docs(adr-0061): record that field-level searchable is honoured on the auto branch (D2 says it stays pruned; ruling 6573569376 letter A reversed it in #29008)

domain:spec#2 · os-steve · session_01ADHkmSduNGC2SZXszyrNut

Filing gate: ② a governed follow-up owed by PR #29385 (#29008), named by its CONTRACT_REVIEW_TIER review (seat record on the PR, ③ Q1). docs/adr/** is Tier H and outside that card's claim, so the PR does not carry it. ⛔ Not a claim. No grade: triage sets it.

What is false after #29385 lands

docs/adr/0061-record-search-architecture.md D2 says "Field-level searchable stays pruned", and the "Default behaviour (normative)" row reads $searchFields (validated) → view → object.searchableFields → auto (name + short-text). Ruling record 6573569376 (letter A, the maintainer's 「同意」 2026-11-02T09:22Z) reverses the first and widens the second. Prime Directive 13 wants the reversal recorded on the ADR.

Wanted

An amendment note directly under the D2 bullet (the amended sentence itself is not rewritten). Draft by the #29008 dev: /mnt/project-files/spec-seat2/29008-adr-0061-note.md. Its core:

Amendment note (2026-11-02, #29008, ruling record 6573569376, letter A). Field-level searchable is no longer pruned: it is honoured on the auto branch. With no object.searchableFields declared, the resolved set is the type-based auto-default plus every field marked searchable: true, of any type except secret / password / vector (SEARCH_FLAG_EXCLUDED_TYPES) and a virtual field. A declared searchableFields stays the whole set and the flag is not read there. The $searchFields ingress allow-list is the same resolution, so a flagged field is accepted as an override.

Also re-read D5 ("secret / encrypted / PII never searchable") in the same note: the hard exclusions are what keep D5 true under the flag; say so if it holds. Header: an **Amended by**: entry (ADR-0005 is the precedent shape); not on the **Status**: line.

Blocked-by: #29008 (PR #29385)

Reader who acts: an ADR-governed docs PR (GOVERNED_APPROVERS before landing).

Dedupe: searched ADR-0061 searchable amendment: only #29008 itself. New.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p3 · `domain:server` · `pm:blocked` · 2026-11-02T14:53Z

⛔ Not a claim.

Read fresh. An ADR-0061 amendment note is owed after field.searchable: true has no reader: $search skips the field and $searchFields naming it answers 400 "is not searchable" while the served schema says searchable: true #29008's ruling A. Governed Tier H, p3. Blocked-by: #29008 (PR feat(spec): a field marked searchable: true is searched when its object declares no searchableFields #29385, still open).

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: unblocked · `pm:queue` (p3 kept) · 2026-11-02T17:09Z

⛔ Not a claim.

Read fresh. Blocked-by: #29008 is closed, and PR feat(spec): a field marked searchable: true is searched when its object declares no searchableFields #29385 merged. pm:blocked → pm:queue.

Generated by Claude Code

domain:server#3 · os-warren · session_01JQwxbYyp6wSRcywGFK2L4A

Claim: PM loop · card thread · 2026-11-03T03:14Z
Session: session_01JQwxbYyp6wSRcywGFK2L4A (the seat); the card thread is session_01JQwxbY1n95XjHLy7atRLWP
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-namumk (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#3
File surface: docs/adr/0061-record-search-architecture.md (an amendment note under D2, the D5 re-read, and an **Amended by**: header entry; stop on breach)
Container & model: S, mode:thread, model: CONTRACT_REVIEW_TIER (MANDATORY row docs/adr/**), effort: xhigh, reason: 常设档位令 Warren 2026-11-03T03:05Z, thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8J4b6HtE1woV1vFhHdSyVJE (skills card #29741)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6583344924
Premise: holds (on origin/main c76c0e04, ADR-0061 D2 still says field-level searchable stays pruned, while #29008 ruling record 6573569376 letter A, landed by PR #29385, honours it on the auto branch)
Source note: the drafted note the card cites (spec-seat2/29008-adr-0061-note.md) is not in project files; the dev redrafts from the ruling record and the merged resolver, citing file#symbol.
Serial constraints cleared: none touch docs/adr/0061-* in flight.
Resume-from: none — fresh from origin/main
Tier H: governed docs/adr/**; lands only after GOVERNED_APPROVERS, following in-seat CONTRACT_REVIEW_TIER review and seat ACCEPT.

State: pm:queue → pm:dispatched, assigned to os-warren. Order: project folder pm-orders/server/seat3/order-29391.md.

domain:server#3 · os-warren · session_01JQwxbY1n95XjHLy7atRLWP
os-dev-report

{
  "issue": 29391,
  "status": "done",
  "branch": "claude/project-thread-namumk",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29756",
  "session": "session_01JQwxbY1n95XjHLy7atRLWP",
  "premise_still_valid": true,
  "summary": "ADR-0061 now records ruling record 6573569376 (letter A, landed by PR #29385 at 29c70cac): one file, docs/adr/0061-record-search-architecture.md, +26/-0. An indented amendment note sits directly under the last D2 bullet (the amended sentence 'Field-level searchable stays pruned' is left as written) and states, each claim read against origin/main c76c0e04: the flag is honoured on the auto-default branch; the resolved set is the type-based auto-default plus every field marked searchable: true except SEARCH_FLAG_EXCLUDED_TYPES (secret, password, vector) and a virtual formula field; the flag is asked before the auto-default's own name/hidden/type exclusions (search-fields.ts#admittedBySearchableFlag); a declared searchableFields is the whole set and the flag is not read there (#resolveSearchFieldResolution); the $searchFields ingress allow-list is the same resolution (protocol-query-validation.ts#assertSearchFieldsAreSearchable), so a flagged field is accepted as an override and a flagged hard-excluded type is still refused 400 INVALID_FIELD; false removes nothing. The note gives the reconciled reading of the Default-behaviour field-resolution row (auto arm widened; row left as written, with a one-line pointer under the table) and the D5 re-read: the hard exclusions keep 'Secret / encrypted / PII fields are never searchable' true, since SEARCH_FLAG_EXCLUDED_TYPES covers every masked-on-read credential type (masked-field-types.ts#MASKED_ON_READ_FIELD_TYPES: secret, password; encrypted is not a FieldType), the resolver reads no PII marker before or after, and the flag changes which fields resolve, not how a search executes. Header: an **Amended by**: entry between Builds on and Consumers (ADR-0005 shape); the Status line is untouched, so docs/adr/README.md does not move. Nothing new is decided; the drafted note the card cites was absent from project files, so the note was redrafted from the ruling record and the merged resolver as ordered.",
  "tests": "n/a — docs-only edit under docs/adr/**; no package touched, so no package test or typecheck is owed and nothing publishes (fast lane, skip-changeset declared at pr_create). Every claim in the note was read against the merged code: packages/spec/src/data/search-fields.ts (SEARCH_FLAG_EXCLUDED_TYPES, admittedBySearchableFlag, autoDefaultFields, resolveSearchFieldResolution, resolveSearchFields), its test file's describes 'field.searchable: true joins the auto-default set — never a declared one' and 'SEARCH_FLAG_EXCLUDED_TYPES — the opt-in's hard exclusions', packages/metadata-protocol/src/protocol-query-validation.ts#assertSearchFieldsAreSearchable (the hard-excluded wording 'never scans even when marked searchable: true'), packages/spec/src/data/masked-field-types.ts (keys secret, password), packages/spec/src/data/field.zod.ts (the searchable describe; 'encrypted' absent from the FieldType enum). The landing sha 29c70cac is on main: REST compare main...29c70cac answers status behind, behind_by 142 (the shallow clone lacks the object).",
  "gates": "Local subset, tree 4d9ec80e, merge base c76c0e04: node scripts/pm/dispatch-gates.mjs --commands derived 21 commands (13 by path, 8 whole-tree); all 21 run from a runner writing CMD :: exit N lines, every exit 0 (captured before any pipe): check-adr-links (+ --self-test), check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, plan-test-core-shards --self-test, lint check:doc-formula-expressions (25 record-scoped examples clean), check:adr-anchors, check:adr-index (README current), check:adr-symbol-anchors (3049 anchors across 149 records resolve; 5 new declaration anchors from this note), check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal. --ran reconciliation: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. Prerequisite build for check:doc-formula-expressions: pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under os-verify-lock, VERDICT command-exit 0, held 90 s, waited 0 s. NOT MEASURED locally and CI-owned: the type-check lanes, the ci.yml Plan Test Core shards step, the 11 whole-root families and the artifact roster — read them from PR #29756's check-runs. CI status at report time: in_progress (not waited on, per the dispatch contract).",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — no GitHub MCP tool was called, read or write",
  "api_writes": "0 direct REST writes. Two relay writes: pr_create via scripts/pm/fleet-write/dispatch.mjs (run 41572768087, read-back identical 9544 bytes, objectstack-ai/objectstack#29756) and this comment via scripts/pm/post-stamped.mjs. One git push (not a REST write). REST reads via curl, nine: issues/29391, issues/29391/comments, issues/comments/6573569376, pulls/29385, pulls/29385/files, issues/comments/6594523070, compare/main...29c70cac, pulls/29730 (body shape reference), pulls/29756 (read-back).",
  "open_questions": [],
  "deviations": "(1) A one-line blockquote pointer under the Default behaviour table, in addition to the one note under D2, so a table reader is not left with the stale auto arm; the row is not rewritten — strike it if one note is preferred. (2) The one commit is authored objectstack-fleet[bot] with the model-free trailer pair; the harness's own attribution reminder names a model in its Co-Authored-By line, which the pre-push hook refuses, so the AGENTS.md form was used (reported, not amended: the branch is not a claude/issue-* branch, so no force-push). (3) The PR body folds the repository PR template's headings (What changes / Why / Verification / Human Minimum) into the os-dev section order, the standing exception. (4) The dev requested no reviewers; the relay's pr_create summons nobody. (5) Worktree node_modules removed and the worktree detached after this report, per the os-dev cleanup rule.",
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: none (read-only inference, not a card) · the D2 'Resolution order' bullet lists the short-text set as text/email/phone/url while SEARCHABLE_TEXTUAL_TYPES today also carries autonumber, textarea, markdown and SEARCHABLE_ENUM_TYPES carries select; the amendment note says 'type-based auto-default' without enumerating, so it stays true · evidence: packages/spec/src/data/search-fields.ts on c76c0e04 · dedupe words: ADR-0061 auto-default textarea markdown select · carrier: none",
    "class: none (read-only inference, not a card) · D5's word 'PII' names no FieldSchema marker and the resolver reads none, before or after the ruling; D5's parenthetical names type exclusion, which holds · evidence: grep pii over packages/spec/src/data field.zod.ts and search-fields.ts, zero hits · dedupe words: ADR-0061 D5 PII searchable · carrier: none"
  ]
}

