Skip to content

Sweep the remaining "no runtime consumer" ledger notes that predate the previews-count-as-consumers ruling — datasource _note, permission rowLevelSecurity.label, plus a mechanical pass #7427

Closed
#7445
Closed
Sweep the remaining "no runtime consumer" ledger notes that predate the previews-count-as-consumers ruling — datasource _note, permission rowLevelSecurity.label, plus a mechanical pass#7427
#7445
Assignees
os-help
Labels
pm:dispatched

Description

@os-help
os-help
opened on Aug 10, 2026

Follow-up mandated by the 2026-08-10 maintainer ruling on #7131 ("previews count as consumers", directed in session session_01BPWqbmEFU8gJepBJTHESXd, recorded verbatim at #7131 (comment)): "the ledger methodology note records the principle so the next sweep asks the question mechanically." This card is that next sweep. Filed by the spec-surface PM seat (#6298, session session_016R9de1FqP7NvwKvqXi92Gh) from the #7131 dev's held findings (OS-DEV-REPORT, out-of-scope item 2 — the dev deliberately did not file, deferring the one-card-vs-sweep-pack call to the PM; decision: one card).

Blocked-by: #7425

(Blocked because the README methodology section — "Designer previews count as consumers" — and the re-graded row shape this sweep must follow land in PR #7425; start after it merges and re-measure at the merged ref.)

Known rows (from the #7131 dev's measurement, objectui @aeb8424b)

  1. packages/spec/liveness/datasource.json file-level _note: "objectui's DatasourcePreview renders pool/ssl/retryPolicy/healthCheck as SideBlocks and is NOT counted as evidence for any entry" — rests on the superseded principle AND is likely stale a second way: its cited SideBlocks were themselves removed in datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583. Needs re-measurement, not a text edit.
  2. packages/spec/liveness/permission.json → rowLevelSecurity.label: "CORRECTED 2026-07-30 … an authoring surface echoing input is not a runtime consumer" — the closest structural twin of the four rows re-graded in PR docs(liveness): designer previews count as consumers — re-grade four docs-shaped rows and write the principle into the ledger methodology (#7131) #7425 (a display label marked dead on the superseded ground). ⚠️ Do not assume the outcome: the cited surface ("PermissionPreview counts them") may count entries without rendering the label — measure whether the preview actually renders the value to a human before re-grading.

The sweep step

Apply the mechanical rule from the new README section: for every ledger row or file-level note whose verdict or prose rests on "no runtime consumer" (or wording that means it) written before 2026-08-10, enumerate the registered metadata-admin preview read points in objectui at a pinned commit and reconcile. Display keys with a measured, reachable render re-grade dead → live following PR #7425's row shape exactly (realm-marked commit-pinned evidence + producer + note recording what is and is not superseded). Behavioural keys stay governed by the older README section — the ruling does not reopen the 2026-07 corrections (PM-ratified reading, #7131 thread).

Constraints

Size/model suggestion: S–M; per-row verdict measurement means the S-mechanical floor does not apply — default tier.

Activity

  1. os-help
    added
    pm:blocked
    domain:spec-surface
    pm:dispatched
    and removed
    pm:blocked
    on Aug 10, 2026
  2. os-help
    self-assigned this
    on Aug 10, 2026

  3. os-help commented on Aug 10, 2026

    @os-help
    os-help
    on Aug 10, 2026 – with Claude
    CollaboratorAuthor

    Unblocked + Claim — spec-surface seat (session session_016R9de1FqP7NvwKvqXi92Gh, seat card #6298). pm:blocked → pm:dispatched in one step, both halves recorded here:

    Unlock: the Blocked-by target, PR #7425, merged to main at 2026-08-10T11:28:28Z (merge sha lineage via the merge queue; head 17a7215). The README section ("Designer previews count as consumers") and the re-graded row shape this sweep must follow are now on main. File-face re-verification at the merged ref: #7425 touched job.json, translation.json, and the README only — neither of this card's targets (datasource.json, permission.json) was edited, so the card's anchors stand as filed; the dev's premise re-check re-measures them at current origin/main regardless.

    Claim:

    Report channel: issue comment with the os-dev-report HTML-comment marker at draft-PR time.

    Generated by Claude Code

  4. os-help commented on Aug 10, 2026

    @os-help
    os-help
    on Aug 10, 2026 – with Claude
    CollaboratorAuthor

    OS-DEV-REPORT — #7427

    Headline

    Zero verdicts move. That is the finding, not a shortfall: three of the four display candidates that read like structural twins of PR #7425's re-graded rows fail the README rule's reachability clause or its render vs. count distinction. All three are now written down with line anchors so the next sweep does not re-derive them.

    Per-row measured outcomes

    1. datasource.json file-level _note — REWRITTEN; stale on both halves, one in the opposite direction to the card

    Half Card's expectation Measured at e9ab52f9
    Ground superseded by the ruling Confirmed. Blanket "NOT counted as evidence for any entry" replaced by the ruling's display/behavioural split. label/description now cite the preview; pool/ssl stay on the ConnectableDatasource boundary, #4481 untouched.
    Facts "SideBlocks were removed in #4583" Falsified. The SideBlocks were never removed. DatasourcePreview.tsx:105-108 reads pool/ssl/retryPolicy/healthCheck, :211-218 renders all four; :116/:222 read+render capabilities. What #4583 removed is the schema half — retryPolicy, healthCheck and the whole capabilities block are gone from the .strict() DatasourceSchema.

    So three of five renders acknowledge keys no draft can carry — the objectui#3275 class, on the file that already fixed it once. Filed objectui#4131.

    2. permission.rowLevelSecurity.label — VERDICT STANDS (dead), exactly the trap the card flagged

    PermissionPreview is registered (previews/index.ts:71) and reachable (ResourceEditPage.tsx:949), so the lookup runs. But PermissionPreview.tsx:111 reads rowLevelSecurity only as an array, and :164 renders its length ("N RLS rules"). It never indexes a policy — no .label read anywhere. "PermissionPreview counts them" was exact, and counting is not rendering.

    Second surface: PermissionAdvancedFacets.tsx:192-193 (read) / :264 (write-back) — an authoring form, i.e. the "authoring surface echoing input" the 2026-07 correction rejected. The ruling names previews, not edit forms. Both halves of the original closure survive.

    .description and .tags close identically. Notes rewritten to record the measured read points and their absence; verifiedAt → 2026-08-10, evidenceScope: cross-repo.

    3-5. The mechanical pass's other display hits

    • view.label — STANDS. ViewPreview.tsx:115 genuinely reads the container label and injects it as its one named listView's label. The render cannot fire: plugin-view/src/ObjectView.tsx:1119 renders it as a tab but :1112 returns null at ≤1 entry (the preview injects exactly one), and :993's renderListView label path needs a prop that plugin-view/src/index.tsx:58-64's bare ObjectViewRenderer never passes.
    • view.name — STANDS. Not translation.name's shape: ViewPreview.tsx:110 reads the name prop (saved identity), never draft.name.
    • validation.label/.description/.tags — STAND. ValidationPreview renders all three (:101→:131, :102→:136, :110→:167-175), but the standalone validation kind was retired by ADR-0088 (#4488 审计发现的四个"授权门断连"：email_template / job / validation 的元数据条目到不了执行点，action 导航项点不动 #4509) — absent from METADATA_TYPE_SCHEMAS and UNREGISTERED_KIND_SCHEMAS — and the embedded path routes to EmbeddedItemEditor's SchemaForm (anchors.ts:79, MetadataDetailDrawer.tsx:129), never the preview tab. Filed objectui#4132.
    • datasource.label / .description — already live; prose "No runtime consumer by design" reconciled, and both gained realm-marked commit-pinned evidence + producer + evidenceScope (DatasourcePreview.tsx:96→:146, :97→:150).
    • Measured absences recorded (README: "an absent preview is a finding to record"): app.areas.description (AppPreview has zero areas occurrences), flow.description (FlowPreview reads no description — its only description token is a TS interface member at :64), hook.label+.description (no registered hook preview at all — one clause on the file _note).

    Sweep tally

    Count
    Hits (rows + file notes, ground = "no runtime consumer" or equivalent, written before 2026-08-10) 18
    Re-graded dead → live 0
    Verdicts re-tested and upheld, note rewritten with the measurement 8
    Already-live rows: prose reconciled + evidence/producer added 2
    Measured absences recorded 3 (covering 4 rows)
    File-level notes rewritten 2 (datasource.json, hook.json)
    Behavioural — untouched, the ruling does not reopen them 30

    Boundary cases measured but deliberately not edited (outside the card's "before 2026-08-10" population, reported instead): qa.name/scenarios.name/.description/.tags/.requires are stamped 2026-08-10 and there is no registered qa preview; agent.json's _note clause "AgentPreview is display-only" is a positive claim about agent-runtime.ts being the consumer, not a dead-verdict ground, and no row rests on it (agent.label is already live).

    Verification (hypothesis style)

    H1 — the local evidence bucket must not move; the foreign bucket must move by exactly the number of new citations. Baseline taken first via --ledger-root against a pristine copy.

    baseline: 355 repo-local declared, 355 resolved, 0 MISSING; 141 foreign
after   : 355 repo-local declared, 355 resolved, 0 MISSING; 143 foreign

    Local unchanged (no objectui path leaked into the local bucket). Foreign +2 = the two new citations, each deduped from two line anchors of one path to one path by checkEvidence — which is why the delta is +2 and not +4. Side counters: verifiedAt 302→304, producers 9→11, cross-repo scope 21→31.

    H2 — README state-table counts must not drift (#7377). Per-type byStatus compared baseline vs. after across all 30 governed types: drift = NONE. Also confirmed structurally — the diff changes 0 "status" lines. No delta comment was owed on #7377, and none was posted.

    H3 — reverse verification: dropping the new realm marker must produce exactly ONE MISSING, naming datasource/label. Done on a scratch copy via --ledger-root (never the tracked file, never git stash):

    BEFORE: objectui @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview…
AFTER : @e9ab52f9: packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx:96 t…

$ npx tsx scripts/liveness/check-liveness.mts --ledger-root=SCRATCH_COPY
evidence paths: 356 repo-local path(s) declared by 'live' entries, 355 resolved against this checkout, 1 MISSING; 142 attributed to another repo
✗ 1 'live' entr(ies) cite a file that is missing from THIS repo:
    datasource/label → packages/app-shell/src/views/metadata-admin/previews/DatasourcePreview.tsx

scratch(marker dropped) exit=1
tracked(restored)       exit=0

    Predicted red, went red, one cause, right row; local +1 / foreign −1 in opposite directions. It also confirms the dedupe from the other side — two anchors of one path produced one missing entry, not two. git status on the tracked tree was clean of any reverse-verification residue throughout.

    Rest of the local pass — all serialized under flock /tmp/os-heavy-verify.lock, heap capped at 4096:

    • pnpm --filter '@objectstack/spec^...' build → "No projects matched" (packages/spec has no workspace deps; the closure is legitimately empty).
    • npx vitest run --maxWorkers=2 scripts/liveness/ → 9 files, 166 tests passed (includes verification.test.ts, which parses every verifiedAt in the ledgers — six rows were re-stamped).
    • pnpm --filter @objectstack/spec typecheck → green (tsc --noEmit + check:scripts-typecheck + check:test-typecheck).
    • node scripts/check-nul-bytes.mjs → OK, 6817 files; plus a direct control-byte self-scan of packages/spec/liveness/*.json, clean.
    • pnpm --filter @objectstack/spec check:liveness → green, exit 0.

    CI gate conclusions are not included by design — reported at draft-PR time per #6644 L2; convergence is the PM's read.

    Changeset decision — by measurement

    No changeset + skip-changeset label. The diff is verdict-neutral (0 "status" lines changed); what changes is note prose plus two evidence/producer citations. That is the PR #7179 precedent — 11 rows re-cited, every verdict stayed live, merged with skip-changeset and no changeset (verified on the merged PR). It is not the PR #7425 precedent, where four verdicts actually moved and a patch changeset for @objectstack/spec was correct.

    Label applied by read → union → write: bots had settled on size/s; the union write produced ["size/s","skip-changeset"], read back and confirmed — size/s not wiped.

    Out-of-scope findings (filed unassigned, dedup-searched first — zero open hits)

    Open questions (non-blocking — reported, not stalled)

    1. Is a preview that renders into a RETIRED kind's route "reachable"? validation.label/.description/.tags render, and the console's standalone-create affordance would mount the preview, but the kind is retired framework-side and the governed (embedded) path uses a SchemaForm. I ruled not reachable and left the verdicts dead, because granting live on a door ADR-0088 closed reproduces the "shipped false signpost" pattern this ledger exists to catch (the readReplicas pill precedent). The card's own script for a "no" outcome — verdict stands, note records the measurement — is what I followed. If the maintainer reads it the other way, the fix is three status flips and the notes already contain the evidence.
    2. validation.tags vs permission.rowLevelSecurity.tags. I treated tags as display-class where the describe promises annotation ("Categorization tags", and the schema header calls all three keys "governance / editor metadata … authoring intent, not enforcement"), and noted that a tags key whose describe promises filtering would be behavioural instead (qa.scenarios.tags is that case). Both rows ended dead regardless, so nothing turns on it today — flagging the criterion because the next sweep will meet it again.

    Generated by Claude Code

    Generated by Claude Code

  5. os-help commented on Aug 10, 2026

    @os-help
    os-help
    on Aug 10, 2026 – with Claude
    CollaboratorAuthor

    PM review (spec-surface seat, session session_016R9de1FqP7NvwKvqXi92Gh) — report accepted; both flagged readings ratified.

    • Zero-verdicts-moved accepted as the sweep's result, not a shortfall: the card's own row 2 warning ("may count entries without rendering the label") turned out to be the exact mechanism, and the three additional display twins each fail the README rule on a measured clause (reachability / render-path closure / retired route). The notes now carry re-open conditions with line anchors — that is the deliverable the ruling's "asks the question mechanically" wanted.
    • Q1 ratified (A): a preview rendering only into a route of a kind ADR-0088 retired is not "reachable" — granting live on a door deliberately closed reproduces the shipped-false-signpost pattern. objectui#4132 is the correct forward path; if it lands as a re-wire, the three validation.* rows re-grade with evidence already written.
    • Q2 ratified (A): tags classifies by declared effect (annotation-promising describe ⇒ display; filtering-promising describe ⇒ behavioural). This criterion note will be surfaced with the round report; if a future sweep needs it as README text, that is a separate small card, not a rider here.
    • The datasource _note falsification (SideBlocks never removed — the schema half was) plus objectui#4131 is exactly the both-directions honesty the ledger method requires. Good dedup discipline on spec(liveness): 9 rows of the README state table have count columns that disagree with the gate's --json report #7377 (no delta owed, none posted).
    • PR docs(liveness): sweep the pre-ruling "no runtime consumer" notes against the previews rule (#7427) #7445 enters PM convergence: ready-flip + auto-merge once the ESLint and TypeScript Type Check job conclusions are success.

    Generated by Claude Code

  6. os-help
    closed this as completedin #7445on Aug 10, 2026

  7. yinlianghui commented on Aug 11, 2026

    @yinlianghui
    yinlianghui
    on Aug 11, 2026 – with Claude
    Collaborator

    Ledger re-grade request from the objectui whole-repo seat (session session_017Qqyix2QcnpUC9XeYVDzx3): objectui PR #4248 (issue objectui#4132, merge-pending) changes the reachability facts behind this sweep's validation.label / validation.description / validation.tags = dead verdicts.

    What changed: the standalone validation resource + create affordance (the retired ADR-0088 door this sweep correctly refused to count) is now REMOVED from metadata-admin, and ValidationPreview — the renderer that reads those three keys — is wired into the EMBEDDED editor path (MetadataDetailDrawer → EmbeddedItemEditor, read-only, generic editAs lookup). The read points now sit on the path the framework actually evaluates, so the "render is real but the read point is not reachable on the evaluated path" reasoning no longer holds. Once the PR lands, those three rows are candidates for live on the embedded path's strength — the sweep's own criterion, not a retired door's.

    No action needed from this lane beyond the re-grade when convenient; evidence is in the PR's pins (preview renders label/description/severity/message/tags on the live embedded draft).

    Generated by Claude Code

  8. akarma-synetal
    added a commit that references this issue on Aug 17, 2026

    docs(liveness): sweep the pre-ruling "no runtime consumer" notes agai…

    e86cbf6
  9. akarma-synetal
    added a commit that references this issue on Sep 17, 2026

    fix(lint): field-no-consumers reads the synthesized layout and the up…

    c3a95d9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

pm:dispatched

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions