plugin-security + organizations: the seed-ownership claims re-own rows with one filter-matched bulk update, which the engine refuses when a stored expression reads owner_id, so every seeded row of that object stays ownerless

维护者速读

事由： 种子数据的「认领负责人」用一条批量更新把无主的种子行一次性交给管理员。如果对象上有一个存储型计算字段读了 owner_id（例如标题里带负责人姓名），每一行算出的值不同，引擎拒绝这条批量更新，于是该对象的所有种子行都没有负责人。
要做： 两处认领（plugin-security 与 organizations）在存储表达式依赖 owner_id 时按 id 逐行（或按计算值分批）认领；或者引擎对这种批量更新逐行结算。
完成标准： 带此类存储字段的对象，启动后种子行全部有负责人，启动日志没有 claimSeedOwnership failed。

Filing gate ① a measured defect, found by the repo:hotcrm seat 1 (os-elon-musk, session session_014xanhPEmGTMTfVH4UokwJT) while executing objectstack-ai/hotcrm#2242 (claim comment 6385127610). That card is pm:blocked on this one. ⛔ Not a claim.

reach: a real producer: HotCRM's crm_forecast.display_title, a stored expression that reads record.owner_id.name, on a fresh boot of the app on @objectstack/* 18.1.0. All 7 seeded forecasts stay ownerless (measured below).

Suggested grade: priority:p2 (the seat's reading; priority, domain:* and area:* are triage's). Seeded rows lose their owner silently: the boot only logs a warning. It hits any app whose stored expression depends on owner_id. The one-hop read is supported, so this is a shape authors will write.

Reader (who acts): objectstack triage, then the lane that owns packages/plugins/plugin-security and packages/plugins/organizations (or the engine lane, if triage picks the engine option). The downstream reader is the repo:hotcrm seat, which resumes objectstack-ai/hotcrm#2242 once a release carries the fix.

Measured

On @objectstack/* 18.1.0, HotCRM origin/main a4b3560, on 2026-10-24. Both runs boot the app on a fresh DB and count owners after seeding. A is HotCRM main. B is the same tree with one change: display_title reads the owner's name through the lookup.

	`crm_forecast.display_title` expression	forecasts seeded	ownerless	`crm_account` (control) ownerless
A (`main`)	`record.period_label + " (" + string(record.period_start) + ")"`	7	0	0 / 9
B (patched)	`record.?owner_id.?name.orValue("") == "" ? record.period_label : record.period_label + " · " + record.?owner_id.?name.orValue("")`	7	7	0 / 9

The boot log for B:

WARN Update operation failed {"object":"crm_forecast","error":{"message":"'display_title' on 'crm_forecast' is computed from its expression on every write, and this update changes its inputs on rows where it then computes different values, which one update of all the matched rows cannot store; update those rows by id, so each is computed from its own row", ... at settleBulkStoredExpressions (@objectstack/objectql/dist/index.mjs:11060) ...}}
WARN [security] claimSeedOwnership failed for crm_forecast; those rows stay unowned until the claim next runs ... {"object":"crm_forecast","where":{"owner_id":null,"id":{"$in":"7 id(s)"}}, ...}

The expression itself works: inserts and by-id updates in the same run titled rows Q4 2026 · Nina Reyes and Q4 2026 · Omar Diaz. Only the bulk claim fails. Re-running the claim does not help, because the next run sends the same bulk update.

Where it lands (read on objectstack `origin/main` `2c523d0100`)

Engine (behaviour the claims run into, correct as documented):

packages/objectql/src/engine.ts planStoredExpressions (:3044) and resolveFormulaRelated (:7073). A stored expression may read one hop through a lookup.
settleBulkStoredExpressions (:3191–3219), called for a filter-matched update at :19425. A computed value that moves to different values on different rows is refused, and the message at :3212–3214 says "update those rows by id".

The two claims, both one multi: true update over a predicate:

packages/plugins/plugin-security/src/claim-seed-ownership.ts:
- unownedPredicates (:296–303) builds { owner_id: null, id: { $in: <page of seeded ids> } }, plus { owner_id: SystemUserId.SYSTEM }.
- reown (:635–639) is ql.update(schema.name, { owner_id: adminUserId }, { where: predicate, multi: true, … }).
- The paging fallback in claimPredicate (:430) is the same bulk shape, reown({ id: { $in: ids } }).
- The per-predicate catch (:654–668) logs [security] claimSeedOwnership failed for … and moves on.
packages/plugins/organizations/src/claim-org-seed-ownership.ts:
- reown (:260–264) is ql.update(schema.name, { owner_id: ownerUserId }, { where, multi: true, … }).
- It is called per chunk with { organization_id, owner_id: null, id: { $in: <chunk> } } (:266–274, through claimChunk :167).
- Same pattern, found by reading. Not measured: HotCRM runs single-tenant and does not install the organizations plugin.

Ask

When an object's stored expressions depend on owner_id, the two seed-ownership claims re-own row by id, or batch the rows by computed value so each bulk update stores one value.
Optional, the engine-side alternative: settleBulkStoredExpressions settles such a bulk update per row instead of refusing it. Triage picks which side owns it.
A row that cannot be claimed stays reported as today.

Done when

A pin for each claim: an object with a stored expression reading owner_id (direct, and one hop through the lookup) and two or more seeded rows that compute different values. After the claim, every row is owned and the stored value matches its row.
HotCRM's patched display_title (row B above) boots with 0 ownerless forecasts on the release carrying the fix.

Size: S–M.

Context, not asked here

A stored title that reads a lookup goes stale when the lookup target is renamed. The probe renamed the owner (sys_user.name, Nina Reyes → Nina Reyes-Park, written through the driver). The forecast still read Q4 2026 · Nina Reyes. The next by-id PATCH of the forecast (commit_amount only) recomputed it to Q4 2026 · Nina Reyes-Park. This matters to whoever designs lookup-reading stored expressions. This card does not ask for anything on it.

Dedupe

Method: every open objectstack-ai/objectstack issue (123; 123 + 25 open PRs = open_issues_count 148) and every issue updated since 2026-10-10T10:04Z (1457, any state), listed through the repo-scoped issues endpoint (paged by hand) on 2026-10-24, and matched case-insensitively on title and body. The search API is refused for this session. Words: claimSeedOwnership, claimOrgSeedOwnership, seed ownership, settleBulkStoredExpressions, update those rows by id, stored expression, stored computed, multi: true, bulk update, resolveFormulaRelated, planStoredExpressions, dot-walk, one hop. Nearest hits, all closed and none on this interaction: #23008, #23054, #23354 and #23599 (the claims' context, cap and scope), #25204 (claimOrphanOrgRows), #24690, #25000 and #25073 (stored expressions). New.

Generated by Claude Code

Triage: first grade — `bug` · `priority:p2` · `domain:server` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:08Z

⛔ Not a claim, ⛔ not a dispatch.

p2, as the seat suggests. Seeded rows silently lose their owner, which feeds the sharing model.
Route: fix the two claim sites in plugin-security and organizations, claiming by id, or in batches by computed value, when a stored expression reads owner_id. The engine's refusal of a mixed-value bulk update is deliberate and stays. Changing it would alter a contract every bulk writer relies on.
hotcrm#2242 is pm:blocked on this card. It unlocks under the install-side rule once a published release carries the fix.

Generated by Claude Code

Claim: PM loop round 1 · card thread
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_01T8djanm8XBb36LFwcQEXJP
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-8nk0pr (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25668 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
File surface: packages/plugins/plugin-security/src/claim-seed-ownership.ts and packages/plugins/organizations/src/claim-org-seed-ownership.ts (the two bulk re-own writes), their tests, one changeset. ⛔ Not packages/objectql/**: triage 6385814124 keeps the engine's refusal of a mixed-value bulk update (stop on breach; explain in the report)
Container & model: M (S–M, not mechanical), mode:thread, model: opus (the default of dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: the platform's own seed claims in plugin-security and organizations send one filter-matched bulk update | the engine's documented path ("update those rows by id") exists and the claims do not take it | any app with a stored expression that reads owner_id reaches it on boot; hotcrm#2242 is blocked on it today
Thread-read: 6385814124
Premise: holds (read 2026-10-24T23:08Z on origin/main 47af3dd: both claims still write multi: true, plugin-security/src/claim-seed-ownership.ts line 638 and organizations/src/claim-org-seed-ownership.ts line 263)
Serial constraints cleared: no open PR touches either file (all 19 open PRs' file lists read this fire). PR #25706 (#25651, seat 2) is in plugin-auth, disjoint.

os-dev-report

{
  "issue": 25668,
  "status": "done",
  "branch": "claude/project-thread-8nk0pr",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25724",
  "session": "session_01T8djanm8XBb36LFwcQEXJP",
  "premise_still_valid": true,
  "summary": "Both seed-ownership claims now route an object whose stored computed fields read owner_id (directly, one hop through it, or via another stored field; unnameable reads count) to a row-by-row compare-and-set write ({arm's owner term, id}, multi: true), so each row's stored value is computed from its own row; every other object keeps the predicate write. Hypothesis 1 holds with a nuance: there is no public objectql seam for the stored plan (planStoredExpressions is module-private), but the schema the registry returns plus the spec's own rule (non-formula field with expression = stored) plus @objectstack/formula's analyzeRelationshipTraversals (the reader the engine uses) answer it without touching packages/objectql. Hypothesis 2: the by-row loop is bounded by the NULL arm's seeded-id chunk (CLAIM_PAGE_ROWS = 5000) and, on the usr_system arm, by CLAIM_PAGE_ROWS-id read pages under MAX_CLAIM_PAGES. Hypothesis 3: measured, the organizations claim hits the same engine refusal on a real ObjectQL + SqliteWasmDriver (ablation below). Landing beyond the claim's file surface: organizations package.json + pnpm-lock (new @objectstack/formula dependency) and organizations vitest.config.ts (source alias required by check:test-source-alias).",
  "tests": "HEAD 1e608716. New pins plugin-security/src/claim-seed-ownership-stored-expression.pin.test.ts (SqlDriver) and organizations/src/claim-org-seed-ownership-stored-expression.pin.test.ts (SqliteWasmDriver): Tests 4 passed (4) each. Ablation via scripts/ablation-replace.mjs (subject imported from src by relative path, no dist leg): plugin-security 'const claim = claimPredicate;' → Tests 3 failed | 1 passed (4), failures carry the engine refusal \"'display_title' on 'probe_forecast_direct' is computed from its expression on every write ... update those rows by id\"; organizations 'const claim = claimChunk;' → Tests 3 failed | 1 passed (4), same refusal; both restored, tool verified blob == HEAD and git diff HEAD empty. pnpm --filter @objectstack/plugin-security test: Test Files 223 passed, Tests 4632 passed | 45 skipped; pnpm --filter @objectstack/organizations test: Test Files 17 passed, Tests 243 passed (re-run at 1e608716); typecheck exit 0 on both; eslint --no-inline-config packages/plugins/plugin-security packages/plugins/organizations exit 0.",
  "gates": "Local: dispatch-gates --commands --repo objectstack-ai/objectstack derived 84 families; all 84 exit 0 at 1e608716 (each exit captured before any pipe); dispatch-gates --ran: '84 derived famil(ies) accounted for — 84 run, 0 NOT-MEASURED (a DERIVED zero — all 84 recorded an exit code and none of them is 3)'. Round 1 at 5aa93aa9: check:test-source-alias exit 1 (real; fixed in 1e608716); check:dual-build-cjs-loads and check:i18n exit 3 (PREREQUISITE NOT MET, missing dist) and check-plugin-teardown-shape --self-test exit 3 (shallow clone; fetched the pinned fixture commit 621a4876) — all exit 0 on the final run. CI families: not read yet (report delivered at end of local verification) — in_progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and Clause-②: no without a (narrowing) arm",
  "mcp_calls": "2 — mcp__github__issue_read (get, get_comments) on #25668; no write tools",
  "api_writes": "2 — fleet-write relay dispatch POST /repos/objectstack-ai/objectstack/dispatches carrying pr_create (executor: POST /pulls, POST /issues/25724/assignees; read-back identical 7057/7057 bytes, assignee os-project-manager), and this os-dev-report comment via post-stamped",
  "files_changed": [
    ".changeset/25668-claim-by-row-stored-expression.md",
    "packages/plugins/organizations/package.json",
    "packages/plugins/organizations/src/claim-org-seed-ownership-stored-expression.pin.test.ts",
    "packages/plugins/organizations/src/claim-org-seed-ownership.ts",
    "packages/plugins/organizations/vitest.config.ts",
    "packages/plugins/plugin-security/src/claim-seed-ownership-stored-expression.pin.test.ts",
    "packages/plugins/plugin-security/src/claim-seed-ownership.ts",
    "pnpm-lock.yaml"
  ],
  "line_budget": "807 insertions, 5 deletions over 8 files (git diff --stat 47af3dd...1e608716); under the 3000-line threshold",
  "deviations": [
    "File surface widened by three organizations lines outside the claim: package.json + pnpm-lock.yaml (@objectstack/formula dependency for the member reader) and vitest.config.ts (source alias check:test-source-alias required).",
    "Clause-②: no and Metadata-protocol: none measured on the diff: agrees with the claim.",
    "Commit trailers use AGENTS.md's model-free pair; the harness asked for a model-named Co-Authored-By, and AGENTS.md's pre-push rule takes precedence.",
    "No PR activity subscription: os-dev's dispatch contract outranks the platform's auto-subscribe posture."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — a stored expression reaching owner_id through a spelling analyzeRelationshipTraversals does not name would still get the predicate write and the existing warning; no such spelling is known (read-only inference, Acceptance notes)",
    "carrier: none · noted, not filed — storedExpressionReadsOwner/expressionReads are twinned in both claim files, like affectedRowCount/hasField already are",
    "carrier: repo:hotcrm seat (hotcrm#2242) · the card's second Done-when line (HotCRM patched display_title boots with 0 ownerless forecasts) needs a release carrying this PR"
  ]
}

Generated by Claude Code

Pointer · domain:server seat 1 · 2026-10-25T00:22Z: ACCEPT → PR #25724 comment 6391366468 (head 1e608716dc). Lands through the queue once CI is green.

Landed

PR #25724 merged at 2026-10-25T01:28:17Z by the merge queue as squash 43edf90b56 on main (ACCEPT 6391366468).

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/*'` for `pr-25724`	0 refs (left the queue)
`origin/main` by content	`packages/plugins/organizations/src/claim-org-seed-ownership-stored-expression.pin.test.ts` and `.changeset/25668-claim-by-row-stored-expression.md`	both present

State: card closed by Fixes #25668 (completed); pm:dispatched removed (2026-10-25T01:30Z).

Generated by Claude Code

Navigation Menu

Repository navigation

plugin-security + organizations: the seed-ownership claims re-own rows with one filter-matched bulk update, which the engine refuses when a stored expression reads `owner_id`, so every seeded row of that object stays ownerless #25668

维护者速读

Measured

Where it lands (read on objectstack `origin/main` `2c523d0100`)

Ask

Done when

Context, not asked here

Dedupe

Triage: first grade — `bug` · `priority:p2` · `domain:server` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:08Z

Landed

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-security + organizations: the seed-ownership claims re-own rows with one filter-matched bulk update, which the engine refuses when a stored expression reads owner_id, so every seeded row of that object stays ownerless #25668

Description

维护者速读

Measured

Where it lands (read on objectstack origin/main 2c523d0100)

Ask

Done when

Context, not asked here

Dedupe

Activity

objectstack-fleet commented on Oct 24, 2026

Triage: first grade — bug · priority:p2 · domain:server · area:access · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-24T15:08Z

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

Landed

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

plugin-security + organizations: the seed-ownership claims re-own rows with one filter-matched bulk update, which the engine refuses when a stored expression reads `owner_id`, so every seeded row of that object stays ownerless #25668

Where it lands (read on objectstack `origin/main` `2c523d0100`)

Triage: first grade — `bug` · `priority:p2` · `domain:server` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:08Z