fix(formula): an advisory validation rule's date verdict says the rule is skipped and the write proceeds - #30585

Requested by Bill · project thread
domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

维护者速读

• 改了什么：advisory 校验规则（severity: 'warning' / 'info'）里对日期做加减时，报错不再说「字段静默得到 null」，改说「规则被跳过、写入照常进行、只留一行日志」，配新码 date-arithmetic-fail-open / date-text-arithmetic-fail-open，文案与同位置的类型不匹配判词一字不差。
• 为什么改：advisory 规则出错时运行时跳过该规则并放行写入，那里没有字段，也没有东西读到 null，旧句说的是不会发生的事。
• 风险与回滚：分级不变（仍是 error），发布门不收也不放，只换文案和码。按旧码 date-arithmetic / date-text-arithmetic 识别 advisory 规则的使用方需改认新码。公式字段原码原句不动。回滚即 revert，无数据迁移。
• 先看：packages/formula/src/validate.ts 的 dateArm 与 dateArmFault（fail-open 分支），packages/formula/src/expression-refusal.ts 的两个新码。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/validate-expressions.test.ts -t 30494，预期 1 条通过：warning / info 规则的日期判词说规则被跳过、写入照常，不含 null；公式字段对照仍说 null。
• 需要你做的：无，席位落地。

Fixes #30494

Clause-②: yes (widening) — two codes join @objectstack/formula's exported ExpressionRefusalCode / EXPRESSION_REFUSAL_CODES: date-arithmetic-fail-open and date-text-arithmetic-fail-open, each with the params of the code it splits from. An advisory rule's date verdicts move to them from date-arithmetic / date-text-arithmetic (a consumer keyed to the old codes on an advisory rule re-keys). The grade is unchanged; what is refused, warned or passed is unchanged.
Metadata-protocol: none — what an author can write is unchanged, and os validate reports no expression refusal code: its findings are @objectstack/lint's ExprIssue (where, message, source, severity, path), re-measured at packages/lint/src/validate-expressions.ts:157, which carries no code. Only the message text changes there.
Skills-docs: none — git grep -c "silently evaluates to null" -- skills answers no hit (exit 1); control: git grep -c "evaluates to" -- skills hits skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md and skills/objectstack-data/rules/validation.md, none of them about a date verdict on an advisory rule.

What changes

Measured on main with PR #30492 merged (67d5d5375), and again after origin/main was merged at a4c3e738.

• One outcome, one sentence. dateArmFault closes the fail-open arm on TYPE_MISMATCH_FAULT_ARMS['fail-open'].clause itself, not a copy, so the date verdict and the type-mismatch verdict on the same rule cannot drift apart.
• One code per template, as formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 did for fail-closed: expression-refusal.ts is the contract that a code names one message template.
• No new signal. @objectstack/lint's faultOutcomeOf ledger already answers fail-open for a warning / info rule (validate-expressions.ts:1358), and MCP validate_expression already passes it for site: 'validation' with severity: 'warning' | 'info' (mcp-http-tools.ts:666). Neither package changes.

Tests

• packages/formula/src/validate.test.ts:
  • new: on a fail-open record site, record.start_date + 1 > 3 and record.end_date - record.start_date > duration("24h") get the -fail-open codes and the fail-open sentence, and not "evaluates to null". Control: the same two predicates with no outcome keep date-arithmetic / date-text-arithmetic and the null sentence;
  • changed: the formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 test's third control asserted that an advisory rule keeps date-arithmetic and the null sentence, which is this card's defect. That row is dropped; its formula-field controls stay.
• packages/formula/src/expression-refusal-codes.test.ts: a PINS entry for each new code (exact params and message), and SWEEP_SCHEMAS gains the fail-open date schema, so the sweep reaches both codes and holds their params to their messages.
• packages/lint/src/validate-expressions.test.ts, new: a warning rule and an info rule with date arithmetic say the rule is skipped and the write proceeds (not null, not refused). Control: a formula field's record.close_date + 1 keeps the null sentence.
• packages/mcp/src/mcp-validate-expression.test.ts: unchanged, verbatim. Measured once with a probe file that was deleted afterwards (not committed): validate_expression at site: 'validation' answers date-arithmetic-fail-open / date-text-arithmetic-fail-open for severity: 'warning' and 'info', -fail-closed for 'error', and date-arithmetic at site: 'formula'; each message equals validateStackExpressions' on the same rule.

red first (pins only, on PR #30492's head, commit 89eebeec):
  formula  × on an advisory rule says the rule is skipped … (#30494) · × has a pin for every code   Tests 2 failed | 181 passed (183)
  lint     × says an advisory validation rule's date arithmetic skips the rule … (#30494)           Tests 1 failed
merged head dfc91e9d (origin/main a4c3e738 merged once), under os-verify-lock, shared box:
  formula test   Test Files 64 passed (64)    Tests 1652 passed (1652)
  lint test      Test Files 195 passed (195)  Tests 8093 passed (8093)
  mcp test       Test Files 56 passed (56)    Tests 678 passed (678)
  typecheck (formula, lint, mcp): exit 0
  objectql src/publish-type-mismatch-fail-closed.test.ts   Tests 12 passed (12)

A1  formula: the fail-open date arm off
    anchor   faultOutcome === 'fail-closed' || faultOutcome === 'fail-open' ? faultOutcome : null
    replace  faultOutcome === 'fail-closed' || String(faultOutcome) === 'ablated-30494-a1' ? faultOutcome : null
    anchor x1 -> x0, replacement x0 -> x1, blob 8931039644aa -> 19c5c422d2f2
    rebuilt (tsup JS emitted; the DTS step exited 1 on the mutated return type), ablation-dist-preflight:
    marker present in dist/index.js and dist/index.mjs
    formula  × on an advisory rule … (#30494) · × date-arithmetic-fail-open · × date-text-arithmetic-fail-open · × the SWEEP
             Tests 4 failed | 181 passed (185)
    lint     × says an advisory validation rule's date arithmetic skips the rule … (#30494)
             Tests 1 failed | 473 passed (474)
    restore: blob 8931039644aa == HEAD, git diff HEAD empty; rebuild exit 0; preflight --absent: marker absent from all 6 built files, tree clean

Acceptance notes

• packages/lint/src/validate-expressions.ts:1338-1341 doc comment names the date verdicts' -run-fails, -run-may-fail and -fail-closed arms and not the new -fail-open one. It says nothing false (it never says an advisory rule keeps the null sentence), and packages/lint/src/** source is outside this card's file surface, so it is left as is.
• The formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 changeset (.changeset/30250-fail-closed-date-and-sweep-run-fails-sentences.md) says an advisory rule keeps date-arithmetic / date-text-arithmetic. Both changesets ship in the same release; this PR's changeset says it replaces that note, and the other file is not edited here.
• content/docs/data-modeling/formulas.mdx date-arithmetic row says "this always faulted to null". That describes a formula's runtime, and this PR changes no runtime, so it is left as is (as formula: two refusal sentences say what does not happen at their site (fail-closed validation date verdict says "null"; run-fails on a time-relative sweep says "the write still lands") #30250 left it).
• Merge. origin/main was merged once at a4c3e738. The branch had carried PR fix(formula,lint,mcp): a fail-closed date verdict says the write is refused, and a time-relative sweep's run-fails verdict names no firing write #30492's head as a merge until it landed as a squash, so git reported conflicts in the five files both sides touch. They were resolved by applying this branch's own diff (ebda9aca..34b93ec4) to origin/main's copies: it applied cleanly, and the changed lines of the resolved delta are identical to that diff's.

Verification

All at head dfc91e9d (git rev-parse --short HEAD), the commit this PR opens on (origin/main merged once, at a4c3e738).

• Full build after the merge: pnpm install --frozen-lockfile && turbo run build --filter='!@objectstack/docs' --concurrency=2, 119/119 tasks, VERDICT command-exit 0.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: change set of 6 paths vs merge base a4c3e738b, 58 derived families, each run on this head, all exit 0 (each exit code recorded before any pipe). check-plugin-teardown-shape.mjs --self-test ran after fetching its pinned fixture commit 621a4876 into the shallow clone ("48 cases pass"). --ran: "58 derived famil(ies) accounted for — 58 run, 0 NOT-MEASURED". Among them check-adr-0087-registration --base origin/main, check-changeset-no-major, check-empty-changeset, check:doc-authoring, check:docs-transcript-drift, check:test-source-alias, check:cross-package-test-inputs, check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:nul-bytes, check:closing-keyword-parity.
• pnpm lint (eslint . --no-inline-config): exit 0.
• Full dogfood: not run. The title has no ! and Clause-② has no (narrowing) arm.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Utp6CbJFWadws6f9r4B8Ke