fix(rest): the public lookup picker searches and sorts by the first display field the caller may query

[objectstack-fleet]

Part of #21062
Clause-②: yes (narrowing)

Position 2 of #21062 only. Position 1 (the public-form submit read-back, in plugin-security) is a separate PR on its own branch, so this PR does not close the card.

What this changes

GET /forms/:slug/lookup/:field, the public form's lookup picker, matches the visitor's search and orders its rows by one key. The handler took that key blindly from the first entry of publicPicker.displayFields. A field whose masking rule applies to the caller is served to it masked and is not queryable, and the engine refuses a search or an order on it with 403 PERMISSION_DENIED. Since PR #21051 that includes the caller who resolves no permission set. So a picker whose first display field declares a masking rule answered 403 to every caller the rule applies to, on every request.

The key is now the first display field the caller may query on, by the security service's published answer (ISecurityService.getQueryableFields, #20935). The handler reads it through the security service it already resolves (resolveSecurityService), for the context it already builds. No masking rule is derived in rest.

• No display field queryable: the route answers the engine's refusal for those fields, in the same envelope (403 PERMISSION_DENIED, the flat body mapDataError already produces for this route) and with the engine's sentence, before any query runs.
• No security service: nothing is masked on such a deployment, and the first display field stays the key, as before.
• A security service that cannot give the query answer (the method absent, or it answered undefined): the fallback the contract prescribes on getQueryableFields. Every display field whose declaration carries a maskingRule is passed over, whoever the caller is. A declaration that cannot be read admits no display field.
• The projection is unchanged. Every display field is still returned in each row, and the engine still masks the masked one.

File surface: packages/rest/src/rest-server.ts, the picker handler's key selection only (the context moved above it, unchanged). Pins beside it, one dogfood pin, and .changeset/21062-picker-queryable-key.md.

Per case, by class (measured on real boots)

bootStack with the real security, REST, auth and SQL layers, before at d9b2e34fac (the pins commit, the route as on main) and after at 2fa3a86e9b. Three deployments: no guest set registered; a guest set without the capability the rule names; a guest set holding it. The readings stay in the seat's private scratch.

Picker	Caller class	Before: status, key	After: status, key
First display field masked	visitor with no session, no guest set registered (resolves no set)	403 PERMISSION_DENIED on every request; the masked field	200; the next queryable display field; masked field served masked
First display field masked	visitor, guest set without the capability	403 PERMISSION_DENIED on every request; the masked field	200; the next queryable display field; masked field served masked
First display field masked	signed-in caller the rule applies to	403, the same as the visitor	200, the same as the visitor
First display field masked	visitor, guest set holding the capability (rule lifted)	200; the first display field; served stored	unchanged
Masked field not first (the dogfood shape)	every class above	200; the first display field; masked where the rule applies	unchanged
No masked display field (control)	every class above	200; the first display field	unchanged
Only display field masked	the two classes the rule applies to	403 PERMISSION_DENIED, from the engine	403 PERMISSION_DENIED, from the route before the engine is asked; same refusal text

The signed-in caller reads the same as the visitor in every row, before and after: the door builds its own context and does not read the session.

What a search finds (H4). For a picker whose first display field is masked, every search was refused before. After, a search matches the next queryable display field, so a caller finds rows by that field. A search for the masked field's value finds no row. In every other row of the table the search matches the same field as before, and what a caller finds is unchanged.

Pins, red then green

• packages/rest/src/public-form-lookup-picker-queryable-key.test.ts (new). The real SecurityPlugin over a real ObjectQL on a real SqlDriver, and the real protocol findData, so the request the route composes crosses the real ingress and the engine's own field guards. Two masked caller classes, each with: the premise (the security service answers the masked field readable and not queryable, and the engine refuses it); rows sorted on the next queryable display field with the masked field served masked; the search matching that field; no request the engine receives naming the masked field; and a picker with no queryable display field answering the engine's refusal (code, status and text equal to the engine's own for the same fields and context) with the engine never asked. Controls: a picker with no masked display field, and a caller the rule is lifted for. The fallback: a security service without the method, and one answering undefined, for a caller the rule applies to and for one it is lifted for. The declared narrowing (patch round 2): the same fallback service, a caller the rule is lifted for, and a picker whose display fields all declare a masking rule, refused 403 PERMISSION_DENIED with the engine never asked; its control is the answering service, which serves that caller. The pickers are parsed by the spec's own FormFieldPublicPickerSchema first.
• packages/qa/dogfood/test/public-picker-queryable-key.dogfood.test.ts (new). A real boot: the visitor with no session and a signed-in caller are served rows sorted, and searched, on the next queryable display field with the masked field served masked; a picker whose only display field is masked answers 403 PERMISSION_DENIED.
• Red on the pins commit d9b2e34fac: unit 12 failed, 6 passed (both masked classes on sorted, searched, never-a-key and the no-queryable refusal, and the four fallback cases; each failure on the defect: a 403 where 200 was expected, the masked field as the order key, the engine asked, the masked order). Dogfood 1 of 1 failed (403 where 200 was expected).
• Green on the fix commit 2fa3a86e9b: unit 18 of 18; the four sibling picker and public-form suites 69 of 69; @objectstack/rest rebuilt and the dogfood pin 1 of 1.

Ablation

On the fix commit 2fa3a86e9b, through scripts/ablation-replace.mjs in wrap mode: the queryable branch of the key expression (the first display field in the security service's answer) is replaced by the first display field, so the key is displayFields[0] again on every path. Anchor 1 to 0, replacement 1 to 2, blob e2f14974 to d520d9ab.

• Prediction, written down before the run: exactly the 12 unit pins that were red on the pins commit go red and the other 6 stay green; the dogfood pin goes red.
• Unit pins: 12 failed, 6 passed. They are the same 12 as the red run, compared by name.
• Rebuilt @objectstack/rest; ablation-dist-preflight --absent passed (the marker is in none of the 6 built files; on the pristine build the same marker was in 2).
• Dogfood pin: 1 of 1 failed, on a 403 where 200 was expected.
• Restore: git checkout HEAD -- on the absolute path, by the tool and again by the script's own EXIT INT TERM trap. Proven byte-identical: the blob equals HEAD's (e2f14974), git diff HEAD is empty and the status is clean. Rebuilt; the marker is back in 2 built files; unit pins 18 of 18 and the dogfood pin 1 of 1.
• A first attempt was a no-op and is not counted. Its replacement text already sat inside its anchor, so the replacement count did not rise and ablation-replace refused to run anything. The anchor was narrowed and the ablation repeated; the readings above are the second attempt's.

Local verification

At the merged head cdeed45868. origin/main was merged twice (no rebase) before opening this PR, and both merges were clean. They brought three changes to rest-server.ts, all outside this handler: one import line (#21084), the published-snapshot doors (#21002) and the datasource metadata reads (#21119). The changed packages' closure was rebuilt first.

• Picker and public-form suites with the new pins: 5 files, 87 of 87. Dogfood, this pin and the security(plugin-security): for a caller who resolves no permission set, the field-projection answers say no masking rule reaches it, while maskingRule's describe and the result masker mask it — which one a public door serves is not measured #20995 zero-set pin: 2 files, 3 of 3.
• @objectstack/rest tests (--project local): 250 files, 4744 passed, 248 skipped. @objectstack/rest typecheck passed, the test layer included (check:test-typecheck OK, 0 errors).
• @objectstack/dogfood typecheck passed. Its tsconfig includes test/**/*, so the new pin is compiled.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 66 commands, plus the three roster families it marks under a directory this diff touches (check-changeset-fixed, check:error-code-casing, check:filter-alias-parity) and check-partof-closing-keyword fed this body. All 77 ran in one locked sequential script and every one exited 0. --ran reconciliation: 66 derived, 66 run, 0 not measured.
• eslint --no-inline-config --format json on the 3 touched TypeScript files: 3 files, 0 errors, 0 warnings. The population is eslint.config.mjs's TypeScript and JavaScript glob, and all 3 files are in it. The config enables no type-aware linting, so this diff cannot move the verdict on any untouched file. The repo-wide pnpm lint is left to CI.

Acceptance notes

• Clause-②: yes (narrowing), per the contract review (5929549767, which ruled the earlier no wrong). Widening: a picker whose first display field is masked for its caller was refused and is now served. Narrowing: for a security service that lacks getQueryableFields, a caller the masking rule is lifted for, and a picker whose display fields all declare a masking rule, the request was served and is now refused 403 PERMISSION_DENIED, by the fallback the service contract prescribes. The only security service in the tree (plugin-security) implements the method, so no in-tree composition reaches the narrowing; the contract names that composition as valid, so it is declared. Patch round 2 carries the minor changeset and its pin.
• The spec describe on FormFieldPublicPickerSchema.displayFields says the visitor's search matches the first entry. For a caller whose masking rule applies to the first entry it now matches the first entry that caller may query; before this PR that search was refused. packages/spec/src/** is outside this PR's claimed surface, so the describe is reported to the seat for the spec owner and is not edited here.
• A declared publicPicker.filter row that names a masked field is still refused 403 PERMISSION_DENIED for every caller the rule applies to. It is the author's filter, not the route's key, so this PR leaves it alone, and it was measured unchanged. Reported to the seat, by class.
• The refusal text is the engine's predicate-guard sentence, carried into the route so that a caller reads the same words whichever side refuses. The unit pin asserts it equal to the engine's live refusal for the same fields and context, so the copy cannot drift silently.
• Not measured: a security service without the method on a real boot (the tree has none); the published-snapshot door and the form-submit route, which are outside this surface; the Console's picker client, which lives in another repository. CI's whole-root and workflow-valued families (10 and 6), the 5 path-scheduled CI jobs and the 4 type-check lanes the derivation names run on this PR.

Patch round 1

CI's Test Core (3/6) was red on this PR's own change: @objectstack/rest#test:repo failed in packages/rest/src/rest-server-canonical-query-ast.test.ts. That test's by-name presence pin (section 1, "names them") still asserted the picker's query literal ordered by displayFields[0]. The local runs had used vitest --project local, which does not run the repo-test project.

• Reproduced first at cdeed45868, under the verify lock: test:repo 1 failed, 178 passed, 1 skipped (5 files). The one failure is that pin.
• The pin's purpose is kept. It is a backstop for the census: it proves the server-built literals are still present, in the canonical QueryAST spelling. It now names the picker's literal as it is, orderBy on the handler's one key. It also names the line that derives that key from the security service's queryable answer, so no other key in the file can satisfy it. rest-server.ts is untouched in this round (d815dd449a).
• Full @objectstack/rest surface at the merged head 6dacc4c51b (origin/main merged, no rebase, no conflicts): every project together, 256 files (251 local and 5 repo, which is the whole tracked population), 4925 passed and 249 skipped; test:repo on its own, 5 files, 179 passed and 1 skipped; typecheck OK, the test layer included. The dogfood picker and zero-set pins: 3 of 3. Dogfood typecheck OK.
• Gates: the 66 derived commands, the three roster families and check-partof-closing-keyword, in one locked script; every exit 0. --ran reconciliation: 66 of 66, 0 not measured. eslint on the 4 touched TypeScript files: 0 errors, 0 warnings.
• CI on 6dacc4c51b: 32 success, 3 skipped, 0 failed, all six Test Core shards included.
• Tooling note, outside this diff: the turbo version main now pins writes an agent-guidance block into AGENTS.md when it runs in an agent session. It happened twice here: during the closure build, and from a type-check gate that spawns turbo. Both times AGENTS.md was restored from HEAD with the blob proven equal, and the gates the write could have reached were re-run on the clean tree. AGENTS.md is not in this PR. Already filed as tooling: turbo 2.11.5 writes a managed block into AGENTS.md in every agent worktree; opt out with "agentGuidance": false in turbo.json #21146, with the fix in flight as PR chore(turbo): opt out of the agent-guidance block in the root turbo.json #21151.

Patch round 2

The contract review (5929549767) ruled the earlier Clause-②: no wrong. The value is yes (narrowing), at least minor. This round carries its items 2 and 3 and nothing else. rest-server.ts is not touched.

• Changeset .changeset/21062-picker-queryable-key.md: '@objectstack/rest': minor; the summary is fix(rest)!:; a **BREAKING** banner names the narrowing by class (with a security service that lacks getQueryableFields or answers no answer, every display field declaring a maskingRule is passed over for every caller, so a picker whose display fields all declare one is refused 403 PERMISSION_DENIED without the engine being asked); the body's declaration line reads Clause-②: yes (narrowing); exactly one adr-0087: marker, not-required (no-migration-prescription), in the shape of analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986's changeset, closing the other four categories on facts. The widening text is kept. The fallback, which round 0 listed under "Unchanged", moved to the banner, and a "What to do after upgrading" paragraph addresses a deployer whose security service predates getQueryableFields. scripts/pm/clause2-line.mjs reads the line as declared yes, arm narrowing.
• Pin on the declared narrowing, appended to packages/rest/src/public-form-lookup-picker-queryable-key.test.ts, with the existing synthetic fixtures. A caller the rule is lifted for is served by the answering service (the control). With the method absent, and with it answering no answer, the same caller is refused 403 with code PERMISSION_DENIED, and the engine's call count is unchanged.
• Ablation: the fallback stops excluding fields that declare a masking rule, through scripts/ablation-replace.mjs in wrap mode (anchor 1 to 0, replacement 0 to 1). The prediction was written down before the run: the new pin and the four round-0 fallback pins go red, because they drive the same branch; the other 14 stay green. Observed: 5 failed, 14 passed, those five by name; the new pin failed on a 200 where the 403 was expected. The restore was proven by the tool (blob equal to HEAD's, git diff HEAD empty), and the pin file is green again, 19 of 19.
• Merged origin/main first (no rebase, clean; no incoming change to rest-server.ts). Head 207eb98a97.
• @objectstack/rest: all vitest projects, 257 files (the whole tracked population, local and repo), 4931 passed and 254 skipped; test:repo on its own, 5 files, 179 passed and 1 skipped; typecheck OK, the test layer included. Dogfood picker and zero-set pins 3 of 3; dogfood typecheck OK.
• Gates: in one locked script, the changeset families against the new declaration ran first: check-adr-0087-registration reads [BREAKING+bang+clause-②-narrowing] with not-required (no-migration-prescription); check-changeset-no-major, check-empty-changeset and check-changeset-fixed passed. Then the 66 derived commands, the three roster families, check-partof-closing-keyword fed the live body, and eslint on the 4 touched TypeScript files (0 errors, 0 warnings). All 81 commands exited 0. --ran reconciliation: 66 of 66, 0 not measured. Locally check-changeset-no-major's level axis has no PR payload to read and says so; CI's Check Changeset reads it, and it passed.
• turbo and AGENTS.md: turbo wrote its block into AGENTS.md during the closure build and during check:type-check-debt. The script restored it from HEAD after each command and proved the blob, so every later command ran on the clean tree. AGENTS.md is not in this PR.
• CI on 207eb98a97: 35 check runs, 32 success, 3 skipped (path and opt-in filters), 0 failed. Every required context is success, Check Changeset and all six Test Core shards included.

The seat appended this section from the dev's patch-round report (5930061042 on #21062), and extended the pin-file line above with the narrowing pin.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 2 documentable anchor(s).

22 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f20f669e17a860a00c74a7a9495b8d3a56957675.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f20f669e17a860a00c74a7a9495b8d3a56957675 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0fdc9e9778fe4ce9961df9765c9e63ab00c7f265 — the merge of head 207eb98a975ea45f9fc6808ddce1a4b4ee645a35 into base f20f669e17a860a00c74a7a9495b8d3a56957675, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0fdc9e9778fe4ce9961df9765c9e63ab00c7f265 && git checkout 0fdc9e9778fe4ce9961df9765c9e63ab00c7f265
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f20f669e17a860a00c74a7a9495b8d3a56957675 207eb98a975ea45f9fc6808ddce1a4b4ee645a35 && git checkout -B drift-repro f20f669e17a860a00c74a7a9495b8d3a56957675 && git merge --no-ff 207eb98a975ea45f9fc6808ddce1a4b4ee645a35

node scripts/docs-audit/affected-docs.mjs --json f20f669e17a860a00c74a7a9495b8d3a56957675

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f20f669e17a860a00c74a7a9495b8d3a56957675 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

CI on cdeed458 · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T09:20Z · ⚠️ Classes and positions only.

Test Core (3/6) is red, and the cause is this PR's own change.

