docs(validating-metadata): the four-door table understates the object runtime door after #4716 — and one row bundles four rule ids across the wall

[os-elon]

Split out of the #4716 review (PR #9825) rather than ridden along with it. #9825 is a 697-line code PR; this is a docs-only edit on a page every rule-crossing PR touches, and one of its three rows needs an editorial split rather than a cell edit.

The falsification

content/docs/deployment/validating-metadata.mdx documents "the one gate, four doors": os validate / os build / os lint / the runtime publish door (saveMetaItem, since #4463). Its table's fourth column carries one superscript per metadata type a rule inspects — ✓ᵒ is object — and the page states its own authority rule in as many words:

that rule's own runtimeTypes in AUTHORING_RULES is the authority — the set has grown a type at a time (#4463 shipped P1 as flow and four rule families, #7220 moved the whole views[] visibility-predicate family across in one edit, #7529 put widget-binding integrity on dashboard, #8307 → #8310 walked the ADR-0090 security-posture block across seed, then permission and book, then object), so read the rule rather than assuming a save of some other type reaches storage unjudged.

#4716 crosses five gating rules onto the object runtime door. Measured against origin/main at 278280586, those five land in exactly three rows, all of which read — in the runtime publish column:

line	row	rules it covers	after #4716
:392	Zod-valid but functionally inert declarations — a summary with no operations (ADR-0078), a managed object advertising an API method its affordances refuse (#7521)	validateFunctionalCompleteness, validateManagedApiMethods	✓ᵒ
:411	Declared enforcement that cannot run — sharing-rule conditions (#4698), row-level-security predicates (#4983), a validation rule's regex / JSON Schema (#4762) and its format names (#5178)	validateRuleCompilability, validateRuleSchemaFormats	see below — not a cell edit
:413	Autonumber {field} interpolation	lintAutonumberFormats	✓ᵒ

Non-vacuity control for that reading: the page already uses ᵒ in two other rows (✓ᵈᵛᵒᵖᶠ on the ordering-comparands row, ✓ˢᵖᵉᵇᵒ on the security-posture row). So the — in these three is a positive claim about the object door, not an artifact of a page that never tracks object.

The row that is not a cell edit

:411 bundles four rule ids that now sit on opposite sides of the wall:

• validateRuleCompilability (A format rule with an invalid regex, and a json_schema rule ajv cannot compile, still fail OPEN — the same trap #4649 closed, one rule type over #4762) and validateRuleSchemaFormats (A MISSPELLED format name in a json_schema validation rule still enforces nothing — format: 'emial' is logged-and-dropped, at runtime AND at publish #5178) — cross onto object in [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716
• sharing-rule conditions (validate/lint have no check for "declared but never read" metadata — three instances found in one app in a day #4698) and row-level-security predicates (ADR-0056 D4 的 RLS authoring gate 从未接线:isSupportedRlsExpression 没有任何非测试消费者 #4983) — do not cross

Writing ✓ᵒ on the merged row would claim the runtime door judges an RLS predicate on an object write, which it does not. Writing — keeps the current falsehood. Under the page's own stated convention the row has to be split so each side reads truthfully.

The page already works through exactly this problem one paragraph down, for the security vocabulary freeze:

That last move is also why the vocabulary freeze is a row of its own. It was split out of the security-posture rule on the day the rest of that block crossed, because it judges collections the per-write snapshot does not carry: one rule id has to sit on ONE side of the wall, so it stayed behind whole rather than crossing for some of the collections it judges and not others.

Follow that precedent — the split here is by rule id, not by collection, but the principle the paragraph states is the governing one. Whichever way the split is drawn, say so in prose so the next crossing does not have to re-derive it.

Also in scope

• Append #4716 to the crossing-history clause quoted above, in the same shape as its siblings (what crossed, onto which type).
• Re-read the —-reasons paragraph against the new state. Its four enumerated reasons for a — should still each be true of at least one remaining — cell; the sharing-rule / RLS example it uses for "snapshot-safe and simply have not been rolled out to a type yet" survives [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 untouched, but check the others rather than assuming.

Out of scope

• content/docs/releases/v17.mdx — release-owned, read-only (AGENTS.md "Documentation Guardrails"). The drift check flagged it too. If it is wrong, that is a separate docs-only PR, never this one.
• Any change to AUTHORING_RULES itself, or to any rule's runtimeTypes. This card corrects the description; [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 / PR feat(lint): the five gating object rules cross the runtime publish gate (#4716) #9825 is the change being described. If the doc and the registry disagree after feat(lint): the five gating object rules cross the runtime publish gate (#4716) #9825 lands, the registry wins and the doc moves.

Verification the card expects

Derive the table's fourth column from the built registry, not by reading source line numbers or trusting this issue's table — the same discipline #9825 used to re-derive its premises. For each of the three rows, state the rule ids it covers and each id's runtimeTypes as the registry reports them post-#9825, and show the reading is non-vacuous (a rule you expect to be absent from the object door reads absent).

Blocked-by: #4716 — the doc can only be corrected to a state that has actually landed. Do not start until PR #9825 is MERGED, and re-derive the registry on the merged ref: what the object door contains is exactly what this card is describing, so inheriting a pre-merge reading would defeat the purpose.

[os-elon]

Claimed by the metadata / engine-core / drivers PM seat — session session_019yDEhPBC3tcGkW9bkce1HM, branch claude/issue-9836-object-door-doc-table.

Blocker discharged: #4716 closed completed at 04:05Z, by PR #9825 merged as squash 1408ae337.

The merged-ref re-derivation this card was waiting for — done, and it moved one number

Measured on origin/main @ 1408ae337, packages/lint/src/authoring-rules.ts:

The object door is exactly 7 rules, all surfaces: CLI_AND_RUNTIME:

line	rule	runtimeTypes
:472	validateFunctionalCompleteness	['object']
:500	validateManagedApiMethods	['object']
:597	validatePresetComparands	['dashboard', 'view', 'object', 'page', 'flow']
:1072	lintAutonumberFormats	['object']
:1260	validateSecurityPosture	['seed', 'permission', 'book', 'object']
:1382	validateRuleCompilability	['object']
:1408	validateRuleSchemaFormats	['object']

:597 and :1260 are the two that were already there; the other five are #4716's crossing. RUNTIME_OBJECT_ADVISORY_VOLUME = 8 occurrences (was 0 pre-merge); RUNTIME_NEEDS_FULL_SNAPSHOT = 17, unchanged — that population is #9612's, not this card's.

⚠️ A warning for whoever measures this file. My first pass counted 8 object-door rules, not 7. The extra was line :1276 — a comment that quotes a declaration:

 // are real), then declare `runtimeTypes: ['object', 'permission', 'book',

A grep for runtimeTypes.*'object' cannot tell a declaration from prose describing one. Anchor the count on ^\s+runtimeTypes: \[ (leading indentation, no comment marker) or read the built registry — and state which you did. This is the third time tonight this repo's own comments have defeated a naive probe; do not let it be the fourth.

What that means for the three rows

The re-derivation confirms this card's premise rather than changing it: all five newly-crossed rules are on the object door, so rows :392, :411 and :413 of the doc table are now understating it. Nothing in the card body needs revising.

Dispatching now.

---

Generated by Claude Code

[os-elon]

