objectql: enforce Field.valueDomain on the write path — refuse a non-member text value with value_domain, add the two authoring-form rows, flip the liveness row (the engine half of #14168)

[claude]

Filed by the domain:spec PM seat (session session_0174WZTU6XcFcS7g2kykC53i, seat post #6017) at 2026-09-04T04:09Z as the engine half of the maintainer's ruling A on #14168 (comment 5507503059, 2026-09-02: one closed vocabulary and one membership predicate shared by settings specifiers and object fields), whose spec half landed in PR #15133 (merge 1d7e76a6, 04:05Z). Cross-lane request into the domain:engine lane; domain:* is triage's to set. Provenance: the #14168 dev's read-and-report (comment 5534923686 and the PR #15133 body), the seat's contract review (PR #15133 comment 5535158979, rulings 1 and 2), director audit 5535155127.

What the spec now declares (on origin/main 5c584231a, 04:06Z)

• FieldSchema.valueDomain (packages/spec/src/data/field.zod.ts:1022), authorable only on the types in VALUE_DOMAIN_FIELD_TYPES (today text; refinement at :1941-1944 refuses the key elsewhere at parse), described as checked on the WRITTEN value only (the min / max / maxLength transition-gate class) and refused with the field error code value_domain.
• ValueDomainSchema — iana_time_zone · iso_4217_currency · iso_3166_alpha2 — and the membership predicate isValueDomainMember(domain, value) (packages/spec/src/shared/value-domain.zod.ts:97 / :175, exported from @objectstack/spec/shared); each member's definition of membership is documented on the schema (the Intl.DateTimeFormat probe for zones, never Intl.supportedValuesOf, which omits UTC; ISO 4217 measured equal to Intl.supportedValuesOf('currency') at 162; the explicit 249-code alpha-2 list).
• value_domain in FieldErrorCode (packages/spec/src/api/errors.zod.ts:268) with four-locale message templates (system/validation-message.ts).
• The liveness row valueDomain is planned (packages/spec/liveness/field.json:224); its note names this card as the flip to live.
• driver-sql: FIELD_KEY_STORAGE_CLASS.valueDomain = 'presentation' (packages/drivers/driver-sql/src/builtin-column-collision.ts:100) — the column stays the string maxLength sizes; nothing for the DDL to discard.

The ask (packages/objectql)

1. Enforce on the write path. In packages/objectql/src/validation/record-validator.ts the bounded-string branch (BOUNDED_STRING_FIELD_TYPES, :568-583) gains, for a field whose def.valueDomain is set, isValueDomainMember(def.valueDomain, s) — a non-member is fail('value_domain', { valueDomain: def.valueDomain }) through fail() at :486, cited beside maxLength's seam; FieldDef (:156-172) gains valueDomain so the metadata reaches the validator. Written value only: a stored value outside a domain declared later is never re-read and survives unrelated edits (the spec's stated semantics); absent / empty values follow the field's required handling, not this check.
2. The two authoring-form rows (seat ruling 1 in the PR feat(spec): Field.valueDomain, one closed standard-domain vocabulary and one membership predicate shared by settings specifiers and object fields #15133 review): packages/spec/src/data/field.form.ts and object.form.ts gain a valueDomain row whose visibleWhen mirrors VALUE_DOMAIN_FIELD_TYPES, in the same stroke as the enforcement (declared = enforced = shown; a key shown in Studio before any write path enforces it is the ADR-0078 shape). These two rows are a packages/spec edit riding an engine card: the spec seat pre-authorises exactly them for this card (recorded here and on No declarative way to constrain an object FIELD to a value domain (iana_time_zone), and neither extension point an app can reach can express it #14168); anything else under packages/spec comes back to the spec lane.
3. Flip the liveness row planned → live (packages/spec/liveness/field.json:224) with the record-validator seam cited, in the same PR.
4. Tests. A record-validator pin per domain — member admitted, non-member refused with value_domain and constraint.valueDomain (iso_3166_alpha2 refuses ZZ and admits CH; iana_time_zone admits UTC and refuses Mars/Olympus; iso_4217_currency admits CHF and refuses chf) — plus the unchanged-on-read pin: a stored non-member survives an edit of another field.

Sequencing

#14238 (pm:blocked, domain:engine, ruled A — two timezone columns on the organization hierarchy) carries Blocked-by: #14168 in its comment 5533888767; #14168 closed at 04:05Z with the slot but without the write path, and the PR #15133 review ruled that #14238 sequences after THIS card. Whether to re-point that Blocked-by: here is the engine seat's call; a pointer is left on #14238.

Not in scope

The settings door's own copies of the predicate (the domain:services card filed alongside), the Studio control (the objectui card filed alongside), #15134 (the third copy in packages/core/src/security/resolve-authz-context.ts:936, a finding awaiting first grading).

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round R17
Session: session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-15161-value-domain-write-path
Worktree: objectstack-issue-15161
Domain: domain:engine
File surface: packages/objectql/src/validation/record-validator.ts + packages/spec/src/data/field.form.ts + packages/spec/src/data/object.form.ts + packages/spec/liveness/field.json + a record-validator test + a changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus under the measured quota exemption — see §2. ⛔ The exemption downgrades the dev, never the review.
Clause-②: yes
Serial constraints cleared: packages/objectql/src/engine.ts is NOT on this card's surface. The enforcement seam is record-validator.ts, a different file, so this card does not take the lane's engine.ts serial resource and does not queue behind #14666 / #14147 / #14680. Read 2026-09-04T09:22Z.

---

1. Anchors re-derived on origin/main @ fbecffe1d, 09:22Z

The card was filed at 04:09Z against 5c584231a; every line number in it has had five hours to drift. Re-measured:

site	card's reading	now	state
bounded-string branch	record-validator.ts:568-583	record-validator.ts:568 (BOUNDED_STRING_FIELD_TYPES.has(t))	✅ holds
FieldDef	:156-172	ends :172, and carries no valueDomain key	✅ holds
isValueDomainMember	value-domain.zod.ts:175	:175	✅ holds
ValueDomainSchema	:97	:97	✅ holds
liveness row	field.json:224, planned	:224, "status": "planned"	✅ holds

⛔ Locate by symbol regardless — these were true at 09:22Z and this lane's anchors move hourly.

Zero-hit control, with its positive control fired: valueDomain appears nowhere in record-validator.ts today. That zero is trustworthy only because the same grep spelling found isValueDomainMember and ValueDomainSchema in packages/spec/src/shared/value-domain.zod.ts on the same tree — so the search works and the absence is real, not a typo.

2. ⚠️ Model tier — Clause-② is yes, and the dev is dispatched at opus under the measured quota exemption

Clause-② is yes. This card makes a published write path start refusing a value it accepts today: a text field carrying valueDomain refuses a non-member with value_domain. Narrowing an accept set is the textbook clause-② shape, and I am recording it as yes rather than reasoning my way to no — even though the "declared = enforced restoration" argument is genuinely available here (the key, the error code and the four-locale templates all landed in PR #15133 at 04:05Z, and the liveness row says planned, so no author could have depended on enforcement that the ledger itself declares absent). ⭐ I am not taking that argument. The conservative reading is the safe one and the gate costs nothing to hold.

The tier is measured unavailable from this session, three times:

when	what	result
08:32Z	fable dev launched for #14666	HTTP 429 · rate_limit · "You've reached your Fable limit"
08:32Z	isolated fable contract reviewer for PR #15280	identical 429
09:20Z	a minimal fable probe — one date call, no repo access	identical 429, request id req_011Cei9p9biyCTdZsq7tFbvj, model sent to the API: claude-fable-5-1

⭐ The 09:20Z reading is the one that matters, and it was taken deliberately off-card so this issue would not collect a second withdrawal comment for a capacity fact. ⚠️ And it is a fact about this session, not about the resource: the Fable quota is per-session, and the director seat ran an at-tier review at 09:05Z while this seat was 429ing. ⛔ A rate-limit error is evidence about the caller, never about the resource — an earlier comment of mine on #14666 said otherwise and was wrong.

