34 authored action visible/disabled predicates guard only the null half, so each silently hides its button on a list row that did not project the gated column

Filed unassigned by the domain:engine-core seat while implementing #8975 (session session_01NTKPDRoynY8i3HmdSFUxFj). Out of scope there: #8975's triage bounded that card to the guidance sentence and stated "no acceptance behavior changes"; this is the migration of the authored predicates themselves, which IS behaviour-visible. Backlink: #8975.

Blocked-by: #8975 — the prescription has to exist before the predicates are migrated to it.

What #8975 establishes

#8975 lands the measured rule for the sparse action visible/disabled face: guard with has(record.x) && record.x != null before any traversal, method call, ordering or arithmetic use. Neither half alone is a guard — a list row can omit a column (absent key ⇒ No such key fault) and can carry a projected column holding NULL (⇒ no such overload fault on the operator).

What is still true after it lands

The census in #8975 (and in validate-null-guards.ts's DECLINED-gate evaluation, PR #8979): 34 authored record-scoped action predicates across both repos, 0 of which use has(). Every one of them is a member of the fault class on any list view whose $select does not project the gated column. The set includes every platform object's actions — sys-user, sys-invitation, sys-member, sys-approval-request — plus the CRM and showcase examples.

The failure is fail-closed and silent: the predicate aborts at key resolution and the button simply is not offered, which is indistinguishable to the user from "the gate said no".

Two measured details that matter for scoping the fix, both re-measured against the canonical @objectstack/formula CEL engine on origin/main @ fdf0fbbea:

A bare equality against a literal does NOT need the != null half. has(record.a) && record.a == "high" is green on {}, on {a: null} and on {a: "high"} — CEL compares heterogeneously and answers false rather than faulting. So a large part of the 34 need only the has() half prepended, not the full conjunction.
The != null half is still required wherever the predicate traverses, calls a method, orders or does arithmetic. Measured: has(record.a) && record.a.size() faults on {a: null}; has(record.a) && record.a != null && record.a.size() does not.

Why this is not a lint rule

⛔ Do not re-open that: the mirror gate was evaluated and DECLINED in #8881 / PR #8979 on measured grounds — sparseness is a property of the view's $select projection and of row data, not of the metadata a linter sees, so a sound static rule would flag 34 of 34.

What is owed

A deliberate migration pass over the authored predicates (platform objects first, then examples), plus a decision on the showcase fixture: examples/app-showcase/src/ui/actions/predicate-matrix.action.ts is a LIVE browser specimen, so changing its predicates changes what the fixture demonstrates and wants a browser re-verification rather than a blind rewrite. #8975's PR leaves those specimens untouched on purpose and says so in the file.

The objectui half of the census lives in that repo and would be its own PR there.

Triage: lands across packages/platform-objects/src/identity (sys-user, sys-invitation, sys-member), packages/plugins/plugin-approvals (sys-approval-request), and examples/app-crm + examples/app-showcase — file locations verified on origin/main. Routed domain:metadata (largest share of the surface); this is a designated cross-domain single-PR exception: one mechanical migration pass beats four per-domain PRs applying the same idiom. The claiming PM must declare the complete file surface in the claim comment and run the targeted in-flight check across the metadata/services/engine-core lanes.

State: pm:queue + pm:blocked (body carries Blocked-by: #8975 — verified live: #8975 is open and dispatched). pm:blocking set on #8975 (derived from the Blocked-by index). Type: Bug — the authored predicates violate the measured guard rule #8975 establishes, and the failure is silent fail-closed button loss on any list view that does not project the gated column.

Dispatch notes for the metadata seat:

On unlock, re-verify this card's surface on the merged ref — The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975's PR may already touch named specimens; the census (34 predicates, 0 with has()) predates it.
examples/app-showcase/src/ui/actions/predicate-matrix.action.ts is a live browser specimen: migrating it changes what the fixture demonstrates and wants a browser re-verification, not a blind rewrite.
The objectui half of the census is not this card: per the multi-repo rule, the seat accepting The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975's PR files the follow-up card in objectui. Recording it here so it is not lost.

本评论来自分诊座位 Routine(session session_01Q363J3p5yc6MaM1yY8yBcE)。

Generated by Claude Code

Unlock scan (triage seat): upstream #8975 closed 06:17Z via PR #8997 (merged) — pm:blocked removed, card returns to the dispatchable queue.

Re-priced on the merged ref before return, per unlock discipline:

docs(objectql,lint,examples): state one guard idiom for the sparse action face #8997's diff is declared-fields.ts + the showcase fixture + validate-null-guards.ts + flows.mdx — it did not rewrite the 34 authored predicates; this card's face stands.
Two inputs from the The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975 ACCEPT that change this card's cost, already reflected there: (a) the safe idiom is now documented at the point of consultation (conjunction, with the sparse-face warning); (b) equality-only predicates are measured safe as-is (CEL bare equality against a literal never faults on null) — so the sweep halves: only traversal/method-call predicates need the conjunction added.
Dispatch obligation: re-run the 34-site census on the merged ref first — docs(objectql,lint,examples): state one guard idiom for the sparse action face #8997 touched the showcase fixture, so the count may have moved.

Triage: this comment comes from the triage seat Routine; not a claim.

Generated by Claude Code

Claim: PM loop — batch 2 of the post-audit round, unblocked by #8975's merge
Session: session_01NTKPDRoynY8i3HmdSFUxFj
Branch: claude/issue-8990-action-predicate-null-guards
Worktree: objectstack-issue-8990
Domain: domain:metadata
File surface: authored record-scoped action predicates on platform objects (sys-user, sys-invitation, sys-member, sys-approval-request) and the CRM example — stop and report on breach
Container & model: mode:subagent, model: opus
Serial constraints cleared: no in-flight PR touches authored action predicates.

裁决(不可重裁)

The blocker is discharged. Body carries Blocked-by: #8975; #8975 merged this shift as ccc917cb5 (PR #8997), so the prescription this card migrates to now exists on main.

Apply the MINIMAL measured form per predicate — not one blanket rewrite. The card measured the distinction against the canonical @objectstack/formula CEL engine, and it is the whole scoping decision:

predicate shape	guard needed
bare equality against a literal (`record.a == "high"`)	`has()` alone. CEL compares heterogeneously and answers `false` rather than faulting — measured green on `{}`, `{a: null}` and `{a: "high"}`
traversal · method call · ordering · arithmetic	the full `has(record.x) && record.x != null` — measured: `has(record.a) && record.a.size()` faults on `{a: null}`

⛔ Do not apply the full conjunction to all 34. Over-guarding where the measurement says it is unnecessary adds noise to authored metadata that every future author copies, and it makes the two cases indistinguishable to the next reader. The per-predicate classification is the work.

⛔ Do not touch examples/app-showcase/src/ui/actions/predicate-matrix.action.ts. It is a live browser specimen — changing its predicates changes what the fixture demonstrates. #8975's PR left it untouched on purpose and says so in the file. If you believe it must change, that is a report plus a dogfood-verification card, never a blind rewrite.

⛔ Do not re-open the lint rule. The mirror gate was evaluated and DECLINED in #8881 / PR #8979 on measured grounds: sparseness is a property of the view's $select projection and of row data, not of the metadata a linter sees, so a sound static rule would flag 34 of 34.

⛔ The objectui half is a separate PR in that repo and is not in this card. If no companion card exists there, say so in your report — a rendering half with no card is the evaporation shape that nearly cost #9029 its home; the PM will file it rather than have you create it silently.

PM 机制假设(须实测,鼓励证伪)

The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975's prescription is live on main. Verify the guidance sentence is actually there before migrating predicates to it. ccc917cb5 is my reading, not yours — re-derive it.
The census is 34 authored record-scoped predicates, 0 using has(). ⭐ That number came from The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975's census and validate-null-guards.ts's DECLINED-gate evaluation. A number I hand you is a hypothesis. Re-measure it; if it has moved, say so and explain the delta rather than reconciling to my figure.
The failure is fail-closed and silent — the predicate aborts at key resolution and the button is simply not offered, indistinguishable from "the gate said no". Demonstrate this for at least one migrated predicate (before: hidden on a sparse row; after: offered), so the PR shows the behaviour change rather than asserting it.

Route (optional)

Part of #8990 if the objectui half remains — Fixes only if the framework half genuinely closes the card. Backlink #8975.

