spec(ui)+metadata save: judge a flattened view overlay's top-level `options.KIND` with the strict per-kind schema and persist the PARSED body — the door half of objectui#10380

[objectstack-fleet]

Ruled: 5910106571 · letter B (Q2) — a saved view stores the author's keys normalised by the parse, undeclared keys dropped, schema defaults not materialised; Q1 A · Q3 A as the seat answered · 2026-09-30T11:28Z
Ruled: 5856781584 · letter 甲 · 2026-09-27T14:48Z

Maintainer: 「20051 不考虑现有的数据」 — the stored-row census is waived; stage (iv) no longer waits on objectui#11013 (record 5909085121)

Filing gate ③: a ruled task. Director seat, summon #29 (session_01EcrTi7s5oDYPHS4Pi7h31d), executing objectui#10380 batch #223 item 5a, letter A. Maintainer verbatim: 「其他同意」. ⛔ Not a claim. Routing and grading are triage's.

What

PUT /api/v1/meta/view with a flattened list overlay passes the door through ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip() (packages/spec/src/ui/view.zod.ts, the listOverlay member). A top-level options bag is stripped unjudged: options.timeline.metaFields passes, while the same key written directly (timeline.metaFields) is refused unrecognized_keys. saveMetaItem then persists the original body verbatim, and objectui's interface page forwards view.options into the renderer. So a stored view carries and renders keys the strict schemas refuse, and it renders two ways (the object page does not forward options). This was measured by the objectui#10222 dev on the installed spec 17.4.0; the persistence step was read from source.

Deliverable (ruling A)

• The door judges each options.KIND present on a flattened overlay with that kind's strict schema, and refuses an out-of-contract key by name, exactly as the direct spelling is refused. options.map (the deliberately kept legacy path, pinned in objectui) stays accepted as far as its kind's schema accepts it.
• Persistence stores the parsed body, not the request body, so nothing unjudged reaches storage.
• Stored-row census before landing: how many stored views carry a top-level options.*, and which keys. The result goes on objectui#10380 and in the changeset; rows that fail the new judgement are named with their fix.
• Pins: a direct and an options-wrapped out-of-contract key get the same refusal; a legal options.KIND round-trips; the persisted body equals the parse result.

Unblocks

objectui#10380 (Blocked-by: this card). objectui then only aligns, so that the same stored view renders the same on the interface page and the object page. objectui#10222 (retiring the metaFields reads) does not wait on this card.

---

Generated by Claude Code

[objectstack-fleet]

分诊首次定级：priority:p2 · bug · domain:spec · pm:queue —— 维护者已裁定 A（objectui#10380）：保存视图时，扁平覆盖层顶层 options.KIND 要按各视图类型的严格校验来判，越界键按名字拒绝；存储改为存校验后的结果；落地前普查已存的视图

Path: packages/spec/src/ui/view.zod.ts（第 5636 行 ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()，列表覆盖成员）· packages/metadata-protocol/src/protocol.ts（第 15479 行 saveMetaItem，原样持久化请求体）

Triage: lands in packages/spec (the door) plus the metadata save in packages/metadata-protocol ⇒ domain:spec (the ruled door half leads; the persistence change travels with it), bug, priority:p2, pm:queue; rationale: ruling A on objectui#10380 (batch #223 item 5a, maintainer 「其他同意」, relayed by the director seat) — today a top-level options bag passes the door unjudged, is persisted verbatim and rendered, so a stored view carries keys the strict schemas refuse and renders two ways; p2 as on objectui#10380, which now waits on this card.

分诊席 #6015，2026-09-25T00:26Z。⛔ 不认领、不派发。本席读完了卡面（本卡尚无评论），也读了 objectui#10380 上总调度席位的裁决评论（5824043998），并在 objectstack origin/main 2274894cc4 上核对。

本席核对

• view.zod.ts 第 5636 行是 ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip()。本席定级 objectui#10380 时它在第 5619 行，之后有提交落地，行号变了，内容不变。
• saveMetaItem 在 packages/metadata-protocol/src/protocol.ts 第 15479 行。

定级说明

p2，与 objectui#10380 一致：严格校验被绕过，存下来的视图带着契约会拒绝的键，同一个视图在两个页面上显示不同。不涉及权限或数据损坏。

执行要点（照裁决 A）

1. 门口判定：扁平覆盖层上的每个 options.KIND 都按对应类型的严格校验来判，越界键按名字拒绝，和直接写的效果完全一样。options.map 这条有意保留的旧路径，在它自己那种类型的校验允许的范围内继续接受。
2. 存解析后的结果：saveMetaItem 不再存原始请求体，没经过判定的内容一律进不了存储。
3. 落地前先普查：已存的视图里有多少带顶层 options.*、都是哪些键。结果写到 objectui#10380 和更新说明里；新判定下会失败的行要逐个点名，并写明修法。
4. 钉子：直接写和包在 options 里写的越界键，得到相同的拒绝；合法的 options.KIND 能原样往返；持久化的内容等于解析结果。
5. 之后：objectui#10380 解锁，objectui 只需配合，让同一个存储视图在接口页和对象页显示一致。

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01QcAS3qiYYZNezaxZxaUdMV
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20051-view-overlay-options-kind-door
Worktree: objectstack-issue-20051
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface: packages/spec/src/ui/view.zod.ts, the flattened list-overlay door region only (the member built as ListViewShapeSchema.extend(flattenedViewOverlayFields()).strip() and the overlay options handling), plus its tests under packages/spec/src/ui/; packages/metadata-protocol/src/protocol.ts (saveMetaItem: persist the parsed body) plus its tests; generated artefacts regenerated, never hand-edited; .changeset/. packages/metadata-protocol is a domain:engine package; the persistence half rides this card per triage 5824570052, and this seat owes the cross-seat notice (stop on breach; explain in the report)
Container & model: M/L, mode:subagent, model: default judgment tier (dispatch-gates.mjs --tier at 8d1f7ab: 「no path-derived mandate … floor · default · ceiling」; a ruled cross-package door with design judgment; the at-tier contract review runs before enqueue in an isolated subagent)
Clause-②: no
Thread-read: 5824570052
Serial constraints cleared: read at 2026-09-27T02:37Z — Open-PR census (6 open PRs besides the release PR): none touches view.zod.ts or metadata-protocol/src/protocol.ts. In-flight claims (seat 1: #19867, #19543, #19856; seat 5: #19938, #19886, #19731, #18459, #17707; engine: #20135 core, #20055 turso; cli: #20129 rest-server; this seat: #19965, #19870) name neither file. Same-day churn: 8d1f7ab (merged today) touched view.zod.ts; 586934e (2026-09-25) touched protocol.ts saveMetaItem's page path.
Ruling-ref: objectstack-ai/objectui#10380 comment 5824043998

---

Scope, restated from the dev contract: 「范围 = 这张 issue,别无其它。」

[objectstack-fleet]

os-dev-report
{
"issue": 20051,
"status": "needs_decision",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV",
"premise_still_valid": true,
"summary": "Done in draft PR #20183 (first line Part of #20051): the door half of ruling A and the stored-row census. The persistence half needs a decision (Q1). The flattened list overlay member now declares options. Each options.KIND (kanban, calendar, gantt, gallery, timeline, chart, map, tree, derived from the shape) is judged key by key by that kind's own strict block, so an out-of-contract key is refused by name with the direct spelling's code and message at path options.KIND. options.foo is refused at options. The form overlay pins options absent: without that pin a column-less list body the list overlay refused would be accepted by the form member. The objectui options.map pin stays accepted and round-trips. H1 and H2 were both confirmed on 8d1f7ab: options was stripped unjudged, and saveMetaItem stored the request body with the bag byte for byte. Persistence half not implemented. Scoping it to view is clean in code, but measured through the real save, persisting the parse output would strip console round-trip state that objectui reads back (isPinned/sortOrder on flat overlays, visibility on ViewItem rows). It would also destroy a column-less list overlay that the form arm accepts, and it reverses ADR-0005 addendum (c), a Tier H surface (Q1). Census: objectstack @8d1f7ab has 0 view bodies with an options kind bag. objectui at pin f8a9d0fb0 and main c3a26ccda has 28 bag literals plus the finding's probe: 17 pass, 12 fail, and every failure is an out-of-contract key by name. Of those, 8 model stored or authored views: 5 pass, and 3 fail on options.kanban.groupField (write groupByField, ObjectView.tsx docblock), options.calendar.dateField (write startDateField, ObjectView.calendarAliasRefused-8355.test.tsx:203) and options.timeline.metaFields (delete it). 21 are renderer-level ListView props: 12 pass, and 9 fail on legacy spellings objectui already refuses. Production sys_metadata rows: NOT MEASURED, the store is unreachable from this container.",
"tests": "Suites at 62be049. spec vitest run --project local: 541 files, 15819 passed. New pin file src/ui/view-overlay-options-bag.test.ts: 22 passed, re-run at 1c6a4eb (comment-only edit): 22 passed. metadata-protocol full: 188 files, 2689 passed, 19 skipped. rest narrowed to the 17 view/meta-save files: 510 passed, incl. new meta-view-overlay-options-bag.test.ts (real RestServer + real protocol + SQLite: 422 INVALID_METADATA and 0 stored rows for both spellings; 200 with the options.map row unchanged). runtime narrowed to the 29 files reaching the save: 510 passed. typecheck spec/metadata-protocol/rest: exit 0 (the metadata-protocol and rest runs are on a dist rebuilt after a killed build; see deviations). Reverse verification, committed first (135027d): base view.zod.ts swapped in (on-disk grep -c ListViewOverlayOptionsSchema = 0), then the pin file: 19 failed, 3 passed (the three controls). Restore by git checkout HEAD: hash-object b4c9089ff4 equals the HEAD blob, git diff HEAD is empty. Before-state probe at 8d1f7ab through the real saveMetaItem (stub engine): the options.timeline.metaFields overlay saved success=true and the row equalled the authored body. NOT MEASURED: red leg of the metadata-protocol/rest pins against a base dist (needs two extra spec rebuilds).",
"gates": "At 1c6a4eb, dispatch-gates --repo objectstack-ai/objectstack --ran: 89 derived, 87 exit 0, 2 NOT MEASURED (pnpm check:dual-build-cjs-loads :: exit 3 and pnpm check:type-check-debt :: exit 3, both PREREQUISITE NOT MET, need the whole-repo build). Five spec gates first answered exit 3 (dist older than the final comment-only commit). They were re-run on a spec dist built from 1c6a4eb: check:api-surface, check:dual-source-exports, check:entry-nameability, check:exported-any and check:generated all exit 0 ('All 15 generated artifacts are up to date'). eslint --no-inline-config, narrowed to the 6 changed .ts files: all in population (--print-config resolves), --format json counts 6 files with 0 errors and 0 warnings, and eslint.config.mjs enables no type-aware linting (its own comment says so). check:nul-bytes exit 0; check:migration-registry exit 0.",
"line_budget": "n/a: no skills/** in the diff",
"deviations": [
"PR first line is Part of #20051, not the dispatch's Fixes #20051: the persistence half goes to the decision box, and the contract forbids Fixes on such a card.",
"Ruling item 2 (persist the parsed body) is not implemented. Stopped per H3 and the contract; see Q1.",
"The door judges options.KIND key by key (.partial() of the kind's strict block) rather than the whole block with its required keys. Measured: the whole block refused the per-key underlay bags objectui pins (ObjectView.namedViewProtocolKeys-8980), so the route changed per the ruling's intent (out-of-contract key refused by name; C ruled out). See Q2.",
"The form overlay pins options absent, outside the ruling's literal subject. Without it, the form arm accepted the bag the list overlay refused (measured on the unpinned change).",
"File surface beyond the claim line: packages/spec/src/migrations/entries/semantic/18.view-overlay-options-bag-judged.ts plus the regenerated registry.ts region (the ADR-0087 registration the breaking changeset needs, precedent .changeset/17499-groupbyfield-non-padded.md); docs/audits/2026-07-unknown-key-strictness-ledger.counts.md (regenerated, +1 strict site); packages/rest/src/meta-view-overlay-options-bag.test.ts (the consumer test the dispatch requires). The metadata-protocol cases ride the already-pinned engine double in protocol.graft-folded-form-sections.test.ts, so the engine-double ledger is untouched.",
"The claim's Clause-②: no is copied verbatim into the PR body and the changeset. The diff is an accept-set narrowing, so the changeset declares breaking via fix(spec)!: and **BREAKING** with ADR-0087 registered view-overlay-options-bag-judged. See Q3.",
"An outer timeout 595 around one os-verify-lock call killed a turbo build mid-run and left packages/spec/dist without .d.ts. It surfaced as TS7016 in a typecheck. Spec was rebuilt, then the typechecks and pins were re-run (all exit 0). Nothing was committed from that state.",
"Declared narrowings: rest tests narrowed to 17 files; runtime to the 29 files that reach the save (grep shows 0 view bodies carrying options in them); eslint to the 6 changed .ts files. CI runs the full sets."
],
"files_changed": [
".changeset/20051-view-overlay-options-bag-judged.md",
"docs/audits/2026-07-unknown-key-strictness-ledger.counts.md",
"packages/metadata-protocol/src/protocol.graft-folded-form-sections.test.ts",
"packages/rest/src/meta-view-overlay-options-bag.test.ts",
"packages/spec/src/migrations/entries/semantic/18.view-overlay-options-bag-judged.ts",
"packages/spec/src/migrations/registry.ts",
"packages/spec/src/ui/view-overlay-options-bag.test.ts",
"packages/spec/src/ui/view.zod.ts"
],
"mcp_calls": "0",
"api_writes": "3: relay dispatches via scripts/pm, each POST /repos/objectstack-ai/objectstack/dispatches. (1) pr_create, executed as POST /repos/objectstack-ai/objectstack/pulls, gave PR #20183 (draft), run 36299889172. (2) label-write --assign os-project-manager, executed as POST /repos//issues/20183/assignees, run 36299920613, read back MATCHES. (3) this os-dev-report comment, executed as POST /repos//issues/20051/comments. Plus git push to the branch (not REST).",
"open_questions": [
{
"question": "Q1. Ruling item 2 says 'the metadata save persists the parsed body'. Measured through the real saveMetaItem on 8d1f7ab, parsing then persisting a view body changes the stored bytes as follows. It strips isPinned and sortOrder from flat list and form overlays, sort[].id and filter[].id from console personalization PUTs, objectName (ADR-0005 addendum (c)'s own example), visibility and the undeclared columnState inner keys from ViewItem rows. It destroys a column-less, type-less list overlay that the form arm accepts: sort and searchableFields are stripped and type 'simple' is added. It rewrites exportOptions ['csv'] to { formats: ['csv'] } and materializes defaults (type 'grid', timeline scale 'week'). objectui reads isPinned, sortOrder and visibility back from stored rows (ObjectView.tsx VIEW_ROW_STATE_KEYS, ViewTabBar visibility grouping). ADR-0005 addendum (c) records the opposite decision, and three pins guard it (objectql protocol-meta.test.ts 'preserves Studio-only auxiliary fields verbatim', and two GUARDs in metadata-protocol protocol.graft-folded-form-sections.test.ts). How should the persistence half proceed?",
"options": [
"A. Persist the parse output for view as ruled. Prerequisites: (1) close the form-arm fall-through first, or it destroys rows; (2) declare every console round-trip key on each wire face (isPinned/sortOrder on the flattened overlays, visibility on the overlays and ViewItem rows; confirm objectName) or they are silently lost; (3) amend ADR-0005 addendum (c) (Tier H); (4) flip the three GUARD pins and align objectui. Cost: large and multi-surface. Gain: no undeclared top-level key reaches storage for view.",
"B. Keep the store as is (ADR-0005 (c) stands). After PR #20183 the door judges options, so every stored options bag is one the door judged and legal, and the finding's render path is closed. The residue is other undeclared top-level keys stored unread. Cost: none now. The wider invariant can be its own card later with A's prerequisites.",
"C. Graft the parsed options onto the stored body (a third graft beside graftNormalizedOperators and graftFoldedFormSections). The stored options then equals its parse output and everything else stays verbatim. Cost: small. Gain: only defaults and transforms inside the kind blocks, which the door already judged."
],
"recommendation": "B, on the four axes. Real business need: measured, no reachable corpus holds a stored options row, and the door alone closes the render hole the card is about. Literal A would drop per-user state the console writes and reads back (pins, order, visibility) on the next save. Long-term soundness: B keeps ADR-0005 (c) and PD#12 (the door is where the contract bites); A is contract-first only once its four prerequisites land, and until then it is a data-loss change. Preventing AI authoring errors: A adds no loudness. It turns 'stored but unread' into 'silently dropped' on a 200, and only closing the members would be louder, which ADR-0005 and #4001 decline for wire round-trip keys. B and A both give the loud 422 for options.KIND junk. Startup focus: B is already done; A spreads across spec, protocol, ADR and objectui. If the maintainer wants the invariant, file A as its own card with the prerequisites, the form-arm fix first."
},
{
"question": "Q2. The ruling says options.KIND is 'judged by the kind's strict schema'. Should the kind's required keys apply to the legacy bag?",
"options": [
"Key by key (implemented): each options.KIND is .partial() of the kind's strict block. The closed key set, the per-key schemas and the unknown-key message are kept; required keys are not asked of the underlay.",
"Whole block: the bag must satisfy the kind's full schema, required keys included. This is a one-line change in listViewKindBlocks."
],
"recommendation": "Key by key. objectui's ListView merges options.KIND as a per-key underlay of the top-level block, with the top-level block winning, and objectui pins bags that carry only the keys the top-level block leaves to them. Measured: the whole block refused those, so 8 more census rows fail and all of them fail for missing keys, which is the 'breaks today's legacy writes' cost the ruling cited against C. Every out-of-contract key is still refused by name either way."
},
{
"question": "Q3. The claim line reads Clause-②: no with no arm, and the diff is an accept-set narrowing. Amend the claim line to Clause-②: no (narrowing)?",
"options": [
"A. Amend it to Clause-②: no (narrowing) in the claim, the PR body and the changeset (seat write).",
"B. Leave it. The changeset already declares breaking via the ! summary and **BREAKING**, so check:adr-0087-registration judges it as breaking."
],
"recommendation": "A, because the arm is the declaration the gate reads without prose (#16421), and the precedent narrowing .changeset/17499-groupbyfield-non-padded.md carries it. The dev copied the claim verbatim and did not invent the arm."
}
],
"out_of_scope_findings": [
"class: a · reach: public door, PUT /api/v1/meta/view (saveMetaItem), gives a wrong 200. A flattened body with viewKind 'list' and no columns and no list type is refused by the list overlay member and then ACCEPTED by the form overlay member (FormViewSchema.extend(flattenedViewOverlayFields()).strip(); the shared viewKind enum admits 'list'). Its list keys are stripped unjudged and the body is stored verbatim. The direct spelling timeline.metaFields on such a body is therefore accepted, not refused. · evidence: measured on 8d1f7ab. diagnoseViewMetadata({name,object,viewKind:'list',sort:[...]}) gives success with branch formOverlay and parse output {type:'simple', viewKind:'list', ...}. The same body with timeline {startDateField,titleField,metaFields} and no columns gives union success=true. saveMetaItem probe (stub engine): success=true for the sort/searchableFields body. If the parse output were ever persisted (Q1 option A), such rows would be destroyed. PR #20183 closes it only for bodies carrying options. · Seam: spec:VIEW_METADATA_MEMBERS.formOverlay (flattenedViewOverlayFields viewKind enum shared by both overlay arms) → runtime:saveMetaItem · dedupe words: 'form overlay accepts viewKind list' · 'column-less list overlay falls through to form arm' · 'flattened overlay viewKind arm mismatch' · 'view union form member list body'",
"carrier: the persistence decision on #20051 (Q1). ViewItemWireSchema (member 1, top-level .strip()) drops a record's top-level options unjudged, and saveMetaItem stores it verbatim. objectui mergeViewsIntoObjects reads only a record's config (applyViewItem via viewItemBody), so no render reach was found. Noted, not filed (PR #20183 Acceptance notes)."
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT (door half) — PR #20183 at head 1c6a4eb17a · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T06:29Z

