#4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定

[xuyushun441-sys]

Filed unassigned from #4811 / PR #4951,那里为了给 null-guard 闸门定判据把这几处逐一实测了一遍。本单只记录发现,不含修法承诺。

背景:为什么全量性是个契约,而不是实现细节

实测 @marcbachmann/cel-js,同一条谓词在两种绑定下语义恰好相反:

谓词	全量绑定 {a: null}	稀疏绑定 {}
has(record.a)	true	false
record.a < record.b	FAULT no such overload	FAULT No such key: a
record.a != null	false	FAULT No such key: a

#4649/#1871 之所以引入 materializeDeclaredFields,正是为了让 record.x == null / != null 这类写法可用:在全量绑定下它返回布尔值,在稀疏绑定下它自身就 fault。

所以「记录是否全量」不是某个求值点的内部选择 —— 它决定了作者被允许写什么。同一个 record.x != null,在一处是正确守卫,在另一处是必然 fault。

发现:全量化只做在两个接缝上

已物化:

• packages/objectql/src/validation/rule-validator.ts —— evaluateValidationRules 的 merged 与 previous(校验规则 + 字段 requiredWhen + option visibleWhen)
• packages/objectql/src/hook-wrappers.ts —— 生命周期 hook 的 record / previous

未物化的三处,各自都在对可空已声明字段求值 CEL:

1. 字段 readonlyWhen —— rule-validator.ts 里的 stripReadonlyWhenFields 合并 { ...previous, ...data } 后直接求值,从不物化。与同一个字段上的 requiredWhen 结论相反,而 requiredWhen 就在同一个文件里物化过。且它 fail-open(readonlyWhen for 'x' failed to evaluate — change allowed through),所以谓词 fault 时字段不再只读,改动照常写入。

2. flow 触发记录 —— packages/triggers/trigger-record-change/src/record-change-trigger.ts 把记录播种为 { ...(inputDoc ?? {}), ...after }。注释本身就写明「fields the driver did not echo back」,即明确知道 after 不保证带全列。start / edge condition 与 {record.x} 插值都读它。

3. action visible / disabled 的客户端绑定 —— 绑定是客户端已取到的那条记录;objectui 该路径上不存在任何物化步骤(ActionEngine / toPredicateInput / useCondition 全链只读已有 record)。列表行只带视图投影列,所以同一条谓词在 record_header 与 list_item 上看到的键集都不同。

后果

• 作者无法用一条写法同时正确覆盖两类绑定:全量处要 != null,稀疏处 has() 才对、!= null 会 fault。而元数据里没有任何东西标明某个 slot 属于哪一类。
• 这直接卡住了 null-guard 闸门(#4763)只覆盖了校验规则与 hook 条件 —— action / flow 条件两面待定,formula 面待判 #4811:null-guard 闸门只能接全量绑定的面,上面三处因此被排除(理由与实测表记在 packages/lint/src/validate-null-guards.ts 的台账里)。把这三处补齐,那三面就可以一并纳入闸门。
• readonlyWhen 与 flow condition 两处都是 fail-open / 静默分支,属于「看起来生效、实则什么都没做」这一族。

需要的决定(不是实现细节)

三处是否都应当补上 materializeDeclaredFields,从而把「谓词看到的记录 = 对象声明的形状」变成平台层面的统一保证?还是其中某几处刻意保持稀疏(例如 action 绑定跨进程,全量化意味着 REST 读取要补齐所有声明列)?

无论结论如何,结论本身需要被写下来并可引用 —— 现状是两个接缝物化了、三个没有,而没有任何文档或注释说这是有意的。

复现

const { evaluate } = require('@marcbachmann/cel-js');
evaluate('record.a != null', { record: { a: null } });  // false
evaluate('record.a != null', { record: {} });           // throws: No such key: a

[os-zhuang]

Seat accounting note (engine-core seat #6019, incoming session session_01MwoubC3jL271FYt9rGXwxb): the engine-core share of the 2026-08-06 ruling is COMPLETE — PR #6454 MERGED 2026-08-07 22:14Z (readonlyWhen materialization; verdict comment above). Nothing of this issue remains in flight in the engine-core lane.

The issue stays OPEN deliberately as the ruling's decision anchor. Outstanding shares, for whoever reads this next: (1) the services half — trigger-record-change flow-trigger record seeding (materializeDeclaredFields), services lane; (2) the objectui sparse-face documentation + lint evaluation (deferred by the ruling); (3) the triage seat's contract-first sub-issue split the ruling requested, which has not happened yet. The pm:dispatched + assignee state on this card reflects the finished engine-core claim only.

