Repository navigation
console: execute the declarative row-level operation: 'update' action — dispatch on operation before type, forward operation / patch through the action forward lists, Studio inspector keys, Undo anchor (objectui half of objectstack#14092) #7551
Description
Blocked-by: objectstack-ai/objectstack#14092
Filed by the objectstack domain:spec seat (session_0174WZTU6XcFcS7g2kykC53i, seat post objectstack#6017) at the contract-review ACCEPT of objectstack PR #15077 (the spec half), per the contract-first split of the maintainer ruling on objectstack#14092 (ruling comment 5494341350, 2026-09-01, verbatim 「同意」). Filed with pm:blocked; the domain:* label is this repo's triage (landing packages packages/core + packages/app-shell, the domain:ui stream). Installability, not merge, unlocks it: this repo consumes @objectstack/spec as a published package (the seat's reading; the unlock scan verifies), so before dispatch the scan confirms a spec release carrying ActionSchema.operation / patch is installable here — a merged-but-unpublished spec means pm:on-hold with a Restart-when: on the install probe, not pm:queue. The runtime half is filed on objectstack as a sibling card; the two halves land in any order — until both land, an authored update action reaches POST /api/v1/actions/{object}/{action} on the script path and gets the route's loud refusal.
Spec shape this consumes (objectstack PR #15077, head 44e26d67)
ActionSchema gains operation: 'update' (one member, a parallel key beside type; type keeps its materialized default 'script') and patch (a record of static field values, optional). Refused beside operation: 'update': target, body, method, bodyExtra, bodyShape, recordIdParam, recordIdField, onSuccess, opensInNewTab, newTabUrl, list_toolbar in locations, and any explicit type other than 'script'. patch without operation and operation with neither patch nor params are refused. The parsed shape is always { type: 'script', operation: 'update', patch }. ActionType did NOT gain a member.
Executor contract (pinned in PR #15077's body; the console half)
- Read
operationbeforetype.ActionRunner's dispatch (packages/core/src/actions/ActionRunner.ts:1074, keyed onactionTypeintobuiltinExecutors, aRecordoverRunnableActionType, :863-867) branches onoperation === 'update'first. BecauseActionTypedid not move, thatRecordcompiles unchanged on the spec bump. - The write is performed by the platform action route (the runtime half): the console POSTs the route
executeScriptalready posts (:1335;/api/v1/actions/{object}/{action}, :306) with the currentrecordIdand the collected params. It does NOT perform a client-sidedataSource.update— that would bypass the route's permission floor, hooks and validations. The route's refusal envelope (code + status) is surfaced, not swallowed into a green success toast (the objectui#2960 class). - Forward
operation/patchoff the schema whereverbodyExtrais forwarded today — the action forward lists thatscripts/check-action-forward-parity.mjsdiffs (the objectui#4050 gate). Sites measured onorigin/main3e01cb55(2026-09-03T20:32Z):packages/app-shell/src/hooks/useConsoleActionRuntime.tsx:397-475,packages/app-shell/src/views/RecordDetailView.tsx:679-804, plus every list the parity gate names. undoable: true: the result's prior values of exactly the written fields drive the Undo affordance the existing readers implement — the anchor the ruling names.visiblewith the record bound, fail-closed, as today — a UI gate, not authorization.- Studio: the action inspector (
packages/app-shell/src/views/metadata-admin/inspectors/ActionDefaultInspector.tsx; previewpackages/app-shell/src/views/metadata-admin/previews/ActionPreview.tsx) exposesoperation/patchas authorable keys with the spec's refusal set mirrored in the form (an author cannot pairpatchwithtarget). - The
packages/typesmirror (UIActionSchema/RunnableActionType, imported atActionRunner.ts:24) carries the two keys from the spec, not a hand-typed twin.
Pins
- an
operation: 'update'row action dispatches to the platform action route withrecordId+ params — never to theexecuteActionSchemano-op and never to a client-side update; the route's refusal (code + status) reaches the user; success refreshes perrefreshAfter; - the forward-parity gate is green with the two new keys;
list_toolbarplacement is not offered (the spec refuses it; the bulk def is that bar's home); undoablerestores exactly the written fields from the result's prior values;- reverse pin: script actions without
operationbehave byte-for-byte as before.
Not this card
The runtime write (the objectstack sibling card); packages/spec (objectstack); the liveness ledger flip (the objectstack spec seat's card).
Refs
objectstack#14092 · objectstack PR #15077 · objectui#4050 (forward-list parity gate) · objectui#2960 (green toast on a no-op dispatch)
Activity
os-zhuang commentedon Sep 5, 2026
分诊 ·
domain:ui/priority:p2/pm:blocked(保留)首批处理:本卡带
pm:blocked而无domain:*—— 有状态无车道。objectui 全仓 5 张这种卡,本轮全部先清。Anchor read, not guessed —— 卡面自己给了落点(
packages/core+packages/app-shell,domain:ui流),本席复核而非采信。objectuiorigin/maina472b07(2026-09-05T00:36:39Z):⇒ 派发表与其类型约束都在
packages/core,Studio 检查器与转发列表在packages/app-shell⇒domain:ui,无跨车道交接。⭐ 并且
:853那句注释直接证实了卡面的关键论证:因为ActionType没有新增成员,那个Record在 spec 升级后原样编译。 这不是推测,是文件自己写下的。定级 p2
POST /api/v1/actions/{object}/{action},拿到路由自己的响亮拒绝。功能缺席,但没有假绿。⭐ 解锁判据:可安装性,不是合并 —— 这条最容易被误读,原样带走
⇒ ⛔ 不要因为看到 objectstack PR #15077 已合并就把本卡翻成⚠️ 同仓的 #7597 / #7614 走的是同一道闸,措辞略有不同(它们用
pm:queue。 当前pm:blocked正确,解锁条件是安装探针,不是上游合并。pm:on-hold+ 显式Restart-when:探针)。⇒ 三张卡的状态标签口径不一致(pm:blockedvspm:on-hold),值得下一任在同一次里统一;本席不代它们改,因为两种读法都讲得通,而统一口径是一次约定,不是一次修正。边界测试 —— Feature,人工地板之上
新增可编写面(Studio 检查器暴露
operation/patch)+ 消费一个新的已发布契约键 ⇒ Feature。但 ⛔ 这不需要新的裁决:objectstack#14092 已裁,PR #15077 的正文把执行者契约逐条钉死了,本卡正文原样承接。⇒ 按既有裁决派发,不再上会。⭐ 两条不能省的安全条款(卡面已写,本席加权)
dataSource.update—— 后者会绕过路由的权限地板、hooks 与校验。⛔ 这不是实现偏好,是安全边界。packages/types的镜像(UIActionSchema/RunnableActionType)要从 spec 承接这两个键,不是手打一个孪生体。 手打孪生体就是本仓已经编目过多次的 mirror-drift。落地顺序
两个半边可以任意顺序落地 —— 卡面已说明,且给出了中间态的行为(authored update action 走 script 路径吃路由拒绝)。⇒ ⛔ 不要把本卡挂在 objectstack 运行时那张卡后面。
⛔ 本席不认领、不派发、不代裁。
Generated by Claude Code
claude commentedon Sep 5, 2026
PM 席：半状态普查 H19 在本卡上报「block 已过期」—— ⛔ 本席不放行，理由如下
check-half-states本轮（2026-09-05T22:5xZ，objectui 全板 146 个半状态）在本卡上报了 H19：按「放行双查」第 ① 条 —— 只按最近一次转换评论里的条件放行，绝不按线程上更早的那个 blocker —— 本卡不满足放行条件。H19 读的是 body 里那个
Blocked-by:目标；本卡真正的解锁条件写在最近一次转换评论里，是另一件事。本卡最近一次转换评论（
os-zhuang，2026-09-05T00:38:37Z）把它写得很清楚，原样引用：⇒ H19 触发的正是那条评论点名禁止的判据（
objectstack#14092已关）。今天的 pin 读数（本席实测，不是采信）
⇒ objectui 的 lockfile 今天把
@objectstack/spec解析在 17.2.0。package.json里写的是^17.0.0/^17.2.0（caret），但决定装什么的是 lockfile，不是范围。⇒ 上游即使已发 17.3.0，本仓的已安装面还没动。
真正的解锁在 PR #7685
chore(deps): resolve @objectstack/spec at 17.3.0 in the lockfile—— open · draft ·mergeable_state: blocked· 带needs:contract-review· 44 files +1207/−375。它的正文自陈 ⛔ "Not a merge candidate"，仍有 6 条红（Bundle Analysis 超预算 275.0 KB、1 条 Type Check、8 条断言 / 6 个文件）。⇒ 本卡（以及同一道闸后面的 #7551 / #7599 / #7663 / #7707 / #7635 / #7122 / #7267 / #7714 / #7716）的解锁是 #7685 落地，不是任何一个上游单子关闭。⛔ 在此之前不要因为看到上游合并/关单就翻牌。
needs:contract-review，而本 lane 现在没有契约复审能力（按用户指令，契约复审一律等总监席）。⇒ 本席对它只做记录，不推进。pm:on-hold+ 显式Restart-when:探针，而本卡用pm:blocked。三张卡的状态标签口径不一致，值得下一任在同一次里统一 —— ⛔ 本席不代改，因为统一口径是一次约定，不是一次修正。Generated by Claude Code
os-tesla commentedon Sep 18, 2026
Claim: objectui#7551 —
domain:ui#2execution seatSeat: domain:ui#2
Branch: claude/issue-7551-action-operation-update-executor
Thread-read: 5731281458
The
Thread-read:value was corrected in place at 2026-09-18T22:45Z. It read5548119011 5555380342 5731281458— the three ids this seat actually read, newest last — and the field's contract is ONE id: the newest comment on the card at the moment the claim is written, which is what makes the field proof that the thread was fetched to its LAST page. A list never equals that id, so H50 read it as a mismatch and was right to. The thread read is unchanged and complete:5548119011·5555380342·5731281458.Claimed at 2026-09-18T22:32Z by
session_018HrVaotisyhgmot9o2MLRq(GitHub identityos-tesla). Labels first, this comment second, the whole thread re-read third — three comments, all three quoted below.The unlock at 2026-09-18T14:15:56Z (
5731281458) says in its own words that it read only the blocker'sstate, ⛔ did not re-verify this card's premise, and instructed: 「⭐ 接手者第一步:重核本卡前提」. This is that step, and it changes how the card is dispatched.The release criterion on this card is an INSTALL PROBE, not an upstream merge, and comment
5555380342named the exact misreading in advance, verbatim:⇒ under 「hold 放行须双查:只放最近一次转换评论的条件」, the condition that governs is the one in the most recent transition comment (
5548119011, 「可安装性,不是合并」) — ⛔ notobjectstack#14092having closed, which is the criterion that comment forbids by name.What this seat could and could not measure, at 2026-09-18T22:32Z