Seat review against GitHub, not the report:

• Shape: draft, base main, first line Part of #20051, and no closing keyword anywhere; docs(ai): tool metadata has a reference and no guide — and the guide has to say when NOT to author one (ADR-0109) #10222 and [finding] Two PASSING @objectstack/runtime tests print Acquire connection error and ~150 ERROR-level sql-driver DATABASE_ERROR lines into the shared Test Core log — they were adopted verbatim as a p1 flake signature #10380 appear in prose only. Clause-②: no is line-leading.
• Delivered:
  • Ruling item 1 (5824043998): each options.KIND on the flattened list overlay is judged by that kind's strict block, and an out-of-contract key is refused by name with the direct spelling's code and message.
  • Ruling item 3: the census (objectstack 0 rows; objectui 28 bag literals, 12 failing, each by a named key). Production sys_metadata rows: NOT MEASURED.
  • The legacy options.map pin stays accepted.
• File surface amendment to claim 5852017412 (recorded here, ⛔ not a second claim):
  • packages/spec/src/migrations/ (the ADR-0087 D3 entry view-overlay-options-bag-judged plus its regenerated region);
  • docs/audits/2026-07-unknown-key-strictness-ledger.counts.md (regenerated, +1 strict site);
  • packages/rest/src/meta-view-overlay-options-bag.test.ts (the consumer test the order asked for);
  • the form overlay's options pin in view.zod.ts, which closes a fall-through the change would otherwise open.
• Q2 (key by key vs whole block): accepted as implemented, key by key. The ruling's own rationale rejected C because it 「breaks today's legacy writes without a census」. The whole-block reading measured 8 more failing rows, all for missing required keys, while every out-of-contract key is refused by name either way. This is recorded here for the maintainer's veto; a switch is a one-line change.
• Q3 (Clause-② arm): no amendment. A narrowing need not declare yes, and the changeset's ! and **BREAKING** banner already carry the break to check-adr-0087-registration.
• Next: at-tier contract review (clause-② path limb). needs:contract-review goes on the PR in this act.

Out-of-scope findings: the form overlay accepting a viewKind: 'list' body → filed #20186. ViewItemWireSchema dropping a top-level options unjudged → rides the persistence decision below (no render reach found).

---

待维护者裁决:持久化那一半(裁决 A 第 2 条「保存时存解析后的结果」)的前提被证伪

一句话问题:裁决 A 要求保存视图时存「校验后的结果」;实测这样做会在每次保存时悄悄删掉控制台自己写进去、之后又读回来的状态(置顶、排序位置、可见性),而 ADR-0005 附录 (c) 当初正是为保住这些字段才规定「存原始请求体」。

Governing text:ADR-0005 附录 (c) 原文 「The persisted document is the original request.item, NOT parsed.data. Studio attaches auxiliary fields (isPinned, isDefault, sortOrder, objectName, …) that aren't in the canonical schema; storing parsed.data would silently strip them on every save.」(git grep -n "The persisted document is the" origin/main -- docs/adr/0005-metadata-customization-overlay.md);裁决 A(objectui#10380 5824043998,维护者 「其他同意」)。两者方向相反。

