view/page 可见性谓词的 CEL **语法**在构建期无人校验 —— `country === "USA"` 这类写法零诊断、运行时静默 fail-open

[hotlong]

Filed unassigned from #6128 / PR #6248。本单只记录发现,不含修法承诺。

事实

validate-expressions.ts(ADR-0032)对每个它遍历到的谓词都跑 validateExpression,语法错误报 blocking error。但它的遍历面是 objects / flows / actions / sharingRules / hooks,从不走 views 与 pages。

走这个面的只有 validate-visibility-predicates.ts(ADR-0089 D3b + #6128 新增的裸标识符闸),而这三条规则都不判语法:PR #6248 的新规则明确在 parseCelToAst 返回 null 时保持沉默,理由是「不发明第二个语法判定」——与 validate-null-guards.ts 同一条政策。那条政策在它自己的调用点上是成立的,因为 validateExpression 就在同一批调用点上跑;在 view/page 面上它不成立:那里根本没有第二个判定,沉默就是没人报。

后果与 #5149 同型:语法不通过的谓词求值失败 → evalFieldPredicate 返回 fallback → 可见性的 fallback 是 true → 元素无条件渲染,与「没写谓词」在屏幕上一模一样。#5149 已落地的运行时 warn-once(objectui#3541)现在会把它喊出来,但那是运行时;构建期依然放行。

现成的样本形状

packages/spec/src/ui/view.test.ts:1126 / :1240 / :1245 / :1291 / :1373 的 fixture 就写着 'country === "USA"' / 'billing_country === "USA"' —— === 不是 CEL。这些是 schema 测试的 fixture(不是发货内容,schema 也不判表达式值),但它们正说明这个写法是作者会写出来的。

决定点(不是实现细节)

view/page 谓词的语法要不要判、判成 error 还是 warning,是一个「作者被允许写什么」的产品判断,不是接线缺口:

• 判 error:与其它面(validation rule / flow / action)一致 —— 那些面上语法错就是 blocking。坏谓词发不出去。
• 判 warning:爆炸半径更小,但这一族的教训恰恰是「静默不可以」,而 warning 在 CI 里通常也不拦。
• 不判:那就得写下来为什么这个面例外。

若采纳,落点就在 validate-visibility-predicates.ts 已有的 parseCelToAst 返回 null 那个分支上 —— 一处判断,配一条自纠措辞的消息。PR #6248 已在该分支写下这条缺口的注释,便于接手者定位。

Refs:#6128 / PR #6248(发现处)、#5149(同族的 fail-open 静默)、ADR-0032(其它面的语法判定)。

[claude]

Triage: needs-user-decision + domain:devx.

Landing site is already known — packages/lint/src/validate-visibility-predicates.ts, the branch where parseCelToAst returns null ⇒ domain:devx (packages/lint). PR #6248 has already left a comment on exactly that branch for whoever picks this up. So this is not blocked on analysis.

Why the maintainer's inbox and not the queue. The issue names its own decision point, and it is a "what are authors allowed to write" call — i.e. authoring-contract shape, not an implementation detail:

• error — consistent with every other predicate surface (validation rules, flows, actions, sharing rules, hooks all treat a CEL syntax error as blocking via validateExpression / ADR-0032). A bad predicate can no longer ship. Largest blast radius: any app currently shipping a syntactically invalid view/page predicate stops building.
• warning — smaller blast radius, but this family's whole lesson is that silence is what hurt, and warnings usually do not fail CI.
• exempt — legitimate, but then the reason this one surface differs has to be written down.

A dev cannot pick between these without guessing at the maintainer's appetite for breaking existing app builds, so it is not dispatchable as written.

The defect behind it is real and confirmed. validate-expressions.ts walks objects / flows / actions / sharingRules / hooks and never views / pages; the only rules that do walk that surface deliberately stay silent on syntax so as not to invent a second syntax judgment — a policy that holds at its other call sites (where validateExpression runs alongside) but not here, where nothing else runs. Runtime consequence is the #5149 shape: predicate eval fails → evalFieldPredicate falls back → visibility fallback is true → the element renders unconditionally, indistinguishable on screen from "no predicate written". objectui#3541's warn-once now shouts at runtime; build time still passes it.

Dedup. #6251 is the sibling filed from the same PR but is a different file and a different defect (unreachable traversal in validate-form-layout.ts) — cross-link, not duplicate. #5149 is the runtime half of the same family, already landed.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling — 2026-08-07. The maintainer reviewed the PM's three-axis analysis of the decision inbox and accepted the recommendations (「你帮我综合评估，我接受你的建议」). Recorded by the PM session; needs-user-decision comes off with this comment.

Decision: blocking error. view/page visibility predicates get build-time CEL syntax validation at the same severity as every other predicate surface (validation rules / flows / actions under ADR-0032). No warning tier, no documented exception for this surface.

Rationale: the fixtures already prove authors — especially AI — write ===; this family's whole lesson is that silence is unacceptable, and a warning that doesn't block in CI is silence with extra steps; the landing point is the single parseCelToAst returns-null branch that PR #6248 already annotated, so the cost is one branch plus a self-correcting message (name the offending token, show the CEL spelling).

---

Generated by Claude Code

[hotlong]

认领 — devx 车道执行座位。 pm:queue → pm:dispatched，assignee 已置。

• session: session_01BDmDsu2575gDxeMCxXhDE3
• branch: claude/issue-6253-view-predicate-cel-syntax
• 文件面: packages/lint/src/validate-visibility-predicates.ts 及其测试。⛔ 不碰 packages/lint/src/validate-expressions.ts（本单不改 ADR-0032 的遍历面）、⛔ 不碰 packages/spec/src/ui/view.test.ts（那里的 'country === "USA"' 是样本，不是待修点）、⛔ 不碰 content/docs/releases/。
• 竞态复核: 派发前重读全部评论 —— 2 条，分诊（needs-user-decision）+ 维护者裁定，均非认领，无其它 session ID。本单未被他人占用。

路线已由维护者钉死，实施方不再有裁量（2026-08-07 裁定评论）：判 blocking error，与 ADR-0032 下其它谓词面同级；不设 warning 档，不写本面豁免。落点是 PR #6248 已经注释过的那个 parseCelToAst 返回 null 的分支。消息要能自纠 —— 指出冒犯的 token、给出 CEL 的写法。

标签是整集 PUT，本次按读-并-写并已回读确认（pm:dispatched + domain:devx，needs-user-decision 已在维护者裁定时摘除）。

---

Generated by Claude Code