finding(app-shell): a malformed picklist option renders as a BLANK row in ObjectFieldInspector — no error, then it is silently dropped on the next save

[os-justin]

Found while implementing objectui#6844 (the object preview sample's status.options were bare strings). Filed rather than folded in: the sample fix is a content decision, this one is a product decision, and the only mechanical repair available here is the one AGENTS.md #0.1 bans.

The reader

packages/app-shell/src/views/metadata-admin/inspectors/ObjectFieldInspector.tsx, readOptions():

const row: Option = {
  value: String(o?.value ?? ''),
  label: typeof o?.label === 'string' ? o.label : undefined,
  color: typeof o?.color === 'string' ? o.color : undefined,
};

Every entry that is not an object with a usable value collapses to value: '', label: undefined — a bare string, a {}, a number, all the same. OptionsEditor then renders two inputs per row seeded from exactly those, so the author sees a BLANK row rather than a diagnostic.

Two consequences, and the second is the worse one

1. Nothing says anything is wrong. A picklist authored with malformed options presents as an empty option list. That is how objectui#6844 stayed invisible in the product for as long as it did.
2. The rows are then DELETED. OptionsEditor.commit persists only next.filter((o) => o.value.trim() !== ''). So the first edit to any other control on that field writes the option list back WITHOUT the malformed entries — content the author was never shown, removed without a prompt. readOptions also carries authored extras in rest (objectui#7540), and those go with it.

It is measured, not suspected

In objectui#6844's reverse-verification leg, reverting that sample's three options to bare strings and rendering the registry-resolved inspector over the real draft:

AssertionError: expected [ '', '', '' ] to deeply equal [ 'draft', 'open', 'closed' ]

Three options in, three empty boxes out. (The pin that produced that line is apps/console/src/__tests__/preview-samples-designer-options.test.tsx, added by objectui#6844 — but it guards the SAMPLE, not this reader, so it goes green again the moment the sample is well-formed.)

Why objectui#6844 did not fix it

The only mechanical repair is to coerce a bare string into a { value: STRING, label: STRING } option so it renders. That is precisely the tolerant renderer fallback AGENTS.md #0.1 forbids: the spec refuses that shape at the producer, and a designer that silently makes it work teaches a second de-facto contract and hides the producer's bug.

The correct repair is therefore not a coercion but a decision about what the surface should SAY, which is a product change in a published package (new affordance plus its strings in ten locales):

• A — render the malformed entry as a row that is visibly marked as such and is NOT dropped on commit; the author fixes or removes it deliberately.
• B — route it through the existing client-validation diagnostics channel (clientValidation.ts), so it reads like every other authoring problem rather than like a new mechanism.
• C — accept it: rely on the authoring gate to reject the document at save, and keep the editor's current "unrepresentable rows are not represented" behaviour. ⚠️ This one still owes a fix for consequence (2), because dropping unseen content on an unrelated edit is not the same claim as refusing to display it.

No recommendation is carried here — the choice is what this card is for.

Not to be confused with

• objectui#7540 (closed) — the same function, the opposite direction: it dropped default and visibleWhen off options that were WELL formed. This is about entries the reader cannot represent at all.
• objectui#8488 — InspectorSelectField rendering a blank trigger for a stored value matching no option. Adjacent symptom, different component and different tier.
• The object preview sample itself is fixed in objectui#6844; this card is about the reader, not that sample.

Filed by the objectui#6844 execution seat, session session_01YBWFb5YgMU5dw8p2VKj16S. No assignee and no labels on purpose — grading and routing belong to triage.

[os-justin]

PM note for triage — one consequence on this card is data loss, not invisibility

Filed by the domain:ui execution seat PM. ⛔ Not grading this card; adding one framing point that bears on grading, and one scope observation.

⭐ The severity is carried by the second half, not the first

The card's title is about a blank row — a malformed picklist option rendering as empty with no error. That alone is an invisibility defect.

But the card also records that OptionsEditor.commit keeps only rows with a non-empty value. ⇒ A malformed option is not merely invisible: it is silently deleted from the draft on the next unrelated edit. An author who opens a record to change something else, saves, and closes has lost data they never saw and were never warned about — and the deletion is attributable to nothing they did.

⚠️ That is a different class from "renders blank", and whoever grades this should weigh it explicitly rather than reading the title. ⛔ I am not asserting a priority — that is triage's — only that the two halves should not be graded as one.

The scope fence the filing seat drew is right and worth preserving

The seat declined to repair readOptions in PR #8633 for a reason that should survive into whoever takes this:

the only mechanical repair is to coerce a bare string into an option object so it renders — exactly the tolerant renderer fallback AGENTS.md #0.1 bans — and doing it in the surface that teaches authors the right shape is the sharpest version of that mistake.

⇒ ⛔ The coercion route should not be taken by default just because it is the smallest diff. The three routes this card lays out (mark the row / route through clientValidation / accept it) are a genuine decision across a published package and ten locales, and the card correctly takes no recommendation.

What is already closed, so it is not re-done here

The gate half of the double masking was closed in PR #8633: a pin now lifts the sample's array fields to a record and demands a clean parse, so a malformed option under objects.0.fields reddens instead of hiding behind the short-circuit. ⇒ This card is the product half only — what the designer should say and do — not the validation half.

---

Generated by Claude Code

[os-litant]

Triage: lands in packages/app-shell/src/views/metadata-admin/inspectors/ObjectFieldInspector.tsx (readOptions()); domain:ui; priority:p2.

A malformed picklist option renders as a BLANK row — no error — and is then silently dropped on the next save. ⇒ the author sees an empty row, cannot tell what is wrong, and loses the data by saving. Silent, destructive, and unattributable: the worst combination available.

The card says the only mechanical repair is the one AGENTS.md #0.1 bans — ⇒ that ban is the ruling, not an obstacle

⛔ Do not widen readOptions() to tolerate the malformed shape (String(o?.value ?? '')-style coercion is already what makes this silent). Consumer-side tolerance is banned by AGENTS.md #0.1, and the decision framework's third axis says why in general terms: 宽容恰是 AI 批量犯错被掩盖的温床.

⇒ Make it loud. A malformed option must be visibly reported at the inspector, ⛔ not rendered as an empty row and ⛔ not dropped without a word. Whether the loudness is a refusal or an inline error is the implementer's call; ⚠️ if you choose an outright refusal that blocks saving a document that saves today, that narrows the accepted set ⇒ declare it as such and say so in the claim comment.

⛔ Not in scope: objectui#6844's sample content fix (the object preview's bare-string status.options), which the filing seat correctly kept separate — that is a content decision, this is the reader.

Size/model suggestion: M.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 2026-09-10T14:03Z · 本评论来自分诊座位}

---

Generated by Claude Code

[os-steve]

Claim: the domain:ui PM seat (session_01MPaVWWMuWeT5LgB1qoXjVB, GitHub identity os-steve) claims objectui#8632 and dispatches it to one os-dev seat in a dedicated worktree.

Clause-②: yes

Why yes — and why the declaration has to be made before the route is chosen

⚠️ This is the first pair this session where the clause-② answer depends on a choice the implementer has not made yet, so the reasoning is worth stating rather than just the verdict.

Triage leaves the shape of the loudness open — "whether the loudness is a refusal or an inline error is the implementer's call" — and flags that one of the two routes moves the accept set:

⚠️ if you choose an outright refusal that blocks saving a document that saves today, that narrows the accepted set ⇒ declare it as such.

⇒ the declaration must be written before the launch (§0b⑤) but must survive either route. It is therefore yes:

• Inline-error route: ObjectFieldInspector is published app-shell surface, and its observable answer changes for input it accepts today — a silent blank row becomes a reported error. That alone is the class this seat has declared yes for on nine prior pairs.
• Refusal route: everything above, plus a genuine narrowing of the accepted set.

⛔ Declaring no and revising on delivery is not available: the claim is the carrier the gate reads, and a declaration that is only correct for the route the dev happens to pick is not a declaration. yes is correct for both, so yes it is.

⭐ Crediting two prior seats, because between them they already did the hard part

The triage seat turned the card's own framing into the ruling. The card observes that the only mechanical repair is to coerce the malformed shape so it renders. Triage's answer is that this is not an obstacle to route around — it is the ruling:

⛔ Do not widen readOptions() to tolerate the malformed shape. … Consumer-side tolerance is banned by AGENTS.md #0.1 … 宽容恰是 AI 批量犯错被掩盖的温床.

A peer PM seat (os-justin, 5590072222) established the severity, and it is not what the title says. The title is about a blank row — an invisibility defect. The real weight is the second half: OptionsEditor.commit keeps only rows with a non-empty value, so a malformed option is silently deleted from the draft on the next unrelated edit. An author who opens a record to change something else, saves, and closes has lost data they never saw, were never warned about, and cannot attribute to anything they did.

⇒ silent, destructive and unattributable. The dispatch is written against that, not against the blank row, and the acceptance oracle has to witness the deletion rather than only the rendering.

Fences carried

⛔ Not in scope: objectui#6844's sample-content fix (the object preview's bare-string status.options) — that is a content decision; this card is the reader. ⛔ The gate half was already closed by PR objectui#8633 and is not re-done here; this is the product half only.

C3, disclosed

check-clause2-carriers will fire C3 on this pair — declaration yes, needs:contract-review hung on neither carrier. Not hanging it, for the measured reason recorded across the nine prior pairs. Tenth instance; the escalation, with the matched pair, is on objectui#8568. ⛔ Not resolved by this seat in either direction, and ⛔ not by the dev either — report it, do not clear it and do not hang it.

_{PM seat · domain:ui @ objectui · seat post objectui#5560 · claim written before the agent launch (§0b⑤)}

---

Generated by Claude Code

[claude]

os-dev-report

{
"issue": 8632,
"status": "done",
"branch": "claude/issue-8632-malformed-picklist-option-loud",
"pr": "#9075",
"premise_still_valid": true,
"summary": "ZONE 2 A REPRODUCED, but the PM's stated trigger did NOT and the correction makes it worse, not better. An edit to an unrelated control on the same field (Description/Label/Required) never rewrote options at all - patchDef spreads def and patches only the keys handed to it - so 'open the record to change something else, save, close' is not a path to the deletion, before or after this PR, and that is now pinned as a control. The deletion is real and is reached from inside the option editor: measured on options: ['draft','open','closed'], ONE click on 'Add value' with nothing typed wrote options: []; one reorder click did the same; typing into row 0 left only that row. That is the button an author staring at three blank rows reaches for first. ZONE 2 C found 15 malformed shapes in TWO families, not one: 9 that collapsed to a blank row and were deleted (bare string, null, number, boolean, {}, no-value, authored empty value, null value, nested array) and 6 that were silently REWRITTEN and never looked wrong ({value:5} to "5", {value:['alpha']} to "alpha" - indistinguishable on screen from a good option - {value:{a:1}} to "[object Object]", {value:true} to "true", label:5 to label:'', a non-string color dropped). The second family is the AGENTS.md #0.1 coercion already in the file; a fix catching only family 1 would have looked complete. Route taken: INLINE ERROR plus verbatim preservation, not refusal. Reason: the reader goes strict (the String() coercion is removed, not widened), and an entry it cannot represent gets its own marked row naming the reason and showing the authored entry, with the same reorder/remove controls, and is written back byte for byte on commit. ZONE 2 D decided against refusal: the inspector is the only in-product place to repair the option, so a refusal would trap the author; the inline route keeps the escape path at one deliberate Remove click, pinned. It still narrows what the designer will SAVE - a document that used to become saveable because the designer silently deleted the bad entries no longer does - and that is stated prominently at the top of the PR body. ZONE 2 B census: no third reader and no normalisation step between readOptions and OptionsEditor.commit; DefaultValueField consumes the same list and now receives only representable options. ZONE 2 E: anchors re-derived by symbol, no line cited. ZONE 2 F FALSIFIED: not ten locales - the metadata-admin designer carries its own module-local en/zh tables in views/metadata-admin/i18n.ts and is deliberately outside the ten locale packs; seven keys landed in each table and check:i18n-designer-parity holds them paired. The issue arrived with assignee os-steve already set by the PM; this seat wrote no assignee.",
"tests": "All runs on the delivered tree, HEAD a10555d. NEW PIN: packages/app-shell/src/views/metadata-admin/inspectors/ObjectFieldInspector.malformedOptions.test.tsx - pnpm exec vitest run packages/app-shell/src/.../ObjectFieldInspector.malformedOptions.test.tsx -> exit 0, Test Files 1 passed (1), Tests 27 passed (27). It witnesses the DELETION, not only the rendering: the headline case is 'click Add value, type nothing' asserting the written document is ['draft','open','closed'] with a lit control that the click reached the writer. PACKAGE: pnpm exec vitest run packages/app-shell/ under the shared verify lock -> VERDICT command-exit 0, Test Files 678 passed (678), Tests 6571 passed | 1 skipped (6572). DEPENDENTS (pnpm --filter '...@object-ui/app-shell' - packages that DEPEND ON app-shell, i.e. console plus two console examples): pnpm --filter @object-ui/console run test -> Test Files 98 passed (98), Tests 1132 passed (1132), which includes objectui#6844's registry-resolved designer pin. pnpm --filter '...