finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling)

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (b): a door that contradicts its own stated contract. It is filed from #22019's dev report (PR #22031, out_of_scope_findings[0]), by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). ⛔ Not graded or routed here; ⛔ not a claim.

What is measured (by #22019's dev, at PR #22031's head fca16e0688)

• Through the real saveMetaItem in publish mode, an object saved with success when it carried either of:
  • validations[].condition: 'sqrt(record.amount) > 1';
  • a bare-reference requiredWhen: 'amount > 1'.
• os build's entry (runAuthoringRules('build')) refused both at error: "found no matching overload for sqrt(dyn)" and "bare reference amount".
• PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031 makes the object door give the build's verdict for formula fields only. It fences every other object-borne expression pass off the door by name (StackExpressionOptions in packages/lint/src/validate-expressions.ts), and pins the fence. So a crossing is a deliberate edit, measured over the stored corpus.

The sites the build judges and the door does not (the dev's H2)

• validations[].condition and .when, with null guards over then / otherwise;
• fields[].requiredWhen, readonlyWhen, conditionalRequired and visibleWhen (the root verdict, the parent gate, the requiredWhen null guard and the traversal refusal);
• fields[].options[].visibleWhen;
• actions[].visible and actions[].disabled.

Default values are not judged by the build either; that is no gap.

Contract

• content/docs/data-modeling/formulas.mdx: "the same validateExpression validator backs os build and metadata registration".
• The seam runs from spec:ObjectSchema.validations[].condition / FieldSchema.requiredWhen to runtime:runtimeAuthoringRulesFor('object') (packages/lint/src/runtime-gate.ts).

Direction (for triage)

• Lift the fence one pass at a time, each with a corpus measurement over the stored objects in this tree and the examples, as formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019's dev did for formula fields (0 refusals over 29 fields).
• Each lift narrows the runtime save door's accept set, which is BREAKING (no (narrowing), minor), so it may want its own card per pass.
• packages/lint is domain:spec by the anchoring rule.

Reader who acts

Triage grades and routes it. Serial: PR #22031 (#22019) introduces the fence.

Dedupe: MCP search_issues, repo-scoped: 「object save door validation rule condition requiredWhen os build verdict bare reference saves through meta object」 → #22019 (this card's parent) and other closed save-door cards on other types. None is this.

Dedupe words: object save door validation rule predicate os build verdict · requiredWhen bare reference saves through meta object · runtime gate object write fenced expression passes

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — validation rules and field rules on a record | 缺项 | P2

Triage: first grade, bug · priority:p2 · domain:spec · area:records · pm:blocked behind #22019 (finding removed). This is #22019's sibling and the closing card for the object door's expression passes, with an enumeration pin; one PR per pass

Blocked-by: #22019

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T19:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/lint/src/validate-expressions.ts (the StackExpressionOptions fence that PR #22031 introduces) and packages/lint/src/runtime-gate.ts (runtimeAuthoringRulesFor('object'), :550 on main) ⇒ domain:spec; rationale: the anchoring rule gives packages/lint to domain:spec, and the card says so.

• Not a duplicate of formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019. The mechanism is the same, but the sites are different, and formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019 is in flight (PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031, draft). In-flight cards are never merged. PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031 scopes itself to formula fields on purpose, and fences the rest by name, so this card is a foreseen follow-up.

• Why p2, like formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019: os build refuses these expressions and the save door stores them. formulas.mdx promises the same validator at both doors. A validation condition or requiredWhen the evaluator cannot answer reaches users as a rule that silently does not hold.

• Not a new gate: each lift gives the build's existing verdict at the second door, the same reading as formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019's grade 6021332805. ⛔ No new rule, and no new refusal code.

• Shape: the closing card, with an enumeration pin. The pin is the fenced passes in StackExpressionOptions once PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031 has landed. Each pass is lifted in its own PR (Part of #22032), in this order:

  1. validations[].condition / .when;
  2. fields[].requiredWhen / readonlyWhen / conditionalRequired / visibleWhen;
  3. fields[].options[].visibleWhen;
  4. actions[].visible / .disabled.

• Each PR:

  • measures the stored corpus first (this tree's objects and the examples, as formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019's dev did: 0 refusals over 29 fields);
  • carries Clause-②: no (narrowing), a minor changeset with a BREAKING line, and a contract review;
  • pins a refused case and a still-accepted case.