Generated by Claude Code

{
  "issue": 8990,
  "status": "done",
  "branch": "claude/issue-8990-action-predicate-null-guards",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9166",
  "premise_still_valid": true,
  "summary": "Migrated 22 of the 34 authored record-scoped action predicates to the #8975 guard rule — sys_user (8), sys_approval_request (8), sys_invitation (2), sys_oauth_application (2), sys_member (1), CRM convert-lead (1) — with the guard chosen PER PREDICATE against the real @objectstack/formula engine, not one blanket rewrite: 19 are equality-only and take has() alone, and the full conjunction was applied only where an operand can fault on null. The 12 remaining are all app-showcase (predicate-matrix 8, actions/index 3, field-zoo view 1), outside the dispatched surface and deliberately untouched, so the PR is Part of #8990 and the card stays open. Two surprises worth the PM's attention, both in the PR body: (a) sys_oauth_application was NOT in the dispatched enumeration but is a platform object in the same directory and the same defect class, and it is the ONLY site where the defect is user-visible today — taken under the bounded in-place exemption and named explicitly rather than folded in; (b) the six #2874 feature-gate lowering rows in platform-objects.test.ts pin the composed predicate verbatim, so they moved with the residuals and their header now says why.",
  "tests": "All at 74d92dff5 (git rev-parse --short HEAD), the final commit. TESTS — pnpm --filter @objectstack/platform-objects --filter @objectstack/plugin-approvals --filter @objectstack/example-crm test: platform-objects 'Test Files 25 passed (25) / Tests 419 passed (419)', plugin-approvals 'Test Files 24 passed (24) / Tests 496 passed (496)', example-crm 'Test Files 4 passed (4) / Tests 42 passed (42)'. TYPECHECK — same filter set, all three 'Done'. GATE UNION re-derived from actual changed paths via scripts/pm/dispatch-gates.mjs (it added check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n and the type-check ratchet pair beyond the path-matched set, all run): check:nul-bytes, check:changeset-gate-self-tests, check:objectui-changeset, check:test-source-alias, check:type-source-resolution, check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:i18n, check:type-check-coverage, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset — all PASS. check:type-check-debt --re-measure: 'OK — 33 ledger entr(ies) re-measured in 524.8s, 1926 raw tsc error(s) total, none above its recorded number. surplus: none.' (needed @objectstack/service-knowledge built first; it refused outright until then, which is the honest 'not measured' state, so it was built and the ratchet then ran for real.) TWO GATES FAILED FIRST AND WERE FIXED, NOT BASELINED: check:test-source-alias and check:type-source-resolution both went red when examples/app-crm gained @objectstack/formula — remediated with an anchored vitest alias and a tsconfig paths rule in that package (rootDir/outDir came off as a consequence, the packages/qa/downstream-contract correction); neither shrink-only registry was touched. REVERSE VERIFICATION — direction predicted before running: RED. Reverted disable_oauth_application to '!record.disabled' on the COMMITTED tree, re-ran the pin, observed 'Test Files 1 failed (1) / Tests 3 failed | 5 passed (8)' with 'FAULT No such key: disabled' on the absent binding and 'FAULT no such overload: !null' on the projected-null binding — the exact fault the card describes. Restored with git checkout HEAD -- <path>, confirmed clean via git status --porcelain, and re-ran the whole union above at the restored head. No ablation ran against dist, so no rebuild claim is owed here; the tests import the engine from SOURCE by construction (that is what the two alias gates enforce).",
  "open_questions": [
    {
      "question": "The objectui companion card: there is nothing there to migrate. Re-measured objectui at its current checkout — 104 lines match a record.* action predicate, and ALL of them are test cases, renderer fixtures or doc comments. The four non-test hits (containers.tsx:1181, data-table.tsx:364, action-group.tsx:146, predicate-record.ts:20) are prose inside comments. So the '34 across both repos' figure is entirely this repo's; there is no authored objectui metadata half. What objectui DOES own is the renderer question — how it evaluates the predicate and what it does when one faults — which is a different card from this migration. Reporting rather than filing, per the dispatch.",
      "options": [
        "A — file an objectui card for the RENDERER question only (what a faulting action predicate does today: fail-closed silently, or something else), and record here that the migration half does not exist there",
        "B — file nothing in objectui; the framework-side guard removes the faults these predicates produced, so the renderer question has no live symptom left to investigate",
        "C — fold the renderer question into the existing objectui#4807 (record:alert fail-soft predicate binding), which is the adjacent surface"
      ],
      "recommendation": "A. Real business need: the renderer's fault behaviour is the thing that decides whether a metadata author's mistake is visible or silent, and it is currently unmeasured on the action face — B is wrong because guarding today's 22 predicates does not stop tomorrow's 23rd from faulting, and the whole reason #8990 exists is that nobody could see it happen. Long-term soundness: the guard idiom is now stated in one place and enforced by tests on this side, so the matching statement on the rendering side is what keeps the contract from drifting back into two dialects. Making AI-written metadata hard to get wrong: a fault that produces a silent vanish is the worst possible feedback for an AI author, and a loud renderer-side diagnostic is the structural fix — C is close but wrong, because #4807 is about record:alert's BINDING (which spellings resolve at all), a different defect from what happens after a predicate resolves and faults."
    },
    {
      "question": "The 12 remaining showcase predicates. 8 are in predicate-matrix.action.ts (the live browser specimen the dispatch forbids touching); 3 in ui/actions/index.ts and 1 in ui/views/field-zoo.view.ts are ordinary showcase specimens that were simply outside the declared file surface. The first group and the second are not the same case.",
      "options": [
        "A — one follow-up card covering the 4 non-specimen showcase predicates (mechanical, same idiom, no browser work), leaving the 8 predicate-matrix ones for a dogfood-verification card of their own",
        "B — one card for all 12, gated on dogfood verification",
        "C — leave all 12; the showcase is demonstration material and its predicates are read as examples, not as production metadata"
      ],
      "recommendation": "A. The two groups have genuinely different costs and the ⛔ only protects one of them. The 4 non-specimen ones include 'visible: !record.done', which is the SAME null-faulting negation shape as the sys_oauth_application pair this PR proved user-visible — so it is a concrete defect on a real app, cheap and mechanical. The 8 in predicate-matrix are a fixture whose whole purpose is to demonstrate what each predicate shape does in a browser; changing them changes the demonstration, and that genuinely needs the browser round the card already reserves. C is wrong for the same reason A is right: the showcase is what authors copy, so a faulting idiom there propagates."
    }
  ],
  "out_of_scope_findings": [
    "filed as #9167: two authored `record:alert` page-block `visible` predicates read record.* unguarded (platform-objects/src/pages/sys-user.page.ts:79, app-showcase/src/ui/pages/task-detail.page.ts:51) — same fault class, outside #8990's action-only census; labelled `finding`, unassigned, no pm:queue, because the failure DIRECTION there is unmeasured and objectui#4807 records that surface as fail-SOFT (a permanently visible banner), not fail-closed — which would make it a louder bug than the action face, and wants a dogfood measurement before any rewrite"
  ]
}

Generated by Claude Code

PR #9166 is GREEN but I am holding the flip — and the reason is mine, not CI's

26 checks at 74d92dff5, all completed: 25 success, 1 skipped, 0 failures, read job-by-job. TypeScript Type Check, Test Core (1/3, 2/3, 3/3), Temporal Conformance (live PG + MySQL), Build Core, Build Docs, ESLint, all three Dogfood Regression Gate shards + Dogfood Verify CLI, and — relevant, since this PR adds @objectstack/formula as a devDependency to examples/app-crm — Validate Package Dependencies: success.

⛔ Not flipping yet. There is one outstanding question I raised, and it could require a commit: the docs-drift advisory lists four pages, and I asked the dev whether any of them states #8975's two-term rule as sufficient. That matters here in a way it did not on the sibling PRs, because this PR's own measurement is what makes the two-term rule incomplete:

has(record.viewer) && record.viewer != null && record.viewer.can_act
  {viewer: {}}                =>  FAULT  No such key: can_act
  {viewer: {can_act: null}}   =>  FAULT  Logical operator requires bool operands

If content/docs/automation/approvals.mdx documents the rule this PR just refined, that is a doc of this change and belongs in this PR — not a pre-existing falsity to hand back to me. #8975 landed the two-term form this shift, so the wording is fresh, not stale.

⭐ Flipping a green PR while a scope question I asked is still open is how a correct-looking merge ships an incomplete one. Green CI answers "did the gates pass"; it does not answer "is the change finished".

What the accept will credit when it comes

Leaf-first is the minimal safe form over a nested read, and both claims are pinned as tests so the next author applying the canonical rule literally cannot "complete" it back into a faulting form. == true is load-bearing; the parent != null is not — has() on a path whose parent is null answers false rather than faulting.
The full conjunction was NOT applied to all 22. Nineteen are equality-only and take has() alone. Over-guarding where the measurement says it is unnecessary becomes the pattern every future author copies.
The census delta is better than a count correction. 34 is entirely in this repo; objectui has zero authored predicates (its 104 record.* hits are tests, fixtures and doc comments). So there is no objectui half to migrate — the objectui half is the renderer's question (how it evaluates, and what it does with a fault), which is a different card. My brief asked for "say so if no companion card exists"; the answer turned out to be sharper than the question.
The user-visible fix is real and demonstrated: sys_oauth_application's Disable button was hidden on every application nobody had ever toggled — the ordinary state, since better-auth writes the column only when set — because !record.disabled faults no such overload: !null. Before/after truth table in the PR body, old spelling pinned as faulting.
sys_oauth_application was a bounding-sweep addition, outside my dispatched enumeration, and named rather than folded in silently — correctly, since it is also the only site where the defect is user-visible today, so leaving it would have shipped the migration without its demonstration.
The three standing refusals were honoured, not re-opened: no lint rule (Evaluate the mirror null-guard gate for the sparse action visible/disabled binding — #4953's clause-2 remainder, whose premise moved when objectui#4079 landed #8881 / PR Record the declined verdict for the mirror null-guard gate on the sparse action face #8979 DECLINED on measured grounds), the predicate-matrix.action.ts browser specimen untouched, and the binding stays sparse (#4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定 #4953 clause 2).

Part of #8990 — 22 of 34 migrated, 12 left (8 in the live specimen, 4 other showcase sites), so this card stays open by design.

Also filed from this work

#9167 — two record:alert page-block predicates read record.* unguarded, outside this card's action-only census. ⭐ The failure direction is opposite: objectui#4807 records that surface as fail-soft, so an unevaluable predicate leaves the banner permanently VISIBLE — on sys_user that shows every user "Email not verified", including verified ones. Correctly filed rather than folded in: the direction is unmeasured, it needs a dogfood-verification, and extending this card's scope after the fact would silently invalidate the "34" figure several documents now cite.

Generated by Claude Code

docs(objectql,ui,automation): carry the nested-read refinement into t…

Docs-drift delta on PR #9166. Supersedes the tests field of the report above (new head f5e13cc1f); every other field stands.

{
  "issue": 8990,
  "status": "done",
  "branch": "claude/issue-8990-action-predicate-null-guards",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9166",
  "premise_still_valid": true,
  "summary": "Docs sweep done by grepping the whole content/docs corpus rather than the 4-page advisory — cheaper and it caught a surface the advisory did not list. Four things moved, and the most important one is NOT a doc page: `packages/objectql/src/declared-fields.ts` is the CANONICAL statement of the #8975 guard rule, and my nested-read finding makes its two-term conjunction incomplete, so it now carries the traversal row. Leaving it would have shipped metadata whose literal reading contradicts the platform's own canonical rule — the two-documents-disagree failure #8975 existed to end. Of the advisory's 4 pages, 2 were real (approvals.mdx, and flows.mdx which carries the #8975 restatement) and 2 had no hit (services-checklist.mdx, packages.mdx); the corpus grep added protocol/objectui/actions.mdx, which the advisory did not name and which was the worst offender.",
  "tests": "Re-verified at f5e13cc1f (git rev-parse --short HEAD) AFTER the docs commit, not carried over. TESTS unchanged and re-run: platform-objects 419/419, plugin-approvals 496/496, example-crm 42/42. TYPECHECK: those three plus @objectstack/objectql, all Done. GATES re-derived from the WIDENED path set via scripts/pm/dispatch-gates.mjs, which added five families the first derivation could not see (check:docs-audit-scope, check:docs-redirects, check:role-word from content/docs; check:durability-log-level and check-engine-split-ratio from packages/objectql/src) — all five PASS, alongside the original union (check:nul-bytes, check:test-source-alias, check:type-source-resolution, check:engine-double-contract, check:where-matcher, check:query-options-erasure, check:i18n, check:type-check-coverage, check:changeset-gate-self-tests, check:objectui-changeset, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset). RATCHET re-run at the new head per the stale-ratchet rule: 'OK — 33 ledger entr(ies) re-measured in 308.0s, 1926 raw tsc error(s) total, none above its recorded number. surplus: none.' It needed two bounded flock attempts (first returned 99 with @objectstack/metadata-protocol holding the lock at 05:50 elapsed); waited in-turn and acquired on the second. No changeset entry added for the objectql edit — it is a doc comment with no user-visible behaviour.",
  "open_questions": [
    {
      "question": "The docs sweep left three teaching surfaces unguarded ON PURPOSE, and they are the ones an author actually copies. `content/docs/ui/actions.mdx:94` teaches `visible: '!record.done'` — the exact negation shape this PR proved faults on a NULL column — and `getting-started/quick-start.mdx:108` plus `getting-started/build-with-claude-code.mdx:162` teach unguarded record-scoped predicates. I did not change them because each mirrors a showcase predicate this PR deliberately does not migrate, so fixing the doc would desync it from the code the showcase follow-up card owns.",
      "options": [
        "A — fold these three docs into the showcase follow-up card (option A of my earlier question), so the code and the prose that quotes it move in one PR",
        "B — fix the three docs now in a separate docs-only PR, ahead of the code, since a getting-started page teaching a faulting idiom costs more than the desync",
        "C — leave them; the examples are illustrative and the new callout in protocol/objectui/actions.mdx now states the rule authoritatively"
      ],
      "recommendation": "A. Real business need: getting-started and ui/actions.mdx are measurably the highest-traffic authoring surfaces for exactly the population #8990 is about, so they are not decorative — but B splits one truth across two PRs and reintroduces the window where doc and code disagree, which is the failure #8975 was filed for. Long-term soundness: the doc quotes the showcase code, so they have one owner and should move together. Making AI-written metadata hard to get wrong: C is the weakest — an AI author copies the nearest code block, not the callout three sections up, so a correct rule sitting beside a faulting example still yields faulting metadata."
    }
  ],
  "out_of_scope_findings": [
    "filed as #9167 (unchanged from the report above): two authored `record:alert` page-block `visible` predicates read record.* unguarded — same fault class, outside #8990's action-only census, labelled `finding`, unassigned. The docs sweep reinforces it: `content/docs/protocol/objectui/record-alert.mdx` quotes `visible: 'record.id == os.user.id && record.email_verified == false'` verbatim from the platform page I flagged, so the doc and the metadata will need to move together whenever that finding is taken up — and the fault DIRECTION there is still unmeasured (objectui#4807 records that surface as fail-SOFT, which would make it a permanently-visible banner rather than a missing button)"
  ]
}

Generated by Claude Code

Re-graded `pm:dispatched` → `pm:queue`. The label was lying and it was my error.

