fix(plugin-sharing): a share link whose redactFields names no column of the object is refused at mint - #29293

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/plugin-sharing, touching 3 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/objectql/src/core.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via createLink (symbol, a method of class ShareLinkService))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via createLink (symbol, a method of class ShareLinkService))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 839bd9d94a680bf268681ceddb2b2834328b8585 && git checkout 839bd9d94a680bf268681ceddb2b2834328b8585
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 276ca307c5a1b2d9f83cd22c54edc14c1c1351c1 04c61e78e8bbf72cc36d704295c0e6670d59c87d && git checkout -B drift-repro 276ca307c5a1b2d9f83cd22c54edc14c1c1351c1 && git merge --no-ff 04c61e78e8bbf72cc36d704295c0e6670d59c87d

node scripts/docs-audit/affected-docs.mjs --json 276ca307c5a1b2d9f83cd22c54edc14c1c1351c1

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 276ca307c5a1b2d9f83cd22c54edc14c1c1351c1 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract-review-claim: session_01ADHkmQjPiXgNoSaEpqeGvY · head 38ded5e5d522fa1001e1d691cc4edc389d1c07c3 · 2026-11-02T11:12Z

The lane seat runs this PR's review in an isolated reviewer. The PR declares Clause-②: yes (widening) for the new declaredColumnSet re-export, and its share-link mint also narrows (unknown redactFields entries are refused). So the review runs at CONTRACT_REVIEW_TIER with ④ over the whole non-prose diff.

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 38ded5e5d522fa1001e1d691cc4edc389d1c07c3
Local-runs: none
Scope: packages/objectql/src/core.ts, packages/plugins/plugin-sharing/src/share-link-service.ts, packages/plugins/plugin-sharing/src/share-link-redact-fields.test.ts, scripts/engine-double-contract.pinned.json + packages/objectql/src/declared-read-columns.ts, packages/objectql/src/index.ts, packages/plugins/plugin-sharing/src/share-link-routes.ts, packages/runtime/src/domains/share-links.ts, packages/spec/src/contracts/share-link-service.ts, packages/types/src/share-link-resolve-answer.ts, scripts/pm/clause2-line.mjs, scripts/pm/record-recognisers.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, .changeset/29130-share-link-redact-fields.md (read for ②)

Reviewed read-only at 2026-11-02T11:31Z: the net diff origin/main...38ded5e5, card #29130 (body and every comment, claims 6573655861 and 6573762130 and the os-dev-report 6575674492 included), PR #29293 (body, file list), and the head's check-runs. Check-runs at posting: 48 on the head, all completed — 35 success, 13 skipped, 0 failure/neutral/cancelled (polled to completion before this record was written). The gate verdicts are green; the FAIL below is the record's own, on the declaration carrier.

① Derived judgments

• Public surface, @objectstack/objectql, entry ./core — gains one value export, declaredColumnSet, re-exported from declared-read-columns.ts. Read in the tree: declared-read-columns.ts already exports it and engine.ts consumes it at eight sites; src/index.ts does NOT re-publish ./core (its only core lines are two @objectstack/core re-exports), so the widening lands on ./core alone, as the PR and the revised claim state. Right. A widening of a published export; no type changes, no signature change.
• REST accept set, POST /api/v1/share-links (and the dispatcher twin packages/runtime/src/domains/share-links.ts) — redactFields is now refused 400 VALIDATION_FAILED when (a) it is not an array of strings, or (b) any entry is outside declaredColumnSet(schema); both doors pass the body's redactFields straight to createLink, the REST door maps err.status/err.code via sendError, the dispatcher via deps.errorFromThrown (reads status), so both answer 400 with the existing envelope. Right: an input accepted 201 on main is refused on head — a NARROWING of a published accept set, exactly what the changeset's own prose says ("The mint now narrows").
• Accept set kept — omitted/null/[] still store null; names in the field map or in PLATFORM_PROVISIONED_COLUMNS (id, created_at, updated_at) are accepted; a schema with no checkable field map (absent, array, empty) returns undefined from declaredColumnSet and the list is stored as sent. Right — this is the shared rule of declared-read-columns.ts and the test pins each arm (doc, bare, unmapped).
• Ordering — the check sits after the visibility/A′ authority block and before assertEligible, so an unauthorised caller gets 403 FORBIDDEN without learning column names. Right; pinned by the 403 test (message does not echo the name).
• No new error code — VALIDATION_FAILED already issued by this mint (object is required, emailAllowlist is required…). Right.
• Stored rows — untouched; resolveToken's union policy.redactFields ∪ row.redact_fields unchanged. Right, and the residue is named in ③.
• Ledger scripts/engine-double-contract.pinned.json — two rows (delete, update, pinned: 1) for the new test file, inserted in the file's sort position (after share-link-enforcement-context.test.ts, before sharing-rule-provenance.test.ts), same shape as neighbours; the new double does call assertEngineUpdateDispatch/assertEngineDeleteDispatch. The gate's output, nothing else changed in the file.

