onchange: backed by a constraint on its field, refused only when taken back

Two changes to onchange-is-not-validation, shipped together because the
first reads true only with the second. A constraint backs an onchange
only when it covers a field the onchange watches (models.Constraint and
_sql_constraints by the names in their SQL, @api.constrains by its plain
names, unreadable ones cover everything); before, any constraint in the
file cleared it. And a returned warning dict counts as a refusal only
when its branch also writes a watched field or clears a field on the
record; a warning beside no write is a notice the user saves past in
the form as in an import. A raise still counts on its own.

OCA 99 unchanged (account_loan's rate note stays out). OpenSPP 153 ->
157, all read into classification-openspp-rest: spp_area level cap,
CR type required documents, one head per group true; spp_import_match
false, backed by the parent's constraint. Core 2345 -> 2339: +11 (8
true: four partner blocks, loyalty expiry, negative price rounding,
expense edit rights, a component equal to its product; 3 checked on the
server elsewhere), -17, all read, all notices (OCR checksum, GST name
length, token archiving, open cart pricelist, ...). A first draft that
counted only watched-field writes lost spp_change_request_v2's
registrant clear, which nothing else enforces; clearing any field
counts now. 280 of 280 hand-classified true positives still reported.
ARCHITECTURE 3.68; 3.67's worklist line updated.

ARCHITECTURE.md

@@ -3354,8 +3354,8 @@ warning dict as a refusal. Narrowing the guard first would ship that noise, 25 f
 true, so it was not taken. A variant that counts a warning dict only when the onchange also
 resets a field it watches was run for information. It keeps all 11 true additions and 4 of the
 false ones, but it also removes 17 existing core findings and 1 on OpenSPP that nobody has read.
-Whether that is the right next change depends on reading those 18 first. It is on the worklist,
-not in the checker.
+Whether that is the right next change depended on reading those 18 first. They were read the
+same day, and §3.68 is what came of it.
 
 **The series half ships.** A `_sql_constraints` block no longer counts as backing on a tree
 that pins 19 or later; on 16 to 18 and on an unknown series it still does, as §3.45 requires.
@@ -3366,6 +3366,65 @@ includes the state before OpenSPP's own incident fix (208d9758), whose file also
 registry throws away is not a backstop, and the checker should not say it is. All 277
 hand-classified true positives are still reported.
 
+### 3.68 A warning refuses only when it takes the value back
+
+**Measured 2026-09-27.** §3.67 left the field-matched guard out because the file-wide one was
+hiding a wider test: any returned warning dict counted as a refusal. Both changes ship now,
+together, and the second is what makes the first read true.
+
+`_refuses_in_branch` asks one thing of a warning: does the branch that returns it also take the
+value back? The branch is the innermost `if`, `for` or `while` around the warning, or the whole
+body when there is none. Taking the value back is writing a field the onchange watches (the
+quantity clamped to zero, the removed document restored, the component taken out again), or
+clearing any field on the record to `False`, `None` or empty (the blocked partner, the
+registrant that no longer fits). A `raise` still counts on its own. A warning with no write
+beside it is a notice, and the user saves past it in the form as easily as in an import, so
+nothing is being enforced anywhere and the rule's harm is not there. A write outside the
+warning's branch does not count either: `account.move` sets its `show_name_warning` flag in
+an earlier `if`, and that flag is not a refusal.
+
+The first draft only looked for writes to watched fields, and reading what it removed stopped
+it. `spp_change_request_v2`'s `_onchange_request_type_id` watches the request type and clears
+the registrant when a group lands on an individual-only type. Nothing else checks that pairing:
+the registrant's domain is a form attribute, so a change request made through the API can pair
+them. Clearing a field the onchange does not watch is a refusal too, and the test now says so.
+Setting one to a suggested value is not: a scrap order's recommended location, moved in for
+the user with a note, refuses nothing.
+
+| | before | after |
+|---|---|---|
+| OCA | 99 | 99 |
+| OpenSPP | 153 | **157** |
+| odoo core | 2,345 | **2,339** |
+
+Every change was read. Added: on OpenSPP the four from §3.67, 3 true and 1 false, now in
+`classification-openspp-rest-2026-09.json` under a new class, `backed-by-the-parent-constraint`.
+On core, 11: the 8 true from §3.67 (the four partner blocks, loyalty expiry, negative price
+rounding, expense edit rights, a component equal to its product) and 3 of the 4 that are checked
+on the server elsewhere (the work order's dates, the reference unit, the Argentinian journal).
+The API key's duration no longer appears: its onchange only warns. OCA's `account_loan` note
+does not come back.
+
+Removed: 17 on core, all read, and none refuses anything. Six are advice about a value that
+saves anyway: an OCR number that fails its checksum, an invoice name too long for GST rule
+46(b), an EGP rate with more than five decimals, a rounding finer than the decimal accuracy, a
+package heavier than its type allows, a pricelist minimum quantity that event tickets will
+ignore. The other eleven say what is about to happen: tokens archived with a payment method or
+provider, a payment method attached to a provider, pricelists archived with the feature, a
+carrier's rating error, a subcontracting purchase order, a decreased service quantity, tracked
+products already in stock, a storage category with no location, an open cart keeping its
+pricelist, and a scrap order's recommended location. None of them is in a classification file.
+
+So the rule now reports 15 more onchanges than it did and 17 fewer, and of the 15, 11 are
+true. OpenSPP's census gains 3 true and 1 false; core's 17 removals were notices nobody had
+read, and they are not claimed as false positives fixed. All 280 hand-classified true
+positives are still reported, the 3 new ones among them.
+
+What it still does not see: a constraint whose fields sit under another name, as
+`spp_import_match`'s parent `@api.constrains("field_ids")` does for its child's `field_id`, and a
+check the server makes in an inverse, a wizard's `create()` or at posting, none of which this
+checker reads as a constraint. The 3 false additions on core are that.
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a