• @objectstack/rest's test:repo project fails at src/rest-server-canonical-query-ast.test.ts:301. That source pin asserts the picker handler's literal sort key, and this PR changed the key.
• The dev's local runs used the local project only, which does not run the repo tests.

Patch round 1 is sent to the same dev:

1. reproduce the red;
2. update the source pin to what the handler now does, without weakening it and without touching the handler's behaviour;
3. run @objectstack/rest's full test surface and the derived gates;
4. push to this branch.

The PR stays a draft until the patch head is green.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6dacc4c51baf72336c73a5369ee8d1f094d50b32
Local-runs: none

PR #21136 (card #21062, position 2, Part of), claude/issue-21062-picker-queryable-key onto main. Inputs: the card body and its twelve comments (triage 5925021024; the claims 5925300766 and 5925661343; the cross-lane acknowledgement 5925483493; position 1's report, ACCEPT and landing 5926107785 / 5926131722 / 5926619268; the pointer 5928414754; position 2's reports 5928441490 and 5929268108; the seat's ACCEPTs 5928488316 and 5929308243); the PR body with the appended patch-round section and its 5-file list; the net diff of the head against main at the merge base c6954d6d09 (5 files, +682 / −13; the head is a merge of origin/main, and rest-server.ts is identical between cdeed45868 and the head); the 42 check-runs on the head, all complete; and, for the Clause-② weighing alone, #20986's record 5925735766 on PR #21088. Not read as conclusions: the dispatch order and the seat's ACCEPTs — every statement below is re-derived from the diff. ⚠️ Classes and positions only: no fixture spelling, slug, request body or returned value appears here.

① Derived judgments

The one key, and both readers of it — right. In the GET /forms/:slug/lookup/:field handler (rest-server.ts) key is derived once: with a security service resolved — resolveSecurityService, the resolver the class's other doors already use, asked for the picker's own route-built guest context (the session is not read, as before; the context object only moved above the derivation, its content unchanged) — key is the first display field in the queryable set; with no service, displayFields[0]. Both consumers read key: the contains search predicate and the fixed ascending orderBy. No other reader of displayFields[0] remains in the file (one occurrence: the derivation). The projection (fields: ['id', ...displayFields]) and the server-side re-projection are untouched, so every display field is still returned and the engine still masks the masked one. Right.

The queryable set, by branch — each judged:

• A service that answers: the published answer of ISecurityService.getQueryableFields (security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935), computed by the service from the derivation the engine's predicate guard refuses with. No masking derived in rest — the direction's ⛔ holds. Right.
• A service with the method absent, or answering no answer: the fallback the contract text prescribes verbatim — every field whose declaration carries a maskingRule is not queryable, whoever the caller is — read off the referenced object's declaration through the protocol's getMetaItem; a declaration that cannot be read admits no display field (fail closed). Right in direction; it is the one branch that changes answers for a composition the contract names as valid — judged in ②.
• No service: queryable is undefined and key is the first display field — main's behaviour. Right; carried by the four sibling picker and public-form suites, which drive the route with no service provider.
• A real empty answer (nothing queryable), or no display field in the answer: key undefined → the refusal below. Right.

Accept-set changes the diff implies, each judged:

• Widening: a masked-first picker, caller the rule applies to (no guest set registered; a guest set without the capability; a signed-in caller, who gets the same route-built context): 403 PERMISSION_DENIED on every request → 200, rows sorted and searched on the next queryable display field, the masked field served masked. Triage's pin. Pinned on both masked classes (the unit pin boots the real SecurityPlugin over a real ObjectQL on a real SqlDriver and routes through the real protocol findData, so the composed request crosses the engine's own field guards; it also asserts no request the engine receives names the masked field) and on a real boot (the dogfood pin: visitor and signed-in caller). Right.
• No queryable display field, masked caller: the engine's 403 → the route's 403 before the engine is asked, same code, status and sentence (pinned equal to the engine's live refusal for the same fields and context; the engine's call count pinned unchanged). "The platform's words": right. The sentence is a literal copy of predicate-guard.ts's, not a shared export — the equality pin is what holds it (a second copy already lives in service-analytics; this is the third). The fields it names are the picker's own display fields, which every 200 body already lists under displayFields — no new disclosure. Right.
• Controls unchanged: a picker with no masked display field (pinned); a caller the rule is lifted for, real service (pinned: first field as key, served stored); a masked field not first (measured in the PR body; the same shape as the pinned control); no service (sibling suites). Right.
• Narrowing, fallback composition only (a service lacking the method or answering no answer): (i) a caller the rule is lifted for, every display field declaring a maskingRule: served, keyed on the first → 403; (ii) the same caller, a masked-first picker with a later unmasked display field: served keyed on the first → served keyed on the next unmasked one (order and search target move). (ii) is pinned for both caller classes, method absent and no answer; (i) — the only refusal the diff introduces — is NOT pinned (the fallback pins drive only the two-field picker). Direction right (the contract's own ⛔ for a consumer that cannot get the answer); its declaration is wrong — ②.
• Public surface: nothing moves. src/index.ts and package.json are not in the diff; no route, response key or error code is added (PERMISSION_DENIED exists; the body is the flat envelope mapDataError already produces for this route's outer catch). Right.

Security posture — no stop. The route never derives who a rule is lifted for: it reads the service's answer, or the declaration's presence of a rule. The fallback fails closed; an unreadable declaration refuses; a service that throws falls to the outer catch (mapDataError + log) and is not served. The context the service is asked for is the one the engine will see. The key choice is observable through row order, which the masked value already reveals. Nothing in the diff returns a value the engine would mask.

Patch round 1 (d815dd449a) — right. One file, rest-server-canonical-query-ast.test.ts (+10 / −1): the census presence pin for the picker's literal is re-spelled from the displayFields[0] literal to the key literal, with a second toContain on the exact derivation line, so the first cannot be satisfied by any other key in the file; every other literal in the block is unchanged. Not weakened — the belt still proves the literal's presence in canonical QueryAST spelling, now anchored to its derivation. rest-server.ts is not in that commit.

Check-runs on the head: 42 — 37 success, 5 skipped, 0 failure, over two triggers (the head push, and the PR-body edit that re-ran the PR-automation set). Skipped: Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in) (path and opt-in filters) and the second trigger's Auto Label and Check PR Size. Every required context success: Lint & Repo Gates, TypeScript Type Check, Test Core (6 of 6, Test Core (3/6) included — red before the round), Dogfood Regression Gate (3 of 3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard (no governed path among the 5 files), Check Changeset (both triggers). ⚠️ Check Changeset and the ADR-0087 registration gate are green on a bare no because a bare no stands both down (check-changeset-no-major.mjs: no without the arm → not-declared); that green measures the declaration's grammar, not its truth. ② judges the truth.

② Semver level

As carried. .changeset/21062-picker-queryable-key.md: @objectstack/rest: patch; summary fix(rest): without !; no **BREAKING** banner; no adr-0087: marker; the body's declaration reads no with no arm, and PR body line 2 the same. The claim 5925661343 declares no. The seat's decision A (5928488316) kept it, explicitly provisional on this review.

The value, read against the fleet's own criteria (.claude/skills/pm-dispatch/references/execution-duties.md 派发 §; references/lanes/spec.md 席内分派参考; AGENTS.md Post-Task §3):

• The contract-surface test is 「改动前后同一份输入的接受/拒绝结果变了」. The same input — a request to a masked-first picker from a caller its rule applies to — was refused on main and is served at the head. That is 放宽, on a published door of a published package, and 「放宽接受集或扩大公开面的卡,不论多小,即条款②」.
• The no exemption is for a mis-refusal the published contract text already negates, and such a no must cite that text (「删已发布契约文本本就否定的误拒本身是 no;该 no 须引那段文本,缺引即读作缺申报」). The PR cites none, and none exists: the published describe of displayFields says the search matches the FIRST entry — the very behaviour that produced the refusal — and the PR itself reports that describe as now wrong (finding b, filed as forms: after #21062, a public picker's displayFields describe still says the search matches the FIRST entry, and a picker whose declared filter names a masked field answers 403 to its whole audience (authoring accepts both shapes) #21137). A change that obliges the published text to be rewritten is not 「拉回已声明契约」; it moves the contract.
• The refusal removed is of the deliberate class: the predicate guard's fail-closed 403, judged the right safe side by fix(plugin-security)!: a caller who resolves no permission set is served a masked field masked and may not query on it #21051's review (5924418816, as the card body records). 「裁决守卫、安全拒绝、失败关闭是刻意拒绝非误拒,删之 yes」.
• The negative boundary (「运行时权限/安全行为变更不是条款②」) does not take this diff out: no permission or masking semantics move — the engine masks and refuses exactly as before; what moves is the door's accept set.
• Parity: analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986's record (5925735766) read its refused → served change on a published door as "widens what a published package serves" and ruled yes, at least minor. This diff's refused → served change is the same class, on an unauthenticated public door. The asymmetry runs one way — 「收窄不触发条款②,但按 yes 申报恒不是错误」, while a wrong no is 「可审计的假申报」.

⇒ The value is yes, and the level is at least minor; patch under-grades it.

The arm. The diff narrows the door for a composition the published contract names as valid: getQueryableFields is optional by type, and its docblock states that "absence is a defined state" and that "a security service that predates this method omits it". For such an out-of-tree service — the contract's own addressee — a caller the rule is lifted for loses the first display field as key, and a picker whose display fields all declare a rule goes served → 403. That is served → refused on a published door, by the measure #20986's record applied to its own "answered → 403" edge (ruled (narrowing), breaking, although the old answer there was wrong too). The dev's case A rests on no in-tree composition reaching it and no measured consumer; AGENTS.md's grammar ((narrowing) is BREAKING) binds on the published contract, not on measured consumers, and the contract text itself is what makes the older implementer real. That the fallback is the contract's prescription for consumers does not make the door's new refusal non-breaking for a deployer who upgrades @objectstack/rest alone.

⇒ The arm is (narrowing).

Ruling: the spelling is wrong. The PR must carry the declaration yes (narrowing) — bare, first after the colon, at the start of its own line, on PR body line 2 and in the changeset body — and @objectstack/rest: minor (the launch-window grade for a breaking change: no .changeset/pre.json at the head, and check-changeset-no-major.mjs refuses major). With the arm, check-adr-0087-registration.mjs reads a breaking declaration (its signal 4) and requires the carriers: the breaking signal on the summary (fix(rest)!:) and/or a **BREAKING** banner naming the narrowing by class, and exactly one adr-0087: disposition marker in an HTML comment. On the facts, not-required (no-migration-prescription) is the honest category — no authorable key, spelling, export or stored shape moves; the package publishes; no registry id covers which field a picker keys on; the change is route behaviour, not an interface or type surface — spelled as #20986's changeset spells it; the body's "What to do" prose carries no FROM → TO rewrite and may stay. The claim's declaration (5925661343) is the seat's to amend in the same round, since the queue gate reads the claim comment.

③ Boundary flags

open_questions (5928441490), one: the Clause-② grammar — A (no, patch) or B (no (narrowing), minor). Answered in ②: neither as written — yes (narrowing) with minor; B's carriers (the breaking signal and the ADR-0087 marker) are the ones owed. Decision A does not stand.

Deviations declared by the dev, each answered:

1. (round 0) The branch pushed empty at main's commit before any pin — nothing disclosed; the first content push carried pins and fix together. Process; no bearing.
2. (round 0) The finding's number (F4 against F5) — labelling; none.
3. (round 0) Ablation attempt 1 refused as a no-op by the tool and re-anchored — the second attempt's readings are the ones reported; the red-first and ablation readings are the dev's and were not re-run here; the pins' verdict on the head is CI's. None.
4. (round 0) A private measurement script copied in under a trap and removed — the 5-file list carries no such file. None.
5. (round 1) turbo writing its agent-guidance block into AGENTS.md in the worktree, twice, restored each time — AGENTS.md is not among the 5 files and Governed Surface Queue Guard is success. None on this head; carried by tooling: turbo 2.11.5 writes a managed block into AGENTS.md in every agent worktree; opt out with "agentGuidance": false in turbo.json #21146 / PR chore(turbo): opt out of the agent-guidance block in the root turbo.json #21151.

Findings, each asked whether it is a data-exposure class needing a card now:

• (b) the displayFields describe still names the first entry as the search target — a contract-text disagreement, not exposure; it is ②'s evidence. Carried by forms: after #21062, a public picker's displayFields describe still says the search matches the FIRST entry, and a picker whose declared filter names a masked field answers 403 to its whole audience (authoring accepts both shapes) #21137 (domain:spec). Right to file; not a card-now exposure.
• (c) a declared publicPicker.filter row naming a masked field answers 403 to its whole masked audience, unchanged — over-refusal; the engine refuses the predicate and no value crosses. Not exposure; same family as this position. Carried by forms: after #21062, a public picker's displayFields describe still says the search matches the FIRST entry, and a picker whose declared filter names a masked field answers 403 to its whole audience (authoring accepts both shapes) #21137. Right.
• (a) turbo / AGENTS.md — tooling; dropped as a duplicate of tooling: turbo 2.11.5 writes a managed block into AGENTS.md in every agent worktree; opt out with "agentGuidance": false in turbo.json #21146. Not exposure. Right.
• From the diff, for the next reader: the refusal's sentence names the picker's own display fields, which every 200 body already carries; the door still builds its own context for a signed-in caller (pre-existing; outside the direction). No data-exposure class here needs a card now.

One item owed with the re-declaration, not a new finding: the narrowing the changeset will declare — fallback service, lifted caller, every display field declaring a rule → 403 PERMISSION_DENIED, the engine never asked — has no pin. A refusal case carries a code-plus-status assertion at minimum (the dispatch rule for 拒收用例), and #20986's declared narrowing was pinned.

What the PR must change:

1. PR body line 2 reads Clause-②: yes (narrowing).
2. .changeset/21062-picker-queryable-key.md: frontmatter '@objectstack/rest': minor; the body's declaration line reads Clause-②: yes (narrowing); a breaking signal the gates read — fix(rest)!: on the summary and/or a **BREAKING** banner naming the narrowing by class (for a security service lacking getQueryableFields or answering no answer: the key moves off any display field declaring a masking rule for every caller, and a picker whose display fields all declare one is refused 403 PERMISSION_DENIED); exactly one adr-0087: disposition marker in an HTML comment, not-required (no-migration-prescription) with the facts that close the other four categories, in the shape of analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986's changeset.
3. One pin on the declared narrowing: a service without the method, a caller the rule is lifted for, a picker whose display fields all declare a rule → 403 with code PERMISSION_DENIED, the engine never asked.
4. (the seat, same round) an amended claim on security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 whose declaration line reads Clause-②: yes (narrowing).

Nothing escalated. No security stop.

Implemented-by: claude/issue-21062-picker-queryable-key
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: FAIL

[objectstack-fleet]

CI on 6dacc4c5 after the body edit · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T10:34Z

Check Changeset is red on 6dacc4c5, and that is this PR's own state, not a flake.

• The contract review 5929549767 ruled the declaration yes (narrowing). This seat set PR body line 2 to match, which re-ran the gate on the old head.
• The head's changeset still declares patch with no breaking signal, so the gate correctly reports the level and the line disagreeing.

The fix is patch round 2, already with the same dev: the minor changeset with the breaking banner, the matching declaration line, the ADR-0087 marker, and one pin on the declared narrowing. No re-run of this head: it would fail identically. The PR stays a draft until the new head is green and re-reviewed.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 207eb98a975ea45f9fc6808ddce1a4b4ee645a35
Local-runs: none

PR #21136 (card #21062, position 2, Part of), claude/issue-21062-picker-queryable-key onto main — re-review after the FAIL record 5929549767 on 6dacc4c51b. Inputs: the card body and its fifteen comments (triage 5925021024; the claim 5925300766 and both amendments 5925661343 and 5929563772; the cross-lane acknowledgement 5925483493; position 1's report, ACCEPT and landing 5926107785 / 5926131722 / 5926619268; the pointer 5928414754; position 2's three reports 5928441490, 5929268108 and 5930061042; the seat's ACCEPTs 5928488316, 5929308243 and 5930095390); the PR body (line 2 set by the seat, both patch-round sections appended), its 5-file list and every comment on it (the docs-drift advisory 5928415194, the seat's CI notes 5928511419 and 5929612459, the previous record 5929549767); the net diff of the head against main at the merge base f20f669e17 (5 files, +716 / −13); the 42 check-runs on the head, all complete; and, for the Clause-② weighing alone, #20986's record 5925735766 on PR #21088 and .changeset/20986-analytics-hop-object-reference.md on main. Not read as conclusions: the dispatch order and the seat's ACCEPTs — every statement below is re-derived from the diff and the head. ⚠️ Classes and positions only: no fixture spelling, slug, request body or returned value appears here.

① Derived judgments

The route is unchanged since the head the previous record judged — verified three ways. git diff 6dacc4c51b 207eb98a97 over rest-server.ts, rest-server-canonical-query-ast.test.ts and the dogfood pin is empty; the merge-base patch of rest-server.ts at the previous head (against c6954d6d09) and at this head (against f20f669e17) are identical hunk for hunk; and main brought no change to rest-server.ts between the two merge bases. Patch round 2 (207eb98a97, first parent the merge 9bc6855025) touches two files: the changeset (+16 / −8) and the pin file (+26 / −0). So the previous record's ① judgments stand as written; re-derived here in brief, each still right:

• One key, both readers. In the GET /forms/:slug/lookup/:field handler key is derived once and read twice — the contains search predicate and the fixed ascending orderBy. At the head displayFields[0] has exactly one occurrence in the file: the no-service arm of the derivation. The projection (fields: ['id', ...displayFields]) is untouched, so every display field is still returned and the engine still masks the masked one. The context object moved above the derivation, its content unchanged; the session is still not read.
• The queryable set, by branch. A service that answers: ISecurityService.getQueryableFields' published answer, asked for the picker's own route-built context through resolveSecurityService — no masking derived in rest. A service lacking the method or answering undefined: the fallback the contract text prescribes verbatim (every display field whose declaration carries a maskingRule is passed over, whoever the caller is), read off the referenced object's declaration through the protocol's getMetaItem; a declaration that cannot be read admits no display field (fail closed). No service: queryable undefined, the first display field — main's behaviour. A real empty answer, or no display field in the answer: key undefined → the refusal.
• Accept-set changes. Widening — a masked-first picker, a caller the rule applies to: 403 PERMISSION_DENIED on every request → 200, keyed on the next queryable display field, the masked field served masked (pinned on both masked classes through the real SecurityPlugin, ObjectQL, SqlDriver and protocol findData; and on a real boot by the dogfood pin). No queryable display field: the engine's 403 → the route's 403 with the same code, status and sentence, the engine never asked (pinned equal to the engine's live refusal). Narrowing — fallback composition only: (i) a caller the rule is lifted for, every display field declaring a rule: served → 403; (ii) the same caller, a masked-first picker with a later unmasked display field: keyed on the first → keyed on the next unmasked one. (ii) was pinned in round 0; (i) is now pinned — below. Controls unchanged (no masked display field; a lifted caller with the answering service; no service). Public surface: nothing moves — src/index.ts and package.json are not in the diff; no route, response key or error code is added.
• Security posture — no stop. Unchanged from the previous record: the route never derives for whom a rule is lifted; the fallback fails closed; a throwing service falls to the outer catch; the refusal's sentence names the picker's own display fields, which every 200 body already lists.

The new pin bites — judged on the diff, not on the dev's readings. The appended describe boots the deployment whose guest set holds the capability the rule names (the rule lifted for the picker's context), takes the control first — the answering service serves the all-masked picker to that caller, 200 — then drives the same picker, same caller, through the method-absent service and through the service answering undefined, asserting {403, PERMISSION_DENIED} and that the engine's find count on the referenced object did not move. The service is injected through the constructor's securityServiceProvider slot, the one resolveSecurityService reads, so the handler under test sees the altered service. On the diff, the only path to that refusal for a lifted caller is the fallback's filter excluding the rule-declaring field, leaving queryable empty and key undefined; on main's route (key = first display field, served to a lifted caller) and under the reported ablation (the exclusion removed, so the key is the first display field, the engine is asked, and a lifted caller is served) the pin fails on status and on the call count. The four round-0 fallback pins (masked-first picker, method absent / no answer, both caller classes) read the same filter, so an ablation of it reds exactly those five — the dev's prediction and reading agree with the derivation. The ablation and red-first readings themselves are the dev's and were not re-run here; the pin's verdict on the head is CI's (Test Core, 6 of 6, success).

Check-runs on the head: 42 — 37 success, 5 skipped, 0 failure, over two triggers (the head push and the PR-body edit). Skipped: Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in) (path and opt-in filters) and the second trigger's Auto Label and Check PR Size. Every required context success: Lint & Repo Gates (which runs the ADR-0087 registration and empty-changeset gates), TypeScript Type Check and the four type-check lanes, Test Core (6 of 6), Dogfood Regression Gate (3 of 3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard (no governed path among the 5 files), Check Changeset on both triggers — the gate that was red on 6dacc4c5 after the body edit (5929612459) now reads the body line and the changeset level agreeing.

② Semver level

The previous record's four items, each judged on the head:

1. PR body line 2 reads Clause-②: yes (narrowing) — bare, first after the colon, on its own line; line 1 is Part of #21062. Done. The body's Acceptance-notes bullet was rewritten to match; the remaining mentions of no are historical, naming the ruling.
2. The changeset .changeset/21062-picker-queryable-key.md: frontmatter '@objectstack/rest': minor; summary fix(rest)!: (the breaking signal on the summary); a **BREAKING** banner naming the narrowing by class — the composition (a service lacking getQueryableFields, or answering no answer for the object), the mechanism (every display field declaring a maskingRule passed over for every caller, the lifted caller included), the consequences (search and order move to the next rule-free display field; a picker whose display fields all declare a rule is refused 403 PERMISSION_DENIED without the engine being asked, where it used to be served) and the exemption (the shipped service implements the method); the declaration line Clause-②: yes (narrowing) at the start of its own line; exactly one adr-0087: marker (count 1), in an HTML comment, not-required (no-migration-prescription), closing the other four categories on facts — the package publishes (not unpublished); no registry id covers which field a picker keys on (not already-registered); route behaviour, not a declaration (not runtime-interface-only / type-surface-only) — in the shape of analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986's changeset. The body carries no FROM → TO rewrite, migration heading or rewrite table, so the category's statement holds. No .changeset/pre.json at the head, so minor is the launch-window grade for a breaking change, as analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986 shipped. Done.
3. The pin on the declared narrowing — judged above. Done, and wider than asked: the no-answer service is driven beside the method-absent one, with the answering service as control.
4. The claim amendment 5929563772's declaration line reads Clause-②: yes (narrowing), and it names the previous record as its reason. Done.

The value and the arm, re-weighed on the head (fleet criteria as the previous record cited them; AGENTS.md Post-Task §3; parity with #20986's record 5925735766): the same input — a masked-first picker, a caller its rule applies to — refused on main and served at the head, on an unauthenticated public door of a published package, with no published contract text negating the old refusal (the displayFields describe still names the first entry, #21137): yes, at least minor. The door narrows for a composition the published contract names as valid — getQueryableFields is optional by type, its docblock states that a service predating it omits it, and the fallback it prescribes is what refuses the all-masked picker to a lifted caller — served → refused: (narrowing), breaking, as #20986's record ruled its own answered → 403 edge. yes (narrowing) with minor and the carriers is the right spelling; the head carries it. The gates agree: Check Changeset success on both triggers; Lint & Repo Gates success.

Clause-②: yes (narrowing) — right, as carried.

The changeset prose, for disclosure and for accuracy against the diff:

• Disclosure: it names the route, the schema keys (publicPicker.displayFields, maskingRule), the contract method, the code and the status, and the package — no fixture spelling, form slug, request body or returned value. Holds.
• The banner: each clause matches the diff — the fallback runs when the method is absent or returned undefined (a real [] answer is not the fallback; it is "nothing queryable" and refuses, as the "When no display field is queryable" paragraph says); the exclusion is by the declaration's maskingRule, context-free; the key moves to the first surviving display field; key undefined refuses before the engine is asked with mapDataError's envelope. "Where it used to be served" is true of the caller the rule is lifted for, which the sentence names; for a caller the rule applies to the same picker was 403 from the engine before and is 403 from the route now — same code and status, so no accept-set change for that class. Right.
• "Unchanged": a no-masked picker and a lifted caller keep the first display field with the shipped service (its answer holds every display field, so find returns the first); a deployment with no security service keeps the first (queryable undefined). Both read off the diff. Right.
• "What to do": the first display field the caller may query is the key (displayFields.find), so listing one such field ahead is the remedy; an all-masked picker is refused. Right.
• The paragraph for a deployer whose service predates the method: "which fields a caller may filter, sort, group or aggregate by" is the contract docblock's own first sentence; "the picker then keys on the first display field in that answer" is the diff; "until it does, give each picker at least one display field that declares no maskingRule, or the picker is refused for every caller" is the fallback branch. Right.
• One sub-case the changeset does not spell, noted for the next reader and not a flag on the verdict: under the same fallback composition, a referenced object whose declaration the protocol cannot read (no getMetaItem, or no fields on the item) admits no display field, so that picker is refused for every caller whatever its fields declare. It is the fail-closed arm inside the declared composition, the same class and code as the banner's narrowing, disclosed in the PR body and the handler's comment; the primary remedy the paragraph gives (implement the method) covers it, and the shipped protocol reads declarations. Not a separate narrowing to declare.

③ Boundary flags

open_questions (5930061042): none declared. Round 0's one question (the Clause-② grammar) was answered by the previous record and is closed by the head's declaration.

Deviations declared by the dev in round 2 (5930061042), each answered:

1. The order's "the ablation must turn exactly this pin red" could not hold: the four round-0 fallback pins read the same filter, so the prediction written before the run was five, and five went red by name. Judged above: the derivation agrees; the new pin's own red is on the exact assertion that pins the narrowing. Right; no bearing on the verdict.
2. The round's commit was pushed before the long locked run (AGENTS.md's WIP rule over the order's "run, then push"). The behaviour was built, pinned and reviewed on the previous head; this round disclosed no new behaviour, and the head's gates are CI's. Process; none.
3. turbo writing its block into AGENTS.md twice, restored and proven each time — AGENTS.md is not among the 5 files and Governed Surface Queue Guard is success. None on this head; carried by tooling: turbo 2.11.5 writes a managed block into AGENTS.md in every agent worktree; opt out with "agentGuidance": false in turbo.json #21146 / PR chore(turbo): opt out of the agent-guidance block in the root turbo.json #21151.
4. The PR body was not edited by the dev; the seat appended the round's section and replaced the one line the new pin made incomplete. The body read on GitHub carries both. None.

Deviations from rounds 0 and 1 (5928441490, 5929268108) stand as the previous record answered them; nothing on this head reopens one.

Findings: round 2 reports none. The previous record's findings — (b) the displayFields describe and (c) a declared publicPicker.filter row naming a masked field, carried by #21137; (a) turbo / AGENTS.md, carried by #21146 — are unchanged by this head; none is a data-exposure class needing a card now.

The one item the previous record owed with the re-declaration — the pin on the declared narrowing — is carried; nothing new is owed.

Nothing escalated. No security stop.

Implemented-by: claude/issue-21062-picker-queryable-key
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS