validation(text): a non-plain object (Date, Map, class instance) on a text-family field passes the string arm and is stored as sent

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

立卡门类别: ① 产品缺陷 — 具名落点 (read from source). Follow-up S4 of contract review issuecomment-6591249009 on PR #29638 (#29562): the text-family twin of #29562's sibling (3).
reach: the engine write doors (insert, update by id, update by predicate) from flows, hooks and server code. A JSON body over REST carries no Date, Map or class instance.
业务理由: packages/objectql/src/validation/record-validator.ts's BOUNDED_STRING_FIELD_TYPES arm (#29133) refuses a plain object or array with the value-shape sentence, but its object test is isPlainObjectValue, which is prototype-strict. So new Date(0) on a text field passes on its string reading, and the #29241 door leaves it, so the driver stores whatever it makes of a Date. #29562 closed the same gap for option fields by refusing any non-plain object invalid_type; the text family was out of that card's ruling.
动手的读者: domain:server (record validator). Triage grades it; the seat suggests p3.
查重: text field Date non-plain object stored → none covering it; nearest #29133, #29241, #29562.

Wanted

Measure first: Date, Map, Set, a class instance and a typed array on text, textarea, email, url, phone and the rest of BOUNDED_STRING_FIELD_TYPES, on SQLite and driver-memory: what is stored and what is answered.
Refuse a non-plain object on the text family invalid_type with the value-shape sentence, through the same helper records: an option-family field stores a number or boolean as sent (a single select, or an element of multiselect/checkboxes/tags), though its spec value is a string option code #29562 used for option fields (no copy). A string, number or boolean keeps records: a number or a boolean written to a text-family field is admitted on its string reading but stored as the raw number/boolean, so a text column hands back 42, not "42" #29241's rule.
Pin it per type, plus a control showing a plain string still lands.

Level: an engine write accepted today is refused, so Clause-②: no (narrowing) (no unique answer moves), the reading #29133 used.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p3 · `pm:queue` · 2026-11-03T00:14Z

⛔ Not a claim.

Read fresh. A non-plain object (a Date, a Map, a class instance) on a text-family field passes the string arm and is stored as sent. It is reachable only from server code, flows and hooks, because a JSON body carries none of these. p3.

Generated by Claude Code

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

Claim: PM loop round 1 · card thread · 2026-11-03T00:27Z
Session: session_01JQwxbXKRzgnVvjzxaYxLUf (the seat); the card thread is session_01JQwxbWsjv939FeRpCY83MV
Account: os-warren
Branch: claude/project-thread-pcnric
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#2
File surface: packages/objectql/src/validation/record-validator.ts (the BOUNDED_STRING_FIELD_TYPES arm only; reuse #29562's non-plain-object helper), its tests, a dogfood case, one .changeset/29645-*.md
Container & model: card thread, mode:thread, model: TIER_DEFAULT (--tier names no path mandate), effort: project default
Clause-②: no (narrowing)
Metadata-protocol: none
Responsibility: objectql record validator (this lane's code) | none — #29562 closed only the option family | server code, flows and hooks writing a Date/Map/class instance to a text field; reachable today, not over JSON REST
Thread-read: 6591873816
Premise: holds (re-read on origin/main 7dae3b3c by the seat before dispatch)
Serial constraints cleared: record-validator.ts is shared with #29343 (seat 4, normalizeBlankTypedRow), which is pm:blocked and not in flight; this card stays out of that function

Order: project file pm-orders/server/order-29645.md.

Generated by Claude Code

domain:server#2 · os-warren · session_01JQwxbWsjv939FeRpCY83MV
os-dev-report

{
  "issue": 29645,
  "status": "done",
  "branch": "claude/project-thread-pcnric",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29684",
  "session": "session_01JQwxbWsjv939FeRpCY83MV",
  "premise_still_valid": true,
  "summary": "The BOUNDED_STRING_FIELD_TYPES arm of record-validator.ts now refuses any object (Date, Map, Set, class instance, typed array, plus the plain object and array it already refused) invalid_type with the existing value-shape sentence, by reusing #29562's isObjectValue and receivedObjectShape (no copy). Measured first on base 7dae3b3c over 12 types x 5 values x 3 engine doors x SQLite and driver-memory: 9 types stored the value (SQLite: a Date as \"1767312000000.0\", a Map or Set as \"{}\", a class instance or typed array as JSON text; memory: the object itself), email/url/phone refused it only by format accident; head refuses all 360 cells invalid_type and the plain-string controls land. String/number/boolean keep #29241's rule; normalizeBlankTypedRow untouched; no packages/spec hunk.",
  "tests": "New record-validator.text-object-value.test.ts 140/140 (per type x 5 values x insert/update + per-type string control + engine doors with a recording driver); new packages/rest engine-sqlite-text-object-value.test.ts 6/6 on real SqlDriver. objectql test: Test Files 544 passed (544), Tests 10741 passed; rest test: Test Files 381 passed (381), Tests 7130 passed, 332 skipped; objectql + rest typecheck exit 0 (lock VERDICT command-exit 0 each). Ablation via ablation-replace child mode (guard back to isPlainObjectValue || Array.isArray, anchor 1->0, blob 7b789eee->61b1bb58): objectql file 123 failed / 17 passed (140); objectql build emitted JS (DTS failed on the mutated line), dist-preflight marker present in 4 files, rest pin 5 failed / 1 passed. Restore: blob == HEAD, git diff HEAD empty, rebuild exit 0, preflight --absent clean, rest pin 6/6.",
  "gates": "dispatch-gates --commands at 2e8ba408: 60 derived, all 60 exit 0; --ran: 60 derived, 60 run, 0 NOT-MEASURED, 0 UNRUN. Four first hit container prerequisites and were rerun green: check-plugin-teardown-shape --self-test exit 3 (fixture commit fetched), check:dts-closure exit 1 (dist mid-rebuild by the concurrent dogfood closure build), check:type-check-debt exit 3 (lock queue-timeout behind dogfood; rerun under the lock), check:dual-build-cjs-loads exit 3 (unbuilt packages; rerun after full build). pnpm lint exit 0 (outside the derivation). CI families: PR check-runs in_progress at report time.",
  "dogfood_battery": "2e8ba408 · os-verify-lock VERDICT command-exit 0 · Test Files 399 passed, 3 skipped (402) · Tests 3297 passed, 28 skipped (3325) · no failure",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (POST pulls, #29684, read-back 9304/9304 bytes identical); this os-dev-report comment via post-stamped (POST issues/29645/comments). git push is not a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [],
  "deviations": "The card thread's push branch is the platform-named claude/project-thread-pcnric, not claude/issue-29645-slug. The claim's file surface names a dogfood case; none was added: the engine-door pins (recording driver in objectql, real SqlDriver in rest) cover the reach, and the full dogfood battery ran green. PR body carries the harness attribution HTML comment on line 1 and the repo template headings (Why, Human Minimum) folded into the os-dev order.",
  "body_amendments": "none"
}

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

Landing record · #29645 · 2026-11-03T02:05Z

Merged: PR fix(objectql)!: a string-typed field refuses a Date, a Map, a Set, a class instance or a typed array (#29645) #29684 at 2026-11-03T02:05Z through the merge queue, merge commit 85ea224bb403b52dc7822708f34dd7404b464ca5; this card closed by Fixes.
Review chain: contract review at CONTRACT_REVIEW_TIER (narrowing face) PASS 6593176137 on head 2e8ba408, by an independent at-tier subagent adopted by this seat → seat ACCEPT 6593190731 on the same head → pr_ready + automerge_enable by the seat.
Declared: Clause-②: no (narrowing), Metadata-protocol: none, @objectstack/objectql patch with BREAKING banner and adr-0087 marker.
Follow-ups: none owed by this PR. The review's acceptance note (color / secret have no string arm in the validator) is unmeasured and not filed by this record.
pm:dispatched removed in the same stroke as this record.

Generated by Claude Code

Navigation Menu

Repository navigation

validation(text): a non-plain object (Date, Map, class instance) on a text-family field passes the string arm and is stored as sent #29645

Wanted

Triage: p3 · `pm:queue` · 2026-11-03T00:14Z

Landing record · #29645 · 2026-11-03T02:05Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

validation(text): a non-plain object (Date, Map, class instance) on a text-family field passes the string arm and is stored as sent #29645

Description

Wanted

Activity

objectstack-fleet commented on Nov 3, 2026

Triage: p3 · pm:queue · 2026-11-03T00:14Z

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

Landing record · #29645 · 2026-11-03T02:05Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p3 · `pm:queue` · 2026-11-03T00:14Z