[objectstack-fleet]

Requested by Steve · project thread
Part of #25933 — this PR is the edit form half; the board half (drop gate on the Kanban columns) follows in a second PR from the same branch.

Clause-②: yes
Metadata-protocol: none

What changes

An object whose field is governed by an error-severity state_machine validation (the showcase task's status, for one) used to offer every option in the record edit form. The server refused the invalid move only after submit, with "Invalid task status transition." and no list of the allowed next states. The edit form now offers the persisted value plus the states the machine declares as its next moves, and leaves the rest out.

• @object-ui/core — new export stateMachineNextValues(objectSchema, fieldName, currentValue) in validation/validators/state-machine-next-values.ts, published through the validators barrel. It was the grid's private helper (plugin-grid/src/inline-edit-options.ts); it now narrows exactly where the server's rule validator refuses: severity error (the spec default), active not false, events covering update (the default covers it). An undeclared from-state stays unconstrained, and several applicable rules on one field intersect. It reads the declared transition map for choice controls; it does not import, mirror or wire the deprecated object-level rule engine (validation-engine-stays-unwired.test.ts still green).
• @object-ui/plugin-form — the narrowing runs in gateFormFields, the one field-gate step every form layout draws its resolved fields through. It takes an optional previousValues (the persisted record) and narrows a single-value select on both carriers: the entry's own options (the form renderer's built-in select) and field.options (the registered select widget). All six layouts pass their persisted record: the simple form, ModalForm, DrawerForm, TabbedForm, SplitForm and WizardForm. The from-state is the stored row, never the live value. A create form is unconstrained, and the current value always stays offered.
• @object-ui/plugin-grid re-exports the helper from core, so ObjectGrid.tsx is untouched.

Visible change in the grid's inline editor (intended)

The grid used to narrow on ANY state_machine rule for the field. It now narrows only on a rule the server enforces on update. A severity: 'warning' / 'info' machine (for example the showcase project_health_progression), an active: false rule, or an events: ['insert'] rule no longer narrows the inline editor: the server never refuses those moves, so every option is offered again.

Why gateFormFields and not ObjectForm.tsx alone

The console's record edit dialog is ModalForm, rendered directly by app-shell AppContent.tsx (formType: 'modal', mode: 'edit'), not ObjectForm's default arm; ObjectForm also routes drawer / tabbed / split / wizard to their own files. Narrowing only the default arm would have left the reported dialog unchanged. The seat approved the wider file surface (Claim amendment on the card).

Tests

Run at head 80690c5b from ui/ under the verify lock:

• packages/core/src/validation/__tests__/state-machine-next-values.test.ts (new, 12): default severity narrows; warning / info / inactive / insert-only do not; undeclared and empty from-states are unconstrained; several rules intersect; published from the package root.
• packages/core/src/validation/__tests__/validation-engine-stays-unwired.test.ts — still green.
• packages/plugin-grid/src/inline-edit-options.test.ts — existing pins green, plus the warning-machine case.
• packages/plugin-form/src/stateMachineOptions.test.ts (new, 11): both carriers narrowed, create unconstrained, unloaded record unconstrained, warning keeps every option, string options, multi-value untouched, and through gateFormFields.
• packages/plugin-form/src/__tests__/stateMachineSelect-25933.test.tsx (new, 5, rendered): the console edit dialog on a backlog task offers backlog, todo; an in_review task offers in_progress, in_review, done; the simple edit form on a done task offers in_progress, done; CONTROLS: a create dialog and a warning-severity machine offer all five.

Result: the five files above, 41 + 5 tests, all pass. The full @object-ui/core and @object-ui/plugin-form suites (npx vitest run --maxWorkers=2 packages/core/ packages/plugin-form/, 413 files, 6484 passed, 28 skipped) ran at 8e28b0ff; their one red, column-identity.ratchet.test.ts reading f?.name || f.multiple || f.field?.multiple as a column-identity dual read, was fixed by splitting the guard and re-run green with the four pinned files. pnpm --filter @object-ui/core --filter @object-ui/plugin-form --filter @object-ui/plugin-grid run type-check: exit 0. The @object-ui/plugin-grid suite was narrowed to inline-edit-options.test.ts (its only change is the re-export); the full grid suite is left to CI Test Core.

Ablation (fix committed first; scripts/ablation-replace.mjs, mutation proven on disk, restored to the HEAD blob): handing narrowStateMachineOptions previousValues: undefined inside gateFormFields turned the 4 narrowing pins red (the gateFormFields unit pin and the three rendered narrowing pins) while the 12 others, controls included, stayed green.

Gates. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 46 commands at 573a23e7; 45 exited 0 there. node scripts/check-sdui-manifest.mjs was red there because the record predated the last source commit; after the re-record it exits 0 at the final head 80690c5b, whose only further change is scripts/sdui-manifest.record.json. --ran reconciliation: 46 derived, 46 run, 0 NOT-MEASURED (a derived zero: every row carries its exit code). Repo-wide scans (pnpm lint, the full check:* farm) are CI's.

Acceptance notes

• The wizard narrows from persistedRecord, the record as first read; it does not advance after a mid-flow save. The wizard only writes at its final commit, so this matches its own previousValues.
• Only top-level state_machine rules narrow. A state_machine nested inside a conditional rule's then / otherwise is not read; that leaves the control permissive, never stricter than the server.
• The refusal message after submit is unchanged; it still does not name the allowed next states. With the select narrowed the user should no longer reach it from the form.

Session: session_015Kzn5VKHAGKe251waHoUqj (card thread, domain:ui#2)

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 80690c5bb12e18531733cc8d0dc8c83980892424
Local-runs: none

Scope: the Clause-②: yes declaration face. The committed tree touches no packages/spec/src/** and no governed path, so it is owed at TIER_DEFAULT and written by the lane seat. Files read: ui/packages/core/src/validation/validators/{state-machine-next-values.ts,index.ts}, ui/packages/plugin-grid/src/inline-edit-options.ts, ui/packages/plugin-form/src/{fieldWriteGate.ts,stateMachineOptions.ts} and the six form arms' gateFormFields call sites.

① Derived judgments

• New public export, @object-ui/core stateMachineNextValues(objectSchema, fieldName, currentValue): Set<string> | null. This widens the package's public surface, which is the declared reason for yes. It is a pure read of the served validations with no runtime dependency on the deprecated engine next door. That is correct.
• What the export narrows on. Only type: 'state_machine' rules for the field that are active !== false, (severity ?? 'error') === 'error', and have events (default ['insert','update']) that include update. An undeclared from-state is unconstrained, and several rules intersect. This mirrors where the server refuses, and the absent-key-as-default reading is right for /meta output. That is correct.
• @object-ui/plugin-grid stateMachineNextValues. It keeps the same name and signature and is now a re-export, so it is not removed or renamed for any importer. Its behaviour widens what the grid offers: warning, info, inactive and insert-only machines no longer narrow, and a null/undefined current value now returns null instead of matching a '' from-state. Both are consistent with the server and named in the changeset. Correct, and not a narrowing of any acceptance set.
• @object-ui/plugin-form GateFormFieldsOptions.previousValues?. An optional key, additive. When absent, gateFormFields returns the same fields as before (narrowStateMachineOptions passes them through by identity off edit mode and with no record). Correct.
• From-value. Modal, Drawer, Tabbed and Split pass formData. In those arms formData is written only by the record and initial loaders (setFormData(data || {}) and the edit-seed lines), and it was already their renderer's previousValues. Wizard passes persistedRecord, and Simple passes initialData. None of them is the live edit value. Correct.

② Semver level

Metadata-protocol: none means patch on each moved package (AGENTS.md: a non-protocol change ships patch). The changeset declares patch for @object-ui/core, @object-ui/plugin-form and @object-ui/plugin-grid, which are exactly the three packages the diff moves. Consistent.

③ Boundary flags

• No permission boundary is moved. The read is presentation only, and the server's validator stays the authority.
• The PR author is objectstack-fleet[bot] (relay pr_create), so there is no out-of-relay login to name.
• The dev's flags have answers. The reviewer request was not sent, but no Tier H path is touched, so none is owed. The narrowed grid run (inline-edit-options.test.ts only) is left to CI, and landing waits on CI's full plugin-grid run at the head.