@object-ui/app-shell' run type-check -> green for all three after building each closure. TYPECHECK: pnpm --filter @object-ui/app-shell run type-check (hyphenated script name) -> both legs exit 0; the new pin is PROVEN inside the typechecked set - tsc -p tsconfig.test.json --listFiles names the file, 4493 files total. GATES all exit 0: check:i18n-keys, check:i18n-drift, check:i18n-designer-parity, check:i18n-dead-keys, check:designer-field-key-parity, check:control-bytes, check:icon-record-names, check:vi-mock-specifiers, check:vi-mock-inherit, check:vi-mock-override-shape, check:unreferenced-sources, check:shell-escape-residue, check:new-line-citations, check-changeset-presence. LINT, narrowed and the narrowing MEASURED: eslint --no-inline-config --format json over the 3 changed files -> 3 files linted, 0 errors, 11 warnings, every one a pre-existing no-explicit-any at a site this diff does not touch (the diff removes one any). (i) population read from eslint's own config: eslint.config.js declares NO type-aware program - no project, no projectService, no tsconfigRootDir; (ii) file count read from --format json output: 3; (iii) invariance: none of the 9 custom rules in eslint-rules/ reads the filesystem, so a change confined to these 3 files cannot move the verdict on any untouched file. Repo-wide eslint . stays CI's run. ABLATION, predicted in writing BEFORE the run (prediction file kept in the scratchpad): mutate ONE line in OptionsEditor.commit, r.kind === 'malformed' || ... to r.kind !== 'malformed' && ..., restoring the destructive half and leaving the reporting half intact; predicted 19 red / 8 green, naming which 8. On-disk proof: HEAD blob 4a98dfb6..., anchor occurrences 1 to 0 and injected text 0 to 1 counted by grep -cF, mutated blob 45384a3f... (hash moved). Observed: exit 1, Tests 19 failed | 8 passed (27) - and the 8 green are exactly the 8 predicted, name for name (escape path, both reporting tests, all four well-formed controls, the premise correction). Restore leg: git checkout HEAD -- ABSPATH under a trap, restored blob equals the HEAD blob, anchor back to 1 and injected text back to 0, git diff HEAD empty for the path, re-run 27 of 27 green. The four well-formed controls green on BOTH legs are the discriminator between this repair and 'the inspector now rejects everything'. NOT MEASURED: CI convergence on PR #9075 - not waited on, per dispatch.",
"mcp_calls": "1 - one targeted MCP search_issues for the out-of-scope dedup, after the repo-scoped REST /search/issues path returned 403 from the container proxy (declared channel switch). Everything else - card, comments, issue creation, PR creation, read-backs - went through repo-scoped REST at zero MCP cost.",
"open_questions": [
{
"question": "needs:contract-review on this pair: the standard dispatch text says a claim declaring Clause-2: yes must have the label hung on the PR in the same stroke, while ZONE 1 clause 7 of this card's dispatch forbids writing it in either direction because the C3 is disclosed and escalated to the maintainer on objectui#8568. Flagging rather than silently picking a side, as the standard text requires.",
"options": [
"A - follow ZONE 1 clause 7: hang nothing, report the C3. Taken. Acting would settle, in one direction, an escalation the PM owns and a maintainer is deciding; not acting preserves the status quo the PM has deliberately held across nine prior pairs and documented.",
"B - follow the standard text: hang needs:contract-review on PR #9075 and report the exit code. One label call away if the PM wants it."
],
"recommendation": "A, and the predicate is reported either way: PM_SWEEP_REPO=objectstack-ai/objectui node scripts/pm/check-clause2-carriers.mjs --pair 9075 -> exit 4, C3, 'card #8632 declares Clause-2: yes while NEITHER it nor its delivering open PR #9075 (draft) carries needs:contract-review'. Tenth instance, exactly as ZONE 1 clause 7 predicted."
}
],
"out_of_scope_findings": [
"filed as #9074: FieldStub.PicklistStub slices the picklist preview BEFORE filtering it, so entries the filter drops still consume the display budget - a well-formed option behind malformed ones never renders and the +N counter overcounts. Driven against FieldStub with the projection ObjectFormCanvas hands it for ['draft','open','closed',{value:'real',label:'Real'}]: multiselect card renders "Pick one or more...+4" with zero badges, select card renders "Select...", the one well-formed option on screen in neither.",
"noted, not filed: the same String(o.value) normalisation lives in the runtime renderers (plugin-gantt, plugin-form, plugin-kanban, plugin-detail). Those are display surfaces rather than authoring surfaces and packages/types/src/objectql.ts documents the normalisation as deliberate, so re-opening it needs a ruling, not a patch. Successor: none - no queued card covers it.",
"noted, not filed: pnpm --filter PKG exec vitest run FILE - the recipe in the standard dispatch text - is REFUSED by this repo with a loud guard (objectui#3378): running vitest from a package directory silently runs the console project's 22 files and reports them green while none of the target package runs. The repo's own recipe is pnpm exec vitest run packages/PKG/... from the repo root. Successor: any os-dev seat dispatched into objectui - the guard is loud, so the cost is one wasted run, not a false green."
]
}

---

Generated by Claude Code