test(dogfood): 给 action param 选项的 visibleWhen 补 ADR-0058 D7 表达式面账本行 (#5016)

expression-conformance 的 ratchet 会重新扫描 packages/spec/src 下每个
ExpressionInputSchema 声明,新增的 ui/action.zod.ts:visibleWhen 没有归类,
CI 的 Dogfood Regression Gate (3/3) 因此报 "UNCLASSIFIED surface"。本仓
scoped 的 spec / runtime 测试看不到这一条 —— 它只在 dogfood 分片里跑。

单开一行而不是并进 cel-ui:cel-ui 那批是 SchemaRenderer 藏元素,这一条是
在字段控件内部收窄一个选项列表,evaluator 不同。tier 取 fail-soft-log,
与 cel-field-rule 一致 —— evalFieldPredicate 的 fallback 是 true,谓词坏掉
时选项保持可选,而不是无声删掉一个作者没打算拿走的选择。

Co-Authored-By: Claude <noreply@anthropic.com>

Author: os-dev

packages/qa/dogfood/test/expression-conformance.ledger.ts

@@ -146,6 +146,22 @@ export const EXPRESSION_SURFACE: ExprSurface[] = [
       'system/settings-manifest.zod.ts:visible',
     ],
   },
+  {
+    id: 'cel-action-param-option-visible',
+    summary: "action param option-list per-option gating (params[].options[].visibleWhen, #5016)",
+    // Same key, same evaluator and same binding environment as the per-option
+    // `visibleWhen` on a FIELD's option list — which is why it is `cel`,
+    // `interpret` and `fail-soft-log` like `cel-field-rule` rather than
+    // fail-closed: `evalFieldPredicate` is called with `fallback: true`, so a
+    // broken predicate leaves the option OFFERED instead of silently deleting a
+    // choice the author never meant to remove. It is a SEPARATE row from
+    // `cel-ui` because the evaluator differs: `cel-ui`'s surfaces hide an
+    // element through the SchemaRenderer, this one narrows an option LIST
+    // inside the field widgets.
+    dialect: 'cel', mode: 'interpret', state: 'enforced', failPolicy: 'fail-soft-log',
+    enforcement: 'console (objectui) ActionParamDialog → paramToField → SelectField / MultiSelectField / RadioField / CheckboxesField → useCascadingOptions → resolveCascadingOptions (core/evaluator/optionRules.ts) → evalFieldPredicate → @objectstack/formula celEngine (interpret), evaluated per OPTION against the live param bag + current_user; a value no longer offered is dropped from the param. UI gating only — `enforceActionParams` (ADR-0104 D2) validates the submitted value against the declared option VALUES and does not evaluate this predicate, so access-control gating must also be enforced by the action body / permissions',
+    covers: ['ui/action.zod.ts:visibleWhen'],
+  },
   {
     id: 'cel-bulk-action-visible',
     summary: "selection-bar bulk action per-record eligibility (bulkActionDefs[].visible, objectui#3067)",