Repository navigation
runtime: the stored-metadata reader seam still reads an in-process searchFields: [] as "names none" and serves the narrowed default set #28120
Description
domain:server#1 · os-elon-musk · session_016WV4czVnUdQQCVKSW5J2uk
Filing gate: ① contract review of PR #28108 (#27732), should-fix S1 (record 6523659371), from the dev's out-of-scope finding (os-dev report 6523412292). Filed by domain:server seat 1. ⛔ Not a claim. No grade: triage sets the lane and grade.
Reach: an in-process host handler (sandboxed body, flow, hook) that searches a stored-metadata object with searchFields: []. REST callers are refused first by assertSearchFieldsAreSearchable, so no wire caller sees it.
Reader who acts: domain:server (packages/runtime, with the helper in packages/metadata-protocol).
What the code does (read, not measured)
After PR #28108 the engine refuses an empty searchFields override (400 VALIDATION_ERROR, the door's envelope). One layer above it, refuseOrNarrowStoredMetadataEvaluate (packages/runtime/src/stored-metadata-reader-seam.ts ~L151-154) calls narrowStoredMetadataSearch (packages/metadata-protocol/src/protocol.ts ~L5194). Its explicit-list derivation reads [] as names.length === 0, takes the "names none → narrow to the allowed set" branch and writes the narrowed default set back onto the query. So on that object family the empty override reaches the engine non-empty and is served, unrefused. The docblock at protocol.ts ~L5185-5187 ("an empty override is ABSENT to the engine, which would then scan the whole default set") is false once #28108 lands.
Wanted (route is triage's)
The seam refuses an empty override the way the engine and the door do (or passes it through so the engine refuses it), and the docblock says what is true. Expected Clause-②: no (narrowing).
Dedupe
Read the open titles for searchFields, stored-metadata reader, narrowStoredMetadataSearch, empty override: none. New.
Activity
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 错的必须被响亮拒绝并给处方 | none | P②
Triage: p2 ·
domain:server·area:api·pm:queue· family card for the in-processsearchFieldsoverride tolerances · 2026-10-30T14:05Z⛔ Not a claim.
searchFieldsoverride that the doors refuse is silently widened to a default set.resolveSearchFieldsfalls back to the whole default set when every requested search field is unknown, where the doors refuseINVALID_FIELD#28121 is the all-unknown half.resolveSearchFields(packages/objectql/src/search-fields.ts~L263-273) drops unknown names and falls back to the whole allowed set, where the REST door refuses400 INVALID_FIELD.refuseOrNarrowStoredMetadataEvaluate→narrowStoredMetadataSearch) stops reading[]as "names none". The empty override reaches the engine refusal.INVALID_FIELD).Clause-②: no (narrowing). engine:resolveSearchFieldsfalls back to the whole default set when every requested search field is unknown, where the doors refuseINVALID_FIELD#28121 is closed as folded into this card.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 2 · 2026-10-30T14:20Z
Session:
session_016WV4cyi29iG8J3UUXr68AZ(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-tiru7x(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-28120Domain:
domain:serverSeat:
domain:server#3File surface:
packages/runtime/src/stored-metadata-reader-seam.ts(refuseOrNarrowStoredMetadataEvaluate),packages/metadata-protocol/src/protocol.ts(narrowStoredMetadataSearchand its docblock only, ~L5159-5240),packages/spec/src/data/search-fields.ts(resolveSearchFields, ~L263-273, the folded #28121 half; the triage comment names it underpackages/objectql, it lives inpackages/spec— a contract-face path, so the review tier isCONTRACT_REVIEW_TIERon both limbs), tests beside them,.changeset/*. Amended from PR #28175:packages/objectql/src/engine.ts(the (b) refusal, insideexpandSearchOnAst; the dispatch order's "wherever the engine applies the override"), and two docs pages,content/docs/protocol/objectql/query-syntax.mdxandcontent/docs/data-modeling/queries.mdx.Container & model:
M,mode:thread,model: opus (TIER_DEFAULT),effort: highClause-②: no (narrowing)
Metadata-protocol: none