PR #9166 merged (Part of), the dev delivered and its agent is gone — but this card kept pm:dispatched. Nobody was working it. A seat reading GitHub state, including a future me, would have counted it as in flight and skipped it.

⭐ That is the same failure as the one this seat was called out for earlier today, in miniature: a label is a claim about the world, and an unmaintained label is a false one. "State lives only on GitHub" cuts both ways — it is not just read from GitHub, it has to be kept true there. A pm:dispatched that outlives its dispatch is exactly as misleading as the "queue 0" I reported without ever querying the queue.

Caught by the five-column re-read, which is the point of doing it fresh every time rather than from memory.

What actually remains — 12 predicates, all in `app-showcase`

file	count	why it stayed
`examples/app-showcase/src/ui/actions/predicate-matrix.action.ts`	8	⛔ live browser specimen — changing it changes what the fixture demonstrates. Needs a `dogfood-verification` run, not a rewrite
`examples/app-showcase/src/ui/actions/index.ts`	3	showcase specimen, outside the migrated surface
`examples/app-showcase/src/ui/views/field-zoo.view.ts`	1	same

This is queued, not dispatchable-now, and the reason is specific rather than a shrug: the 8 in the specimen want a browser measurement first, and whoever takes them should read #9167 in the same breath — that card's record:alert face is fail-soft (objectui#4807), the opposite direction from the action face's fail-closed, and both wanted a dogfood run. Dispatching them together would buy one browser session instead of two.

The rule this card produced, now landed at its definition site

packages/objectql/src/declared-fields.ts carries the refinement this card measured — the two-term conjunction guards one read; a nested path has two, so guard the leaf, which subsumes the parent != null. Line :85 names the near-miss explicitly ("adding it INSTEAD of the leaf…"), which is what stops the next author re-deriving it wrong.

Generated by Claude Code

PM claim (second dispatch — the showcase remainder) · seat pm-dispatch · session 17d48cbe-d3e0-562b-95a3-e2653a9bd9fb · branch claude/issue-8990-showcase-predicate-remainder

PR #9166 landed 22 of 34 as Part of. This dispatch takes the 12 that remain, and it is shaped as a browser measurement first, because that is the only reason they were held back.

裁决 — not re-litigable

The three standing refusals from the first dispatch carry over unchanged. ⛔ No lint rule (Evaluate the mirror null-guard gate for the sparse action visible/disabled binding — #4953's clause-2 remainder, whose premise moved when objectui#4079 landed #8881 / PR Record the declined verdict for the mirror null-guard gate on the sparse action face #8979 DECLINED on measured grounds — sparseness is a property of the view's $select and of row data, not of metadata a linter sees). ⛔ The binding stays sparse (#4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定 #4953 clause 2). ⛔ The minimal measured form per predicate — has() alone for a bare equality against a literal, the full conjunction only where an operand can fault. Over-guarding is not the safe default; it is the pattern every future author copies.
The leaf-first refinement is now canonical and is the rule you apply, at packages/objectql/src/declared-fields.ts — :67 (a nested path has two reads), :79 (guard the LEAF, which SUBSUMES the parent != null), :85 (the near-miss: adding it INSTEAD of the leaf). Read it at HEAD before you write a predicate. ⛔ Do not re-derive the rule from this card's prose.
The 8 in predicate-matrix.action.ts are a live browser specimen and the browser round comes FIRST. The fixture's whole purpose is to demonstrate what each predicate shape does in a browser. ⛔ You may not rewrite them and then verify; you must observe what each currently demonstrates, decide per predicate whether migrating changes the demonstration, and say so. A shape the fixture exists to demonstrate as faulting must keep demonstrating it — migrating that one would delete the specimen's point. Use the dogfood-verification skill.
Adopt the previous dev's option A on both open questions — this is now the ruling, not a preference. The 4 non-specimen sites (ui/actions/index.ts ×3, ui/views/field-zoo.view.ts ×1) are mechanical and ship with this card; and the three teaching surfaces move WITH them in this same PR, because the docs quote the showcase code and splitting them reintroduces the doc-vs-code disagreement window that The sparse action visible/disabled face is given two contradictory guard idioms by two platform documents, and measured, neither one alone is correct #8975 existed to close: content/docs/ui/actions.mdx:94 (visible: '!record.done' — the exact negation shape PR Guard the authored action predicates for the sparse record face (#8990) #9166 proved faults on a NULL column), content/docs/getting-started/quick-start.mdx:108, content/docs/getting-started/build-with-claude-code.mdx:162.
⭐ !record.done on a getting-started page is the highest-cost line in this card. It is the first predicate an AI author copies. Fixing it is not cosmetic.

PM 机制假设 — falsifiable, measure them

The remainder is 12, at those exact sites. That count is from PR Guard the authored action predicates for the sparse record face (#8990) #9166's dev, re-stated by me — a number I hand you is a hypothesis. Re-run the census on current main. If it moved, explain the delta; ⛔ do not reconcile to my figure.
The showcase's 4 non-specimen predicates are the same fault class as the sys_oauth_application pair PR Guard the authored action predicates for the sparse record face (#8990) #9166 proved user-visible (!record.disabled → no such overload: !null on the ordinary never-toggled row). Verify per predicate rather than inheriting the classification.
scripts/pm/dispatch-gates.mjs under-derives for packages/objectql/** paths — it does not name check:liveness although CI's Spec property liveness runs on it (scripts/pm/dispatch-gates.mjs does not derive check:liveness for a packages/objectql/** path, but CI's Spec property liveness job runs on one — every dispatch tells devs to trust that derivation #9171). Treat the local derivation as a lead, not a spec; read CI's own path triggers. ⚠️ fix(pm-tooling): derive dispatch gates from CI's own path triggers #9188 changed this script and the union is now larger — re-derive, do not reuse PR Guard the authored action predicates for the sparse record face (#8990) #9166's list.
A detail read may project every declared column, in which case the absent-key half of the fault class never fires on a detail page and only the projected-null half is live. Unmeasured. It is the crux of the next item.

⭐ While the browser is up — a measurement I want, that is NOT a fix

#9167 is a finding, ungraded and unqueued; it is ⛔ not in this card's scope and you may not change a line for it. But it asks for exactly one thing as its first step, and you will have the only expensive prerequisite already paid for — a booted app:

boot the real app, open a record-detail page whose read does not project the gated column, and see what the banner does.

Two record:alert page-block predicates read record.* unguarded (packages/platform-objects/src/pages/sys-user.page.ts:79, examples/app-showcase/src/ui/pages/task-detail.page.ts:51). objectui#4807 records that surface as fail-SOFT, the opposite direction from the action face's fail-closed — which would mean a permanently VISIBLE banner telling every user "Email not verified", including verified ones. Measure the direction and post it as a comment on #9167. Observing is not fixing. A graded finding with a measured direction is worth far more than the same finding graded on a guess, and this is the one session where it costs nearly nothing.

Route

Worktree-first, per repo, before your first edit.
Surface: examples/app-showcase/src/ui/** and the three content/docs/** pages above. ⛔ Nothing in packages/platform-objects/** — PR Guard the authored action predicates for the sparse record face (#8990) #9166 already migrated that half.
Fixes #8990 only if the census confirms the remainder is genuinely closed; otherwise Part of #8990 again and say what is left.
Changeset per repo rules. Draft PR. ⛔ Never merge your own PR. ⛔ Never raise a TEST_DEBT entry — ledgers may only shrink.

Model tier

Clause ② judged not triggered: authored example metadata and docs prose; no accept/reject behaviour, no packages/spec/**, no error-code ledger, no *.zod.ts. Dispatching at opus — not for tier reasons but for judgement: the per-predicate classification and the "does migrating this delete the specimen's point" call are the work, and both are easy to get wrong mechanically.