Implemented-by: claude/project-thread-aetoxp
Reviewed-by: session_01SMps7wq7rBTk53e8KTSEup

VERDICT: PASS

[objectstack-fleet]

席位核对

ACCEPT (PR 1 of 2) · domain:ui seat 2 · session_01SMps7wq7rBTk53e8KTSEup · 2026-10-26T09:52Z · head 80690c5b

1. 形态: draft → main, assigned to os-steve. The first content line is Part of #25933, which is right because the board half is still owed on this branch. No closing keyword appears anywhere in the body. Clause-②: yes and Metadata-protocol: none each lead their own line in the body and in the changeset.
2. 前提实测: the card thread's own premise read widened the surface from ObjectForm.tsx to gateFormFields plus all six layouts, because the console's edit form is ModalForm. The seat recorded that in amendment 6411987055 before any code was written, and this diff stays inside the amended surface. The from-value in every arm is the persisted record, never the live form value, and create mode is unconstrained. Both option carriers are narrowed (options and field.options). The contract review below covers the details.
3. Contract review: declaration face TIER_DEFAULT, PASS at this head (comment 6413093140).
4. 门禁 check-runs: there are none at this head. GitHub reports mergeable=false / dirty, so no pull_request run has started. Landing waits on a conflict-free head with Lint & Repo Gates and TypeScript Type Check at success, and every other check green, including CI's full plugin-grid run, which the dev narrowed locally.
5. 接受的偏差 / 范围外:
   • The grid's inline editor stops narrowing on warning, inactive and insert-only machines. That is intended, it matches where the server refuses, and the changeset names it.
   • The detail-page inline editor (plugin-detail) is a third surface that still offers every option. It is left out on purpose, because seat 1 holds those files, and is noted here.
6. 落地条款: no governed path, +704/−55, scripts/sdui-manifest.record.json re-recorded, and a root .changeset/ patch for core, plugin-form and plugin-grid. A merge of main that changes only the conflict resolution and the re-recorded manifest keeps this ACCEPT, and the seat re-records the contract review at the new head. The seat then lands it through relay pr_ready + automerge_enable once the checks are green.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 39f9d3be5a66e0261e5455c6ff1ace4990f97aa1
Local-runs: none

Scope: same declaration face as the PASS at 80690c5b (comment 6413093140). The head moved only by merging main (904af38f) and re-recording scripts/sdui-manifest.record.json. The PR's file list at this head is the same 16 files plus that manifest record, 17 in all.

① Derived judgments

Unchanged from 6413093140. The same new @object-ui/core export stateMachineNextValues, the same plugin-grid re-export, and the same optional GateFormFieldsOptions.previousValues. The merge brought in no change to these files.

② Semver level

Unchanged: patch on core, plugin-form and plugin-grid, with Metadata-protocol: none.

③ Boundary flags

None new. Regen-provenance: scripts/sdui-manifest.record.json re-recorded with node scripts/gen-sdui-manifest-node.mjs at the merged head (check-sdui-manifest exit 0, per the card thread's report).

Implemented-by: claude/project-thread-aetoxp
Reviewed-by: session_01SMps7wq7rBTk53e8KTSEup

VERDICT: PASS

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40354367596 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test UI (11/16) — 失败步骤: Run the ui tests (shard 11/16)

  × has no near-spelling for any of them — unlike objectui#6041, nothing here is a rename 6ms
  FAIL   unit  packages/app-shell/src/services/MetadataService.specKeyObjectPayload.test.ts > the instrument > has no near-spelling for any of them — unlike objectui#6041, nothing here is a rename
    ↳ 失败原因: AssertionError: expected 48 to be 47 // Object.is equality
  

• Test UI (12/16) — 失败步骤: Run the ui tests (shard 12/16)

  × has no on/off flag to rename to — `enable` is a capabilities object, not a boolean 6ms
  FAIL   unit  packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts > objectui#6238 · the schema oracle — both tombstone keys are refused BY NAME > has no on/off flag to rename t
    ↳ 失败原因: AssertionError: expected 48 to be 47 // Object.is equality
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• packages/app-shell/src/services/MetadataService.specKeyObjectPayload.test.ts — 24h 内已弹出 4 个 PR（feat(ui): an edit form's state-machine select offers only the moves the server accepts #26033、fix(app-shell,react,plugin-detail): fold an override-only admin's approval levers into one menu and draw Recall once #26053、refactor(devx): move the four inline ESLint rule plugins into a private workspace package #26177、fix(console): keep the build-identity define out of the other ui test projects #26197），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: packages/app-shell/src/services/MetadataService.specKeyObjectPayload.test.ts #26222（已刷新）
• packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts — 24h 内已弹出 4 个 PR（feat(ui): an edit form's state-machine select offers only the moves the server accepts #26033、fix(app-shell,react,plugin-detail): fold an override-only admin's approval levers into one menu and draw Recall once #26053、refactor(devx): move the four inline ESLint rule plugins into a private workspace package #26177、fix(console): keep the build-identity define out of the other ui test projects #26197），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts #26223（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 31 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)