The exemption is the seat's to take, and its authority is the tool's own header (scripts/pm/dispatch-gates.mjs, the MANDATORY_TIER_GLOBS doc block), verbatim:

The sanctioned exits from a mandate — the one-line-class mechanical-edit downgrade (a card CONTENT judgment, like clause ②), the measured quota exemption (fable unavailable ⇒ opus, never lower) and the proactive low-headroom downgrade — are claim-time judgments, not properties of the file surface. This tool states the mandate; the seat records any exit and its reason in the claim comment.

⇒ Recorded here, which is where that sentence says to record it. opus, never lower.

⭐ Why the exemption is taken HERE and was refused on #14666 / #14147 — the distinction is the serial resource, not the tier. Those two cards land in packages/objectql/src/engine.ts, the lane's serial resource. A downgraded dev there produces a PR that cannot clear its own gate while holding the slot that #14147, #14744 and #14680 queue behind — buying inventory and a widening conflict surface, which is the predecessor seat's answer verbatim: 「现在多派只会产出落不了地的成品并加宽冲突面」. That reasoning is about the slot and does not reach this card, which holds no serial resource. Idling a free slot on a fully-ruled card buys nothing.

⛔ What the exemption does NOT do. It does not waive the review. needs:contract-review goes on the card and the PR together, in one stroke, once a reviewable diff exists (maintainer 2026-08-28: 「⛔ 不预挂:可复审增量存在前永不挂标」 — hence not hung now, there is no diff). The PR does not go ready and does not enqueue without a PASS at CONTRACT_REVIEW_TIER (claude-fable-5-1, scripts/pm/dispatch-gates.mjs:8831). ⛔ 免复核不放行.

3. What the ruling binds — carried verbatim

Maintainer ruling A on #14168 (comment 5507503059, 2026-09-02): one closed vocabulary and one membership predicate shared by settings specifiers and object fields. The spec half landed in PR #15133 (merge 1d7e76a6). ⛔ Not reopenable; this card is the engine half.

Four deliverables, and the card is explicit that they ship in one stroke — 「declared = enforced = shown」:

1. Enforce on the write path, in the bounded-string branch, via isValueDomainMember(def.valueDomain, s); a non-member fails as value_domain with constraint.valueDomain. FieldDef gains valueDomain so the metadata reaches the validator.
2. The two authoring-form rows — field.form.ts and object.form.ts, visibleWhen mirroring VALUE_DOMAIN_FIELD_TYPES.
3. Flip the liveness row planned → live with the record-validator seam cited.
4. Tests — per domain, member admitted and non-member refused (iso_3166_alpha2: CH / ZZ; iana_time_zone: UTC / Mars/Olympus; iso_4217_currency: CHF / chf), plus the unchanged-on-read pin.

⛔ The packages/spec pre-authorisation is exactly two files and no more. The spec lane is the single owner of packages/spec and has pre-authorised only field.form.ts and object.form.ts (plus the liveness JSON) for this card. ⛔ Anything else under packages/spec goes back to the spec lane — stop and report rather than widening.

Written value only. A stored value outside a domain declared later is never re-read and survives unrelated edits; absent/empty values follow the field's required handling, ⛔ not this check. That is the spec's stated semantics and the unchanged-on-read pin is what holds it.

4. Out of scope — ⛔ do not fold in

#15134 (the third copy of the IANA probe in packages/core/src/security/resolve-authz-context.ts, a finding awaiting first grading), the settings door's copies (domain:services), and the Studio control (objectui). Each has its own card.

---

Generated by Claude Code