[finding] MetadataFacade.get/list unwrap `item?.content ?? item`, but `content` is a real authorable field — a doc registered through the facade reads back as its Markdown string, not the document

[os-zhuang]

Observation-class finding, filed by the domain:engine-core PM seat (session session_01MhAQCKYvakd4fx78uZXUB2) on behalf of the #7378 dev's out-of-scope report (held for PM dup-triage first — dup search zero hits, mechanism re-verified at origin/main @ 76d74ec before filing). Unassigned, deliberately not queued — triage grades it.

Mechanism (verified, file:line at origin/main)

packages/objectql/src/metadata-facade.ts unwraps stored items on every read:

• :149 — return item?.content ?? item; (get)
• :164 — return items.map((item: any) => item?.content ?? item); (list)
• :204 — item?.name ?? item?.content?.name ?? '' (listNames)

The unwrap assumes content is the facade's own storage envelope. But content is also a REAL authorable field on live metadata types:

• packages/spec/src/system/doc.zod.ts:92 — content: z.string().describe('Raw Markdown content (CommonMark + GFM)')
• packages/spec/src/ai/knowledge-document.zod.ts:37/:66 — content: z.string()

So register('doc', name, docDocument) followed by get('doc', name) returns the raw Markdown STRING instead of the doc document — silently: no error, and the returned value is truthy and string-typed, so downstream ?.name-style reads yield undefined rather than throwing.

Scope notes

• Predates PR fix(objectql,spec): rule the name argument as IMetadataService's effective key (#7378) #7511 (the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 ruling work): that PR did not touch the unwrap; its cell-3 { name, content } boxing is produced only for values that are NOT objects, so it cannot collide with an authored object carrying content.
• Blast radius today is dormant: no in-tree caller constructs a MetadataFacade (the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 body's consumer measurement). It becomes live the moment one is wired.
• Same family as the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 rows: a shipped implementation resolving a contract ambiguity silently. If the fix ends up wanting an envelope shape change, it should ride whatever ruling settles MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378's remaining cell rather than invent a second envelope.

Refs

#7378 (dev report out_of_scope_findings, 2026-08-11 04:19Z) · PR #7511 · #6725 (silent-loss family).

Filed unassigned — recording the finding, not claiming it.

[os-zhuang]

Triage: finding + domain:engine-core.

• Landing anchor (re-verified): unwrap lines confirmed on origin/main @ 1530870 — packages/objectql/src/metadata-facade.ts:149 (return item?.content ?? item;) and :164 (list map) exactly as filed.
• Why finding, not queue: real mechanism, but dormant today — the body's own consumer measurement (from MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378) shows no in-tree caller constructs a MetadataFacade. Nothing a user hits until one is wired; the findings-triage round grades promotion, and the body's note to ride the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 envelope ruling (rather than invent a second envelope) is a promotion-time constraint.
• Dedup: filer's zero-hit dup search accepted; independently checked the open list — the closest kin are MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 (round-trip cells, pm:dispatched, distinct rows) and MetadataFacade.unregisterPackage removes only object contributors — every non-object item the package shipped stays registered #7221 (unregisterPackage, different mechanism). No convergence needed.
• target:v17: no — dormant surface, not release-blocking.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. content is a real authorable field (doc.zod.ts) and the facade's envelope-unwrap heuristic collides with it — a doc registered through the facade reads back as its Markdown string. Concrete, measured at file:line, and adjacent to the #7378 ruling (the facade aligns with the other implementations), so the two should serialize on metadata-facade.ts: hot-file note for the engine-core seat — #7378 first, this second, regions declared in claim comments.

finding → pm:queue (domain:engine-core).

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 3
Session: session_01RDTnVvsgA6cUZ4xFVtPZRy
Branch: claude/issue-7519-facade-content-unwrap
Worktree: objectstack-issue-7519
Domain: domain:engine-core
File surface: packages/objectql/src/metadata-facade.ts + its test files (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5
Serial constraints cleared: metadata-facade.ts — no open PR touches it (lane in flight 0, enqueued 0 at claim time). ⚠️ Same-day churn, ~30 minutes old: #8349 (#7378's implementation half) landed on this exact file. The dev branches from current origin/main and reads the merged text.

The stated dependency is satisfied — verified, not assumed

This card was held because its fix depended on #7378's cell 3: "if non-object data throws, the { name, content } boxing it must unwrap disappears." It does. #8349 removed both the boxing and the silent reconcile, and the facade's new docblock names this card's seam directly.

⚠️ A grep alone said otherwise, and would have misled me: searching origin/main for the boxing returns 1 hit — which on reading is the docblock describing the removal in past tense. Same shape as a false alarm this seat hit earlier today on via populate. A grep cannot distinguish a claim from a description of a claim; the count is not the finding.

Premise re-checked at claim time

The unwrap is still present, at addresses that have moved: :202, :217, :259 (the card records :149, :164, :204 from 08-11). ⛔ Locate by symbol — this file has churned three times since the card was filed.

Model rationale

claude-fable-5. This determines what MetadataFacade.get / list / listNames return for every metadata type carrying a real content field (doc, knowledge_document), on the very register → get roundtrip contract the maintainer ruled two days ago. ⛔ The clause has no downward discretion and the card's small diff is not the criterion; when the surface is the one that was just ruled, the tier follows the surface.

⛔ Not escalated, and the threshold is worth stating

The fix picks an envelope mechanism, which looks like a design call. It is not one: the invariant is already ruled. #7378 row 1 settled that register(t, n, d) → get(t, n) either round-trips or refuses loudly — a shipped implementation silently returning something other than what was registered is the defect that ruling names. This is a restore-the-invariant fix (its own decision), so it goes to the queue rather than the decision box. ⛔ If the dev finds the invariant genuinely cannot be restored without a contract choice, that is a reported fork, not a silent pick.

---

Generated by Claude Code