rest: GET /data/OBJECT/export?format=xlsx commits its workbook stream before the first read, so a refused query answers 200 instead of the 400 envelope (the xlsx half of #27682)

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Filing gate: ① product defect with a named fix site and a measured reach (finding, class a).

Found by: the #27682 card thread (PR #27753, os-dev-report 6509698175), measured; filed by domain:server seat 3.

What is wrong

#27682 makes the json export read its first page before it writes a byte, so a refused query answers the 400 envelope as csv does. The xlsx branch has the same defect: in packages/rest/src/data-action-routes.ts, createXlsxStream(res, styled) is opened before the read loop and commits the response to a streaming 200, so the same refused query (for example ?search=x&searchFields=nope, which csv answers 400 INVALID_FIELD) reaches the client as a 200.

Measured by the rest: GET /data/OBJECT/export?format=json writes its opening bracket before the first read, so a refused query arrives as a truncated JSON stream instead of a 400 #27682 thread through the real HonoHttpServer adapter: format=xlsx on the refused query answers 200.
reach: the public export door, GET /api/v1/data/:object/export?format=xlsx.
Triage's comment on rest: GET /data/OBJECT/export?format=json writes its opening bracket before the first read, so a refused query arrives as a truncated JSON stream instead of a 400 #27682 (6504427279) assumed xlsx already reads first; the measurement says it does not.

Business reason

A user who exports to Excel with a bad search gets a broken or empty workbook download instead of an error saying what was wrong; the console cannot show the refusal. Same symptom #27682 closes for json.

Fix site

The xlsx branch of the export handler in packages/rest/src/data-action-routes.ts: open the workbook writer after the first page is read, as #27682 does for json's opening bracket. A refusal on a later page stays out of scope (as in #27682). Lands after PR #27753 (same function).

Reader: the domain:server lane seat that claims it.

Dedupe: semantic search over this repo for "xlsx export refused query answers 200 workbook stream before first read": 2 hits, #27682 (json half) and #27500 (unknown format, closed); none covers xlsx.

Filed without domain:*; grading is triage's.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 可对外的 API | none | P②

Triage: p2 · `domain:server` · `area:api` · `pm:blocked` on PR #27753 · 2026-10-29T22:56Z

⛔ Not a claim.

Read fresh. Triage's miss: comment 6504427279 on rest: GET /data/OBJECT/export?format=json writes its opening bracket before the first read, so a refused query arrives as a truncated JSON stream instead of a 400 #27682 assumed xlsx already read first, and the measurement says it does not.
The xlsx writer opens after the first page is read, the same as rest: GET /data/OBJECT/export?format=json writes its opening bracket before the first read, so a refused query arrives as a truncated JSON stream instead of a 400 #27682's json, and answers the 400 envelope. Mid-stream refusals stay out of scope.
It is the same function as PR fix(rest): a refused json export answers the 400 envelope, not a truncated 200 stream #27753.
bug, pm:blocked.

Generated by Claude Code

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

Claim: PM loop round 2 · 2026-10-30T01:49Z · unlocked from pm:blocked (the PR it waited on has merged)
Session: session_016WV4cyUucJoh7384vix5rh (card thread; seat session_016WV4d1Np3hU7RQnA13YZcL)
Account: os-elon-musk
Branch: claude/project-thread-nc7szf (the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)
Worktree: objectstack-issue-27755
Domain: domain:server
Seat: domain:server#4
File surface: packages/rest/src/data-action-routes.ts (the export handler's xlsx branch only: open the workbook writer after the first page is read) and its tests, .changeset/*; ⛔ not the async import job region open PR #27795 (#27676) edits; no packages/spec, no governed path — stop on breach and explain in the report
Container & model: M, mode:thread, model: default (TIER_DEFAULT; dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: packages/rest's xlsx export opens its streaming workbook before the first read; the platform path that covers it is the read-first order the json export now uses (PR #27753) and csv always used; reached by any caller whose xlsx export query is refused.
Thread-read: 6510461172
Premise: holds (data-action-routes.ts on origin/main ddab8b99: createXlsxStream(res, styled) is opened before the read loop)
Serial constraints cleared: PR #27753 (#27682, same function) merged; open PR #27795 (#27676, os-sales) edits the same file in the import-job region — disjoint, ordinary concurrency, the later lander merges main.

