finding: 16 test doubles short-circuit $or in their WHERE matcher, dropping sibling filters — the suite stays green while testing a different query

[claude]

What

Sixteen test files spread over four packages build an in-memory driver / engine double whose WHERE matcher returns early on $or (and usually $and), discarding every sibling equality key in the same object:

const matchesWhere = (row, where) => {
    if (!where || typeof where !== 'object') return true;
    if (Array.isArray(where.$and)) return where.$and.every((w) => matchesWhere(row, w));
    if (Array.isArray(where.$or)) return where.$or.some((w) => matchesWhere(row, w));   // <-- returns here
    for (const [k, v] of Object.entries(where)) { /* the sibling keys, never reached */ }
};

A real driver conjoins them. So for a query shaped like SysMetadataRepository.listDrafts's —

{ state: 'draft', package_id: 'app.x', $or: [{ organization_id: ORG }, { organization_id: null }] }

— the double answers on the $or alone and hands back rows matching neither state nor package_id: active rows, other packages' rows, anything with a matching org. This is not a stricter or looser edge case; it is a different query.

Why it matters — measured, not theorised

Hit while measuring #7559. A probe driving the real publishPackageDrafts twice through one of these doubles had its second publish record no sys_metadata_commit row at all (commitId: undefined) while still promoting the draft — because listDrafts returned the active row alongside the draft one and the batch went down a different path. Correcting the matcher to conjoin (~8 lines) made the same scenario behave as the product does, and only then did the real defect reproduce.

The failure mode is the dangerous direction: the suite stays green while silently testing a scenario nobody wrote. Nothing distinguishes "this double is faithful here" from "this double quietly changed the fixture", and every one of these files reads as if the query were honoured.

Where

$or short-circuit, confirmed by grep on 2c1988c:

• packages/objectql/src/ — protocol-recorded-by-null.test.ts, save-meta-response-conformance.test.ts, plugin.authoring-channel.test.ts, publish-meta-response-conformance.test.ts, protocol-save-meta-repo-path-real-engine.test.ts, protocol-registry-shadow.test.ts
• packages/runtime/src/domains/share-links-enforcement-context.test.ts
• packages/plugins/plugin-security/src/ — row-write-widener-composition.test.ts, vama-write-path-convergence.test.ts, authored-row-write-verdict.test.ts
• packages/plugins/plugin-sharing/src/ — bulk-recompute.test.ts, boot-backfill.test.ts, authored-row-write-deferral.test.ts, sharing-rule.test.ts, system-write-skip-notice.test.ts, record-share-cascade.test.ts

Not audited per file: whether each one's suite actually sends a mixed $or + sibling-key query today. Several plausibly never do, in which case the looseness there is dormant rather than active — dormant is still worth closing, because the next test that adds an $or inherits a double that lies. Establishing which are live is the first step of this issue, not a precondition for filing it. sharing and security are the packages most likely to be live: org / owner / group $or predicates are their normal shape.

Suggested shape

Conjoin instead of returning early — the whole change per file:

for (const [k, v] of Object.entries(where)) {
    if (k === '$and') { if (!v.every((w) => matchesWhere(row, w))) return false; continue; }
    if (k === '$or')  { if (!v.some((w) => matchesWhere(row, w)))  return false; continue; }
    if (k.startsWith('$')) continue;
    /* equality compare */
}

Better than sixteen copies: one shared matchesWhere helper these doubles import, so the semantics are fixed once. That is a judgement for whoever picks this up — the copies differ slightly in what else they support, and consolidating them is a larger change than correcting them.

packages/objectql/src/protocol-revert-org-scope.test.ts (PR #7619) carries the corrected form with a comment saying why, and can be copied.

Not

Not a product defect — no shipped code path is affected, and no user hits this. It is a test-fixture fidelity gap, filed per Prime Directive #10 rather than fixed in #7619's PR, which is scoped to the revert. Adjacent but distinct from #7264 (objectql test driver doubles any-annotated at scale): that one is about the type channel over these same doubles, this one about their runtime semantics.

---

Found while measuring #7559.

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

Triage (route-A pass): deliberate leave-blank — no domain:* applied; finding grade untouched.

• Premise re-verified on origin/main @ 5823d59 (the card grepped 2c1988c): the early-return shape is live in both spot-checked packages — packages/objectql/src/protocol-registry-shadow.test.ts:84 and packages/plugins/plugin-sharing/src/sharing-rule.test.ts:26 (matcher named matches/f there — counter-probed, the sibling-key skip at :29 confirms the same semantics).
• Why no routing label: the 16 files split 6 objectql (engine-core) / 1 runtime (cli) / 9 security+sharing (identity) — a genuine three-lane span with no single principal landing site. The card's own better-fix (one shared matchesWhere helper) has no decided home yet, and picking a lane by file-count majority would dispatch two other lanes' test files to the wrong PM. Per the route-A discipline, ambiguous landings stay blank rather than mislabeled.
• Suggested resolution shape for the grading round: this is a strong sweep-promotion candidate (one criterion — "double's WHERE matcher short-circuits combinators" — N mechanical per-file edits, PR fix(metadata-protocol,metadata): revert reads the history row under the key the writer stored it with (#7559) #7619's corrected form as the template). A sweep card can carry a single lane (wherever the shared helper lands) with the other lanes' files enumerated in the per-item checklist; the split IS the decision, so if the sweep shape is rejected, contract-first split by package family instead.
• Dedup: distinct from objectql test driver doubles are any-annotated at scale — the retired-capability tombstone has no tsc channel in 64 files #7264 (type-channel any over the same doubles — the card itself draws the line); no other open card covers matcher semantics.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. Sixteen doubles answering $or while discarding sibling conjuncts means those suites are green while testing a different query — test-integrity at scale, and sweep-shaped (one matcher fix template, N files, itemized checklist per the sweep discipline). Routing note for the triage seat: the fix spans four packages, so domain:* (or a contract-first split) is deliberately left to the triage seat's single-producer channel — only pm:queue is set here.

finding → pm:queue.

