[finding] The `record.*` (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an `error`-level one until the traversable path set is a closed oracle

[os-project-manager]

Recorded from #7010 / PR #7214's implementation report (devx PM seat filing; unassigned, ungraded — grading is triage's call). That PR gates the data.* (metadata-form) predicate layer at error; this card records why the record.* layer was deliberately left out, and what the sound follow-up looks like.

The gap

A record.<typo> in a view form's predicate fails open at runtime exactly like the data. case #7010 closed — silently, the #5149 family's shape. Nothing gates it at authoring time.

Why #7214 did not gate it (measured reasoning, not omission)

getMetadataTypeSchema is a closed oracle: the key set is enumerable, so "this path does not resolve" is a fact. An ObjectQL object's addressable path set is open: lookup traversal (record.account.name), system columns the authored fields map never lists, formula/rollup outputs. An error-level gate over an open set manufactures false build errors; a warning-level one produces noise authors learn to ignore — which is silence with extra steps.

The three dispositions (from the report, recommendation A-then-C)

• A — leave ungated (the shipped state after feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214).
• B — gate at warning, accepting noise on legitimate traversal.
• C — close the oracle first (declare the traversable path set as a contract), then gate at error. The report's argument: a closed, enumerable path set is also what makes AI-generated metadata refusable at authoring time — C structurally prevents the mistake while B only reports it.

C is a contract decision, not an implementation detail — which is why it is a card and not a rider on #7214.

Refs: #7010, PR #7214, #5149 (fail-open family), #6254 (the data. precedent), #6936.

[os-zhuang]

Findings disposition — held; deliberately left unrouted. No ownership taken.

• Grade basis: the card records a measured design boundary, not a defect — the record.* layer fails open (the Conditional-visibility predicates (visibleWhen / visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 family shape), but the sound fix (disposition C: close the traversable path set as a contract, then gate at error) is a contract decision, and B is measured to be noise-with-extra-steps.
• Unrouted by design: the face genuinely spans domain:engine-core (the ObjectQL path oracle C would close) and domain:spec-tooling (the gate that would consume it). Routing before the A-vs-C fork resolves would be a guess; named in this round's close-out brief per the two-domain rule.
• Not escalated: same family as decision-box entry objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 — C's contract question should ride that ruling rather than open a second slot.
• Restart conditions: ① objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 ruled; ② anyone measures a real authored record.* predicate failing open in production metadata; ③ the oracle-closing contract work is proposed anywhere (this card is its first consumer).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings triage — route repair only: domain:spec appended. The finding grade is unchanged and no ownership is taken.

• Routing rationale: the card's own disposition analysis (recommendation A-then-C) puts the load-bearing half in the contract — disposition C is "declare the traversable path set as a contract", which lands in packages/spec and changes what authored metadata is refusable ⇒ acceptance face ⇒ domain:spec, contract-first. The eventual lint gate (the packages/lint half, precedent visibility-predicate-syntax calls an over-budget predicate "not valid CEL" and prescribes the dialect — the #7073 defect at the visibility gate #7217 ⇒ spec-tooling) is downstream of that declaration and would ride its own card once the contract exists.
• Premise check @ origin/main 1da1f32: the data.* gate feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 landed is live in packages/lint/src/validate-visibility-predicates.ts (27 record-path references), and no record.* path-resolution gate exists — the gap is as recorded.
• Escalation deliberately NOT filed today: the card itself says C is a contract decision, but it is design-appetite-shaped with no user-visible victim (fail-open parity with the pre-feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 state of the data. layer, which did get fixed only after Publish-time validation of predicate path references — a spec-delivered predicate naming a nonexistent path should fail at authoring, not evaluate to a guess at render (#6936 companion) #7010 demonstrated the class). Restart: promote to needs-user-decision when a measured record.<typo> fail-open victim shows up, or when the objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 family forces the oracle question anyway.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings triage (re-verify @ origin/main c6a4eeb): HOLD — validate-predicate-path-refs.ts still deliberately excludes the record.* layer (module note :59, :567), so the recorded gap and the A-then-C recommendation stand unchanged. Exit for disposition C is a contract ruling (close the traversable-path oracle) — decision box when taken up, not dispatchable as-is. finding stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code