[finding] `MongoDBDriver.update()` and `RemoteTransport.update()` fabricate a record for a missing id — a third posture that becomes a semantic violation once `IDataDriver.update()` declares `null` (#13878 ruling item 5)

[os-musk]

Filed unassigned by the #13878 dev seat (session session_0112hMx9hjJ9BgB28X97DS68), as the director's ruling on #13878 (comment 5494524403) item 5 directs — verbatim, untranslated:

⚠️ Mongo / RemoteTransport 的捏造姿态在 A 落地后成为语义违反者 —— ⛔ 不折进本卡:实施者测完「谁读它们的 update() 结果」后另立卡(行为变更,量了再裁);

Recording + measurement only — no severity asserted, no fix chosen; the posture is the maintainer's decision. Generic types are written in SQUARE brackets throughout (the body sanitizer eats the angle-bracket spelling).

The two sites (measured at 79b6a22a5)

Implementation	Where	What it does on a miss
MongoDBDriver.update()	packages/drivers/driver-mongodb/src/mongodb-driver.ts:403-424	updateOne({ id }), then findOne({ id }); when nothing comes back it returns withoutUndefinedOwnKeys({ id: String(id), ...updateData }) — a row assembled from the caller's payload plus the updated_at it stamped, for an id that names no document
RemoteTransport.update()	packages/drivers/driver-turso/src/remote-transport.ts:1517-1534	UPDATE ... WHERE "id" = ?, then SELECT * ... WHERE "id" = ?; when no row comes back it returns { id, ...data } — the caller's payload with the id stapled on

Both are declared Promise[Record[string, unknown]] and both honour that declaration by inventing data. After #13878 the contract's not-found arm is null (the shape findOne carries, what InMemoryDriver / SqlDriver / TursoDriver (local) / SqliteWasmDriver return), so "a row for an id that does not exist" is no longer a way of satisfying the declaration — it is a value the declaration now distinguishes from, and these two drivers answer "updated" where every other driver answers "not found".

Who reads their update() results — the measurement the ruling asked for

Reader	Path	What a fabricated row does there
Engine by-id dispatch	packages/objectql/src/engine.ts:11017 — result = await driver.update(object, id, data, options)	Returned to the engine's caller as the updated record. The only guard downstream is typeof result === 'object' && result && 'id' in result around an id read — a fabricated row passes it, so a REST / SDK / MCP update on a missing id answers 200 with a record that does not exist, on these two drivers only
TursoDriver.update() remote branch	packages/drivers/driver-turso/src/turso-driver.ts:778 — this.formatRemoteRow(object, await this.remoteTransport!.update(...))	Passes the fabricated row through as the driver's own result; the local branch (super.update, SqlDriver) returns null for the same miss — one driver, two postures, chosen by isRemote
RemoteTransport.bulkUpdate()	packages/drivers/driver-turso/src/remote-transport.ts:1625-1632 — if (updated) results.push(updated)	The cross-driver skip convention SqlDriver.bulkUpdate follows is dead code on this transport: updated is never falsy, so a batch over N missing ids answers N fabricated rows
In-package bulkUpdate on Mongo	none — mongodb-driver.ts has no this.update( call site	—
Tests	mongodb-driver.test.ts:157,171 · turso-driver.test.ts:138,731 · turso-remote-autonumber-refusal.test.ts:369	All read update() results over rows that EXIST; no test pins the miss posture on either driver, so changing it breaks nothing landed

What this does NOT claim

• ⛔ No fix chosen. The two candidate postures after [finding] InMemoryDriver.update() returns null for a missing id, which IDataDriver.update()'s declared return type forbids — hidden for the life of the code by an inferred any #13878 are (a) return null on a miss — the contract's declared arm and what the other four implementations do — or (b) throw. Both are behaviour changes visible to every reader above; (a) would want a per-driver pin of the same shape as driver-memory's should return null on update of missing record in default mode.
• ⛔ Nothing here was changed in [finding] InMemoryDriver.update() returns null for a missing id, which IDataDriver.update()'s declared return type forbids — hidden for the life of the code by an inferred any #13878's PR: packages/drivers/driver-mongodb/** and packages/drivers/driver-turso/** were fenced to measure-only by the dispatch.
• No claim about the upsert doors of either driver (an upsert never answers "not found" by definition).

Dedup

MCP search_issues, one targeted query (MongoDBDriver update fabricates synthesizes a record for a missing id RemoteTransport returns invented row instead of null not found) → 5 results, none on this posture: #13878 (the parent), #12586 (turso json column types), #11151 (mongo boolean aggregates), #6944 (turso remote autonumber), #5088 (updateMany hooks on a nonexistent id). Control query for #13878's own title → #13878 ranked first ⇒ the channel answers, the zero on this posture is a reading.

Related

#13878 (the ruling, item 5) · #13854 (SqlDriver.bulkUpdate, the live dependent of the null skip — the convention RemoteTransport.bulkUpdate copies but can never take)

---

Triage — the block is discharged and the premise is now present tense

#13878 closed as completed at 2026-09-02T08:28:30Z via merged PR #14434 ("declare the not-found arm on IDataDriver.update() and un-mask driver-memory's published update/upsert types"). The Blocked-by: #13878 line was therefore exhausted and has been removed from this body — verified by re-reading the card after the write.

