Filed unassigned by the dev seat implementing #12914, whose dispatch fenced the file surface to exactly four spec/lint sites plus their pins, the regenerated reference docs and one changeset. Every site below was found while re-measuring those four; none of them is inside that fence, and none was touched. Recording only.
Blocked-by: #12914 — these are downstream of that card's contract text. Fixing any of them before it lands would make the consumer disagree with the shipped prose in the other direction, which is the same defect facing the other way.
Measured on origin/main @ 9e8adf3f6 with objectui at the pin this repo now builds against, 9602dc820450.
1. packages/metadata-core/src/form-predicate-root-policy.ts — a live detector, and the highest-stakes of the three
BOUND_FORM_VIEW_PREDICATE_ROOTS is ['record', 'previous', 'parent', 'data'], and its docblock says why in as many words:
current_user is absent here and that is CORRECT for a section: the section docblock states it is unbound at that level and the predicate faults open.
That vocabulary is derived from the very sentence #12914 replaces. Once the section binds the root, a legacy artifact carrying a legitimate section-level current_user predicate gets flagged by this detector as an unbound root that will fault open — a boot notice about a predicate that now resolves. The module's own doc names that failure and forbids it: "A notice that fires on a healthy, current, correctly-authored artifact is worse than no notice, because the next one is ignored."
⚠️This module has already paid for this exact mistake once, on the other half. Its BOUND_FORM_FIELD_PREDICATE_ROOTS docblock records that the first version quoted the contract prose faithfully, the prose was stale, and it needed a same-day correction after #12930 re-measured the FIELD sites. The section half is now in the identical position, one card later.
What makes it more than a one-line edit, and why the dev seat did not take it under the bounded in-place exemption:
- the module's architecture is the per-surface split (
FIELD_ONLY_BOUND_PREDICATE_ROOTS, the surface discriminator on UnboundFormPredicateRoot, the boundRoots parameter defaulting to the stricter section list). If section gains the current_user family the split becomes empty, the constant is misnamed, the default-is-stricter argument evaporates, and the "per-surface vocabulary is load-bearing" doc inverts. That is a design decision on a detector nobody dispatched this seat for. form-predicate-root-policy.test.ts pins the section list and quotes the retired sentence verbatim in a comment (the shared base — and therefore the SECTION vocabulary — is record / previous / parent / data). The comment goes stale silently; no gate reads comments.- it sits in a package outside the dispatched surface, so it drags in a test suite the dispatch did not scope.
Blast radius is bounded and worth stating plainly: this is a notice, not a refusal — no parse change, no gate, no behaviour change, and it only runs inside the versioned window applyArtifactForwardConversions opens. The cost is a false operator signal on legacy artifacts, not a broken runtime.
2. Two hand-written docs still teach the retired section claim
#11740 swept the hand-written docs for the FIELD half of objectui#6010 and is closed. The SECTION half was correct then and is not now:
content/docs/ui/views.mdx:431 lists the surfaces that "still evaluate it unbound, where the predicate faults open" and names "section-level predicates (objectui#6111)" as one of them — citing the very PR that bound it.content/docs/protocol/objectui/layout-dsl.mdx:808, :818, :824 — a comment reading "on a FormSection, current_user is not", a table row spelling the section vocabulary as "record + previous — notcurrent_user", and the prose under it.
3. packages/lint/scripts/check-doc-formula-expressions.mjs:2018 — the gate epilogue
The failure text a docs-corpus author reads carries the pre-#12914 causal claim:
A field-level visibleWhen that faults is fail-OPEN — the renderer falls back to VISIBLE — so a wrong example does not merely not work, it shows the thing it was written to hide to everyone who copies it.
Same staleness as #12914's site 4, in a different file: under a scope-publishing host the predicate resolves rather than faulting, and the wrong example ships a silent enforcement gap instead of a visible fail-open. Editing it also owes that script's own test suite, which is why it was left rather than swept.
Suggested shape
Section 1 is a real card on its own — it needs a decision about whether the per-surface split survives at all, and it deserves the same re-measurement treatment the field half got. Sections 2 and 3 are prose trims of the same retired claim and can ride together. Splitting at triage is expected; they are filed as one card because they are one family and were found in one pass.
Generated by Claude Code
Filed unassigned by the dev seat implementing #12914, whose dispatch fenced the file surface to exactly four spec/lint sites plus their pins, the regenerated reference docs and one changeset. Every site below was found while re-measuring those four; none of them is inside that fence, and none was touched. Recording only.
Blocked-by: #12914— these are downstream of that card's contract text. Fixing any of them before it lands would make the consumer disagree with the shipped prose in the other direction, which is the same defect facing the other way.Measured on
origin/main@9e8adf3f6with objectui at the pin this repo now builds against,9602dc820450.1.
packages/metadata-core/src/form-predicate-root-policy.ts— a live detector, and the highest-stakes of the threeBOUND_FORM_VIEW_PREDICATE_ROOTSis['record', 'previous', 'parent', 'data'], and its docblock says why in as many words:That vocabulary is derived from the very sentence #12914 replaces. Once the section binds the root, a legacy artifact carrying a legitimate section-level
current_userpredicate gets flagged by this detector as an unbound root that will fault open — a boot notice about a predicate that now resolves. The module's own doc names that failure and forbids it: "A notice that fires on a healthy, current, correctly-authored artifact is worse than no notice, because the next one is ignored."BOUND_FORM_FIELD_PREDICATE_ROOTSdocblock records that the first version quoted the contract prose faithfully, the prose was stale, and it needed a same-day correction after #12930 re-measured the FIELD sites. The section half is now in the identical position, one card later.What makes it more than a one-line edit, and why the dev seat did not take it under the bounded in-place exemption:
FIELD_ONLY_BOUND_PREDICATE_ROOTS, thesurfacediscriminator onUnboundFormPredicateRoot, theboundRootsparameter defaulting to the stricter section list). If section gains thecurrent_userfamily the split becomes empty, the constant is misnamed, the default-is-stricter argument evaporates, and the "per-surface vocabulary is load-bearing" doc inverts. That is a design decision on a detector nobody dispatched this seat for.form-predicate-root-policy.test.tspins the section list and quotes the retired sentence verbatim in a comment (the shared base — and therefore the SECTION vocabulary — is record / previous / parent / data). The comment goes stale silently; no gate reads comments.Blast radius is bounded and worth stating plainly: this is a notice, not a refusal — no parse change, no gate, no behaviour change, and it only runs inside the versioned window
applyArtifactForwardConversionsopens. The cost is a false operator signal on legacy artifacts, not a broken runtime.2. Two hand-written docs still teach the retired section claim
#11740 swept the hand-written docs for the FIELD half of objectui#6010 and is closed. The SECTION half was correct then and is not now:
content/docs/ui/views.mdx:431lists the surfaces that "still evaluate it unbound, where the predicate faults open" and names "section-level predicates (objectui#6111)" as one of them — citing the very PR that bound it.content/docs/protocol/objectui/layout-dsl.mdx:808,:818,:824— a comment reading "on a FormSection,current_useris not", a table row spelling the section vocabulary as "record+previous— notcurrent_user", and the prose under it.3.
packages/lint/scripts/check-doc-formula-expressions.mjs:2018— the gate epilogueThe failure text a docs-corpus author reads carries the pre-#12914 causal claim:
Same staleness as #12914's site 4, in a different file: under a scope-publishing host the predicate resolves rather than faulting, and the wrong example ships a silent enforcement gap instead of a visible fail-open. Editing it also owes that script's own test suite, which is why it was left rather than swept.
Suggested shape
Section 1 is a real card on its own — it needs a decision about whether the per-surface split survives at all, and it deserves the same re-measurement treatment the field half got. Sections 2 and 3 are prose trims of the same retired claim and can ride together. Splitting at triage is expected; they are filed as one card because they are one family and were found in one pass.
Generated by Claude Code