{
 "issue": 9836,
 "status": "done",
 "branch": "claude/issue-9836-object-door-doc-table",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9847",
 "premise_still_valid": true,
 "summary": "The card's premise held on re-derivation: the object runtime-publish door is 7 rules at 1408ae337 (was 2 pre-merge), so all three named rows were understating it. :392 and :413 became cell edits to the object superscript; :411 was SPLIT into two rows, drawn by which collection carries the declaration each rule reads — validateRuleCompilability (#4762) and validateRuleSchemaFormats (#5178) read validationRules[] on the object being written and crossed, while validateSharingRuleEnforceability (#4698) and validateRlsPredicateEnforceability (#4983) read sharingRules[] / permissions[] and did not, each held by a different thing per the registry's own surfaceReason. A new paragraph states the split rule in prose so the next crossing does not re-derive it, following the vocabulary-freeze precedent. #4716 appended to the crossing-history clause. ONE THING BEYOND THE CARD'S LITERAL CHECK: the --reasons paragraph's four reasons each survive (13 / 2 / 2 / 1 rules respectively), but that accounts for only 18 of the 25 remaining dash rules; the other 6 sit in a reason class #4716 CREATED. Their old constant RUNTIME_OBJECT_WRITES_P2 is retired to 0 occurrences and replaced by RUNTIME_OBJECT_ADVISORY_VOLUME, whose text says crossing one is 'never a bare runtimeTypes edit' — the exact opposite of where the paragraph's third reason would have sent a reader. Added as a fifth reason, phrased from the registry constant. No AUTHORING_RULES change, nothing under content/docs/releases/, RUNTIME_NEEDS_FULL_SNAPSHOT untouched at 17.",
 "tests": "Registry derived TWO ways, both at base 1408ae337, because the naive probe is known-wrong here. (1) BUILT REGISTRY: pnpm --filter '@objectstack/lint^...' build (EXIT=0), then pnpm --filter @objectstack/lint build (EXIT=0), then AUTHORING_RULES imported from packages/lint/dist/index.js — 41 rules total, 7 with runtimeTypes containing 'object', all surfaces=cli,runtime-publish and all tier=gating: validateFunctionalCompleteness ['object'], validateManagedApiMethods ['object'], validatePresetComparands ['dashboard','view','object','page','flow'], lintAutonumberFormats ['object'], validateSecurityPosture ['seed','permission','book','object'], validateRuleCompilability ['object'], validateRuleSchemaFormats ['object']. (2) ANCHORED SOURCE grep '^\\s+runtimeTypes: \\[' — 16 declarations, the same 7 carrying object at :472 :500 :597 :1072 :1260 :1382 :1408. The two readings agree. TRAP REPRODUCED: grep -c \"runtimeTypes.*'object'\" returns 8; the extra is :1276, a comment in the validateSecurityRoleWord block quoting a declaration it does not make. NON-VACUITY: the same query that finds those 7 reports validateSharingRuleEnforceability and validateRlsPredicateEnforceability as surfaces=cli with NO runtimeTypes — absent, as predicted — and validateSecurityRoleWord absent too, matching its existing dash. OPPOSITE-DIRECTION CONTROL: at 1408ae337^ the anchored grep finds only :567 and :1226 carrying object, i.e. the door was 2 and is now 7, exactly #4716's five. GATES: union re-derived at the FINAL commit 3c693d15c via node scripts/pm/dispatch-gates.mjs with no paths passed (it takes its own change set from the merge base) — 11 families matched, run as 12 commands, ALL PASS at 3c693d15c: check:nul-bytes (6280 files, no control bytes), check:doc-anchors (251 fragment links resolve), check:doc-authoring (377 files clean), check:docs-audit-scope (179 hand-written docs in sync; 9 release-owned pages confirmed review-only), check:docs-redirects (92 entries), check:role-word (43 baselined, no new occurrences), check:published-readme-links, check:cross-package-test-inputs, and @objectstack/spec check:empty-state / check:liveness / check:strictness-ledger / check:variant-docs. NO ABLATION was run and none applies — this is a prose/table correction with no rule or guard to mutate. NO PACKAGE TESTS AFFECTED, as the dispatch expected: the diff is one file under content/docs/, in no workspace package (content/ is in no pnpm-workspace entry; apps/docs is private). Verified nothing pins the page's content — the only code references are two route entries in apps/docs/redirects.mjs, a comment in check-doc-anchors.mjs, and generated apps/docs/.source/*. docs-drift-check.yml correctly does not trigger: its paths are packages/**, scripts/docs-audit/** and its own file. BYTE DISCIPLINE: a U+200B slipped into the identifier validateRuleCompilability while writing the new prose and was caught by a codepoint scan BEFORE commit; removed, file now scans clean and the identifier greps as one token.",
 "open_questions": [
 {
 "question": "The dispatch listed 'Changeset' as a deliverable; I shipped the skip-changeset label instead and want that confirmed rather than assumed. AGENTS.md line 940 scopes changesets to feature work and functional improvements ('Pure bug fixes do not require a changeset'); this PR ships no package at all — content/ is in no pnpm-workspace entry and apps/docs is private — and the ten most recent docs-only commits on main carry zero changesets. The skip-changeset label exists in this repo with the description 'PR has no user-facing published change; bypasses the changeset gate', which is this case verbatim.",
 "options": [
 "A — keep skip-changeset (applied): matches AGENTS.md, the label's own description, and 10/10 recent docs-only commits. Labels read back as ['size/s','skip-changeset'], so the union write did not erase the auto-labeler.",
 "B — add a changeset anyway to honour the dispatch word: would attribute a version bump and a CHANGELOG line to some package that did not change, since no package did."
 ],
 "recommendation": "A. B manufactures a phantom release entry for a page-text correction, and there is no honest package to attribute it to. Flagging only because the dispatch and the standing contract disagreed here and the contract says to name the conflict rather than quietly pick a side."
 }
 ],
 "out_of_scope_findings": []
}

Two notes the JSON does not carry well

The hard-fenced v17.mdx, with a detail the fence may not have. I did not read into or touch it. But a corpus grep for runtimeTypes across content/docs/ returns exactly one hit outside the page I edited: content/docs/releases/v17.mdx:3103 — the #7891 flip — `runtimeTypes` gains `object`, and ADR-0094 R2's. Note the issue number: #7891, not #4716. I have not assessed whether that line is wrong, and deliberately did not, since the card reserved this page and said any fix is a separate docs-only PR. Recording the exact line and the number mismatch so whoever takes it to the maintainer does not have to re-find it. No issue filed — the card already names this fence as yours.

Signature footer duplicated on the PR body. The platform appended a second _Generated by [Claude Code](…session_…)_ line under the one I wrote. Cosmetic; both are the session-URL form, so both survive edits. Left alone rather than re-PUT the body for it.

Generated by Claude Code

---

Generated by Claude Code