spec: inline view arms of the runtime write door require the object binding (#8089)

* spec: inline view arms of the runtime write door require the object binding (#7741)

Direction B per the maintainer ruling of 2026-08-12: the two flattened
overlay members of ViewMetadataSchema now require object + viewKind —
the exact pair the object-bound read paths filter on (GET
/meta/view?object= in rest-server.ts and getViewsByObject() in
metadata-manager.ts both match v.viewKind && v.object === obj) — so an
inline config that could never be served is refused at the door, draft
and active alike, with located guidance that reuses defineView's
existing wrap prescription instead of forking a second copy.

Personalization PUTs are unaffected: normalizeViewMetadata inherits
viewKind/object/label from the shadowed registry entry (#2555) before
validation, so a console pin/sort/hide PUT on a real view arrives
bound. The body this refuses is the baseline-less one — the dead row
QA run #7695 measured being stored and badged valid:true.

Union membership (#6391) is preserved: four arms, same order, same
JSON-Schema anyOf face; the arms' required set is the only move.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0123k4cam2jEAkPmbJeoaY3r

* test: re-spell consumer view fixtures to the bound inline form (#7741)

Fixture triage across the wire union's consumption radius: every consumer
test writing an inline view body through saveMetaItem now carries the
object + viewKind binding the arms require — the post-normalize shape a
real shadowing write always had. Two deliberate inversions ride along:
objectql's 'plain name-stamp with no entry to inherit from' pin (that
save IS the #7741 dead row and now 422s with the located guidance,
asserting code INVALID_METADATA + status 422), and the diagnostics
lean-overlay pin (an unbound stored row is badged invalid now).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0123k4cam2jEAkPmbJeoaY3r

* test: bind the two runtime control view fixtures (#7741)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0123k4cam2jEAkPmbJeoaY3r

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: huangyiirene

.changeset/inline-view-arms-require-object-binding.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/spec": minor
+---
+
+The runtime metadata write door for `view` now refuses an inline view config that carries no object binding. The two flattened-overlay members of `ViewMetadataSchema` require `object` and `viewKind` — the pair every object-bound read path (`GET /meta/view?object=`, the view switcher) matches stored rows on — so a flat body like `{ name, type: 'grid', columns: [...] }` is rejected at save time (draft and active alike) with located guidance naming the missing binding and the `defineView({ list: { … } })` wrap remedy, instead of being stored, reported valid, and served by nothing. Console personalization PUTs are unaffected: the write path inherits the binding from the registry entry the overlay shadows before validation. Union membership is unchanged — four arms, same order, same JSON-Schema `anyOf` face; the inline arms' required set is the only change.

packages/metadata-protocol/src/metadata-diagnostics.union-issues.test.ts

@@ -189,8 +189,14 @@ describe('#5599 a stored `view` that is not a view is no longer badged valid', (
 
     it('a legitimately-lean overlay is still valid — no collateral badge', () => {
         // The precondition asks "is this a view at all", never "is it complete".
-        expect(computeMetadataDiagnostics('view', { isPinned: true })).toEqual({ valid: true });
-        expect(computeMetadataDiagnostics('view', { hidden: true })).toEqual({ valid: true });
+        // [#7741] "lean" now still carries the object binding: the write path
+        // inherits `object`/`viewKind` from the shadowed entry (#2555), so a
+        // stored lean overlay of a REAL view looks exactly like this.
+        expect(computeMetadataDiagnostics('view', { isPinned: true, object: 'task', viewKind: 'list' })).toEqual({ valid: true });
+        expect(computeMetadataDiagnostics('view', { hidden: true, object: 'task', viewKind: 'list' })).toEqual({ valid: true });
+        // …while a stored row with NO binding is a row no object-bound read
+        // path can serve — the #7741 dead row — and is badged invalid now.
+        expect(computeMetadataDiagnostics('view', { isPinned: true })?.valid).toBe(false);
     });
 
     it('a stored row of pure identity is no longer valid either', () => {

packages/metadata-protocol/src/protocol-publish-drafts-org-scope.test.ts

@@ -195,6 +195,7 @@ const viewBody = (name: string) => ({
     name,
     label: 'Project Tasks',
     object: 'proj_task',
+    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
     columns: [{ field: 'title', label: 'Title' }],
 });
 

packages/metadata-protocol/src/protocol.adr0005-org-override-rollback.test.ts

@@ -198,6 +198,7 @@ const VIEW = {
     name: 'probe_view',
     label: 'Probe',
     object: 'task',
+    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
     columns: [{ field: 'name', label: 'Name' }],
 };
 

packages/metadata-protocol/src/protocol.code-only-types.test.ts

@@ -330,6 +330,7 @@ describe('code-only metadata types are refused on every kernel (#5086)', () => {
                     name: 'rc3_probe_view',
                     label: 'Probe',
                     object: 'task',
+                    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
                     columns: [{ field: 'name', label: 'Name' }],
                 },
             });
@@ -452,6 +453,7 @@ describe('code-only metadata types are refused on every kernel (#5086)', () => {
                     name: 'rc3_receipt_view',
                     label: 'Receipt',
                     object: 'task',
+                    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
                     columns: [{ field: 'name', label: 'Name' }],
                 },
             },

packages/metadata-protocol/src/protocol.flow-org-override-closed.test.ts

@@ -178,6 +178,7 @@ const VIEW = {
     name: 'overdue_grid',
     label: 'Overdue',
     object: 'task',
+    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
     columns: [{ field: 'name', label: 'Name' }],
 };
 

packages/metadata-protocol/src/protocol.lock-gate-fail-closed.test.ts

@@ -201,7 +201,8 @@ const save = (p: ObjectStackProtocolImplementation) =>
     p.saveMetaItem({
         type: 'view',
         name: 'v1',
-        item: { name: 'v1', label: 'Edited', type: 'grid', columns: ['name'] },
+        // [#7741] carries the object binding the inline arm now requires.
+        item: { name: 'v1', label: 'Edited', type: 'grid', columns: ['name'], object: 'task', viewKind: 'list' },
     } as any);
 
 const remove = (p: ObjectStackProtocolImplementation) =>

packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts

@@ -266,6 +266,7 @@ const VIEW = {
     name: 'org_grid',
     label: 'Org grid',
     object: 'task',
+    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
     columns: [{ field: 'title', label: 'Title' }],
 };
 

packages/metadata-protocol/src/protocol.save-flow-canonicalization.test.ts

@@ -390,7 +390,8 @@ describe('saveMetaItem canonicalizes flow bodies (#4542)', () => {
             type: 'view',
             name: 'case_grid',
             organizationId: 'org_alpha',
-            item: { name: 'case_grid', type: 'grid', label: 'Cases', columns: ['id', 'title'] },
+            // [#7741] carries the object binding the inline arm now requires.
+            item: { name: 'case_grid', type: 'grid', label: 'Cases', columns: ['id', 'title'], object: 'case', viewKind: 'list' },
         });
         expect(spy).not.toHaveBeenCalled();
     });

packages/metadata-protocol/src/protocol.save-receipt-wording.test.ts

@@ -144,6 +144,7 @@ const VIEW = {
     name: 'rc5_probe_view',
     label: 'Probe',
     object: 'task',
+    viewKind: 'list', // [#7741] the inline arm requires the object binding pair
     columns: [{ field: 'name', label: 'Name' }],
 };