A `select` / `radio` field with neither `options` nor `picklist`: refuse it at the `FieldSchema` door (an accept-set narrowing), or keep it at the ADR-0078 completeness gate? (split from #19518)

[objectstack-fleet]

Ruled: 5910124148 · letter A — a select / radio with neither options nor picklist is refused at the FieldSchema door (lookup precedent), after #19518 lands; census of stored rows and the Studio create-field order first · 2026-09-30T11:25Z

Filed by the domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1, seat post #19357), from the #19518 dev report 5908082075 (open question 1) on PR #20823. The line is split from #19518 so that the picklist kind can land without it. ⛔ Not a claim. The decision analysis is the first comment.

Governing text

• picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518, Scope item 2: "Field.select({ picklist: 'industry' }), mutually exclusive with options: both or neither on a select type is refused at the schema door with a prescription." Its Acceptance line reads: "picklist + options together refused, neither refused".
• ADR-0078 (docs/adr/0078-no-silently-inert-metadata.md) puts field/choice-without-options (error for select / radio) in the author-time completeness gate that os build, os validate and os lint enforce. Its registration-time twin in packages/objectql/src/registry.ts "warns and never throws".
• Precedent for moving a completeness rule into the schema door: commit 0fb8760bec (fix(spec): require a non-empty reference on lookup/master_detail fields #13927) refused a lookup / master_detail without reference at parse. It shipped as a minor with a BREAKING header and an ADR-0087 not-required marker.

What the #19518 dev measured (branch claude/issue-19518-picklist-kind)

• A schema-door refusal of a select / radio with neither key was implemented and then withdrawn. With it in place, 4 packages/spec fixtures and 9 tests in @objectstack/metadata-protocol's stored-conversions and stored-migration suites went red: a stored select row with no options stops validating, and migrateStoredMetadata stops rewriting it.
• Not measured: how many stored rows in real deployments carry such a field, and whether Studio saves a select field before its options exist. The dev's report says such a save "would 422"; that is inferred, not measured.
• On main today, a select with an empty option list at runtime turns off server-side value validation (record-validator.ts, the reason the ADR-0078 rule gives).

Dedupe words: choice-without-options, select without options, picklist neither, FieldSchema select refuse

Blocked-by: objectstack-ai/objectui#11253

[objectstack-fleet]

os-decision-facets

决策请求:一个 select/radio 字段既没写 options 也没写 picklist,要不要在 schema 门口直接拒绝? · 2026-09-30T09:21Z

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1)。#19518 的 dev 在 PR #20823 上实现了拒绝，测到存量数据会受影响，于是撤回，把问题交了回来(报告 5908082075,开放问题 1)。这件事会让已存的数据不再通过校验，卡片当初没有算过这笔账。所以本席不自己拍板，单独开这张卡请你定。共享选项集(picklist)本身不等这个决定，照常落地。

一句话问题

字段类型是下拉单选，却一个选项都没给。今天这种字段能保存，运行时也不校验填进来的值;作者在 os validate/os lint/os build 时会收到错误。要不要把它升级成保存时直接拒绝?

Governing text

• picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 Scope 2 与验收:「both or neither on a select type is refused at the schema door」「neither refused」。
• ADR-0078:field/choice-without-options(select/radio 为 error)放在作者期的完整性检查里;注册期那一道「只警告，从不抛错」,理由是「一个没用的字段不能拖垮整个启动」。
• 先例:0fb8760bec(fix(spec): require a non-empty reference on lookup/master_detail fields #13927)把「lookup 没写 reference」从完整性检查升级到 schema 门口拒绝。它按 minor 加 BREAKING 标题发布，并带 ADR-0087 的 not-required 标记。

前提(每条带复查方法)

1. 升级拒绝后，存量测试会红。 4 个 spec 夹具和 metadata-protocol 存量转换与迁移套件里的 9 个测试会红：存下来的无选项 select 行校验不过,migrateStoredMetadata 也不再改写它。复查：看 picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 的 dev 报告 5908082075;本席没有重跑。
2. 今天的运行时后果。 选项为空的 select 会关掉服务端的值校验，任何值都能写进去。复查：ADR-0078 该规则的理由一栏，指向 record-validator.ts。
3. 没测的两件事。 一是真实部署里有多少这样的存量行;二是 Studio 是否会先保存字段、后补选项(dev 报告说「会 422」,那是推断，不是实测)。

选项与代价

选项	做什么	客户看到的后果
A	升级到 schema 门口拒绝，照 lookup 的先例：单开一个 PR,minor 加 BREAKING 标题;先修夹具，再处理存量行(先普查，再定迁移或点名修复);先确认 Studio 的建字段流程不受影响，再落地	任何入口保存无选项的下拉都会被拒，并提示「写 options 或 picklist」。已存的无选项字段需要补选项
B	维持现状：作者期报错、注册期警告，schema 不拒	用 os 工具的作者照样挡得住;经运行时接口或 Studio 保存的无选项下拉仍然能存，值不校验

业务直译:A = 下拉必须有选项，哪里都不放行;B = 只在开发工具里拦，线上照样能存。

四轴(业务立场)

• 长远合理性: 主流平台(Salesforce 选项列表、Dataverse 选项列)都要求至少有一个值，或者引用一个全局选项集。A 与主流一致，也与 lookup 先例同一个思路。B 让「门口放、工具拦」的双标准继续存在。
• 实际业务拉动: 没有测到任何作者是有意写无选项下拉的;存量行数量没测。拉动只影响排期。
• 防 AI 犯错: AI 漏写选项时，今天只有走 os 工具才会被拦;经运行时接口保存则静默成功，而且值不校验。A 在所有入口响亮拒绝，并给出处方。
• 创业阶段不扩散: B 零成本;A 需要一个 PR 的量：修夹具、处理存量、核对 Studio。

推荐

A,排在 #19518 落地之后。 只看①选 A;②③④ 是否翻转：否(④只多一个 PR 的工作量,②只影响排期)。回退:B。
置信缺口：存量行数量和 Studio 的建字段顺序都没测。A 的第一步就是测这两件;如果测出的代价超出预期，本席会回到本卡报告，不会硬上。

自检

• 这不是本席能定的:picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 当初的设计只写了结果，没算存量代价，而新代价会让已存的数据失效。
• 两个选项都能执行，不会卡在别的决定上。

裁后执行

• A: 本卡转 pm:queue,等 picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518(PR feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823)落地后由 spec 席认领。第一步普查存量行，并核对 Studio 的建字段流程;然后单开 PR 按 lookup 先例做,达档复核后落地。
• B: picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 的验收里去掉「neither refused」这一条，保留 ADR-0078 的作者期报错;本卡以「不做」关闭，并记下理由。
• 无论选哪项，picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 都不等这张卡。

四棱

① 项目长远合理性:A 与主流和 lookup 先例一致;B 保留双标准。
② 实际业务拉动：没有测到作者，存量未测;只影响排期。
③ 防 AI 犯错:A 在所有入口响亮拒绝;B 只在 os 工具里拦。
④ 创业阶段不扩散:B 零成本;A 一个 PR。
Prior rulings read: picklist, choice-without-options, schema door, neither refused → #18164 设计 5715762696 与裁决 5755653853、5904864936;#19518 正文;ADR-0078、ADR-0049、ADR-0087;先例 0fb8760bec(#13927);thread: 本卡无评论，#19518 的 dev 报告 5908082075。
推荐:A。只看①选 A;②③④ 是否翻转：否。置信缺口：见上。

(备注：本卡创建时，发卡工具报告回读未确认(退出码 6)。本席没有重发，读了看板：只有这一张 #20827,标题和正文都与发出的一致。)

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #256 item 5 · letter A · maintainer 「同意 批次 #256」 2026-09-30T11:20Z

Director seat (objectstack#12708, summon #30 续 2, session_01AsCNgFBs8HCjwhyHQsFbx3). Provenance: maintainer, live PM chat with the director seat, 2026-09-30, replying 「同意 批次 #256」 to batch #256 as presented (five cards, each with the seat's recommendation and the director's four-axis reading). Presented on this card: the domain:spec seat 5's decision request 5908178556 (from the #19518 dev report 5908082075, open question 1) and the director's reading (A after #19518, census and Studio-order check first).

Ruled: A — a select / radio with neither options nor picklist is refused at the FieldSchema door, on the lookup-without-reference precedent (0fb8760bec, #13927): its own PR, minor with a BREAKING header, an ADR-0087 marker, a prescription naming both keys. Sequenced after #19518 (PR #20823) lands.

Execution parameters, as presented: two measurements before the door closes. (1) A census of stored rows carrying such a field — the four spec fixtures and the nine metadata-protocol stored-conversion / migration tests that went red show what a stored row does; the disposition for existing rows follows the count: none → the not-required marker as the precedent; some → new writes refused, stored rows read through the legacy path and named, since no migration can invent options. (2) The Studio create-field order (the dev's "would 422" is inferred): if Studio saves a select before its options exist, the objectui side changes its order first (a card in that lane) and the door closes after. If either measurement's cost exceeds the card's estimate, the seat returns here before building. ADR-0078's author-time rule and the registration-time warning stay as they are — the door is one more gate, not a replacement.

Readings that decided it: ① Salesforce and Dataverse require a value or a global set, and the lookup precedent is the same move; ② no author measured wanting an empty select; ③ today a runtime-API or Studio save of an empty select succeeds silently and turns off server-side value validation — A refuses loudly at every door with a prescription; ④ one PR plus the two measurements.

State: needs-user-decision → pm:blocked, Blocked-by: #19518 (PR #20823); the triage unlock scan or the spec seat moves it to pm:queue when #19518 lands; grading (type, priority) is triage's. The Ruled line goes on the body.

[objectstack-fleet]

Unlock: pm:blocked → pm:queue; #19518's spec layer landed · 2026-09-30T14:35Z

domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1). The ruling 5910124148 names this seat as one of the two that move the card when #19518 lands. ⛔ Not a claim.

• The condition is met: PR feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823 merged as addbbf02ab at 2026-09-30T14:31Z (landing record 5913418487 on picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518). The body's Blocked-by: line comes off in this act.
• Serial on packages/spec/src/data/field.zod.ts: this card claims after two things land that edit the same file. First, the picklist metadata kind — spec: picklist collection, Field.select({ picklist }), server-resolved options, translation face (phase 1 of objectstack#18164) #19518 wording follow-up PR, which is in flight. Second, fields: number rendering honours the authored useGrouping (1 key) #20313 (FieldSchema.useGrouping), unless the claiming seat orders them differently and says why.
• Execution when claimed, as the ruling states: first the stored-row census and the Studio create-field order. If either costs more than the card estimated, report back here before building.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 27 (ruling A 5910124148, step one: the two measurements before the door closes) · 2026-09-30T17:11Z
Session: session_01Sfe5YjBLwB9J3y8fvm2xq1
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: none yet. Step one is read-only, and the build branch is named at step two.
Worktree: objectstack-verify-20827 (read-only measurement)
Domain: domain:spec
Seat: domain:spec#5 (seat post #19357)
Clause-②: yes (narrowing), for the step-two build. Step one changes nothing.
Scope, in the ruling's order:

1. The census: every stored or authored select / radio field with neither options nor picklist that this repository and objectui can see. That means examples, platform objects, spec and metadata-protocol fixtures, and test stacks. Also how migrateStoredMetadata treats such a row today. Production sys_metadata is NOT reachable from here, and the seat says so rather than guessing.
2. The Studio order: whether objectui's Studio create-field flow saves a select / radio before its options exist, which would be a 422 once the door closes. It is read at objectui origin/main and at the .objectui-sha pin.
3. The step-two decision: if either reading costs more than the card estimated, the seat reports back here before building. Otherwise step two builds the refusal on the lookup precedent (0fb8760bec), with a minor BREAKING header and an ADR-0087 marker.
   File surface: step one is none. Step two will be packages/spec/src/data/field.zod.ts and its tests, the fixtures the census names, and the changeset. ⛔ Step two waits for fields: number rendering honours the authored useGrouping (1 key) #20313 (another seat, same file) to land.
   Container & model: S, read-only measurement agent, model: opus.
   Thread-read: 5913459642
   Serial constraints: step one reads only. For step two, field.zod.ts is held by fields: number rendering honours the authored useGrouping (1 key) #20313 (os-warren).

---

Generated by Claude Code

[objectstack-fleet]

Step one (the two measurements) reported: the Studio order exceeds the estimate, so the ruling's objectui branch runs first. pm:dispatched → pm:blocked on objectstack-ai/objectui#11253 · 2026-09-30T18:23Z

domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1), holder of claim 5916083155. The measurement was read-only. The withdrawn door (1c111c3e67) was re-applied behind an environment switch in a throwaway worktree, and each package was run with the switch on and off. objectstack origin/main 8fec76a2b5; objectui origin/main 1263e405de, pin db11afd496.

Measurement 1, the census: within the estimate.

• Red with the door on, green with it off (the estimate was 4 spec fixtures plus 9 metadata-protocol tests):
  • Four oversight fixtures in packages/spec: field.test.ts:2155; field-autonumber-default-unique.test.ts:45; and the exported fixtures filter-number-comparand-declared-type.ts:705-713 and filter-text-operator-declared-type.ts:417-423. Each is fixed by adding one option.
  • One intended pin, picklist.test.ts:129, with 2 tests. It pins today's "neither is only the completeness gate's error". The door flips it by design, and it is rewritten as a refusal pin.
  • metadata-protocol: exactly 9 tests, from ONE fixture row, legacyObjectRow's status: { type: 'select' }, at protocol.stored-conversions.test.ts:102 (2 tests) and protocol.stored-migration.test.ts:143 (7 tests). That row exists to test conditionalRequired, so it is an oversight, and it is fixed by adding one option.
• Every other suite: 0 reds caused by the door. The suites were spec, metadata-protocol, objectql, lint, rest, runtime, cli, metadata, mcp, formula, driver-sql, driver-sqlite-wasm, service-analytics/automation/settings and app-showcase. There are 141 more no-option stubs in 62 files, and they bypass FieldSchema. The 7 intended no-option authorings are judged by the ADR-0078 author-time rule, which is unchanged.
• examples/** and platform-objects: 0 real no-option choice fields.
• What a stored row does once the door closes:
  • It is still read, with _diagnostics.valid: false, and listed by /meta/diagnostics.
  • It still registers at boot, counted invalid with a [metadata_spec_invalid] log line.
  • migrateStoredMetadata apply marks it failed and leaves its bytes untouched. Every later save of that object answers 422 until options or a picklist are added.
  • ⚠️ The os migrate meta --stored PREVIEW does not validate, so it counts such a row canonical. Step two's disposition must name these rows through /meta/diagnostics or the boot log (field/choice-without-options from registry.ts#warnFunctionalCompleteness, available today), not through the preview.
• Production sys_metadata: not reachable from here, so not measured.

Measurement 2, the Studio order: it saves before the options exist, on both mounted paths. This exceeds the estimate.

• The Studio data page: newField(name, 'text'), then a type change to select, then an autosave after 1.5 s. Its blocked condition counts only CEL errors.
• The metadata-admin editor: newField seeds options: [], and it autosaves after 1.5 s. After a 422, #refusalBlocking holds the autosave.
• plugin-designer: the drawer has no options editor, so once the door closes it could never create a choice field. It is not mounted in the console.
• The file-and-symbol evidence is on Studio autosaves a new select / radio before it has options; once objectstack#20827 refuses such a field at the FieldSchema door, that save answers 422: guard or complete the write first objectui#11253.

Next, as the ruling's execution parameter directs ("the objectui side changes its order first (a card in that lane) and the door closes after"):

• Studio autosaves a new select / radio before it has options; once objectstack#20827 refuses such a field at the FieldSchema door, that save answers 422: guard or complete the write first objectui#11253 is filed. It asks for a write guard on the half-filled-lookup precedent (object-metadata-write-guard.ts), or an options-first create, plus plugin-designer's options editor.
• This card unblocks when that lands AND objectstack's .objectui-sha carries it. Step two then runs as ruled: the 4 fixtures plus the one metadata-protocol row gain an option, the picklist pin is rewritten, and the door follows the lookup precedent.
• The maintainer may overrule the order. The door could close now and accept Studio's 422 until objectui lands. The seat does not recommend that.

One side finding: packages/spec/src/ai/solution-blueprint.zod.ts:88 and :320 let a blueprint select carry no options, or options: null. The blueprint's expansion lives outside these two repos. Step two checks whether the door reaches blueprint output.

Transition in this act: pm:dispatched → pm:blocked. The seat's assignee comes off, and the claim is released because nothing is in flight here. The body gains Blocked-by: objectstack-ai/objectui#11253.

---

Generated by Claude Code