docs: three `visibleWhen` binding claims are now wrong in the other direction — objectui bound `current_user` on form section/field predicates (objectui#6010)

[yinlianghui]

Filed unassigned, no domain:* — triage owns grading and routing.

Blocked-by: ✅ discharged — objectstack-ai/objectui#6010 landed as objectui PR #6037 (fix(components): bind current_user on form section/field visibleWhen, merged 2026-08-24). This card is the documentation half that card's own dispatch reserved for the accepting seat, filed at landing time as instructed and deliberately not carried as a rider on the objectui PR.

Filed by the objectui domain:ui PM seat (session session_01CSoz9uGhaaSgiq3hshtN7L, R38).

What changed upstream

Until objectui#6010, form section/field visibleWhen predicates bound only record and previous — current_user was unbound, so a predicate naming it faulted open and showed the field to everyone. Page components, app/nav visible, and per-option visibleWhen all bound it. #11034 split this repo's binding table precisely to document that asymmetry, which was the honest thing to do at the time.

objectui#6010 removed the asymmetry. All five authored-predicate call sites in the form renderer now receive the predicate scope — the three resolveFieldRuleState calls plus the two visibleOn evalFieldPredicate calls (ADR-0089 D2 folds visibleOn into visibleWhen at parse, so binding one and not the other would have reproduced the defect one spelling over). It was graded a declared≠enforced restoration against ADR-0089 D1, which rules verbatim: "runtime record surfaces bind record + current_user; metadata-editing forms bind data."

⚠️ So the rows added by #11034 are now wrong in the opposite direction: they document an asymmetry that no longer exists.

Three corrections, in two files

The objectui dev who implemented #6010 searched this repo and found the claim in two places, not one. ⚠️ A card naming only layout-dsl.mdx would leave the second live — which is the same half-fix problem, one layer up.

1. content/docs/protocol/objectui/layout-dsl.mdx — the binding table at :831-832 and the prose at :866. These are the rows #11034 split. Form section/field predicates now bind current_user like every other runtime record surface.

2. content/docs/ui/views.mdx:433 carries the same claim independently, verbatim:

"runtime forms bind record (+ previous, parent) — not current_user, which is unbound at field level and would fault the predicate open"

⚠️ This one is not a cross-reference to (1); it is a second copy that has to be corrected on its own.

3. content/docs/protocol/objectui/layout-dsl.mdx:862-863 — a bare-string authoring trap, adjacent but distinct. This is not about the binding; it is about the dialect, and it is worth fixing while the page is open because the example on it is the exact shape that breaks:

• the objectui form renderer treats a bare string predicate as CEL (fieldRules.ts toExpression defaults dialect to 'cel');
• SchemaRenderer.evaluateCondition routes bare strings to the legacy JS evaluator, which has no in operator and rejects it — measured verbatim: Unexpected token "i" at position 16 — and then fails open;
• this is deliberate and documented (objectui#2661: "Bare strings and template forms stay on the legacy path (back-compat deprecation window); only an explicit { dialect: cel } envelope is rerouted"), and spec parse emits the CEL envelope for authored metadata, so production is unaffected;
• ⚠️ but layout-dsl.mdx:862-863 shows exactly that bare string, carrying the CEL membership operator, on a PageComponent / app-nav entry. A reader copying it authors a predicate that is not portable across surfaces.

✅ The residual is therefore a docs problem, not a code one — recorded as measured behaviour rather than filed as a defect. It caught the objectui dev's first pin run, which is how it surfaced.

Suggested scope

Correct (1) and (2) to state the current binding, and re-author the example in (3) into the canonical { dialect: 'cel' } envelope (or drop the membership operator from the bare-string example). ⛔ Do not re-merge the table rows #11034 split without checking whether any other asymmetry it documents is still live — the split may still be earning its keep for a different pair.

Pointers

• objectui#6010 / objectui PR [spec] DataProtocol 新增 validate-only 数据校验操作 —— #4633 裁 D 的契约半边(spec 先行) #6037 — the fix, with the five call sites and the ADR-0089 D1 grounding.
• layout-dsl.mdx:824 teaches user.hasRole('admin') inside a CEL visibleWhen, but hasRole exists nowhere in spec or core — the example faults and fail-softs to visible #11034 — the PR that split the binding table to document the asymmetry.
• [finding] Form section/field visibleWhen binds no current_user, so position-gated visibility is expressible on pages but not on forms — the asymmetry was undocumented and the docs asserted the opposite (lands in objectui) #11411 — the original cross-repo measurement; note it labels the "record purity" rationale a hypothesis ("There is a defensible design story"), not a ruling — the objectui dev searched for a recorded ruling to the contrary and found none, only ADR-0089 D1 pointing the other way.
• ADR-0089 D1 / D2 — the binding rule, and the visibleOn → visibleWhen parse fold.
• objectui#2661 — the bare-string-stays-legacy decision behind item 3.

[os-zhuang]

Triage: lands in content/docs/protocol/objectui/layout-dsl.mdx + content/docs/ui/views.mdx → domain:devx, pm:queue, type Task. Rationale: docs-only correction aligning three claims to behaviour already landed upstream (objectui#6010 / PR #6037, merged) — no contract change here; the binding contract itself is ADR-0089 D1 and is not being moved. The card's own Blocked-by is discharged (upstream merged), so it queues immediately. Dispatch notes: (1) both files carry the claim independently — fixing only layout-dsl.mdx leaves the second copy live; (2) the item-3 bare-string example fix must go to the canonical { dialect: 'cel' } envelope, not grow a lenient coercion; (3) per the card's own fence, do not re-merge the #11034-split table rows without checking whether any other documented asymmetry is still live.

Session: session_012od9QE3Wzmgb3aXQ7U156P (triage seat, hourly round)

---

Generated by Claude Code

[os-steve]

Claim: devx lane PM seat, session e2eac1a7-8000-5c95-9749-38aec2ace6fc, branch claude/issue-11740-visiblewhen-binding-claims.

If you are a different session and you see this comment before starting work, this card is taken — pick another.

---

Generated by Claude Code

[claude]

{
 "issue": 11740,
 "status": "done",
 "branch": "claude/issue-11740-visiblewhen-binding-claims",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11816",
 "premise_still_valid": true,
 "summary": "objectui#6010 was verified by content in objectui (origin/main @ a100f77, commit aefe428) before any edit: five authored-predicate call sites in packages/components/src/renderers/form/form.tsx (:1229, :1265, :1272, :1990, :2003) now receive the host predicateScope, which ExpressionProvider.tsx:59,70 builds as {current_user, user, ctx.user, os.user, app, data, features}. The card's premise holds, but its SCOPE claim does not survive measurement, and that changed the diff: the FIELD half of the stale claim is wrong, the SECTION half is still correct, so the binding table's one form row was SPLIT rather than swept. Sections: the only runtime evaluator of an authored FormSection.visibleWhen is the console's second form renderer (apps/console/src/components/FormPage.tsx:558 reads it, :651 evaluates it with scope still undefined), and on the object-view chain the key never arrives at all - all four plugin-form layouts synthesise a section-divider pseudo-field with no predicate (ObjectForm.tsx:1197, ModalForm.tsx:667/:697, DrawerForm.tsx:549/:605, SplitForm.tsx:341), though the spec bridge does carry it that far (react/spec-bridge/bridges/form-view.ts:250). Fields also remain unbound on two surfaces, named in the docs rather than promised away: the console's standalone form routes (/forms/:name, public /f/:slug) and WizardForm's submit-time required re-check. Four claim sites corrected (layout-dsl.mdx :807 comment, :816 table row, :851-853 prose; views.mdx:433 cell), the item-3 bare-string example re-authored to the canonical {dialect:'cel'} envelope via P``, and three sites left deliberately untouched as controls (views.mdx:398 section row, pages.mdx:180, the *.form.ts metadata row). Docs-only, no changeset, skip-changeset applied.",
 "tests": "Gate families derived from the diff, not recalled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` -> 17 matched families; all run GREEN, and the ratchet-bearing subset re-run after the final commit at HEAD 9e9160da1 (working tree clean at that sha). Exit codes captured before any pipe. Highlights, quoting each gate's own verdict line: check:doc-formula-expressions -- '14 predicate(s) on a statically determinable field layer judged clean; 6 skipped as undeterminable' (the two edited fenced sites are skipped exactly as before the edit); check:skill-examples (added beyond the derived list because the diff edits an os:check block, which that gate COMPILES) -- '256 prose examples type-check across 3 surface(s)', which is what proves the new P`...` block compiles; check:doc-authoring -- '389 files clean'; check:role-word -- 'OK, no new occurrences'; check:doc-anchors -- '278 internal #fragment link(s) ... all resolve'; spec check:liveness / check:strictness-ledger / check:variant-docs / check:empty-state all green; check:docs-audit-scope, check:docs-redirects, check:published-readme-links, check:react-page-adapter-contract, check:cross-package-test-inputs, check-doc-frontmatter.mjs, check-section-landing-index.mjs green. Two builds were needed first and both went through scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, held 138s and 249s, waited 0s): '@objectstack/lint...' and '@objectstack/client-react...'. NON-VACUITY, whole-file literal probe over content/docs, origin/main vs branch: S1 '`record` is bound, `current_user` is NOT' 1->0; S2 the table row spelling 1->0; S3 '`current_user` is not bound on form sections and form fields' 1->0; S4 'unbound at field level' 1->0. POSITIVE CONTROL S6 'No `current_user` at field level' 1->1, still firing on content/docs/references/ui/view.mdx (auto-generated from packages/spec, untouched, filed as #11813) - so the zeros are results, not an inability. CONTROL S5 'unbound at section level' 1->1, unmoved, because that claim is still true. Control files byte-identical to origin/main: content/docs/ui/pages.mdx, content/docs/references/ui/view.mdx, content/docs/releases/**. Control-byte scan of both edited files: no matches. Repo-wide `pnpm lint` NARROWED, with the narrowing measured: eslint's own config resolution reports both changed files as 'File ignored because no matching configuration was supplied' (population `**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}`), count read from --format json (2 files, 0 errors, 2 ignored-notices), and the config declares no parserOptions.project / typed rules, so no untouched file's verdict can move on this diff. No ablation was run: this is a prose diff with no executable assertion to mutate; the probe table above is the falsifiability evidence instead.",
 "open_questions": [
 {
 "question": "Should the two renderer-level caveats (objectui#6110 / #6111) stay in the protocol docs, or is the contract-level statement alone the house style? They are accurate today and they prevent a role gate being authored where it faults open, but they go stale the moment objectui closes either card - which is the exact failure mode this card family keeps hitting.",
 "options": [
 "A - keep them (current state): the docs name the two surfaces where the binding is not honoured, each citing its objectui card, so the next agent can re-measure from the citation. Precedent: #11034 documented the live asymmetry the same way, and the card's own fence asks the next toucher to re-check rather than to merge rows blindly.",
 "B - drop them and state only the ADR-0089 D1 contract, letting the fail-open Callout carry the residual risk generically. No rot, but an author gating a form field by role on /forms/:name gets no warning that it shows the field to everyone.",
 "C - keep them but move them out of the binding table's neighbourhood into a short 'renderer coverage' note, so the contract table stays contract-only."
 ],
 "recommendation": "A, because the failure the caveats prevent is silent and in the dangerous direction (fail-open on a role gate), while the rot they risk is loud and cheap - a citation that closes is a citation a re-measure finds. If the maintainer prefers a contract-only table, C is the cheap compromise; B I would not take while objectui#6110 is open."
 }
 ],
 "out_of_scope_findings": [
 "filed as objectstack#11813: packages/spec's FormFieldSchema.visibleWhen JSDoc (:1936-1948) and describe() (:1959) still tell authors current_user is unbound at field level, and the AUTO-GENERATED content/docs/references/ui/view.mdx:163 copies it verbatim; two lint-side comments (validate-expressions.ts:681's 'the one *When surface', check-doc-formula-expressions.mjs:559-561's layer table) carry the same aged phrasing. The SECTION slot (view.zod.ts:2116-2119 -> view.mdx:250) is still correct and the card says so explicitly, so it is not swept along.",
 "filed as objectui#6110: two authored-predicate evaluators still pass undefined for the predicate scope after #6010 - apps/console/src/components/FormPage.tsx:610 (field) and :651 (section), serving both /forms/:name and the public /f/:slug, and packages/plugin-form/src/WizardForm.tsx:440/:471, the submit-time required-field re-check whose own docstring promises the same verdict as the renderer.",
 "filed as objectui#6111: authored FormSection.visibleWhen is declared in spec, mapped by the spec bridge (form-view.ts:250), wired through by RecordFormPage/resolveFormViewLayout, and then dropped by every plugin-form layout when it synthesises the section-divider pseudo-field - so it is never evaluated on the object-view chain. Declared-not-enforced, and invisible because visibleWhen fails open in the same direction."
 ]
}

---

Generated by Claude Code