feat(lint): a record trigger that names no object opens its flow to the CEL root judge; the runtime gate's stand-down is by design

flowCelEntrances gains one open reason: a flow whose trigger kind is
record_change and whose start node names no config.objectName. The
record-change trigger then registers its hook with no object filter, fires
on a write to any object and hands that row, so the build door cannot know
the record's keys. The trigger shape is not refused.

The runtime publish gate's stand-down of this judgment (S) is reworded from
a hold-out awaiting a wider per-write snapshot to the ruled boundary: a
judgment that reads other items of the stack is objectstack validate's, and
the snapshot is not widened for it.

Claude-Session: https://claude.ai/code/session_01S3aAf11JjbW1mSGL1EhfFj
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/22636-flow-cel-record-trigger-no-object-opens.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/lint': minor
+---
+
+A flow whose `record-*` trigger names no start `config.objectName` is no longer judged for unbound flow CEL roots by `objectstack validate`. With no object named, the record-change trigger registers its hook with no object filter, so it fires on a write to any object, one the stack does not declare included, and hands that row to the run as `record`, its fields flattened beside it. The build door cannot know that record's keys, so it leaves the flow unjudged, as it already does for a record trigger on an object the stack does not declare. The trigger shape itself is not refused.
+
+Clause-②: yes (widening: a flow whose `record-*` trigger names no start `config.objectName` opens, so `validate` no longer reports an unbound flow CEL root there)
+
+**What changes.** On such a flow, `expression-invalid` no longer reports a root the flow does not bind (`user.id`, `foo.bar`, a field name no declared object has). The same flow with a declared `config.objectName` is judged exactly as before.
+
+**The runtime publish gate, by design.** That gate still does not judge unbound flow CEL roots on a flow write, and it will not: who launches a flow and what record it is handed are read from other items of the stack, which makes this a whole-stack judgment that belongs to `objectstack validate`, and the gate's per-write snapshot is not widened to carry flows and actions. Read the runtime publish gate notes of the two earlier entries for this rule (the unbound-root refusal and the `record` entrance) this way: that stand-down is the intended boundary, not a gap waiting on a wider snapshot.
+
+**Who is affected.** Every shipped `record-*` trigger names its object, so no example app changes: `objectstack validate` over `app-crm`, `app-todo`, `app-multi-package` and `app-showcase` reports the same findings before and after.

packages/lint/src/flow-cel-root-scope.ts

@@ -82,6 +82,11 @@
  *
  *  - **a record trigger** — the start node's `config.objectName` (the trigger
  *    object a record-change run's row belongs to) names an undeclared object;
+ *  - **a record trigger that names no object** — the trigger kind is
+ *    `record_change` and the start node names no `config.objectName`: the
+ *    record-change trigger then registers its hook with no object filter
+ *    (`record-change-trigger.ts`), so it fires on a write to ANY object, one the
+ *    stack does not declare included, and hands that row;
  *  - **a time-relative sweep** — the start node's `config.timeRelative.object`
  *    (`TimeRelativeTriggerSchema`; its own key, independent of `objectName`, and
  *    the object whose rows the sweep hands each run) is undeclared;
@@ -130,7 +135,7 @@
  *    its `context.record`. A parent's own `record` VARIABLE is not handed on —
  *    the child gets the parent's context, not its variables. Read to a fixpoint.
  *
- * ## The runtime publish gate stands down (#22636 is the carrier)
+ * ## The runtime publish gate stands down, by design
  *
  * The same pass runs at the runtime publish gate on a flow write, and there the
  * per-write snapshot carries the written flow alone beside `objects` /
@@ -139,9 +144,16 @@
  * `map` node could hand this flow any record. A false 422 on the only door a
  * Studio tenant has is worse than the gap, so this one judgment stands down there
  * ({@link perWriteSnapshotEntrance}); every other expression verdict at that door
- * is unchanged, and `objectstack validate` judges under the rule above. #22636
- * widens that snapshot to carry flows and actions; when it lands, this
- * stand-down goes.
+ * is unchanged, and `objectstack validate` judges under the rule above.
+ *
+ * ⛔ Not a hold-out awaiting a wider snapshot. Who launches a flow and what
+ * record it is handed are read from OTHER items of the stack, so this is a
+ * whole-stack judgment, and it belongs to `objectstack validate` (ADR-0109
+ * Decision §3's boundary); the runtime publish gate judges the written item
+ * against the four collections it carries. The snapshot stays as it is: ruling
+ * `5791822697` on #19527 (item 3: `RuntimeStackContext` / `CONTEXT_STACK_KEYS`
+ * are unchanged, because every gated write pays for what they carry), held for
+ * this judgment by ruling `6104584601` on #22636 (letter B).
  */
 
 import { firstUndeclaredReference, parseCelToAst, SCOPE_ROOTS } from '@objectstack/formula';
@@ -380,6 +392,10 @@ export function flowCelEntrances(
     if (triggerObject && undeclared(triggerObject)) {
       open(name, `its trigger object '${triggerObject}' (start config.objectName) is not declared in this stack, so the record's keys are not in hand`);
     }
+    if (kind === 'record_change' && !triggerObject) {
+      // No object filter on the hook: any object's write fires it and hands its row.
+      open(name, `its record trigger '${String(config.triggerType)}' names no object (start config.objectName), so it fires on a write to any object and the record's keys are not in hand`);
+    }
     const sweep = config.timeRelative && typeof config.timeRelative === 'object' ? (config.timeRelative as AnyRec) : undefined;
     const sweepObject = sweep ? nameOf(sweep.object) : undefined;
     if (sweepObject && undeclared(sweepObject)) {
@@ -466,7 +482,9 @@ export function flowCelEntrances(
 /**
  * The runtime publish gate's entrance: none visible. Its per-write snapshot
  * carries the written flow alone (module note), so this one judgment stands down
- * there until #22636 widens the snapshot.
+ * there, by design: it is a whole-stack judgment, `objectstack validate`'s, and
+ * the snapshot is not widened for it (rulings `5791822697` item 3 and
+ * `6104584601`, module note).
  */
 export function perWriteSnapshotEntrance(): FlowCelEntrance {
   return {

packages/lint/src/validate-expressions.ts

@@ -2169,8 +2169,10 @@ export function runStackExpressionPasses(stack: AnyRec, options: StackExpression
   // another flow's `subflow` / `map` node). At the runtime publish gate
   // (`runtimeWriteType` set) the per-write snapshot holds the written flow alone,
   // so no entrance is visible there and the judgment stands down
-  // (`perWriteSnapshotEntrance`) until #22636 widens that snapshot; every other
-  // verdict this pass gives at that door is unchanged.
+  // (`perWriteSnapshotEntrance`), by design: a judgment that reads other items of
+  // the stack is `objectstack validate`'s, and that snapshot is not widened for
+  // it (rulings `5791822697` item 3 and `6104584601`; `flow-cel-root-scope.ts`'s
+  // module note). Every other verdict this pass gives at that door is unchanged.
   const runtimeGateWrite = options.runtimeWriteType !== undefined;
   const flowEntrances: ReadonlyMap<string, FlowCelEntrance> =
     objectWrite || runtimeGateWrite ? new Map() : flowCelEntrances(stack, fieldIndex);