Context

SERVER-128089 audited aggregation-stage internal-only mechanisms (a CVE-261 postmortem follow-up), looking for internal fields/stages that aren't rejected when an external client supplies them. The audit found that the aggregate command's internal $_translatedForViewlessTimeseries flag — which tells the server the pipeline was already translated for a viewless timeseries collection, so it skips re-translating — has no guard rejecting it from an external client. Handing this to Query Integration as the owner of the timeseries translation.

Severity (needs reproduction)

If a user sets it true on a timeseries collection, the server should skip the bucket-unpacking translation and run the query against the raw bucket documents instead of the logical measurements. The worst case appears to be wrong/raw results on the user's own timeseries namespace — no other namespace read, and no privilege check skipped (command auth is on the same namespace) — so likely low severity. We did not fully chase whether exposing raw bucket documents or skipping the translation has any sharper consequence.

Please verify the severity and decide the fix, which is likely to reject the field from external clients (e.g. an isInternalThreadOrClient check like fromRouter/fromMongos).