[finding] MetadataFacade.get/list unwrap `item?.content ?? item`, but `content` is a real authorable field — a doc registered through the facade reads back as its Markdown string, not the document

[os-zhuang]

Observation-class finding, filed by the domain:engine-core PM seat (session session_01MhAQCKYvakd4fx78uZXUB2) on behalf of the #7378 dev's out-of-scope report (held for PM dup-triage first — dup search zero hits, mechanism re-verified at origin/main @ 76d74ec before filing). Unassigned, deliberately not queued — triage grades it.

Mechanism (verified, file:line at origin/main)

packages/objectql/src/metadata-facade.ts unwraps stored items on every read:

• :149 — return item?.content ?? item; (get)
• :164 — return items.map((item: any) => item?.content ?? item); (list)
• :204 — item?.name ?? item?.content?.name ?? '' (listNames)

The unwrap assumes content is the facade's own storage envelope. But content is also a REAL authorable field on live metadata types:

• packages/spec/src/system/doc.zod.ts:92 — content: z.string().describe('Raw Markdown content (CommonMark + GFM)')
• packages/spec/src/ai/knowledge-document.zod.ts:37/:66 — content: z.string()

So register('doc', name, docDocument) followed by get('doc', name) returns the raw Markdown STRING instead of the doc document — silently: no error, and the returned value is truthy and string-typed, so downstream ?.name-style reads yield undefined rather than throwing.

Scope notes

• Predates PR fix(objectql,spec): rule the name argument as IMetadataService's effective key (#7378) #7511 (the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 ruling work): that PR did not touch the unwrap; its cell-3 { name, content } boxing is produced only for values that are NOT objects, so it cannot collide with an authored object carrying content.
• Blast radius today is dormant: no in-tree caller constructs a MetadataFacade (the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 body's consumer measurement). It becomes live the moment one is wired.
• Same family as the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 rows: a shipped implementation resolving a contract ambiguity silently. If the fix ends up wanting an envelope shape change, it should ride whatever ruling settles MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378's remaining cell rather than invent a second envelope.

Refs

#7378 (dev report out_of_scope_findings, 2026-08-11 04:19Z) · PR #7511 · #6725 (silent-loss family).

Filed unassigned — recording the finding, not claiming it.

[os-zhuang]

Triage: finding + domain:engine-core.

• Landing anchor (re-verified): unwrap lines confirmed on origin/main @ 1530870 — packages/objectql/src/metadata-facade.ts:149 (return item?.content ?? item;) and :164 (list map) exactly as filed.
• Why finding, not queue: real mechanism, but dormant today — the body's own consumer measurement (from MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378) shows no in-tree caller constructs a MetadataFacade. Nothing a user hits until one is wired; the findings-triage round grades promotion, and the body's note to ride the MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 envelope ruling (rather than invent a second envelope) is a promotion-time constraint.
• Dedup: filer's zero-hit dup search accepted; independently checked the open list — the closest kin are MetadataFacade answers three register → get round-trip cases differently from every other shipped IMetadataService #7378 (round-trip cells, pm:dispatched, distinct rows) and MetadataFacade.unregisterPackage removes only object contributors — every non-object item the package shipped stays registered #7221 (unregisterPackage, different mechanism). No convergence needed.
• target:v17: no — dormant surface, not release-blocking.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. content is a real authorable field (doc.zod.ts) and the facade's envelope-unwrap heuristic collides with it — a doc registered through the facade reads back as its Markdown string. Concrete, measured at file:line, and adjacent to the #7378 ruling (the facade aligns with the other implementations), so the two should serialize on metadata-facade.ts: hot-file note for the engine-core seat — #7378 first, this second, regions declared in claim comments.

finding → pm:queue (domain:engine-core).

---

Generated by Claude Code