spec: hold a predicate to what the engine can run; declare its fault semantics (ADR-0136)

.changeset/17778-field-rule-predicate-fault-semantics.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": patch
+---
+
+**ADR-0137 makes field-rule predicate fault semantics part of the contract** (#17778): what SUBMIT and RENDER do when a predicate cannot run.
+
+Clause-②: no
+
+**The predicate fault-semantics contract is recorded, not enforced, by this release.** ADR-0137 states what a field-rule predicate does when it cannot RUN: at SUBMIT a faulting predicate refuses the write and names the field and the rule (D2); at RENDER visibility stays fail-OPEN, so a rule that could not run never hides a control and lets the form write `null` over a column the user never saw (D3); a blank or faulting GATE predicate is diagnosed, never a silent `true` (D4); and the evaluation helper's fallback stays freely specifiable (D5), because fault-to-flag and fault-to-throw both exist only because it is a parameter. Those are consequences CONSUMERS deliver — `packages/spec` carries no business logic — and they land in the ObjectUI half. D1's authoring refusal (an `ast`-only envelope and a blank `source` are refused at authoring) is ruled by decision batch #122 item 2 and ships with the evaluated-slot narrowing that owns it, under that change's own ADR-0087 entry.
+
+**ADR-0089 gains an addendum, not a reopening.** It unified the `visibleWhen` / `visibleOn` / `visibility` family under one name; ADR-0137 owns what that family does when a predicate cannot run, and ADR-0089 itself is unchanged by this release.
+
+**Not carried by this entry: the `cel` / `expression` return-type narrowing to `EvaluatedExpression`.** This card touched that signature too, but main shipped the identical narrowing first, under #18638 (card #15811) — see that release's own changeset for the `EvaluatedExpression` story and the TS2322 it fixes. Restating it here would announce, a second time, a fact this release has already shipped under a different entry.

docs/adr/0089-unify-visibility-predicate-naming.md

@@ -8,6 +8,16 @@
 
 ---
 
+> **Addendum (2026-09-18, #17778) — what the `*When` family does when it cannot RUN is decided by [ADR-0137](./0137-predicate-fault-semantics-are-contract.md), not here.**
+> This record unified the family under one NAME and is unchanged by that one. ADR-0137 D1 holds a
+> predicate slot to what the engine can actually run — an `ast`-only envelope and a `source` blank
+> after trimming are refused at authoring, which is the field-rule row of the rule decision batch
+> #122 item 2 gave across every evaluated slot; D2 refuses the SUBMIT loudly on a fault, naming the
+> field and the rule; D3 keeps visibility fail-OPEN at RENDER. A reader who arrived here asking what
+> a broken `visibleWhen` does should read that record.
+
+---
+
 ## TL;DR
 
 One concept — *"show this only when the CEL predicate is TRUE"* — is spelled three