@@ -4003,3 +4003,119 @@ describe('runtime authoring gate on VIEW writes that name no package — the who
         expect(JSON.parse(activeViewRows(rows)[0]!.metadata)).toEqual(stored);
     });
 });
+
+/**
+ * [#24957] The object save door refuses a `validations[]` rule whose predicate
+ * reads `parent`, as `os build` does.
+ *
+ * ObjectQL evaluates every `validations[]` predicate against `record` and
+ * `previous` only; the master-detail header is bound as `parent` for a field's
+ * own `readonlyWhen` / `requiredWhen` alone. Such a rule faults on every write
+ * it judges and fails closed. #24720 reported it at `warning` (the door listed
+ * it among its advisories and admitted the save); this card makes it the
+ * refusal.
+ *
+ * The refusal is in `@objectstack/lint` (the validation pass's root verdict);
+ * no code here moves. Pinned through the REAL `saveMetaItem`, the header stored
+ * in the registry:
+ *
+ *  (a) the measured body is refused on an active save — a 422
+ *      `INVALID_METADATA` carrying the build's located finding — and nothing
+ *      lands;
+ *  (b) the same body still saves as a DRAFT (drafts are never gated), and the
+ *      draft's promotion is refused;
+ *  (c) control: `parent` on the field's own `readonlyWhen` saves, and so does a
+ *      rule reading `record`.
+ *
+ * ⚠️ As in the blocks above: this package reaches `@objectstack/lint` through
+ * its built `dist/`, so an edit to the rule is invisible here until
+ * `pnpm --filter @objectstack/lint build` has run.
+ */
+describe('runtime authoring gate on OBJECT writes — a validations[] predicate reading parent (#24957)', () => {
+    const header = {
+        name: 'fx_header',
+        label: 'Header',
+        sharingModel: 'private',
+        fields: { name: { type: 'text', label: 'Name' }, status: { type: 'text', label: 'Status' } },
+    };
+    const line = (validations: unknown[], extraFields: Record<string, unknown> = {}) => ({
+        name: 'fx_line',
+        label: 'Line',
+        sharingModel: 'private',
+        fields: {
+            hdr: { type: 'master_detail', label: 'Header', reference: 'fx_header' },
+            amount: { type: 'number', label: 'Amount' },
+            ...extraFields,
+        },
+        validations,
+    });
+    /** The measured body. */
+    const PARENT = "parent.status == 'paid'";
+    const rule = (condition: string) => ({ name: 'paid_lock', type: 'script', condition, message: 'Locked.' });
+    /** Where the build locates it — the rule the author edits. */
+    const WHERE = "object 'fx_line' · validation 'paid_lock'";
+
+    const hostWithHeader = () => {
+        const { engine, rows } = makeStubEngine();
+        engine.registry.listItems = (type: string) => (type === 'object' ? [header] : []);
+        const protocol = new ObjectStackProtocolImplementation(engine, () => new Map(), 'env_test') as any;
+        return { protocol, rows };
+    };
+    const lineRows = (rows: Map<string, Row>) =>
+        Array.from(rows.values()).filter((r) => r.type === 'object' && r.name === 'fx_line');
+    const saveLine = (protocol: any, item: unknown, extra: Record<string, unknown> = {}) =>
+        protocol.saveMetaItem({ type: 'object', name: 'fx_line', item, ...extra });
+
+    it('(a) REFUSES an active save with a 422 carrying the build\'s located finding, and nothing lands', async () => {
+        const { protocol, rows } = hostWithHeader();
+
+        const err = await saveLine(protocol, line([rule(PARENT)])).catch((e: any) => e);
+
+        expect(err, 'the save resolved — the door still admits the rule').toBeInstanceOf(Error);
+        expect({ code: err.code, status: err.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        const issues = err.issues.filter((i: any) => i.rule === EXPRESSION_INVALID);
+        expect(issues, `issues: ${JSON.stringify(err.issues)}`).toHaveLength(1);
+        expect(issues[0].path).toBe(WHERE);
+        expect(issues[0].severity).toBe('error');
+        expect(issues[0].message).toContain("validation rule 'paid_lock' reads `parent`");
+        expect(lineRows(rows)).toEqual([]);
+
+        // The door's issue IS the build's finding.
+        const stack = { objects: [header, line([rule(PARENT)])] };
+        const atBuild = runAuthoringRules('build', { normalized: stack, parsed: stack })
+            .filter((f) => f.rule === EXPRESSION_INVALID);
+        expect(atBuild).toHaveLength(1);
+        for (const key of ['rule', 'where', 'path', 'message', 'severity'] as const) {
+            expect(issues[0][key], `door and build disagree on '${key}'`).toBe(atBuild[0]![key]);
+        }
+    });
+
+    it('(b) the same body still saves as a DRAFT, and its PROMOTION is refused', async () => {
+        const { protocol, rows } = hostWithHeader();
+
+        await expect(saveLine(protocol, line([rule(PARENT)]), { mode: 'draft' })).resolves.toMatchObject({ success: true });
+        expect(lineRows(rows).map((r) => r.state)).toEqual(['draft']);
+
+        const err = await protocol.publishMetaItem({ type: 'object', name: 'fx_line' }).catch((e: any) => e);
+
+        expect({ code: err?.code, status: err?.status }).toEqual({ code: 'INVALID_METADATA', status: 422 });
+        const issue = err.issues.find((i: any) => i.rule === EXPRESSION_INVALID);
+        expect(issue, `issues: ${JSON.stringify(err.issues)}`).toBeDefined();
+        expect(issue.path).toBe(WHERE);
+        expect(lineRows(rows).map((r) => r.state)).toEqual(['draft']);
+    });
+
+    it('(c) control: `parent` on the field\'s own `readonlyWhen`, and a rule reading `record`, save and land', async () => {
+        for (const body of [
+            line([], { note: { type: 'text', label: 'Note', readonlyWhen: PARENT } }),
+            line([rule('record.amount != null && record.amount > 0')]),
+        ]) {
+            const { protocol, rows } = hostWithHeader();
+
+            const result = await saveLine(protocol, body);
+
+            expect(result.success, JSON.stringify(body)).toBe(true);
+            expect(lineRows(rows).map((r) => r.state)).toEqual(['active']);
+        }
+    });
+});