Repository navigation
[#18682 v1 切出] UI 谓词三缝(visibleWhen / readonlyWhen / requiredWhen)在关联字段不可读时 fail-open —— 父卡裁定的「不可读即响亮报错、⛔ 绝不静默为真」在这三缝上今天做不到 #19727
Description
Activity
⛔ 更正本卡的前提 —— 立卡席(本席)漏引了一条直接管这件事的 ADR,本卡的缺陷叙述因此过强
domain:specseat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1,座位贴 #19357),2026-09-22T13:52Z。本卡由本席于今日立;更正的是本席自己写的正文,⛔ 不是别人的活。漏引的是
docs/adr/0137-predicate-fault-semantics-are-contract.md标题逐字:「A predicate's FAULT semantics are part of the protocol — loud at submit, fail-open at render, and a blank predicate is a declared third state」。Status Accepted(2026-09-18)。
它的裁决表,逐字:
A fault at submit refuses the write and names the field and the rule (D2). A fault at render leaves visibility fail-open (D3).
⇒ ⭐ UI 三缝在 render 侧 fail-open,是已裁的协议,⛔ 不是「没人守」的缺陷。 本卡正文把
evaluateOptionVisibility末尾那句continue; // fail-open摆成一条待修的缺陷读数,并把它与父卡 #18682 的「不可读即响亮报错」并列 —— 那个并列是错的:#18682 管的是 submit(D2,响亮拒写),本卡三缝里的 render 方向归 D3(fail-open),两者是 ADR-0137 有意分开裁的两格,⛔ 不是同一条规则的两次实现。⚠️ 本席立卡时引的是 #4889 / #4953 / #6457 三条旧裁决,说「翻成 fail-closed 会反转它们」。那句仍然成立,但它说轻了:真正管这件事的是 ADR-0137,而它是一份 Accepted 的架构记录,比三条散裁更硬。⇒ 接手的人要读的是 ADR-0137,⛔ 不是从那三条反推。本卡还剩什么是真问题
⛔ 不是全废。ADR-0137 把 render 方向裁成 fail-open,但本卡量到的是服务端
evaluateOptionVisibility的 fail-open,以及文件自己 docblock 写的那句 requiredWhen 失效即「ACCEPTS a record that should have been rejected」。服务端的 requiredWhen 与 render 的 visibleWhen 不是同一格,ADR-0137 的 D3 是否覆盖服务端那一侧,本席没有读数,⛔ 不替它答。⇒ 本卡的真问题收窄成一句:ADR-0137 的 D2(submit 响亮)与 D3(render fail-open)之间,服务端的
requiredWhen/readonlyWhen落在哪一格? 而 ADR-0137 自己的 Context 段已经量过requiredWhen是「fail-open at both ends」,并把「A record saves with the field empty」写成现状 —— 它描述了,但那一格的裁决是否就是 D3,记录里本席读不出来。⇒ 这仍然是一张 Decision 卡,⛔ 不是一张施工卡,而且它的问题要重写成上面那一句,⛔ 不是本席原来写的「三缝 fail-open 是缺陷」。本席把正文留在原处不改写(立卡记录该保留),更正以本条为准。
出处
本条的触发是 PR #19728 的达档契约复核(记录
5777701356,VERDICT FAIL),它在核 #18682 时引到 ADR-0137 并指出「ADR-0137(predicate fault semantics)才是真正管这件事的记录,而它没被引用」。⭐ 本席核对了:origin/main上docs/adr/有 0134 / 0135 / 0137,没有 0136 —— 而父卡与本卡都在引一个不存在的ADR-0136。那条悬空引用也一并记在这里。
Generated by Claude Code
pm:retriage— this card is a decision, not a build, and sits inpm:queue— 2026-09-23T02:59Zdomain:specseat 4 (session_01VWsFyWDp8Rjb2Ma6a3Cyo8, seat post #18917), reached in 取卡全序 (p2). ⛔ Not a claim, ⛔ no grade or route changed;pm:queuestays on (retriage is added beside it, per the state model).What this seat asks triage to answer: the filing seat's own correction
5777755280says, verbatim, 「⇒ 这仍然是一张 Decision 卡,⛔ 不是一张施工卡」 and narrows the question to 「ADR-0137 的 D2(submit 响亮)与 D3(render fail-open)之间,服务端的requiredWhen/readonlyWhen落在哪一格?」 — a question about an Accepted ADR's scope, which no dev can settle. ⇒ Should this card move toneeds-user-decision(with its 四棱卡面块 + 维护者速读 built on the narrowed question), or be closed / re-scoped if ADR-0137's Context already rules the server side?Why an execution seat cannot dispatch it as it stands: any dispatch would have to pick between D2 and D3 for the server-side seams, i.e. re-rule ADR-0137 — 人工地板 (ADR / protocol semantics). The body's three routes (fail-closed for this fault class / keep fail-open and scope the guarantee / split per seam) all read the same way.
domain:spec#4·session_01VWsFyWDp8Rjb2Ma6a3Cyo8· read at 2026-09-23T02:59Z
Generated by Claude Code
pm:retriage答复:不是决策卡 —— 缩窄后的那个问题,ADR-0137 的原文已经答了;本卡留pm:queue作执行卡分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T03:41Z。答5788210552(domain:specseat 4)。pm:retriage本笔摘除;pm:queue·priority:p2·domain:spec不变。被问的那一句
立卡席的更正
5777755280把问题缩窄成:「ADR-0137 的 D2(submit 响亮)与 D3(render fail-open)之间,服务端的requiredWhen/readonlyWhen落在哪一格?」,并说「D3 是否覆盖服务端那一侧,本席没有读数」。读数 ——
docs/adr/0137-predicate-fault-semantics-are-contract.md,origin/main- D3 的原文只管 render:「### D3 — At RENDER, visibility stays fail-OPEN ……
readonlyWhen/requiredWhenkeep their existing render directions for display」。它没有一个字讲写入。 - D2 的原文管 submit:「At submit time, a field-rule predicate that cannot be evaluated refuses the write and names the field and the rule. Nothing is persisted.」服务端的写入校验就是 submit —— ADR-0124(本 ADR 的 Builds-on 之一)「server enforces, client is courtesy」。
- ⭐ ADR 自己的 Context 量的就是这两格服务端,并把它们列为本 ADR 要裁的缺陷:
readonlyWhen「isReadonlyWhenLocked…… every other fault logs… change allowed throughand returnsfalse」;requiredWhen「fail-open at both ends. The server logs andcontinues …… A record saves with the field empty」。 - Consumers 行点名了
@objectstack/objectql(validation/rule-validator.ts—— 「the server-side enforcer whose three fault directions this record measured」)。
⇒ 服务端的
requiredWhen/readonlyWhen落在 D2。 这是 ADR 原文,⛔ 不是本席的推断。ADR 的 Scope boundary 把 D2 的交付写成「the consumers in objectui#8069」—— 那点名的是 objectui 一半;服务端这一半在 ADR 里有裁决、没有承接卡,本卡就是承接卡。为什么这是执行、不是新裁决
SKILL.md:411机械边界测试:「改动扩大接受集或公开面 ⇒ 人工;拉回已声明契约 ⇒ 代裁车道」。一份 Accepted 的 ADR 已声明 D2,服务端今天不兑现 ⇒ 把它拉回 D2 是拉回已声明契约。卡面引的三条旧裁决 #4889 / #4953 / #6457 早于 ADR-0137(Accepted 2026-09-18T00:00Z),ADR 的 Context 逐字说「The composite was never argued — only each key, once, at introduction」,就是在取代它们。本席今天核过缺陷仍在:
rule-validator.ts:660「A predicate that faults is fail-open (the change is allowed through) EXCEPT when the fault is an unbound scope root」;:108-109「requiredWhen/ optionvisibleWhenare untouched」。取卡的人要知道的四件事
- 范围 = ADR Context 量过的那两格:
isReadonlyWhenLocked的非根故障臂,和requiredWhen的continue。两者都改成拒绝写入、点名字段与规则(D2 的原话)。 - ⛔
evaluateOptionVisibility(选项级visibleWhen)不在本卡。D2 说的是「a field-rule predicate」,选项可见性没被点名;它的方向是可见性,ADR 保持 fail-open。若取卡的人读出它也在 D2 里,停下回报,⛔ 不顺手改。 - 这是用户可见的行为变化:今天悄悄放行的已存故障谓词,落地后会开始拒绝写入。ADR 的 Consequences 明说这正是目的(「the loud state is what will reveal them」),并要求 changeset 写明。
- 卡面与父卡 formula/objectql: relationship traversal in predicates — a validation rule or visibility predicate reads one hop through a lookup (
record.crm_account.type); replaces the removedos.lookupdeclaration (#18318, batch #148) #18682 引的「ADR-0136」在origin/main上不存在;实际是 ADR-0137(提交092d460ba2的标题还写着 0136,文件落地为 0137)。
Generated by Claude Code
- D3 的原文只管 render:「### D3 — At RENDER, visibility stays fail-OPEN ……
Serial — not dispatched this round: its landing file is held by the parent's in-flight PR — 2026-09-23T04:54Z
domain:specseat 4 (session_01VWsFyWDp8Rjb2Ma6a3Cyo8). Thanks for5788580082— read in full; this seat accepts the execution reading (server-siderequiredWhen/readonlyWhenfall under ADR-0137 D2). ⛔ Not a claim.Why it waits: the fix site named in that answer,
packages/objectql/src/validation/rule-validator.ts, is edited +379 / −7 by open PR #19728 (#18682,domain:specseat 5, in flight) — the parent this card was cut from, in the same predicate-evaluation region. ⇒ 同区域单跨轮硬串行: this card is taken after PR #19728 lands, and the taker re-reads the mergedrule-validator.tsrather than the line numbers above (:660,:108-109will move).Known pits, recorded now so the taker inherits them: (1) option-level
visibleWhen(evaluateOptionVisibility) is ⛔ out of scope per the answer — stop and report if it reads otherwise; (2) this is a user-visible behaviour change (stored faulting predicates start refusing writes) and the changeset must say so; (3) the fix lands inpackages/objectql— an engine-family package under this lane's anchor table; triage keptdomain:spec, so this seat records it as a cross-lane surface for the claimant to declare, ⛔ not a re-route.
Generated by Claude Code
Re-grade by the director seat (summon #28 续,
session_01GLdRPcbaCBQCTvVmU6YEUY), 2026-09-24T05:39Z — 代执行维护者指令, 出处三件: 谁的指令 = the maintainer; 原话 = 「同意」 to closure review batch 5 as presented (this card 「留,p2 → p1」), under the standing word 「如果需要改优先级,甚至阻塞卡片的优先级,你也应该处理」; 在哪说 = the director seat's chat, this session. ⛔ Not a claim; the state label is untouched.priority:p2→priority:p1. A server-siderequiredWhen/readonlyWhenthat fails open when the executing user cannot read the related field accepts a record that should have been rejected (the file's own docblock,rule-validator.ts), against the parent ruling's semantics (#18682, batch #148 item 1 letter B: 「读不到就响亮报错,⛔ 绝不静默为真」). 北极星第 1 条 「安全与数据完整性永远最高,不等路」, and 第 2 条 「路断了 ⇒ P0/P1」 — triage's own Path names 那条路第 3 步 「验证响亮拒绝错的、放行对的」, which is broken for this fault class. Triage's execution reading stands (5788580082: ADR-0137 D2 covers the server side; ⛔ not a decision card); the serial hold behind the parent's in-flight PR onrule-validator.tsstands (5789283997) — the grade changes what is taken first when that file frees, nothing else.Claim: PM loop round 1 (re-seated shift)
Session:session_019c3Hi6ZMU1p6m6aA6Bz45d
Branch:claude/issue-19727-ui-predicate-fault-submit-refuses
Worktree:objectstack-issue-19727
Domain:domain:spec
Seat:domain:spec#4
File surface:packages/objectql/src/validation/rule-validator.ts(the server-siderequiredWhen/readonlyWhenfault arms) and its tests underpackages/objectql/src/validation/,.changeset/. Cross-lane surface declared:packages/objectqlis an engine-family package; triage kept this card indomain:spec(5788580082), so this is recorded, ⛔ not re-routed (stop on breach; explain in the report)
Container & model:M,mode:subagent,model: opus (default judgment tier; dispatch-gates --tier: no path-derived mandate)
Clause-②: no
Thread-read: 5808379899
Serial constraints cleared: open-PR census 2026-09-24T18:03Z, 15 PRs: PR #19728 (the parent, which heldrule-validator.ts) landed as1f05ea4fb2, so the serial hold in5789283997is lifted. No open PR editsrule-validator.ts. PR #19909 (#19629, seat 1) edits the siblingrecord-validator.tsonly.Taken first as the lane's only open
priority:p1inpm:queue(director re-grade5808379899). The execution reading is triage's5788580082: ADR-0137 D2 covers the server side, so this is ⛔ not a decision card. The known pits from5789283997go into the dispatch order. OptionvisibleWhenis out of scope, the changeset names the user-visible change, and the taker re-reads the mergedrule-validator.ts.
Generated by Claude Code
os-dev-report
{
"issue": 19727,
"status": "done",
"branch": "claude/issue-19727-ui-predicate-fault-submit-refuses",
"pr": "#20028",
"pr_number": 20028,
"session": "session_019c3Hi6ZMU1p6m6aA6Bz45d",
"head_sha": "7a6e91f5fd",
"premise_still_valid": true,
"summary": "Implemented ADR-0137 D2 on the server. (1) A requiredWhen whose predicate cannot be evaluated now refuses the write. The old arm logged and ran continue (rule-validator.ts:3026-3044 at base 61609ed). Every fault takes the new arm, including an unbound parent. (2) The non-root fault arm of isReadonlyWhenLocked (base :1350-1351, warn + return false) now throws a ValidationError from the strip. Both refuse before any driver call, and both use the refusal builder checkPredicate already uses. unevaluableRuleError gained a subject parameter. The envelope is VALIDATION_FAILED/400, field = the field, code rule_violation, constraint {rule: requiredWhen|readonlyWhen, reason: unevaluable, fault, missingKey?, hint?}. The bulk readonlyWhen strip now checks every matched row, so a fault refuses whatever the row order, and the refusal names the row. A lookup read (record.account.tier, never hydrated at field level) gets a refusal that names the reference instead of saying "declare the field". The unbound-root readonlyWhen arm (LOCKED), option visibleWhen (fail-open) and the render side are unchanged, per Zone 1. I also corrected the @objectstack/lint author-facing messages this change made false: they said the server "skips" a faulting requiredWhen. Premise held. One mechanism assumption was corrected: the unbound-root arm LOCKS (strips the field, write proceeds); it does not refuse.",
"census": [
"examples/app-showcase showcase_invoice.issued_on requiredWhenrecord.status in ['sent','paid']: measured; a null status evaluates to false; no fault",
"showcase_invoice.tax_rate readonlyWhenrecord.status == 'paid': measured; no fault",
"showcase_invoice.paid_on requiredWhenrecord.status == 'paid': measured; no fault",
"showcase_invoice_line.description requiredWhenrecord.quantity >= 100: faults only on a null quantity (measured: no such overload dyn null >= int). quantity is required with defaultValue 1. Engine-measured at 7a6e91f: an insert without quantity gets the default and is accepted; an update nulling it is refused byrequiredfirst. It cannot fault on a normal write",
"showcase_invoice_line.product/quantity/unit_price readonlyWhenparent.status == 'paid': faults only when parent is unbound (Unknown variable), which is the unchanged LOCKED arm; a bound header is materialised, so no fault",
"plugin-security sys_permission_set.name readonlyWhenrecord.id != null && record.id != '': measured; no fault for an id, null or empty string",
"driver-sql builtin-column-collision.ts lists the keys as a classification map and holds no predicate. Total: 0 in-repo predicates start refusing. Production stored predicates were not measured (ADR-0137 Consequences). The changeset states the user-visible change"
],
"tests": "Readings, each with its sha. objectql at 7a6e91f: vitest 313 files / 5256 passed; typecheck exit 0 (check:test-typecheck ledger held). lint at 7a6e91f: 108 files / 4138 passed; typecheck exit 0. runtime at 7a6e91f: 276 files / 3893 passed, 1 skipped. plugin-security at b25e969: 128 files / 2501 passed. rest at b25e969: 194 files / 3265 passed, 1 skipped. Both of those read objectql dist built from the same rule-validator.ts. First red run before the pin updates: 5 failures, all pins of the retired fail-open branch (engine-reference-tenant-scope x4, plus a rule-validator fixture whose note rule faulted silently on a null quantity). New pins are in engine-field-predicate-fault.test.ts (13 cases, real engine plus in-memory driver, persistence read off the store). Ablation at 326ad25: 9 legs via scripts/ablation-replace.mjs WRAP mode, each under os-verify-lock with its own EXIT/INT/TERM trap. On every leg the anchor hit x1 and went to x0, the blob changed, and the restore was proven: blob 5bfc176263 == HEAD and git diff HEAD empty. A1 requiredWhen arm back to continue: 5 of 5 (a) red. A2 readonlyWhen return false: 3 of 3 (b) red. A3 stop at the first locking row: only the ok-row-first order case red. A4 traversal sentence off: only the lookup case red. A5a FALSE read as TRUE: (c) requiredWhen FALSE red. A5b every lock LOCKED: (c) readonlyWhen FALSE red. A5c TRUE routed to the fault builder: (c) required-not-fault red. A5d every lock UNLOCKED: (c) readonlyWhen TRUE red. A6 option fault arm pushes an error: (d) red. No build or dist preflight was needed: the subject resolves through relative source imports (./engine.js -> ./validation/rule-validator.js), not dist. Narrowed lint instead of the CI-owned pnpm lint: eslint --no-inline-config --format json on the 13 touched .ts files gave 13 files, 0 errors, 0 warnings, none ignored. Population: the /*.{ts,...} config object at eslint.config.mjs:971. Invariance: the config enables no type-aware linting (eslint.config.mjs:327), so no untouched file can change verdict. Measured at 7a6e91f.",
"gates": [
"node scripts/check-adr-0087-registration.mjs --base origin/main => exit 0",
"node scripts/check-adr-0087-registration.mjs --self-test => exit 0",
"node scripts/check-changeset-no-major.mjs --base origin/main => exit 0",
"node scripts/check-changeset-no-major.mjs --self-test => exit 0",
"node scripts/check-ci-filter-parity.mjs => exit 0",
"node scripts/check-closing-keyword-parity.mjs => exit 0",
"node scripts/check-closing-keyword-parity.mjs --self-test => exit 0",
"node scripts/check-comment-mask-adoption.mjs => exit 0",
"node scripts/check-comment-mask-adoption.mjs --self-test => exit 0",
"node scripts/check-comment-mask-corpus.mjs => exit 0",
"node scripts/check-empty-changeset.mjs --base origin/main => exit 0",
"node scripts/check-empty-changeset.mjs --self-test => exit 0",
"node scripts/check-engine-split-ratio.mjs --days 90 => exit 0",
"node scripts/check-engine-split-ratio.mjs --self-test => exit 0",
"node scripts/check-keyed-text-bounds.mjs => exit 0",
"node scripts/check-keyed-text-bounds.mjs --self-test => exit 0",
"node scripts/check-platform-object-tenancy-census.mjs => exit 0",
"node scripts/check-platform-object-tenancy-census.mjs --self-test => exit 0",
"node scripts/check-plugin-teardown-shape.mjs => exit 0",
"node scripts/check-plugin-teardown-shape.mjs --self-test => exit 0",
"node scripts/check-registry-log-declared.mjs => exit 0",
"node scripts/check-registry-log-declared.mjs --self-test => exit 0",
"node scripts/check-rest-log-spy-declared.mjs => exit 0",
"node scripts/check-rest-log-spy-declared.mjs --self-test => exit 0",
"node scripts/check-scripts-symbol-anchors.mjs => exit 0",
"node scripts/check-scripts-symbol-anchors.mjs --self-test => exit 0",
"node scripts/check-system-context-census.mjs => exit 0",
"node scripts/check-system-context-census.mjs --self-test => exit 0",
"node scripts/check-undeclared-dep-imports.mjs => exit 0",
"node scripts/check-undeclared-dep-imports.mjs --self-test => exit 0",
"node scripts/docs-audit/check-affected-docs.mjs => exit 0",
"node scripts/docs-audit/check-drift-comment.mjs => exit 0",
"node scripts/pm/release-rehearsal-clone.mjs --self-test => exit 0",
"pnpm --filter @objectstack/spec run check:duration-unit-keys => exit 0",
"pnpm check:agent-test-spelling => exit 0",
"pnpm check:bash32-floor => exit 0",
"pnpm check:changeset-gate-self-tests => exit 0",
"pnpm check:cli-command-ids => exit 0",
"pnpm check:cross-package-test-inputs => exit 0",
"pnpm check:dispatcher-error-vocabulary => exit 0",
"pnpm check:doc-authoring => exit 0",
"pnpm check:docs-transcript-drift => exit 0",
"pnpm check:driver-memory-census => exit 0",
"pnpm check:dts-closure => exit 0",
"pnpm check:dual-build-cjs-loads => exit 3",
"pnpm check:durability-log-level => exit 0",
"pnpm check:engine-double-contract => exit 0",
"pnpm check:entry-guard => exit 0",
"pnpm check:error-code-casing => exit 0",
"pnpm check:gitlink-declared => exit 0",
"pnpm check:issue-citations => exit 0",
"pnpm check:lean-entry-closure => exit 0",
"pnpm check:logger-receiver-detach => exit 0",
"pnpm check:nul-bytes => exit 0",
"pnpm check:objectql-double-limit => exit 0",
"pnpm check:objectui-changeset => exit 0",
"pnpm check:org-identifier => exit 0",
"pnpm check:page-declaration-shape => exit 0",
"pnpm check:parse-guard => exit 0",
"pnpm check:pm-changeset-deadline-census => exit 0",
"pnpm check:pnpm-filter-targets => exit 0",
"pnpm check:published-files => exit 0",
"pnpm check:query-options-erasure => exit 0",
"pnpm check:refd-timer-probe => exit 0",
"pnpm check:slot-lookup => exit 0",
"pnpm check:sourcemap-no-sources-content => exit 0",
"pnpm check:test-source-alias => exit 0",
"pnpm check:tier-file-adoption => exit 0",
"pnpm check:type-check-coverage => exit 0",
"pnpm check:type-check-debt => exit 0",
"pnpm check:watch-hint-literal => exit 0",
"pnpm check:where-matcher => exit 0"
],
"gates_reconciliation": "dispatch-gates --ran at 7a6e91f: 72 derived, 71 run, 1 NOT-MEASURED (check:dual-build-cjs-loads exit 3, PREREQUISITE NOT MET: needs a full pnpm build), 0 UNRUN. Two gates went red earlier and are now green: check:objectql-double-limit (the new test find double was limit-blind; it now honours limit) and check:doc-authoring (the prose-id baseline over-pinned lint ids #4889/#4977 that the message rewrite removed; shrunk with the prescribed --census-ledger). check:adr-0087-registration: green, disposition not-required (no-migration-prescription), classified BREAKING+bang+clause-2-narrowing.",
"line_budget": "changed lines 1252 (+979 / -273) over 15 files vs the human-merge threshold 5000: under. Not a governed surface (no .claude/docs/adr/skills/AGENTS paths)",
"files_changed": [
".changeset/19727-field-rule-predicate-fault-refuses-submit.md",
"packages/objectql/src/validation/rule-validator.ts",
"packages/objectql/src/cel-fault.ts",
"packages/objectql/src/master-detail.ts",
"packages/objectql/src/engine-field-predicate-fault.test.ts",
"packages/objectql/src/validation/rule-validator.test.ts",
"packages/objectql/src/validation/rule-fail-closed.test.ts",
"packages/objectql/src/engine-required-when-parent.test.ts",
"packages/objectql/src/engine-readonly-when-parent.test.ts",
"packages/objectql/src/engine-readonly-when-interdependent-locks.test.ts",
"packages/objectql/src/engine-reference-tenant-scope.test.ts",
"packages/lint/src/validate-expressions.ts",
"packages/lint/src/validate-expressions.test.ts",
"packages/lint/src/validate-null-guards.ts",
"scripts/doc-authoring-prose-id.baseline.json"
],
"deviations": [
"The file surface goes beyond the claim (rule-validator.ts + validation tests + .changeset). It adds: packages/lint/ (three author-facing requiredWhen messages said the server skips, which this change made false; fixed under the must-fix-what-your-change-falsifies rule); cel-fault.ts and master-detail.ts (docblocks made false); four engine-*.test.ts pin files and rule-fail-closed.test.ts (pins of the retired branch, flipped); scripts/doc-authoring-prose-id.baseline.json (the gate-prescribed shrink). No claim write was in the budget, so the seat needs to append these to the claim surface. packages/lint is a second cross-lane surface beside objectql.",
"Zone 2 item 2 assumed the unbound-scope-root arm "already refuses". Measured: it LOCKS. isReadonlyWhenLocked returns true, the strip drops the field with a warn and a readonly_when drop report, and the rest of the write proceeds (it refuses only under strictReadonlyWrites). Left unchanged per Zone 1 scope. See open_questions.",
"Zone 3 route (keep it inside rule-validator.ts + tests + changeset) was exceeded for the reasons above. Measurement wins.",
"Clause-2: the PR body line 2 isClause-②: no, verbatim from the claim and the dispatch. The changeset body carriesClause-②: no (narrowing)plus the BREAKING banner and a bang summary; the ADR-0087 gate reads those. See open_questions.",
"Merged origin/main (a0920b4) into the branch before opening the PR, per AGENTS.md section 10. No overlap with the touched packages (the incoming changes were runtime, drivers, service-analytics, cli, docs). Rebuilt the runtime and driver-turso closures and ran runtime tests on the merged tree.",
"NOT MEASURED: check:dual-build-cjs-loads (exit 3, needs a full workspace build). NOT MEASURED: dogfood suites (the showcase-readonly-when-parent / invoice dogfood tests need the full showcase stack; they belong to the CI Dogfood Regression Gate). The showcase predicates are covered by the census evaluation and the engine measurement.",
"Two os-verify-lock foreground calls exceeded the 600s tool timeout and were moved to the background by the harness (plugin-security+rest run, final objectql+lint run). I read both results from their logs before proceeding. No watcher is left running."
],
"mcp_calls": "0 (no MCP GitHub tools used)",
"api_writes": "2: (1) pr_create through scripts/pm/fleet-write/dispatch.mjs relay (POST /repos/objectstack-ai/objectstack/dispatches, run 36053399368, executed as POST /repos/objectstack-ai/objectstack/pulls draft=true, giving PR #20028 as objectstack-fleet[bot]); (2) this os-dev-report comment through scripts/pm/post-stamped.mjs (POST /repos//issues/19727/comments). git push is not counted. Reads were REST GETs only.",
"open_questions": [
{
"question": "D2 is implemented literally: a faulting requiredWhen refuses even a write that supplies the field, and a faulting readonlyWhen refuses even an unchanged echoed value. Should the refusal instead fire only when the verdict could change what is stored?",
"options": [
"A (implemented): literal D2. Any fault in a judged field-rule predicate refuses the submit.",
"B: refuse only when the verdict matters: requiredWhen when the field is empty (and the ADR-0113 pre-state is not a proven violation); readonlyWhen when the incoming value differs from the stored one. Measured basis: CEL absorbs an error in && (record.statsu == 'closed' && record.reason == nullis false when reason is set), so the same rule written as a validations[] script refuses only when the field is empty."
],
"recommendation": "A. Business need: no in-repo predicate faults (census), so B's relief has no measured user. Long-term: D2's own text refuses "the submit", and its rationale is "refusing is the only answer that neither invents a verdict nor hides that one is missing"; B hides a missing verdict whenever it is irrelevant. AI-safety: A surfaces a broken predicate on the first write, while B lets it sit until the one write that leaves the field empty. Startup focus: A is the smaller rule, and B adds a value-equality notion to the lock strip. B stays available if production refusals prove noisy."
},
{
"question": "The readonlyWhen unbound-root arm still LOCKS (strips the field, write proceeds) instead of refusing. D2 literally says a predicate that cannot be evaluated refuses the write, but Zone 1 scoped this card to the non-root arm.",
"options": [
"A: keep LOCKED (this PR). It is conservative and already reported (warn plus the readonly_when drop report; refused under strictReadonlyWrites).",
"B: a separate card to make it refuse too, which moves the #4889 pins and the lint LOCKED consequence text."
],
"recommendation": "A for this card, since Zone 1 excludes it. Raise B only if the maintainer reads D2 as covering the unbound-root arm."
},
{
"question": "Should PR #20028 body line 2 carry the arm,Clause-②: no (narrowing), to match the changeset? The dispatch specifiedClause-②: no.",
"options": [
"A: seat edits line 2 toClause-②: no (narrowing), so Check Changeset enforces the (already satisfied) minor level.",
"B: leave it; the ADR-0087 gate already reads the narrowing from the changeset."
],
"recommendation": "A. The narrowing is real and the level is already minor, so the edit costs nothing and makes the PR-level declaration accurate."
}
],
"out_of_scope_findings": [
"class: c · A field-level requiredWhen/readonlyWhen that reads through a lookup (record.account.tier) is accepted at authoring: FieldSchema's EvaluatedExpressionInputSchema, and lint validate-expressions.ts passes traversalHydration only for validation-rule conditions (the site near :1538-1545). The runtime never hydrates it. Before this PR the write was silently skipped; since this PR every write that reaches the read is refused, with a sentence naming the reference (pinned in engine-field-predicate-fault.test.ts, lookup case). Producer: object field metadata requiredWhen/readonlyWhen, stored and re-authored. Seam: spec:FieldSchema.requiredWhen / readonlyWhen -> runtime:rule-validator.ts evaluateValidationRules / isReadonlyWhenLocked; lint:validate-expressions.ts traversalHydration. In-repo census: 0 such predicates. Dedupe words:requiredWhen lookup traversal authoring·field-level predicate reads through reference·readonlyWhen record.fk.field not hydrated·traversalHydration field rule",
"noted, not filed (acceptance note): for a detail whose header FK does not resolve and that carries a parent-scoped requiredWhen, the first error is now the requiredWhen refusal ('no header could be resolved') instead of header: reference_not_found, because evaluateValidationRules runs before assertReferencesResolve. carrier: 承接者:无",
"noted, not filed (dead code): NullGuardOutcome 'fail-open' in packages/lint/src/validate-null-guards.ts has no caller after this PR, and its clause text still describes the old requiredWhen runtime. The doc comment says so. carrier: 承接者:无"
]
}Seat review — PR #20028 (head
7a6e91f5fd), 2026-09-24T20:34Z: the surface amendment and the dev's three questionsdomain:specseat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d), claim5819444783. Verified against GitHub and the at-tier record5821798690, ⛔ not against the report.Claim-surface amendment (the bounded in-place exemption, recorded here). The claim named
rule-validator.ts+ validation tests +.changeset/. The head also touches the files below. The at-tier record's ①(d) found each one forced by "fix what your change makes false", and the dev reported every one:packages/lint/src/validate-expressions.tsandvalidate-null-guards.ts, plus the test that pins their strings: three author-facing messages said the server skips a faultingrequiredWhen. This is a second cross-lane surface, besidepackages/objectql.packages/objectql/src/cel-fault.tsandmaster-detail.tsdocblocks: both stated fail-open.- Five engine pin files: pins of the retired fail-open branch, flipped with no guarantee lost (record ①(d)).
scripts/doc-authoring-prose-id.baseline.json: the gate-prescribed shrink.
The dev's questions, answered by the seat:
- Literal D2 (A) stands. ADR-0137 D2 says a field-rule predicate that cannot be evaluated "refuses the write". Nothing in it conditions the refusal on the field being empty or changed, and B would hide a missing verdict exactly where D2 forbids it (record ①(c)). No maintainer question is owed: this is the ruled text.
- The unbound-root
readonlyWhenarm stays LOCKED in this card. Triage (5788580082) scoped the card to the non-root arm. Whether D2 also reaches that arm is recorded here for triage. ⛔ This PR does not re-rule it. - PR body line 2. It now reads
Clause-②: no (narrowing), matching the changeset. That was the at-tier FAIL's one blocking item. The claim's ownClause-②: nostays as it is: the claim line takes exactlyyes | no(execution-duties.md), and the arm lives on the PR and in the changeset.
Next. Once
Check Changesetre-runs on the edited body, with the level axis now armed, the same reviewer re-checks this head. On PASS and green CI the PR lands through the allow-listed ccr pair. That landing is currently stopped on the classifier denial recorded at5819399538; it waits for the maintainer.Carried to after landing: the dev's class-(c) finding. A field-level
requiredWhen/readonlyWhenthat reads through a lookup is accepted at authoring but never hydrated, so since this PR every write that reaches it is refused. It will be filed with its landing citation.
Generated by Claude Code
Landing stop — PR #20028 (
landing-operations.md:54). 2026-09-24T22:59Z- Command, the allow-listed ccr row, verbatim:
curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectstack/pulls/20028/ccr/ready_for_review -d '{}' - Denied by the session's auto-mode classifier:
[Auto-Mode Bypass]. It is the same denial recorded for fix(lint): walk page filterBy and lookup-field lookupFilters as authored filters #19818 in5819399538, now repeated after the maintainer asked in chat why the green PRs are not merged. - State at the attempt: head
7a6e91f5fd, the at-tier PASS5821892253names that head, 41 of 41 checks green,mergeable: true(clean), not governed (check-governed-merges.mjs --pr 20028: 0 of 15 paths, 1252 lines). - Stopped. The command was not respelled and not re-routed through the relay. PR fix(objectql)!: a field-level requiredWhen / readonlyWhen that cannot be evaluated refuses the write (ADR-0137 D2) #20028 stays draft; landing waits on the maintainer (a permission rule for the ccr pair, or the maintainer's own ready and merge).
Generated by Claude Code
- Command, the allow-listed ccr row, verbatim:
Landed — PR #20028 →
5dba7f3bd0, 2026-09-25T01:53Zdomain:specseat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d). Landed through the merge queue only; ⛔ no hand approval, no hand merge.- Landing channel. The allow-listed ccr pair (
ready_for_review, thenauto_merge). Its earlier classifier denials (5819399538, and the repeat recorded on [#18682 v1 切出] UI 谓词三缝(visibleWhen / readonlyWhen / requiredWhen)在关联字段不可读时 fail-open —— 父卡裁定的「不可读即响亮报错、⛔ 绝不静默为真」在这三缝上今天做不到 #19727) cleared when the maintainer turned the session's auto mode off: 「是auto 的问题，我取消auto了，你再试试」. The command was not respelled and not re-routed. - Merged by the queue at 2026-09-25T01:42Z. The card closed
completedthroughFixes #19727, the PR body's only closing keyword. - The squash
5dba7f3bd0has one parent and is an ancestor oforigin/main. Content probe:git patch-id --stableof the squash's own diff equals that of the PR's diff from its merge base to head7a6e91f5fd, the head the at-tier PASS5821892253names. pm:dispatchedand the assignee are removed in one label write. Nothing on this card remains in flight.
Generated by Claude Code
- Landing channel. The allow-listed ccr pair (
本卡承 #18682 v1 切出的那一半:
visibleWhen/readonlyWhen/requiredWhen三条 UI 谓词缝。父卡 #18682 留的是checkPredicate(校验规则)那一条缝 —— 它是四缝里唯一 fail-closed、因而唯一今天就能兑现父卡权限语义的一条。Path: P3 | 那条路第 3 步「验证响亮拒绝错的、放行对的」 | UI 谓词三缝遇到不可读的关联字段时静默放行
出处:一次实测,⛔ 不是推断
domain:specseat 5(座位贴 #19357)在 #18682 的施工轮上派出的测量,读于origin/main=fb7b74691f7d192430f6b3b457a858dc442ad0e0。施工轮报告见 #18682 评论5775939494,本席的裁决见5776007340(Q2 = A:v1 只做一条缝,三缝切到本卡)。缺陷
#18682 的卡面(维护者裁决 batch #148 item 1 letter B)写明权限语义:
实测:四条缝里只有一条做得到。
No such key这类故障时checkPredicate(rule-validator.ts:2713)unevaluableRuleError,拒绝写入(#4649)evaluateOptionVisibility(rule-validator.ts:2150)logger?.warn之后continue; // fail-open⇒ 在
visibleWhen/readonlyWhen/requiredWhen上,一个不可读的关联字段产出的正是父卡明文禁止的那种静默不执行。文件自己的 docblock 把代价写得很直白:一条 fail-open 的requiredWhen「ACCEPTS a record that should have been rejected」。把这三缝翻成 fail-closed 会反转三条有意为之的裁决:#4889 · #4953 · #6457。按规矩这要它自己的 ADR 或一次修订,并且会改变已存储谓词今天的判决。⇒ 接手的人第一步是把这件事摆进决策通道,⛔ 不是直接动刀。
三条路,⛔ 本卡不选、不排序:
requiredWhen的代价(放行本该拒的记录)与visibleWhen的代价(多显示一个控件)不同量级,未必该同一个答案。⛔ 本卡不主张的事
checkPredicate—— 它已经是 fail-closed,且是父卡 v1 的落点。查重词
visibleWhen fail-open unreadable field·evaluateOptionVisibility continue fail-open·requiredWhen accepts a record that should have been rejected·UI predicate permission guarantee·relationship traversal UI seams出处链
#18682(父卡,v1 保留
checkPredicate一缝)· #4649(checkPredicate 的 fail-closed)· #4889 · #4953 · #6457(三缝 fail-open 的既有裁决)· #18318 / 裁决 5716041368Generated by Claude Code