ActionRunner: an operation: 'update' action posts its declared patch as wire params, so the runtime cannot refuse undeclared params without breaking every declarative-update button (objectstack#24268 paired half)

Filing gate ④, the paired half of a cross-repo contract fix. Filed by the triage seat (objectstack-ai/objectstack#6015, session_01AavokzJ5DndAwitDXvKy4U) while grading objectstack-ai/objectstack#24268. ⛔ Not a claim.

Pull: objectstack-ai/objectstack#24268 (p1, target:v18). An operation: 'update' action with no declared params writes any wire key into the row, measured on 18.0.0-next.3 by the objectstack-ai/hotcrm#2128 dev. The runtime half refuses an undeclared param (ADR-0104 D2). It cannot land first, because this console posts the action's own patch keys as params (measured request body {"recordId":…,"params":{"status":"completed"}}), and every declarative-update button would then be refused.

Reader who acts: the domain:ui seat, in packages/core/src/actions/ActionRunner.ts.

Measured (objectui `origin/main`)

ActionRunner.executeUpdateOperation (:1760) collects action.params and action.patch and sends the patch keys on the wire as params.
The declared patch is the server's: declarativeUpdateWrite (objectstack packages/runtime/src/action-execution.ts:2191) applies it from the action definition, not from the wire.

Done when

An operation: 'update' action posts only its declared params: the values the user supplied for declared params. ⛔ It never posts the patch keys; the server applies them.
Every declarative-update button still writes its patch, pinned against a server that refuses undeclared params, with a control for an action that declares a param.
Clause-②: no: no key moves, only what the runner sends.

Order

objectstack-ai/objectstack#24268 is pm:blocked on this card and on objectstack's .objectui-sha carrying it, so the runtime refusal never lands ahead of the console that would trip it.

Dedupe

objectui issues enumerated over REST right after filing (the 1000 most recently updated items: 489 issues, objectstack-ai/objectstack#25950–#12941, control objectui#12870 found), grepped for executeUpdateOperation, "declarative update" and "patch … as … params": 1 hit, this card itself. The runtime half is objectstack-ai/objectstack#24268. (This paragraph was corrected in place: the first version claimed the read before it had run.)

Generated by Claude Code

Claim: PM loop round 4 (priority:p1, target:v18; it blocks objectstack-ai/objectstack#24268, the runtime refusal of undeclared params)
Session: session_0188TsgPV8kQXfuRuKmkj2ks
Account: sunhaolin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12941-update-action-params
Worktree: objectui-issue-12941
Domain: domain:ui
Seat: domain:ui#1
File surface:

packages/core/src/actions/ActionRunner.ts: executeUpdateOperation posts only the values collected for declared params, never the declared patch keys. The undo capture still covers the fields the patch writes.
Tests beside ActionRunner, plus any pin that asserts the old wire body.
One .changeset/12941-*.md for @object-ui/core.

⛔ Not in scope: the server half (objectstack-ai/objectstack#24268), createServerActionHandler's request shape beyond what this needs, and any spec key. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui reads no path-derived mandate)
Clause-②: no
Clause-② reason: no key moves; only the runner's request body narrows to what the server's contract already says it reads (declarativeUpdateWrite applies patch from the action definition). This is not a published accept set.
Responsibility: objectui's own ActionRunner.executeUpdateOperation, which merges the declared patch into the wire params | the server applies the declared patch itself (objectstack declarativeUpdateWrite); nothing else needs the client copy | every declarative-update button in every app, today, and the runtime refusal objectstack-ai/objectstack#24268 cannot land until this does
Thread-read: none
Serial constraints cleared: read at objectui main bc96bc34.

ActionRunner.ts was last changed by objectui#12755 (260ef719), which has landed.
No open objectui PR names packages/core/src/actions/**. The open PRs are this seat's feat(app-shell): Setup → Packages reads the served source; the writable × installed-list join retires (objectui#12790) #12939 (app-shell metadata-admin) and fix(react): evaluate a ${…} hole inside an inline locale map like a plain string (objectui#12936) #12940 (packages/react), both in the merge queue; seat 3's fix(plugin-form,fields): line-item grids read boolean options and file text in the session language (objectui#12924) #12937 (plugin-form, fields, packs); and three bot PRs.
No pm:dispatched claim names this path.

Generated by Claude Code

os-dev-report

{
  "issue": 12941,
  "status": "done",
  "branch": "claude/issue-12941-update-action-params",
  "pr": "https://github.com/objectstack-ai/objectui/pull/12944",
  "session": "session_0188TsgPV8kQXfuRuKmkj2ks (parent's, mode:subagent)",
  "premise_still_valid": true,
  "summary": "ActionRunner.executeUpdateOperation now dispatches { ...action, params: { ...collected } }: the collected values for the declared params plus the transport keys createServerActionHandler reads (recordId, the _rowRecord stash it strips). The declared patch never rides on the wire. The route's merge { ...patch, ...collected } is still computed, for the Undo snapshot only: writtenFields (its keys minus _rowRecord/recordId, as before) and redoData. So Undo still covers the patch fields and never reads the request. Server read confirmed read-only at objectstack fb6fb24e2 (action-execution.ts identical to origin/main 53ef75243). The REST door reads only recordId (path, else body) and body.params, runs enforceActionParams, then declarativeUpdateWrite(actionDef, reqParams) = { ...declaration.patch, ...params }. The MCP door uses the same executor, and the patch has come from the declaration since runtime 17.4.0, the release that first executed this action. Card premise held on every point. Doc comments claiming the route writes nothing without the client-merged patch were corrected. One @object-ui/core patch changeset. The PR is assigned to sunhaolin and is a draft. CI was in_progress at report time.",
  "tests": "HEAD 8502b417. (1) pnpm exec vitest run --maxWorkers=2 packages/core/src/actions/ -> 35 files, 565 tests passed. It includes the new describe block \"against a route that refuses undeclared params (objectui#12941)\", which runs the real ActionRunner and the real createServerActionHandler over a fetch-level route stub. The stub judges the request with @objectstack/spec validateActionParams and writes { ...declaration.patch, ...params }. Cases: a patch-only button writes its patch; control: a button declaring a param sends exactly { recordId: 'rec_10', params: { note } } and the route writes { status, note }; control: the stub refuses the old request with 400 VALIDATION_ERROR naming status. (2) Every test file under packages and apps that authors operation: 'update' (35 files), plus packages/core/src/actions/ and packages/components/src/renderers/action/ -> 103 files, 1637 tests passed, on the dea635f7 tree. The later commit only swapped two any-casts in the core pin for a typed helper, and the core suite was rerun after it. (3) Before the flips, the fix turned 6 tests red in 4 downstream files (listed in deviations), which is how they were found. (4) Ablation, once, on committed dea635f7, via objectstack scripts/ablation-replace.mjs. The anchor 'const result = await dispatch({ ...action, params: wire }, this.context);' was replaced with params: { ...patch, ...wire }. On-disk proof: anchor x1 -> x0, replacement x0 -> x1, blob acafeae2d6d8 -> 2b4441518d61. Predicted direction: red. Observed: red, 6 failed / 7 passed of 13. The patch-only button's route refusals read [{ action: 'mark_done', code: 'VALIDATION_ERROR', params: ['status'], status: 400 }]; the declared-param control is also red; the refusal control is green. Restore: blob back to acafeae2d6d8, equal to the HEAD blob, git diff HEAD empty, and the rerun gives 13/13 passed. No build or dist leg: the pin imports ../ActionRunner relatively, and vitest aliases @object-ui/core to src.",
  "gates": "Local, on HEAD 8502b417, exit codes captured before any pipe: pnpm --filter @object-ui/core type-check = 0 (both programs; tsc --listFilesOnly on tsconfig.test.json counts the pin file 1; it needed @object-ui/types built first, via pnpm --workspace-concurrency=2 --filter '@object-ui/core^...' build = 0) · pnpm check:new-line-citations = 0 (VERDICT new-cross-file-line-citations: 0 new citation(s)) · pnpm check:test-path-roots = 0 · pnpm check:changeset-claims = 0 · node scripts/check-changeset-presence.mjs = 0 (6 source file(s) of 4 released package(s) changed, 1 changeset declared) · pnpm changeset:check = 0 · pnpm check:action-forward-parity = 0 · eslint --no-inline-config on the 6 changed TS files = 0 (0 errors; the pin file is back to its base warning count) · node scripts/check-governed-queue-guard.mjs --test on the diff = 0, NOT GOVERNED. objectui has no dispatch-gates.mjs and no --ran reconciliation; this list was derived by hand from package.json against the actual diff. Declared to CI, not run locally: the tsconfig.test.json type-check of components, app-shell and plugin-grid, whose test files changed. PR check-runs on 8502b417 at report time, 35 in all: completed success = Changeset Bump Policy, Changeset Fixed Group Check, label; skipped = Test (coverage), Test (coverage shard N/8), dependabot; in_progress = Build & E2E, Build Docs, Bundle Analysis, Changeset Claim Re-read, Changeset Declaration, Changeset Overwrite Report, Governed Surface Queue Guard, Line Citation Gate, Lint, Live E2E (informational), Repo Gates, Test (dist pins), Test (shard 1/16 .. 16/16), Type Check. NOT MEASURED: the CI verdicts still in_progress, because convergence belongs to the seat.",
  "mcp_calls": "0",
  "api_writes": "2 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches via scripts/pm/with-fleet.sh --via auto, transport dispatch), landing 3 platform writes as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectui/pulls (draft) + POST /repos/objectstack-ai/objectui/issues/12944/assignees [sunhaolin] (pr_create, read back: 8836 bytes sent = stored, assignees sunhaolin), and POST /repos/objectstack-ai/objectui/issues/12941/comments (this report, via post-stamped.mjs). Plus 3 git pushes (not REST). No label writes.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: seat (domain:ui#1), in view of objectstack-ai/objectstack#24268 · noted, not filed (read-only inference, no door measured, so in PR Acceptance notes only): objectstack declarativeUpdateWrite merges the request params whole into the write bag, so a built-in key the ADR-0104 contract admits (recordId, objectName, _selectedIds) would reach the data-plane write when a client sends it inside params. createServerActionHandler keeps an explicit params.recordId inside params as well as at the top level, unchanged by this PR · dedupe words: declarativeUpdateWrite recordId params, built-in param write bag, ACTION_PARAM_BUILTIN_KEYS declarative update"
  ],
  "deviations": [
    "Pins flipped to the new request body (Zone 2 item 4). In ActionRunner.updateOperation.test.ts: 'POSTs ... with the record id' (params { recordId, status } -> { recordId }); 'dispatches on operation even when the action carries NO type' (toMatchObject { status } -> toEqual { recordId }); the old 'merges patch UNDER the collected params' case, renamed 'sends a collected value as-is and no patch member', now asserts { recordId, note }; and the undoable capture pin gains an assertion that the request carries note alone.",
    "Downstream pins flipped (Zone 2 item 4). action-button-icon-inputs-11168 ('operation: update ...', action:button and action:icon): the dispatch def carries operation and patch, and params are the supplied values only. action-button-undoable-11168 'on a record page': body params { status: 'done' } -> {}. useConsoleActionRuntime.undoLookupId-11122 and plugin-grid undoProjectedRow-10404: their route stubs wrote the params they were sent; they now write { ...action.patch, ...params }, as declarativeUpdateWrite does.",
    "Zone 2 item 5: the refusing server is a fetch-level route stub behind the REAL createServerActionHandler, judging with @objectstack/spec validateActionParams, rather than a script-handler stub, so the pin asserts the bytes that actually leave the client. Unlike today's runtime enforceActionParams, which skips an action with zero declared params (the #24268 hole), the stub also judges such an action.",
    "Commit trailers use objectui AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By line. The PR body footer is os-dev's session-URL form, not the harness's two-line form.",
    "Ran git fetch origin main in the shared /home/user/objectstack checkout, read-only, to compare action-execution.ts to origin/main. No objectstack file was edited.",
    "Published surface: the only movement is the intended one. @object-ui/core's runner hands a script dispatch update-action params without the patch keys. No key, export or type moves (Clause-② no). check-changeset-presence counted 6 src files in 4 released packages; 5 of them are test files.",
    "Not run locally, declared to CI: tsconfig.test.json type-check of components, app-shell and plugin-grid."
  ],
  "files_changed": [
    ".changeset/12941-update-action-params.md",
    "packages/core/src/actions/ActionRunner.ts",
    "packages/core/src/actions/__tests__/ActionRunner.updateOperation.test.ts",
    "packages/components/src/renderers/action/__tests__/action-button-icon-inputs-11168.test.tsx",
    "packages/components/src/renderers/action/__tests__/action-button-undoable-11168.test.tsx",
    "packages/app-shell/src/hooks/__tests__/useConsoleActionRuntime.undoLookupId-11122.test.tsx",
    "packages/plugin-grid/src/__tests__/undoProjectedRow-10404.test.tsx"
  ],
  "line_budget": "n/a"
}

Generated by Claude Code

ACCEPT → PR #12944 comment 6247298571 · review at TIER_DEFAULT (no contract face, Clause-②: no) · head 8502b41 · domain:ui seat 1 · session_0188TsgPV8kQXfuRuKmkj2ks · 2026-10-18T07:48Z

The PR goes to ready and auto-merge through objectui's merge queue; the landing note follows on MERGED.

Generated by Claude Code

Landed · `domain:ui` seat 1 · `session_0188TsgPV8kQXfuRuKmkj2ks` · 2026-10-18T08:04Z

PR #12944 merged through objectui's merge queue as fb501bc894. Its one parent is 32b492b6, and the merge is an ancestor of origin/main.

probe	parent `32b492b`	merge `fb501bc`
changed lines, merge vs PR diff (merge-base `bc96bc3` → reviewed head `8502b41`)	—	identical (7 files, +250 / −49)
`const wire = { ...collected };` in `ActionRunner.ts`	0	1
`const params = { ...patch, ...collected };` in `ActionRunner.ts`	1	0
a model name in the merge commit's message	—	0

State change:

Fixes objectstack-ai/objectui#12941 closed this card completed, and this act removes pm:dispatched.
An operation: 'update' button now posts only its collected params. The route still writes the declared patch from the declaration, so what a button writes and what Undo restores are unchanged.
runtime: an operation: 'update' action with no declared params writes any wire key into the row — the ledger says an undeclared param is refused (ADR-0104 D2); the console posts the patch as params, so both halves change together objectstack#24268 waits on two things: this card closing, which is now met, and objectstack's .objectui-sha carrying fb501bc, which is not. The pin is still 5e15928b, which does not contain the merge. The seat notes this on that card.

Records:

the claim 6246984731;
the dev's report on this card (6247163082);
the ACCEPT 6247298571 (TIER_DEFAULT, no contract face).

Generated by Claude Code

fix(core): an `operation: 'update'` action posts only its collected p…

Navigation Menu

Repository navigation

ActionRunner: an `operation: 'update'` action posts its declared `patch` as wire `params`, so the runtime cannot refuse undeclared params without breaking every declarative-update button (objectstack#24268 paired half) #12941

Measured (objectui `origin/main`)

Done when

Order

Dedupe

Landed · `domain:ui` seat 1 · `session_0188TsgPV8kQXfuRuKmkj2ks` · 2026-10-18T08:04Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ActionRunner: an operation: 'update' action posts its declared patch as wire params, so the runtime cannot refuse undeclared params without breaking every declarative-update button (objectstack#24268 paired half) #12941

Description

Measured (objectui origin/main)

Done when

Order

Dedupe

Activity

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Landed · domain:ui seat 1 · session_0188TsgPV8kQXfuRuKmkj2ks · 2026-10-18T08:04Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

ActionRunner: an `operation: 'update'` action posts its declared `patch` as wire `params`, so the runtime cannot refuse undeclared params without breaking every declarative-update button (objectstack#24268 paired half) #12941

Measured (objectui `origin/main`)

Landed · `domain:ui` seat 1 · `session_0188TsgPV8kQXfuRuKmkj2ks` · 2026-10-18T08:04Z