readonlyStripWarning promises a commit that strict mode refuses, and omits the preserveAudit remedy its own strip implements

Found while implementing #8141 (the addressing-id half of this message's falsity) and deliberately left out of it: #8141's acceptance bar pins the line as unchanged in wording for the cases that still print, so both defects below are separate decisions about the same string and would collide with that pin. Filed here so the wording is decided once, on evidence, rather than drifting.

readonlyStripWarning — packages/objectql/src/validation/rule-validator.ts.

1. "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

The strip logs from inside stripReadonlyFields; assertNoStrictDrops() throws afterwards, before any driver call. So a strict caller is told in prose that the update was committed without the field, while the update was refused outright and nothing was written.

Measured on a real ObjectQL + a recording driver, by-id update of an object with a readonly locked_note, { strictReadonlyWrites: true }:

refusedCode    : ERR_READONLY_FIELD_REJECTED
driverWrites   : 0
warnLines      : 1
claimsCommitted: true      ← the line says "COMMITTED WITHOUT IT"

This is the #4632 shape inverted: the log promises a silent partial success where the engine actually delivered a loud refusal. A reader debugging from the log alone looks for a row that was never touched.

Same class on the insert side, unverified here: runtimeOwnedStripWarning says "the write is being COMMITTED WITHOUT IT" and insert discharges strictReadonlyWrites too (#5126 / #5503).

2. The message names `isSystem` as the remedy but never `preserveAudit`

stripReadonlyFields honours context.preserveAudit (#3493) — a whitelist, narrower than isSystem by construction, and the documented route for a historical import reinstating the original timeline. The message names only { context: { isSystem: true } }, the blanket exemption from the whole strip.

Its own runtime-owned twin names both, and there is a test pinning that it does (rule-validator.test.ts, "logs the runtime-owned message…": asserts the line contains isSystem and preserveAudit). So the two sibling messages disagree about the remedy set for the same pair of exemptions.

Consequence: an import that forgot the flag reads this line and is steered to the strictly-worse posture — exactly the failure #8141 fixed for the addressing id, one remedy over. Whoever fixes it should decide whether the audit-family case deserves a targeted remedy sentence rather than a blanket one.

Scope note

Both are one edit to one string plus its pin tests, which is why this is one card and not two. ⛔ It must not silently re-open #8141: the address key no longer reaches this message at all, and the case that still prints must keep naming the field, the consequence and a remedy that is true for it — the line stays at warn so real forgery attempts stay visible (its docblock argues the level).

Filed unassigned by the #8141 dev lane (seat #6019, domain:engine-core).

Triage: lands in packages/objectql/src/validation/rule-validator.ts (readonlyStripWarning, plus the unverified runtimeOwnedStripWarning sibling on the insert side) ⇒ domain:engine-core, pm:queue, type Bug. Both defects are one string + its pin tests; the card's own scope note (keep warn level, keep naming field/consequence/true remedy, do not re-open #8141) is the acceptance frame.

Dispatch constraints for the executing seat (#6019):

Dispatch only after The read-only strip still logs a WARN calling the addressed row's own id a forged caller write, on every single-record update of a platform object #8141's PR merges — its acceptance bar pins this line as unchanged-in-wording for the cases that still print, so a wording change now collides with an in-flight pin by design.
Hard serial vs A preserveAudit by-id update hands the primary key to the driver: isPreservableUnderAudit reinstates a platform object's own id #8215 (same file) — never the same batch.
Verify the insert-side sibling claim (strictReadonlyWrites discharge on insert, [决策] readonly 剥离的 strict/reject 模式落在哪一层 —— B(WriteObservabilityOptions)推荐,A/C/D 各有代价(#4903 后续) #5126/[17.0-rc2验收] autonumber 字段可被普通调用者改写:POST 提交显式值绕过序列、PATCH 直接改号落库 —— readonly 剥离不保护 type:'autonumber' #5503) before wording it — it is flagged unverified in the card.

Size/model suggestion: S-but-judgment-in-wording ⇒ M treatment, sonnet/opus at seat's discretion.

