[objectstack-fleet]

Requested by Bill · project thread
domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

维护者速读

• 改了什么：advisory 校验规则（severity: 'warning' / 'info'）里对日期做加减时，报错不再说「字段静默得到 null」，改说「规则被跳过、写入照常进行、只留一行日志」，配新码 date-arithmetic-fail-open / date-text-arithmetic-fail-open，文案与同位置的类型不匹配判词一字不差。
• 为什么改：advisory 规则出错时运行时跳过该规则并放行写入，那里没有字段，也没有东西读到 null，旧句说的是不会发生的事。
• 风险与回滚：分级不变（仍是 error），发布门不收也不放，只换文案和码。按旧码 date-arithmetic / date-text-arithmetic 识别 advisory 规则的使用方需改认新码。公式字段原码原句不动。回滚即 revert，无数据迁移。
• 先看：packages/formula/src/validate.ts 的 dateArm 与 dateArmFault（fail-open 分支），packages/formula/src/expression-refusal.ts 的两个新码。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/validate-expressions.test.ts -t 30494，预期 1 条通过：warning / info 规则的日期判词说规则被跳过、写入照常，不含 null；公式字段对照仍说 null。
• 需要你做的：无，席位落地。

Fixes #30494

Clause-②: yes (widening) — two codes join @objectstack/formula's exported ExpressionRefusalCode / EXPRESSION_REFUSAL_CODES: date-arithmetic-fail-open and date-text-arithmetic-fail-open, each with the params of the code it splits from. An advisory rule's date verdicts move to them from date-arithmetic / date-text-arithmetic (a consumer keyed to the old codes on an advisory rule re-keys). The grade is unchanged; what is refused, warned or passed is unchanged.
Metadata-protocol: none — what an author can write is unchanged, and os validate reports no expression refusal code: its findings are @objectstack/lint's ExprIssue (where, message, source, severity, path), re-measured at packages/lint/src/validate-expressions.ts:157, which carries no code. Only the message text changes there.
Skills-docs: none — git grep -c "silently evaluates to null" -- skills answers no hit (exit 1); control: git grep -c "evaluates to" -- skills hits skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md and skills/objectstack-data/rules/validation.md, none of them about a date verdict on an advisory rule.

What changes

Measured on main with PR #30492 merged (67d5d5375), and again after origin/main was merged at a4c3e738.

site	before	now
advisory (warning / info) validation rule (faultOutcome: 'fail-open'): date arithmetic	date-arithmetic / date-text-arithmetic, error, "this faults at runtime, so the field silently evaluates to null."	date-arithmetic-fail-open / date-text-arithmetic-fail-open, error: "this faults at runtime, and here the rule is advisory, so a rule that cannot be evaluated is skipped, not refused: the write proceeds, the rule is never applied (its advisory never fires), and the only trace is a log line saying it could not be evaluated."
formula field, display predicate (no outcome)	date-arithmetic / date-text-arithmetic	unchanged, code and sentence
fail-closed site, flow condition	the -fail-closed / -run-fails / -run-may-fail codes	unchanged

• One outcome, one sentence. dateArmFault closes the fail-open arm on TYPE_MISMATCH_FAULT_ARMS['fail-open'].clause itself, not a copy, so the date verdict and the type-mismatch verdict on the same rule cannot drift apart.
• One code per template, as formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 did for fail-closed: expression-refusal.ts is the contract that a code names one message template.
• No new signal. @objectstack/lint's faultOutcomeOf ledger already answers fail-open for a warning / info rule (validate-expressions.ts:1358), and MCP validate_expression already passes it for site: 'validation' with severity: 'warning' | 'info' (mcp-http-tools.ts:666). Neither package changes.

Tests

• packages/formula/src/validate.test.ts:
  • new: on a fail-open record site, record.start_date + 1 > 3 and record.end_date - record.start_date > duration("24h") get the -fail-open codes and the fail-open sentence, and not "evaluates to null". Control: the same two predicates with no outcome keep date-arithmetic / date-text-arithmetic and the null sentence;
  • changed: the formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 test's third control asserted that an advisory rule keeps date-arithmetic and the null sentence, which is this card's defect. That row is dropped; its formula-field controls stay.
• packages/formula/src/expression-refusal-codes.test.ts: a PINS entry for each new code (exact params and message), and SWEEP_SCHEMAS gains the fail-open date schema, so the sweep reaches both codes and holds their params to their messages.
• packages/lint/src/validate-expressions.test.ts, new: a warning rule and an info rule with date arithmetic say the rule is skipped and the write proceeds (not null, not refused). Control: a formula field's record.close_date + 1 keeps the null sentence.
• packages/mcp/src/mcp-validate-expression.test.ts: unchanged, verbatim. Measured once with a probe file that was deleted afterwards (not committed): validate_expression at site: 'validation' answers date-arithmetic-fail-open / date-text-arithmetic-fail-open for severity: 'warning' and 'info', -fail-closed for 'error', and date-arithmetic at site: 'formula'; each message equals validateStackExpressions' on the same rule.

Suites and red-first

red first (pins only, on PR #30492's head, commit 89eebeec):
  formula  × on an advisory rule says the rule is skipped … (#30494) · × has a pin for every code   Tests 2 failed | 181 passed (183)
  lint     × says an advisory validation rule's date arithmetic skips the rule … (#30494)           Tests 1 failed
merged head dfc91e9d (origin/main a4c3e738 merged once), under os-verify-lock, shared box:
  formula test   Test Files 64 passed (64)    Tests 1652 passed (1652)
  lint test      Test Files 195 passed (195)  Tests 8093 passed (8093)
  mcp test       Test Files 56 passed (56)    Tests 678 passed (678)
  typecheck (formula, lint, mcp): exit 0
  objectql src/publish-type-mismatch-fail-closed.test.ts   Tests 12 passed (12)

Ablation (scripts/ablation-replace.mjs; restored: blob == HEAD, git diff HEAD empty, dist marker absent after rebuild, tree clean)

A1  formula: the fail-open date arm off
    anchor   faultOutcome === 'fail-closed' || faultOutcome === 'fail-open' ? faultOutcome : null
    replace  faultOutcome === 'fail-closed' || String(faultOutcome) === 'ablated-30494-a1' ? faultOutcome : null
    anchor x1 -> x0, replacement x0 -> x1, blob 8931039644aa -> 19c5c422d2f2
    rebuilt (tsup JS emitted; the DTS step exited 1 on the mutated return type), ablation-dist-preflight:
    marker present in dist/index.js and dist/index.mjs
    formula  × on an advisory rule … (#30494) · × date-arithmetic-fail-open · × date-text-arithmetic-fail-open · × the SWEEP
             Tests 4 failed | 181 passed (185)
    lint     × says an advisory validation rule's date arithmetic skips the rule … (#30494)
             Tests 1 failed | 473 passed (474)
    restore: blob 8931039644aa == HEAD, git diff HEAD empty; rebuild exit 0; preflight --absent: marker absent from all 6 built files, tree clean

Acceptance notes

• packages/lint/src/validate-expressions.ts:1338-1341 doc comment names the date verdicts' -run-fails, -run-may-fail and -fail-closed arms and not the new -fail-open one. It says nothing false (it never says an advisory rule keeps the null sentence), and packages/lint/src/** source is outside this card's file surface, so it is left as is.
• The formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 changeset (.changeset/30250-fail-closed-date-and-sweep-run-fails-sentences.md) says an advisory rule keeps date-arithmetic / date-text-arithmetic. Both changesets ship in the same release; this PR's changeset says it replaces that note, and the other file is not edited here.
• content/docs/data-modeling/formulas.mdx date-arithmetic row says "this always faulted to null". That describes a formula's runtime, and this PR changes no runtime, so it is left as is (as formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 left it).
• Merge. origin/main was merged once at a4c3e738. The branch had carried PR fix(formula,lint,mcp): a fail-closed date verdict says the write is refused, and a time-relative sweep's run-fails verdict names no firing write #30492's head as a merge until it landed as a squash, so git reported conflicts in the five files both sides touch. They were resolved by applying this branch's own diff (ebda9aca..34b93ec4) to origin/main's copies: it applied cleanly, and the changed lines of the resolved delta are identical to that diff's.

Verification

All at head dfc91e9d (git rev-parse --short HEAD), the commit this PR opens on (origin/main merged once, at a4c3e738).

• Full build after the merge: pnpm install --frozen-lockfile && turbo run build --filter='!@objectstack/docs' --concurrency=2, 119/119 tasks, VERDICT command-exit 0.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: change set of 6 paths vs merge base a4c3e738b, 58 derived families, each run on this head, all exit 0 (each exit code recorded before any pipe). check-plugin-teardown-shape.mjs --self-test ran after fetching its pinned fixture commit 621a4876 into the shallow clone ("48 cases pass"). --ran: "58 derived famil(ies) accounted for — 58 run, 0 NOT-MEASURED". Among them check-adr-0087-registration --base origin/main, check-changeset-no-major, check-empty-changeset, check:doc-authoring, check:docs-transcript-drift, check:test-source-alias, check:cross-package-test-inputs, check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:nul-bytes, check:closing-keyword-parity.
• pnpm lint (eslint . --no-inline-config): exit 0.
• Full dogfood: not run. The title has no ! and Clause-② has no (narrowing) arm.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Utp6CbJFWadws6f9r4B8Ke

[github-actions]

📓 Docs Drift Check

5 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2ffdb649775d20313707d88a8388275f280a0a7f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7886a3daa57310c24e3764b14ffb1012e8350df9 — the merge of head dfc91e9df6c84797eb6c6f03451d60a62839814b into base 2ffdb649775d20313707d88a8388275f280a0a7f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7886a3daa57310c24e3764b14ffb1012e8350df9 && git checkout 7886a3daa57310c24e3764b14ffb1012e8350df9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 2ffdb649775d20313707d88a8388275f280a0a7f dfc91e9df6c84797eb6c6f03451d60a62839814b && git checkout -B drift-repro 2ffdb649775d20313707d88a8388275f280a0a7f && git merge --no-ff dfc91e9df6c84797eb6c6f03451d60a62839814b

node scripts/docs-audit/affected-docs.mjs --json 2ffdb649775d20313707d88a8388275f280a0a7f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

Contract review

Served-tier: TIER_DEFAULT
Head-sha: dfc91e9df6c84797eb6c6f03451d60a62839814b
Local-runs: none

① Derived judgments

• Exported surface: widening, and correctly declared. Two codes join ExpressionRefusalCode / EXPRESSION_REFUSAL_CODES (CODE_TABLE in expression-refusal.ts): date-arithmetic-fail-open and date-text-arithmetic-fail-open. Each takes the params of the code it splits from (operands, optional reference). No other exported member changes.
• Grades unchanged. dateArm returns fail-open only on a record-scoped site with faultOutcome: 'fail-open', where the date verdict was already an error. A site with no outcome (formula field, display predicate) still returns null and keeps date-arithmetic and the null sentence. The flattened (flow) arms are untouched.
• One outcome, one sentence. dateArmFault's fail-open arm closes on TYPE_MISMATCH_FAULT_ARMS['fail-open'].clause itself, so the date verdict and the type-mismatch verdict on the same advisory rule cannot drift.
• Consumers: no change needed. lint's faultOutcomeOf already answers fail-open for a warning / info rule, and MCP validate_expression already passes it for site: 'validation', so the parity test stays verbatim (the dev measured both codes through MCP with a deleted probe).

