Repository navigation
fix(app-shell): a refused metadata write on the view, report and draft surfaces is said, and the view-config panel stays dirty (objectui#11583) - #11593
Merged
objectstack-fleet[bot] merged 7 commits intoOct 4, 2026
Conversation
…t surfaces is said, and the view-config panel stays dirty Every metadata write under packages/app-shell/src/views now raises a refusal through toast.error with formatMetadataError: the view-config panel's edit Save, pin, reorder, the toolbar toggles' updateViewConfig, the report editor's Save, and the draft bar's Publish and Discard. ViewConfigPanel clears isDirty and bumps savedSignal only after the save lands. A census over every write call under the directory keys each site to a ledger row with mechanical evidence, so a new write site with no row is red. Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2 Co-authored-by: Claude <noreply@anthropic.com>
…ly close (objectui#11583) Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2 Co-authored-by: Claude <noreply@anthropic.com>
…bound t the i18n gates can see (objectui#11583)
An aliased translator (`const { t: tConsole } = useObjectTranslation()`) is
invisible to check:i18n-keys and check:i18n-dead-keys, which classify `t` /
`tt` bindings only: the two new keys read as dead. A module-level hook binds
the packs' `t` in its own scope, so the bar's engine-table `t` is untouched.
Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2
Co-authored-by: Claude <noreply@anthropic.com>
…ere check:test-path-roots can classify it (objectui#11583) Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2 Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
…and set-as-default says the refusal's reason (objectui#11583) Patch round from the seat's review: ReportConfigPanel.handleSave waits for onSave's outcome (ReportView.saveSchema now resolves whether it saved), so a refused report save leaves the editor open with the edit and Save live; Save is disabled and the inspector read-only while the save is in flight. handleSetDefaultView's untranslated literal toast becomes form.saveError with formatMetadataError, like its siblings. Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2 Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
…leViewConfigSave's own body, not a 600-character window (objectui#11583)
The control asserted `handleViewConfigSave[\s\S]{0,600}persistRuntimeMetadata('view'`.
objectui#11583 added a docblock and an early return to the handler, moving the
call 708 characters after the name with the call still in place, so the
window went red (CI shard 4/8 at e3c7e63). The assertion now finds the
`const handleViewConfigSave` declaration with the TypeScript parser and
requires a `persistRuntimeMetadata('view', ...)` call inside it: same
meaning, no byte distance, and a call in another function cannot satisfy it.
Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2
Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Contributor
Author
Contract reviewServed-tier: Written 2026-10-04T05:56Z by the reviewing subagent of Check-runs on ① Derived judgments
② Semver levelPackage set right: ③ Boundary flags
Implemented-by: VERDICT: FAIL |
…s every host the void prop admitted (objectui#11583) Contract review 5977112283 (item 1.1), remedy (a) per the seat's answer 5977119047: the widened `void | Promise<boolean>` return refused, with TS2322, an async host returning nothing, a host resolving to a record and a sync non-void host, all of which the published `void` prop admitted. The prop now returns `unknown`; the runtime keeps reading one signal, a `false` or a rejection, and reads anything else as saved. ReportConfigPanel's unpublished onSave is aligned in the same stroke. A compile-time pin in the app-shell test project assigns those hosts to the prop. The emitted JS of both panels is unchanged. The changeset says what the type admits. Claude-Session: https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2 Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Contributor
Author
Contract reviewServed-tier: Written 2026-10-04T06:28Z by the reviewing subagent of Check-runs on The delta since ① Derived judgments
② Semver levelPackage set right: the changeset names ③ Boundary flags
Implemented-by: VERDICT: PASS |
Contributor
Author
|
Generated by Claude Code |
objectstack-fleet
Bot
deleted the
claude/issue-11583-refused-writes-said
branch
October 4, 2026 06:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #11583
Clause-②: yes
Why yes:
ViewConfigPanelis exported frompackages/app-shell/src/index.ts, and the return type of itsonSaveprop moves fromvoidtounknown. The type admits any return, exactly whatvoidadmitted; the panel now awaits it, andfalse(returned, or the value a returned promise settles with) or a rejection means refused, while anything else, nothing included, is read as saved. An earlier head typed itvoid | Promise(boolean)(parentheses because the body sanitizer drops angle-bracket shapes) and called that caller-compatible; the at-tier contract review (5977112283, item ①.1) measured that false: the union refuses, with TS2322, anasynchost that returns nothing, a host resolving to a record and a sync non-void host. Remedy (a), the seat's call (5977119047):unknown, pinned at compile time below, andpatchstands. No published schema, spec type or accept set moves.ReportConfigPanel'sonSaveis aligned tounknownin the same stroke;ReportConfigPanelis exported from neitherpackages/app-shell/src/index.tsnorpackages/app-shell/src/views/index.ts, so it adds nothing to Clause-②: theyesis forViewConfigPanelonly.onCreatekeeps itsvoidtype.What this changes
This is the silent-refused-write family's closing card (direction: triage
5975148557). Every metadata write call underpackages/app-shell/src/views/now raises a refusal through the console's existingtoast.errorchannel withformatMetadataError, the way objectui#11578 did for the two Create View doors. ⛔ No new notification surface.ObjectView.tsx›handleViewConfigSavepersistRuntimeMetadata('view', …)console.erroronly, not awaitedfalseViewConfigPanel.tsx›handleSaveonSaveisDirtyand bumpedsavedSignalbefore the save settledObjectView.tsx›handlePinViewupdateView(…, { isPinned })console.erroronlyObjectView.tsx›handleReorderViewsdispatchViewPatches, oneupdateView(…, { sortOrder })per saved viewconsole.erroronlyObjectView.tsx›persistViewPatch(triage's extra site)updateViewConfigViewConfigPermissionDeniedError; every other refusal, a server 403 included,console.erroronlyReportView.tsx›saveSchemapersistRuntimeMetadata('report', …)console.warnonlyReportConfigPanel.tsx›handleSave(patch round)onSavedirtyand shut the panel before the save settled; a refused save lost the editObjectView.tsx›handleSetDefaultView(patch round)dispatchViewPatches,updateView(…, { isDefault })form.saveErrorwith the door's message, like its siblingsRuntimeDraftBar.tsx›handlePublish,handleDiscardpublishRuntimeMetadata,discardRuntimeDraftconsole.erroronlyform.saveError, as objectui#11578 did. The draft bar takes its labels from the metadata-admin engine table (objectui#10202's claim, untouched here), which has no failure keys, so two keys are added to all ten packs:console.runtimeDraft.publishFailedandconsole.runtimeDraft.discardFailed. They are read through a module-level hook (useRefusalTitles) whosetis bound to the packs. An aliased translator was tried first and measured invisible tocheck:i18n-keysandcheck:i18n-dead-keys, which classifyt/ttbindings only: the two keys read as dead-key candidates until the hook landed.handleReportFieldChange); the write fires once per press of the editor's Save. So one refusal is one toast, no burst guard is added, and when the editor saves is unchanged. The pin counts the writes after three edits (none) and after Save (one).5976535570).ReportView.handleReportConfigSaveawaitssaveSchemaand re-seats the panel's config only on a save that landed, so a refused save keeps the open panel's draft.saveSchema's no-client branch returnsfalse.onSavetype (contract-review remedy).ViewConfigPanelProps.onSaveandReportConfigPanelProps.onSavereturnunknown; the runtime read is unchanged ((await onSave?.(flat)) !== false), and the emitted JavaScript of both panels is byte-identical to the previous head's (TypeScripttranspileModulewithout comments, same hash). The docblocks namefalseor a rejection as the only refusal signal.ViewConfigPanel.onSaveHosts-11583.test.ts, in the app-shell test project thattype-checkcompiles, assigns the hosts thevoidprop admitted to the prop type.view-filter-fold.ratchet.test.ts's explicit-save control assertedhandleViewConfigSave[\s\S]{0,600}persistRuntimeMetadata('view', a fixed window after the name. This PR's docblock and early return moved the call 708 characters after the name, with the call still there, so CI'sTest (shard 4/8)went red ate3c7e63. The control now finds theconst handleViewConfigSavedeclaration with the TypeScript parser and requires apersistRuntimeMetadata('view', …)call inside it: the same meaning, no byte distance, and a call in another function cannot satisfy it. The old window still matches atb65aa5eand does not ate3c7e63(measured with the regex itself).CreateViewDialog's await and objectui#11581's one builder; rename and delete, which already raised a toast with a pack key.The census
packages/app-shell/src/views/writeRefusalCensus-11583.test.ts. The population is derived by the TypeScript parser over every non-test source under the directory, recursively (metadata-admin/**included; it holds no write today): calls to the ruling's five names (createRuntimeMetadata,persistRuntimeMetadata,publishRuntimeMetadata,discardRuntimeDraft,updateView) plusupdateViewConfig(triage's extra site),deleteView(updateView's adapter sibling) and any symbol arelaysrow names (dispatchViewPatches). A site is keyedfile › enclosing symbol › callee, never by line. Every ledger row carries a kind with mechanical evidence:surfaces: atoast.errorcall sits inside acatchclause or a.catch(…)callback of the enclosing symbol, and the row names a pin file that exists and names the symbol.relays: the write's promise leaves the symbol uncaught, and each call of the symbol is itself a census row.The census is also red on a site with no row, a row whose declared call count differs from the tree, a stale row, a reason that says only "out of scope", an adapter write read off its object as a value, and a seam write imported under another name.
Evidence
Red first. At
b65aa5ewith only the new test files added: the panel's 403 and 422 cases sawtoast.errorcalled 0 times (the objectui#11578 dev's measurement, reproduced through the realObjectView, the real panel and its real draft bar, and a realMetadataClient); pin, reorder, the toolbar toggle's server refusal, the report Save, Publish and Discard saw 0 toasts; the panel'sfalse, rejection and in-flight cases were red; the census was red naming exactly the six log-only rows (handleViewConfigSave,handlePinView,handleReorderViews,saveSchema,handlePublish,handleDiscard). Every control was green:Tests 12 failed | 19 passed (31). After the change:Tests 31 passed (31).Patch round, red first on the first round's head
69529b5(the new pins only):Tests 5 failed | 23 passed (28). The set-as-default case:expected 'undefined' to contain 'Setting a default view requires the M…'(a toast, no description). The report editor through the realReportView:Unable to find an element by: [data-testid="report-config-panel"]after a refused save. The panel'sfalseand rejection cases:onClosecalled once; the in-flight case: Save not disabled. Controls green. After the change:Tests 41 passed (41)over the patched pins and the report panel's neighbours.Ablations, from the committed head through
ablation-replace.mjs(anchor hit once, blob changed on disk; restore proven by the HEAD blob hash and an emptygit diff HEAD):handlePinView's toast swapped forconsole.info: exactly two cases went red, the pin case and the census'ssurfacescheck namingObjectView.tsx › handlePinView › updateView(Tests 2 failed | 18 passed (20)). Restored to blobe24f9c5, equal to HEAD.censusProbe11583Scratch.tswith onedataSource.updateViewcall in a catch-and-log handler: the census's "every write site has a ledger row" went red namingcensusProbe11583Scratch.ts › renameQuietly › updateView(Tests 1 failed | 6 passed (7)). The file was removed by its trap;git statusclean.t('console.runtimeDraft.publishFailed')mutated to a missing key madecheck:i18n-keysexit 1 with[missing-key]on it. Restored to blob405b57c, equal to HEAD.e3c7e63:ReportConfigPanel.handleSave'sif (!landed) return;swapped forvoid landed;, so the panel shuts whatever the outcome: exactly three cases went red, the panel'sfalseand rejection cases and the report editor's refused case throughReportView(Tests 3 failed | 4 passed (7)). Restored to blob2500984, equal to HEAD.handleSetDefaultView'sdescription: formatMetadataError(err)removed: exactly the set-as-default pin went red (Tests 1 failed | 20 passed (21)); the census stayed green, since the toast is still on the refusal path. Restored to blobec24e59, equal to HEAD.e075976: thepersistRuntimeMetadata('view', …)call inhandleViewConfigSaverenamed to an ablated callee: the rebound ratchet control went red withhandleViewConfigSave no longer persists through the metadata seam(Tests 1 failed | 8 passed (9)). Restored to blobec24e59, equal to HEAD.ba2a810:ViewConfigPanelProps.onSavetyped back tovoid | Promise(boolean):pnpm --filter @object-ui/app-shell type-checkexit 2 with TS2322 on exactly the three host rows ofViewConfigPanel.onSaveHosts-11583.test.ts(anasynchost returning nothing, a host resolving to a record, a sync host returning a number) and TS2344 on its return-type equation; the void host and thefalsehost still compile. Restored to blob0497429, equal to HEAD.Verification at
ba2a810e075976, the changed sources are type and comment only: the emitted JavaScript ofViewConfigPanel.tsxandReportConfigPanel.tsxhashes the same before and after (TypeScripttranspileModulewithout comments), so no runtime test's verdict ate075976can move. Run atba2a810: every test that imports, mocks or namesViewConfigPanelorReportConfigPanel, every app-shell test that reads sources from disk, everyObjectView*suite, the census and the new pin:Test Files 96 passed (96),Tests 1075 passed (1075).pnpm --filter @object-ui/app-shell type-check: exit 0, its test project lists the new pin (counted with--listFilesOnly). The readings below are frome075976.Verification at
e075976packages/app-shellsuite, run under the verify lock in pieces that fit the foreground cap:--shard=1/4, then--shard=2/8through--shard=8/8(vitest's shard ranges over the 994 files:1/4is the first 249,2/8starts inside it, so together they cover every file). Each piece exit 0; summed:Test Files1117 passed and 1 skipped across 1118 runs (124 files ran twice in the overlap), 0 failed (Testssummed: 10989 passed, 10 skipped). Plus every test outsideapp-shellthat namesObjectView,ViewConfigPanel,ReportView,ReportConfigPanelorRuntimeDraftBaras text or reads sources from disk (35 files), andpackages/i18n/:Test Files 113 passed (113),Tests 2727 passed | 13 skipped (2740).ObjectView.tsxfrom disk withreadFileSyncand imports nothing from it, so the union could not see it. Shards 1, 4, 5, 6 and 7 at69529b5were cancelled by the next push, so it never ran there either. The whole-package run above covers that gap forapp-shell.pnpm --filter @object-ui/app-shell type-check: exit 0 after the dependency closure was rebuilt at this head (turbo run build --filter=@object-ui/app-shell^..., 28 tasks). Its test project lists all six new files and the ratchet (counted with--listFilesOnly).check:metadata-write-doors,check:control-bytes,check:new-line-citations(0 new citations),check:changeset-claims(report-only; the three pending changesets it names for touched files were re-read and still hold),check:pending-changeset-literals,check:i18n-keys,check:i18n-drift,check:i18n-dead-keys(report),check:i18n-designer-parity,check-changeset-presence,check-changeset-no-major,check-changeset-overwrite,check-changeset-fixed,check-vi-mock-specifiers,check-vi-mock-inherit,check-vi-mock-override-shape,check-test-path-roots(the census's directory walk is classified as self-rooted),check:unreferenced-sources,check:handler-key-reads..ts/.tsxfile in the diff under the rooteslint.config.jsthat each package'seslint .reads;--format jsonreports 23 files, 0 errors (the 23rd, the type pin, atba2a810) (none of the 5 changed app-shell sources carries more warnings than atb65aa5e); the config enables no type-aware linting (noparserOptions.project, noprojectService) and no local rule reads the filesystem, so this diff cannot move the verdict of an untouched file.performance-budget.yml); reason: it needs a full console build and is CI's. The eagerenpack grows by two short strings.Acceptance notes
ViewConfigPanelProps.onCreateis still typed as returningvoidwhile the object page passeshandleViewCreate(which returns whether the view was saved). Avoidtarget admits that host, create mode does not gate Save on the dirty flag, and a refused create keeps the panel open, so nothing is stranded.handleViewConfigSave's no-write branch (no metadata client or no view id) now returnsfalsewith its existingconsole.warn, so the panel stays dirty instead of reading as saved;ReportView.saveSchema's no-client branch returnsfalsethe same way.useMetadataClientalways returns a client and the edit-mode draft carries the active view's id, so neither editor reaches them.persistViewPatchpassed that check before this change through its permission-denied branch. Its behaviour is pinned byObjectView.viewWriteRefusal-11583.test.tsx.Session:
https://claude.ai/code/session_01FjqrwXPfSMkSfkKYDSRkN2Generated by Claude Code