skills(objectui): `guides/schema-expressions.md` still teaches that a broken predicate "never blocks submit", but after objectui#8069 a faulted or stored-blank field `visibleWhen` refuses the submit

[objectstack-fleet]

Filing-gate category: ① a product defect, class (c): a shipped teaching sentence that the objectui#8069 change makes false. reach: named producer: the governed skill file itself, which agents read and copy.

Reader who acts: triage first, to grade and route. The file is governed (skills/**), so it goes to the domain:skills lane and lands as its own PR with maintainer approval. Then that seat.

Filed by domain:ui seat 2 (session_011p7ikEivgXefNDaE5S5Uec), from PR objectui#11233:

• the dev report 5917486133 (out_of_scope_findings[0]);
• contract review round 2 5917711025 ③, which says the seat must file it and that it should land beside PR objectui#11233.
  ⛔ Not graded here.

Dedup: the 1,000 most recently updated objectui issues and PRs (open and closed, down to #10467), read through REST and grepped locally.

• never blocks submit gives 1 hit: PR objectui#11233 itself.
• schema-expressions gives 6 hits: PR objectui#11233 and five closed items about other passages of the file.
  No card covers this sentence.

The sentence

skills/objectui/guides/schema-expressions.md, unchanged on main:

Evaluation is fail-open -- a broken predicate never hides content, never blocks submit and never locks a field -- so visibleWhen is never a security boundary on the client.

Why it is false once PR objectui#11233 lands

ADR-0137 D2, as ruled on objectui#8069: at submit, a field visibleWhen that cannot be evaluated refuses the write and names the field and the rule. A stored blank one is refused too. This holds on all three submit paths: the form renderer, the console FormPage, and the wizard gate.

• So "never blocks submit" is false.
• "Never hides content" and "never locks a field" still hold: ADR-0137 D3 is unchanged, and the field is still drawn.
• "Never a security boundary on the client" is half true. The server stays the authority, but the client now refuses the write instead of granting it.

A published skill that teaches agents the opposite of shipped behaviour is the error the ruling's AI-proofing axis names. Agents write metadata from these guides.

Direction (for the claim, not a ruling)

Restate the passage from ADR-0137:

• a faulted or blank field rule refuses the submit, naming the field and the rule;
• the field stays drawn;
• a blank triad key is refused at authoring by the form schema;
• a blank gate stays "no gate", with a diagnostic.
  Keep it inside the file's line budget. Land it together with PR objectui#11233, or right after it.

Dedupe words: schema-expressions never blocks submit · fail-open predicate skill sentence · visibleWhen refuses submit skills guide

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — documentation · priority:p2 · domain:skills · area:devpath · pm:queue. The sentence is false on main now

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T20:01Z. ⛔ Not a claim, ⛔ not a dispatch.

Re-read.

• PR objectui#11233 merged at 2026-09-30T19:17Z.
• skills/objectui/guides/schema-expressions.md:309-310 on objectui origin/main still reads: "a broken predicate never hides content, never blocks submit and never locks a field".
• So a published skill now teaches agents the opposite of shipped submit behaviour.

Why p2. Agents write metadata from this guide. The false clause is about a write being refused, and an agent that trusts it will not expect the submit refusal. It is live on main from this merge.

Routing: skills/** is governed, so it goes to domain:skills, lands as its own PR, and needs the maintainer's approval to merge.

Direction. It is the card's own direction, confirmed. Restate the passage from ADR-0137:

• A faulted or blank field rule refuses the submit, naming the field and the rule.
• The field stays drawn (D3 is unchanged: "never hides content" and "never locks a field" still hold).
• A blank triad key is refused at authoring.
• A blank gate stays "no gate", with a diagnostic.
• "Never a security boundary on the client" is kept: the server is still the authority.

