metadata: after #23469, the legacy-organization read seam's loose ends (ambient transaction, filter-after-limit, an unpinned by-name filter, DatabaseLoader._count, a 404 where a named refusal belongs) and the ceremony wording

Filing gate: (c) a read-only finding from a contract review, not run. The PASS record 6184549574 on PR #23469 (#23429, C7b S2 + S5) lists these as non-blocking.
Reader who acts: domain:engine triage, to grade and route.

Filed by domain:engine seat 1 · marchtian · session session_01Rerax7QTjKMPCUZxQUtPFR. ⛔ Not a claim.

PR #23469 is on main (dd29bbe60d). The Blocked-by: #23469 line was removed 2026-10-16T00:00Z by domain:engine seat 1, in its claim stroke (claim 6204823952).

Why it is low priority

Every path below matters only on an unmigrated (v17-shape) database, where legacy organization rows still sit in the sys_metadata family. os serve refuses to boot such a database (S5's guard) until os migrate organization-ownership has verified. So no served door reaches these paths in a supported posture today. They are latent, and worth closing before anything else starts reading the family off the served boot.

What the review found (PR #23469 at `e4811b67f2`, read only)

findServedOverlayRow's filter has no pin of its own. In meta-stored-legacy-organization.integration.test.ts, the _lock case asserts only lock and editable. With that filter alone removed, getMetaItem would serve the organization's body as item, and no pin goes red.
- Wanted: assert that read.item is not the organization's body.
The seam joins only an explicit context.transaction.
- legacyOrganizationRowsOf's raw listPhysicalColumns / execute calls do not read ObjectQL's ambient transaction.
- The protocol passes none: every call site passes { isSystem: true }.
- Inside publishPackageDrafts' ambient engine.transaction, on a v17-shape SQLite file, the column read would wait on a second pool connection. The paths are promoteDraftForPublish's draft read, the active-row read, repo.get and repo.promoteDraft.
- Wanted: take the engine's ambient transaction, or thread trxCtx into those reads.
The plural form filters after limit, so a page under-fills, or a single-row read misreads, when legacy rows sit in it:
- auditMetaItem (orderBy plus limit);
- listCommits (limit);
- revertStoredPackage (limit: 1), which answers 409 "never been published" when its first active row is a legacy one;
- the repository's list(filter.limit).
- Wanted: filter before limiting, or page until the limit is met.
DatabaseLoader._count does not filter. So exists() answers true for an address that only a legacy row holds, while load() answers null, and the history total counts legacy rows. This is pre-existing: main's loader never filtered.
rollbackToPackageCommit answers COMMIT_NOT_FOUND (404) for a legacy commit, where revertCommit gives a named refusal. Wanted: the same named refusal.
Inert plumbing to remove, behaviour-neutral:
- rowsRead;
- ServedOverlayRowCandidate.scope / organizationId;
- orgId / itemOrgId in protocol.ts.
Every row that reaches them is now the environment's (the dev's report 6184164699; verified inert in 6184549574).
Wording:
- The four ADR-0087 entries 18.sys-metadata{,-audit,-commit,-history}-organization-column-retired, and content/docs/concepts/metadata-lifecycle.mdx, name os migrate organization-ownership --apply without --plan-file. main's 18.cli-organization-ownership-apply-plan-file-required makes --plan-file required.
- E1's refusal sentence in os migrate apply reads "which the organization-ownership ceremony owns that drop", which is garbled.

Not in this card

The ceremony's dialectOf / config.client is cli: the organization-ownership ceremony resolves its SQL dialect from config.client as a string only (dialectOf, resolvePlannedDriverExec, the template-lookup guard), and falls back to sqlite on a client class or an unrecognised value #23558.
The /meta trail doors admitting setup.access is rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546.
The changeset gaps the review named are not here: S5's unnamed runtime exports, and the ApiError.code widening by ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED. Changesets are consumed at release, so these ride the release notes, not a code change.

Dedupe

The words legacyOrganizationRowsOf findEnvironmentRows ambient transaction rollbackToPackageCommit DatabaseLoader _count rowsRead itemOrgId match only PR #23469 and #23429.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-15T23:59Z
Session: session_01GP3comALHRcRBixS2TEnLF (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23609-legacy-org-read-seam
Worktree: objectstack-issue-23609
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface, by the card's items (the dev re-measures each item on main first; an item already closed on main is reported, not re-done):

packages/metadata-protocol/src/protocol.ts, the legacy-organization read seam only: legacyOrganizationRowsOf and its callers' transaction (item 2); the plural reads that filter after limit, namely auditMetaItem, listCommits and revertStoredPackage (item 3); rollbackToPackageCommit's answer for a legacy commit (item 5); the inert rowsRead, ServedOverlayRowCandidate.scope / organizationId and orgId / itemOrgId plumbing (item 6). packages/metadata-protocol/src/sys-metadata-repository.ts: list's filter.limit only (item 3). packages/metadata/src/loaders/database-loader.ts: _count only (item 4).
Cross-lane, wording and one pin only: packages/cli/src/commands/migrate/meta-stored-legacy-organization.integration.test.ts (item 1's pin) and packages/cli/src/commands/migrate/apply.ts's E1 refusal sentence (item 7), domain:cli, declared on [PM seat] domain:cli — 🟢 marchtian · session_01PFB9ZGRWYvjhTXsd8i6KBp · finishing 3, then serial (maintainer) #6024; the four packages/spec/src/migrations/entries/semantic/18.sys-metadata{,-audit,-commit,-history}-organization-column-retired.ts texts (item 7, --plan-file) with their regenerated artifacts, domain:spec, declared on [PM seat] domain:spec · seat 3 — 🟢 baozhoutao · session_01D6F9axfoPzR7t8G1J7Ytzz #18883; content/docs/concepts/metadata-lifecycle.mdx (item 7), domain:devx, declared on [PM seat] domain:devx · seat 2 — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #20163.
Plus pins and one changeset .changeset/23609-*.md. ⛔ Not saveMetaItem, its D9.9 call or unboundOwnerPackageRefusal (metadata-protocol: over legacy object rows [package-less, Q], a draft save naming no package answers 200 into Q's draft, which no publish can serve: the save door's D9.9 check judges the request's package before the draft address resolves to Q #23712, in flight), not the promote door's D9.9 call, not the draft address. Stop on any other breach and explain it in the report.
Container & model: M, mode:cloud (the maintainer's order on seat post [PM seat] domain:engine — 🟢 sunhaolin #6367: 「后续重活开发都可以单独开云卡」; a spec regeneration plus three packages is build-heavy), model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate", with the Clause-② SUSPECT hint on packages/spec/src/**, judged from the card's content: the spec hunk corrects four migration entries' prose to the CLI's required --plan-file, no schema, no accept set)
Clause-②: no
Responsibility: the risk is produced by packages/metadata-protocol and packages/metadata's legacy-organization read seam, left by PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 (feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429, C7b S2 + S5) as non-blocking in its PASS record 6184549574 | no platform path covers it: os serve refuses an unmigrated (v17-shape) database until os migrate organization-ownership has verified, so no served door reaches these paths in a supported posture today | nobody reaches it on a supported boot; the migration ceremony and any future reader of the family off the served boot would (the card's own reach statement).
Thread-read: none
Serial constraints cleared: PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 (feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429) is on main (dd29bbe60d), so the body's stale Blocked-by: #23469 line is removed in this stroke. metadata-protocol: over legacy object rows [package-less, Q], a draft save naming no package answers 200 into Q's draft, which no publish can serve: the save door's D9.9 check judges the request's package before the draft address resolves to Q #23712 (this seat, dispatched just before this claim) works saveMetaItem's D9.9 call and unboundOwnerPackageRefusal, other regions of protocol.ts; whichever lands second merges main. Open PRs at this read (10) touch none of the files above. Claims in other lanes without a PR yet (domain:cli: cli/serve: with --no-server the ready banner still prints "API: http://localhost:PORT/" and an MCP connect URL, though no HTTP server is composed and nothing listens #23623, cli/serve --dev: an OS_DATABASE_URL whose scheme the CLI does not recognise is ignored in silence, and the boot serves an in-memory SQLite store instead of the database the operator named #23633, error-code provenance: the Hono doors and the runtime dispatcher stamp UNIQUE_VIOLATION as a literal inside a ternary that check:error-code-provenance cannot see, and the ledger has no row for either package #23714): their surfaces are UNKNOWN to this seat; the dev lists the open PRs touching each file above before opening its own.

Generated by Claude Code

Dispatch · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-16T00:03Z: mode:cloud, the dev session session_01TekAoE8QbLrxFVJsdNuRgg, titled "⚡ engine #23609 legacy-organization read seam loose ends". It runs at the default tier on branch claude/issue-23609-legacy-org-read-seam, the claim 6204823952.

Scope: the body's seven items, each measured on main first. This card was filed from a read-only review of e4811b67f2, and main has moved since. An item already closed is reported with its reading, not re-done.
Latent paths only: no fix changes a served door's answer on a migrated store. Each pin runs on a legacy-shape store beside a migrated CONTROL. Items 1, 3, 4 and 5 each get an ablation.
Item 2: the narrowest route that joins the ambient transaction. It stays out of promoteDraftForPublish's region next to the promote door's D9.9 call (metadata-protocol: over legacy object rows [package-less, Q], a draft save naming no package answers 200 into Q's draft, which no publish can serve: the save door's D9.9 check judges the request's package before the draft address resolves to Q #23712's neighbourhood).
Cross-lane hunks are wording and one pin only, declared on [PM seat] domain:cli — 🟢 marchtian · session_01PFB9ZGRWYvjhTXsd8i6KBp · finishing 3, then serial (maintainer) #6024 (packages/cli), [PM seat] domain:spec · seat 3 — 🟢 baozhoutao · session_01D6F9axfoPzR7t8G1J7Ytzz #18883 (packages/spec's four ADR-0087 entries, regenerated) and [PM seat] domain:devx · seat 2 — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #20163 (content/docs).
Clause-②: no. The PR says Fixes #23609 only when all seven items are closed; otherwise Part of #23609.
Delivery: a draft PR, then an os-dev-report comment here.

Generated by Claude Code

os-dev-report

{
 "issue": 23609,
 "status": "done",
 "branch": "claude/issue-23609-legacy-org-read-seam",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/23778",
 "session": "session_01TekAoE8QbLrxFVJsdNuRgg",
 "premise_still_valid": true,
 "summary": "Six of seven items are closed in draft PR #23778 (Part of #23609), one commit each, every one measured on main 2906cd8 first; no item was already closed on main. Item 2 is measured but stopped: H2 holds (publishPackageDrafts on a v17-shape SQLite file had not answered after a 25 s bound; the migrated control published in 97 ms), but neither fix route fits the claimed file surface (see open_questions). Every fix acts only where legacy organization rows are present, and each pin runs beside a migrated CONTROL whose answer is unchanged. Claim verified: comment 6204823952 is the newest Claim: and names this branch; no second claim posted; card assignee not written.",
 "items": [
  {
   "item": 1,
   "status": "done here (0546039d)",
   "reading": "H1 confirmed on main: findServedOverlayRow's filter alone reverted to the raw engine.findOne (rebuilt, marker present in metadata-protocol dist per ablation-dist-preflight) left meta-stored-legacy-organization.integration.test.ts 7/7 green. The new assertion (read.item.subject is not 'Org A locked') turns exactly that case red under the same ablation: 1 failed / 6 passed, AssertionError expected 'Org A locked' not to be 'Org A locked'. Restore leg: marker absent from dist, tree clean."
  },
  {
   "item": 2,
   "status": "measured, NOT done: stopped at the claim's file surface",
   "reading": "H2 confirmed with a throwaway probe (not committed) on the cli ceremony boot over a v17-shape SQLite file: protocol.publishPackageDrafts for a package with one draft gave timeout:true at 25000 ms. Control (same file, organization_id dropped): published in 97 ms. ObjectQL exposes no public ambient-transaction accessor (txStore and privilegedReadDriverOptions are private; engine.execute does not thread it), so the narrow in-seam route needs packages/objectql. Threading trxCtx needs publishPackageDrafts' inTxn callback, promoteDraftForPublish (lockWriteRefusal, repo.get draftForGate, repo.promoteDraft) and the repository's legacyOrganizationRowIds, because repo.get alone keeps the stall. That is outside the claim (repository: list's limit only; not the promote door's D9.9 neighbourhood). Correction to the card: the active-row read it names (now findEnvironmentRow at the revert-plan capture) runs BEFORE Phase 1's transaction, not inside it."
  },
  {
   "item": 3,
   "status": "done here (a6f23cd9)",
   "reading": "Reproduced on a v17-shape fake engine (driver seam answering the physical column): auditMetaItem limit 2 served 0 env events, listCommits limit 1 served 0, revertStoredPackage answered 409 never-been-published, repository list({limit:1}) yielded 0. Fixed in findEnvironmentRows (re-read with id $nin only when a page holds a legacy row, or an offset is set and legacy rows exist) and in SysMetadataRepository.list. Ablation (a): the paged branch disabled turns 4 v17 cases red (audit, commits, revert, offset). Ablation (b): repository list turns 1 v17 case red. Controls green in both."
  },
  {
   "item": 4,
   "status": "done here (7a52179d)",
   "reading": "Reproduced: exists() true for an address only a legacy row holds while load() is null; queryHistory total 3 with 2 records. _count now counts first and re-counts with id $nin only when the count is non-zero and legacy rows exist, so exists()'s unprovisioned-table discrimination is untouched. Ablation: both v17 cases red, 2 controls green."
  },
  {
   "item": 5,
   "status": "done here (c39c8c8e)",
   "reading": "H3 confirmed: revertCommit's named refusal already existed (organizationScopedWriteRefusal, NOT_OVERRIDABLE 403). Both doors now read the commit through readRevertableCommit; revertCommit's read, refusal and text are moved unchanged. Pin: on v17 both doors answer NOT_OVERRIDABLE/403 with the same message (first sentence pinned: Commit 'o_c' cannot be written organization-scoped (organization 'org_a')); on the control both answer COMMIT_NOT_FOUND/404; an environment commit still rolls back. Ablation (rollback read put back through findEnvironmentRow with the old 404): exactly that case red."
  },
  {
   "item": 6,
   "status": "done here (8052436a)",
   "reading": "H4 partly falsified: rowsRead is a presence flag, not inert. It is behaviour-neutral to drop because every caller passing it ({} at the active and draft-preview merges) also sends stored places, and every caller omitting it sends none; servedStoredRow returns undefined over place-less records. Removed: rowsRead, ServedOverlayRowCandidate.scope/organizationId, StoredRowPlace.organizationId, the always-null orgId/itemOrgId locals (applyRemoteMetadataMutation, revertCommit, rollbackMetaItem, deleteMetaItem). Proof: the full metadata-protocol suite gives 237 files passed / 3 skipped, 20593 passed / 19 skipped both with the commit and with protocol.ts restored to its parent blob ea9fa58d (restore proved by hash). Left: StoredOverlayEntry.organizationId and the organizationId parameters of restoreArtifactRegistryView / hydrateOverlayIntoRegistry (the #6780 registry-scope API, not in the card's list)."
  },
  {
   "item": 7,
   "status": "done here (6bdaa0e0)",
   "reading": "The four entries and metadata-lifecycle.mdx now name os migrate organization-ownership --out PLAN, then --apply --plan-file PLAN (--plan-file is required, organization-ownership.ts plan-file-required; --backup-taken can be answered at the prompt). The E1 sentence now reads: a drop the organization-ownership ceremony owns, and the ceremony has not verified on this database. Prose only; ids, categories and versions unchanged. spec build + check:generated: 14/14 up to date, nothing checked in regenerated (the entries feed only the gitignored registry). The E1 pins (apply-organization-ownership-gate, 11/11 with its sibling) match the command name only."
  }
 ],
 "tests": "All at head 81aa285d unless noted, each through os-verify-lock (VERDICT command-exit 0). metadata-protocol full suite: 237 files passed / 3 skipped, 20593 passed / 19 skipped (at 8052436a; later commits touch no metadata-protocol source); typecheck exit 0. New protocol.legacy-organization-read-seam.test.ts 16/16. metadata full suite 63 files, 892/892 (before 81aa285d, which only adds an assertEngineFindOnePredicate call to the new fake); database-loader.legacy-organization-count.test.ts re-run at 81aa285d: 4/4; typecheck exit 0. cli: --project unit 297 files, 4377/4377; --project integration meta-stored-legacy-organization 7/7, apply-organization-ownership-gate + organization-ownership-platform-global-column-drop 11/11 (rebuilt metadata, metadata-protocol and cli dist); typecheck exit 0. spec: build + check:generated exit 0; typecheck exit 0. Ablations (items 1, 3a, 3b, 4, 5) through scripts/ablation-replace.mjs: anchor 1 to 0, blob moved, restore blob == HEAD and git diff HEAD empty. Item 1 also passed ablation-dist-preflight on both legs. The first item 1 attempt was a no-op: the build dropped a void-string marker and the preflight refused (exit 5); it was re-run with a context-key marker. Item 6: full-suite equality, no ablation.",
 "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) at 042ba4c5 derived 115; every one run with its exit captured before any pipe. 110 exit 0; check:engine-double-contract exit 1 (a real finding: the loader pin's fake findOne lacked assertEngineFindOnePredicate, and the ledger lacked the new doubles), fixed in 81aa285d (check:engine-double-contract --write; re-run exit 0). Re-derived at 81aa285d: 123 (8 added by scripts/engine-double-contract.pinned.json). The 8 new ones plus engine-double-contract, type-check-coverage, type-check-debt, cross-package-test-inputs and test-source-alias re-run at 81aa285d: 13/13 exit 0. --ran: 123 derived, 119 run, 4 NOT-MEASURED (derived from recorded exit 3), 0 UNRUN, RAN_EXIT=0. NOT MEASURED, PREREQUISITE NOT MET: check-plugin-teardown-shape --self-test (shallow clone), spec check:skill-examples (client-react has no dist), check:dual-build-cjs-loads (whole-workspace build), check:i18n-coverage (connector-slack has no dist). check:adr-0087-registration exit 0. CI check-runs on #23778: in_progress at report time, not awaited per the role file.",
 "mcp_calls": "8, all read-only: issue_read get #23609, issue_read get_comments x3 (#23609, #23469, #23429), list_pull_requests (open), pull_request_read get_files x2 (#23755, #23761), pull_request_read get #23778",
 "api_writes": "2 relay strokes (scripts/pm/fleet-write/dispatch.mjs, POST /repos/objectstack-ai/objectstack/dispatches each): (1) pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23778/assignees; (2) comment, i.e. POST /repos/objectstack-ai/objectstack/issues/23609/comments (this report). git push is not counted (9 pushes to the branch). label-write: 0 (no criterion met: the diff publishes, so skip-changeset does not apply, and the dispatch names no label).",
 "line_budget": "14 files, +564 / -126 = 690 changed lines (dispatch-gates numstat vs merge base 2906cd8), under the 3000 human-merge threshold. No governed surface.",
 "files_changed": [
  ".changeset/23609-legacy-org-read-seam.md",
  "content/docs/concepts/metadata-lifecycle.mdx",
  "packages/cli/src/commands/migrate/apply.ts",
  "packages/cli/src/commands/migrate/meta-stored-legacy-organization.integration.test.ts",
  "packages/metadata-protocol/src/protocol.legacy-organization-read-seam.test.ts",
  "packages/metadata-protocol/src/protocol.ts",
  "packages/metadata-protocol/src/sys-metadata-repository.ts",
  "packages/metadata/src/loaders/database-loader.legacy-organization-count.test.ts",
  "packages/metadata/src/loaders/database-loader.ts",
  "packages/spec/src/migrations/entries/semantic/18.sys-metadata-audit-organization-column-retired.ts",
  "packages/spec/src/migrations/entries/semantic/18.sys-metadata-commit-organization-column-retired.ts",
  "packages/spec/src/migrations/entries/semantic/18.sys-metadata-history-organization-column-retired.ts",
  "packages/spec/src/migrations/entries/semantic/18.sys-metadata-organization-column-retired.ts",
  "scripts/engine-double-contract.pinned.json"
 ],
 "open_prs_touching_files": "Read at 2026-10-16T01:20Z, 18 open PRs. None touches a file of this PR. #23755 changes protocol.lock-one-resolution.test.ts only; #23761 (domain:cli, #23633) changes cli storage-driver files only; #23760 (#23714) is plugin-hono-server/runtime by title. No open PR for #23712 or #23623 was listed. origin/main moved 3 commits past 2906cd8, none on these files, so no merge was made (the dispatch asks for one only on an overlap).",
 "deviations": [
  "Role file over the dispatch's harness reminder: commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness-suggested model-named Co-Authored-By.",
  "Role file over the platform's PR-subscription default: #23778 is not subscribed, and CI was not awaited.",
  "The cloud checkout was already on the branch, so the dev worktree was created after detaching the primary checkout (git checkout --detach; worktree add -B ... origin/main). Base 2906cd8 = origin/main at dispatch, at or after a869ea6362 (merge-base --is-ancestor exit 0).",
  "Item 3's two ablation legs ran outside os-verify-lock (small vitest runs); every other build and test went through the lock.",
  "The derived-gate union was run in full at 042ba4c5. After the final commit 81aa285d (one test fake plus the engine-double ledger), 13 families were re-run: the 8 the re-derivation added, plus those reading the changed files. The other 106 results are from 042ba4c5's tree, which differs from the head only in those two files.",
  "ablate.sh printed ABLATED-TEST-EXIT=0 from a grep pipe. Each ablation verdict was read from vitest's own Tests line, never from that code.",
  "Item 2 was stopped under the claim's rule (stop on a surface breach and explain), not fixed."
 ],
 "open_questions": [
  {
   "question": "Item 2 (the seam's raw column read waits on a second pool connection inside publishPackageDrafts' ambient transaction on a v17-shape SQLite file; 25 s+ measured, control 97 ms). Which route, under which claim?",
   "options": [
    "A: add one public, same-origin-gated read accessor to ObjectQL (the existing private privilegedReadDriverOptions(object), exposed). legacyOrganizationRowsOf and SysMetadataRepository.legacyOrganizationRowIds take context.transaction ?? that accessor. Surface: packages/objectql engine.ts (+ a pin), protocol.ts legacyOrganizationRowsOf, and the repository's one helper. Small, one seam, no caller threading, stays out of promoteDraftForPublish and D9.9.",
    "B: thread trxCtx from publishPackageDrafts' inTxn callback through promoteDraftForPublish, lockWriteRefusal / overlayLockLayerAt, repo.get and repo.promoteDraft. Wide: it touches #23712's neighbourhood and the promote door's D9.9 region, and every future reader inside a transaction must remember to thread it.",
    "C: leave it latent (os serve refuses the database; the ceremony does not publish packages) and close item 2 with this reading."
   ],
   "recommendation": "A as its own small card (domain:engine with an objectql surface), P3. Long-run soundness: one engine-owned answer to 'the transaction this read is inside', the same rule buildDriverOptions already applies to engine reads; no caller convention to forget. AI-error axis: B relies on every author threading a context, A makes the default right. Startup scope: it is a 3-file change with no new gate. Real-need axis: nobody reaches it on a supported boot, so C is honest if the seat prefers zero change; A costs about as little and removes a 60 s acquire-timeout stall for any future off-serve reader."
  }
 ],
 "out_of_scope_findings": [
  "carrier: none · noted, not filed (Acceptance notes on #23778) · DatabaseLoader.queryHistory's page read (_find with limit + offset) filters legacy rows after the cut, the item 3 shape on the loader; outside the claim (_count only); latent like the card (os serve refuses the database) · dedupe words: queryHistory limit offset legacyOrganizationRows _find",
  "carrier: none · noted, not filed (Acceptance notes on #23778) · listCommits passes limit with no orderBy and sorts afterwards, so with a limit it returns store-order rows rather than the newest; predates the card, unrelated to the legacy filter · dedupe words: listCommits limit orderBy newest-first compareAuditInstants"
 ],
 "pr_body_later_edits": "none"
}

Generated by Claude Code

Seat ruling on item 2 · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-16T01:57Z · C

Answers report 6205946408, open_questions[0]. Item 2 is measured and left latent. The card closes with PR #23778, which then says Fixes #23609. The seat writes that body edit.

What was measured. The reading stands as the dev gave it. On a v17-shape SQLite file, publishPackageDrafts had not answered after 25 s; with the column dropped it published in 97 ms. ObjectQL gives a raw read no way to join the ambient transaction. So the narrow fix (A) needs a new public accessor on ObjectQL. Threading the transaction through (B) reaches into promoteDraftForPublish, next to the promote door's D9.9 call.

Why C, on the four axes (long-term first):

Long-term. The seam serves one thing: an unmigrated database, which the v18 ceremony migrates and os serve refuses to start on. It is transitional code, retired with the organization axis. A adds a permanent public engine accessor to fix it, a public-surface widening (Clause-②: yes) bought for code meant to go away. B spreads a threading convention through the promote path. Neither is the shape the long-term architecture wants for this seam.
Business need. Nothing reaches the path today, measured from both ends. os serve refuses the database before any door runs, and the ceremony never publishes packages. No caller of publishPackageDrafts on an unmigrated database exists in the repo.
Anti-AI-error. The path has no author to mislead: an AI-written app reaches it only through the served boot, which refuses that database loudly first.
Startup scope. No pull, so no new engine surface (implementation-first). A's price is small, but it is a price for a capability nobody uses.

Where it comes back. A future reader of the sys_metadata family inside an ambient transaction, off the served boot on an unmigrated database, carries this fix in its own card. The trigger words are in this comment for dedupe: legacyOrganizationRowsOf ambient transaction publishPackageDrafts v17-shape second pool connection. A, as the dev described it, is the route to take then.

The two out-of-scope findings go to the PR's Acceptance notes, not filed. Both were checked on main:

DatabaseLoader.queryHistory cuts its page before the legacy filter, as item 3 did. It is latent like the card.
listCommits with a limit cuts in store order before sorting newest-first. No in-repo caller passes a limit: GET /api/v1/packages/:id/commits and rollbackToPackageCommit both read the whole timeline, and no spec contract declares the parameter.

Generated by Claude Code

ACCEPT → PR #23778 comment 6206412907 · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-16T02:06Z. This is the seat's review of record for the engine, cli and docs hunks. The four spec entries' prose has its CONTRACT_REVIEW_TIER record 6206405366, PASS on 81aa285d58. Six items are done, and item 2 is ruled C (6206299338). Clause-②: no. CI is green. The PR now says Fixes #23609. Landing follows through the merge queue.

Generated by Claude Code

Landed · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-16T02:41Z

Probe	Reading
Queue	Armed with `pr_ready` + `automerge_enable` through the fleet-write relay (run 38838757695), after ACCEPT 6206412907 and the `CONTRACT_REVIEW_TIER` record 6206405366 (PASS). `8684079f2a`'s commit time, 2026-10-16T02:08:58Z, is the enqueue. After the merge, `git ls-remote` lists queue branches only for PRs #23481, #23758 and #23783. None is left for PR #23778.
`origin/main`	`8684079f2a` is on `origin/main` (`git merge-base --is-ancestor` exit 0). It is the squash of PR #23778: the same 14 files, +564/−126. The merge event and this card's close were both at 2026-10-16T02:40:41Z.
Cards closed	Since the enqueue, two cards closed: #23609, this PR's card, and #23740 (`domain:spec`, assigned elsewhere). Nothing unexpected.

Status: #23609 is closed, and its pm:dispatched is removed in this stroke. The cloud dev session session_01TekAoE8QbLrxFVJsdNuRgg is archived.

Items 1 and 3–7 landed.
Item 2 is ruled C and left latent (6206299338). Its trigger words are in that comment, for the future reader that brings it back.

Generated by Claude Code

Navigation Menu

Repository navigation

metadata: after #23469, the legacy-organization read seam's loose ends (ambient transaction, filter-after-limit, an unpinned by-name filter, DatabaseLoader._count, a 404 where a named refusal belongs) and the ceremony wording #23609

Why it is low priority

What the review found (PR #23469 at `e4811b67f2`, read only)

Not in this card

Dedupe

Seat ruling on item 2 · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-16T01:57Z · C

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata: after #23469, the legacy-organization read seam's loose ends (ambient transaction, filter-after-limit, an unpinned by-name filter, DatabaseLoader._count, a 404 where a named refusal belongs) and the ceremony wording #23609

Description

Why it is low priority

What the review found (PR #23469 at e4811b67f2, read only)

Not in this card

Dedupe

Activity

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Seat ruling on item 2 · domain:engine seat 1 · sunhaolin · session_01GP3comALHRcRBixS2TEnLF · 2026-10-16T01:57Z · C

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What the review found (PR #23469 at `e4811b67f2`, read only)

Seat ruling on item 2 · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-16T01:57Z · C