fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads parent (#22157)

[objectstack-fleet]

Fixes #22157
Clause-②: no (narrowing: os build and the object save door refuse a select option's visibleWhen that reads parent, which the runtime's option check cannot bind)

What changes

A select option's visibleWhen is a gate the server enforces on write. The server's option check (evaluateOptionVisibility in packages/objectql/src/validation/rule-validator.ts) binds record, previous and the acting user, and nothing else. An option predicate that read parent.status == 'closed', on a detail with exactly one master_detail, passed os build and the object save door. Then every write that picked the option faulted (Unknown variable: parent) and was admitted unchecked.

• The option loop gains a root verdict. optionVisibleWhenRootIssue in packages/lint/src/validate-expressions.ts is an allowlist of what the option check binds: record, previous, and the acting user as current_user with its ADR-0068 aliases user, ctx and os. Every other SCOPE_ROOTS member is refused at error, parent included. The finding is located at the option slot (object 'NAME' · field 'FIELD' option 'VALUE' visibleWhen). The message names the option, the field and the root. For parent it says that only a field's own readonlyWhen / requiredWhen binds that root, and it gives the denormalise-onto-the-detail remedy.
• One change covers both doors. The object save door runs this same pass (runStackExpressionPasses, since the finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 pass-3 crossing), so the door's finding is the build's finding.
• The runtime is unchanged (ruling). evaluateOptionVisibility still binds no parent. The constant's docblock says a root joins the list only in the change that binds it there.
• Why the membership test is SCOPE_ROOTS, not the field-rule's judged vocabulary. The gap is exactly the set of roots the strict env declares. A root it does not declare, such as app, is already refused on this slot by the bare-reference check, so judging it here would give one mistake two verdicts. The existing lint: a field-level *When reading app gets the generic bare-reference prescription ("Write record.app") — the #6290 misprescription class, one root over #13935 pin ("app there keeps the bare-reference verdict") is untouched and green. Because the judged roots are all declared, check never reports a bare reference to them, so the two verdicts stay disjoint by construction.

The dispatch's hypotheses, measured

• H1 held. At base 73a0a6bf1d, through the built @objectstack/lint, the body parent.status == 'closed' on a one-master detail gave 0 findings from runAuthoringRules('build') and 0 door errors from runRuntimeAuthoringRules({ type: 'object' }). So did input.x == 1 and data.x == 1. The option loop had no root verdict, and parent is a SCOPE_ROOTS member, so the bare-reference check stayed silent.
• H2 held, read off the call. evaluateOptionVisibility calls ExpressionEngine.evaluate(expr, { record: merged, previous, user, permissions }). buildScope turns that into record, previous (when defined) and, when the write carries a user, the same EvalUser under current_user, user, ctx.user and os.user. In the expression env the acting user is spelled current_user (ADR-0068 D1's canonical root); user, ctx and os are aliases. permissions mounts no root: it reaches can through the environment. The allowlist is exactly those six bare roots, the same root-granularity reading as the runtime's own USER_SCOPE_ROOTS next to the evaluator.
• H3 held: corpus first, stop condition not met. Corpus A is every *.object.ts under packages/** and examples/** (112 files) plus the two app-multi-package sub-stacks: 119 objects in 18 groups, 0 import or parse failures. Corpus B is the example stacks as defineStack composes them: 33 objects in 5 groups. Both carry the same 5 option predicates, all on showcase_cascade: four record.country cascades and one 'org_admin' in current_user.positions gate. Their roots are record ×4 and current_user ×1. Option findings: 0 at the build and 0 at the door (errors and advisories), at both shapes, at base 73a0a6bf1d and at head 48b9329137. Positive control in the same harness: the parent body gave build 0 and door 0 at base, and build 1 and door 1 at head.
• H4 held. The new protocol block was run against the base build of @objectstack/lint (73a0a6bf1d). Through the real saveMetaItem, with the header in the registry, the publish save of the measured body resolved { success: true }, so pin (a) went red, and (d) went red with 0 build findings. (b), as first written with the draft save alone, and (c) were green. The promotion and package-publish legs of (b) were added later; the ablation below covers them. With the verdict built, the same save answers 422 INVALID_METADATA, because the door runs the same pass.

