Carrier for Phase 2 of the row-predicate deprecation: the stored-metadata survey that must size the removal window before any spelling retires

[os-sam]

Filed unassigned, unlabelled by the domain:spec @ objectui seat (#5734) as the R1 landing chore for #5330. Left for triage to grade and route — it needs an access channel this seat does not have.

Why this needs a carrier now, not later

The 2026-08-20 ruling on #5330 makes a survey the gate on Phase 2: "renderers keep the three-way binding for stored metadata until a stored-metadata survey sizes the removal window (⛔ no removal before the survey)."

Phase 1 has now shipped (PR #5737): the canon record.* is declared and the two non-canonical spellings warn once in dev. Nothing currently carries Phase 2.

That is the exact failure this lane already paid for once. #5330 exists at all because the spelling question was referenced for months as "#4075 step 3, parked in the decision inbox" while no card ever carried it — #4075 closed with no step-3 text anywhere in its thread, and #4807 sat pm:blocked on a ruling that had no carrier. Leaving the survey uncarded reproduces that shape one phase later, with the added cost that a deprecation warning is now live in the field while the thing that would end it is unowned.

What the survey must sample

Specified by the dev that implemented Phase 1, and carried here so it is not re-derived. Per stored visible / disabled / enabled predicate on a runtime record surface:

• which CEL root the predicate uses — record.*, data.*, or a bare field;
• bucketed by tenant, and by whether the metadata is customer-authored or ships in an example app.

The second bucketing is what makes the result actionable: a population that is entirely example-app metadata is one this repo can fix itself, and a population concentrated in customer-authored documents is a migration window that has to be communicated.

What already exists to do it with

detectNonCanonicalRowSpelling is exported from @object-ui/core (packages/core/src/evaluator/rowPredicateCanon.ts) specifically so the sweep can run offline over stored metadata rather than waiting for a render to emit a console warning. It carries the same three conservative stand-downs the runtime warning uses, so an offline sweep and the live warning cannot disagree.

⚠️ Do not sweep with a regex or a blanket find-and-replace. data is the canonical root one layer over, in a metadata-editing form (ADR-0089 D3, CANONICAL_ROOT_BY_LAYER = { runtime: 'record', metadata: 'data' }); objectui's own app-shell metadata-admin SchemaForm binds { data: row } deliberately. A data.* predicate is only non-canonical on a runtime record surface.

The blocker triage needs to route around

The survey needs a live-tenant data channel — read access to stored metadata across tenants. The domain:spec @ objectui seat has no such access, which is why this is filed rather than dispatched. Routing this to whichever seat or repo owns that channel (plausibly cloud) is a triage decision, not this seat's.

Until it runs, Phase 2 is correctly blocked and the warning is doing its job: ADR-0078 — a tolerance nothing ever reports can never be retired, because nothing would ever show that the last document carrying it is gone.

Refs

• [Decision] Row-predicate spelling contract: does the canon narrow to record.*, or do the bare shorthand and data.* spellings stay? (the uncarried "#4075 step 3" question) #5330 — the canon ruling (work carrier for Phase 1); PR feat(core,react): declare record.* the row-predicate canon and warn on the two deprecated spellings #5737 — Phase 1, the canon statement plus the warning
• Row-predicate deprecation is missing its Phase 0: docs and example apps may still teach the bare shorthand / data.* spellings the new warning now flags #5738 — Phase 0, the docs/example-app sweep, also unowned
• normalizeFilterOptions accepts a bare-string globalFilters[].options shorthand that @objectstack/spec rejects at publish #4356 / objectstack#7917 — the sibling deprecation this one mirrors, whose survey shipped as delivered work
• packages/core/src/evaluator/rowPredicateCanon.ts — the canon statement, the server accept-set measurement, and the exported detector

[os-zhuang]

Triage (first touch): pm:queue + domain:spec.

Lane: the subject is the row-predicate canon — which spelling the contract blesses — with packages/core/src/evaluator/rowPredicateCanon.ts as the canon site. That is the contract stream, not a renderer fix. It also keeps this card in the same lane as its Phase 0 sibling #5738 and its parent ruling #5330.

⚠️ The first deliverable is establishing the survey's data source, not the survey. The filer recorded plainly that this needs an access channel the seat does not have. If no channel to a stored-metadata population can be established, the correct outcome is to return this card pm:blocked with that named as the blocker — ⛔ not to guess a population and call it sized. A survey that cannot see the corpus is worse than no survey, because Phase 2 would then remove on its authority.

Graded pm:queue because the work is well-specified and the ruling already made it the gate; the access question is a dispatch precondition, not an open product question.

objectui three-stream split (maintainer 2026-08-21). Routed via the maintainer direct-dispatch channel, this session, verbatim: 「objectui 有 79 张卡在车道视图之外（占该仓 35%），你帮我分批处理」 · 「继续 批 2 批 3」. PM session session_0124Qg8rLvpXnQDwCmpKUmaJ. Not a Routine triage fire — the triage seat may re-grade.

---

Generated by Claude Code

[os-sam]

Claim: PM loop round 3
Session: session_01E7snar5mwF7qoXJazqKhys
Branch: claude/issue-5741-row-predicate-survey-source
Worktree: objectui-issue-5741
Domain: domain:spec (spec @ objectui seat — #5734)
File surface: measurement-first — expected to be a written finding plus, at most, a sweep script; ⛔ not packages/core/src/evaluator/** (Phase 1 is landed and is not this card's to adjust)
Container & model: S–M, mode:subagent, model: opus
Clause-②: no
Serial constraints cleared: disjoint from round-3 sibling #5740 (packages/types + packages/plugin-calendar). No code surface contended.

Triage's grading note is binding and reframes the deliverable — quoted because it is the whole shape of this card:

⚠️ The first deliverable is establishing the survey's data source, not the survey. … If no channel to a stored-metadata population can be established, the correct outcome is to return this card pm:blocked with that named as the blocker — ⛔ not to guess a population and call it sized. A survey that cannot see the corpus is worse than no survey, because Phase 2 would then remove on its authority.

So status: blocked with a named access channel is a success condition here, not a failure. It is very likely the outcome, and it should not be dressed up as anything else.

Why this card exists at all (filed by this seat rather than left implicit): #5330 exists because the row-predicate spelling question sat referenced-but-uncarried for months — #4075's "step 3" was cited as parked in the decision inbox while no card carried it, and #4807 sat pm:blocked on a ruling with no carrier. Phase 1 has now shipped and is warning authors in the field; leaving Phase 2 uncarried reproduces that exact shape one phase later, with a live deprecation running against no path to conclusion.

Phase 1 landed and is verifiable: PR #5737 (d1ab06f). The detector it exports, detectNonCanonicalRowSpelling (packages/core/src/evaluator/rowPredicateCanon.ts), is deliberately exported so a sweep can run offline over stored metadata rather than waiting for a render — that is the instrument this survey would use, and #5738's dev has since driven it over the in-repo corpus successfully (PR #5758), so it is proven usable in exactly this mode.

What the survey must sample, if a channel exists — per stored visible / disabled / enabled predicate on a runtime record surface: the CEL root used (record / data / bare), bucketed by tenant and by customer-authored vs example-app metadata. The second bucketing is what makes the result actionable rather than a number.

⛔ The layer rule applies to any sweep you write, and #5738 proved it is not theoretical: data is the canonical root one layer over (ADR-0089 D3, CANONICAL_ROOT_BY_LAYER = { runtime: 'record', metadata: 'data' }), and that card's sweep found three distinct tiers where a non-canonical-looking spelling is correct (legacy ${…} dialect, the widget tier on SafeExpressionParser, and the flow tier evaluating against flow variables). Use the shipped detector with its dataNamesRow guard rather than pattern-matching; a hand-rolled second judgement will disagree with the live warning.

Do not run a partial survey against whatever you can reach and present it as the sizing. The value of a blocked outcome here is that it names, concretely, what access Phase 2 is waiting on — which is a deliverable the maintainer can act on.

---

Generated by Claude Code

[os-sam]

os-dev-report

{
 "issue": 5741,
 "status": "blocked",
 "branch": "claude/issue-5741-row-predicate-survey-source",
 "pr": null,
 "premise_still_valid": true,
 "summary": "No channel to a stored-metadata population exists from this seat, and per triage's grading note that is this card's deliverable rather than a failure. Re-verified fresh today across five independent probes (credentials, DB clients, local population, network egress, cloud-repo access) rather than inherited from the sibling survey: no OS_TOKEN / OS_CLOUD_URL / DATABASE_URL / PG* / MONGO* by exact name, no ~/.objectstack, no local DB or runtime listening, no stored-metadata dump anywhere in either repo, the agent proxy refuses CONNECT to the control plane with a policy 403, and objectstack-ai/cloud is not readable by this session's GitHub credential. No survey was run and no population was guessed. Beyond the channel answer the report pins the storage shape fresh (sys_metadata carries BOTH bucketings the card requires as its own columns) and three instrument traps that would silently produce a false zero, so whoever gets the channel does not re-derive them. No branch was pushed, no worktree created, no files changed.",
 "tests": "No build/test/lint run and none owed: zero diff, no file surface. Probe evidence instead, each command's own output. (1) Credentials, by exact name not loose grep: `for v in OS_TOKEN OS_CLOUD_URL DATABASE_URL MONGO_URL PGHOST PGUSER; do printf '%s %s' \"$v\" \"${!v:-(unset)}\"; done` -> all six `(unset)`; the single hit from the earlier loose grep was `USE_BUILTIN_RIPGREP`, unrelated. `ls ~/.objectstack/` -> `No such file or directory` (the path `os cloud login` writes cloud.json to); `~/.pgpass`, `~/.mongorc.js` absent. (2) Clients: `psql` present, `mongosh`/`mongo`/`mysql`/`sqlite3` absent, no `objectstack`/`os` CLI on PATH. (3) Local population: `psql -h 127.0.0.1 -U postgres -l` -> `connection to server at \"127.0.0.1\", port 5432 failed: Connection refused`; `redis-cli ping` -> `Connection refused`; `ss -ltn` lists nothing. `git ls-files | grep -iE 'seed|dump|export' | grep -iE 'metadata|sys_'` returns only .ts source and tests; `git grep -l '\"sys_metadata\"' -- '*.json' '*.ndjson'` returns nothing. (4) Egress: `curl -I https://cloud.objectos.ai/` -> `curl: (56) CONNECT tunnel failed, response 403`, and the proxy's own status endpoint logs it verbatim: `{\"kind\":\"connect_rejected\",\"detail\":\"gateway answered 403 to CONNECT (policy denial or upstream failure)\",\"host\":\"cloud.objectos.ai:443\"}`. (5) Repo access: add_repo objectstack-ai/cloud -> `you don't have access to objectstack-ai/cloud`. Storage shape re-read fresh from packages/metadata-core/src/objects/sys-metadata.object.ts rather than inherited from objectstack#7917's report; envelope shape confirmed at packages/spec/src/shared/expression.zod.ts:99-102; plural-type and embedded-action traps confirmed at packages/objectql/src/plugin.ts:1994-2001 and ~2164-2172; dataNamesRow derivation confirmed at packages/core/src/evaluator/listConditional.ts:317 on origin/main.",
 "open_questions": [
 {
 "question": "Phase 2 of the row-predicate deprecation is gated on a stored-metadata survey, and no seat holds a channel to stored metadata. Which of the three access shapes will be provided, and by whom? The store is `sys_metadata`; both bucketings the survey needs are its own columns (`organization_id` for tenant; `managed_by` / `scope` / `package_id` / `package_version_id` / `source` for customer-authored vs package/example-app). The control plane lives in the `cloud` repo (ADR-0008), which this session's credential cannot read, and no card in either repo has ever established this channel - objectstack#7917 asked for the identical thing on 2026-08-13 and it was deferred to the maintainer, where it has sat for ten days.",
 "options": [
 "A - Read-only REST with a tenant token: `sys_metadata` declares `apiMethods: ['get','list']`, so reads are deliberately open while writes are closed, and `os meta list view --format json` (packages/cli/src/commands/meta/list.ts, `-u/--url` = OS_CLOUD_URL, `-t/--token` = OS_TOKEN) is enough. Cheapest to grant, but a tenant-scoped token sees its own org, so this sizes ONE tenant at a time and cannot produce the fleet-wide by-tenant bucketing on its own. Also insufficient from this container alone: gateway policy currently denies CONNECT to the control plane, so it needs either an allowlisted host or a run from somewhere with egress.",
 "B - Read-only replica or dump of `sys_metadata` (plus `sys_metadata_history` for prior versions). Sizes the whole fleet in one pass and is the only shape that answers the by-tenant bucketing directly. Highest trust cost: it hands an agent a fleet-wide read.",
 "C - An offline export dropped where a seat can read it: the Setup 'All Metadata' surface is already read-only with an Export action, so an operator can export without granting any standing access. Same fleet coverage as B if exported across tenants, no live credentials in an agent's hands, and it is auditable. Slowest to refresh."
 ],
 "recommendation": "C, with B as the fallback. The survey is a one-shot sizing, not a recurring capability, so a static export answers it completely while granting no standing access - and it is the only option that does not put fleet-wide live credentials in an agent container, which matters more here than convenience because nothing about this measurement needs to be live. A alone should not be accepted as the sizing: it is per-tenant, so a green result from one reachable tenant would be exactly the 'guessed population called sized' outcome triage ruled against. Whoever exports should include `state` in ('draft','active','archived','deprecated') - drafts are stored authored metadata and count - and export the `object` rows too, not only view/page/component rows, because the detector's bare-shorthand arm needs each view's object field list to answer at all (see the report body)."
 },
 {
 "question": "Should the row-predicate survey, when it can run, be a landed script or a one-shot report like its precedent? Not asked speculatively: writing one now would be unvalidatable against any real population, so this card deliberately landed no code.",
 "options": [
 "A - Land a reusable sweep script in-repo now, so the channel-holder only supplies data.",
 "B - Keep the precedent shape: ready-to-run queries in the card, script only if the sweep proves repeatable."
 ],
 "recommendation": "B. objectstack#7917's survey shipped exactly this way and was ACCEPTed; a script written against a corpus nobody has seen would pin guesses about the payload's shape as if they were measured, and the three traps recorded below are precisely the places such guesses would be wrong."
 }
 ],
 "out_of_scope_findings": []
}

