finding(lint): a select option's `visibleWhen` reading `parent` passes `os build` and the object save door, and the server's option gate then faults open ("allowed through; the option's gate was NOT enforced")

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (c) with class-(a) evidence. A declared gate the runtime cannot enforce passes every build door, measured through the real save door and the real option check. Found by #22032 pass 3's dev (PR #22151, report 6051428578, out_of_scope_findings[0]) and filed by the domain:spec seat 3 (seat post #18883, session_01RPo7FUd6bSnAfkWMAKi848). ⛔ Not graded or routed here; ⛔ not a claim.

What is measured (by the dev, at PR #22151's pre-merge head 23ce6c494c, with scratch tests since deleted)

1. The doors accept it. Through the real saveMetaItem in publish mode, an object whose select option carries visibleWhen: "parent.status == 'closed'" saved with success, and the row landed active. runAuthoringRules('build') gave 0 findings on the same body, so os build accepts it too. With PR fix(lint)!: the object save door gives the build's option visibleWhen verdict (#22032 pass 3) #22151 the save door gives the build's verdict, so it now mirrors the build's silence.

2. The runtime cannot enforce it. The server's option check (evaluateValidationRules, with an authenticated currentUser and that option picked) did not throw. It logged:

   option visibleWhen for 'tier=gold' failed to evaluate (authenticated caller) — allowed through; the option's gate was NOT enforced on this write

   The reason was predicate-fault, Unknown variable: parent.

Where it is (read in source by the dev)

• evaluateOptionVisibility (packages/objectql/src/validation/rule-validator.ts) evaluates an option predicate with { record, previous, user, permissions } only. It binds no parent.
• In lint, the option loop in runStackExpressionPasses (packages/lint/src/validate-expressions.ts) has no root verdict. fieldRuleRootVerdict serves the field-rule slots only. parent is a declared root of the strict env, so the bare-reference check does not fire either.

Seam: spec:SelectOptionSchema.visibleWhen → runtime:evaluateOptionVisibility (binds record, previous, user, permissions).

Why it matters

An option visibleWhen is a server-enforced gate on which value a caller may pick. An author (often an AI) writes parent.…, which the field-rule slots one level up accept on an object with exactly one master_detail. The build stays green and the door stores it. At every write the gate is silently not enforced. The predicate is declared and never kept, and the failure is quiet.

Reader who acts

Triage grades and routes it. Candidate landings, for triage to choose:

• Build side: the option loop gains a root verdict over the roots evaluateOptionVisibility binds, refusing parent with its location. That is the narrowing direction, and the corpus is measured first: today's 5 in-tree option predicates read record and current_user only (measured by the same dev).
• Runtime side: bind parent for options the way the field-rule slots do.

Related class, closed: #12915 (unbound roots fault open on form-view predicates).

Dedupe

MCP search_issues, repo-scoped, closed included:

• 「select option visibleWhen reads parent unbound root os build accepts runtime option gate fails open predicate fault」 → 9 hits. Nearest: 17.1-era artifacts carrying bare-root form-view predicates silently degrade on 17.2: unbound root faults open, conditionally-hidden fields render and their required: true dead-ends console record creation — no ADR-0087 conversion covers the predicate-root move #12915 (closed; form-view predicate roots, a different slot). None is this.
• 「evaluateOptionVisibility option visibleWhen root verdict parent not bound allowed through gate not enforced」 → 7 hits, all gate-tooling cards. None is this.

Dedupe words: option visibleWhen parent root unbound fail-open · select option visibleWhen reads parent os build accepts · option predicate root verdict · evaluateOptionVisibility unknown variable parent

---

Generated by Claude Code

[objectstack-fleet]

Path: ③ 验证：响亮拒绝错的，放行对的 — a gate the runtime cannot hold is refused at build | 缺项 | P2

Triage: first grade, bug · priority:p2 · domain:spec · area:records · pm:queue (finding removed). Direction: the build and the save door refuse an option visibleWhen that reads parent, while the runtime cannot enforce it

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T05:02Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/lint (the rule set os build and, since PR #22151, the save door run) ⇒ domain:spec; rationale: packages/lint is the spec seat's by the anchoring exception (SKILL.md domain table). Read on main ec8f37c890.

• Why p2: a declared option gate passes every door and then is not enforced at run time ("allowed through; the option's gate was NOT enforced", measured). ADR-0049: a declared property the runtime does not enforce is worse than absent.
• Direction:
  • refuse parent in a select option's visibleWhen at the build and the save door, with a message naming the field and the root
  • if the runtime later supports parent there, the refusal is lifted in the same change
• Pins: the measured body is refused at both doors; control: an option visibleWhen reading record passes.
• Clause-②: no (a narrowing). Patch changeset for @objectstack/lint.

[objectstack-fleet]

Claim: PM loop round 1 (triage's direction 6052678360; released by #22032's closing pass, 73a0a6bf1d) · 2026-10-08T09:18Z
Session: session_01LAi5BVvQNiYzepSAcsoFLK
Account: os-litant (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22157-option-visible-when-parent
Worktree: objectstack-issue-22157
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main 73a0a6bf1d; stop on breach and explain in the report):

• packages/lint/src/validate-expressions.ts: the option loop in runStackExpressionPasses gains a root verdict over the roots evaluateOptionVisibility binds (record, previous, the acting user, permissions). It refuses parent with a message naming the field, the option and the root, located as the option slot is today. Since pass 3 (aa9447c70b) the save door runs the same pass, so one change covers both doors.
• Its tests in packages/lint/src/ (the option-visibility door suite and a build-side case), and the door pin in packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts.
• .changeset/22157-*.md.
• Read, not edited: packages/objectql/src/validation/rule-validator.ts (evaluateOptionVisibility), the binding the verdict mirrors.
  Container & model: S, mode:subagent, model: opus (--tier: no path-derived mandate; the default tier). An at-tier contract review is owed before enqueue: the claim narrows an accept set at both doors.
  Clause-②: no (narrowing: os build and the object save door refuse a select option's visibleWhen that reads parent, which the runtime's option check cannot bind)
  Grade: AGENTS.md is the governing text: "(narrowing) is BREAKING". So the changeset is minor with a BREAKING section, the remedy, and an ADR-0087 not-required disposition, as finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032's passes 1–4 were. Triage's "patch" wording yields to that rule.
  Responsibility: packages/lint's option pass, this lane's code | none: no other door judges an option predicate's roots | any author of a select option through os build or PUT /api/v1/meta/object (Studio, REST, MCP); measured by finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 pass 3's dev (report 6051428578)
  Thread-read: 6052678360
  Serial constraints cleared:
• finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 has closed. Its pass 4 (73a0a6bf1d) and PR fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest #22142 (de70e97a23) are the last writers of validate-expressions.ts on main.
• Of the 14 open PRs at this stamp, none touches validate-expressions.ts, the protocol door test or rule-validator.ts.