fix(formula): unknown-function refusal names the function and points at the callable set

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13821

An unknown-function refusal is graded type by the engine's own check(), so it fell through
bracesHint (null, no brace) and out to the generic dialect trailer. The author was told
"predicates are bare CEL (e.g. record.rating >= 4)" about a source that already is bare CEL and
parses fine — advice that cannot succeed. This is the second leg of the repair #7073 / PR #7209
made for the bounds class, for the reason boundsHint's own doc-comment gives: an author who
obeys the last sentence they were given, an LLM author above all, rewrites the dialect, learns
nothing, and comes back with the same unresolvable name.

What changed

validate.ts routes the type class to its own prescription, one class per arm, alongside the
existing bounds arm. The new hint names the function that did not resolve and points at the
callable set introspectScope publishes:

invalid CEL predicate: found no matching overload for 'dyn.nosuchmethod(string)'
> 1 | record.x.nosuchmethod('a')
^ — `nosuchmethod` is not a callable name here — a NAME fault, not a dialect mistake, so
re-spelling the expression will not fix it. The callable names this platform advertises for
authoring are the `functions` list `introspectScope` returns (`CEL_STDLIB_FUNCTIONS`) — pick one of
those, or precompute the value in a stored field and reference that field instead.

The front half is untouched: it is cel-js's own vocabulary and matches the runtime fault exactly.
Only the trailer after the dash is new.

Message only. The refusal fires on exactly the same inputs as before — no rule id, no severity,
no match set, no gate behaviour. CEL_STDLIB_FUNCTIONS is neither reshaped nor renamed; it is
pointed at. The message states no member count, deliberately: what the catalog contains is
being adjudicated on #13933, and a sentence asserting a size would be falsified by that ruling
without failing any test here. A pin asserts the absence of a count.

did-you-mean ships WITH a threshold, and the threshold is the whole point

Against this catalog the shared nearestName budget is measurably unsafe:
nearestName('can', CEL_STDLIB_FUNCTIONS) answers 'min' — two edits on a three-character name,
a jump from a permission verb to a numeric function. That is worse than silence: an author who
takes it writes min(object, verb) and is further from working than before it asked.

This class therefore narrows locally to at most one edit per three characters of the longer
name, so at least two thirds of a suggestion must already be typed. The shared nearestName budget
is untouched, so field-name suggestions are unaffected. Both measured cases are pinned, in both
directions:

input	before	after
isBlnk(record.name)	dialect trailer	names isBlnk, suggests `isBlank`
current_user.can(object, verb)	dialect trailer	names can, no suggestion

A third pin asserts nearestName('can', ...) still answers 'min' — if that ever stops being
true, the local threshold is no longer what protects the message and the silence pin has quietly
become vacuous.

What deliberately keeps the old trailer

cel-js emits one message shape for two different faults, so the arm is gated on the name being
absent from the advertised catalog. Faults that name no unresolvable call fall through untouched,
each with a pin:

• an operator or ternary type mismatch (1 + 'a') — there is no name to hand back;
• a real function given arguments no overload accepts (upper(1, 2) produces the identical
  found no matching overload for 'upper(int, int)' shape) — calling upper "not a callable name"
  would replace a useless sentence with a false one.

Tests

packages/formula/src/validate.test.ts gains 13 pins asserting the specific prescription text,
not merely that an error fires (an error already fired before this change). They mirror the bounds
suite's structure, including its flipped controls.

Ablation on the committed tree, reverting only the routing block: 7 type-class assertions go
red while the bounds control ("leaves the bounds prescription untouched") stays green — that
contrast is what proves a new class was routed rather than the shared tail replaced for everyone.
The mutation was confirmed on disk by blob hash before the run, and the restore proven after it by
an empty git diff HEAD plus a blob hash equal to HEAD's.

Union re-run at dabda374, after the final commit:

• pnpm --filter @objectstack/formula test — 26 files, 679 tests, all pass. Includes the drift
  tests cel-stdlib-drift.test.ts and skill-catalog-sync.test.ts, confirmed by name in a verbose
  run; both read CEL_STDLIB_FUNCTIONS, which this PR does not modify.
• pnpm --filter @objectstack/formula typecheck — clean. --listFiles confirms it reads
  validate.ts. It does not read validate.test.ts (this package's tsconfig excludes
  **/*.test.ts), so the test file was type-checked separately through a throwaway
  tests-inclusive config: 0 errors in validate.test.ts.
• Gate family derived from the actual diff via dispatch-gates.mjs --repo objectstack-ai/objectstack:
  33 commands, 30 pass, 0 red, 3 NOT MEASURED. The three are check-test-completeness,
  check:dual-build-cjs-loads and check:type-check-debt, each exiting 3 and each printing its own
  prerequisite banner (a full-repo build, or a saved turbo log). Exit codes captured by redirect
  before any pipe.
• pnpm check:nul-bytes clean, plus a control-byte self-scan over the three changed files.
• Downstream consumers that forward this message: validate-expressions.test.ts and
  validate-null-guards.test.ts in packages/lint pass (256 tests).
  validate-visibility-predicates.test.ts is NOT MEASURED — it fails to load on an unbuilt
  @objectstack/sdui-parser, an import chain unrelated to this diff.

Repo-wide pnpm lint is left to CI. The local run is a declared narrowing: eslint linted all
three changed files (count read from --format json, not assumed) with 0 errors and 0 warnings, and
--print-config shows parserOptions.project is null — type-aware linting is not enabled, so this
diff cannot move the verdict on any file it does not touch.

A repo-wide grep confirms nothing outside packages/formula asserts the trailer this PR changes.

Out of scope, filed separately

#14203 — the same family's remaining arm: a bare-callable stdlib function invoked as a receiver
method (record.name.upper()) still gets the dialect trailer. The name is advertised, so this PR's
arm stays silent on it by design; the mistake is the call shape, not the name. Filed unassigned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 41adf369c52c58415f6b05c9245c82ccd5741582 — the merge of head dabda374fae7901355f53c55ea9c8c205bfe976c into base c41b42e8db6efdc7091e9c320c0598cd30c7777d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 41adf369c52c58415f6b05c9245c82ccd5741582 && git checkout 41adf369c52c58415f6b05c9245c82ccd5741582
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c41b42e8db6efdc7091e9c320c0598cd30c7777d dabda374fae7901355f53c55ea9c8c205bfe976c && git checkout -B drift-repro c41b42e8db6efdc7091e9c320c0598cd30c7777d && git merge --no-ff dabda374fae7901355f53c55ea9c8c205bfe976c
node scripts/docs-audit/affected-docs.mjs --json c41b42e8db6efdc7091e9c320c0598cd30c7777d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c41b42e8db6efdc7091e9c320c0598cd30c7777d → pass the list as
args.docs, on the commit named under Which tree this was computed on.