new_head": "2526e4052e742ee2f2d9a6a93c2e653efb093e1f",
"commits": [
"b48c0b5b55 merge of origin/main 0bd1126; parents 69c7f31 and 0bd1126; auto-committed by the script's step 1",
"2526e4052e chore(spec): regenerate the strictness-ledger counts on the merged tree; 1 file, +12/-12"
],
"old_head_to_new_head": "65 files changed, +2266 / -2108",
"from_main": "65 files, exactly the file set of 560b724..0bd1126 (0 extra, 0 missing). 63 are main-only and equal to main. registry.ts is +260/-0, identical to main's own delta (+260). The counts file is +12/-12 overall",
"regenerated": "1 file: docs/audits/2026-07-unknown-key-strictness-ledger.counts.md, +12/-12 in 2526e40. It restores main's side (automation/ 68 to 67, api/ 454 to 435, totals 454/126 to 453/125) that the driver had dropped from the merge commit, while keeping the PR's +1 ui/ site. registry.ts needed no regeneration: it text-merged, check:migration-registry says it is current, and its delta vs main equals the PR's 41-line hunk (cmp exit 0)",
"anything_else": "0 files",
"branch_delta_vs_merged_main": "The same 8 files. Six are identical blobs and registry.ts has an identical delta. The counts file's delta vs main carries the same +1 ui/ site, and differs only in 2 absolute total lines that now include main's -1 strip site (453 vs 454, 125 vs 126)"
},
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/20051/comments (this os-dev-report), through scripts/pm/post-stamped.mjs via the fleet-write relay (transport dispatch). git push x1 through write-pace --run. 0 label, 0 PR-body, 0 ready or auto-merge writes. Read-only REST GETs: #20051 comments (claim re-check) and PR #20183 (one mergeability read).",
"open_questions": [],
"out_of_scope_findings": []
}
Generated by Claude Code
Queue kick-out record for this card's PR #20183 (
Part of #20051) ·domain:specseat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T10:17ZThe queue build
36310592557failed with a new signature:packages/client/src/auth-login-register-envelope.test.ts›register() parses as the declared envelope, with the payload under data›Test timed out in 5000ms. It is a timeout in a package this PR does not touch. The full signature, the three-fact reading and the initial reading are on the PR: comment5854946276.⛔ No re-queue on sight. A read-only diagnosis (base vs base+PR, 8 runs each) decides whether the PR is implicated. This card's state is unchanged (
pm:dispatched). The transition toneeds-user-decision(decision analysis5853397704) still waits for the door half to merge.40 remaining items
Claim: PM loop round 1 (stage (iv) under ruling B; re-claim after
5909486308's release) · 2026-09-30T11:28Z
Session:session_018fxqvRJW12TaHC7DUQ89Y6
Account:os-warren(the seat's linked user asGET /useranswers it; the card's assignee from this act)
Branch:claude/issue-20051-persist-parsed-view-body(reused, as the ruling allows; empty at15b586dc)
Worktree:objectstack-issue-20051
Domain:domain:spec
Seat:domain:spec#1(seat post #6017)
File surface: the view branch ofsaveMetaIteminpackages/metadata-protocol/src/protocol.ts(one projection replacing the operator-rewrite and groups→sections grafts);ViewItemWireSchematop-leveloptionsrefused by name inpackages/spec/src/ui/view.zod.ts; the verbatim-save pins and the W1–W5 / form-default pins (metadata-protocol/src/protocol.graft-*.test.ts,protocol.runtime-authoring-gate.test.ts,packages/objectql/src/protocol-meta.test.ts); the "ADR-0005 §Validation" citations inprotocol.tsre-anchored, plus the existingscripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json; one.changeset/20051-*.md(minor, BREAKING, ADR-0087 disposition). ⛔ Nodocs/adr/**edit (a separate Tier H docs PR). Stop on breach; explain in the report.
Container & model:M,mode:subagent,model: opus(as claim5909135345; ruling implementation with design judgment ⇒ default tier). The same dev resumes, holding its measurements.