---

Generated by Claude Code

[os-zhuang]

State observation from the domain:engine-core seat (#6019, session session_014C8pAprWdmtecFsEprZax4) — ⛔ not a claim, not a reclaim, and no label changed.

This card carries pm:dispatched with nothing in flight, and has been silent since 2026-08-08T08:47Z (~4 days). PR #6454 — the readonlyWhen / materializeDeclaredFields seam, this lane's share of the maintainer's 2026-08-06 ruling item 1 — merged 2026-08-07T22:14:20Z (a483d38), correctly as Part of #4953 rather than Fixes, so the card survived by design as the decision anchor.

⚠️ Why I am flagging rather than fixing. pm:dispatched with no live dev is the label that starts a #4551 double-implementation, and this seat corrected exactly that on #5571 (comment 5264018042). But this card's assignee is not me and its claim is backed by a branch whose commits merged — ⛔ a claim with a live committed branch is never reclaimed, and ⛔ a card assigned to another account is not mine to relabel. Recording the reading so it is on GitHub rather than in one session's context.

What the card is still open for (per PR #6454's own scope statement, ⛔ none of it engine-core's):

• flow trigger-record seeding ⇒ the services seat ([PM seat] domain:services — ⏳ vacant #6021)
• the objectui sparse-surface docs / lint evaluation ⇒ repo:objectui ([PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #6025)
• null-guard 闸门(#4763)只覆盖了校验规则与 hook 条件 —— action / flow 条件两面待定,formula 面待判 #4811's null-guard gate widening — ruling item 3 requires both server-side seams complete first

⭐ One result from this lane's share the anchor should keep visible, because it is a deliberate, pinned behaviour change and not a detail: materialising the bindings flipped one spelling in the reverse direction — !has(record.<declared field>) used to lock the field and now does not. That was implemented and pinned rather than silently absorbed, on the grounds that has() guards undeclared keys, not empty values (the declared-fields.ts contract since #4649), and that the old behaviour was never a guarantee anyway — it depended on which columns the driver happened to read back. Authors wanting the old effect write == null, which is what the lint null-guard has always advised. Anyone closing out this anchor should not re-derive that grid; it is measured in PR #6454 with a reverse-verification run (predicted 6 red / 137 green, matched line for line).

---

Generated by Claude Code

[os-zhuang]

Taken over by the domain:engine-core seat (#6019) on the maintainer's direct instruction. ⛔ This is not a claim race, and the previous holder's work is not being discarded.

Session session_01RDTnVvsgA6cUZ4xFVtPZRy. ⚠️ Recording the provenance because an unexplained cross-account reassignment is indistinguishable from someone stealing a card — this issue was assigned to baozhoutao, a different account from the one now on it.

Authorization, verbatim

The maintainer was shown this card (and #7620, #5571) as cards belonging to other accounts that this seat may only report on, never touch, together with the observation that all three carry stale state invisible to dispatch scans. The instruction back was:

「⛔ 别的账号的（3 张）
你都接手」

Why it was surfaced

⚠️ pm:dispatched with no dev in flight — untouched since 2026-08-12 ~14:37, closed_by_pull_requests empty. Such a card reads as "someone is on it" to every dispatch sweep, indefinitely.

⭐ One thing this seat will not skip past

This card's own body says, in its own words, that what it needs is a decision, not an implementation:

「## 需要的决定（不是实现细节）
三处是否都应当补上 materializeDeclaredFields …… 还是其中某几处刻意保持稀疏？」

⛔ So this seat will not dispatch it as a fix card on the strength of the stale pm:dispatched label. If the question is still open, it goes to the maintainer as a decision card; if a ruling already exists in the comment history, that ruling is what gets dispatched — and it will be quoted, not paraphrased.

⚠️ The body also records why the question is load-bearing rather than cosmetic: the same predicate has opposite semantics under the two bindings (record.a != null returns false under a full binding and faults under a sparse one), and nothing in the metadata tells an author which kind of slot they are writing for. Two of the five seams are also fail-open — readonlyWhen lets the change through when its predicate faults.

What happens next

State reconnaissance is running across all three cards — live-vs-spent claim, any pushed work, what remains, and ⚠️ whether the body's mechanism still stands or has been falsified in a comment. Grading follows that reading, not the label.

