@@ -0,0 +1,21 @@
+---
+'@objectstack/lint': minor
+---
+
+fix(lint)!: a field group's `visibleWhen` is judged like a field's own `visibleWhen` — in `os validate` / `os build` and at the object save door, refused as `expression-invalid` at the group's key
+
+`fieldGroups[].visibleWhen` gates the whole group, header included, and the form renderer fails it closed: a predicate that cannot evaluate hides the group on every form and record page. No pass of the expression rule read the slot, so a group predicate naming a field the object does not declare (`record.no_such_field == 'x'`) saved with a 200 and the section vanished, while the same text on a field's `visibleWhen` or an action's `visible` was refused 422 at the same door. The object walk now judges every field group's `visibleWhen` with the field `visibleWhen` slot's rules: it must parse, read fields as `record.FIELD` (never bare), name fields the object declares, call only registered functions, and read no root beyond `record`, `previous` and `parent`. The finding is located at `object 'NAME' · field group 'KEY' visibleWhen`, and the root refusal is worded for the group's fail-closed gate.
+
+Clause-②: no (narrowing) — the object save door, `os validate` and `os build` refuse a field group `visibleWhen` they accepted before. Nothing is widened.
+
+Metadata-protocol: narrowed (an object's `fieldGroups[].visibleWhen` may no longer carry a predicate the field `visibleWhen` slot refuses)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed or renamed: ObjectFieldGroupSchema.visibleWhen keeps its shape and meaning, and the build and the door now give it the verdict a field visibleWhen already gets. A refused predicate never evaluated (the group was hidden on every form), so there is no rewrite that keeps what the author meant; the author fixes the predicate, and the refusal names the field or root. -->
+
+**BREAKING** accept-set narrowing at the object save door (`PUT /api/v1/meta/object/:name`, draft promotion, package draft publish) and in `os validate` / `os build`.
+
+- **Before.** A field group `visibleWhen` with an unknown field, a bare field reference, an unregistered function or a syntax error saved, and the group was hidden on every form and detail page with nothing said. A `current_user` read saved too, and hid the group everywhere except in a form whose host binds the user.
+- **Now.** Each answers `422 INVALID_METADATA` at the door (and an `expression-invalid` error at build), located at the group's key.
+- **Unchanged.** A group predicate over the object's declared fields (`record.stage == 'won'`, `previous.stage != record.stage`) saves as before, and a group with no `visibleWhen` is untouched. No example, template or platform object in this repository declares a group `visibleWhen`.
+
+**The remedy.** Fix the predicate the refusal names: write `record.FIELD` against a field the object declares. To hide fields by role, declare field-level security on a permission set; to gate on record state, write the predicate against `record`.
@@ -52,6 +52,8 @@ export const Contact = ObjectSchema.create({
 });
 ```
 
+A group can also hide itself: `visibleWhen` on a `fieldGroups` entry is a CEL predicate over `record` (plus `previous`, and `parent` on a master-detail line item), and it gates the **whole** section, header included. The gate is **fail-closed**: when the predicate is false, or cannot evaluate at all, the section disappears. `os validate`, `os build` and the metadata save door check it with the same rules as a field's own `visibleWhen`, so a predicate that names a field the object does not have (`record.stauts == 'won'`) is refused as **`expression-invalid`** at the group's key instead of silently hiding the section on every form.
+
 **2. Layout grouping — form `sections` (on a view).** A specific form's explicit arrangement: which fields, which section, how many columns, collapsible. It can **inherit** the object's declared groups as its default or **override** them per form.
 
 ```ts
 
@@ -733,6 +733,20 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     // leaves are judged: the build and the door accept all 8, and refuse a
     // misspelt leaf.
     //
+    // [#26646] The field-group pass joins the build and the object door: every
+    // `fieldGroups[].visibleWhen`, the section predicate the form renderer
+    // gates the whole group on, fail-closed. It takes the field `visibleWhen`
+    // slot's verdict (the `record`-scoped check and the root verdict), located
+    // at the group's key. Before it no pass read the slot, so
+    // `record.no_such_field == 'x'` saved with a 200 while the same text on a
+    // field's `visibleWhen` or an action's `visible` was refused 422, and the
+    // group then vanished from every form. No entry-level change. MEASURED
+    // first: the repository ships 8 field groups on 4 objects (examples:
+    // app-showcase `contact` 4 and `semantic_zoo` 2; the `create-objectstack`
+    // blank template and the `os init` scaffold 1 each; platform objects
+    // none) and none carries a `visibleWhen` → 0 findings at either door,
+    // against a refusal at each for the card's body.
+    //
     // [#24677] The object pass also refuses a `lookup` / `master_detail`
     // whose `reference` is a stored-metadata-body table — the declaration the
     // #24316 hop refusal presupposes, which the engine never hydrates. No
 
@@ -0,0 +1,167 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #26646 — the build and the OBJECT write door judge a field group's
+ * `visibleWhen`.
+ *
+ * ## The state this closes
+ *
+ * `ObjectFieldGroupSchema.visibleWhen` is a live slot: the form renderer gates
+ * the whole group on it, header included, and a predicate that faults hides
+ * the group (fail-closed). No pass of `validateStackExpressions` read it, so
+ * the card's body — `record.no_such_field == 'x'` on a group — saved with a
+ * 200 and the group vanished from every form, while the same text on a
+ * field's `visibleWhen` or an action's `visible` was refused 422 at the same
+ * door.
+ *
+ * ## The crossing
+ *
+ * No registry change: the entry already declares `object`. The field-group
+ * pass runs in the object walk, after the field walk, with the field
+ * `visibleWhen` slot's verdict (the `record`-scoped check and the root
+ * verdict). It is not fenced on an object write, so the door's finding IS the
+ * build's finding — rule, location, message and hint — located at the group's
+ * key.
+ *
+ * The protocol-level half — the same verdict through the real `saveMetaItem` —
+ * is the #26646 block of
+ * `packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts`.
+ */
+import { describe, expect, it } from 'vitest';
+import { EXPRESSION_INVALID, runAuthoringRules } from './authoring-rules.js';
+import { runRuntimeAuthoringRules, runtimeAuthoringRulesFor } from './runtime-gate.js';
+
+/**
+ * The card's probe object, verbatim but for the predicate: `stage` sits in
+ * group `g1`, whose `visibleWhen` is the body under test.
+ */
+const fxGroup = (visibleWhen: unknown, name = 'qa_fg_probe') => ({
+  name,
+  label: 'QA',
+  sharingModel: 'private',
+  fields: {
+    name: { type: 'text', label: 'Name' },
+    stage: { type: 'text', label: 'Stage', group: 'g1' },
+  },
+  fieldGroups: [{ key: 'g1', label: 'G1', visibleWhen }],
+});
+
+const WHERE = "object 'qa_fg_probe' · field group 'g1' visibleWhen";
+
+/** The card's body: a read of a field the object does not declare. */
+const CARD_BODY = "record.no_such_field == 'x'";
+
+/**
+ * One refused body per finding the pass gives. Each `subject` is the named
+ * subject of the build's finding (what the author typed), not its prose.
+ */
+const REFUSED = [
+  { body: CARD_BODY, subject: 'unknown field `no_such_field`' },
+  { body: "stage == 'won'", subject: 'bare reference `stage`' },
+  { body: 'sqrt(record.stage) > 1', subject: '`sqrt`' },
+  { body: 'record.stage ==', subject: 'invalid CEL predicate' },
+  // The root verdict: a root the field-rule family never binds.
+  { body: "'org_admin' in current_user.positions", subject: 'reads `current_user`' },
+] as const;
+
+/** Bodies the build accepts on a field's `visibleWhen`, and so must accept on a group. */
+const ACCEPTED = [
+  "record.stage == 'won'",
+  "record.stage != null && record.name != ''",
+  "previous.stage != record.stage",
+] as const;
+
+const gateObject = (item: unknown, objects: unknown[] = []) =>
+  runRuntimeAuthoringRules({ type: 'object', item, context: { objects } });
+
+const expressionFindings = <T extends { rule: string }>(fs: readonly T[]): T[] =>
+  fs.filter((f) => f.rule === EXPRESSION_INVALID);
+
+const buildFindings = (...objects: unknown[]) => {
+  const stack = { objects };
+  return expressionFindings(runAuthoringRules('build', { normalized: stack, parsed: stack }));
+};
+
+const dump = (r: unknown) => JSON.stringify(r, null, 2);
+
+describe('#26646 — the object door gives the build\'s field group `visibleWhen` verdict', () => {
+  it('needs no registry change: `validateStackExpressions` is already on the object door', () => {
+    expect(runtimeAuthoringRulesFor('object').map((r) => r.name)).toContain('validateStackExpressions');
+  });
+
+  for (const { body, subject } of REFUSED) {
+    it(`⭐ LIT — a group's \`visibleWhen: ${body}\` is REFUSED, located at the group's key`, () => {
+      const result = gateObject(fxGroup(body));
+
+      expect(result.rulesRun).toContain('validateStackExpressions');
+      const errs = expressionFindings(result.errors);
+      expect(errs, dump(result)).toHaveLength(1);
+      expect(errs[0]).toMatchObject({ severity: 'error', where: WHERE, path: WHERE });
+      expect(errs[0]!.message).toContain(subject);
+    });
+  }
+
+  for (const body of ACCEPTED) {
+    it(`⭐ CONTROL — a group's \`visibleWhen: ${body}\` still publishes clean, and the build agrees`, () => {
+      const result = gateObject(fxGroup(body));
+
+      expect(result.rulesRun).toContain('validateStackExpressions');
+      expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+      expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+      expect(buildFindings(fxGroup(body))).toEqual([]);
+    });
+  }
+
+  it('⭐ CONTROL — a group with no `visibleWhen` publishes clean', () => {
+    const result = gateObject(fxGroup(undefined));
+
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+    expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+  });
+
+  it('⭐ PARITY — the card\'s body earns the same finding on the group as on the field\'s own `visibleWhen`', () => {
+    const onGroup = expressionFindings(gateObject(fxGroup(CARD_BODY)).errors);
+    const onField = expressionFindings(
+      gateObject({
+        ...fxGroup(undefined),
+        fields: { ...fxGroup(undefined).fields, stage: { type: 'text', label: 'Stage', group: 'g1', visibleWhen: CARD_BODY } },
+      }).errors,
+    );
+
+    expect(onField.map((f) => f.where)).toEqual(["object 'qa_fg_probe' · field 'stage' visibleWhen"]);
+    expect(onGroup.map((f) => f.message), dump(onGroup)).toEqual(onField.map((f) => f.message));
+  });
+
+  it('⭐ PARITY — for each refused body the door findings ARE the build findings', () => {
+    for (const { body } of REFUSED) {
+      const atBuild = buildFindings(fxGroup(body));
+      const atDoor = expressionFindings(gateObject(fxGroup(body)).errors);
+
+      // Non-vacuous: the build refuses each of them.
+      expect(atBuild.length, body).toBeGreaterThan(0);
+      expect(atDoor, body).toEqual(atBuild);
+    }
+  });
+
+  it('the root verdict is worded for the group, and names its fail-closed consequence', () => {
+    const errs = expressionFindings(gateObject(fxGroup(REFUSED[4].body)).errors);
+
+    expect(errs, dump(errs)).toHaveLength(1);
+    expect(errs[0]!.message).toMatch(/^`visibleWhen` reads `current_user`, but a field group's section predicate binds only `record`/);
+    expect(errs[0]!.message).toContain('fails CLOSED');
+    // The prescription is the group's: field-level security or a `record`
+    // rewrite, never the select-option move a field's message offers.
+    expect(errs[0]!.message).toContain('field-level security');
+    expect(errs[0]!.message).not.toContain('CHOICES of a select');
+  });
+
+  it('a stored sibling\'s broken group is not this write\'s to answer for (the differential)', () => {
+    const sibling = fxGroup(CARD_BODY, 'qa_fg_sibling');
+    // Non-vacuous: the sibling is refused at the build.
+    expect(buildFindings(sibling).length).toBeGreaterThan(0);
+
+    const result = gateObject(fxGroup(ACCEPTED[0]), [sibling]);
+
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+  });
+});
@@ -22,9 +22,11 @@
  * (its pins: `runtime-gate.object-validation-writes.test.ts`), since its
  * pass 2 the field-rule slots (`runtime-gate.object-field-rule-writes.test.ts`),
  * since its pass 3 the per-option `visibleWhen`
- * (`runtime-gate.object-option-visibility-writes.test.ts`), and since its
+ * (`runtime-gate.object-option-visibility-writes.test.ts`), since its
  * pass 4 the object's own action predicates
- * (`runtime-gate.object-action-predicate-writes.test.ts`). Every pass over the
+ * (`runtime-gate.object-action-predicate-writes.test.ts`), and since #26646 a
+ * field group's `visibleWhen`
+ * (`runtime-gate.object-field-group-visibility-writes.test.ts`). Every pass over the
  * object's own body now judges here; the passes over the stack's OTHER
  * collections (flows, top-level actions, sharing rules, hooks) do not. Both
  * halves are pinned below with the build still flagging the same body, so a
@@ -161,8 +163,9 @@ describe('#22019 / #22032 — every pass over the object\'s body judges on this
   /**
    * One body carrying a fault in EVERY pass over the object's own body — the
    * validation-rule pass (#22032 pass 1), a field-rule slot (`requiredWhen`,
-   * pass 2), an option's `visibleWhen` (pass 3) and an object action's
-   * `visible` and `disabled` (pass 4) — beside a CLEAN formula. Since pass 4 no
+   * pass 2), an option's `visibleWhen` (pass 3), an object action's
+   * `visible` and `disabled` (pass 4) and a field group's `visibleWhen`
+   * (#26646) — beside a CLEAN formula. Since pass 4 no
    * object-borne site is fenced: the build and the object door flag the same
    * sites in the same order. Each fault is one the build refuses at `error`,
    * so a fence put back on any of these passes drops its site from the door's
@@ -182,15 +185,17 @@ describe('#22019 / #22032 — every pass over the object\'s body judges on this
         options: [{ label: 'Gold', value: 'gold', visibleWhen: 'amount > 1' }],
       },
     },
+    fieldGroups: [{ key: 'g1', label: 'G1', visibleWhen: 'amount > 1' }],
     actions: [
       { name: 'fx_close', label: 'Close', type: 'script', target: 'close', visible: 'record.status ==', disabled: 'amount > 1' },
     ],
   });
-  /** Every object-borne site of the body (passes 1–4), by the build's `where`, in the build's order. */
+  /** Every object-borne site of the body (passes 1–4 and #26646), by the build's `where`, in the build's order. */
   const LIFTED_SITES = [
     "object 'fx_sqrt' · validation 'amount_root'",
     "object 'fx_sqrt' · field 'name' requiredWhen",
     "object 'fx_sqrt' · field 'tier' option 'gold' visibleWhen",
+    "object 'fx_sqrt' · field group 'g1' visibleWhen",
     "object 'fx_sqrt' · action 'fx_close' visible",
     "object 'fx_sqrt' · action 'fx_close' disabled",
   ];
@@ -232,7 +237,7 @@ describe('#22019 / #22032 — every pass over the object\'s body judges on this
     const result = gateObject(withEverySite());
 
     expect(result.rulesRun).toContain('validateStackExpressions');
-    // [#22032 passes 1–4] Every lifted pass's finding, in the build's order, and nothing else.
+    // [#22032 passes 1–4, #26646] Every lifted pass's finding, in the build's order, and nothing else.
     expect(expressionFindings(result.errors).map((f) => f.where), dump(result)).toEqual(LIFTED_SITES);
     expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
   });
@@ -244,9 +249,9 @@ describe('#22019 / #22032 — every pass over the object\'s body judges on this
     // in its own walk order (flows, the object's body, actions, sharing rules, hooks).
     expect(all.map((i) => i.where), dump(all)).toEqual([
       OTHER_SITES[0],
-      ...LIFTED_SITES.slice(0, 3),
+      ...LIFTED_SITES.slice(0, 4),
       OTHER_SITES[1],
-      ...LIFTED_SITES.slice(3),
+      ...LIFTED_SITES.slice(4),
       OTHER_SITES[2],
       OTHER_SITES[3],
     ]);
 
@@ -7,7 +7,7 @@ import { describe, it, expect } from 'vitest';
 // the root the rule never saw.
 import { SCOPE_ROOTS, buildScope, ExpressionEngine } from '@objectstack/formula';
 import { EVALUATED_EXPRESSION_SOURCE_REQUIRED, ExpressionInputSchema, ObjectStackSchema } from '@objectstack/spec';
-import { FieldSchema, ObjectSchema, SelectOptionSchema } from '@objectstack/spec/data';
+import { FieldSchema, ObjectFieldGroupSchema, ObjectSchema, SelectOptionSchema } from '@objectstack/spec/data';
 import { EvalUserSchema } from '@objectstack/spec/identity';
 import { SharingRuleSchema } from '@objectstack/spec/security';
 import { BulkActionDefSchema } from '@objectstack/spec/ui';
@@ -3349,7 +3349,8 @@ const READ_SURFACES: Array<{ receiver: string; expected: string[]; declaredBy: s
     // attachments, whose block names join the field index.
     // `listViews` joined with #24798: an object's own list views carry bulk
     // defs whose `confirmText` is judged.
-    expected: ['actions', 'attachedOnRead', 'fields', 'listViews', 'name', 'validations'],
+    // `fieldGroups` joined with #26646: each group's section predicate.
+    expected: ['actions', 'attachedOnRead', 'fieldGroups', 'fields', 'listViews', 'name', 'validations'],
     declaredBy: 'ObjectSchema',
     keys: () => Object.keys(ObjectSchema.shape),
   },
@@ -3435,6 +3436,14 @@ const READ_SURFACES: Array<{ receiver: string; expected: string[]; declaredBy: s
     declaredBy: 'SelectOptionSchema',
     keys: () => Object.keys(SelectOptionSchema.shape),
   },
+  {
+    // [#26646] One `fieldGroups[]` entry: its section predicate, and its
+    // `key` for the location.
+    receiver: 'fieldGroup',
+    expected: ['key', 'visibleWhen'],
+    declaredBy: 'ObjectFieldGroupSchema',
+    keys: () => shapeKeysOf(ObjectFieldGroupSchema),
+  },
   {
     // [#22228] A field's cell formatting rule — the list view's own rule
     // element, mounted on `FieldSchema.conditionalFormatting`. `condition` is