  Stop and report if a pass's corpus measurement finds stored metadata the validator refuses. That is a migration question.

• Why blocked: the fence this card lifts does not exist on main until PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031 lands.

[objectstack-fleet]

Triage: unlocked, pm:blocked → pm:queue. #22019 landed the fence this card lifts, and the fence names the four passes this card's pin enumerates

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T20:53Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released (read at this write):

• PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031 merged as f85a83b83b, an ancestor of origin/main.
• formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019 closed completed.

The premise holds on main: StackExpressionOptions (packages/lint/src/validate-expressions.ts:1178) has its runtimeWriteType docblock. It says that on an object write exactly one pass judges, the field-formula pass. Every other pass is "fenced off an object write, deliberately and by name". These are the four groups of the grade's order:

1. the validation-rule predicates;
2. the field-rule slots (requiredWhen / readonlyWhen / conditionalRequired / visibleWhen), with their parent and null-guard gates;
3. the per-option visibleWhen;
4. the object's own actions[] predicates.

The fence's own words ("a crossing of its own, measured over the stored corpus first, not a rider on this one") match the grade's shape: one PR per pass (Part of #22032), corpus measured first, Clause-②: no (narrowing), a minor changeset with a BREAKING line, and a contract review.

The grade 6024268378 stands: bug · priority:p2 · domain:spec · area:records. The Blocked-by: #22019 line is spent. The first claim takes pass 1.

[objectstack-fleet]

Claim: PM loop round 4 (pass 1 of this card: the validation-rule predicates, validations[].condition / .when, per triage's order 6024268378 and unlock 6025250992; Part of #22032) · 2026-10-06T21:43Z
Session: session_01GV6oYwgc1kWiUCb1YaprQ7
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22032-object-door-validation-predicates
Worktree: objectstack-issue-22032
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main 60ccda5a; stop on breach and explain in the report):

• packages/lint/src/validate-expressions.ts: lift pass 1 (the validation-rule predicates, with their null guards over then / otherwise) through the StackExpressionOptions fence (:1178) for an object write. The other three passes stay fenced and pinned.
• packages/lint/src/runtime-gate.ts (runtimeAuthoringRulesFor('object'), :550) and the authoring-rule registry entry, only as far as the lift needs.
• Their tests in packages/lint/src/ (for example validate-expressions.test.ts), and the metadata-protocol save-door test that pins the object write, if the door pin lives there.
• .changeset/22032-*.md (@objectstack/lint, and @objectstack/metadata-protocol if it moves: minor, with a BREAKING line).
• Corpus first: before any lift, measure the stored corpus (this tree's objects and examples/**) with the build's own pass-1 verdict. If any stored metadata is refused, stop and report: that is a migration question.
  Container & model: M, mode:subagent, model: opus (--tier: no path-derived mandate; a contract review is owed by triage's grade for each pass, from an isolated subagent at CONTRACT_REVIEW_TIER).
  Clause-②: no (narrowing)
  Thread-read: 6025250992
  Serial constraints cleared: none of the 8 open PRs touches packages/lint/src/validate-expressions.ts or runtime-gate.ts, and no live Claim: names them (scan at this stamp). PR feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974 (service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898) touches validate-expressions.test.ts. It is pm:blocked behind [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 (the 18.0 opening), so whichever lands later merges main.
  Landing question, held for an answer before this pass enqueues: ruling 6020116360 (decision: before the v18 line opens, does main publish one last 17.x release to npm? #22009) makes the last 17.x release, cut from main, "fixes only", and says "a narrowing breaking change does not go into the closing release … it lands after the opening, in 18.0" (that is why service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 was re-blocked, 6022498227). This pass is a fix(lint)! narrowing of the object save door. formula: the metadata save door stores a formula that calls an unregistered function (sqrt), and every read answers null with nothing logged — the docs say the shared validator backs metadata registration #22019's PR fix(lint,objectql)!: the object save door gives the build's formula verdict, and a formula fault is logged once per object and field #22031, the same door's formula pass and also fix(lint)!, merged after the ruling. The PR is built now; whether it lands before the last 17.x release or after the opening is asked of triage and the maintainer, and the seat does not enqueue it until that is answered.

---

Generated by Claude Code