fix(qa): keep the settings visible slot in the ADR-0058 expression ratchet, classified honestly (#7327)

The expression-surface conformance ratchet discovers surfaces by matching
`<key>: ExpressionInputSchema` textually, so narrowing the two settings
`visible` slots onto their own schema dropped them out of the scan and turned
their ledger entry stale — a live predicate surface silently leaving the
ledger, which is the #1887 class the ledger exists to catch.

Discovery now reads a registered list of expression-declaring schema names
rather than one hardcoded name, with the failure mode written down: a slot
narrowed onto its own schema must register that schema on the same commit.

The classification is corrected while it is being moved. `settings-manifest
visible` sat under `cel-ui` — `dialect: 'cel'`, enforced by the SchemaRenderer
and celEngine — and is evaluated by neither. It gets its own `settings-visibility`
row naming `evaluateVisibility`, its closed grammar, and its fail-closed policy
(#7310), proved by the producer/consumer pin. `ExprDialect` gains a member for
it: the ledger records what a surface IS, and spelling this one `cel` would
restate in the ledger the exact claim #7327 removes from the schema.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdPj3S347aPWapzTuHCb4N

Author: claude

packages/qa/dogfood/test/expression-conformance.ledger.ts

@@ -15,13 +15,24 @@ import type { ConformanceRow } from '@objectstack/verify';
 // the celEngine). There is NO silent fallback from compile to interpret.
 //
 // The companion test (`expression-conformance.test.ts`) RE-DISCOVERS every
-// `ExpressionInputSchema` field declaration in `packages/spec/src` (plus the RLS
+// expression-declaring field in `packages/spec/src` (plus the RLS
 // `using`/`check` string predicates) and asserts each is `covers`-ed by exactly
 // one row. A NEW expression surface that nobody classified — the #1887 class of
-// "declared-but-unwired predicate" — breaks the build.
+// "declared-but-unwired predicate" — breaks the build. Discovery is by SCHEMA
+// NAME (`EXPRESSION_INPUT_SCHEMAS` in that file), so a slot narrowed onto its
+// own schema must register that schema there or it drops out of the scan.
 
 export type ExprMode = 'compile' | 'interpret';
-export type ExprDialect = 'cel' | 'cron' | 'template' | 'js';
+/**
+ * What a surface is ACTUALLY evaluated as — deliberately not the spec's
+ * `ExpressionDialect` enum. `js` outlives its retirement from that enum
+ * (#3278), and `settings-visibility` never was in it: the settings manifest
+ * `visible` slots carry a closed hand-rolled grammar with its own evaluator
+ * (#7169 / #7327). A ledger that could only spell the three declared dialects
+ * would have to record the settings slot as `cel`, which is the exact
+ * misclassification it exists to surface.
+ */
+export type ExprDialect = 'cel' | 'cron' | 'template' | 'js' | 'settings-visibility';
 export type ExprState = 'enforced' | 'experimental' | 'removed';
 /** ADR-0058 D5 fail-policy tiers. */
 export type FailPolicy = 'compile-error' | 'fail-closed' | 'fail-soft-log' | 'throw';
@@ -143,9 +154,34 @@ export const EXPRESSION_SURFACE: ExprSurface[] = [
       // this new surface). Interpreted by the objectui page:tabs renderer to
       // omit the whole tab (header + panel) when FALSE.
       'ui/component.zod.ts:visibleWhen',
-      'system/settings-manifest.zod.ts:visible',
+      // `system/settings-manifest.zod.ts:visible` used to sit here. It never
+      // belonged: this row's dialect is `cel` and its enforcement is the
+      // SchemaRenderer + celEngine, and the settings slot is evaluated by
+      // neither. Split out as `settings-visibility` in #7327.
     ],
   },
+  {
+    id: 'settings-visibility',
+    summary: 'settings-manifest `visible` — specifier + whole-manifest gating (a closed non-CEL grammar)',
+    // The one row in this ledger whose dialect is NOT one of the spec's three.
+    // That is the finding, not an oversight: the slot was typed
+    // `ExpressionInputSchema` — which labels its contents CEL — while its only
+    // two evaluators read a small hand-rolled grammar. Measured in #7169 over
+    // the 94 bundled predicates: routing them through CEL breaks 93 (`===` and
+    // `!==` are not CEL operators at all), so the maintainer's 2026-08-10
+    // ruling moved the DECLARATION rather than the evaluator. Classifying this
+    // `cel` under `cel-ui` would restate here the exact claim #7327 removed
+    // from the schema.
+    dialect: 'settings-visibility', mode: 'interpret', state: 'enforced', failPolicy: 'fail-closed',
+    enforcement:
+      'service-settings `evaluateVisibility` (visibility-eval.ts), called from `SettingsService.validatePatch` — a closed grammar: single root `data`, one-level member access, `|| && !`, `=== !== == != >= <= > <`, parens, and string/number/bool/null literals, optionally `${…}`-wrapped, as a bare string or a `{dialect, source}` envelope. Fail-closed since #7310: a predicate outside the grammar REFUSES the save (SettingsValidationError, HTTP 400) instead of skipping the specifier — `visible` gates every other check on the key (`required`, `options`, `pattern`, `valueDomain`, the value window), so skipping it switched all of them off at once. The console evaluates the same string client-side through `new Function(...)`. Since #7327 the spec DECLARES that same grammar (`SettingsVisibilityInputSchema`), so it is refused at publish/parse too',
+    covers: ['system/settings-manifest.zod.ts:visible'],
+    // Proof is the producer/consumer pin rather than a runtime fixture: the
+    // failure mode this surface actually has is the two sides disagreeing about
+    // what parses, which is what that file measures — over the real bundled
+    // corpus and an in/out-of-grammar table.
+    proof: 'packages/services/service-settings/src/settings-visibility-declaration.pin.test.ts',
+  },
   {
     id: 'cel-action-param-option-visible',
     summary: "action param option-list per-option gating (params[].options[].visibleWhen, #5016)",

packages/qa/dogfood/test/expression-conformance.test.ts

@@ -2,9 +2,12 @@
 //
 // ADR-0058 D7 — the Expression Surface Conformance ledger is a CHECKED artifact.
 // Refactored onto the reusable ADR-0060 `checkLedger` helper: one call asserts
-// the shared invariants AND the ratchet (re-discover every ExpressionInputSchema
-// field in packages/spec/src + the RLS using/check predicates; fail if any is
-// unclassified). The expression-specific invariants (mode/dialect/fail-policy,
+// the shared invariants AND the ratchet (re-discover every expression-declaring
+// field in packages/spec/src — see EXPRESSION_INPUT_SCHEMAS — plus the RLS
+// using/check predicates; fail if any is unclassified). Discovery is by SCHEMA
+// NAME, so a slot that moves to a narrower schema leaves the scan unless that
+// schema is registered: #7327 is the worked example. The
+// expression-specific invariants (mode/dialect/fail-policy,
 // compile rows name the canonical compiler) stay here.
 
 import { describe, expect, it } from 'vitest';
@@ -20,7 +23,26 @@ const SPEC_SRC = join(REPO_ROOT, 'packages/spec/src');
 
 const MODES = new Set(['compile', 'interpret']);
 const FAIL_POLICIES = new Set(['compile-error', 'fail-closed', 'fail-soft-log', 'throw']);
-const DIALECTS = new Set(['cel', 'cron', 'template', 'js']);
+// `settings-visibility` is not one of the spec's `ExpressionDialect` members on
+// purpose (#7327): it is a closed non-CEL grammar with its own evaluator, and
+// the ledger's job is to say what a surface IS, not what its schema used to
+// claim. See the `settings-visibility` row.
+const DIALECTS = new Set(['cel', 'cron', 'template', 'js', 'settings-visibility']);
+
+/**
+ * Schemas that DECLARE an expression surface. `ExpressionInputSchema` is the
+ * shared one; a slot whose accepted grammar is narrower gets its own schema and
+ * must be listed here too, or the ratchet silently stops watching it.
+ *
+ * That is not hypothetical — it is how this scan behaves by construction, and
+ * #7327 hit it: narrowing the settings `visible` slots off `ExpressionInputSchema`
+ * dropped them out of discovery and turned their ledger entry stale. A new
+ * narrowed alias belongs in this list on the same commit that introduces it.
+ */
+const EXPRESSION_INPUT_SCHEMAS = ['ExpressionInputSchema', 'SettingsVisibilityInputSchema'];
+const DECLARES_EXPRESSION = new RegExp(
+  String.raw`^\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*:\s*(?:${EXPRESSION_INPUT_SCHEMAS.join('|')})\b`,
+);
 
 /** Re-discover every expression surface in the spec — the SAME scan the ledger encodes. */
 function discoverSurfaces(): Set<string> {
@@ -34,7 +56,7 @@ function discoverSurfaces(): Set<string> {
       else if (ent.isFile() && ent.name.endsWith('.zod.ts')) {
         const rel = relative(SPEC_SRC, p);
         for (const line of readFileSync(p, 'utf8').split('\n')) {
-          const m = line.match(/^\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*:\s*ExpressionInputSchema\b/);
+          const m = line.match(DECLARES_EXPRESSION);
           if (m) found.add(`${rel}:${m[1]}`);
         }
       }