That discharge is what makes this card urgent rather than anticipatory. The contract's | null arm is on main now, so the sentence "these two drivers answer updated where every other driver answers not found" is a description of today, not of a state after some future landing. Everything the measurement table predicts is live.

The measurement the ruling ordered — 「实施者测完『谁读它们的 update() 结果』后另立卡」 — is done and it is thorough (five readers enumerated, the dead if (updated) in RemoteTransport.bulkUpdate found, and the absence of any test pinning the miss posture established). So this card is ready for the ruling half: 「行为变更,量了再裁」 — the measuring is finished, the ruling is the maintainer's.

<!-- os-decision-facets -->

• ① 项目长远合理性(权重 ≥50%,领起推荐) —— 契约现在明写「找不到就是 null」,六个实现里四个照做,两个捏造一行数据交差。而那两个之所以捏造,靠的是「声明不允许 null,所以必须返回点什么」这个理由 —— 那个理由已经被 [finding] InMemoryDriver.update() returns null for a missing id, which IDataDriver.update()'s declared return type forbids — hidden for the life of the code by an inferred any #13878 修掉了,姿态却还留着。长远终态只有一个:一个契约一个答案。①指向姿态 (a) 返回 null,因为那是契约自己声明的那一支,也是另外四个实现的做法;(b) 抛错是第三种姿态,等于在两个答案之上再加一个。
• ② 实际业务拉动 —— 今天就在发生。[finding] InMemoryDriver.update() returns null for a missing id, which IDataDriver.update()'s declared return type forbids — hidden for the life of the code by an inferred any #13878 已合并关闭,契约的 null 支已在 main 上。此刻一个客户对着已删除的记录发 update,在 Mongo 或 Turso 远程上拿回的是 200 加一条并不存在的记录。不是「将来会怎样」。
• ③ 防 AI 犯错 —— 最响的一棱,而且坏在方向上:它在该说「没找到」的地方说了「成功」。捏造的那行还带着调用方自己传进去的字段和一个刚刚戳上的 updated_at,看起来完全合理,没有任何地方不对劲。调用方(人或 agent)据此认定写入落地了 —— 不重试、不告警、不回滚。批量更糟:RemoteTransport.bulkUpdate 里那句跨驱动的 if (updated) 跳过约定在这个传输上是死代码,N 个不存在的 id 换回 N 行假数据。
• ④ 创业阶段不扩散 —— (a) 不引入任何新概念,只是让这两个实现回到契约已经声明的那一支;(b) 抛错要新增一条错误契约、要 REST 映射、要文档、要迁移指引。对齐优于新增。

推荐:A = 姿态 (a),miss 返回 null。 四棱同向。每个驱动配一条与 driver-memory 的 should return null on update of missing record in default mode 同形的 pin —— 卡面已经量到当前没有任何测试钉住 miss 姿态,所以这是净增覆盖,不是改基线,风险面比一般行为变更小得多。
回退:B = 姿态 (b) 抛错。 若维护者认为「更新一个不存在的记录」应当是响亮失败而非安静的 null,走这条 —— 但必须同批裁定另外四个实现是否一起改,⛔ 否则就是把两种答案变成三种,而那正是本卡要消灭的东西。
置信缺口(本分析看不见什么): 没有量 Mongo 与 Turso 远程的真实部署面 —— 有多少客户在这两个驱动上跑写路径,决定 (a) 的迁移面是零还是非零。卡面量到的是仓内无测试钉住,仓外未知,而那正是「净增覆盖」这句话唯一可能不成立的地方。

Generated by Claude Code

[os-project-manager]

Maintainer ruling recorded — A: MongoDBDriver.update() and RemoteTransport.update() return null on a miss, the contract's declared not-found arm, with a per-driver pin

Director seat (objectstack #12708), summon #10, session session_01ShyhexkB2d1AeRZ85tgAAe, 2026-09-03.

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat, replying to decision batch #15 in which this card was item 1 with the recommendation A (fallback B: throw), the same recommendation triage attached. Verbatim reply: 「同意」 — A is adopted as recommended.

Ruled: A. Both implementations stop fabricating a row for an id that names no document. On a miss they return null, which is the arm IDataDriver.update() declares since #13878 (PR #14434, merged 2026-09-02) and what InMemoryDriver, SqlDriver, TursoDriver (local) and SqliteWasmDriver already return. TursoDriver.update()'s remote branch then answers the same as its local branch for the same miss, and RemoteTransport.bulkUpdate()'s if (updated) skip stops being dead code: a batch over N missing ids answers the rows that exist, not N invented ones.

Not taken: B (throw on a miss — a third posture on top of the two this card exists to collapse; would have required re-ruling the other four implementations in the same stroke).

Execution: domain:engine lane. Two drivers, each with a miss pin of the same shape as driver-memory's should return null on update of missing record in default mode, plus a pin that RemoteTransport.bulkUpdate() skips a missing id. The card measured that no landed test pins the fabricating posture, so this is net-new coverage, not a baseline change. The visible behaviour of two published drivers changes (a by-id update on a missing id answers not-found instead of 200 with a record) ⇒ Clause-② yes, needs:contract-review on the card and the PR at CONTRACT_REVIEW_TIER; @objectstack/driver-mongodb and @objectstack/driver-turso changesets. ⛔ The upsert doors of either driver are not this card's.

State transition, same stroke: needs-user-decision → pm:queue; bug, priority:p1, domain:engine retained. Ledger: objectstack director seat post #12708, summon #10.

---

Generated by Claude Code