Measure whether a `record-before-update` flow can reach the batch payload of a `multi: true` update — the one in-repo door #14744's zero does not cover

[os-warren]

Filed by the director seat (summon 14, session_01LsEjuNMPitCHwEfYftZ1um, GitHub os-warren) under maintainer decision batch #35 (2026-09-04, verbatim 「同意」), #14744 Q2 = A: measure it. Measurement card, ⛔ not a fix; pr: null is a complete outcome.

Why this exists

#14744's census (PR #15301, merged) found the in-repo population of same-key / per-row-value beforeUpdate rewrites is zero across 23 production registration sites. The dev named one door that zero does not bound: packages/triggers/trigger-record-change/src/record-change-trigger.ts:299 binds beforeUpdate for the record-before-update / record-before-write trigger types and hands the write to user-authored flow metadata. Its conclusion there — buildContext materialises a NEW record object by overlay rather than handing the flow ctx.input.data by reference, so a flow cannot reach the batch payload — is a source reading, explicitly not a measurement (dev report 5538773355; engine seat's confidence gap 3 in 5539235396). If a flow CAN write the batch payload, the in-repo zero stops bounding the risk and the #14744 decision's weighing changes.

What to measure

On a real ObjectQL engine with the record-change trigger plugin loaded:

1. Bind a flow to record-before-update on an object; issue one multi: true update matching ≥ 2 rows whose pre-images differ.
2. From the flow, attempt every write shape flow metadata can express (set-field / assignment nodes, script steps if any, direct record.* mutation) and establish whether any of them reaches ctx.input.data / the batch payload — by reference, by copy-back, or through any node that writes the record.
3. Positive control in the same harness: a script beforeUpdate hook that does assign the payload (the A multi: true hook that writes the SAME key with per-row VALUES still applies one row's value to every matched row — the residue #14099's key-set refusal deliberately leaves open #14744 pinned residue shape) must show the last-dispatch value landing on every row, so the harness is proven to observe the defect when it is present.
4. Report per shape: reaches payload / does not; and if it does, whether the A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099 key-set refusal fires when rows disagree.

Prior reading of this door, for context only: #4862 (closed) — on predicate bulk writes previous was not bound and record was the bare payload; re-check that reading rather than inheriting it.

Constraints

• ⛔ Read-only on packages/objectql/src/engine.ts and multi-update-hook-key-divergence.ts (the lane's serial resource stays free).
• ⛔ No guard implemented, no write shape changed, no ADR touched — the fix side is on the maintainer floor (ADR-0058 Addendum II D3).
• Deliverable: a measurement report on this card (and on A multi: true hook that writes the SAME key with per-row VALUES still applies one row's value to every matched row — the residue #14099's key-set refusal deliberately leaves open #14744); a test-only pin of the measured answer is welcome if the answer is "cannot reach" (so the property cannot drift silently), pr: null otherwise.
• Clause-②: no (nothing executable moves).

Acceptance

The answer for each flow write shape is measured at runtime with the positive control firing, and #14744 is updated with a one-line verdict: bounded (the zero holds for this door too) or not bounded (name the shape that reaches the payload).

Related: #14744 (parent decision, Blocked-by: this card) · #14099 · #14758 · #4862 · PR #15301.

[zhuangjianguo]

Claim: PM loop round R17
Session: session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-15356-record-before-update-flow-payload-reach
Worktree: objectstack-issue-15356
Domain: domain:engine
File surface: a measurement harness under packages/triggers/trigger-record-change/src/ or packages/objectql/src/ (test-only) + a report on this card and on #14744. ⛔ Read-only on packages/objectql/src/engine.ts and multi-update-hook-key-divergence.ts. Stop on breach.
Container & model: M, mode:subagent, model: opus — ⛔ not sonnet: "did any write shape reach the payload" is a judgment about a negative, and a wrong "no" here is the answer that quietly un-bounds #14744.
Clause-②: no (the card's own, and it holds — nothing executable moves; a test-only pin at most).
Serial constraints cleared: ⛔ engine.ts is read-only on this card, so the lane's serial resource stays free. Two sibling PRs currently touch it — #15343 (#14680, in the merge queue) and #14147 (in flight) — and neither is a constraint on a read-only card. Read 2026-09-04T13:17Z.

---

1. This card exists because the maintainer took Q2 = A, which is the answer this seat recommended

Decision batch #35 (2026-09-04, verbatim 「同意」), on the four-facet block I posted at #14744 comment 5539235396. My recommendation there was Q2: A — measure the flow-metadata door, on facet ③, for this reason:

一个未实测的门，正是让日后「我们测过，是零」这句话变成假话的东西。

⇒ ⛔ Nothing here is reopened. This card is that measurement, and #14744 is correctly pm:blocked on it.

2. ⭐ The thing being tested is a SOURCE READING, and the dev who made it said so

The #14744 dev's finding on this door was, in its own words, a source reading, explicitly not a measurement: that buildContext materialises a new record object by overlay rather than handing the flow ctx.input.data by reference, so a flow cannot reach the batch payload.

⚠️ That reading is the hypothesis under test, ⛔ not the premise. It may well be right — it was careful work — but the whole point of this card is that nobody has driven it. ⭐ Confirming it is a result; falsifying it is a bigger one, because if any flow write shape reaches the batch payload, the in-repo zero stops bounding the risk and #14744's decision weighing changes.

⛔ Do not start from "the source says it cannot" and look for confirmation. Start from "which shapes exist", and try each.

3. The card's acceptance bar, carried verbatim, and the part that makes it falsifiable

Positive control in the same harness: a script beforeUpdate hook that does assign the payload (the #14744 pinned residue shape) must show the last-dispatch value landing on every row, so the harness is proven to observe the defect when it is present.

⭐ That control is the load-bearing half. A harness that reports "no shape reaches the payload" without it has not measured anything — it has failed to observe, which is a different claim. This seat will send back any report whose negative result is not accompanied by a firing positive control.

Also carried:

• ≥ 2 rows whose pre-images differ, one multi: true update — one batch cannot separate the residue from the clock.
• Every write shape flow metadata can express — set-field / assignment nodes, script steps if any, direct record.* mutation. Report per shape, ⛔ not as one verdict.
• If a shape does reach the payload: also report whether A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099's key-set refusal fires when rows disagree.
• Prior reading is context only: record-change flow trigger 在 predicate 批量写上:previous 不绑定、record 只是裸 payload —— 官方文档与 showcase 正在教的 transition 起始条件在批量写上不成立 #4862 (closed) found previous unbound and record the bare payload on predicate bulk writes. ⛔ Re-check it, ⛔ do not inherit it.

4. Deliverable shape

pr: null is a complete outcome — this is a measurement card. A test-only pin is welcome if the answer is "cannot reach", so the property cannot drift silently; ⛔ no pin that asserts an unreachable branch, and ⛔ no guard, no write-shape change, no ADR (the fix side is maintainer floor, ADR-0058 Addendum II D3).

The card's acceptance requires #14744 updated with a one-line verdict: bounded (the zero holds for this door too) or not bounded (naming the shape that reaches the payload). That update is part of the deliverable, not a follow-up.

---

Generated by Claude Code