[finding] The `record.*` (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an `error`-level one until the traversable path set is a closed oracle

[os-project-manager]

Restart-when: #4001 strictness cadence reaches the record.* predicate layer, or the ObjectQL traversable path set becomes enumerable (a closed oracle), or a measured record. fail-open incident

Recorded from #7010 / PR #7214's implementation report (devx PM seat filing; unassigned, ungraded — grading is triage's call). That PR gates the data.* (metadata-form) predicate layer at error; this card records why the record.* layer was deliberately left out, and what the sound follow-up looks like.

The gap

A record.<typo> in a view form's predicate fails open at runtime exactly like the data. case #7010 closed — silently, the #5149 family's shape. Nothing gates it at authoring time.

Why #7214 did not gate it (measured reasoning, not omission)

getMetadataTypeSchema is a closed oracle: the key set is enumerable, so "this path does not resolve" is a fact. An ObjectQL object's addressable path set is open: lookup traversal (record.account.name), system columns the authored fields map never lists, formula/rollup outputs. An error-level gate over an open set manufactures false build errors; a warning-level one produces noise authors learn to ignore — which is silence with extra steps.

The three dispositions (from the report, recommendation A-then-C)

• A — leave ungated (the shipped state after feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214).
• B — gate at warning, accepting noise on legitimate traversal.
• C — close the oracle first (declare the traversable path set as a contract), then gate at error. The report's argument: a closed, enumerable path set is also what makes AI-generated metadata refusable at authoring time — C structurally prevents the mistake while B only reports it.

C is a contract decision, not an implementation detail — which is why it is a card and not a rider on #7214.

Refs: #7010, PR #7214, #5149 (fail-open family), #6254 (the data. precedent), #6936.

---

Generated by Claude Code

[os-zhuang]

Findings disposition — held; deliberately left unrouted. No ownership taken.

• Grade basis: the card records a measured design boundary, not a defect — the record.* layer fails open (the Conditional-visibility predicates (visibleWhen / visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 family shape), but the sound fix (disposition C: close the traversable path set as a contract, then gate at error) is a contract decision, and B is measured to be noise-with-extra-steps.
• Unrouted by design: the face genuinely spans domain:engine-core (the ObjectQL path oracle C would close) and domain:spec-tooling (the gate that would consume it). Routing before the A-vs-C fork resolves would be a guess; named in this round's close-out brief per the two-domain rule.
• Not escalated: same family as decision-box entry objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 — C's contract question should ride that ruling rather than open a second slot.
• Restart conditions: ① objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 ruled; ② anyone measures a real authored record.* predicate failing open in production metadata; ③ the oracle-closing contract work is proposed anywhere (this card is its first consumer).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings triage — route repair only: domain:spec appended. The finding grade is unchanged and no ownership is taken.

• Routing rationale: the card's own disposition analysis (recommendation A-then-C) puts the load-bearing half in the contract — disposition C is "declare the traversable path set as a contract", which lands in packages/spec and changes what authored metadata is refusable ⇒ acceptance face ⇒ domain:spec, contract-first. The eventual lint gate (the packages/lint half, precedent visibility-predicate-syntax calls an over-budget predicate "not valid CEL" and prescribes the dialect — the #7073 defect at the visibility gate #7217 ⇒ spec-tooling) is downstream of that declaration and would ride its own card once the contract exists.
• Premise check @ origin/main 1da1f32: the data.* gate feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 landed is live in packages/lint/src/validate-visibility-predicates.ts (27 record-path references), and no record.* path-resolution gate exists — the gap is as recorded.
• Escalation deliberately NOT filed today: the card itself says C is a contract decision, but it is design-appetite-shaped with no user-visible victim (fail-open parity with the pre-feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 state of the data. layer, which did get fixed only after Publish-time validation of predicate path references — a spec-delivered predicate naming a nonexistent path should fail at authoring, not evaluate to a guess at render (#6936 companion) #7010 demonstrated the class). Restart: promote to needs-user-decision when a measured record.<typo> fail-open victim shows up, or when the objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 family forces the oracle question anyway.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings triage (re-verify @ origin/main c6a4eeb): HOLD — validate-predicate-path-refs.ts still deliberately excludes the record.* layer (module note :59, :567), so the recorded gap and the A-then-C recommendation stand unchanged. Exit for disposition C is a contract ruling (close the traversable-path oracle) — decision box when taken up, not dispatchable as-is. finding stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings triage (re-verify @ origin/main afdc6ea): HOLD — validate-predicate-path-refs.ts still excludes the record.* layer by design: the module note at :59 ("Not closed today, and not closable by this rule") and the skip rationale at :567 ("see the module note for why the record.* layer is out") are both verbatim. The recorded gap and the A-then-C recommendation are unchanged, and disposition C still exits through a contract ruling (closing the traversable-path oracle), not through dispatch. finding stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.

Ruling: deliberate defer — this enters the spec seat's strictness-ledger cadence rather than being ruled ad hoc. The ungated record.* root is intentional and loudly annotated; nothing burns today. finding stays; the strictness cadence is the exit.

Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — the card itself proves a sound error-level gate needs a closed path oracle the record.* layer does not have; gating on an open set would refuse legitimate paths. Restart: when the addressable path set becomes enumerable (lookup traversal + system columns + formula outputs), or a measured author incident on this layer.

---

Generated by Claude Code

[hotlong]

Finding-grading round: hold stands (maintainer ruled 2026-08-11, comment 5248480685: deliberate defer into the spec seat's strictness-ledger cadence — the cadence is the exit). Recording a round-efficiency note: this card is exempt from per-round re-verification — the last four passes returned identical results against an unchanged file. Re-open triggers only: #4001's strictness cadence reaching this layer, the ObjectQL traversable path set becoming enumerable, or a measured record.<typo> fail-open incident.

---

Generated by Claude Code

[hotlong]

State-machine migration, maintainer-authorized (2026-08-13, live triage session: 「我授权你先迁标签」; semantics on #8449): graded hold under the 2026-08-11 maintainer ruling (deliberate defer, strictness-cadence exit) — finding → pm:on-hold. The re-verification exemption and re-open triggers recorded 08-12 stand unchanged.

---

Generated by Claude Code