A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

Description

@os-warren

Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

The defect

A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

// beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

Correct per record. On a batch it stamps rows that never transitioned.

Measured

duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

Why it is worse than a cosmetic timestamp

In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

Why the application cannot fix it

  • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
  • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
  • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

Related, and possibly the same root

objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

Suggested direction

Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

Unassigned and untriaged, per the single-producer rule for domain:*.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
    }
    } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
    })();
    (function(){
    try {
    var __m = "github.com";
    var __re = new RegExp('^' + "github\\.com" + '
    
    Skip to content

    A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

    Description

    @os-warren

    Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

    The defect

    A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

    The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

    // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

    Correct per record. On a batch it stamps rows that never transitioned.

    Measured

    duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

    awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

    The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

    Why it is worse than a cosmetic timestamp

    In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

    Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

    Why the application cannot fix it

    • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
    • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
    • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

    Related, and possibly the same root

    objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

    Suggested direction

    Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

    Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

    Unassigned and untriaged, per the single-producer rule for domain:*.

    Metadata

    Metadata

    Assignees

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
      Skip to content

      A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

      Description

      @os-warren

      Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

      The defect

      A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

      The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

      // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

      Correct per record. On a batch it stamps rows that never transitioned.

      Measured

      duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

      awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

      The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

      Why it is worse than a cosmetic timestamp

      In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

      Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

      Why the application cannot fix it

      • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
      • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
      • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

      Related, and possibly the same root

      objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

      Suggested direction

      Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

      Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

      Unassigned and untriaged, per the single-producer rule for domain:*.

      Metadata

      Metadata

      Assignees

      Type

      No type

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions

        , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
        Skip to content

        A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

        Description

        @os-warren

        Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

        The defect

        A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

        The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

        // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

        Correct per record. On a batch it stamps rows that never transitioned.

        Measured

        duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

        awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

        The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

        Why it is worse than a cosmetic timestamp

        In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

        Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

        Why the application cannot fix it

        • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
        • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
        • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

        Related, and possibly the same root

        objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

        Suggested direction

        Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

        Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

        Unassigned and untriaged, per the single-producer rule for domain:*.

        Metadata

        Metadata

        Assignees

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
          Skip to content

          A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

          Description

          @os-warren

          Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

          The defect

          A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

          The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

          // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

          Correct per record. On a batch it stamps rows that never transitioned.

          Measured

          duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

          awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

          The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

          Why it is worse than a cosmetic timestamp

          In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

          Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

          Why the application cannot fix it

          • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
          • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
          • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

          Related, and possibly the same root

          objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

          Suggested direction

          Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

          Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

          Unassigned and untriaged, per the single-producer rule for domain:*.

          Metadata

          Metadata

          Assignees

          Type

          No type

          Projects

          No projects

            Milestone

            No milestone

            Relationships

            None yet

            Development

            No branches or pull requests

            Issue actions

            , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
            Skip to content

            A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

            Description

            @os-warren

            Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

            The defect

            A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

            The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

            // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

            Correct per record. On a batch it stamps rows that never transitioned.

            Measured

            duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

            awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

            The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

            Why it is worse than a cosmetic timestamp

            In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

            Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

            Why the application cannot fix it

            • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
            • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
            • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

            Related, and possibly the same root

            objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

            Suggested direction

            Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

            Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

            Unassigned and untriaged, per the single-producer rule for domain:*.

            Metadata

            Metadata

            Assignees

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

              Description

              @os-warren

              Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

              The defect

              A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

              The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

              // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

              Correct per record. On a batch it stamps rows that never transitioned.

              Measured

              duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

              awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

              The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

              Why it is worse than a cosmetic timestamp

              In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

              Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

              Why the application cannot fix it

              • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
              • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
              • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

              Related, and possibly the same root

              objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

              Suggested direction

              Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

              Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

              Unassigned and untriaged, per the single-producer rule for domain:*.

              Metadata

              Metadata

              Assignees

              Type

              No type

              Projects

              No projects

                Milestone

                No milestone

                Relationships

                None yet

                Development

                No branches or pull requests

                Issue actions

                , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                Skip to content

                A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099

                Description

                @os-warren

                Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because no application can fix it.

                The defect

                A beforeUpdate hook is documented and used as a per-record seam. On a multi: true update it is not one: driver.updateMany takes a single SET clause, so whatever the hook writes into the payload for one row is applied to every matched row.

                The common shape this breaks is the transition stamp — the standard way to record "when did this reach that state":

                // beforeUpdateif(previous.status!=='done'&&next.status==='done')patch.completed_at=now;

                Correct per record. On a batch it stamps rows that never transitioned.

                Measured

                duly_task has a readonlycompleted_at stamped by a beforeUpdate hook on the transition into done. Two rows, one open and one completed earlier, updated in a single call:

                awaitdata.update('duly_task',{status: 'done'},{multi: true,where: {id: {$in: [open,alreadyDone]}},});

                The already-done row's completed_atmoved — from …:26.560Z to …:26.571Z. It did not transition. Nothing errored.

                Why it is worse than a cosmetic timestamp

                In the application that found it, completed_at is what every on-time measure reads. A task completed comfortably before its deadline, swept up in a later batch, silently acquires a completion instant that can fall past its due date — turning a compliant record into a breach in the metric, with no error, no audit entry, and nothing in the data that shows it happened. The row looks exactly like one that really was completed late.

                Any object with a state-entry timestamp has the same exposure: approved_at, closed_at, shipped_at, first_responded_at.

                Why the application cannot fix it

                • There is no per-row seam on the batch path. The hook cannot decline to write for a subset of matched rows, because there is only one payload.
                • Guarding in the caller means abandoning batch writes, which is the performance reason the path exists.
                • The only remaining mitigation is a client-side predicate excluding non-transitioning rows from the selection — and that is a UI hide, not authorization. Any direct API caller reaches the same corruption. The application's own hook docblock already says a client hide is not the authority.

                Related, and possibly the same root

                objectstack-ai/duly's #3 measured that an unscoped predicate write dispatches the hook once for the whole operation with no pre-image, so it stamps nothing at all. Combined with this report, beforeUpdate has three different contracts depending on the write path — by-id (pre-image present, per record), scoped multi (one payload, many rows), unscoped predicate (no pre-image). That divergence is worth resolving as one question rather than three.

                Suggested direction

                Either make the batch path genuinely per-record when a hook is bound to the object (splitting the SET clause, or falling back to per-row writes), or make it refuse loudly — a hook that mutates the payload on a multi update is a correctness hazard the engine can detect and reject at dispatch, which is far better than applying it. Silently applying one row's derived value to N rows is the one option that cannot be reasoned about from the application side.

                Application-side tracking: objectstack-ai/duly#39, which pins the behaviour in both directions.

                Unassigned and untriaged, per the single-producer rule for domain:*.

                Metadata

                Metadata

                Assignees

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions