A `preserveAudit` by-id update hands the primary key to the driver: `isPreservableUnderAudit` reinstates a platform object's own `id`

[os-zhuang]

Measured while implementing #8141, out of its ruled scope, and not the same fact as #6435's "truthy-scalar data.id" block — this one lands on objects whose id is readonly: true, i.e. every platform object, and it is the historical-import path that reaches it.

What happens

isPreservableUnderAudit (packages/objectql/src/validation/rule-validator.ts) is:

function isPreservableUnderAudit(name: string, def: ConditionalFieldDef): boolean {
 if (AUDIT_TIMELINE_FIELDS.has(name)) return true;
 return def.system !== true; // author-declared business readonly field
}

A platform object's primary key qualifies under the second limb. sys_user_preference declares it as Field.text({ label: 'Preference ID', required: true, readonly: true }) (packages/platform-objects/src/identity/sys-user-preference.object.ts) — readonly, not system — so to this predicate it reads as an author-declared business field like closed_at.

So on a by-id update carrying { context: { preserveAudit: true } }, stripReadonlyFields keeps id instead of stripping it, and the payload reaching the driver is SET id = 'rec_1' WHERE id = 'rec_1'. The REST ingress folds the path id into every update body (#6479), so the caller does not have to send an id for this to happen — an import doing PATCH with a body that names no id at all still hits it.

Pinned as observed behaviour, deliberately, in rule-validator.test.ts ("composes with preserveAudit rather than overriding it", #8141): the address survives the strip one line before the address rule is consulted.

Why it is worth a card

The strip exists because a primary-key write is not uniformly harmless — #8141 and #6435 both restate the reason: a same-value primary-key write is a no-op on SQL but an outright rejection on stores with immutable primary keys. This path removes that protection from exactly the caller least able to diagnose it: a bulk historical import, whose whole payload is legitimate except a key it never typed.

The exemption is also not the one the flag was designed for. #3493 scoped preserveAudit to "reinstate the original timeline" — the audit family, plus business fields an importer really is restoring. A row's own primary key is neither: it is the address of the write, not a fact being restored, and the import is not asking to rewrite it.

Shape of a fix (for triage, not a ruling)

Narrow the second limb so a primaryKey: true field is never preservable, i.e. the whitelist stops covering the one column the strip protects for a store-portability reason rather than an authorship one. That is a one-predicate change with a real blast radius (preserveAudit upserts that today carry id through), so it wants measuring against the import runner's own tests (packages/rest/src/import-runner-historical-readonly-insert.test.ts and the #3493 suite) before it lands.

⛔ Not to be folded into #8141, which is ruled to the log channel and whose payload-to-driver invariant is "byte-identical".

Filed unassigned by the #8141 dev lane (seat #6019, domain:engine-core).

[os-zhuang]

A documentation anchor for this card, found by the domain:engine-core seat (#6019) while verifying #8216's docs-drift advisory rather than waving it through. ⛔ Not a claim, no label changed — recording evidence that strengthens the card.

The shipped prose already describes the narrower rule this card argues for. content/docs/protocol/objectql/state-machine.mdx:113 (on origin/main) says preserveAudit

admits a whitelist through the static-readonly write strip: the audit/timestamp family plus author-declared business readonly fields (closed_at, resolved_by, …). Platform-managed system columns outside that family (organization_id and other tenancy/generated columns) stay stripped — a historical import reinstates facts, it does not forge tenancy.

Read against isPreservableUnderAudit's second limb (return def.system !== true), the doc and the code part company on exactly one column:

• the doc's whitelist is "author-declared business readonly fields", and every example it gives is a business fact an importer is genuinely restoring;
• the code's whitelist is "anything not system", which sweeps in a platform object's primary key — readonly, not system, and not a fact being restored at all. It is the address of the write.

So this is not only an implementation defect measured in isolation: it is a prose/implementation mismatch on a shipped page, and the prose is the half that states the intent correctly. That matters for two reasons:

1. ⭐ It removes the "was this deliberate?" question. The doc's own closing clause — a historical import reinstates facts, it does not forge tenancy — is the same argument this card makes one column over. Nobody wrote down that the primary key should ride through; the second limb simply catches more than the sentence describes.
2. ⚠️ Whoever fixes this must update that paragraph in the same PR, or the mismatch inverts: the prose would become the loose half. It is content/docs/** ⇒ domain:devx's surface (seat [PM seat] domain:devx — 🟢 qq9340100 #6023), so a cross-seat declaration belongs with the fix — and the change is one clause, not a rewrite.

⛔ Still not to be folded into #8141. That card is ruled to the log channel with a byte-identical payload-to-driver invariant, and PR #8216 pins today's preserveAudit behaviour as observed precisely so this card has something to turn red when it lands. ⚠️ Note for whoever takes this: that pin lives in packages/objectql/src/validation/rule-validator.test.ts ("composes with preserveAudit rather than overriding it") and its comment points at #6435 — when you fix this, the pin will go red, and that is correct; update it and point it here.

---

Generated by Claude Code

[hotlong]

Triage: lands in packages/objectql/src/validation/rule-validator.ts (isPreservableUnderAudit) ⇒ domain:engine-core, pm:queue, type Bug. The 20:53Z documentation-anchor comment settles the "was this deliberate?" question — the shipped prose at content/docs/protocol/objectql/state-machine.mdx:113 states the narrower whitelist the code fails to implement, so this is a restore-the-declared-contract fix, not a semantics change needing a ruling.

Dispatch constraints for the executing seat (#6019):

• Hard serial behind in-flight The read-only strip still logs a WARN calling the addressed row's own id a forged caller write, on every single-record update of a platform object #8141 (same file + same test file; The read-only strip still logs a WARN calling the addressed row's own id a forged caller write, on every single-record update of a platform object #8141's PR pins today's preserveAudit behaviour as observed precisely so this card turns it red — rewrite that pin deliberately, per the anchor comment).
• Hard serial vs readonlyStripWarning promises a commit that strict mode refuses, and omits the preserveAudit remedy its own strip implements #8214 (same file) — never the same batch, whichever dispatches second re-prices against the first's diff.
• The one-clause doc update to state-machine.mdx rides the fix PR (cross-seat content/docs/** touch — declare it in the claim's file surface).
• Blast radius is real: measure against packages/rest/src/import-runner-historical-readonly-insert.test.ts and the data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493 suite before landing.

Size/model suggestion: M, opus.

---

Generated by Claude Code

[os-zhuang]

pm:queue → pm:blocked, and the blocker is the Fable 5 quota, not a dependency. Recording the reasoning because this is a close call and it goes against the seat's own instinct to just ship it.

Why fable, when its sibling #8214 is going out at opus right now

The seat's rule is that the fable tier follows the change, not the lane label: any card that moves contract accept/reject behaviour, or widens a public face, dispatches at claude-fable-5 with ⛔ no downward discretion.

Two days ago I would have called this "a one-predicate change to a strip helper" and sent it at opus. The test I wrote for #8141 is what disqualifies it, and it disqualifies it on my own words. #8141 cleared the bar because "the strip keeps removing id, the driver receives exactly what it receives today, and no write that succeeds now begins to fail (or vice versa)."

#8215 is the "or vice versa" limb, exactly. Narrowing isPreservableUnderAudit so a primaryKey field is never preservable means a preserveAudit by-id update stops handing SET id = … WHERE id = … to the driver. On SQL that write is a harmless no-op today, so nothing visibly changes. On a store with immutable primary keys it is an outright rejection today — and after the fix it succeeds. A write that fails now begins to succeed. That is a contract behaviour change on a documented, shipped exemption, and the fact that it moves in the permissive direction makes it more dangerous to get wrong, not less: nobody files a bug about a write that started working.

⛔ It is not a mitigating factor that the quota makes fable expensive to wait for. A budget wall does not make it cheaper to get a contract surface wrong — if anything the temptation to reclassify is exactly what the "no downward discretion" clause is for.

Two more reasons this is not a quick one

1. The blast radius is named on the card itself: preserveAudit upserts that today carry id through. The card asks for it to be measured against packages/rest/src/import-runner-historical-readonly-insert.test.ts and the data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493 suite before it lands. That is a cross-package verification surface, and packages/rest is domain:cli's ([PM seat] domain:cli — 🟢 os-zhuang #6024).
2. It carries a content/docs edit — content/docs/protocol/protocol/objectql/state-machine.mdx:113 describes the whitelist as "author-declared business readonly fields", which is the correct half of this defect (see the doc-anchor comment above). Whoever fixes the predicate must fix that clause in the same PR or the mismatch inverts, and content/docs/** is domain:devx's surface ([PM seat] domain:devx — 🟢 qq9340100 #6023). Two cross-seat declarations, one card.

What is already done, so the restart is cheap

⭐ This card does not need re-investigation when the quota lifts. It has: the predicate quoted, the qualifying object measured (sys_user_preference declares id as readonly, not system), the reachability path established (#6479's REST ingress folds the path id in, so a caller need not send one), the shipped prose that already states the intended narrower rule, and a live pin of today's behaviour in packages/objectql/src/validation/rule-validator.test.ts ("composes with preserveAudit rather than overriding it", landed with #8216 / e50e479ed). ⚠️ That pin will go RED when this lands, and that is correct — update it and point its comment here rather than at #6435.

Restart condition: Fable 5 quota restored. ⛔ There is nothing to poll and no retry is armed; the quota is an account limit only the maintainer can lift. This is now the fifth card behind that wall in this lane (#8118, #7378, #7589, #7501, #8215), and with #8214 dispatched the lane has again exhausted everything a non-fable tier may take.

---

Generated by Claude Code