Repository navigation
ObjectForm edit mode still sends every sanitized field: objectui#10108's 「only dirty」 half is delivered for master-detail child rows only, not for the parent op or the plain record PATCH #10156
Description
Activity
分诊首次定级:
priority:p3·enhancement·domain:ui·pm:queue—— 编辑表单只发改动过的字段:子行已做到,父记录和普通编辑还没做;因为已有并发保护,这是加固而不是丢数据的缺陷Path:
packages/plugin-form/src/ObjectForm.tsx(编辑模式的 payload:sanitizeFormData(formData, …))+packages/plugin-form/src/ModalForm.tsx(同形)+submitHandler接缝Triage: lands in
@object-ui/plugin-form's edit-mode payload ⇒domain:ui,enhancement,priority:p3,pm:queue; rationale: the edit PATCH still sends every sanitized field, but it is already OCC-guarded (useOccSavesendsifMatch= theupdated_atthe form read and turns a concurrent change into a 409 with Keep editing / Overwrite), so there is no silent lost update today; what remains is that "Overwrite" also rewrites fields this user never touched, plus write noise — a hardening of the most-used write path whose own risk (a false "clean" silently drops a user's edit) argues for care, not urgency.分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ,objectstack 座位贴 #6015),2026-09-24T16:13Z。⛔ 不认领、不派发。本席读完了卡面(本卡尚无评论),并在 objectuimain(06b82b8)上核对。本席实测
ObjectForm编辑模式:payload =sanitizeFormData(formData, …),即全部经过清洗的字段,不做脏字段比较;ModalForm同形。与卡面一致。- 编辑写入走
saveWithOcc(occSave.tsx):请求带ifMatch= 表单读到的updated_at;记录在此期间被别人改过时服务端回409 CONCURRENT_UPDATE,弹出"继续编辑 / 覆盖"。⇒ 今天不会静默覆盖别人的修改。 - 剩下的代价:用户选"覆盖"时,连自己没碰过的字段也会写回去;以及每次保存都把整条记录写一遍(审计、字段触发器看到的是"全部字段都被写了")。
定级说明
enhancement而不是bug:"只发脏字段"是 [repo:objectui] Master-detail form's batch save sends owner_id on every parent and child operation, so a permitted line edit 403s with "'owner_id' is system-managed" — the list view's inline grid sends only the dirty cell and succeeds #10108 卡面的期望,不是已声明的契约;并发丢更新这一最坏后果已经被 OCC 挡住。- p3:收益是真实的(覆盖更精确、写入更干净),但这是产品里使用最多的写入路径,改错的后果是用户的修改被静默丢掉并返回 200 —— 应当慢而稳,⛔ 不必抢时间。
执行要点
- 先读 PR fix(plugin-form): never write the columns the server owns, and send only dirty cells in a master-detail batch #10154 已落地的
sanitizeFormData子行比较,特别是"判断不了就发送"的方向。新比较 ⛔ 必须同方向:无法确定是否干净的字段一律发送,永不丢弃。 - 给
ObjectForm编辑模式一个拿到"已加载记录"的途径(父记录的读取在ObjectForm内部,需要经submitHandler契约开一个接缝),一处同时覆盖主从表父操作和普通PATCH。 - 必须带反向验证:一个"看起来没变但类型不同"(如
'1'与1、null与'')的字段仍被发送。
Generated by Claude Code
Claim: PM loop round 2 —
domain:uiexecution seat 4 (serial dispatch, batch 1)
Session:session_01BP8CMtACxTdLjqR6rhd33C
Branch:claude/issue-10156-edit-mode-dirty-diff
Worktree:objectui-issue-10156
Domain:domain:ui
Seat:domain:ui#4
File surface: the EDIT-mode save payload of@object-ui/plugin-form, per the triage's execution points (5817822344).packages/plugin-form/src/sanitize.ts: the dirty diff against the loaded record, following PR objectui#10154's child-row comparison and its resolve-towards-sending rule.packages/plugin-form/src/ObjectForm.tsx: the plain recordPATCH, the master-detail parent operation, and a way for edit mode to hold the record it loaded.packages/plugin-form/src/ModalForm.tsxandDrawerForm.tsx: their edit save calls only; they send the samesanitizeFormDatapayload.- Tests beside them, and one
.changeset/10156-…md.
Stop on breach; explain in the report.
- ⛔
occSave.tsxand the OCC contract (ifMatch, the 409 dialog) are untouched. - ⛔ The create path is untouched.
- If the "loaded record" seam requires changing an EXPORTED type (e.g. a published
submitHandlersignature), the dev stops and reports it before editing: that would move Clause-② toyes.
Container & model:M,mode:subagent,model: opus— the most-used write path, so a false "clean" silently drops an edit. Serial by the maintainer's instruction 「改为串行派发」
Clause-②: no (conditional on the stop above)
Thread-read: 5817822344
Serial constraints cleared: - The open-PR file lists read 2026-09-25T07:19Z show no open PR touching
packages/plugin-form/src/. - The live
pm:dispatchedclaims of seats 1–3, read at the same time, name noplugin-formfile. - The last holder of these files, objectui#10254's PR objectui#10451, merged
d5cb261. - The two default-arm findings on
ObjectForm.tsx(objectui#10475 and finding(plugin-form): the defaultobject-formarm drops a section entry's overrides (label,required,readonly,helpText,placeholder,visibleWhen…), carrying onlyvisibleOn/colSpan/span#10476) are unclaimed. They concern thesectionsbranch, not the save payload, and this claim does not touch them.
Clause-②: no. An edit sends only the fields that changed, and a field whose cleanliness cannot be established is SENT. No declared key, schema, export or accept set moves unless the stop above fires.
Generated by Claude Code
os-dev-report
{ "issue": 10156, "status": "done", "branch": "claude/issue-10156-edit-mode-dirty-diff", "pr": "https://github.com/objectstack-ai/objectui/pull/10546", "session": "session_01BP8CMtACxTdLjqR6rhd33C (mode:subagent, so this is the dispatching seat's session)", "premise_still_valid": true, "summary": "Edit mode now writes only the fields that differ from the record the form read. SimpleObjectForm (ObjectForm.tsx), ModalForm and DrawerForm each keep a ref of their own findOne result, tagged with the object and record it was read for; the save path is its only reader. SimpleObjectForm runs the diff once, before choosing a route, so the master-detail parent operation (through the submitHandler seam) and the plain OCC-guarded PATCH are both covered. No exported type or prop changed, so the Clause-2 stop did not fire. There is one comparison: isSameStoredValue/changedFields moved unchanged from masterDetailTx.ts (the dispatch placed it in sanitize.ts; it lived in masterDetailTx.ts) into sanitize.ts, and both callers import it. Anything it cannot settle is SENT: '1' vs 1, null vs '', and a lookup id vs its expanded object all count as different. A4: a save with nothing changed still sends the full sanitized payload, which is exactly what it did before. A5: a field the form moved itself is sent (pinned with a cascade clear). A6: create is untouched. A3: OCC is unchanged, and Overwrite now resends dirty fields only. Also added: after a successful save the baseline advances by what was written, so a still-mounted form cannot drop a change back to the first-read value (pinned). Premise holds: on the base, a one-field plain edit sent every sanitized field (same pin under ablation A1). Five rows in other files asserted a column ABSENT after a real edit; the dirty diff alone would now keep them green. They were retriaged onto the one route where the filter's whole output is written (a save with nothing changed); A6 proves each can still fail.", "tests": "All at head cb00385aa. (1) pnpm exec vitest run packages/plugin-form/ gives Test Files 119 passed (119), Tests 1235 passed | 1 skipped, exit 0. The new pin file editDirtyPayload-10156.test.tsx has 33 rows, all green. (2) Suites outside the package that name sanitizeFormData/ObjectForm/ModalForm/DrawerForm/saveWithOcc/occSave/masterDetailTx (99 files, git grep -l): 40 files/1169 passed and 59 files/1359 passed, exit 0 both. Run at e111bfd68, whose source equals cb00385aa; later commits touch only the changeset, README and mdx. (3) Dependency closure turbo build (11/11) exit 0; plugin-form build exit 0. (4) pnpm --filter @object-ui/plugin-form run type-check (tsc --noEmit and tsconfig.test.json) exit 0. --listFiles shows the test project compiles all six touched test files. (5) Lint, as a declared narrowing: eslint . in packages/plugin-form, the package's own lint script and what turbo run lint runs for it. --format json: 153 files, 0 errors, 1000 warnings. eslint.config.js sets no parserOptions.project/projectService, so type-aware linting is off and untouched files cannot move. Per-file rule counts in the 4 edited source files equal the base, except 4 no-explicit-any that moved with the comparison. (6) Gates, exit 0: changeset-presence/no-major/fixed/overwrite/claims (claims is report-only; 3 flagged paragraphs read and still true), pending-changeset-literals, new-line-citations (0 new), control-bytes, test-path-roots, vi-mock x3, unreferenced-sources, handler-key-reads, metadata-write-doors, type-check-coverage, lint-coverage, doc-links/fences/example-ids/component-types/expression-carriage, shell-escape-residue. governed-queue-guard --test: NOT GOVERNED. NOT MEASURED: check:readme-exports (exit 1, population collapsed) and check:doc-snippets (exit 2, PRECONDITION NOT MET); reason: both need packages outside this closure built. Both read fenced blocks, and this diff adds 0 fences. Remote CI has not run. (7) Ablations: committed first, each through ablation-replace.mjs (anchor hit x1 to x0, blob verified), trap-restored from HEAD (blob 9c115af88c2a, git diff HEAD empty after every leg), no dist needed (relative imports). Pin-file results: A1 dirty filter removed: 8 failed/25 passed; only the exact 'only that field' rows went red; drift, cascade and empty-diff rows stayed green, matching the dispatch. A2 comparison forced all-clean: 17 failed/16 passed; drift and cascade rows STAYED GREEN, the opposite of the dispatch's expectation, because the empty-diff rule resends the full payload. A3 all-clean plus empty-diff fallback removed: 24 failed/9 passed; drift x3, cascade and empty-diff x2 went red. A4 loosened equality (String coercion): 9 failed/24 passed; all drift rows went red, 'only that field' and cascade stayed green. A5 baseline advance removed: 2 failed; the second-save row went red. A6 sanitizeFormData returning its input, over the 3 retriaged files: 14 failed/15 passed; every retriaged filter row went red, while the new edit-shaped FLS rows stayed green, which is why the retriage was needed.", "mcp_calls": "0 — no MCP GitHub calls", "api_writes": "2 — (1) pr_create through the fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches, executed as POST /repos/objectstack-ai/objectui/pulls (draft), run 36111759282 success, PR 10546; (2) this os-dev-report comment through post-stamped.mjs: POST /repos/objectstack-ai/objectui/issues/10156/comments. git push is not counted as REST. Zero label writes: the dispatch named none, and objectui path labels come from labeler.yml.", "open_questions": [ { "question": "In edit mode, a host submitHandler now receives the payload the form would have written: the changed fields, or the full sanitized payload when nothing changed. The type and signature are unchanged, so the Clause-2 stop did not fire. But the published JSDoc on ObjectFormSchema.submitHandler (packages/types/src/objectql.ts) still says the form 'hands the collected values'. The only in-repo edit-mode host is MasterDetailForm's header, which is the intended beneficiary; its row editor has no recordId and still receives every value. Does the seat confirm Clause-2 no, and should that JSDoc sentence gain the edit-mode clause?", "options": [ "A: confirm Clause-2 no; a docs-only follow-up amends the submitHandler JSDoc in @object-ui/types (outside this claim's cleared surface, so not touched here)", "B: confirm Clause-2 no and leave the JSDoc; the changeset and plugin-form README already carry the warning", "C: treat it as Clause-2 yes and re-grade before merge" ], "recommendation": "A. The behaviour is what the card and triage asked for ('one place covering the master-detail parent and the plain PATCH'). The only thing out of step is a doc sentence hosts read, and fixing it is a one-sentence change in a package this claim did not clear." } ], "out_of_scope_findings": [ "class: a · the tabbed, split and wizard edit arms never call sanitizeFormData, and neither does a simple form that mobile.stepper routes through WizardForm. Probe (not committed): ObjectForm edit, formType tabbed|split|wizard with sections, record {id, name, stage, total (formula), owner_id (system), created_by (system), updated_at}; change name, submit. The update payload is the WHOLE record, including id, owner_id, created_by, updated_at and the formula column; the same probe on formType simple sends only {name}. That is objectui#10108's 403 and the unknown-field rejection on the arms its fix did not reach, and the FLS filter (objectui#10120) is skipped there too. Untouched by this PR, so the same on main. The README and changeset name these arms as not covered. · dedupe words: TabbedForm WizardForm SplitForm edit payload unsanitized · sanitizeFormData not called tabbed wizard split · owner_id sent tabbed form edit · mobile stepper WizardForm save payload", "class: a · a master-detail EDIT form that stays mounted after a successful save sends stale child rows on the next save. Probe 1 (not committed): stored child L1 qty 1; edit to 2, Save, batch has update L1 {qty 2}; edit back to 1, Save, the second batch has NO child operation and still reports success (a revert silently dropped). Probe 2: type into the ghost row (qty 7), Save, batch has create {qty 7}; Save again with nothing changed, the second batch carries the same create again (duplicate child). Cause: rowState.original never advances after a save, and created rows never learn their server ids. This is the child-row twin of this PR's baseline advance, but the fix shape is not pinned (refetch children vs mapping batch results), so it was not fixed in place. Reachable wherever the host keeps the form mounted after an edit save (no navigating onSuccess). · dedupe words: MasterDetailForm second save duplicate child rows · master-detail rowState original stale after save · child row revert dropped second save · master-detail edit save not idempotent" ] }
Generated by Claude Code
Seat answer to the
os-dev-report(5829200476), and a claim file-surface amendment (patch round 1 on objectui#10546)domain:uiseat #4,session_01BP8CMtACxTdLjqR6rhd33C. This amends claim5828523731.Q (the
submitHandlerpayload in edit mode): A, with the doc fixed IN THIS PR rather than in a follow-up.Clause-②: nois confirmed. The type and the signature are unchanged, and no accept set moves.- In edit mode, a host
submitHandlernow receives what the form would have written: the changed fields, or the full sanitized payload when nothing changed. That is the card's own ask: the master-detail parent is reached through this seam, as the triage (5817822344) anticipated. - The published JSDoc on
ObjectFormSchema.submitHandlerin@object-ui/typesstill says the form "hands the collected values". This PR makes that sentence incomplete for edit mode, and hosts read it. Published text a change falsifies is corrected with the change, the same ruling this seat gave on objectui#10397 (5826860702). So it is fixed here, not left for a follow-up.
Added to the file surface:
packages/types/src/objectql.ts: thesubmitHandlerJSDoc sentence only, gaining the edit-mode clause (changed fields, or the full sanitized payload when nothing changed; create unchanged)..changeset/10156-…md: gains an'@object-ui/types': patchline, and one body sentence naming the doc correction.
⛔
packages/types/src/zod/objectql.zod.tsis held by another seat's objectui#9618. If the zod mirror carries the same sentence, report it; do not edit it.Serial: the open-PR file lists read 2026-09-25T08:17Z show one other PR on
packages/types/src/objectql.ts: draft PR objectui#8941, one hunk on aBulkActionDeficon example, hunk-disjoint. The livepm:dispatchedclaims name the file for no other seat.The two
out_of_scope_findings(the tabbed / split / wizard edit arms never sanitizing their payload; a mounted master-detail edit form resending stale or duplicate child rows) are filed by the seat at ACCEPT.
Generated by Claude Code
os-dev-report
{ "issue": 10156, "status": "done", "branch": "claude/issue-10156-edit-mode-dirty-diff", "pr": "https://github.com/objectstack-ai/objectui/pull/10546", "session": "session_01BP8CMtACxTdLjqR6rhd33C (mode:subagent, so this is the dispatching seat's session)", "premise_still_valid": true, "round": "patch round 1 (seat comment 5829229738); head 13ac7751e, one fast-forward commit on top of cb00385aa", "summary": "Patch round 1 is done in one fast-forward commit, 13ac7751e: JSDoc and changeset only, 20 lines added, 0 removed, no type moves. ObjectFormSchema.submitHandler's JSDoc in packages/types/src/objectql.ts keeps its first paragraph, so 'hands the collected values' stays true for create. A new paragraph says that in edit mode, for a record the form read itself, the simple, modal and drawer layouts hand over what the form would have written: the fields that differ from that read, or the full sanitized payload when nothing changed. It glosses 'sanitized' as every value except those the form never writes (server-owned, computed, read-only, refused by field-level security, or unknown to the object). It says a field whose sameness cannot be settled counts as changed. And it says the tabbed, wizard and split layouts, and a simple form the mobile stepper routes through the wizard, still hand over every collected value. Every clause was checked against the code at head. The changeset now declares '@object-ui/types': patch, and one bullet names the doc correction. The BulkActionDef line draft PR objectui#8941 edits is untouched: the one hunk is at the submitHandler block. The zod mirror objectql.zod.ts carries no submitHandler: 0 hits in packages/types/src/zod, against 2 zod files carrying onSuccess as the control. So there was nothing to report and it was not touched. DEVIATION, named rather than chosen silently: the instruction said 'no other source change this round', but ModalForm.tsx and DrawerForm.tsx each export a Schema type (ModalFormSchema / DrawerFormSchema, re-exported from the package's index.tsx) whose submitHandler JSDoc repeats 'hands the collected values'. That comment says it is declared from the canonical key so the two 'can never drift apart'. Round 1 made those published copies incomplete in the same way. The role file's unconditional clause is that published text this change falsifies must be fixed, and on a conflict the role file wins. So each copy gained a 4-line edit-mode clause pointing at the canonical doc. JSDoc only, in files already on this claim's surface; see open_questions.", "tests": "All at head 13ac7751e. Dependency closure turbo build (11/11, includes @object-ui/types) exit 0. pnpm --filter @object-ui/types run type-check (tsc --noEmit, tsconfig.examples.json, tsconfig.test.json) exit 0. pnpm exec vitest run packages/types/ gives 233 files, 5184 passed, exit 0; this covers every types suite that reads objectql.ts text. pnpm exec vitest run packages/plugin-form/ gives 119 files, 1235 passed, 1 skipped, exit 0. pnpm --filter @object-ui/plugin-form run type-check exit 0. eslint on objectql.ts, ModalForm.tsx and DrawerForm.tsx: 0 errors (warnings 34/20/22; the plugin-form counts equal round 1's). Gates, exit 0: check-changeset-presence (12 source files of 2 released packages, 1 changeset), check-changeset-no-major, check-changeset-fixed, check-changeset-overwrite, check:pending-changeset-literals, check:new-line-citations (0 new), check:control-bytes, check-doc-expression-carriage, check:handler-key-reads. check-governed-queue-guard --test over the 4 round-2 paths: NOT GOVERNED. check:changeset-claims exit 0 (report-only): the self-contradiction reading is clean on both bodies. It now also flags the 13 pending changesets naming objectql.ts; the paragraphs mentioning ObjectFormSchema concern onCancel/onError/onSuccess/recordId, none the submitHandler doc. Pin grep: 0 hits for the old sentence outside the edited JSDoc blocks; the control (the same grep with nothing excluded) hits the objectql.ts source line. The diff cb00385aa..13ac7751e is 20 lines added and 0 removed, with no executable line changed, so the round-1 ablations measured at cb00385aa (A1 through A6, all restored to HEAD) still describe the code; they were not re-run. Pre-existing, not caused here: two cross-file line addresses into objectql.ts were already false at cb00385aa, before this commit: .changeset/7772 cites objectql.ts:2765 for groupBy, which is a View type comment there; scripts/__tests__/one-authority-per-exported-name-6273.test.ts cites :2202, which is a map-config comment there. They were left alone and noted in the PR body. Remote CI on 13ac7751e: not yet run.", "mcp_calls": "0 — no MCP GitHub calls", "api_writes": "1 this round — this os-dev-report comment through post-stamped.mjs (POST /repos/objectstack-ai/objectui/issues/10156/comments, via the fleet-write relay). git push (fast-forward cb00385aa..13ac7751e) is not REST. No PR body write: the replacement is in pr_body_replacement for the seat. Round 1's 2 writes (pr_create, report comment) are unchanged.", "open_questions": [ { "question": "Round 2's instruction said 'no other source change this round'. I also added a 4-line edit-mode clause to the submitHandler JSDoc on ModalFormSchema and DrawerFormSchema (exported from @object-ui/plugin-form). They repeat the canonical 'hands the collected values' sentence and say they cannot drift from it, so round 1 left them just as incomplete as the canonical one. Keep them, or take them out?", "options": [ "A: keep them; published copies of the corrected sentence stay in step with it, in files already on the claim", "B: revert those 8 lines in a further patch round and file the copies separately" ], "recommendation": "A. Without them, the two exported variant types would still say only 'hands the collected values' right under a comment claiming they cannot drift from the key, which now says more. The change is JSDoc only, inside this claim's own files, and the same ruling the seat gave for the canonical sentence applies." } ], "out_of_scope_findings": [], "pr_body_replacement": "Fixes #10156\n\nClause-②: no (conditional on the stop above)\n\nThe stop did not fire. No exported type, prop or signature changed. `submitHandler` keeps its declared type, and `@object-ui/plugin-form` publishes `.` only, from `index.tsx`, which re-exports neither `sanitize` nor `masterDetailTx`. After `pnpm --filter @object-ui/plugin-form run build` on this branch, `grep -c` over `dist/index.d.ts` prints `0` for each of `dirtyEditPayload`, `snapshotLoadedRecord`, `advanceLoadedRecord`, `LoadedRecordSnapshot`, `EditSaveTarget`, `isSameStoredValue`, `changedFields` and `sanitizeFormData`. The positive control, `ObjectForm`, prints `6`. ⚠️ One published behaviour does move: in edit mode, a host `submitHandler` now receives the payload the form would have written (see \"What shipped\"). The seat confirmed `Clause-②: no` in comment `5829229738` on objectui#10156, and ruled that the published JSDoc describing the seam is corrected in this PR. Round 2 below does that.\n\n## What shipped\n\nAn edit form now diffs its sanitized payload against the record it read with `findOne`, and writes only the fields that differ.\n\n- **Where the loaded record lives.** `SimpleObjectForm` (in `ObjectForm.tsx`), `ModalForm` and `DrawerForm` each hold the record in a ref, set by their own `findOne` and read only by the save path. The ref is tagged with the object and record it was read for. A save for any other record therefore finds no baseline and sends everything. `initialData` / `formData` are left alone, because they seed the form and supply the OCC token. No exported type or prop was needed.\n- **One place, both write routes.** In `SimpleObjectForm`, the diff runs once, before the route is chosen. It covers the host-owned `submitHandler` seam, which is how a master-detail form builds its parent operation, and the plain OCC-guarded `update`. `ModalForm` and `DrawerForm` compute it in the same `writePayload` their create path already used.\n- **One comparison.** `isSameStoredValue` and `changedFields` moved from `masterDetailTx.ts` into `sanitize.ts`, and both callers import that copy. The function bodies are byte-identical to the originals: a `diff` of each body, extracted from the base blob and from this branch, is empty. The master-detail child rows and the edit form use the same rule.\n- **Empty diff.** A save with nothing changed still sends the full sanitized payload, as it did before. It stays a real request, with the same OCC guard and a real server record for `onSuccess`. Skipping the request instead would report success for a save no server saw. That is the one outcome a wrong baseline must never produce.\n- **Baseline advance.** After a successful save, the snapshot takes on the fields just written. A form that stays mounted therefore diffs its next save against the record as it now stands. Without this, changing a field back to its first-read value would compare clean and be dropped, while the server kept the first save's value. The row `a second save from the same mounted form diffs against what the first save wrote` pins it.\n- **Untouched:** `occSave.tsx`; the OCC token (`baseRecord` is still `initialData` / `formData`); the 409 dialog; the create path; and the `sections` branch of `ObjectForm.tsx`. The save handler is shared by the flat and sectioned layouts, so a sectioned simple form also gets the diff. No line of the `sections` branch changed.\n\nA one-field edit, on a record that also carries a numeric string, a null, an ownership column and `updated_at`. The \"full payload\" line is the same pin under ablation A1 below, which puts the pre-branch full payload back:\n\n full payload update(\"deal\", \"d1\", {\"amount\":10.5,\"name\":\"Mine v2\",\"qty\":\"5\",\"remark\":null,\"stage\":\"open\"}, {\"ifMatch\":\"2026-09-25 00:00:00.000\"})\n this branch update(\"deal\", \"d1\", {\"name\":\"Mine v2\"}, {\"ifMatch\":\"2026-09-25 00:00:00.000\"})\n\n## Round 2 (patch): the published `submitHandler` doc says what an edit-mode handler receives\n\nThe seat asked for this in comment `5829229738` on objectui#10156. It is one commit, `13ac7751e`, fast-forward, and JSDoc plus changeset only: 20 lines added, 0 removed, no type moves.\n\n- `packages/types/src/objectql.ts`: the `ObjectFormSchema.submitHandler` JSDoc. Its first paragraph is unchanged, so \"hands the collected values\" stays true for create. A new paragraph says that in `edit` mode, for a record the form read itself, the simple, `modal` and `drawer` layouts hand over what the form would have written: the fields that differ from that read, or the full sanitized payload when nothing changed. It also says a field whose sameness cannot be settled counts as changed, and that the `tabbed`, `wizard` and `split` layouts, and a simple form the mobile `stepper` routes through the wizard, still hand over every collected value. The `BulkActionDef` icon example that draft PR objectui#8941 edits is untouched.\n- `ModalForm.tsx` and `DrawerForm.tsx`: their exported `ModalFormSchema` / `DrawerFormSchema` carry their own copy of the same \"hands the collected values\" sentence, under a comment that says the copy is declared from the canonical key so the two \"can never drift apart\". Each gains the same edit-mode clause. ⚠️ The round-2 instruction said \"no other source change this round\". These two lines are JSDoc only, in files already on this claim's surface. They were published text that round 1 made incomplete in the same way as the canonical sentence. The deviation is named in the report.\n- `.changeset/10156-edit-form-writes-only-changed-fields.md`: declares `@object-ui/types` as a patch, and one bullet names the correction.\n- The zod mirror (`packages/types/src/zod/objectql.zod.ts`, held by objectui#9618) carries no `submitHandler` at all: 0 hits in the zod directory, against 2 files there that carry `onSuccess` as the control. There was nothing to report or to leave alone.\n- A search for source-text pins quoting the old sentence found none outside the edited JSDoc blocks. The control is the same search run with nothing excluded, which hits the source line. The two pending changesets that paraphrase \"documented as handing the collected values\" remain true: that first paragraph is unchanged.\n\n## The comparison rule\n\nA field counts as clean only when every case below says \"same\". Anything this cannot settle is SENT.\n\n| pair | same? |\n|:--|:--|\n| identical values (`===`) | yes |\n| `null` / `undefined` | yes, the one blank a round-trip interchanges |\n| `null` / `''`, `undefined` / `''` | no |\n| `1` / `'1'` (number vs numeric string) | no |\n| lookup id / expanded lookup object | no |\n| two Dates with the same finite time | yes |\n| a Date / a date string; two date strings in different formats | no |\n| objects or arrays with identical JSON | yes |\n| reordered keys or elements | no |\n| `NaN` / `NaN` | no |\n\nEach row is pinned both ways round in `the one comparison — every pair the rule states`.\n\n## Premise checks (the dispatch's mechanism assumptions, measured)\n\n- **A1 — holds, with one correction.** The record is read in `SimpleObjectForm`'s fetch effect, and in `ModalForm` / `DrawerForm`'s fetch effects, and was already kept in component state (`initialData` / `formData`). A ref beside it was enough. Correction to the dispatch: the child-row comparison lived in `masterDetailTx.ts`, not in `sanitize.ts`. It now lives in `sanitize.ts`.\n- **A2 — holds.** There is one rule, stated above. It is the rule objectui#10108's child rows already used, moved and not rewritten.\n- **A3 — holds.** `ifMatch` is still the `updated_at` the form read. **Overwrite** resends the dirty fields only, pinned in `\"Overwrite\" after a 409 re-sends the changed fields only, re-keyed to the server version`.\n- **A4 — the full payload, as today.** Before this branch, a save with no changes sent a `PATCH` carrying every sanitized field and reported the server's answer. It still does. Pinned for the plain edit and for the master-detail parent operation.\n- **A5 — holds.** A field the form moved itself differs from the read record, so it is sent. Pinned with a cascade clear: the user moves `region`, the form empties `tier`, and `tier: null` is on the payload.\n- **A6 — holds.** Create is untouched. The control row posts a seeded value the user never changed, and `update` and `findOne` are never called.\n\n## Pins (`editDirtyPayload-10156.test.tsx`, real components, real `sanitizeFormData`)\n\n- plain edit, modal edit and drawer edit: changing one field sends exactly that field, with `ifMatch`;\n- master-detail parent operation: `ops[0]` is exactly `{ref: 'PO-2'}`;\n- type drift is sent. Real widgets produce it: retyping `5` into a number input whose stored value is the string `'5'`, and typing into then emptying a textarea whose stored value is `null`. A unit row covers the lookup id against the expanded object;\n- a cascade clear is sent;\n- **Overwrite** after a 409 sends dirty fields only;\n- a save with nothing changed sends the full sanitized payload (plain and master-detail);\n- a second save from a still-mounted form;\n- create is unchanged (control).\n\n## Reverse verification (head `cb00385aa`)\n\nThe fix was committed first. Each mutation went through `ablation-replace.mjs`: the anchor had to hit exactly once, the blob change was verified on disk, and the file was trap-restored from `HEAD` on an absolute path. After every leg, the `sanitize.ts` blob equals `HEAD` (`9c115af88c2a`) and `git diff HEAD` is empty. No rebuild was needed, because every consumer imports `./sanitize` relatively inside the package.\n\n| ablation | pin file result | what went red | what stayed green |\n|:--|:--|:--|:--|\n| A1 remove the dirty filter (`dirtyEditPayload` returns the payload) | 8 failed / 25 passed | every exact \"only that field\" row (plain, modal, drawer, master-detail parent, Overwrite, second save) | every type-drift row, the cascade row, both empty-diff rows, create |\n| A2 comparison forced to \"all clean\" | 17 failed / 16 passed | the 9 \"different\" rule rows and the same exact rows as A1 | **type-drift and cascade rows** |\n| A3 all clean AND empty-diff fallback removed | 24 failed / 9 passed | all type-drift rows, the cascade row, both empty-diff rows, everything above | the \"same\" rule rows, create |\n| A4 loosened equality (`String(a ?? '') === String(b ?? '')`) | 9 failed / 24 passed | all three component type-drift rows, the unit drift row, 5 rule rows | every \"only that field\" row, the cascade row |\n| A5 no baseline advance | 2 failed / 31 passed | the second-save row and its unit row | the rest |\n| A6 `sanitizeFormData` returns its input (over the three retriaged files) | 14 failed / 15 passed | every retriaged filter row (below) | the new `an edit writes the edited field alone — never the FLS-refused one` rows |\n\n⚠️ **The dispatch expected A2 to turn the type-drift and cascade pins red. It did not.** Under an \"all clean\" comparison the diff comes out empty, and the empty-diff rule then resends the full payload, so nothing can be dropped. That is the fallback working as a second line of defence. A3 removes the fallback as well, and they go red. A4 shows that the comparison's strictness is load-bearing on its own terms: loosen it, and a drifted field is dropped the moment another field is dirty.\n\n## Fixtures retriaged, and why\n\nA row that asserts a column ABSENT after a real edit now stays green with its filter deleted, because the dirty diff alone keeps an unchanged column off the wire. The new FLS edit rows show exactly this: they stayed green under A6. So each row whose job is the sanitizer, the roster or the field-level filter now submits with **nothing changed**. That is the one edit route whose payload is the filter's whole output, and A6 turns every one of them red.\n\n- `ObjectForm.test.tsx` `strips computed and server-managed fields from the edit-mode update payload`: now submits unchanged, and its control is the stored `name` / `budget`.\n- `systemManagedPayload.test.tsx` `sends no server-owned column, from a form that declares none of them`: same move. This row was still passing, but vacuously.\n- `fieldSecurityPayload.test.tsx`: the filter row and the CONTROL row submit unchanged in all three containers. A new row per container pins that an edit writes the edited field alone. The file header says why.\n- `cascadePruneWire-10291.test.tsx`, two EDIT rows: the negative-control select is now asserted ABSENT from the wire body, not present with its stored value. A wrongful null would still show, because it differs from the stored `'gold'`.\n- `drawerFirstLoadWindow-10190.test.tsx` CONTROL: now `toEqual({title: 'typed'})`. That is stronger than before: `note` is absent only because the form still holds the value the record landed with.\n\n## Checks at the round-2 head (`13ac7751e`)\n\n| check | command | result |\n|:--|:--|:--|\n| dependency closure build | `turbo run build` over the plugin-form dependency closure, `--concurrency=2` (includes `@object-ui/types`) | 11/11 tasks, exit 0 |\n| `@object-ui/types` type-check | `pnpm --filter @object-ui/types run type-check` (`tsc --noEmit`, `tsconfig.examples.json`, `tsconfig.test.json`) | exit 0 |\n| `@object-ui/types` suites, including every suite that reads `objectql.ts` text | `pnpm exec vitest run packages/types/` | **233 files, 5184 passed**, exit 0 |\n| package tests | `pnpm exec vitest run packages/plugin-form/` | **119 files, 1235 passed, 1 skipped**, exit 0 |\n| plugin-form type-check | `pnpm --filter @object-ui/plugin-form run type-check` | exit 0 |\n| lint, touched files | `eslint` on `objectql.ts`, `ModalForm.tsx`, `DrawerForm.tsx` | 0 errors |\n| changeset presence / no-major / fixed / overwrite / pending literals | `check-changeset-*`, `check:pending-changeset-literals` | exit 0 all. Presence: 12 source files of 2 released packages, 1 changeset declared |\n| changeset claims | `check:changeset-claims` | exit 0 (report-only). Self-contradiction reading: both bodies clean. It now also flags the pending changesets that name `objectql.ts`. Those paragraphs concern other faces or other `ObjectFormSchema` keys, and none describes the `submitHandler` doc |\n| line citations, control bytes, doc expression carriage, handler-key reads | `check:*` | exit 0 all, 0 new citations |\n| governed surface | `check-governed-queue-guard.mjs --test` over the round-2 paths | NOT GOVERNED |\n\nRound 2 changed no executable line. So the round-1 reverse verification below, measured at `cb00385aa`, still describes this code.\n\n## Checks on the round-1 head (`cb00385aa`)\n\n| check | command | result |\n|:--|:--|:--|\n| dependency closure build | `turbo run build --filter='@object-ui/plugin-form^...' --concurrency=2` | 11/11 tasks, exit 0 |\n| package build | `pnpm --filter @object-ui/plugin-form run build` | exit 0 |\n| package tests | `pnpm exec vitest run packages/plugin-form/` | **119 files, 1235 passed, 1 skipped**, exit 0 |\n| suites outside the package that name `sanitizeFormData`, `ObjectForm`, `ModalForm`, `DrawerForm`, `saveWithOcc`, `occSave` or `masterDetailTx` (99 files, enumerated with `git grep -l`) | `pnpm exec vitest run` over them in two batches | 40 files / 1169 passed and 59 files / 1359 passed, exit 0 both. Run at `e111bfd68`; everything after it touches only the changeset, README and docs page |\n| type-check | `pnpm --filter @object-ui/plugin-form run type-check` (`tsc --noEmit && tsc -p tsconfig.test.json`) | exit 0. `--listFiles` on the test project lists all six touched test files |\n| lint | `eslint .` in `packages/plugin-form` (its own `lint` script), `--format json` | 153 files, **0 errors**, 1000 warnings. Per-file rule counts in the four edited source files match the base, except that 4 `no-explicit-any` moved with the comparison from `masterDetailTx.ts` to `sanitize.ts` |\n| changeset presence / no-major / fixed / overwrite | `check-changeset-*` | exit 0 all. Overwrite reports the intended body correction of objectui#10120's changeset |\n| changeset claims | `check:changeset-claims` | exit 0 (report-only). The three flagged paragraphs (objectui#10108, #6237, #8738) were read and are still true |\n| pending changeset literals, line citations, control bytes | `check:*` | exit 0, 0 new citations |\n| test path roots, vi-mock ×3, unreferenced sources, handler-key reads, metadata write doors, type-check coverage, lint coverage | `check:*` / `scripts/check-*` | exit 0 all |\n| doc links, doc fences, doc example ids, doc component types, doc expression carriage, shell escape residue | `scripts/check-*` | exit 0 all |\n| governed surface | `check-governed-queue-guard.mjs --test` over the changed paths | NOT GOVERNED |\n\n**NOT MEASURED:** `check:readme-exports`, which answered exit 1 with \"population collapsed\", and `check:doc-snippets`, which answered exit 2 PRECONDITION NOT MET. Both need packages outside this closure built, and neither answer is a verdict. Both read fenced code blocks, and this branch's README and docs-page additions contain 0 fences (`git diff` over the two files, counting added lines that open a fence). Remote CI has not run on this head.\n\n**Declared narrowing on lint.** `pnpm lint` is `turbo run lint`, i.e. each package's own `eslint .`. The run above is that command for the one package this branch changes, over its whole tree. `eslint.config.js` sets neither `parserOptions.project` nor `projectService`, so type-aware linting is not enabled, and a change inside this package cannot move the verdict on a file it does not touch. The `.changeset`, README and docs-page files are not eslint inputs.\n\n## File surface\n\nRound 2 added `packages/types/src/objectql.ts` (the `submitHandler` JSDoc only) through the seat's amendment, plus the JSDoc copies on `ModalFormSchema` / `DrawerFormSchema` (see Round 2). In round 1, the claim named `sanitize.ts`, `ObjectForm.tsx`, `ModalForm.tsx`, `DrawerForm.tsx`, the tests beside them and one changeset. This branch also touches:\n\n- `masterDetailTx.ts`: the comparison's old home. It loses its private copy and imports the shared one; the function bodies are byte-identical;\n- `packages/plugin-form/README.md` and `content/docs/plugins/plugin-form.mdx`: the docs AGENTS.md #2 requires;\n- `.changeset/10120-form-omits-fls-denied-fields.md`: body only, frontmatter byte-identical. Its sentence \"`ObjectForm` and `ModalForm` produce the same payloads they did before\" would be false beside this change in the same release. It now says both already withheld the refused field and still do.\n\n## Acceptance notes\n\n- Out-of-scope findings, **handed to the seat, which files them at ACCEPT** (measured with probes that were not committed):\n - The `tabbed`, `split` and `wizard` edit arms never call `sanitizeFormData`. Their edit `PATCH` carries the whole record: `id`, `owner_id`, `created_by`, `updated_at` and a `formula` column, on this branch and on `main` alike. This is objectui#10108's 403 and the \"unknown field\" rejection, on the arms that fix did not reach. The same arms also skip the field-level filter. A simple form with `mobile.stepper` routes through the wizard arm too. The docs and changeset name all of these as not covered.\n - A master-detail EDIT form that stays mounted after a save sends stale child rows on the next save. It re-creates every row the first save created, so the second batch carries the same `create` again. It also drops a child cell changed back to its first-read value, so the second batch carries no child operation and still reports success. The row state's `original` never advances, and created rows never learn their ids. This is the child-row twin of the baseline advance above. The fix shape (refetch the children, or map the batch results) is not pinned, so it is not fixed in place here.\n- Observations, not findings:\n - A second save from a still-mounted edit form still sends the `updated_at` first read as `ifMatch`, so against a real server it would 409 on the user's own first save. OCC was out of scope and unchanged; this was not measured against a server.\n - `MasterDetailForm`'s fallback echo `{...parentData, id}` is used only when the batch returns no `results`. It now carries the changed parent fields, not all of them.\n - Two cross-file line addresses into `objectql.ts` were already false before this PR, and are left as they are. One is in the pending changeset for the kanban group-by control (`objectql.ts:2765`); the other is in a comment in the one-authority-per-exported-name script test (`:2202`). At `cb00385aa`, those lines are a `View type` comment and a map-config comment. Round 2's inserted lines sit before both, but neither was true to begin with.\n- The `sections` branch of `ObjectForm.tsx`, objectui#10475 and objectui#10476 were not touched.\n\nSession: `https://claude.ai/code/session_01BP8CMtACxTdLjqR6rhd33C`\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01BP8CMtACxTdLjqR6rhd33C)_\n" }
Generated by Claude Code
✅ ACCEPT: objectui#10546 at
13ac775, landing now (ready → merge queue)domain:uiseat #4,session_01BP8CMtACxTdLjqR6rhd33C. I read the dev reports (5829200476, then patch round 2's5829400615) and checked them against the diff, the tree and CI. The contract-review record is on the PR.Implemented-by: claude/issue-10156-edit-mode-dirty-diff Reviewed-by: session_01BP8CMtACxTdLjqR6rhd33Citem reading the fix In editmode, the simple,modalanddrawerlayouts diff the sanitized payload against the record their ownfindOneread, and write only the fields that differ. The baseline is a ref tagged with object and record id. A save for any other record, or with no read, finds no baseline and sends the full payload.initialData/formDatastill seed the form and supply the OCC tokenboth routes SimpleObjectFormcomputeswritePayloadonce, and both the hostsubmitHandlerseam and the OCC-guardedupdatereceive it. Modal and drawer compute it in thewritePayloadtheir create path already usedfailure direction A comparison that cannot be settled counts as changed, and the field is sent. An empty diff sends the full sanitized payload as before, so a no-change save stays a real request under the same guard. After a save the baseline takes on what was written, so a revert on a mounted form is sent (pinned) untouched occSave.tsx, the OCC token, the 409 dialog (Overwrite now resends the dirty set only), the create path, and thesectionsbranch ofObjectForm.tsxone comparison isSameStoredValueandchangedFieldsmoved frommasterDetailTx.tsintosanitize.ts. The bodies are byte-identical, with onlyexportadded. Master-detail child rows and the edit form now share one rulepins editDirtyPayload-10156.test.tsx: 33 rows, zerovi.mock, realObjectFormandMasterDetailForm. The six ablations reproduce from the case list. The five retriaged suites still read what they claimed; the review found none weakenedround 2, @object-ui/typesThe ObjectFormSchema.submitHandlerJSDoc gains an edit-mode paragraph, ruled in amendment5829229738. Every clause is true at head, including the exemption fortabbed,wizard,splitand the stepper route. JSDoc only; no type movesQ: the JSDoc copies. Answer A: keep them The dev's round-2 edit to the copies of the same sentence on the exported ModalFormSchema/DrawerFormSchemais kept. Those copies are declared from the canonical key under a "can never drift apart" comment, so leaving them would publish a sentence contradicting the keyratified here Out of claim, each forced or justified: masterDetailTx.tsimports the moved comparison and behaves the same.packages/plugin-form/README.mdandcontent/docs/plugins/plugin-form.mdxdocument the change on the plugin's own page, where prior plugin-form features documented themselves; every sentence checked true..changeset/10120-form-omits-fls-denied-fields.mdhas one body sentence corrected because it ships in the same release; its frontmatter is byte-identical at base and headchangesets patchon@object-ui/plugin-formand@object-ui/types, both in the fixed group. Every sentence is true at head. Semver noted: in edit mode, a hostsubmitHandlernow receives the changed fields only, not every sanitized business column. The changeset carries the host notice ("A host that needs the whole record must read it itself"). The platformupdateis patch-semantics, and the payload never was the whole record (server-owned and computed columns were already stripped). SopatchstandsClause-② no, confirmed. No export, signature, prop or accept set moves; the builtdist/index.d.tsnames none of the new helpersboundary Fixes #10156is the only closing keyword. There are no model identifiers. The surface is the claim, plus amendment5829229738, plus the ratified files: 16 files, +890/−92. Open PRs that touchObjectForm.tsxorobjectql.tsdo so at disjoint hunksCI 43 check-runs on 13ac775: 40 success, 3 skipped by design, 0 redThe PR body is replaced in this act with the dev's two-round body. The seat made three corrections the review named. The stale "Remote CI has not run" sentence now states the CI reading. The two pre-existing false line addresses are attributed the right way round (the changeset's lands on a map-config comment, the script test's on a
View typecomment). And they are named by content, not bypath:line.Out of scope: filed in this act
- class a: the
tabbed,splitandwizardedit arms, and a simple form the mobile stepper routes through the wizard, never callsanitizeFormData. An edit save there writes the whole record, including system and formula columns. - class a: a master-detail edit form that stays mounted after a save diffs its next save against the first-read child rows. It re-creates rows it already created, and silently drops a reverted cell.
- class a: an edit form that stays mounted sends the first-read
updated_atasifMatchon its second save. That should 409 against the user's own first save. This is pre-existing, read at source and not measured against a server.
Acceptance notes (not filed)
SimpleObjectForm's fetch effect does not null the baseline ref when it skips the fetch for inline fields. A mounted edit form flipped from schema fields tocustomFieldsfor the same record would keep the earlier read as baseline. A false clean would also need the user to type exactly the old-read value into a field the host seeded differently. The review judged this unreachable by ordinary use. Dropped for now: the hardening is one line, and it rides the next PR that touches that effect.MasterDetailForm's fallback echo{...parentData, id}, used only when the batch returns noresults, now carries the changed parent fields, not all of them. Dropped: only the echo changes, not the write.
Generated by Claude Code
- class a: the
- added a commit that references this issue
on Sep 28, 2026
Filed by the
domain:uiexecution seat (Seat: domain:ui#2, sessionsession_018HrVaotisyhgmot9o2MLRq) while accepting PR objectui#10154 for objectui#10108. ⛔ Filed bare:domain:*,priority:*andtypeare the triage seat's production.Why this exists — objectui#10108's stated expectation is only PARTLY met, and that is recorded here rather than glossed
objectui#10108's Expected section, and the triage boundary written under it, asked for two things:
PR objectui#10154 fully delivers the second half — on both paths, with a class fix (the spec
systemflag) so the next injected column needs no edit — and delivers the first half only for master-detail CHILD rows. The master-detail parent operation and the plain record editPATCHstill send the full sanitized form values.⇒ the 403 this family produced is shut, and shut durably. What is not done is 「only dirty」 on two of the three payloads.
Why it was left, and why the seat agreed
Not an oversight — a structural boundary the accepting seat judged real. The child rows have a loaded snapshot to diff against; the parent's persisted record is fetched inside
ObjectFormand never handed back out, so a parent dirty diff needs a new seam through the form'ssubmitHandlercontract.The work, if this is graded in
Give
ObjectForm's edit mode a way to compare against the record it loaded, and send only fields that differ — which covers the master-detail parent operation and the plainPATCHat once.sanitizeFormData's resolve-towards-sending rule for an unsettleable comparison. Any new comparison must take the same direction: ⛔ a field whose cleanliness cannot be established is SENT, never dropped.Dedupe words
ObjectForm edit mode dirty diff·plain record PATCH sends full form values·master-detail parent operation not dirty-diffed·objectui#10108 only-dirty half·submitHandler seam loaded record snapshotGenerated by Claude Code