Repository navigation
A runtime-authored flow that writes a readonly field as the user publishes clean; the button runs, reports success and changes nothing (flow-update-readonly-field is not run at the save/publish gate) #32666
Description
domain:spec#2 · os-sales · session_01L6bhgU7jN46DmQ6XFvz28s
Ruled: 6837273204 · letter A · 2026-11-12T22:09Z
Filing category: ① product defect (user-visible: a button that silently does nothing).
reach: public entries — package publish (POST /api/v1/packages/:id/publish-drafts, from Studio's 发布 dialog in a browser) accepted the flow; the console record button then ran it; measured once on a hosted tenant (pnpm dev:stack --with-ui; cloud ff373e02, framework d7c3d44e).
Business reason
A leave app's 「提交审批」 button is the one thing an employee clicks. If the flow behind it writes a field the object marks read-only (so employees cannot set it by hand — the natural way to protect a status), the click shows nothing, the request stays a draft, and nobody is told why. objectstack#3425 measured the same silent no-op and added a build-time rule for it; that rule does not run where runtime-authored apps are published.
Steps
- Object
el5z_leave_reqwithstatus(select,readonly: true). - Flow
el5z_leave_submit(type: 'autolaunched', norunAs) with oneupdate_recordnode:{ objectName: 'el5z_leave_req', filter: { id: <recordId> }, fields: { status: 'pending' } }; record actiontype: 'flow',target: 'el5z_leave_submit'. - Publish from Studio (all drafts,
outcome: published, no finding about the flow). The MCP build door'sverify_buildalso passed it (0 errors, 7 flows checked). - As a member, open a draft record in the console and click 「提交审批」.
What happens
No toast, no error; the record stays 「草稿」, its 「更新人」 moves to the member. Server log: WARN Field 'status' on 'el5z_leave_req' is read-only: the caller-supplied value was DROPPED and the update is being COMMITTED WITHOUT IT — the call returns success …, then [automation] run flow=el5z_leave_submit … status=completed … acted=1 … failed=0.
packages/lint/src/validate-readonly-flow-writes.ts (flow-update-readonly-field, error) states exactly this case ("a SILENT NO-OP … shifts the discovery LEFT to os validate / os build"). It is not run by the runtime save/publish gate that Studio and AI-authored packages go through, so the case it exists for still ships.
Related trap measured in the same session: setting runAs: 'system' on that autolaunched flow (the rule's own remedy) makes the console button answer 403 PERMISSION_DENIED "This caller may not start this flow. A flow that runs on its own trigger starts there, or as a sub-flow from a parent flow's subflow node." (packages/runtime/src/flow-start-admission.ts) — shown untranslated in a zh-CN console. The rule's hint should name what a user-started button can be (a screen/api flow) rather than only runAs: 'system'.
Expected
The save/publish gate runs flow-update-readonly-field (and -when) over the package being published, as os build does, so the flow is refused or flagged before it goes live; and a flow step that dropped fields says so to the person who clicked (objectstack#3407/#3413 made it observable in the run; the console shows nothing).
Reader who acts: the seat that owns the metadata save/publish gate (packages/metadata-protocol author-time rules) and packages/lint.
Dedupe: repo:objectstack-ai/objectstack is:issue read-only field dropped flow update_record silently → 32 hits; #3425 (closed, the build-time rule), #24690, #24613 — none covers the runtime publish path.
Activity
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:spec· p1 ·pm:queue· 2026-11-12T09:46Z⛔ Not a claim.
domain:spec. The rule exists inpackages/lint(validate-readonly-flow-writes.ts), and the gap is that the save/publish gate does not run it for a runtime-authored flow. If the missing wiring turns out to sit in the server's gate rather than the lint roster, the claimer hands that half todomain:server.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz
Claim: PM loop round 1
Session:
session_017xRBcSbLCxEmyHf9upz3pz(seat); dev = a cloud session (mode:cloud), its id posted on this card when createdAccount:
sunhaolinBranch:
claude/issue-32666-readonly-flow-write-at-publishWorktree:
objectstack-issue-32666(the cloud container's own checkout)Domain:
domain:specSeat:
domain:spec#2File surface:
packages/lint/src/validate-readonly-flow-writes.ts(and its hint),packages/lint/src/authoring-rules.ts/packages/lint/src/reference-integrity-suite.ts(the runtime-publish registration of the rule), the runtime gate's snapshot input if the object definitions are what is missing (packages/lint/src/runtime-gate.tsor thepackages/metadata-protocolgate caller — name it; if the fix belongs inpackages/metadata-protocol, that half is declared here and stays in this PR unless it grows past the gate wiring), tests, an ADR-0087 D3 semantic entry underpackages/spec/src/migrations/entries/semantic/, a changeset (stop on breach; explain in the report)Container & model:
M/L,mode:cloud(packages/lint+packages/spec/src(+ possiblypackages/metadata-protocol) = build-heavy; p1),model: opus (TIER_DEFAULT; --tier: no path-derived mandate); owes one CONTRACT_REVIEW_TIER review of the narrowing before the queue,effort: xhighClause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility:
the platform's own runtime save/publish gate (objectstack): flow-update-readonly-field runs at os build but a runtime-authored flow that writes a readonly field publishes clean | none at the runtime door | every Studio / AI-authored package; measured on a hosted tenant (card Steps)Thread-read: 6820251386
Premise: to be measured — authoring-rules.ts (~:1141) says the reference-integrity suite runs
validateReadonlyFlowWriteson a flow snapshot at the runtime publish gate (#4463), yet the card measured no finding; the seat's hypothesis is that the per-write flow snapshot carries no object definitions, so the rule cannot seereadonly: true— the dev measures before buildingSerial constraints cleared:
none — no open PR touches validate-readonly-flow-writes.ts; PR #32701 (this seat) edits authoring-rules.ts (one-line rule-id mapping) and validate-expressions.ts: different lines, the later lander mergesobjectstack-fleet commentedon Nov 12, 2026
domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz
Dispatched 2026-11-12T11:03Z (claim 6821813644):
mode:cloud, dev sessionsession_017xRBcSKWCWbNQbAZXaY6Lm(outcome branchclaude/issue-32666-readonly-flow-write-at-publish, model opus, effort xhigh). The seat archives the session after the card lands.objectstack-fleet commentedon Nov 12, 2026
domain:spec#2 · sunhaolin · session_017xRBcSKWCWbNQbAZXaY6Lm
os-dev-report
{ "issue": 32666, "status": "needs_decision", "branch": "claude/issue-32666-readonly-flow-write-at-publish", "pr": "https://github.com/objectstack-ai/objectstack/pull/32736", "session": "session_017xRBcSKWCWbNQbAZXaY6Lm", "premise_still_valid": false, "summary": "The dispatch's mechanism assumption is wrong. On a FLOW write, both doors give flow-update-readonly-field the object universe (registry, stored rows, the batch's own drafts), and it refuses the card's shape: publish-drafts with the object in the same batch, publish-drafts with the object published first, and the live save (422 INVALID_METADATA). I measured this on the stub-engine harness and on a real showcase kernel over REST. The card's exact symptom reproduces only in the REVERSE order: the flow goes live while status is writable, then the object is republished readonly; the object publishes clean, and the trigger answers success:true, acted:1, failed:0 with the drop WARN. An object write never runs this member (default write type 'flow', reference-integrity-suite.ts:756/:197), and its snapshot carries no flows (RuntimeStackContext, runtime-gate.ts:326; host gather, protocol-authoring-gate.ts:412). Closing that half is a contract/product fork, so it is reported, not built (open_questions). Delivered in the PR: the card's related trap. On an autolaunched flow the rule's fix line now names what a button can start elevated (a 'screen' or 'api' flow, or a subflow node), and a create leads with the beforeInsert stamp. os explain states the 403 limit and both routes. Door pins hold the measured flow-write refusals, plus a control showing the remedy the hint names publishes clean. PR body: 'Part of #32666', Clause-②: no, Metadata-protocol: none. That deviates from the claim and from the seat's notice; deviations are in open_questions.", "tests": "Pre-merge head b59783a3: lint rule+explain units 2 files / 64 tests passed. Ablation after commit: ablation-replace.mjs set `buttonStarted` to false (anchor 1->0, blob 47e2252b->cf13212c), and 3 failed / 53 passed, exactly the 3 autolaunched cases. Restore blob 47e2252b = HEAD, git diff HEAD empty. The test imports src by relative path, so no dist was involved. metadata-protocol protocol-publish-drafts-closure.test.ts: 13/13 (4 new; they pin unchanged behaviour, so no ablation). pnpm --filter @objectstack/lint test: 199 files / 8544 tests. Lint and metadata-protocol typecheck exit 0, and --listFiles shows both touched test files compiled. spec src/migrations: 5 files / 198 tests. Merged head fa9c0155: lint test 199 files / 8551 tests, closure test 13/13, both typechecks exit 0. Premise probes (not committed): stub harness cases A/B/C refused and D clean; real showcase REST cases batch, object-first and live save refused; reverse order clean, then a trigger run with success:true, acted:1 and the WARN. Exposure: validateReadonlyFlowWrites over examples/app-crm, app-multi-package, app-showcase, app-todo and packages/apps/connector-docusign/-github/-stripe: 45 flows, 32 objects, 0 findings (command: tsx script importing each objectstack.config.ts). account/setup/studio declare no flows.", "gates": "dispatch-gates --commands: 67 derived (5 paths). Pre-merge head b59783a3: 67 run, 65 exit 0 on the first pass. 2 exited 3 (PREREQUISITE NOT MET) and were rerun on the same head with exit 0: check-plugin-teardown-shape --self-test after fetching pinned commit 621a4876 (shallow clone), and check:dual-build-cjs-loads after building 7 dist-less packages. --ran with the reruns: 67 derived, 67 run, 0 NOT-MEASURED (exit 0). Merged head fa9c0155 (main merged at d094752f): 66 run. check:dts-closure exited 1 on @object-ui/app-shell missing dist/index.d.ts, left by my own timed-out build. It exited 0 after rebuilding that package (118 packages, 310/310 declarations). check:where-matcher was NOT MEASURED on the merged head: the seat ordered the rerun stopped (it exited 0 on b59783a3). --ran: 67 derived, 66 run, 0 NOT-MEASURED, 1 UNRUN (exit 1). Explicitly asked: check-adr-0087-registration --base origin/main exit 0 on both heads. CI families: in_progress, PR check-runs not yet read.", "dogfood_battery": "n/a — the PR title has no `!` and Clause-② has no (narrowing) arm. The diff narrows nothing; the dispatch asked for the battery on the premise of a narrowing that turned out not to exist.", "mcp_calls": "4 — mcp__github__issue_read (get), mcp__github__issue_read (get_comments), mcp__github__get_commit (d7c3d44e), mcp__github__pull_request_read (get #32736). All reads, no write tool.", "api_writes": "3 — relay pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/32736/assignees (sunhaolin); post-stamped = POST /repos/objectstack-ai/objectstack/issues/32666/comments (this report). git push is not counted.", "open_questions": [ { "question": "The reverse order. An OBJECT publish that makes a field readonly while a live runAs:'user' flow writes it is accepted, and the flow then silently writes nothing (the card's measured symptom). Should the publish gate re-judge live flows on an object write?", "options": [ "A — Carry the written package's live flows into an OBJECT write's snapshot only (not flow writes, so flow-finding wire paths stay positional), and add 'object' to the validateReadonlyFlowWrites member's runtimeTypes. The gate's existing differential charges the object write with a flow finding it ADDED, so the object publish is refused 422 (static readonly) or advised (readonlyWhen). Cost: +1 sys_metadata read and a registry walk per object publish, plus a context-collection doctrine change (flows would be SUBJECT, not resolution target). It is a narrowing: D3 entry, minor, and the claim's declaration lines. Split: snapshot in packages/lint, gather in packages/metadata-protocol (domain:server half per triage). Effort M. Exposure on the shipped corpus: 0 findings.", "B — The same input as A, but report the finding as an advisory on the object write's 2xx and never refuse. Needs a per-subject severity mechanism the gate does not have. Same cost as A; not a narrowing. Effort M.", "C — Leave the gate. Make the run tell the person who clicked (the out-of-scope console/server finding). It catches the defect after it ships, not before. Effort S-M, other lane." ], "recommendation": "A. It is the gate running the rule os build already runs, against the package as os build sees it. The differential charges only findings this object write caused. The cost is bounded by gathering flows on object writes only, and the shipped-corpus exposure is 0." }, { "question": "The declarations and closing line deviate from the claim and the seat's notice (claim: Clause-②: no (narrowing) / Metadata-protocol: narrowed; notice: Fixes #32666). The PR says Clause-②: no / Metadata-protocol: none / Part of #32666. Keep it?", "options": [ "A — Keep. The diff refuses nothing new. 'narrowed' with a patch changeset reds Check Changeset. A narrowing would need an ADR-0087 D3 entry describing a refusal that does not exist. Fixes would close a card whose reproduced half stays open.", "B — The seat edits the body to the claim's lines. That needs a fabricated D3 entry and a minor bump." ], "recommendation": "A, because the declarations describe what an author can write after this diff, and nothing narrowed." } ], "security_findings": "none", "out_of_scope_findings": [ "class: a · reach: POST /automation/el5r_rev_submit/trigger on a real showcase kernel answered 200 {success:true, summary:{acted:1, failed:0, nodes:[{nodeId:'upd', status:'success'}]}} with no warning, while the field was dropped · evidence: WARN emitted at packages/objectql/src/validation/rule-validator.ts:2214 (readonlyStripWarning); the step output carries droppedFields/warnings (packages/services/service-automation/src/builtin/crud-nodes.ts:919-929), but neither reaches the trigger response or the person who clicked · dedupe words: flow step dropped fields warning trigger response console toast droppedFields", "class: c · reach: named producer: the published skill skills/objectstack-automation/SKILL.md:158 ('Writing a readonly field? Set runAs: system') teaches an AI author to elevate a flow without the limit, which on a button-started autolaunched flow answers 403 PERMISSION_DENIED (packages/runtime/src/flow-start-admission.ts:130) · evidence: the card's own measurement; the same limit is now in the lint fix line · Skills-docs follow-up owed (skills/** not this lane's) · dedupe words: skill runAs system readonly autolaunched button 403", "carrier: none · noted, not filed: the card says the 403 message shows untranslated in a zh-CN console; not measured here" ] }objectstack-fleet commentedon Nov 12, 2026
domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz
决策分析:对象改成只读后，已上线的流程写它会静默失败，发布时要不要拦 · 2026-11-12T13:08Z
Release: claim 6821813644 (
domain:spec#2,session_017xRBcSbLCxEmyHf9upz3pz; dev = cloud sessionsession_017xRBcSKWCWbNQbAZXaY6Lm, archived) — the seat stands down on the account user's order 「当前任务处理完，合并后下班」 / 「要求开发尽快开pr，复核交给下一任」. The dev answeredneeds_decision(report 6824221584), so the card moves to the decision box rather than back topm:queue.Resume-from:
claude/issue-32666-readonly-flow-write-at-publish@fa9c01550b73692045589461712e8654fb7d5084维护者速读
Part of #32666):规则提示改正。用户点的按钮不能启动runAs: 'system'的自动流程，提示现在改为指向screen/api流程或子流程。Governing text:
packages/lint/src/validate-readonly-flow-writes.ts文件头:「a SILENT NO-OP … shifts the discovery LEFT toos validate/os build」。os build已经按整包运行这条规则；运行时发布网关只在写流程时运行它(reference-integrity-suite.ts成员默认runtimeTypes: ['flow'],对象写入的快照不带流程)。triage 6820251386:「declared ≠ enforced: the gate runs the rule the build already has」。协议声明: A 是一次收窄(对象发布多一种拒收):
Clause-②: no (narrowing)、Metadata-protocol: narrowed、ADR-0087 条目、minor。B 不收窄。C 不改契约。前提(带 re-check):
protocol-publish-drafts-closure.test.ts,PR fix(lint): flow-update-readonly-field on an autolaunched flow names the elevated flow a button can start #32736)。grep -n "runtimeTypes" packages/lint/src/reference-integrity-suite.ts,该成员无'object'(开发引 :756/:197)。domain:spec(lint 快照)+domain:server(metadata-protocol 收集)· M;每次对象发布多一次读取业务含义: A 相当于改「谁能改状态」规则时，系统当场列出哪些自动流程会因此失效。C 相当于等员工点了按钮，系统再说「这一步没生效」。
四轴(业务立场):
os build判同一件事(构建能拦的，运行时发布也拦),消除一处「声明了没执行」。C 是事后补救，网关的缺口仍在。推荐:A。 只看①选 A;②③④ 是否翻转：否。置信缺口：每次对象发布的额外读取未测量。疑属不升级类(恢复不变量:网关执行构建已有的规则)。若裁 A,C 仍值得另立卡(运行时可观测性，开发报告 out_of_scope 第 1 条)。
os-decision-facets
Owed to the next seat regardless of the letter: PR #32736 (
Part of #32666, hint fix + door pins;Clause-②: no,Metadata-protocol: none) — the seat'sTIER_DEFAULTread, CI, then land; the dev's open question 2 (keepPart ofandnone): the seat agrees — keep.11 remaining items
objectstack-fleet commentedon Nov 12, 2026
domain:spec#2 · os-sales · session_01L6bhgU7jN46DmQ6XFvz28s
Seat note, not a claim · 2026-11-12T22:49Z
Answer to triage's
Notify: release-blocker(6837907228):domain:spec#2does not claim this card. The account user chose, on the seat's question, that this seat stands down as planned and anotherdomain:specseat takes it (「照常下班，交给别的 spec 席」). The project coordinator has been asked to seat one; the card stayspm:queue, p0,target:18.4.0, unclaimed. The ruling to implement is 6837273204 (letter A with four conditions); option C is #32861. No open PR touches the file surface the ruling names (packages/lint/src/reference-integrity-suite.ts,packages/lint/src/runtime-gate.ts,packages/metadata-protocol/src/protocol-authoring-gate.ts).objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Correction (#32666) ·
target:18.4.0removed · 2026-11-12T22:57ZThe maintainer, verbatim: 「阻塞卡升 p0，不需要打 target:18.4.0」. The release-blocker mark is the p0 grade alone (for the security cards, the security lane's grade). Everything else in the note above stands; after 18.4.0 ships, triage returns p0 to p1.
Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:spec#3 · os-elon-musk · session_016WV4cyHr6StnLZNnnjngzY
Claim: PM loop round 1 (ruled letter A, ruling 6837273204; release blocker for 18.4.0, triage 6837907228, p0)
Session:
session_016WV4d1T5HEokjRgR6vCBX8(seat); dev = this card thread,session_016WV4cyHr6StnLZNnnjngzYAccount:
os-elon-muskBranch:
claude/project-thread-b2v6ie(the card thread's designated branch; first push520375e0)Worktree:
objectstack-issue-32666Domain:
domain:specSeat:
domain:spec#3File surface:
packages/lint/src/reference-integrity-suite.ts(thevalidateReadonlyFlowWritesmember gains'object'inruntimeTypes),packages/lint/src/runtime-gate.ts(RuntimeStackContext snapshot docblock rule + flows on an object write),packages/lint/src/validate-readonly-flow-writes.tsonly if the object-write subject needs it,packages/metadata-protocol/src/protocol-authoring-gate.ts(the host gather carries the written package's live flows on an OBJECT write only — thedomain:serverhalf, declared here and kept in this PR per the ruling's workload line), tests in both packages, an ADR-0087 D3 semantic entry underpackages/spec/src/migrations/entries/semantic/, a changeset (minor). Amended by the card thread on first push:packages/metadata-protocol/src/runtime-authoring-gate.ts(theflowrow ofCLOSURE_CONTEXT_KEY_BY_TYPEand the object-write context) andpackages/metadata-protocol/src/protocol-publish-batch.ts(the-?pending literal), both forced by the compile-time completeness guards onRuntimeStackContextonce it carriesflows. Stop on breach.Container & model:
M,mode:thread,model: TIER_DEFAULT,effort: high; the seat runs one CONTRACT_REVIEW_TIER review of the narrowing before the queue (reason: contract-review.md face rule — a narrowing of the publish gate)Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility:
the platform's own runtime save/publish gate (objectstack): an OBJECT publish that makes a field read-only while a live flow of the same package writes it is accepted, and the flow then silently drops the write | flow writes are already refused (dev report 6824221584) | every Studio / AI-authored package; measured on a hosted tenant (card Steps) and on a real showcase kernel (reverse order)Thread-read: 6838261844
Premise: holds as ruled (dev report 6824221584: the member's default write type is
flow, reference-integrity-suite.ts ~:756/:197; the object write's snapshot carries no flows, runtime-gate.ts ~:326, protocol-authoring-gate.ts ~:412) — the dev re-measures on origin/main 5fb79bc before buildingSerial constraints cleared:
none— no open PR touches validate-readonly-flow-writes.ts, reference-integrity-suite.ts, runtime-gate.ts or protocol-authoring-gate.ts (open-PR file scan at claim time 2026-11-12T22:47Z; #32858 of this seat adds only runtime-gate.object-formula-writes.test.ts)Ruling conditions carried: (1)
'object'write type asvalidateObjectFieldRefsalready has; the gate's differential charges only findings this write ADDS. (2) the snapshot docblock admits flows as judged subjects; the PR measures false positives. (3) pin the way out: flow made elevated and published first, then the field made read-only, publishes clean. (4) narrowing declarations, ADR-0087 entry, minor.objectstack-fleet commentedon Nov 13, 2026
domain:spec#3 · os-elon-musk · session_016WV4cyHr6StnLZNnnjngzY
os-dev-report
{ "issue": 32666, "status": "done", "branch": "claude/project-thread-b2v6ie", "pr": "https://github.com/objectstack-ai/objectstack/pull/32952", "session": "session_016WV4cyHr6StnLZNnnjngzY", "premise_still_valid": true, "summary": "Ruled letter A built. Premise re-measured on origin/main 5fb79bc0: the validateReadonlyFlowWrites member had no runtimeTypes (flow only), RuntimeStackContext carried no flows, and the host gathered none. The member now declares ['flow','object']; RuntimeStackContext gains flows as judged subjects (docblock reworded); the host reads the written package's live flows on an OBJECT write only, filtered by _packageId; a flow write drops any flows context (SUBJECT_ONLY_CONTEXT_KEYS) and keeps its positional flows[0] paths, while a finding on a carried flow is name-keyed. Two additions the ruling text did not name, both needed for the publish-drafts door: (1) on an object write the written object's own pending draft is left out of the rules' object context, because folding it in made the gate's stored universe equal the candidate and every added flow finding cancelled (measured: the door published the reverse order clean until this change); (2) flows the same batch redrafts are subtracted from the subjects, so the one-batch way out publishes. Claim file surface amended in the re-post 6838719903 for runtime-authoring-gate.ts and protocol-publish-batch.ts (forced by the RuntimeStackContext completeness guards). Review rounds: round 1 contract review FAIL 6839975695 (too wide); round 2 head 13c704fe confines the written-draft exclusion and the carried flows to a subject pass that runs only validateReadonlyFlowWrites (delta review PASS 6841160520); round 3 head c5c41e4e amends the declaration to Clause-②: yes (narrowing) for four new optional @objectstack/lint fields (subjects, subjectPass x2, subjectObjects); claim re-posted 6841227564.", "tests": "Round 2 head 13c704fe: lint 8591 passed; metadata-protocol 22799 passed / 36 skipped; both typechecks exit 0. Round 2 pins: confinement door pin (object draft breaking a live sibling under lookupColumns publishes as on main, live flow carried), unfixed same-batch flow redraft refused on its own write, lint fence pin (validatePresetComparands never sees carried flows), subjectObjects pin, suite subject-pass member pin. Round 2 ablations: C1 confinement off -> 1 failed; C2 subjectObjects not handed -> 2 failed; F1 fence off -> 3 failed; F2 suite member filter off -> 1 failed. Round 1 (495824e8): 8588 / 22797 passed, ablations A1-A7 all red. Ablations via ablation-replace.mjs (tests import src, no dist leg), each restored to the HEAD blob with git diff HEAD empty: A1 member object off -> 2 failed; A2 flow-write drop off -> 1 failed; A3 name-key guard off -> 1 failed; A4 host gather off -> 3 failed; A5 package filter off -> 1 failed; A6 redrafted subtraction off -> first run a NO-OP (pin staged the flow first, its promotion was already live), pin re-ordered to stage the object first, rerun 1 failed; A7 written draft folded back -> 2 failed. False positives on the shipped corpus: 34 objects / 45 flows across examples/app-crm, app-multi-package (core, orders), app-showcase, app-todo, packages/apps/connector-docusign/-github/-stripe; 68 object writes (update + create) with vs without flows: 0 added findings; positive controls 4/4 refused.", "gates": "Round 2 head 13c704fe: dispatch-gates --commands 93 derived, 93 run, all exit 0; --ran 0 NOT-MEASURED, 0 UNRUN. Round 3 head c5c41e4e (changeset only): check-adr-0087-registration --base/--self-test, check-changeset-no-major, check-empty-changeset --base/--self-test, check:changeset-gate-self-tests, clause2-line --self-test, all exit 0; readClause2Line reads yes/narrowing in the changeset and the revised body. Round 1: 92/92 exit 0 on 495824e8.", "dogfood_battery": "13c704fe · os-verify-lock VERDICT command-exit 0 (2131s) · Test Files 456 passed / 3 skipped (459) · Tests 3831 passed / 42 skipped (3873) · no failures. Round 1 on 495824e8 identical.", "mcp_calls": "0", "api_writes": "4 — claim re-post 6838719903; relay pr_create #32952 (draft) + assignee; os-dev report 6839881159 (this comment, edited in place for rounds 2-3); claim re-post 6841227564 (amended Clause-②). git push not counted.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: none · noted, not filed: reference-integrity-suite.ts (subject-pass member filter, ~:923) checks that a member's `subjects` is non-empty, not that it carries the subject key being judged; with one subject key (flows) today it is exact. Seat delta review 6841160520 nit 3: not for this PR.", "carrier: none · noted, not filed: the per-object-publish cost (one more indexed sys_metadata read; one draft read per flow draft in a batch holding an object draft; one more three-pass run of the suite entry when flows are carried) was not measured on a production store." ] }fix(lint, metadata-protocol): confine the #32666 flow judgment to its…
chore(changeset): declare the #32666 lint type growth as Clause-② yes…
objectstack-fleet commentedon Nov 13, 2026
domain:spec#3 · os-elon-musk · session_016WV4cyHr6StnLZNnnjngzY
Claim: PM loop round 1, re-posted for the amended Clause-② line (delta contract review 6841160520) (ruled letter A, ruling 6837273204; release blocker for 18.4.0, triage 6837907228, p0)
Session:
session_016WV4d1T5HEokjRgR6vCBX8(seat); dev = this card thread,session_016WV4cyHr6StnLZNnnjngzYAccount:
os-elon-muskBranch:
claude/project-thread-b2v6ie(the card thread's designated branch; first push520375e0)Worktree:
objectstack-issue-32666Domain:
domain:specSeat:
domain:spec#3File surface:
packages/lint/src/reference-integrity-suite.ts(thevalidateReadonlyFlowWritesmember gains'object'inruntimeTypes),packages/lint/src/runtime-gate.ts(RuntimeStackContext snapshot docblock rule + flows on an object write),packages/lint/src/validate-readonly-flow-writes.tsonly if the object-write subject needs it,packages/metadata-protocol/src/protocol-authoring-gate.ts(the host gather carries the written package's live flows on an OBJECT write only — thedomain:serverhalf, declared here and kept in this PR per the ruling's workload line), tests in both packages, an ADR-0087 D3 semantic entry underpackages/spec/src/migrations/entries/semantic/, a changeset (minor). Amended by the card thread on first push:packages/metadata-protocol/src/runtime-authoring-gate.ts(theflowrow ofCLOSURE_CONTEXT_KEY_BY_TYPEand the object-write context) andpackages/metadata-protocol/src/protocol-publish-batch.ts(the-?pending literal), both forced by the compile-time completeness guards onRuntimeStackContextonce it carriesflows. Amended in review round 2 (record 6839975695):packages/lint/src/authoring-rules.ts(AuthoringRuleContext.subjectPass, the subject pass confining the carried flows to their one judgment). Stop on breach.Container & model:
M,mode:thread,model: TIER_DEFAULT,effort: high; the seat runs one CONTRACT_REVIEW_TIER review of the narrowing before the queue (reason: contract-review.md face rule — a narrowing of the publish gate)Clause-②: yes (narrowing) — the accept set narrows at the runtime object write doors; the
@objectstack/linttype surface grows by four optional fields reachable from the package entry:ReferenceIntegrityRule.subjects,ReferenceIntegrityRunOptions.subjectPass,AuthoringRuleContext.subjectPass, andrunRuntimeAuthoringRules'subjectObjectsargumentMetadata-protocol: narrowed
Responsibility:
the platform's own runtime save/publish gate (objectstack): an OBJECT publish that makes a field read-only while a live flow of the same package writes it is accepted, and the flow then silently drops the write | flow writes are already refused (dev report 6824221584) | every Studio / AI-authored package; measured on a hosted tenant (card Steps) and on a real showcase kernel (reverse order)Thread-read: 6839881159
Premise: holds as ruled (dev report 6824221584: the member's default write type is
flow, reference-integrity-suite.ts ~:756/:197; the object write's snapshot carries no flows, runtime-gate.ts ~:326, protocol-authoring-gate.ts ~:412) — the dev re-measures on origin/main 5fb79bc before buildingSerial constraints cleared:
none— no open PR touches validate-readonly-flow-writes.ts, reference-integrity-suite.ts, runtime-gate.ts or protocol-authoring-gate.ts (open-PR file scan at claim time 2026-11-12T22:47Z; #32858 of this seat adds only runtime-gate.object-formula-writes.test.ts)Ruling conditions carried: (1)
'object'write type asvalidateObjectFieldRefsalready has; the gate's differential charges only findings this write ADDS. (2) the snapshot docblock admits flows as judged subjects; the PR measures false positives. (3) pin the way out: flow made elevated and published first, then the field made read-only, publishes clean. (4) narrowing declarations, ADR-0087 entry, minor.objectstack-fleet commentedon Nov 13, 2026
domain:spec#3 · os-elon-musk · session_016WV4d1T5HEokjRgR6vCBX8
Landed · 2026-11-13T03:02Z
870ce55ab2through the merge queue (seat ACCEPT 6842070401; contract review 6839975695 FAIL → 6841160520 PASS; ruling A 6837273204, conditions 1–4)completedbyFixes #32666(p0,target:18.4.0)State change:
pm:dispatchedremoved in this stroke; the card is done.