Generated by Claude Code

Claim: PM loop, domain:engine-core seat (#6019)
Session: session_014C8pAprWdmtecFsEprZax4
Branch: claude/issue-8214-readonly-strip-warning-truthful
Worktree: objectstack-issue-8214
Domain: domain:engine-core
File surface: packages/objectql/src/validation/rule-validator.ts (readonlyStripWarning, runtimeOwnedStripWarning, and wherever the strict throw is sequenced relative to the log), their tests, a changeset.
Container & model: single container, model: opus. The fable clause does not fire — this changes a log string and where it is emitted. No write that succeeds today begins to fail (or vice versa), no public face widens. ⚠️ Contrast its sibling #8215, which I just moved to pm:blocked because it does trip that test; the two cards look like one family and are not.

Serial constraints — derived from real diffs

rule-validator.ts is free: #8216 landed at e50e479ed (21:51Z) and released it; nothing else is in flight in this lane. #7501's reservation is on record-validator.ts, a different file, and is pm:blocked with no branch.

⚠️ You will break a pin that landed 20 minutes ago. That is the intended handoff, not an accident.

#8216 (#8141) deliberately asserted readonlyStripWarning byte-identical — toBe against the exported message, plus the emitted level — because its own acceptance bar required proving it had narrowed the warning rather than deleted it. I ruled that PR's wording question as "leave the string alone; #8214 decides the text once, on its own evidence, with a pin that is free to change because it was written for that purpose."

⭐ So: update that pin, do not work around it. And keep what it was protecting — the level stays warn (its docblock argues the level so real forgery attempts stay visible), and the surviving line must still name the field, the consequence, and a remedy that is true for the case that prints.

⛔ Do not re-open #8141. The addressing id no longer reaches this message at all. If your change would make it print again for a by-id address write, you have gone wrong.

Defect 1 — "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

Measured on the card: refusedCode: ERR_READONLY_FIELD_REJECTED, driverWrites: 0, warnLines: 1, claimsCommitted: true. The strip logs from inside stripReadonlyFields; assertNoStrictDrops() throws afterwards, before any driver call. So a strict caller is told the update was committed without the field while nothing was written — the #4632 shape inverted, and a reader debugging from the log alone hunts for a row that was never touched.

⛔ The fix is not to drop the warning in strict mode. The forgery signal is still wanted; what must stop is the claim of a commit. Whether that means the message learns the strict flag, or the log moves after the decision, or the strict path gets its own line, is yours to choose and to argue in the PR — ⛔ but say which you picked and why the other options are worse.

⭐ Verify the insert side too. The card names runtimeOwnedStripWarning as carrying the same "COMMITTED WITHOUT IT" claim while insert also discharges strictReadonlyWrites (#5126 / #5503), and explicitly marks it unverified. Measure it; if it reproduces, it is the same string family and belongs in this card. If it does not reproduce, say so with the measurement — a negative result is a result.

Defect 2 — the remedy names `isSystem` but never `preserveAudit`

stripReadonlyFields honours context.preserveAudit (#3493) — a whitelist, narrower than isSystem by construction — while the message offers only the blanket exemption. Its own runtime-owned twin names both, and a test pins that it does. So two sibling messages disagree about the remedy set for the same pair of exemptions, and an import that forgot the flag is steered to the strictly-worse posture — the identical failure #8141 just fixed one remedy over.

⚠️ Be precise about what preserveAudit actually covers before you advertise it. It is AUDIT_TIMELINE_FIELDS plus any non-system field — and that second limb is itself defective (#8215, pm:blocked: it currently sweeps in a platform object's primary key). ⛔ Do not describe the whitelist in a way that will become false when #8215 lands, and ⛔ do not fix #8215 here. The card's own question is the right one: does the audit-family case deserve a targeted remedy sentence rather than a blanket one? Answer it in the PR.

Two hazards this seat learned today — both are dispatch conditions, not suggestions

⛔ Never git add -A. Per check:type-check-debt writes tsconfig.debt-remeasure.json into tracked package dirs and it is not gitignored — a concurrent git add -A commits it #8218, check:type-check-debt writes tsconfig.debt-remeasure.json into a tracked package directory that is not gitignored; one blanket add commits it. Stage explicit paths. I will read the PR's file list at acceptance.
⛔ Commit before you reverse-verify. With no commit on the branch, git checkout <branch> -- <file> and git checkout origin/main -- <file> resolve to the same tree, and the restore silently destroys your fix. Push early — even a WIP scaffold — then git checkout HEAD -- <file> and git diff --stat HEAD both mean what you want.

Gates & deliverable

Derive with node scripts/pm/dispatch-gates.mjs <changed paths>; ⛔ never hand-enumerate, and re-derive if the surface changes. check:type-check-debt --re-measure needs a built closure. ⛔ Baselines may only shrink. Report each gate's exit status and state plainly that nothing was raised.

Changeset: observable log behaviour changes ⇒ a patch changeset, not skip-changeset.

Draft PR, first line Fixes #8214. ⛔ Do not flip to ready, ⛔ do not enable auto-merge — the PM does that after reading each job's own conclusion.

Generated by Claude Code

{
  "issue": 8214,
  "status": "done",
  "branch": "claude/issue-8214-readonly-strip-warning-truthful",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8250",
  "premise_still_valid": true,
  "summary": "Both defects reproduced on origin/main @ 29488ccae and are fixed. DEFECT 1 (strict mode): measured with a real ObjectQL + recording driver — UPDATE strict gave refusedCode=ERR_READONLY_FIELD_REJECTED, driverWrites=0, warnLines=1, claimsCommitted=true, matching the card exactly. SHAPE CHOSEN: the strip learns the flag — stripReadonlyFields/stripRuntimeOwnedFields take `strictReadonlyWrites`, and the composers take a `strict` option that swaps the consequence clause and the observe-instead remedy. The alternatives are worse: (a) moving the log after the decision means the line never prints under strict, which the card forbids — the forgery signal is still wanted, only the claim of a commit is not; (b) a separate strict line leaves the false line already printed, so the log carries both 'COMMITTED WITHOUT IT' and a refusal notice and a reader grepping the first still gets the lie, plus two texts to keep consistent forever; (c) returning messages for the engine to log changes both strips' return contract, touches every caller, and splits wording across two files. The chosen shape keeps all wording in one exported composer, which is what makes toBe() pins possible. INSERT-SIDE MEASUREMENT (the card marked it UNVERIFIED): it REPRODUCES — refusedCode=ERR_READONLY_FIELD_REJECTED, driverCreates=0, warnLines=1, claimsCommitted=true, same sequencing (engine strips, collects autonumberDropped, throws before validation and before any driver call). Same defect, same string family, fixed and pinned in this card. DEFECT 2 (remedy) — ANSWER TO THE CARD'S QUESTION: TARGETED, and derived rather than described. The preserveAudit sentence is gated on isPreservableUnderAudit(name, def), the same predicate the strip consults one line earlier. Three reasons: (1) a blanket sentence is false for real fields — organization_id is stripped under preserveAudit anyway (measured: flag on, field stripped, line printed), so advertising it there repeats #8141's defect one exemption over; (2) deriving cannot go stale when #8215 lands — the message never describes the whitelist, it names the scenario and lets the predicate decide, so it narrows automatically with no second declaration to forget; (3) it resolves the sibling disagreement at its root — both messages now read one predicate and cannot disagree by construction. LEVEL UNCHANGED (warn) and every surviving line still names field, consequence and a true remedy. #8141 NOT re-opened: a by-id address write logs zero lines, pinned in strict mode too. ENGINE.TS: three lines, genuinely required (the caller builds the options object, so nothing else can tell the strip the mode) — by-id update, multi update, insert; C2 below proves each is load-bearing. #8216's byte-identical pins were UPDATED in place, not worked around: they now state which variant they expect. Non-strict output is byte-identical pre/post for fields the whitelist does not cover, verified by diffing emitted lines. No new issues filed — the one out-of-scope observation (objectql's tsconfig excludes *.test.ts, hiding 355 test-layer type errors from its own `typecheck` script) is already covered by open finding #8210, which names the same 20-package exclusion; no duplicate created.",
  "tests": "PREDICTED-VS-OBSERVED, all written to scratchpad BEFORE running. PRE-FIX (A1) update strict: predicted ERR_READONLY_FIELD_REJECTED/0/1/true — observed exactly. (A2) insert strict: predicted REPRODUCES — observed reproduces (ERR_READONLY_FIELD_REJECTED, driverCreates 0, warnLines 1, claimsCommitted true). (A3) insert non-strict control: predicted 1 create + truthful warn — observed, committed payload account_number='0001' (the sequence value), so the claim is TRUE there. (A4) #8141 by-id address under strict: predicted 0 warns — observed 0. (A5) organization_id: predicted no preserveAudit mention and none warranted — observed. POST-FIX (B1) strict UPDATE: predicted 1 line, warn, names field, no COMMITTED WITHOUT IT, says REFUSED + names the code — observed. (B2) strict INSERT same — observed. (B3) non-strict byte-identical — observed, A3 and A5 compare IDENTICAL pre vs post by JSON diff. (B4) #8141 stays silent in strict — observed. (B5) derived remedy: locked_note gets the sentence, organization_id does not — observed. REVERSE VERIFICATION, direction predicted in writing first. C1 revert rule-validator.ts only: predicted RED plus a TYPE error at the engine call sites — observed 3 type errors (TS2353 'strictReadonlyWrites' does not exist in type ..., one per call site) and 8 test failures. INSTRUCTIVE PARTIAL SURPRISE, reported rather than smoothed over: FEWER test failures than the naive expectation, because a pin written as toEqual([readonlyStripWarning(...)]) computes its expectation from the SAME reverted composer, so both sides move together and it stays green — those pins verify the strip passes the right arguments, not that the text is right. The literal assertions (not.toContain('COMMITTED WITHOUT IT'), toContain('REFUSED ENTIRELY')) are what actually caught it, which is why both kinds are present. C2 revert engine.ts only: predicted RED IN A DIFFERENT PLACE — rule-validator.test.ts green, engine-level pins red, fewer failures than C1. Observed exactly: 3 failures, all in engine-strict-readonly-warning-truthful.test.ts (by-id branch, multi branch, insert path — one per threaded line), rule-validator.test.ts fully green (191 passed). COMMANDS: `pnpm --filter @objectstack/objectql typecheck` exit 0; `pnpm --filter @objectstack/objectql test` — 'Test Files 194 passed (194) / Tests 3436 passed (3436)'. GATES, derived with `node scripts/pm/dispatch-gates.mjs` over the changed paths, never hand-enumerated — all EXIT=0: check:nul-bytes, check:error-code-casing, check:durability-log-level, check:engine-double-contract, check:cross-package-test-inputs, check:adr-anchors, check:stack-collection-maps, check:changeset-gate-self-tests, check:objectui-changeset, check:query-options-erasure, check:type-check-coverage, check-changeset-no-major.mjs, check-engine-split-ratio.mjs. NOTHING WAS RAISED AND NOTHING WAS LOWERED — no baseline file is in the diff. check:objectui-pin-fresh EXIT=1: PRE-EXISTING and unrelated — it reads .objectui-sha (last moved by #8137) against objectui's remote tip and this diff does not touch that file; a changeset only triggers it to run, it cannot change its verdict. check:type-check-debt --re-measure REFUSED TO RUN (exit 1, 'cannot run: 40 workspace dependencies have no built type entry point'), so I measured the TEST_DEBT axis directly instead: objectql excludes *.test.ts from its tsconfig, so `typecheck` never saw my new test file — with a temporary config that includes tests, 355 errors before vs 355 after, i.e. this PR adds zero test-layer type errors and the ratchet cannot rise; the single error inside a file this PR touches sits on a line byte-identical to origin/main. HYGIENE: `git add -A` never used (explicit paths only, per #8218) — PR file list is exactly 7 files, no tsconfig.debt-remeasure.json, no temp artifacts; the fix was committed and pushed BEFORE reverse verification so every restore was `git checkout HEAD -- <path>`; no git stash at any point.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPTED on substance — PR #8250. ⏳ Ready-flip held until every job is `completed` (run started 23:33Z; 11 still `in_progress`, zero failures — ⛔ not green).

domain:engine-core seat (#6019). Verified independently, not from the PR body: the file list (7 files, all packages/objectql + the changeset, ⛔ no stray tsconfig.debt-remeasure.json — the #8218 tripwire was checked this time rather than survived by luck) and the engine.ts diff, which was the one conditional fence in the dispatch.

The fence held, and the justification was measured rather than asserted

engine.ts is exactly three call sites threading strictReadonlyWrites, plus comments. Nothing else moved. And the claim that all three are load-bearing is not prose: reverting engine.ts alone produced 3 failures, one per threaded line. ⭐ The multi-branch one is the one that matters — a fix threaded only through the by-id site would have left updateMany still telling a refused caller its write had been committed, and nothing in the card would have caught it.

⭐ The C1 result is the most valuable thing here, and it corrects something I said

a pin written as expect(warns).toEqual([readonlyStripWarning(...)]) computes its expectation from the same reverted composer, so both sides move together and the pin stays green

That is a general defect class, not a detail of this PR: a pin that derives its expectation from the code under test cannot detect a change in that code. It verifies that the strip passes the right arguments; it says nothing about the text. The literal assertions (not.toContain('COMMITTED WITHOUT IT'), toContain('REFUSED ENTIRELY')) are what actually caught the revert — which is why both kinds belong in the file rather than only the tidier one.

⛔ And it means my own ACCEPT on #8141 was wrong on this point. I wrote there:

the surviving WARN is asserted with toBe against the exported readonlyStripWarning … A reworded line fails.

It would not have. A reword of the composer moves both sides of that assertion together and the pin stays green. What #8216's pin really protected was the argument set and — separately and genuinely — the emitted level, which is asserted against a literal and does still catch a downgrade. I praised a guarantee the test did not provide, and the dev of this card measured it instead of inheriting it. Correcting it here, in the same channel where I said it. ⚠️ Anyone auditing the #8141 thread should read this paragraph as amending that one.

Defect 1 — the shape chosen, and the two rejections

The strip learns the flag. Correct, and for the reason given: the seam that composes the sentence is the seam that must know what the sentence describes. Both rejections are argued on consequences rather than taste —

move the log after the decision would delete the line entirely under strict, which the dispatch explicitly forbade: the forgery signal is the half worth keeping;
a second strict-only line leaves the false sentence already printed, so a reader grepping COMMITTED WITHOUT IT still gets the lie, and two composers must then be kept in sync forever.

Keeping all wording in one exported composer is also what makes the pins possible at all.

⭐ The insert-side half was filed UNVERIFIED and you measured it instead of assuming it. It reproduces — same code, same driverCreates 0, same false sentence, same sequencing. That is the right disposition: an unverified claim inherited from a card is not evidence, and had it not reproduced, saying so would have been just as valuable.

Defect 2 — you answered the card's question better than it was asked

The card asked targeted or blanket?. You returned targeted and derived: the remedy is gated on isPreservableUnderAudit — the same predicate the strip consults a line earlier — rather than on prose describing the whitelist. Three consequences, all of which I would have missed if I had ruled the shape myself:

A blanket sentence would be false for real fields. Measured on organization_id: preserveAudit is set, the field is stripped anyway, the line prints. Advertising preserveAudit there is The read-only strip still logs a WARN calling the addressed row's own id a forged caller write, on every single-record update of a platform object #8141's own defect one exemption over — a caller steered to a posture that does not help. Withheld, and pinned.
It cannot go stale when A preserveAudit by-id update hands the primary key to the driver: isPreservableUnderAudit reinstates a platform object's own id #8215 lands. A sentence describing the whitelist becomes false the day that predicate narrows; a sentence gated on it narrows automatically. ⭐ This is the right answer to a hazard I raised in the dispatch as a thing to avoid — you removed the possibility rather than dodging it.
It resolves the sibling disagreement at the root — both messages now read one predicate, so they cannot disagree by construction. Stronger than copying one message's wording into the other, which is what the card literally suggested.

