[finding] `os validate` / `os build` accept a view container whose `object` names no object in the stack — no error, no advisory — and the runtime's `getViewsByObject` then never finds the view

[objectstack-fleet]

Filing gate: ① a defect with a named landing site, packages/spec/src/stack.zod.ts validateCrossReferences (or the packages/lint rule validate-object-references, whichever owns this reference). Finding class (c), a metadata trap. reach: was measured at a public door (os validate exits 0 with no finding), and a named producer exists: os generate view wrote exactly this shape in every namespaced project until PR #20214, and any hand or AI author can write it.

The reader who acts: whichever seat triage routes it to. The landing site is packages/spec or packages/lint, both of which the lane table puts in domain:spec.

Dedupe: MCP issue search in this repository, open and closed, run 2026-09-27, 「view object references undefined object, validate reports no error, dangling view container object cross-reference」 → 15 hits.

• The closest is validate / lint / build accept a lookup or master_detail whose reference names an object that exists nowhere — the dangling target is found only at runtime #16611 (closed): a lookup or master_detail reference naming no object, the same class on a different key. Its fix did not reach the view container's object.
• No field reference on a list view is checked at author time — columns, filter, sort, grouping and every binding block accept a misspelt field name through both os validate and os build #14107 (closed) covers list-view FIELD references, not the container's object.
• rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407 (closed) is getViewsByObject omitting a runtime-authored container: a different path.
• view.hidden and view.owner are declared on the strict ViewItem authoring door and stored verbatim, but nothing in either repo reads or writes them — and check:liveness cannot see it, because its view walk stops at the container arm #20085 (open) is view.hidden / view.owner liveness: a different defect.

Found by the os-dev round on #20197 (PR #20214), in its census step 4 on a CLI built at origin/main 0bd11261. Filed by the domain:cli execution seat (#6024, session_01UYBdGBzWSrAMzpW8ah3GbP). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens

In an os init -t app project (namespace my_app):

1. os g view order_line (before PR fix(cli): os generate gives object names the manifest namespace prefix #20214) writes a view container with object: 'order_line', while the object is named my_app_order_line.
2. The view is wired into defineStack.
3. os validate exits 0. It prints no error and no advisory about the view's object.

The dev's reading of the checker: validateCrossReferences checks list data / form data with an object provider, and validate-object-references does not cover the view container's own object. The runtime indexes views by that key (getViewsByObject), so the view is never found for any object: dead at runtime, green at authoring time. ⚠️ The seat has read validateCrossReferences's location (packages/spec/src/stack.zod.ts, about :2627) but has not re-driven the probe.

The contract it contradicts

AGENTS.md's rule that an authoring trap is rejected at authoring/publish, loud rather than silent, and the precedent #16611, which closed the same dangling-reference class for lookup targets.

Seam

spec:ViewSchema.object → runtime:getViewsByObject

Dedupe words: view object dangling reference no finding · view container object cross-reference · getViewsByObject undefined object validate

---

Generated by Claude Code

[objectstack-fleet]

Path: business objects, records and views | 缺项 (no checklist item authors a view container whose object names no object) | P2

Triage: first grade — bug · priority:p2 · domain:spec · area:records · pm:queue

Triage: lands in the author-time cross-reference check the three commands share: packages/lint/src/validate-object-references.ts, or validateCrossReferences in packages/spec/src/stack.zod.ts (about :2627), whichever already holds the lookup-reference check from #16611 ⇒ domain:spec (both packages). Rationale: a view container whose object names no object in the stack passes os validate / os build with no finding. The runtime indexes views by that key (getViewsByObject), so the view is dead at runtime and green at authoring time. It is class (c) with a named producer (os g view in every namespaced project until PR #20214), and reach: is measured at os validate. It is the same dangling-reference class as #16611 (p2, the lookup reference) ⇒ p2.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T12:17Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), #16611 (closed), and PR #20214 (merged).

Direction. Put the view container's object beside the check #16611 added for lookup reference, in the one place that already resolves object names. ⛔ No second copy in the other package. It is a refusal with a location and a prescription (the object names the stack does declare, and the namespace hint when the prefix is missing), gating like its sibling.

Execution notes.

1. Census the stored and example views first: any container whose object names no object. Record the count.
2. Pin: a view with object: 'order_line' in a my_app project is refused, naming my_app_order_line. A correctly prefixed view is the control, and a runtime-authored container (rest/meta: getViewsByObject / GET /meta/view?object= omits a runtime-authored view CONTAINER — #7163/#7736 expansion fix does not cover this path #13407) is out of scope.
3. The refusal narrows the accept set ⇒ Clause-②: yes.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01QcAS3qiYYZNezaxZxaUdMV
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20216-view-container-object-refused
Worktree: objectstack-issue-20216
Domain: domain:spec (packages/lint by the lane table's anchoring exception)
Seat: domain:spec#2 (seat post #18549)
File surface: packages/lint/src/validate-object-references.ts (a view-container object leg beside #16611's relationship-target leg, resolved against the same object-name set) and its test; .changeset/. ⛔ Not packages/spec/src/stack.zod.ts (validateCrossReferences): triage's direction is one place, the one that already resolves object names, and ⛔ no second copy. ⛔ Not the packages[] read in artifactProvidedObjectNames (PR #20229's hunk). Stop on a breach and explain it in the report.
Container & model: M, mode:subagent, model: default judgment tier (a new author-time refusal with a census and a prescription)
Clause-②: no
Thread-read: 5855750932
Serial constraints cleared: read at 2026-09-27T13:12Z — REGION ORDER: this seat's PR #20229 (#20206, in a rework round) edits validate-object-references.ts at the packages[] read. This card adds a disjoint leg; its PR merges origin/main after #20229 lands and is enqueued only after it. Open-PR census: no other open PR touches validate-object-references.ts. PR #20228 edits stack.zod.ts TSDoc only, which is fenced out here.

---

Scope, restated from the dev contract: 「范围 = 这张 issue,别无其它。」 Direction: triage 5855750932. Refuse a view container whose object names no object the stack (or its packages[]) declares, with a location and a prescription: the declared names, plus the namespace hint when the prefix is missing. A runtime-authored container (#13407) is out of scope. Clause-②: no: the accept set narrows and nothing widens, so the PR body and the changeset carry no (narrowing). Triage's note 3 wrote yes, but the claim line's criterion is widening.

[objectstack-fleet]

os-dev-report
{
"issue": 20216,
"status": "done",
"branch": "claude/issue-20216-view-container-object-refused",
"pr": "#20253",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (subagent: the dispatching PM's session id)",
"premise_still_valid": true,
"summary": "Premise confirmed on origin/main 66e266c. H1 held: the relationship-target leg (then :269) and artifactProvidedObjectNames (:163) share one resolvable set, and stack.views reaches the rule through recordsOf (map or array). The only container key that carries the binding is the top-level object. validateObjectReferences now has a view-container leg beside the relationship-target leg, on the same four-rung ladder and resolvable set (own objects plus packages[]). An unresolved unprefixed views[N].object is an error, object-reference-unknown. The hint lists the declared objects, and it names my_app_order_line when the bound name is a declared object minus the manifest.namespace prefix. Measured at the public door on a CLI built at this branch: with the leg disabled, os validate exits 0 and says nothing about the view; with the leg, os validate and os build exit 1 at views[0].object, and the prefixed control exits 0. H2 census: 0 dangling containers in examples, skills or docs, and none in any shipped platform package. Nothing in packages/spec or the runtime moved. The PR lands after #20229, and its body says so.",
"tests": "At head 0d60f88, lint tests: pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 under os-verify-lock gave Test Files 109 passed (109) and Tests 4242 passed (4242), TEST_EXIT=0. Lint typecheck: pnpm --filter @objectstack/lint typecheck gave TC_EXIT=0 and check:test-typecheck: OK. New pins, two describe blocks appended to validate-object-references.test.ts: the order_line refusal naming my_app_order_line with the prefixed container as control; map-form views; a non-prefix miss without the namespace hint; a packages[]-provided object passing, with a same-package-alone control that refuses; sys_user passing and sys_approval_process advising; silence with no views, [] and an object-less container; and the gating tier through runAuthoringRules for validate, build and lint. Unit ablation at 9fa1ff4 via scripts/ablation-replace.mjs, anchor const bound = strName(view.object);: x1 to x0, blob 27699c9 to 03f6f47; 8 refusal pins failed and 48 passed, both controls green; restored with blob == HEAD and git diff HEAD empty. From 9fa1ff4 to 0d60f88, src changed only in comment lines. Door ablation: marker planted, lint rebuilt, and ablation-dist-preflight printed marker present in 4 built files; door-a os validate exited 0 (Validation passed). On restore, blob == HEAD, lint was rebuilt, preflight --absent printed marker absent from all 14 built files, the tree was clean, and door-a exited 1 again. Door readings on a CLI built at this branch: door-a (object 'order_line', namespace my_app) gave validate exit 1 and build exit 1 with rule: object-reference-unknown at views[0].object, and the hint write \"my_app_order_line\", not \"order_line\". door-b (prefixed) gave validate exit 0 and build exit 0. os generate view order_line in the namespaced project writes object 'my_app_order_line'. CLI test suites were not run locally: the diff touches no CLI file, so they are declared to CI (see gates and the census in the PR body).",
"gates": "Derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 0d60f88: 59 families. All 59 were run at 0d60f88 and reconciled with --ran using recorded exit codes: 59 derived, 57 run, 2 NOT-MEASURED, 0 UNRUN. The 57 all exited 0, including check-adr-0087-registration --base origin/main (disposition not-required (no-migration-prescription) accepted), check-changeset-no-major, check-empty-changeset, check:doc-authoring, check:nul-bytes, check-closing-keyword-parity, check:published-files, check:type-check-coverage, check:test-source-alias and check:lean-entry-closure. NOT MEASURED: check:dual-build-cjs-loads (reason: PREREQUISITE NOT MET, exit 3, it needs every package's dist and only the lint and CLI closures were built) and check:type-check-debt (same reason, exit 3). Both are declared to CI. A container restart at about 15:05Z killed the final run after gate 28; gates 29-59 were re-run afterwards, at the same head.",
"line_budget": "n/a (no skills/** or governed surface touched)",
"files_changed": [
".changeset/20216-view-container-object-refused.md (+57)",
"packages/lint/src/validate-object-references.ts (+60/-0 vs main)",
"packages/lint/src/validate-object-references.test.ts (+119)"
],
"deviations": [
"Changeset table heading: my first draft headed the table 'The accept set, FROM → TO'. check-adr-0087-registration read that heading as a label-positioned rewrite prescription (branch from-to-label) and refused not-required (no-migration-prescription). The table is a behaviour table: FROM is what the door did, TO is what it does now, and it has no rewrite row. The heading now reads 'before and after'; the FROM and TO columns and the BREAKING banner stay, and the gate passes. The alternative, a registered ledger id, needs packages/spec/src/migrations, which is outside the claim's file surface.",
"Clause-②: no (narrowing) follows the claim and dispatch in the PR body and changeset. Triage's note 3 said yes, and the claim's criterion overrides it.",
"The unit ablation was read at 9fa1ff4, not the final head. The final head differs from it only in comment lines in src and in changeset prose.",
"The PR opened on 0d60f88 after a merge of origin/main (9fa1ff4). #20229 is still open (draft, rework round). A local git merge-tree of this head against #20229's head a4b05d6 wrote a clean tree.",
"After the PR opened, labeler bots added documentation, tests, tooling and size/m to it. I did not write them; my only label-write was the assignee.",
"Cleanup: node_modules removed and git worktree remove succeeded without --force; the branch equals the remote at 0d60f88."
],
"mcp_calls": "0",
"api_writes": "3 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: (1) pr_create, which ran POST /repos/objectstack-ai/objectstack/pulls and opened #20253 as a draft; (2) label-write --assign, which ran POST /repos//issues/20253/assignees with os-project-manager; (3) this os-dev-report comment, which ran POST /repos//issues/20216/comments. Also 4 paced git push calls to the branch, which are not REST. Reads were unauthenticated GETs.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted, not filed. The namespace-prefix prescription is on the view-container leg only. The other sites of object-reference-unknown (field reference, action params, dataset object) give only the edit-distance suggestion for the same missing-prefix miss. This is polish, not a class a/b/c defect. It is recorded in the PR's Acceptance notes.",
"carrier: none (承接者:无) · noted, not filed. A container whose own object and list.data.object name different objects is judged by no rule. This is an unmeasured read-only inference, and the census found no instance. It is recorded in the PR's Acceptance notes."
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #20253 at head 0d60f88760 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T15:31Z

Seat review against GitHub, not the report:

• Shape: draft, base main, Fixes #20216 and Clause-②: no (narrowing) line-leading (readClause2Line → declared no / narrowing), assignee os-project-manager. 3 files, +236/−0: validate-object-references.ts, its test, and a @objectstack/lint minor changeset with a BREAKING banner and not-required (no-migration-prescription).
• Delivered: triage's direction 5855750932.
  • A view-container leg in validateObjectReferences, beside validate / lint / build accept a lookup or master_detail whose reference names an object that exists nowhere — the dangling target is found only at runtime #16611's relationship-target leg, on the same ladder and the same resolvable set (own objects plus packages[]). ⛔ There is no second copy in stack.zod.ts.
  • An unresolved unprefixed views[N].object gates as object-reference-unknown, with the declared names. The hint names my_app_order_line when the prefix is the miss.
  • Measured at the public door on a CLI built at the branch: os validate / os build exit 1 at views[0].object, the prefixed control exits 0, and with the leg ablated os validate exits 0 ("Validation passed").
  • Unit ablation: 8 refusal pins red and the controls green, then restored clean.
  • Census: 0 dangling containers in examples, skills, docs or platform packages.
• Enqueue gate: neither limb fires. The claim says Clause-②: no, and nothing touches packages/spec/src/**. So the seat's review is the landing review, and no at-tier record is owed.
• Landing order (region order in the claim): it enters the queue immediately after PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229 (lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206), which edits the same file at the packages[] read. A driver-free merge-tree of the two heads is clean.
• Out-of-scope findings: both → Acceptance notes.
  • The namespace-prefix hint exists only on this leg, which is polish.
  • A container whose object and list.data.object disagree has no measured instance.

[objectstack-fleet]

os-dev-report
{
"issue": 20216,
"status": "done",
"branch": "claude/issue-20216-view-container-object-refused",
"pr": "#20253",
"head": "60808317dc",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV (subagent: the dispatching PM's session id)",
"premise_still_valid": true,
"summary": "CI fix round for Test Core (6/6). The red was packages/cli/test/generate-scaffold-validates.test.ts, os g 'view' writes a stack os validate accepts, which got object-reference-unknown at views[0].object for probe_thing. The harness judged each scaffold in a host stack holding only the collection under test, so the view scaffold's binding to the object os g object probe_thing writes was judged against no objects. The new leg's refusal was correct; the omission was the harness's. I reproduced it red locally (1 failed, 17 passed). Fix, test fixture only: every namesObject generator other than object itself (view, action, flow, app) is now judged beside the object scaffold for the same name, materialized through the same bundle-require loader. A new pin holds the view binding and the seeded object's name to the same spelling, and holds non-binding generators to no seeded object. The rule is not weakened and nothing is special-cased or skipped. The file-surface amendment is packages/cli/test/generate-scaffold-validates.test.ts only; no other CLI fixture needed a change. origin/main did not move in any file this PR touches, so it was not merged. #20228 has merged; #20229 is still open. Landing order in the PR body: PR #20228 → PR #20229 → this PR.",
"tests": "At head 6080831. Reproduced red first under os-verify-lock: pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/generate-scaffold-validates.test.ts gave Tests 1 failed | 17 passed (18), failing on os g 'view'. After the fix, the same file gave Tests 19 passed (19), including the new binding-spelling pin. Full CLI unit project, --project unit: Test Files 227 passed (227), Tests 3219 passed (3219). The CLI integration tier, the 21 files that reference views or scaffolds (--project integration): Test Files 21 passed (21), Tests 196 passed (196). pnpm --filter @objectstack/cli typecheck: exit 0, check:test-typecheck OK. Lint: vitest run gave 109 passed (109) files and 4242 passed (4242) tests; pnpm --filter @objectstack/lint typecheck: exit 0. Nightly tier (OS_TEST_TIERS=nightly), 7 e2e files on views or scaffolds: 6 files passed and 71 of 72 tests passed. The one failure is generate-agent-retired.e2e.test.ts › os g object … --dry-run still previews a typed object file. It expects import * as Data from '@objectstack/spec/data', but the object template writes import { ObjectSchema } since #20195. Neither file differs from the merge base (0 diff lines), so it is independent of this PR (see out_of_scope_findings). No ablation this round: the change is a test fixture; the first round's rule ablation stands.",
"gates": "Re-derived at 6080831: 60 families. One is new versus the last round, check:cli-test-child-env, and it exited 0. All 60 were run at 6080831 and reconciled with --ran using recorded exit codes: 60 derived, 59 run, 1 NOT-MEASURED, 0 UNRUN. check:type-check-debt now measures green: none above its recorded number. NOT MEASURED: check:dual-build-cjs-loads (reason: PREREQUISITE NOT MET, exit 3, it needs every package's dist and only the lint and CLI closures were built). Declared to CI.",
"line_budget": "n/a (no skills/** or governed surface touched)",
"files_changed": [
".changeset/20216-view-container-object-refused.md (+57, unchanged this round)",
"packages/lint/src/validate-object-references.ts (+60, unchanged this round)",
"packages/lint/src/validate-object-references.test.ts (+119, unchanged this round)",
"packages/cli/test/generate-scaffold-validates.test.ts (+57/-8, this round: test fixture only, a file-surface amendment)"
],
"deviations": [
"File-surface amendment: packages/cli/test/generate-scaffold-validates.test.ts (test fixture only), stated in the PR body.",
"Correction to the first round: I declared the packages/cli suites to CI without running them locally. The census missed os g view because its container sits inside a template string, which the AST scan cannot see. That gap is the red this round fixes, and the CLI unit project was run in full this round.",
"No merge of origin/main this round (a9fb83e): it moved in no file this PR touches (overlap check empty), per the round's instruction.",
"Worktree recreated from branch head 0d60f88. The only new commit is 6080831, and the push was a fast-forward: no rebase, no amend, no force-push. Afterwards node_modules was removed and git worktree remove succeeded without --force.",
"The PR body was edited once (issue_patch, body only). The read-back is byte-identical (11221 bytes), and the PR is still a draft."
],
"mcp_calls": "0",
"api_writes": "This round: 2 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: (1) issue_patch, which ran PATCH /repos//issues/20253 with the body only; (2) this os-dev-report comment, which ran POST /repos//issues/20216/comments. Plus 1 paced git push (0d60f88..6080831), which is not REST. No labels, no ready flip. Reads were unauthenticated GETs.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: none at a public door. A nightly CI tier test fails on main; this is test-versus-template drift, and no product behaviour is wrong. Evidence: OS_TEST_TIERS=nightly pnpm --filter @objectstack/cli exec vitest run test/generate-agent-retired.e2e.test.ts fails [#10359] ... os g object … --dry-run still previews a typed object file at line 150. It expects import * as Data from '@objectstack/spec/data', while since #20195 (0bd1126) the object template writes import { ObjectSchema } from '@objectstack/spec/data'. Both files are identical to the merge base c02fa12, so this PR does not cause it. It does not run per-PR (the e2e tier is nightly-only). Dedupe words: generate-agent-retired e2e import * as Data · os g object dry-run preview ObjectSchema.create · nightly e2e object template drift.",
"carrier: none (承接者:无) · noted, not filed (carried from round 1). The namespace-prefix prescription is on the view-container leg only; recorded in the PR's Acceptance notes.",
"carrier: none (承接者:无) · noted, not filed (carried from round 1). A container whose object and list.data.object differ is judged by no rule; recorded in the PR's Acceptance notes."
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT (CI fix round) — PR #20253 at head 60808317dc · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T17:38Z

• The red, root-caused: Test Core (6/6) failed in packages/cli/test/generate-scaffold-validates.test.ts (os g 'view', with object-reference-unknown at views[0].object for probe_thing). The harness judged each scaffold alone, so the view's binding was judged against no objects. The new leg was right; the fixture was incomplete.
• The fix (delta 0d60f88760..60808317dc: that one test file, +57/−8):
  • every object-naming generator (view, action, flow, app) is judged beside the os g object scaffold for the same name;
  • a new pin holds the binding and the seeded object's spelling equal.
  • ⛔ The rule was not weakened, and nothing was skipped.
• File-surface amendment to claim 5856174763 (recorded here, ⛔ not a second claim): packages/cli/test/generate-scaffold-validates.test.ts, test fixture only.
• Proof:
  • reproduced red locally (1 failed / 17), then green (19/19);
  • the full CLI unit project 227 files / 3219 tests, and the CLI integration tier's 21 view and scaffold files (196 tests);
  • lint 4242 tests.
  • PR CI at this head: 36 success, 5 skipped, 0 failed.
• Enqueue gate: unchanged, no limb fires.
• Landing order: immediately after PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229. PR fix(core,runtime,plugin-dev,plugin-security): refuse packages: null as malformed, never absent #20228 has already landed.
• Out-of-scope finding (the nightly e2e drift in generate-agent-retired.e2e.test.ts, which also fails on main): filed as its own card in this window.