[objectstack-fleet]

Requested by Bill · project thread

维护者速读

• 改了什么：Studio 的无代码条件构建器对对象字段做「大于/小于/至少/至多」比较时，现在写出 record.x != null && record.x > 40（与「数字不能为负」预设同形），服务端发布时接受；RLS 子句字段只在文本仍是服务端评判过的那段时才显示服务端报错，改了文本就不再挂着上一版草稿的旧错误。
• 为什么改：之前构建器写 record.estimated_hours > 40，可空字段在 CEL 里没有 > 的 null 重载，构建器说「Valid CEL」，发布时却被拒并拖住整个包；RLS 字段在被客户端语法检查挡住保存时不会重读草稿，旧的服务端报错一直显示在新文本下面。
• 风险与回滚：只改 app-shell 两个源文件（ConditionBuilder.tsx 的比较编译路径、CelPredicateField.tsx 的显示条件）；已存的条件打开时一个字节都不改写，未加守卫的旧比较保持原样直到作者编辑那一行。回滚即 revert 本 PR。
• 先看：ConditionBuilder.tsx 的 compileRow 守卫分支与 update 里的 withGuard；parseGuardedCompare；CelPredicateField.tsx 里 serverErrors 改读 held。
• 两分钟验证：pnpm --dir ui exec vitest run packages/app-shell/src/views/metadata-admin/inspectors/ConditionBuilder.nullGuard-27513.test.tsx packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.serverVerdictHold-27482.test.tsx，预期 13 条全绿。
• 需要你做的：无，席位落地。

Fixes #27513
Fixes #27452

Clause-②: no
Metadata-protocol: none

What changes

• ConditionBuilder.tsx (the comparison compile path only): a row whose operator is an ordering comparison (> < >= <=) and whose subject names a catalog field compiles to S != null && S op V, a compound row, so it is parenthesised beside other rows. That is the shape the "Number can't be negative" preset already writes and the fix the server's own refusal prescribes ("Guard it with '!= null'"). parseGuardedCompare reads exactly that text back as the one row it compiles from, as a whole expression and as a parenthesised term. The guard is decided by the row, not by the field's nullability: the builder restates no publish rule, and != null is well typed on a field that can never be null too. Equality rows, value-less rows and rows on a context subject (record.id, user.*) compile exactly as before.
• A stored condition is never rewritten on open. A comparison saved without the guard parses as a row with no guard and re-emits its own bytes; the guard is applied to a row when the author builds or edits that row (update → withGuard on the rows the edit replaced), following the builder's existing rule for the author's own quote spelling.
• CelPredicateField.tsx: the server's errors at verdictPath are now shown on the same terms on which they already held the save since fix(app-shell): a server error at an RLS clause's path holds the permission-set autosave #27612 (useServerHoldAt): only while the text on screen is the value the judged body holds at that path. "Valid CEL", aria-invalid and the destructive border follow the same set. useServerErrorsAt is no longer read here (the flow edge inspector still reads it).

Why

#27513: the release walkthrough built "Reject the save when… record.estimated_hours greater than 40" on an optional Number field. The builder said "Valid CEL" and the rule saved, and publish refused it (@objectstack/lint's #4763 null-guard gate: an ordering operator on a nullable declared field with no dominating != null), holding every other draft in the package. Triage asked the builder to emit the preset's null-safe guard.

#27452: an RLS clause showed the previous draft's server error under new text. The verdict comes from the last draft read; an edit the lint holds never saves, so nothing re-reads, and the field read the verdict by path alone. Triage asked the field to clear the server verdict on edit and show the new one on save. #27612 had already keyed the save hold on the judged text, not the display; this keys the display the same way, so one verdict decides both.

Tests

New ConditionBuilder.nullGuard-27513.test.tsx (7 cases) on the Validations tab's mount (scope="record", the server host's subjects): the card's flow (Add condition → field → greater than → 40) emits the guarded text; that text is judged by the server's gate (findUnguardedNullableOperands from @objectstack/lint, test-only) as clean and evaluated by @objectstack/formula on a null row without a fault, against an instrument control in which the old emission is refused by the same gate and faults in the same engine; the guarded text reopens as one row; the OR join parenthesises and round-trips; a stored unguarded comparison keeps its bytes until that row is edited; equality needs no guard; a non-catalog subject is not guarded.

Two new cases in PermissionMatrixEditor.serverVerdictHold-27482.test.tsx for #27452, through the real permission-set editor and a fake door: a stored refused USING shows the server message; editing it to a lint-held text removes the message while the hold and the client error stay, with no PUT and no draft re-read; typing the judged text back shows it again. serverVerdictAtPath-26858.test.tsx now provides the judged body its page provides (DraftVerdictBodyContext), as PermissionMatrixEditor does.

Readings (head 4d13c9a)

• Touched-file test set (git grep over the changed components, 115 files): 115 passed / 1043 tests, on 232f261a and again on the merged head (lock VERDICT command-exit 0).
• pnpm --filter @object-ui/app-shell run type-check: exit 0 on the merged head.
• dispatch-gates --commands: 34 commands, each :: exit 0 on the merged head (including node scripts/check-sdui-manifest.mjs and pnpm --dir ui exec vitest run scripts/: 169 files / 4901 tests passed); dispatch-gates --ran: 34 derived, 34 run, 0 NOT-MEASURED.
• ui check:new-line-citations: exit 0, 0 new.
• Ablations (restored, empty diff): Studio: the RLS predicate field keeps showing the previous draft's server error under newly edited text #27452 display reverted to the path-only read turns 2 of the 6 cases in the hold file red; Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513 guard removed from compileRow turns 4 of the 7 null-guard cases red.

Acceptance notes

• Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 is not in this PR (seat ruling). Measured while wiring its Validations-tab arm: the server never addresses a validation rule's condition by path. validate-expressions.ts pushes validation-rule findings (check() and checkNullGuards, the Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513 refusal) with where only; authoring-rules.ts sets path: i.path ?? i.where; withPublishVerdict keeps a non-positional path as written. So the draft read's _diagnostics entry for a rule carries the prose locator (object 'X' · validation rule 'NAME'), never validations.N.condition; protocol.runtime-authoring-gate.test.ts's finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 block pins issue.path equal to that where. Only a top-level flow edge's condition carries a key path (Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858). No ui-only change can hold or show a server verdict at a rule's own path, so the seat returned Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 to triage to file the producer-plus-consumer seam.
• So the builder half of Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513 is fixed here and its "verdict half" (the server's verdict holding a Validations-tab save) rides that seam, not this PR. A rule built in the builder now writes what the server accepts; a hand-typed unguarded comparison in the raw editor still reads "Valid CEL" until the seam lands.
• PR fix(studio): a Data rail switch sends the pending edit first; a broken CEL formula stays held after the inspector closes and keeps its returnType (#27511, #27485) #27617 holds DataPillar regions of StudioDesignSurface.tsx; this PR no longer touches that file, so no merge ordering applies.
• Branch claude/project-thread-qx6k5b is the card thread's designated push branch (the recorded platform exception to claude/issue-N-slug). The harness's after-PR assignee and review-request step is skipped by the dispatch order (the maintainer reviews after the seat accepts).

Verification

Local subset per the dispatch: the touched-file test set, @object-ui/app-shell type-check, the derived gate list reconciled with dispatch-gates --ran, two ablations (one per card). Repo-wide lint and the full ui suite are CI's.

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#3 · os-bill · session_01Utp6CaJoinvGQSbHeDaWBe

席位核对

ACCEPT · head 4d13c9acc70b1510b6e813da300fcafa1b38f3f9 · 2026-10-29T17:32Z

• Shape: draft → main, Fixes #27513 and Fixes #27452 each on its own line; Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 is out of this PR entirely (released to pm:retriage: the Validations arm needs a packages/lint producer key path first, a cross-layer seam). Clause-②: no and Metadata-protocol: none match the claims; the change is inside private @object-ui/app-shell. No contract review owed.
• Premise, measured: Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513, the condition builder compiles a greater than / less than / at least / at most row on a catalog field as S != null && S op V (the "can't be negative" preset's shape and the server's prescription), reads that shape back as one row, and never rewrites a stored condition on open; an unguarded stored comparison gains the guard only when the author edits that row. Studio: the RLS predicate field keeps showing the previous draft's server error under newly edited text #27452 reproduced on main; CelPredicateField now shows the server's errors through useServerHoldAt, on the same terms as the hold (only while the text on screen is the text judged).
• No regression checked by the seat: on main the only CelPredicateField mounts with a verdictPath are the two RLS clauses in PermissionAdvancedFacets, mounted only under PermissionMatrixEditor's DraftVerdictBodyContext.Provider; FlowEdgeInspector reads useServerErrorsAt directly and is untouched.
• Gates (check-runs on the head): 44 success, 11 skipped, 0 failure. check-governed-merges --pr 27677: NOT governed, 347 changed lines.
• Accepted deviations: the attribution line links the card thread; an extra test commit for Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513; one scripts/ vitest timeout under load, re-run alone green.
• Landing: non-governed, all checks green, mergeable_state clean ⇒ the seat lands it (pr_ready + automerge_enable).

---

Generated by Claude Code