spec: the flow get_record node declares limit as any number, while its executor needs a positive integer and hands a fraction to the driver as LIMIT (follow-up to #25269)

Filing gate ③, a follow-up owed by landing work. It was filed by domain:spec seat 2 (seat post #18549), os-bill, session session_01B2EeooonSXrANpkpgUSfFZ, from out-of-scope finding 1 in the os-dev-report 6351947108 on #25269. Contract review 6352380127 on PR #25300 answered it as a card. ⛔ Not a claim. Grade and lane are triage's.

The gap

packages/spec/src/automation/builtin-node-config.zod.ts declares the get_record node's limit as z.number().
The executor (packages/services/service-automation/src/builtin/crud-nodes.ts) does not route through findData, so the Data API window normalizer (PR fix(metadata-protocol)!: the Data API refuses a malformed or negative page window with a 400 naming the parameter as written #25260) and the schemas PR fix(spec)!: the published list-query schemas declare the page window the Data API enforces #25300 narrows never judge it. With limit above 1 it calls data.find with that LIMIT as written, so 2.5 reaches the driver; otherwise it calls findOne.
So an authored flow can declare a window the runtime does not honour as written (declared ≠ enforced, ADR-0049; an authoring trap under Prime Directive chore: version packages #10).

Ask

Declare get_record.limit as the positive integer the executor needs (or reuse the bound PR #25300 exports, if the semantics match), refuse anything else at the flow authoring doors, and add the ADR-0087 disposition. This is authored metadata, so it is Clause-②: no (narrowing), Metadata-protocol: narrowed, minor, with a migration line.

Producers measured by the review: none in the repo's examples, none in HotCRM at 4166f2146bec.

Dedupe: searched issues for "flow get_record limit number not integer findOne data.find"; no open carrier. New.

Generated by Claude Code

Triage: graded p1 · `domain:spec` · `area:workflow` · `bug` · `pm:queue`. Handled as a protocol narrowing under the maintainer's standing rule

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-22T23:51Z. ⛔ Not a claim.

The get_record node's limit is declared z.number(), while the executor hands any value straight to the driver as LIMIT, 2.5 included. Declaring it a positive integer narrows what a flow author can write. That is handled in 18.x with no retirement stage (「协议变更直接处理，排查相关的任务，和我沟通」) and reported to the maintainer. Measure in-repo and HotCRM producers first. The changeset is minor with Metadata-protocol: narrowed.

Claim: PM loop round 1
Session: session_013XF6vcPvtFkNY5BmaMGzcd (the card thread; seat session session_013odhA26dvzy7pQmevdTTvy posts this claim)
Account: os-tesla
Branch: claude/project-thread-kdrs5c
Worktree: objectstack-issue-25302
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface: packages/spec/src/automation/builtin-node-config.zod.ts (+ its test, changeset, generated references) (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier (dispatch-gates --tier: "no path-derived mandate", floor sonnet · default opus · ceiling fable), effort: xhigh
Clause-②: no
Metadata-protocol: narrowed
Responsibility: the spec declares any number; the executor in service-automation hands it to the driver | none: no door judges a fractional get_record limit | any flow author; zero producers measured by the review (repo examples, HotCRM 4166f2146bec)
Thread-read: 6353914667
Serial constraints cleared: none (20 open PRs' file lists read 2026-10-23T01:22Z: none touches this surface; no in-flight lane claim names it)

The platform lets the card thread push only its designated thread branch, so Branch: records that branch, not claude/issue-25302-<slug>. Dispatch order: the project's shared folder, spec-seat-1/dispatch-25302.md.

Generated by Claude Code

os-dev-report

{
  "issue": 25302,
  "status": "done",
  "branch": "claude/project-thread-kdrs5c",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25357",
  "session": "session_013XF6vcPvtFkNY5BmaMGzcd",
  "premise_still_valid": true,
  "summary": "GetRecordConfigSchema.limit narrowed from z.number() to z.number().int().positive() at packages/spec/src/automation/builtin-node-config.zod.ts; the shared builtin-contract judge (flowNodeConfigRefusals) now refuses a fraction, 0 or a negative at nodes.N.config.limit at every flow door, with no consumer code change. Premise verified on origin/main 97967a9: the executor (crud-nodes.ts) hands limit to data.find as written when limit > 1 and calls findOne otherwise. PR #25300's QueryPageWindowSchema is not reused: it admits 0 (the total alone), which is not a get_record window. ADR-0087: not-required (already-registered flow-builtin-node-config-values-refused), with that D3 entry amended in this diff. Producers: objectstack 97967a9 has 70 get_record nodes, 14 limit values, all positive whole numbers except one string template that was already refused; HotCRM 4166f21 (current main) has 42 nodes and 12 limits, all positive whole numbers. Card assignee untouched; PR assignee os-tesla. PR reviewer request not sent (outside the write budget; seat may add it).",
  "tests": "head d972d18 (spec diff unchanged since e92f351). spec test: 709/709 files, 21566 passed, 1 todo; spec typecheck exit 0. Consumers, downstream direction: service-automation test 198/198 files, 2618 tests; lint 153/153, 7076; metadata-protocol 259 passed + 3 skipped files, 21416 passed + 19 skipped; typecheck exit 0 for all three; each run under os-verify-lock, VERDICT command-exit 0. No fixture triage needed (no producer or fixture carries a fractional or non-positive limit). Ablation via scripts/ablation-replace.mjs (anchor int().positive() 1 to 0, blob a900d3e7 to 37141a22): flow-builtin-node-config-values.test.ts went 10 failed / 59 passed, which is exactly the 10 refusal cases; controls stayed green. Restore: blob equals HEAD a900d3e7, git diff HEAD empty. Spec tests import src, so there is no dist leg.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 113 families (merge base 97967a9, 5 paths, 120 changed lines). Run locally, exit codes captured before any pipe: 112 exit 0. pnpm check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: no dist for about 40 packages outside this diff), so it is NOT MEASURED locally and left to CI. Transient exit 3 then exit 0 on rerun: check-plugin-teardown-shape --self-test (shallow clone, fixed by fetch --unshallow); lint check:doc-formula-expressions and check:doc-security-posture (lint dist, fixed by building the closure); spec check:skill-examples (client dist, fixed by building client and client-react). spec check:generated: 1 of 14 stale (check:docs), fixed with --fix and re-checked green. --ran reconciliation against the first partial record was 49 of 113, from a truncated list; the full 113 were then run, record in the scratchpad. PR check-runs at report time: Check PR Size success, The card this PR closes must claim this branch success, No other open PR may claim the same issue success, single-writer path success, Part-of PR must not also close its card success, Spec property liveness success, Check Documentation Links success, Dogfood Regression Gate success (selector), Auto Label success. Lint, Type Check, Test Core 1-6, Build Core, Governed Surface Queue Guard, Check Changeset, Build Docs and Flag docs affected by code changes are in_progress.",
  "dogfood_battery": "d972d18be0 · os-verify-lock VERDICT command-exit 0 (16m03s) · Test Files 289 passed, 3 skipped (292) · Tests 2491 passed, 18 skipped (2509) · no failures",
  "mcp_calls": "3 — github issue_read (get), issue_read (get_comments), pull_request_read (get_check_runs); no write tool",
  "api_writes": "2 relay actions — pr_create (POST /repos/objectstack-ai/objectstack/pulls draft, then POST .../issues/25357/assignees [os-tesla]); comment (POST .../issues/25302/comments, this report). Plus git push of branch claude/project-thread-kdrs5c (not REST)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — the get_record executor form descriptor in packages/services/service-automation/src/builtin/crud-nodes.ts declares limit as type integer with no minimum, so a designer form offers 0, which the save door now refuses loudly; in the PR's Acceptance notes · dedupe words: get_record form descriptor limit minimum, crud-nodes configSchema limit"
  ]
}

Generated by Claude Code

ACCEPT → PR #25357 comment 6356477974 (contract review PASS 6356385532)

Navigation Menu

Repository navigation

spec: the flow get_record node declares limit as any number, while its executor needs a positive integer and hands a fraction to the driver as LIMIT (follow-up to #25269) #25302

The gap

Ask

Triage: graded p1 · `domain:spec` · `area:workflow` · `bug` · `pm:queue`. Handled as a protocol narrowing under the maintainer's standing rule

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: the flow get_record node declares limit as any number, while its executor needs a positive integer and hands a fraction to the driver as LIMIT (follow-up to #25269) #25302

Description

The gap

Ask

Activity

objectstack-fleet commented on Oct 22, 2026

Triage: graded p1 · domain:spec · area:workflow · bug · pm:queue. Handled as a protocol narrowing under the maintainer's standing rule

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: graded p1 · `domain:spec` · `area:workflow` · `bug` · `pm:queue`. Handled as a protocol narrowing under the maintainer's standing rule