objectql(validation): a rule that reads previous is unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window as unevaluable, not with its message

Filing gate ① — a product defect at a public door, measured. reach: as admin, POST /api/v1/data/sys_user_permission_set with valid_from: 2027-01-02T00:00:00Z, valid_until: 2027-01-01T00:00:00Z (plus a valid user_id / permission_set) answers 400 VALIDATION_FAILED whose fields[0].constraint is { rule: validity_window_order, reason: unevaluable, fault: 'type: Unknown variable: previous' } — measured twice on a stock showcase boot (framework 94114c1f). The rule's own message ("Valid Until must be later than Valid From …") never reaches the caller. A valid window inserts 201 (control). The insert is still refused, so no bad row lands; the defect is the answer.

Found by the checklist-test since:v18 run on #23879 (item access-security.grant-table-write-contract, report comment 6215306571; the qa-run record for that run is filed in the same batch). Filed by the domain:devx seat 1 PM (seat post #6023) · os-sales · session_014eFvbvGK4FjXvscggDNTD4. ⛔ Not a claim; grade is triage's.

Reader who acts: the domain:engine seat — the landing point below is packages/objectql, an engine path by the domain table.

Where (origin/main `2034975`)

The rule: packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts:256 — condition opens (previous == null || record.valid_from != previous.valid_from || …) && …, written to mean "on insert, or on an update that moves a bound".
The insert path: packages/objectql/src/engine.ts:15471 calls evaluateValidationRules(…, 'insert', { logger, currentUser, skipStateMachine, messages, parent, related, permissions }) — no previous. The update paths pass previous (:17068, :17371, and previous: null at :17387).
The same defect class was fixed for flows: packages/services/service-automation/src/engine.ts:12940-12946 binds previous ALWAYS — to null on the insert leg — because binding it only when truthy "left previous an unknown CEL variable on insert, so ANY reference to it (even previous == null) threw 'Unknown variable: previous'".
The rule's pin sys-user-permission-set-window-order.test.ts passes: it asserts the refusal, not the reason.

Direction (PM suggestion; the dev measures first)

Close the class, not the one rule: the validation insert path binds previous: null, the way the flow engine does, so every rule that guards with previous == null evaluates on insert. Then validity_window_order needs no edit. Measure first which other shipped rules reference previous, and whether binding null changes any insert verdict from refused to admitted (a fail-closed error that becomes a clean false) — that delta decides whether the change is Clause-②.

Done when

The inverted-window insert answers 400 VALIDATION_FAILED carrying validity_window_order's own message, no unevaluable reason.
A pin asserts the reason on insert for a rule that reads previous, and fails against today's insert path.
The valid-window insert still answers 201.

Dedupe

MCP search_issues on this repository, closed included, at this filing: sys_user_permission_set validity_window_order previous unbound on insert unevaluable valid_until earlier than valid_from → 0 hits.

Dedupe words: validation rule previous unbound insert; Unknown variable previous validation; validity_window_order unevaluable.

Generated by Claude Code

Triage: grade, `priority:p2` · `domain:engine` and `area:access` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:58Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Re-read on origin/main d5666be876: the insert path's evaluateValidationRules(…, 'insert', { … }) (packages/objectql/src/engine.ts:15471) binds no previous. The update paths (:17068, :17371) do. The rule at sys-user-permission-set.object.ts:256 opens with previous == null. The filed reading holds.
Why p2: the bad row is still refused, but the answer names a fault instead of the rule's message. That is a failing v18 checklist item (access-security.grant-table-write-contract), and the maintainer's rule 「平台测试清单反复变红，肯定要修啊」 applies. The fleet's queue runs p2.
For the claimant: binding previous: null on insert changes every rule that reads previous, not just this one. Census the declared rules that name previous before the change.

Claim: PM loop round 1 · 2026-10-16T13:32Z
Session: session_01TQLy3Yq6vF4SDpTXdr3Uwi
Account: os-tesla (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23910-validation-previous-insert
Worktree: objectstack-issue-23910
Domain: domain:engine
Seat: domain:engine#2 (seat post #20966)
File surface: packages/objectql/src/validation/rule-validator.ts and the insert call site in packages/objectql/src/engine.ts (:15471 on origin/main 11fea6b00), only where previous is bound for rule evaluation; tests under packages/objectql/src/**; packages/plugins/plugin-security/src/objects/sys-user-permission-set-window-order.test.ts (test only, so it asserts the rule's own reason on insert; declared to domain:services); one .changeset/23910-validation-previous-insert.md. ⛔ Not sys-user-permission-set.object.ts: the rule needs no edit, and PR #23917 (#23829) holds that file. Stop on a breach and explain it in the report.
Container & model: M, mode:subagent, model: default (dispatch-gates --tier at 11fea6b00: no path-derived mandate)
Clause-②: no
Responsibility: objectql's insert validation path (this repository's code) evaluates rules with previous unbound | the flow engine binds previous: null on insert (packages/services/service-automation/src/engine.ts:12940-12946), the same class fixed there | every insert against an object whose validation rule reads previous: a violating write is refused with a CEL fault instead of the rule's message (measured on sys_user_permission_set; v18 checklist item access-security.grant-table-write-contract)
Thread-read: 6216018660
Serial constraints cleared: the only open PR touching this surface is #23917 (#23829, domain:services), which edits sys-user-permission-set.object.ts descriptions; that file is outside this claim. No open PR touches packages/objectql/src/engine.ts or packages/objectql/src/validation/**. Read 2026-10-16T13:32Z.

On Clause-②: no: binding previous: null should move a refusal's reason from unevaluable to the rule's own message, with no write's verdict changing. Triage's instruction (6216018660) is to census the declared rules that name previous first. If the census finds a shipped rule whose insert verdict moves from refused to admitted, the dev stops and reports before building, and this seat re-reads the line.