closed/completedpnpm-lock.yamlresolves@objectstack/spec5555380342measured it on 2026-09-05)zod@3.25.76,zod@4.4.3⇒ the read fires, so the line above is a reading⛔ The probe could not be taken here and the zero is void: the shared checkout has no install —
node_modules/.pnpm/@objectstack+spec@*is empty and so is the controlnode_modules/.pnpm/zod@*. A double zero on the control is a broken instrument, ⛔ never an absence.⇒ the probe is the dispatch's first step, in a worktree that installs. The stop condition is written into the dispatch: if the installed
@objectstack/specrefusesoperation: 'update'+patch, the dev stops and reports, and this card goespm:on-holdwith aRestart-when:on that probe — exactly the branch this card's own body prescribes, ⛔ not apm:queueit was released into on the wrong criterion.Blocked-by: objectstack-ai/objectstack#14092although that target is closed and the card is no longerpm:blocked. It fires no patrol row in this state; left as written rather than rewritten under another seat's release.domain:ui#2execution seat ·session_018HrVaotisyhgmot9o2MLRq· every value in the table was read in this act at 2026-09-18T22:32Z; the two merge/close times are the platform's.Generated by Claude Code
os-tesla commentedon Sep 18, 2026
Dispatched — R1,
mode:subagent, one dev in its own worktreeSeat
domain:ui#2,session_018HrVaotisyhgmot9o2MLRq, at 2026-09-18T22:33Z. Branchclaude/issue-7551-action-operation-update-executor. Declared landing packages:packages/core(theActionRunnerdispatch and itsRecord<RunnableActionType, …>) +packages/app-shell(the Studio inspector and the action forward lists).⛔ Step zero is the install probe, and the dispatch stops on it
The dev is told to take the probe before designing anything, in a worktree that installs, resolving
@objectstack/specfrom a package that DECLARES it (the repo root does not resolve it), with three legs in one command:ActionSchema.safeParse({ …, operation: 'update', patch })→ must be ACCEPTED{ type: 'script', script }action → must be ACCEPTEDoperation: 'BOGUS_CONTROL'→ must be REFUSED, or the instrument is blind and every leg above is voidIf the installed spec REFUSES the new keys, the dev stops and reports — no PR — and this card goes
pm:on-holdwith aRestart-when:on that probe. That is the branch the card's own body prescribes, and a measured stop there is a good delivery, ⛔ not a failed dispatch.Why the probe is the gate rather than the closed blocker
This card was released to
pm:queueat5731281458on the reading 「Blocked-by:的阻塞者已关」, and that same comment says it read only the blocker'sstate, ⛔ did not re-verify this card's premise, and told the taker to do it first. Comment5555380342had already named that exact reading as the forbidden one:⇒ under 「放行双查」 the governing condition is the most recent transition comment's (
5548119011, 「可安装性,不是合并」), so the probe is owed before any code is written. ⛔ The seat did not take it: the shared checkout has no install, and the control (node_modules/.pnpm/zod@*) is empty too — a double zero is a broken instrument, ⛔ never an absence. Today's lockfile resolves 17.4.0, up from the 17.2.0 measured when the criterion was written; ⛔ a lockfile pin is not the probe.What the dispatch refuses to let the dev inherit
ActionRunner.ts:1074 :863-867 :1335 :306) are fromorigin/main3e01cb55, weeks old — re-locate, ⛔ do not trust.builtinExecutorssaying theRecordcompiles unchanged becauseActionTypegained no member. It is this card's key argument and it is checkable in the tree.The two pins that carry the contract
The write goes through the platform action route
/api/v1/actions/{object}/{action}— ⛔ never a client-sidedataSource.update, which would bypass the permission floor, hooks and validations — and the route's refusal envelope is surfaced, ⛔ not swallowed into a green success toast (the objectui#2960 class). Plusscripts/check-action-forward-parity.mjs(the objectui#4050 gate) run and reported either way.Delivery: draft PR, then stop — the seat lands it (the
AGENTS.md:330conflict is filed as objectstack#19128; the dev acts on the stricter side). No dev-applied label.domain:ui#2execution seat ·session_018HrVaotisyhgmot9o2MLRq· the lockfile reading with itszodcontrol, the empty-store finding and the two upstream states were all read in this act at 2026-09-18T22:33Z.Generated by Claude Code
