fix(lint)!: refuse a stored sort on a sortable: false field, on list views and every stored page sort - #30084

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/lint, @objectstack/spec, touching 23 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

38 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json d79eecfe5b78598f9117726b542615ca2332d58f.

⛔ 12 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 497170c2e0c081b9595f6ace8a9542edd7b04512 && git checkout 497170c2e0c081b9595f6ace8a9542edd7b04512
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d79eecfe5b78598f9117726b542615ca2332d58f c745679c608b987d8810d2b3a2c4b27e03991d62 && git checkout -B drift-repro d79eecfe5b78598f9117726b542615ca2332d58f && git merge --no-ff c745679c608b987d8810d2b3a2c4b27e03991d62

node scripts/docs-audit/affected-docs.mjs --json d79eecfe5b78598f9117726b542615ca2332d58f

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d79eecfe5b78598f9117726b542615ca2332d58f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c745679c608b987d8810d2b3a2c4b27e03991d62
Local-runs: none
Scope: card #30023 body and all three comments (triage 6625679577, Claim 6629587477, dev report 6630951308); the seat order /mnt/project-files/server-orders/30023.md; the dev report and replacement body under /mnt/project-files/issue-30023/ against the live PR body (identical); git diff origin/main...pr-30084 in full (two linear commits, 10 files, +710/−44); PR #30021's delta review 6625831334 and its merged changeset .changeset/29896-field-sortable-false-honoured.md (140d8ce); precedent #9257 and its PM review; scripts/check-adr-0087-registration.mjs (already-registered branch), scripts/pm/clause2-line.mjs (arm reader), AGENTS.md Post-Task Checklist §3; resolveObjectSortability / fieldEntriesOf (sortability.zod.ts), walkPageComponents (page-walk.ts), ObjectSearchTarget (validate-searchable-fields.ts), validateReferenceIntegrity dispatch and DEFAULT_MEMBER_RUNTIME_TYPES, runtime-gate.ts:1178, the per-write snapshot in protocol-authoring-gate.ts; the spec sort: keys in component.zod.ts / page.zod.ts; the UI consumers of each walked slot (element-data-source.ts, recordBinding.tsx, record-related-list.tsx, recordPagePayload.ts, LineItemsPanel.tsx, ObjectGrid/Calendar/Gantt/Map/Timeline.tsx, plugin-list/index.tsx, InterfaceListPage.tsx:503, PageView.tsx); validate-page-field-bindings.ts; liveness/page.json; the 23 Supersedes precedents in changeset history; the head's 64 check-runs.

Face: a narrowing of the publish gate. validate-sortable-fields now judges a stored sort by resolveObjectSortability's projection for both reasons, so a sort naming a field declared sortable: false is sort-field-unsortable at error on the five list-view rungs it already walked; it newly walks every stored page sort (block sort, element dataSource.sort, parentDataSource.sort, interfaceConfig.sort, record.sort) for the projection's verdict only, which also refuses a formula sort on those page slots for the first time; validateReferenceIntegrity dispatches on a page write for this one member. protocol.ts / engine.ts untouched; no facade row owed.

① Derived judgments

• Same projection as the door, both reasons, at the A view's declared sort naming a formula field clears lint, then 400s on every load — the SORT axis has no authoring gate, unlike SEARCH (#6674) #9257 level. unsortableFinding reads projection[name].sortable === false and branches on reason === FIELD_UNSORTABLE_AUTHOR_DECLARED; the projection is resolveObjectSortability(obj).fields over the authored object (indexObjectSortability), the resolver assertSortFieldsExist refuses by. The virtual message is byte-identical to before; the author-declared message carries the door's clause (a field on object "X" that declares \sortable: false`). Both error, the level #9257 landed (validate-sortable-fieldshas always beenerror; triage and the PM review on #9257 ruled it). A formulafield also markedfalsekeepsvirtual-type` because the projection does (pinned on the view and on a page).
• The second narrowing (virtual sorts on page slots) is real and declared. Before, no page sort was judged for sortability at all, so a page formula sort published green. The Clause-② line says "where a formula sort is now refused too", the Before bullet names it, and a lint pin plus a route control cover it. Same kind (narrowed), one arm; nothing extra owed.
• Every walked surface reaches the data door. dataSource.sort → element-data-source.ts:503 composes config.sort ?? view.sort into the read; parentDataSource.sort → ParentRecordBinding (recordBinding.tsx:515 $orderby); record:related_list sort → recordPagePayload.ts:169 → related[].sort → findData; record:line_items sort → LineItemsPanel.tsx:400 convertSortToQueryParams(schema.sort); object-grid/calendar/gantt/map/timeline sort → each renderer's $orderby: convertSortToQueryParams(schema.sort); page list-view → ListViewRenderer (a list view's own sort); interfaceConfig.sort → InterfaceListPage.tsx:503; app page record.sort → PageView.tsx:236 $orderby. No false-refusal surface. The PAGE_BLOCK_SORT_OBJECT_PROP table equals the live sort: keys of ComponentPropsMap (seven sort: declarations plus ListViewPageProps' spread; element:record_picker / element:repeater are tombstones), and that equality is pinned with a non-vacuity control.
• No missed surface. Dashboard sortBy and report order[].by are dataset names (as A view's declared sort naming a formula field clears lint, then 400s on every load — the SORT axis has no authoring gate, unlike SEARCH (#6674) #9257 settled); kind: 'react' pages are validate-react-page-props' (and walkPageComponents already skips them). Nothing else under packages/spec/src/ui carries an object-field sort.
• Binding precedence matches the renderers. elementDataSourceBlock maps dataSource.object onto the block's object key, so a block sort is judged against dataSource.object ?? <block prop>; interfaceConfig.source ?? page.object matches InterfaceListPage. An object from another package has no projection and is skipped (no refusal on an unresolvable binding).
• The page door crossing is real and pinned through the real route. validateReferenceIntegrity filters members by options.runtimeWriteType (runtime-gate.ts:1178 sets it to the written type); members without runtimeTypes default to ['flow'], and validateSortableFields is the only member naming page, so a page write runs exactly one member. The per-write snapshot gathers objects on every write (protocol-authoring-gate.ts listCollection('object', 'objects')), so the member has its universe and no missing-collection channel. Pinned at saveMetaItem({ type: 'page' }) on the stub-engine harness: 422 INVALID_METADATA at the four slot paths, nothing stored; the view door likewise; the dispatch roster pin lists validateReferenceIntegrity. Ablation B (drop page) reds exactly the 4 page slots plus the page virtual control; ablation A (author-declared guard off) reds the 7 author-declared cases and the 5 route refusals, controls green. Reported, not re-run here.
• Exported core stays compatible. checkSortDeclaration's new trailing sortability is optional; absent, the projection is derived from ObjectSearchTarget.fields, which carries type/hidden/searchable and no sortable, so an out-of-repo caller gets the virtual-only answer, as pinned. validate-sortable-fields.ts is the only in-repo caller.
• Entry text matches the code. surface lists exactly the eight blocks in the table plus the four other slots; acceptanceCriteria is phrased as the os validate finding; the "Lint does not yet judge" sentence is replaced truthfully (the page door now dispatches). The committed docs/protocol-upgrade-guide.md carries neither 18.x entry on main, so it lags unreleased entries by design; no regeneration owed.
• Corpus. No shipped object declares sortable: false; the rule gives 0 findings over the four example apps, and the all-fields-false probe fires on two showcase interfaceConfig.sort slots, so the page walk is live on real metadata. Reported.

② Semver level

@objectstack/lint and @objectstack/spec both minor; Clause-②: yes (narrowing) with one arm; Metadata-protocol: narrowed; BREAKING banner with Before / Now / Not changed / The remedy. Judged the same: a metadata value refused is narrowed, which takes at least minor on each moved package. "The widening half:" is prose after the arm, not a parenthetical, so readClause2Line reads one arm (the identical spelling in #30021's changeset passed). No FROM → TO label is owed: AGENTS.md ties that mapping to removing or renaming an authorable thing, nothing is removed here, and #30021 (140d8ce) landed the same class with Before/Now/Remedy and no literal label. ADR-0087: not-required (already-registered field-sortable-false-sort-refused) is valid. The id resolves at HEAD and existed at the merge base (140d8ce is an ancestor of c23501b), the why clears 40 characters, and the branch continues before the prescription-contradiction check, so "The remedy." is allowed; registered would be refused by R4 as the dev says, and #9257 used this very category (already-registered engine-find-formula-order-by-refused). Supersedes paragraph: the bolded "Supersedes, in the same release." form is the repo's established shape (the #29904, #27008, #26660 notes), the superseded note is still in .changeset/ on main (unreleased; last version-packages commit predates 140d8ce) and does contain "Lint does not yet judge these at authoring." Skills-docs none — REASON is in the closed vocabulary.

③ Boundary flags

• CI at head: 64 check-runs, 55 success, 9 skipped, 0 failed (Test Core 8/8, Test UI 16/16, Type Check UI, Build & E2E UI, Live E2E UI, all lint and type-check gates, Check Changeset, PR-body guards, Governed Surface Queue Guard, Spec property liveness).
• Existence on page sorts is uneven and pre-existing: validate-page-field-bindings reads block sort and interfaceConfig.sort (at warning), but nothing reads element dataSource.sort or an app page record.sort for an unknown name; that name reaches the door and answers 400. Out of this card's scope (the order confined it to the sortability verdict); the dev's class-b finding covers the severity half only.
• The object publish door does not run validateSortableFields (member lacks object; the reference-integrity-suite.ts note reserves that crossing), so an object write carrying sortable: false and a built-in listViews.*.sort on the same field saves and fails at read; os validate catches it. Pre-existing, reported by the dev.
• liveness/page.json grades every props.record.* row planned while PageView.tsx#appPageRecordBinding reads record.sort; stale ledger, not moved here.
• Nit, not owed: a block carrying both dataSource.sort and its own sort has the binding override the block's (element-data-source.ts "binding overrides view"), so the inert properties.sort is still judged. The list-view rungs already behave this way; consistent.

④ Narrowing face

• validate-sortable-fields.ts: one projection, two messages, error; the page walk uses the shared walkPageComponents (cycle-safe, source-authored pages skipped) and asks only the sortability question, so no name is reported twice.
• reference-integrity-suite.ts / authoring-rules.ts: page on the member and on the suite entry; the entry's rationale comment names the one member a page write reaches.
• 18.field-sortable-false-sort-refused.ts: surface, reason and acceptance criteria widened to the full stored list; shape unchanged.
• Changeset and PR body: identical declarations; disposition verified; Supersedes paragraph true of the unreleased field.sortable: false has no effect — the sortability projection still reports the field sortable, the data door sorts by it, and the list header and Sort picker offer it #29896 note.

Implemented-by: claude/project-thread-vyggze
Reviewed-by: session_01WGufzibcN9oHa8kDbTTnL5

VERDICT: PASS

domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5

席位核对

Verdict: ACCEPT at head c745679c608b987d8810d2b3a2c4b27e03991d62 · 2026-11-04T13:11Z

• Shape:

  • validate-sortable-fields judges a stored sort by resolveObjectSortability's projection for both reasons. A sort naming a field declared sortable: false is sort-field-unsortable at error on the five list-view rungs.
  • The rule newly walks every stored page sort (block sort, element dataSource.sort, parentDataSource.sort, interfaceConfig.sort, record.sort) for the projection's verdict only, which also refuses a formula sort on those slots.
  • validateReferenceIntegrity dispatches on a page write for this one member, pinned through the real saveMetaItem route.
  • The 18.field-sortable-false-sort-refused entry's surface text is widened to the full stored list.

• Review: the CONTRACT_REVIEW_TIER review at this head is PASS (record above).

• Premise measured: before/after on the lint and route pins. Ablations: A, the author-declared guard turned off (7 cases + 5 route refusals red); B, page dropped from runtimeTypes (4 page slots + the virtual control red). Each was red, then restored. The corpus gives 0 findings over the four example apps, and an all-false probe fires on two showcase interfaceConfig.sort slots.

• Declaration: Clause-②: yes (narrowing), Metadata-protocol: narrowed, minor on @objectstack/lint and @objectstack/spec, BREAKING with Before / Now / Not changed / The remedy, adr-0087: not-required (already-registered field-sortable-false-sort-refused), and a Supersedes paragraph for field.sortable: false has no effect — the sortability projection still reports the field sortable, the data door sorts by it, and the list header and Sort picker offer it #29896's pending note. Reviewed as correct. No FROM → TO label is owed, because nothing authorable is removed or renamed (the same class as fix(spec,metadata-protocol)!: honour field.sortable false in the sortability projection and the data door #30021).

• CI (head): 64 check-runs, 55 success, 9 skipped, 0 failed.

• Accepted deviations: the harness-pinned branch claude/project-thread-vyggze. The seat files three follow-ups:

  • existence readers and severity for page sorts (element dataSource.sort, app page record.sort);
  • the liveness/page.json props.record.* regrade;
  • the object publish door not dispatching validateSortableFields.

  A nit is carried: the Supersedes paragraph could name the superseded file.

• Landing: on all-green at this head, the seat sends pr_ready + automerge_enable through the relay. It closes lint: a view sort naming a field the author declared sortable: false clears validate, then 400s on every load once #29896 lands — validate-sortable-fields judges only the virtual predicate #30023.