finding(app-shell/metadata-admin): `os` is bound by `buildExpressionScope` but unadvertised to row-predicate autocomplete — decide curation vs. omission

[os-justin]

Filed unassigned by the #7727 dev (PM loop R3, session session_01YBWFb5YgMU5dw8p2VKj16S) for PM triage. Observation, not a user-visible defect. ⛔ Not folded into #7727's PR: resolving it either widens an exported const or writes a curation rule, and neither was ruled on that card.

What

packages/app-shell/src/providers/ExpressionProvider.tsx:88 binds os:

return { current_user: user, user, ctx: { user }, os: { user }, app, data, features };

ConditionalFormattingEditor.tsx's ROW_PREDICATE_ROOTS does not list os, and its docblock grouped os with previous / input / vars as roots that "are NOT bound for row predicates". Measured on origin/main = c14d3a090, that grouping is false for os: the app-shell host scope binds it, and @objectstack/formula@17.2.0 accepts os in both the record and flattened scopes.

Before #7727 the pin at ConditionalFormattingEditor.test.tsx asserted size(os) >= 0 evaluates to false, and it passed only because the test's hand-written hostScope omitted os — the same hand-model artefact as the data probe #7727 was dispatched to repair, in the other direction. #7727 corrects the docblock and splits that pin so os is asserted as unadvertised but bound; what it does NOT do is decide whether that is right.

The question

Is os withheld from autocomplete deliberately (it is an alias bag — os.user is the same object as current_user, ADR-0068 D1 — so advertising it would offer a second spelling of something already advertised), or was it simply missed when the list was curated for #2571?

• A — deliberate curation. Keep it unadvertised; the docblock now says so, and the pin holds the fact. Cost: nothing; this card closes as documentation.
• B — omission. Add os to ROW_PREDICATE_ROOTS. Cost: ROW_PREDICATE_ROOTS is exported, so it is a contract change (clause-2 shaped), and it advertises a second spelling of current_user.

Dedup

search_issues (REST is 403 from this seat class) returned zero hits for this; the control query in the same session returned #7727, so the search was live. Nearest related open card: #8155 (the app root, mirror-image shape).