Record the declined verdict for the mirror null-guard gate on the sparse action face - #8979

Fixes #8881

The maintainer's 2026-08-06 ruling on #4953 asked, as item 2, for an evaluation of the mirror of checkNullGuards — flag != null on a sparse binding — for the action visible/disabled face. The ledger in packages/lint/src/validate-null-guards.ts recorded that evaluation as owed, with no answer.

The answer is: declined. Do not build it. This PR is comment-only and records the verdict with its measurements in the ledger that poses the question, so the next reader does not re-derive it and so a closed card does not leave a stale "owed" behind.

The premise shift is real — re-measured, not inherited

The card flagged its own renderer evidence as dated. Re-read on objectui 2e82ab2: usePredicateRecordContext binds the row as { ...row, record: row, data: row }, and evalRowPredicate binds the same three ways. So a record.x predicate does now resolve the namespace on all four action renderers and does reach the sparse-binding fault for real. Confirmed, not carried forward.

Four measurements against origin/main @ 585edf738 + objectui 2e82ab2

1. != null is not a distinctive fault — it is one spelling of nine. On a sparse binding the abort happens at key resolution, before any operator is reached:

record.a == 'pending'   | SPARSE: FAULT [runtime] No such key: a
record.a != null        | SPARSE: FAULT [runtime] No such key: a
record.a != 'owner'     | SPARSE: FAULT [runtime] No such key: a
!record.a               | SPARSE: FAULT [runtime] No such key: a
record.a > 1            | SPARSE: FAULT [runtime] No such key: a

The ledger's mirror table reads as though != null were the special case. It is not special at all.

2. Yield: 2 of 34 authored action predicates (5.9%). Census over production + examples in both repos — 34 record-scoped action predicates, all members of the fault class, exactly 2 matching record.x [!=]= null, both in one file (examples/app-showcase/.../predicate-matrix.action.ts). Zero of the 34 use has(). The 32 missed include every platform object's actions (sys-user, sys-invitation, sys-member, sys-approval-request).

3. Sparseness is not decidable from the metadata this linter sees. It is a property of the view's $select projection — and the two hits from (2) prove it inside one file: identical != null guards on identical locations, where f_lookup/f_lookups are not default-list columns (so it faults on list_item) while f_textarea is one (so it does not). Nothing in the action metadata distinguishes them. && short-circuiting makes it worse — record.id == ctx.user.id && record.two_factor_enabled != true never reaches the absent key when the first conjunct is false, so faulting depends on row data. A sound static rule would flag 34 of 34, which is a platform-contract finding rather than a lint rule.

4. The prescription would be wrong. has() guards absence, not nullness:

A list row is both sparse-capable and null-capable, so both failure modes are live on this one face. Swapping != null for has() would trade one silent fail-closed vanish for another — the exact error this row already refuses in the opposite direction, mirrored.

Routing

The card's domain:devx read was anchored on the gate landing in packages/lint. Since the recommendation is to build no gate, the residual work is not devx: it is the authoring-contract contradiction filed as #8975, which belongs to the metadata/docs lane. Flagging for re-routing as the triage comment invited.

Not done here

has(record.x) && record.x != null is the measured-correct idiom, and neither declared-fields.ts nor the showcase says it. Correcting that changes what authors are told to write, so it is filed separately (#8975) rather than ridden in on this PR. #4953 clause 2 is untouched — the binding stays sparse permanently, and nothing here re-opens it.

Verification

Comment-only change; no behavior change. Gate union re-run at final head a2ceecb38:

• pnpm check:nul-bytes — OK (5935 files, self-test 75 assertions)
• pnpm check:cross-package-test-inputs — OK (26 self-test cases, 12 packages)
• pnpm --filter @objectstack/lint typecheck — clean
• pnpm --filter @objectstack/lint test — 73 files, 2041 passed / 4 skipped

Gates re-derived with node scripts/pm/dispatch-gates.mjs against the actual changed paths; it returned the same two families the dispatch named, plus the any-edit check:nul-bytes.

skip-changeset: comments only in packages/lint, nothing user-visible is released.

Generated by Claude Code