spec: two docblocks name the wrong mechanism, ActionParam.options's visibleWhen bullet (objectui's inline branch is options: authoredOptions) and conversions/registry.ts's master-update refusal (the record validator, not the security gate) #24187

Filing gate ①: wrong text with a named landing; the first item is published (files[] ships src/**/*.zod.ts).

• reach: the @objectstack/spec tarball for item 1. Item 2 is repo-internal (conversions/registry.ts is not in files[]). It is one family: a docblock that states the mechanism wrong. It is filed with item 1 because it is follow-up work owed by landed reviews.

Filed by the domain:spec seat 2 (#18549) · huangyiirene · session session_01HSDGREvqxQUt7K7pjHXMyC, at its shift close. Both were carried on the seat post as "rides the next PR that edits the file", which is not a carrier, so they get a card. ⛔ Not a claim. Lane, grade and area:* are triage's.

Measured on origin/main 727091c82

1. packages/spec/src/ui/action.zod.ts:251, the ActionParam.options docblock's visibleWhen bullet, reads: "objectui resolveActionParam's inline branch does options: param.options". At the console pin (.objectui-sha 5e15928b46), objectui packages/fields/src/resolveActionParams.ts:574 and :634 read options: authoredOptions.
   • The bullet's point, that an inline param's options are lowered verbatim, still holds.
   • Only the quoted expression is stale.
   • Found by the seat's ACCEPT on PR docs(spec): describe objectui's normaliseOptions as it is at the console pin #24072 and carried in its landing record 6229226099.
2. packages/spec/src/conversions/registry.ts:14224–:14225, the cbp-master-detail-required-defaulted conversion's docblock, reads: "the write the row could not legally take (an insert without its master, an update nulling it) was refused before as well, by the security gate".
   • The insert half is true.
   • The update half is not. assertControlledByParentWrite reads opCtx.data only on the insert leg. An update that nulls a non-required master's FK is refused by the record validator's ADR-0113 check, which required: true arms.
   • Found by contract review 6142098559 item A on PR feat(spec)!: a controlled_by_parent object derives its master from exactly one required master_detail; the runtime's fallback tiers retire (#23100) #23179.

The work

One PR, comment text only:

• Correct the quoted expression in item 1 to what the pin reads, or drop the quote and keep the point.
• Correct item 2's update half to name the record validator.
• No key, export, accepted value or message text changes: Clause-②: no, and a patch changeset for @objectstack/spec, because item 1 ships in the tarball (the PR docs(spec): describe objectui's normaliseOptions as it is at the console pin #24072 precedent).

Reader who acts: the domain:spec seat, one PR on these two files. conversions/registry.ts is a shared hot file, so read the live claims first.

Dedupe

MCP search_issues on objectstack-ai/objectstack, closed included: docblock wrong mechanism ActionParam options visibleWhen param.options authoredOptions conversions registry security gate nulling master → 1 hit, #24047 (closed). That card fixed the same docblock's normaliseOptions sentence, not this bullet.

Dedupe words: ActionParam options visibleWhen param.options authoredOptions docblock; cbp master update nulling security gate record validator docblock.

Generated by Claude Code