fix(runtime,cli): one file-URL filename rule for both hosts — FILE: strips case-insensitively, file://NAME opens NAME on the CLI host

[objectstack-fleet]

Fixes #23794
Fixes #23796
Clause-②: yes

What changed

One rule turns a SQLite database URL into a file name, and both hosts call it.

• Runtime host, runtime(standalone host): an upper-case FILE: database URL is classified as SQLite but its prefix is not stripped, so OS_DATABASE_URL=FILE:./app.db creates a directory literally named FILE:. and a database inside it #23794's half (commit 9c5853767). sqliteFilenameFromUrl in packages/runtime/src/standalone-stack.ts strips file: / file:// case-insensitively on its sqlite path, as detectDriverFromUrl classifies (/^file:/i) and as its sqlite-wasm path already stripped. The function is now exported from @objectstack/runtime (one name added to the existing standalone-stack export line in packages/runtime/src/index.ts). Nothing else in standalone-stack.ts moved: not detectDriverFromUrl, not createStandaloneStack's mkdirSync arms, not its config schema.
• CLI host, cli(storage): OS_DATABASE_URL=file://NAME opens //NAME at the filesystem root on the CLI host, where the runtime host opens ./NAME (the file: twin of the sqlite:// alias #23633 fixed) #23796's half (commits 71b52fdbf, 48728977b). resolveStorageDefinition's sqlite and sqlite-wasm arms in packages/cli/src/utils/storage-driver.ts drop their local copy (a case-sensitive /^file:/ strip, plus /^sql:\/\// on the sqlite arm and /^wasm-sqlite:\/\// on the wasm arm) and call one module-private helper, sqliteFileFor: normalizeDatabaseUrl, then the runtime's sqliteFilenameFromUrl. A URL the rule refuses is re-raised as UnsupportedDriverError (recognized, driverType = the kind) carrying the runtime host's sentence minus its [StandaloneStack] tag, the shape the CLI host's retired-engine URL refusal took on main. The class is load-bearing: serve.ts re-throws UnsupportedDriverError and silently swallows every other construction error, so passing the runtime's plain Error through would have booted with no storage at all.
• One changeset, .changeset/23794-file-url-filename-rule.md: @objectstack/runtime minor (the new export, Clause-②: yes (widening)), @objectstack/cli patch.

#23794's open question, measured

The card left this unmeasured: does the CLI host strip the prefix the same way? It does not. At base 3fed1eb00, OS_MODE=off OS_DATABASE_URL=FILE:./urd.db os serve --dev made a FILE:. directory on the CLI host as well (listing below). The one shared rule fixes both hosts.

Disk proof at the public door

Every probe ran in a scratch directory outside any repo tree, with the built CLI (node packages/cli/bin/run.js) and OS_HOME pointed into that scratch directory. Before = base 3fed1eb00; after = this branch (CLI closure rebuilt).

host · input	before	after
runtime host, plain project: OS_DATABASE_URL=FILE:./urd.db os serve	directory FILE:. holding urd.db (700416 bytes)	./urd.db (700416 bytes), no FILE: entry
runtime host, control: OS_DATABASE_URL=file:./urd.db os serve	./urd.db	(unchanged path)
CLI host (OS_MODE=off): OS_DATABASE_URL=file://proc/os23794-probe.db os serve --dev	Server is ready, then [driver-sqlite-wasm] Writing //proc/os23794-probe.db to disk failed (ENOENT …) for the main and telemetry files; nothing created under the cwd	./proc/os23794-probe.db plus its telemetry sibling under the cwd, no write failures
CLI host: OS_DATABASE_URL=FILE:./urd.db os serve --dev	directory FILE:. holding urd.db and urd.telemetry.db*	./urd.db and ./urd.telemetry.db*, no FILE: entry
CLI host: OS_DATABASE_DRIVER=sqlite OS_DATABASE_URL=postgres://PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:5999/db os serve --dev	Server is ready; directories postgres:/PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:5999/ created, holding db and db.telemetry.db*	exit 1, ✗ sqlite driver was selected but the URL does not look like a file path (its scheme is "postgres://"). Use file:/path/to/db.sqlite, or set OS_DATABASE_DRIVER explicitly.; nothing created; PLACEHOLDER appears 0 times in the output

The runtime-host boots stop afterwards on the unrelated production prerequisite OS_SECRET_KEY, before and after alike, as the card recorded. The /proc aim of the CLI-host probe is kept so nothing could be written under /.

What each host answers, before and after (mechanism assumption 1)

resolveDriverType + resolveStorageDefinition(…, { isDev: true }) for the CLI host and resolveStandaloneDatabase for the runtime host, same OS_DATABASE_URL. Before = base; after = this branch. kind (file); a refusal shows the thrown class.

driver · URL	CLI before	CLI after	runtime before	runtime after
- · file:./x.db	sqlite ./x.db	sqlite ./x.db	sqlite ./x.db	sqlite ./x.db
- · file://x.db	sqlite //x.db	sqlite x.db	sqlite x.db	sqlite x.db
- · file:///abs/x.db	sqlite ///abs/x.db	sqlite /abs/x.db	sqlite /abs/x.db	sqlite /abs/x.db
- · FILE:./x.db	sqlite FILE:./x.db	sqlite ./x.db	sqlite FILE:./x.db	sqlite ./x.db
- · File:///tmp/x.db	sqlite File:///tmp/x.db	sqlite /tmp/x.db	Error, scheme "File://"	sqlite /tmp/x.db
- · sqlite:x.db	sqlite x.db	sqlite x.db	sqlite x.db	sqlite x.db
- · sqlite://x.db	sqlite x.db	sqlite x.db	sqlite x.db	sqlite x.db
- · ./x.db	sqlite ./x.db	sqlite ./x.db	sqlite ./x.db	sqlite ./x.db
- · x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db
- · :memory:	sqlite :memory:	sqlite :memory:	sqlite (no file)	sqlite (no file)
- · file://x.wasm.db	sqlite-wasm //x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db
- · FILE:x.wasm.db	sqlite-wasm FILE:x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db	sqlite-wasm x.wasm.db
- · WASM-SQLITE://w.db	sqlite-wasm WASM-SQLITE://w.db	sqlite-wasm w.db	sqlite-wasm w.db	sqlite-wasm w.db
- · wasm-sqlite://	sqlite-wasm (empty name)	sqlite-wasm :memory:	sqlite-wasm (no file)	sqlite-wasm (no file)
sqlite · postgres://u:p@h/db	sqlite postgres://u:p@h/db	UnsupportedDriverError, scheme "postgres://"	Error, scheme "postgres://"	Error, scheme "postgres://"
sqlite · sql://x.db	sqlite x.db	UnsupportedDriverError, scheme "sql://"	Error, scheme "sql://"	Error, scheme "sql://"
sqlite · libsql://pin.turso.io	sqlite libsql://pin.turso.io	UnsupportedDriverError, scheme "libsql://"	Error	Error
sqlite · file:	sqlite (empty name)	UnsupportedDriverError, names no file	Error, names no file	Error, names no file
sqlite · empty or blank	sqlite (empty name)	sqlite :memory:	unified default file	unified default file
sqlite · unset	sqlite :memory:	sqlite :memory:	unified default file	unified default file

Behaviour changes on the CLI host beyond file:// and FILE: (reported, not hidden)

1. Newly refused, fatally: an explicit sqlite selection over a URL with a SCHEME:// that is not file: (postgres://, libsql://, wasm-sqlite://, any other), and a file: / FILE: naming no file. The first used to boot "ready" and create directories named after the URL, credentials included (measured above); the second declared an empty file name. Both are what the runtime host already refused for the same input. Remedy in the changeset: point OS_DATABASE_URL at a file, or select the driver the URL is for.
2. The undocumented sql:// strip is gone. It was reachable only under an explicit sqlite selection (URL inference refuses sql:// as an unknown scheme). git grep over the tree finds no other sql:// spelling. It is now refused like any other non-file scheme; the changeset says to write file:.
3. An empty or blank URL under an explicit sqlite / sqlite-wasm selection is read as absent: :memory:. It used to be an empty file name. Blank is absent the way inferDriverTypeFromUrl reads it; without this the rule would refuse it with "it names no file after file:", a sentence about something the operator never wrote. wasm-sqlite:// with nothing after it is :memory: the same way, by the runtime rule's own empty answer for the WASM kind.

Public surface (mechanism assumption 2)

• packages/runtime has no API-surface snapshot or export ledger: its package.json declares build, dev, typecheck, check:test-typecheck, gen:test-typecheck-debt, test, test:repo; the api-surface/ snapshot and check:exported-any are packages/spec's. Repo gates reading built output (check:dts-closure, check:published-files, check:dual-build-cjs-loads, check:lean-entry-closure, check:published-readme-exports) take no registration for a new named export. check:exported-any-returns would flag an any return; the export returns string.
• Downstream typecheck sweep not needed, with evidence: the delta is one added named export whose name collides with nothing. git grep finds no export * from '@objectstack/runtime' in this repo or in ../objectui, so no consumer can meet a star re-export ambiguity, and no other symbol is named sqliteFilenameFromUrl. The one consumer that imports it, @objectstack/cli, was typechecked against the rebuilt .d.ts (below).

Verification

Local runs are on the head named in each line; CI runs the full farm.

• Runtime pins (packages/runtime): resolve-project-database.test.ts (an it.each over FILE:./x.db, File:///tmp/x.db, FILE://x.db, FILE:./x.wasm.db and the lower-case / bare-path CONTROL rows, asserting driver and sqliteFile; a bare FILE: refused as plain Error with the names-no-file sentence) and standalone-stack.test.ts (createStandaloneStack from an empty cwd over FILE:./upper/x.db declares ./upper/x.db, equal to the file: spelling, and the cwd holds no entry matching /^file:/i).
• CLI pins (driver-vocabulary-parity.test.ts, alias block): file://x.db, file:///var/lib/objectstack/x.db, file://x.wasm.db, FILE:./x.db, File:///var/lib/objectstack/x.db, FILE:./x.wasm.db (plus the lower-case and bare-path controls) open the same file on both hosts, dev and prod; both hosts refuse explicit sqlite over a credentialed postgres:// URL, file: and FILE:, the CLI's refusal an UnsupportedDriverError with recognized: true, driverType: 'sqlite', a message equal to the runtime's minus its tag, never the runtime's verbatim, and with no credential; the blank-URL reading on the CLI host.
• Runs on the final head 48728977b (after merging origin/main at 1eac7ad75; every heavy run through scripts/pm/os-verify-lock.sh, verdict lines quoted):
  • pnpm --filter @objectstack/runtime test (vitest local project): Test Files 399 passed (399), Tests 5990 passed | 19 skipped (6009), VERDICT command-exit 0.
  • pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 src/utils/driver-vocabulary-parity.test.ts src/utils/storage-driver.test.ts src/commands/database-driver-allowlist.pin.test.ts src/utils/dev-self-heal-host-parity.test.ts: Test Files 4 passed (4), Tests 188 passed (188), VERDICT command-exit 0. The allowlist pin is in the set because it uses resolveStorageDefinition('sqlite', { databaseUrl: 'libsql://pin.turso.io' }) as an oracle: it now answers through the new typed refusal (recognized: true, driverType: 'sqlite') and still derives sqlite. The CLI integration tier is declared to CI: the diff touches no integration-tier file and no spawn entry.
  • pnpm --filter @objectstack/runtime typecheck && pnpm --filter @objectstack/cli typecheck: VERDICT command-exit 0; both check:test-typecheck: OK with their debt ledgers held.
  • pnpm exec eslint --no-inline-config over the six changed .ts files: exit 0, no output. The repo-wide lint run is the PR's Lint & Repo Gates check-run.
  • Derived gate families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (65 commands), each run once with its exit code captured before any pipe: 65 of 65 exit 0. Reconciled with --ran: 65 derived, 65 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero — all 65 recorded an exit code and none of them is 3). Also pnpm --filter @objectstack/spec check:generated (spec moved on main's side of the merge): exit 0, All 14 generated artifacts are up to date.
• Ablations (run on 71b52fdbf, before the merge and the tag-strip follow-up, neither of which touches the mutated lines), each through node scripts/ablation-replace.mjs (anchor hit 1 time, blob changed, restored to the HEAD blob with git diff HEAD empty). Both subjects are reached through relative source imports (the runtime pins import ./standalone-stack.js, the parity file imports ./storage-driver.js), so neither needed a dist/ rebuild.
  • Runtime: /^file:(\/\/)?/i back to /^file:(\/\/)?/ on the sqlite path: Tests 5 failed | 63 passed (68). Red: the FILE:./x.db, File:///tmp/x.db, FILE://x.db rows, the bare-FILE: refusal, and the createStandaloneStack case (expected 'FILE:./upper/x.db' to be './upper/x.db'). The lower-case and bare-path CONTROL rows stayed green.
  • CLI: return sqliteFilenameFromUrl(url, kind); replaced by the old local strip return url.replace(/^file:/, '');: Tests 9 failed | 90 passed (99) in the parity file. Red: the six file:// / upper-case rows and the three refusal rows. The sqlite: / sqlite:// rows, the lower-case and bare-path controls and the blank-URL case stayed green.
• Reverse verification of the cross-package type (on 71b52fdbf): with the CLI call changed to sqliteFilenameFromUrl(url, 'postgres'), tsc --noEmit in packages/cli failed with error TS2345: Argument of type '"postgres"' is not assignable to parameter of type '"sqlite" | "sqlite-wasm"', so the CLI read the rebuilt runtime .d.ts; restored and re-checked as above.

Acceptance notes

• Out of scope, measured at the public door, for the seat to file: the rule's sqlite-wasm kind refuses nothing. On the runtime host, OS_DATABASE_DRIVER=sqlite-wasm OS_DATABASE_URL=postgres://PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:5999/db os serve --dev printed Server is ready and created postgres:/PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:5999/db under the cwd: credentials in a directory name, against the module header's rule that a URL is never treated as a file path to make bogus directories. The CLI host's wasm arm gave the same file name before this PR and gives it now by the same rule (table rows sqlite-wasm · libsql://…). Not fixed here: the refusal for the WASM kind is its own wording and behaviour decision, and this card's surface is the file: strip.
• The two hosts still differ on an absent URL under an explicit sqlite selection: the CLI host's legacy path opens :memory:, the runtime host its unified default file. That difference predates this PR (rows "unset" and "empty or blank" above) and is not judged here.
• #23796 recorded a [driver-sqlite-wasm] prefix on write-failure lines while the banner read SqlDriver(better-sqlite3); the base-tree probe here showed the same pairing. Not investigated.
• origin/main moved to a31ff2eb5 after the merge, by two commits that touch neither changed file nor storage-driver.ts's neighbours (scaffold create / init and translations); not merged, the merge queue rebuilds on the current main.

Overlap, in non-closing sentences: #23765 (detectDriverFromUrl, another dev's) is untouched here, as are its parity rows. #23737's mkdirSync arms in createStandaloneStack are untouched. #23792's memory-URL refusal landed on main as PR #23840 before this PR opened; origin/main was merged at 1eac7ad75 and both sides kept. #23633's sqlite:// alias fix is the twin this completes for file://.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 2 changed package(s); no hand-written page names any of them. ⚠️ 1 changed file(s) yielded no anchor (packages/runtime/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/runtime/src/index.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 44 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f7e836da1ed344aaa6936b9de8b173d0f326b9ec → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0a2247ca442785490dd212583e72cb387926354f — the merge of head 48728977bf8c8eab7b7d0c2b4543ab17adc25897 into base f7e836da1ed344aaa6936b9de8b173d0f326b9ec, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0a2247ca442785490dd212583e72cb387926354f && git checkout 0a2247ca442785490dd212583e72cb387926354f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f7e836da1ed344aaa6936b9de8b173d0f326b9ec 48728977bf8c8eab7b7d0c2b4543ab17adc25897 && git checkout -B drift-repro f7e836da1ed344aaa6936b9de8b173d0f326b9ec && git merge --no-ff 48728977bf8c8eab7b7d0c2b4543ab17adc25897

node scripts/docs-audit/affected-docs.mjs --json f7e836da1ed344aaa6936b9de8b173d0f326b9ec

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 48728977bf8c8eab7b7d0c2b4543ab17adc25897
Local-runs: none

The face: the Clause-②: yes declaration alone (claims 6211181834 / 6211190349; changeset arm yes (widening)). No packages/spec path and no governed path is in the diff. Read: the PR's diff and the branch at this head.

① Derived judgments

• The widening is exactly one name. @objectstack/runtime's root entry (src/index.ts) adds sqliteFilenameFromUrl beside resolveStandaloneDatabase. It is the existing module-private function, now exported with an unchanged signature (dbUrl: string, kind: 'sqlite' | 'sqlite-wasm') => string; the only types it reaches are string literals. Nothing is removed or renamed.
• Why the widening is the long-term shape. The CLI host kept its own copy of this rule (.replace(/^file:/, '')), and that copy is the defect of cli(storage): OS_DATABASE_URL=file://NAME opens //NAME at the filesystem root on the CLI host, where the runtime host opens ./NAME (the file: twin of the sqlite:// alias #23633 fixed) #23796. The export replaces the copy with one rule both hosts call (sqliteFileFor in packages/cli/src/utils/storage-driver.ts). Its one in-repo importer is @objectstack/cli.
• What the exported rule promises. It strips file: / file:// case-insensitively on both kinds (runtime(standalone host): an upper-case FILE: database URL is classified as SQLite but its prefix is not stripped, so OS_DATABASE_URL=FILE:./app.db creates a directory literally named FILE:. and a database inside it #23794's fix), plus wasm-sqlite: for the WASM kind. For 'sqlite', it throws a plain Error naming the scheme, never the URL, on a URL that is not a path. Its docblock says it takes the URL after normalizeDatabaseUrl. Known limit, not widened here: the 'sqlite-wasm' kind refuses nothing, and neither kind refuses an opaque scheme. Both are carried on runtime(standalone host): with an explicit OS_DATABASE_DRIVER=sqlite, an opaque-scheme OS_DATABASE_URL (jdbc:postgresql://…) still opens a SQLite file at a path made of the URL — the explicit-driver path of #23765 #23863.

② Semver level

@objectstack/runtime minor (one new export, nothing removed); @objectstack/cli patch. That matches yes (at least minor on the widened package). No major.

③ Boundary flags

• The CLI host's legacy storage path now refuses, fatally (UnsupportedDriverError, which serve.ts re-throws), three inputs it used to build a definition for. An explicit sqlite selection over a server URL used to create directories named after the URL, credentials included. A file: URL that names no file used to declare an empty file name. The undocumented sql:// prefix used to be stripped. Each is a value the runtime host already refused. Each is written in the changeset with its fix. None is a packages/spec or REST accept set; host config refusals were declared Clause-②: no before (PR fix(cli): os serve refuses an OS_DATABASE_URL whose scheme no driver recognises, and reads pg:// and a scheme-less path as the runtime host does #23761).
• A blank URL under an explicit sqlite selection reads as :memory: on the CLI host. This is CLI-only, pinned, and stated in the changeset.
• The refusal text is the runtime's minus its [StandaloneStack] tag, by the convention PR fix(cli): the memory:// / mingo:// OS_DATABASE_URL refusal names the scheme, never the URL #23840 landed, held by the parity rows.

Implemented-by: claude/issue-23794-file-url-filename-rule
Reviewed-by: session_018t6a5rvqPRvEDMCVVW9kYT

VERDICT: PASS

[objectstack-fleet]

席位核对

ACCEPT · #23794 + #23796 (folded) · domain:cli seat 2 · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT · 2026-10-16T10:01Z · reviewed head 48728977bf8c8eab7b7d0c2b4543ab17adc25897, against GitHub and the branch, not against the report's prose.

1. Shape. Draft, base main. The body opens with Fixes #23794 and Fixes #23796, one line each, the only closing keywords. Clause-②: yes at line start in the body; the changeset carries yes (widening). Commits are one per card: 9c5853767 (runtime(standalone host): an upper-case FILE: database URL is classified as SQLite but its prefix is not stripped, so OS_DATABASE_URL=FILE:./app.db creates a directory literally named FILE:. and a database inside it #23794, runtime strip + export) and 71b52fdbf (cli(storage): OS_DATABASE_URL=file://NAME opens //NAME at the filesystem root on the CLI host, where the runtime host opens ./NAME (the file: twin of the sqlite:// alias #23633 fixed) #23796, CLI arms), then a merge of origin/main (1eac7ad75) and 48728977b (cli(storage): OS_DATABASE_URL=file://NAME opens //NAME at the filesystem root on the CLI host, where the runtime host opens ./NAME (the file: twin of the sqlite:// alias #23633 fixed) #23796, the tag). Files are inside the chain-head claim's surface, plus one module-private helper (sqliteFileFor) directly below resolveStorageDefinition, which the report declares. inferDriverTypeFromUrl is untouched. check-governed-merges --pr 23862: 0 of 7 paths governed; 211 changed lines.
2. Premise, measured. Both premises reproduced at the public door on base 3fed1eb00. Runtime host: FILE:./urd.db made a FILE:. directory. CLI host: file://proc/… aimed at //proc/… with every flush failing. The report also answers runtime(standalone host): an upper-case FILE: database URL is classified as SQLite but its prefix is not stripped, so OS_DATABASE_URL=FILE:./app.db creates a directory literally named FILE:. and a database inside it #23794's open question: the CLI host mis-stripped FILE: too. After the fix: ./urd.db and ./proc/…, and no FILE: entry. Read in the diff: the runtime's sqlite path strip gains /i; the CLI's two arms call normalizeDatabaseUrl, then the runtime rule, through one helper, and a refusal is re-raised as the fatal UnsupportedDriverError.
3. The Clause-②: yes review is the ## Contract review record 6213025619 on this PR (TIER_DEFAULT, the declaration face), PASS on this head.
4. Changeset, sentence by sentence. @objectstack/runtime minor, @objectstack/cli patch. The FILE: bullet matches the strip and the two runtime pins. The new-export bullet matches index.ts and the signature. The legacy-path bullet ("OS_MODE=off, bootMode: 'off', or a host config") is the path shouldBootWithLibrary routes away from library boot, the same as PR fix(cli): the memory:// / mingo:// OS_DATABASE_URL refusal names the scheme, never the URL #23840's reading. The refusal bullet names the three newly refused inputs, each with its fix. The blank-URL sentence matches sqliteFileFor.
5. Gates, pinned to the head. 48728977b check-runs read at review: 39; 27 success, 6 skipped (EXPECTED_SKIPS rows), 6 in_progress (Test Core 1–6/6). Landing waits for every check green or an expected skip. The dev's local subset, all on this head: 65 of 65 derived gate commands exit 0 (--ran: 0 NOT-MEASURED, 0 UNRUN); @objectstack/runtime test 399 files / 5990 tests; the four CLI unit files (188 tests); both typechecks; @objectstack/spec check:generated. Also two ablations (runtime 5 red, CLI 9 red) and a reverse type check (TS2345).
6. Accepted deviations. (1) sqliteFileFor, a private helper outside the line range the claim named, in the claimed function's file; no other region touched. (2) The CLI refusal drops the runtime's [StandaloneStack] tag, the convention PR fix(cli): the memory:// / mingo:// OS_DATABASE_URL refusal names the scheme, never the URL #23840 landed mid-run. (3) A blank URL reads as :memory: on the CLI host, pinned and stated. (4) The downstream '...@objectstack/runtime' typecheck sweep was skipped for an additive export, with its grep (no export * of the package here or in ../objectui). The only importer typechecked green.
7. Out of scope. Finding 1 (class: a+b): under an explicit OS_DATABASE_DRIVER=sqlite-wasm, a server URL (postgres://USER:SECRET@…) boots ready and creates directories named after it, credentials included. The rule's sqlite-wasm branch refuses nothing, measured at the door. This is the explicit-driver path runtime(standalone host): with an explicit OS_DATABASE_DRIVER=sqlite, an opaque-scheme OS_DATABASE_URL (jdbc:postgresql://…) still opens a SQLite file at a path made of the URL — the explicit-driver path of #23765 #23863 carries (filed from runtime(standalone host): an OS_DATABASE_URL with an opaque scheme (jdbc:postgresql://…, redis:h) is opened as a SQLite file path and creates directories, against the module's own "unknown URL schemes throw" #23765's report), so it joins that card as an enumerated location: pointer on runtime(standalone host): with an explicit OS_DATABASE_DRIVER=sqlite, an opaque-scheme OS_DATABASE_URL (jdbc:postgresql://…) still opens a SQLite file at a path made of the URL — the explicit-driver path of #23765 #23863. Findings 2 and 3 stay in Acceptance notes.

Landing: once every check on the head is green or an expected skip, this seat flips the PR ready and arms auto-merge through the relay, then follows it to MERGED. #23863 is ordered after it.

---

Generated by Claude Code