[finding] The record.* (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an error-level one until the traversable path set is a closed oracle

Restart-when: #4001 strictness cadence reaches the record.* predicate layer, or the ObjectQL traversable path set becomes enumerable (a closed oracle), or a measured record. fail-open incident

Recorded from #7010 / PR #7214's implementation report (devx PM seat filing; unassigned, ungraded — grading is triage's call). That PR gates the data.* (metadata-form) predicate layer at error; this card records why the record.* layer was deliberately left out, and what the sound follow-up looks like.

The gap

A record.<typo> in a view form's predicate fails open at runtime exactly like the data. case #7010 closed — silently, the #5149 family's shape. Nothing gates it at authoring time.

Why #7214 did not gate it (measured reasoning, not omission)

getMetadataTypeSchema is a closed oracle: the key set is enumerable, so "this path does not resolve" is a fact. An ObjectQL object's addressable path set is open: lookup traversal (record.account.name), system columns the authored fields map never lists, formula/rollup outputs. An error-level gate over an open set manufactures false build errors; a warning-level one produces noise authors learn to ignore — which is silence with extra steps.

The three dispositions (from the report, recommendation A-then-C)

A — leave ungated (the shipped state after feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214).
B — gate at warning, accepting noise on legitimate traversal.
C — close the oracle first (declare the traversable path set as a contract), then gate at error. The report's argument: a closed, enumerable path set is also what makes AI-generated metadata refusable at authoring time — C structurally prevents the mistake while B only reports it.

C is a contract decision, not an implementation detail — which is why it is a card and not a rider on #7214.

Refs: #7010, PR #7214, #5149 (fail-open family), #6254 (the data. precedent), #6936.

Generated by Claude Code

Findings disposition — held; deliberately left unrouted. No ownership taken.

Grade basis: the card records a measured design boundary, not a defect — the record.* layer fails open (the Conditional-visibility predicates (visibleWhen / visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 family shape), but the sound fix (disposition C: close the traversable path set as a contract, then gate at error) is a contract decision, and B is measured to be noise-with-extra-steps.
Unrouted by design: the face genuinely spans domain:engine-core (the ObjectQL path oracle C would close) and domain:spec-tooling (the gate that would consume it). Routing before the A-vs-C fork resolves would be a guess; named in this round's close-out brief per the two-domain rule.
Not escalated: same family as decision-box entry objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 — C's contract question should ride that ruling rather than open a second slot.
Restart conditions: ① objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 ruled; ② anyone measures a real authored record.* predicate failing open in production metadata; ③ the oracle-closing contract work is proposed anywhere (this card is its first consumer).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Findings triage — route repair only: domain:spec appended. The finding grade is unchanged and no ownership is taken.

Routing rationale: the card's own disposition analysis (recommendation A-then-C) puts the load-bearing half in the contract — disposition C is "declare the traversable path set as a contract", which lands in packages/spec and changes what authored metadata is refusable ⇒ acceptance face ⇒ domain:spec, contract-first. The eventual lint gate (the packages/lint half, precedent visibility-predicate-syntax calls an over-budget predicate "not valid CEL" and prescribes the dialect — the #7073 defect at the visibility gate #7217 ⇒ spec-tooling) is downstream of that declaration and would ride its own card once the contract exists.
Premise check @ origin/main 1da1f32: the data.* gate feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 landed is live in packages/lint/src/validate-visibility-predicates.ts (27 record-path references), and no record.* path-resolution gate exists — the gap is as recorded.
Escalation deliberately NOT filed today: the card itself says C is a contract decision, but it is design-appetite-shaped with no user-visible victim (fail-open parity with the pre-feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 state of the data. layer, which did get fixed only after Publish-time validation of predicate path references — a spec-delivered predicate naming a nonexistent path should fail at authoring, not evaluate to a guess at render (#6936 companion) #7010 demonstrated the class). Restart: promote to needs-user-decision when a measured record.<typo> fail-open victim shows up, or when the objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 family forces the oracle question anyway.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Findings triage (re-verify @ origin/main c6a4eeb): HOLD — validate-predicate-path-refs.ts still deliberately excludes the record.* layer (module note :59, :567), so the recorded gap and the A-then-C recommendation stand unchanged. Exit for disposition C is a contract ruling (close the traversable-path oracle) — decision box when taken up, not dispatchable as-is. finding stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Findings triage (re-verify @ origin/main afdc6ea): HOLD — validate-predicate-path-refs.ts still excludes the record.* layer by design: the module note at :59 ("Not closed today, and not closable by this rule") and the skip rationale at :567 ("see the module note for why the record.* layer is out") are both verbatim. The recorded gap and the A-then-C recommendation are unchanged, and disposition C still exits through a contract ruling (closing the traversable-path oracle), not through dispatch. finding stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.

Ruling: deliberate defer — this enters the spec seat's strictness-ledger cadence rather than being ruled ad hoc. The ungated record.* root is intentional and loudly annotated; nothing burns today. finding stays; the strictness cadence is the exit.

Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.

Generated by Claude Code

Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — the card itself proves a sound error-level gate needs a closed path oracle the record.* layer does not have; gating on an open set would refuse legitimate paths. Restart: when the addressable path set becomes enumerable (lookup traversal + system columns + formula outputs), or a measured author incident on this layer.

Generated by Claude Code

Finding-grading round: hold stands (maintainer ruled 2026-08-11, comment 5248480685: deliberate defer into the spec seat's strictness-ledger cadence — the cadence is the exit). Recording a round-efficiency note: this card is exempt from per-round re-verification — the last four passes returned identical results against an unchanged file. Re-open triggers only: #4001's strictness cadence reaching this layer, the ObjectQL traversable path set becoming enumerable, or a measured record.<typo> fail-open incident.

Generated by Claude Code

State-machine migration, maintainer-authorized (2026-08-13, live triage session: 「我授权你先迁标签」; semantics on #8449): graded hold under the 2026-08-11 maintainer ruling (deliberate defer, strictness-cadence exit) — finding → pm:on-hold. The re-verification exemption and re-open triggers recorded 08-12 stand unchanged.

Generated by Claude Code

feat(spec): sink the objectstack-ai#7865 injected-column provenance d…

关 `not_planned` —— 维护者逐张复核 on-hold 卡时同意关闭;原定的出口已经不存在

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T08:00Z。维护者 2026-09-23 在分诊会话里逐张复核 pm:on-hold 卡,对第二组的回复原文:「8006 保留,其他同意」。本卡在那一组里的建议是关闭,维护者同意了。

呈给维护者的事实

缺口是真的:表单视图里写成 record.<字段> 的显示条件,字段名写错时,运行时会悄悄算错(Conditional-visibility predicates (visibleWhen / visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 那一族的形状),作者保存时没有任何提示。
为什么没做检查:合法路径是一个开放集合(关联对象的字段、系统字段、公式输出),在开放集合上做 error 级检查会误报,做 warning 级只会变成没人看的噪音。这一点在代码里已经写明:packages/lint/src/validate-predicate-path-refs.ts 模块说明第 59 行。
原定的出口已经没了:2026-08-11T02:57Z 的裁定(5248480685)是「刻意延后,进入 spec 座位的收紧节奏」,出口是未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 的收紧节奏走到 record.* 这一层。本席 2026-09-23 的全量开放卡快照里 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 已不在开放列表中(关闭或已不可读)⇒ 这条出口不会再触发。
挂起 6 周,没有实测到一起真实事故。

重开条件

有人实测到一起真实的 record.<拼写错误> 事故(作者写错了字段,线上表单因此显示或隐藏错了);或者可遍历路径集合变成了可枚举的封闭集合。满足任一条即可重开,按正文里的 A-then-C 推荐继续。

关闭理由:not_planned,同时摘掉 pm:on-hold。

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] The `record.*` (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an `error`-level one until the traversable path set is a closed oracle #7219

The gap

Why #7214 did not gate it (measured reasoning, not omission)

The three dispositions (from the report, recommendation A-then-C)

关 `not_planned` —— 维护者逐张复核 on-hold 卡时同意关闭;原定的出口已经不存在

呈给维护者的事实

重开条件

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] The record.* (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an error-level one until the traversable path set is a closed oracle #7219

Description

The gap

Why #7214 did not gate it (measured reasoning, not omission)

The three dispositions (from the report, recommendation A-then-C)

Activity

os-zhuang commented on Aug 10, 2026

claude commented on Aug 10, 2026

claude commented on Aug 10, 2026

claude commented on Aug 11, 2026

claude commented on Aug 11, 2026

os-zhuang commented on Aug 11, 2026

hotlong commented on Aug 12, 2026

hotlong commented on Aug 13, 2026

objectstack-fleet commented on Sep 23, 2026

关 not_planned —— 维护者逐张复核 on-hold 卡时同意关闭;原定的出口已经不存在

呈给维护者的事实

重开条件

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] The `record.*` (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an `error`-level one until the traversable path set is a closed oracle #7219

关 `not_planned` —— 维护者逐张复核 on-hold 卡时同意关闭;原定的出口已经不存在