@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): a stored list sort or filter on a deleted or unreadable field is dropped when the list opens
+
+Clause-②: no
+Metadata-protocol: none
+
+A user's stored sort and Filter panel conditions for a list view now pass the same field check a list link already passes. A sort level or a filter condition naming a field the object no longer declares, or one the user can no longer read, is dropped when the list opens, at any nesting of filter groups. Everything else the user stored still applies, so the list opens with rows instead of failing on a field that is gone. When every stored sort level is dropped, the view's own sort applies; when every condition is dropped, the list opens unfiltered.
+
+Opening the list does not rewrite the stored row: the dropped part stays stored, so a field whose read access comes back applies again. The user's next sort or filter change replaces that part with what the list shows. Field-level read permissions are applied once they have loaded, the same rule the list's columns and a list link follow.
@@ -22,6 +22,9 @@
  *   - opening and closing a panel leaves the URL alone (the triage control);
  *   - a malformed or stale param is dropped: the list opens, nothing throws,
  *     and the address bar loses it;
+ *   - objectstack#28949 — the same holds for the user's stored sort and
+ *     filter: a field deleted since, or one they can no longer read, is
+ *     dropped, and the rest of what they stored still applies;
  *   - another view starts clean, and params this page wrote for one view never
  *     read as a link to the next when the active view resolves late;
  *   - a user the server refuses gets the same refusal with or without params.
@@ -93,6 +96,8 @@ import '@object-ui/plugin-grid';
 import { ExpressionProvider } from '../providers/ExpressionProvider';
 import { buildListFilterKey } from './listFilterStorage';
 import { LIST_FILTER_PARAM, LIST_GROUP_PARAM, LIST_SEARCH_PARAM, LIST_SORT_PARAM } from './userFilterUrlState';
+import { localListStateKey } from '../context/ListPreferencesProvider';
+import { acceptStoredFilters, acceptStoredSort } from './objectViewListUrlState';
 
 const OBJ = 'url_task';
 const VIEW = `/apps/demo/${OBJ}/view`;
@@ -398,6 +403,96 @@ describe('a malformed or stale param is dropped — the list opens and nothing t
   });
 });
 
+/** This user's stored state for one view (objectui#12418's per-browser cache, the shape the server row has). */
+function storeViewPreference(viewId: string, pref: { sort?: unknown; filters?: unknown }) {
+  localStorage.setItem(localListStateKey('u1', OBJ), JSON.stringify({ perView: { [viewId]: pref } }));
+}
+
+describe('a stored sort or filter naming a stale field is dropped too (objectstack#28949)', () => {
+  const group = (...conditions: unknown[]) => ({ id: 'root', logic: 'and', conditions });
+
+  it('a field the object no longer declares: the list opens on the rest of the stored state', async () => {
+    storeViewPreference('all', {
+      sort: [{ field: 'ghost', order: 'asc' }, { field: 'due_date', order: 'desc' }],
+      filters: group(
+        { id: 'g', field: 'ghost', operator: 'equals', value: 'x' },
+        { id: 'p', field: 'priority', operator: 'equals', value: 'urgent' },
+      ),
+    });
+    const host = await mountHost([`${VIEW}/all`]);
+    const q = lastQuery();
+    expect(filterOf(q)).toContain('"priority","=","urgent"');
+    expect(filterOf(q)).not.toContain('ghost');
+    expect(q.$orderby).toEqual([{ field: 'due_date', order: 'desc' }]);
+    const params = new URLSearchParams(host.search());
+    expect(JSON.parse(params.get(LIST_FILTER_PARAM)!).conditions).toEqual([
+      { field: 'priority', operator: 'equals', value: 'urgent' },
+    ]);
+    expect(JSON.parse(params.get(LIST_SORT_PARAM)!)).toEqual([{ field: 'due_date', order: 'desc' }]);
+  });
+
+  it('a field this user cannot read is dropped once permissions are loaded; a readable one is untouched', async () => {
+    perms.isLoaded = true;
+    perms.checkField = (_object, field) => field !== 'priority';
+    storeViewPreference('all', {
+      sort: [{ field: 'priority', order: 'asc' }, { field: 'name', order: 'asc' }],
+      filters: group(
+        { id: 'p', field: 'priority', operator: 'equals', value: 'urgent' },
+        { id: 's', field: 'status', operator: 'equals', value: 'open' },
+      ),
+    });
+    await mountHost([`${VIEW}/all`]);
+    const q = lastQuery();
+    expect(filterOf(q)).not.toContain('priority');
+    expect(filterOf(q)).toContain('"status","=","open"');
+    expect(q.$orderby).toEqual([{ field: 'name', order: 'asc' }]);
+  });
+
+  it('a stored state whose every entry is stale: no filter, and the view\'s own sort', async () => {
+    storeViewPreference('sorted', {
+      sort: [{ field: 'ghost', order: 'desc' }],
+      filters: group({ id: 'g', field: 'ghost', operator: 'equals', value: 'x' }),
+    });
+    const host = await mountHost([`${VIEW}/sorted`]);
+    expect(listQueries.length).toBeGreaterThan(0);
+    expect(lastQuery().$filter).toBeUndefined();
+    expect(lastQuery().$orderby).toEqual([{ field: 'name', order: 'asc' }]);
+    const params = new URLSearchParams(host.search());
+    expect(params.has(LIST_FILTER_PARAM)).toBe(false);
+    expect(params.has(LIST_SORT_PARAM)).toBe(false);
+  });
+
+  it('CONTROL: while permissions are still loading, only the declaration gates, as it does for a link', async () => {
+    perms.isLoaded = false;
+    perms.checkField = (_object, field) => field !== 'priority';
+    storeViewPreference('all', { filters: group({ id: 'p', field: 'priority', operator: 'equals', value: 'urgent' }) });
+    await mountHost([`${VIEW}/all`]);
+    expect(filterOf(lastQuery())).toContain('"priority","=","urgent"');
+  });
+
+  it('nested groups are read at any depth; untouched entries keep their ids and a clean state its identity', () => {
+    const accept = (field: string) => field !== 'ghost';
+    const stored = group(
+      { id: 'p', field: 'priority', operator: 'equals', value: 'urgent' },
+      { id: 'n1', logic: 'or', conditions: [
+        { id: 'g', field: 'ghost', operator: 'equals', value: 'x' },
+        { id: 's', field: 'status', operator: 'equals', value: 'open' },
+      ] },
+      { id: 'n2', logic: 'and', conditions: [{ id: 'g2', field: 'ghost', operator: 'equals', value: 'y' }] },
+    );
+    expect(acceptStoredFilters(stored, accept)).toEqual(group(
+      { id: 'p', field: 'priority', operator: 'equals', value: 'urgent' },
+      { id: 'n1', logic: 'or', conditions: [{ id: 's', field: 'status', operator: 'equals', value: 'open' }] },
+    ));
+    const clean = group({ id: 'p', field: 'priority', operator: 'equals', value: 'urgent' });
+    expect(acceptStoredFilters(clean, accept)).toBe(clean);
+    expect(acceptStoredFilters(group({ id: 'n', logic: 'or', conditions: [{ id: 'g', field: 'ghost', operator: 'equals', value: 'x' }] }), accept)).toBeUndefined();
+    // A sort the user cleared stays cleared; one emptied by the gate is no sort.
+    expect(acceptStoredSort([], accept)).toEqual([]);
+    expect(acceptStoredSort([{ field: 'ghost', order: 'asc' }], accept)).toBeUndefined();
+  });
+});
+
 describe('the params belong to one view (objectui#11860)', () => {
   it('another view starts clean — the ad-hoc params do not follow the user into it', async () => {
     const host = await mountHost([link(`${VIEW}/all`, { filter: URGENT, search: 'acme' })]);
 
@@ -18,15 +18,69 @@ import {
     applyListStateParams,
     userFilterParamsKey,
     type ListStatePatch,
+    type ListUrlFieldGate,
     type ListUrlState,
+    type ListSortRule,
 } from './userFilterUrlState.js';
 import { buildListFilterKey, readListFilterState } from './listFilterStorage.js';
-import type { useObjectListPreferences } from '../context/ListPreferencesProvider.js';
+import type {
+    useObjectListPreferences,
+    ListFilterGroupPreference,
+    ListSortPreference,
+} from '../context/ListPreferencesProvider.js';
 import { parseUrlEqualityFilterTriples } from './drillUrlFilters.js';
 import { selectFilterParams } from './objectViewHelpers.js';
 import type { buildViewTabs } from './objectViewTabs.js';
 import type { ConsoleObjectViewProps } from './ObjectView.js';
 
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+    !!v && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * objectstack#28949 — the stored sort through the seed's field gate: a level
+ * naming a refused field is dropped and the levels around it keep their order.
+ * An empty stored sort is a sort the user cleared, and it is kept; one whose
+ * every level was dropped is no sort at all, so the view's own sort applies.
+ */
+export function acceptStoredSort(
+    sort: readonly ListSortPreference[] | undefined,
+    acceptField: ListUrlFieldGate,
+): ListSortRule[] | undefined {
+    if (!sort) return undefined;
+    const kept = sort.filter(level => acceptField(level.field));
+    return sort.length === 0 || kept.length > 0 ? kept : undefined;
+}
+
+/**
+ * objectstack#28949 — the stored Filter panel group through the seed's field
+ * gate, at any nesting: a condition naming a refused field is dropped, a
+ * nested group left with no condition is dropped with it, and every other
+ * entry is kept exactly as stored (ids included: the panel rehydrates them).
+ * A group nothing was dropped from is returned as is; one left with no
+ * condition at all is no filter, and the list opens unfiltered.
+ */
+export function acceptStoredFilters(
+    group: ListFilterGroupPreference | undefined,
+    acceptField: ListUrlFieldGate,
+): ListFilterGroupPreference | undefined {
+    if (!group || !Array.isArray(group.conditions)) return group;
+    let dropped = false;
+    const conditions: unknown[] = [];
+    for (const entry of group.conditions) {
+        if (isRecord(entry) && Array.isArray(entry.conditions)) {
+            const nested = acceptStoredFilters(entry as ListFilterGroupPreference, acceptField);
+            if (nested !== entry) dropped = true;
+            if (nested) conditions.push(nested);
+        } else if (isRecord(entry) && typeof entry.field === 'string' && entry.field && !acceptField(entry.field)) {
+            dropped = true;
+        } else {
+            conditions.push(entry);
+        }
+    }
+    if (!dropped) return group;
+    return conditions.length > 0 ? { ...group, conditions } : undefined;
+}
+
 export function useObjectViewListUrlState({
     objectName,
     objectDef,
@@ -68,6 +122,11 @@ export function useObjectViewListUrlState({
      *    seed waits until that state has been read (`listPrefs.ready`), so a
      *    second browser opens on it rather than on an empty cache.
      *
+     * Both seeds pass the same field gate (`acceptField`, objectstack#28949):
+     * a field stored before it was deleted, or before this user lost read on
+     * it, is dropped exactly as a stale link's is, and the rest of the state
+     * opens as stored.
+     *
      * Then the seed is written back into the URL (replace, never a new history
      * entry), so the address bar shows the list on screen: a restored filter
      * is in the link a user copies, and an entry dropped on load (a field the
@@ -93,14 +152,15 @@ export function useObjectViewListUrlState({
     const listSeedRef = useRef<{ key: string; source: 'url' | 'storage'; state: ListUrlState } | undefined>(undefined);
     const ownListParamsRef = useRef<string | undefined>(undefined);
     if (listIdentityKey && listPrefs.ready && listSeedRef.current?.key !== listIdentityKey) {
+        // A field the object does not declare (a stale link, or a stored state
+        // older than the field's deletion) or one this user cannot read is
+        // dropped. Field-level permissions gate only once loaded — the same
+        // gate `ListView` puts on its columns.
+        const acceptField: ListUrlFieldGate = (field: string) =>
+            !!objectDef.fields?.[field]
+            && (!perms.isLoaded || perms.checkField(objectDef.name, field, 'read'));
         const carried = userFilterParamsKey(searchParams);
         if (carried && carried !== ownListParamsRef.current) {
-            // A field the object does not declare (a stale link) or one this
-            // user cannot read is dropped. Field-level permissions gate only
-            // once loaded — the same gate `ListView` puts on its columns.
-            const acceptField = (field: string) =>
-                !!objectDef.fields?.[field]
-                && (!perms.isLoaded || perms.checkField(objectDef.name, field, 'read'));
             listSeedRef.current = {
                 key: listIdentityKey,
                 source: 'url',
@@ -113,9 +173,9 @@ export function useObjectViewListUrlState({
                 key: listIdentityKey,
                 source: 'storage',
                 state: {
-                    filters: (viewPref?.filters ?? undefined) as ListUrlState['filters'],
+                    filters: acceptStoredFilters(viewPref?.filters, acceptField) as ListUrlState['filters'],
                     search: stored?.search || undefined,
-                    sort: viewPref?.sort,
+                    sort: acceptStoredSort(viewPref?.sort, acceptField),
                 },
             };
         }