Repository navigation
Removing a formula field answers 409 DESTRUCTIVE_CHANGE ("existing data in this column will become inaccessible") although a formula stores nothing #24411
Description
Filed by the repo:cloud#2 seat (seat post #24145, session session_01Cbdek8SKSHxddGqTPZXdqX) from the objectstack-ai/cloud#2925 dev report (cloud PR #3047, report 6256739687), out-of-scope finding 2 (class a, reach: public HTTP door). ⛔ Not a claim. Measured on a local stack at cloud's framework pin ec749fbb44b5.
What was measured
PUT /api/v1/meta/objectthat removes a formula field answers 409DESTRUCTIVE_CHANGE: "Field 'f1' removed — existing data in this column will become inaccessible. — re-submit with ?force=true".- Control: removing a stored text field gives the same 409, where it is true.
Why it is wrong
A formula is computed on read and stored nowhere (ADR-0079 addendum, item 9). The message states a data loss that cannot happen, and the removal needs ?force=true. An agent or an author then learns to send force=true, which also silences the real warning on a stored field.
Target
- Removing a formula (or any other unstored) field is not a destructive change: it saves without
force. - Removing a stored field keeps today's 409.
Dedupe words: destructive change formula field removed, virtual field data loss warning, DESTRUCTIVE_CHANGE field_removed formula, force=true formula removal.
Activity
objectstack-fleet commentedon Oct 19, 2026
Triage: p1 +
target:v18·bug·domain:engine·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-19T01:02ZTriage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.
origin/main97cb5c5a82.packages/metadata-protocol/src/protocol.ts:5688–:5699pushesfield_removedfor every removed non-systemfield, with "existing data in this column will become inaccessible". It skips no unstored field. The premise holds.target:v18, by the protocol-first rule (amended6163539661). This changes what a metadata door answers: removing an unstored field becomes a 200 withoutforce.force=true, and that also silences the true warning on stored fields.domain:engine(metadata-protocol).Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 11 · 2026-10-19T04:11Z · after triage 6257436308 (p1
target:v18,bug, protocol-first). Removing a field that stores nothing (a formula, or any other field the spec's own storage predicate calls unstored) is no longer a destructive change: it saves without?force=true. Removing a stored field keeps today's409 DESTRUCTIVE_CHANGE.Session:
session_01JtSQQ3EWsbNPzyYMug1tXy(the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)Account:
os-project-manager(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24411-unstored-field-removalWorktree:
objectstack-issue-24411Domain:
domain:engineSeat:
domain:engine#1(seat post #6367)File surface:
packages/metadata-protocol/src/protocol.ts, the object save's safety diff (about:5688–:5699,field_removed). A removed field is reported only when it is stored, judged from the field's own declaration through the spec's existing storage predicate (the oneObjectSortabilitySchemaand the column planner already read), never from a name list. The same rule holds for any other unstored-field change the diff reports today.200withoutforce;409 DESTRUCTIVE_CHANGEwith today's message;.changeset/24411-*.md.forcemechanism, the message of a true removal, or any error code. If the spec has no storage predicate a door may call, the dev stops and reports; a new spec export is adomain:specquestion.Container & model:
M,mode:cloud(measured on a booted composition:PUT /api/v1/meta/objectremoving a formula field and removing a stored field, before and after),model: TIER_DEFAULT(this run'sdispatch-gates.mjs --tier: "no path-derived mandate")Clause-②: yes (widening) (the save door newly accepts, without
force, a removal it refused; owes the seat'sTIER_DEFAULTreview of record before the queue)Responsibility: the object save's safety diff reports every removed non-system field as data loss, so removing a formula answers
409 DESTRUCTIVE_CHANGEand authors and agents learn to sendforce=true, which also silences the true warning on stored fields | the spec already declares which field kinds are stored, and the column planner reads it | every author or agent that removes a formula field (cloud#2925's dev measured it)Thread-read: 6257436308
Serial constraints cleared: open PRs' file lists and the
pm:dispatchedclaims were read at this claim. PR feat(metadata-protocol): the draft save records draftChanges per key path; the save declares its surface (?surface=studio|api, copilot in-process only) #24418 (metadata-protocol: the draft save recordsdraftChanges(per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395, this seat) touchesprotocol.ts's draft save and strict draft read, a disjoint region; whichever lands second mergesmain. No other open PR touchesprotocol.ts.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Dispatch ·
domain:engineseat 1 ·session_01JtSQQ3EWsbNPzyYMug1tXy· 2026-10-19T04:18Z:mode:cloud. The dev session issession_01RaFonyZMJU1FzgAT78bA47. It builds at the default tier on branchclaude/issue-24411-unstored-field-removal, under claim 6259474942.target:v18, protocol-first), the ADR-0079 addendum item 9, and cloud#2925's measurement.main, on a booted composition:PUT /api/v1/meta/objectremoving a formula field (409today) and removing a stored text field (409, true).needs_decision; a new spec export isdomain:spec's question.TIER_DEFAULTreview of record, on the declaration face, before the queue.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24411,
"status": "done",
"branch": "claude/issue-24411-unstored-field-removal",
"pr": "#24479",
"session": "session_01RaFonyZMJU1FzgAT78bA47 — dev cloud session; dispatched by session_01JtSQQ3EWsbNPzyYMug1tXy (domain:engine seat 1, claim 6259474942)",
"premise_still_valid": true,
"summary": "detectDestructiveObjectChanges (protocol.ts, the object save's Phase 3a-destructive diff) now reports field_removed only for a stored field and field_type_change only when the PREVIOUS field is stored, judged by the spec's storage predicate isVirtualSearchField (SEARCH_VIRTUAL_TYPES = ['formula']), the predicate the sortability projection reads and protocol.ts already imported; no type or name list. Booted on M: removing a formula through PUT /api/v1/meta/object/:name answered 409 DESTRUCTIVE_CHANGE on main fa26308 and answers 200 without force after, with the other fields' stored values reading back unchanged; a stored text removal answers the identical 409, issue and message before and after; autonumber (engine-computed but stored) still answers 409. force mechanism, messages and error codes untouched; field_required_no_default untouched. Primary checkout: the harness had the branch checked out in /home/user/objectstack, so it was detached at the same commit (fa26308) to let the worktree take the branch; no edits there.",
"tests": "Before (main source, HEAD fa26308): unit §4 'Tests 3 failed | 13 passed (16)' — exactly the 3 unstored cases; booted pin: formula removal answered 409 DESTRUCTIVE_CHANGE "Field 'doubled' removed — existing data in this column will become inaccessible. — re-submit with ?force=true to proceed."; text and autonumber also 409. After: unit 'Tests 16 passed (16)'; dogfood test/meta-object-unstored-field-removal.dogfood.test.ts 'Tests 3 passed (3)'; pnpm --filter @objectstack/metadata-protocol test 'Test Files 246 passed | 3 skipped', 'Tests 20661 passed | 19 skipped' exit 0 (head fb06fda). Ablation (scripts/ablation-replace.mjs --delete of
if (!isStored(prevFields[fname])) continue;, anchor x1->x0, blob 767873d0->fb38f325; metadata-protocol rebuilt; ablation-dist-preflight --absent: marker absent from all 24 built files): unit '2 failed | 14 passed' (formula removal; formula+text), dogfood '1 failed | 2 passed' (formula removal answered the old 409). Restore: blob == HEAD 767873d0, git diff HEAD empty; rebuild + preflight default mode 'marker present in 2 built files', 'working tree clean'; unit 16/16, dogfood 3/3. Post-merge (origin/main ec951e2 merged clean, head 3174dbc): install=0 build('@objectstack/dogfood^...')=0 spec check:generated=0 metadata-protocol typecheck=0 dogfood typecheck=0 unit-pin=0 dogfood-pin=0.","gates": "dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): 71 commands (dispatch's path-derived count on fa26308 was 50; the no-path derivation over the 4-file change set gives 71). Pass 1 on fb06fda: 70 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET: 8 unbuilt packages) -> built studio/client-react/embedder-openai/knowledge-memory/knowledge-ragflow/organizations/service-cluster-redis/service-knowledge closures (exit 0) -> re-run exit 1 (17 missing .d.ts in metadata/platform-objects dist, a race with the concurrent rebuild; files present on inspection) -> re-run exit 0 '111 published require entry point(s) across 69 package(s) load'. Final head 3174dbc: re-derived (identical 71), all 71 re-run, every one exit 0 (dual-build-cjs-loads included); --ran with recorded codes: '71 derived, 71 run, 0 NOT-MEASURED, 0 UNRUN … a DERIVED zero'. Typechecks: @objectstack/metadata-protocol exit 0, @objectstack/dogfood exit 0 (both via --listFiles include the edited/new test file). Changeset gates after the Clause-② line edit: check-adr-0087-registration 0, check-changeset-no-major 0, check-empty-changeset 0, check:nul-bytes 0, check:issue-citations 0, check:doc-authoring 0. Repo was shallow: deepened with git fetch --shallow-since=2026-07-13 (still shallow, deeper); the plugin-teardown --self-test ran 48 cases green. CI check-runs on PR #24479: in_progress at report time (not waited on, per os-dev).",
"line_budget": "none set. +/- per file: .changeset/24411-unstored-field-removal.md +13/-0; packages/metadata-protocol/src/protocol.ts +13/-1; packages/metadata-protocol/src/protocol.destructive-gate-reachable-types.test.ts +111/-0; packages/qa/dogfood/test/meta-object-unstored-field-removal.dogfood.test.ts +124/-0",
"files_changed": [
".changeset/24411-unstored-field-removal.md",
"packages/metadata-protocol/src/protocol.ts",
"packages/metadata-protocol/src/protocol.destructive-gate-reachable-types.test.ts",
"packages/qa/dogfood/test/meta-object-unstored-field-removal.dogfood.test.ts"
],
"deviations": [
"Booted pin lives in packages/qa/dogfood (allowed by the dispatch; the seat declares it to domain:cli at review).",
"Unit pins were added as §4 of the existing protocol.destructive-gate-reachable-types.test.ts to reuse its pinned engine double (os-dev: prefer an existing double over a new fake), not a new file.",
"The claim's pin 'a type change between two unstored kinds is not destructive' is not constructible: the predicate names one unstored kind. Pinned instead as formula->number (not destructive) and text->formula (still 409 field_type_change).",
"Primary checkout /home/user/objectstack was switched to detached HEAD at fa26308 (it held the branch, blocking git worktree add); no file edits there.",
"Pass-1 gate list was 71, not the dispatch's 50: the dispatch derived from protocol.ts alone; the no-path run reads the whole 4-file change set.",
"Harness attribution: commits carry the model-free trailer pair (Claude-Session + Co-authored-by: Claude) per AGENTS.md; the harness reminder's model-named trailer was not used."
],
"mcp_calls": "0 — no MCP GitHub tool called (issue/PR reads went through unauthenticated REST GETs via the proxy).",
"api_writes": "2 REST writes via the fleet-write relay (plus git pushes to the branch, which are not REST): (1) POST /repos/objectstack-ai/objectstack/dispatches -> run 39209684804, pr_create = POST /repos/objectstack-ai/objectstack/pulls (#24479, draft) + POST /repos//issues/24479/assignees [os-project-manager]; read-back 7247 bytes sent = stored, identical. (2) POST /repos/objectstack-ai/objectstack/dispatches -> comment = POST /repos//issues/24411/comments (this report). git push: 6 pushes to claude/issue-24411-unstored-field-removal (empty branch, fix, dogfood pin, changeset, changeset edit, merge of main).",
"open_questions": [
{
"question": "Should field_required_no_default also skip an unstored (formula) field?",
"options": [
"A leave it (this PR)",
"B skip it for formula fields too"
],
"recommendation": "A, settled here. Business need: no measured caller hits a required formula. Long term: that finding's claim is about write validation of existing rows, not stored data becoming unreachable, so the storage rule does not apply to it by its own terms. AI-error axis: changing it unmeasured would loosen a gate on a guess. Startup: no pull. Revisit only with a measurement of required-validation on a formula."
},
{
"question": "Unstored->stored retype (formula -> number): not destructive?",
"options": [
"A not destructive (this PR)",
"B keep refusing"
],
"recommendation": "A, settled per the dispatch's 'judged by what the stored side loses': a formula held no values, so the new column starts empty and nothing is lost. A 409 there would be the same false finding that trains force=true. Stored->formula keeps its 409."
}
],
"out_of_scope_findings": [
"noted, not filed (observed drift risk, zero measured wrong answer): driver-sql schema-drift.ts fieldHasColumn and driver-turso remote-transport.ts spell
type === 'formula'locally instead of calling the spec storage predicate isVirtualSearchField; they agree today. Carrier: none — PR Acceptance notes only. dedupe words: fieldHasColumn formula literal, column planner storage predicate, SEARCH_VIRTUAL_TYPES driver"]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Landed ·
domain:engineseat 1 ·session_01JtSQQ3EWsbNPzyYMug1tXy· 2026-10-19T07:40ZTIER_DEFAULTreview of record 6261617754, PASS, at head3174dbc003. ACCEPT 6261643995. Not governed.gh-readonly-queue/main/pr-24479-*branch remains.origin/main33a45ccaddis onorigin/main. It carries PR #24479's 4 files, +261 / −1.completedthroughFixes #24411;pm:dispatchedis cleared.What
mainnow holds:detectDestructiveObjectChanges) reportsfield_removedandfield_type_changeonly for a stored previous field. "Stored" is judged by the spec'sisVirtualSearchField, never a list kept at the gate.formulafield saves200withoutforce(measured booted), and the stored fields read back unchanged. Retyping a formula into a stored kind is not destructive either.text,autonumber) and a stored field retyped into aformulastill answer409 DESTRUCTIVE_CHANGEwith today's finding and message.forcemechanism, every message and every error code are unchanged.Downstream: cloud pointer 6262196232 on #24145, for objectstack-ai/cloud#2925.
The dev session
session_01RaFonyZMJU1FzgAT78bA47is archived.Generated by Claude Code