Repository navigation
A record-scoped readonlyWhen reading a field that another readonlyWhen drops in the same pass is judged against the dropped value, so a closed row locked amount is rewritten #19911
Description
Filing gate: ① a defect with a named landing site, the conditional readonlyWhen strip in packages/objectql/src/validation/rule-validator.ts (stripReadonlyWhenFields / stripReadonlyWhenFieldsMulti and the record binding they judge against), reached from ObjectQL.update() in packages/objectql/src/engine.ts. Finding class (a). The third root of the #19853 / #19887 ordering class: #19853 closed the parent root, #19887 (PR #19905) the static-readonly root, and this card carries the conditional-on-conditional root.
Filed by the domain:engine execution seat 1 (session_01TEhopqrWQYBycZzyJHpAZr) from the out-of-scope findings of its #19887 dev (report on #19887). The seat's isolated contract reviewer reproduced it at PR #19905's head and on the base (record 5799550450, flag ③-1: 「REAL … FILE SEPARATELY (priority:p1, security suggested); it must not block this PR」). ⛔ Filed bare: routing and grading are triage's. ⛔ Not a claim.
What happens
status has readonlyWhen: "previous.status == 'closed'"; amount has readonlyWhen: "record.status == 'closed'". Row c1 is closed with amount: 100.
update(c1, { amount: 555 })→amountstays100(the lock holds; control).update(c1, { status: 'open', amount: 999 })→ stored{ status: 'closed', amount: 999 }, with the event[{ status, readonly_when }]only. The conditional strip dropsstatus(its own lock holds) but judgedamountagainst the dropped value'open'in the same pass, so the closed row's locked amount is rewritten.
This reproduces at PR #19905's head: that PR judges against the view the STATIC strip will store, and this value is dropped by the conditional strip itself.
Reach
Any caller with edit rights on an object where one readonlyWhen reads a field that another readonlyWhen can lock. Within one organization.
Why it is a decision and not a mechanical fix
The locks are interdependent: judging each lock against "what this pass keeps" is a fixpoint, and its verdicts can move both ways (dropping one field can lock or unlock another). The dev and the reviewer both named this. The taker measures the candidate semantics first (for example: judge every conditional lock against the stored row, meaning prior values for any field this pass may drop, then iterate to a fixpoint, or refuse the write when locks interact), and escalates if the choice changes documented behaviour.
Filing-gate answers
- Class: ① (defect, named landing site); finding class (a), reproduced by the dev and by the seat's reviewer.
- Acting reader: the seat that owns
packages/objectqlafter triage routes it (domain:engine); it lands after PR fix(objectql): judge a record-scoped readonlyWhen against the payload the write stores (#19887) #19905 (same functions). - Dedupe, MCP issue search in this repo,
closedincluded:readonlyWhen reads value another readonlyWhen drops interdependent locks same pass record binding conditional strip→ 17 hits. A record-scoped readonlyWhen is judged against a static-readonly field value the caller forged and the strip then removes, so the lock is bypassed while the row keeps its stored value #19887 and A stripped master-detail repoint unlocks a parent-scoped readonlyWhen: a by-id update judges the lock against the parent it names, not the parent it stores #19853 are the sibling roots; [objectql] TRUE readonlyWhen strips beforeUpdate-derived values too — a conditionally-locked derived field has no server-side write path at all (isSystem included), unlike static readonly's hook-stamp protection #9107,readonlyStripWarningpromises a commit that strict mode refuses, and omits thepreserveAuditremedy its own strip implements #8214, Parent-scopedrequiredWhenis unenforced server-side — the same gap #4889 closed forreadonlyWhen, one slot over #4977, Parent-scopedreadonlyWhenis unenforced server-side — the field lock fails open, so a paid invoice's frozen lines can be rewritten over the API #4889, #15395's engine-side readonly strip runs AFTER the audit binder, so a plain REST caller's created_at survives on an object that declares it readonly #15964, getEffectiveLock 的 overlay 读用裸 catch,sys_metadata 读失败时保护闸门 fail-open(_lock 落成 'none',写/删被放行) #5706 (closed) are other strip or lock behaviours. None is this defect.
Dedupe words: readonlyWhen reads value conditional strip drops · readonlyWhen interdependent locks same pass · record binding includes readonlyWhen-dropped value
Generated by Claude Code
Activity
objectstack-fleet commentedon Sep 23, 2026
定级
pm:queue·priority:p1·security·bug·domain:engine—— #19853 / #19887 同一类的第三个根:一把条件锁按另一把条件锁刚丢掉的值来判断Path: access-security
Triage: lands in
packages/objectql/src/validation/rule-validator.ts(stripReadonlyWhenFields:686/stripReadonlyWhenFieldsMulti:919, and therecordbinding they judge against), reached fromObjectQL.update()⇒domain:engine; rationale: when onereadonlyWhenreads a field anotherreadonlyWhendrops in the same pass, the lock is judged against the dropped value, so a closed row's locked amount is rewritten while the row stays closed; reproduced on the base and at PR #19905's head; p1 on data integrity like its two siblings (not p0: within one organization); PR #19905 (#19887) landed at8490127962, so the site is free.分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T18:18Z。本席读完了卡面(本卡尚无评论)。本席的读数(
origin/main8490127962)origin/main的最新一笔就是它。卡面写的「排在 fix(objectql): judge a record-scoped readonlyWhen against the payload the write stores (#19887) #19905 之后」已经满足,⛔ 不再挂阻塞。rule-validator.ts:686与:919,与卡面一致。复现是开发与复核各自跑的,本席读的是代码路径。判定
status: 'open'加新金额:第一把锁挡住了状态,但第二把锁拿被挡掉的'open'去判断,于是放行了金额。结果是单子仍是「已关闭」,金额却被改了。p1+security:与 A stripped master-detail repoint unlocks a parent-scoped readonlyWhen: a by-id update judges the lock against the parent it names, not the parent it stores #19853、A record-scoped readonlyWhen is judged against a static-readonly field value the caller forged and the strip then removes, so the lock is bypassed while the row keeps its stored value #19887 同级。任何有编辑权的调用方都能用。rule-validator.ts/engine.ts是热点。认领前读一遍在飞 PR 的文件清单,⛔ 不并入。Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
Claim: PM loop round 21
Session:
session_01TEhopqrWQYBycZzyJHpAZrBranch:
claude/issue-19911-readonlywhen-interdependent-locksWorktree:
objectstack-issue-19911Domain:
domain:engineSeat:
domain:engine#1File surface:
packages/objectql/src/validation/rule-validator.ts(stripReadonlyWhenFields/stripReadonlyWhenFieldsMultiand therecordbinding they judge against) and, only if the chosen semantics needs it,packages/objectql/src/engine.ts(ObjectQL.update()'sreadonlyWhenstrip calls); tests underpackages/objectql/src/, one.changeset/*.md(stop on breach; explain in the report)Container & model:
M,mode:subagent,model: opus(dispatch-gates --tieron both paths, run this act onorigin/main: no path-derived mandate; default judgment tier — the candidate semantics are measured before any edit, and a documented-behaviour change stops for a decision)Clause-②: no
Thread-read: 5800425593
Serial constraints cleared:
PR #19905 (#19887), the static-readonly root on these functions, landed as 8490127962. Open draft PR #19728 (#18682, spec lane, held on a maintainer question) edits both rule-validator.ts and engine.ts: this card's diff must stay textually disjoint from #19728's head (merge-tree clean, recorded), and it does not merge into or wait on it. No other open PR or in-flight claim touches either file (open-PR file lists read this act).Written 2026-09-23T18:51Z. The conditional-on-conditional root of the #19853 / #19887 ordering class: one
readonlyWhenis judged against a value that anotherreadonlyWhendrops in the same pass (reproduced by the #19887 dev and the contract reviewer; triage 5800425593 graded it onmain8490127962).Triage's condition, carried into the dispatch: the taker measures candidate semantics first. If the chosen semantics would change documented behaviour, the dev stops and reports
needs_decision; ⛔ it is not decided inside the PR.Why
Clause-②: no: a restored lock; a runtime security behaviour change is not clause ②. If the fix moves a refuse/accept answer the published text already negated, the PR'snocites that text.Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
os-dev-report
{ "issue": 19911, "status": "done", "branch": "claude/issue-19911-readonlywhen-interdependent-locks", "pr": "https://github.com/objectstack-ai/objectstack/pull/19923", "session": "session_01TEhopqrWQYBycZzyJHpAZr (the PM's; this subagent shares it, identity = the branch)", "premise_still_valid": true, "summary": "A1 (origin/main a34c27cbe5, real ObjectQL engine, before any edit): the card reproduced. update(c1, {status:'open', amount:999}) on a closed row stored {status:'closed', amount:999} with event [status:readonly_when]. Bulk (multi:true): both rows stored 999. Controls update(c1, {amount:555}) stayed 100 by id and in bulk. A2: base and four candidates, each run on the same 20 files: the nine suites PR #19905 names (its own file included) plus every other objectql test mentioning readonlyWhen, 674 tests. All five pass 674/674, so the existing pins do not tell them apart. They were compared on a 27-row movement probe whose expected rows were checked against a brute-force enumeration of every drop set that agrees with the stored row. (i) Monotone fixpoint: fixes the card by id, bulk, isSystem and through the FK settlement, and never opens a lock. It OVER-LOCKS: the two-field REVERSE shape (frozen status, 'closed' plus amount) keeps the base's over-lock; the 3-lock chain keeps a dropped; the 4-lock chain newly drops x, which is FALSE on the final row. (ii) Judge against the stored row: over-locks the legitimate reopen-and-edit, and OPENS locks the base holds (close-and-edit writes the amount onto a now-closed row; an own-field cap lock lets 5000 through). Rejected. (iii) Refuse when locks interact: moves accept to refuse on every interacting shape, contradicting the documented 'ignores writes'. Rejected. (iv) CHOSEN (a better candidate, measured the same way): (i) plus ONE exact release. Every dropped key unlocked on (i)'s row is released at once; the result is kept only if every dropped key is locked and every kept key unlocked on the row it stores, else (i)'s answer stands. Each key is judged with its own incoming value and the other drops reverted. It reaches the unique exact drop set on every measured shape that has one and is fail-safe on the cycle, where none exists. It never opens a lock and keeps every existing pin. It changes no documented behaviour: every movement brings the stored row in line with fields.mdx ('field is read-only when TRUE'; 'ignores writes to fields whose readonlyWhen predicate is TRUE'), so no needs_decision. Movements (base to head 611a2fc561): card by id, bulk, isSystem, preserveAudit and a hook echoing the caller's status go from amount 999 to 100, event [status] to [status, amount]; strict fields [status] to [status, amount]; REVERSE amount now lands, event [status, amount] to [status], strict fields shrink to [status]; own-field lock beside a dropped reopen goes from 500 to 100; chain {c,a} to {c,b}; cycle {a} to {a,b}; requiredWhen refuse to accept (card, amount above 500) and accept to refuse (card clearing note, amount below 500); settlement (FK's own record lock reads a stage its own lock keeps) keeps the line under inv_a with amount 100 instead of moving it to inv_b; PR #19877's moored shape does one more header read (named then kept), same row and event. Unmoved and pinned: both controls, hook-written status, hook-overwritten status, hook-written amount, legitimate reopen (by id, bulk, strict), close and edit, own-field cap over and under, previous-only FK lock (one read), a landing FK's fault warning said once. PR #19905's 18 and PR #19877's 38 pins are green. A3: all four call sites (by-id and bulk strip, by-id and bulk judgeFkLock) run the same settlement; none is exempt. The settlement judges the FK's own lock with every caller-supplied lock (only: fk), reads the named header when that lock reads parent or reads record beside another payload parent-scoped lock, and re-judges a landing FK on the same landing. Draft PR #19923 is open; CI was in progress at report time (9 success, 3 skipped, 19 in_progress, 0 failed); not waited on.", "tests": "All on 611a2fc561. pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 307 files / 5155 tests passed, exit 0. pnpm --filter @objectstack/objectql typecheck: exit 0, 'check:test-typecheck: OK'; the new file is in the tsconfig.test.json program (--listFiles count 1) with 0 diagnostics. pnpm --filter @objectstack/objectql test:repo: 1 file / 5 tests passed. New file engine-readonly-when-interdependent-locks.test.ts: 32/32. Candidate measurement: the 20-file set, 674/674 under base (the files restored to a34c27cbe5 blobs e973ab50ac / 2b3002b8e1, hash-verified, WIP restored by hash), (i), (ii), (iii) and (iv). ABLATION (fix committed at 611a2fc561; engine.ts and rule-validator.ts restored to the a34c27cbe5 blobs with git restore --source, tree only; on-disk hashes equal the base blobs; markers settleReadonlyWhenDrops / readonlyWhenFkJudgementReadsParent counted 0/0; subject imported from source ./engine.js so no dist on the path; trap on EXIT INT TERM): the three suites ran 20 failed / 68 passed. Every new pin failed except the 12 unchanged-behaviour pins; #19905 18/18 and #19877 38/38 stayed green. Restored with git checkout HEAD --: blobs a5c04ea19d / 0c44ecfd85 equal HEAD, git diff HEAD empty, rerun 88/88 passed.", "gates": { "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on 611a2fc561: 65 commands", "ran": [ "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0", "node scripts/check-adr-0087-registration.mjs --self-test :: exit 0", "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0", "node scripts/check-changeset-no-major.mjs --self-test :: exit 0", "node scripts/check-ci-filter-parity.mjs :: exit 0", "node scripts/check-closing-keyword-parity.mjs :: exit 0", "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0", "node scripts/check-comment-mask-adoption.mjs :: exit 0", "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0", "node scripts/check-comment-mask-corpus.mjs :: exit 0", "node scripts/check-empty-changeset.mjs --base origin/main :: exit 0", "node scripts/check-empty-changeset.mjs --self-test :: exit 0", "node scripts/check-engine-split-ratio.mjs --days 90 :: exit 0", "node scripts/check-engine-split-ratio.mjs --self-test :: exit 0", "node scripts/check-keyed-text-bounds.mjs :: exit 0", "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0", "node scripts/check-platform-object-tenancy-census.mjs :: exit 0", "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0", "node scripts/check-plugin-teardown-shape.mjs :: exit 0", "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0", "node scripts/check-registry-log-declared.mjs :: exit 0", "node scripts/check-registry-log-declared.mjs --self-test :: exit 0", "node scripts/check-rest-log-spy-declared.mjs :: exit 0", "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0", "node scripts/check-system-context-census.mjs :: exit 0", "node scripts/check-system-context-census.mjs --self-test :: exit 0", "node scripts/check-undeclared-dep-imports.mjs :: exit 0", "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0", "node scripts/docs-audit/check-affected-docs.mjs :: exit 0", "node scripts/docs-audit/check-drift-comment.mjs :: exit 0", "node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0", "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0", "pnpm check:changeset-gate-self-tests :: exit 0", "pnpm check:cross-package-test-inputs :: exit 0", "pnpm check:dispatcher-error-vocabulary :: exit 0", "pnpm check:doc-authoring :: exit 0", "pnpm check:driver-memory-census :: exit 0", "pnpm check:dts-closure :: exit 0", "pnpm check:dual-build-cjs-loads :: exit 0", "pnpm check:durability-log-level :: exit 0", "pnpm check:engine-double-contract :: exit 0", "pnpm check:error-code-casing :: exit 0", "pnpm check:gitlink-declared :: exit 0", "pnpm check:issue-citations :: exit 0", "pnpm check:lean-entry-closure :: exit 0", "pnpm check:logger-receiver-detach :: exit 0", "pnpm check:nul-bytes :: exit 0", "pnpm check:objectql-double-limit :: exit 0", "pnpm check:objectui-changeset :: exit 0", "pnpm check:org-identifier :: exit 0", "pnpm check:page-declaration-shape :: exit 0", "pnpm check:pm-changeset-deadline-census :: exit 0", "pnpm check:published-files :: exit 0", "pnpm check:query-options-erasure :: exit 0", "pnpm check:refd-timer-probe :: exit 0", "pnpm check:slot-lookup :: exit 0", "pnpm check:sourcemap-no-sources-content :: exit 0", "pnpm check:stack-collection-maps :: exit 0", "pnpm check:swallow-census-controls :: exit 0", "pnpm check:test-source-alias :: exit 0", "pnpm check:tier-file-adoption :: exit 0", "pnpm check:type-check-coverage :: exit 0", "pnpm check:type-check-debt :: exit 0", "pnpm check:watch-hint-literal :: exit 0", "pnpm check:where-matcher :: exit 0" ], "ran_verdict": "node scripts/pm/dispatch-gates.mjs --ran ran.list: exit 0, '65 derived famil(ies) accounted for — 65 run, 0 NOT-MEASURED (a DERIVED zero — all 65 recorded an exit code and none of them is 3)'", "prerequisite_reruns": "pnpm check:dual-build-cjs-loads, pnpm check:lean-entry-closure and pnpm check:type-check-debt first answered PREREQUISITE NOT MET (exit 3, no workspace dist). After pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 (72/72 tasks, exit 0) all three exit 0; the ran list carries the reruns", "by_hand": [ "node scripts/check-issue-citations.mjs :: exit 0 (live; 22 citations resolve)", "node scripts/check-system-context-census.mjs :: exit 0", "pnpm check:query-options-erasure :: exit 0", "node scripts/check-changeset-fixed.mjs :: exit 0 (roster under .changeset)", "pnpm check:authz-resolver :: exit 0 (roster under packages)", "pnpm check:filter-alias-parity :: exit 0 (roster under packages)" ], "lint": "narrowed and proven: eslint's own config ignores the changeset and lints the three TS files with typescript-eslint/parser, parserOptions.project and projectService both null (no type-aware linting); eslint --no-inline-config --format json over them gives 3 results, 0 errors, 0 warnings; the config's only file reads are two baselines this diff does not touch, so this diff cannot move a verdict on any untouched file. pnpm lint is CI's", "neighbour_19728": "driver-free bare probe (git clone --bare --shared, no merge driver): merge-tree --write-tree 611a2fc561 vs #19728 head 3b9c5f2fca :: exit 0; vs origin/main beac798026 :: exit 0; the merged tree carries both changes", "ci": "in_progress at report time (31 check runs: 9 success, 3 skipped, 19 in_progress, 0 failed)" }, "files_changed": [ "packages/objectql/src/validation/rule-validator.ts (+273 / -49)", "packages/objectql/src/engine.ts (+31 / -19)", "packages/objectql/src/engine-readonly-when-interdependent-locks.test.ts (new, +538)", ".changeset/19911-readonlywhen-interdependent-locks.md (new, +46, patch for @objectstack/objectql)" ], "deviations": [ "Chose candidate (iv), fixpoint plus exact release, which is not one of the PM's (i)-(iii). The dispatch welcomes a better candidate; it carries the same measurements.", "engine.ts is touched: the chosen semantics needs it at the settlement (the FK's own lock judged with the other locks, the named-header condition, and a landing FK re-judged). This is within the claim's file surface.", "One new import line in engine.ts, placed away from line 214, which PR #19728 edits; merge-tree against #19728 is clean.", "Candidates were measured through a temporary env switch in the working tree; it was never committed or pushed (the committed code is the chosen candidate only).", "Commit trailers use AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By; the PR body ends with AGENTS.md's session-URL footer, not the harness's footer. Harness text reported, not copied.", "No label writes (the dispatch forbids them); no docs edited (docs stay true)." ], "mcp_calls": "0", "api_writes": "2 — POST /repos/objectstack-ai/objectstack/dispatches x2 through scripts/pm (fleet-write relay, objectstack-fleet[bot]): run 35912507475 executed POST /repos/objectstack-ai/objectstack/pulls (draft, #19923), and the os-dev-report comment run executed POST /repos/objectstack-ai/objectstack/issues/19911/comments. git push is not counted (not REST).", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
Contract review
Served-tier:
CONTRACT_REVIEW_TIERHead-sha:
611a2fc56101eea3e1cbfd24461401cc46ffd861① Derived judgments
Head = branch tip = PR head; merge-base
a34c27cbe5; four files, +888/−68. Measured in throwaway worktrees of the head and the merge-base (removed afterwards) with a 174-shape probe: 14 hand-built adversarial shapes plus 160 seeded random ones. The random shapes have 2–5 fields andrecord/previous/parentroots, and mix in self-reading locks, staticreadonly, amaster_detailFK, andisSystem/strictReadonlyWritestoggles. Each ran by id and bulk over 1–3 differing rows: 281 engine runs at each of head and base, each repeated under 3 permutations of field declaration order and payload key order. An independent oracle re-evaluated every caller-supplied field's predicate on the row the driver holds after the write.amountstays 100, event[status, amount]), with the controls unchanged;isSystem,preserveAuditand the hook-echo variant hold.readonlyWhenis TRUE on the stored row. Base: 16, including the card, a chain, a cycle, anisSystemrow beside a staticreadonlyfield, and an FK's own lock through the settlement. Every movement where a base-dropped write now lands (REVERSE, the chain'sa, the self-lock, 9 random releases) was checked on the stored row: all FALSE there. Staticreadonlynever opened.invhasreadonlyWhen: "record.amount == 'big'",amounthasreadonlyWhen: "parent.status == 'paid'", and the row is{ inv: inv_b (open), amount: 'small' }. The write isupdate(r1, { inv: 'inv_a' (paid), amount: 'big' }).{ inv_b, 'big' }, event[inv]). Head moves the line onto the paid invoice and drops the edit ({ inv_a, 'small' }, event[amount]).storedview underlies every drop-set view. PR fix(objectql): judge a parent-scoped readonlyWhen against the header the write stores (#19853) #19877's settlement keeps its rule for an FK that does not land, and a landing FK is re-judged on the same landing. Both suites pass unchanged.readonlyWhenlock reads the update as it will be stored", and the PR body's "(iv) ... is the only candidate that reaches the unique exact drop set on every shape that has one".c: previous.c == 'L',x: record.c == 'open',y: record.x == 'xv'; row{ c: 'L', x: 'old', y: 'old' }; writeupdate({ c: 'open', x: 'xv', y: 'yv' }).{c, y}:xmust land. Head drops{c, x, y}, because releasingxmovesy's verdict and the release is abandoned, so the evaluation that decidedxread acthe update never stores.② Semver level
Clause-②: noandpatchare right in kind: no authorable key, export or error code moves, and a restored lock is a runtime security behaviour change. Judged per movement againstcontent/docs/data-modeling/fields.mdx("field is read-only whenTRUE"; "ignores writes to fields whosereadonlyWhenpredicate isTRUE"; "locks the field for every API-boundary caller") andformulas.mdx("record| the row being evaluated"), all cited verbatim in the PR body:band the settlement moves→stays remove a write the base stored while its predicate was TRUE on the stored row: the docs cover them.aandrequiredWhenrefuse→accept remove a refusal or a drop the text negated: covered, with the citation present and accurate.requiredWhenaccept→refuse is a restored guarantee: covered.So no documented answer moves, and triage's condition does not require a maintainer decision.
③ Boundary flags
readonlyWhenkeys, the worst case is at most n+1 fixpoint passes, one over-lock check and one verification; one pass when nothing locks.3b9c5f2fcaexits 0 (reproduced), and againstorigin/mainbeac798026exits 0. ACCEPTABLE.611a2fc561: 31success, 3skipped, 0 failed.Implemented-by:
claude/issue-19911-readonlywhen-interdependent-locksReviewed-by:
session_01TEhopqrWQYBycZzyJHpAZrVERDICT: FAIL — no security defect and no lock opened. ①(d) finds an unlisted, unpinned, undeclared movement (the settlement's stays→moves direction), and ①(f) finds two false consumer-facing sentences (the cascade counter-shape). Next step, on this branch: list and pin the stays→moves shape by id and bulk and state it in the changeset; narrow the two sentences; file the cascade residue as its own card; re-review at the new head.
Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
os-dev-report
{ "issue": 19911, "status": "done", "round": "patch round after contract review 5802262677 (VERDICT FAIL on disclosure only)", "branch": "claude/issue-19911-readonlywhen-interdependent-locks", "pr": "https://github.com/objectstack-ai/objectstack/pull/19923", "new_head": "d01b912f3da551e13c6f561eda44ac7bd1008d20 (fast-forward from 611a2fc561; one commit)", "session": "session_01TEhopqrWQYBycZzyJHpAZr (the PM's; this subagent shares it, identity = the branch)", "premise_still_valid": true, "summary": "Both review findings addressed without changing the settlement's code: (1) the unlisted stays-to-moves settlement movement is measured on base and head, pinned by id, bulk and under strictReadonlyWrites (3 pins), and stated in the changeset; (2) the over-claiming sentences are narrowed from the measured cascade counter-shape: the changeset's 'What happens now' paragraph and title, the rule-validator docblocks (settleReadonlyWhenDrops, stripReadonlyWhenFields, ReadonlyWhenStripOptions.only, readonlyWhenFkJudgementReadsParent), the engine settlement docblock and the test file header and describe name. The residue is not fixed here (#19927 carries it). The PR body is untouched; replacement text is below.", "measurements": { "stays_to_moves": { "shape": "invoice (master_detail to inv, no static readonly) readonlyWhen \"record.amount == 'big'\"; amount readonlyWhen \"parent.status == 'paid'\"; row { invoice: inv_b (open), amount: 'small' }; update(r1, { invoice: 'inv_a' (paid), amount: 'big' })", "base_a34c27cbe5": "by id: stored { inv_b, 'big' }, event [inv:readonly_when], header reads [inv_b]; bulk (2 rows): both { inv_b, 'big' }, event [inv:readonly_when]; strictReadonlyWrites: refused, fields ['inv'], nothing lands", "head_611a2fc561_and_d01b912f3d": "by id: stored { inv_a, 'small' }, event [amount:readonly_when], reads [inv_a (named header), inv_a (repoint reference check)]; bulk: both { inv_a, 'small' }, event [amount:readonly_when]; strictReadonlyWrites: refused, fields ['amount'], nothing lands (probe output byte-identical at both heads; the three pins pass at d01b912f3d)", "exactness": "Both outcomes are exact on the row they store: base {inv} (inv's lock reads 'big' TRUE; amount under open inv_b FALSE), head {amount} (inv's lock reads the stored 'small' FALSE; amount under paid inv_a TRUE). The probe named the FK 'inv'; the pins name it 'invoice'." }, "cascade_counter_shape": { "shape": "c readonlyWhen \"previous.c == 'L'\"; x readonlyWhen \"record.c == 'open'\"; y readonlyWhen \"record.x == 'xv'\"; row { c: 'L', x: 'old', y: 'old' }; update({ c: 'open', x: 'xv', y: 'yv' })", "enumeration": "unique exact drop set {c, y} (brute force over all 8 drop sets with the formula engine)", "base_a34c27cbe5": "by id and bulk: drops {c, x, y}, stored { L, old, old }, event [c+x+y:readonly_when]", "head_611a2fc561_and_d01b912f3d": "by id and bulk: drops {c, x, y}, stored { L, old, old }, event [c+x+y:readonly_when] — no movement; releasing x and y together fails the check (y locks again once x lands), so the fixpoint's drop set stands; no lock opens; fail-safe residue carried by #19927, not fixed and not pinned here (probe output byte-identical at both heads)" } }, "rewritten_sentences_verbatim": { "changeset_title": "fix(objectql): a value one `readonlyWhen` lock drops can no longer unlock another `readonlyWhen` lock (#19911)", "changeset_what_happens_now": "**What happens now.** A value one `readonlyWhen` lock drops can no longer unlock another: no field is written while its `readonlyWhen` is TRUE on the row the update stores. The locks are judged together, again with each dropped value put back to the row's stored one, until no further field locks; then a field that was held only by a value that was later put back is released, if the result agrees with the stored row. In the example above `amount` is dropped as locked, exactly as `update(c1, { amount: 999 })` on its own always was. Values a `beforeUpdate` hook wrote are still stored and read as before.", "changeset_bullet_one_step_residue": "- The release is one step, not a search. When it does not settle the drops, every lock involved holds and the field is dropped, never written — so a field whose own lock is FALSE on the stored row can still be dropped. That happens when locks read each other in a cycle (no set of drops agrees with the stored row), and in a cascade where releasing one field changes another's verdict: with `c` locked by `previous.c == 'L'`, `x` by `record.c == 'open'` and `y` by `record.x == 'xv'`, `update(r, { c: 'open', x: 'xv', y: 'yv' })` on a row with `c: 'L'` drops all three, although `x` is unlocked on the stored row. That was dropped before this change too; it is tracked as #19927.", "changeset_bullet_stays_to_moves": "- A master-detail repoint that the field's own `record`-scoped lock used to hold can now land. Its lock is judged together with the other locks on the header the update names, so when the value that lock reads is itself locked under that header, the value is dropped, the repoint lands, and the edit is dropped under the header the row lands on. With `invoice: { readonlyWhen: \"record.amount == 'big'\" }` and `amount: { readonlyWhen: \"parent.status == 'paid'\" }`, `update(line, { invoice: 'inv_a', amount: 'big' })` on a line under an open invoice, naming a paid one, used to keep the line where it was and store `amount: 'big'` (`onFieldsDropped` reported `invoice`); it now moves the line onto the paid invoice and keeps its old amount (`onFieldsDropped` reports `amount`), by id and on bulk updates. A `strictReadonlyWrites` refusal of that write now names `amount` instead of `invoice`. Both outcomes agree with the locks on the row they store.", "changeset_lead_in": "**What else you may see move:** (was: '... move, all in the same direction (the stored values decide):')", "rule_validator_settleReadonlyWhenDrops_summary": "[#19911] Which judged keys the conditional strip drops — so that a value another lock in the same strip takes back out can never unlock a lock, and, where one release step can settle it, no key is dropped that is unlocked on the row the write stores.", "rule_validator_settleReadonlyWhenDrops_heading": "## The rule: never open a lock, then agree with the stored row where one step can", "rule_validator_settleReadonlyWhenDrops_residue": "① alone is guaranteed; ② is one step, not a search. When it does not settle the set, ①'s larger drop set stands, so a key whose own lock is FALSE on the stored row can still be dropped — the fail-safe direction, where a lock that cannot be settled is not waived (#4889's frozen lines depend on that). Two shapes, measured: a CYCLE has no exact set at all; a CASCADE can have one that ② misses (#19927) — the exact set is {c, y}, but releasing x moves y's verdict, so the release fails its check and {c, x, y} stands, as it did before this function existed.", "rule_validator_stripReadonlyWhenFields": "`record` is the payload the write STORES over the prior row (`options.stored`, #19887), so a predicate never reads a value the static `readonly` strip takes back out; and since #19911 a value this strip takes back out can no longer unlock a lock ({@link settleReadonlyWhenDrops}, which says where it can still over-lock).", "rule_validator_only_option": "Take only this key, while every judged key is still judged with it, so its verdict is settled together with theirs ({@link settleReadonlyWhenDrops}).", "rule_validator_readonlyWhenFkJudgementReadsParent": "The second is new: the FK's lock is settled together with the other locks ({@link settleReadonlyWhenDrops}), so when it reads `record` it depends on which OTHER payload keys their own locks drop ...", "engine_settlement_docblock": "① the FK's OWN `readonlyWhen` lock. Judged here first, against the header the FK names — #4889's rule for the FK itself, unmoved. [#19911] Judged WITH the other caller-supplied locks, not alone, and settled with them (`settleReadonlyWhenDrops`), so a value one of them drops can no longer unlock it — but only the FK is TAKEN here (`only`). That moves the FK's verdict in BOTH directions: a repoint its lock used to let through can now stay home, and a repoint it used to hold can now LAND, when the value its `record` lock reads is itself locked under the header the FK names — that value is dropped, the FK's lock reads the stored one, and the rest are then judged under the header the row lands on.", "test_file_header_and_describe": "header: '#19911 — a value one `readonlyWhen` lock drops can no longer unlock another `readonlyWhen` lock in the same strip.' and '... then one release step, kept only when every dropped key is locked and every kept key unlocked on the row the write stores. When that one step does not settle the set — a cycle, or a cascade where releasing one key moves another's verdict (#19927) — the fixpoint's larger, fail-safe drop set stands.'; describe renamed to 'a value one readonlyWhen lock drops no longer unlocks another (#19911)'" }, "pr_body_replacements_for_the_seat": { "every_movement_table_new_rows_insert_after_the_settlement_row": [ "| settlement, stays to moves: the FK's own `record` lock reads a value that is itself locked under the header the update names (`invoice` locked by `record.amount == 'big'`, `amount` by `parent.status == 'paid'`; line under open `inv_b`, the update names paid `inv_a` with `amount: 'big'`), by id and bulk | line stays under `inv_b` and stores `amount: 'big'`; event `[invoice]`; header reads `[inv_b]` | line moves to `inv_a` and keeps `amount: 'small'`; event `[amount]`; header reads `[inv_a]`, then the repoint's reference check on `inv_a`. Both rows agree with their locks |", "| the same write under `strictReadonlyWrites` | refused, `fields: ['invoice']` | refused, `fields: ['amount']`, nothing lands |" ], "every_movement_table_optional_unmoved_row": "| three-lock cascade (`c` locked by `previous.c == 'L'`, `x` by `record.c == 'open'`, `y` by `record.x == 'xv'`; row `c: 'L'`; the update sets all three), by id and bulk | drops `{c, x, y}` | drops `{c, x, y}`, unchanged; the exact set is `{c, y}` (#19927) |", "replacement_for_the_iv_sentence": "It never opens a lock: no field is written while its lock is TRUE on the row the update stores. It reaches the unique exact drop set on every measured shape except the three-lock cascade (#19927): there, one release step does not settle the set (releasing `x` moves `y`'s verdict), so the fixpoint's larger drop set `{c, x, y}` stands instead of `{c, y}`, and a field whose own lock is FALSE on the stored row is still dropped, as on base. The cycle has no exact set at all and takes the same fail-safe answer.", "optional_replacement_for_the_now_paragraph_second_and_third_sentences": "No field is written while its lock is TRUE on the row the update stores. The strip then releases, in one step, every dropped key that is unlocked on that row, and keeps the result only when every dropped key is locked and every kept key is unlocked on the row it stores. When that step does not settle the set (locks that read each other in a cycle, or a cascade where releasing one key moves another's verdict, #19927), the larger fail-safe drop set stands.", "numbers_that_moved_in_the_body": "head 611a2fc561 becomes d01b912f3d; new test file 32 becomes 35 cases; objectql local suite 5155 becomes 5158 tests (307 files); ablation 20 failed / 68 passed becomes 23 failed / 68 passed, restored 88/88 becomes 91/91; HEAD blobs a5c04ea19d / 0c44ecfd85 become c9b1cfc19e / f3934b80f6; citations 22 become 23" }, "pins_added": [ "STAYS → MOVES: the repoint lands on the paid invoice and the edit under it is dropped", "STAYS → MOVES in BULK: every matched line lands on the paid invoice, every edit is dropped", "STAYS → MOVES under strictReadonlyWrites: still refused, now naming the amount, and nothing lands" ], "ablation": "One ablation on d01b912f3d (fix committed; engine.ts and rule-validator.ts restored to the a34c27cbe5 blobs e973ab50ac / 2b3002b8e1 with git restore --source, tree only; on-disk hashes equal the base blobs; markers settleReadonlyWhenDrops / readonlyWhenFkJudgementReadsParent 0/0; source-imported subject, no dist on the path; EXIT/INT/TERM trap). Three suites: 23 failed / 68 passed. All 3 new STAYS → MOVES pins RED: by id and bulk got { invoice: 'inv_b', ... } where { invoice: 'inv_a', amount: 'small' } was expected; strict got fields ['invoice'] where ['amount'] was expected. The earlier 20 fix pins red, the same 12 unchanged-behaviour pins green, #19905 18/18 and #19877 38/38 green. Restored with git checkout HEAD --: blobs c9b1cfc19e / f3934b80f6 equal HEAD, git diff HEAD empty, rerun 91/91 passed.", "tests": "On d01b912f3d: pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 :: exit 0 (307 files / 5158 tests passed); pnpm --filter @objectstack/objectql typecheck :: exit 0 ('check:test-typecheck: OK'); new file engine-readonly-when-interdependent-locks.test.ts 35/35.", "gates": { "ran": [ "pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 :: exit 0", "pnpm --filter @objectstack/objectql typecheck :: exit 0", "node scripts/check-issue-citations.mjs :: exit 0 (23 citations resolve, #19927 included)", "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 ('This diff introduces no major bump'; level axis NOT APPLICABLE locally, no pull_request payload)", "pnpm check:nul-bytes :: exit 0 (9343 text files, no raw ASCII control bytes)", "npx eslint --no-inline-config --format json over the 3 changed TS files :: exit 0 (3 results, 0 errors, 0 warnings)" ], "neighbour_19728": "driver-free bare probe (git clone --bare --shared, no merge.* driver registered): merge-tree --write-tree d01b912f3d vs #19728 current head 3b9c5f2fca :: exit 0 (merged tree carries readonlyWhenFkJudgementReadsParent 3/1, settleReadonlyWhenDrops 7 in rule-validator, RelatedRecordBinding 2/5); vs origin/main beac798026 :: exit 0", "not_rerun_this_round": "the full 65-family dispatch-gates derivation; the changed-file set is the same four paths as at 611a2fc561, where all 65 ran with exit 0" }, "files_changed": [ "packages/objectql/src/validation/rule-validator.ts (+284 / -49 vs a34c27cbe5; this round: docblocks only)", "packages/objectql/src/engine.ts (+36 / -19; this round: settlement docblock only)", "packages/objectql/src/engine-readonly-when-interdependent-locks.test.ts (new, +587; this round: 3 pins, header, describe name)", ".changeset/19911-readonlywhen-interdependent-locks.md (new, +68; this round: title, now-paragraph, lead-in, two bullets)" ], "deviations": [ "One extra pin beyond the requested by-id and bulk: the stays-to-moves write under strictReadonlyWrites, because the refused field list moves too (['invoice'] to ['amount']).", "Narrowed four more universal claims besides the two named: the changeset title, the changeset's 'all in the same direction' lead-in, the engine settlement docblock's \"#4889's verdict ... unmoved\" (the FK's verdict does move; the rule does not), and the test file's describe name (renaming the full names of the 35 pins under it).", "The cascade residue is neither fixed nor pinned (#19927 carries it).", "PR body not edited (the seat's); replacement text is in pr_body_replacements_for_the_seat.", "No settlement or strip code changed this round; the stays-to-moves behaviour is disclosed and pinned as measured, not altered." ], "mcp_calls": "0", "api_writes": "this round 1 — POST /repos/objectstack-ai/objectstack/dispatches through scripts/pm/post-stamped.mjs (fleet-write relay, objectstack-fleet[bot]) executing POST /repos/objectstack-ai/objectstack/issues/19911/comments (this report); plus git push (fast-forward, not REST). Card total 3 dispatches (PR create, first report, this report).", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
Contract review
Served-tier:
CONTRACT_REVIEW_TIERHead-sha:
d01b912f3da551e13c6f561eda44ac7bd1008d20① Derived judgments
Narrow re-review over record 5802262677 (head
611a2fc561, FAIL on disclosure only).611a2fc561is the head's parent (one commit, fast-forward); the merge-base withmainis stilla34c27cbe5; the round touches the same four files (+125/−38). Measured in a throwaway worktree of the head, withengine.ts/rule-validator.tsswapped to theira34c27cbe5blobs for every base reading and restored afterwards (hashes verified).git diff 611a2fc561 d01b912f3don the two source files is docblock-only. Comment-stripped, whitespace-normalised copies at the two heads are byte-identical.{ inv_b, 'big' }with event[invoice]and header reads[inv_b]; bulk (2 rows), both{ inv_b, 'big' }, event[invoice]; understrictReadonlyWrites, refused withfields ['invoice']and nothing lands.{ inv_a, 'small' }with event[amount]and reads[inv_a, inv_a]; bulk, both rows{ inv_a, 'small' }, one event[amount]; strict,fields ['amount']and the row untouched.{c, x, y}, stored{ L, old, old }. The unique exact set is{c, y}; the release fails its check, and ①'s set stands, as on base.settleReadonlyWhenDrops,stripReadonlyWhenFields,ReadonlyWhenStripOptions.onlyandreadonlyWhenFkJudgementReadsParentdocblocks; the engine settlement docblock; the test header and describe name; and the PR body's "Now" paragraph and (iv) sentence.d01b912f3d, latest per name over 34 names: 29success, 5skipped, 0 failed, 0 in progress; all seven required contextssuccess.d01b912f3dagainst PR feat(formula,objectql): read one hop through a lookup in a validation predicate #19728's head3b9c5f2fcaexits 0, and againstorigin/mainbeac798026exits 0.② Semver level
Carried:
Clause-②: noandpatchare right in kind. The round adds no authorable key, export or error code. The newly declared stays→moves movement is one the docs leave open: both outcomes obey "judged against the master it lands on" and "ignores writes to fields whosereadonlyWhenpredicate isTRUE" on the row stored. So no documented answer moves, and no maintainer decision is required.③ Boundary flags
beforeUpdatehook's value still lands under a TRUE lock ([objectql] TRUE readonlyWhen strips beforeUpdate-derived values too — a conditionally-locked derived field has no server-side write path at all (isSystem included), unlike static readonly's hook-stamp protection #9107, pinned), and the changeset says so. ACCEPTABLE.parent-locked reader (strictfieldsswap['f1']→['invoice']) is disclosed by class, not by row. ACCEPTABLE.Implemented-by:
claude/issue-19911-readonlywhen-interdependent-locksReviewed-by:
session_01TEhopqrWQYBycZzyJHpAZrVERDICT: PASS
Generated by Claude Code
objectstack-fleet commentedon Sep 23, 2026
ACCEPT — round 21 · PR #19923 ·
Fixesdomain:engine#1,session_01TEhopqrWQYBycZzyJHpAZr, written 2026-09-23T20:52Z. Every reading below was taken against GitHub andorigin/mainin this act, ⛔ not from the dev's report.Review
d01b912f3d(patch round 1, fast-forward from611a2fc561; docblocks, changeset and three pins only, no code)main; first body lineFixes #19911; no other closing keyword;Clause-②: noat column 0, agreeing with thepatchchangesetrule-validator.ts(settleReadonlyWhenDrops: a monotone fixpoint plus one exact release step, used by both strip functions),engine.ts(the FK settlement judges the FK's own lock together with the other locks), one new test file (35 cases), one changesetfields.mdxor lands where the docs leave the answer open (the cycle, the settlement's stays→moves). So no maintainer decision is owedreadonlyWhenis TRUE on the stored row; base opened 16 and 3. Deterministic under field and key permutationsno,patch: a restored lock is a runtime security behaviour change; the accept-direction movements (REVERSE,requiredWhenrefuse→accept) remove refusals the published text negates, cited verbatim fromcontent/docs/data-modeling/fields.mdxandformulas.mdxin the PR bodymerge-tree --write-treeof this head against its head3b9c5f2fcaand againstorigin/mainbeac798026both exit 0 (reproduced by the reviewer)check-governed-merges --pr 19923, 0 of 4 paths; +975 / −68)611a2fc561(5802262677: an unlisted stays→moves movement and two over-claiming sentences; no security defect) → patch round → PASS on this head (5802738521)success, 5skipped, 0 failed; all seven required contextssuccessOut-of-scope findings — dispositions:
c→x→y) still dropsx, whose own lock is FALSE on the stored row; one release step does not settle it. This is fail-safe, present on base, unchanged here, and disclosed in the changeset → filed A three-lock readonlyWhen cascade drops a write whose own lock is FALSE on the stored row: a legitimate edit is silently ignored #19927.parent-locked reader (strictfields['f1']→['invoice']) is disclosed by class in the changeset and the engine docblock, not by its own table row → Acceptance notes.beforeUpdatehook's value still lands under a TRUE lock ([objectql] TRUE readonlyWhen strips beforeUpdate-derived values too — a conditionally-locked derived field has no server-side write path at all (isSystem included), unlike static readonly's hook-stamp protection #9107, pinned); the changeset says so → Acceptance notes.readonlyWhenkeys; one pass when nothing locks → Acceptance notes.Landing: ready → queue on this head once CI is fully green.
Generated by Claude Code
test(objectql): the #19911 suite header says the release now repeats
docs(changeset): correct the #19911 entry in place for the repeated r…
fix(objectql): judge each readonlyWhen lock against the row the updat…
fix(objectql): settle a chain of readonlyWhen locks on the drop set t…
fix(objectql): settle readonlyWhen locks per cycle, so a cycle no lon…