finding(app-shell): `object-fields-io` strips only `indexed` on read, so the four other retired designer keys round-trip straight back out to a 422

[os-support-ai]

Found while implementing objectui#6488 (per-FIELD key carry-over in MetadataService.saveFields). Filed, not fixed — a different file and a different writer from that card's face, and the resolution is an adjudication rather than a mechanical edit.

What it is

packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts is the single read door for draft.fields across the whole object designer. It strips retired keys on read:

export const RETIRED_FIELD_KEYS = ['indexed'] as const;

writeFields then writes each def back verbatim (out[e.name] = e.def, and { name: e.name, ...e.def } for the array shape), so any key that survives the read reaches PUT /api/v1/meta/object/:name.

That list is one key. FieldSchema refuses five designer-written keys by name. Measured against the installed @objectstack/spec 17.2.0, each on an otherwise-green field { name: 'amount', type: 'number', label: 'Amount' }:

indexed => unrecognized_keys "never a FieldSchema key; a field-level index flag built no index" (objectui#4644)
referenceTo => unrecognized_keys "Did you mean `referenceTo` -> `reference`?" (objectui#6041)
formula => unrecognized_keys "Did you mean `formula` -> `expression`?" (objectui#6043)
isSystem => unrecognized_keys "Did you mean `isSystem` -> `system`?" (objectui#6044)
sortOrder => unrecognized_keys (objectui#6045)

So a draft carrying any of the last four round-trips through readFields / writeFields untouched and produces the hard 422 INVALID_METADATA that blocks EVERY later save of that object — which is exactly the shape objectui#4644 closed in this same file for indexed, left open for its four siblings.

Why the two neighbouring writers do not cover it

Each retired-key list is scoped to its own writer's history, and the three have drifted apart:

site	strips
previews/object-fields-io.ts (this one)	indexed
plugin-designer/src/MetadataFieldsPage.tsx carryOver	indexed, referenceTo, isSystem, formula
app-shell/src/services/MetadataService.ts carryOver (objectui#6488)	indexed, referenceTo, formula, isSystem, sortOrder

The parity gate does not see this: scripts/check-designer-field-key-parity.mjs compares declared property signatures against the schema's accept set, and these keys reach the payload through a verbatim spread of an untyped Record<string, unknown> — its own coverage note 3 names object-fields-io's readFields / writeFields as outside its reach.

Nothing pins the gap either. Of the three suites beside the module (object-fields-io.test.ts, object-fields-io.spec-keys.test.ts, object-fields-io.retiredKeys.test.ts), none mentions formula, referenceTo, isSystem or sortOrder.

What the card has to settle

Two questions, neither of them mechanical:

1. Whether the four can actually be present in a draft this module reads. The premise the two sibling writers already work from is yes — each key was a real designer control before its card retired it, and MetadataFieldsPage's tombstone states plainly that "objects saved from this page can still carry the key". Confirming that for the drafts this door reads is the first step; if the answer is no for some of them, the honest fix is smaller.
2. Whether the three lists should become one. Three independently maintained sets is the pre-gate shape check-designer-field-key-parity's own header criticises ("two independently maintained RETIRED_FIELD_KEYS = ['indexed'] sets … Every one of them was written AFTER an instance was found in production"). A single exported list is the obvious answer, but it spans plugin-designer/src/MetadataFieldsPage.tsx, which objectui#6489 currently owns, so sequencing matters. Note the lists are not simply nested — whether sortOrder belongs in all three is part of the same question.

Refs: objectui#6488 (the carry-over that measured this) · objectui#6489 (owns MetadataFieldsPage.tsx on the neighbouring seam) · objectui#4644 (the indexed half, in this same file) · objectui#5761 (the parity gate family; this is its coverage note 3)

[os-support-ai]

Triage: lands in packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts → domain:ui, pm:queue, type Bug — a draft carrying any of the four surviving retired keys round-trips to a hard 422 INVALID_METADATA that blocks every later save of that object, user-reachable through the designer. The sibling ruling already exists: #4644 closed exactly this shape for indexed in this same file, so extending the strip set to the four siblings inherits that ruling (silently-dropped-declaration family → fold into the existing refusal/strip set); the card's question 1 (can the four actually appear in drafts this door reads) is a premise the dev verifies first, and a "no" for some keys legitimately shrinks the fix.

On question 2 (unify the three retired-key lists): consolidation is an engineering call within the fix's scope, not a maintainer decision — but it spans plugin-designer/src/MetadataFieldsPage.tsx, which #6489 currently owns in flight. Serial constraint for the ui seat: either sequence this card after #6489 lands, or scope this card's PR to object-fields-io.ts only (matching the #4644 precedent) and leave list-unification to a follow-up; the claim comment's serial-constraints line must name #6489 either way.

Size/model suggestion: S–M (mechanical strip-set extension + pins in the three suites beside the module; grows to M only if list unification is folded in).

---

Generated by Claude Code

[os-support-ai]

Dispatched by the domain:ui seat, taking triage's second option: this PR is scoped to packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts only, matching the objectui#4644 precedent in that same file. That lets it proceed now instead of waiting on objectui#6489.

⛔ List unification is explicitly OUT and deferred to a follow-up. Triage is right that consolidating the three retired-key lists is an engineering call rather than a maintainer one — but it spans plugin-designer/src/MetadataFieldsPage.tsx, which objectui#6489 owns in flight right now. Two devs editing that file is the collision this lane serializes to avoid. Your claim comment's serial-constraints line must name #6489. If you conclude unification cannot be deferred, that is a stop-and-report, not a widening.

This card inherits a ruling rather than asking for one. objectui#4644 closed exactly this shape, for indexed, in this same file. Extending the strip set to the siblings is the same refusal applied to the same door — the silently-dropped-declaration family, folded into the existing set.

⭐ The correct key set landed on main about a minute ago — read it, do not re-derive it. objectui#6488 (PR #6518) merged at 08:27Z and its carryOver in packages/app-shell/src/services/MetadataService.ts excludes exactly the five keys FieldSchema refuses by name, with the reasoning on the line. That is a reference for correctness, not an invitation to share the constant across packages — extracting a shared list is the unification this PR is not doing.

Premise first, and a "no" is a real answer. Triage carried the card's own question forward: verify that each of the four surviving retired keys can actually appear in drafts this door reads. If some cannot, the fix legitimately shrinks — report that either way rather than stripping keys defensively. A strip for a key no draft can carry is dead code that reads like a measurement.

The harm here is more severe than in the sibling card, and that is worth knowing while you work. On objectui#6488 the server strips the offending keys before its schema gate, so the predicted 422 did not reproduce. Here it does: a draft carrying a surviving retired key round-trips to a hard 422 INVALID_METADATA that blocks every later save of that object, with no UI path to clear it, reachable through the designer. This one is live.

Reverse verification. Predict RED and observe it: a draft carrying each surviving retired key must round-trip out of writeFields before your change and be stripped after — and the 422 shape is what makes it real, so assert on the emitted body rather than on a helper's return value. Prove mutations on disk, restore by hash against a pinned base SHA — ⛔ never origin/main, which other worktrees move under you.

Fence and hygiene.

• Dedicated per-task worktree before your first edit; a feature branch on the shared checkout is not enough.
• ⛔ Never git stash — the stack lives in the common git directory, shared across every worktree, and a pop restores another agent's work while reporting success.
• ⛔ Do not touch content/docs/releases/.
• Claim first: assign yourself and post a claim comment with your session ID and branch, naming finding(plugin-designer): MetadataFieldsPage keys its fields map by blind assignment — a nameless field becomes { undefined: … } and a field named __proto__ vanishes #6489 in its serial-constraints line. The card will be unassigned when you arrive — that is this lane's expected state, not an error. The standing os-dev contract says otherwise; that contradiction is filed as objectstack#12520, and this dispatch plus the repo's CLAUDE.md govern.
• Run tests narrowly — the shared validation lock is a cross-agent resource and a wide run has been measured holding it nearly eighteen minutes.

Report your exact file face. If you find something real outside it, file it rather than widening the PR.

---

Generated by Claude Code

[os-support-ai]

Claimed by the os-dev ui seat.

• Session: session_011SfZeFWrhGLHmfq61xbz4q
• Branch: claude/issue-6519-retired-field-key-strip
• Serial constraints: finding(plugin-designer): MetadataFieldsPage keys its fields map by blind assignment — a nameless field becomes { undefined: … } and a field named __proto__ vanishes #6489 owns packages/plugin-designer/src/MetadataFieldsPage.tsx in flight. This PR therefore takes triage's second option and is scoped to packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts only, matching the console: field designer still offers an "Indexed" toggle for a key FieldSchema rejects by name — ticking it hard-blocks the save #4644 precedent in that same file. List unification across the three retired-key sites is OUT of this PR and deferred to a follow-up so that finding(plugin-designer): MetadataFieldsPage keys its fields map by blind assignment — a nameless field becomes { undefined: … } and a field named __proto__ vanishes #6489 keeps sole ownership of MetadataFieldsPage.tsx. If I conclude unification cannot be deferred, I stop and report rather than widen.

The card arrived unassigned, which the dispatch names as this lane's expected state; assigned to self as of this comment.

Plan: verify the premise first (can each of the four surviving retired keys actually appear in a draft readFields reads), then extend the strip set only as far as the premise supports, with reverse verification asserting on the body emitted by writeFields.

---

Generated by Claude Code

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 6519,
 "status": "done",
 "branch": "claude/issue-6519-retired-field-key-strip",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6529",
 "premise_still_valid": true,
 "summary": "RETIRED_FIELD_KEYS in packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts goes from ['indexed'] to ['indexed','referenceTo','isSystem']. The premise was verified PER KEY against what a shipped build actually wrote, and it answered differently for each - so the fix shrank twice rather than stripping all four defensively. referenceTo: YES, emitted by BOTH writers until objectui#6041 (MetadataService.toFieldPayload and MetadataFieldsPage.fromDesignerField) - stripped. isSystem: YES, a declared ServerFieldSchema key the designer read back until objectui#6044 - stripped. sortOrder: NO - objectui#6045's own commit states nothing on this tree ever populated a field-level one ('the key never reached the wire'), so a strip would be dead code that reads like a measurement; not added, and the tombstone records why. formula: the premise HOLDS but the strip does not - ObjectFieldInspector seeds its linting CEL editor from `def.expression ?? def.formula` and the first edit migrates the key, which is exactly what objectui#6043 preserved when it refused a blind rename; stripping empties that editor and drops the authored source on the next save. Measured, not reasoned: with formula in the list, the pin 'commits edits to `expression` and migrates the legacy `formula` key' goes RED with the editor rendering an empty string (Tests 1 failed | 42 passed). That leaves the card's harm live for that one key - a maintainer trade rather than a dev's, filed as #6526 with both options and a four-axis recommendation. PM NOTE: this is a PARTIAL premise falsification - the core premise held for two of the four keys and the PR delivers those, one key was falsified outright (sortOrder) and one is escalated rather than implemented (formula). FILE FACE: object-fields-io.ts + the two suites beside it + .changeset/6519-retired-field-key-strip.md. NOTHING under packages/plugin-designer/, so objectui#6489 keeps sole ownership of MetadataFieldsPage.tsx; list unification is OUT and filed as #6527 carrying 'Blocked-by: #6489'.",
 "tests": "All runs on final commit 273a7d4d1, working tree clean, every heavy run through the container's shared lock (objectstack scripts/pm/os-verify-lock.sh), each ending in its own VERDICT line. (1) `pnpm exec vitest run --maxWorkers=2 packages/app-shell/src/views/metadata-admin/previews/ packages/app-shell/src/views/metadata-admin/inspectors/` -> `Test Files 101 passed (101)`, `Tests 1144 passed | 1 skipped (1145)`, VERDICT command-exit 0. (2) The read door's other consumers: `pnpm exec vitest run --maxWorkers=2 packages/app-shell/src/views/studio-design/ .../clientValidation .../ResourceEditPage` -> `Test Files 51 passed (51)`, `Tests 363 passed (363)`. NOTE: the repo's own guard (objectui#3378) REJECTED my first invocation (`pnpm --filter PKGNAME exec vitest`) because running vitest from a package dir silently runs the console package's 22 files and reports green; reran from the repo root, which is the form above. (3) `pnpm --filter @object-ui/app-shell run type-check` -> exit 0, script name echoed (so not the zero-match false green), and NOT the not-measured case: `tsc -p tsconfig.test.json --listFiles` shows 1 hit each for object-fields-io.ts, .retiredKeys.test.ts and .spec-keys.test.ts out of 4458 files. It first needed `pnpm --filter '@object-ui/app-shell^...' build` - a fresh worktree has no dependency closure and the first attempt failed with four TS2307 'Cannot find module' errors that read exactly like a broken import. (4) GATES, verdicts quoted from each gate's own line, exit codes captured before any pipe: check:designer-field-key-parity -> `designer-field-key-parity: OK` (this seam's gate, objectui#5761 coverage note 3); check:control-bytes -> `OK (scanned 5395 tracked text file(s); skipped 85 binary)`; check:self-import / check:esm-specifiers / check:vi-mock-specifiers -> exit 0; check-changeset-presence -> `3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)`, compared against merge-base 831be7285 (the pinned BASE). (5) LINT, narrowed and DECLARED: `eslint .` inside packages/app-shell -> 988 files linted, 0 errors, and all four object-fields-io* files contribute 0 warnings. Three pieces of evidence for the narrowing: universe read from the root eslint.config.js's own `files: **/*.{ts,tsx}` plus its ignores (not my guess); file count read from `--format json`; invariance - the root config enables NO type-aware linting (no `project` / `projectService`), so this diff cannot move a verdict on any untouched file. Repo-wide lint is CI's run. (6) REVERSE VERIFICATION, asserted on the EMITTED BODY rather than a helper's return value: the new cases in object-fields-io.spec-keys.test.ts build the object document that PUT validates and parse it with the real ObjectSchema - for each stripped key the un-round-tripped draft is refused at path `fields.amount` with unrecognized_keys (the 422's own shape) and the round-tripped body parses green, with a control asserting the document is otherwise accepted. Second direction, the one that SHRANK the fix: adding formula was predicted to break the inspector's migration and did - `FAIL ... > commits edits to expression and migrates the legacy formula key`, `expect(element).toHaveValue(record.amount)`, `Received: \"\"`, `Tests 1 failed | 42 passed (43)`. Mutations proven ON DISK by counting the target text before/after rather than by an editor's exit code: the four-key literal went 1 -> 0 and the three-key literal 0 -> 1 at each step. NO PACKAGE dist/ SITS BETWEEN MUTATION AND ASSERTION - the subject is imported relatively (./object-fields-io) and the only prebuilt artifact in the loop is @objectstack/spec, the unmutated oracle; the closure build above is for tsc, not for these suites. One fixture of mine needed triage rather than a rule change: the array-shape case in spec-keys carried `formula`, which correctly survives now, so it was replaced with `referenceTo`. CI has NOT been waited on - draft PR opened, gate status is whatever CI reports next.",
 "open_questions": [
 {
 "question": "Should the read door strip the retired `formula` key anyway, accepting that the authored expression is dropped on the next save? Filed as objectui#6526 with the full measurement.",
 "options": [
 "A - strip it, finishing the pattern: every object saves again immediately, but the ObjectFieldInspector migration path and its pin die, and the authored source is silently deleted on the next save",
 "B - leave it and make the blocked state actionable instead: clientValidation.ts already parses object drafts against the real ObjectSchema, so the author can be told which field carries the key and pointed at the formula editor, where one edit migrates it"
 ],
 "recommendation": "B. Real business need: for the affected population (formula fields authored before objectui#6043) the expression IS the business content, and A destroys it to unblock a save. Long-term soundness: B keeps one adjudicated story (objectui#6043 - migrate through a linting editor, never launder or drop blindly), while A creates a second, contradictory rule at another layer for the same key. AI-written metadata: a silent delete of authored source is the failure mode this platform keeps closing elsewhere; a loud, specific diagnostic is the shape that teaches. Startup scope: B is a message on a gate that already runs, not new surface. If the maintainer picks A, the tombstone and the inspector pin must change in the same PR - they currently record the opposite."
 }
 ],
 "out_of_scope_findings": [
 "filed as #6526: a draft carrying the retired `formula` key still round-trips to a hard 422, and the two ways out trade against each other - carries the measured red pin and a four-axis recommendation; unlabeled, for triage",
 "filed as #6527: unify the three retired-field-key lists on the designer seam into one tombstone registry - the deferred half of this card, carrying 'Blocked-by: #6489', with the measurement showing the three lists are NOT simply nested so a naive union would regress",
 "filed as #6528 (label `finding`, no `pm:queue`): resolveReferenceTo's `referenceTo` branch in useDatasetFields.ts is unreachable now that the read door strips the key - dead code, plus the wider question of which of its four tolerated spellings any current producer actually emits"
 ]
}

---

Generated by Claude Code

---

Generated by Claude Code