pyric 0.1.0-alpha.20 → 0.1.0-alpha.21

package/src/rules/linter/hallucinations.ts

@@ -95,7 +95,14 @@ const HALLUCINATED_GLOBALS: Record<string, string> = {
   undefined:  '`undefined` does not exist in rules — use `null`',
 };
 
-const VALID_MATH_METHODS = new Set(['abs', 'ceil', 'floor', 'round', 'sqrt', 'pow', 'isNaN']);
+/**
+ * The math-namespace functions production Firestore actually compiles.
+ * Notably ABSENT: `isInfinite`. Reference docs list it, but production
+ * rejects it at compile (`Function not found error: Name: [math.isInfinite]`).
+ * Exported so the stdlib-modules drift test can assert the documented
+ * catalog never re-grows a name this validator rejects.
+ */
+export const VALID_MATH_METHODS = new Set(['abs', 'ceil', 'floor', 'round', 'sqrt', 'pow', 'isNaN']);
 
 
 /**
@@ -122,6 +129,21 @@ const WRONG_CONTEXT_PATHS: WrongPath[] = [
     suggestion: '`resource.id` is not available — capture the document id with `/{docId}` in the match path' },
 ];
 
+/**
+ * Auth-token claims that are typed BOOL in production. Comparing one
+ * against a STRING literal compiles fine (CEL is dynamically typed) but
+ * the comparison is cross-type, so `== "true"` is always false and
+ * `!= "true"` is always true, and the latter silently opens the rule.
+ * WRONG_CONTEXT_PATHS can't express this: it matches `receiver.property`
+ * at depth 2, while token claims live at `request.auth.token.<claim>`
+ * and the bug is in the *comparison*, not the path itself.
+ *
+ * Only claims verifiably typed bool belong here. `email_verified` is the
+ * documented one (`request.auth.token.email_verified: bool`).
+ * `firebase.sign_in_provider` is a string, so it is deliberately NOT listed.
+ */
+const BOOL_TOKEN_CLAIMS = new Set(['email_verified']);
+
 /**
  * Built-in CEL methods that, when accessed without parentheses, are
  * almost certainly a missing-call mistake. Restricted to a small
@@ -186,40 +208,51 @@ interface Loc {
   ruleIndex?: number;
 }
 
+/**
+ * Visit every expression in the match tree, carrying the set of
+ * user-defined function names visible where the expression sits. Scope
+ * accumulates outward-in: a block sees its own declarations plus every
+ * enclosing scope's, which is the resolution order the simulator
+ * implements in `simulator/match-resolution.ts`.
+ */
 function walkAllExpressions(
   match: MatchBlock,
-  visit: (expr: Expression, loc: Loc) => void,
+  inheritedScope: ReadonlySet<string>,
+  visit: (expr: Expression, loc: Loc, scope: ReadonlySet<string>) => void,
 ) {
   const path = match.path.raw;
+  const scope = new Set(inheritedScope);
+  for (const fn of match.functions) scope.add(fn.name);
   for (const fn of match.functions) {
     const loc: Loc = { matchPath: path, functionName: fn.name };
-    walkExpr(fn.body, loc, visit);
-    for (const b of fn.lets) walkExpr(b.value, loc, visit);
+    walkExpr(fn.body, loc, scope, visit);
+    for (const b of fn.lets) walkExpr(b.value, loc, scope, visit);
   }
   for (let i = 0; i < match.allows.length; i++) {
-    walkExpr(match.allows[i].condition, { matchPath: path, ruleIndex: i }, visit);
+    walkExpr(match.allows[i].condition, { matchPath: path, ruleIndex: i }, scope, visit);
   }
-  for (const child of match.children) walkAllExpressions(child, visit);
+  for (const child of match.children) walkAllExpressions(child, scope, visit);
 }
 
 function walkExpr(
   expr: Expression,
   loc: Loc,
-  visit: (expr: Expression, loc: Loc) => void,
+  scope: ReadonlySet<string>,
+  visit: (expr: Expression, loc: Loc, scope: ReadonlySet<string>) => void,
 ) {
-  visit(expr, loc);
+  visit(expr, loc, scope);
   switch (expr.type) {
-    case 'binaryOp': walkExpr(expr.left, loc, visit); walkExpr(expr.right, loc, visit); break;
-    case 'unaryOp': walkExpr(expr.operand, loc, visit); break;
-    case 'methodCall': walkExpr(expr.object, loc, visit); expr.args.forEach(a => walkExpr(a, loc, visit)); break;
-    case 'memberAccess': walkExpr(expr.object, loc, visit); break;
-    case 'bracketAccess': walkExpr(expr.object, loc, visit); walkExpr(expr.index, loc, visit); break;
-    case 'ternary': walkExpr(expr.condition, loc, visit); walkExpr(expr.consequent, loc, visit); walkExpr(expr.alternate, loc, visit); break;
-    case 'inExpr': walkExpr(expr.element, loc, visit); walkExpr(expr.collection, loc, visit); break;
-    case 'isExpr': walkExpr(expr.value, loc, visit); break;
-    case 'listLiteral': expr.elements.forEach(e => walkExpr(e, loc, visit)); break;
-    case 'mapLiteral': expr.entries.forEach(en => { walkExpr(en.key, loc, visit); walkExpr(en.value, loc, visit); }); break;
-    case 'functionCall': expr.args.forEach(a => walkExpr(a, loc, visit)); break;
+    case 'binaryOp': walkExpr(expr.left, loc, scope, visit); walkExpr(expr.right, loc, scope, visit); break;
+    case 'unaryOp': walkExpr(expr.operand, loc, scope, visit); break;
+    case 'methodCall': walkExpr(expr.object, loc, scope, visit); expr.args.forEach(a => walkExpr(a, loc, scope, visit)); break;
+    case 'memberAccess': walkExpr(expr.object, loc, scope, visit); break;
+    case 'bracketAccess': walkExpr(expr.object, loc, scope, visit); walkExpr(expr.index, loc, scope, visit); break;
+    case 'ternary': walkExpr(expr.condition, loc, scope, visit); walkExpr(expr.consequent, loc, scope, visit); walkExpr(expr.alternate, loc, scope, visit); break;
+    case 'inExpr': walkExpr(expr.element, loc, scope, visit); walkExpr(expr.collection, loc, scope, visit); break;
+    case 'isExpr': walkExpr(expr.value, loc, scope, visit); break;
+    case 'listLiteral': expr.elements.forEach(e => walkExpr(e, loc, scope, visit)); break;
+    case 'mapLiteral': expr.entries.forEach(en => { walkExpr(en.key, loc, scope, visit); walkExpr(en.value, loc, scope, visit); }); break;
+    case 'functionCall': expr.args.forEach(a => walkExpr(a, loc, scope, visit)); break;
   }
 }
 
@@ -231,9 +264,19 @@ function walkExpr(
  * distinct (rule, key, location) tuple — duplicate identical patterns
  * within the same rule are de-duplicated.
  */
-function isUnsupportedDebugCall(expr: Expression, allowDebug?: boolean): boolean {
+/**
+ * A `debug(...)` call that resolves to NOTHING. Production has no built-in
+ * `debug`, but a ruleset is free to declare `function debug(v) { ... }`, and
+ * that call resolves and evaluates like any other user function, so only an
+ * unresolved call is a finding.
+ */
+function isUnresolvedDebugCall(
+  expr: Expression,
+  scope: ReadonlySet<string>,
+  allowDebug?: boolean,
+): boolean {
   if (allowDebug) return false;
-  return expr.type === 'functionCall' && expr.name === 'debug';
+  return expr.type === 'functionCall' && expr.name === 'debug' && !scope.has('debug');
 }
 
 function isHallucinatedMethodCall(expr: Expression): boolean {
@@ -275,6 +318,37 @@ function isWrongContextPath(expr: Expression): { suggestion: string } | undefine
   return WRONG_CONTEXT_PATHS.find(p => p.receiver === recv && p.property === prop);
 }
 
+/** Is `expr` a member access spelling exactly `request.auth.token.<claim>`
+ *  for a claim in BOOL_TOKEN_CLAIMS? */
+function boolTokenClaimName(expr: Expression): string | undefined {
+  if (expr.type !== 'memberAccess' || !BOOL_TOKEN_CLAIMS.has(expr.property)) return undefined;
+  const token = expr.object;
+  if (token.type !== 'memberAccess' || token.property !== 'token') return undefined;
+  const auth = token.object;
+  if (auth.type !== 'memberAccess' || auth.property !== 'auth') return undefined;
+  return auth.object.type === 'identifier' && auth.object.name === 'request'
+    ? expr.property
+    : undefined;
+}
+
+/**
+ * `request.auth.token.email_verified == "true"` (or `!=`, either operand
+ * order). The claim is a bool; a string literal can never equal it, so the
+ * comparison is a constant: `==` always denies, `!=` always allows.
+ */
+function boolTokenClaimStringComparison(
+  expr: Expression,
+): { claim: string; op: string; literal: string } | undefined {
+  if (expr.type !== 'binaryOp' || (expr.op !== '==' && expr.op !== '!=')) return undefined;
+  for (const [side, other] of [[expr.left, expr.right], [expr.right, expr.left]] as const) {
+    const claim = boolTokenClaimName(side);
+    if (claim && other.type === 'literal' && typeof other.value === 'string') {
+      return { claim, op: expr.op, literal: other.value };
+    }
+  }
+  return undefined;
+}
+
 function isLengthPropertyAccessOnMethod(expr: Expression): boolean {
   return expr.type === 'memberAccess' && expr.property === 'length' && expr.object.type === 'methodCall';
 }
@@ -301,14 +375,23 @@ export function checkHallucinations(ast: FirestoreRules, options: { allowDebug?:
     warnings.push(w);
   }
 
-  walkAllExpressions(ast.service.match, (expr, loc) => {
-    if (isUnsupportedDebugCall(expr, options.allowDebug)) {
+  // Functions declared above `service` and directly inside it are visible
+  // everywhere below, so they seed the scope the walk carries down.
+  const outerScope = new Set<string>();
+  for (const fn of ast.functions ?? []) outerScope.add(fn.name);
+  for (const fn of ast.service.functions ?? []) outerScope.add(fn.name);
+
+  walkAllExpressions(ast.service.match, outerScope, (expr, loc, scope) => {
+    if (isUnresolvedDebugCall(expr, scope, options.allowDebug)) {
       emit('HALLUCINATED_GLOBAL', 'debug', loc, {
         rule: 'HALLUCINATED_GLOBAL',
         severity: 'error',
-        message: '`debug()` helper is only permitted in local testing environments; remove it before deployment.',
+        message:
+          '`debug()` is not a Firestore rules function and no function named `debug` is declared in scope. '
+          + 'Production rejects the whole ruleset at compile time with '
+          + '`Function not found error: Name: [debug]`, so nothing in the file deploys.',
         location: loc,
-        fix: 'Remove debug() wrapper around the expression.',
+        fix: 'Remove the debug() call and evaluate the inner expression directly.',
       });
     }
 
@@ -400,6 +483,21 @@ export function checkHallucinations(ast: FirestoreRules, options: { allowDebug?:
       }
     }
 
