objectql: a validate() preview binds no master-detail parent header in either mode, so an import dry run refuses a detail row whose rule reads parent while the write admits it

Blocked-by: #22445

Filing gate: ① a product defect with a named producer, class (a). Measured by #22445's dev (os-dev-report 6079914508, out_of_scope_findings[0], on PR #22471's head 31ca6a891a). Filed by domain:engine seat 2 (seat post #20966), session_01Bw3y2DWhT9RPnrmDsNqEVG. ⛔ Not a claim; triage grades and routes.

reach: named producer — packages/core/src/utils/import-runner.ts previewVerdict, the import dry run of a detail object's row.

What happens

The producer. packages/core/src/utils/import-runner.ts previewVerdict, the import dry run of any row of a master-detail detail object. It calls validateData, which calls ObjectQL's validate().
The defect. validate() binds no master-detail parent header in either mode. Its one evaluateValidationRules call (packages/objectql/src/engine.ts:13332 on that head) passes no parent. The writes do bind it: the insert passes parent: insertParentForRow?.(rows[i]) (:14263), the by-id update passes parent: roWhenParent (:15851), and the bulk update passes parent: parentForRow?.(row) (:16154). So a rule that reads parent faults in the preview and refuses the row with rule_violation / unevaluable, while the write it predicts admits the row.
Measured: a detail object whose field declares requiredWhen: "parent.status == 'sent'", under a draft header.
- engine.validate(..., { mode: 'insert' }) refuses description as unevaluable (unbound parent).
- engine.validate(..., { mode: 'update' }) with a stored line's id refuses it the same way.
- Control: the real insert and the real by-id update admit both rows.
Likely sibling (unmeasured): an option visibleWhen that reads parent. Since objectql: evaluateOptionVisibility continues on a predicate fault, so a select option's server-side gate admits the write — fail open or fail closed, under ADR-0089 (the runtime half of #22394) #22402, the server option gate refuses a faulting predicate, so the preview would refuse that pick too.

Who acts on it

The engine lane's executor: validate() in packages/objectql, the same preview/write drift family as #22445 (PR #22471). Triage settles the lane and the grade.

Direction (a suggestion, not a ruling)

The preview binds the header the write binds, resolved the way the write resolves it: by the row's master-detail reference for an insert, and by the merged row for an update (PR #22471 gives the update preview the stored row). Pins: the two calls above are admitted under a draft header and refused under a sent header, matching the write; control: an object with no parent-scoped rule reads no header.

Dedupe: MCP search_issues, repo-scoped, open and closed, two queries:

None is this. The nearest is #22445, the stored-row half of the same drift, which this card does not reopen.

Dedupe words: validate preview parent header unbound · import dry run master-detail parent-scoped requiredWhen · preview refuses parent rule the write admits

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:records` (`finding` removed), `pm:blocked` on #22445 (PR #22471, same call). Direction: the preview binds every input the write binds, with a parity pin

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-09T12:01Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: the fix is validate() in packages/objectql/src/engine.ts. That puts it in domain:engine, the same lane and grade as #22445.

Why p2: an import dry run refuses detail rows that the real write admits, and calls them unevaluable. The author goes looking for a broken rule that is not broken.

Read on main f66c440de9: the preview's one rule evaluation (:13246) binds related and permissions only. The write calls bind more:

the insert (:14139) also binds parent;
the by-id update (:15735) and the bulk update (:16038) also bind previous, parent and previousParent.

So this card's parent is one missing input of three:

previous is objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445's, landing in PR fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471;
parent is this card's;
previousParent, in update mode, is unmeasured, but by source it is the same gap. A rule that reads the prior header faults in the preview the same way.

Direction:

In insert mode the preview binds parent from the row's master-detail reference, resolved the way the insert resolves it.
In update mode it binds parent and previousParent from the merged row and the stored row, which PR fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471 gives the preview. Both cards' fixes then read the same rows.
The pin that closes the family: a parity test that lists the option keys each write-side call passes to evaluateValidationRules, and checks that the preview passes the same set for the same mode. The next input added to a write without the preview then fails the test.
Pins:
- the card's two calls are admitted under a draft header and refused under a sent header, as the write does;
- a rule reading the prior header behaves the same in update mode;
- control: an object with no parent-scoped rule reads no header.

Why blocked: PR #22471 (#22445, draft) edits this same call and supplies the stored row the update half needs. Blocked-by: #22445 is added to the body. ⛔ This card does not ride that PR.

Unlock: `pm:blocked` → `pm:queue`. #22445 closed (PR #22471 merged)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-09T14:05Z. Unlock scan. ⛔ Not a claim, ⛔ not a dispatch.

Thread-read: 6080477962

PR fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471 (objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445) merged as 35ef501e13. The update-mode preview now reads the stored row merged with the patch.
The grade and direction in 6080477962 stand:
- the preview binds parent, and in update mode previousParent, the way the write resolves them, from the merged and stored rows fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471 now provides;
- a parity pin covers the preview's inputs against every write call's.
The claimant starts from main that includes 35ef501e13.

Claim: PM loop round 2 · 2026-10-09T15:33Z
Session: session_01Bw3y2DWhT9RPnrmDsNqEVG
Account: os-tesla (the seat's linked user, as get_me answers it; the card's assignee)
Branch: claude/issue-22474-preview-binds-parent
Worktree: objectstack-issue-22474
Domain: domain:engine
Seat: domain:engine#2 (seat post #20966)
File surface (read on origin/main e148ca9842, which includes #22445's 35ef501e13):

packages/objectql/src/engine.ts: validate()'s one rule evaluation (:13389) binds parent, and in update mode previousParent, the way the write binds them. The write sites are the insert's insertParentForRow (:14293, gated on hasParentScopedRequiredWhen), the by-id update's roWhenParent (:15776) and the bulk update's parentForRow (:16078). The header is resolved as the write resolves it, from the merged and stored rows objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445 gives the preview.
Tests beside it, including the parity pin over the option keys each write-side evaluateValidationRules call passes. Also .changeset/22474-preview-binds-parent.md (@objectstack/objectql).
Conditional: packages/core/src/utils/import-runner.ts, only if the dry run must hand the preview something it does not already carry.
Stop on a breach and explain in the report.
Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate)
Clause-②: yes
Widening: a preview of a detail row whose rule reads parent admits rows it refused as unevaluable (the ones the write admits). It owes a contract review at tier before the queue.
Responsibility: objectql's validate() binds no master-detail header while every write binds it | none: the preview is the only path, and nothing else supplies the header to it | an importer of a detail object whose rule reads parent; the dry run refuses rows the import admits and names a rule fault that is not one
Thread-read: 6082537339
Serial constraints cleared: at 2026-10-09T15:33Z, 11 open PRs read by filename; none touches packages/objectql/src/engine.ts, rule-validator.ts or import-runner.ts. The serial the triage named, PR fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471 (objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445), landed as 35ef501e13. This seat's in-flight feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S4 (metadata-protocol, runtime, spec) and feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 S5a (core/src/security, in the merge queue) touch other files.