README.md

@@ -143,8 +143,8 @@ fails if this paragraph stops agreeing with them.
 
 On <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP the rate is
 <!--fig:openspp.rate-->0.7<!--/fig-->, and those findings have been read too: of the
-<!--fig:openspp.findings-->153<!--/fig--> it makes today,
-**<!--fig:openspp.read.true-->131<!--/fig--> true, <!--fig:openspp.read.false-->16<!--/fig-->
+<!--fig:openspp.findings-->157<!--/fig--> it makes today,
+**<!--fig:openspp.read.true-->134<!--/fig--> true, <!--fig:openspp.read.false-->17<!--/fig-->
 false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable**, with
 <!--fig:openspp.unread-->3<!--/fig--> not yet read. One rule produced 97 false positives
 along the way and has been rewritten because of them — that story is
@@ -611,13 +611,13 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 | Retrievable by their own probe | 27 of 27 at top 6, 25 of them at top 3 |
 | Hit rate on <!--fig:oca.lines-->33,960<!--/fig--> lines of reviewed OCA code | <!--fig:oca.rate-->2.9<!--/fig--> per 1000 lines: <!--fig:oca.findings-->99<!--/fig--> findings |
 | Those findings, read by hand | **<!--fig:oca.read.true-->83<!--/fig--> true positives**, <!--fig:oca.read.false-->6<!--/fig--> false, <!--fig:oca.read.undecidable-->7<!--/fig--> undecidable from one file, <!--fig:oca.unread-->3<!--/fig--> not yet read |
-| Hit rate on <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP (Odoo 19) | <!--fig:openspp.rate-->0.7<!--/fig--> per 1000 lines: <!--fig:openspp.findings-->153<!--/fig--> findings, +<!--fig:openspp.decided-->127<!--/fig--> another tool had already flagged, +<!--fig:openspp.advisory-->82<!--/fig--> advisory |
-| Those findings, read by hand | **<!--fig:openspp.read.true-->131<!--/fig--> true positives**, <!--fig:openspp.read.false-->16<!--/fig--> false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable, <!--fig:openspp.unread-->3<!--/fig--> not yet read |
+| Hit rate on <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP (Odoo 19) | <!--fig:openspp.rate-->0.7<!--/fig--> per 1000 lines: <!--fig:openspp.findings-->157<!--/fig--> findings, +<!--fig:openspp.decided-->127<!--/fig--> another tool had already flagged, +<!--fig:openspp.advisory-->82<!--/fig--> advisory |
+| Those findings, read by hand | **<!--fig:openspp.read.true-->134<!--/fig--> true positives**, <!--fig:openspp.read.false-->17<!--/fig--> false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable, <!--fig:openspp.unread-->3<!--/fig--> not yet read |
 | …the two `depends`/`constrains` rules alone | **<!--fig:cls.openspp.true-->87<!--/fig--> true**, <!--fig:cls.openspp.false-->15<!--/fig--> false, <!--fig:cls.openspp.undecidable-->3<!--/fig--> undecidable: <!--fig:cls.openspp.precision-->85<!--/fig-->% |
 | …the 8 composed-in Python rules alone | **<!--fig:cls.python.true-->9<!--/fig--> true**, <!--fig:cls.python.false-->42<!--/fig--> false: <!--fig:cls.python.precision-->18<!--/fig-->%, after 18 datetime verdicts were reversed: Odoo runs in UTC |
 | …`sudo-bypasses-record-rules` alone, before it was narrowed | <!--fig:cls.openspp-rest.sudo-bypasses-record-rules.true-->6<!--/fig--> true, <!--fig:cls.openspp-rest.sudo-bypasses-record-rules.false-->97<!--/fig--> false — 5.8%, and the reason it is now an AST pass |
-| Hit rate on <!--fig:core.lines-->559,663<!--/fig--> lines of odoo core 18.0 | <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines: <!--fig:core.findings-->2,345<!--/fig--> findings, <!--fig:core.read-->89<!--/fig--> of them read by hand: <!--fig:core.read.true-->45<!--/fig--> true, <!--fig:core.read.false-->44<!--/fig--> false |
-| Hand-classified true positives still reported | **<!--fig:survival.found-->277<!--/fig--> of <!--fig:survival.true-->277<!--/fig-->**, across <!--fig:survival.artifacts-->9<!--/fig--> classifications |
+| Hit rate on <!--fig:core.lines-->559,663<!--/fig--> lines of odoo core 18.0 | <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines: <!--fig:core.findings-->2,339<!--/fig--> findings, <!--fig:core.read-->89<!--/fig--> of them read by hand: <!--fig:core.read.true-->45<!--/fig--> true, <!--fig:core.read.false-->44<!--/fig--> false |
+| Hand-classified true positives still reported | **<!--fig:survival.found-->280<!--/fig--> of <!--fig:survival.true-->280<!--/fig-->**, across <!--fig:survival.artifacts-->9<!--/fig--> classifications |
 | **Recall against real Odoo bugfixes** | **<!--fig:recall.all.caught-->20<!--/fig--> of <!--fig:recall.all.in_scope-->334<!--/fig-->, <!--fig:recall.all.pct-->6<!--/fig-->%, across three ecosystems. See below.** |
 | Verdict stability, 12 questions x 5 runs | 12/12 same verdict every run |
 | Escalation rescued a bad draft | 11 of 21, 95% CI 32–72% |
@@ -743,8 +743,8 @@ files on a `float_compare` written somewhere else in them.
 The check that makes all of this safe is the same one every time, and it is worth
 stating as a number rather than a promise: across all
 <!--fig:survival.artifacts-->9<!--/fig--> classification artifacts,
-**<!--fig:survival.true-->277<!--/fig--> hand-classified true positives,
-<!--fig:survival.found-->277<!--/fig--> still found, none lost.** That is asserted by
+**<!--fig:survival.true-->280<!--/fig--> hand-classified true positives,
+<!--fig:survival.found-->280<!--/fig--> still found, none lost.** That is asserted by
 `python bin/figures.py --check`, which matches every `true` verdict to a finding in the
 committed fieldtest artifact for the same checkout at the same commit, and runs in CI.
 It is not done by reading the diff and hoping, and no longer by re-running against a
@@ -1087,7 +1087,7 @@ Reading them turned up three more checker defects, all of the same family as the
 `sudo(False)` one above: a model with `_auto = False` is a SQL view with no foreign key,
 so `ondelete` is not a decision about it; `sudo(flag=False)` is de-escalation by
 keyword; and `x.sudo(self.env.su)` restores the ambient level and cannot raise
-privilege. Core is now **<!--fig:core.findings-->2,345<!--/fig--> findings at
+privilege. Core is now **<!--fig:core.findings-->2,339<!--/fig--> findings at
 <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines**.
 
 One finding is worth acting on outside this project. Core's
@@ -1101,7 +1101,7 @@ Seven rules are now sampled on core, <!--fig:cls.odoo-core.rows-->105<!--/fig-->
 read, and the <!--fig:cls.sudo-core.rows-->45<!--/fig--> `sudo` findings a stricter
 re-scoping test added were read in full: <!--fig:cls.sudo-core.true-->1<!--/fig--> true,
 <!--fig:cls.sudo-core.false-->44<!--/fig--> false. Core makes
-<!--fig:core.findings-->2,345<!--/fig--> live ones. The rest stay unread,
+<!--fig:core.findings-->2,339<!--/fig--> live ones. The rest stay unread,
 and a rate on core is a statement about how often the rules fire there, not how often
 they are right.
 

bin/semantics.py

@@ -3054,11 +3054,130 @@ def float_coercion_of_external_money(code):
     return findings
 
 
+class _Every(object):
+    """A constraint is present and which fields it covers cannot be read."""
+
+
+EVERY_FIELD = _Every()
+
+
+def _sql_identifiers(node):
+    """Names inside a constraint's SQL text, or EVERY_FIELD when the text is
+    not a literal. Keywords come along (CHECK, UNIQUE, NOT) and match no field."""
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return set(re.findall(r"[A-Za-z_][A-Za-z0-9_]*", node.value))
+    return EVERY_FIELD
+
+
+def _constrained_fields(tree, legacy_dead):
+    """Field names some constraint in this file covers, or EVERY_FIELD.
+
+    Three spellings: @api.constrains (its plain names -- a dotted one registers
+    nothing), models.Constraint (the names in its SQL) and _sql_constraints (the
+    names in each entry's SQL, and nothing at all when `legacy_dead`, because
+    from 19 the registry never creates it). A constraint that is present but
+    cannot be read -- @api.constrains(*FIELDS), a _sql_constraints inherited and
+    extended -- covers every field, which is the reading this had before it
+    looked at fields at all.
+    """
+    covered = set()
+
+    def add(names):
+        if names is EVERY_FIELD:
+            return True
+        covered.update(names)
+        return False
+
+    for fn in _functions(tree):
+        declared = _decorator_args(fn, "api", "constrains")
+        if declared is UNREADABLE:
+            return EVERY_FIELD
+        if declared:
+            covered.update(d for d in declared if "." not in d)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call):
+            func = node.func
+            name = func.attr if isinstance(func, ast.Attribute) else \
+                func.id if isinstance(func, ast.Name) else None
+            if name == "Constraint":
+                if add(_sql_identifiers(node.args[0]) if node.args else EVERY_FIELD):
+                    return EVERY_FIELD
+            continue
+        if isinstance(node, (ast.Assign, ast.AugAssign, ast.AnnAssign)):
+            targets = node.targets if isinstance(node, ast.Assign) else [node.target]
+            if not any(isinstance(t, ast.Name) and t.id == "_sql_constraints"
+                       for t in targets) or node.value is None or legacy_dead:
+                continue
+            if not isinstance(node.value, (ast.List, ast.Tuple)):
+                return EVERY_FIELD
+            for entry in node.value.elts:
+                if not (isinstance(entry, (ast.List, ast.Tuple)) and len(entry.elts) > 1):
+                    return EVERY_FIELD
+                if add(_sql_identifiers(entry.elts[1])):
+                    return EVERY_FIELD
+    return covered
+
+
+def _clears(value):
+    """False, None, '' or an empty collection: what a form resets a field to."""
+    if isinstance(value, ast.Constant):
+        return value.value is False or value.value is None or value.value == ""
+    if isinstance(value, ast.Dict):
+        return not value.keys
+    return isinstance(value, (ast.List, ast.Tuple, ast.Set)) and not value.elts
+
+
+def _refuses_in_branch(fn, warning, watched):
+    """Does the branch that returns this warning also take the value back?
+
+    A warning dict on its own informs: "this reference already exists", "the
+    rate is far from the previous one", "please choose another package type".
+    The user saves anyway, from the form as from an import, so nothing is
+    enforced anywhere and the rule's harm -- a check only the form applies --
+    is not there. What refuses is the same branch writing back a field the
+    onchange watches (the quantity clamped, the partner cleared, the removed
+    document restored) or clearing any field on the record (a registrant that
+    does not fit the new request type). "The same branch" is the innermost
+    if, for or while around the warning, or the whole body when there is none.
+    """
+    parents = {}
+    for node in ast.walk(fn):
+        for child in ast.iter_child_nodes(node):
+            parents[id(child)] = node
+    branch = warning
+    while branch is not fn and not isinstance(branch, (ast.If, ast.For, ast.AsyncFor,
+                                                       ast.While)):
+        branch = parents.get(id(branch), fn)
+    roots = set() if watched is UNREADABLE else {w.split(".")[0] for w in watched}
+    aliases = _aliases(fn)
+
+    def on_record(node):
+        return isinstance(node, ast.Name) and aliases.get(node.id) == ()
+
+    for node in ast.walk(branch):
+        if isinstance(node, (ast.Assign, ast.AugAssign)):
+            targets = node.targets if isinstance(node, ast.Assign) else [node.target]
+            for target in targets:
+                if isinstance(target, ast.Attribute) and on_record(target.value) and (
+                        watched is UNREADABLE or target.attr in roots
+                        or _clears(node.value)):
+                    return True
+        elif (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)
+              and node.func.attr == "update" and on_record(node.func.value)
+              and node.args and isinstance(node.args[0], ast.Dict)):
+            for key, value in zip(node.args[0].keys, node.args[0].values):
+                if isinstance(key, ast.Constant) and (
+                        watched is UNREADABLE or key.value in roots or _clears(value)):
+                    return True
+    return False
+
+
 def onchange_tries_to_enforce(code, facts=None):
     """odoo.onchange-is-not-validation
 
-    An @api.onchange method that RAISES or returns a warning -- it is trying
-    to enforce an invariant the web client is the only thing that will apply.
+    An @api.onchange method that RAISES, or returns a warning while taking the
+    value back -- it is trying to enforce an invariant the web client is the
+    only thing that will apply.
 
     The regex this replaces read 400 characters after the decorator and could
     not see where the method ended. All three of its false positives are the
@@ -3071,40 +3190,39 @@ def onchange_tries_to_enforce(code, facts=None):
     positives -- an onchange that really does raise ValidationError, and ones
     that return the warning dict -- all stand.
 
-    A constraint anywhere in the file clears it, exactly as the
-    satisfied_pattern did: an onchange sitting beside a real @api.constrains
-    is the faster feedback the rule explicitly allows. _sql_constraints counts
-    here on 16 through 18 and on an unknown series, because it IS a constraint
+    A constraint in the file clears it when it covers a field the onchange
+    watches: an onchange beside a real @api.constrains on the same field is
+    the faster feedback the rule explicitly allows. Until 2026-09-27 ANY
+    constraint anywhere in the file cleared it, so a UNIQUE(reference)
+    silenced an onchange that raised on credit_limit. _sql_constraints counts
+    on 16 through 18 and on an unknown series, because it IS a constraint
     there, and not when the tree pins 19 or later, where the registry never
-    creates it. That changed nothing on the three trees measured.
-
-    "Anywhere in the file" is wider than the rule, and narrowing it to a
-    constraint that covers a field the onchange watches was measured on
-    2026-09-27 and not taken. It added 36 findings, and 11 read true. Most of
-    the rest were never refusals: a warning dict that informs ("the rate is
-    far from the previous one", "this reference already exists") and resets
-    nothing. The file-wide guard had been hiding that the warning test is too
-    wide, and narrowing the guard first would ship the noise. See ARCHITECTURE
-    3.67.
+    creates it (_constrained_fields).
+
+    Narrowing the guard alone added 36 findings and 11 read true, because the
+    wide guard had been hiding a second problem: a returned warning dict was
+    read as a refusal whatever it said. Most were notices -- "this reference
+    already exists", "the rate is far from the previous one" -- that the user
+    saves past in the form as easily as in an import, so nothing is enforced
+    anywhere. A warning counts now only when its branch also takes the value
+    back (_refuses_in_branch). Both together: OCA unchanged, OpenSPP +4 (3
+    true), core +11 (8 true) and -17, all 17 notices. ARCHITECTURE 3.67, 3.68.
     """
     tree, _ = parse_python(code)
     if tree is None:
         return []
-    legacy_dead = _series_at_least((facts or {}).get("odoo_series"), 19.0)
-
-    backed = False
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Name) and node.id == "_sql_constraints":
-            backed = backed or not legacy_dead
-        elif isinstance(node, ast.Attribute) and node.attr in ("constrains",
-                                                               "Constraint"):
-            backed = True
-    if backed:
-        return []
+    covered = _constrained_fields(
+        tree, _series_at_least((facts or {}).get("odoo_series"), 19.0))
 