前提(带 re-check):dev 在 8d1f7ab 经真实 saveMetaItem 测得,存解析结果会剥掉平铺覆盖体的 isPinned / sortOrder、ViewItem 行的 visibility、个性化 PUT 的 sort[].id / filter[].id,并把 exportOptions ['csv'] 改写成对象、补出默认值;objectui 从存储行读回 isPinned / sortOrder / visibility(ObjectView.tsx VIEW_ROW_STATE_KEYS、ViewTabBar)。守护「原样保存」的 pin:git grep -n "preserves Studio-only auxiliary fields verbatim" origin/main -- packages/objectql 与 git grep -n "GUARD: Studio-only round-trip keys" origin/main -- packages/metadata-protocol。

选项	做什么	客户能感到的后果
甲(A) 照裁决存解析结果	先修 #20186(表单分支吞下列表视图);把控制台回读的每个键在契约上声明;修订 ADR-0005 (c)(受管,需你批);翻转三条 GUARD pin 并让 objectui 对齐;最后才改存储	存储里的每个键都有契约、都被校验;代价大、跨 spec / 协议 / ADR / objectui 四处
乙(B) 维持原样存储	ADR-0005 (c) 不动;PR #20183 已让门口校验 options,渲染漏洞已堵	零改动;残留:其它未声明的顶层键仍会被原样存下、无人读取
丙(C) 只把解析后的 options 回填进存储体	在现有两个 graft 旁加第三个	改动小;收益仅限 options 内部的默认值与改写,门口已判过它

业务直译:甲 = 「表单上每一格都要有定义,没定义的不许存」;乙 = 「表单收件时检查,但存档时连同便签一起原样归档」;丙 = 「只把其中一张表按标准格式重抄一遍再归档」。

四轴(业务立场)

• 长远合理性:两年后的平台应当是「存储即契约」——主流做法(Salesforce Metadata API 只存已声明字段,Hasura 应用 metadata 前先校验成形)都不存未声明的键;控制台要保存的界面状态应当是契约里声明过的键,而不是靠「原样存」的例外活着。甲是这个终态;乙把例外永久化;丙是半量。
• 实际业务拉动:今天无可达语料存有顶层 options 行(objectstack 0 行;生产行未测);门口半已堵住卡面的渲染漏洞。拉动只决定甲的时序,不改方向。
• 防 AI 犯错:出错时谁看到什么——乙下,AI 写一个未声明的顶层键会收到 200、被原样存下、没人读(静默);甲在前置齐备后会对未声明键响亮拒绝;照裁决字面直接改存储(不做前置)则把「存下没人读」变成「200 后静默丢掉用户状态」,更糟。
• 创业阶段不扩散:乙零成本;甲是四处改动,应按「先 spec(ui): a flattened viewKind: 'list' view overlay with no columns is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 → 声明回读键 → 修 ADR → 改存储」分期,而不是一次铺开。

os-decision-facets
① 项目长远合理性:甲收敛到「存储即契约」,消掉 ADR-0005 (c) 这一永久特例;乙保留特例;丙新增一个 graft 特例。
② 实际业务拉动:今天无人撞上(存量 options 行 0,生产未测);门口半已堵住渲染漏洞 ⇒ 甲可排后,不必现在做。
③ 防 AI 犯错:甲(前置齐备后)对未声明键响亮拒绝;乙对未声明键静默存下;照字面直接改存储会在 200 后静默丢状态,最差。
④ 创业阶段不扩散:甲需声明一批界面状态键(永久义务)并改 ADR;乙零新增;丙新增一个 graft。
Prior rulings read: persist parsed body,request.item,auxiliary fields,ispinned,overlay save,savemetaitem → 2 hits; ADR-0005 Decision §10, ADR-0094 D2; thread: none; repo: objectstack-ai/objectstack

推荐:甲(分期执行);回退:乙。只看①选 甲;②③④ 是否翻转:否(② 只把甲排到 #20186 之后、按需开工,④ 只决定分四步走,都不改字母)。
置信缺口:生产 sys_metadata 里带未声明顶层键的视图行数未测;objectui 回读键的完整清单只测到 isPinned / sortOrder / visibility / objectName,可能还有别的。

裁后执行:

• 甲:本卡在门口半落地时转 needs-user-decision → 按你的字母;甲则本席拆出「声明控制台回读键 + ADR-0005 (c) 修订」子卡(ADR 部分为 Tier H、等你批),排在 spec(ui): a flattened viewKind: 'list' view overlay with no columns is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it #20186 之后,最后一张改存储并翻 GUARD pin。
• 乙:门口半落地即关本卡(completed),在 ADR-0005 (c) 旁不做改动;objectui#10380 解锁。
• 丙:派一轮小改动加第三个 graft,再关卡。

The card state moves pm:dispatched → needs-user-decision in the same stroke as the door half's landing, with this comment as the analysis.

[objectstack-fleet]

os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (mode:subagent, the PM's session; identity = the branch)",
"premise_still_valid": true,
"summary": "Merge-only round done. I merged origin/main 560b724 into the branch with os-regen-merge.sh and pushed a fast-forward, 1c6a4eb..69c7f31: merge commit 01e3c86 plus regeneration commit 69c7f31. No rebase, no amend, no force-push, and no edit to view.zod.ts, the tests, the entry file or the changeset. The one conflict, registry.ts, was measured before resolving. This PR's only hunk (41 lines) sits inside the os-generated semantic:18 region, and outside the generated regions its side is byte-equal to the merge base 8d1f7ab. So I took main's side, which keeps main's hand-written step18 rationale and its conversion id page-component-filter-record-to-rule-array, then regenerated the region from the merged entries/ with gen:migration-registry. That restored this PR's 41 lines byte-identical. WARNING: the PR is DIRTY again. origin/main moved after the merge (4db1bf1 #20194, 172b4cf #20199, 0bd1126 #20195), and GitHub reads mergeable=false / mergeable_state=dirty on head 69c7f31. A driver-free probe against 0bd1126 conflicts in exactly docs/audits/2026-07-unknown-key-strictness-ledger.counts.md; registry.ts merges clean there. A second merge is outside this round's ONE-merge scope, so I did not make it; see open_questions.",
"tests": "All at head 69c7f31. (1) Spec build under os-verify-lock: VERDICT command-exit 0, held 252s. git status was clean afterwards, so the build's gen:schema moved no tracked file. (2) pnpm --filter @objectstack/spec check:generated: EXIT 0, 'All 15 generated artifacts are up to date', read against a dist built in this worktree (declaration stamp 9f988cacaaf1 match). (3) check:authorable-surface: EXIT 0, 'Successfully generated 1549 schemas'. Its only other line is the informational 'authorable-surface.base.json trails the baseline at 560b724'; the anchor was not touched. (4) check:migration-registry: EXIT 0, 'src/migrations/registry.ts is current (253 semantic, 210 retired-key, 183 retired-def)', read both before the regeneration commit and at head. (5) Targeted tests, one locked run, VERDICT command-exit 0. spec: vitest run of src/ui/view-overlay-options-bag.test.ts, src/migrations/migrations.test.ts, src/migrations/retired-tables-not-floor-scoped.test.ts and src/migrations/spec-changes-surface-scope.test.ts gave 'Test Files 4 passed (4) / Tests 170 passed (170)'. metadata-protocol: src/protocol.graft-folded-form-sections.test.ts gave 'Test Files 1 passed (1) / Tests 19 passed (19)', matching the 19 declared. rest: src/meta-view-overlay-options-bag.test.ts gave 'Test Files 1 passed (1) / Tests 2 passed (2)', matching the 2 declared. The dependency closure for the last two suites (24 packages, spec excluded because it was already built) was built JS-only with OS_SKIP_DTS=1, exit 0. (6) pnpm check:nul-bytes: EXIT 0. (7) node scripts/check-adr-0087-registration.mjs --base 560b724: EXIT 0, 'registered view-overlay-options-bag-judged'. No ablation this round: merge only, no code change.",
"gates": [
"spec build (os-verify-lock): command-exit 0 @ 69c7f31",
"@objectstack/spec check:generated: EXIT 0, 15/15 current @ 69c7f31",
"@objectstack/spec check:authorable-surface: EXIT 0 @ 69c7f31",
"@objectstack/spec check:migration-registry: EXIT 0 @ 69c7f31",
"tests: spec 4 files/170, metadata-protocol 1/19, rest 1/2, all passed @ 69c7f31",
"check:nul-bytes: EXIT 0 @ 69c7f31",
"check-adr-0087-registration --base 560b724: EXIT 0 @ 69c7f31",
"registration presence: a quoted-exact git grep -F -c for the literal id line of each id in packages/spec/src/migrations/registry.ts, on the tree committed as 69c7f31, found each id exactly once. This PR's id: 'view-overlay-options-bag-judged'. Main's ids since the fork: 'cel-predicate-list-comparand-refused', 'cel-predicate-variable-root-comparand-refused', 'element-data-source-and-object-block-filter-rule-array', 'field-predicate-reference-traversal-refused', 'manifest-id-reverse-domain-required', 'object-grid-default-filters-rule-array', 'rls-check-on-select-or-delete-policy-refused', 'rls-predicate-array-comparand-refused', 'ui-report-joined-container-selection-refused', 'view-pagination-page-size-default-50'. The hand-written conversion id 'page-component-filter-record-to-rule-array' (from #20175) is at registry.ts:5329",
"GitHub mergeability after push: mergeable=false, mergeable_state=dirty (main moved; see open_questions)",
"CI on 69c7f31: not awaited (in_progress at report time; convergence is the seat's)"
],
"line_budget": "n/a",
"deviations": [
"Two commits, not one. The dispatch says 'push ONE merge commit'. os-regen-merge.sh, whose step order the dispatch makes authoritative, prescribes for this class-3 conflict: 'take either side to reach a committable state, commit the merge (step 3), then run its generator and commit that as its own commit'. The branch therefore carries ONE merge commit (01e3c86) and ONE regeneration commit (69c7f31), and the latter adds only this PR's 41 regenerated lines. I am reporting this conflict between the dispatch wording and the script, not choosing between them silently.",
"The worktree objectstack-issue-20051 did not exist. I recreated it on the existing local branch at the remote head 1c6a4eb (BASE); no claim was posted.",
"Driver-free probe: git clone --bare --shared refuses its local optimisation on this shallow clone and copied branch heads only, so the objects were missing. I built the equivalent by hand: a bare init with no merge driver, alternates pointing at the shared object store, and the shallow file copied. Merge-base 8d1f7ab resolved, and there was no merge.os-regen.driver in local or global config.",
"Verify lock: three foreground attempts with OS_VERIFY_LOCK_WAIT=300 (lowered so wait plus build fits the 10-minute cap) each ended at exit 99 / queue-timeout: NOT MEASURED, not red. After that I ran the locked build, and later the locked tests, as a background os-verify-lock wrapper under a stable slot with its PID recorded. I awaited each with one foreground 'tail --pid'. Both wrappers have exited, and nothing outlives the run.",
"Declared narrowing: locally I ran only the dispatch-named families plus the implicated ones (check:generated's 15 artifact gates, check-adr-0087-registration, check:nul-bytes). The remaining families that dispatch-gates.mjs --commands lists for the 8-file PR delta belong to CI. The test closure was built JS-only (OS_SKIP_DTS=1), and typecheck was not run locally; it is declared to CI.",
"check-adr-0087-registration took --base 560b724, the main actually merged, and not the moving origin/main, which had already advanced to 172b4cf and would have charged main's newer commits to this branch."
],
"files_changed": {
"new_head": "69c7f3100c72d9e86c5a94faa19b87f1663fa131",
"commits": [
"01e3c860c9 Merge origin/main (560b724); parents 1c6a4eb and 560b724; registry.ts resolved to main's blob d5f34bcc9a",
"69c7f3100c chore(spec): regenerate the migration registry on the merged entries; 1 file, +41"
],
"old_head_to_new_head": "131 files changed, +9720 / -647",
"from_main": "131 files, exactly the file set of 8d1f7ab..560b724 (0 extra, 0 missing). 129 are main-only and equal to main. view.zod.ts is +6/-1, main's delta auto-merged. registry.ts is +343/-32, identical to main's own registry.ts delta since the fork (+343/-32)",
"regenerated": "1 file: packages/spec/src/migrations/registry.ts. Merge to head is +41 / -0, byte-identical to the PR's pre-merge hunk (cmp exit 0). The text outside the generated regions is byte-equal to main's (cmp exit 0)",
"anything_else": "0 files",
"branch_delta_vs_merged_main": "The same 8 files as before the merge. Each hunk body hashes identical to its pre-merge delta. Six are identical blobs; view.zod.ts and registry.ts moved only by main's side"
},
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/20051/comments (this os-dev-report), through scripts/pm/post-stamped.mjs on its resolved route: transport dispatch, i.e. the fleet-write relay (one repository_dispatch whose workflow posts as objectstack-fleet[bot]). git push x1 went through write-pace --run (not a REST write). 0 label writes, 0 PR-body writes, 0 pr_create. Read-only REST GETs: PR #20183, issue comment 5853809566, #20051 comments.",
"open_questions": [
{
"question": "origin/main moved after this round's merge, and PR #20183 is DIRTY again (GitHub: mergeable=false). A driver-free merge-tree of 0bd1126 against 69c7f31 conflicts in exactly one path: docs/audits/2026-07-unknown-key-strictness-ledger.counts.md, a merge=os-regen generated counts file. This PR's +1 strict ui/ site (view.zod.ts 61 to 62, total 453 to 454) meets #20194's -1 automation/ strip site (execution.zod.ts 13 to 12, total 453 to 452) on the same total rows. registry.ts merges clean. Should a second merge be taken?",
"options": [
"A: one more merge-only round now. os-regen-merge.sh lets the driver defer the counts file, step 2 takes main's side (both sides edited it), and step 4 regenerates it (check:generated --fix, check:strictness-ledger). The merged totals are to be measured then, not assumed from the two deltas.",
"B: hold until main settles, then take the merge together with the at-tier review on the final head."
],
"recommendation": "A. The conflict is in a generated counts file only, and its resolution is fully mechanical by the same script. Each hour of waiting on the hot spec tree invites another collision. The fresh at-tier record the kick-out comment requires should be taken on the head after that merge, not on 69c7f31."
}
],
"out_of_scope_findings": []
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20051,
"status": "done",
"branch": "claude/issue-20051-view-overlay-options-kind-door",
"pr": "#20183",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (mode:subagent, the PM's session; identity = the branch)",
"premise_still_valid": true,
"summary": "Second merge-only round (ruling A), done. I re-fetched main (still 0bd1126 at merge time), merged it with os-regen-merge.sh, and pushed a fast-forward, 69c7f31..2526e40: merge commit b48c0b5 (parents 69c7f31 and 0bd1126) plus regeneration commit 2526e40. No rebase, amend or force-push; no ready, auto-merge or label action; none of the PR's own content changed. As predicted, the only GitHub-side conflict was docs/audits/2026-07-unknown-key-strictness-ledger.counts.md. Locally the os-regen driver deferred it and silently kept the branch's side (blob 20cf62a2d0, total 454). Step 2 took main's side (70b6d05f51, total 452). The step-3 commit was refused by pre-commit as stale, which the script calls its designed collection point. gen:strictness-ledger then re-derived the file from the merged AST, and the MEASURED merged totals are 453 sites / 323 strict / 125 strip: main's 452/322/125 plus this PR's one strict ui/ site (view.zod.ts 61 to 62). I did not hand-edit any count. registry.ts text-merged cleanly this time and check:migration-registry confirms it is current (255 semantic, 196 retired-def). Its delta against main is still exactly this PR's 41 lines. After the push, GitHub's single mergeability read returned mergeable=null / mergeable_state=unknown, meaning not yet computed, so it is NOT MEASURED. main has since moved to 1c8b320 (#20191, #20187), and a driver-free merge-tree of that tip against 2526e40 merges CLEAN (exit 0); neither new commit touches any file in the PR delta. So the PR is not dirty.",
"tests": "All at head 2526e40. One locked run: VERDICT command-exit 0, held 399s. Inside it: spec build exit 0 (git status clean afterwards); spec vitest run of src/ui/view-overlay-options-bag.test.ts plus the three src/migrations tests (migrations, retired-tables-not-floor-scoped, spec-changes-surface-scope) gave 'Test Files 4 passed (4) / Tests 170 passed (170)'; the closure for the next two suites was built JS-only with OS_SKIP_DTS=1, exit 0; metadata-protocol src/protocol.graft-folded-form-sections.test.ts gave 'Test Files 1 passed (1) / Tests 19 passed (19)'; rest src/meta-view-overlay-options-bag.test.ts gave 'Test Files 1 passed (1) / Tests 2 passed (2)'. Unlocked gates on that built tree: check:generated EXIT 0, 'All 15 generated artifacts are up to date' (declaration stamp 979178fb9da0 match); check:authorable-surface EXIT 0, 'Successfully generated 1536 schemas', plus the informational 'base.json trails the baseline at 0bd1126' (anchor untouched); check:strictness-ledger EXIT 0, '...counts.md is current — 453 site(s) measured'; check:migration-registry EXIT 0, 'registry.ts is current (255 semantic, 210 retired-key, 196 retired-def)'; check:nul-bytes EXIT 0; check-adr-0087-registration --base 0bd1126 EXIT 0, 'registered view-overlay-options-bag-judged'. No ablation: merge only.",
"gates": [
"spec build (os-verify-lock): exit 0 @ 2526e40",
"@objectstack/spec check:generated: EXIT 0, 15/15 current @ 2526e40",
"@objectstack/spec check:strictness-ledger: EXIT 0, counts current at 453 sites @ 2526e40",
"@objectstack/spec check:authorable-surface: EXIT 0 @ 2526e40",
"@objectstack/spec check:migration-registry: EXIT 0 (255 semantic, 210 retired-key, 196 retired-def) @ 2526e40",
"tests: spec 4 files/170, metadata-protocol 1/19, rest 1/2, all passed @ 2526e40",
"check:nul-bytes: EXIT 0 @ 2526e40",
"check-adr-0087-registration --base 0bd1126: EXIT 0 @ 2526e40",
"registration presence (git grep -F -c on the committed tree 2526e40, packages/spec/src/migrations/registry.ts): all 26 present, each exactly once, 0 missing. This PR's 'view-overlay-options-bag-judged'. Main since the fork 8d1f7ab, 12 semantic ids: 'cel-predicate-list-comparand-refused', 'cel-predicate-variable-root-comparand-refused', 'element-data-source-and-object-block-filter-rule-array', 'export-job-family-retired', 'field-predicate-reference-traversal-refused', 'manifest-id-reverse-domain-required', 'object-grid-default-filters-rule-array', 'rls-check-on-select-or-delete-policy-refused', 'rls-predicate-array-comparand-refused', 'turso-config-transport-mismatch-refused', 'ui-report-joined-container-selection-refused', 'view-pagination-page-size-default-50'. Main's 13 retired-def entries: 'api/CreateExportJobRequest', 'api/CreateExportJobResponse', 'api/ExportJobProgress', 'api/ExportJobStatus', 'api/ExportJobSummary', 'api/GetExportJobDownloadRequest', 'api/GetExportJobDownloadResponse', 'api/ListExportJobsRequest', 'api/ListExportJobsResponse', 'api/ScheduleExportRequest', 'api/ScheduleExportResponse', 'api/ScheduledExport', 'automation/ScheduleState'. Main changed 0 retired-key entries. The hand-written conversion id 'page-component-filter-record-to-rule-array' is at registry.ts:5329",
"GitHub mergeability, one read after the push: mergeable=null, mergeable_state=unknown (not yet computed): NOT MEASURED",
"driver-free merge-tree of main 1c8b320 against 2526e40: exit 0, clean",
"CI on 2526e40: not awaited (convergence is the seat's)"
],
"line_budget": "n/a",
"deviations": [
"The merge commit b48c0b5 carries git's default message ('Merge remote-tracking branch ...') and no Claude-Session trailer pair. os-regen-merge.sh step 1 runs 'git merge --no-edit', which auto-commits, and the fence forbids amending. The pre-push trailer check passed on both commits.",
"The worktree was recreated at 69c7f31 for this round (it was removed after round 1), and removed again after the push. No claim was posted.",
"The presence grep's first pass extracted an empty id from the 13 retired-def files, which carry 'export const entry' and no 'id:'. An empty pattern matches every line, so those 13 rows read n=20250 and were INVALID, not a pass. I re-ran them with the entry value, and each came back n=1.",
"GitHub mergeability was read once, as ordered, and answered null/unknown. I did not poll it again. The substantive answer is the driver-free merge-tree against the current main tip, which runs GitHub's own no-driver condition.",
"Declared narrowing, as in round 1: only the dispatch-named gates plus check:strictness-ledger, check:nul-bytes and the ADR-0087 check ran locally. Typecheck and the other dispatch-gates families are declared to CI, and the test closure was built JS-only."
],
"files_changed": {
"new_head": "2526e4052e742ee2f2d9a6a93c2e653efb093e1f",
"commits": [
"b48c0b5b55 merge of origin/main 0bd1126; parents 69c7f31 and 0bd1126; auto-committed by the script's step 1",
"2526e4052e chore(spec): regenerate the strictness-ledger counts on the merged tree; 1 file, +12/-12"
],
"old_head_to_new_head": "65 files changed, +2266 / -2108",
"from_main": "65 files, exactly the file set of 560b724..0bd1126 (0 extra, 0 missing). 63 are main-only and equal to main. registry.ts is +260/-0, identical to main's own delta (+260). The counts file is +12/-12 overall",
"regenerated": "1 file: docs/audits/2026-07-unknown-key-strictness-ledger.counts.md, +12/-12 in 2526e40. It restores main's side (automation/ 68 to 67, api/ 454 to 435, totals 454/126 to 453/125) that the driver had dropped from the merge commit, while keeping the PR's +1 ui/ site. registry.ts needed no regeneration: it text-merged, check:migration-registry says it is current, and its delta vs main equals the PR's 41-line hunk (cmp exit 0)",
"anything_else": "0 files",
"branch_delta_vs_merged_main": "The same 8 files. Six are identical blobs and registry.ts has an identical delta. The counts file's delta vs main carries the same +1 ui/ site, and differs only in 2 absolute total lines that now include main's -1 strip site (453 vs 454, 125 vs 126)"
},
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/20051/comments (this os-dev-report), through scripts/pm/post-stamped.mjs via the fleet-write relay (transport dispatch). git push x1 through write-pace --run. 0 label, 0 PR-body, 0 ready or auto-merge writes. Read-only REST GETs: #20051 comments (claim re-check) and PR #20183 (one mergeability read).",
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code

[objectstack-fleet]

Queue kick-out record for this card's PR #20183 (Part of #20051) · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T10:17Z

The queue build 36310592557 failed with a new signature: packages/client/src/auth-login-register-envelope.test.ts › register() parses as the declared envelope, with the payload under data › Test timed out in 5000ms. It is a timeout in a package this PR does not touch. The full signature, the three-fact reading and the initial reading are on the PR: comment 5854946276.

⛔ No re-queue on sight. A read-only diagnosis (base vs base+PR, 8 runs each) decides whether the PR is implicated. This card's state is unchanged (pm:dispatched). The transition to needs-user-decision (decision analysis 5853397704) still waits for the door half to merge.