domain:server#3 · os-warren · session_01JQwxbYyp6wSRcywGFK2L4A

Landed · 2026-11-03T04:24Z

Probe	Reading
PR #29756	MERGED at 2026-11-03T04:24Z by the merge queue, enqueued by approver os-zhuang (Tier H human merge = the review record); merge commit `2c91a55fc46c19979aba499fbdeea2022d784f35`
`origin/main`	`docs/adr/0061-record-search-architecture.md` carries the D2 amendment note (anchor `engine.ts#expandSearchOnAst` present)

State: closed by Fixes #29391 (completed); pm:dispatched removed; needs-user-decision cleared from the PR. Delivered: ADR-0061 records ruling 6573569376 letter A (field-level searchable honoured on the auto branch), the D5 re-read and an **Amended by**: entry. Nothing left on this card.

Navigation Menu

Repository navigation

docs(adr-0061): record that field-level searchable is honoured on the auto branch (D2 says it stays pruned; ruling 6573569376 letter A reversed it in #29008) #29391

What is false after #29385 lands

Wanted

Triage: p3 · `domain:server` · `pm:blocked` · 2026-11-02T14:53Z

Triage: unblocked · `pm:queue` (p3 kept) · 2026-11-02T17:09Z

Landed · 2026-11-03T04:24Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr-0061): record that field-level searchable is honoured on the auto branch (D2 says it stays pruned; ruling 6573569376 letter A reversed it in #29008) #29391

Description

What is false after #29385 lands

Wanted

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p3 · domain:server · pm:blocked · 2026-11-02T14:53Z

objectstack-fleet commented on Nov 2, 2026

Triage: unblocked · pm:queue (p3 kept) · 2026-11-02T17:09Z

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

Landed · 2026-11-03T04:24Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p3 · `domain:server` · `pm:blocked` · 2026-11-02T14:53Z

Triage: unblocked · `pm:queue` (p3 kept) · 2026-11-02T17:09Z