Pins (Zone 3)

• Build side (validate-expressions.test.ts, new describe #22157):
  • parent.status == 'closed' on a one-master detail is refused at error, at the option slot, with a message naming the option, the field and the root.
  • CONTRAST: the same parent read on the field's own readonlyWhen passes.
  • CONTROL: record, previous, current_user, user, ctx.user, os.user, current_user.can(...) and a record member spelled like the root (record.parent_code) all pass.
  • Every SCOPE_ROOTS member outside the allowlist is refused, one finding each. The table is generated from the real SCOPE_ROOTS.
• Door side, lint (runtime-gate.object-option-visibility-writes.test.ts): LIT (refused at the door, located at the option), PARITY (the door's finding equals the build's), and CONTROL for record.x and the current_user role gate.
• Door side, protocol (protocol.runtime-authoring-gate.test.ts, new #22157 block, through the real methods):
  • (a) A publish save answers 422 INVALID_METADATA, with one expression-invalid issue at the option, and nothing lands.
  • (b) A draft save is allowed and lands as draft. Its promotion through publishMetaItem is refused 422, and a package draft publish answers refused with 0 published.
  • (c) Control: record.x == 'a' saves and lands active.
  • (d) PARITY: rule, where, path, message and hint are equal at the door and at the build.

Reverse verification (ablation)

The run was made from the committed head 012e8d7dbe through scripts/ablation-replace.mjs in WRAP mode, with an outer trap restore on EXIT, INT and TERM against the absolute path.

• Mutation. The verdict call was gated on Reflect.has(Object, 'ablation22157'), which is always false. The anchor went x1 to x0 and the blob went 9781066c15f0 to 570d3d5df714.
• Prediction, recorded before the run. The lint source suites go 5 red: build refuses parent, the generated table, the two-roots case, door LIT and door PARITY. Everything else stays green. The protocol file goes 4 red, (a), both (b) refusals and (d), with (c) and every other block green.
• Observed. Lint: 5 failed, 371 passed, the predicted five. @objectstack/lint was then rebuilt, and ablation-dist-preflight found the marker in 4 built files. Protocol: 4 failed, 115 passed, the predicted four.
• Restore. The blob is 9781066c15f0, equal to HEAD, and git diff HEAD is empty. After a rebuild, --absent found the marker gone from all 14 built files and the whole tree clean. Lint went back to 376 of 376 and the protocol file to 119 of 119.

Local verification (at c6d1020b90, the merge of origin/main b460153912)

• The merge changed none of this PR's lines. For each of the 5 files, git patch-id --stable of the diff from the merge base is equal at 012e8d7dbe (base 73a0a6bf1d) and at c6d1020b90 (base b460153912).
• pnpm --filter @objectstack/lint test: 128 files, 5862 tests passed.
• pnpm --filter @objectstack/lint typecheck: tsc --noEmit and check:test-typecheck both OK.
• pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/protocol.runtime-authoring-gate.test.ts: 119 passed.
• pnpm --filter @objectstack/metadata-protocol typecheck: OK. Its tsconfig.json includes src/**/* and excludes only node_modules and dist, so the test file is in the program.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at c6d1020b90 derived the same 63 commands as at claim time. 62 exited 0. pnpm check:dual-build-cjs-loads exited 3 with PREREQUISITE NOT MET: 68 packages unrelated to this diff have no dist/ in the local worktree. NOT MEASURED: dual-build-cjs-loads, reason: prerequisite not met locally; CI builds the full tree. The --ran reconciliation reads 63 derived, 62 run, 1 NOT-MEASURED, 0 UNRUN.
• ESLint, narrowed to the 4 changed .ts files with --no-inline-config --format json, gave 4 files, 0 errors and 0 warnings. The population was read from eslint.config.mjs: **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} minus the build-dir ignores. That config enables no type-aware linting (no parserOptions.project), so this diff cannot move the verdict on any file it does not touch. The repo-wide pnpm lint is CI's.

Grade and changeset

• .changeset/22157-option-visible-when-parent.md lists @objectstack/lint and @objectstack/metadata-protocol as minor. It has fix(lint)!, the Clause-② line above, a BREAKING section with the remedy, and the ADR-0087 disposition not-required (no-migration-prescription). check-adr-0087-registration reads it as [BREAKING+bang+clause-②-narrowing].
• Why minor, not triage's patch. AGENTS.md says "(narrowing) is BREAKING". This is the shape of the finding(lint): the object save door gives no build verdict on validation conditions, field-rule slots (requiredWhen etc.), option visibleWhen or action predicates; os build refuses them, a metadata save stores them (#22019's sibling) #22032 pass changesets. @objectstack/metadata-protocol is listed as those passes listed it: no code moves there, but its save, promotion and package-publish doors are where the breaking behaviour shows.
• .changeset/pre.json is present on origin/main, in pre mode next. The bump is still minor, and check-changeset-no-major is green.
• Built declarations. One doc comment moves in @objectstack/lint's index.d.ts: the docblock above the exported FIELD_RULE_BOUND_ROOTS gains one sentence pointing at the option verdict. No export or signature moves, because the new constant and function are module-private.

File surface

All five files are inside the claim's surface: packages/lint/src/validate-expressions.ts, its tests in packages/lint/src/ (validate-expressions.test.ts and runtime-gate.object-option-visibility-writes.test.ts), packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts, and .changeset/22157-option-visible-when-parent.md. rule-validator.ts was read, not edited. The diff is +449/-6 lines.

Acceptance notes

• A residual in the same family, measured and reported to the PM, not fixed here. The allowlist is root-granular, as the ruling asked. At the option site, ctx and os carry only their user member: evaluateOptionVisibility passes no org or env.
  • At head 012e8d7dbe, an option visibleWhen of os.org.id != '', os.env == 'prod' or ctx.locale == 'en' passes the build and the door with 0 findings.
  • Through the built evaluateValidationRules with an authenticated caller, os.org.id != '' and ctx.locale == 'en' are admitted with predicate-fault (No such key: org, No such key: locale). os.env was not run.
  • A member-level verdict needs its own shape decision, so it goes to the family's closing card.
• An option visibleWhen reading app keeps the bare-reference message, which prescribes the record-qualified rewrite that lint: a field-level *When reading app gets the generic bare-reference prescription ("Write record.app") — the #6290 misprescription class, one root over #13935 removed on the field-rule slots. It is still refused at error, so only the prose is affected. Carrier: none.
• Observed, not measured: validate-expressions.ts never walks a picklist's own option visibleWhen (the picklist metadata type). Whether the server's option check ever evaluates those predicates was not read. Carrier: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

4 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: current_user (literal, 33 pages)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b460153912dc5c178c66322e03e7ec183269bafa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e2f7bddce9fd257c023b5c738cbedc40a8b67a21 — the merge of head c6d1020b90288d16f30ed3c60fd4423924beeb3f into base b460153912dc5c178c66322e03e7ec183269bafa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e2f7bddce9fd257c023b5c738cbedc40a8b67a21 && git checkout e2f7bddce9fd257c023b5c738cbedc40a8b67a21
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b460153912dc5c178c66322e03e7ec183269bafa c6d1020b90288d16f30ed3c60fd4423924beeb3f && git checkout -B drift-repro b460153912dc5c178c66322e03e7ec183269bafa && git merge --no-ff c6d1020b90288d16f30ed3c60fd4423924beeb3f

node scripts/docs-audit/affected-docs.mjs --json b460153912dc5c178c66322e03e7ec183269bafa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 012e8d7dbee0a85ca14d4cfccc296e77952cb56f
Local-runs: none

Inputs, and nothing else: card #22157 (body and its four comments 6052678360, 6056732334, 6058210167, 6058329084), PR #22268 (body, the 5-file list, the net diff against merge base 73a0a6b: +449 / -6), the head's check-runs, and the binding text at head and at base: evaluateOptionVisibility and USER_SCOPE_ROOTS in packages/objectql/src/validation/rule-validator.ts, SCOPE_ROOTS in packages/formula/src/cel-engine.ts with buildScope in packages/formula/src/stdlib.ts (the function that turns the evaluator's context into roots), the option loop, fieldRuleRootVerdict and check in packages/lint/src/validate-expressions.ts, AGENTS.md's changeset rule, and ADR-0087's level amendment and disposition addendum. rule-validator.ts and cel-engine.ts are byte-identical at head and base. The dev report and the seat's ACCEPT were read as inputs, not as evidence; every judgment below is re-derived from the binding text and the diff.

① Derived judgments

(a) The allowlist is exactly the bound set — HOLDS. evaluateOptionVisibility calls ExpressionEngine.evaluate with { record: merged, previous, user, permissions } and nothing else. buildScope mounts record and previous when defined, input only from ctx.input (never passed here), os.org / os.env only from ctx.org / ctx.env (never passed here), extra roots only from ctx.extra (never passed here), and, only when user is defined, one EvalUser under current_user, user, ctx.user and os.user. permissions is handed to buildEnv as the resolver behind can and mounts no root. So the bare roots the option check can bind are record, previous, current_user, user, ctx, os: the six in OPTION_VISIBLE_WHEN_BOUND_ROOTS, the same reading as the runtime's own USER_SCOPE_ROOTS beside the evaluator. Nothing bound is refused: collectCelRootIdentifiers reports the receiver of a member access or call and never the member or function name, so current_user.can('fx_line', 'edit'), 'org_admin' in user.positions, ctx.user.id, os.user.id, record.x, previous.x and record.parent_code each report an allowlisted root, and each is pinned (build CONTROL; door CONTROL and the pre-existing ACCEPTED list with the grant check). The allowlist is root-granular by design, so an unbound MEMBER of a bound root (os.org.id, os.env, ctx.locale) still passes: that is #22274, not this card.

(b) Every refused root is genuinely unbound at the option check — HOLDS. The verdict refuses SCOPE_ROOTS minus those six, which at head is 21 roots: input, output, vars, variables, automation, context, args, item, env, step, result, trigger, event, payload, data, params, config, settings, features, parent, current. From { record, previous, user, permissions }, buildScope mounts none of them, so each faults as an unknown variable at the option check and takes the evaluator's fail-open continue branch. No true gate is newly refused. The generated-table pin filters the real SCOPE_ROOTS and asserts parent is in the unbound set, so it cannot pass vacuously; a root added to SCOPE_ROOTS later is judged the day it lands.

(c) Clause-②: no (narrowing) — HOLDS. Nothing is newly accepted: the diff's six deleted lines are comment text, and no check call, traversal refusal or existing verdict is removed, reordered or fenced. Nothing the runtime can enforce is newly refused, per (b). Line 2's parenthetical names parent only while the verdict refuses 21 roots. Judged a NON-BLOCKING note, not a FAIL: the arm (narrowing) is what readClause2Line and the ADR-0087 gate read and it is correct; the line is the claim's own text verbatim, as the dispatch form asks; and the consumer-facing text, the changeset heading ("or any other root the server's option check does not bind") and its BREAKING section, enumerates the full width. The parenthetical describes the motivating case where the whole set is meant. If the seat wants line 2 to carry the width as well, that is a one-clause edit to a claim-derived line, not a code change.

(d) The door's finding equals the build's — HOLDS. One pass serves both doors: the new verdict sits inside the option loop of runStackExpressionPasses, which carries no runtimeWriteType fence on an object write, and validateStackExpressions is on the object door's rule list (pinned by the pre-existing pass-3 test). Lint door suite: LIT (refused at the door, located at the option, naming the root), PARITY (door findings equal build findings, non-vacuous at length 1), CONTROL (record.x == 'a' and the current_user role gate clean at door and build, errors and advisories). Protocol suite through the real saveMetaItem, publishMetaItem and publishPackageDrafts, with the header stored in the registry: (a) a publish save answers 422 INVALID_METADATA with one expression-invalid issue at the option and nothing lands; (b) a draft save lands draft, its promotion is refused 422, and a package draft publish answers refused with 0 published; (c) record.x == 'a' saves and lands active; (d) rule, where, path, message and hint are equal at the door and at the build, with the control clean at the build. A refused case and a still-accepted case are pinned at both doors. (The protocol suite reaches lint through its built dist/; CI's shard builds the dependency closure before it tests.)

(e) The message and prescription are true of the platform — HOLD. The message's "binds only record, previous and the acting user (current_user, and its ADR-0068 aliases user, ctx and os)" is (a), and the embedded consequence (fail-open: the fault is logged and the value admitted, so the gate is never enforced) is the evaluator's own branch. The parent prescription, bound only for a field's own readonlyWhen / requiredWhen on an object with exactly one master_detail, matches the only runtime sites that mount it: isReadonlyWhenLocked and the field requiredWhen block in rule-validator.ts, both from opts.parent, which the engine resolves and whose ParentBinding docblock scopes to those two slots and not to object-level rules; the runtime's own warn text states the exactly-one-master_detail condition. The refusal text carries no tracker number.

② Semver level

minor for @objectstack/lint and @objectstack/metadata-protocol, with fix(lint)!, a BREAKING section, the remedy, and the adr-0087 marker not-required (no-migration-prescription): CORRECT. AGENTS.md: "(narrowing) is BREAKING". ADR-0087's level amendment: pre-GA a metadata-facing break ships minor carrying the BREAKING banner and its disposition, and major is refused by check-changeset-no-major; .changeset/pre.json on origin/main is pre mode next. Triage's "patch" yields to the rule. The disposition is sound on the ADR's own test: no authorable key, spelling, export or stored shape moves and no stored row is read or rewritten, so no ledger entry is derivable; the Remedy paragraph is an imperative rewrite with no old-to-new pair, the shape the gate's detector deliberately leaves to the category's reasoning; and the two #22032 pass changesets carry the same level, the same disposition and the same reasoning for the same door. @objectstack/metadata-protocol is listed as those listed it: no code moves there, and its save, promotion and package-publish doors are where the refusal shows. The gate ran in CI: Check Changeset, the job that runs check-adr-0087-registration --base and check-changeset-no-major --base, is success on this head.

③ Boundary flags

Deviations in 6058210167:

1. Verdict width: answered in (c). Accepted as the claim's own "root verdict over the roots evaluateOptionVisibility binds"; non-blocking note on line 2's parenthetical.
2. pnpm check:dual-build-cjs-loads NOT MEASURED locally: measured in CI. That gate is a step of Build Core ("Every published require entry point actually loads"), and Build Core is success on this head.
3. @objectstack/metadata-protocol full suite not run locally: CI's Test Core shards carry it; the shard holding it was still in progress at read time (gates below).
4. Pre mode: verified on origin/main; minor stands.
5. Commit trailers: the three branch commits carry Claude-Session plus Co-authored-by: Claude, AGENTS.md's model-free pair; no model identifier in the diff, the PR body or the changeset.
6. and 7. The background closure build and the worktree cleanup are process notes with no effect on the diff; nothing to judge here.

Out-of-scope findings in 6058210167:

1. Member-level unbound roots (os.org.id, os.env, ctx.locale) pass both doors and fault open: filed as lint: a select option's visibleWhen reading a member the option check never binds (os.org.id, os.env, ctx.locale) passes os build and the save door, and the server's option gate then faults open #22274 (open; its title matches the finding). Correctly carried, and not this PR's to fix.
2. An option visibleWhen reading app keeps the bare-reference message with the record-qualified rewrite: pre-existing at base (the option slot's check call and app outside SCOPE_ROOTS are both base behaviour) and untouched by this diff. ESCALATED, non-blocking: the pass's own docblock calls that rewrite the false record.-qualified prescription lint: a field-level *When reading app gets the generic bare-reference prescription ("Write record.app") — the #6290 misprescription class, one root over #13935 exists to remove, so a reproducible wrong prescription an author is shown is a metadata-authoring trap under Prime Directive chore: version packages #10 and wants a carrier (a card, or a line on the family's closing card) rather than "noted, no carrier".
3. A picklist metadata type's own option visibleWhen is not walked by validate-expressions.ts, and whether the server evaluates it was not read: ESCALATED, non-blocking, as a question for the family's closing card. Unmeasured, so not a finding yet.

Check-runs on the head, read at 2026-10-08T11:08Z, with CI still running:

• success: Build Core (carries check:dual-build-cjs-loads), Dogfood Regression Gate and its three shards, Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, Check Changeset, Check PR Size, Auto Label, Type Check · debt ledger, Type Check · consumer gates, Type Check · source gates, Check Documentation Links, Flag docs affected by code changes, the claim and closing-keyword guards, filter, Test Core (3/6).
• in_progress: Lint & Repo Gates, Type Check · workspace, Test Core (1/6), (2/6), (4/6), (6/6). Not a FAIL.
• skipped: Console Pin Gate, Build Docs, Packed-tarball smoke (opt-in).
• failure: Test Core (5/6). Step "Run this shard's tests": @objectstack/lint pnpm run test exited 1 on ONE test, src/build-access-matrix.test.ts "exhaustively matches the fold over every declared bit combination", which timed out at 5000 ms (a 3^8-entry fold with an entries.find inside its loop). That file is not in this diff and shares no module with it; the lint run read 125 of 126 files and 5756 of 5757 tests passed, and turbo's single failed task is @objectstack/lint#test (the rest and cloud-connection ELIFECYCLE lines are the sibling cancellation). Recorded as read: this record does not vouch for CI, the required Test Core context must be green before the queue, and a re-run or a new generation on this head is the seat's act, not a re-judgment of the contract.

Implemented-by: claude/issue-22157-option-visible-when-parent
Reviewed-by: session_01LAi5BVvQNiYzepSAcsoFLK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Test Core is red on 012e8d7dbe. Under investigation, not yet attributed. domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T11:21Z

• What failed: Test Core (5/6), one test. packages/lint/src/build-access-matrix.test.ts, "exhaustively matches the fold…", timed out at 5000 ms. It is not an assertion failure. 5756 of 5757 lint tests passed, and the contract reviewer read the split log (6058545425).
• Why it is not yet called "not this PR's": the file is untouched by this diff, but the verdict adds a root collection per option predicate to a pass that test runs exhaustively. A borderline test pushed over its budget would be this PR's.
• Now: the dev is timing that test file at the merge base and at this head, several runs each.
  • If this PR adds measurable time, the verdict is made cheaper on the PR side. ⛔ The test's timeout is not raised, and the test is not skipped.
  • If the times are equal, it is a load-only timeout. The seat then reports it here and asks for one re-run.
• main is green on every Test Core shard.

[objectstack-fleet]

The red Test Core (5/6) on 012e8d7dbe is not this PR's: a load-only timeout in a test this PR's code never runs. domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T12:33Z. It follows 6058755221. The measurement is the dev's report 6059884538 on #22157.

• The failing test is packages/lint/src/build-access-matrix.test.ts, "exhaustively matches the fold over every declared bit combination". It timed out at 5000 ms, with no assertion failure.
• Why it is not this PR's, measured:
  • The import closure: the test and its in-package closure (build-access-matrix.ts, object-graph.ts, system-fields.ts) are byte-identical at the merge base, at this head and on a merge with main 8cbe255ef6. None of them imports validate-expressions.ts.
  • A call count: an instrumented run counted 0 calls of the new verdict inside that test. The positive control in the option door suite counted 57.
  • Interleaved timings: 7 pairs on the merged tree, swapping only validate-expressions.ts. The PR's version has a median of 700 ms and the base version 862 ms, which is noise. The test is CPU-heavy on its own: 6561 linear find() calls, about 0.6 to 1.0 s on a dev box, and under CI shard contention it reached its 5000 ms budget.
• On the CI-equivalent tree (this head merged with main 8cbe255ef6): the full lint suite is 5806 / 5806, and the protocol door file is 119 / 119.
• The fix: none on the PR side. The test belongs to main, and it stays untouched: it is not skipped, not loosened, and its timeout is not raised. One re-run of the job re-measures it.
• Who can re-run: this seat has no re-run route through its write channel, so the re-run is requested from the maintainer. The contract review PASS 6058545425 still names this head.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c6d1020b90288d16f30ed3c60fd4423924beeb3f
Local-runs: none

A delta record over the PASS 6058545425 on 012e8d7dbe. The head is a merge of main b460153912 into 012e8d7dbe (parents confirmed on the fetched ref); the new merge base is b460153912, the old one 73a0a6bf1d is its ancestor, and 65 commits came in between them.

Inputs, and nothing else: card #22157 (body and its seven comments 6052678360, 6056732334, 6058210167, 6058329084, 6059884538, 6071296830, 6071326077), PR #22268 (body, the 5-file list, the net diff of c6d1020b90 against b460153912, the net diff of 012e8d7dbe against 73a0a6bf1d), the head's check-runs, and the binding text at all four commits: packages/lint/src/validate-expressions.ts at both heads, SCOPE_ROOTS in packages/formula/src/cel-engine.ts and evaluateOptionVisibility in packages/objectql/src/validation/rule-validator.ts at both bases, plus what main changed in the window on the route from that pass to the two doors (authoring-rules.ts, runtime-gate.ts, protocol.ts), read because the question "how is the verdict reached" runs through them. The merge-round report and the seat's delta ACCEPT were read as inputs, not as evidence; each judgment below is re-derived from the diffs and the blobs.

① Derived judgments

(a) The PR's own delta is byte-identical across the merge — HOLDS. Per file, git patch-id --stable of the diff from the merge base is equal at the two heads: .changeset/22157-option-visible-when-parent.md e9ff4dd01003, runtime-gate.object-option-visibility-writes.test.ts ae055b1f4fb8, validate-expressions.test.ts a36f70ee7337, validate-expressions.ts 0a09c3d7eba5, protocol.runtime-authoring-gate.test.ts a763391f5cbf. The two diff texts differ only in their index lines and in the @@ offsets of the source file's four hunks (main's flow-pass deletion moved them 63 lines up); every added and deleted line is the same, 449 added and 6 deleted, 5 files.

(b) What main brought into validate-expressions.ts leaves the option verdict untouched — HOLDS. One commit changes the source file in the window, 0e9e7b7066 (#19939 C half, PR #22259), in three hunks that are all in the flow pass: the import swap (resolveFlowNodeValueSlots out, flowNodeValueTemplateRefusals in), the deletion of the flow-template-grammar import and the three template-hint helpers, and the value-slot loop, which now pushes error refusals from the spec's judge instead of warning hints. None of the symbols the option verdict reads moves. At the merged head collectCelRootIdentifiers and SCOPE_ROOTS are still imported from @objectstack/formula (lines 83 and 85), celSourceOf is at 410, FIELD_TRAVERSAL_CONSEQUENCE at 995, OPTION_VISIBLE_WHEN_BOUND_ROOTS at 1111 with its six roots, optionVisibleWhenRootIssue at 1143, and the option loop at 2154 to 2161 still calls it after check and before the traversal refusal, inside the object and field walk with no runtimeWriteType fence. 2f70c2222d (#22319) changes the source file by 0 lines; in the test it moves one fixture key (itemVariable to iteratorVariable) in the #17493 describe near line 4379, and 0e9e7b7066's test edits are near 3026 (the receivers meta-test's plumbing list, grammar out, templateRefusal in, matching its own source change) and 3857. The PR's #22157 describe is at lines 2005 to 2093, and its other two test files have no main-side change in the window at all. The merge did not interleave with the PR's lines anywhere.

(c) The sources the verdict mirrors are unchanged across the window — HOLDS. Blob ids are equal at 73a0a6bf1d, b460153912, 012e8d7dbe and c6d1020b90: cel-engine.ts 6fa1738be716, stdlib.ts (buildScope) d7d2c4d8e3b0, rule-validator.ts 41ed77fc129d, and the whole packages/formula/src tree fe2e2a3a8d1b. SCOPE_ROOTS is the same 27 roots; evaluateOptionVisibility still hands the engine record: merged, previous, user and permissions and nothing else, and still takes the fail-open continue on a fault. So the bound set is still the six roots and the refused set the same 21, the generated-table pin filters the same list, and USER_SCOPE_ROOTS beside the evaluator is the same reading. The one main change under packages/objectql/src/validation/ is record-validator.ts (4578c56e65, #22282, card #22183): keptOptionValues, the value-in-options membership arm of validateRecord, which binds no expression root and never reaches evaluateOptionVisibility. It does not touch which roots an option visibleWhen may read.

(d) How the verdict reaches the two doors, re-derived under what main changed on that route — HOLDS, with one shape change named. runtime-gate.ts is byte-identical across the window. Two changes sit on the route:

• authoring-rules.ts 54d32e5147 (feat(lint,cli): one-line author-time rule verdicts, and os explain RULE_ID for the reasoning #22339, card [maintainer] validate: the field-no-consumers warning is one 856-character line, printed by validate, build and dev alike — one-line verdict + rule: id + a pointer to the full reasoning (os explain, which today takes only schema names) #22161) re-renders every ExprIssue the validateStackExpressions entry emits: the authored source now rides the message (the message text, then a dash, then source: and the quoted source), and hint is now the empty string where it used to carry source: and the quote. That re-shapes this PR's new finding identically at the build and at the door: the verdict itself (severity error, rule expression-invalid, located at the option) is unchanged, and the message still names the option, the field and the root, now followed by the source. The PR's pins survive by construction, not by luck: its four message assertions are containment, its two PARITY pins compare door against build over rule, where, path, message and hint, and both sides pass through this one mapping; no pin reads hint's content, and the changeset's "the same rule id, location, message and hint" is a parity sentence, still true. The same entry added validatePrintPageBlocks (spec(print page) ① of #8346: a page gains an optional print declaration, a linted printable-block subset, the list-export retirement sentence made true, and the three zero-reader document schemas retired #22158), typed page, with no object-door effect.
• protocol.ts (35afb15878 fix(metadata-protocol): a packaged item's save answers the package door before the checks that judge its body, on every kernel topology #22338 and metadata-protocol: on a host-config kernel the object save door runs the authoring gate before the package door, so a packaged object's publish save can answer 422 INVALID_METADATA where an environment kernel answers 403 NOT_OVERRIDABLE (#8184's sibling) #22220; 746637e51e; a3bcbcf3ca; 2f70c2222d): the package door now answers on every topology ahead of the runtime authoring gate, which reorders refusals for a packaged item and moves no acceptance set, and a flow write is judged in its canonical spelling (singularType equal to flow only). An unpackaged object write still reaches runRuntimeAuthoringRules at the same position and answers 422 INVALID_METADATA, which is the path the PR's protocol block (a) to (d) drives; that block is unchanged by patch-id.

Observed, not vouched for: every Test Core shard is success on the head, so the lint suites and the protocol door file ran green under the re-rendered finding and the reordered door.

(e) The earlier record's reasoning at this head. Its (a), (b) and (e) rest on the binding blobs, which the merge did not touch, and are adopted unchanged. Its (c), the Clause-②: no (narrowing) reading, rests on the diff and the changeset, both equal by patch-id, and is adopted; the non-blocking note that line 2's parenthetical names parent while the verdict refuses 21 roots stands, still non-blocking, for the reasons given there. Its (d), door parity, is not adopted but re-derived above under (d) here, because the merge did touch the rendering on that route.

② Semver level

Unchanged and CORRECT: minor for @objectstack/lint and @objectstack/metadata-protocol, fix(lint)!, the BREAKING section, the remedy, and the ADR-0087 marker not-required (no-migration-prescription). The changeset is the same patch (e9ff4dd01003). The gates read it the same way because nothing that reads it moved in the window: check-adr-0087-registration.mjs, check-changeset-no-major.mjs, check-empty-changeset.mjs, .changeset/pre.json (pre mode, tag next), .changeset/config.json and AGENTS.md ("(narrowing) is BREAKING", line 1076) all have an empty diff from 73a0a6bf1d to b460153912. On the head, Check Changeset's steps "Require an ADR-0087 disposition on a declared-breaking changeset" and "Guard against accidental major bumps (launch window)" are success.

③ Boundary flags

• Dispatch premise, corrected as the merge-round report also corrects it: fix(spec,service-automation)!: an undeclared config key on 10 more builtin node types is refused at the build doors; one judge per type #22319 (2f70c2222d) changed validate-expressions.ts by 0 lines; only its test moved, by one fixture line outside the PR's describe.
• The merge-round deviations in 6071296830: the push before the measurement is one fast-forward and the pushed head is the one measured (parents and tree read on the fetched ref); the amended merge message was never pushed in its first form; the dual-build gate NOT MEASURED locally is measured in CI, where Build Core's step "Every published require entry point actually loads" is success on the head.
• The Docs Drift Check comment on the PR notes its own checkout carried uncommitted changes; that is the runner's note about its merge checkout, not this PR's tree.
• Check-runs on the head. One read, for the conclusions: 39 runs, none failed. in_progress: Test Core (1/6), at its step "Run this shard's tests". success: Build Core, Check Changeset, Lint & Repo Gates, TypeScript Type Check with the four Type Check jobs, Test Core (2/6) to (6/6), Dogfood Regression Gate and its three shards, Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, the claim and closing-keyword guards, Check PR Size, Check Documentation Links, Flag docs affected by code changes, Auto Label, filter; the combined status (Vercel) is success. skipped: Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), and the skipped twins of Auto Label and Check PR Size. Test Core (5/6), the shard that was red on 012e8d7dbe, is success. A second read of the same endpoint, made a few minutes later to fetch the runs' output fields, found Test Core (1/6) and the Test Core rollup success as well; no monitor was started and nothing was waited on. This record is written at 2026-10-09T00:01Z; both reads preceded it. No red context exists on this head, so nothing is this PR's to answer. The record does not vouch for CI; its conclusions are read.
• Reads outside git and gh: two GitHub MCP read calls fetched the tail of the Test Core (5/6) job log (the REST log route is proxy-forbidden here) to name that shard's package set; the tail reached only its last two minutes, and the question became moot once every shard was green. No MCP write tool was called; this comment is the one write.

Implemented-by: claude/issue-22157-option-visible-when-parent
Reviewed-by: session_01LAi5BVvQNiYzepSAcsoFLK

VERDICT: PASS

---

Generated by Claude Code