@@ -8,6 +8,16 @@
 
 ---
 
+> **Addendum (2026-09-18, #17778) — what the `*When` family does when it cannot RUN is decided by [ADR-0136](./0136-predicate-fault-semantics-are-contract.md), not here.**
+> This record unified the family under one NAME and is unchanged by that one. ADR-0136 D1 holds a
+> predicate slot to what the engine can actually run (the `FieldSchema` field-rule triad composes
+> `PredicateInputSchema`, so an `ast`-only envelope and a blank `source` are refused at authoring);
+> D2 refuses the SUBMIT loudly on a fault, naming the field and the rule; D3 keeps visibility
+> fail-OPEN at RENDER. A reader who arrived here asking what a broken `visibleWhen` does should
+> read that record.
+
+---
+
 ## TL;DR
 
 One concept — *"show this only when the CEL predicate is TRUE"* — is spelled three
 
@@ -0,0 +1,135 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The `FieldSchema` field-rule triad is EVALUATED (#17778, ADR-0136 D1) — all
+ * three of `visibleWhen` / `readonlyWhen` / `requiredWhen` compose
+ * `PredicateInputSchema`, which is now the evaluated rule, so an envelope the
+ * engine cannot evaluate is refused at authoring instead of silently doing
+ * nothing at evaluation time.
+ *
+ * Before this the triad was `ExpressionInputSchema` — the persistence contract,
+ * `source` OR `ast` — and all three slots resolved both refused spellings to a
+ * NO-OP, each by its own mechanism (measured at each end on `03b7b8187`):
+ * `visibleWhen` is never evaluated server-side at the field level at all
+ * (`rule-validator.ts`'s `ConditionalFieldDef` has no such member);
+ * `isReadonlyWhenLocked` returns LOCKED only for an unbound-ROOT fault and
+ * logs `change allowed through` + returns `false` for every other fault, which
+ * is the arm an unevaluable envelope takes; `requiredWhen` logs and SKIPS the
+ * check. So one unauthored predicate made a form show more, lock less and
+ * demand less at once, with nothing saying the rule had not run.
+ *
+ * Reproduction pins, one per spelling per slot, each asserting the issue's
+ * `code`, `path` and message — never `success === false` alone, which an
+ * unrelated refusal would satisfy just as well. Two preservation controls
+ * carry the other half: the persistence contract still ACCEPTS both refused
+ * shapes (it was deliberately not narrowed), and a real predicate parses to
+ * byte-identically what it parsed to before.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  EVALUATED_EXPRESSION_SOURCE_REQUIRED,
+  ExpressionInputSchema,
+  ExpressionSchema,
+} from '../shared/expression.zod.js';
+import { FieldSchema } from './field.zod.js';
+
+const AST_ONLY = { dialect: 'cel', ast: { kind: 'const', value: true } };
+const BLANK_SOURCE = { dialect: 'cel', source: '   ' };
+const BLANK_BARE = '   ';
+const GOOD = { dialect: 'cel', source: "record.status == 'paid'" };
+
+const FIELD = { name: 'amount', label: 'Amount', type: 'currency' } as const;
+
+const SLOTS = ['visibleWhen', 'readonlyWhen', 'requiredWhen'] as const;
+
+function issuesOf(slot: string, value: unknown) {
+  const result = FieldSchema.safeParse({ ...FIELD, [slot]: value });
+  return result.success
+    ? []
+    : result.error.issues.map((i) => ({
+        code: i.code,
+        path: i.path.map(String).join('.'),
+        message: i.message,
+      }));
+}
+
+describe('FieldSchema field-rule triad — an evaluated slot requires a non-blank `source` (#17778)', () => {
+  for (const slot of SLOTS) {
+    describe(`\`${slot}\``, () => {
+      it('REFUSES an `ast`-only envelope with the published sentence at the slot', () => {
+        // Both arms of the input union abort on this shape (the envelope arm's
+        // missing `source` is an aborting `invalid_type`), so it surfaces as
+        // the union's own issue at the SLOT, worded by the union's error map.
+        expect(issuesOf(slot, AST_ONLY)).toEqual([
+          { code: 'invalid_union', path: slot, message: EVALUATED_EXPRESSION_SOURCE_REQUIRED },
+        ]);
+      });
+
+      it('REFUSES a blank `source` INSIDE an envelope, at `source`', () => {
+        // The one shape the envelope arm refuses WITHOUT aborting (a `custom`
+        // refine), so it surfaces from the arm itself, one level deeper.
+        expect(issuesOf(slot, BLANK_SOURCE)).toEqual([
+          {
+            code: 'custom',
+            path: `${slot}.source`,
+            message: EVALUATED_EXPRESSION_SOURCE_REQUIRED,
+          },
+        ]);
+      });
+
+      it('REFUSES a blank bare-string shorthand at the slot', () => {
+        expect(issuesOf(slot, BLANK_BARE)).toEqual([
+          { code: 'invalid_union', path: slot, message: EVALUATED_EXPRESSION_SOURCE_REQUIRED },
+        ]);
+      });
+
+      it('PRESERVES a real predicate — parses, and to the same envelope as before', () => {
+        const result = FieldSchema.safeParse({ ...FIELD, [slot]: GOOD });
+        expect(result.success).toBe(true);
+        expect((result as { success: true; data: Record<string, unknown> }).data[slot]).toEqual(GOOD);
+      });
+
+      it('PRESERVES the bare-string shorthand, normalized to a `cel` envelope', () => {
+        const result = FieldSchema.safeParse({ ...FIELD, [slot]: "record.status == 'paid'" });
+        expect(result.success).toBe(true);
+        expect((result as { success: true; data: Record<string, unknown> }).data[slot]).toEqual(GOOD);
+      });
+
+      it('PRESERVES an `ast` BESIDE a string `source`', () => {
+        expect(FieldSchema.safeParse({ ...FIELD, [slot]: { ...GOOD, ast: { kind: 'const' } } }).success)
+          .toBe(true);
+      });
+
+      it('PRESERVES absence — "no rule" is not a malformed rule', () => {
+        expect(FieldSchema.safeParse(FIELD).success).toBe(true);
+      });
+    });
+  }
+
+  it('CONTROL: the persistence contract was NOT narrowed and still accepts both shapes', () => {
+    // If this control ever goes red, the narrowing has leaked out of the
+    // evaluated slots and into the schema that only PERSISTS an envelope —
+    // which ADR-0136 D1 explicitly declines to do.
+    expect(ExpressionSchema.safeParse(AST_ONLY).success).toBe(true);
+    expect(ExpressionInputSchema.safeParse(AST_ONLY).success).toBe(true);
+    expect(ExpressionSchema.safeParse(BLANK_SOURCE).success).toBe(true);
+    expect(ExpressionInputSchema.safeParse(BLANK_SOURCE).success).toBe(true);
+  });
+
+  it('CONTROL: the per-OPTION `visibleWhen` is OUT of scope and still accepts an `ast`-only envelope', () => {
+    // ADR-0136's scope boundary: the option-level predicate, the inline-column
+    // pair and every view/page/action gate still compose
+    // `ExpressionInputSchema`. This pin is what makes that boundary a measured
+    // fact rather than a claim in prose — when the gate slots are converted,
+    // this expectation is the one that must be updated deliberately.
+    const result = FieldSchema.safeParse({
+      name: 'tier',
+      label: 'Tier',
+      type: 'select',
+      options: [{ label: 'Gold', value: 'gold', visibleWhen: AST_ONLY }],
+    });
+    expect(result.success).toBe(true);
+  });
+});
@@ -0,0 +1,96 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+// No backticks in `surface` — build-upgrade-guide.ts renders it inside a code
+// span already, and a nested backtick would close it.
+export const entry: SemanticMigration = {
+  id: 'field-rule-predicate-evaluated-slot-source-required',
+  surface:
+    'a field-rule predicate, all three slots of the triad on FieldSchema — visibleWhen, '
+    + 'readonlyWhen and requiredWhen — and with them the PredicateSchema / PredicateInputSchema '
+    + 'public exports every other declaration site composes, authored either as an expression '
+    + 'envelope carrying only ast ({ dialect: \'cel\', ast: … } with no source), or with a source '
+    + 'that is blank after trimming, through the envelope key '
+    + '({ dialect: \'cel\', source: \'   \' }) or the bare-string shorthand for it '
+    + '(visibleWhen: \'   \'). Reachable wherever an object is authored or stored: '
+    + 'defineStack({ objects }) sources, an exported stack passed to objectstack validate, a '
+    + 'POST /objects body, and an object row already sitting in sys_metadata',
+  replacement:
+    'a non-blank `source` — `{ dialect: \'cel\', source: \'record.status == \\\'paid\\\'\' }`, or the '
+    + 'bare string, or the `P` tagged template the examples use — if the rule was meant to gate; '
+    + 'or REMOVE the key entirely if the field was meant to carry no rule. ⚠️ Unlike the '
+    + 'flow-edge entry this one otherwise mirrors, removal here is BEHAVIOUR-PRESERVING and is a '
+    + 'safe default: all three slots resolve BOTH refused spellings to a no-op today (measured, '
+    + 'see `reason`), so deleting the key preserves exactly what the runtime already did. What '
+    + 'removal does NOT preserve is the author\'s INTENT — the rule was written to gate '
+    + 'something, and a removal records that it never did. Authoring the `source` is the '
+    + 'repair; removal is the honest way to say the rule was abandoned. An `ast` BESIDE a string '
+    + '`source` is untouched and stays admitted everywhere',
+  reason:
+    'Card #17778, on the maintainer ruling for objectui#8069 (decision batch #119 item 3, '
+    + '2026-09-12: 「同意」 to A, Q2 yes, Q3 yes) and the standing ruling '
+    + '「我们的项目以objectstack 协议为准…协议不正确的应该先修改协议。」. ADR-0136 D1: a predicate is an '
+    + 'EVALUATED slot by definition, so `PredicateSchema` / `PredicateInputSchema` now compose '
+    + '`EvaluatedExpressionSchema` / `EvaluatedExpressionInputSchema` instead of the PERSISTENCE '
+    + 'contract `ExpressionSchema` / `ExpressionInputSchema`, and the field-rule triad binds '
+    + 'them. The CEL engine evaluates `source` alone (`cel-engine.ts` `evaluate`: "AST-only '
+    + 'evaluation not yet supported; persist `source`"), so both refused spellings parsed, '
+    + 'registered, passed `objectstack validate`, and then produced a rule that silently did '
+    + 'nothing. ⚠️ The three no-op directions are NOT the same mechanism, and each was measured '
+    + 'at its own end rather than inferred from the others: `visibleWhen` is never evaluated '
+    + 'server-side at the FIELD level at all (`rule-validator.ts`\'s `ConditionalFieldDef` has no '
+    + 'such member) and the renderer falls back to VISIBLE where no host publishes a predicate '
+    + 'scope; `readonlyWhen` reaches `isReadonlyWhenLocked`, whose unbound-ROOT arm returns '
+    + 'LOCKED but whose every-other-fault arm logs "change allowed through" and returns false, '
+    + 'and an unevaluable envelope takes that second arm — the declared lock is silently waived; '
+    + '`requiredWhen` logs and SKIPS the check. So one misspelled or unauthored predicate '
+    + 'produced a form that showed more, locked less and demanded less at once, with no state '
+    + 'that said "this rule did not run" — which is the composite objectui#8069 measured and '
+    + 'this entry\'s ruling closes. ⚠️ No D2 conversion is possible, and that is why this needs '
+    + 'a D3 entry rather than none: an `ast`-only envelope carries no `source` to derive one '
+    + 'from (lowering an AST to surface syntax is the compiler direction the platform does not '
+    + 'run), and a blank `source` names no predicate to reconstruct. Choosing between "author '
+    + 'the rule" and "drop the rule" is an intent question only the author can answer, which is '
+    + 'what this entry delegates. ⚠️ Scope of the RUNTIME half, stated so it is not read wider '
+    + 'than it is: ADR-0136 D2 (a faulting field-rule predicate refuses the SUBMIT, naming the '
+    + 'field and the rule) and D3 (visibility stays fail-OPEN at RENDER) are consequences '
+    + 'CONSUMERS deliver — `packages/spec` carries no business logic — and the renderer half '
+    + 'lands in objectui#8069. This entry is the AUTHORING refusal only. ⚠️ And one '
+    + 'stored-row consequence is deliberately left UNMEASURED rather than guessed: '
+    + '`applyConversionsToStoredItem` IS applied to `object` (only `flow` is skipped, '
+    + '`spec/src/conversions/stored.ts` and the same skip in '
+    + '`metadata/src/loaders/database-loader.ts` `rowToData`), but no conversion can repair '
+    + 'either refused spelling, so a stored row carrying one now meets a strict schema at '
+    + 'whichever seam parses it; which seam that is, and whether it degrades to a warn or '
+    + 'refuses the object, was NOT measured on this card and is named here as the open edge '
+    + 'rather than asserted. A repo-wide census over examples/, packages/, content/ and skills/ '
+    + 'at 03b7b8187 found ZERO field-rule predicates of either spelling against two live lit '
+    + 'controls (non-blank tagged-template predicates: 15 files; envelope-form predicates: 14 '
+    + 'files), so there is nothing in THIS repository to rewrite — a repo reading, which is why '
+    + 'the notification is registered here rather than skipped. ADR-0136, ADR-0087, ADR-0089, '
+    + 'ADR-0058, ADR-0124.',
+  acceptanceCriteria:
+    'Grep every authored field-rule predicate — all three of `visibleWhen`, `readonlyWhen` and '
+    + '`requiredWhen` on a FIELD (not the per-OPTION `visibleWhen`, not the inline-column pair, '
+    + 'and not a view/page/action gate: those slots still compose `ExpressionInputSchema` and '
+    + 'are unaffected by this entry) — in `defineStack({ objects })` sources, exported stacks '
+    + 'and `POST /objects` bodies, and every object row in `sys_metadata`, for an envelope with '
+    + 'no `source` key and for a `source` (or bare string) that is empty after trimming. For '
+    + 'each hit decide, per the `replacement` note, whether the rule was meant to gate (author '
+    + 'the `source`) or was abandoned (remove the key) — removal is behaviour-preserving here, '
+    + 'so it is a safe default, but it records that the rule never ran. Two proofs. (1) For a '
+    + 'stack authored in config files, `objectstack validate` is clean: it locates each offender '
+    + 'with the `EVALUATED_EXPRESSION_SOURCE_REQUIRED` sentence at '
+    + '`objects.N.fields.N.visibleWhen` (and the two siblings) — a blank `source` inside an '
+    + 'envelope surfaces as one issue at `source`, while an `ast`-only envelope and a blank '
+    + 'bare string abort both arms of the input union and surface as one `invalid_union` at the '
+    + 'SLOT, carrying that same sentence. There is no CLI verb that lowers a stored row back '
+    + 'into a config file, so this proof does not reach an object that exists only in '
+    + '`sys_metadata`. (2) For stored rows, boot the stack and confirm each object still loads '
+    + 'and its form still renders: a row carrying either spelling no longer parses, and per the '
+    + '`reason`\'s last note the seam that reports it was not measured on this card — so read '
+    + 'the boot log for the object by name rather than expecting a specific message, and treat '
+    + 'a missing object as this entry\'s signal. An object whose field rules all carry a '
+    + 'non-blank `source` parses byte-identically to before.',
+};