[finding] The runtime gate runs `validateVisibilityPredicates` at its `runtime` layer default for schema-bound metadata forms, so a correctly `data.`-rooted form is told to use `record.`

[os-help]

Found while implementing #7696 (PR #7810), disclosed in that PR's body and deliberately not fixed there — it is a layer-plumbing question in the gate, not the bare-word prescription pair that card reopened. Filed so it does not scroll away with a PR body.

Filed unassigned, observation class. ⛔ Grading is the triage seat's single channel.

What was measured

At the runtime publish gate, validateVisibilityPredicates runs with opts.layer at its 'runtime' default for every view — including schema-bound metadata forms, whose predicates are correctly rooted at data..

Two consequences, both visible in PR #7810's 14-row controls table:

1. Every FORM row draws a warning visibility-root-mislayered telling the author to use record. — on metadata that is correctly written. It appears on all form rows in that table (marked ¹), including the ones that are otherwise silent.
2. Before fix(lint): one prescription for a bare unquoted word on the right of == (#7696) #7810, visibility-bare-identifier prescribed record.active on those sites — not the data.active that [finding] Two publish-time rules give an author contradictory fixes for the same bare unquoted word — visibility-bare-identifier (error) says data.active, predicate-rhs-path-shaped (warning) says 'active' #7696's issue body quotes. The prescription an author actually saw was rooted for the wrong layer.

⚠️ Point 2 means the card that produced this finding was itself working from a slightly wrong quotation of the message, and nobody noticed until someone measured the gate instead of reading the rule. The reconciliation in #7810 is unaffected (it removes that prescription for this position entirely), but the layer default is still there for every other rule that consults it.

Why it is worth a card

This is an advisory that is wrong on correct metadata, at the publish door, for a whole surface class. It is the same harm shape as #7696 — an author is told to change something that is already right — differing only in that it warns rather than blocks.

It also has the property that makes this class expensive: nothing goes red. The gate is green, the advisory is emitted, and the only symptom is authors (or AI authors) being steered toward record. in a place where data. is the correct root.

What is NOT being claimed

• ⛔ Not a defect in visibility-root-mislayered itself — the rule is correct for the layer it is told it is on.
• ⛔ Not a defect in fix(lint): one prescription for a bare unquoted word on the right of == (#7696) #7810 — that PR removes the affected prescription for the bare-RHS position specifically, and states this remainder rather than absorbing it.
• The fix is plausibly a one-line plumbing change (pass the real layer for schema-bound form sites), but "plausibly one line" is exactly the shape that turns out to have a reason, so it is filed as a finding rather than asserted as a trivial fix.

Pointers

• packages/lint/src/validate-visibility-predicates.ts — the rule and its opts.layer default
• packages/lint/src/runtime-gate.test.ts — where the gate's invocation is pinned
• packages/lint/src/predicate-rhs-position.ts (new in fix(lint): one prescription for a bare unquoted word on the right of == (#7696) #7810) — schemaIdOf, the shared "the metadata-admin evaluator renders this surface" test, which is the same discrimination a layer fix would need
• [finding] Two publish-time rules give an author contradictory fixes for the same bare unquoted word — visibility-bare-identifier (error) says data.active, predicate-rhs-path-shaped (warning) says 'active' #7696 / PR fix(lint): one prescription for a bare unquoted word on the right of == (#7696) #7810 (surfaced it), lint: publish-time predicate validation should refuse a path-shaped RIGHT-hand side — outside the renderer's declared ==/!= subset, and unreachable by #7214's resolution check #7659 / PR feat(lint): refuse a path-shaped ==/!= right-hand side at publish time (#7659) #7691, Publish-time validation of predicate path references — a spec-delivered predicate naming a nonexistent path should fail at authoring, not evaluate to a guess at render (#6936 companion) #7010 / PR feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214