meta: `applySystemFields` stamps `indexed` on `organization_id` — a key `FieldSchema` rejects by name, so every registry-backed object read answers `_diagnostics: { valid: false }`

[os-zhuang]

Found while implementing #6562 (the /meta object read serving the effective runtime schema). Out of that issue's scope — the fix is at the injection site, not at the read exits — so filed here rather than folded in.

What

applySystemFields (packages/objectql/src/registry.ts) provisions organization_id with an indexed: opts.multiTenant key:

additions.organization_id = { ...TENANT_SCOPE_FIELD_DEF, indexed: opts.multiTenant };

indexed is not a FieldSchema key. It was removed in the 16.x line (#2377, ADR-0049) and FieldSchema is a strictObject, so a field definition carrying it is rejected — by name, with a purpose-written message:

Unrecognized key(s) on this field: `indexed`.
  • never a FieldSchema key; a field-level index flag built no index (#2377).
    Declare the index in the object's `indexes[]`. Until #4001 closed this shape
    these were dropped silently — the field was still created, minus whatever the
    key was meant to constrain, protect or compute.

registerObject runs applySystemFields before storing, and SchemaRegistry.getItem('object', name) serves that post-injection document. So the key travels all the way out to the /meta surface, where decorateMetadataItem re-parses the served body and stamps the verdict on it.

Measured

origin/main @ 4bb6f01af, via the real SchemaRegistry + the real ObjectStackProtocolImplementation, on a plain business object declaring one field:

--- multiTenant=true  REGISTRY-BACKED getMetaItem ---
_diagnostics: { valid: false,
  errors: [ { path: 'fields.organization_id', code: 'unrecognized_keys',
              message: 'Unrecognized key(s) on this field: `indexed`. …' } ] }
list exit _diagnostics: (identical)

--- multiTenant=false REGISTRY-BACKED getMetaItem ---
(identical — the key is present either way, only its VALUE follows the flag)

Both modes, both exits. The object itself is otherwise spec-clean: delete that one key and the same document parses green.

Why it matters

_diagnostics is what Studio renders invalid-metadata banners and inline field errors from, and what an AI author reads to decide whether a document it produced is acceptable. Here it reports a defect on every tenancy-enabled object, attributed to a field the author never wrote and cannot fix — the platform's own column failing the platform's own schema. It also makes the verdict useless as a signal on those objects: a real authoring error is indistinguishable from this one.

Direction (not a decision — for triage)

The consumer of indexed is a single line in one driver: packages/drivers/driver-mongodb/src/mongodb-schema.ts:87 (} else if (field.indexed) {). Nothing else in the repo reads it. So the plausible shapes are:

• A. Move the intent to where the schema says it belongs — declare the tenant index in the object's indexes[] and teach driver-mongodb to read that (which is what every other index in the system already does). Removes the key.
• B. Keep the DDL hint but strip it before the document leaves the registry for any metadata consumer, so the physical layer keeps it and the served/parsed document never sees it.
• C. Re-declare indexed on FieldSchema. Almost certainly wrong — [11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377 removed it precisely because a field-level flag built no index, and re-adding it would restore a declared-but-unenforced key on every field.

A is the contract-first direction; B is smaller. Either is a behaviour change in the DDL/driver lane, which is why it is not folded into #6562.

Relationship to #6562

Independent, not blocking. #6562 converges the overlay-backed /meta object read onto the registry-backed field set; it deliberately does not propagate indexed onto served documents (converging onto a key the object schema refuses would spread this defect rather than close that one), and it pins the residual divergence in both directions in packages/objectql/src/protocol-meta-effective-schema.test.ts:

expect(divergences(registryBacked, overlayBacked)).toEqual(['organization_id.indexed']);
expect(overlayBacked._diagnostics).toEqual({ valid: true });
expect(registryBacked._diagnostics.valid).toBe(false);

Whichever fix lands here flips those three lines, which is the intended tripwire — the pin exists so this cannot be quietly forgotten.

[claude]

Triage: pm:queue + domain:engine-core + target:v17.

• Concrete measured defect: applySystemFields stamps indexed (a key FieldSchema rejects by name since [11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377/ADR-0049) onto organization_id — verified live on origin/main @ 271cee1 at registry.ts:437 (indexed: opts.multiTenant); the sole consumer is one line at driver-mongodb/src/mongodb-schema.ts:87. Both tenancy modes, both /meta exits answer _diagnostics: { valid: false } per the card's measurements, so Studio's invalid-metadata surface and any AI author reading the verdict get a platform-caused false negative on every registry-backed object.
• Routing: injection site and the direction-A work (declare the tenant index in indexes[], stop stamping the key) land in packages/objectql ⇒ engine-core; the one-line driver-mongodb read is a rider-sized consumer change (drivers-lane freeze covers investment, not defect-fix touches — flag it in the dispatch prompt regardless).
• Direction: A (contract-first, matches how every other index is declared) preferred over B (strip-before-serve); C is anti-[11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377 and out. A-vs-B is dev-measurable within the fix, no maintainer fork.
• target:v17: board class ① / ④ — a shipped-surface diagnostic that reports the platform's own column as invalid on every tenancy-enabled object, and drowns real authoring errors.
• Dedup: repo-scoped search returns only this card; meta: an overlay-backed object read OMITS the injected system columns a registry-backed read includes — the same endpoint answers two different field sets #6562 (in flight) is independent by construction and pins the residual divergence as a tripwire that flips when this fix lands. Not blocked by it.
• Stale-premise: all anchors re-verified @ 271cee1 (card measured @ 4bb6f01af).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 3 (engine-core seat #6019, batch:1 — maintainer 17:3xZ instruction; this is the single card in flight)
Session: session_01MwoubC3jL271FYt9rGXwxb
Branch: claude/issue-6810-organization-id-indexed-key
Worktree: cloud session's own clone (mode:cloud)
Domain: domain:engine-core
File surface: packages/objectql/src/registry.ts (applySystemFields injection site + the tenant index declaration), packages/drivers/driver-mongodb/src/mongodb-schema.ts (the single consumer line, ~:87 — rider-sized, cross-lane, see below), objectql tests + packages/objectql/src/protocol-meta-effective-schema.test.ts (its three-line tripwire is DESIGNED to flip here), .changeset/. ⛔ No FieldSchema change (direction C is out — it would restore the declared-but-unenforced key #2377 removed).
Serial constraints cleared: registry.ts's last landings today are #6786 (as any sweep, MERGED 19:20Z) and #6788/#6794 — all merged, none in flight; #6562 is independent by construction (it deliberately does not propagate the key and pins the residual divergence). No open PR touches packages/objectql. In-flight elsewhere in this lane: none (batch:1).
PM ruling (direction, veto window open): A — contract-first. Stop stamping a key FieldSchema rejects; declare the tenant index where every other index in the system is declared (the object's indexes[]) and teach driver-mongodb to read it there. B (strip-before-serve) is smaller but leaves the platform's own document carrying a key its own schema refuses, and keeps two truths about one column. Premise for the dev to verify: indexes[] can express what indexed: multiTenant meant (including the multiTenant=false case — likely "no index declared" rather than "declared false"), and the driver's index creation reaches the same DDL outcome. Falsified ⇒ report the fork with evidence and fall back to B only with that evidence attached, ⛔ not silently.
Cross-lane note: the one-line driver-mongodb consumer change is a defect-fix touch, not investment — the #5499 drivers freeze covers investment. Declaring the file surface here per the cross-domain path; notice to the drivers seat rides this claim.
Container judgment: size M (two packages + a designed tripwire flip) ⇒ mode:cloud.

---

Generated by Claude Code