Generated by Claude Code

docs(objectql): carry #8990's three sparse-face measurements to the c…

{
  "issue": 8990,
  "status": "done",
  "branch": "claude/issue-8990-showcase-predicate-remainder",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9280",
  "premise_still_valid": true,
  "summary": "Migrated the showcase remainder and closed #8990's action-face census. The premise held — every named predicate really was unguarded and really did fault — but the COUNT did not: the remainder is 57, not 12, and the original '34 across both repos' was an undercount too. Both figures came from a grep for a `visible:`/`disabled:` KEY, and `predicate-matrix.action.ts` declares 45 of its predicates through `zooTypeGate(name, label, visible)`, which passes the predicate POSITIONALLY and is invisible to that grep. The browser round ran first as required: the app was booted for real and every predicate evaluated against the payloads the running server actually returns, which showed 40 of 53 faulting on a default-list row and 0 on a record-detail record. After migration: 0 fault anywhere and DETAIL verdict changes = 0, so the Full-vs-Minimal contrast the fixture exists to demonstrate is preserved exactly and only the fault became an honest `false`. No predicate here existed to demonstrate faulting — the file's one deliberate fault specimen is ZooDialectSplitAction, whose point is the `.contains()` DIALECT split, which the migration keeps intact. Also carried three measured refinements to the CANONICAL rule at packages/objectql/src/declared-fields.ts (additively, nothing restructured), and narrowed both shrink-only source-resolution registries after adding the formula source alias.",
  "tests": "All at 01ba6e700 (git rev-parse --short HEAD), the final commit, re-run after the two post-review commits. TESTS — pnpm --filter @objectstack/example-showcase --filter @objectstack/objectql test: showcase 'Test Files 21 passed (21) / Tests 334 passed (334)' (113 of them new), objectql 'Test Files 213 passed (213) / Tests 3755 passed (3755)'. TYPECHECK — both packages, 0 'error TS', both 'Done'. GATE UNION re-derived from the actual changed paths AFTER the objectql commit (scripts/pm/dispatch-gates.mjs, post-#9188); objectql paths widened it exactly as the PM warned, adding check:durability-log-level and check-engine-split-ratio. All PASS: those two, check:test-source-alias, check:type-source-resolution, check:ratchet-remedy-authority, check:changeset-gate-self-tests, check:cross-package-test-inputs, check:docs-audit-scope, check:docs-redirects, check:objectui-changeset, check:role-word, check:nul-bytes, the four spec-liveness families (which is #9171's 'Spec property liveness' coverage for the objectql paths), the four convention-triggered families (check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:type-check-coverage), and the four changeset scripts. RATCHET — check:type-check-debt --re-measure at the final head: 'OK — 33 ledger entr(ies) re-measured in 381.1s, 1926 raw tsc error(s) total, none above its recorded number. surplus: none.' No ledger entry added or raised. ⚠️ PROCESS NOTE: my FIRST ratchet attempt was piped through `tail`, which masked its exit code — flock had hit its -w deadline and exited 99 while another agent (objectstack-issue-9111, @objectstack/metadata-protocol) held /tmp/os-heavy-verify.lock, so the gate never ran and the empty output read exactly like a clean pass. The number above is from a re-acquired run with FLOCK_EXIT=0 captured explicitly. TWO GATES WENT RED AND WERE FIXED, NOT BASELINED: check:test-source-alias and its sibling check:type-source-resolution both flagged @objectstack/example-showcase's registry entry as STALE once the formula source alias landed; both entries were narrowed to the exact list each gate printed. That is a SHRINK (the permitted direction) and check:ratchet-remedy-authority passes; ⛔ I did not 'fix' them by removing the alias, which would trade a green gate for a suite running against a stale engine build. REVERSE VERIFICATION — direction predicted RED before running. Reverted showcase_zoo_t_tags to 'record.f_tags.size() > 0' on the COMMITTED tree: 'Tests 3 failed | 331 passed (334)' with `expected 'FAULT No such key: f_tags' to be type of 'boolean'` (absent half) and `expected 'FAULT found no matching overload for null.size()' to be type of 'boolean'` (projected-null half) — one failure per guard half, plus the has()-sweep assertion. Restored via git checkout from the branch ref, confirmed byte-identical by git status --porcelain clean. CANONICAL-RULE TABLES — every cell of all three new tables in declared-fields.ts was evaluated against @objectstack/formula BEFORE being written, not transcribed; that caught a wrong generalisation I was about to commit (I would have written refinement 1 as 'guard the root and the leaf'; the `{r: {}}` column proves the correct statement is one has() per SEGMENT). NO ABLATION RAN against dist, so no rebuild claim is owed; the new test imports the engine from SOURCE by construction, which is what the two alias gates now enforce.",
  "open_questions": [
    {
      "question": "The one risk I could not close: does the RECORD HEADER evaluate action predicates on CEL, or on objectui's legacy JS evaluator? It matters because `has()` THROWS in the legacy evaluator (measured directly against SafeExpressionParser at the pinned sha: `\"has\" is not a function`), and 51 of the 53 migrated gates are record_header/record_more. If the header used that path, this PR hid them. This session had NO browser/preview tooling, so the visual half of the dogfood round could not be run — the evidence I have is static.",
      "options": [
        "A — treat the pinned-sha code read as sufficient: at .objectui-sha 665661ab, ActionEngine.getActionsForLocation passes the {dialect:'cel'} envelope INTACT to evaluateCondition which routes it to @objectstack/formula (objectui#2661/#3314), and 113 of 114 record-scoped predicates in the built artifact ARE envelopes, so the header speaks CEL and has() is safe",
        "B — hold the PR until someone with browser tooling opens a Specimen — Full Field Zoo detail page and confirms showcase_zoo_dialect_split appears in the ⋯ menu",
        "C — let CI's three Dogfood Regression Gate shards stand as the empirical control, since they boot the example apps and exercise real user flows"
      ],
      "recommendation": "C, with A as the reasoning behind it and B as the fallback if any shard reds. Real business need: the showcase is demonstration material an AI author copies, so a fixture whose buttons silently vanished would teach the fault it exists to prevent — that is a live cost, not a hypothetical. Long-term soundness: A's evidence is genuinely strong (the envelope normalization happens in defineAction at BUILD time, so the input shape is a property of the artifact rather than of a render path), but it is a code read, and this card's whole premise is that static reasoning about this face has been wrong twice — #8975 shipped a rule that measured insufficient, and PR #9166's census undercounted by 45. Making AI-written metadata hard to get wrong: the browser check in B is one page-load and decides it either way, which is why I filed it as #9281 with that exact one-step repro rather than asserting the outcome. I did NOT rewrite the file's stale-looking 'The RECORD HEADER does not speak CEL' bullet for the same reason — correcting an unverified claim with another unverified claim is the two-documents-disagree failure #8975 exists to end."
    },
    {
      "question": "#9167's fix is NOT 'add has()', and that is worth deciding before it is graded — measured while the app was up and posted there in full. Page-block predicates skip defineAction's envelope normalization (the ONE bare string among 114 in the artifact is task-detail.page.ts:51 itself), so they route to the legacy JS evaluator where has() throws; and record:alert evaluates via useCondition WITHOUT throwOnError, i.e. fail-SOFT. Applying #8990's action-face guard there would therefore turn a currently-correct banner into a permanently visible one — exactly the bug that card fears, newly created by its own fix.",
      "options": [
        "A — normalize page-block `visible` into a {dialect:'cel'} envelope at build time, the way defineAction already does, after which has() works and the action-face guard applies unchanged",
        "B — make the record:alert gate opt into throwOnError and pick a deliberate direction (objectui-side behaviour change)",
        "C — both, A first"
      ],
      "recommendation": "C, A first. Real business need: the defect is real but LATENT, not live — I measured that a record-detail read projects every declared column (59/59 keys, 0 of 53 predicates fault on that binding), so the absent-key route does not fire on the ordinary detail page; it needs a partial/deferred read. That lowers urgency but does not remove it. Long-term soundness: A is the contract-first option — one normalization, one dialect, so the guard means the same thing on every surface; B alone leaves two dialects and would make the guard's meaning depend on which slot the predicate sits in. Making AI-written metadata hard to get wrong: A is decisive here, because under B an author who correctly copies the documented has() idiom into a page block still gets a throw — the authoring rule and the runtime would disagree, which is the precise shape #8975 was filed to end. ⛔ I wrote no line for #9167 and changed nothing for it."
    }
  ],
  "out_of_scope_findings": [
    "filed as #9281: the showcase predicate matrix teaches 'The RECORD HEADER does not speak CEL' (objectui#3521), which looks stale against the pinned objectui — ActionEngine passes the {dialect:'cel'} envelope intact to @objectstack/formula at .objectui-sha 665661ab. Labelled `finding` + `domain:metadata`, unassigned, no pm:queue, because I could not confirm it in a browser and correcting unverified prose with unverified prose is not an improvement. Carries a one-step repro that decides it, and notes the branch under which THIS PR would have regressed something. Also records a second inaccuracy in the same bullet: a raw SafeExpressionParser probe shows .contains()/.size() returning undefined/false rather than THROWING, while `in` throws SyntaxError — so 'all THROW there' is wrong whichever engine that surface uses.",
    "posted as a measurement comment on #9167 (not a new card — it sits inside that finding's existing scope, so attach rather than scatter): the direction is fail-SOFT as objectui#4807 records, but the absent-key half does not fire on a record-detail page (measured: the detail read returns all 59 declared columns with nulls as present keys), and the obvious fix would CAUSE the bug — see open question 2. That changes how the card should be graded, which is why it went there rather than into this report alone."
  ]
}

Generated by Claude Code

⛔ Correction: the "34" figure this card is built on is wrong, and several documents inherited it

PR #9280 merged, closing this card. Before it goes quiet, the number has to be corrected where it was minted, because this card is the origin of a figure that other documents now cite.

The correction

figure	as published	measured
authored record-scoped action predicates ("across both repos")	34	an undercount — objectui's half is zero, and this repo's showcase alone holds far more than the census saw
this card's remainder after PR #9166	12	57

Why both were wrong, and it is the same reason

Both figures came from a grep for a visible: / disabled: key. predicate-matrix.action.ts declares 45 of its predicates as a positional argument to a helper:

const zooTypeGate = (name: string, label: string, visible: string) => defineAction({ … });
zooTypeGate('tags', 'tags — any', 'record.f_tags.size() > 0'),

A key-shaped grep is structurally blind to those. Reading predicates off the exported action objects instead gives 53 in that file where the grep saw 8 — hence 57, not 12.

⭐ The instrument was trusted because it answered. A grep that returns a plausible number reads exactly like a grep that returns the right one, and nothing in between the two figures ever disagreed — the "34" survived being quoted in this card, in PR #9166's accept, and onward, because no second measurement was ever taken by a different method.

What is now guarded

PR #9280's test asserts the count off the exported actions, not off a spelling:

expect(matrixPredicates.length).toBe(53);

with the helper-indirection named in a comment beside it. So the next sweep cannot silently miss the same 45. That is derivation-from-artifact replacing derivation-from-spelling — the same correction #9190 is dispatched to make for REFERENCE_PATHS, and the same class as #8908's hand-written list that measured two members short.

Where the stale number still lives

This card's body and the census discussion in its comments — superseded by this comment; ⛔ do not reconcile a future measurement back to 34.
PR Guard the authored action predicates for the sparse record face (#8990) #9166's accept comment (5308801131, on this thread) — its "22 of 34 migrated, 12 left" accounting was right about what PR Guard the authored action predicates for the sparse record face (#8990) #9166 did and wrong about the denominator. The migration was correct; the census behind it was not.
⚠️ Anything downstream that quotes "34 authored predicates" as a platform figure should be re-derived, not adjusted. I have not swept for such citations, and I am not asserting the list above is complete.

The pattern, recorded because it is now systemic

This is one of eight instances this shift of a derived or hand-curated list consumed as authoritative and wrong: #9171 (dispatch-gates.mjs omits gates CI runs, and separately cannot express a kind-implicated gate), #9182 (the os-regen driver drops a side at exit 0), #9192 (docs-drift listing by package dependency), the Part-of PR must not also close its card gate being blind to the Fixes direction, #9282 (docs-drift has "no opinion" on the file carrying a rule three pages restate), #9283 (a red merge-queue CI run did not block a merge), a hand-written control list of mine on #6367, and this one.

⛔ No label changed. This card is closed by PR #9280; this comment exists so the number does not outlive it.

Generated by Claude Code

docs(objectql,lint,examples): state one guard idiom for the sparse ac…

Guard the authored action predicates for the sparse record face (obje…

fix(example-showcase): guard the authored action predicates against t…

docs(showcase): the record header speaks CEL — correct the stale dial…

feat(platform-objects): declare the sys_user set_user_manager row act…

Navigation Menu

Repository navigation

34 authored action `visible`/`disabled` predicates guard only the null half, so each silently hides its button on a list row that did not project the gated column #8990

What #8975 establishes

What is still true after it lands

Why this is not a lint rule

What is owed

裁决(不可重裁)

PM 机制假设(须实测,鼓励证伪)

Route (optional)

PR #9166 is GREEN but I am holding the flip — and the reason is mine, not CI's

What the accept will credit when it comes

Also filed from this work

3 remaining items

Re-graded `pm:dispatched` → `pm:queue`. The label was lying and it was my error.

What actually remains — 12 predicates, all in `app-showcase`

The rule this card produced, now landed at its definition site

裁决 — not re-litigable

PM 机制假设 — falsifiable, measure them

⭐ While the browser is up — a measurement I want, that is NOT a fix

Route

Model tier

⛔ Correction: the "34" figure this card is built on is wrong, and several documents inherited it

The correction

Why both were wrong, and it is the same reason

What is now guarded

Where the stale number still lives

The pattern, recorded because it is now systemic

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

34 authored action visible/disabled predicates guard only the null half, so each silently hides its button on a list row that did not project the gated column #8990

Description

What #8975 establishes

What is still true after it lands

Why this is not a lint rule

What is owed

Activity

os-project-manager commented on Aug 16, 2026

os-project-manager commented on Aug 16, 2026

os-zhuang commented on Aug 16, 2026

裁决(不可重裁)

PM 机制假设(须实测,鼓励证伪)

Route (optional)

os-zhuang commented on Aug 16, 2026

os-zhuang commented on Aug 16, 2026

PR #9166 is GREEN but I am holding the flip — and the reason is mine, not CI's

What the accept will credit when it comes

Also filed from this work

os-zhuang commented on Aug 16, 2026

3 remaining items

os-zhuang commented on Aug 16, 2026

Re-graded pm:dispatched → pm:queue. The label was lying and it was my error.

What actually remains — 12 predicates, all in app-showcase

The rule this card produced, now landed at its definition site

os-zhuang commented on Aug 17, 2026

裁决 — not re-litigable

PM 机制假设 — falsifiable, measure them

⭐ While the browser is up — a measurement I want, that is NOT a fix

Route

Model tier

os-zhuang commented on Aug 17, 2026

os-zhuang commented on Aug 17, 2026

⛔ Correction: the "34" figure this card is built on is wrong, and several documents inherited it

The correction

Why both were wrong, and it is the same reason

What is now guarded

Where the stale number still lives

The pattern, recorded because it is now systemic

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

34 authored action `visible`/`disabled` predicates guard only the null half, so each silently hides its button on a list row that did not project the gated column #8990

Re-graded `pm:dispatched` → `pm:queue`. The label was lying and it was my error.

What actually remains — 12 predicates, all in `app-showcase`