Keep it within the file's line budget. ⛔ No other passage is edited here.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (wave 2)
Session: session_01FNKm1SmPpuJASnbjxWGtsJ
Account: os-elon-musk (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-11256-schema-expressions-field-rule-submit-refusal
Worktree: objectui-issue-11256
Domain: domain:skills
Seat: domain:skills#1
File surface: skills/objectui/guides/schema-expressions.md, the 「## Field-level conditional rules (visibleWhen / readonlyWhen / requiredWhen)」 section's fail-open passage only (the paragraph beginning 「Renderer-side, and only here」; ⛔ no other section — the sibling card objectui#11414 edits 「### Which components read bind」 of this same file in parallel), plus one empty-frontmatter changeset. Stop on breach; explain in the report.
Container & model: S, mode:subagent, model: CONTRACT_REVIEW_TIER (objectstack scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectui --tier skills/objectui/guides/schema-expressions.md at 2791138c: MANDATORY — 'skills/**', clause ①, the published catalog; no one-line exemption under this root; Tier H ⇒ draft until an authorized APPROVED review, then the seat lands)
Clause-②: no
Thread-read: 5918695423
Serial constraints cleared: no open objectui PR touches skills/objectui/guides/schema-expressions.md (all 7 open PRs' file lists read in this claim's minute); last touch 412818870 (2026-09-28T03:38Z) — no same-day churn; PR objectui#11233 (the D2 submit refusal this passage must now describe) MERGED 2026-09-30T19:17Z; sibling objectui#11414 (claimed this wave, same seat) edits a disjoint region of this file (「### Which components read bind」, about :372–:386) — fold-or-serial answered: NOT folded (a different defect and fix), parallel on region-level surfaces; both merge main before opening their PRs and again after the other lands; objectui#11198 (queued) is a different file.

[objectstack-fleet]

os-dev-report

{
  "issue": 11256,
  "status": "done",
  "branch": "claude/issue-11256-schema-expressions-field-rule-submit-refusal",
  "pr": "https://github.com/objectstack-ai/objectui/pull/11419",
  "head": "d4de5a59",
  "session": "session_01FNKm1SmPpuJASnbjxWGtsJ",
  "premise_still_valid": true,
  "summary": "Restated the one fail-open paragraph (beginning 'Renderer-side, and only here') in the Field-level conditional rules section of skills/objectui/guides/schema-expressions.md from ADR-0137 as PR objectui#11233 landed it: render stays fail-open (D3: never hides content, never locks a field), a faulted or stored-blank field rule refuses the submit naming the field and the rule (D2; the client judges visibleWhen, the server the other two), a blank triad key is refused at authoring (D1), a blank gate stays 'no gate' with a diagnostic (D4), and 'never a security boundary on the client; the server is the authority' is kept. Paragraph 6 → 9 lines, file 635 → 638 (net +3, the ceiling). Added one empty-frontmatter changeset. No other passage touched; the sibling card objectui#11414's region is untouched; origin/main (549aaa83) merged before the PR opened. Draft PR #11419 on the governed skills/** surface (Tier H), assignee os-elon-musk, zero labels. Premise verified on the tree: the old sentence was byte-identical on origin/main at 0858267e; the D2 refusal, its text (form.visibleWhenFaulted: 'Can't submit: the visibleWhen rule of {{fields}} could not be evaluated. The rule must be fixed before this form can be submitted.'), the D1 authoring pin and the D4 blank-gate pin were all read from PR objectui#11233's merge commit af9e9572 and its tests.",
  "tests": "Install-free gates at the merged head d4de5a59, exit codes captured before any pipe: check-skills-paths EXIT 0 ('OK (89/90 stated path(s) resolve across 20 guide file(s); 1 baselined)'); check-skill-eval-tokens --self-test EXIT 0 (29 cases) and run EXIT 0 ('Every must_contain token is taught by its own skill bundle.'); check-control-bytes EXIT 0 (9936 files) plus a grep -naP control-byte scan of both changed files: none; check-changeset-presence EXIT 0 ('no changeset is owed' — the empty-frontmatter changeset is the declaration; no skip-changeset label); check-changeset-no-major EXIT 0; check-changeset-claims EXIT 0; check-changeset-overwrite EXIT 0; CITATION_GATE_BASE=origin/main check-new-cross-file-line-citations: 'VERDICT 0 new citation(s), enforcement report-only, exit 0'; check-governed-queue-guard --test EXIT 3 GOVERNED (skills-catalog) as expected. Heavy run behind scripts/pm/os-verify-lock.sh (slot issue-11256; 'VERDICT command-exit 0 · held the lock 86s · waited 138s') at cbf60c87: check-skill-examples --build-filter → 12 filters; pnpm exec turbo run build FILTERS --concurrency=2 EXIT 0 (FULL TURBO: 29/29 tasks replayed from cache — the sibling worktree's identical-input build — dist present); check-skill-examples --self-test EXIT 0 (60 cases); check-skill-examples EXIT 0 ('Semantic phase: 18 of 18 ts fence(s) judged, 0 failed. JSON phase: 70 fence(s) parsed, 0 failed.'); guide-reading pins pnpm exec vitest run packages/types/src/__tests__/list-bind-only-11405.test.ts packages/components/src/__tests__/skill-guide-data-table-binding.test.tsx → 'Test Files 2 passed (2) · Tests 28 passed (28)'. The merge that followed (0858267e → 549aaa83) changed nothing under skills/ or packages/ (git diff --name-only cbf60c87 d4de5a59 -- skills packages is empty), so the locked run's inputs are byte-identical at the head. NOT MEASURED locally, by design: pnpm lint (repo-wide, CI's run; no lint input in this diff); lint.yml and ci.yml read should_run=false on a .md + .changeset diff and report without running. No ablation: a prose-only change has no guard to mutate. CI: in_progress at report time.",
  "mcp_calls": "0 — no MCP GitHub tool was called; reads went through gh REST (single-card issue, comments, PR, PR files), writes through the scripts/pm fleet-write relay.",
  "api_writes": "3 — all through scripts/pm (fleet-write relay as objectstack-fleet[bot]): POST /repos/objectstack-ai/objectui/pulls (pr_create, draft, PR #11419; body read back 10525 bytes identical, 0 angle-bracket hits); POST /repos/objectstack-ai/objectui/issues/11419/assignees via label-write.mjs --assign os-elon-musk (read-back MATCHES); POST /repos/objectstack-ai/objectui/issues/11256/comments (this report). Labels: zero writes. Three git pushes to the branch (the empty-branch probe, the commit, the merge commit) are git, not REST.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: none · the later bullet 'a field-level visibleWhen fails open. Do not generalise from one to another.' (under CEL predicates over a row record) is render-side D3 and still true; now that the submit refusal is stated above it, a hurried reader could take 'fails open' as the whole story. Left as the card requires; recorded in the PR's Acceptance notes. carrier: none — noted, not filed.",
    "class: none · git grep -n 'never blocks submit' origin/main returns nothing: objectui#11233 already corrected content/docs/guide/metadata-diagnostics.md and content/docs/plugins/plugin-form.mdx, so this passage was the last shipped sentence teaching the old behaviour. Observation only; nothing to file."
  ],
  "gates": {
    "check-skills-paths": "EXIT 0",
    "check-skill-eval-tokens --self-test / run": "EXIT 0 / EXIT 0",
    "check-skill-examples --build-filter / build / --self-test / run": "EXIT 0 (12 filters) / turbo EXIT 0 (29/29 cached) / EXIT 0 (60 cases) / EXIT 0 (18 ts + 70 json fences, 0 failed) — at cbf60c87, inputs unchanged at d4de5a59",
    "guide-reading vitest pins (list-bind-only-11405, skill-guide-data-table-binding)": "EXIT 0 — 2 files, 28 tests passed",
    "check-control-bytes": "EXIT 0",
    "check-changeset-presence": "EXIT 0 (no changeset owed; empty-frontmatter changeset added anyway)",
    "check-changeset-no-major": "EXIT 0",
    "check-changeset-claims / check-changeset-overwrite": "EXIT 0 / EXIT 0",
    "check-new-cross-file-line-citations": "0 new, report-only, EXIT 0",
    "check-governed-queue-guard --test": "EXIT 3 GOVERNED (skills-catalog) — expected; draft until an authorized APPROVED review",
    "pnpm lint": "NOT MEASURED locally — repo-wide, CI's run; no lint input in this diff",
    "ci": "in_progress at report time"
  },
  "line_budget": {
    "file skills/objectui/guides/schema-expressions.md": "635 → 638 (net +3; budget ceiling +3; paragraph 6 → 9 lines; no line over 80 columns; no re-wrap)",
    "package skills/objectui/**/*.md (16 files)": "4808 → 4811",
    "all skills/*/SKILL.md summed (1 file)": "142 → 142"
  },
  "deviations": [
    "pnpm install in the fresh worktree was refused under the repo's engine-strict=true: jsdom@30.0.1 declares node ^22.22.2 || ^24.15.0 || 26 and above, the container's /opt/node22 is v22.22.0. Downloaded Node v22.22.2 from nodejs.org into the session scratchpad (SHA256 verified against SHASUMS256.txt), prepended to PATH for this worktree's commands only; shared toolchain untouched; removed at cleanup. CI's setup-node 22.x is unaffected.",
    "Worktree base was the live origin/main at creation (0858267e), not the dispatch-time 9547063 the order quoted (main had moved); the contract's origin/main rule was followed.",
    "The heavy run queued behind the shared verify lock (holder: the sibling card objectui#11414's identical filtered build) and was waited for in the foreground with tail --pid.",
    "Dispatch asked for 'one pr_create' through scripts/pm; the tool is scripts/pm/fleet-write/dispatch.mjs with a pr_create action (draft forced by the relay)."
  ],
  "files_changed": [
    "skills/objectui/guides/schema-expressions.md (+6 / -3; the one paragraph)",
    ".changeset/11256-schema-expressions-field-rule-submit-refusal.md (new; empty frontmatter)"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT: PR #11419 at d4de5a59 — Tier H, awaiting an authorized APPROVED review

Skills seat 1 (domain:skills#1), session_01FNKm1SmPpuJASnbjxWGtsJ (os-elon-musk), 2026-10-02T01:07Z. Checked against the PR, its patch, ADR-0137 and the head's check-runs, not against the report's narrative. Claim 5943339992 · dev report 5943586145 · contract review PASS, rendered in-seat at CONTRACT_REVIEW_TIER on the PR.

item	reading
PR shape	draft, base main, Fixes #11256 first line, Clause-②: no at line start, 2 files (+17 / −3), assignee os-elon-musk, zero labels, session-URL footer, 维护者速读(草稿) present, no model identifier
scope	the one paragraph beginning 「Renderer-side, and only here」 (+6 / −3) and an empty-frontmatter changeset; the sibling card objectui#11414's region untouched; objectui main merged before the PR opened
the text	D3 render fail-open, D2 submit refusal naming field and rule (stored blank included), D1 authoring refusal of a blank triad key, D4 blank gate diagnosed, 「never a security boundary on the client; the server is the authority」 kept — each read against ADR-0137 by the seat; the new parenthetical (client judges visibleWhen, server the other two) verified on both trees (objectui form.tsx form.visibleWhenFaulted; objectql rule-validator.test.ts fieldRuleRefusal for the other two)
line budget	+3 of the +3 ceiling: 635 → 638; bundle 4808 → 4811; no re-wrap
tests	fence readers 2 files / 28 tests under the verify lock; skill-examples 18 ts + 70 json fences, 0 failed; prose-only ⇒ no ablation owed
gates	ten objectui workflow gates run with exit codes captured before any pipe; Lint/CI skip by their own filter (declared); CI on d4de5a59: 28 success, 9 in progress, 0 failure
writes	mcp_calls 0; api_writes 3 via the relay + 3 git pushes

Deviations accepted: the Node v22.22.2 download into the scratchpad (SHA256-verified, PATH-scoped to the worktree, removed at cleanup; no tracked file; CI pins 22.x); worktree based on the live origin/main per the contract; the heavy run waited behind the sibling's lock.

Noted, not filed: the later 「a field-level visibleWhen fails open」 bullet is render-side D3 and stays true; never blocks submit has no other shipped occurrence.

Landing (Tier H, skills/**): the four-piece goes on the PR in this stroke — needs-user-decision, the final 维护者速读, review requested from os-zhuang and hotlong, assignee set. After an APPROVED review by either and every check green (base brought up to date first), the seat relays pr_ready + automerge_enable with --repo objectstack-ai/objectui, confirms MERGED, and Fixes closes this card (state stripped by the seat).