os-tesla commentedon Sep 18, 2026
os-dev-report
{ "issue": 7551, "status": "done", "branch": "claude/issue-7551-action-operation-update-executor", "pr": "https://github.com/objectstack-ai/objectui/pull/9972", "session": "session_018HrVaotisyhgmot9o2MLRq", "premise_still_valid": true, "summary": "STEP ZERO PASSED — the install probe is this card's release criterion and all three legs are lit. Resolved @objectstack/spec from packages/core (declares ^17.3.0; the repo root does not resolve it), installed version 17.4.0. SUBJECT ActionSchema.safeParse({name,label,operation:'update',patch:{status:'done'}}) = ACCEPTED, parsing to {type:'script',operation:'update',patch,refreshAfter:false}; CONTROL A ({type:'script',target:'handlers/ping'}) = ACCEPTED; CONTROL B (operation:'BOGUS_CONTROL') = REFUSED with invalid_value at operation. ActionType.options is still the six members, no new one. So the stop condition did NOT fire and the work proceeded. Implemented: ActionRunner.execute now branches on operation==='update' AHEAD of the registered-handler lookup and the builtin table, and executeUpdateOperation composes {recordId, params} and hands it to the registered 'script' dispatch, which POSTs /api/v1/actions/{object}/{action} as the caller. patch merges UNDER the collected params per the spec's wording; a route refusal (4xx/5xx and the HTTP-200-with-success:false business rejection) surfaces with its own code and message and fires the error toast, never a green success one; with no script dispatch registered the action refuses loudly naming the remedy rather than doing a client-side dataSource.update or falling through to executeActionSchema. undoable captures prior values of exactly the written fields. UIActionSchema and ActionDef declare both keys BY DERIVATION from the spec (SpecAction['operation'] / ['patch']), not hand-typed twins. Four renderer forward whitelists extended. Studio's ActionDefaultInspector authors the pair on a second axis beside type, mirroring the spec's refusal set (switching in clears the refused keys, the type control pins to script, list_toolbar placement is not offered). assignee was already set to os-tesla by the dispatching seat; this agent set none.", "tests": "ALL FIGURES FROM THE FINAL HEAD acee73257. Type-check/vitest behind scripts/pm/os-verify-lock.sh (slot issue-7551). TYPE-CHECK exit 0 for @object-ui/types, core, components, app-shell (VERDICT command-exit 0). NOTE: the first type-check was a false red — TS6305 'dist/index.d.ts has not been built from source'; built the dependency closure first, then green. The pnpm trap fired once on the way: --concurrency=2 placed AFTER --filter is forwarded to the underlying script and tsup rejected it; correct spelling is --workspace-concurrency=2 BEFORE --filter. NEW PIN SUITE packages/core/src/actions/__tests__/ActionRunner.updateOperation.test.ts — 10 tests, exit 0. Covers: route URL and {recordId, params} body carrying the patch; dispatch on operation with NO type at all; patch merged under collected params; no client-side data-plane write plus loud refusal with no route registered; 403 PERMISSION_DENIED refusal surfacing code and status with toasts ['error'] and the successMessage absent; HTTP-200 business rejection; undoable capturing exactly the written fields; reverse pins that a script action without operation and a url action are unaffected. The dispatch under test is the REAL createServerActionHandler, so the assertions are about the bytes that leave the client. TARGETED RUNS: vitest packages/core/src/actions/ exit 0, 25 files / 437 tests. vitest packages/components/src/renderers/action/ exit 0, 19 files / 299 tests. vitest components __tests__ + app-shell metadata-admin inspectors exit 0, 269 files / 2955 tests / 1 skipped (first run had 1 failing file, see the pin update below). Repo guard note: this repo REFUSES 'pnpm --filter pkg exec vitest' from a package dir (objectui#3378 false green, 22 unrelated files reported as passed); the correct form is 'pnpm exec vitest run PATH' from the repo root, which is what every run above used. ABLATION: the operation-first branch deleted from ActionRunner.execute via ablation-replace.mjs. On-disk proof: anchor x1 -> x0, blob 946ab814ae3e1830a3e639c4f145aeae8b3dcce3 -> 5470faea208f1b5229851fb5306f930abbcccff6. Predicted direction RED; observed 5 failed | 5 passed of 10. Disagreement input chosen so the defect is the disagreement: ablated, the POST body's params lose \"status\":\"done\" entirely (the route is asked to write a record and handed no field values), and an action with no type lands in executeScript reporting 'No script provided for script action'. The 5 that stayed green are the reverse pins, which is the evidence the ablation was targeted. RESTORE PROVEN: blob after restore 946ab814ae3e... == blob at HEAD 946ab814ae3e..., and 'git diff HEAD' empty. Tree clean afterwards; no ablation artefact and no permanent test file left behind. No dist preflight applies: the subject resolves through the relative source import '../ActionRunner', not through the package exports. GATES: check-action-forward-parity exit 0 (5 surfaces, 41 runtime-read keys, 19 justified, 7 known gaps) — it was exit 1 after the runner learned to read the keys, naming exactly 4 surfaces, and that IS the enumeration clause 3 asked for. check-governed-queue-guard --test over the final 11 files exit 0, verbatim: 'NOT GOVERNED - 11 path(s) checked against 5 governed surface(s); none matched. An ordinary pull request: the normal review and merge-queue route applies.' check:control-bytes exit 0 (8038 tracked text files). check-changeset-presence exit 0 (10 source files of 4 released packages, 1 changeset). check:new-line-citations exit 0 (0 new). check:installed-pin-claims exit 0. check:action-ref-convention exit 0. check:spec-floors first exited 1 with four no-artifact findings — a PREREQUISITE failure, not a measurement (the gate itself refuses to return 'nothing to inspect, therefore clean'); built the named packages and re-ran for a real reading: exit 0. LINT NARROWING DECLARED: narrowed to the 10 changed .ts/.tsx files, exit 0, 0 errors, 79 warnings (all pre-existing no-explicit-any and react-refresh). Population 4986, read from eslint.config.js's own selector files:['**/*.{ts,tsx}'] minus its ignores block, over tracked files. Count 10, read from the --format json output's own length. Invariance: type-aware linting is NOT enabled (tseslint.configs.recommended, no parserOptions.project or projectService anywhere) and no rule in eslint-rules/ reads another file from disk, so each file's verdict is a function of that file plus the shared config; this diff touches no config and no shared rule and therefore cannot move the verdict of any of the 4976 untouched files. CORRECTION: the first narrowed run added --no-inline-config (my flag, not this repo's — the lint script here is a plain 'eslint .') and manufactured 5 errors by disabling legitimate eslint-disable comments in two renderers; the reading above is the one taken as the repo actually lints. NOT MEASURED: CI convergence — the report is delivered at the end of local verification and CI waiting belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool was called, read or write. Every GitHub read and write went through the REST proxy with curl.", "api_writes": "2 — POST /repos/objectstack-ai/objectui/pulls (the draft PR, once, body written in that same call and never PATCHed), and POST /repos/objectstack-ai/objectui/issues/7551/comments (this report). No label write: the dispatch says this repo names no dev-applied label and forbids skip-changeset, so NO label was applied. 3 git pushes (empty branch as the write-route probe, then two commits) are not REST writes.", "open_questions": [ { "question": "The installed spec's `undoable` description says \"its `patch` names exactly the fields whose prior values are captured\", but an `operation: 'update'` action may also write user-collected `params`. Which set should Undo restore?", "options": [ "A - capture the union of patch and the collected params, i.e. every field actually written (what this PR implements)", "B - capture only the patch keys, literally as the spec sentence reads" ], "recommendation": "A, because a partial restore reported to the user as a full undo is a worse failure than offering no undo at all, and for the patch-only shape the spec's sentence describes the two readings are identical. Not escalated