@@ -181,3 +181,69 @@ describe('#22032 pass 3 — the object door gives the build\'s option `visibleWh
     expect(expressionFindings(result.errors), dump(result)).toEqual([]);
   });
 });
+
+/**
+ * #22157 — the option's root verdict, at the object door.
+ *
+ * The server's option check (`evaluateOptionVisibility`) binds `record`,
+ * `previous` and the acting user. An option `visibleWhen` reading `parent` (on
+ * a detail with exactly one `master_detail`, where the field-rule slots DO
+ * bind it) published clean through this door and then faulted open on every
+ * write that picked the option. The verdict lives in the build's option pass,
+ * which this door runs since #22032's pass 3, so the door's finding is the
+ * build's. The protocol-level half, through the real `saveMetaItem`, is the
+ * #22157 block of `packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts`.
+ */
+describe('#22157 — the object door refuses an option `visibleWhen` reading `parent`, as the build does', () => {
+  const header = {
+    name: 'fx_header',
+    label: 'Header',
+    sharingModel: 'private',
+    fields: { name: { type: 'text', label: 'Name' }, status: { type: 'text', label: 'Status' } },
+  };
+  const line = (visibleWhen: unknown) => ({
+    name: 'fx_line',
+    label: 'Line',
+    sharingModel: 'private',
+    fields: {
+      hdr: { type: 'master_detail', label: 'Header', reference: 'fx_header' },
+      x: { type: 'text', label: 'X' },
+      tier: {
+        type: 'select',
+        label: 'Tier',
+        options: [{ label: 'Standard', value: 'standard' }, { label: 'Gold', value: 'gold', visibleWhen }],
+      },
+    },
+  });
+  const LINE_WHERE = "object 'fx_line' · field 'tier' option 'gold' visibleWhen";
+  const PARENT = "parent.status == 'closed'";
+
+  it('⭐ LIT — the measured body is REFUSED at the door, located at the option, naming the root', () => {
+    const result = gateObject(line(PARENT), [header]);
+
+    expect(result.rulesRun).toContain('validateStackExpressions');
+    const errs = expressionFindings(result.errors);
+    expect(errs, dump(result)).toHaveLength(1);
+    expect(errs[0]).toMatchObject({ severity: 'error', where: LINE_WHERE, path: LINE_WHERE });
+    expect(errs[0]!.message).toContain("option 'gold' on field 'tier' reads `parent`");
+  });
+
+  it('⭐ PARITY — the door finding IS the build finding', () => {
+    const atBuild = buildFindings(header, line(PARENT));
+    const atDoor = expressionFindings(gateObject(line(PARENT), [header]).errors);
+
+    // Non-vacuous: the build refuses it.
+    expect(atBuild, dump(atBuild)).toHaveLength(1);
+    expect(atDoor, dump(atDoor)).toEqual(atBuild);
+  });
+
+  for (const body of ["record.x == 'a'", "'org_admin' in current_user.positions"]) {
+    it(`⭐ CONTROL — \`${body}\` on the same option publishes clean, and the build agrees`, () => {
+      const result = gateObject(line(body), [header]);
+
+      expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+      expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+      expect(buildFindings(header, line(body))).toEqual([]);
+    });
+  }
+});
@@ -2005,6 +2005,89 @@ describe('validateStackExpressions (ADR-0032 build-time)', () => {
       });
     });
 
+    /**
+     * ── The option's root verdict (#22157) ──────────────────────────────────
+     *
+     * The server's option check (`evaluateOptionVisibility`) binds `record`,
+     * `previous` and the acting user, and nothing else. A predicate reading any
+     * other root faults on every write that picks the option and is admitted
+     * unchecked, so the build refuses it. The measured body is `parent` on a
+     * detail with exactly one `master_detail`: the object shape on which the
+     * field-rule slots one level up DO bind `parent`, so it is the shape an
+     * author copies from.
+     */
+    describe('a per-option `visibleWhen` root the option check does not bind is refused (#22157)', () => {
+      const detail = (visibleWhen: unknown, readonlyWhen?: unknown) => ({
+        objects: [
+          { name: 'fx_header', fields: { status: { type: 'text' } } },
+          {
+            name: 'fx_line',
+            fields: {
+              hdr: { type: 'master_detail', reference: 'fx_header' },
+              x: { type: 'text', ...(readonlyWhen === undefined ? {} : { readonlyWhen }) },
+              parent_code: { type: 'text' },
+              tier: {
+                type: 'select',
+                options: [{ label: 'Standard', value: 'standard' }, { label: 'Gold', value: 'gold', visibleWhen }],
+              },
+            },
+          },
+        ],
+      });
+      const WHERE = "object 'fx_line' · field 'tier' option 'gold' visibleWhen";
+      const PARENT = "parent.status == 'closed'";
+      /** What `evaluateOptionVisibility` binds, read off its call (`rule-validator.ts`). */
+      const BOUND = ['record', 'previous', 'current_user', 'user', 'ctx', 'os'];
+
+      it('⭐ refuses `parent` at error, located at the option, naming the option, the field and the root', () => {
+        const issues = validateStackExpressions(detail(PARENT));
+        expect(issues, JSON.stringify(issues, null, 2)).toHaveLength(1);
+        expect(issues[0]).toMatchObject({ where: WHERE, severity: 'error', source: PARENT });
+        expect(issues[0]!.message).toContain("option 'gold' on field 'tier' reads `parent`");
+      });
+
+      it('⭐ CONTRAST — the same `parent` read on the field\'s own `readonlyWhen` passes: that slot binds it', () => {
+        expect(validateStackExpressions(detail("record.x == 'a'", PARENT))).toEqual([]);
+      });
+
+      it('⭐ CONTROL — `record`, `previous` and the acting user under every ADR-0068 spelling pass', () => {
+        for (const body of [
+          "record.x == 'a'",
+          "previous.x == 'a'",
+          "'org_admin' in current_user.positions",
+          "'org_admin' in user.positions",
+          "ctx.user.id != ''",
+          "os.user.id != ''",
+          "current_user.can('fx_line', 'edit')",
+          // A `record` member merely spelled like the refused root.
+          "record.parent_code == 'a'",
+        ]) {
+          expect(validateStackExpressions(detail(body)), body).toEqual([]);
+        }
+      });
+
+      /**
+       * An ALLOWLIST read against the real `SCOPE_ROOTS`, never a copy of it:
+       * every platform-wide root outside what the option check binds is
+       * refused, one finding each, so a root added to the baseline later is
+       * covered the day it lands.
+       */
+      it('refuses every `SCOPE_ROOTS` member the option check does not bind, one finding each', () => {
+        const unbound = (SCOPE_ROOTS as readonly string[]).filter((r) => !BOUND.includes(r));
+        expect(unbound).toContain('parent');
+        for (const root of unbound) {
+          const issues = validateStackExpressions(detail(`${root}.k == 'a'`));
+          expect(issues, root).toHaveLength(1);
+          expect(issues[0]!.where, root).toBe(WHERE);
+          expect(issues[0]!.message, root).toContain(`reads \`${root}\``);
+        }
+      });
+
+      it('gives one finding when the predicate reads two unbound roots', () => {
+        expect(validateStackExpressions(detail(`${PARENT} && input.k == 1`))).toHaveLength(1);
+      });
+    });
+
     it('flags a bare-field sharing-rule condition', () => {
       const issues = validateStackExpressions({
         objects: [{ name: 'crm_account', fields: { region: { type: 'text' } } }],
 
@@ -2210,6 +2210,128 @@ describe('runtime authoring gate on OBJECT writes — the option visibleWhen ver
     });
 });
 
+/**
+ * [#22157] The object save door refuses a field option's `visibleWhen` that
+ * reads `parent`, as `os build` does.
+ *
+ * The server's option check (`evaluateOptionVisibility` in ObjectQL) binds
+ * `record`, `previous` and the acting user, never `parent`. Measured before
+ * this change: on a detail with exactly one `master_detail` (where the
+ * field-rule slots DO bind `parent`), an option whose `visibleWhen` read
+ * `parent.status` saved through this door with a 200 and landed `active`, and
+ * every write that then picked the option faulted and was admitted unchecked.
+ *
+ * The refusal is in `@objectstack/lint` (the option pass's root verdict); no
+ * code here moves. Pinned through the REAL `saveMetaItem`, the header stored
+ * in the registry so the write is judged against the universe it lands in:
+ *
+ *  (a) the measured body is refused on an active save — a 422
+ *      `INVALID_METADATA` carrying the build's located finding — and nothing
+ *      lands;
+ *  (b) the same body still saves as a DRAFT (drafts are never gated);
+ *  (c) control: an option reading `record` saves, and the row lands;
+ *  (d) the door's issue and the build's finding are the same finding.
+ *
+ * ⚠️ As in the blocks above: this package reaches `@objectstack/lint` through
+ * its built `dist/`, so an edit to the rule is invisible here until
+ * `pnpm --filter @objectstack/lint build` has run.
+ */
+describe('runtime authoring gate on OBJECT writes — an option visibleWhen reading parent (#22157)', () => {
+    const header = {
+        name: 'fx_header',
+        label: 'Header',
+        sharingModel: 'private',
+        fields: { name: { type: 'text', label: 'Name' }, status: { type: 'text', label: 'Status' } },
+    };
+    const line = (visibleWhen: unknown) => ({
+        name: 'fx_line',
+        label: 'Line',
+        sharingModel: 'private',
+        fields: {
+            hdr: { type: 'master_detail', label: 'Header', reference: 'fx_header' },
+            x: { type: 'text', label: 'X' },
+            tier: {
+                type: 'select',
+                label: 'Tier',
+                options: [{ label: 'Standard', value: 'standard' }, { label: 'Gold', value: 'gold', visibleWhen }],
+            },
+        },
+    });
+    /** The card's measured body. */
+    const PARENT = "parent.status == 'closed'";
+    /** Where the build locates it — the option the author edits. */
+    const WHERE = "object 'fx_line' · field 'tier' option 'gold' visibleWhen";
+
+    /** A protocol whose live registry holds the header — the stored universe. */
+    const hostWithHeader = () => {
+        const { engine, rows } = makeStubEngine();
+        engine.registry.listItems = (type: string) => (type === 'object' ? [header] : []);
+        const protocol = new ObjectStackProtocolImplementation(engine, () => new Map(), 'env_test') as any;
+        return { protocol, rows };
+    };
+    const lineRows = (rows: Map<string, Row>) =>
+        Array.from(rows.values()).filter((r) => r.type === 'object' && r.name === 'fx_line');
+    const saveLine = (protocol: any, item: unknown, extra: Record<string, unknown> = {}) =>
+        protocol.saveMetaItem({ type: 'object', name: 'fx_line', item, ...extra });
+    const buildFindings = (obj: unknown) => {
+        const stack = { objects: [header, obj] };
+        return runAuthoringRules('build', { normalized: stack, parsed: stack })
+            .filter((f) => f.rule === EXPRESSION_INVALID);
+    };
+
+    it('(a) REFUSES an active save with a 422 carrying the build\'s located finding, and nothing lands', async () => {
+        const { protocol, rows } = hostWithHeader();
+
+        const err = await saveLine(protocol, line(PARENT)).catch((e: any) => e);
+
+        expect(err, 'the save resolved — the door still accepts the option predicate').toBeInstanceOf(Error);
+        expect({ code: err.code, status: err.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        expect(err.rulesRun).toContain('validateStackExpressions');
+        const issues = err.issues.filter((i: any) => i.rule === EXPRESSION_INVALID);
+        expect(issues, `issues: ${JSON.stringify(err.issues)}`).toHaveLength(1);
+        expect(issues[0].path).toBe(WHERE);
+        expect(issues[0].severity).toBe('error');
+        // The named subject: the option, the field and the root.
+        expect(issues[0].message).toContain("option 'gold' on field 'tier' reads `parent`");
+        expect(lineRows(rows)).toEqual([]);
+    });
+
+    it('(b) the same body still saves as a DRAFT — drafts are never gated', async () => {
+        const { protocol, rows } = hostWithHeader();
+
+        await expect(saveLine(protocol, line(PARENT), { mode: 'draft' })).resolves.toMatchObject({ success: true });
+
+        expect(lineRows(rows).map((r) => r.state)).toEqual(['draft']);
+    });
+
+    it('(c) control: an option reading `record` saves, and the row lands', async () => {
+        const { protocol, rows } = hostWithHeader();
+
+        const result = await saveLine(protocol, line("record.x == 'a'"));
+
+        expect(result.success).toBe(true);
+        expect(lineRows(rows).map((r) => r.state)).toEqual(['active']);
+    });
+
+    it('(d) the door and `os build` give the SAME finding', async () => {
+        const { protocol } = hostWithHeader();
+        const err = await saveLine(protocol, line(PARENT)).catch((e: any) => e);
+        const atDoor = (err.issues ?? []).filter((i: any) => i.rule === EXPRESSION_INVALID);
+
+        const atBuild = buildFindings(line(PARENT));
+
+        // Non-vacuous on both sides.
+        expect(atBuild).toHaveLength(1);
+        expect(atBuild[0]!.severity).toBe('error');
+        expect(atDoor).toHaveLength(1);
+        for (const key of ['rule', 'where', 'path', 'message', 'hint'] as const) {
+            expect(atDoor[0][key], `door and build disagree on '${key}'`).toBe(atBuild[0]![key]);
+        }
+        // And the control is clean at the build too, not just at the door.
+        expect(buildFindings(line("record.x == 'a'"))).toEqual([]);
+    });
+});
+
 /**
  * [#22118] The object save door judges a stored sibling's finding against the
  * STORED universe — the registry's objects WITH the written object's stored