Clause-②: no
Thread-read: 5910106571
Ruling-ref: 5856781584 (甲); 5909085121 (the maintainer's 「20051 不考虑现有的数据」); 5910106571 (Q2 = B; Q1 = A, Q3 = A)
Serial constraints cleared: atorigin/main1741c5dcb, no open PR touchesmetadata-protocol/src/protocol.ts,ui/view.zod.ts, theprotocol.graft-*tests,protocol-meta.test.tsorscripts/adr-anchors/. PR #20823 touches two othermetadata-protocoltest files. The cross-lane note to the engine seat stands (5909185560).The ADR-0005 appendix (c) wording (
parsed.data) and its two "not yet in force" markers change in a separate Tier H docs PR, which the seat files once this lands.- added a commit that references this issue
on Sep 30, 2026 os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-persist-parsed-view-body",
"pr": "#20868",
"session": "session_018fxqvRJW12TaHC7DUQ89Y6 (mode:subagent, the PM's session; identity = the branch named by re-claim 5910252155, verified as the newest Claim on the card)",
"premise_still_valid": true,
"summary": "Stage (iv) implemented under ruling 5910106571 (Q2 = B, Q1 = A, Q3 = A), draft PR #20868 at head 4191327, first lineFixes #20051. Forviewonly,saveMetaItemnow storesprojectStorableViewBody: the parsed value of every key the body carried. Undeclared keys are dropped and schema defaults are not materialised. Moved keys are found by re-parse evidence, not a list: a key the parse added is kept only when a re-parse of the body without it does not reproduce it. The loop ends when the stored body re-parses to exactly the save's parse. If it does not converge, the fallback storesparsed.data, logs a once-per-view warn, and loses no key. A ViewItem record's top-leveloptionsis pinned absent on both wire arms (z.never, soViewItemWire.jsonstill publishes) and answers 422 with theconfig.KINDprescription; the ADR-0087 disposition isregistered view-item-options-bag-refused. Zone 2 readings: (1) the gate issingularType === 'view', as for flow, and a page save is pinned verbatim as the control. (2) The projection subsumes both grafts for views; the grafts are kept for other types, becauseViewFilterRuleSchemais reused by page, component and skill, andFormViewSchemaby component, sharing and field. (3) Nested defaults are not stored: W1-W5 store notype, forms store nosharing.enabledor section defaults, and avisibleOnnested insidegroupsis stored assections[].visibleWhen. (4) All five protocol.ts citations, plus the one in view.zod.ts, re-anchored to 'ADR-0005 appendix (c), the Addendum — 2026-05-16 (c)'; the anchor JSON gains ADR-0005 and ADR-0087. Docs PR (Tier H, the seat's) must change three ADR-0005 passages: (a) in the Status line, 'and the storage switch itself is the ruling's last stage, not yet landed — see the amendment note under that addendum's persisted-document bullet'; (b) in appendix (c), '⚠️ Ruled, not yet in force: the storage switch is the ruling's last stage and has not landed, so todaysaveMetaItemstill stores the request body (request.item).'; (c) appendix (c)'s bullet 'The persisted document is the parsed body (parsed.data) once every round-trip key is declared', which letter B turns into 'the parsed value of every key the body carried, no default materialised'. One measured fact decides against letter A:parsed.dataof a toolbar patch carriestype: 'grid'and nocolumns, so a stored patch would fail its own re-save (ablation 2).",
"tests": "At head 4191327, all under os-verify-lock. metadata-protocol full: 191 files, 2819 passed, 19 skipped. objectql full: 345 files, 6778 passed. rest full: 237 files, 4641 passed, 99 skipped. spec--project localsrc/ui + src/migrations: 97 files, 3560 passed; the whole local project also ran before the origin/main merge (192 + 578 files, green after the population pin was re-judged). runtime, the 19 files that save or read a view: 990 passed. Typecheck, exit 0 for each of spec (tsc + check:scripts-typecheck + check:test-typecheck), metadata-protocol, objectql and lint. Before the re-judge, the full sweep found exactly 7 red pins, all re-judged in one round: 3 in metadata-protocol graft-folded, 3 in objectql (protocol-meta:586, protocol-publish-rollback diff, protocol-view-identity-overlay sort id) and 1 in spec (view-union-retirement-prescription §2). Ablation 1 (committed first; the view branch renamed to 'view__ablated' and the record refusal renamed to '_ablated_options', through scripts/ablation-replace.mjs with a trap restore; spec and metadata-protocol dist rebuilt; ablation-dist-preflight markers present in 10 and 2 built files): graft-folded file 9 red, 40 green; objectql three files 3 red, 114 green; spec two files 4 red, 37 green (one red is the §2 retirement text reading the renamed leaf, an artifact of the mutation shape). Restore: 'blob == HEAD' for both files, markers absent from both dist/ after rebuild, andgit status --porcelainempty. Ablation 2 (request.item = parsed.data, src only): graft-folded file 20 red, 29 green, with all five toolbar pins, the form-default pin and the parse-equivalence pin among the reds; restored to the HEAD blob. Pre-change measurement of the console's writes at the pin (probe through the real save, stub engine) is on the card, report 5909437934.",