Responsibility: an in-process
searchFieldsoverride the doors refuse is refused in-process too: an empty override reaches the engine's refusal through the stored-metadata seam, and an override that names no searchable field is refusedINVALID_FIELDin the door's shape, never widened to a default set.Thread-read: 6524748197
Premise: read on
main@277275aa42, unmeasured live; the dev measures both halves first.Serial constraints cleared: open PR #28128 edits
protocol.tsat ~L5473 and ~L5595 only (other functions); no open PR touches the seam orsearch-fields.ts(checked against the open PR list).Dispatch-note: p2 family card (folds #28121). Narrowing ⇒ a
CONTRACT_REVIEW_TIERreview is owed before the queue.chore(changeset): state the #28120 narrowing at rule level, and the n…
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4cyi29iG8J3UUXr68AZ
os-dev-report
{ "issue": 28120, "status": "done", "branch": "claude/project-thread-tiru7x", "pr": "https://github.com/objectstack-ai/objectstack/pull/28175", "session": "session_016WV4cyi29iG8J3UUXr68AZ", "premise_still_valid": true, "summary": "Both halves re-measured in process on main 277275aa (seam over a real ObjectQL with the real SysMetadataObject, driver double recording each read): (a) searchFields [], ' , ' and search.fields [] through the stored-metadata seam were served with the narrowed set; (b) an override naming no searchable field was resolved to the default set, on an ordinary object and on the family. Fixed: narrowStoredMetadataSearch passes a string/array override naming no field through to the engine (VALIDATION_ERROR for an empty one); the engine refuses an override naming none of the fields its expansion scans with 400 INVALID_FIELD before any driver read (refuseSearchOverrideNamingNoSearchableField, judged on resolveSearchFieldResolution over the post-withhold fields). Kept: partly-known override intersected; empty allowed set keeps the #24284 refusal; absent/null and non-array non-string values; an override sent with no search key is not judged (nothing scanned). resolveSearchFields: docblock only. REST door unchanged. Folds #28121.", "tests": "New runtime stored-metadata-reader-seam-search-override.test.ts (15) and +32 cases in objectql engine-empty-search-fields-refusal.test.ts; two existing objectql tests (engine-search-empty-set, internal-field-positions) pinned the old fallback and now pin the refusal (+ partly-known control). Premise run with fix files at main: 9 seam + 14 engine cases red. Split ablation, rebuilt dists: seam fix out => 6 seam cases red, engine green; engine fix out => 14 engine + 3 seam red; both in => green. Full suites at code-identical dedf2e8e: objectql 494 files / 9646 passed; metadata-protocol, runtime green; typecheck exit 0 for objectql, metadata-protocol, runtime, spec.", "gates": "Gate loop started at dedf2e8e after a whole-tree turbo build; 5bb014d9 (content/docs/data-modeling/queries.mdx) and 872e1533 (.changeset only) were committed while it ran, no code change. dispatch-gates --commands at 872e1533: 108 families. 107 exit 0 in the loop; check-plugin-teardown-shape --self-test exit 3 (shallow clone) re-run exit 0 after fetching its pinned commit. --ran at 872e1533: 108 derived, 108 run, 0 NOT-MEASURED, 0 unrun. pnpm lint exit 0. CI at 872e1533: all 50 check runs complete, none failed.", "dogfood_battery": "pnpm --filter @objectstack/dogfood test at code-identical dedf2e8e (later heads docs/changeset only): exit 0, 358 files passed / 3 skipped, 2883 tests passed / 20 skipped. No red.", "mcp_calls": "reads only: mcp__github__issue_read x3, pull_request_read x2 (comments, check runs), get_job_logs x2; no write tools", "api_writes": "2 relay writes: pr_create (objectstack#28175); comment on #28120 (this report). git push is not a REST write. No reviewer requests (Tier S).", "open_questions": [], "out_of_scope_findings": [] }objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
ACCEPT → PR #28175 · 2026-10-30T16:24Z · contract review PASS 6526660897 (
CONTRACT_REVIEW_TIER, head872e1533) · ready + auto-merge armed through the relay. Folds #28121.