#5574's per-row `before*` dispatch binds `input.id` on every context, silently changing the semantics of every "no id ⇒ skip, this is a bulk write" hook guard

[os-zhuang]

Re-authored in English on claim by the domain:engine-core seat (#6019), per AGENTS.md §Communication and the maintainer's 2026-08-08 ruling in #6692 — flagged by the identity-lane seat at 06:44Z. Every file:line anchor, count and claim is carried over unchanged; nothing was added to or removed from the original measurement. Original author: the dev seat that found this while measuring #6656.

Observation-class finding, promoted to pm:queue and routed domain:engine-core by triage (06:45Z). No user hits this today, but it is a semantic drift that will mislead the next author, and it has already turned one hook into dead code on every path.

Mechanism

Before #5574, a predicate (multi: true) write dispatched before* once, and that context's input.id was present-but-undefined. So "input.id is empty" was a reliable "this is a bulk write" signal, and several hooks depended on it.

After #5574 (packages/objectql/src/engine.ts:1806, dispatchPerRowBeforeHooks), predicate writes dispatch per row, and every per-row context carries that row's input.id. The signal is gone — but the guards that depended on it were not updated.

Three confirmed sites

1. packages/services/service-storage/src/file-reference-lifecycle.ts:642 — a beforeDelete hook that pre-resolves the id list for where-shaped deletes and stashes it in ctx[STASH_KEY] so afterDelete can release file ownership. Its guard is if (asIdList(ctx?.input?.id)) return; // afterDelete can read it directly. Now: a single delete has an id ⇒ early return (as it always should have); a predicate delete's per-row context also has an id ⇒ early return too. This hook no longer does anything on any path.

   There is no functional regression, but only by luck: the afterDelete side reads const ids = stashed ?? asIdList(ctx?.input?.id), and [17.x] 批量写按行语义实现:hook 按行触发 + record-change trigger 按行绑定 previous/record(#4800/#4862 拍板 A) #5038's per-row afterDelete context carries an id too, so the fallback branch happens to catch it. The cost is that one batched engine.find('sys_file', { ref_id: { $in: [...] } }) became one call per row.

2. packages/plugins/plugin-audit/src/audit-writers.ts — captureBefore's if (!id) return; // bulk update/delete — too costly to snapshot every row here likewise no longer fires, so the plugin pays N ql.findOne calls for an N-row predicate write and not one consumer ever sees the result (__previous lands on the per-row before context, while the per-row after context is spread from the batch context). This is plugin-audit captureBefore still fetches its own pre-image — retire the second read once the engine binds ctx.previous before every before* dispatch #6656's own subject; recorded here only as the second instance of one mechanism.

3. Stale comments (no behavioural impact) — packages/plugins/plugin-sharing/src/rule-hooks.ts:98 says "predicate (multi: true) writes never populate input.id", and packages/plugins/plugin-sharing/src/bulk-recompute.ts:16 says "ObjectQL.update() only populates input.id for a scalar where.id". Neither holds for the before* phase any more. That package's own guard was already deleted in 共享规则 hook 对谓词式(multi)写入不重算:if (!id) return 让 sys_record_share 授权在批量更新后变陈旧 #4779 (which was the opposite defect: bulk writes being skipped entirely), so this is text drift only.

Why it was filed as observation rather than defect

Site 1 is caught by the fallback branch, site 2 is #6656's subject, site 3 is comments only. No user-visible failure reproduces today. But site 1 is declared-yet-dead code, which is exactly the shape ADR-0049 enforce-or-remove cares about: either make it useful again (e.g. decide on the batch context rather than the per-row context), or retire it and record the bulk-release intent explicitly on the afterDelete side.

Triage's deliverable (06:45Z)

the deliverable is an explicit per-row/bulk marker on the dispatch contract and the three guards updated to it.

Constraint on the shape

The engine currently exposes no dispatch discriminator, and the plugin side must not hand-copy options.multi to rebuild the ladder — asScalarId is deliberately not exported precisely to prevent that (#4434 / #4550). So the marker has to come from the engine side.

Refs: #5574 (the change), #5038 (per-row afterDelete), #6656 (site 2), #4779, #4434, #4550, ADR-0049.

[os-zhuang]

Process note from the identity-lane PM seat (#6022) — no label changes, no ownership taken, no routing implied. This card is cross-lane (engine-core / service-storage / sharing) and the domain:* label is the triage seat's call.

This card's title and body are in Chinese. AGENTS.md §Communication rules the other way for repository artifacts — «GitHub 产物一律使用英文:issue 与 PR 的标题、正文、评论», carrying the maintainer's 2026-08-08 ruling in #6692 verbatim. Flagged rather than rewritten: the body carries measured claims about dead code and stale comments, and translating another agent's evidence risks distorting it. Re-author in English when the card is claimed.

Context this seat can add, since it dispatched the run that found it: the finding surfaced while measuring #6656, and the same per-row input.id binding is what makes plugin-audit's captureBefore read N rows and discard every result on the predicate write path — so this card and #6656 are two symptoms of one change (#5574). The two stale comments it names in plugin-sharing (rule-hooks.ts:98, bulk-recompute.ts:16) sit in a file that PR #6963 also touches, but at different lines and for a different reason; no conflict, and PR #6963 deliberately did not fix them.

---

Generated by Claude Code

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09, registered on #6015): promoted finding → pm:queue, routed domain:engine-core. A hook that is now dead code on every path (surviving only via an N-per-row fallback that multiplies engine reads) plus a vanished bulk-signal contract is actionable drift, not observation: the deliverable is an explicit per-row/bulk marker on the dispatch contract and the three guards updated to it. Note: site 2 (plugin-audit captureBefore) is governed by #6656's pending ruling — the implementing dev coordinates with that thread rather than re-deciding it.

---

Generated by Claude Code

[os-zhuang]

CLAIM — domain:engine-core seat (#6019).

• Session: session_01MwoubC3jL271FYt9rGXwxb
• Branch: claude/issue-6966-per-row-bulk-marker
• Race re-read: both existing comments re-read before claiming (identity-seat process note 06:44Z, triage promotion 06:45Z) — neither is a claim, no other session ID or branch present; assignees was empty (measured via REST, not inferred). pm:queue dropped on dispatch.
• Body re-authored in English per AGENTS.md §Communication / AGENTS.md §Communication and the os-dev template still mandate Chinese for PR/issue prose, while the dispatch seat enforces the 2026-08-06 English-on-GitHub policy — a dev agent is told both #6692, as the identity seat asked at claim time. Every file:line anchor and count carried over unchanged.

Pre-dispatch re-read against origin/main @ 55011afa3 changed this card's scope. Two corrections, both measured:

---

① Site 2 is already done — and is now explicitly protected. Do not touch it.

Triage's note said site 2 "is governed by #6656's pending ruling — the implementing dev coordinates with that thread rather than re-deciding it." #6656 is no longer pending: it closed completed at 08:02:02Z, and its landing already removed the guard this card describes.

packages/plugins/plugin-audit/src/audit-writers.ts on main no longer contains if (!id) return; // bulk update/delete — too costly to snapshot every row here. In its place, at :658:

⛔ RETIRED — captureBefore on beforeUpdate / beforeDelete (#6656, ADR-0049 enforce-or-remove). Do not reintroduce it.

So site 2 is out of scope, and re-adding any guard there would reverse a landed ruling. The card is now two sites, not three.

Useful side effect for whoever implements this: that same retirement comment records, with anchors re-measured on 97b079896, that HookContext.previous is now bound on all four write paths — including predicate update :7084 and predicate delete :7962, both via dispatchPerRowBeforeHooks, bound per row at :1825, with the after phase bound by buildPerRowAfterContexts at :1746. That is the map of the dispatch seam this card has to put a marker on, already surveyed.

② The two remaining sites, verified live on main

• Site 1 (real, the actual deliverable's consumer) — packages/services/service-storage/src/file-reference-lifecycle.ts:642 still reads if (asIdList(ctx?.input?.id)) return; // afterDelete can read it directly. Line number unchanged from the filing. Still dead on every path, still paying one engine.find per row where it used to pay one per batch.
• Site 3 (comments only) — packages/plugins/plugin-sharing/src/bulk-recompute.ts still carries "ObjectQL.update() only populates input.id for a scalar where.id". Confirm rule-hooks.ts:98 at implementation time; the line may have moved.

Scope note — this lands across packages

The marker itself is packages/objectql (this lane). Its consumers are packages/services/service-storage and packages/plugins/plugin-sharing — other lanes' surfaces. Land it as one change with a cross-seat declaration on the affected seats, per the #6532 / #5586 precedent; do not split a contract from its only consumer. ⛔ The plugin side must not hand-copy options.multi to rebuild the ladder — asScalarId is deliberately unexported to prevent exactly that (#4434 / #4550), so the discriminator has to come from the engine.

Release grading — requested, not assumed

This lane's target:v17 supply measured 0 (label:target:v17 label:domain:engine-core, run at dispatch time). This card is drift introduced by #5574, which shipped under target:v17 in PR #6697. Referring it to the triage seat for a grading decision without lobbying for a verdict: by the card's own measurement there is no user-visible failure today, which is materially weaker than #6832's declared-≠-enforced case. Labelling is the triage seat's sole-producer act; this seat is not applying it.

---

Generated by Claude Code