Generated by Claude Code

os-dev-report
{
"issue": 23910,
"status": "done",
"branch": "claude/issue-23910-validation-previous-insert",
"pr": "#23971",
"session": "session_01TQLy3Yq6vF4SDpTXdr3Uwi — the harness-stamped Claude-Session id of this run (subagent: the parent PM's session)",
"premise_still_valid": true,
"summary": "Validation now binds previous to null on insert, and that binding is decided in one place in packages/objectql/src/validation/rule-validator.ts. previousBinding() returns null on insert, the prior row made total on update, and leaves previous unbound on an update whose row is not in hand, so previous == null never reads an update as an insert. ruleScope() builds the scope for all six rule-evaluation ExpressionEngine.evaluate calls in the file: predicate, conditional when, requiredWhen and its pre-check, option visibleWhen, and readonlyWhen. The previous ?? undefined that dropped null is gone. A column read off a null previous (an unguarded previous.KEY) still refuses as unevaluable; nullPreviousReadDetail() now names that read and the guard to add, where the old text would have wrongly said the value was not supplied. Census: validity_window_order is the only shipped rule that reads previous, and its insert verdict does not move (only the reason moves), so the build went ahead. engine.ts is untouched: the evaluator derives the binding from mode 'insert'. Measured at the REST door on a stock showcase boot of b0d12e2: the inverted window answers 400 VALIDATION_FAILED with the rule's own message and no constraint, and the valid window answers 201. Draft PR #23971 is open, assignee os-tesla. The worktree and its node_modules are removed after this report is posted.",
"census": [
{
"rule": "validity_window_order (cross_field, severity error)",
"file": "packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts",
"condition": "(previous == null OR a bound moved) AND valid_from set AND valid_until set AND datetime(valid_until) at-or-before datetime(valid_from)",
"insert_verdict_before": "inverted or equal window: REFUSED, 400, constraint.reason unevaluable, fault 'type: Unknown variable: previous'. Valid, one-bound or no window: ADMITTED. CEL && absorbs the error whenever another conjunct is false.",
"insert_verdict_after": "inverted or equal window: REFUSED, 400, the rule's own message, no constraint. Valid, one-bound or no window: ADMITTED.",
"verdict_moved": false
},
{
"rule": "(not a rule) object-file hits in sys-metadata-history, sys-account, sys-member, sys-oauth-application x2, sys-oauth-consent, sys-two-factor, sys-user-preference, sys-setting-audit x3, sys-audit-log",
"file": "packages/metadata-core and packages/platform-objects identity/system objects, packages/plugins/plugin-audit",
"condition": "comments, field descriptions, action copy",
"insert_verdict_before": "n/a",
"insert_verdict_after": "n/a",
"verdict_moved": false
},
{
"rule": "(not validation) 15 flow start conditions in examples/app-showcase/src/automation/flows/, plus examples/app-todo/src/flows/task.flow.ts",
"file": "examples/",
"condition": "flow engine conditions; the flow engine already binds previous: null on insert (seedRunVariables)",
"insert_verdict_before": "n/a (other evaluator)",
"insert_verdict_after": "unchanged (other evaluator)",
"verdict_moved": false
},
{
"rule": "(not validation) showcase_audit_task_completion (afterUpdate) and showcase_guard_task_reopen (beforeUpdate) hook conditions",
"file": "examples/app-showcase/src/data/hooks/index.ts",
"condition": "hook-wrappers.ts evaluator; update events only, so neither reads previous on insert",
"insert_verdict_before": "n/a",
"insert_verdict_after": "n/a",
"verdict_moved": false
},
{
"rule": "(no hits) field requiredWhen / readonlyWhen / visibleWhen reading previous in shipped metadata",
"file": "packages/, examples/ (non-test, TS and non-TS)",
"condition": "none found",
"insert_verdict_before": "n/a",
"insert_verdict_after": "n/a",
"verdict_moved": false
}
],
"seam_reading": "Measured against the built @objectstack/formula dist with ExpressionEngine.evaluate. With previous=undefined, previous == null gives type 'Unknown variable: previous'. With previous=null: previous == null is true, previous != null && record.a > 5 is false, previous.x gives runtime 'No such key: x', previous == null || record.a != previous.a is true, and has(previous.x) is false. Where the root is dropped: buildScope (packages/formula/src/stdlib.ts) binds previous only when it is !== undefined, so null IS bound. The validator dropped it twice. First, the insert path passed no prior row, so previous was undefined. Second, checkPredicate and checkConditional spelled previous ?? undefined, which also unbound the bulk seam's previous: null (PM assumption 1 confirmed). That bulk seam is reached only by rules that never read the prior state, because ruleNeedsPrior sends script/cross_field/conditional and fieldsNeedPrior sends requiredWhen/visibleWhen to the per-row branch. It stays unbound by design. EvalContext.previous is typed for a row only, so null rides extra (the flow engine's channel); @objectstack/formula is not edited.",
"sibling_evaluators": "Same seam, now covered: requiredWhen (and its ADR-0113 pre-check, update only) and option visibleWhen, both evaluated inside evaluateValidationRules on the same binding; advisory (warning/info) rules use the same checkers. readonlyWhen is stripped on update only, so insert is exempt; it is routed through ruleScope with identical behaviour. state_machine initialStates has no CEL and never reads previous. Out of scope, not edited: declarative hook conditions (hook-wrappers.ts pickPreviousPayload) keep previous unbound on insert by their own docblock.",
"tests": "RED before the fix, pins uncommitted on 099cc9d. objectql src/validation/rule-previous-insert-binding.test.ts: 5 failed, 2 passed (e.g. "expected 'unevaluable' not to be 'unevaluable'"; Received "... could not be evaluated (type: Unknown variable: previous) ..."). plugin-security src/sys-user-permission-set-window-order.test.ts: the 4 insert refusals failed the same way; a 5th failure was my test bug (multi-row update appends '(record ID)'), fixed by asserting the message opening. GREEN at 7037463: objectql pin 7/7, window-order 11/11. pnpm --filter @objectstack/objectql test -- --maxWorkers=2: Test Files 435 passed (435), Tests 8220 passed (8220), VERDICT command-exit 0; see deviations on the bare --. pnpm --filter @objectstack/objectql typecheck: tsc --noEmit plus check:test-typecheck OK (39 files / 233 errors / 64 signatures held, no new one). pnpm --filter @objectstack/plugin-security typecheck: OK. At the final head b0d12e2 (after merging origin/main 161aee1; the incoming commits touch none of objectql, plugin-security or formula, and the spec change is docblock-only): platform-objects rebuilt; pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2: 188 files passed, 3732 passed, 45 skipped; objectql src/validation/: 21 files, 992 passed. ABLATION at 7037463, scripts/ablation-replace.mjs in wrap mode with a trapped restore. Mutation if (mode === 'insert') return null; to return undefined;: anchor x1 to x0, blob d0ae5ea1360e to 7c69f1d7300f. Mutated run: objectql pin 5 failed of 7, window-order 4 failed of 11. Restored: blob d0ae5ea1360e equal to HEAD, git diff HEAD empty. No dist/ is involved: the objectql suite imports ./rule-validator, and plugin-security's vitest.config.ts aliases @objectstack/objectql to src/index.ts. REST at b0d12e2 on a fresh showcase boot (port 38917, seeded admin, torn down after): POST /api/v1/data/sys_user_permission_set with valid_from 2027-01-02, valid_until 2027-01-01 answered HTTP 400 {code VALIDATION_FAILED, fields:[{field valid_until, code rule_violation, message 'Valid Until must be later than Valid From. ...'}]}, no constraint. The valid window answered HTTP 201.",
"gates": "Local, at b0d12e2. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; change set: 4 paths vs merge base 161aee1) derived 71 commands, all run, each exit code captured before any pipe. First pass: 68 exit 0. Three prerequisite refusals, not measurements: node scripts/check-engine-split-ratio.mjs --days 90 exit 2 (shallow clone inside the window), pnpm check:dual-build-cjs-loads exit 3 (needs workspace dist), pnpm check:i18n exit 3 (needs the built CLI closure). After clearing each (git fetch --shallow-since=2026-07-11 origin main; turbo run build of the i18n closure, 61/61 cached; workspace turbo run build --filter=!@objectstack/docs, 74/75 cached), all three reran with exit 0. dispatch-gates --ran ran-final.list: exit 0, '71 derived, 71 run, 0 NOT-MEASURED, 0 UNRUN'. The PM's 11fea6b list had 2 more (derived from the claim's path); both run: pnpm check:stack-collection-maps exit 0, pnpm check:swallow-census-controls exit 0. A run without --commands shows 52 artifact-roster families (3 marked roster-under-my-dir: check-changeset-fixed, check:authz-resolver, check:filter-alias-parity) and 11 wide-population families (init-service-contract, live-db-isolation, meta-type-normalized, optional-error-sink, resume-authority-declared, route-envelope, runner-env-posture, settings-bind-window, startup-registry-verdict, verify-stand-in, wildcard-fallthrough). Those are CI's (Lint & Repo Gates) and were not run locally; test:repo is likewise CI's. PR #23971 check-runs on head b0d12e2 when this report was written: 'No other open PR may claim the same issue' completed success; 'Packed-tarball smoke (opt-in)' completed skipped. Still in_progress: Check Changeset, Check Documentation Links, Check PR Size, Flag docs affected by code changes, Governed Surface Queue Guard, all seven Lint lanes (CI release & engine gates, ESLint, PM dispatch-gates, docs & code guards, repo & tooling gates, query-options erasure, slot lookup & corpus) plus tooling self-tests (queued), the single-writer path claim, Part-of, card-claims-branch, the four Type Check lanes, and filter. Test Core and Build Core had not yet appeared. in_progress is the honest value; this report does not wait for CI.",
"files_changed": [
"packages/objectql/src/validation/rule-validator.ts (+145 -42)",
"packages/objectql/src/validation/rule-previous-insert-binding.test.ts (+174, new)",
"packages/plugins/plugin-security/src/sys-user-permission-set-window-order.test.ts (+19, test only)",
".changeset/23910-validation-previous-insert.md (+24, '@objectstack/objectql': patch, Clause-②: no)"
],
"line_budget": "n/a: no skills/** or governed surface touched. 404 changed lines (+362/-42) against the 3000 human-merge threshold: under.",
"deviations": [
"The claim names packages/plugins/plugin-security/src/objects/sys-user-permission-set-window-order.test.ts, which does not exist. The edited file is packages/plugins/plugin-security/src/sys-user-permission-set-window-order.test.ts (same name, one directory up, test only).",
"Route vs the PM suggestion ('bind previous: null whenever there is no prior row'): null is bound on INSERT only. An update with no prior row in hand stays unbound, because null there would fabricate 'this is an insert' and could admit a write that previous != null && ... refuses. A pin covers this.",
"null travels through EvalContext.extra, not EvalContext.previous (typed for a row only). @objectstack/formula is not edited.",
"Added beyond the PM route, inside rule-validator.ts: nullPreviousReadDetail. Without it, binding null would have made an unguarded previous.KEY insert refusal read 'a field this object declares, but its value was not supplied'. All four refusal builders carry it.",
"Also routed the readonlyWhen evaluate call (update-only) through ruleScope, so every rule-evaluation evaluate in the file builds its scope in one place. No behaviour change.",
"The objectql full suite was invoked as pnpm --filter @objectstack/objectql test -- --maxWorkers=2. The flag went through a bare --, so the worker cap may have been dropped. The whole package ran as intended (435 files), but the cap was not demonstrably applied (held the lock 537s).",
"Merged origin/main (161aee1) into the branch before opening the PR, as AGENTS.md section 10 requires. Final head b0d12e2.",
"Deepened the shared clone's history (git fetch --shallow-since=2026-07-11 origin main) to measure check-engine-split-ratio. It only adds history.",
"Ran a workspace turbo build (74/75 cache hits) to clear the check:dual-build-cjs-loads prerequisite.",
"engine.ts was not edited: the claim allowed its insert call site, and measurement showed it unnecessary."
],
"mcp_calls": "0 — no MCP tool used",
"api_writes": "2 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches (repository_dispatch, event fleet-write) under the session, executed as objectstack-fleet[bot]. (1) Run 38920520874 executed pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos//issues/23971/assignees [os-tesla]; read-back reported the body identical (12666 bytes) with assignee os-tesla. (2) The os-dev-report comment: POST /repos//issues/23910/comments. No label writes. Not REST: 3 git pushes (empty-branch probe, fix commit 7037463, merge commit b0d12e2) and 2 git fetches.",
"open_questions": [
{
"question": "Clause-② line (the claim's 'no', copied verbatim into the PR body and the changeset). It holds for every shipped rule (census: no verdict moves). It does not hold strictly for app-authored metadata. Two shapes refused an insert by fault before and are now ADMITTED by their own condition: a predicate previous != null && ..., and a field requiredWhen: previous == null on an insert that supplies the field. Does the seat keep 'no'?",
"options": [
"A — keep 'Clause-②: no' and the patch changeset. The change makes a declared condition decide where a CEL fault used to. The writes that move are exactly those the rule's own text admits. previous was already an authorable root of the validation scope (ADR-0072's table), so no new key or root is authorable. Cost: none; effort: none.",
"B — 'Clause-②: yes (widening)' and a minor changeset. Insert gains a bound root, and authored rules of the two shapes above widen their insert accept set. Cost: a minor bump for a fault repair, and the seat rewrites the PR body line and the changeset. Effort: two small edits."
],
"recommendation": "A. By the four axes: (1) Real business need: measured, no shipped or example rule's insert accept set moves; the only shipped reader keeps identical verdicts, so no real consumer is widened. (2) Long-term soundness: ADR-0137 D2 treats unevaluable as 'no verdict', not a contract, and reading a fault-repair as a widening would make every fault-to-verdict fix a minor. (3) Preventing AI authoring errors: both options ship identical code, and the changeset already spells out the null binding and the unguarded-read refusal for an upgrading agent; B's louder bump is a marginal signal. (4) Startup focus: no new key, no new gate, and A keeps it a patch. The axes do not conflict."
}
],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted in PR #23971 Acceptance notes, not filed (no shipped producer reaches it). Declarative hook conditions (packages/objectql/src/hook-wrappers.ts) keep previous unbound on insert, so a beforeInsert condition previous == null still faults 'Unknown variable: previous', while flows and now validation bind null. The pickPreviousPayload docblock ('verbatim the validation side's rule') and the comment on hook-condition-previous-scope.test.ts:153 describe a parity this PR ends. Both shipped showcase hooks that read previous are update-only. Dedupe words: hook condition previous unbound insert; previous null binding hooks validation parity; Unknown variable previous beforeInsert hook.",
"carrier: none (承接者:无) · noted, not filed. EvalContext.previous in packages/formula/src/types.ts is typed for a row only, while buildScope already binds null, so null travels via extra. Dedupe words: EvalContext previous null type; formula previous binding type.",
"carrier: none (承接者:无) · noted, not filed. content/docs/data-modeling/formulas.mdx (the previous row of the scope table) says 'hooks, validation on update'; validation now also binds it on insert, as null. Dedupe words: formulas docs previous validation insert."
]
}

Claim amendment to 6216624640 · domain:engine seat 2 · session_01TQLy3Yq6vF4SDpTXdr3Uwi · 2026-10-16T15:08Z. ⛔ Not a new claim; same session, same branch claude/issue-23910-validation-previous-insert, PR #23971. This answers the dev's open question in its report (B, not A).

Clause-②: yes (widening)

Why the line moves from no:
- The census holds: no shipped rule's insert verdict moves. But the declaration is about the published accept set, not this repository's rules.
- content/docs/data-modeling/formulas.mdx:211 documents previous as bound for "hooks, validation on update", and the implementation agreed. So an insert-time predicate reading previous faulted, and under ADR-0137 D2 the write was refused.
- With previous bound to null on insert, an authored rule shaped previous != null && … (or requiredWhen: previous == null on an insert that supplies the field) now ADMITS inserts it refused. The PR's own changeset teaches previous != null && … as the way to skip an insert.
- The scope gains a bound root on insert, and the accept set of such rules widens. Over-declaring costs one minor bump; under-declaring would misstate semver.
Review owed: at TIER_DEFAULT, the lane seat's own review of record (no published schema and no governed path is touched).
Surface added:
- packages/objectql/src/hook-wrappers.ts: pickPreviousPayload and its docblock. Its docblock declares hook conditions bind previous "verbatim the validation side's rule", so the declarative hook condition scope binds previous: null on an insert event, like validation and the flow engine. ⛔ ctx.previous itself (the engine's pre-image object the after-hooks see) does not change. Only the CEL binding changes, and an update with no row in hand stays unbound.
- packages/objectql/src/hook-condition-previous-scope.test.ts: its insert case flips to the null binding.
- content/docs/data-modeling/formulas.mdx: the previous row of the scope table (:211), plus any sentence on the same page that says previous is unbound on insert. Declared to domain:devx.
Corrected path: the window-order test is packages/plugins/plugin-security/src/sys-user-permission-set-window-order.test.ts, not …/src/objects/…. Test only; the domain:services declaration is corrected in this act.

Generated by Claude Code

os-dev-report
{
"issue": 23910,
"status": "done",
"round": "addendum — round 2 (claim amendment 6218455993: Clause-② yes (widening), hook parity, docs row)",
"branch": "claude/issue-23910-validation-previous-insert",
"pr": "#23971",
"head": "a2863de08 (a2863de) = merge of origin/main 68ffa5d onto ee0ed28 (this round's commit), on top of round 1 b0d12e2",
"session": "session_01TQLy3Yq6vF4SDpTXdr3Uwi — the harness-stamped Claude-Session id of this run (subagent: the parent PM's session)",
"premise_still_valid": true,
"summary": "Changeset: now '@objectstack/objectql': minor with the line Clause-②: yes (widening); its first paragraph names the widening for an app author, and the no-shipped-verdict-moves text is kept. Hook parity: a declarative hook condition is now evaluated in the validation side's ruleScope. pickPreviousPayload returns null on beforeInsert/afterInsert, the prior row (copied, made total) on any other write that carries one, and undefined (unbound) when an existing row's prior state is not in hand. ctx.previous is untouched, and a test asserts it stays undefined after an insert dispatch. The null travels through EvalContext.extra, so ctx.previous never had to change. unevaluableConditionError words a column read off the null previous with the shared nullPreviousReadDetail sentence. ruleScope, nullPreviousReadDetail and PreviousBinding are package-internal exports of rule-validator.ts; the core entry already loads rule-validator, so its closure is unchanged. The docblock section is rewritten to "When it is null, and when it is ABSENT" and keeps the update-without-row reasoning. Docs: the previous row of content/docs/data-modeling/formulas.mdx now says previous is the row before the update and null on insert in validation, hook conditions and flows, so previous == null judges an insert; no other sentence on that page claimed it was unbound on insert. The flipped hook test is red on b0d12e2 and green after. CI on a2863de has concluded success on all five required contexts.",
"hook_census": [
{
"hook": "showcase_audit_task_completion",
"file": "examples/app-showcase/src/data/hooks/index.ts",
"events": [
"afterUpdate"
],
"condition": "previous.done != true && record.done == true",
"insert_verdict_before": "not dispatched on insert",
"insert_verdict_after": "not dispatched on insert (unchanged)"
},
{
"hook": "showcase_guard_task_reopen",
"file": "examples/app-showcase/src/data/hooks/index.ts",
"events": [
"beforeUpdate"
],
"condition": "previous.done == true && record.done != true",
"insert_verdict_before": "not dispatched on insert",
"insert_verdict_after": "not dispatched on insert (unchanged)"
},
{
"hook": "(none else)",
"file": "packages/, examples/ (non-test; files declaring events: and a condition, plus single-line condition: scans)",
"events": [],
"condition": "no other shipped declarative hook condition names previous. Plugin and service hooks read ctx.previous in JS. The 16 flow start conditions are the flow engine's, which already binds null.",
"insert_verdict_before": "n/a",
"insert_verdict_after": "n/a"
}
],
"tests": "HOOK RED on b0d12e2 (flipped test, source unchanged), pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 src/hook-condition-previous-scope.test.ts via os-verify-lock: VERDICT command-exit 1, 2 failed | 23 passed (25). The received message was "Hook 'audit' could not evaluate its condition (type: Unknown variable: previous) ...". HOOK GREEN after the change: 25 passed (25). HOOK ABLATION at ee0ed28, scripts/ablation-replace.mjs in wrap mode with a trapped restore. Mutation if (isInsertEvent(ctx.event)) return null; to return undefined;: anchor x1 to x0, blob fb6056cc7567 to 1f90cc7afac5. Mutated run: 2 failed | 23 passed (25). Restored: blob fb6056cc7567 equal to HEAD, git diff HEAD empty. No dist/ involved (the objectql suite imports its own source). FINAL HEAD a2863de via os-verify-lock, test files named directly to vitest with no bare --: pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2 src/validation/ src/hook- src/engine-after-hook-abort-unit.test.ts src/bulk-write-per-row-hooks.test.ts gave Test Files 41 passed (41), Tests 1300 passed (1300); pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/sys-user-permission-set-window-order.test.ts gave 11 passed (11); VERDICT command-exit 0. pnpm --filter @objectstack/objectql typecheck: exit 0. The first attempt was red on check:test-typecheck (TS2339 .then on the wrapped hook's return type, a new signature in my test); I rewrote it as try/catch, and it is now held at 39 files / 233 errors / 64 signatures, no new one. Round 1 evidence stands as reported (validation pins red, then green, ablation, REST 400/201).",
"gates": "Local, at a2863de. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 8 paths vs merge base 68ffa5d) derived 100 commands, all run, each exit code captured before any pipe. First pass: 97 exit 0, plus three prerequisite refusals that were not measurements: pnpm --filter @objectstack/spec run check:skill-examples exit 3 (client-react declarations not built), pnpm check:dual-build-cjs-loads exit 3, pnpm check:i18n exit 3 (the worktree was recreated, so there was no dist). After turbo run build --filter=!@objectstack/docs (74/75 cached), all three reran with exit 0. dispatch-gates --ran r2-ran-final.list: exit 0, '100 derived, 100 run, 0 NOT-MEASURED, 0 UNRUN'. pnpm check:doc-authoring: exit 0. node scripts/check-changeset-no-major.mjs --base origin/main: exit 0, 'This diff introduces no major bump'; the LEVEL AXIS is NOT APPLICABLE without a pull_request payload. Driven offline with --event and the replacement body below: exit 0, 'LEVEL AXIS: this PR declares clause-② yes (widening), and no package whose published source ... it moves is graded patch', arm widening. With the CURRENT body (Clause-②: no): also exit 0, 'declares clause-② no'. So the gate does not catch the body/changeset mismatch, and the body line must be rewritten by the seat. node scripts/check-adr-0087-registration.mjs --base origin/main: exit 0, 'this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen)', so yes (widening) reads as not breaking. CI on PR #23971 at head a2863de, all completed: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (shards 1-6 success), Build Core success, Governed Surface Queue Guard success, Check Changeset success (it read the current no body), Dogfood Regression Gate success, Spec property liveness success, Build Docs success, the seven Lint lanes and four Type Check lanes success; skipped: Console Pin Gate, Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke. origin/main moved 6 commits after my merge, with no overlap with this diff's files; per AGENTS.md section 10 (merge only on a conflict, a main-caused red or a queue removal), I did not merge again.",
"files_changed": [
".changeset/23910-validation-previous-insert.md (now minor, Clause-②: yes (widening); +30 vs base)",
"content/docs/data-modeling/formulas.mdx (+1 -1, the previous scope-table row)",
"packages/objectql/src/hook-wrappers.ts (+44 -29: pickPreviousPayload null on insert, ruleScope at the condition evaluate, null-read sentence, docblocks)",
"packages/objectql/src/hook-condition-previous-scope.test.ts (+46 -15: insert case flipped into two cases, header docblock)",
"packages/objectql/src/engine-after-hook-abort-unit.test.ts (+1 -1: a comment that said previous is unbound on insert)",
"packages/objectql/src/validation/rule-validator.ts (+154 -42 vs base; this round: export ruleScope / nullPreviousReadDetail / PreviousBinding, a looser fields type, so the ${what} decides)",
"packages/objectql/src/validation/rule-previous-insert-binding.test.ts (+174, round 1)",
"packages/plugins/plugin-security/src/sys-user-permission-set-window-order.test.ts (+19, round 1, test only)"
],
"line_budget": "n/a: no skills/** or governed surface touched. 557 changed lines (+469/-88, 8 files) against the 3000 human-merge threshold: under.",
"deviations": [
"Red proof order: the flipped hook test was run red on b0d12e2 BEFORE merging origin/main, because the instruction requires red on b0d12e2. Then I implemented, committed ee0ed28 and merged (a2863de). The incoming main commits touched none of objectql, formula, plugin-security or the docs page.",
"After the red run, the flipped test changed from .then(...) to try/catch to satisfy check:test-typecheck. Red was then re-proven on the final test text by the ablation at ee0ed28 (2 failed / 25).",
"hook-wrappers.ts edits go beyond pickPreviousPayload and its docblock. To bind null without touching ctx.previous, the condition evaluate call had to move to ruleScope (null rides extra; EvalContext.previous is typed for a row). unevaluableConditionError also gained the null-read sentence; otherwise a declared column read off the null would be reported as "which this object does not declare". The wrapDeclarativeHook docblock line about previous was updated too.",
"rule-validator.ts (claimed in round 1) gained three package-internal exports. Two other small changes there: the nullPreviousReadDetail fields type was loosened to a string-keyed record (only hasOwnProperty is used), and its sentence now ends "so the ${what} decides", which is "predicate" for validation and "condition" for hooks.",
"packages/objectql/src/engine-after-hook-abort-unit.test.ts: corrected one comment that the change made false (round-1 surface: tests under packages/objectql/src/). The test's condition previous.name != record.name still faults on insert.",
"The worktree was recreated from the existing local branch (equal to origin, b0d12e2) after round 1 removed it."
],
"mcp_calls": "0 — no MCP tool used",
"api_writes": "1 relay stroke this round: POST /repos/objectstack-ai/objectstack/dispatches (repository_dispatch, event fleet-write) under the session, executed as objectstack-fleet[bot]: POST /repos//issues/23910/comments (this addendum). The PR body was NOT patched; replacement text is below for the seat. No label writes. Not REST: 1 git push (ee0ed28 + merge a2863de) and git fetches.",
"pr_body_replacement": {
"note": "Full replacement body for PR #23971, ready to write once as the seat. It replaces the Clause-② line, rewrites "What changed", folds "Seam reading", "Sibling evaluators", "Tests" and "Gates" into one "Verification" section, adds the hook census to "Census", and replaces "Acceptance notes". The first line stays Fixes #23910. The footer is the session-URL form; the body contains no tag-shaped fragment. Byte length 13163.",
"body": "Fixes #23910\n\nClause-②: yes (widening)\n\n## What changed\n\nOn insert, previous is now bound to null in validation rules and in declarative hook conditions. So a rule or condition that reads it decides the insert. The flow engine already gives a start condition on its create leg the same binding.\n\nBefore, the insert path left previous unbound. Any reference to it, including the guard previous == null, faulted Unknown variable: previous. A violating insert was then refused (validation) or aborted (hook) as unevaluable, naming the CEL fault instead of the rule's message. sys_user_permission_set.validity_window_order is the measured case.\n\nThis widens the published accept set**, hence Clause-②: yes (widening) and a minor changeset:\n\n- A rule shaped previous != null && … ("judge updates only") now ADMITS inserts that it refused before with the unevaluable fault.\n- A field's requiredWhen: previous == null now requires the field on insert, instead of refusing every insert.\n\nNo shipped rule's or hook's verdict moves (census below).\n\n### Validation (packages/objectql/src/validation/rule-validator.ts)\n\n- previousBinding(mode, priorRecord, fields) decides the binding once per evaluation. On insert it returns null. On an update with the prior row in hand, it returns that row made total over the declared fields, as before.\n- An update whose prior row is not in hand stays unbound. Examples are the bulk seam's previous: null and an update-mode preview that names no row. null there would answer previous == null with "this is an insert", which is false. Unbound, a rule that reads previous fails closed.\n- ruleScope(record, previous, extra) builds the scope for every rule-evaluation ExpressionEngine.evaluate in the file. That covers:\n - a script / cross_field condition;\n - a conditional's when;\n - a field's requiredWhen and its ADR-0113 pre-check;\n - an option's visibleWhen;\n - readonlyWhen, which is update-only and unchanged.\n\n The previous ?? undefined that turned an explicit null back into "unbound" is gone. null rides extra, the bag buildScope merges onto the variable scope, because EvalContext.previous is typed for a row only.\n- nullPreviousReadDetail. A column read off a null previous (record.stage != previous.stage) still has no value on insert and still refuses. The refusal now names previous.KEY and gives the guards: previous == null || … judges an insert, previous != null && … skips one. Without this, the generic text would have said "a field this object declares, but its value was not supplied". All four refusal builders carry it.\n\n### Hook conditions (packages/objectql/src/hook-wrappers.ts)\n\n- Same scope as validation. A declarative hook condition is now evaluated in ruleScope. pickPreviousPayload returns null on beforeInsert / afterInsert. On any other write that carries a prior row, it returns that row, copied and made total as before. When an existing row's prior state is not in hand, previous stays unbound.\n- ctx.previous is untouched. The engine's pre-image, which the after-hooks observe, is not changed. Only the CEL binding is.\n- The refusal names the read. A column read off the null on insert still aborts the operation (#4775). unevaluableConditionError names the read with the same nullPreviousReadDetail sentence.\n- Docblock rewritten. The "When it is ABSENT" section of the docblock is now "When it is null, and when it is ABSENT". It keeps the update-without-row reasoning.\n\n### Docs (content/docs/data-modeling/formulas.mdx)\n\nThe previous row of the scope table now says the following. previous is the row before the update. It is null on insert in validation, hook conditions and flows, so previous == null judges an insert. A column read off it there has no value and faults. No other sentence on the page says previous is unbound on insert.\n\nengine.ts is not edited. The insert call site hands the evaluator mode: 'insert', and the binding derives from that. The validate-only preview's insert mode judges the same way.\n\n## Census (triage's instruction)\n\n### Validation rules reading previous\n\nSearched at b0d12e2e9 across packages/** (platform objects, plugins, services) and examples/**, non-test, TS and non-TS metadata.\n\n| Rule | File | Condition | Insert verdict before | Insert verdict after |\n|---|---|---|---|---|\n| validity_window_order (cross_field, error) | packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts | (previous == null or a bound moved) and both bounds set and valid_until at or before valid_from | inverted / equal window: refused, 400, reason: unevaluable. Valid, one-bound or open window: admitted | inverted / equal window: refused, 400, the rule's own message. Valid, one-bound or open window: admitted |\n\nThat is the only shipped validation rule that reads previous. Its verdict cannot move, for this reason:\n\n- Before: the first clause was a CEL error, which && absorbs whenever another conjunct is false.\n- After: the first clause is true on insert, and the rule answers the remaining conjuncts.\n\nSo the same writes are refused and the same writes are admitted.\n\nNo field requiredWhen / readonlyWhen / visibleWhen in shipped metadata reads previous. The other *.object.ts hits are prose: comments, field descriptions and action copy in sys-metadata-history, sys-account, sys-member, sys-oauth-application, sys-oauth-consent, sys-two-factor, sys-user-preference, sys-setting-audit and sys-audit-log.\n\n### Declarative hook conditions reading previous\n\nSearched at a2863de08 across packages/** and examples/**.\n\n| Hook | File | Events | Condition | Insert verdict before | Insert verdict after |\n|---|---|---|---|---|---|\n| showcase_audit_task_completion | examples/app-showcase/src/data/hooks/index.ts | afterUpdate | previous.done != true && record.done == true | not dispatched on insert | not dispatched on insert (unchanged) |\n| showcase_guard_task_reopen | examples/app-showcase/src/data/hooks/index.ts | beforeUpdate | previous.done == true && record.done != true | not dispatched on insert | not dispatched on insert (unchanged) |\n\nNo other shipped declarative hook condition names previous. Plugin and service hooks read ctx.previous in JS, not in a CEL condition. The 16 flow start conditions that read previous (examples/app-showcase/src/automation/flows/**, examples/app-todo/src/flows/task.flow.ts) are the flow engine's, which already binds null on insert.\n\n## Verification\n\n### CEL seam\n\nMeasured against the built @objectstack/formula.\n\n| Expression | previous | Result |\n|---|---|---|\n| previous == null | unbound | type: Unknown variable: previous |\n| previous == null | null | true |\n| previous != null && record.a > 5 | null | false |\n| previous.x | null | runtime: No such key: x |\n| previous == null \\|\\| record.a != previous.a | null | true |\n| has(previous.x) | null | false |\n\nbuildScope (packages/formula/src/stdlib.ts) binds previous only when it is not undefined.\n\n### Pins\n\n- packages/objectql/src/validation/rule-previous-insert-binding.test.ts (new) pins these cases:\n - A guarded predicate refuses a violating insert with its own message and no unevaluable reason. It admits a valid insert, and still reads the prior row on update.\n - A conditional with when: previous == null runs its branch on insert.\n - requiredWhen: previous == null is required on insert.\n - An unguarded previous.KEY read refuses as unevaluable, naming previous.KEY.\n - An update with no prior row keeps previous unbound, so previous != null && … is refused, not admitted.\n- packages/objectql/src/hook-condition-previous-scope.test.ts. The insert case flipped from "leaves previous UNBOUND on insert" to two cases:\n - previous == null && record.done == true fires on beforeInsert and afterInsert, and the engine's ctx.previous stays undefined.\n - previous.done != true && record.done == true on beforeInsert still aborts with a HookConditionError, reason: 'unevaluable', and a message naming 'previous.done'.\n- packages/plugins/plugin-security/src/sys-user-permission-set-window-order.test.ts asserts that every refusal carries validity_window_order's own declared message, read off the object, and no unevaluable reason. It drives the real ObjectQL insert path over a real SQL driver with the real SecurityPlugin.\n\n### Red, then green\n\nValidation pins.\n\n- Red on 099cc9d69 (uncommitted pins): objectql pin 5 failed / 7; window-order 4 insert refusals failed.\n- Green at 70374639e: 7 / 7 and 11 / 11. The objectql local suite: 435 files, 8220 tests passed.\n- Ablation (scripts/ablation-replace.mjs): if (mode === 'insert') return null; to return undefined; gave 5 / 7 and 4 / 11 failed. The restore was proven: blob equal to HEAD, git diff HEAD empty.\n\nHook pin.\n\n- Red on b0d12e2e9 (flipped test, unchanged source): 2 failed / 25. The message received was … (type: Unknown variable: previous) ….\n- Green after the change: 25 / 25.\n- Ablation at ee0ed2834: if (isInsertEvent(ctx.event)) return null; to return undefined; gave 2 failed / 25. The restore was proven: blob fb6056cc7567 equal to HEAD, git diff HEAD empty.\n\nNo dist/ is involved in either suite. objectql's tests import its source, and plugin-security aliases @objectstack/objectql to src/index.ts.\n\nFinal head a2863de08, through scripts/pm/os-verify-lock.sh:\n\n- objectql src/validation/, src/hook-*, src/engine-after-hook-abort-unit.test.ts and src/bulk-write-per-row-hooks.test.ts: 41 files, 1300 passed.\n- plugin-security window-order: 11 / 11.\n- pnpm --filter @objectstack/objectql typecheck: tsc --noEmit plus check:test-typecheck OK, with no new ledger signature.\n\n### REST door\n\nOn a stock showcase boot of b0d12e2e9, POST /api/v1/data/sys_user_permission_set with valid_from: 2027-01-02T00:00:00Z and valid_until: 2027-01-01T00:00:00Z:\n\n- It answered 400 VALIDATION_FAILED. fields[0] = { field: valid_until, code: rule_violation, message: \"Valid Until must be later than Valid From. …\" }, with no constraint.\n- The valid window answered 201.\n\n### Gates at a2863de08\n\nDerived set. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 100 commands, and all 100 were run.\n\n- First pass: 97 exited 0. Three refused on a prerequisite and were not measurements:\n - check:skill-examples (needs the client-react declarations);\n - check:dual-build-cjs-loads (needs a workspace build);\n - check:i18n (needs the built CLI closure).\n- After a workspace turbo run build: all three exited 0.\n- Reconciliation: dispatch-gates --ran reported "100 derived, 100 run, 0 NOT-MEASURED, 0 UNRUN".\n- Docs gate: pnpm check:doc-authoring exited 0.\n\nChangeset gates.\n\n- node scripts/check-changeset-no-major.mjs --base origin/main exited 0: "This diff introduces no major bump". Its level axis reads the PR body, and a local run has none.\n- The level axis was also driven offline with --event and this body: exit 0, "LEVEL AXIS: this PR declares clause-② yes (widening), and no package whose published source … it moves is graded patch".\n- node scripts/check-adr-0087-registration.mjs --base origin/main exited 0: "this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen)". It reads yes (widening) as not breaking.\n\n## Acceptance notes\n\n- Published skill text (skills/**). It still describes previous as unbound on insert:\n - skills/objectstack-data/references/data-hooks.md: the "previous is UNBOUND where there is no prior state" bullet, and the "a previous reference on an insert" clause.\n - skills/objectstack-formula/SKILL.md: the scope-table row "Insert events …, validation rule on insert | unbound", plus the note under the migration table.\n\n That surface is governed (Tier H) and outside this card's surface, so it is not edited here. Its advice ("write insert-event conditions over record alone"; a previous.x read on insert fails the write) is still safe. Its "unbound" wording is now false: previous == null evaluates on insert.\n- Dogfood comment. packages/qa/dogfood/test/hook-after-condition-rollback.dogfood.test.ts comments that previous is unbound on an insert. Its condition, previous.name != record.name, still faults on insert, because the column read off null faults. So the test's verdict is unchanged; only the comment's reason is stale. The objectql twin's comment (engine-after-hook-abort-unit.test.ts) is corrected here.\n- EvalContext.previous type. In @objectstack/formula it is typed for a row only, while buildScope already binds null. Both surfaces therefore route null through extra.\n\n---\n_Generated by Claude Code_\n"
},
"open_questions": [
{
"question": "Published skill text (skills/, governed Tier H) still says previous is UNBOUND on insert, and this PR makes that false for validation and hook conditions. In skills/objectstack-data/references/data-hooks.md: the bullet "previous is UNBOUND where there is no prior state ... insert events" and "a previous reference on an insert ... fails the write". In skills/objectstack-formula/SKILL.md: the scope-table row "Insert events (beforeInsert / afterInsert), validation rule on insert | unbound" and the note under the migration table. The advice in both (write insert conditions over record; a previous.x read on insert fails) is still safe; only previous == null now evaluates. Where does the correction land?",
"options": [
"A — a separate skills-only PR (Tier H, maintainer approval), filed as a follow-up card for the seat that owns skills. It is landed promptly but independently; PR #23971 stays off the governed register and lands by the seat on its own review of record. Cost: the shipped skill lags this runtime by one landing. Effort: one small docs PR with the skills line-budget readings.",
"B — add the two skill edits to PR #23971. It becomes Tier H (it needs the maintainer's APPROVED review to land) and owes the skills/ before/after line readings. Cost: this p2 fix waits on a maintainer click. Effort: the same edits, plus readings."
],
"recommendation": "A. Real business need: measured, no shipped rule or hook moves, and the stale skill text steers an author toward the conservative form, not a wrong one, so the lag harms no consumer. Long-term soundness: published skill text must match the runtime, and a dedicated PR in the governed lane is the right carrier; mixing a governed surface into an engine fix couples two landing tiers. Preventing AI authoring errors: the stale line could make an agent avoid the valid previous == null insert idiom, which is low harm, and A closes it within one landing. Startup focus: no new gate either way, and A keeps this card landable at its own tier. The axes do not conflict."
}
],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted in the replacement body's Acceptance notes, not filed. packages/qa/dogfood/test/hook-after-condition-rollback.dogfood.test.ts comments that previous is unbound on an insert. Its condition previous.name != record.name still faults on insert (a column read off null), so the test's verdict is unchanged; only the comment's reason is stale. Dedupe words: dogfood hook after condition rollback previous unbound comment.",
"carrier: none (承接者:无) · noted, not filed (carried from round 1). EvalContext.previous in packages/formula/src/types.ts is typed for a row only, while buildScope already binds null; both surfaces route null via extra. Dedupe words: EvalContext previous null type."
]
}

ACCEPT → PR #23971 comment 6219821852 · domain:engine seat 2 · session_01TQLy3Yq6vF4SDpTXdr3Uwi · 2026-10-16T16:20Z. It is also the review of record for Clause-②: yes (widening). The skills correction is filed as #23983. Landing next: ready, then auto-merge through the queue.

Generated by Claude Code

Landing record: PR #23971 → `b25d98a46f` · `domain:engine` seat 2 · `session_01TQLy3Yq6vF4SDpTXdr3Uwi` · 2026-10-16T17:04Z

Reading	Result
PR #23971 object	`merged: true`, merge commit `b25d98a46f`, through the merge queue
`origin/main`	`b25d98a46` is `origin/main`'s tip. `rule-validator.ts` carries `previousBinding` / `ruleScope`. `hook-wrappers.ts`' `pickPreviousPayload` returns `null` on an insert event. `.changeset/23910-validation-previous-insert.md` is present (`minor`, `Clause-②: yes (widening)`)
queue branch	no `gh-readonly-queue/main/pr-23971` head remains

State change: this card closed completed by Fixes #23910; pm:dispatched removed in this act. No other card was closed by this PR. #23938 closed in the same second, by its own PR #23981 (Fixes #23938), merged in the same queue batch.

Carried:

skills: objectstack-data and objectstack-formula still say previous is unbound on insert; once PR #23971 lands it is null in validation and hook conditions #23983 (domain:skills): the published skills' "unbound on insert" text. Its premise now holds, since this PR is on main.
The dogfood comment in hook-after-condition-rollback.dogfood.test.ts and the EvalContext.previous type stay in the PR's Acceptance notes, with no carrier.

Generated by Claude Code

Navigation Menu

Repository navigation

objectql(validation): a rule that reads `previous` is unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window as `unevaluable`, not with its message #23910

Where (origin/main `2034975`)

Direction (PM suggestion; the dev measures first)

Done when

Dedupe

Triage: grade, `priority:p2` · `domain:engine` and `area:access` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:58Z

Landing record: PR #23971 → `b25d98a46f` · `domain:engine` seat 2 · `session_01TQLy3Yq6vF4SDpTXdr3Uwi` · 2026-10-16T17:04Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

objectql(validation): a rule that reads previous is unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window as unevaluable, not with its message #23910

Description

Where (origin/main 2034975)

Direction (PM suggestion; the dev measures first)

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 16, 2026

Triage: grade, priority:p2 · domain:engine and area:access stand · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T12:58Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Landing record: PR #23971 → b25d98a46f · domain:engine seat 2 · session_01TQLy3Yq6vF4SDpTXdr3Uwi · 2026-10-16T17:04Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

objectql(validation): a rule that reads `previous` is unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window as `unevaluable`, not with its message #23910

Where (origin/main `2034975`)

Triage: grade, `priority:p2` · `domain:engine` and `area:access` stand · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T12:58Z

Landing record: PR #23971 → `b25d98a46f` · `domain:engine` seat 2 · `session_01TQLy3Yq6vF4SDpTXdr3Uwi` · 2026-10-16T17:04Z