The read-only strip still logs a WARN calling the addressed row's own `id` a forged caller write, on every single-record update of a platform object

[os-zhuang]

Split out of #8093 rather than fixed there, because the fix is a judgement call about a shared strip helper and #8093's scope fence is the report channel.

What #8093 fixed, and what it left

#8093 stopped droppedFields / onFieldsDropped naming the row's own primary key on a by-id update: the payload id that equals the bound row is the write's address, not payload, so it is not a drop. That closed the user-facing amber toast.

The log channel still says the untrue thing. stripReadonlyFields (packages/objectql/src/validation/rule-validator.ts) is unchanged by that PR — deliberately, since the strip itself must keep removing id from the SET clause — and it emits its readonlyStripWarning whenever it deletes a key.

Measured, after #8093's fix

A real ObjectQL + a real ObjectStackProtocolImplementation, updateData({ object: 'sys_user_preference', id: 'rec_1', data: { value: ['x'] } }) — a body with no id key:

droppedFields : null            ← #8093's fix, correct
warn count    : 1
  WARN: Field 'id' on 'sys_user_preference' is read-only: the caller-supplied
        value was DROPPED and the update is being COMMITTED WITHOUT IT — ...

Every one of those three claims is false for this write. The value was not caller-supplied (metadata-protocol's updateData folded the path id in, #6479); nothing the caller wanted was dropped; and the update was not "committed without" anything it asked for.

Why it is worth a card and not a shrug

1. Volume. It fires on every single-record PATCH of every object declaring id as readonly: true — which is every platform object. The console's recents trace alone emits one per org switch. This is the log-side version of the exact "drown the real signal" cost sys_user_preference update reports droppedFields:[id] for a key the caller never sent — every org switch pops a user-facing warning toast #8093, rest: PATCH /data 对被静默剥离的写入字段无任何回传 — onFieldsDropped 通道未接线(follow-up #3407/#3413) #3431 and 审批场景下记录可写性的反馈全线失真:能改的显示「已锁定」,改不了的提示「更新成功」 #3794 were about; readonlyStripWarning's own doc argues it stays at warn precisely so real forgery attempts are visible, and this buries them.
2. The remedy prose is wrong here. The message tells the reader to pass { context: { isSystem: true } }. Following that advice for this write would exempt the caller from the static read-only strip entirely — a strictly worse posture, adopted to silence a line that should never have printed.

What the fix is NOT

⛔ Not "stop stripping id". The strip must stay: a same-value primary-key write is a harmless no-op on SQL but an outright rejection on stores with immutable primary keys, and #6435's block already ruled that widening the strip to the truthy-scalar data.id case "is a separate decision, not a rider here".

Options for whoever takes it

• A. Teach stripReadonlyFields which key is the write's address (an option alongside preserveAudit) and skip only the log line for it. Contained, but adds a parameter to a helper shared by the by-id branch, the multi branch and the insert-side sibling.
• B. Have the by-id branch remove the addressing id before the read-only pass, as addressing rather than as a read-only strip — no strip, no warn, no report, one concept in one place. Bigger blast radius: it changes what the driver receives for objects whose id is not readonly, which is update 的 **by-id** 路径同样把非标量 data.id 交给驱动写主键列(#6262 的孪生形状,where.id 胜出时) #6435's explicitly separate decision.
• C. Leave it and accept the log noise.

Recommendation from the #8093 lane: A, with B filed as the follow-up if the "addressing is not payload" idea is worth unifying across both channels.

Pointers

• packages/objectql/src/validation/rule-validator.ts — stripReadonlyFields, readonlyStripWarning
• packages/objectql/src/engine.ts — idAddressesThisRow, the sys_user_preference update reports droppedFields:[id] for a key the caller never sent — every org switch pops a user-facing warning toast #8093 predicate that already computes "this id is the address"
• packages/spec/src/contracts/data-engine.ts — WriteObservabilityOptions, where sys_user_preference update reports droppedFields:[id] for a key the caller never sent — every org switch pops a user-facing warning toast #8093 wrote the invariant down

Filed unassigned by the #8093 dev lane (seat #6019, domain:engine-core).

[hotlong]

Triage: lands in packages/objectql (rule-validator.ts stripReadonlyFields / readonlyStripWarning) ⇒ domain:engine-core, type Bug, pm:queue. The log line makes three measured-false claims on every single-record PATCH of every platform object, and its remedy prose steers callers toward isSystem: true — advice that would weaken posture to silence a line that should not print. That is a concrete defect against the warning's own documented purpose (keeping real forgery attempts visible), not a design question.

Scope note for the dispatch: option A (teach the helper which key is the write's address, skip only the log line) is the queued scope, per the filing lane's own recommendation — the idAddressesThisRow predicate from #8093 already computes the needed fact. ⛔ Option B (remove the addressing id before the read-only pass) changes what drivers receive and is #6435's explicitly separate decision — file it as a follow-up if wanted, do not fold it in. The strip itself must keep removing id.

Size/model suggestion: S–M / opus (shared-helper parameter design, three call sites).

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop, domain:engine-core seat (#6019)
Session: session_014C8pAprWdmtecFsEprZax4
Branch: claude/issue-8141-readonly-strip-address-warn
Worktree: objectstack-issue-8141
Domain: domain:engine-core
File surface: packages/objectql/src/validation/rule-validator.ts (stripReadonlyFields / readonlyStripWarning), the by-id call site in packages/objectql/src/engine.ts that must pass the address through, their tests, and a changeset. ⚠️ packages/spec/src/contracts/data-engine.ts only if the #8093 invariant text needs extending — doc comment only, ⛔ no schema change (cross-seat, see below).
Container & model: single container, model: opus — matching triage's own S–M/opus read. The fable clause does not fire, and the reason is worth stating because the card sits next to a contract: Option A changes only which key the log line names. The strip keeps removing id, the driver receives exactly what it receives today, and no write that succeeds now begins to fail (or vice versa). No accept/reject behaviour moves, no public face widens.

Serial constraints — derived from real diffs, not from symbol addresses

• rule-validator.ts — free. Nothing in flight holds it. (A number field's declared scale is never enforced — values with more decimals are accepted and stored verbatim (min/max on the same field are enforced) #7501 will touch record-validator.ts, a different file, and it is pm:blocked on the Fable quota with no branch.)
• engine.ts — free in practice. finding: SqlDriver's #3821 recovery ladder widens an unresolvable projection to every field #7589's ruled landing (the known.has(head) projection filter) is reserved on the seat post but is pm:blocked with no branch and no PR, so there is no diff to collide with; it is also a different function from the by-id write path. ⚠️ Re-verify at your base anyway — this seat landed a merge conflict this shift by clearing a region from a symbol's address instead of the other card's actual changed lines.
• The lane's only open PR, test(objectql): two engine fixtures spell the declared aggregation key function, un-erased (#8112) #8206 ([finding] Two objectql engine test fixtures build aggregations: [{ func: … }] behind an as any — the declared key is function, so the aggregation they construct is silently dropped #8112), touches two test files and a ratchet baseline. Disjoint.

Scope — ruled, not open

Triage queued option A: teach stripReadonlyFields which key is the write's address (an option alongside preserveAudit) and skip only the log line for it.

⛔ Option B is explicitly out — removing the addressing id before the read-only pass changes what the driver receives for objects whose id is not readonly, and #6435 already ruled that a separate decision. ⛔ Do not fold it in because it looks cleaner from inside the code. If the "addressing is not payload" idea deserves unifying across both channels, that is a follow-up card, and filing one is welcome.

⛔ "Stop stripping id" is not on the table. A same-value primary-key write is a harmless no-op on SQL and an outright rejection on stores with immutable primary keys.

What makes this fix correct rather than merely quiet

The predicate you need already exists: idAddressesThisRow in engine.ts, written by #8093 (PR #8143, landed a0fdc564e) — the payload id that equals the bound row is the write's address, not payload. ⭐ Reuse that fact; do not re-derive a second, subtly different notion of "this id is the address." Two predicates that disagree in one edge case is a worse defect than the log line.

⚠️ The trap in this card is silencing too much. The warning exists so that real forgery attempts stay visible — its own docblock argues for staying at warn for exactly that reason. So the acceptance bar is a pair, both pinned:

1. the by-id update whose body carries no id (the card's measured repro, sys_user_preference / rec_1) ⇒ no WARN;
2. a caller-supplied id that does not equal the bound row, and a caller-supplied value on some other readonly field ⇒ WARN still fires, unchanged in wording and level.

⛔ A patch that makes (1) green without proving (2) is not acceptable — that is the difference between fixing a false claim and deleting a tripwire. Report the measurement for both, and reverse-verify: predict the direction before you run it.

Also check the third claim in the message while you are there. The card measures all three as false for this write ("caller-supplied", "DROPPED", "COMMITTED WITHOUT IT"), and the remedy prose steers the reader to { context: { isSystem: true } } — advice that would exempt the caller from the static strip entirely, a strictly worse posture adopted to silence a line that should never have printed. If the line still prints for genuine cases, its wording and its remedy should be true for those cases; say what you changed and why.

Cross-seat

packages/spec/src/contracts/data-engine.ts is domain:spec's surface (seat #6017). #8093 already extended WriteObservabilityOptions' invariant text there with a declaration filed by this seat. If your change needs that text extended again, keep it to a doc comment, say so in the report, and I will file the declaration with a stated deadline — ⛔ do not change a schema or a type in that package on this card.

Gates

Derive with node scripts/pm/dispatch-gates.mjs <changed paths> — ⛔ never hand-enumerated. check:type-check-debt --re-measure needs a built closure. ⛔ Baselines may only shrink; --lower is never run. Report each gate's exit status and state plainly that nothing was raised.

Deliverable

Push early — even a WIP scaffold commit — then a draft PR whose first line is Fixes #8141. ⛔ Do not flip to ready, ⛔ do not enable auto-merge; the PM does that after reading each job's own conclusion.

---

Generated by Claude Code