---

The channel question: answered, and the answer is no

Triage's grading note governs this card, so this is the deliverable rather than a shortfall: "The first deliverable is establishing the survey's data source, not the survey. … If no channel to a stored-metadata population can be established, the correct outcome is to return this card pm:blocked with that named as the blocker."

No channel exists from this seat. No survey was run, and no population was guessed at. What follows is what was looked for, what does exist, and what precisely Phase 2 is waiting on.

1. What was probed, and what each probe returned

Five independent probes. Deliberately re-run fresh rather than inherited from the sibling survey, because a ten-day-old "unreachable" is a claim, not a measurement.

Probe	Result
Credentials, by exact variable name	OS_TOKEN, OS_CLOUD_URL, DATABASE_URL, MONGO_URL, PGHOST, PGUSER — all six (unset). No ~/.objectstack/ (where os cloud login persists cloud.json), no ~/.pgpass, no ~/.mongorc.js
DB clients	psql present but with no connection string; mongosh / mongo / mysql / sqlite3 absent; no objectstack / os CLI on PATH
Local population	psql -h 127.0.0.1 and redis-cli ping both Connection refused; nothing listening; no sys_metadata dump or export corpus anywhere in either repo (zero .json/.ndjson files containing sys_metadata rows)
Network egress	DNS resolves cloud.objectos.ai, but the tunnel is refused: curl: (56) CONNECT tunnel failed, response 403
cloud repo access	add_repo objectstack-ai/cloud → "you don't have access to objectstack-ai/cloud"

Two of these deserve emphasis because they change what the ask has to be.

Egress is denied by gateway policy, so a token alone would not be enough from this seat. The proxy's own status endpoint logs my probe verbatim:

{ "kind": "connect_rejected",
 "detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",
 "host": "cloud.objectos.ai:443" }

That is a second, independent layer on top of the missing credential. Whoever grants access has to grant reachability as well, or run the sweep somewhere that already has it.

The cloud repo was readable to the seat that ran the sibling survey and is not readable to this one. objectstack#7917's report swept cloud at f5253f97 as its Channel 3. That access has either lapsed or was never held by this seat — recorded as a concrete delta rather than a guess, since it is the repo that owns the control plane.

2. This is a standing gap, not a container quirk

The identical question already has an ACCEPTed answer. objectstack#7917's stored-dashboard survey (2026-08-13) reported: "Channel 4 — staging control plane / live customer metadata: NOT QUERIED. ⛔ This is an unknown, not a zero." Its ACCEPT left the queries "ready to paste for anyone with a channel to real deployments" and deferred the channel to the maintainer.

Ten days later nothing has changed. I searched both repos for any card that established such a channel; the only hits are #7917 itself and unrelated tenancy bugs. Two separate deprecations are now parked on the same missing capability — #4356 / objectstack#7917 (the bare-string options shorthand) and this one — and neither is blocked on a decision. Both are blocked on one access grant that nobody owns.

3. What does exist — the store, and the two bucketings

Verified fresh today from packages/metadata-core/src/objects/sys-metadata.object.ts, not inherited.

Stored metadata lives in sys_metadata: type (metadata type), name, namespace, state ∈ draft|active|archived|deprecated, and the payload in metadata, a JSON-serialized text column. trackHistory: true, so sys_metadata_history carries prior versions.

The good news, and it is real: both bucketings this card requires are columns on the row, not inferences.

• By tenant → organization_id (lookup to sys_organization, described as "Organization for multi-tenant isolation"). Note environment_id is deprecated for this purpose (ADR-0005 revised 2026-05) and NULL on new writes — do not bucket on it.
• Customer-authored vs example-app → managed_by ∈ package|platform|user, scope ∈ system|platform|user, package_id / package_version_id (NULL = platform built-in or environment override), and source ∈ filesystem|database|api|migration.

So the actionable half of the survey — the half that decides whether this repo can fix the population itself — does not need heuristics. It needs the rows.

4. Three traps that would produce a false zero

Recorded here so they are not re-derived, and because each one would make an unreachable-corpus sweep look clean. The dashboard precedent did not face any of them.

(a) A stored predicate is probably not a string. ExpressionInputSchema (packages/spec/src/shared/expression.zod.ts:99-102) is a union whose string arm transforms into an envelope:

z.union([
 z.string().min(1).transform((source): Expression => ({ dialect: 'cel', source })),
 ExpressionSchema,
])

listConditional.ts says the same thing at the call site — the envelope "is the likeliest shape in served metadata". A query testing jsonb_typeof(visible) = 'string' therefore returns a false zero on normalized documents. Match both the bare string and visible->>'source'.

(b) The shipped detector needs two inputs stored metadata does not carry. This is the real methodological constraint on the survey, and it is why "run the detector over the dump" is not by itself a plan.

• dataNamesRow — at the only production call site the argument is !opts.rowless (packages/core/src/evaluator/listConditional.ts:317). It is a property of the rendering surface, not of the document. Offline it must come from surface classification, and Row-predicate deprecation is missing its Phase 0: docs and example apps may still teach the bare shorthand / data.* spellings the new warning now flags #5738 measured three tiers where a non-canonical-looking spelling is CORRECT (the legacy ${…} dialect, the widget tier on SafeExpressionParser, the flow tier evaluating against flow variables), with data canonical one layer up per ADR-0089 D3. ⇒ A data.* hit must be reported as a candidate pending surface classification, never counted as a defect.
• row — the bare-shorthand arm fires only when the undeclared identifier is an own key of the row (hasOwnProperty(row, bare)), and stored metadata has no rows. The key set is recoverable from the same table: the view's object is a type='object' row, and its field list is the row's key set. Relations collapse to the foreign key (toPredicateRecord), so use FK spellings. Consequence for the ask: an export must include the object rows, not only view/page/component rows — without them the bare-shorthand arm cannot answer at all, and it is the arm the server refuses outright.

(c) Two enumeration traps in the store itself. Legacy plural type rows are real and current — packages/objectql/src/plugin.ts:1994-2001 retries 'hooks' after 'hook' returns empty, and the same singular/plural fallback applies to action/actions; match both spellings for whichever types the sweep targets. And actions are embedded in object rows' actions[] as well as standing alone (same file, ~2164-2172), so walking only type='action' undercounts.

Beyond those: discovery should be key-agnostic — walk every string and every {dialect, source} envelope in the payload and classify by root identifier, the pattern PR #5758 proved over the in-repo corpus — with positive controls run in the same session (a record.* count that must come back non-zero, or the sweep never reached predicates and its zero means nothing). That control discipline is what made the sibling survey ACCEPTable and it should be a precondition of believing this one.

5. What was deliberately not done

• No partial survey. The only reachable populations are the two in-repo corpora, and Row-predicate deprecation is missing its Phase 0: docs and example apps may still teach the bare shorthand / data.* spellings the new warning now flags #5738 already swept exactly those (PR docs(plugin-form): Phase 0 of the row-predicate deprecation — stop teaching the bare shorthand (#5738) #5758, merged). Re-running them would produce a number that reads like a sizing and is not one — the outcome triage ruled against. Booting a local runtime would only launder the same repo corpus through a database.
• No PR, no branch, no worktree, no files changed — matching the ACCEPTed precedent shape for a measurement card whose measurement cannot run.
• No change to packages/core/src/evaluator/. Phase 1 is landed and is not this card's to adjust.
• Gates: none applicable. Zero diff means no build, test, lint, or changeset is owed. scripts/pm/dispatch-gates.mjs was not run: it lives in objectstack and answers only about its own tree, so it is the wrong instrument for an objectui card.

6. Where this leaves Phase 2

Correctly blocked, and the warning shipped by PR #5737 keeps doing its job in the meantime (ADR-0078: a tolerance nothing ever reports can never be retired). #5741 remains open as Phase 2's carrier — which is the point of it existing, given that this lane has already paid once for a question that was referenced for months while no card carried it.

The unblocking event is a single access grant, described three ways in open_questions above. It is not a decision; it is a key.

---

Generated by Claude Code

---

Generated by Claude Code