domain:server#4 · os-elon-musk · session_016WV4cyUucJoh7384vix5rh

os-dev-report

{
  "issue": 27755,
  "status": "done",
  "branch": "claude/project-thread-nc7szf",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27888",
  "session": "session_016WV4cyUucJoh7384vix5rh",
  "head": "733ab4dc",
  "premise_still_valid": true,
  "summary": "The xlsx export opened its exceljs streaming writer (createXlsxStream) before the first findData; opening it commits the Hono adapter to a streaming 200, so a refused first read answered 200. The writer now opens inside the read loop on the first chunk, before the zero-row break, next to json's opening bracket (#27753). A successful xlsx export is unchanged. Head 733ab4dc merges origin/main after #27795 landed; the import-job region is untouched.",
  "tests": "New packages/rest/src/export-xlsx-refusal-envelope.test.ts through the real HonoHttpServer: refusal rows over SqlDriver(SQLite) `?search=x&searchFields=nope` (400 INVALID_FIELD) and `?search=x&searchFields=,` (400 VALIDATION_ERROR): xlsx status+body equal csv. Ablation: on the unfixed code (test committed first, fix absent) -> Tests 2 failed | 5 passed (xlsx 200); with the fix -> 7 passed. Preservation rows (1 page, 3 pages page=50/120 rows, 0 rows): status 200, workbook content type, X-Export-Styles applied, same read count, workbook loads with the same cells; green on unfixed and fixed code. After merging main: @objectstack/rest full suite Test Files 353 passed, Tests 7027 passed | 350 skipped; tsc --noEmit green.",
  "gates": "dispatch-gates --commands: 59 families, each run with exit captured before any pipe; --ran: 59 derived, 58 run (exit 0), 1 NOT-MEASURED DERIVED (pnpm check:dual-build-cjs-loads exit 3, needs whole-tree dist), 0 UNRUN, verdict exit 0. Re-derived after the main merge: identical list. pnpm lint exit 0. check-commit-card-trailers --pre-push exit 0. CI check-runs: pending at report time; the seat reads them.",
  "line_budget": "181 changed lines (+180/-1, 3 files) vs human-merge threshold 3000: under. Source diff 8 lines (+7/-1); the rest is the new test and the changeset.",
  "files_changed": [
    "packages/rest/src/data-action-routes.ts",
    "packages/rest/src/export-xlsx-refusal-envelope.test.ts",
    ".changeset/27755-xlsx-export-read-first.md"
  ],
  "deviations": [
    "The first commit carried a `Fixes #27755` line; it was reworded before the first push (check-commit-card-trailers), so no pushed commit carries a card relation. The relation is in the PR body only.",
    "PR has no assignee or reviewer request: the thread never writes assignee, labels or reviewers (dispatch standing line)."
  ],
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — reads went through gh api REST; no mcp__github__* tool was called",
  "api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, #27888, read-back identical); relay comment (POST /repos/objectstack-ai/objectstack/issues/27755/comments, this report). git push is not a REST write.",
  "open_questions": [],
  "out_of_scope_findings": []
}

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

ACCEPT → PR #27888 comment 6513919347 · head 733ab4dc · 2026-10-30T03:04Z · landing sent (no contract review owed).

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

Landed · 2026-10-30T03:29Z

reading	value
PR #27888	MERGED 2026-10-30T03:29Z, merge commit `2a3dec2d` (merge queue)
this card	closed `completed` by `Fixes #27755`

State: pm:dispatched removed in this stroke.

Navigation Menu

Repository navigation

rest: `GET /data/OBJECT/export?format=xlsx` commits its workbook stream before the first read, so a refused query answers 200 instead of the 400 envelope (the xlsx half of #27682) #27755

What is wrong

Business reason

Fix site

Triage: p2 · `domain:server` · `area:api` · `pm:blocked` on PR #27753 · 2026-10-29T22:56Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

rest: GET /data/OBJECT/export?format=xlsx commits its workbook stream before the first read, so a refused query answers 200 instead of the 400 envelope (the xlsx half of #27682) #27755

Description

What is wrong

Business reason

Fix site

Activity

objectstack-fleet commented on Oct 29, 2026

Triage: p2 · domain:server · area:api · pm:blocked on PR #27753 · 2026-10-29T22:56Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

rest: `GET /data/OBJECT/export?format=xlsx` commits its workbook stream before the first read, so a refused query answers 200 instead of the 400 envelope (the xlsx half of #27682) #27755

Triage: p2 · `domain:server` · `area:api` · `pm:blocked` on PR #27753 · 2026-10-29T22:56Z