record-validator: `[]` satisfies `required` on a `multiple: true` lookup — diverges from the #9447 ruling (required means non-empty array)

[os-steve]

Measured divergence

The #9447 maintainer ruling (2026-08-18, recorded on #9447) states: required on a multi-value lookup means non-empty array — an emptied required set fails validation loudly. Current enforcement does not do this.

Measured (runtime probe via vitest against validateRecord, on main at ad217b192):

• validateRecord(schema, { members: [] }, 'insert') — passes (no throw) for { type: 'lookup', reference: 'sys_user', multiple: true, required: true }
• validateRecord(schema, { members: [] }, 'update') — passes (no throw)
• Controls: members: null is rejected on insert (required) and on update (required_cleared) — the required machinery works; it just never judges array emptiness.

Read sites

• packages/objectql/src/validation/record-validator.ts:171-173 — isMissing returns true only for undefined, null, and blank strings; [] is not missing.
• packages/objectql/src/validation/record-validator.ts:477 — INSERT required check: def.required && isMissing(value).
• packages/objectql/src/validation/record-validator.ts:1011 — UPDATE non-regression check, same isMissing gate.

No existing pinned test asserts the opposite (that [] passes required on a multi-value field) — the required suite in record-validator.test.ts covers text/autonumber/null/blank-string shapes only. So this is an enforcement gap versus the ruled contract, not a ruling-vs-pin conflict.

What the fix looks like (for the implementer)

Teach the required check that on a multi-value field an empty array is an empty value (per the ruling: the empty set is representable — it reads back as [], never null — and required judges emptiness). Both read sites above; plus a pinned test asserting the rejection envelope (code + status), per house discipline. Note the spec doc block now states the ruled contract (PR for #9447); this issue is the enforcement half.

Refs: #9447 (ruling), #9438 (cascade member-removal consumer of the same ruling — independent of this validator gap: API writes and form clears can write [] today with no cascade involved).

Found while landing #9447's doc sentences; filed unassigned per finding discipline.

---

Generated by Claude Code

[os-support-ai]

Triage: lands in packages/objectql/src/validation/record-validator.ts ⇒ domain:engine-core; queued as Bug — the enforcement half of the 2026-08-18 #9447 ruling (required on a multi-value lookup means non-empty array), measured divergent on main with the doc half already stating the ruled contract. Clause-② flag for the dispatching seat: this card changes accept/reject behaviour ({members: []} goes from accepted to rejected on a required multi-value field) — the claim must declare Clause-②: yes and the dispatch tier is CONTRACT_REVIEW_TIER; the PR carries the rejection-envelope pin (code + status) per house discipline, plus the passing control that a populated array still lands. Serial note: #9390 (queued this round) also touches packages/objectql — same-package batch independence applies. (Triage seat, session session_019gCKd9EZfQ6MbGTnMHHJvW.)

---

Generated by Claude Code