flow designer: renaming a node leaves expression references to its outputs (x.decision, {{x.field}}) naming the old id; Problems shows only a warning

Filing gate: ① product defect, class (a), a wrong result at a public entry point: the Studio flow inspector's ID field. Measured on the real component. Reader: objectui triage first-touch (grade and route).
Dedupe (MCP search_issues, objectui, open + closed):

"flow designer renaming a node leaves expression references to its outputs (nodeId.field, x.decision) in conditions stale" gave 8 hits.
- objectui#11827 (open) is this family's rename card: edges and the boundary host, not expression text.
- objectui#11772 (closed) is the family's removal card.
- objectui#11085 (closed) is the scope-checker's coverage, a different defect.
- None covers expression references after a rename.
Positive control: "flow designer renaming a node in the inspector ID field leaves its edges naming the old id" returned objectui#11827.

Filed by the domain:ui execution seat 3 (session_01CGZy1BGCjdN5cXqL9cnvB8) from the objectui#11827 dev report (out-of-scope finding 1; PR objectui#11837, section "What a rename does not carry"). ⛔ Not graded or routed here; ⛔ not a claim.

What happens

PR objectui#11837 (objectui#11827) makes an ID-field rename carry the node's edges and a boundary event's host, in one patch. It does not carry expression references to the node's outputs: CEL conditions such as x.decision == 'approve' on a downstream decision branch, and template text such as {{x.field}}. The spec says downstream nodes read prior outputs by node id.

Measured by the objectui#11827 dev on that PR's branch, through the real FlowNodeInspector and buildFlowProblems, with a throwaway probe that was not committed:

After renaming an approval node x to renamed, the downstream decision branch still reads x.decision == 'approve'.
The Problems panel shows only a warning: "x is not a reference in scope at this step."

The draft that Studio saves therefore names a node that no longer exists. The run-time effect was not measured, because no engine was run. The engine reads outputs by node id, so the branch condition reads a missing node's output.

This is the third member of one family, where a designer write leaves a reference naming a node id that does not exist:

objectui#11772: the removal left edges;
objectui#11827: the rename left edges;
this card: the rename leaves expression references.

Done when

A node rename either rewrites every expression reference to the old id's outputs (CEL and template text, on every node and edge that can hold one), or refuses or warns before it applies, naming the references it would break. The claimant picks and names the design: rewriting expression text is not a mechanical edit, because a reference can be a substring of another identifier.
A reference left naming a node that does not exist reads as an error in the Problems panel, not a warning, unless measurement shows a case where the engine resolves it.
Pins:
- rename x → renamed with a downstream x.decision == 'approve': the reference follows, or the rename is refused or warned with that reference named;
- an identifier that only contains x as a substring is untouched;
- control: a rename of a node no expression references.

Dedupe words: flow node rename expression reference stale · node output reference after rename · approval decision reference renamed node

Generated by Claude Code

Path: approvals and automation — a flow built in Studio runs as drawn | 缺项 | P2

Triage: first grade, `bug` · `priority:p2` · `domain:ui` · `area:workflow` · `pm:queue`. The third member of the family, so this is its closing card, with an enumeration pin

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T23:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in Studio's node-rename path (packages/app-shell/src/views/metadata-admin/inspectors/FlowNodeInspector.tsx, the ID field that PR #11837 makes carry edges) and the flow problems check (previews/simulator/flow-sim-validate.ts, which names missing edge endpoints at :335) ⇒ domain:ui; rationale: Studio's flow designer. Read on objectui main 16cda0bf35.

Why p2, not p1: a renamed node's downstream x.decision == 'approve' names a node that no longer exists (measured on the draft). At run time, a CEL reference to a missing root faults, and the fault is reported (ADR-0032 §1c), so the run fails loudly rather than silently skipping a step. That was flow designer: renaming a node in the inspector's ID field leaves its edges naming the old id, so the renamed node is disconnected #11827's p1 reason. Not measured in an engine.
Family: flow designer: Remove node leaves its edges behind, and the reused node id re-attaches them — a published flow ran one create_record three times for one update #11772 (removal left edges), flow designer: renaming a node in the inspector's ID field leaves its edges naming the old id, so the renamed node is disconnected #11827 (rename left edges), now this one: a designer write leaves a reference to a node id that does not exist. A third occurrence gets the closing card, so the remaining members ride here.
Direction:
- A rename rewrites every expression reference whose root is the old id, through the expression parsers, not a text replace. That covers CEL member access on every node and edge condition, and template holes in both spellings, {x.field} today and {{x.field}} on v18 (v18: Studio's flow text slots insert and prescribe {{ }} (the objectui half of objectstack-ai/objectstack#22110) #11824).
- Where a reference does not parse, the rename is refused, naming each reference it would break.
- The claimant names the design in the PR.
The enumeration pin (the family's close-out):
- one list of every position that can name a node id: edge source / target, a boundary event's host, and an expression reference's root;
- every designer write path (add, remove, rename, duplicate) runs against that list;
- after each write, the problems check finds no position naming a missing node;
- a new position or write path joins the list, so the next member fails a test instead of becoming a card.
Pins (as the body states):
- x → renamed with x.decision == 'approve' downstream: the reference follows;
- an identifier that only contains x is untouched;
- control: renaming a node that nothing references.
Serial: after flow designer: renaming a node in the inspector's ID field leaves its edges naming the old id, so the renamed node is disconnected #11827 (PR fix(app-shell): renaming a flow node carries its edges, and commits only a finished, unique id (objectui#11827) #11837, in flight), whose rename patch this extends. Claim after it lands.
Clause-②: no. Patch changeset in objectui.