"gates": [
"node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 4191327: 125 derived; each run with its exit code captured before any pipe",
"123 exit 0. Two are re-runs after a prerequisite: node scripts/check-engine-split-ratio.mjs --days 90 (first exit 2, shallow-clone refusal; exit 0 after git fetch --shallow-since=2026-06-25) and pnpm --filter @objectstack/spec run check:skill-examples (first exit 3, client-react dist stale; exit 0 after building client-react)",
"NOT MEASURED: pnpm check:dual-build-cjs-loads (exit 3, PREREQUISITE NOT MET: whole-repo dist) and pnpm check:type-check-debt (exit 3, PREREQUISITE NOT MET: whole-repo build). Both are declared to CI",
"dispatch-gates --ran: '125 derived famil(ies) accounted for — 123 run, 2 NOT-MEASURED', 0 UNRUN",
"pnpm --filter @objectstack/spec check:generated: EXIT 0, 'All 15 generated artifacts are up to date' (content/docs/references/ui/view.mdx regenerated by --fix before that)",
"node scripts/check-adr-0087-registration.mjs --base 1741c5d: EXIT 0, 'registered view-item-options-bag-refused (new here)'",
"eslint, narrowed to the 15 changed .ts files: each resolves under --print-config; --no-inline-config --format json gives 15 files, 0 errors, 0 warnings; eslint.config.mjs enables no type-aware linting (its comment at :328), so no untouched file's verdict can move"
],
"line_budget": "n/a",
"deviations": [
"Clause-② spelling conflict, named rather than chosen silently. The PR body carriesClause-②: no, copied from the claim as the dispatch's card clause says. The changeset carriesClause-②: no (narrowing), which is how ruling 甲 item 4 (restated in this dispatch's Zone 1) spells the changeset. check-adr-0087-registration reads the changeset as BREAKING+bang+clause-②-narrowing.",
"The projection finds moved keys by re-parse evidence (one extra parse per save, more only when a key moved), not by a named key-move list. It is one projection that replaces both grafts for views, and it also coversvisibleOn→visibleWhen, which neither graft did.",
"The ViewItem wire'soptionsusesz.never(), not the form overlay'sz.undefined(): withz.undefined()the spec build refused because ViewItemWire.json disappeared. As a result, view-union-retirement-prescription.test.ts §2 (every non-catchall never leaf says 'was removed') was re-judged to admit a closed two-entry pinned-absent family, each entry reached and each matching its curated text.",
"File surface beyond the claim line. (1) packages/spec/src/migrations/entries/semantic/18.view-item-options-bag-refused.ts plus the regenerated registry.ts region: the ADR-0087 registration for the Q3 narrowing, following the door-half precedent. (2) content/docs/references/ui/view.mdx, regenerated. (3) Spec tests: view-overlay-options-bag (the record pins), view-union-retirement-prescription (the re-judge) and the view-console-round-trip-keys header. (4) objectql protocol-publish-rollback and protocol-view-identity-overlay, pins the sweep found. (5) Comment-only fixes in metadata-protocol read-decorations, graft-normalized-operators and runtime-authoring-gate tests and in lint runtime-gate.view-writes.test.ts, where the text stated a verbatim view save.",
"A JS-only closure build (OS_SKIP_DTS=1) removed the .d.ts files from already-built packages. Every package was rebuilt with declarations before any typecheck ran, and nothing was committed from that state.",
"One single-file spec vitest run (view-overlay-options-bag.test.ts, 25 passed) ran outside os-verify-lock. It was re-run under the lock.",
"Merged origin/main 660a9b2 with scripts/pm/os-regen-merge.sh: merge commit 4191327, no conflicts, no artifact regeneration needed (check:generated green). The shared .git was deepened withfetch --shallow-since=2026-06-25for the engine-split gate.",
"packages/qa/dogfood: 0 hits for a view save or read (grep of test/ and src/), so no reading is owed there."