② Semver level

• Level: patch on both packages — right. Under ruling A (check-changeset-no-major.mjs and AGENTS.md Post-Task Checklist §3) the level follows Metadata-protocol: alone; this diff changes nothing a metadata author writes (none), so every entry is patch. A non-protocol widening or narrowing "ships patch and keeps its BREAKING banner and ADR-0087 disposition". skip-changeset would be wrong (two released packages move); the changeset lists both. ✓
• Metadata-protocol: none — right.
• Clause-②: yes (widening) — WRONG declaration for this diff. Must-fix (M1). The one reader, scripts/pm/clause2-line.mjs, spells out the four combinations: yes/yes (widening) = a widening; no (narrowing) = breaking, not a widening; and yes (narrowing) — "a diff that widens one surface and narrows another. Both facts are true and both are read." This PR is that diff by its own account (and by the seat's original claim 6573655861, which read no (narrowing)). AGENTS.md allows "at most one arm", and the reader resolves which one carries when both are true: the narrowing arm, because it is the only carrier of the breaking signal here — the changeset has no major, no **BREAKING** banner and no !, so check-adr-0087-registration.mjs signal (4) is the ONLY thing that can see this narrowing, and with (widening) it sees nothing and asks for no ADR-0087 disposition. That is the feat(platform-objects): sys_job.timezone and sys_report_schedule.timezone are validated against the IANA domain #16296 hole the arm was built to close, reopened by prose. record-recognisers.mjs#reviewFace reads the same arm: with the paths deciding no face, yes (narrowing) on any carrier ⇒ the narrowing face (CONTRACT_REVIEW_TIER, ④ owed); yes (widening) ⇒ the declaration face (TIER_DEFAULT, no ④). So the line as written also under-routes the review the diff owes — the dispatching seat compensated by hand in this brief, but the committed carrier is what the queue guard reads. Prose ("The mint now narrows") is not read by any gate.
  Fix: Clause-②: yes (narrowing) on the PR body and in .changeset/29130-share-link-redact-fields.md; then, because the changeset declares breaking, exactly one ADR-0087 disposition marker in its body (the HTML-comment form adr-0087: not-required (CATEGORY) WHY, category from the gate's own print — no spec key moves and no migration ledger entry applies) and the migration line AGENTS.md asks of a breaking changeset (the FROM→TO is already in prose: "correct the name, or drop it" — keep it, under a **BREAKING** banner). Level stays patch.
• Changeset body otherwise follows the diff: both packages, the narrowing stated, the unchanged set stated, stored rows stated, the new ./core export named. ✓

③ Boundary flags

• Deviation: scripts/engine-double-contract.pinned.json outside the claim's file surface — accepted. Gate-forced coverage ledger, judged in ① as the gate's output. Not a shrink-only baseline.
• Deviation: Clause-② copied as yes (widening) per revised claim 6573762130 — ⛔ not accepted; see ② M1. The revised claim's instruction to put the narrowing "in the PR body" as prose contradicts the reader it must satisfy. The seat ruling on the single-source route (re-export declaredColumnSet) stands; the declaration spelling does not.
• Deviation: closure build rerun with --workspace-concurrency=2 — process note, nothing to judge.
• Open question 1 (stored rows still list an unknown name at resolve; filter?) — A (this PR) agreed. B (display-only filter in @objectstack/types buildShareLinkResolveAnswer) is a separate card on a types surface; C (filter the effective set in resolveToken) is rightly refused — the same list drives redaction and a gap in the column set would un-hide a policy entry. Escalation: file B as a follow-up card; not a condition of this PR.
• Open question 2 (no checkable field map ⇒ no verdict; fail closed instead?) — A agreed. It is declaredColumnSet's shared rule on every read/write door, and a non-system, non-permissive caller is refused 422 SHARING_NOT_ENABLED before the check when getSchema answers nothing (read: getPolicy(undefined) ⇒ enabled: false). Only permissive/system callers reach the mint without a schema, and those bypass the policy by design (system-context ledger row 38).
• Open question 3 (system columns; update path) — as implemented: provisioned columns accepted exactly when declaredColumnSet holds them; no update/edit verb exists for a link's redactFields (create/list/revoke/resolve only, read in share-link-routes.ts and the dispatcher), so the mint is the only entry.
• Docs drift advisory (content/docs/permissions/system-context.mdx row 38 names createLink) — read: the row describes the system-context bypass of the enabled check, which this diff does not touch; nothing falsified. content/docs/releases/v14.mdx is release-owned and untouched. ✓
• Dogfood battery — n/a per the report (no ! in title). Note: once M1 lands as yes (narrowing), re-read whether the dev-report's dogfood clause (Clause-② arm is (widening)) still exempts the PR; the targeted share-link dogfood files already ran 41/41.

④ Design judgment

packages/plugins/plugin-sharing/src/share-link-service.ts — holds against the cited code and the card's scenario.

• assertRedactFields judges against declaredColumnSet(schema) where schema = this.engine.getSchema?.(input.object) — the same registry object resolveToken reads for its policy and the same set the engine shapes rows to on every read (engine.ts find/findOne/insert/update/delete sites), so "a name is accepted exactly when the read serves a column by that name" is true for storage-backed columns. The card's repro (sumary ⇒ 201 ⇒ served in full under a "hidden" notice) now ends at the mint with 400 and no row. ✓
• Break attempts: '' and whitespace names are refused (not in the set) ✓; duplicates in a valid list are stored as sent (pre-existing; harmless, resolve builds a Set) ✓; internal: true fields are declared and so redactable (harmless — already omitted by the read) ✓; a name present only in the object policy's redactFields is not consulted (right — the per-link list is the input under judgment; the policy list is an authoring question outside this card) ✓; permissive mode with no schema ⇒ no verdict, list kept (the shared rule; ③ Q2) ✓; the refusal message names only the unknown entries, deduplicated, and nothing about valid ones (pinned) ✓.
• Residual edge (observation, no finding): a key the served record carries that the field map does not declare — one an afterFind hook or expand adds after the engine's declared-column shaping — was redactable on main (the name matched a served key) and is now refused as "does not have". declared-read-columns.ts names such keys as "the engine's or the hook's, not storage's". The mint's rule is the right one for the card (a name must have a column behind it); the docblock's "exactly when there is something for it to hide" is one notch stronger than the code. No change asked.
• Should-fix (S1): the request-SHAPE half of the check (Array.isArray / typeof name === 'string') runs after the authority read, unlike the mint's other 400 request-shape checks (object, recordId, emailAllowlist), which run before any DB read. Only the COLUMN half needs the authority ordering (it is what leaks column names). Splitting the shape check up to the request-shape block keeps a malformed body from paying a record read and keeps the mint's own 400-before-403 convention for shape; the 403-first test stays true because it sends a well-shaped list. Not a FAIL on its own.

packages/objectql/src/core.ts — holds. One value re-export, source already exported from its module and already consumed by engine.ts; comment states the consumer and the single-list reason. ./core is the lean entry, index.ts does not fan it out, so the widening is exactly the one declared. ✓

packages/plugins/plugin-sharing/src/share-link-redact-fields.test.ts — holds against the scenario. Fixtures shaped like the registry's (id outside the field map; bare carries no timestamps in the map) so the provisioned-column arm is really exercised; every refusal pinned on status + code + row-count, no bare toThrow(); the 403-ordering case checks the name is not echoed; the REST case mounts the real registerShareLinkRoutes and reads the envelope (success: false, error.code). The double pins update/delete to the engine's dispatch contract, honours limit and refuses $ combinators — what the three gates asked. The mixed case asserts the bdoy, titel ordering and dedup against the message spelling in the service, which is the right pin for "names every unknown entry once". ✓

scripts/engine-double-contract.pinned.json — the gate's output (①), judged only as such. ✓

Findings: M1 (must-fix) — Clause-②: yes (widening) is the wrong carrier for a diff that widens ./core AND narrows the share-link mint; spell yes (narrowing) on the PR body and the changeset and add the ADR-0087 disposition marker the gate then requires (level stays patch). S1 (should-fix) — move the array-of-strings shape check of redactFields before the record read, beside the mint's other request-shape 400s.

Implemented-by: claude/project-thread-gor7h6
Reviewed-by: session_01ADHkmQjPiXgNoSaEpqeGvY

VERDICT: FAIL

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract-review-claim: session_01ADHkmQjPiXgNoSaEpqeGvY · head 04c61e7 · 2026-11-02T12:38Z

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 04c61e78e8bbf72cc36d704295c0e6670d59c87d
Local-runs: none
Scope: packages/objectql/src/core.ts, packages/plugins/plugin-sharing/src/share-link-service.ts, packages/plugins/plugin-sharing/src/share-link-redact-fields.test.ts, scripts/engine-double-contract.pinned.json + packages/objectql/src/declared-read-columns.ts, packages/objectql/src/index.ts, packages/plugins/plugin-sharing/src/share-link-routes.ts, packages/runtime/src/domains/share-links.ts, packages/spec/src/contracts/share-link-service.ts, scripts/pm/clause2-line.mjs, scripts/pm/record-recognisers.mjs, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, .changeset/29130-share-link-redact-fields.md (read for ②)

Round 2, rendered read-only at 2026-11-02T12:41Z. Supersedes record 6576071712 (FAIL, on head 38ded5e5). Inputs: the round-2 delta 38ded5e5..04c61e78 (one commit), the net diff origin/main...04c61e78, card #29130 with every comment (the round-2 os-dev-report 6577314563 included), the PR body as rewritten at 2026-11-02T12:38Z, and the head's check-runs. Check-runs at posting: 52 on the head, all completed — 37 success, 15 skipped, 0 failure/neutral/cancelled, none still in progress (polled to completion before this record was written). The gate verdicts are green, Check Changeset, PR-body guards and Governed Surface Queue Guard included.

① Derived judgments

Re-read on the WHOLE net diff; the delta touches no accept set or public surface beyond moving one check earlier.

• Public surface, @objectstack/objectql entry ./core — unchanged since round 1: one value export declaredColumnSet, index.ts does not fan ./core out. Right.
• REST accept set, POST /api/v1/share-links and the dispatcher twin — redactFields refused 400 VALIDATION_FAILED when (a) not an array of strings or (b) an entry is outside declaredColumnSet(schema). Delta: (a) now runs in the request-shape block (after the emailAllowlist check, before readRecord), (b) stays after the authority block and before assertEligible. Same codes, same envelope, same stored row; the accept set is byte-for-byte the one round 1 judged. Right — a narrowing of a published accept set, now declared as such (②).
• Ordering consequence of the delta — a malformed redactFields from a caller with no authority now answers 400 instead of 403. The shape refusal reveals nothing about the object or the record (it is a statement about the request body alone), so the 403-before-anything rule that guards column names is intact; the column check is still 403-first and the test pins it. Right.
• Accept set kept — omitted/null/[] ⇒ null stored; provisioned columns accepted; uncheckable field map ⇒ no verdict (assertRedactFieldColumns also returns at once on an empty list, so an empty list never consults the schema). Right.
• Ledger — unchanged since round 1, the gate's output. Right.

② Semver level

• M1 — RESOLVED. .changeset/29130-share-link-redact-fields.md at the head and the PR body both carry Clause-②: yes (narrowing) and Metadata-protocol: none. The changeset carries a **BREAKING**: banner that names the door, the old and new answers and the FROM → TO fix (correct the name, or drop the entry), and EXACTLY ONE ADR-0087 disposition marker in the HTML-comment form the gate reads, category no-migration-prescription (one of the gate's CATEGORIES), with a reason that is true of the tree: no metadata key, spec schema or stored row moves, so there is nothing for objectstack migrate meta to rewrite. Read against clause2-line.mjs: yes (narrowing) is the spelling for a diff that widens one surface and narrows another; check-adr-0087-registration.mjs reads signals BREAKING and clause-②-narrowing and finds the disposition; reviewFace now routes the PR to the narrowing face (CONTRACT_REVIEW_TIER, ④ owed) — the face this record serves.
• Level: patch on both packages — right (ruling A: the level follows Metadata-protocol: alone; none ⇒ patch; a non-protocol narrowing ships patch and keeps its BREAKING banner and ADR-0087 disposition, which it now does). skip-changeset would be wrong; both released packages are listed.
• Changeset body follows the diff: narrowing stated, unchanged set stated, stored rows stated, the ./core export named. The round-2 placement of the shape check is covered by the existing "A redactFields that is not an array of strings answers the same" sentence (the status and code did not change, only where it is asked). ✓

③ Boundary flags

• M1 / S1 round-2 deviations — the dev reports the commit was amended once locally before push (no pushed history rewritten) and that the ADR-0087 marker is an HTML comment in the changeset file (the form the gate requires, invisible in a published changelog by design). Both accepted.
• Deviation: ledger outside the claim's file surface — accepted, as in round 1.
• Open questions 1–3 — unchanged from round 1 and answered there: Q1 A now, B (display-only filter in @objectstack/types buildShareLinkResolveAnswer) as a follow-up card, C refused; Q2 A (the shared declaredColumnSet rule; a non-system, non-permissive caller is refused 422 SHARING_NOT_ENABLED before the check when no schema answers); Q3 as implemented. Nothing in the delta reopens them.
• Dogfood battery — the dev ran the full battery under the (narrowing) arm (388 files / 3208 tests passed, 0 failures, per report 6577314563); not re-run here, the check-runs are the gate verdicts.
• PR body prose nit (not reviewed, noted) — the 「先看」 bullet still names assertRedactFields, a function the delta split into redactFieldsShape and assertRedactFieldColumns; the English sections describe the two-step shape correctly. Prose only; the seat holding the body may refresh it.
• Docs drift advisory — same two pages as round 1 (system-context.mdx row 38 and the release-owned v14.mdx); the delta changes nothing they state.

④ Design judgment

packages/plugins/plugin-sharing/src/share-link-service.ts — holds; S1 — RESOLVED.

• redactFieldsShape(raw) is called at the mint's request-shape block, immediately after the emailAllowlist 400 and before readRecord is defined or run, so a malformed list pays no engine.find and answers 400 with the mint's other request-shape refusals. assertRedactFieldColumns(names, schema, object) keeps the column judgment after the visibility/A′ block and before assertEligible, so column names are still disclosed only to a caller with authority. The stored value is the shape-checked list (redact_fields: redactFields.length > 0 ? redactFields : null), unchanged in effect from round 1.
• Break attempts on the split: null/undefined ⇒ [] ⇒ the column check returns at once without touching the schema ✓; a non-array ('body'), a non-string member ([42]) and an object are refused by shape (the existing three-shape test still runs against the service and now exercises the earlier site) ✓; the column check receives a readonly string[] and cannot see a non-string ✓; the message spellings are unchanged, so the bdoy, titel and the not-echoed-name pins still bind ✓; the permissive/system no-schema path is unchanged (no verdict) ✓.
• Round-1 residual observation (a key served only via an afterFind hook or expand is not redactable) stands as an observation, not a finding.

packages/plugins/plugin-sharing/src/share-link-redact-fields.test.ts — holds; the S1 pin is real. The new case wraps engine.find on the same object the service holds (the service reads this.engine.find at call time, so the wrap is observed), sends redactFields: 'body' for a record the caller cannot see (recordId: 'missing'), and asserts 400 VALIDATION_FAILED with ZERO reads — which also proves the ordering claim against the 403 path: the same missing record with a well-shaped list still answers 403 first in the neighbouring case. 11 cases; no existing case changed. ✓

packages/objectql/src/core.ts — unchanged since round 1; holds. ✓

scripts/engine-double-contract.pinned.json — unchanged since round 1; the gate's output. ✓

Findings: none. M1 and S1 from record 6576071712 are both resolved on this head.

Implemented-by: claude/project-thread-gor7h6
Reviewed-by: session_01ADHkmQjPiXgNoSaEpqeGvY

VERDICT: PASS

domain:server#1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY

席位核对 · ACCEPT · domain:server seat 1 · os-steve · session_01ADHkmQjPiXgNoSaEpqeGvY · 2026-11-02T12:43Z

Head 04c61e78e8, round-2 report 6577314563 (on #29130), claim 6573762130. The diff widens one surface (declaredColumnSet on @objectstack/objectql/core) and narrows another (redactFields on POST /api/v1/share-links), so it is declared Clause-②: yes (narrowing). A contract review is owed at CONTRACT_REVIEW_TIER: round-2 record 6577411412 on this head is PASS with no findings, and it supersedes FAIL 6576071712.