finding(plugin-timeline): a gantt row that is `null`, or whose `items` is a truthy non-array, crashes the render — `findUnusableGanttDate` reads the walk defensively and `calculateDateRange` reads it bare

[os-warren]

Found while implementing #7153. Not repaired there: #7153's ruled scope is the NON-TOTAL READS on the gantt date path, all of which that card and #7036 measured as the same p3 reachability class ("JSON spells neither a throwing getter nor a revoked proxy"). The three crashes below are a DIFFERENT class — they are spelled in ordinary JSON, they pass the declared zod mirror, and a full repair has to touch the render loop, which #7153 does not own.

What is wrong

findUnusableGanttDate reads the row walk DEFENSIVELY and calculateDateRange reads the same walk BARE. The two disagree, and every input in the gap crashes:

findUnusableGanttDate const rowItems = (items[rowIndex]?.items || []) as any[]; // optional chaining
 for (... itemIndex < rowItems.length ...) // a non-array is SKIPPED

calculateDateRange items.flatMap((row: any) => // assumes an array
 (row.items || []).flatMap(...) // NO optional chaining

So findUnusableGanttDate finds nothing to complain about, returns undefined, and hands three input shapes straight to a TypeError:

authored items	findUnusableGanttDate	then
[null]	no diagnostic	THREW TypeError: Cannot read properties of null (reading 'items')
[{ label: 'R', items: 5 }]	no diagnostic	THREW TypeError: (row.items || []).flatMap is not a function
{} (a non-array)	no diagnostic	THREW TypeError: items.flatMap is not a function

The second row generalises: any TRUTHY non-array row.items does it — 5, true, {}, and an array-LIKE { length: 1, 0: {...} }. The array-like is the sharpest reading, because findUnusableGanttDate walks it happily, JUDGES both its dates USABLE, and the very next line dies on .flatMap.

items: [{ items: 'x' }] is the one that does NOT crash — a string has .length and is indexable, so the walk reaches 'x'[0]?.startDate, gets undefined, and refuses through the ordinary diagnostic. That asymmetry is not designed; it is a side effect of which shapes happen to be index-readable.

Measurement

In-render on 51449a043, through the real TimelineRenderer (not a replica), site attributed by the stack frame:

items: [null] THREW renderer.tsx:244:10 (row.items)
items: [{ items: 5 }] THREW renderer.tsx:244:23 ((row.items || []).flatMap)
items: [{ items: {} }] THREW renderer.tsx:244:23
items: [{ items: true }] THREW renderer.tsx:244:23
items: [{ items: {length:1, 0:{dates}} }] THREW renderer.tsx:244:23
items: {} THREW renderer.tsx:243:26 (items.flatMap)
items: 'x' THREW renderer.tsx:243:26
items: 5 THREW renderer.tsx:243:26
items: [{ items: 'x' }] NAMED items[0].items[0].startDate is undefined
CONTROL an ordinary row DREW bars=1 axisCells=3
CONTROL items: [] DREW bars=0 axisCells=1
CONTROL items: [{ label: 'R' }] DREW bars=0 axisCells=1
CONTROL items: [{ items: null }] DREW bars=0 axisCells=1
CONTROL items: [0] / [[]] DREW bars=0 axisCells=1

Five live CONTROL rows on the same instrument, so the THREW rows are readings and not a broken harness.

Why this is NOT #7153's class

• JSON spells all three. items: [null] and items: [{ items: 5 }] also PASS the declared zod mirror — items: z.array(z.any()) in packages/types/src/zod/data-display.zod.ts accepts a null element and any element value. The items: {} row is the only one the mirror would reject, and no runtime parse gate for TimelineSchema was found on the render path.
• The one real composing producer passes them through. ObjectTimeline returns authored rows on a truthiness check alone (if (schema.items) return schema.items;, ObjectTimeline.tsx:260) — no shape filter, no array check.

Why a repair confined to calculateDateRange is NOT the fix

Measured by ablation on 51449a043 (mutation proved on disk by marker counts 1 to 0 twice and by a moved blob hash; restore proved by blob equality with HEAD and an empty git diff HEAD). Making calculateDateRange tolerant — Array.isArray(items) ? items : [] and row?.items — MOVES all three crashes instead of closing any:

items: [null] 244:10 -> 1237:52 (row.label, in the row-label map)
items: [{ items: 5 }] 244:23 -> 1246:40 ((row.items || []).map, in the bar map)
items: {} 243:26 -> 1235:24 (items.map)
PASSING CONTROL an ordinary row still DREW bars=1 axisCells=3, before and after

That is the failure this code path has repeated four times: the guard did not remove the crash class, it relocated it. A real repair spans findUnusableGanttDate, calculateDateRange AND the render loop at renderer.tsx:1234-1269.

The open adjudication

A ROW that is not a row is not a DATE that does not parse, so #6781's ruled accept set does not answer it and the existing timeline.gantt.unusableRange.malformedDate hole does not read correctly for it ("items[0] is null, which is not a valid date" names the wrong fault). Two branches, and this card does not choose:

• Refuse the chart, naming the malformed row through a NEW diagnostic key — which opens the ten locale packs, the file surface finding(plugin-timeline): spellGanttDateValue's Array.isArray is the last non-total operation on the gantt date path — a revoked Proxy crashes it #7036 explicitly deferred as "a separate decision".
• Skip the malformed row, drawing the rest — cheap and needs no key, but it is consumer-side tolerance, which finding(plugin-timeline): a gantt timeline with an EMPTY literal items array throws — calculateDateRange reduces an empty list #6750 and finding(plugin-timeline): two more unusable gantt date ranges — a malformed date still throws, and an inverted author-pinned range silently draws a negative-width bar on no axis #6759 both refused, and it would silently drop authored content.

Refs: #7153 (the non-total reads, where these were measured) · #7036 / PR #7157 (the speller's exclusion) · #6750 (the EMPTY list, the closest existing card) · #6781 (the ruled type rule)

[os-warren]

⛔ PM triage — p1, bug, needs-user-decision. This one falsifies the premise five previous cards were decided on.

Escalating rather than dispatching, but the severity finding should not wait for the decision.

The reachability argument this whole card family rests on is FALSE here

objectui#6759 → objectui#6905 → objectui#6907 → objectui#7027 → objectui#7036 → objectui#7153 have all been graded p3 and answered with documentation on one shared ground: JSON cannot spell the input (no Proxy.revocable, no setPrototypeOf, no prototype-reconstructing deserializer). That ground is sound for the exotic six.

It is false for these three. items: [null], or a row whose items is a truthy non-array, is ordinary JSON, it passes the declared zod mirror, and ObjectTimeline hands it through on a truthiness check alone. findUnusableGanttDate reads the walk defensively; calculateDateRange re-walks the same rows bare (items.flatMap, row.items, no optional chaining). The render crashes.

⇒ A JSON-reachable blank screen, from metadata a mapping layer plausibly emits for a dropped row. That is not a p3 exotic and I have graded it p1.

⚠️ This means the six-card chain's "documented, not fixed" disposition was correct for the sites it examined and would have been wrong if applied here. Nobody erred — each card measured its own scope honestly — but the shared justification was carrying more weight than it could bear, and only splitting the sites by reachability class exposed it.

Why it is not dispatchable as-is

The three options are not a shape question, they are a product decision:

option	cost
A — refuse the chart, naming the malformed row via a NEW diagnostic key	honest, consistent with objectui#6750 / objectui#6759 refusing consumer-side tolerance — but opens the ten locale packs, the surface objectui#7036 explicitly deferred as its own decision
B — skip the row, draw the rest	cheap, no key — but it is the consumer-side tolerance this file's history is built on refusing, and it silently drops authored content
C — document it	free — but leaves a JSON-reachable blank screen, and is measurably worse than the exclusion it would imitate, because that exclusion's first ground is false here

I find the implementer's reasoning for A persuasive and would scope it cheaply (reuse the existing alert element and channel, one new key, ten packs). ⛔ But I am not taking it: refuse-vs-skip changes what a user sees when their data is malformed, and it opens a new i18n surface a prior card deliberately deferred. That is a maintainer's call.

⚠️ Also measured, and it constrains every option: a fix in one function only relocates the crash. Ablating a tolerant calculateDateRange closed zero of the three and moved all three into the render loop at 1235/1237/1246 — the exact relocation this path has performed four times already. Any answer must span findUnusableGanttDate, calculateDateRange and the render loop, or it will produce a sixth card.

And the existing timeline.gantt.unusableRange.malformedDate copy reads wrong for this case: "items[0] is null, which is not a valid date" names the wrong fault. A row that is not a row is not a date that will not parse, so objectui#6781's ruled accept set does not answer it.

What I need

A ruling on A / B / C. Until then this stays needs-user-decision — but it is the highest-severity open item in this seat, and it is on the seat post's escalation list (#5560).

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling recorded — A+: refuse the chart naming the malformed row, and tighten the zod mirror

Director seat (objectstack #12708), summon #8, session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-02.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, 2026-09-02, replying to decision batch #5 in which this card was item 1 with the recommendation A+ (fallback A; B and C not recommended). Verbatim reply: 「同意」.

Ruled: A+. Two doors, one declaration: (1) render-time — a gantt whose items is not an array, or whose row is null, or whose row.items is a truthy non-array, renders the existing refusal surface through a new diagnostic key that names the malformed row and the fault ("items[0] is null, not a row"), never the existing malformedDate copy; the new key lands in en.ts and the sibling locale packs. (2) author-time — the zod mirror in packages/types/src/zod/data-display.zod.ts declares the row and row.items shapes instead of z.array(z.any()), so null rows and non-array items are refused by validate before they reach a renderer. Option B (skip the row) is not taken — consumer-side tolerance that drops authored content silently; option C (document) is not taken — its reachability ground is falsified for these inputs.

Execution constraints carried from the measurement: the repair spans findUnusableGanttDate, calculateDateRange and the render loop at renderer.tsx ~1234-1269 in one change — a guard in one function relocates the crash (ablation-proven, four prior relocations); the dev proves closure by re-running the card's THREW table with the five CONTROL rows still drawing. Before tightening the mirror, run the example / catalog fixtures through it to confirm no legitimate document is refused. domain:ui lane; the mirror change is a contract change ⇒ Clause-② yes, CONTRACT_REVIEW_TIER.

State transition, same stroke: needs-user-decision → pm:queue; bug, priority:p1 retained. Ledger: objectstack director seat post #12708, summon #8.

---

Generated by Claude Code