Skip to content

A traversing validation rule on a child refuses the cascade FK clear that deleting its parent issues, and the refusal names the wrong fix: it points at the child object, not the reference the delete is clearing #20006

Closed
#20021
Closed
A traversing validation rule on a child refuses the cascade FK clear that deleting its parent issues, and the refusal names the wrong fix: it points at the child object, not the reference the delete is clearing#20006
#20021
Assignees
os-sales
Labels
bugSomething isn't workingdomain:enginepriority:p2Medium: important, M3

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Sep 24, 2026

Filing gate: ① a product defect with a named landing site. It is the follow-up the #18682 thread fixed as round-11 Q1 option D (「让外键清空的拒绝文字指对对象」, recorded 5792704279). The round-15 at-tier PASS 5795813514 named it as a debt, and PR #19728's body discloses it as a known limit ("Cascade delete"). Filed by the domain:spec seat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d) on the landing of PR #19728 → 1f05ea4fb2. Filed unassigned and unlabelled: routing and grading are triage's. Routing suggestion: domain:spec (the landing is packages/objectql). ⛔ Not a claim.
Hand that acts: the lane triage routes this to, in one claim.
Dedupe (including closed): the semantic query cascade delete foreign key clear traversing validation rule refusal prescription names wrong object returns 6 hits: #11668, #9002, #8895, #8783, #7413, #7307. All are other cascade or prescription defects; none covers this.

The defect (at origin/main 1f05ea4fb2)

  • ObjectQL.cascadeDeleteRelations clears a child's reference with a cleanup UPDATE stamped __referentialFieldClear (packages/objectql/src/engine.ts:14835).
  • By design, resolvePredicateRelated resolves nothing for that UPDATE (engine.ts:7307-7316). A system read there would let a traversing rule's verdict decide the delete (one bit of a related row per delete), and that is correct.
  • So a child rule that reads through the reference (record.<ref>.<field>) meets the bare id. checkPredicate leaves an unbound record to CEL (packages/objectql/src/validation/rule-validator.ts:3445-3450). Reading through a string faults, and the rule refuses the cleanup, which refuses the parent's delete.
  • The refusal that reaches the deleter is the generic unevaluable text (rule-validator.ts:3330-3345): Validation rule '…' could not be evaluated (…) — write rejected. Its prescription is about the CHILD object's rule and field. Nothing says that a cascade clear of <ref> caused it, or which parent delete is blocked. The deleter did not author the child's rule and gets no usable repair.

The refusal itself (fail-closed) is what #18682 ruled and stays. The defect is the text.

Remedy shape (option D, for the implementing round to confirm)

When the write is a referential FK clear, refuse with a text naming what is happening:

  • the child object and rule;
  • the reference being cleared;
  • the parent delete it blocks;
  • the repair: guard the rule on the reference being set (for example a conditional wrapper when: record.<ref> != null), or change the relationship's delete behaviour.

Pin: a parent delete whose cascade clears a child reference read by a traversing rule refuses with that text, and the same delete with the guarded rule succeeds.

Dedupe words: cascade FK clear traversing rule refusal · __referentialFieldClear prescription · round-11 Q1 option D · #18682 cascade delete known limit

Generated by Claude Code

Activity

  1. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    分诊首次定级：priority:p2 · bug · domain:engine · pm:queue —— 删除父记录时，级联清空子记录外键被子对象的跨关系校验规则拒绝，拒绝文字指向的却是子对象的规则，删除者拿不到可用的修法

    Path: packages/objectql/src/engine.ts（cascadeDeleteRelations 带 __referentialFieldClear 的清理 UPDATE）→ packages/objectql/src/validation/rule-validator.ts（通用的 Validation rule '…' could not be evaluated (…) — write rejected. 文字）

    Triage: lands in packages/objectql ⇒ domain:engine (the lane table maps packages/objectql to domain:engine; the filer suggested domain:spec), bug, priority:p2, pm:queue; rationale: the fail-closed refusal of a cascade FK clear is ruled (#18682) and stays, but the text that reaches the DELETER is the generic unevaluable-rule message about the child's rule — it never says a cascade clear of <ref> caused it or which parent delete it blocks, so the person deleting gets no usable repair; the fix shape is already ruled (#18682 round-11 Q1 option D, 「让外键清空的拒绝文字指对对象」).

    分诊席 #6015，2026-09-24T18:32Z。⛔ 不认领、不派发。本席读完了卡面（本卡尚无评论），并在 objectstack origin/main b81da66df7 上核对。

    本席核对

    • engine.ts：__referentialFieldClear 是 cascadeDeleteRelations 清理 UPDATE 的标记。约第 7309 行的注释说明了这种写入不解析关联（设计如此）。
    • rule-validator.ts：通用拒绝文字 Validation rule '${ruleName}' could not be evaluated (${summary}) — write rejected.${detail} 在 main 上，没有区分「这是一次外键清空」。
    • 卡面的推理链（跨关系规则读到裸 id，CEL 报错，规则拒绝，父记录删除被拒）本席没有跑运行时复现。

    路由说明

    填卡人建议 domain:spec。但本卡的落点是 packages/objectql，按 SKILL.md 的车道表属于 domain:engine。

    定级说明

    p2：删除被拒本身是正确的（#18682 已裁决 fail closed）。错的是文字：删除者不是子对象规则的作者，照着文字改不了任何东西，只能去找人。修法方向已由 #18682 第 11 轮 Q1 选项 D 裁定，不需要再进决策箱。

    执行要点

    1. 先写失败探针：父记录删除，级联清空子记录的某个引用，而子对象有一条经这个引用跨关系读取的规则。
    2. 引用清空时换一段拒绝文字，写明四样：
      • 子对象和规则名；
      • 正在被清空的引用；
      • 被挡住的父记录删除；
      • 修法：用 conditional 包装，when: record.<ref> != null，或者改这个关系的删除行为。
    3. 钉住两个方向：未加保护的规则按新文字拒绝；加了保护的同一次删除成功。
    4. ⚠️ 与 An optional lookup cannot be null-guarded in a traversing rule: the authoring refusal and the engine's "no single related record" prescription both point at spellings that do not work, and neither names the conditional wrapper or required that do #20007 同车道、同文件（两张卡都改 rule-validator.ts 的处方文字）。建议同一个认领里先后做，或者串行派发，⛔ 不要并行开两个 PR。

    Generated by Claude Code

  2. objectstack-fleet
    added
    bugSomething isn't working
    domain:engine
    pm:queue
    priority:p2Medium: important, M3
    pm:dispatched
    and removed
    pm:queue
    on Sep 24, 2026
  3. objectstack-fleet
    assigned
    os-sales
    on Sep 24, 2026

  4. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    Claim: PM loop round 22
    Session: session_01Bvd69VPa6puiNzzPUroDBx
    Branch: claude/issue-20006-cascade-fk-clear-refusal-text
    Worktree: objectstack-issue-20006
    Domain: domain:engine
    Seat: domain:engine#1
    File surface:

    • packages/objectql/src/validation/rule-validator.ts: the refusal text for a referential FK clear;
    • packages/objectql/src/engine.ts: the cascadeDeleteRelations / __referentialFieldClear region only, and only to carry what the refusal must name;
    • objectql tests;
    • .changeset/20006-*.md.

    Stop on breach and explain in the report. ⛔ Not engine.ts's OperationContext interface or update() (draft PR #20012, services seat). ⛔ Not packages/formula (#20007's half). ⛔ Not packages/spec, and no new error code.
    Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
    Clause-②: no
    Thread-read: 5819902891
    Serial constraints cleared: at 2026-09-24T18:41Z, a census of the 13 open PRs finds one on packages/objectql/src/engine.ts: draft PR #20012 (#19989), whose hunks are in OperationContext (~2235–2257) and update() (~13420–13669). That is a different region from cascadeDeleteRelations (~14835) and rule-validator.ts, so the two do not overlap and nothing is held; whichever lands second merges main first. No open PR touches rule-validator.ts. #20007 (untriaged; triage names the same rule-validator.ts prescription text) queues SERIAL behind this card. Fold-or-serial fails gate ①: this card is a cascade-clear refusal text, and #20007 is an optional-lookup null-guard prescription spanning packages/formula.

    Generated by Claude Code

  5. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 20006,
  "status": "done",
  "branch": "claude/issue-20006-cascade-fk-clear-refusal-text",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20021",
  "session": "session_01Bvd69VPa6puiNzzPUroDBx — the harness-stamped id of this run (mode:subagent; the PM claim 5820042373 names the same id and this branch)",
  "premise_still_valid": true,
  "summary": "The premise holds at base fc6ddb87a. A parent delete's set_null cleanup UPDATE resolves no related record, a child rule that reads through a reference faults in CEL, and the deleter got the generic text 'The predicate reads 'status', which this object does not declare — fix the rule's condition, or declare the field.' That text was reproduced as a failing pin before any fix: 636550185, 3 red / 28 green. The refusal is unchanged: same VALIDATION_FAILED, same rule_violation, a byte-identical constraint, and the same set of deletes refused. Only the message changes. It now names the blocked delete ('Cannot delete crm_account (acc_1)'), the cleared reference, the rule and its object, and the repairs measured to work. Those are a `conditional` guard whose `when` is `record.REF != null` (offered only when the cleanup empties the reference), and `deleteBehavior` on CHILD.REF ('cascade' deletes those records with the parent; 'restrict' refuses the delete while they exist). Mechanism: `cascadeDeleteRelations` stamps an operation-private `__referentialFieldClearCause` beside `__referentialFieldClear`. The `__referentialFieldClear` short-circuit in `resolvePredicateRelated` still resolves nothing, but for the cleared record only it hands back an EMPTY binding. `referentialClearBinding` mints that binding, and a module-private WeakMap carries the cause. `checkPredicate` picks the new text only after CEL has faulted, and only when the missing key is a column the rule reads through a reference. No public type or option moves: the new names have 0 hits in the shipped d.ts. No new error code. Neither OperationContext nor update() is touched, and nor are packages/formula or packages/spec. Draft PR #20021 is open. No label was due (the dispatch named none, and a changeset is present), so no label was written. Next step, after this post: remove node_modules and the worktree.",
  "tests": "All at b1de69f91 (git rev-parse --short HEAD). (1) Failing probe first, at 636550185: engine-predicate-relationship.test.ts gave 3 failed / 28 passed. The 3 are exactly the new-text pins; each received today's generic text. (2) `pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/engine-predicate-relationship.test.ts src/validation/rule-relationship-traversal.test.ts` gave 63/63 passed. That includes 12 new end-to-end cases (the rule reads the cleared reference; the rule reads another reference; both guarded variants succeed; the guard control, where an ordinary write still refuses with the authored message; deleteBehavior cascade succeeds; restrict gives DELETE_RESTRICTED 409; two byte-for-byte generic-text controls; a hand-emptied reference is not told about a delete; the refused set is unchanged, with `record.amount > 100 && record.account.status == 'closed'` passing; a write that only inherits the marker keeps the generic text) and 5 evaluator cases (guard offered only on an emptied single reference; multi-value gets deleteBehavior only; a fault in the rule's own columns keeps the generic text; a rule with a verdict decides nothing; a plain empty binding is the control). (3) objectql `vitest run --project local --maxWorkers=2`: 311 files / 5255 tests passed. `test:repo`: 1/5 passed. (4) objectql `typecheck`: exit 0, test-typecheck debt unchanged at 40 files / 234 errors / 65 pinned. (5) plugin-security `delete-reference-cleanup-system-identity.test.ts`, unchanged: 18/18 green. A scratch copy that printed the message (deleted) showed the new text arriving through the real SecurityPlugin, identical for the secret and public rows. (6) eslint `--no-inline-config --format json` over the 4 touched TS files: 4 files, 0 errors, 0 warnings. Type-aware linting is off (parserOptions only ecmaVersion and sourceType, no project), so no untouched file's verdict can move. (7) Ablations through scripts/ablation-replace.mjs in WRAP mode. Every mutation was verified on disk (anchor 1 to 0, blob changed); every restore ended blob == HEAD with `git diff HEAD` empty, and porcelain was 0 after. A, engine binding dropped: 3 red. B, validator branch dropped: 6 red. C1, row-id match dropped: 1 red. C2, object match dropped: 1 red. D, attribution check dropped: 2 red, the byte-for-byte clear control and the own-columns case. E, guard unconditional: 1 red, the multi case. The first A attempt was refused by the tool because the replacement was a substring of the anchor; nothing ran, and it was re-run with a distinct marker. No dist build was needed: the subjects import ./engine.js and ./validation/rule-validator.js relatively, so they are source. (8) The public d.ts was rebuilt: referentialClearBinding and ReferentialClearCause have 0 hits in index.d.ts, core.d.ts and util-*.d.ts, against the lit control RelatedRecordBinding at 1/1/3.",
