[objectstack-fleet]

Closes #24720
Clause-②: no

What changes

A validations[] rule's predicates are evaluated by ObjectQL in ruleScope(record, previous) (packages/objectql/src/validation/rule-validator.ts, checkPredicate and checkConditional). That scope binds record and previous, and no master-detail header. The header is bound as parent only for a field's own readonlyWhen / requiredWhen, on an object with exactly one master_detail. A rule that read parent (for example parent.status == 'paid') passed os validate silently, because parent is a SCOPE_ROOTS member and the bare-reference check stays silent on it. At runtime every write the rule judged was refused as unevaluable (Unknown variable: parent), the seed's rows at boot included.

• A root verdict on the rule's own predicates, at warning in 18.x. validationRuleParentIssue in packages/lint/src/validate-expressions.ts reports a predicate that reads parent. It covers a script / cross_field rule's condition, a conditional rule's when, and the same two slots on every rule nested in its then / otherwise. "Reads parent" is decided from the parsed AST (readsParentRoot, the same reader the field-rule verdict uses), so record.parent_code and the string 'parent' are not judged.
• Location and prescription. The finding is located where check() locates the same predicate (object 'NAME' · validation 'RULE', its when, or the nested rule's label). The message names the slot, the rule and the root, and points at the field-rule slots where parent IS bound (readonlyWhen / requiredWhen), with the denormalise-onto-the-detail remedy for any other check. Its rule id is the existing expression-invalid.
• Both doors, neither refuses. os validate / os build and the object save door run the same pass (runStackExpressionPasses). A warning fails no command, and the door admits the write and lists the finding among its advisories.
• The refusal is deferred to 19.0, per the standing post-GA ruling 「甲」. A narrowing that no ADR-0087 conversion can carry ships only its loud half in 18.x, and no conversion can rewrite a predicate that reads parent. The same finding at error is planned for 19.0. The docblock and the message say so, and the ⛔ withdrawal note stays: the verdict goes in the same change that binds parent for a validations[] rule.
• The runtime is unchanged.

Evidence

All readings at the PR head on top of origin/main a7199ef974.

• New suite packages/lint/src/validate-expressions.validation-rule-parent.test.ts: 12 tests pass. It asserts warning on the script, cross_field and conditional (when and nested then) slots, and on objects with 0, 1 and 2 masters. For os validate and os build it asserts one warning finding and no error finding. At the object door it asserts that errors is empty, that the finding is in advisories, and that the door finding equals the build finding. Controls: parent on a field's own readonlyWhen / requiredWhen gives no finding at the build or at the door, and record / previous reads, record.parent_code and the literal 'parent' stay clean.
• Ablations through scripts/ablation-replace.mjs; each landed on disk and was restored to blob == HEAD with git diff HEAD empty. Making the verdict return null turned 9 of 12 tests red, and the 3 CONTROL tests stayed green. Setting the severity back to error turned 7 of 12 red: the warning assertions bite.
• Public door, measured. On the stock showcase, with a temporary rule { type: 'script', name: 'probe_paid_lock', events: ['insert'], condition: "parent.status == 'paid'" } on showcase_invoice_line, pnpm --filter @objectstack/example-showcase validate exits 0 (Validation passed). It prints the finding as a warning: rule: expression-invalid at object 'showcase_invoice_line' · validation 'probe_paid_lock'. The probe was applied and restored by ablation-replace.mjs.
• Whole package: pnpm --filter @objectstack/lint test passed 151 files and 7000 tests. pnpm --filter @objectstack/lint typecheck passed.
• Changeset gates: check-adr-0087-registration reports "this PR adds no declared-breaking changeset". check-changeset-no-major, check-empty-changeset, check:changeset-gate-self-tests and check:spec-changes are green.
• Corpus: git grep over examples/** and the package objects finds parent. only in field readonlyWhen slots and in no validations[] rule.

Acceptance notes

• The verdict judges a rule as written, the way the rest of the expression rule does. So the warning also covers a rule with active: false, a rule on events a stack never fires, and a conditional branch whose when is never true. The 19.0 refusal will cover them too, which is why it waits for a major.
• The changeset is a patch with Clause-②: no: a warning narrows nothing. The earlier breaking-minor declaration was withdrawn under 「甲」.
• The object door is pinned in-package through runRuntimeAuthoringRules({ type: 'object' }). There is no saveMetaItem pin in packages/metadata-protocol, because that package is outside this card's file surface.
• No rule registry or docs row is needed: the verdict uses the existing expression-invalid rule, and content/docs/data-modeling/fields.mdx already states that parent is bound for the field-rule slots only.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

5 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json feb09db14a6b84dd91ca756160ef101222bdd1dc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c7708ad942b66f60d0942582c0c75bab626a9f99 — the merge of head 687bb33a5f11062b37b99d73c6fff4df5cd6d89a into base feb09db14a6b84dd91ca756160ef101222bdd1dc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c7708ad942b66f60d0942582c0c75bab626a9f99 && git checkout c7708ad942b66f60d0942582c0c75bab626a9f99
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin feb09db14a6b84dd91ca756160ef101222bdd1dc 687bb33a5f11062b37b99d73c6fff4df5cd6d89a && git checkout -B drift-repro feb09db14a6b84dd91ca756160ef101222bdd1dc && git merge --no-ff 687bb33a5f11062b37b99d73c6fff4df5cd6d89a

node scripts/docs-audit/affected-docs.mjs --json feb09db14a6b84dd91ca756160ef101222bdd1dc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.