feat(core,react): row predicates on runtime record surfaces bind record.* only — the bare-field and data.* spellings retire (objectui#5741) - #7846

Fixes #5741

What this is

Phase 2 of the row-predicate canon ruled on #5330 (2026-08-20, option B), executed exactly as ruled on this card: ruling B of 2026-09-02 (comment 5511170986) as amended on 2026-09-05 (comment 5555359327) — Q1 = A, Q2 = A, Q3 = (i). Runtime record surfaces now bind record.* only; the bare-field shorthand and the data.* root stop being bound there, for both dialects; the Phase-1 warning (PR #5737) goes with the bindings. No survey, no export, no migration rewrite, no sizing (「不考虑存量」). Contract-review tier, Clause-② yes: published runtime behaviour removed. The PR stays draft; needs:contract-review is attached.

Placeholders in this body are spelled as words because GitHub's sanitizer eats angle-bracket shapes (so "a Record of string to any", never the literal generic).

Premise, re-verified on 900f8d99 before editing

• packages/core/src/evaluator/listConditional.ts:273 built { ...(opts.scope ?? {}), ...rowObj, data: rowObj, record: rowObj }; :317 called warnNonCanonicalRowSpelling(predicateText, rowObj, !opts.rowless, opts.label) inside the CEL guard; the legacy ${…} branch at :298 and the CEL calls at :327 / :329 consumed the same scope.
• packages/react/src/hooks/useExpression.ts:170 returned { ...row, record: row, data: row }; :251 was the second warning call; :255 served both dialects from one evaluator.
• rowPredicateCanon.ts exported ROW_PREDICATE_CANONICAL_ROOT (:89), NonCanonicalRowSpelling (:98), detectNonCanonicalRowSpelling (:145), resetRowPredicateCanonWarnings (:208), warnNonCanonicalRowSpelling (:221). declaredPredicate.ts holds no binding and is untouched.
• The metadata-admin layer is decoupled: views/metadata-admin/predicate.ts buildPredicateCtx binds { data: draft, … } through its own evaluatePredicate, never evalRowPredicate / usePredicateRecordContext. Its data.* pins (predicate.test.ts, SchemaForm.visibleWhen.test.tsx) are the ruled control: byte-for-byte untouched (git diff on that directory is empty) and green in every union below.
• Today, on the BASE dist: evalRowPredicate on { status: 'active' } — record.status true, bare status true, data.status true; on a record-only engine scope the bare and data.* spellings fault [type] Unknown variable: status / Unknown variable: data. Recorded in the measurement script the report names.
• git log origin/main -- packages/core/src/evaluator packages/react/src/hooks showed nothing after 900f8d99 at dispatch. Five commits landed during the run (origin/main 52cac388, merged here as 14384aa1): they touch packages/core/src/utils/*, packages/react/src/hooks/useNavigationOverlay.ts and changesets — disjoint from this PR. The When bumping @objectstack/spec past objectstack#14075: list-view spec-parity pins need the CalendarConfig titleField-optional update #7122 chain (PR chore(deps): resolve @objectstack/spec at 17.3.0 in the lockfile #7685) and @object-ui/types' Phase-2 ActionCallback surface is a third onSuccess meaning — declared, zod-mirrored, doc-advertised, zero producers #7068 hold none of these paths.

What moved — 17 files, nothing else

Source (3):

• packages/core/src/evaluator/listConditional.ts — the non-rowless scope is { ...(opts.scope ?? {}), record: rowObj } for BOTH dialect paths (record still pinned after the host spread, objectui#3796, its comment kept); the warnNonCanonicalRowSpelling call and import removed; the evalRowPredicate docblock, the scope / rowless option docs and the two comment blocks now describe the post-Phase-2 truth (record-only, faults, no warning, layer rule).
• packages/core/src/evaluator/rowPredicateCanon.ts — the runtime warning half deleted (warnNonCanonicalRowSpelling, resetRowPredicateCanonWarnings, the dev gate, the warn-once memo); detectNonCanonicalRowSpelling, ROW_PREDICATE_CANONICAL_ROOT and NonCanonicalRowSpelling stay exported; the canon docblock rewritten. The core barrel export *s this module, so the two deletions are public-export removals — named in the changeset, as the brief asks; git grep across packages/ apps/ examples/ scripts/ content/ skills/ found no importer outside the evaluator's own tests except useExpression.ts and the react useCondition.canonSpelling pin, both on this PR.
• packages/react/src/hooks/useExpression.ts — usePredicateRecordContext returns { record: row }; the {} for the no-row / non-object case stays, and its ledger spelling typeof record !== 'object' || Array.isArray(record) is unchanged, so configBag.pin.test.ts needed no edit (green); the Phase-1 block in useCondition and the two now-unused imports removed; the docblock that declares the two sites one rule keeps the declaration with new text; the useRowPredicate doc updated.

Pins (13) — every pin that held the three-way binding was rewritten to the ruled verdict, never deleted silently; each rewrite cites objectui#5741 in its describe / it text. The brief's list, each line re-verified on this tree, plus five more three-way pins the repo-wide grep found:

• packages/core/src/evaluator/__tests__/rowPredicateCanon.test.ts — detector pins unchanged; the binding block now pins record.* discriminating, four retired spellings (bare, data.*, ${data.x}, ${x}) at the caller fallback on BOTH rows with both fallbacks driven, the fault warning on both routes, partitionRowsByPredicate, the host's own data left standing, the Phase-1 warning gone, and the two removed exports absent from the barrel.
• packages/core/src/evaluator/__tests__/rowPredicateCanon.schemaCatalog.test.ts — NEW: the mechanical slice of the corpus sweep (below).
• packages/core/src/evaluator/__tests__/listConditional.test.ts — :41, :97-98, :104, :256-258, :282-286, :436-440 flipped; :480 (rowless, legacy data.tag === 'HOST') needed no flip — a rowless caller keeps the host scope's own data, so its verdict did not move (green, unchanged).
• packages/react/src/hooks/__tests__/useCondition.canonSpelling.test.tsx — rewritten: the bag shape, record.* on both legs, four retired spellings on the throwing leg (hidden on both rows, reported once naming the variable) and the non-throwing leg (fail-soft true on both rows), the ambient-data consequence, no Phase-1 warning.
• packages/react/src/hooks/__tests__/useExpression.test.ts — the useRowPredicate bare-field case (:154, whose fallback direction flipped) and a row-present shape pin for the helper.
• packages/components/src/__tests__/page-header-predicate-dialect.test.tsx :207-216 — bare / data.* hidden on both rows (page:header is fail-closed).
• packages/components/src/renderers/action/__tests__/action-record-predicate-root.test.tsx — the four generic renderers plus the action:bar overflow: record.* rows kept, bare / data.* re-pinned as "same verdict on both rows" with each site's policy (hidden on the throwing visible legs, shown / greyed / enabled on the fail-soft legs).
• packages/components/src/renderers/complex/__tests__/data-table-row-action-visible.test.tsx :76-81 — bare role != 'owner' hidden on both rows.
• packages/app-shell/src/views/__tests__/DeclaredActionsBar.test.tsx — :513-521 and :626 re-spelled record.* with new bare-field pins beside them (fail-closed visible: hidden on both rows, reported once; fail-soft disabled: greyed on both rows); the legacy rows :536 / :646 re-spelled ${record.status …}; :703-721 split into the record.* case and the retired pair (app-shell SOURCE untouched).
• packages/plugin-detail/src/renderers/__tests__/record-alert.rowBinding.test.tsx — group B: shorthand SHOWN on both rows (fail-soft), legacy data.* OFF on both rows (the ambient data: {} answers), the row still wins over an ambient record while a host data is left standing; group C: shorthand no longer gates; the header docblock rewritten. The two sibling record-alert pins import no canon symbol and use only record.* — unchanged.
• packages/plugin-grid/src/__tests__/predicate-surface-parity.test.tsx :192-193 — bare / data.* expected false on all three surfaces (the parity claim now holds for the retirement).
• packages/plugin-kanban/src/cardPredicateScope.test.tsx :79-85 — a bare-field formatting condition binds nothing (no style); record.id on the same card is the control.
• packages/plugin-list/src/__tests__/ListView.test.tsx :2277-2283 — the spec-format formatting case re-spelled ${record.status …}, with a retired ${data.status …} case beside it (no style on either row).

Changeset (1): .changeset/row-predicate-phase2-record-only-5741.md — @object-ui/core and @object-ui/react minor (same fixed group); first line is the ruled wording verbatim; then the per-surface fault shapes (Q1 A), the warning removal with the two export names, the detector staying exported, the layer rule, and the release fact: Phase 1 (PR #5737) shipped in @object-ui/core@17.6.0 (npm 2026-08-24, per report 5551793236) while .changeset/row-predicate-record-canon-5330.md is still pending on main, so the next CHANGELOG section reads both phases together.