],
"files_changed": [
".changeset/20051-persist-parsed-view-body.md",
"content/docs/references/ui/view.mdx",
"packages/lint/src/runtime-gate.view-writes.test.ts",
"packages/metadata-protocol/src/protocol.graft-folded-form-sections.test.ts",
"packages/metadata-protocol/src/protocol.graft-normalized-operators.test.ts",
"packages/metadata-protocol/src/protocol.read-decorations.test.ts",
"packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts",
"packages/metadata-protocol/src/protocol.ts",
"packages/objectql/src/protocol-meta.test.ts",
"packages/objectql/src/protocol-publish-rollback.test.ts",
"packages/objectql/src/protocol-view-identity-overlay.test.ts",
"packages/spec/src/migrations/entries/semantic/18.view-item-options-bag-refused.ts",
"packages/spec/src/migrations/registry.ts",
"packages/spec/src/ui/view-console-round-trip-keys.test.ts",
"packages/spec/src/ui/view-overlay-options-bag.test.ts",
"packages/spec/src/ui/view-union-retirement-prescription.test.ts",
"packages/spec/src/ui/view.zod.ts",
"scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json"
],
"mcp_calls": "0",
"api_writes": "3 REST writes, all through scripts/pm on the fleet-write relay (transport dispatch). Each is one POST /repos/objectstack-ai/objectstack/dispatches, which the relay executes as objectstack-fleet[bot]: (1) pr_create, executed as POST /repos/objectstack-ai/objectstack/pulls, gave PR #20868 (draft; 9923 bytes sent, 9923 stored, identical); (2) label-write --assign os-warren, executed as POST /repos//issues/20868/assignees, read back as MATCHES; (3) this os-dev-report, executed as POST /repos//issues/20051/comments. git push x11 to the branch (not REST). Reads: the card's comments, PR #20868.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: 承接者:无 · the projection is view-only by ruling, and every other typegetMetadataTypeSchemaregisters (dashboard, page, app, report and the rest, not only view and dashboard) still stores its request body with the two grafts. Widening is its own decision · evidence: packages/spec/src/kernel/metadata-type-schemas.ts:90-281; the page control pin in protocol.graft-folded-form-sections.test.ts · noted in PR #20868 Acceptance notes, not filed",
"carrier: objectui#11013 · objectui's adapterlistViewsflatten keeps only config plus name/label/isDefault of a ViewItem record, so the saved-view toolbar toggle (which writes the whole tab back) rewrites the row without isPinned/sortOrder/visibility/columnState. The drop is present today and independent of this PR · evidence: data-objectstack/src/index.ts:5500-5508 at db11afd4967c; code read only, NOT MEASURED in a browser · noted in PR #20868 Acceptance notes, not filed",
"carrier: the next change to those files · 'ADR-0005 §Validation' (a heading the ADR lacks) is still cited outside this PR's files: packages/metadata-core/src/injected-system-columns.ts:132 and the headers of objectql meta-object-primary-designation-roundtrip, meta-object-search-companion-roundtrip and meta-object-tenant-index-roundtrip tests · noted in PR #20868 Acceptance notes, not filed"
]
}os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-persist-parsed-view-body",
"pr": "#20868",
"session": "session_018fxqvRJW12TaHC7DUQ89Y6 (mode:subagent; patch round on re-claim 5910252155, which is still the newest Claim)",
"premise_still_valid": true,
"summary": "Delta report: tests only, and no pin revealed a production defect. New head 9924c95 (previous 4191327). Correction to the patch premise: at 4191327 a test file DID referenceprojectStorableViewBody— protocol.graft-folded-form-sections.test.ts:731 held a structural block that covered both fallback arms. That block moved into a dedicated file beside protocol.ts, protocol.project-storable-view-body.test.ts, and was strengthened into (a) through (d): (a) a re-parse that refuses on round one storesparsed, notauthored, with one call; (b1) a re-parse that never reproduces the parse and makes no progress stops, converged false, with no throw; (b2) a re-parse that reveals one more needed key per round stops at the round bound (at most 8 calls against the 21 rounds convergence would need), converged false, body = parsed; (c) a default the re-parse reproduces is not stored, with one call; (d) a moved key is stored canonical, and a moved container is projected against its origin, so its nested default is not stored. The once-per-view warn dedupe IS pinned, with no test-only hook. The seam is the production plugin APIregisterMetadataTypeSchema('view', …), set to a non-idempotent stand-in schema with the built-in re-registered infinally. Two saves of one view warn once, a second view warns on its own, and the row is the whole parse output. No merge was taken. GitHub reads PR #20868 mergeable=true, and a driver-freegit merge-fileof registry.ts, protocol.ts and protocol.runtime-authoring-gate.test.ts against origin/main 72f8c38 is clean. The text-merged registry.ts is byte-equal (cmp) to a regeneration on origin/main plus this branch's entry.",