  "mcp_calls": "0 — no MCP GitHub tool was called",
  "api_writes": "2 — (a) pr_create, which opened draft #20021. It was carried by POST /repos/objectstack-ai/objectstack/dispatches (relay request fw-20260924T193808Z-f9a2d1, run 36049484614, conclusion success) and executed by the relay as POST /repos/objectstack-ai/objectstack/pulls; the body was read back byte-identical. (b) This os-dev-report comment, through scripts/pm/post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/20006/comments, carried by a second relay dispatch. No label writes, no PR-body edits, no assignee writes. There were 4 git pushes, which are not REST writes: the empty branch as a write probe, then 636550185, 8fc90c922 and b1de69f91, all fast-forward. REST reads: issue 20006 and its comments; comments 5792704279 and 5795813514; the #18682 comment list; the file lists of PRs 20012, 19909, 19947 and 19943; the open-PR list; the PR lookup and read-back for #20021.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · The ConditionalValidationSchema TSDoc examples in packages/spec/src/data/validation.zod.ts (use cases 1-3, around lines 376-420) fail when copied. `when: 'account_type = \"enterprise\"'`, `condition: 'approval_status = null'` and `'shipping_address = null OR shipping_address = \"\"'` each give `parse: Unexpected character: =`, and `'order_total > 10000'` gives `type: Unknown variable: order_total` (no `record.` root). Measured through ExpressionEngine.evaluate at fc6ddb87a. The examples ship in the published spec d.ts (packages/spec/dist/object.zod-*.d.ts). packages/spec/src/data/validation.test.ts uses the same strings as parse-only fixtures. · dedupe words: `ConditionalValidationSchema example CEL` · `account_type = \"enterprise\"` · `validation.zod.ts conditional use cases parse error` · `requires_shipping = true when`",
    "carrier: none — noted in PR #20021's Acceptance notes, not filed; for the seat to file"
  ],
  "gates": "Derivation at b1de69f91: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (merge base fc6ddb87a, 5 paths, 498 changed lines) derived 65 commands, and all 65 were run. 63 exited 0. 2 exited 3 (PREREQUISITE NOT MET, workspace dist not built in this worktree), NOT MEASURED: pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt. A supplementary reading, not the gate: require('./packages/objectql/dist/index.js') loads. `--ran` reconciliation: 65 derived, 63 run, 2 NOT-MEASURED, 0 UNRUN, exit 0. `node scripts/check-issue-citations.mjs --base fc6ddb87a4cd065171080f018cd865cd9c84c9d9`: exit 0, 7 citations in 2 files, all resolve. The derived list equals the PM's gates-20006.txt list, 65 for 65. origin/main moved to a0920b42d (driver-turso only), and the derivation reports that none of those commits touched what it derives from. CI is not awaited.",
  "line_budget": "n/a — the diff touches no skills/** path",
  "deviations": [
    "Option D's literal mechanism, 'an explicit unavailable binding ... a new RelatedUnavailableReason member', was not taken. It refuses BEFORE evaluation, which grows the refused set: measured at base, `record.amount > 100 && record.account.status == 'closed'` (amount 50) and `has(record.account.status) && ...` both pass the cleanup today. It would also widen a public type the dispatch rules out. The ruled direction, 「让外键清空的拒绝文字指对对象」, is implemented on the fault path instead. The refused set is pinned unchanged, and Clause-② stays no.",
    "engine.ts is edited in two methods, not in cascadeDeleteRelations alone. cascadeDeleteRelations writes the stamp. The `__referentialFieldClear` short-circuit in resolvePredicateRelated reads it; that is the only seam where the cleanup's context reaches the validator without editing update(). One named import was added to the existing rule-validator import line. No hunk overlaps draft PR #20012 (OperationContext around lines 2235-2257, update() around 13420-13669). I read the claim's surface 'the cascadeDeleteRelations / __referentialFieldClear region' as covering the second method.",
    "The commit trailers use AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By. The repo rule takes precedence, and the pre-push hook enforces it."
  ],
  "files_changed": [
    "packages/objectql/src/validation/rule-validator.ts",
    "packages/objectql/src/engine.ts",
    "packages/objectql/src/engine-predicate-relationship.test.ts",
    "packages/objectql/src/validation/rule-relationship-traversal.test.ts",
    ".changeset/20006-cascade-fk-clear-refusal-text.md"
  ],
  "reuse_sentence_for_20007": "Guard the rule on `REF` being set: make it the `then` of a `conditional` rule whose `when` is `record.REF != null`. In rule-validator.ts, the clause after the colon is the module-local `referenceGuardRepair(field)`, so #20007 can call it rather than respell it."
}

    Generated by Claude Code

  6. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 20006,
  "status": "done",
  "round": "patch round 1: contract review FAIL record 5821350148 on PR #20021, items F1 and F2",
  "branch": "claude/issue-20006-cascade-fk-clear-refusal-text",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20021",
  "head": "9a31fc9925e5a930aa5ae2a7c51b766a9883c448 (9a31fc992). Fast-forward on top of b1de69f91: 98cb79454 adds the failing pins, 9a31fc992 is the fix plus the changeset. No force-push, no merge of origin/main.",
  "session": "session_01Bvd69VPa6puiNzzPUroDBx — this run's harness-stamped id (mode:subagent)",
  "premise_still_valid": true,
  "summary": "F1: the attribution is tightened. A cleanup fault is attributed to the traversal only when its missing key is a column the rule reads through a reference AND the key cannot fault on the rule's own columns. The new module-local `readsKeyOffTheTraversal` decides that from where the predicate reads the key, against what those places hold. It counts four reads: `record.KEY` when the record does not hold KEY, `record.FIELD.KEY` through a non-reference field whose value lacks KEY, and `previous.KEY` / `previous.FIELD.KEY` on the same test (the `previous` root is analysed with the same `analyzeRelationshipTraversals`). If any of them counts, the generic text stands. The seat's shape now keeps today's text byte for byte: `record.status == 'x' && record.account.status == 'closed'` on a crm_deal declaring no `status`. Two variants of the route were measured and rejected. (i) Re-evaluating with the traversals served is unsound: CEL's `&&` absorbs the bare fault when the served side is false, so it still blamed the traversal (measured red). (ii) The seat's literal rule, 'a key also read bare at the root keeps the generic text', emits 'which this object does not declare' on an object that DOES declare `status`, for `record.status == 'x' || record.account.status == 'closed'`. That is false: the declared `record.status` reads null and cannot fault (measured red under ablation F1lit). So the bare read counts only when the record does not hold the key. F2, option (b): the guard is offered only to a rule that reads through the reference the cleanup empties. A rule reading only ANOTHER reference is offered `deleteBehavior` alone. The T1 arm's text is unchanged, as instructed. Surface unchanged: two files of logic/text (rule-validator.ts, the changeset) plus the two pin files. engine.ts is untouched this round. There is no new export: `referentialClearBinding`, `ReferentialClearCause` and this round's `readsKeyOffTheTraversal` have 0 hits in the shipped d.ts.",
  "pins_red_green": "RED at 98cb79454 (new pins on b1de69f91's implementation): 4 failed / 61 passed. (1) engine 'CONTROL: a fault on a bare column of the rule's own object keeps its text, though a reference reads the same name' received the cleanup text 'Cannot delete crm_account (acc_1): …'. (2) engine 'REFUSES naming the reference the rule reads AND the one the delete clears' received the guard, expected no 'conditional'. (3) evaluator 'attributes a key read both ways to the traversal only when the traversal is what faults' received the cleanup text for `previous.kind == 'x' && record.region.kind == 'secret'`. (4) evaluator 'offers the guard only to a rule reading through the reference the cleanup EMPTIES' received the guard on the other-reference rule. GREEN at 9a31fc992: 66/66. That includes the new 'the guard gives up nothing a rule on the CLEARED reference enforced': an unguarded, account-less insert is refused with 'no single related record', and guarded it is accepted. It also includes the F2 direction pin 'keeps a rule on ANOTHER reference judged on account-less records': an account-less secret-region insert is refused with the authored message unguarded and under deleteBehavior 'restrict' and 'cascade', and is accepted only when guarded. That pin measures existing behaviour, so it is green at both heads. Ablations through scripts/ablation-replace.mjs in WRAP mode, every restore ending blob == HEAD and porcelain 0: F1, the off-traversal check disabled, gives 2 red (the engine bare-column control and the evaluator both-ways case). F1lit, the bare read counting whether or not the record holds the key, gives 1 red (the evaluator declared-`status` leg: 'which this object does not declare' on an object that declares it). F2, the guard gated on emptiness only, gives 2 red (the engine other-reference refusal and the evaluator guard case).",
  "message_sentences_changed": [
    "A rule reading only ANOTHER reference (e.g. `record.region.kind == 'secret'` while the delete clears `account`). OLD tail: 'Guard the rule on `account` being set: make it the `then` of a `conditional` rule whose `when` is `record.account != null`. Or change `deleteBehavior` on crm_deal.account: 'cascade' deletes those records with the crm_account, 'restrict' refuses the delete while they exist.' NEW tail: 'Change `deleteBehavior` on crm_deal.account: 'cascade' deletes those records with the crm_account, 'restrict' refuses the delete while they exist.' The leading sentence 'Cannot delete crm_account (acc_1): the delete clears `account` … it reads 'kind' through `region`, and a rule is given no related record while a delete clears references.' is unchanged.",
    "A bare own-column fault that shares a traversed column's name (`record.status == 'x' && record.account.status == 'closed'`, `status` undeclared). OLD: the whole cleanup text 'Cannot delete crm_account (acc_1): … Guard the rule on `account` being set: … '. NEW: today's generic text, byte for byte: 'Validation rule 'closed_account_frozen' could not be evaluated (runtime: No such key: status) — write rejected. The predicate reads 'status', which this object does not declare — fix the rule's condition, or declare the field.'. The same holds for a `previous.KEY` collision.",
    "Unchanged: the text for a rule reading through the cleared reference (T1, including a rule that also reads another reference), the multi-value text, and the changeset's example block."
  ],
  "changeset_sentences_changed": [
    "OLD: '**The guard** is offered only when the cleanup empties the reference, which is the only case where it skips the rule. It applies whether the rule reads through the cleared reference or through another one. The guarded rule is still judged on every write where the reference is set.' NEW: '**The guard** is offered only to a rule that reads through the reference the cleanup empties. Such a rule already refuses every write that leaves that reference empty (`no single related record`), so the guard only lets those writes through. The guarded rule is still judged on every write where the reference is set.'",
    "ADDED: '**A rule that reads only through another reference** is offered only `deleteBehavior`. A guard on the cleared reference would stop judging that rule on every record whose cleared reference is empty, on every insert and update.'",
    "OLD: '**Unchanged:** a rule whose fault is in its own columns, a rule that reads through no reference, and every write that is not a delete's reference cleanup keep today's text byte for byte.' NEW: '**Unchanged:** a rule whose fault is its own keeps today's text byte for byte. That covers a key the rule reads from `record` or `previous` directly, or through a field that is not a reference, which the record does not hold, even when the rule also reads a column of that name through a reference. So does a rule that reads through no reference, and every write that is not a delete's reference cleanup.'",
    "Unchanged: the summary line, `Clause-②: no`, the two lead paragraphs, the example block and the multi-value bullet."
  ],
  "f2_option": "(b): only `deleteBehavior` is offered in the arm where the rule reads only another reference. Why not (a): that rule (the seat's example is `no_secret_region`) guards a different invariant, and a first-offered repair that switches it off on every account-less record is the one an author or agent would apply without weighing the cost. `deleteBehavior` repairs the delete and costs the rule nothing (pinned: still refused under 'restrict' and 'cascade'). A rule that reads the cleared reference AND another one keeps the guard: on an account-less record it is already refused before evaluation by 'no single related record', so the guard gives up only writes the rule already refused.",
  "tests": "All at 9a31fc992. The two pin files: `pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/engine-predicate-relationship.test.ts src/validation/rule-relationship-traversal.test.ts` gives 66/66. plugin-security `delete-reference-cleanup-system-identity.test.ts` gives 18/18; its fixture is the other-reference shape, and it asserts code, terminal state and secret == public, not text. objectql `vitest run --project local --maxWorkers=2` gives 311 files / 5258 tests passed. objectql `typecheck` exits 0, with test-typecheck debt unchanged at 40 / 234 / 65. eslint `--no-inline-config --format json` over the 4 touched TS files gives 4 files, 0 errors, 0 warnings; type-aware linting is off (parserOptions only ecmaVersion and sourceType), so no untouched file's verdict moves. Built d.ts: `referentialClearBinding`, `ReferentialClearCause` and `readsKeyOffTheTraversal` have 0 hits in index.d.ts, core.d.ts and the util chunk.",
  "gates": "Re-derived at 9a31fc992 with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (merge base fc6ddb87a, 5 paths, 619 changed lines): 65 commands, the same set as round 0, so no new family. All 65 were re-run at the new head: 63 exit 0, and 2 exit 3 (PREREQUISITE NOT MET, workspace dist not built), NOT MEASURED: pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt. `--ran`: 65 derived, 63 run, 2 NOT-MEASURED, 0 UNRUN, exit 0. `node scripts/check-issue-citations.mjs --base fc6ddb87a4cd065171080f018cd865cd9c84c9d9`: exit 0, 8 citations in 2 files, all resolve.",
  "pr_body_edits_for_the_seat": [
    "'What this changes', guard bullet. Replace 'It works whether the rule reads through the cleared reference or through another one; the second case is the #18682 plugin-security fixture's own shape.' and 'The guard is offered only when the cleanup empties the reference.' with the changeset's new guard bullet and other-reference bullet.",
    "'Unchanged, byte for byte' and 'How'. 'A fault on the rule's own columns keeps the generic text' should name the condition now implemented: the missing key is read through a reference AND cannot fault on a `record`/`previous` column or a non-reference field the record does not hold (`readsKeyOffTheTraversal`).",
    "'Tests' / 'Ablations'. The counts move to 66/66, 311/5258 and 14 end-to-end cases, and the F1, F1lit and F2 ablation rows above are added. 'For #20007' is unchanged (see reuse_sentence_for_20007)."
  ],
  "mcp_calls": "0",
  "api_writes": "1 — this os-dev-report addendum on #20006, via scripts/pm/post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/20006/comments, carried by a fleet-write relay dispatch. There were 2 git pushes (fast-forward, not REST): 98cb79454 and 9a31fc992. No PR-body edit, no label write. REST reads: review record 5821350148.",
  "deviations": [
    "F1's mechanism is the seat's suggested bare-read route plus one measured refinement: a bare read counts only when the record does not hold the key. The seat's literal rule is measured to emit a false 'does not declare' sentence on a declared key (ablation F1lit). The `previous` root and non-reference fields are covered by the same check."
  ],
  "open_questions": [],
  "out_of_scope_findings": [],
  "files_changed_this_round": [
    "packages/objectql/src/validation/rule-validator.ts",
    "packages/objectql/src/engine-predicate-relationship.test.ts",
    "packages/objectql/src/validation/rule-relationship-traversal.test.ts",
    ".changeset/20006-cascade-fk-clear-refusal-text.md"
  ],
  "reuse_sentence_for_20007": "Unchanged: 'Guard the rule on `REF` being set: make it the `then` of a `conditional` rule whose `when` is `record.REF != null`.' The clause after the colon is the module-local `referenceGuardRepair(field)`. #20007's `no single related record` arm is always a rule reading through REF itself. There the guard gives up only writes the rule already refuses, so no cost clause is needed. A cost clause would be owed only if the guard were offered to a rule reading another reference, which this PR no longer does."
}

    Generated by Claude Code

  7. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 20006,
  "status": "done",
  "round": "patch round 2: contract review FAIL record 5822275989 on PR #20021, item F3",
  "branch": "claude/issue-20006-cascade-fk-clear-refusal-text",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20021",
  "head": "b22174cd4 — fast-forward on top of 9a31fc992. 7a57a1092 adds the failing F3 pins. a5480fa34 is the fix plus the changeset bullet. b22174cd4 rewords that bullet as the four reads the code checks. No force-push, no merge of origin/main.",
  "session": "session_01Bvd69VPa6puiNzzPUroDBx — this run's harness-stamped id (mode:subagent)",
  "premise_still_valid": true,
  "summary": "F3 is fixed on the CODE route, as ruled. The attribution now answers for EVERY own read the rule makes, not only the key CEL reports. `readsKeyOffTheTraversal(source, key, …)` is replaced by the key-independent `readsAnOwnColumnItLacks(source, record, previous, fields)`, module-local in rule-validator.ts. Any one of these four reads keeps the generic text: a bare `record.K` the record does not hold; a `record.F.K` through a non-reference field whose value lacks K; a bare `previous.K` the previous row does not hold; and a `previous.F.K` through ANY field whose value lacks K. The last includes a reference hop on `previous`, which is kept as it was. The round-1 refinement is kept too: a DECLARED column is materialised, is always held, and never counts. The every-own-read route measured sound: 70/70 pins, and a base-revert probe over 22 shapes moved 0 verdicts and 0 envelopes. Nothing had to stop. Surface: rule-validator.ts, engine-predicate-relationship.test.ts and the changeset. engine.ts is untouched this round. There is no new export: the module-local names have 0 hits in the rebuilt d.ts (controls 1/1/3).",
  "pins_red_green": "RED at 7a57a1092 (the F3 pins on 9a31fc992's implementation): 3 failed / 67 passed. The failures are the three cleanup legs of 'CONTROL: an own read the record lacks keeps the text, whatever key CEL reports': (1) `record.kind == 'x' && record.account.status == 'closed'`; (2) `record.kind == 'x' || record.account.status == 'closed'`; (3) `previous.kind == 'x' && record.account.status == 'closed'`. Each received the cleanup text 'Cannot delete crm_account (acc_1): … Guard the rule on `account` being set: …'. The ordinary-write control 'that rule is broken on every write — a linked deal refuses it on its own `kind`' is GREEN at both heads, and must be: it measures an ordinary update, which this PR never touched. It pins that such an update refuses with 'Validation rule 'closed_account_frozen' could not be evaluated (runtime: No such key: kind) — write rejected. The predicate reads 'kind', which this object does not declare — fix the rule's condition, or declare the field.' GREEN at b22174cd4: 70/70. That includes every round-1 pin: the `record.status` bare-column control, the declared-`status` `||` leg, the `previous.kind` / `record.region.kind` leg, the guard pins for both references, the account-less direction pins and the refused-set pin. Ablations through scripts/ablation-replace.mjs in WRAP mode (on-disk counts verified; each restore blob == HEAD with `git diff HEAD` empty; porcelain 0 after). G1, the bare-read loop removed: 5 red, the round-1 bare-column control, the three F3 legs and the evaluator both-ways case. G2, the `previous` root unchecked: 2 red, the F3 previous leg and the evaluator previous leg.",
  "refused_set_and_envelope": "Re-measured with a scratch probe (deleted) over 22 engine-level shapes: 16 deletes and 6 ordinary updates. It ran at b22174cd4, then again with rule-validator.ts and engine.ts restored to fc6ddb87a; the blob hashes matched base. Both files were restored with `git checkout HEAD --`, proven by blob == HEAD and an empty `git diff HEAD`, under a trap. 0 verdicts moved, and 0 envelopes moved (code, status, and every field error with its whole constraint). The message differs from base in exactly the 5 cleanup shapes where only the traversal faults: the rule on the cleared reference, the rule on the other reference, the rule reading both, declared `status` with `||`, and declared `status` stored 'x' with `&&`. Byte-identical to base: the three F3 legs, the swapped `record.account.status == 'closed' && record.kind == 'x'`, the round-1 `record.status` shape, the `previous.region` hop, a json `record.meta.status` read, `record.nope`, and all 6 ordinary updates. Accepted at both heads: the short-circuit rule, the `has()` rule and the guarded rule.",
  "message_sentences_changed": [
    "The F3 shapes on the cleanup: `record.kind == 'x' && record.account.status == 'closed'`, its `||` form, and `previous.kind == 'x' && record.account.status == 'closed'`, on a crm_deal declaring no `kind`. OLD (9a31fc992): 'Cannot delete crm_account (acc_1): the delete clears `account` on the crm_deal records that reference it, and validation rule 'closed_account_frozen' on crm_deal could not be evaluated on that write — it reads 'status' through `account`, and a rule is given no related record while a delete clears references. Guard the rule on `account` being set: make it the `then` of a `conditional` rule whose `when` is `record.account != null`. Or change `deleteBehavior` on crm_deal.account: 'cascade' deletes those records with the crm_account, 'restrict' refuses the delete while they exist.' NEW, which is base's text byte for byte (probe): 'Validation rule 'closed_account_frozen' could not be evaluated (runtime: No such key: status) — write rejected. The predicate reads 'status', which this object does not declare — fix the rule's condition, or declare the field.'",
    "No other message changes this round. The cleanup texts for a rule on the cleared reference, a rule on another reference, and the multi-value form are byte-identical to 9a31fc992."
  ],
  "changeset_sentences_changed": [
    "OLD (9a31fc992): '**Unchanged:** a rule whose fault is its own keeps today's text byte for byte. That covers a key the rule reads from `record` or `previous` directly, or through a field that is not a reference, which the record does not hold, even when the rule also reads a column of that name through a reference. So does a rule that reads through no reference, and every write that is not a delete's reference cleanup.' NEW (b22174cd4): '**Unchanged:** a rule that reads a key where it is not held keeps today's text byte for byte, whichever key the fault reports. Those reads are `record.KEY`, `record.FIELD.KEY` through a field that is not a reference, `previous.KEY`, and `previous.FIELD.KEY` through any field, when the record, the previous row or the field's value lacks `KEY`. A declared column always reads, as `null` when empty, so it never counts. A rule that reads through no reference keeps today's text too, and so does every write that is not a delete's reference cleanup.'",
    "All other changeset sentences are unchanged from 9a31fc992."
  ],
  "pr_body_how_bullet": "Replace the PR body's `rule-validator.ts` bullet under 'How' with: '- **`rule-validator.ts`.** On a CEL fault, `checkPredicate` asks `referentialClearRefusal` whether this is the cleanup. It is only when three things hold. (1) The `related` binding was minted by `referentialClearBinding`. (2) The fault's missing key is a column the rule reads through a reference field. (3) `readsAnOwnColumnItLacks` finds no own read of the rule that faults. That check covers EVERY own read, not only the key CEL reports: when both operands of `&&` / `||` fault, CEL reports the right-hand key. The own reads are a bare `record.K` the record does not hold; a `record.F.K` through a field that is not a reference, whose value lacks `K`; a bare `previous.K` the previous row does not hold; and a `previous.F.K` through ANY field, a reference included, whose value lacks `K` (`previous` is never hydrated, so a hop through a reference there meets its bare id). A declared column is materialised on `record` and `previous`, is always held, and never counts. If any own read faults, or the missing key is not read through a reference, the generic text stands byte for byte. `referenceGuardRepair(field)` holds the guard wording once.' The 'Unchanged' paragraph's 'A fault on the rule's own columns keeps the generic text' should become 'A rule that reads, on its own record or previous row, a key that is not held keeps the generic text, whichever key CEL reports', to match the changeset.",
  "tests": "All at b22174cd4. The two pin files give 70/70. The plugin-security file `delete-reference-cleanup-system-identity.test.ts` gives 18/18. objectql `vitest run --project local --maxWorkers=2` gives 311 files / 5258 → 5262 tests passed (the +4 are this round's pins). objectql `typecheck` exits 0, with test-typecheck debt unchanged at 40 / 234 / 65. eslint `--no-inline-config --format json` over the 4 touched TS files gives 4 files, 0 errors, 0 warnings; type-aware linting is off, so no untouched file's verdict moves. objectql was rebuilt at b22174cd4. In the rebuilt d.ts, `referentialClearBinding`, `ReferentialClearCause`, `referentialClearRefusal`, `readsAnOwnColumnItLacks` and `referenceGuardRepair` have 0 hits in index.d.ts, core.d.ts and the util chunk; the control `RelatedRecordBinding` has 1/1/3.",
  "gates": "Re-derived at b22174cd4 with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (merge base fc6ddb87a, 5 paths, 654 changed lines): the same 65 commands, so no new family. All 65 were re-run at the new head: 63 exit 0, and 2 exit 3 (PREREQUISITE NOT MET, workspace dist not built), NOT MEASURED: pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt. After the objectql rebuild at head, the 4 dist-reading families were re-run: check:dts-closure, check:lean-entry-closure, check:published-files and check:sourcemap-no-sources-content, all exit 0. `--ran`: 65 derived, 63 run, 2 NOT-MEASURED, 0 UNRUN, exit 0. `node scripts/check-issue-citations.mjs --base fc6ddb87a4cd065171080f018cd865cd9c84c9d9`: exit 0, 8 citations in 2 files, all resolve.",
  "observation": "The kept generic text for the F3 shapes names `status`, the key CEL reports, not the broken `kind`. That is base's text byte for byte, as ruled. The rule's own ordinary write names `kind` (pinned). Nothing was changed for it.",
  "open_questions": [
    {
      "question": "A neighbouring shape outside the ruled list of own reads has the F3 cost: a rule reading a column the RELATED object does not declare, e.g. `record.account.nope == 'x'` with no `nope` on crm_account. Measured at b22174cd4: the cleanup gets the cleanup text with the guard, while an ordinary linked write refuses with 'Validation rule 'r' could not be evaluated ('crm_account' declares no 'nope') — write rejected. …'. Following the guard lets the delete through while the rule stays broken on every linked write. No shipped sentence is false: the text and the changeset's guard bullet stay true. It is a read through a reference, not an own read, so this round did not touch it.",
      "options": [
        "A — a patch round 3: in the `__referentialFieldClear` branch of `resolvePredicateRelated` (engine.ts, a region the claim already owns), the empty cleanup binding also carries, per traversed reference, the columns its related object does not declare. That is schema only, with no row read. `referentialClearRefusal` then keeps the generic text when the missing key is one of those. The cost is one more engine hunk and one pin plus its ordinary-write control.",
        "B — accept it as is. Every sentence is true, and the author meets the 'declares no' refusal on the next linked write.",
        "C — file a follow-up card for it."
      ],
      "recommendation": "A, if the seat wants the F3 standard applied uniformly. It is the same defect class the review asked closed: the text must not steer a deleter past an author's breakage. The fix is schema-only and inside the claim's surface. B is defensible on 'no false sentence'. I did not take A myself because the round forbids widening the surface."
    }
  ],
  "mcp_calls": "0",
  "api_writes": "1 — this os-dev-report addendum on #20006, via scripts/pm/post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/20006/comments, carried by a fleet-write relay dispatch. There were 3 git pushes (fast-forward, not REST): 7a57a1092, a5480fa34 and b22174cd4. No PR-body edit, no label write. REST reads: review record 5822275989.",
  "deviations": [],
  "out_of_scope_findings": [],
  "files_changed_this_round": [
    "packages/objectql/src/validation/rule-validator.ts",
    "packages/objectql/src/engine-predicate-relationship.test.ts",
    ".changeset/20006-cascade-fk-clear-refusal-text.md"
  ],
  "reuse_sentence_for_20007": "Unchanged: 'Guard the rule on `REF` being set: make it the `then` of a `conditional` rule whose `when` is `record.REF != null`.' The clause after the colon is the module-local `referenceGuardRepair(field)`. No cost clause is needed in #20007's `no single related record` arm."
}

    Generated by Claude Code

  8. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    ACCEPT: PR #20021 at b22174cd

    domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T22:06Z. Reviewed against references/review-checklist.md on GitHub, not from the dev's reports (os-dev-report 5820964267 and its two patch-round addenda on this card).

    Landing: ready + auto-merge through the queue once the Check Changeset re-run completes. #20007 unlocks when this lands.

  9. objectstack-fleet
    closed this as completedin #20021on Sep 24, 2026
  10. objectstack-fleet
    removed
    pm:dispatched
    on Sep 24, 2026

  11. objectstack-fleet commented on Sep 24, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Sep 24, 2026
    ContributorAuthor

    Landed: PR #20021, verified on main

    domain:engine#1, session_01Bvd69VPa6puiNzzPUroDBx, written 2026-09-24T22:25Z.

    Generated by Claude Code

  12. akarma-synetal
    added a commit that references this issue on Sep 28, 2026

    fix(objectql): a delete refused by a traversing rule on its reference…

    b373596
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingdomain:enginepriority:p2Medium: important, M3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions