test(objectql): pin the case that defines a script rule as an invariant

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.

[os-musk]

Fixes#14891

Two it cases, no behaviour change. packages/objectql/src/validation/rule-validator.ts is untouched — the engine already does the right thing; what was missing was the pin for the case that defines it.

Why this case, and not any of the three already there

checkPredicate is handed ctx.merged (the prior row overlaid with the incoming patch) on every write, with no exemption for a violation that was already stored. A row that already violates is therefore refused on any edit until a repairing write lands: frozen, not bricked. That is exactly what makes a validations[]script rule an invariant rather than a transition gate.

The mirrored case on the gate side is already pinned:

• packages/objectql/src/validation/rule-validator.test.ts:65 — "legacy rows rest: a pre-existing violation does not block an unrelated write" (the ADR-0113 exemption on Field.requiredWhen).

The script / cross_field predicates block pinned only the write that carries the offending value (:1813), the write that makes the predicate false (:1824), and the un-evaluable predicate (:1838). The distinguishing case had no pin, so the boundary between the two mechanisms had asymmetric coverage: the gate's exemption was pinned, the invariant's absence of one was not.

What landed

write	previous row	expected
touch an unrelated field only	discount 90	ValidationError (frozen)
repairing write, discount 50	discount 90	passes (not bricked)

The refusal case asserts the envelope — VALIDATION_FAILED, and fields exactly [{ field: '_record', code: 'rule_violation', message: the authored message }] — rather than a bare toThrow, which here would also be satisfied by an unrelated fault.

Reverse verification (ablation)

Committed first, then checkPredicate was mutated to give script rules the requiredWhen-style exemption (skip when the predicate was already TRUE over previous), i.e. the exact erasure of the boundary these pins exist to notice:

Tests 1 failed | 187 passed (188)
x script / cross_field predicates > a stored violation FREEZES the row -- an unrelated-field write is refused too (#14891)

Exactly the new frozen pin turns red; the three pre-existing cases in the block stay green, which is the measurement that shows the gap was real. Mutation proved on disk (marker count 1, blob hash moved 0cc67e6f -> a6766298); restore proved against the HEAD blob (hash back to 0cc67e6f, marker count 0, git diff HEAD empty), and the restored tree re-runs 188 passed.

Two readings from the card that did not hold

1. PR chore(lint): delete inert eslint-disable family comments in package sources #14801 is already merged, so it was never a conflict. State read directly: MERGED, titled "chore(lint): delete inert eslint-disable family comments in package sources", and already in this branch's base (8bcc348be on origin/main). It touches no predicate evaluation, so there was nothing to land against.
2. requiredWhen(与字段级 min/max)是转换门,validations[] script 是真不变量 —— 边界是刻意的、已被双驱动实测,但平台没有任何一处教它 #13879's contract text has NOT landed. The card and the dispatch both state the invariant wording now ships from packages/spec/src/data/validation.zod.ts. On origin/main at 84b8190ae it does not: the script rule's condition describe string still reads 'Predicate (CEL). If TRUE, validation fails. e.g. P\record.amount < 0`', and neither "invariant" nor "transition gate" appears anywhere in the module docblock. #13879 is an **open issue** with an unmerged branch (claude/issue-13879-required-when-transition-gate-docblocks). Nothing here depends on that text — the behaviour was driven directly rather than taken from the spec — but the published-claim-versus-pin framing in the card is a statement about a branch, not about main`, and the spec seat should know that.

Gates

Union re-derived from the tree after the final commit and run at 90ed65f08:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 28 families (24 by path + 6 by change KIND, 2 shared). 25 green, 3 NOT MEASURED locally rather than red:
  • check-test-completeness.mjs — exit 3, prerequisite: it parses a saved turbo run test log, which only CI produces.
  • check:dual-build-cjs-loads — exit 3, prerequisite: reads built dist/ for 56 packages.
  • check:type-check-debt — needs the full workspace closure built. Declared narrowing: the closure build was started under the shared verify lock, then released to three queued peers rather than held for a 50-line test-only diff. Its substantive reading for this diff was taken directly instead (the --listFiles measurement above), and CI runs the ratchet unconditionally on packages/**.
• pnpm --filter @objectstack/objectql exec vitest run src/validation/rule-validator.test.ts — 188 passed.
• pnpm --filter @objectstack/objectql typecheck — green, and the edited file is genuinely in the program: tsc -p tsconfig.test.json --listFiles lists src/validation/rule-validator.test.ts, which reports 0 errors (so it carries no debt-ledger entry and any error it gains is red on arrival).
• node scripts/pm/check-governed-merges.mjs --test on the final file list — not a governed surface.
• node scripts/check-nul-bytes.mjs — clean.

skip-changeset: the diff is one test file. Nothing is published from any released package.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b91c351e5d87e8f98759b31d355ca46e3fa1dde8 → packageMentionDocs.