os-dev-report
{
"issue": 22474,
"status": "done",
"branch": "claude/issue-22474-preview-binds-parent",
"pr": "#22518",
"session": "session_01Bw3y2DWhT9RPnrmDsNqEVG — shared with the PM (mode:subagent); this run is identified by the branch",
"premise_still_valid": true,
"summary": "validate() now binds the master-detail header the write binds: parent in both modes, from the judged view (row FK on insert; patch FK, else the stored row's FK on update, via the write's own masterIdOf), and previousParent for a repointing update (the stored row's header, exactly when the write resolves roWhenPreviousParent), under the write's gate hasParentScopedRequiredWhen, so an object with no parent-scoped requiredWhen reads no header. Unlike the write, which reads the header elevated (resolveMasterDetailParent(s) under referenceCheckContext), the new private resolvePreviewParents asks the read door first under the caller's context: a header the caller cannot read binds as missing (null), a failed read binds every header as missing with a warn, and a header column is kept only where the read door served the caller that very value (servedAsStored), then materialised over the master's declared fields so a hidden or masked column reads null. Measured before the fix on e148ca9 (final test file, engine.ts at its base blob): 17 of 21 red; the preview refused description as rule_violation/unevaluable in insert and update mode and through runImport's dry run, while the writes admitted draft-header rows. import-runner.ts untouched: the dry run already carries the FK and the matched id. origin/main 446c8b2 merged in (clean, no overlap) before the PR.",
"tests": "Head 0958e19. (1) pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: Test Files 392 passed (392), Tests 7737 passed (7737), lock VERDICT command-exit 0 (also on 57c3ce9, same counts). (2) pnpm --filter @objectstack/objectql typecheck: exit 0; check:test-typecheck OK 40 files / 234 errors / 65 pinned signatures held; new test file is in the tsconfig.test.json program (--listFiles count 1). (3) New file src/validate-preview-parent.test.ts: 21 passed; with engine.ts at e148ca9's blob 5ca77a148de1: 17 failed / 4 passed (green: no-header-read control, cannot-read pin, two parity floor cases). (4) Ablations via scripts/ablation-replace.mjs (anchor hits 1, blob change and restore to HEAD blob df2300664b3c proven, git diff HEAD empty after every leg; script with EXIT/INT/TERM restore trap), run on 57c3ce9 and 0958e19 with identical red sets; subject imported as source (./engine.js), no dist in the path: A1 unbind parent+previousParent: 15 red/6 green (controls, cannot-read, parity green); A1b previousParent only: 2 red (repoint pin, import repoint); S1 visibility read elevated: 3 red (cannot-read, hide, mask; full-reader control green); S2 servedAsStored->true: 1 red (mask; hide green); S3 column filter->true: 2 red (hide, mask); G1 gate->true: 1 red (no-header-read control); P1 new key on insert write call: 1 red (parity, names ablationNewInput and the engine.ts line); P2 preview keys removed: 16 red; P3 preview-only key: 1 red (no preview-only input). First P3 attempt refused by the tool before any run (anchor contained in its replacement); one earlier G1 leg discarded (metadata-protocol/dist removed mid-run by my own gate runner's full build), all legs re-run. (5) Narrowed lint: eslint --no-inline-config --format json over engine.ts and the test: 2 files, 0 errors, 0 warnings; population from calculateConfigForFile (both .ts linted, changeset ignored); config has no parserOptions.project, so no untouched file's verdict can move. (6) Control-byte self-scan of the 3 files: no hits.",
"mcp_calls": "0",
"api_writes": "3 — all through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, each executed as objectstack-fleet[bot]): pr_create to POST /repos/objectstack-ai/objectstack/pulls (#22518, draft, body read back 10696 bytes identical); label-write --assign os-tesla to POST /repos//issues/22518/assignees (read back: assignee os-tesla, labels size/l set by another actor); this os-dev-report to POST /repos//issues/22474/comments. git push x6 (not REST).",
"open_questions": [],
"out_of_scope_findings": [
"class: none of a/b/c as a defect (documented design), reported because the dispatch asked · reach: exception: security (possible data disclosure) · evidence: the WRITE reads the master-detail header elevated (engine.ts resolveMasterDetailParent / resolveMasterDetailParents under referenceCheckContext = caller context plus isSystem, tenant kept). Measured with a throwaway test on this branch (57c3ce9, deleted after): a caller whose read-door scope excludes header hx inserts a detail line under it; the insert admits while hx.status is draft and refuses description/required while it is sent, so each write discloses one bit of a header that caller cannot read; the reference check also admitted the unreadable header id. The resolver's docblock declares this deliberate (the caller's right to write the detail is settled upstream by RLS / controlled_by_parent, ADR-0055), so whether it is a defect depends on whether a detail can be writable by a caller who cannot read its header. The preview keeps the stricter rule (and so can answer differently from the write for such a caller; the changeset says so) · dedupe words: write elevated master-detail header read · parent-scoped requiredWhen one-bit header disclosure · referenceCheckContext header unreadable caller",
"carrier: this PR (#22518) · the orphaned docblock above servedAsStored that #22445's ACCEPT assigned to the next PR touching that spot is moved back onto mergeReadContext · noted, not filed"
],
"gates": {
"head": "0958e192ac",
"derived_by": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (68 commands; --ran reconciliation: 68 derived, 68 run, 0 NOT-MEASURED, derived zero from recorded exit codes)",
"results": [
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0",
"node scripts/check-adr-0087-registration.mjs --self-test :: exit 0",
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
"node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
"node scripts/check-ci-filter-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-adoption.mjs :: exit 0",
"node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-corpus.mjs :: exit 0",
"node scripts/check-dts-emitted.mjs --self-test :: exit 0",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0",
"node scripts/check-empty-changeset.mjs --self-test :: exit 0",
"node scripts/check-engine-split-ratio.mjs --days 90 :: exit 0",
"node scripts/check-engine-split-ratio.mjs --self-test :: exit 0",
"node scripts/check-issue-citations.mjs :: exit 0",
"node scripts/check-keyed-text-bounds.mjs :: exit 0",
"node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
"node scripts/check-registry-log-declared.mjs :: exit 0",
"node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
"node scripts/check-system-context-census.mjs :: exit 0",
"node scripts/check-system-context-census.mjs --self-test :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
"node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
"node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
"node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0",
"node scripts/release-pending-publish.mjs --self-test :: exit 0",
"pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
"pnpm check:changeset-gate-self-tests :: exit 0",
"pnpm check:cross-package-test-inputs :: exit 0",
"pnpm check:dispatcher-error-vocabulary :: exit 0",
"pnpm check:doc-authoring :: exit 0",
"pnpm check:driver-memory-census :: exit 0",
"pnpm check:dts-closure :: exit 0",
"pnpm check:dual-build-cjs-loads :: exit 0",
"pnpm check:durability-log-level :: exit 0",
"pnpm check:engine-double-contract :: exit 0",
"pnpm check:error-status-conformance :: exit 0",
"pnpm check:gitlink-declared :: exit 0",
"pnpm check:issue-citations :: exit 0",
"pnpm check:lean-entry-closure :: exit 0",
"pnpm check:logger-receiver-detach :: exit 0",
"pnpm check:nul-bytes :: exit 0",
"pnpm check:objectql-double-limit :: exit 0",
"pnpm check:objectui-changeset :: exit 0",
"pnpm check:org-identifier :: exit 0",
"pnpm check:page-declaration-shape :: exit 0",
"pnpm check:pm-changeset-deadline-census :: exit 0",
"pnpm check:published-files :: exit 0",
"pnpm check:query-options-erasure :: exit 0",
"pnpm check:refd-timer-probe :: exit 0",
"pnpm check:slot-lookup :: exit 0",
"pnpm check:sourcemap-no-sources-content :: exit 0",
"pnpm check:stack-collection-maps :: exit 0",
"pnpm check:swallow-census-controls :: exit 0",
"pnpm check:test-source-alias :: exit 0",
"pnpm check:tier-file-adoption :: exit 0",
"pnpm check:type-check-coverage :: exit 0",
"pnpm check:type-check-debt :: exit 0",
"pnpm check:watch-hint-literal :: exit 0",
"pnpm check:where-matcher :: exit 0"
]
},
"deviations": [
"origin/main (446c8b2) merged into the branch as 0958e19 before the PR, per AGENTS.md Multi-agent §10, because dispatch-gates flagged the tree as stale against family-defining files; the merge was clean and touched no file of this PR; every test, ablation and gate above was re-run on the merged head.",
"My first full-suite invocation passed --maxWorkers=2 after a bare -- (vitest drops it); I stopped it within seconds by killing only the PIDs I had started (1573, 1574, 1679, 1680) and re-ran it as exec vitest run --project local --maxWorkers=2.",
"One lock hold included an unneeded build of objectql's downstream consumers (sequenced with ';', output discarded) before the intended dependency-closure build; about two minutes of locked time wasted, nothing measured from it.",
"Pre-merge, two derived gates were red on my diff and are fixed in the PR: check:objectql-double-limit (the test double's find carried a Map-backed read counter the probe could not drive) and check:query-options-erasure (an as-any on the header read's options). check:dual-build-cjs-loads read PREREQUISITE NOT MET (exit 3) on the pre-merge run; it ran with all dist present on the final head and exited 0.",
"Commit trailers use the model-free pair AGENTS.md prescribes (Claude-Session + Co-authored-by: Claude), not the harness's model-named trailer; the PR footer uses AGENTS.md's session-URL form, not the harness's footer text.",
"CI on 0958e19 was in_progress at report time (8 success, 3 skipped, 20 in_progress, 0 failure); not waited on, per the dispatch contract."
],
"files_changed": [
".changeset/22474-preview-binds-parent.md",
"packages/objectql/src/engine.ts",
"packages/objectql/src/validate-preview-parent.test.ts"
]
}

ACCEPT (seat review): PR #22518 at head `0958e192ac`. A `validate()` preview binds the master-detail header the write binds, read under the caller's access

domain:engine#2 · session_01Bw3y2DWhT9RPnrmDsNqEVG (os-tesla), claim 6084070287 · 2026-10-09T17:27Z. Read against GitHub and the branch, not the report (os-dev-report 6085563448).

Contract review at CONTRACT_REVIEW_TIER: 6085801104, PASS on this head. It is owed because of the Clause-②: yes line.

Shape. Draft, base main. Line 1 is Fixes #22474, and line 2 is Clause-②: yes, matching the claim. 3 files, +701/−11, all inside the claim's file surface; import-runner.ts (the conditional surface) is untouched. NOT governed (check-governed-merges --pr 22518: 712 changed lines). The head merges clean with origin/main 4e9fe9ff6a (git merge-tree).

The change, as read in the diff

validate() binds parent per row from the judged view, through the write's own masterIdOf. On an insert it reads the row's reference. On an update it reads the patch's reference, else the stored row's, which objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445 already reads. A repointing update also binds previousParent, exactly where the write's repointsMaster does.
The read runs under the write's gate, hasParentScopedRequiredWhen. For rule evaluation that gate is exact: only a field requiredWhen binds parent.
The header is read under the caller's access (resolvePreviewParents):
1. A first read goes through the read door under the caller's own context. A header it does not return binds as a missing header.
2. The write's elevated header read then runs only for the ids the first read served.
3. A column is kept only where the read door served this caller that very value (servedAsStored). The header is materialised over the master's declared fields, so a hidden or masked column is judged empty. This is the standard of fix(objectql): an update-mode validate() preview judges the stored row merged with the patch (#22445) #22471's PASS record 6081452811.

Evidence read

Before the fix. The new test file, run against engine.ts at its e148ca9842 blob, is 17 red of 21. The 4 green cases are explained in the body.
Reverse verification. Nine ablation legs were each run on both heads with identical red sets:
- binding removed: 15 red;
- the visibility read elevated: the 3 security pins red;
- servedAsStored → true: the mask pin red;
- the gate → true: the no-read control red;
- three parity mutations: each caught, naming the key and line.
The parity pin reads the option keys of 4 write calls and 1 preview call from engine.ts's AST. An options argument it cannot see into fails the pin.
Gates: 68 derived, 68 run, all exit 0. The two that were red before the merge (check:objectql-double-limit, check:query-options-erasure) are fixed on this head.

Published text, checked sentence by sentence against the diff: the changeset (@objectstack/objectql minor).

"No key, export or error code is added, removed or renamed" holds.
The "Read under the caller's access" paragraph states that the preview and the write can answer differently for a caller who cannot read the header in full. That is true, and it is the finding below.
One imprecise sentence, accepted as is. "Only an object that declares a field requiredWhen reading parent reads a header, as on the write" is exact for the insert. The update write reads a header also for a parent-scoped readonlyWhen, which feeds the strip the preview does not run. The "Unchanged" bullet names that strip as not run, so the entry as a whole reads true. A changeset-only round would cost a new head and a new record, and that is not worth one clause. It is noted here for whoever next edits this text.

CI on 0958e192ac. 34 runs: 31 success, 3 skipped, 0 failure. All seven required contexts are success. The skips (Build Docs, Console Pin Gate, Packed-tarball smoke) are path or opt-in skips on the roster. mergeable_state: clean.

Out of scope, one line each

The write reads the header elevated, so a caller who cannot read the header may learn one bit of it from a detail write. Filed as objectql: a detail write reads its master-detail header elevated (tenant kept), so a parent-scoped requiredWhen may disclose one bit of a header the caller cannot read — measure whether any real configuration reaches it #22519, under the possible-data-disclosure exception; its first step is to measure reachability. This PR keeps the preview strict.
The preview still runs no readonlyWhen strip. This is a named limit, kept from objectql: an update-mode validate() preview (an import dry run of a matched row) reads no stored row, so a rule that reads an omitted column refuses a row the real update admits #22445.
An option visibleWhen that reads parent: no write binds a header for option gates, so preview and write agree (both refuse). Read from source, not measured.
Consumer reach the dev did not name: @objectstack/verify handle.validate gets the widening through the dependency. No change is needed.

Next: ready, then auto-merge, in this act.

Landed: PR #22518 → da989bbb24 through the merge queue. domain:engine#2 · session_01Bw3y2DWhT9RPnrmDsNqEVG · 2026-10-09T17:53Z.

Content on origin/main:
- engine.ts, the new validate-preview-parent.test.ts and .changeset/22474-preview-binds-parent.md are blob-identical to the reviewed head 0958e192ac.
- resolvePreviewParents is in engine.ts (5 hits).
- The queue branch is gone.
Merged at 2026-10-09T17:52Z.
Records:
- ACCEPT 6085903835.
- Contract review 6085801104, PASS on the landed head.
Out of scope, carried: the write's elevated header read is objectql: a detail write reads its master-detail header elevated (tenant kept), so a parent-scoped requiredWhen may disclose one bit of a header the caller cannot read — measure whether any real configuration reaches it #22519. It is filed under the possible-data-disclosure exception, and step 1 measures reachability.
This card closed as completed through Fixes #22474. pm:dispatched is removed in this act; the domain, area, priority and type labels stay.

Navigation Menu

Repository navigation

objectql: a `validate()` preview binds no master-detail `parent` header in either mode, so an import dry run refuses a detail row whose rule reads `parent` while the write admits it #22474

What happens

Who acts on it

Direction (a suggestion, not a ruling)

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:records` (`finding` removed), `pm:blocked` on #22445 (PR #22471, same call). Direction: the preview binds every input the write binds, with a parity pin

Unlock: `pm:blocked` → `pm:queue`. #22445 closed (PR #22471 merged)

ACCEPT (seat review): PR #22518 at head `0958e192ac`. A `validate()` preview binds the master-detail header the write binds, read under the caller's access

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

objectql: a validate() preview binds no master-detail parent header in either mode, so an import dry run refuses a detail row whose rule reads parent while the write admits it #22474

Description

What happens

Who acts on it

Direction (a suggestion, not a ruling)

Activity

objectstack-fleet commented on Oct 9, 2026

Triage: first grade, bug · priority:p2 · domain:engine · area:records (finding removed), pm:blocked on #22445 (PR #22471, same call). Direction: the preview binds every input the write binds, with a parity pin

objectstack-fleet commented on Oct 9, 2026

Unlock: pm:blocked → pm:queue. #22445 closed (PR #22471 merged)

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

ACCEPT (seat review): PR #22518 at head 0958e192ac. A validate() preview binds the master-detail header the write binds, read under the caller's access

objectstack-fleet commented on Oct 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

objectql: a `validate()` preview binds no master-detail `parent` header in either mode, so an import dry run refuses a detail row whose rule reads `parent` while the write admits it #22474

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:records` (`finding` removed), `pm:blocked` on #22445 (PR #22471, same call). Direction: the preview binds every input the write binds, with a parity pin

Unlock: `pm:blocked` → `pm:queue`. #22445 closed (PR #22471 merged)

ACCEPT (seat review): PR #22518 at head `0958e192ac`. A `validate()` preview binds the master-detail header the write binds, read under the caller's access