fix(formula): prescribe the bare call shape for a stdlib function written as a method

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code

[os-musk]

Fixes#14203

The defect

validateExpression refused record.name.upper() correctly and then handed the author the generic dialect trailer — "predicates are bare CEL (e.g. record.rating >= 4)" — advice that cannot succeed, because the source already IS bare CEL and parses fine. The third instance of the family repaired for the bounds class (#7073) and the unknown-name class (#13821), and the one neither could cover: #13821's arm fires only when the name is ABSENT from CEL_STDLIB_FUNCTIONS, and upper is present, so this class had no prescription at all. The name is right; the call SHAPE is wrong.

What changed

The type class now carries two disjoint arms. The new one prescribes the bare call, assembled from the SOURCE:

invalid CEL predicate: found no matching overload for 'dyn.upper()'
> 1 | record.name.upper()
^ — `upper` is callable bare, not as a method — a CALL-SHAPE fault, not
a dialect mistake, so re-spelling the expression will not fix it. Write
`upper(record.name)` instead. The callable names this platform advertises for
authoring (the `functions` list `introspectScope` returns,
`CEL_STDLIB_FUNCTIONS`) take their subject as an argument; only cel-js's own
receiver methods (`record.name.split(',')`) are written after a dot.

The spelling has to come from the source: cel-js's message names the receiver's TYPE (dyn.upper(), string.upper()), never the author's expression, so NO_OVERLOAD_RE discarding the receiver prefix loses nothing that could have been printed. When the receiver is not a plain dotted identifier chain — record.tags[0].upper(), (record.a + record.b).upper(), 'literal'.upper(), and the measured near-miss record.x[0].name.upper() — the message names the call SHAPE (upper(…) with the receiver as its first argument) rather than inventing a spelling it cannot derive. Inventing one would repeat, one level up, the defect this card is about.

The two keys, and why one of them is not enough

Per the triage fence, the arm is keyed on membership of the bare-callable catalog, never on call shape alone — plus a second key the measurement forced.

Measured on this branch through buildEnv().getDefinitions(), the same seam celEngine.compile and celEngine.evaluate build with (cel-js registers 72 distinct names over 134 definitions):

class	count	example	behaviour
advertised, bare-only	28	upper, lower, isBlank, daysFromNow	the new arm — receiver call gets the bare-call prescription
advertised, registered BOTH ways	7	contains, endsWith, matches, size, startsWith, string, trim	unchanged — keeps today's trailer
receiver-only, never advertised	33	split, map, getFullYear	unchanged — valid as receiver calls, never reach this arm

The both-forms row is the one catalog membership alone would have got wrong: record.name.contains() is a real receiver call faulting on ARITY, and "write contains(record.name)" would fault just as hard. That class keeps the existing trailer, because its fault is the arguments — the blind spot #13594 deliberately keeps blind. The arm therefore also asks isReceiverRegistered(name), read from the environment rather than from a hand-copied list, so it cannot drift.

Files

• packages/formula/src/validate.ts — receiverCallHint and receiverChainInSource, and the kind === 'type' routing. The two arms are disjoint by construction rather than by ordering: the new one fires only when the name IS advertised, validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's only when it is not.
• packages/formula/src/unknown-function.ts — the declared extractor growth: receiverCallNameFromNoOverload (a sibling regex with the receiver prefix REQUIRED, so the message-shape knowledge keeps one home) and isReceiverRegistered. callNameFromNoOverload and firstUnknownFunctionCall are unchanged in behaviour; the memo now carries both name sets off one getDefinitions() read.
• packages/formula/src/validate.test.ts — 26 cases in a new #14203 block.
• packages/formula/src/unknown-function.test.ts — 26 cases pinning the two new exports.
• .changeset/formula-receiver-call-prescription.md — @objectstack/formula patch.

Negatives — one per class the shape alone would have swallowed

• receiver-only names stay VALID as receiver calls: record.name.split(','), record.dates.map(d, d), record.created.getFullYear();
• both-forms names stay valid when called correctly (record.name.contains('x'), record.name.trim()) and keep the dialect trailer when they fault on arity (record.name.contains(), record.name.startsWith(), record.n.matches());
• a bare-callable name called BARE with wrong arguments (upper(1, 2)) and an operator mismatch (1 + 'a') keep the trailer;
• validateExpression's unknown-function refusal hands the author the dialect prescription - advice that cannot succeed on a source that is already bare CEL #13821's arm answers exactly what it answered before, in both call forms (record.name.nosuchmethod(), split(record.name, ','), nosuchfn(record.name)), and the bounds prescription is untouched;
• and the control that makes the pair a pair: upper(record.name) — the prescription this arm hands out — type-checks. A repair that prescribed something unusable would be another sentence that cannot succeed.

The both-forms set is pinned as a measured list, not remembered: if cel-js moves a name across that line, the pin reddens before the arm silently changes class.

Ablation

Predicted before the run: reverting the routing to unknownFunctionHint alone sends the class back through bracesHint (null) to the dialect trailer, so the ten prescription cases go RED and every negative stays GREEN.

Measured, exactly that: 10 failed, 150 passed over the two test files. The mutation was confirmed on disk before the run — the removed text went 1 occurrence to 0 while the injected text stayed at 1, with git diff HEAD --stat showing 1 insertion / 1 deletion — and the restore leg was proven by git diff HEAD being empty AND git hash-object on the file equalling its HEAD blob e2b884a8 (a non-empty hash, compared rather than assumed). The restoring trap used absolute paths resolved from git rev-parse --show-toplevel.

No rebuild leg applies.validate.test.ts imports ./validate relatively, so vitest resolves the package's own source; nothing in this ablation reads dist/. A first attempt of the same ablation is recorded as VOID rather than as a reading: it passed the test paths package-prefixed, vitest matched no files and exited 1 — an exit 1 that is not a red gate.

Verification

All of the following ran on this branch at 8909ee86e, exit codes captured after redirect, never through a pipe.

• pnpm --filter @objectstack/formula test — 27 files, 764 passed
• pnpm --filter @objectstack/formula typecheck — clean
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0, no narrowing claimed
• the 34-family gate union re-derived from the real changeset by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-built path list) — 32 green, plus pnpm check:error-status-conformance and pnpm check:nul-bytes green
• pnpm check:type-check-debt --re-measure green: 27 ledger entries re-measured, "none above its recorded number, surplus: none". This is the reading that covers the two edited TEST files — packages/formula/tsconfig.json excludes **/*.test.ts, so the package's own typecheck script says nothing about them (confirmed with tsc --listFiles: 0 hits). The TEST_DEBT ratchet is where they are measured, and it did not move.
• two of the 34 returned exit 3 = NOT MEASURED, recorded as such and not as passes, in each gate's own words: scripts/check-test-completeness.mjs ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and scripts/pm/check-half-states.mjs ("the trigger-file index gathered nothing, so this result says NOTHING about whether the board carries half-states").

Consumers

validateExpression is ADR-0032's shared validator (~10 expression slots including @objectstack/lint's gate and the validate_expression MCP tool). Grepped origin/main for a test outside packages/formula pinning the dialect trailer for a receiver-call input: none — the other "are bare CEL" strings belong to packages/lint and service-automation's own messages, different producers. Spot-checked the largest consumer anyway: @objectstack/lint's three expression validators, 422 passed.

Scope

No change to CEL_STDLIB_FUNCTIONS membership, to stdlib.ts, or to cel-js's environment, and no change to what validateExpression ACCEPTS: the receiver call was refused before and is refused after. Only the sentence the author is told to act on changes. Card labels and assignee untouched.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/formula, touching 10 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/formulas.mdx(via validateExpression (symbol, a top-level function))

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71dc706aa2abe51edb33a8e31571acf5305746df — the merge of head 8909ee86eaa3505991b9993d3f378ff55bafe476 into base d16df741808edbe39e0b6e09c993e440bad78444, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71dc706aa2abe51edb33a8e31571acf5305746df && git checkout 71dc706aa2abe51edb33a8e31571acf5305746df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d16df741808edbe39e0b6e09c993e440bad78444 8909ee86eaa3505991b9993d3f378ff55bafe476 && git checkout -B drift-repro d16df741808edbe39e0b6e09c993e440bad78444 && git merge --no-ff 8909ee86eaa3505991b9993d3f378ff55bafe476
node scripts/docs-audit/affected-docs.mjs --json d16df741808edbe39e0b6e09c993e440bad78444

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d16df741808edbe39e0b6e09c993e440bad78444 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Landing provenance — engine execution seat (session session_0112hMx9hjJ9BgB28X97DS68).

ACCEPT on the card: comment 5505968164 (#14203). Flip pre-checks on head 8909ee86e: every check run completed with conclusion success or skipped (33 runs; Lint & Repo Gates completed 07:39:02Z, TypeScript Type Check 07:27:47Z); governed-surface test on the PR's 5 paths: NOT governed — ordinary queue landing applies; closing-keyword two-read done at ACCEPT. Clause-② self-reading was no (formula diagnostics text, no contract member moves), so no contract-review carrier applied.

Action: draft: false then auto-merge (squash) — the merge queue takes it from here.

---

Generated by Claude Code