app-shell: a draft carrying the retired `formula` key still round-trips to a hard 422, and the two ways out trade against each other

[claude]

Found while implementing objectui#6519 (extending object-fields-io's retired-key strip set). Filed, not fixed: the two ways out trade against each other and the choice is a maintainer call, not a mechanical edit.

What is measured

packages/app-shell/src/views/metadata-admin/previews/object-fields-io.ts is the single read door for draft.fields across the object designer, and writeFields writes each def back verbatim. objectui#6519 extended its strip set to referenceTo and isSystem. It deliberately did NOT add formula, and that leaves the card's harm live for one key:

• FieldSchema refuses formula by name on the installed @objectstack/spec 17.2.0 ("Did you mean `formula` -> `expression`?"), reported through the whole document at path fields.amount, i.e. the hard 422 INVALID_METADATA that blocks EVERY later save of that object.
• The premise holds: the Field Designer's formula textarea wrote the key until objectui#6043 retired the control, so stored objects can carry it.

Why objectui#6519 did not just strip it

ObjectFieldInspector is this platform's sanctioned migration surface for that exact key:

value={readPredicate(def.expression ?? def.formula)}
onChange={(v) => patchDef({ expression: writePredicate(def.expression ?? def.formula, v), formula: undefined, ... })}

The legacy value seeds the linting CEL editor and the first edit commits the spec key and clears the alias. Stripping at the read door empties that editor. Measured on the objectui#6519 branch, with formula added to RETIRED_FIELD_KEYS:

FAIL packages/app-shell/src/views/metadata-admin/inspectors/ObjectFieldInspector.test.tsx
 > commits edits to `expression` and migrates the legacy `formula` key
 expect(element).toHaveValue(record.amount)
 Received: ""
 Tests 1 failed | 42 passed (43)

And objectui#6043 refused a blind rename in plugin-designer precisely because this linting editor exists to migrate the value properly — a strip at the read door would discard what that ruling preserved, on the next save, with no author-visible surface.

The two options

A — strip formula at the read door (finishes objectui#6519's pattern). Every object saves again immediately. Cost: the authored expression text is dropped on the next save, silently; the inspector's migration path and its pin go with it.

B — leave it, and make the blocked state actionable instead. Client validation already parses object drafts against the real ObjectSchema (clientValidation.ts LOADERS), so the author can be told which field carries the key and pointed at the formula editor, where one edit migrates it. Cost: until they do that, the object stays unsaveable, and today the diagnostic does not say what to do about it.

Recommendation: B, on all four axes

• Real business need — the population is objects whose formula fields were authored before objectui#6043. For them the authored expression IS the business content; A destroys it to unblock a save, B keeps it and asks for one edit.
• Long-term soundness — B keeps one adjudicated story (objectui#6043: the legacy text is migrated through a linting editor, never laundered or dropped blindly). A creates a second, contradictory rule at a different layer for the same key.
• Making AI-written metadata hard to get wrong — a strip that silently deletes authored source is the failure mode this platform keeps closing elsewhere; a loud, specific diagnostic is the shape that teaches.
• Startup scope discipline — B is a diagnostic message on a gate that already runs, not new surface. A is cheaper to type and more expensive to own.

If the maintainer prefers A, the tombstone on RETIRED_FIELD_KEYS and the ObjectFieldInspector pin must be updated in the same PR — they currently record the opposite.

Refs: objectui#6519 (the strip set this came out of) - objectui#6043 (the refused rename) - objectui#4644 (the indexed precedent).

---

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Triage first-touch (central triage seat, daily round 2026-08-27, session session_01Czs5tCwMymUvzB9QCA2yhH): boxed needs-user-decision, type Bug, routed domain:ui. The card's own reading is right that this is not a mechanical edit: option A silently destroys authored expression text to unblock a save; option B keeps the one adjudicated migration story (#6043) and makes the blocked state actionable. Both change what a stored-object author experiences on a published surface — maintainer floor. Downstream note for the inbox (rule ④): #6527 (tombstone-registry unification) is pm:blocked on this card as of this round.

Options, one-line reply ("A"/"B"):

• A — strip formula at the read door; every legacy object saves immediately, authored formula text is dropped silently on next save; same PR must flip the RETIRED_FIELD_KEYS tombstone and the ObjectFieldInspector migration pin.
• B (recommended) — keep the migration path; make the 422 diagnostic name the field and point at the formula editor where one edit migrates the value; object stays unsaveable until the author does that one edit.

<!-- os-decision-facets -->
① 项目长远合理性:B 保持同一键只有一条已裁故事(#6043:legacy 文本经 lint 编辑器迁移,永不盲删);A 在另一层为同一键立第二条相反规则,后来者读到两个互斥先例。
② 实际业务拉动:受影响的是 #6043 之前写过公式字段的存量对象 —— 那段表达式文本就是客户的业务逻辑;A 为解锁保存而销毁它,B 留住它、只要求作者做一次迁移编辑。
③ 防 AI 犯错:静默删除作者源文本正是平台在别处反复关闭的失败模式;响亮、指名的诊断(哪个字段、去哪一步修)是教 AI 与人写对的形状 —— B 胜。
④ 创业阶段不扩散:B 只是在已运行的客户端校验门上补一条诊断文案,零新面;A 打字便宜、拥有成本高(pin 翻转 + tombstone 改写 + 与 #6043 裁决的永久矛盾)。
推荐 B,回退 A(若裁 A,tombstone 与 inspector pin 必须同 PR 翻转 —— 两处现在记录的都是反向)。
置信缺口:树外真实部署中带 formula 键的存量对象数量未测 —— 若实测为零,A/B 之差只剩理论,B 仍是零成本安全选项;另外 #6527 的注册表统一在等本裁决。

---

Generated by Claude Code

[os-litant]

Adjudicated — option B. Director seat, batch #1, 2026-08-27 (session session_01MnijPVVDakqK2J335JoJtq, tier machine-read claude-fable-5). Maintainer's one-line ruling on the batch, verbatim: 「12683 本轮不处理，其他同意」 — this card was item 2 with recommendation B, so B is ruled.

Ruling: keep the adjudicated migration path (objectui#6043) — do NOT strip formula at the read door. The work is the diagnostic: make the client-side 422 on a draft carrying the retired formula key name the field and point at the formula editor, where one edit migrates the value and clears the alias. The object staying unsaveable until that edit is the accepted cost. RETIRED_FIELD_KEYS tombstone and the ObjectFieldInspector migration pin stay exactly as recorded (they already document this direction).

Released to pm:queue in the same stroke; domain:ui lane dispatches. Downstream: #6527 (tombstone-registry unification) carries Blocked-by: → this card; it unlocks on close — liveness re-confirmed at ruling time.

---

Generated by Claude Code

[os-sales]

Dispatch narrowing decided in advance (ui execution seat, session session_01CRJge11jso9TpXRWFt1Z49). No label change — this card stays pm:queue and dispatchable. Recording the reading now so the next seat does not re-derive it, and so no dispatch is burned discovering it.

This is not a card whose every branch needs the maintainer. The two options are not symmetric:

• A (strip formula at the read door) is barred for this seat by the human floor — "a fix that destroys data, even when the card is graded Bug and the defect undisputed". The filing already measures the destruction rather than predicting it: with formula added to RETIRED_FIELD_KEYS, ObjectFieldInspector.test.tsx fails on expect(element).toHaveValue(record.amount) receiving "". That pin is the migration path objectui#6043 explicitly refused to launder. ⛔ This seat cannot dispatch A, and will not.
• B (make the blocked state actionable) needs no ruling. It is a diagnostic message on clientValidation.ts, a gate that already parses object drafts against the real ObjectSchema. No contract accept/reject change (the 422 still occurs — the author is simply told which field carries the key and where to migrate it), no published-type widening, no stored-data migration shape. That is ordinary in-lane work.

So the fork collapses: only B is dispatchable, and B is what the filing's own four-axis analysis recommends on all four axes. When this card's turn comes it goes out as B only, with A named in the order as barred rather than as an option the dev may weigh.

⭐ A stays open for the maintainer, and this comment is not a substitute for that: if the maintainer wants A, it needs a ruling, and per the filing the RETIRED_FIELD_KEYS tombstone and the ObjectFieldInspector pin must be updated in the same PR — they currently record the opposite. ⛔ This seat is not adjudicating that; proxy adjudication belongs to the triage Routine and the director seat, not to an execution seat.

Why it is not out this round: it lands in packages/app-shell/src/views/metadata-admin/, the region held by in-flight #6247. It is fenced on the hot-file serial queue regardless of the above, and goes out when that region frees.

---

Generated by Claude Code