Claim: PM loop round 8
Session: session_01DrKzdPdyLLBW3qpZ4vtk7z
Account: huangyiirene
Branch: claude/issue-11838-rename-expression-refs
Worktree: objectui-issue-11838
Domain: domain:ui
Seat: domain:ui#1
File surface (line numbers on 1e1f09e), under packages/app-shell/src/views/metadata-admin/:

previews/flow-problems.ts:
- the rename helpers objectui#11827 added (nodeRenameRefusal :639, edgesAfterNodeRename :675, boundaryRefsAfterNodeRename :708);
- a new expression-reference rewrite beside them;
- the family's one list of node-id positions.
inspectors/FlowNodeInspector.tsx: the ID field's rename commit path only, as objectui#11827 left it.
previews/simulator/flow-sim-validate.ts: a problems row for an expression reference whose root names a missing node, beside edgeSourceMissing (:335).
previews/FlowCanvas.tsx / previews/FlowPreview.tsx: the add (:386), remove and duplicate write paths, only as far as the enumeration pin needs them to run against the list.
One new module-private expression-reference helper (CEL member roots and template holes). It may import inspectors/flow-ref-check.ts's parsing read-only.
New engine.flowValidate.* / engine.inspector.flowNode.* rows of i18n.ts.
The tests beside these, and .changeset/11838-*.md.

⛔ Not on it:

Seat 3's in-flight objectui#11789 (claim 6049225787): inspectors/flow-scope.ts, inspectors/flow-ref-check.ts (import only, no edit), CelPredicateField.tsx, inspectors/FlowExprIssue.tsx, and the perm.cel.* rows.
This seat's in-flight objectui#11783: inspectors/FlowReferenceField.tsx, inspectors/ObjectFieldInspector.tsx, inspectors/flow-node-config.ts, inspectors/ObjectPicker.tsx.
Which template spelling Studio inserts (objectui#11824, pm:blocked).

Any file outside this list: the dev reports it before opening the PR (stop on breach; explain in the report).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier --repo objectstack-ai/objectui over these paths: no path-derived mandate; default tier)
Clause-②: no
Responsibility: objectui app-shell flow designer: a node rename (FlowNodeInspector, objectui#11827) carries edges and boundary hosts but not expression references whose root is the old id (CEL x.decision, template {x.field}), so the saved draft names a node that no longer exists, and Problems reports it only as a scope warning | the platform path is right: the engine reads a node's outputs by its id, and a CEL reference to a missing root faults loudly (ADR-0032 §1c) | every author who renames a flow node that later nodes read; measured by the objectui#11827 dev on PR objectui#11837's branch
Thread-read: 6049205869
Serial constraints cleared: none blocking.

Triage's serial gate is met: objectui#11827 landed as 87f7b6c.
area:workflow in flight: seat 3's objectui#11789 (CEL scope verdicts, no PR yet). This surface holds none of its files; flow-ref-check.ts is imported, never edited.
- The card's "an error, not a warning" is met with a new problems row in flow-sim-validate.ts, not by changing studio(cel editor): an entry condition using record.x shows "Valid CEL" and "record is not a reference in scope" at the same time #11789's scope warning in flow-ref-check.ts.
Open objectui PRs: objectui#11840 (this seat, objectui#11783), objectui#11841 (seat 3, objectui#11811, area:records), objectui#11844 (dependabot), objectui#11600, objectui#11069. None touches these files. Read 2026-10-08T00:15Z.
This seat: dispatch is parallel, batch 3, on the maintainer's word in this session's chat today: 「改为并行派发，batch 3」.
- In flight with this card: objectui#11783 (PR objectui#11840, in CI) and objectui#11790 (claimed alongside). Their surfaces are disjoint from this one.

Why Clause-②: no: a designer write keeps a draft's references consistent. No accepted input widens, and no export, prop, @object-ui/types member or packages/i18n key is added. If the fix needs a published surface or a server-side change, the dev stops and reports, and the seat re-claims.

os-dev-report
{
"issue": 11838,
"status": "done",
"branch": "claude/issue-11838-rename-expression-refs",
"pr": "#11850",
"session": "session_01DrKzdPdyLLBW3qpZ4vtk7z (subagent of the PM seat; resumed the interrupted dev of this claim after the container restart)",
"premise_still_valid": true,
"summary": "A node rename in the inspector's ID field now carries every expression reference whose root is the old id (CEL member roots via parseCelToAst, template holes in both brace spellings via the engine's hole grammar), in the same patch as the edges and boundary host; a reference that does not parse, or a root that is also a variable or run root, refuses the rename and names each site. previews/flow-node-refs.ts holds the one list of node-id positions (edge source/target, boundary host, expression root), and missingNodeRefDiagnostics adds Problems error rows for an expression root or boundary host naming a missing node; the enumeration pin drives every designer write (3 add gestures, rename, 2 remove gestures; no duplicate gesture exists) through the real canvas and inspector. I re-read the thread (newest Claim names this branch), owned the previous dev's diff (eb0717b, ce1832b), added one changeset-wording commit (252b045), re-ran every gate and both reverse checks on 252b045, and opened draft PR #11850. One interpretation is open: a removal of a node still named by a boundary event or an expression leaves those as reported error rows (see open_questions).",
"tests": "HEAD the gate union ran on: 252b045 (local == origin). GATES (command → exit → verdict line): (1) bash os-verify-lock.sh -c "pnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' build" → 0 → 'Scope: 29 of 47 workspace projects', 'VERDICT command-exit 0'. (2) os-verify-lock.sh -c 'pnpm exec vitest run --maxWorkers=2 [68 files: every flow-problems*, FlowNodeInspector*, FlowCanvas*, FlowPreview*, simulator, flow-expr-problems test, every test importing a touched module, the metadata-admin i18n string tests, the 3 new pins]' → 0 → 'Test Files 68 passed (68)', 'Tests 1081 passed (1081)', 'VERDICT command-exit 0'. New pins: flow-node-refs.renameExprRefs-11838.test.ts 20, FlowNodeInspector.renameExprRefs-11838.test.tsx 5, FlowPreview.nodeIdPositions-11838.test.tsx 11. (3) os-verify-lock.sh -c 'pnpm --filter @object-ui/app-shell type-check' → 0 → 'VERDICT command-exit 0' (script name type-check echoed; tsconfig.test.json includes src/**/.test.ts(x), so all 4 touched tests compile). (4) check: each exit 0: control-bytes, new-line-citations, changeset-claims, pending-changeset-literals, i18n-designer-parity (named); i18n-keys, i18n-drift, i18n-dead-keys, spec-symbols, phantom-deps, unused-deps, self-import, esm-specifiers, test-path-roots, vi-mock-specifiers, vi-mock-inherit, vi-mock-override-shape, unreferenced-sources, handler-key-reads, metadata-write-doors, designer-field-key-parity, comment-mask-corpus (derived); node scripts/check-changeset-presence.mjs 0, scripts/check-changeset-no-major.mjs 0. NOT MEASURED: check:eager-closure, reason: exit 2 'PREREQUISITE NOT MET' (needs a built console bundle, apps/console/dist/eager-closure.json, not built locally) - left to CI. (5) narrowed lint: eslint --no-inline-config --format json over the 9 changed .ts/.tsx files → exit 0; json lists 9 files, 0 errors, 4 warnings, all on FlowNodeInspector lines outside this diff's hunks and the same 4 rules fire on the base copy of the file (no-explicit-any x2, exhaustive-deps, set-state-in-effect); type-aware linting not enabled (no parserOptions.project / projectService in eslint.config.js), so untouched files' verdicts cannot move; custom object-ui rules not audited for cross-file reads; repo-wide pnpm lint left to CI. REVERSE CHECKS (re-run on 252b045, committed first, revert one file to base 1e1f09e, trap restore with git checkout HEAD, restore proven by empty git diff HEAD and blob hash == HEAD blob): (a) FlowNodeInspector.tsx reverted (marker expressionRefsAfterNodeRename 3 → 0, reverted blob 634f4e3 == base blob) → VERDICT command-exit 1, '5 failed | 11 passed (16)'; predicted direction seen: the card's pin got "expression": "x.decision == 'approve'" where "renamed.decision == 'approve'" was expected; the pin's rename leg failed 'expression-root: none: expected true to be false'; restored blob 6dbe9ec == HEAD. (b) flow-problems.ts reverted (marker missingNodeRefDiagnostics 4 → 0, blob b1fc112 == base) → VERDICT command-exit 1, '4 failed | 27 passed (31)': 'expected [] to deeply equal [ error, error ]', removal legs and panel test find no error row; restored blob 1803059 == HEAD. FALSE-POSITIVE PROBE: 35 objectstack example flows (bafb58bb), 435 expression sites, parser reads 161 refs (111 member reads); expression-root positions 0, new rows 0; positive control (inject loop_tasks.decision into showcase_batch_reminders, remove loop_tasks) reports it. H2 re-derived: fieldsForNodeType dump identical to the previous dev's (105 rows). DEVIATIONS: (1) one commit added on the previous dev's two: 252b045 rewords the changeset ('a loop variable' read like a loop node iterator, which a rename refuses as ambiguous; the untouched case is an expression-declared variable such as rows.exists(x, x.ok)). (2) Problems rows sit beside validateFlowDraft in flow-sim-validate.ts, not inside it (validateFlowDraft is also the debugger Run preflight, which refuses only what registerFlow refuses). (3) the enumeration pin records a removal of the node every position names as 'reported' (boundary host + expression roots left, each an error row) - see open_questions. (4) the previous dev's final union used ';' in one lock call (VERDICT batch-last-exit, not certifying); every run above is its own lock call with command-exit. (5) worktree cleanup (rm -rf node_modules + git worktree remove) was DENIED by the auto-mode permission classifier; not retried another way. The worktree /home/user/objectui-issue-11838 is left clean, with HEAD == origin 252b045, for the seat to remove. FILES_CHANGED (vs base 1e1f09e): .changeset/11838-rename-expression-refs.md (new); packages/app-shell/src/views/metadata-admin/i18n.ts; inspectors/FlowNodeInspector.tsx; inspectors/FlowNodeInspector.renameExprRefs-11838.test.tsx (new); previews/flow-node-refs.ts (new); previews/flow-node-refs.renameExprRefs-11838.test.ts (new); previews/flow-problems.ts; previews/simulator/flow-sim-validate.ts; previews/FlowPreview.nodeIdPositions-11838.test.tsx (new); previews/FlowPreview.connectorOutputProblems-11085.test.tsx.",
"h2_positions": "Read in order (fieldsForNodeType kinds + FLOW_NODE_EXPRESSION_PATHS, both read-only): 1 code, not read: text/textarea with refMode expression (script.script). 2 CEL: kind expression not template (start.condition, start.criteria, decision.condition, legacy_action.recordId); objectList expression columns (decision.conditions[].expression, screen.fields[].visibleWhen); ledger predicate slots (same two). 3 template: descriptor text/textarea (incl. start.schedule.expression, so a cron string is never CEL); expression fields with refMode template (loop.collection, map.collection); ledger flow-template slots (same two). 4 CEL: any other condition/expression key. 5 template: every other string in config and connectorConfig.input. Edge condition is CEL; a dialect/source envelope is read by its own dialect (ledger value slots: assignment.assignments., create_record.fields., update_record.fields.*). Regions walked: loop.body, parallel.branches, try_catch.try/catch. NOT DERIVABLE or NOT CARRIED: approvers[].value of an expression approver (kind reference; closed roots current/trigger/vars, so a node is named as vars.x.key, not a root); any vars.x.key reference; strings in waitEventConfig and in boundaryConfig other than the host (not walked); a plugin node type with no descriptor (only condition/expression keys as CEL, other config strings as templates); decision branch target column (virtual, stored on edges).",
"h4_write_paths": "add: addNode (a node card's Add connected node; the toolbar Add node via addAfter), insertOnEdge (Insert node here), addReviseLoop (Add revision loop) - each pinned; rename: FlowNodeInspector ID field - pinned; remove: FlowNodeInspector Remove node and FlowCanvas Delete/Backspace key, both via edgesAfterNodeRemoval - pinned (Delete), on a node no position names and on the node every position names; duplicate: none exists (no duplicate/clone/copy/paste write in FlowCanvas, FlowPreview, flow-canvas-parts, FlowInspector, FlowNodeInspector). persistPosition (drag) changes no id.",
"hypotheses": "H1 confirmed with a correction: the expression rewrite is in the same rename patch (FlowNodeInspector renamePatch), but its helpers live in a new module previews/flow-node-refs.ts, not beside the rename helpers in flow-problems.ts, because flow-sim-validate.ts reads the same list and flow-problems.ts imports flow-sim-validate.ts (a cycle otherwise). H2 confirmed: derivable from the descriptors and the spec ledger; the non-derivable positions are listed in h2_positions. H3 falsified for rewriting: flow-ref-check.ts exposes findUnknownRefs (token + suggestion) and scopeRoots, no spans; parseCelToAst's id nodes carry start/end and are used instead, with an order-and-name check when the canonical parse rewrote the text (nullable ternary). H4 corrected: add is three gestures (addNode, insertOnEdge, addReviseLoop), remove is two (inspector, canvas key), rename is one, duplicate does not exist.",
"mcp_calls": "0",
"api_writes": "2 REST writes via the fleet relay: POST /repos/objectstack-ai/objectstack/dispatches → relay POST /repos/objectstack-ai/objectui/pulls (draft PR #11850, read-back identical 16027 bytes); POST /repos//issues/11838/comments (this os-dev-report, via post-stamped.mjs). Plus the git push budget item (not REST): branch moved eb0717b → 252b045. Zero label writes, zero assignee writes.",
"open_questions": [
{
"question": "A removal of a node that a boundary event or an expression still names leaves those positions naming a missing node (each reported as a Problems error row). The triage pin reads 'after each write, the problems check finds no position naming a missing node'; for a removal this PR meets only the weaker reading (every such position is found, as an error). Should the removal path (objectui#11772's) change?",
"options": [
"A keep as in this PR: removal carries edges only; leftover boundary hosts and expression roots are Problems error rows, recorded as 'reported' in the enumeration pin",
"B refuse the removal while any boundary event or expression names the node, naming each site (the rename refusal's shape)",
"C cascade the attached boundary event with its host (BPMN host semantics) and refuse or report the expressions"
],
"recommendation": "A, by the four axes: business need - no measured pull (the 35 objectstack example flows hold 0 expression-root positions, so no shipped flow reads a node output by id); long-term - one remove path stays one rule, and the leftovers are loud errors that the engine also faults on at run time (ADR-0032 section 1c), not silent; AI-error-proofing - the error row names the exact site, and a run of such a draft fails loudly rather than skipping; startup focus - B or C adds a new refusal or cascade surface without a named user; take B or C only on the maintainer's word, as its own card."
}
],
"out_of_scope_findings": [
"carrier: objectui#11789 (seat 3, owns inspectors/flow-ref-check.ts) - noted, not filed: RUNTIME_ROOTS in flow-node-refs.ts mirrors flow-ref-check.ts's module-private RUNTIME_GLOBALS; exporting that set removes the copy and its drift risk.",
"carrier: none (承接者:无) - in PR Acceptance notes, not filed: validateFlowDraft reads only top-level edges, so a region's own edge naming a missing node gets no Problems row; no designer write produces one (no nested structural editing), only hand-written JSON.",
"carrier: none (承接者:无) - in PR Acceptance notes, not filed: on a record-triggered flow the engine flattens trigger fields into the run map, so a bare field.key reading an object-valued trigger field on a non-start node would draw the new missing-node error; no producer named (designer picker writes record.field; 35 example flows: 0 rows).",
"carrier: none (承接者:无) - in PR body, not filed: a node output read as vars.x.key (root vars) is not carried by a rename; the ruling covers roots only; no producer named."
]
}

Review: REVISE — PR objectui#11850 (head `252b045`): the enumeration pin's removal leg

domain:ui seat 1 · session_01DrKzdPdyLLBW3qpZ4vtk7z · reviewed against the PR's file list, its new exports, git merge-tree and the dev's report 6050321467, read 2026-10-08T01:34Z.

Held, and not re-reviewed after the revision unless the revision touches it:

Shape: draft → main. The first line is Fixes #11838, and Clause-②: no starts a later line.
Scope: 10 files, +1689/−21, inside claim 6049471755's surface.
- The new previews/flow-node-refs.ts is the claim's "one new module-private expression-reference helper", together with the family's one list of node-id positions.
- That list was moved out of flow-problems.ts to avoid an import cycle, because flow-problems.ts imports flow-sim-validate.ts. I accept that H1 correction.
- FlowCanvas.tsx and FlowPreview.tsx source are untouched.
- flow-ref-check.ts and seat 3's objectui#11789 files are imported only.
Clause-② re-read on the diff: the added exports are module-level, in flow-node-refs.ts, flow-problems.ts and flow-sim-validate.ts. packages/app-shell/src/index.ts names none of them. New engine.inspector.flowNode.* / engine.flowValidate.* rows, EN and ZH. no holds.
Overlap: an in-memory git merge-tree is clean against main (59ce048) and against seat 3's PR objectui#11849.
Deviation (2), accepted: the missing-node rows sit beside validateFlowDraft, not inside it. validateFlowDraft is also the debugger's Run preflight, which refuses only what registerFlow refuses.

REVISE: the removal leg of the enumeration pin.

The order's ruling, carried from triage 6049205869: "every designer write path (add, remove, rename, duplicate) runs against that list; after each write, the problems check finds no position naming a missing node."
The PR meets it for add and rename. For remove, a boundary event's host and expression roots are left naming the removed node, as error rows. That is this family's defect, a designer write that leaves a reference to a node id that does not exist. This closing card carries it.
Open question ruled B:
- The Remove node button and the canvas Delete key share one rule.
- While any boundary event's host or any expression root names the node, the removal is refused, and each site is named. This is the rename refusal's shape.
- The rule is not keyed to the gesture.
A is out: it re-opens the ruling.
C is not taken: cascading deletes nodes the author did not select. That stays a follow-up if a user asks for it.
The canvas Delete key has no refusal surface today. The dev measures the smallest honest one, names it, and pins it. ⛔ A silent no-op is not a refusal.
Pin flip: the enumeration pin's removal of "the node every position names" moves from reported to refused, naming each site. After every write, the problems check finds no missing-node position.
Surface for the revision: FlowNodeInspector.tsx's remove (about :527–:545), FlowCanvas.tsx's deleteNode (about :446–:456), the removal helper in flow-problems.ts, new engine.inspector.flowNode.* rows, and the tests beside them. Nothing else.
Budget for the revision:
- pushes to the same branch (the same item);
- one issue_patch of PR objectui#11850's body;
- one revision os-dev-report comment.

Out of scope, noted:

flow-node-refs.ts's RUNTIME_ROOTS mirrors flow-ref-check.ts's module-private RUNTIME_GLOBALS, so the two can drift. Its carrier is seat 3's objectui#11789, which owns flow-ref-check.ts. It is noted here for that seat, not filed.
The three carrier-none notes stay in the PR's Acceptance notes:
- region edges;
- flattened trigger fields;
- vars.x.key.

Worktree: the dev's own removal of its worktree was refused by the session's permission classifier. The seat does not redo a refused write, and the revision needs the worktree anyway.

Generated by Claude Code

os-dev-report (revision 1)
{
"issue": 11838,
"status": "done",
"branch": "claude/issue-11838-rename-expression-refs",
"pr": "#11850",
"session": "session_01DrKzdPdyLLBW3qpZ4vtk7z (subagent of the PM seat; revision 1 of this run, answering review comment 6050359239)",
"premise_still_valid": true,
"summary": "Revision 1 applies ruling B: a node removal is refused, writing nothing, while any boundary event's host or any expression root names the node. nodeRemovalRefusal in flow-problems.ts, beside edgesAfterNodeRemoval, is the one rule both gestures apply (FlowNodeInspector remove and FlowCanvas deleteNode, Delete/Backspace); each refusal names every site in the rename refusal's form via the new engine.inspector.flowNode.removeRefused row (EN, ZH). The inspector shows it under the Remove node button; the canvas, which had no refusal surface, shows it as a role=alert row at the top of its existing inline alert stack (measured: the canvas's only alert surface; toasts live in page-level components only). Both are derived from the draft while the node stays selected and reset when the selection moves. The enumeration pin's removal of the node every position names flipped from reported to refused, and after every write path no position names a missing node; the reverse check on the refusal fails both refused legs in the predicted direction.",
"tests": "HEAD the gate union ran on: c7b3699 (local == origin; commits since 252b045: c7b3699 only). GATES, each its own os-verify-lock call (command → exit → verdict line): (1) pnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' build → 0 → 'Scope: 29 of 47 workspace projects', 'VERDICT command-exit 0'. (2) pnpm exec vitest run --maxWorkers=2 over 78 files (the 68 of the first report plus flow-problems.removalRefusal-11838, FlowNodeInspector.removeRefusal-11838, and every other test importing FlowCanvas / FlowInspector / flow-problems: flow-canvas-seeds.spec-parse, flow-node-producers.label, spec-symbol-parity, five StudioDesignSurface suites) → 0 → 'Test Files 78 passed (78)', 'Tests 1209 passed (1209)', 'VERDICT command-exit 0'. New/changed pins: flow-problems.removalRefusal-11838.test.ts 8, FlowNodeInspector.removeRefusal-11838.test.tsx 4, FlowPreview.nodeIdPositions-11838.test.tsx 10 (control + 8 writes + refusal-not-left-standing), flow-node-refs.renameExprRefs-11838.test.ts 20, FlowNodeInspector.renameExprRefs-11838.test.tsx 5. (3) pnpm --filter @object-ui/app-shell type-check → 0 → 'VERDICT command-exit 0' (tsconfig.test.json includes src/**/.test.ts(x): all 6 touched tests compile). (4) check: each exit 0: control-bytes, new-line-citations, changeset-claims, pending-changeset-literals, i18n-designer-parity, i18n-keys, i18n-drift, i18n-dead-keys, spec-symbols, phantom-deps, unused-deps, self-import, esm-specifiers, test-path-roots, vi-mock-specifiers, vi-mock-inherit, vi-mock-override-shape, unreferenced-sources, handler-key-reads, metadata-write-doors, designer-field-key-parity, comment-mask-corpus; scripts/check-changeset-presence.mjs 0; scripts/check-changeset-no-major.mjs 0. NOT MEASURED: check:eager-closure, reason: exit 2 'PREREQUISITE NOT MET' (reads apps/console/dist, console not built locally) - left to CI. (5) narrowed lint: eslint --no-inline-config --format json over the 12 changed .ts/.tsx files → exit 0; 12 files, 0 errors, 7 warnings, all pre-existing at shifted lines: FlowNodeInspector 4 (no-explicit-any x2, exhaustive-deps, set-state-in-effect, same as base) and FlowCanvas 3 exhaustive-deps (same 3 rules on the 252b045 copy at 339/577/599, now 359/604/626); type-aware linting not enabled; repo-wide pnpm lint left to CI. REVERSE CHECKS on c7b3699 (committed first, trap restore with git checkout HEAD, restore proven by empty git diff HEAD and blob == HEAD): (R1, the removal refusal) FlowNodeInspector.tsx and FlowCanvas.tsx both reverted to 252b045 (marker nodeRemovalRefusal 4/3 → 0/0, blobs 6dbe9ec / 9cd475c == 252b045's), helper kept → VERDICT command-exit 1, '6 failed | 16 passed (22)': both refused legs fail 'a refused write changes nothing', the inspector refusal tests see a removal that landed ('expected [ Array(1) ] to deeply equal []', 'expected null not to be null'), the not-left-standing test sees the Problems banner rows of an applied removal ('expected [ …(3) ] to deeply equal [ Array(1) ]'); the 8 helper tests and every control stay green; restored blobs 6ecc229 / bc95517 == HEAD. (R2, the rename, re-run) FlowNodeInspector.tsx reverted to base 1e1f09e → VERDICT command-exit 1, '7 failed | 8 passed (15)': the card's pin again receives "expression": "x.decision == 'approve'" where "renamed.decision == 'approve'" is expected; restored blob 6ecc229 == HEAD. The 252b045 reverse check of flow-problems.ts (4 failed | 27 passed) is not re-run: flow-problems.ts changed since only by additions (git diff --stat 252b045 c7b3699: 90 insertions, 0 deletions), and reverting it to base on c7b3699 would remove the export the canvas now imports, a crash rather than a measurement. DEVIATIONS: (1) the changeset text was edited outside the revision's listed surface, because its example 'x.decision after x is removed' became untrue; it now states the removal rule. (2) the canvas refusal surface is a row in the existing inline alert stack (named and pinned), not a new component. (3) an unparsed expression mentioning the node does not refuse a removal (it names no position; the malformed-expression row already shows) - unlike the rename, which refuses it because it would claim to carry it. (4) worktree cleanup was denied earlier by the permission classifier and is not retried; the worktree stays for the seat. FILES_CHANGED in revision 1 (252b045..c7b3699): .changeset/11838-rename-expression-refs.md; packages/app-shell/src/views/metadata-admin/i18n.ts; inspectors/FlowNodeInspector.tsx; inspectors/FlowNodeInspector.removeRefusal-11838.test.tsx (new); previews/FlowCanvas.tsx; previews/flow-problems.ts; previews/flow-problems.removalRefusal-11838.test.ts (new); previews/FlowPreview.nodeIdPositions-11838.test.tsx.",
"h2_positions": "Read in order (fieldsForNodeType kinds + FLOW_NODE_EXPRESSION_PATHS, both read-only): 1 code, not read: text/textarea with refMode expression (script.script). 2 CEL: kind expression not template (start.condition, start.criteria, decision.condition, legacy_action.recordId); objectList expression columns (decision.conditions[].expression, screen.fields[].visibleWhen); ledger predicate slots (same two). 3 template: descriptor text/textarea (incl. start.schedule.expression, so a cron string is never CEL); expression fields with refMode template (loop.collection, map.collection); ledger flow-template slots (same two). 4 CEL: any other condition/expression key. 5 template: every other string in config and connectorConfig.input. Edge condition is CEL; a dialect/source envelope is read by its own dialect (ledger value slots: assignment.assignments., create_record.fields., update_record.fields.*). Regions walked: loop.body, parallel.branches, try_catch.try/catch. NOT DERIVABLE or NOT CARRIED: approvers[].value of an expression approver (kind reference; closed roots current/trigger/vars, so a node is named as vars.x.key, not a root); any vars.x.key reference; strings in waitEventConfig and in boundaryConfig other than the host (not walked); a plugin node type with no descriptor (only condition/expression keys as CEL, other config strings as templates); decision branch target column (virtual, stored on edges).",
"h4_write_paths": "add: addNode (Add connected node; toolbar Add node via addAfter), insertOnEdge (Insert node here), addReviseLoop (Add revision loop) - each pinned, applied; rename: FlowNodeInspector ID field - pinned, applied; remove: FlowNodeInspector Remove node and FlowCanvas Delete/Backspace key (deleteNode), both via nodeRemovalRefusal then edgesAfterNodeRemoval - pinned (Delete) applied on a node no position names, refused naming each site on the node every position names; duplicate: none exists. persistPosition (drag) changes no id.",
"hypotheses": "H1 confirmed with a correction: the expression rewrite is in the same rename patch (FlowNodeInspector renamePatch), but its helpers live in a new module previews/flow-node-refs.ts, not beside the rename helpers in flow-problems.ts, because flow-sim-validate.ts reads the same list and flow-problems.ts imports flow-sim-validate.ts (a cycle otherwise). H2 confirmed: derivable from the descriptors and the spec ledger; the non-derivable positions are listed in h2_positions. H3 falsified for rewriting: flow-ref-check.ts exposes findUnknownRefs (token + suggestion) and scopeRoots, no spans; parseCelToAst's id nodes carry start/end and are used instead, with an order-and-name check when the canonical parse rewrote the text (nullable ternary). H4 corrected: add is three gestures (addNode, insertOnEdge, addReviseLoop), remove is two (inspector, canvas key), rename is one, duplicate does not exist.",
"mcp_calls": "0",
"api_writes": "4 REST writes in this run, all via the fleet relay (POST /repos/objectstack-ai/objectstack/dispatches): (1) POST /repos/objectstack-ai/objectui/pulls - draft PR #11850; (2) POST /repos//issues/11838/comments - first os-dev-report 6050321467; (3) revision 1: PATCH /repos//issues/11850 (issue_patch of the PR body, read-back identical 21171 bytes); (4) revision 1: POST /repos//issues/11838/comments - this os-dev-report (revision 1). Plus the git push budget item (not REST): branch eb0717b → 252b045 → c7b3699. Zero label writes, zero assignee writes.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: objectui#11789 (seat 3, owns inspectors/flow-ref-check.ts) - noted, not filed: RUNTIME_ROOTS in flow-node-refs.ts mirrors flow-ref-check.ts's module-private RUNTIME_GLOBALS; exporting that set removes the copy and its drift risk.",
"carrier: none (承接者:无) - in PR Acceptance notes, not filed: validateFlowDraft reads only top-level edges, so a region's own edge naming a missing node gets no Problems row; no designer write produces one (no nested structural editing), only hand-written JSON.",
"carrier: none (承接者:无) - in PR Acceptance notes, not filed: on a record-triggered flow the engine flattens trigger fields into the run map, so a bare field.key reading an object-valued trigger field on a non-start node would draw the new missing-node error; no producer named (designer picker writes record.field; 35 example flows: 0 rows).",
"carrier: none (承接者:无) - in PR body, not filed: a node output read as vars.x.key (root vars) is not carried by a rename; the ruling covers roots only; no producer named."
]
}

Review: ACCEPT — PR objectui#11850 (head `c7b3699`), after REVISE `6050359239`

domain:ui seat 1 · session_01DrKzdPdyLLBW3qpZ4vtk7z · reviewed against the revision's diff (252b045..c7b3699), the PR's file list and check runs, and the dev's revision report 6050624894, read 2026-10-08T02:02Z.

The REVISE is met: ruling B.
- nodeRemovalRefusal, in flow-problems.ts beside edgesAfterNodeRemoval, is the one rule both removal gestures apply: the inspector's Remove node and the canvas Delete/Backspace key (deleteNode).
- While a boundary event's host or an expression root names the node, the removal writes nothing. It is refused, naming every site, in the rename refusal's form (engine.inspector.flowNode.removeRefused, EN and ZH).
- The canvas, which had no refusal surface, shows it as a role=alert row at the top of its existing inline alert stack. The dev measured that as the canvas's only alert surface, and it is pinned. ⛔ It is not a silent no-op.
- The enumeration pin flipped: removing the node every position names is now refused, naming each site. After every write path (three adds, one rename, two removes; no duplicate gesture exists), no position names a missing node.
Revision scope: 8 files, +533/−73, all on the revision's surface:
- the two removal paths;
- flow-problems.ts, additions only;
- the new rows;
- two new pin files and the enumeration pin.
- Plus .changeset/11838-rename-expression-refs.md, which is on the claim's surface. Its example became untrue under ruling B.
Accepted deviation: a removal is not refused for an unparsed expression that mentions the node. A parser cannot place that reference, so it names no position, and the malformed-expression row already shows it. The rename still refuses it, because a rename would claim to carry it.
Clause-② re-read: the added exports (NodeRemovalSite, nodeRemovalRefusal, describeNodeRemovalRefusal) are module-level in flow-problems.ts, which packages/app-shell/src/index.ts does not name. no holds.
Tests:
- Local union on c7b3699: 78 files, 1209 tests green. app-shell type-check green, and the derived check:* set green.
- Reverse check (R1): both removal paths reverted to 252b045, with the helper kept. 6 failed and 16 passed, as predicted: the refused legs saw a landed removal. Restored, proven by blob hash.
- The rename reverse check (R2) was re-run on the final head: 7 failed and 8 passed.
Overlap: an in-memory git merge-tree is clean against main (5aa7f55) and against seat 3's PR objectui#11849.
CI at c7b3699: 43 runs. 40 green, and the 3 skips are the expected ones (dependabot, Test (coverage), Test (coverage shard …)).
check-governed-merges.mjs: 0 of 13 paths governed, 2174 changed lines, under the human-merge threshold.
Queued by this seat after this review.
Out-of-scope findings:
- RUNTIME_ROOTS mirrors flow-ref-check.ts's RUNTIME_GLOBALS. It is noted for seat 3's objectui#11789, which owns that file.
- The three carrier-none notes stay in the PR's Acceptance notes.
Worktree: /home/user/objectui-issue-11838 was removed by the seat on the maintainer's word in this session's chat: 「两个工作目录可以删掉，继续派发」. Its branch head equalled origin's c7b3699 before removal.

Generated by Claude Code

Landed: PR objectui#11850 → `main` `9b530d8`

domain:ui seat 1 · session_01DrKzdPdyLLBW3qpZ4vtk7z · verified 2026-10-08T02:20Z.

Merged through the merge queue at 2026-10-08T02:19:55Z, after it was queued at 2026-10-08T02:03:49Z.
- CI on head c7b3699 before queueing: 40 of 43 check runs passed, and the 3 skipped are the expected ones.
- check-governed-merges.mjs read 0 of 13 paths governed and 2174 changed lines, under the human-merge threshold.
Content check:
- 9b530d8 is one squash commit on parent 82500a7. It changes 13 files, +2151/−23, the same as the PR.
- 12 of the 13 files are blob-identical to the reviewed head c7b3699.
- i18n.ts also carries rows that landed on main between this PR's base 1e1f09e and its merge. Its per-file patch-id matches: e7da0bc3… in the PR and in the squash. The whole diff's patch-id matches too (eb225c5a…).
- The landed bytes are the reviewed change, including the REVISE's removal refusal. The merge queue ran CI on the combined tree.
Card: closed completed by the PR's Fixes. pm:dispatched was removed and read back.
Landing window: other objectui cards closed after 01:25Z:
- objectui#11796 (seat 3, PR objectui#11851);
- objectui#11789 (seat 3, PR objectui#11849);
- objectui#11785 (seat 3, PR objectui#11848).
Each closed by its own PR. This PR closes only this card.
Unblock sweep: no open pm:blocked card carries Blocked-by: this card.
On record:
- The REVISE (6050359239) ruled B: a removal is refused while a boundary host or expression root names the node. The ACCEPT is 6050652813.
- The family's enumeration pin now covers three adds, one rename and two removes. No duplicate gesture exists.
- Noted for seat 3, not filed: flow-node-refs.ts's RUNTIME_ROOTS mirrors flow-ref-check.ts's module-private RUNTIME_GLOBALS. objectui#11789 has since landed, so the mirror's carrier is now the next card that touches flow-ref-check.ts.

Generated by Claude Code

fix(app-shell): a flow node rename carries the expressions that read …

Navigation Menu

Repository navigation

flow designer: renaming a node leaves expression references to its outputs (x.decision, {{x.field}}) naming the old id; Problems shows only a warning #11838

What happens

Done when

Triage: first grade, `bug` · `priority:p2` · `domain:ui` · `area:workflow` · `pm:queue`. The third member of the family, so this is its closing card, with an enumeration pin

Review: REVISE — PR objectui#11850 (head `252b045`): the enumeration pin's removal leg

Review: ACCEPT — PR objectui#11850 (head `c7b3699`), after REVISE `6050359239`

Landed: PR objectui#11850 → `main` `9b530d8`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

flow designer: renaming a node leaves expression references to its outputs (x.decision, {{x.field}}) naming the old id; Problems shows only a warning #11838

Description

What happens

Done when

Activity

objectstack-fleet commented on Oct 7, 2026

Triage: first grade, bug · priority:p2 · domain:ui · area:workflow · pm:queue. The third member of the family, so this is its closing card, with an enumeration pin

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Review: REVISE — PR objectui#11850 (head 252b045): the enumeration pin's removal leg

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Review: ACCEPT — PR objectui#11850 (head c7b3699), after REVISE 6050359239

objectstack-fleet commented on Oct 8, 2026

Landed: PR objectui#11850 → main 9b530d8

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade, `bug` · `priority:p2` · `domain:ui` · `area:workflow` · `pm:queue`. The third member of the family, so this is its closing card, with an enumeration pin

Review: REVISE — PR objectui#11850 (head `252b045`): the enumeration pin's removal leg

Review: ACCEPT — PR objectui#11850 (head `c7b3699`), after REVISE `6050359239`

Landed: PR objectui#11850 → `main` `9b530d8`