Uh oh!
There was an error while loading. Please reload this page.
fix(lint): resolve dotted dashboard filter fields on the object graph and drop the SYSTEM_FIELDS union - #14437
Conversation
… and drop the SYSTEM_FIELDS union (#14275)
…shboard-filter-dotted-seam
📓 Docs Drift CheckThis PR changes 1 package(s): ⛔ 2 release-owned page(s) name something this change touched. These are read-only:
What this run could not see
Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): Which tree this was computed onThis run read A worktree cut from an older # while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c2201f7f22e6c4106cad20acbc512c686857f76e && git checkout c2201f7f22e6c4106cad20acbc512c686857f76e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bd8795ea1476e1b27cd8157ee95ea93aedb4e183 e685f7839b747e24fc2bbd0e7eaf1da958df45ab && git checkout -B drift-repro bd8795ea1476e1b27cd8157ee95ea93aedb4e183 && git merge --no-ff e685f7839b747e24fc2bbd0e7eaf1da958df45ab
node scripts/docs-audit/affected-docs.mjs --json bd8795ea1476e1b27cd8157ee95ea93aedb4e183
|
Uh oh!
There was an error while loading. Please reload this page.
Fixes#14275
dashboard-filter-field-unknownresolves a dashboard-level filter's effective fieldagainst every bound widget's dataset object. It shipped with two limitations, both now
closed by migrating that branch onto the
resolveFieldPath/joinablePrefixes/injectedColumnsForseam — exactly as #14148 did one key over, on the widget's ownfilter.Head SHA for every reading below:
e685f7839.The two gaps
1. Every dotted path was skipped outright. The branch carried
whose comment said a relationship path "can't be checked here". Accurate when nothing in
packages/lintcould walk hops; false sinceresolveFieldPathlanded (#14267 for#14105). So
filterBindings: { dateRange: 'account.signed_at' }was unjudged whether ornot
accountexisted, whether or notsigned_atexisted on it, and whether or notaccountwas declared in the dataset'sinclude. The consequence is the sharper one onthis position: a dashboard filter is ANDed into every widget's analytics query, so
one unjudged dotted re-target degrades the whole board, not one tile.
2. Existence was decided against the flat
SYSTEM_FIELDSunion. The test wasobjectFields.has(field) || SYSTEM_FIELDS.has(field), which answers "could this name bea system column anywhere".
object-graph.tsdeliberately does not do that, and sayswhy: on
ownership: 'none'the platform injects noowner_id, so the union answered areal defect as resolvable. The same holds for
systemFields: { audit: false }and thebare
dateRangedefault,created_at.The migration
The (a1) loop body now mirrors (a2) limb for limb:
graph(an object this stackdoes not define, or one with no readable field map) — replacing the old
objectFieldTypes.get(datasetObject)guard, which was truthy for an object with zerotyped fields and therefore reported every filter field on it;
resolveFieldPath(graph, datasetObject, field)per filter, withisUnjudgeableverdicts never reported (ADR-0072 D1);
dashboard-filter-field-unknown, keeping the id;joinablePrefixes(dataset.include)clause for a dotted path;Message shapes. The explicit-vs-inherited wording is kept byte-for-byte for a
bare column — that is the whole shipped population, and this PR narrows an accept set
rather than re-wording what already fires. A dotted miss is rendered through
describeFieldPathVerdict, so it names which hop failed ("traversesaccount, whichis not a field on object
crm_deal"); a bare "has no fielda.b" would send the authorlooking for a column nobody wrote.
The id decision
New error id
dashboard-filter-field-not-included(exported from the barrel,documented in the module doc's rule list) rather than reusing the existence id. It
mirrors
WIDGET_FILTER_FIELD_NOT_INCLUDEDand the family's one-id-per-classconvention that PR #14368 pinned: the repair is a different edit — declare the join,
versus point the filter at something real — and a reader filtering CI output by id
should be able to tell those apart.
Consequence stated rather than left implicit:
validateWidgetBindingsissurfaces: CLI_AND_RUNTIME, so the new error id joins the #7529 runtime publish gatealongside the rule's other errors, as one "this board cannot render"
reference-integrity class (the 2026-08-15 ruling that put all of them there). The
existing "exactly the six" assertion in
runtime-gate.test.tsis scoped to the cases itexercises and is unchanged.
The #8340 answer
dashboard-filter-field-unprovisionedstays, andunprovisionedAnchorsstays as itssource. The verdict's
injectedmarker cannot replace it — the marker says the leafresolved through the injected set, never whether the anchor has storage behind it;
that derivation is
unprovisionedInjectedColumnsin the spec. What the marker does isgate the question, which is strictly better than the union membership test it
replaces: only a leaf that resolved because it is injected can be an unprovisioned
anchor (an author-declared column of the same name is one they vouch for, #7859).
It also now travels: the anchor is looked up on
verdict.object/verdict.field—the object the leaf landed on — so a dotted filter path ending on an ADR-0015
externalobject is answered too. The old branch could not do that at all; it skipped every dotted
field before reaching the provenance test. Pinned by a new test.
SYSTEM_FIELDSand the #8999 censusThe import is dropped — the branch was this file's only read site. That makes the
validate-widget-bindings.tsrow insystem-fields-consumers.test.ts's LEDGER stale, soit is deleted in the same commit, with a note recording why the file left the
population (a shrinking population is the one direction that census cannot distinguish
from a broken analyzer). The rule still references the #8116 provenance API, so its
obligation did not lapse with the row. The other nine consumers are untouched.
Fixture pass over the shipped dashboards
Per the triage ruling's standing condition. A throwaway probe (deleted before commit;
the tree is clean) ran
validateWidgetBindingsover each shipped stack twice — oncewith the rule as of the merge base
8eeca27db, once with this branch's — in oneprocess, so both readings are over byte-identical metadata.
system_overviewBefore/after on the corpus: 0 dashboard-filter findings, 0 dashboard-filter findings.
The false-positive budget is paid at zero. The platform stack's 2 findings are
chart-config-missingwarnings on two widgets, identical on both sides and untouched bythis change (filed unassigned as #14436). The platform row is assembled rather than
imported — that package ships objects, datasets and the dashboard as separate exports
and no module composes them — so every export carrying
name+fieldswas taken as anobject def.
CONTROLS — so a zero is a measurement, not a vacuous green. One shipped dashboard,
mutated, pushed through the same two calls; each control isolates one gap:
app-showcase›showcase_chart_gallery›kpi_total_tasks,its filter re-pointed at
no_such_rel.no_such_col— BASE 0, HEAD 1(
dashboard-filter-field-unknown), message: "…the effective fieldno_such_rel.no_such_coltraversesno_such_rel, which is not a field on objectshowcase_task."showcase_taskset toownership: 'none'andthe filter pointed at
owner_id— BASE 0, HEAD 1(
dashboard-filter-field-unknown).Tests
packages/lint/src/validate-widget-bindings.test.ts, 24 new cases in four blocks plusone rewrite:
block now states why: the assertion kept passing precisely because the rule had
stopped asking the question. It asserts the head-hop miss is now named.
include; unknown hop (with the "did youmean"); unknown leaf, reported against the object the leaf lives on; a hop that is
not a relationship; the explicit
filterBindingswording; thefalseopt-out stillsilent; the injected-hop skip (
owner_id.nameis unknowable, not a miss); skip 2.double-report when the path also fails to resolve; the ADR-0021 implicit-prefix rule
(
account.ownerincludesaccount); not suppressible.owner_idonownership: 'none'reports, and the mutation twin (dropownership) stays silent, so the test cannot pass for a rule that simply flags everyinjected column; the same pair for
created_atundersystemFields: { audit: false }.validateandbuild, and the clean shapepasses both.
Verification (all at
e685f7839, after the final commit)pnpm --filter @objectstack/lint testpnpm --filter @objectstack/lint run typecheckpnpm --filter @objectstack/metadata-protocol exec vitest run src/protocol.runtime-authoring-gate.test.tspnpm --filter @objectstack/example-showcase --filter @objectstack/example-crm --filter @objectstack/example-todo testpnpm lint(eslint . --no-inline-config)mainpnpm --filter @objectstack/spec check:generatednode scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commandsnode scripts/pm/dispatch-gates.mjs --repo … --ran ran.listEvery gate's exit code was captured by redirect before any pipe. 31 of 34 exit 0.
The other three are exit 3 = PREREQUISITE NOT MET = NOT MEASURED, never a pass and
never a finding — each says so in its own verdict text:
node scripts/check-test-completeness.mjs— grades a savedturbo run testlog; thefamily names it with no argument, and its own text says the local reading is NOT
MEASURED.
pnpm check:dual-build-cjs-loads— reads built output; six packages have nodist/without a full
pnpm build.pnpm check:type-check-debt—--re-measurerefuses without the whole workspaceclosure built, because measuring from here would measure a different world.
pnpm check:type-check-coverage(the sibling that does not re-measure) is exit 0.One further NOT MEASURED, stated rather than glossed:
@objectstack/lint'stypecheckprogram does not include
*.test.ts— verified withtsc --noEmit --listFiles,which lists
validate-widget-bindings.tsand neither test file. That is this package'spre-existing, ledgered TEST_DEBT (the coverage gate counts 16 such packages), not
something this PR introduced or is closing; the new tests are compiled and run by
vitest, and the suite is green.
mainwas merged into the branch before this reading,pnpm install --frozen-lockfilere-run, and the
packages/specclosure rebuilt, per the post-merge build-state rule.Generated by Claude Code
Generated by Claude Code