FormField/FormSection `visibleWhen` describe 宣称 runtime 表单绑定 `current_user`,但字段级条件规则的求值面从未绑过它——按文档写的谓词必然 fault 并 fail-open

[hotlong]

现象

packages/spec/src/ui/view.zod.ts 的字段级与 section 级 visibleWhen 文档(origin/main):

• :1410-1412(JSDoc)与 :1414(describe):「Root: record+current_user (runtime forms) or data (metadata forms)」
• :1505-1508:FormSection 级同样宣称

但 字段级条件规则的实际求值面没有任何一处绑定 current_user:

• objectui 侧:resolveFieldRuleState 的三个生产调用点(packages/components/src/renderers/form/form.tsx 渲染门与 error-clearing effect、packages/plugin-form/src/WizardForm.tsx 必填门)都不传 scope,evalFieldPredicate 只绑 record / previous /(经 extra 的)parent。objectui 的授权 autocomplete 也是这么钉的:packages/app-shell/src/views/metadata-admin/celAuthoring.ts 的 FIELD_RULE_ROOTS = ['record', 'previous', 'parent'],注释明说 "nothing else (no current_user)"(objectui#1582 的决定);
• 服务端:packages/objectql/src/validation/rule-validator.ts 的 EvaluateRulesOptions.currentUser 按其 JSDoc 只供 per-option visibleWhen(objectui#2284,ADR-0068);readonlyWhen 求值(isReadonlyWhenLocked)绑 record/merged + parent,不含 current_user。

per-option visibleWhen(选项级)确实绑 current_user——文档对「选项级」为真,对「字段级/section 级」为假。

后果

照 describe 写 visibleWhen: "current_user.positions.exists(p, p == 'admin')" 的字段级谓词,引用未绑定根 → fault → fail-open(字段恒可见)。这正是 #5149 的「文档诱导写出永不生效谓词」类别(Repro 1 是裸标识符,这里是文档亲自点名的根)。objectui PR objectstack-ai/objectui#3541(#5149 诉求 2)落地后该 fault 会以每谓词一条 console.warn 显形(undeclared reference to current_user 一类),不再静默,但谓词本身依旧不工作。

两个修法方向(留给分诊)

1. 文档收窄:describe 与 JSDoc 把字段级/section 级的 runtime 根改为 record(+previous/parent),current_user 只保留在 per-option visibleWhen 的文档上——与 objectui#1582 钉的授权面一致,改动最小;
2. 实现补齐:让字段级规则求值面(客户端 resolveFieldRuleState 调用点传 host predicate scope;服务端 rule-validator 同步)真的绑 current_user——有真实业务拉力(按角色显隐字段)时才值得,且需两端同时落,否则客户端/服务端 verdict 漂移。

按仓规不自选方向,留 PM 分诊。发现于 #5149 诉求 4 验收(该验收本身成立:record./data. 绑定说明与示例齐全,本单只针对 current_user 这一半句的过度宣称)。

Refs: #5149、objectstack-ai/objectui#3541、objectui#1582、objectui#2284、ADR-0068

[claude]

Triage: pm:queue + domain:spec + target:v17.

Landing site (read from code, not from the title). The over-claim is four strings in packages/spec/src/ui/view.zod.ts — verified verbatim on origin/main just now: :1411 (field JSDoc), :1414 (field describe), :1505 (section JSDoc), :1508 (section describe), each carrying Root: `record`+`current_user` (runtime forms). That is packages/spec ⇒ domain:spec. The evaluation surfaces the body cites (objectui resolveFieldRuleState call sites, rule-validator.ts) are evidence that the claim is false, not the fix site — under direction 1 nothing outside packages/spec changes.

Why pm:queue and not the decision box. The contract question this looks like it raises is already answered, twice, and both answers point the same way: objectui#1582 pinned FIELD_RULE_ROOTS = ['record', 'previous', 'parent'] with an explicit "nothing else (no current_user)", and ADR-0068 / objectui#2284 scope EvaluateRulesOptions.currentUser to per-option visibleWhen. So direction 1 (narrow the describe/JSDoc to record + previous/parent, leave current_user documented only on per-option visibleWhen) sits inside rulings that already exist — it is a concrete defect with a named location, not an appetite question.

Direction 2 (actually bind current_user on the field/section evaluation surface) is the half that would need a maintainer call, and it is deliberately not queued here: it is cross-repo, needs client and server to land together or verdicts drift, and the issue itself conditions it on "有真实业务拉力". If that pull appears, it is a fresh card, not a re-scope of this one.

target:v17. Criterion ② — a public contract surface whose declaration is a lie. It is also a member of the family #5149 already carries target:v17 for: a predicate written from this documentation faults and fails open, so the field stays visible instead of hiding. The doc does not merely omit the root, it names it as an example.

Stale-premise check. git log origin/main -- packages/spec/src/ui/view.zod.ts — most recent touch is 820ea5d (a CI change, unrelated); all four line anchors still read as filed.

Dedup. Full paginated enumeration of open issues and PRs in all three repos (the GitHub search API is not reachable from this seat — repository-scoped sessions get This GitHub API path is not available). Nearest neighbours are #5149 (parent fail-open family, pm:queue + repo:objectui + target:v17) and #6128 (the build-time bare-identifier lint split out of #5149's ruling, domain:devx). Neither overlaps: #5149/#6128 make a broken predicate visible, this one stops the schema from teaching readers to write one. No duplicate; cross-linked only.

Serialization note for whoever claims it. #6128 lands in packages/lint, not in view.zod.ts — no file collision. But a describe edit in packages/spec regenerates docs/baselines; check the merge=os-regen paths before batching this alongside another spec-lane item.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code