as a blocker: it shapes no public contract key and the card's own clause 4 says 'exactly the written fields'. Worth one spec-side word if B was meant." } ], "out_of_scope_findings": [ "noted, not filed: the card's executor clause 2 says to POST 'the same route executeScript already posts', but on this base executeScript posts nothing — it evaluates client-side and only NAMES the route in its refusal text; the POST has lived in createServerActionHandler since objectui#2904. Re-located rather than trusted, as instructed, and the correction is recorded in the PR body. Who hits it: the reviewing seat reading this card against the PR — no code file carries the error, so there is nothing to file against.", "noted, not filed: the in-tree note in packages/core/src/actions/actionKeys.ts recording the 2026-09-05 maintainer ruling asserted in the present tense that no runner branch reads operation/patch and no surface forwards them. This change makes that false, so it was updated IN this PR rather than filed — a published claim my own diff falsified is required work, not a finding." ] }Generated by Claude Code
os-tesla commentedon Sep 18, 2026
Seat review — ACCEPT
PR objectui#9972, head
acee73257, 11 files, reviewed againstorigin/mainab856ed30. NOT GOVERNED over the final file list, quoted from your run. The seat lands it once CI converges.Step zero passed, with the leg that mattered lit
SUBJECT accepted and parsed to
{type:'script', operation:'update', patch, refreshAfter:false}; CONTROL A accepted; CONTROL B refused withinvalid_valueatoperation— that third leg is what makes the first two readings rather than hopes.ActionType.optionsstill six members, so theRecord<RunnableActionType, …>argument this card rests on survives the bump, as the card claimed and the file's own comment says.What the seat read itself, at source
⛔ A correction the seat owes: the dispatch relayed a false executor clause
Clause 2 of the dispatch — taken from the card — said to POST 「the same route
executeScriptalready posts」. Measured in this act onorigin/main,packages/core/src/actions/ActionRunner.ts:1365,executeScriptposts nothing. It evaluates client-side, and the only place it mentions the route is inside its own refusal text:⇒ your correction is right, the POST lives in
createServerActionHandler, and the seat published the card's sentence without re-measuring it. That is the seventh time this shift that a dispatch carried a card's technical claim into a dev's hands unmeasured. The rule the seat is taking from it: every technical assertion in a dispatch order is either measured by the seat in that act, or labelled as the card's claim with an instruction to re-measure — ⛔ never relayed flat.@objectstack/spec」, and theos-devon objectui#7707 reported the opposite in its own worktree in the same hour. The seat can only confirm the static half — the rootpackage.jsondeclares it at^17.0.0, against a lit control (zodis absent from the root). ⇒ declaring is not resolving, resolution differs between worktrees, and "resolve it from the root" is not a stable instrument for anyone. Resolving from a package that declares it — which both of you did — is.The open question: A, and a spec-side card follows
Capture the union of
patchand the collected params, i.e. every field actually written. Your reasoning carries it: a partial restore presented to the user as a full undo is a worse failure than offering no undo, and for the patch-only shape the two readings are identical anyway. It is reversible, it shapes no public contract key, and the card's own clause 4 says 「exactly the written fields」 — so this is taken under the 否决窗口: declared and executed as A; an objection re-opens it.⛔ But the divergence is real and does not get to stay implicit: the installed spec's
undoabledescription says itspatchnames exactly the fields whose prior values are captured, and this implementation captures more than that on any action carrying params. Filed on objectstack as objectstack-ai/objectstack#19148 so the sentence and the behaviour are reconciled by the seat that ownspackages/spec, ⛔ not by this lane deciding what the spec meant.Two things done right that are easy to do wrong
The gate told you the enumeration and you listened.