Before / after, measured on the built dist (BASE 900f8d99 versus this branch)

The fault warning after the removal — verified, reported, not rewritten

• Fast route (evalFieldPredicate's one-time warning in fieldRules.ts): names the variable and carries the hint — A conditional predicate failed to evaluate (row action "approve") and was treated as its safe default (false): "amount > 5". Reason: [type] Unknown variable: amount … Values are bound under 'record.' (e.g. record.status). Pinned.
• Fail-closed route (warnEvalError, warnOnError: true): names the variable, no record. hint — … Reason: [type] Unknown variable: data … Check the field names and CEL syntax. Pinned; report line, not a rewrite.
• useCondition throwing legs: … was hidden/disabled: its predicate threw — Failed to evaluate expression "status == 'in_review'": status is not defined. Predicate: …. Pinned.
• Report line for the seat: under a host scope that carries its OWN data — app-shell's ExpressionProvider mounts data: {} on every record page — a data.* row predicate does not fault at all: it reads the host's object and is a constant false with no console line (the pre-finding: record:alert 是唯一没接 #4075/#4077 行绑定的谓词面 —— 裸 { record } 作用域下 row-action 简写与 data.* 拼法 unbound,fail-soft 使作者门控的横幅永远显示 #4807 record-alert polarity, now by ruling). A detector there would be the B / C behaviour the ruling rejected, so it is pinned as measured (useCondition.canonSpelling, record-alert.rowBinding) and stated in the changeset and the canon docblock.

Docs — zero diff, as expected

git grep over content/docs for the Phase-1 prose (deprecated spelling, stored-metadata survey, deprecation window, non-canonical) hits only guide/console-architecture.md:183, which is about something else; the one data.* CEL teaching hit, core/enhanced-actions.mdx:245 (condition: 'data.amount > 1000'), is an ActionRunner condition evaluated on the runner's own context, not a row surface. skills/** is governed and carried by #7728; the metadata-admin editor by #7727; content/docs/releases/ untouched.

Corpus sweep — PR #5758's recipe, re-run on this tree

Key-agnostic string-literal scan (every literal carrying a comparison / boolean operator), classified by CEL root with @objectstack/formula's collectCelRootIdentifiers / firstUndeclaredReference and by detectNonCanonicalRowSpelling. 1,016 files, 82,981 literals, 296 ms; identical counts on 14384aa1.

1,315 predicate-shaped strings; roots: ${…} legacy 141, record 77, data 4, bare undeclared 79. Positive controls: record. 77 and data 4 both reached; the classifier reports bare-shorthand / metadata-layer-root on the control spellings and nothing on the canon / host-scope ones.

Every non-canonical hit read in source:

• CEL data.* (4): apps/console/src/components/FormPage.fieldSpec.test.ts:127 is a visibleOn type-face fixture (schema / widget tier, where data is the form scope); content/docs/components/data-display/tree-view.mdx:59 is prose (bind || nodes || data); skills/objectui/guides/schema-expressions.md:220 and :232 are the visibleOn / hiddenOn tier on finding(skills): skills/objectui/guides/schema-expressions.md teaches the bare-field and data.* row spellings as "deprecated and warned once in dev" — stale once #5741 (Phase 2) retires them #7728's governed surface.
• Legacy ${data.x} with an operator (28): content/docs teaching pages, apps/console fixtures and the ActionRunner condition examples — the ${…} dialect on schema / widget nodes and runner contexts, the class PR docs(plugin-form): Phase 0 of the row-predicate deprecation — stop teaching the bare shorthand (#5738) #5758 stood down on; none is a row surface.
• Bare undeclared (79): flow-tier trigger / decision / validation conditions in apps/console/src/preview-samples.ts (condition: 'status == "active"' on a flow start trigger, criteria: "status == 'Closed'" on a workflow rule, amount, discount, daysToExpiry), formula-field expressions (content/docs/fields/formula.mdx:68-69), a view filter described in prose (guide/building-crud-app.md:342), diagnostics examples with a deliberate unknown root (guide/metadata-diagnostics.md:181-182), JS expressions in test files (children || body, length > 0), UI strings ("Open in GitHub"), CHANGELOG entries and ADR prose (docs/adr/0036). None is a runtime record surface.
• One pre-existing doc defect of a DIFFERENT tier surfaced: fieldTabs[].visibleWhen: 'status == "won"' in content/docs/plugins/plugin-form.mdx:173 and packages/plugin-form/README.md:446 — the fieldRules tier binds record only and always did, and a broken tab predicate fails open. Filed as objectui#7834; not edited here.
• schema-catalog (examples/schema-catalog/src/schemas, 432 JSON documents, 7,302 strings): 20 predicate-shaped — 4 record.*, 1 current_user.*, 14 display text that does not parse as CEL — 0 data.*, 0 legacy, 0 bare. Clean.

Pin decision: the full recipe is deterministic and fast but not MECHANICAL — 79 of its hits need tier judgement — so it stays this reading. Its mechanical slice IS landed: rowPredicateCanon.schemaCatalog.test.ts sweeps the catalog JSON from disk (rooted at the test file per objectui#7799, enumerated rather than listed, no new dependency edge — @objectstack/formula is already core's), with a positive control (documents present, parsed CEL predicates present) and a classifier control.

Gates — exit captured before any pipe, verdict lines quoted, head 14384aa1 unless noted

Lint, declared narrowing: repo-wide pnpm lint was not run. Population: eslint.config.js enables no type-aware linting (no parserOptions.project / projectService), so this diff cannot move any untouched file's verdict; the PR's own 16 code files were linted with --format json — 16 files, 0 errors, 78 warnings, run the way CI's turbo run lint runs it (package-level eslint ., no --no-inline-config). On useExpression.ts the 9 no-explicit-any warnings are the BASE file's own: eslint on the BASE blob via stdin at the same path reports 9, the current file reports 9.

Ablation — Clause-② yes

Run on 6e9c7a6e, the implementation commit; the merge left both mutated files byte-identical (git diff 6e9c7a6e 14384aa1 on the two paths is empty). vitest resolves @object-ui/core and @object-ui/react to src through the vitest.config.mts aliases (:408, :413), so no dist is on the resolution path and no rebuild leg applies. Each mutation was proven on disk before the run (grep -c injected = 1, removed = 0, and the blob hash) and restored with git checkout HEAD -- path under a trap on EXIT / INT / TERM; restoration proven by git diff HEAD empty and git hash-object equal to the HEAD blobs (62f0181b… for listConditional.ts, 320a8da7… for useExpression.ts).

• Leg A — the core scope bag alone, back to { ...scope, ...rowObj, data: rowObj, record: rowObj }: Test Files 4 failed | 1 passed (5) · Tests 18 failed | 110 passed (128). Every red is a retired-spelling pin (rowPredicateCanon ×9, listConditional ×5, predicate-surface-parity ×2, page-header ×2); every record.* pin green; the react tier's file untouched and green, because the hook is the second, independent site.
• Leg B — the react hook alone, back to { ...row, record: row, data: row }: Test Files 5 failed | 1 passed (6) · Tests 38 failed | 122 passed (160). Every red is a retired-spelling pin (useCondition.canonSpelling, the useExpression shape pin, action-record-predicate-root ×20, DeclaredActionsBar ×3, record-alert.rowBinding ×4); every record.* pin green; core's rowPredicateCanon file green.

Out of scope, filed

• objectui#7834 — docs(plugin-form): the fieldTabs[].visibleWhen example teaches the bare spelling on the fieldRules tier (a Phase-0 class defect, one block below the one PR docs(plugin-form): Phase 0 of the row-predicate deprecation — stop teaching the bare shorthand (#5738) #5758 corrected).
• objectui#7835 — finding: renderer comments in the four action renderers, containers.tsx, record-alert.tsx, SchemaRenderer.tsx and DeclaredActionsBar.tsx still describe the three-way binding; Blocked-by Carrier for Phase 2 of the row-predicate deprecation: the stored-metadata survey that must size the removal window before any spelling retires #5741. It also records the ctx.data alias on page:header as an observation (a separate ctx.* namespace, objectui#2358, not ruled on).
• finding(app-shell/metadata-admin): the conditional-formatting CEL editor lints row predicates in the flattened scope and advertises bare fields — declared-but-unbound once #5741 (Phase 2) retires the bare-field binding #7727 and finding(skills): skills/objectui/guides/schema-expressions.md teaches the bare-field and data.* row spellings as "deprecated and warned once in dev" — stale once #5741 (Phase 2) retires them #7728 stay Blocked-by Carrier for Phase 2 of the row-predicate deprecation: the stored-metadata survey that must size the removal window before any spelling retires #5741 and unlock when this lands; not touched here.

Generated by Claude Code