---

Generated by Claude Code

[os-zhuang]

Triage: routed domain:engine-core — closing out the routing debt the 14:31Z promotion comment explicitly left to this seat. This supersedes this seat's earlier deliberate leave-blank (10:08Z): that pass held the label back because the three-lane span had no decided home; the promotion to pm:queue makes an undispatched-but-unroutable card a queue-blocker, so the cross-domain exception path is now invoked instead.

Routing rationale (read, not guessed).

• The corrected matcher template the card names is live on origin/main @ 098b629 at packages/objectql/src/protocol-revert-org-scope.test.ts:124 (matchesWhere, conjoining form) — the template and the card's own better-fix (one shared helper) both have their natural home in packages/objectql ⇒ domain:engine-core.
• Dependency direction supports it: packages/plugins/plugin-sharing/package.json (and the security/runtime siblings) already depend on @objectstack/objectql, so a helper exported from objectql is importable by every one of the 16 files; the reverse direction is not.
• 6 of the 16 files are already in packages/objectql; the remaining 10 (1 runtime, 9 security/sharing) are mechanical ~8-line matcher corrections off the same template.

Cross-domain exception path (rule 4). This is a designated single-lane claim, not a split: 16 mechanical edits off one template make a contract-first three-way split cost more than it saves (three claims/PRs/CIs for trivial per-file diffs, and the shared-helper question is unsplittable). The engine-core seat's claim must declare the full file face (all 16 files across packages/objectql, packages/runtime, packages/plugins/plugin-security, packages/plugins/plugin-sharing) and run the targeted in-flight check per the exception path. Sweep shape recommended: one PR, per-item checklist, Fixes #7620.

Stale-premise check. Spot re-verified on origin/main @ 098b629: the early-return $or shape is still present in packages/objectql/src/protocol-registry-shadow.test.ts and packages/plugins/plugin-sharing/src/sharing-rule.test.ts (checked at the prior pass @ 5823d59, unchanged since). Premise holds.

Dedup. Unchanged from the prior pass: distinct from #7264 (type channel over the same doubles); no other open card covers matcher runtime semantics.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Correction to the routing comment above (same place as the error, per the correction discipline): the spot-check line "unchanged since" is wrong for one of the two files. On origin/main @ 098b629, packages/plugins/plugin-sharing/src/sharing-rule.test.ts:34 now carries the corrected conjoining form (with a comment block explaining the old return f.$or.some(...) hazard) — it has been fixed since the card's grep @ 2c1988c. Re-measured across all 16 named files just now: the early-return shape is confirmed live in at least packages/objectql (all 6), packages/runtime/src/domains/share-links-enforcement-context.test.ts:149, and packages/plugins/plugin-security/src/row-write-widener-composition.test.ts:221; matcher variable names vary per file (where/f/filter), so the dispatch's step 1 must re-grep the list at its own ref rather than trusting the card's enumeration — expect ~15 of 16 remaining, minus whatever else lands in the interim. Routing and classification are unaffected.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 2 — this lane's share only (6 of 16 files); the card stays open for the rest
Session: session_01VGAePF7iGGUYUT8oX1cVgx
Branch: claude/issue-7620-objectql-or-matcher-conjoin
Worktree: objectstack-issue-7620
Domain: domain:engine-core
File surface: the six packages/objectql/src/*.test.ts doubles listed below — ⛔ nothing outside packages/objectql, ⛔ not engine.ts, ⛔ not registry.ts
Container & model: M, mode:cloud single container, model: opus (the card's own step one — establishing which doubles are live vs dormant — is judgement, not mechanics)
Serial constraints cleared: none of the six is touched by any in-flight card. #7738/PR #7833 owns engine.ts + engine-external-tenant-scope.test.ts; #7521 owns registry.ts; #5571 writes only a new harness file. All disjoint

⚠️ This card spans four packages and three seats — I am taking one seat's share

Measured against the card's own file list:

files	package	owner
6	packages/objectql/src/	domain:engine-core — this seat, dispatched now
6	packages/plugins/plugin-sharing/src/	domain:identity (#6022)
3	packages/plugins/plugin-security/src/	domain:identity (#6022)
1	packages/runtime/src/domains/	domain:cli (#6024)

⛔ I am not dispatching the other ten. A PM claiming files in two other lanes because one card happens to name them is exactly what the lane bijection prevents — and the card notes sharing/security are the most likely to be live, so their share is the higher-value half and deserves its own seat's attention rather than a drive-by.

Routing request for the triage seat: this wants a contract-first split — one sub-issue per lane under this parent, each carrying its own domain:*. I have deliberately not created them, since domain:* is triage's single-producer territory. My PR will say Part of #7620, ⛔ not Fixes, so the card survives to carry the remaining shares.

The six in scope

protocol-recorded-by-null.test.ts · save-meta-response-conformance.test.ts · plugin.authoring-channel.test.ts · publish-meta-response-conformance.test.ts · protocol-save-meta-repo-path-real-engine.test.ts · protocol-registry-shadow.test.ts

Reference implementation of the corrected matcher already on main: packages/objectql/src/protocol-revert-org-scope.test.ts (PR #7619).

Adjacent, ⛔ not folded in: #7264 (these same doubles are any-annotated at scale) is the type channel over the same fixtures; this card is their runtime semantics. Different fix, different round.

---

Generated by Claude Code