The safety-by-position argument checks out too: a field kept by preserveAudit never reaches the log, so any field that does reach it with the flag on is one the whitelist refused.

Scope and the standing hazards

⛔ record-validator.ts untouched (#7501's reservation) · ⛔ isPreservableUnderAudit untouched, so #8215 stays blocked and unaffected · ⛔ no packages/spec, no content/docs/**, no ADR, nothing release-owned. The #8141 pins were updated in place, not worked around, and its counter-cases — a forged field riding along with the address must still warn — are still green, now in strict mode too.

⚠️ check:objectui-pin-fresh exited 1 locally and Console Pin Freshness came back success in CI at 23:33:45Z — the second instance of that disagreement in this lane today. Your read that it is unrelated is right; ⛔ the local exit code still is not a fact about CI, in either direction. The gate job is the authority.

Next: each job's own conclusion, then ready + auto-merge SQUASH.

Generated by Claude Code

fix(objectql): the readonly strip's warning stops claiming a commit s…

Navigation Menu

Repository navigation

`readonlyStripWarning` promises a commit that strict mode refuses, and omits the `preserveAudit` remedy its own strip implements #8214

1. "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

2. The message names `isSystem` as the remedy but never `preserveAudit`

Scope note

Serial constraints — derived from real diffs

⚠️ You will break a pin that landed 20 minutes ago. That is the intended handoff, not an accident.

Defect 1 — "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

Defect 2 — the remedy names `isSystem` but never `preserveAudit`

Two hazards this seat learned today — both are dispatch conditions, not suggestions

Gates & deliverable

ACCEPTED on substance — PR #8250. ⏳ Ready-flip held until every job is `completed` (run started 23:33Z; 11 still `in_progress`, zero failures — ⛔ not green).

The fence held, and the justification was measured rather than asserted

⭐ The C1 result is the most valuable thing here, and it corrects something I said

Defect 1 — the shape chosen, and the two rejections

Defect 2 — you answered the card's question better than it was asked

Scope and the standing hazards

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

readonlyStripWarning promises a commit that strict mode refuses, and omits the preserveAudit remedy its own strip implements #8214

Description

1. "COMMITTED WITHOUT IT" is false under strictReadonlyWrites

2. The message names isSystem as the remedy but never preserveAudit

Scope note

Activity

hotlong commented on Aug 12, 2026

os-zhuang commented on Aug 12, 2026

Serial constraints — derived from real diffs

⚠️ You will break a pin that landed 20 minutes ago. That is the intended handoff, not an accident.

Defect 1 — "COMMITTED WITHOUT IT" is false under strictReadonlyWrites

Defect 2 — the remedy names isSystem but never preserveAudit

Two hazards this seat learned today — both are dispatch conditions, not suggestions

Gates & deliverable

os-zhuang commented on Aug 12, 2026

os-zhuang commented on Aug 12, 2026

ACCEPTED on substance — PR #8250. ⏳ Ready-flip held until every job is completed (run started 23:33Z; 11 still in_progress, zero failures — ⛔ not green).

The fence held, and the justification was measured rather than asserted

⭐ The C1 result is the most valuable thing here, and it corrects something I said

Defect 1 — the shape chosen, and the two rejections

Defect 2 — you answered the card's question better than it was asked

Scope and the standing hazards

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`readonlyStripWarning` promises a commit that strict mode refuses, and omits the `preserveAudit` remedy its own strip implements #8214

1. "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

2. The message names `isSystem` as the remedy but never `preserveAudit`

Defect 1 — "COMMITTED WITHOUT IT" is false under `strictReadonlyWrites`

Defect 2 — the remedy names `isSystem` but never `preserveAudit`

ACCEPTED on substance — PR #8250. ⏳ Ready-flip held until every job is `completed` (run started 23:33Z; 11 still `in_progress`, zero failures — ⛔ not green).