     findings = []
     for fn in _functions(tree):
-        if _decorator_args(fn, "api", "onchange") is None:
+        watched = _decorator_args(fn, "api", "onchange")
+        if watched is None:
+            continue
+        if covered is EVERY_FIELD or (watched is UNREADABLE and covered):
+            continue
+        if watched is not UNREADABLE and any(w.split(".")[0] in covered
+                                             for w in watched):
             continue
         # Anchored on the decorator, not on the def below it. That is where
         # the rule is, where a reader looking the finding up will look, and
@@ -3124,10 +3242,10 @@ def onchange_tries_to_enforce(code, facts=None):
                     else _final_name(exc)
                 if name and ("Error" in name or "Warning" in name):
                     spot = node.lineno
-            elif isinstance(node, ast.Dict):
-                for key in node.keys:
-                    if isinstance(key, ast.Constant) and key.value == "warning":
-                        spot = node.lineno
+            elif isinstance(node, ast.Dict) and any(
+                    isinstance(key, ast.Constant) and key.value == "warning"
+                    for key in node.keys) and _refuses_in_branch(fn, node, watched):
+                spot = node.lineno
             if spot is None:
                 continue
             findings.append((

classification-openspp-rest-2026-09.json

@@ -11,8 +11,8 @@
  "files": 1351,
  "lines": 226937,
  "totals": {
-  "true": 46,
-  "false": 114,
+  "true": 49,
+  "false": 115,
   "undecidable": 3
  },
  "by_rule": {
@@ -33,8 +33,8 @@
    "false": 1
   },
   "odoo.onchange-is-not-validation": {
-   "false": 3,
-   "true": 4
+   "false": 4,
+   "true": 7
   },
   "odoo.float-comparison-needs-float-utils": {
    "true": 2,
@@ -60,7 +60,8 @@
   "identifier-not-value": 2,
   "sql-view-model": 1,
   "deliberate-recompute-trigger": 1,
-  "parent-store-refuses-the-cycle": 5
+  "parent-store-refuses-the-cycle": 5,
+  "backed-by-the-parent-constraint": 1
  },
  "hits": [
   {
@@ -1640,8 +1641,44 @@
    "class": "no-record-rule-on-this-model",
    "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
    "evidence": null
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_area/models/area_core.py",
+   "line": 88,
+   "evidence": "@api.onchange(\"parent_id\")",
+   "verdict": "true",
+   "class": null,
+   "why": "caps an area at level 10 here and nowhere else; the file's only constraints are unique(code), so an import or RPC can store level 11"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_change_request_v2/models/change_request_type.py",
+   "line": 206,
+   "evidence": "@api.onchange(\"available_document_ids\")",
+   "verdict": "true",
+   "class": null,
+   "why": "keeps required documents inside the available list only in the form; the file's constraints cover code, detail_model and the apply strategy"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_import_match/models/import_match.py",
+   "line": 187,
+   "evidence": "@api.onchange(\"field_id\")",
+   "verdict": "false",
+   "class": "backed-by-the-parent-constraint",
+   "why": "the parent spp.import.match's @api.constrains('field_ids') enforces the same no-duplicate rule, under a field name the child's onchange does not watch"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_registry/models/group_membership.py",
+   "line": 71,
+   "evidence": "@api.onchange(\"membership_type_ids\")",
+   "verdict": "true",
+   "class": null,
+   "why": "one head per group is checked here and in the group's write(); spp_change_request_v2's add_member creates memberships directly, past both"
   }
  ],
- "what_this_changed": "sudo-bypasses-record-rules went 6 true / 97 false / 3 undecidable, 5.8%. 73 of the 97 were on models the tree gives no ir.rule at all and 10 on a model whose only rule is [(1,'=',1)], so sudo dropped nothing at 83 of 106 sites. The rule is now an AST pass that asks the tree whether a filtering rule exists, and answers UNKNOWN -- keeping the finding -- for any model the walk did not see declared. The 14 remaining false positives constrain the search by hand to records the caller already named, in a spelling the rule does not recognise because it names only company_id. That is a worklist entry, not a narrowing: deciding a domain is already scoped means evaluating it.\n\n2026-09-26: 5 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true.",
+ "what_this_changed": "sudo-bypasses-record-rules went 6 true / 97 false / 3 undecidable, 5.8%. 73 of the 97 were on models the tree gives no ir.rule at all and 10 on a model whose only rule is [(1,'=',1)], so sudo dropped nothing at 83 of 106 sites. The rule is now an AST pass that asks the tree whether a filtering rule exists, and answers UNKNOWN -- keeping the finding -- for any model the walk did not see declared. The 14 remaining false positives constrain the search by hand to records the caller already named, in a spelling the rule does not recognise because it names only company_id. That is a worklist entry, not a narrowing: deciding a domain is already scoped means evaluating it.\n\n2026-09-26: 5 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true.\n\n2026-09-27: 4 onchange-is-not-validation findings added and read, surfaced when the checker stopped letting any constraint in the file clear it and started asking whether a constraint covers a field the onchange watches (ARCHITECTURE 3.68). 3 true, 1 false (backed-by-the-parent-constraint).",
  "worklist": "float-comparison-needs-float-utils is the next one down at 2 true / 5 false. All five compare an INTEGER to zero -- search_count, a read_group _count, SELECT COUNT(*) -- which the regex cannot see because it matches on the variable's name. Fixing it means tracing the assignment, so it is named here and not yet done. onchange-is-not-validation is 4 true / 3 false, and all three false ones are an onchange that sets a field rather than enforcing anything, which the rule's existing narrowing was supposed to exclude and does not catch when the write is to a Many2one."
-}
+}

corpus/build_corpus.py

@@ -674,7 +674,9 @@ ENRICH = {
     },
     "odoo.onchange-is-not-validation": {
         # An onchange that TRIES to enforce something: it raises, or it returns
-        # the warning dict that is the other way to refuse a value in the form.
+        # the warning dict while taking the value back in the same branch,
+        # which is the other way to refuse a value in the form. A warning that
+        # only informs is saved past in the form too (ARCHITECTURE 3.68).
         # Bare @api.onchange is not a violation -- setting a default, filling a
         # field from a provider and narrowing a domain are what onchange is for,
         # and flagging those fired on all 16 onchange declarations in two OCA
@@ -696,7 +698,8 @@ ENRICH = {
         # and backs nothing the onchange watches; the finding was false because
         # the onchange's warning informs and refuses nothing.) The checker reads
         # odoo_series off the tree facts and stops counting _sql_constraints
-        # when it says 19+, where the registry never creates it.
+        # when it says 19+, where the registry never creates it, and counts a
+        # constraint only when it covers a field the onchange watches.
         "semantic_check": "onchange_tries_to_enforce",
         "source": ODOO_ONCHANGE,
     },

fieldtest-oca-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T14:45:39+00:00",
+  "generated_utc": "2026-09-27T15:03:24+00:00",
   "stack": "odoo",
   "roots": [
     "server-tools",

fieldtest-odoo-core-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T14:50:55+00:00",
+  "generated_utc": "2026-09-27T15:09:46+00:00",
   "stack": "odoo",
   "roots": [
     "odoo"
@@ -631,6 +631,16 @@
       "likelihood": "unmeasured",
       "path": "addons/account/models/account_move.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 2384,
+      "evidence": "@api.onchange '_onchange_partner_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/account/models/account_move.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -3741,16 +3751,6 @@
       "likelihood": "unproven",
       "path": "addons/delivery/models/sale_order.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 43,
-      "evidence": "@api.onchange '_onchange_order_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/delivery/wizard/choose_delivery_carrier.py"
-    },
     {
       "rule": "odoo.constrains-iterate-recordset",
       "severity": "high",
@@ -5211,6 +5211,16 @@
       "likelihood": "construct",
       "path": "addons/hr_expense/models/hr_expense.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 324,
+      "evidence": "@api.onchange '_inverse_total_amount_currency' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/hr_expense/models/hr_expense.py"
+    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -7101,6 +7111,16 @@
       "likelihood": "unmeasured",
       "path": "addons/l10n_account_withholding_tax/wizards/account_payment_register_withholding_line.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 172,
+      "evidence": "@api.onchange '_onchange_partner_journal' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/l10n_ar/models/account_move.py"
+    },
     {
       "rule": "odoo.noupdate-on-user-editable-data",
       "severity": "medium",
@@ -7311,16 +7331,6 @@
       "likelihood": "construct",
       "path": "addons/l10n_dk_nemhandel_response/models/account_move.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 12,
-      "evidence": "@api.onchange '_onchange_rate_warning' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/l10n_eg_edi_eta/models/res_currency_rate.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -8251,16 +8261,6 @@
       "likelihood": "construct",
       "path": "addons/l10n_in/models/account_invoice.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 135,
-      "evidence": "@api.onchange '_onchange_name_warning' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/l10n_in/models/account_invoice.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -9781,16 +9781,6 @@
       "likelihood": "construct",
       "path": "addons/l10n_se/models/account_move.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 14,
-      "evidence": "@api.onchange 'onchange_l10n_se_default_vendor_payment_ref' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/l10n_se/models/res_partner.py"
-    },
     {
       "rule": "python.bare-except-catches-the-exit",
       "severity": "high",
@@ -10091,6 +10081,16 @@
       "likelihood": "defect",
       "path": "addons/loyalty/controllers/portal.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 65,
+      "evidence": "@api.onchange '_restrict_expiration_on_loyalty' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/loyalty/models/loyalty_card.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -12061,6 +12061,16 @@
       "likelihood": "unmeasured",
       "path": "addons/mrp/models/mrp_production.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 915,
+      "evidence": "@api.onchange '_onchange_product_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/mrp/models/mrp_production.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -12331,6 +12341,16 @@
       "likelihood": "construct",
       "path": "addons/mrp/models/mrp_workorder.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 446,
+      "evidence": "@api.onchange '_onchange_date_finished' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/mrp/models/mrp_workorder.py"
+    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -12581,16 +12601,6 @@
       "likelihood": "construct",
       "path": "addons/mrp/models/stock_scrap.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 51,
-      "evidence": "@api.onchange '_onchange_serial_number' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/mrp/models/stock_scrap.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -12791,16 +12801,6 @@
       "likelihood": "defect",
       "path": "addons/mrp_subcontracting/models/stock_warehouse.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 21,
-      "evidence": "@api.onchange 'onchange_picking_type_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/mrp_subcontracting_dropshipping/models/purchase.py"
-    },
     {
       "rule": "python.assert-is-not-validation",
       "severity": "critical",
@@ -12831,26 +12831,6 @@
       "likelihood": "unproven",
       "path": "addons/payment/data/payment_cron.xml"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 113,
-      "evidence": "@api.onchange '_onchange_warn_before_disabling_tokens' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/payment/models/payment_method.py"
-    },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 146,
-      "evidence": "@api.onchange '_onchange_provider_ids_warn_before_attaching_payment_method' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/payment/models/payment_method.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -12861,16 +12841,6 @@
       "likelihood": "construct",
       "path": "addons/payment/models/payment_provider.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 258,
-      "evidence": "@api.onchange '_onchange_state_warn_before_disabling_tokens' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/payment/models/payment_provider.py"
-    },
     {
       "rule": "odoo.onchange-is-not-validation",
       "severity": "critical",
@@ -14411,6 +14381,16 @@
       "likelihood": "construct",
       "path": "addons/product/models/product_pricelist_item.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 422,
+      "evidence": "@api.onchange '_onchange_price_round' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/product/models/product_pricelist_item.py"
+    },
     {
       "rule": "odoo.sql-needs-query-parameters",
       "severity": "critical",
@@ -14481,16 +14461,6 @@
       "likelihood": "construct",
       "path": "addons/product/models/product_template_attribute_value.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 25,
-      "evidence": "@api.onchange '_onchange_group_sale_pricelist' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/product/models/res_config_settings.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -14521,16 +14491,6 @@
       "likelihood": "unmeasured",
       "path": "addons/product/models/res_partner.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 10,
-      "evidence": "@api.onchange '_onchange_rounding' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/product/models/uom_uom.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -15211,6 +15171,16 @@
       "likelihood": "construct",
       "path": "addons/purchase/models/purchase_order.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 365,
+      "evidence": "@api.onchange 'onchange_partner_id_warning' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/purchase/models/purchase_order.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -16511,6 +16481,16 @@
       "likelihood": "construct",
       "path": "addons/sale/models/sale_order.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 895,
+      "evidence": "@api.onchange '_onchange_partner_id_warning' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/sale/models/sale_order.py"
+    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -18071,16 +18051,6 @@
       "likelihood": "unproven",
       "path": "addons/sale_project_stock/models/stock_picking.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 25,
-      "evidence": "@api.onchange '_onchange_service_product_uom_qty' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/sale_purchase/models/sale_order_line.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -18761,16 +18731,6 @@
       "likelihood": "construct",
       "path": "addons/spreadsheet/models/spreadsheet_mixin.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 464,
-      "evidence": "@api.onchange '_onchange_tracking' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/stock/models/product.py"
-    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -18831,16 +18791,6 @@
       "likelihood": "defect",
       "path": "addons/stock/models/product.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 82,
-      "evidence": "@api.onchange '_onchange_sublocation' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/stock/models/product_strategy.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -19711,6 +19661,16 @@
       "likelihood": "construct",
       "path": "addons/stock/models/stock_picking.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 1033,
+      "evidence": "@api.onchange '_onchange_picking_type' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/stock/models/stock_picking.py"
+    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -20361,16 +20321,6 @@
       "likelihood": "unmeasured",
       "path": "addons/stock_delivery/wizard/choose_delivery_package.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 38,
-      "evidence": "@api.onchange '_onchange_package_type_weight' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/stock_delivery/wizard/choose_delivery_package.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -20861,6 +20811,16 @@
       "likelihood": "defect",
       "path": "addons/transifex/models/transifex_code_translation.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 20,
+      "evidence": "@api.onchange '_onchange_uom_ids' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "addons/uom/models/uom_uom.py"
+    },
     {
       "rule": "odoo.noupdate-on-user-editable-data",
       "severity": "medium",
@@ -21591,16 +21551,6 @@
       "likelihood": "unmeasured",
       "path": "addons/website_event_sale/controllers/main.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 8,
-      "evidence": "@api.onchange '_onchange_event_sale_warning' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/website_event_sale/models/product_pricelist.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -22361,16 +22311,6 @@
       "likelihood": "defect",
       "path": "addons/website_sale/models/product_template.py"
     },
-    {
-      "rule": "odoo.onchange-is-not-validation",
-      "severity": "critical",
-      "line": 32,
-      "evidence": "@api.onchange '_onchange_property_product_pricelist' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "addons/website_sale/models/res_partner.py"
-    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",

fieldtest-openspp-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T14:46:49+00:00",
+  "generated_utc": "2026-09-27T15:05:40+00:00",
   "stack": "odoo",
   "roots": [
     "OpenSPP2-19.0"
@@ -841,6 +841,16 @@
       "likelihood": "construct",
       "path": "spp_area/models/area_core.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 88,
+      "evidence": "@api.onchange '_onchange_parent_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_area/models/area_core.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -1451,6 +1461,16 @@
       "likelihood": "unproven",
       "path": "spp_change_request_v2/models/change_request.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 206,
+      "evidence": "@api.onchange '_onchange_available_document_ids' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_change_request_v2/models/change_request_type.py"
+    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -2601,6 +2621,16 @@
       "likelihood": "preference",
       "path": "spp_import_match/models/import_match.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 187,
+      "evidence": "@api.onchange '_onchange_field_id' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_import_match/models/import_match.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -3101,6 +3131,16 @@
       "likelihood": "unmeasured",
       "path": "spp_registry/models/group.py"
     },
+    {
+      "rule": "odoo.onchange-is-not-validation",
+      "severity": "critical",
+      "line": 71,
+      "evidence": "@api.onchange '_membership_type_onchange' refuses a value, and onchange runs in the web client form only -- an import, an RPC call, a cron or a direct create() never triggers it, so the record enters the database unchallenged",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_registry/models/group_membership.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",

tests/test_semantics.py

@@ -1033,6 +1033,64 @@ def test_a_dead_sql_constraint_does_not_back_an_onchange_on_19():
                                {"odoo_series": "19.0"}) == []
 
 
+CREDIT_ONCHANGE = ('class M(models.Model):\n'
+                   '{constraint}'
+                   '    @api.onchange("credit_limit")\n'
+                   '    def _onchange_credit_limit(self):\n'
+                   '        if self.credit_limit < 0:\n'
+                   '            raise ValidationError("no")\n')
+
+
+@pytest.mark.parametrize("constraint", [
+    '    _ref = models.Constraint("UNIQUE(reference)", "no")\n',
+    '    _sql_constraints = [("ref", "UNIQUE(reference)", "no")]\n',
+    '    @api.constrains("reference")\n    def _check(self):\n        pass\n',
+    '    @api.constrains("partner_id.credit_limit")\n    def _check(self):\n        pass\n',
+])
+def test_a_constraint_on_another_field_does_not_back_an_onchange(constraint):
+    """A uniqueness rule on `reference` used to silence an onchange raising
+    on `credit_limit`. A dotted @api.constrains name registers nothing."""
+    code = CREDIT_ONCHANGE.format(constraint=constraint)
+    assert semantics.run_check("onchange_tries_to_enforce", code), constraint
+
+
+@pytest.mark.parametrize("constraint", [
+    '    _c = models.Constraint("CHECK(credit_limit >= 0)", "no")\n',
+    '    @api.constrains("credit_limit")\n    def _check(self):\n        pass\n',
+    '    @api.constrains(*FIELDS)\n    def _check(self):\n        pass\n',
+    '    _sql_constraints = BASE + [("c", "CHECK(credit_limit >= 0)", "no")]\n',
+])
+def test_a_constraint_on_a_watched_field_or_an_unreadable_one_backs_it(constraint):
+    code = CREDIT_ONCHANGE.format(constraint=constraint)
+    assert semantics.run_check("onchange_tries_to_enforce", code) == [], constraint
+
+
+WARNING_ONCHANGE = ('class M(models.Model):\n'
+                    '    @api.onchange("qty")\n'
+                    '    def _onchange_qty(self):\n'
+                    '        self.hint = False\n'
+                    '        if self.qty < 0:\n'
+                    '{branch}'
+                    '            return {{"warning": {{"title": "x", "message": "y"}}}}\n')
+
+
+@pytest.mark.parametrize("branch,refuses", [
+    ("", False),                                        # a notice
+    ("            self.qty = 0\n", True),               # the watched field back
+    ("            self.update({'qty': 0})\n", True),
+    ("            self.partner_id = False\n", True),    # a field cleared
+    ("            self.location_id = self.other\n", False),   # a suggestion
+])
+def test_a_warning_refuses_only_when_its_branch_takes_the_value_back(branch, refuses):
+    """Most warning dicts on core inform: "this reference already exists",
+    "the rate is far from the previous one". The user saves past them in the
+    form as in an import, so nothing is enforced anywhere. `self.hint = False`
+    outside the branch does not count: it is a UI flag, not the refusal."""
+    code = WARNING_ONCHANGE.format(branch=branch)
+    found = semantics.run_check("onchange_tries_to_enforce", code)
+    assert bool(found) is refuses, (branch, found)
+
+
 # ------------------------------------------------ the value-origin trace
 #
 # Four rules were classified false for one reason: each read a variable's NAME