A virtual formula field declared in searchableFields clears lint and the #4254 gate, then silently matches nothing — the same fail-open shape #4254 closed one axis over

[os-zhuang]

Out-of-scope finding from #4840 / PR #6670 (measured by that dev, filed by the engine-core PM on its behalf). Recorded, not claimed. Behavior-change proposal — needs triage grading and, if promoted, a deliberate accept/reject ruling (it narrows what a declaration is allowed to say).

Fact (origin/main, 2026-08-08, measured via resolveSearchFieldResolution)

AUTO:          {"allowed":["name","project_name"],"source":"auto"}          // lookup + formula excluded from the auto-default
DECL-FORMULA:  {"allowed":["name","project_name_formula"],"source":"declared"}  // admitted verbatim
DECL-TEXT:     {"allowed":["name","project_name"],"source":"declared"}

The auto-default set deliberately excludes formula fields — but a declared searchableFields entry naming a formula field is admitted verbatim. It then passes validate-searchable-fields (the field exists) and the #4254 ingress gate (same reason), and every search against it matches nothing: the field is virtual, no driver has a column for $contains to scan (engine.ts:568-573, schema-drift.ts:337, remote-transport.ts:1224).

So the declaration reads as coverage and delivers none — silent wrong-result, the exact failure family #4254 was filed to close on the unknown-name axis, surviving on the known-but-virtual axis. The current hint strings actively steer authors into it (separate wording finding filed alongside).

Direction if promoted (not presumed)

Refuse (or at minimum warn) a formula entry in searchableFields at lint and/or ingress, consistent with the auto-default's own judgment that formula fields are not scannable. Landing would span packages/lint and possibly the ingress assertion; whether refusal is a breaking change for existing metadata needs the usual measured sweep first.

Refs: #4840, PR #6670, #4254; wording half filed separately.

[claude]

Findings-round routing fix only: appended domain:spec — the finding grade is unchanged and this is not a claim.

• Why spec (read, not inferred): the decisive face is acceptance, not the fix's file list. The declared-verbatim admission the card measures is spec's own resolution semantics — resolveSearchFieldResolution lives in @objectstack/spec/data (confirmed on origin/main @ e120a5a via packages/lint/src/validate-searchable-fields.ts:58,95, which documents itself as mirroring that spec function). Refusing (or warning on) a formula entry in searchableFields narrows what a declaration is allowed to say — the "legal metadata set changes" red line routes any such card to domain:spec regardless of size (precedents meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidated PUT /meta write hole (#2657 audit, option A) #6245 / feat(spec): action param 的 options[] 声明逐选项 visibleWhen (#5016) #6235). Lint/ingress edits would be the enforcement tail, not the deciding face.
• Card's own framing agrees: it is a behavior-change proposal that "needs a deliberate accept/reject ruling" if promoted — that ruling is the spec seat's queue.
• Grading untouched: stays finding; the promote decision (and the measured breaking-change sweep the card asks for) belongs to a findings round with the spec seat's visibility. Wording half is The searchable-fields hints prescribe a "text/formula" mirror — the formula half never works, so the tool output now contradicts the docs that quote it #6673 (left unrouted this round: its two hint strings land in packages/lint + packages/metadata-protocol, a genuine two-domain split — named in the round brief).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09, registered on #6015): promoted finding → pm:queue (domain:spec kept), direction per precedent rather than a new ruling: #4254 already closed this exact fail-open shape one axis over — a declared search entry that can never match must be refused loudly, not admitted verbatim. Mirror that treatment for formula fields in declared searchableFields. Sequencing: corpus-count the would-be-refused declarations first and report in the PR body (same discipline as every enforcement widening); a non-trivial hit count is a STOP.

---

Generated by Claude Code