+    const boolClaim = boolTokenClaimStringComparison(expr);
+    if (boolClaim) {
+      const { claim, op, literal } = boolClaim;
+      emit('BOOL_TOKEN_CLAIM', `${claim}|${op}|${literal}`, loc, {
+        rule: 'BOOL_TOKEN_CLAIM',
+        severity: 'error',
+        message:
+          `\`request.auth.token.${claim}\` is a bool, but it is compared against the string ` +
+          `"${literal}", a cross-type comparison that is always ${op === '==' ? 'false (rule always denies)' : 'true (rule silently allows)'}. ` +
+          `Compare against the boolean literal instead: \`request.auth.token.${claim} ${op} true\`.`,
+        location: loc,
+        fix: `Drop the quotes: \`request.auth.token.${claim} ${op} ${literal === 'false' ? 'false' : 'true'}\`.`,
+      });
+    }
+
     if (isLengthPropertyAccessOnMethod(expr)) {
       emit('LENGTH_PROPERTY', '', loc, {
         rule: 'LENGTH_PROPERTY',

package/src/rules/linter/linter.ts

@@ -18,7 +18,6 @@ import {
   extractFirstExpression,
   buildCallGraph,
   maxCallDepth,
-  countGetCalls,
   countFunctionCallSites,
   functionContainsGet,
   referencesRequestTime,
@@ -26,6 +25,7 @@ import {
   collectAllRules,
 } from './ast-utils.js';
 import { checkSyntaxHints, checkHallucinations } from './hallucinations.js';
+import { countDocumentAccessCalls } from '../grammar/document-access-count.js';
 
 // ═══ Types ═══
 
@@ -93,7 +93,11 @@ const THRESHOLDS = {
   CALL_DEPTH_WARN: 6,
   CALL_DEPTH_ERROR: 10,
   GET_COUNT_WARN: 5,
-  GET_COUNT_ERROR: 10,               // documented by Google
+  // Production allows EXACTLY 10 document access calls per request
+  // evaluation; the 11th fails (site-docs secure/firestore-rules-limits.md).
+  // Error fires strictly ABOVE this value, the same boundary as SEM-3 and
+  // the simulator's runtime LookupBudget.
+  GET_COUNT_ERROR: 10,
 };
 
 // ═══ Lint Rules ═══
@@ -350,12 +354,14 @@ function checkGetCount(
   for (const fn of allFunctions) fnMap.set(fn.name, fn);
 
   for (let i = 0; i < rules.length; i++) {
-    const count = countGetCalls(rules[i].rule.condition, fnMap);
-    if (count >= THRESHOLDS.GET_COUNT_ERROR) {
+    const count = countDocumentAccessCalls(rules[i].rule.condition, fnMap);
+    // Error only ABOVE the limit: production allows exactly 10 and fails
+    // the 11th, so a rule at exactly 10 is legal (still worth the WARN).
+    if (count > THRESHOLDS.GET_COUNT_ERROR) {
       warnings.push({
         rule: 'GET_COUNT',
         severity: 'error',
-        message: `Rule #${i} may invoke ${count} get()/exists() calls. Limit is ${THRESHOLDS.GET_COUNT_ERROR}.`,
+        message: `Rule #${i} may invoke ${count} get()/exists()/getAfter()/existsAfter() calls. Limit is ${THRESHOLDS.GET_COUNT_ERROR}.`,
         location: { ruleIndex: i },
         fix: 'Cache get() results via a config() wrapper function. Same-path calls are cached by Firestore.',
       });
@@ -363,7 +369,7 @@ function checkGetCount(
       warnings.push({
         rule: 'GET_COUNT',
         severity: 'warning',
-        message: `Rule #${i} invokes ${count} get()/exists() calls. Limit is ${THRESHOLDS.GET_COUNT_ERROR}.`,
+        message: `Rule #${i} invokes ${count} get()/exists()/getAfter()/existsAfter() calls. Limit is ${THRESHOLDS.GET_COUNT_ERROR}.`,
         location: { ruleIndex: i },
       });
     }
@@ -767,7 +773,16 @@ export interface LintOptions {
    * block linting of a valid current ruleset.
    */
   previousSource?: string;
-  /** Set to true when validating in a local emulator or testing environment where debug() is permitted. */
+  /**
+   * Set to true ONLY when linting a scratch ruleset that will never be
+   * deployed and an unresolved `debug()` call should be tolerated.
+   * Production Firestore rejects a ruleset that calls `debug()` at compile
+   * time (`Function not found error: Name: [debug]`), so the linter rejects
+   * it by default, including when `testCases` is supplied. A ruleset that
+   * declares its own `function debug(...)` is never flagged, with or
+   * without this flag. This flag is an explicit caller choice; it is never
+   * inferred from other options.
+   */
   allowDebug?: boolean;
 }
 
@@ -836,8 +851,15 @@ export function lintFirestoreRules(source: string, options: LintOptions = {}): L
   // Rule 8: Get duplication (same get()-containing function called multiple times)
   checkGetDuplication(allRules, allFunctions, warnings);
 
-  // Rule 9: Hallucinations — JS-style code that parses but fails at runtime
-  warnings.push(...checkHallucinations(ast, { allowDebug: options.allowDebug || Boolean(options.testCases && options.testCases.length > 0) }));
+  // Rule 9: Hallucinations, JS-style code that parses but fails at runtime.
+  // `allowDebug` is an EXPLICIT caller opt-in only. It used to be implied by
+  // a non-empty `testCases` array, which silently disabled the debug()
+  // rejection in any lint run that also carried a test suite, exactly the
+  // authoring path that feeds the write gate. Production rejects debug() at
+  // compile time (`Function not found error: Name: [debug]`), so the default
+  // must reject; a caller linting a ruleset that will never deploy can still
+  // pass `allowDebug: true`.
+  warnings.push(...checkHallucinations(ast, { allowDebug: options.allowDebug }));
 
   // Rule 9.5: Always-true predicates and recursive-wildcard open rules.
   // Severity: error so deployRules refuses to swap. The agent's #1
@@ -884,7 +906,7 @@ export function lintFirestoreRules(source: string, options: LintOptions = {}): L
   let maxExprs = 0;
   let maxGets = 0;
   for (const r of allRules) {
-    const gets = countGetCalls(r.rule.condition, fnMap);
+    const gets = countDocumentAccessCalls(r.rule.condition, fnMap);
     if (gets > maxGets) maxGets = gets;
   }
 

package/src/rules/rtdb/grammar/simulator.ts

@@ -115,23 +115,21 @@ export class DataSnapshot {
 
   child(path: string): DataSnapshot {
     const parts = path.split('/').filter(p => p.length > 0);
-    let current: unknown = this._value;
-    let currentPath = this._path;
+    if (parts.length === 0) return this;
 
+    let current: unknown = this._value;
     for (const part of parts) {
-      if (current === null || current === undefined || typeof current !== 'object') {
+      if (current !== null && current !== undefined && typeof current === 'object') {
+        current = Object.hasOwn(current as object, part)
+          ? ((current as Record<string, unknown>)[part] ?? null)
+          : null;
+      } else {
         current = null;
-        currentPath = `${currentPath}/${part}`.replace(/\/+/g, '/');
-        break;
       }
-      // Own-property access only: a `__proto__`/`constructor` child must
-      // not resolve to the JS prototype chain.
-      current = Object.hasOwn(current as object, part)
-        ? ((current as Record<string, unknown>)[part] ?? null)
-        : null;
-      currentPath = `${currentPath === '/' ? '' : currentPath}/${part}`;
     }
 
+    const prefix = this._path === '/' ? '' : this._path;
+    const currentPath = `${prefix}/${parts.join('/')}`;
     return new DataSnapshot(current, currentPath, this._root);
   }
 
@@ -139,9 +137,10 @@ export class DataSnapshot {
     if (this._path === '/') return null;
     const parts = this._path.split('/').filter(p => p.length > 0);
     parts.pop();
-    const parentPath = '/' + parts.join('/');
+    if (parts.length === 0) {
+      return new DataSnapshot(this._root, '/');
+    }
     const rootSnap = new DataSnapshot(this._root, '/');
-    if (parentPath === '/') return rootSnap;
     return rootSnap.child(parts.join('/'));
   }
 

package/src/rules/rtdb/simulation/handler.ts

@@ -58,6 +58,23 @@ function snapshotChildKeys(snap: DataSnapshot): string[] {
  * the first unsupported node, else `null` when every applicable `.validate`
  * passes.
  */
+function hasValidateRule(n: RtdbNode): boolean {
+  if (n.validate) return true;
+  return n.children.some(hasValidateRule);
+}
+
+function shouldValidateSiblingSubtree(
+  currentSegments: readonly string[],
+  hasLocalDeletion: boolean,
+  allWritePaths: readonly string[][],
+): boolean {
+  return (
+    currentSegments.length > 0 ||
+    hasLocalDeletion ||
+    allWritePaths.some((wp) => wp.length === 1)
+  );
+}
+
 function findFailingValidate(
   node: RtdbNode,
   data: DataSnapshot,
@@ -65,31 +82,47 @@ function findFailingValidate(
   bindings: Record<string, string>,
   buildContext: ContextBuilder,
   pathToWrite: string[],
+  updates?: readonly { path: string; value?: unknown }[],
 ): ValidateFailure | null {
   let firstUnsupported: ValidateFailure | null = null;
 
+  const writePathStrings = new Set<string>();
+  if (updates && updates.length > 0) {
+    for (const u of updates) {
+      writePathStrings.add(u.path.split('/').filter(Boolean).join('/'));
+    }
+  }
+  writePathStrings.add(pathToWrite.filter(Boolean).join('/'));
+  const allWritePaths = Array.from(writePathStrings).map((p) => p.split('/').filter(Boolean));
+
   function walk(
     node: RtdbNode,
     data: DataSnapshot,
     newData: DataSnapshot,
     bindings: Record<string, string>,
-    remainingPath: string[],
+    currentSegments: string[],
+    isUnderModifiedSubtree: boolean,
   ): ValidateFailure | null {
-    // A null proposed value is a delete — RTDB does not validate deletes.
-    if (!newData.exists()) return null;
-
-    const rule = node.validate;
-    if (rule) {
-      if (!rule.parsed.valid) {
-        if (!firstUnsupported) {
-          firstUnsupported = { node, rule, bindings, unsupported: true };
+    if (newData.exists()) {
+      const rule = node.validate;
+      if (rule) {
+        if (!rule.parsed.valid) {
+          if (!firstUnsupported) {
+            firstUnsupported = { node, rule, bindings, unsupported: true };
+          }
+        } else {
+          const result = evaluateRtdbExpression(rule.raw, buildContext(data, newData, bindings));
+          if (!result) return { node, rule, bindings };
         }
-      } else {
-        const result = evaluateRtdbExpression(rule.raw, buildContext(data, newData, bindings));
-        if (!result) return { node, rule, bindings };
       }
     }
 
+    const isAtOrBelowWriteTarget = allWritePaths.some(
+      (wp) => wp.length <= currentSegments.length && wp.every((seg, idx) => seg === currentSegments[idx]),
+    );
+
+    const hasLocalDeletion = snapshotChildKeys(data).some((k) => !newData.child(k).exists());
+
     for (const child of node.children) {
       const childSegments = child.path.split('/').filter(Boolean);
       if (childSegments.length === 0) continue;
@@ -97,49 +130,118 @@ function findFailingValidate(
       const lastSegment = childSegments[childSegments.length - 1];
       const isPathVar = lastSegment.startsWith('$');
 
-      // Above the write location, validation follows only the operation path.
-      // Once the write location is reached, it fans out through every child
-      // present in the proposed value.
-      if (remainingPath.length > 0) {
-        if (!isPathVar && remainingPath[0] !== lastSegment) continue;
-        return walk(
-          child,
-          data.child(remainingPath[0]),
-          newData.child(remainingPath[0]),
-          isPathVar ? { ...bindings, [lastSegment]: remainingPath[0] } : bindings,
-          remainingPath.slice(1),
-        );
-      }
+      if (isAtOrBelowWriteTarget || isUnderModifiedSubtree) {
+        if (isPathVar) {
+          for (const key of snapshotChildKeys(newData)) {
+            const failure = walk(
+              child,
+              data.child(key),
+              newData.child(key),
+              { ...bindings, [lastSegment]: key },
+              [...currentSegments, key],
+              true,
+            );
+            if (failure) return failure;
+          }
+        } else {
+          if (newData.child(lastSegment).exists()) {
+            const failure = walk(
+              child,
+              data.child(lastSegment),
+              newData.child(lastSegment),
+              bindings,
+              [...currentSegments, lastSegment],
+              true,
+            );
+            if (failure) return failure;
+          }
+        }
+      } else {
+        // We are at an ancestor of write path(s)
+        if (isPathVar) {
+          const writeKeys = new Set<string>();
+          for (const wp of allWritePaths) {
+            if (
+              wp.length > currentSegments.length &&
+              currentSegments.every((seg, idx) => seg === wp[idx])
+            ) {
+              writeKeys.add(wp[currentSegments.length]);
+            }
+          }
+          for (const key of writeKeys) {
+            const failure = walk(
+              child,
+              data.child(key),
+              newData.child(key),
+              { ...bindings, [lastSegment]: key },
+              [...currentSegments, key],
+              false,
+            );
+            if (failure) return failure;
+          }
 
-      if (isPathVar) {
-        // Bind the path variable to each key actually present in the new
-        // data — a `$var` node validates every child of the written value.
-        for (const key of snapshotChildKeys(newData)) {
-          const failure = walk(
-            child,
-            data.child(key),
-            newData.child(key),
-            { ...bindings, [lastSegment]: key },
-            [],
+          if (
+            hasValidateRule(child) &&
+            shouldValidateSiblingSubtree(currentSegments, hasLocalDeletion, allWritePaths)
+          ) {
+            for (const key of snapshotChildKeys(newData)) {
+              if (writeKeys.has(key)) continue;
+              const failure = walk(
+                child,
+                data.child(key),
+                newData.child(key),
+                { ...bindings, [lastSegment]: key },
+                [...currentSegments, key],
+                true,
+              );
+              if (failure) return failure;
+            }
+          }
+        } else {
+          const key = lastSegment;
+          const isChildOnWritePath = allWritePaths.some(
+            (wp) =>
+              wp.length > currentSegments.length &&
+              wp[currentSegments.length] === key &&
+              currentSegments.every((seg, idx) => seg === wp[idx]),
           );
-          if (failure) return failure;
+
+          if (isChildOnWritePath) {
+            const failure = walk(
+              child,
+              data.child(key),
+              newData.child(key),
+              bindings,
+              [...currentSegments, key],
+              false,
+            );
+            if (failure) return failure;
+          } else {
+            // Sibling branch
+            if (
+              newData.child(key).exists() &&
+              hasValidateRule(child) &&
+              shouldValidateSiblingSubtree(currentSegments, hasLocalDeletion, allWritePaths)
+            ) {
+              const failure = walk(
+                child,
+                data.child(key),
+                newData.child(key),
+                bindings,
+                [...currentSegments, key],
+                true,
+              );
+              if (failure) return failure;
+            }
+          }
         }
-      } else {
-        const failure = walk(
-          child,
-          data.child(lastSegment),
-          newData.child(lastSegment),
-          bindings,
-          [],
-        );
-        if (failure) return failure;
       }
     }
 
     return null;
   }
 
-  const realFailure = walk(node, data, newData, bindings, pathToWrite);
+  const realFailure = walk(node, data, newData, bindings, [], false);
   return realFailure ?? firstUnsupported;
 }
 
@@ -343,6 +445,7 @@ export class SimulateHandler {
               {},
               buildContext,
               pathSegments,
+              updates,
             );
             if (failure) {
               return {