Context

SERVER-128089 audited aggregation-stage internal-only mechanisms (a CVE-261 postmortem follow-up), looking for internal fields/stages that aren't rejected when an external client supplies them. The audit found that $lookup has three internal-only IDL fields — $_internalUnwind, $_internalFieldMatchPipelineIdx, and $_internalFromIsAView — that are set by the router/optimizer but are not validated against external clients. Handing this to Query Optimization as the owner of $lookup.

Severity (needs reproduction)

• $_internalFieldMatchPipelineIdx looks like the possibly-problematic one: a $lookup with localField/foreignField plus a crafted out-of-range value appears to reach tassert 12761201 (a tripwire, process-fatal) in relocateFieldMatchPlaceholder (document_source_lookup.cpp:452, called from createFromBson at :1410). That would be a single-request DoS that runs post-auth, so it seems like an authenticated crash (the client must be authorized for the $lookup).
• $_internalUnwind and $_internalFromIsAView look benign — wrong-results-only on the caller's own data (a trailing $unwind / disabling SBE lowering), no cross-namespace read or privilege bypass.

Please verify the severity — in particular, reproduce (or rule out) the $_internalFieldMatchPipelineIdx tripwire — and decide the fix, which is likely to reject these fields from external clients at parse time (mirroring the view-field guard in the search stages).