② Semver level

• Clause-②: yes (widening) and a patch changeset on @objectstack/formula match the precedent for a code-split widening (expression gate: a date-arithmetic verdict in a flow condition still says the value "silently evaluates to null", though the run fails #30016, formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 / PR fix(formula,lint,mcp): a fail-closed date verdict says the write is refused, and a time-relative sweep's run-fails verdict names no firing write #30492).
• Metadata-protocol: none is right: os validate reports lint's ExprIssue, which has no code field. Only message text changes there.

③ Boundary flags

• Existing assertions: one control row of the formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 test asserted that an advisory rule keeps date-arithmetic and the null sentence, which is this card's defect. It is dropped; its formula-field controls stay. Accepted, since it pinned the bug.
• The formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 changeset says an advisory rule keeps the old codes. Both ship in the same release, and this PR's changeset says it replaces that note. Accepted; editing a merged changeset is not this card's.
• Left as is: the validate-expressions.ts:1338-1341 doc comment (lint source, outside the card's surface) omits the new arm but says nothing false, and formulas.mdx's date row describes formula runtime, which is unchanged.
• Skills: git grep "silently evaluates to null" -- skills has no hit.

Implemented-by: claude/project-thread-r6w6jd
Reviewed-by: session_01Utp6CYVV6fcAQrNTDQRvPb

VERDICT: PASS

[objectstack-fleet]

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

维护者速读

• 改了什么：advisory 校验规则（severity: 'warning' / 'info'）里做日期加减时，报错不再说「字段静默得到 null」，改说「规则被跳过、写入照常进行、只留一行日志」，配新码 date-arithmetic-fail-open / date-text-arithmetic-fail-open。这句话直接引用同一规则上类型不匹配判词的那句原文。
• 为什么改：advisory 规则出错时，运行时会跳过该规则并放行写入。那里没有字段，也没有东西会读到 null，旧文案说的是不会发生的事。
• 风险与回滚：分级不变（仍是 error），发布门不收紧也不放宽，只换文案和码。按旧码识别 advisory 规则的使用方需要改认新码。公式字段的码和文案不动。回滚就是 revert，不涉及数据迁移。
• 先看：packages/formula/src/validate.ts 里 dateArm 和 dateArmFault 的 fail-open 分支；packages/formula/src/expression-refusal.ts 里的两个新码。
• 两分钟验证：运行 pnpm --filter @objectstack/lint exec vitest run src/validate-expressions.test.ts -t 30494，预期 1 条通过：warning / info 规则的日期提示说规则被跳过、写入照常，不含 null；公式字段的对照仍说 null。
• 需要你做的：无，席位落地。

席位意见：同意落地。这是放宽型改动（新增两个码），declaration 面记录 PASS（6663771132），钉住 head dfc91e9df。这是 #30250（PR #30492）的跟进卡，合并后 #30494 关闭，没有新的跟进项。

席位核对

Head dfc91e9df6c84797eb6c6f03451d60a62839814b · 2026-11-05T16:49Z

• 形态: the order's whole card. Two codes are added, the advisory arm of dateArm is opened, and the tests are in formula and lint only. 6 files, +165 / −19.
• 前提实测: the seat read the formula diff against a fresh origin/main. dateArm returns fail-open only for a record site with faultOutcome: 'fail-open'. The no-outcome path still returns null (null sentence kept). The new clause is the TYPE_MISMATCH_FAULT_ARMS['fail-open'].clause constant, not a copy. Red-first (formula 2 / lint 1), the ablation (formula 4 / lint 1) and the MCP probe are the dev's readings (os-dev-report 6663736900).
• 门禁 check-runs: in progress at this head. Auto-merge waits on the required checks. check-governed-merges.mjs --pr 30585 reports NOT governed (+165 / −19).
• 接受的偏差: one formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 control row that pinned the defect is dropped. The merged formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 changeset's note about advisory rules is superseded by this PR's changeset, not edited. The lint doc comment at validate-expressions.ts:1338-1341 is outside the card's surface and says nothing false.
• 范围外去向 + Skills-docs:: none. Skills-docs: none, with the grep.
• 落地条款: Fixes #30494. A non-governed widening, Clause-②: yes (widening), landed by the seat.