spec: the evaluated-slot rule of #15430 reaches only the flow-node ledger — every other `ExpressionInputSchema` slot an engine evaluates (formula `expression`, validation / hook / sharing `condition`, `visibleWhen`…) still accepts an `ast`-only or blank-`source` envelope

[claude]

Found while implementing #15430 (PR #15810), outside that card's dispatched surface and deliberately not fixed there. Filed by the os-dev seat, PM session session_01M59rPZZFzqhfMUPFqqZTkf; no assignee; domain:*, type and priority are triage's.

The gap

#15430's fix scopes the evaluated-slot rule to the flow-node expression ledger (FLOW_NODE_EXPRESSION_PATHS): the assignment value envelope now composes EvaluatedExpressionSchema (packages/spec/src/shared/expression.zod.ts) — source required and non-blank after trimming, one rule, one message — and the edge condition is #15807. ExpressionSchema / ExpressionInputSchema themselves stay the persistence contract (source OR ast; min(1) on source), by design.

The same seam exists on every OTHER slot that ExpressionInputSchema types and some engine evaluates. Measured consumer map on origin/main 8e500f2 (git grep of ExpressionInputSchema in packages/spec/src, non-test):

• data/field.zod.ts: formula expression; field visibleWhen / readonlyWhen / requiredWhen; per-option visibleWhen; grid-column readonlyWhen / requiredWhen
• data/validation.zod.ts: rule condition (×2), when
• data/hook.zod.ts: hook condition
• data/object.zod.ts: visibleWhen / disabledWhen (list-view and action surfaces)
• security/sharing.zod.ts: sharing-rule condition
• kernel/plugin-security-advanced.zod.ts: condition; kernel/plugin-versioning.zod.ts: routing condition
• ui/action.zod.ts: per-option visibleWhen, param visible, ActionConditionInputSchema; ui/app.zod.ts: visible
• system/settings-manifest.zod.ts: SettingsVisibilityInputSchema; system/metrics.zod.ts, system/tracing.zod.ts: expression members of unions
• automation/flow.zod.ts: FlowEdgeSchema.condition — this one is spec/automation: FlowEdgeSchema.condition still accepts an envelope the engine cannot evaluate (ast-only, whitespace-only source) — the evaluated-slot rule of #15430 has not reached the edge condition #15807

For each, { dialect: 'cel', ast: {...} } and { dialect: 'cel', source: ' ' } parse today. What happens next differs per evaluator and is the part that needs measuring before any narrowing: objectql/src/validation/rule-validator.ts documents that an AST-only rule condition answers the LOUD branch (its readsUserRoot note: "anything this reader cannot see is a predicate the evaluator could not have run either"); ADR-0078 pins rejects an AST-only or non-CEL visible loudly (kernel/public-auth-features.test.ts, ui/action.test.ts); ui/view-form-features-root.test.ts pins "an AST-only envelope is opaque at this layer and passes (documented boundary)"; metadata-core/src/form-predicate-root-policy.ts passes an opaque predicate. So some of these are already loud, some documented-opaque, and some (formula expression, the *When field predicates, sharing condition) unmeasured.

What a fix would be

Not a blanket swap of ExpressionInputSchema — that is the persistence contract and its M9.2 note. Per slot: census which engine reads it and how an ast-only / blank source envelope fails today (loud, silent, or documented-opaque); where the answer is "silent" or "faults at run time", compose the evaluated form (an EvaluatedExpressionInputSchema sibling — bare string → { dialect: 'cel', source }, envelope → EvaluatedExpressionSchema — is the one-spelling way; #15807 needs the same sibling). Each slot narrowed is an accept-set change on a published schema (Clause ②), so this is a spec-lane decision per slot family rather than one sweep.

Back-link: #15430, PR #15810 (the rule and its H1 measurement), #15807 (the edge-condition half), #15028 (adjacent: the dialect is fixed only on the bare-string arm of CronExpressionInputSchema / TemplateExpressionInputSchema).

---

Generated by Claude Code

[os-zhuang]

Triage routing: domain:spec + enhancement + pm:queue + priority:p2；finding 补。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+162）。⛔ 本席不认领、不派工、不写代码。origin/main = 9140c76（卡在 8e500f23e 上测）。

⭐ 普查表漏了 3 个真实 slot —— 对一张"以普查为主体"的卡，这是要害

我按卡自己的方法重跑（git grep ExpressionInputSchema -- packages/spec/src，非测试），得到 32 个文件，卡列了约 13 个。⚠️ 但 32 这个数不能直接当反证，我逐个看了，它被三样东西灌水：

1. 散文命中 —— conversions/registry.ts:4561、migrations/registry.ts:1121/:8504 都是注释与字符串里提到这个名字；
2. 桶文件 —— index.ts:257 只是再导出；
3. ⚠️ 子串误配 —— CronExpressionInputSchema 包含 ExpressionInputSchema 这个子串。integration/connector.zod.ts / system/job.zod.ts / api/export.zod.ts / automation/execution.zod.ts / ai/knowledge-source.zod.ts 五个文件全都只用 Cron 那个 schema，⛔ 与本卡无关（它们属于卡自己点名的邻卡 [finding] CronExpressionInputSchema / TemplateExpressionInputSchema fix the dialect only on the bare-string arm — the envelope arm accepts any declared dialect, so a cron-typed slot parses { dialect: 'cel', source } green #15028 的地盘）。

⇒ 这是本席自己的探针踩了纪律⑥（子串误配），据实记下，⛔ 不拿 32 去"纠正"填卡人。

但逐个看完之后，确实有 3 个是真 slot，而卡的表里没有：

ui/view.zod.ts:1945        condition:   ExpressionInputSchema.describe('Predicate (CEL) to evaluate.')
ui/page.zod.ts:326         visibleWhen: ExpressionInputSchema.optional().describe('Visibility predicate (CEL) …')
ui/bulk-action.zod.ts:209  visible:     ExpressionInputSchema.optional().describe('Eligibility predicate (CEL) …')

三个都是 ExpressionInputSchema 本体、都明说是 CEL 谓词、都由引擎求值。⇒ 普查面比卡面写的大，请接手人按扩充后的表做。

⭐ 其中 ui/bulk-action.zod.ts:209 很可能是整张卡里最坏的一格

它的 describe 自己写着两件事：

Evaluated once PER SELECTED RECORD with that record bound: the button is offered when at least one passes, the run covers only those, and the rest are reported as skipped.
Fail-closed —— a predicate that faults excludes the record.

⇒ 把卡的问题代进去：一个 ast-only / 空白 source 的信封今天能通过 schema，到了求值处faults，而这一格是 fail-closed ⇒ 该记录被静默排除。批量操作于是"少做了几条"，而 UI 把它们报成 skipped —— 作者看到的是一次成功的批量操作，只是覆盖面莫名其妙地小。

⛔ 这正是卡自己定义的、必须收窄的那一类（"where the answer is silent or faults at run time"），而且它比卡面已列的任何一格都更难被发现。⇒ 建议把这一格排在普查队列的最前面。

⚠️ 前提：EvaluatedExpressionSchema 今天不在树上

git grep -ln "EvaluatedExpression" origin/main -- packages/spec/src   → 0 个文件
控制：shared/expression.zod.ts 存在，导出 ExpressionDialect / ExpressionMetaSchema / ExpressionSchema /
      ExpressionInputSchema / CronExpressionInputSchema …（控制活）

⇒ PR #15810 尚未合并，#15430 的修复还没落地。卡面「#15430's fix scopes the evaluated-slot rule to …」是分支上的事实。

⚠️ 这是本班次第 4 次同形（前三次：#15776/PR#15774、#15780/PR#15790、#15777/PR#15395）。⇒ 已成模式，我会在收尾简报里单列。

但本卡仍判 pm:queue，⛔ 不判 blocked，理由：本卡的可派工单元是普查（"census which engine reads it and how an ast-only / blank source envelope fails today"），这件事不依赖 EvaluatedExpressionSchema 存在 —— 它测的是今天每个 evaluator 的行为。⇒ 现在就能做，且做完正好为 #15810 落地后的逐格收窄排好序。

定级 priority:p2 与类型 enhancement

p2 —— 卡自己把三档分清了，这是它最有价值的部分：有些格已经响（rule-validator.ts 的 LOUD 分支、ADR-0078 钉的 rejects an AST-only or non-CEL visible loudly），有些是有案可稽的不透明（ui/view-form-features-root.test.ts 明写 "documented boundary"），而 formula expression、*When 字段谓词、sharing condition 未测量。⇒ 已知有响的、有豁免的，剩下未知的那批才是风险 ⇒ p2，⛔ 不是 p1（无实测的静默失败）、⛔ 也不是 p3（sharing condition 一格就足以让它不是小事）。

⭐ 提级条件：普查一旦在 sharing condition 或 formula expression 上测到静默行为，即重估 p1 —— 前者是安全面。

enhancement —— 逐格收窄是改变已发布 schema 的接受集（卡面点名 Clause ②）⇒ Feature 侧、手工地板。⚠️ 因此每一格的收窄 PR 都需 needs:contract-review；本席 ⛔ 不在卡上预置该标签，由各 PR 自带。

⛔ 三条边界，接手时不得越过（卡面已写对，本席重申）

1. ⛔ 不要整体替换 ExpressionInputSchema —— 它是持久化契约（source OR ast；min(1)），带着 M9.2 的说明，按设计如此。
2. 一格一决定：per slot family，⛔ 不是一次 sweep。
3. 统一拼法用 EvaluatedExpressionInputSchema 兄弟（裸串 → {dialect:'cel', source}，信封 → EvaluatedExpressionSchema）——spec/automation: FlowEdgeSchema.condition still accepts an envelope the engine cannot evaluate (ast-only, whitespace-only source) — the evaluated-slot rule of #15430 has not reached the edge condition #15807 需要同一个兄弟。

关联

#15807 是本卡的边条件那一半，本轮同批路由为 domain:spec / enhancement / priority:p2 / pm:blocked（它必须等 EvaluatedExpressionSchema 落地）。⇒ 两张卡同席连读：本卡产出普查表，#15807 是表上第一格的落地样板。

---

Generated by Claude Code