test(cli): enumeration pin for apply's drop gates, and the changeset

The pin discovers apply's drop-gate refusals from its source and holds
plan and apply to naming each gate's command for a held drop. The two
gate refusal tests' fixtures spell the drift entry's finding as
`message`, the key ManagedDriftEntry declares.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmjU2x1faLZ39DVTFyVca6

Author: claude

.changeset/24958-migrate-drop-gate-remedies.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os migrate plan` and `os migrate apply` name the command each held drop waits for, never `--allow-destructive`, for every drop `apply` refuses (#24958)
+
+Clause-②: no
+
+`os migrate apply --allow-destructive` refuses the whole run, whatever flag is passed, while it would drop one of three columns before its precondition holds: `sys_account.issuer` while its retirement pre-flight finds `(provider_id, account_id)` keys held by more than one row (or cannot read `sys_account`), `sys_comment.reactions` while no verified run of `os migrate comment-reactions --apply` is recorded, and an `organization_id` column while the organization-ownership ceremony has not verified. Yet `os migrate plan` offered `--allow-destructive` for the first two, and `os migrate apply` without the flag listed all three with `"os migrate apply --allow-destructive" to drop it.` and closed with `N destructive change(s) will be SKIPPED (re-run with --allow-destructive to include them).` and `Skipped N destructive change(s) (re-run with --allow-destructive to include them).` That re-run was refused, exit 1.
+
+- **Now.** Each such drop is still listed and counted as destructive drift, in both commands. Its line names what it waits for: the ceremony, `os migrate comment-reactions`, or the retirement pre-flight `os migrate account-issuer`.
+- **The footer.** One line per gate that holds a drop names that gate's commands and says `--allow-destructive` is refused until they have run. `os migrate plan` offers `--allow-destructive` for nothing while a drop is held. `os migrate apply` prints `N destructive change(s) will be SKIPPED, and a re-run with --allow-destructive cannot include them yet:` before those lines, and `Skipped N destructive change(s); a re-run with --allow-destructive cannot include them yet (see above).` after the apply.
+- **Unchanged.** A database with no held drop prints what it printed before, byte for byte, in both commands. The `--json` documents, the exit codes and every refusal of `os migrate apply --allow-destructive` (its rule and its text) are unchanged.
+
+**What to do.** Nothing. Follow the footer: run the command each held drop names, then re-run `os migrate plan`.

packages/cli/src/commands/migrate/apply.account-issuer-json-refusal.test.ts

@@ -69,7 +69,9 @@ const ISSUER_DROP = {
   table: 'sys_account',
   column: 'issuer',
   op: { type: 'drop_column', column: 'issuer' },
-  description: 'sys_account.issuer: column exists in the database but not in metadata (orphaned)',
+  // The differ's `message` (`ManagedDriftEntry`), remedy sentence included: the
+  // listing above the gate reads it (#24958).
+  message: 'sys_account.issuer: column exists in the database but not in metadata (orphaned) — "os migrate apply --allow-destructive" to drop it.',
 };
 
 const COLLISIONS = {
@@ -188,7 +190,10 @@ describe('controls', () => {
     const { exit } = await runApply(ARGV);
 
     expect(exit).toBe(1);
-    // Refused by the pre-flight, not by anything earlier on the human face.
+    // Refused by the pre-flight, not by anything earlier on the human face:
+    // its refusal printed, and the pre-flight read once — the listing above
+    // the gate shares the gate's read (#24958).
+    expect(log.mock.calls.map((c: unknown[]) => c.map(String).join(' ')).some((l: string) => l.includes('Refusing to drop sys_account.issuer'))).toBe(true);
     expect(mocks.probeAccountIdentityCollisions).toHaveBeenCalledTimes(1);
     expect(applyMigrationEntries).not.toHaveBeenCalled();
   }, RUN_TIMEOUT);

packages/cli/src/commands/migrate/apply.organization-ownership-refusal.test.ts

@@ -64,7 +64,9 @@ const ORGANIZATION_DROP = {
   table: 'sys_platform_setting',
   column: 'organization_id',
   op: { type: 'drop_column', column: 'organization_id' },
-  description: 'sys_platform_setting.organization_id: column exists in the database but not in metadata (orphaned)',
+  // The differ's `message` (`ManagedDriftEntry`), remedy sentence included: the
+  // listing above the gate reads it (#24958).
+  message: 'sys_platform_setting.organization_id: column exists in the database but not in metadata (orphaned) — "os migrate apply --allow-destructive" to drop it.',
 };
 
 /** The ceremony's two steps, as the refusal prescribes them. */

packages/cli/src/utils/apply-drop-gates.ts

@@ -170,10 +170,10 @@ export const APPLY_DROP_GATES: readonly ApplyDropGate[] = [
     id: 'sys_comment.reactions',
     judges: isCommentReactionsDrop,
     holds: async (reads, engine) => ((await reads.commentReactionsConversion(engine)).verified ? null : {}),
-    entry: 'a drop that waits for "os migrate comment-reactions" to carry the reactions stored in it into '
+    entry: 'a drop that waits for "os migrate comment-reactions" to carry any reactions stored in it into '
       + 'sys_comment_reaction records, and no verified run is recorded on this database (see below).',
     footer: (_held, waiting) =>
-      'sys_comment.reactions above holds the reactions stored before they became sys_comment_reaction records, and no '
+      'sys_comment.reactions above is where reactions were stored before they became sys_comment_reaction records, and no '
       + `verified run of "os migrate comment-reactions --apply" is recorded on this database, so ${REFUSES} one is`
       + `${andTheOthers(waiting)}. Run "os migrate comment-reactions" to preview, then "os migrate comment-reactions `
       + '--apply"; it carries them into records and records the run verified.',