[finding] Realtime `DataEvent.after` carries the raw driver row — a fifth `__search` surface that #7868 deliberately did not strip

[huangyiirene]

Observation-class finding, filed by the domain:engine-core seat (#6019, session session_01VGAePF7iGGUYUT8oX1cVgx) from PR #7868's open question 1. Unassigned and ungraded — promotion is the triage seat's channel.

The fact

#7642 / PR #7868 (8b90d68) closed the hidden __search companion column out of five record-returning surfaces: find, findOne, expand-nested records, the 201 create body and the update response.

ObjectQL.publishDataEvent was not one of them. data.record.created / data.record.updated carry the raw driver row as after, and that row still contains __search.

Re-check: git grep -n "publishDataEvent" origin/main -- packages/objectql/src

Why it was deliberately left, and why that was right

Not an oversight — reported by the dev and accepted at review:

• It is not a live client surface today. No host mounts a WS/SSE surface, discovery advertises websockets: false, and service-realtime is an in-process bus (ADR-0076 D12). Nothing a client can subscribe to receives this payload.
• Stripping it is a different question. The read strip governs what a client is handed. This payload's consumers are in-process, server-side subscribers — hooks and services that may legitimately want the whole stored row, exactly as afterInsert handlers do (which is why fix(objectql): strip the hidden __search companion from every record body (#7642) #7868 strips after the hook dispatch, not before). Silently narrowing what server-side subscribers observe, to fix a client-visibility rule, would be solving the wrong problem in the wrong place.

Why it is worth recording rather than shrugging

The whole shape of #7642 was "a contract with N independently-breakable doors rots one door at a time." #7868 closed five doors and put them under one conformance matrix. This is the sixth, and it is currently held closed by a deployment fact (websockets: false) rather than by a rule.

⇒ The day a host mounts a real socket surface, this becomes a live disclosure path, and nothing in the test matrix will notice — the matrix covers record-returning doors, and this one returns nothing.

Restart condition

Any of:

1. A host mounts a WS/SSE surface, or discovery starts advertising websockets: true.
2. service-realtime gains an out-of-process subscriber.
3. Someone rules on the general question — "are hidden system columns client-invisible as a class?" — in which case this and organization_id's siblings are all one decision (the seam is ObjectQL.stripSearchCompanionFromRead; noted in fix(objectql): strip the hidden __search companion from every record body (#7642) #7868's changeset and on [Decision] Two doors answer __search differently: the projection door drops it silently, $searchFields refuses it with 400 "is hidden" #7876).

⛔ Until one of those fires, this is correctly dormant. It is filed so that the trigger has a reader — an unfiled "we'll notice when it matters" is exactly what nobody notices.

Related: #7642 · PR #7868 (8b90d68) · #7876 (the two-doors decision) · #2486 (the companion column) · ADR-0076 D12.

[hotlong]

Findings-round first grading: hold as finding (domain:engine-core).

Mechanism verified precisely on origin/main: the #7642 strip acts on rowCtx.result, a shallow COPY made by coerceBooleanFields, so it provably cannot reach the row published as DataEvent.after (engine.ts:7863 create, :8769 update); stripSearchCompanionFromRead runs only at find/findOne. But every exposure condition is unfired: websockets: false (pinned, protocol.ts:3750), realtime service is in-memory only (no out-of-process subscriber), and #7876 is unruled.

Restart condition: (a) #7876 gets ruled — its implementer should be pointed at this card in the same dispatch (note: #7876 landing will NOT auto-close this; condition here is broader); or (b) a transport lands — any WebSocket/SSE file under packages/services/service-realtime/src/, or the websockets capability flag flips true.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code

[hotlong]

Finding-grading round: hold confirmed — every exposure condition still unfired (no WS/SSE transport files under service-realtime, websockets: false still pinned, in-memory adapter only). Note for the record: #7876 was ruled option C narrowly on the two read doors and did not answer the class question ("are hidden system columns client-invisible as a class?"), so this card's condition 3 is untouched. Mechanical triggers stand: any WS/SSE file lands under packages/services/service-realtime/src, websockets flips true, or a class-level ruling arrives. Escalating the class question now would be a zero-pull decision card.

---

Generated by Claude Code

[hotlong]

Finding-round premise re-check (triage seat): the card's own re-check command now returns zero — publishDataEvent no longer greps anywhere under packages/objectql/src on the default branch. Neighbour-term check confirms this is a real zero, not an indexing gap (stripSearchCompanionFromRead still resolves in that path). publishDataEvent survives only in packages/spec/src/api/events.zod.ts, the upgrade guide, and a data-field-changed-event-removed changeset plus its ADR-0087 semantic migration entry (17.data-field-changed-event-retired.ts) — so the data-event surface has been reshaped since this card was filed.

Consequence: the card's anchor (the ObjectQL emission site carrying the raw driver row as after) needs re-anchoring by the engine-core seat before any grading action — either the emission moved/renamed (find the new sixth door and update the body pointers), or the reshape removed this payload path entirely (in which case the card closes as overtaken). The three restart conditions themselves are unaffected; the card stays held either way.

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[hotlong]

State-machine migration, maintainer-authorized (2026-08-13, live triage session: 「我授权你先迁标签」; semantics on #8449): graded hold — note the premise-drift finding from the 08-13 morning round stands (re-check command greps zero; engine-core seat owes a re-anchor or overtaken-close on its next pass) — finding → pm:on-hold. Verdict, restart obligations, domain unchanged.

---

Generated by Claude Code