Veto path: if the previous holder is in fact still working this, say so here and it goes straight back.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 7 — the services half of ruling item 1
Session: session_01RDTnVvsgA6cUZ4xFVtPZRy
Branch: claude/issue-4953-flow-trigger-materialize
Worktree: objectstack-issue-4953-services
File surface: packages/triggers/trigger-record-change/src — ⇒ domain:services (#6021), cross-seat declaration being filed
Container & model: M, mode:subagent, model: claude-sonnet-5
Prior claim: session_019Q7oc7ASjh8yxyS3Yz78We (2026-08-07), SPENT — PR #6454 MERGED as Part of, scoped 「仅限本席半边」. A handover note (2026-08-08) states plainly: 「the engine-core share … is COMPLETE … Nothing of this issue remains in flight in the engine-core lane.」 ⛔ Nothing is being reclaimed.

⛔ The decision this card was filed to force has ALREADY BEEN RULED

The body's 「需要的决定（不是实现细节）」 section is spent. The maintainer ruled it 2026-08-06 (5199136892): server-side unified, cross-process deferred — and that ruling says in terms 「决定已做，⛔ 不挂 needs-user-decision」.

⚠️ So this card is now a fix card in other lanes, not a decision card. ⛔ Do not re-open the ruled question, and ⛔ do not read the body's decision framing as live.

Four of the body's premises are outdated — dispatch carries all four

1. ⛔ "2 of 5 seams" is wrong — readonlyWhen landed (3 of 5), and a sixth root the body never named, parent, was found sparse and fixed separately via parent 表头绑定也是稀疏的 —— #4953 修完 record 之后,同一个作者陷阱在 parent 根上原样留着 #6457 / PR fix(objectql): materialise the master-detail header a parent-scoped predicate reads (#6457) #6788.
2. ⛔ The INSERT premise was disproven (5222432900): 「insert 格不存在」 — the readonlyWhen strip runs by design only on the update path (engine.ts "INSERT stays exempt").
3. ⛔ A deliberate behaviour reversal already shipped and must not be re-derived: !has(record.<declared field>) used to strip/lock the field and now does not — has() guards undeclared keys, not empty values (the declared-fields.ts contract since Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649). Authors wanting the old effect write == null. Pinned by two tests.
4. Two spin-off cards from that PR — parent 表头绑定也是稀疏的 —— #4953 修完 record 之后,同一个作者陷阱在 parent 根上原样留着 #6457 and validate-null-guards.ts 的接缝台账在 PR #6454 合并后会说假话 —— 字段 readonlyWhen 那行仍写着 "sparse / never materializes" #6458 — are both closed and merged.

⭐ The body's core mechanism STANDS and is why this still matters: the same predicate has opposite semantics under the two bindings (record.a != null ⇒ false when materialised, faults when sparse), and nothing in the metadata tells an author which kind of slot they are writing for.

What this dispatch covers, and what it does not

Covers: ruling item 1's services half — flow-trigger record seeding in trigger-record-change, where the record is seeded { ...(inputDoc ?? {}), ...after } and the code's own comment concedes 「fields the driver did not echo back」.

Does not cover (⛔ out of scope, do not widen): ruling item 2's objectui share (docs + a lint evaluation, repo:objectui #6025), and #4811's null-guard gate widening, which the ruling gates on both server-side seams being complete — ⭐ this dispatch is the second of the two, so landing it makes #4811 ripe. The PM sequences that; the dev reports it.

---

Generated by Claude Code

[os-zhuang]

<!-- os-dev-report -->

{
  "issue": 4953,
  "status": "done",
  "branch": "claude/issue-4953-flow-trigger-materialize",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8483",
  "premise_still_valid": true,
  "summary": "Implemented the services-lane half of the 2026-08-06 ruling: record-change-trigger.ts's buildContext now layers the prior row under the payload/after-row (so an untouched declared field keeps its real persisted value) and materializes both the record and previous CEL roots over the object's declared fields via a structural mirror of objectql's materializeDeclaredFields, gated on the same groundTruth rule evaluateValidationRules uses (insert always, update/delete only once the prior row was fetched). Reused the RecordChangeDataEngine.getObject accessor (confirmed wired to the real engine) rather than the interface's existing getObjectConfig, which measurement showed is never implemented by the concrete ObjectQL engine (filed as a separate out-of-scope finding). Updated the seam ledger in declared-fields.ts and validate-null-guards.ts in the same PR.",
  "tests": "pnpm --filter '@objectstack/trigger-record-change^...' build: clean. pnpm --filter '@objectstack/trigger-record-change' typecheck: clean. pnpm --filter '@objectstack/trigger-record-change' test -- --maxWorkers=2: 5 test files, 64/64 passing (7 new unit cases incl. a real-CEL red-before/green-after reproduction via @objectstack/formula's ExpressionEngine, plus 1 new real-engine integration test on driver-sql/better-sqlite3 proving a record-before-update flow condition that used to fault now evaluates and fires; one pre-existing pinned test's expected value updated with inline rationale). pnpm --filter '@objectstack/objectql' typecheck and pnpm --filter '@objectstack/lint' typecheck (doc-only edits): clean. Derived gates via node scripts/pm/dispatch-gates.mjs <changed paths>: check:nul-bytes, check:cross-package-test-inputs, check:durability-log-level, check:engine-double-contract, check:query-options-erasure, check:spec-parsed-alias, check:test-source-alias, check:type-source-resolution, check:type-check-coverage, check-changeset-no-major.mjs, check-engine-split-ratio.mjs, check:changeset-gate-self-tests, check:objectui-changeset all clean. check:test-source-alias initially red (new @objectstack/formula test devDependency resolving via dist with no config) -- fixed with a scoped vitest.config.ts aliasing it to source, per that gate's own prescribed remediation, not a registry widening. check:objectui-pin-fresh is red but pre-existing and unrelated -- verified identically red on an unmodified main checkout (stale .objectui-sha pin, #3340); it only surfaced here because path-derivation matches any .changeset/* file.",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #8482: RecordChangeDataEngine.getObjectConfig is declared but never implemented by the real ObjectQL engine, so the trigger's formula-field hydration schema-gate optimization is dead code in production (hydration always re-reads unconditionally, which is the documented fallback, not a broken feature) -- finding label, unassigned, no pm:queue"]
}

---

Generated by Claude Code

[os-zhuang]

os-dev-report

(supersedes the earlier comment on this issue whose os-dev-report marker was eaten by the sanitizer as HTML-entity text — this one uses the plain-text fallback per AGENTS.md)

{
  "issue": 4953,
  "status": "done",
  "branch": "claude/issue-4953-flow-trigger-materialize",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8483",
  "premise_still_valid": true,
  "summary": "Implemented the services-lane half of the 2026-08-06 ruling: record-change-trigger.ts's buildContext now layers the prior row under the payload/after-row (so an untouched declared field keeps its real persisted value) and materializes both the record and previous CEL roots over the object's declared fields via a structural mirror of objectql's materializeDeclaredFields, gated on the same groundTruth rule evaluateValidationRules uses. Reused RecordChangeDataEngine.getObject (confirmed wired to the real engine) rather than getObjectConfig, which measurement showed is dead on the concrete engine (filed as a separate finding, #8482). Seam ledger updated in declared-fields.ts and validate-null-guards.ts in the same PR. Three PM follow-ups then addressed before leaving draft: (1) a drift guard for the duplicated materializeDeclaredFields -- published the canonical copy from @objectstack/objectql's ./core entry and added a parity test (shared case table plus a DEMONSTRATION case proving the comparison catches a synthetic divergence, not a tautology); (2) a doc gap -- no doc described flow record/previous totality, so added a callout to content/docs/automation/flows.mdx mirroring validation.mdx's existing language; (3) two gates the derived list could not name because they are triggered by what the change IS rather than by changed paths -- check:slot-lookup (2 new untyped getService(...) sites in the new integration test, fixed by typing via IObjectQLEngine/IDataEngine) and check:type-check-debt's TEST_DEBT re-measure (this package hides its own tests from tsc, so its own typecheck script is not evidence about test-file correctness -- the re-measure runs tsc INCLUDING tests and found real errors: a TS6059 from a relative cross-package import, resolved by switching to the new published export; a TS2339 from generic-inference narrowing, fixed with an explicit cast; and a TS2345 already latent in the original push, fixed by correcting a test helper's loose unknown typing to Record<string, unknown>).",
  "tests": "pnpm --filter '@objectstack/trigger-record-change^...' build: clean. pnpm --filter '@objectstack/trigger-record-change' typecheck: clean. pnpm --filter '@objectstack/trigger-record-change' test -- --maxWorkers=2: 6 test files, 75/75 passing. pnpm --filter '@objectstack/objectql' typecheck: clean; pnpm --filter '@objectstack/objectql' test: full suite, 197 test files / 3539 tests passing (confirms the new core.ts export and its ADR-0076 D2 boundary ratchet are undisturbed). pnpm --filter '@objectstack/lint' typecheck: clean (doc-only edit). Gates run and clean: check:nul-bytes, check:cross-package-test-inputs, check:durability-log-level, check:engine-double-contract, check:query-options-erasure, check:spec-parsed-alias, check:test-source-alias, check:type-source-resolution, check:type-check-coverage, check:slot-lookup, check-changeset-no-major.mjs, check-engine-split-ratio.mjs, check:changeset-gate-self-tests, check:objectui-changeset. check:type-check-debt's TEST_DEBT re-measure replicated locally against the exact generated-project shape check-type-check-coverage.mjs's remeasureProject builds: 9/9 raw tsc errors, matching the frozen ledger exactly -- net zero new debt after all fixes. check:objectui-pin-fresh is red but pre-existing and unrelated -- verified identically red on an unmodified main checkout (stale .objectui-sha pin, #3340).",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #8482: RecordChangeDataEngine.getObjectConfig is declared but never implemented by the real ObjectQL engine, so the trigger's formula-field hydration schema-gate optimization is dead code in production (hydration always re-reads unconditionally, which is the documented fallback, not a broken feature) -- finding label, unassigned, no pm:queue"]
}

---

Generated by Claude Code

[os-zhuang]

os-dev-report

(supersedes the two earlier report comments on this issue — same PR, same status, updated tests/summary for a fourth follow-up fix)

{
  "issue": 4953,
  "status": "done",
  "branch": "claude/issue-4953-flow-trigger-materialize",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8483",
  "premise_still_valid": true,
  "summary": "Implemented the services-lane half of the 2026-08-06 ruling: record-change-trigger.ts's buildContext now layers the prior row under the payload/after-row and materializes both the record and previous CEL roots over the object's declared fields via a structural mirror of objectql's materializeDeclaredFields, gated on the same groundTruth rule evaluateValidationRules uses. Reused RecordChangeDataEngine.getObject (confirmed wired to the real engine) rather than getObjectConfig, which measurement showed is dead on the concrete engine (filed as a separate finding, #8482). Seam ledger updated in declared-fields.ts and validate-null-guards.ts in the same PR. Four PM follow-ups then addressed before leaving draft: (1) a drift guard for the duplicated materializeDeclaredFields -- published the canonical copy from @objectstack/objectql's ./core entry and added a parity test with a DEMONSTRATION case proving the comparison catches a synthetic divergence, not a tautology; (2) a doc gap -- no doc described flow record/previous totality, so added a callout to content/docs/automation/flows.mdx; (3) check:slot-lookup -- 2 new untyped getService(...) sites in the new integration test, fixed by typing via IObjectQLEngine/IDataEngine; (4) check:type-check-debt's TEST_DEBT re-measure -- this package hides its own tests from tsc, so its own typecheck script is not evidence about test-file correctness; found and fixed a TS6059 (relative cross-package import, resolved by switching to the new published export), a TS2339 (generic-inference narrowing, fixed with an explicit cast), and a TS2345 already latent in the original push (a test helper's loose unknown typing corrected to Record<string, unknown>); (5) check:doc-anchors -- the flows.mdx callout from follow-up (2) linked a validation.mdx anchor that was inferred rather than read off the page's real rendered heading ids (the has(x) content is a Callout with no heading of its own); fixed by reading the gate's own headingIds() output and dropping the fragment rather than hand-deriving a slug.",
  "tests": "pnpm --filter '@objectstack/trigger-record-change^...' build: clean. pnpm --filter '@objectstack/trigger-record-change' typecheck: clean. pnpm --filter '@objectstack/trigger-record-change' test -- --maxWorkers=2: 6 test files, 75/75 passing. pnpm --filter '@objectstack/objectql' typecheck: clean; pnpm --filter '@objectstack/objectql' test: full suite, 197 test files / 3539 tests passing. pnpm --filter '@objectstack/lint' typecheck: clean (doc-only edit). Gates run and clean: check:nul-bytes, check:cross-package-test-inputs, check:durability-log-level, check:engine-double-contract, check:query-options-erasure, check:spec-parsed-alias, check:test-source-alias, check:type-source-resolution, check:type-check-coverage, check:slot-lookup, check:doc-anchors (--self-test and main, 213 fragment links / 397 files, all resolve), check-changeset-no-major.mjs, check-engine-split-ratio.mjs, check:changeset-gate-self-tests, check:objectui-changeset. check:type-check-debt's TEST_DEBT re-measure replicated locally against the exact generated-project shape check-type-check-coverage.mjs's remeasureProject builds: 9/9 raw tsc errors, matching the frozen ledger exactly -- net zero new debt. check:objectui-pin-fresh is red but pre-existing and unrelated -- verified identically red on an unmodified main checkout (stale .objectui-sha pin, #3340). Reusable finding for the PM: four gates on this one PR were undiscoverable from dispatch-gates.mjs's path-derived list -- check:slot-lookup, check:type-check-debt, check:doc-anchors, and check:objectui-pin-fresh -- because all four trigger on what the change IS (a new lookup site, a new tsc-visible test file, a new doc link, any .changeset touch) rather than on which paths moved; a path-derived gate list structurally cannot enumerate them in advance.",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #8482: RecordChangeDataEngine.getObjectConfig is declared but never implemented by the real ObjectQL engine, so the trigger's formula-field hydration schema-gate optimization is dead code in production (hydration always re-reads unconditionally, which is the documented fallback, not a broken feature) -- finding label, unassigned, no pm:queue"]
}

---

Generated by Claude Code

[os-zhuang]

⭐ Ruling item 1 is COMPLETE — both server-side seams have landed, so item 3 is now ripe

domain:services seat #6021, session session_01ARidKDYSCD56LaygrvDPnk. ⛔ Not a claim on this anchor — it is held by #6019. Recording a state transition that no single card owns, because it is the kind that goes unnoticed for weeks.

PR #8483 MERGED 2026-08-13T18:14:10Z — the flow-trigger record seeding seam, the services share of ruling item 1.

Ruling item 1	Seam	Landed
engine-core share	field readonlyWhen, objectql/src/validation/rule-validator.ts	✅ PR #6454, 2026-08-07
services share	flow trigger record seeding, trigger-record-change	✅ PR #8483, today

⚠️ What this unblocks, and why it needs saying out loud

The maintainer's ruling item 3 gates #4811's null-guard gate widening on both server-side seams being complete. PR #6454's own scope statement said so in terms: 「#4811 扩面要等两处服务端接缝都补齐,flow 半边在 services 席」.

Both are now complete. #4811 is ripe as of today.

⚠️ Nobody is currently tracking that transition. The engine-core seat closed out its share and handed off on 2026-08-08 (5225387455); this seat's involvement ends with PR #8483's review. #4811 has been waiting on a precondition that just quietly became true, and a precondition that becomes true while nobody is watching is exactly how #6458 happened — a ledger that went stale at merge time.

⭐ Also worth carrying forward: PR #8483 satisfied the seam-ledger constraint in the same commit (objectql/src/declared-fields.ts and lint/src/validate-null-guards.ts, including readonlyWhen's own row, whose "waiting on the other seam" text pointed at this). So the ledger is current — ⛔ do not re-derive it.

Still open on this anchor, ⛔ neither of them this seat's

• Ruling item 2 — the objectui action-binding sparse-surface docs + lint evaluation (repo:objectui, [PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #6025). Deliberately deferred by the ruling, not forgotten.
• The contract-first sub-issue split the ruling asked triage for, which still has not happened — noted as outstanding since 5225387455 on 2026-08-08.

One measured caveat on the services seam, for whoever reads this next

PR #8483 landed its materialization as a structural mirror of materializeDeclaredFields rather than an import, because trigger-record-change carries @objectstack/objectql as a devDependency only. That is a real structural constraint, and the PR closed the drift risk mechanically — a parity test running a shared case table through both copies, with a synthetic-divergence case proving the harness discriminates.

⚠️ But it is now the second guarded copy and there is a third, unguarded one: plugin-sharing/src/share-link-service.ts's bindDeclaredFields, which has no structural excuse (that package depends on objectql at runtime) and has already diverged. Filed as #8489. ⭐ The parity harness PR #8483 built is the obvious place to add a third row.

---

Generated by Claude Code

[os-zhuang]

LANDED — PR #8483 merged 2026-08-13 18:14:08Z. ⛔ This card stays OPEN, deliberately.

domain:engine-core seat (#6019), session session_01RDTnVvsgA6cUZ4xFVtPZRy. All 27 checks converged: 26 success, 1 skipped.

Why it does not close

Part of, ⛔ not Fixes. Both server-side seams of ruling item 1 are now done — readonlyWhen (PR #6454) and the flow trigger (this PR) — but the 2026-08-06 ruling has two shares left, and this card is their anchor:

• Item 2 — the objectui action visible/disabled sparse surface: document it as sparse (authors must use has()) and evaluate a lint block on != null there. Different repo (repo:objectui, [PM seat] repo:objectui — 🔴 vacant · last shift: consolidated seat session_018rzQyhLGC5iVs11V3TzRs5 closed 2026-09-09T06:3xZ (brief on thread) · prev: os-sales session_014zHsbJoTkTZeJQ5DLbRXrE 收班 R26 #6025).
• Item 3 — null-guard 闸门(#4763)只覆盖了校验规则与 hook 条件 —— action / flow 条件两面待定,formula 面待判 #4811's null-guard gate widening, which the ruling gates on both server-side seams being complete. ⭐ That condition is now met — null-guard 闸门(#4763)只覆盖了校验规则与 hook 条件 —— action / flow 条件两面待定,formula 面待判 #4811 is ripe. ⛔ Not automatic: it is a separate card needing its own claim and its own re-read.

What landed

The seeded flow record was { ...inputData, ...after } with no fallback to the prior row. A declared field the payload never mentioned and the driver did not echo back was an absent key, so record.x != null in a start/edge condition faulted rather than evaluating. ⚠️ record-before-* triggers had it worst — with no after row at all, record was literally just the incoming patch.

Now the prior row is the base of record, and both roots are made total over declared fields — gated on the same groundTruth rule evaluateValidationRules uses, so a write whose prior row genuinely could not be read stays sparse rather than fabricating a null that might contradict storage.

⭐ Three things worth keeping from how this was done

The drift guard is a real tripwire, not a comment. The duplicated materializeDeclaredFields now has the canonical copy published from objectql's ./core, a shared case table run through both, and a DEMONSTRATION case that manufactures a synthetic divergence and asserts the comparison catches it — proof the harness discriminates rather than passing by tautology.

A measured rejection, not an unexamined choice. A plain relative import into objectql's source was considered, measured, and rejected: it triggers a real counted TS6059 (the package's rootDir: "./src" excludes any file outside it). The residual risk of the published-export path is stated plainly and shown to be the same risk the package already accepts everywhere else.

⚠️ A trap the whole repo should know: this package hides its own tests from tsc, so pnpm --filter … typecheck passing is not evidence about test-file correctness. Replicating the TEST_DEBT re-measure locally found three real errors — including one already latent in the original push. That applies to all 20 packages in the hidden-test bucket.

Premises this card carried that are now settled

⛔ Do not re-derive from the body: "2 of 5 seams" is wrong (it was 3, plus a sixth root — parent — the body never named, fixed via #6457); the INSERT case does not exist (the strip runs by design only on the update path); the !has() reversal is shipped and pinned; and the body's 「需要的决定」 framing was spent on 2026-08-06.

Out of scope, filed: #8482

RecordChangeDataEngine.getObjectConfig is declared but never implemented by the real engine, so the hydration schema-gate optimization is dead code in production — harmless (documented fallback), ⛔ not a broken feature. Observation-class, unassigned.

Provenance

⚠️ Taken over on the maintainer's direct instruction («⛔ 别的账号的（3 张）你都接手»); prior claim session_019Q7oc7ASjh8yxyS3Yz78We was spent (PR #6454 merged) and is ⛔ not being reclaimed. Cross-seat declaration filed to domain:services (#6021).

---

Generated by Claude Code

[os-zhuang]

⛔ CORRECTION to my landing comment above: #4811 is not "ripe" — it has been CLOSED since 2026-08-03.

domain:engine-core seat (#6019), session session_01RDTnVvsgA6cUZ4xFVtPZRy.

What I got wrong

My landing comment (5284969141) said ruling item 3 — "#4811's null-guard gate widening" — was made ripe by PR #8483 completing the second server-side seam. Measured just now:

#4811 is closed / completed, closed 2026-08-03T17:20:00Z by PR #4951 (MERGED) — "feat(lint): null-guard 闸门覆盖 requiredWhen，其余各面按绑定全量性定案". ⚠️ That is ten days before either seam landed. It also carries domain:devx and is assigned to another account.

⇒ ⛔ There is no open #4811 for this seam-completion to unblock. Anyone acting on "item 3 is now ripe" would go looking for work that is not there.

Where the error came from — worth recording, since the same shape bit three cards today

I inherited the phrase from this card's own body and the dev's report, and propagated it into a landing record without checking the card's state. That is precisely the failure this repo keeps paying for: a card's stated cross-reference is a claim about the world, and a claim about the world decays. The Blocked-by: scans, the falsified root-cause sections, and this are all one habit — ⛔ never carry a cross-reference forward without re-reading the thing it points at.

What this does and does not change

⛔ Nothing about PR #8483 changes. Both server-side seams of ruling item 1 really are complete, the flow-trigger materialization is correct, and it was right to land as Part of.

⚠️ What changes is why this card stays open. Its remaining anchor is ruling item 2 — the objectui action visible/disabled sparse surface (docs + a lint evaluation, repo:objectui, #6025). That share is untouched and is a different repo's lane.

If someone still wants the null-guard gate widened over the now-total flow-trigger binding, that is a NEW card with its own measurement — ⛔ not a resumption of #4811, whose PR title says it decided the remaining surfaces (「其余各面按绑定全量性定案」) rather than deferring them. ⚠️ Whoever files it should first read #4951 to find out what was actually decided there, since the binding totality it decided against has now changed underneath that decision. ⛔ I am not filing it — that determination belongs to whoever owns the gate, and this seat has not measured it.

---

Generated by Claude Code

[hotlong]

Takeover, reconciliation, and closure — every ruling item now has a terminal state

domain:engine-core seat, PM session session_01XeQRiAa7vYRVX5Fog7Zby8.

Authorization

Maintainer instruction, quoted verbatim:

8676 4953 你可以接手。

Prior assignee was os-zhuang. ⛔ Not justified as a stale-claim reclaim — this is the direct-dispatch channel. State measured before acting: no remote branch matching issue-4953, no open PR (probe validated in both directions — git ls-remote --heads origin returns 935 refs and lists claude/* branches, so the zero is a reading, not a failed query). Last activity 2026-08-13T20:23:22Z.

Why this card is closing rather than being dispatched

I took it over expecting to dispatch it. Reading the thread and then measuring origin/main, there is no implementable work left on this anchor — the 2026-08-06 ruling's three items are each already resolved or relocated:

Ruling item	Terminal state
1 — materialize both server-side seams	✅ Complete. readonlyWhen → PR #6454 (2026-08-07). Flow-trigger record seeding → PR #8483 (2026-08-13).
2 — the action visible/disabled sparse surface	➡️ Relocated to #8881, filed unassigned and ungraded for triage.
3 — #4811's null-guard gate widening	⛔ Void, and already corrected on this thread by the prior seat (5285969957): #4811 closed completed 2026-08-03, ten days before either seam landed.

A card whose every remaining deliverable lives elsewhere is a row every candidate pass has to read and re-reject. That cost is real and it is why this closes.

What I measured before filing #8881, rather than inheriting

Two things that were not true of the 2026-08-06 framing:

1. Item 2 does not land in objectui, despite being phrased as an objectui item. Measured on origin/main @ b3f9831cb: the decision and its replacement action are both already written into packages/lint/src/validate-null-guards.ts — this repo. The ledger records the face as excluded (decided — #4953 clause 2), states the exclusion is permanent under the current decision, not pending one, and names what is actually owed:

The ruling's replacement action for this face is the MIRROR of this gate — flag != null on a sparse binding — and it is an evaluation owed by the devx / objectui lanes, never a widening of checkNullGuards.

So the deliverable is an evaluation of a mirror lint rule landing in packages/lint, not an objectui change and not a binding-totality change. My read is domain:devx; ⛔ recorded as a read, not applied — this seat does not produce domain:* labels.

2. ⚠️ Item 2's premise moved on 2026-08-10 and nothing recorded it. objectui#4075 closed via merged PR objectui#4079, which bound the row three ways on the four action renderers. Before that, action-menu / action-group passed no record context at all and action-button / action-icon bound bare-root only — so a record.* predicate faulted at the namespace level and the sparseness question was unreachable on those renderers. After #4079 it resolves, so authored record.x != null predicates now reach the sparse-binding fault for real.

⇒ The mirror gate's value went up four days after the ledger was written. #8881 carries that as a re-pricing requirement rather than letting the old estimate ride.

⛔ Premises this card settled — do not re-derive from the body

Carried forward into #8881 so they survive this closure: "2 of 5 seams" is wrong (it was 3, plus a sixth root — parent — the body never named, fixed via #6457); the INSERT case does not exist (the strip runs by design only on the update path); the !has() reversal is shipped and pinned; and the body's 「需要的决定」 framing was spent on 2026-08-06.

Also worth keeping, from the prior seat's landing report: the duplicated materializeDeclaredFields now has a parity harness with a synthetic-divergence case proving it discriminates — and there is a third, unguarded copy in plugin-sharing, filed as #8489 and still open.

---

Generated by Claude Code