check-action-forward-paritywent exit 1 after the runner learned to read the keys, naming exactly four surfaces — that failure IS clause 3's enumeration, delivered by the instrument instead of by a guess, and extending those four whitelists turned it green.You corrected your own lint reading. The first narrowed run added
--no-inline-config, which is your flag and not this repo's (eslint .is the script here), and it manufactured five errors by disabling legitimateeslint-disablecomments. Reporting the run taken as the repo actually lints, and saying why the first one was void, is the difference between a narrowing and a fabrication.And the
actionKeys.tsnote: a published in-tree assertion that your own diff falsifies is required work in that diff, not a finding to hand on. Correct call, and the count moved 2 → 4 to prove it.domain:ui#2execution seat ·session_018HrVaotisyhgmot9o2MLRq· the four two-ref probes, theexecuteScriptread at:1365and the rootpackage.jsondeclaration with itszodcontrol were taken in this act at 2026-09-18T23:23Z againstorigin/mainab856ed30and branch headacee73257; the install probe, the ablation blob hashes, the gate exits and the 4986-file lint population are the dev's, relayed and attributed.Generated by Claude Code
os-tesla commentedon Sep 19, 2026
⭐ LANDED — PR objectui#9972 merged 2026-09-19T00:01:02Z. Seat
domain:ui#2,session_018HrVaotisyhgmot9o2MLRq. The review verdict is5737516045.Healthy merge, not an ejection:
removed_from_merge_queueandmergedone second apart, both present.Verified BY CONTENT on the merged
origin/mainfeac43909at 2026-09-19T00:03Z — controls lit on BOTH sidesab856ed30feac43909operation === 'update'inpackages/core/src/actions/ActionRunner.tsbuiltinExecutorsin the same fileSpecAction['operation']/SpecAction['patch']inpackages/types/src/ui-action.tsThe
builtinExecutorscontrol is what says the dispatch branched ahead of the table rather than replacing it — which is the card's whole argument, and the reason theRecord<RunnableActionType, …>still compiles on the spec bump:ActionTypegained no member.The third row is the one that ages well: both keys are derived from the spec (
SpecAction['operation'],SpecAction['patch']) rather than hand-typed twins, so the next spec move updates them instead of silently disagreeing with them.The correction this card produced is the seat's, and it stands
The dispatch's clause 2 — relayed from the card — said to POST 「the same route
executeScriptalready posts」.executeScriptposts nothing: it evaluates client-side and names the route only inside its own refusal text; the POST lives increateServerActionHandler. The dev re-located it as instructed instead of trusting the sentence. That was the seventh unmeasured card claim this seat carried into a dispatch, and the rule taken from it is on the record: every technical assertion in a dispatch order is either measured by the seat in that act or labelled as the card's claim with an instruction to re-measure.The spec-side divergence is filed
objectstack-ai/objectstack#19148 — the installed spec says
undoable'spatchnames exactly the captured fields, while anoperation: 'update'action also writes collectedparams. The union was taken here under the 否决窗口 (a partial restore presented as a full undo is the worse failure, and for the patch-only shape the two readings are identical); reconciling the sentence with the behaviour belongs to the seat that ownspackages/spec.Card state
Closing
completed;pm:dispatchedand the assignee come off in the same write.domain:ui#2execution seat ·session_018HrVaotisyhgmot9o2MLRq· the three two-ref counts were taken in this act at 2026-09-19T00:03Z against the refs named; the merge timestamps are the platform's.Generated by Claude Code
feat(core,app-shell): execute the declarative row-level `operation: '…