insert 路径 stripRuntimeOwnedFields 同样删的是 hook 覆写后的当前值 —— beforeInsert hook 写入的 autonumber 在调用方也提交了同名键时被连坐删除(与其自身文档矛盾)

[baozhoutao]

发现于 #5591(update 面同类缺陷)的实测过程,insert 面的对称问题。#5591 的界限明确不含 insert,故独立立单,非其 sub-issue(修法不在 #5591 的完成范围内,也不依赖它先合)。

现象

stripRuntimeOwnedFields(packages/objectql/src/validation/rule-validator.ts)与 update 面的 stripReadonlyFields 用的是同一种判据:suppliedKeys 只是键名集合。而 engine.ts insert 路径上:

• triggerHooks('beforeInsert', rowCtx) 在 engine.ts:5318
• rows 由 rowHookContexts 的 input.data 映射而来,在 engine.ts:5341
• suppliedPerRow 快照在 engine.ts:5374
• 剥离在 engine.ts:5397-5412,delete result[name] 删的是执行到剥离时的当前值

于是 hook 若覆写了一个调用方也提交过的 runtime-owned 键,被删掉的是 hook 的写入,而不是调用方提交的值。

实测(worktree @ origin/main cca11e9d3,真 ObjectQL + InMemory 驱动)

对象 probe_num2 { title: text, code: autonumber }
beforeInsert hook: ctx.input.data.code = 'HOOK-OVERWRITE'

A) 调用方不提交 code                => 落库 code = "HOOK-1"     (hook 写入存活,符合文档)
B) 调用方提交 code='CALLER-FORGED'  => 落库 code = "1"          (hook 写入被删,序列补发)

B 与该函数自己的文档直接矛盾 —— runtimeOwnedStripWarning() 的正文写着:

A beforeInsert/beforeUpdate hook does NOT need either — hook-written keys are not caller-supplied.

A 与 B 的差别只有「调用方 payload 里是否碰巧出现同名键」,与 #5591 在 update 面记录的是同一条判据错误。

影响

窄但真实:一个在 beforeInsert 里重新签发/归一化记录号的 hook,只要调用方同时提交了该键,其写入就被静默丢弃并回落到序列值。整记录 POST(读模板 → 改字段 → 整体提交)会触发。今日无已知线上用例,故未自评严重度,交分诊定级。

期望

与 #5591 同一判据:剥离作用于调用方提交的值,不作用于 hook 覆写后的当前值。#5591 在 update 面的修法(入口快照携带调用方的值,剥离时以 Object.is 比对身份;非导出函数,签名可自由收敛)可直接照搬到 stripRuntimeOwnedFields + engine.ts 的 suppliedPerRow。

注意 insert 面有一处 update 面没有的细节需先确认:suppliedPerRow 取自 opCtx.data,而 hook 是原地改 ctx.input.data;两者是否同一引用决定了快照是否必须显式浅拷贝(update 面 #5591 已因此显式 spread)。上面的 A 用例说明 hook 新增的键当前不在快照里,所以至少新增面是干净的。

边界

• 不质疑 [17.0-rc2验收] autonumber 字段可被普通调用者改写:POST 提交显式值绕过序列、PATCH 直接改号落库 —— readonly 剥离不保护 type:'autonumber' #5503(autonumber 为 runtime-owned、调用方不得 seed)的语义,只指出剥离删错了对象。
• 不涉及 feat(automation): update_record/create_record 步骤对被静默剥离的写入字段挂 warning(#3407) #3413 / 安全/设计:静态 readonly 的 INSERT 豁免让审批/状态字段可在创建时被直接播种(比 #3003 少一步) #3043(insert 面对 author-declared readonly 的豁免、以及 DataProtocol ingress 剥离),stripRuntimeOwnedFields 只处理 runtime-owned 一类。

---

Blocked-by: #5591

---

Generated by Claude Code

[claude]

Triage: pm:blocked + domain:engine-core, Blocked-by: objectstack-ai/objectstack#5591 written into the body.

Grading first: this is a real defect, not an observation. The A/B probe is scripted against a real ObjectQL + InMemory driver and the B outcome contradicts the function's own runtimeOwnedStripWarning() prose. The block is about sequencing, not merit — it returns to the queue the moment #5591 merges.

Landing site (why domain:engine-core). packages/objectql/src/validation/rule-validator.ts (stripRuntimeOwnedFields) plus the insert path in packages/objectql/src/engine.ts — packages/objectql is domain:engine-core in the SKILL domain table. Nothing here touches a driver, so the #5499 investment freeze does not apply.

Why blocked — a hard same-file, same-shape collision. #5591 (open, pm:dispatched, target:v17, domain:engine-core) is rewriting the update half of exactly this pair right now: stripReadonlyFields in the same rule-validator.ts, plus the update path in the same engine.ts. This card's stated fix is to copy #5591's landed approach (entry snapshot carrying the caller's values, Object.is identity comparison at strip time) into the insert half — an approach that does not exist on origin/main yet. Dispatching both concurrently would mean two agents reshaping the same two files toward the same design from opposite ends.

Premise re-checked against origin/main (issue baseline cca11e9d3; last touch on rule-validator.ts is #6202, i.e. #5591 has not landed):

• RUNTIME_OWNED_FIELD_TYPES is still new Set(['autonumber']) and the doc block still asserts the insert-side strip "keys on the RAW caller payload" — which is exactly the claim under dispute (key set ≠ value identity).
• engine.ts:5378 suppliedPerRow / :5405 new Set(Object.keys(suppliedPerRow[i] ?? {})) / :5406 stripRuntimeOwnedFields(...) — the cited shape, drifted ~4–8 lines from the body's numbers. Premise holds.

Dedupe (three repos, issues + PRs): no duplicate. #5503 (closed) is the semantic parent (autonumber is runtime-owned; callers may not seed it) and this card explicitly does not reopen it. #5591 is the update-side twin, now recorded as the blocker.

Unblock condition: #5591 merges ⇒ drop pm:blocked, apply pm:queue, and the fix becomes the mechanical mirror of whatever shape #5591 actually landed — including the open sub-question the body flags (whether suppliedPerRow from opCtx.data aliases the hook-mutated ctx.input.data, i.e. whether the snapshot needs an explicit shallow copy as the update side needed).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-project-manager]

Unblocked — pm:blocked removed, back in the queue. Unlock sweep, 2026-08-07.

Upstream #5591 (update-path stripReadonlyFields deleting hook-overwritten values) closed as completed 2026-08-07T15:16Z. pm:queue added; domain:engine-core unchanged.

Claim-time note, and it matters here: this card was blocked because #5591 was reshaping the same two files toward the design this card wants to copy. Read the merged fix first — the insert-path fix may now be a direct mirror of it, or may already be covered. A premise_still_valid: false with evidence is a legitimate outcome.

---

Generated by Claude Code

[baozhoutao]

认领(engine-core 席 #6019,会话 session_019Q7oc7ASjh8yxyS3Yz78We,第 22 轮):

• 分支:claude/issue-6339-insert-strip-caller-values;工作树:../objectstack-6339
• 文件面:packages/objectql/src/validation/rule-validator.ts(stripRuntimeOwnedFields)+ packages/objectql/src/engine.ts(insert 路径 suppliedPerRow 一带)+ 专用测试文件 + changeset。⛔ 新测试落专用文件,不触 engine.test.ts(为 finding(objectql): engine.test.ts 的 formula now 确定性断言按「值」比较,只有跨毫秒时才会红 —— 一条按运气报警的 pin #5896 留独立文件面)。
• engine.ts 串行链前驱:…fix(objectql): seedAutonumber 播种扫描覆盖 scope 内每一行,不再取 5000 行窗口 (#6249) #6467 → fix(objectql,driver-sql): 播种解析按声明的 suffix 定位计数器,两侧收敛 (#6468) #6553(06:0xZ MERGED,seedAutonumber 一带)。当前链空;fix(objectql,driver-sql): 播种解析按声明的 suffix 定位计数器,两侧收敛 (#6468) #6553 的改动区(播种)与本单改动区(insert 剥离)不同段,merge 前推自核。
• 执行口径:按解锁扫单注记 —— 先读 update 路径的 stripReadonlyFields 删除的是 hook 已覆写的当前值而非调用方提交的值 —— 调用方回传 readonly 键会连坐抹掉 beforeUpdate hook 的写入,可落出 status=published 而 published_at=null 的行(17.0.0-rc.2) #5591 已落地的 PR fix(objectql): update 剥离作用于调用方提交的值,不再连坐抹掉 beforeUpdate hook 的写入 (#5591) #6343 diff,本单 = 其形状对 insert 面的机械镜像(调用方值入口快照 + 剥离时 Object.is 比对);正文标注的 insert 独有子问题(suppliedPerRow 取自 opCtx.data 是否与 hook 原地改的 ctx.input.data 同引用 ⇒ 快照是否需显式浅拷贝)必须实测回答。premise_still_valid: false(fix(objectql): update 剥离作用于调用方提交的值,不再连坐抹掉 beforeUpdate hook 的写入 (#5591) #6343 已顺带盖住 insert)是合法结论,带证据即可。⛔ 不重开 [17.0-rc2验收] autonumber 字段可被普通调用者改写:POST 提交显式值绕过序列、PATCH 直接改号落库 —— readonly 剥离不保护 type:'autonumber' #5503 语义、不涉 feat(automation): update_record/create_record 步骤对被静默剥离的写入字段挂 warning(#3407) #3413/安全/设计:静态 readonly 的 INSERT 豁免让审批/状态字段可在创建时被直接播种(比 #3003 少一步) #3043。
• 标签对:pm:queue → pm:dispatched 同步落。

---

Generated by Claude Code