"tests": "At head 9924c95, under os-verify-lock. protocol.project-storable-view-body.test.ts: 7 passed. protocol.graft-folded-form-sections.test.ts: 46 passed (49, minus 4 moved out, plus 1 new). metadata-protocol full: 192 files, 2823 passed, 19 skipped. metadata-protocol typecheck (tsc --noEmit): exit 0. Ablation for (a), committed first: scripts/ablation-replace.mjs turnedreturn { body: parsed, converged: false };intoreturn { body: authored, converged: false };(grep-c injected=1, original=0), under a trap restore. Result: 4 red of 53 — (a), both (b)s, and the save-path warn pin. Restore: 'blob == HEAD (e2c307e8c6dd) and git diff HEAD is empty', andgit status --porcelainempty.",
"gates": [
"dispatch-gates --commands --repo objectstack-ai/objectstack over the two touched files: 53 derived, 51 exit 0, 2 NOT MEASURED (pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt, exit 3 PREREQUISITE NOT MET, whole-repo build), 0 UNRUN (--ran reconciliation). pnpm check:lean-entry-closure first answered exit 3 because the fresh worktree had no objectql dist; after building objectql it answered exit 0",
"eslint --no-inline-config --format json on the 2 touched files: 2 files, 0 errors, 0 warnings (no type-aware linting in eslint.config.mjs)"
],
"line_budget": "n/a",
"deviations": [
"The patch premise ('no test file references projectStorableViewBody') is falsified, as stated in the summary. The existing block was moved and strengthened rather than duplicated.",
"The warn-dedupe pin lives in protocol.graft-folded-form-sections.test.ts, not the new file, so that it rides that file's already-pinned engine double instead of minting a new one (check:engine-double-contract exit 0)."
],
"files_changed": [
"packages/metadata-protocol/src/protocol.project-storable-view-body.test.ts",
"packages/metadata-protocol/src/protocol.graft-folded-form-sections.test.ts"
],
"mcp_calls": "0",
"api_writes": "1: this delta os-dev-report, through scripts/pm/post-stamped.mjs (fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches, executed as POST /repos//issues/20051/comments). git push x1 (not REST). The PR body is unedited. Reads: PR #20868 mergeability.",
"open_questions": [],
"out_of_scope_findings": []
}ACCEPT — PR #20868 at head
9924c95b(stage (iv), ruling 甲 under Q2 = B / Q1 = A / Q3 = A) ·domain:specseat 1 (session_018fxqvRJW12TaHC7DUQ89Y6) · 2026-09-30T14:22ZReviewed against GitHub, not the reports (
5912512351, delta5912995677).- PR shape: draft, base
main. The first line isFixes #20051, thenClause-②: no, and there is no other closing keyword. The PR assignee isos-warren.check-governed-merges --pr 20868: NOT governed, 949 lines at the first head. The patch round adds 2 test files (+222/−32). - What lands:
- For
viewonly,saveMetaItemstoresprojectStorableViewBody: the parsed value of every key the body carried, with undeclared keys dropped and defaults not materialised. It replaces both grafts for views; every other type keeps its body and the grafts. - A ViewItem record's top-level
optionsis refused by name with theconfig.KINDprescription, registered as the ADR-0087 entryview-item-options-bag-refused. - Changeset:
minor× 2, BREAKING, FROM → TO.
- For
- Contract review: at-tier record
5913199665on the PR,Head-sha= the current head, PASS,Local-runs: none, identity pair present. Its two non-blocking notes (a same-shape moved-container corner, and the fail-safe arm's re-save prescription) are unreachable at the pin and carried to the next change ofprojectStorableViewBody. - CI at this head: 33 success, 2 rostered skips (
mergeable_state: clean). - Correction, owed publicly. My patch round said "no test file references
projectStorableViewBody". That was wrong.protocol.graft-folded-form-sections.test.ts:731already covered both fallback arms. My grep had found it, but I read a list truncated to 12 lines and took the missing tail for a zero. The dev moved that block intoprotocol.project-storable-view-body.test.tsand strengthened it. The fallback ablation now turns 4 of 53 tests red, and the once-per-view warn is pinned throughregisterMetadataTypeSchema, with no test-only hook. - Out of scope (named carriers):
- Other types stay verbatim: the ruling names views.
- The objectui
listViewsflatten dropping row state: objectui#11013. - The stale "ADR-0005 §Validation" citations in files this PR does not touch: carrier is the next change to those files.
- After MERGED: the ADR-0005 Tier H docs PR (the Status line, the "Ruled, not yet in force" marker, and the
parsed.databullet, per ruling5910106571) is filed by this seat for the maintainer's hand.
- PR shape: draft, base
Landed · stage (iv), the last stage of ruling 甲 · PR #20868 MERGED through the merge queue as
9905e61ca2(single parent) ·domain:specseat 1 (session_018fxqvRJW12TaHC7DUQ89Y6) · 2026-09-30T14:55Z- Verified by content on
origin/main:export function projectStorableViewBody(1 hit) and theif (singularType === 'view')save branch (1 hit) are inpackages/metadata-protocol/src/protocol.ts, and the old "original payload is stored verbatim" comment has 0 hits.- The
VIEW_ITEM_OPTIONS_REFUSEDrefusal is inpackages/spec/src/ui/view.zod.ts, and the ADR-0087 entryview-item-options-bag-refusedis inmigrations/registry.ts. protocol.project-storable-view-body.test.tsis present.
- Rulings executed: 甲
5856781584(the end state); the maintainer's 「20051 不考虑现有的数据」5909085121(no stored-row census, no migration of existing rows); Q2 = B, Q1 = A, Q3 = A5910106571. - Records: ACCEPT
5913223729; at-tier contract review5913199665(PASS, head9924c95b); dev reports5912512351and5912995677. - Closing-keyword audit: the PR body closed only this card. The queue merge did not auto-close it, so the seat closes it now.
pm:dispatchedand the assignee were removed in this act. - Follow-up owed by ruling
5910106571: the ADR-0005 Tier H documentation change (the Status line, the "Ruled, not yet in force" marker, and theparsed.databullet). It is filed as its own card for the governed-surface lane and the maintainer's hand; the link follows on this card.
- Verified by content on
Pointer ·
domain:specseat 1 (session_018fxqvRJW12TaHC7DUQ89Y6) · 2026-09-30T14:58Z: the ADR-0005 Tier H documentation follow-up that ruling5910106571requires is filed as #20879 (bare, for triage; the acting reader is the governeddocs/adr/**seat, landing at Tier H by the maintainer's hand).- added 5 commits that reference this issue
on Oct 7, 2026
Ruled: 5910106571 · letter B (Q2) — a saved view stores the author's keys normalised by the parse, undeclared keys dropped, schema defaults not materialised; Q1 A · Q3 A as the seat answered · 2026-09-30T11:28Z
Ruled: 5856781584 · letter 甲 · 2026-09-27T14:48Z
Maintainer: 「20051 不考虑现有的数据」 — the stored-row census is waived; stage (iv) no longer waits on objectui#11013 (record
5909085121)Filing gate ③: a ruled task. Director seat, summon #29 (
session_01EcrTi7s5oDYPHS4Pi7h31d), executing objectui#10380 batch #223 item 5a, letter A. Maintainer verbatim: 「其他同意」. ⛔ Not a claim. Routing and grading are triage's.What
PUT /api/v1/meta/viewwith a flattened list overlay passes the door throughListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()(packages/spec/src/ui/view.zod.ts, the listOverlay member). A top-leveloptionsbag is stripped unjudged:options.timeline.metaFieldspasses, while the same key written directly (timeline.metaFields) is refusedunrecognized_keys.saveMetaItemthen persists the original body verbatim, and objectui's interface page forwardsview.optionsinto the renderer. So a stored view carries and renders keys the strict schemas refuse, and it renders two ways (the object page does not forwardoptions). This was measured by the objectui#10222 dev on the installed spec 17.4.0; the persistence step was read from source.Deliverable (ruling A)
options.KINDpresent on a flattened overlay with that kind's strict schema, and refuses an out-of-contract key by name, exactly as the direct spelling is refused.options.map(the deliberately kept legacy path, pinned in objectui) stays accepted as far as its kind's schema accepts it.options.*, and which keys. The result goes on objectui#10380 and in the changeset; rows that fail the new judgement are named with their fix.options-wrapped out-of-contract key get the same refusal; a legaloptions.KINDround-trips; the persisted body equals the parse result.Unblocks
objectui#10380 (
Blocked-by:this card). objectui then only aligns, so that the same stored view renders the same on the interface page and the object page. objectui#10222 (retiring themetaFieldsreads) does not wait on this card.Generated by Claude Code