test(dogfood): pin the undeclared-key refusal on the suite's SQL driver arms (#15953 slice 7)

[objectstack-fleet]

Part of #15953
Clause-②: no

What this is

Slice 7 of the card: row 10 of the classification table (comment 6115219467), the per-driver half, as the slice-7 claim (6217542057) scopes it. It is one new test file, packages/qa/dogfood/test/undeclared-key-conformance.test.ts, beside read-coercion-conformance.test.ts and in its style.

On every SQL driver arm the dogfood conformance files run, it pins that a key the object does not declare is refused by the ENGINE as one envelope, whether the caller wrote it or a before-hook stamped it. The table, read straight past the engine through knex, holds nothing the refused write carried. This is the platform's own pin for what hotcrm's test/undeclared-key-probe.test.ts asserted, so objectstack-ai/hotcrm#1583 can retire that file.

• No source change anywhere.
• @objectstack/dogfood is private: true, so there is no changeset. The seat applies skip-changeset.
• The card stays open for the date-window family's residue and the acceptance clause "runs from os verify on hotcrm's metadata".

The arms

• driver-sql on better-sqlite3 :memory:. This arm is the table's "memory", read as the claim rules: the driver-memory arm left the conformance files in driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704, and this is the arm read-coercion-conformance.test.ts runs. It is also the table's "sqlite".
• driver-sqlite-wasm :memory:. Covered by measurement. The suite already runs this arm (date-bucket-parity-conformance.test.ts, group-key-read-shape-parity.test.ts), and here it boots under ObjectQL and syncs its schema.

What each arm answers today, measured before anything was pinned

The setup is ObjectQL over each real driver with a system context. probe_quote declares tax_rate and probe_quote_line does not (hotcrm's declared/undeclared pair). The reading was taken on the built engine and drivers at base 161aee104, and the pinned file re-ran green at the final head.

write carrying tax_rate onto probe_quote_line	driver-sql	sqlite-wasm
caller insert, caller update	refused: Error, code INVALID_FIELD, status 400, field tax_rate, object probe_quote_line	the same
beforeInsert hook stamps it	the same envelope	the same
beforeUpdate hook, by id	the same envelope	the same
beforeUpdate hook, by predicate (multi: true)	the same envelope	the same
the table after each refusal	unchanged	unchanged
the same hook on probe_quote, which declares the key	stored 7	stored 7

No arm departs from one envelope, so there was no defect to stop at. The objectql pins (engine-post-hook-undeclared-field.test.ts, engine-undeclared-key-caller-path.test.ts) prove the door against driver doubles only, and say so. This file is the half on the shipped drivers.

The cases (six per arm, twelve in all)

1. Control: a declared key round-trips through insert, update, findOne and the knex read.
2. Control: the same hook stores the same key on the object that declares it. So a refusal can never mean "hooks never ran on this arm".
3. Caller insert: INVALID_FIELD / 400, naming the field and the object. The table is empty.
4. Caller update: the same envelope, and the row is unchanged.
5. Hook insert: code and status as above, and the same envelope, field for field, as the caller path's answer on that arm. The table is empty.
6. Hook update, by id and by predicate: the same, and both rows are unchanged.

The envelope is projected from the engine's own error (code, status, field, object) and never rebuilt in the test. The hook path is compared with the caller path's measured answer. No message text is pinned.

Ablation (one, on the fixture)

• Mutation: the probe hook on probe_quote_line writes a DECLARED key instead. const LINE_HOOK_WRITES = { [KEY]: 7 }; becomes { unit_price: 7 }, through scripts/ablation-replace.mjs: anchor x1 to x0, replacement x0 to x1, blob 878a1b97a7cc to 8c606255f1ce. A trap in the ablation script restores on exit.
• Reading: predicted 4 failed | 8 passed, read 4 failed | 8 passed. Both hook-path cases failed on both arms, each with "expected the engine to refuse, and it answered". The controls and the caller path stayed green.
• Restore: the blob is back to 878a1b97a7cc, equal to HEAD's; git diff HEAD and git status --porcelain are both empty.
• No build leg: the mutated file is the test itself, which vitest loads from source, so there was no build or dist leg to run.

Tests and gates, at 04185a291

• pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 --reporter=verbose test/undeclared-key-conformance.test.ts test/read-coercion-conformance.test.ts: 2 files, 14 passed.
• pnpm --filter @objectstack/dogfood typecheck: exit 0, after a build of the whole @objectstack/dogfood^... closure. tsc --listFiles includes the new file.
• pnpm exec eslint --no-inline-config packages/qa/dogfood/test/undeclared-key-conformance.test.ts: exit 0 with 0 messages, and the file was linted, not ignored. The repo-wide lint is CI's Lint & Repo Gates.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): 53 derived, 53 run, all exit 0. --ran reconciles 53 / 53 / 0 NOT-MEASURED / 0 UNRUN.
  • check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: 8 packages outside the dogfood closure had no dist/). It exited 0 after those were built.
• Declared to CI, not run locally: the rest of the dogfood suite (the Dogfood Regression Gate, three shards) and test:repo (Test Core).

Acceptance notes

• Wall time. The twelve cases take about 200 ms. The file's local wall (15 s on a shared box) is module import of the built objectql and drivers. Dogfood is excluded from Test Core, whose per-file captures feed the 10 s line, so this file is outside that reading.
• A driver-memory arm was not added. bootStack({ databaseDriver: 'memory' }) can still boot driver-memory in this suite; the analytics isolation pins use it as a two-driver equivalence arm. This slice follows the claim's reading of "memory". Noted, not filed; carrier: none.
• origin/main moved after the merge. This branch merged 6d1660dc3, and origin/main then moved to 68ffa5dc1. That is one commit (PR refactor(rest): move registerSearchEndpoints into search-routes.ts (#23050 slice 9) #23959), touching other dogfood files (authz-conformance.test.ts and its census) and packages/rest. Neither reads this file or anything it imports, so the branch was not re-merged.
• Left alone, as the claim says:
  • the objectql write-path half of row 10 (it landed with verify family split (#15953), engine rows: objectql and driver-sql regression tests that replace hotcrm's platform-semantics pins (rows 3, 4-5, 7, 8, 10, 11) #23603);
  • the date-window family's residue;
  • packages/verify.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 68ffa5dc1af1abeb012cd1ed7dfa18be4c07a8c4 → packageMentionDocs.

[objectstack-fleet]

席位核对

ACCEPT · #15953 slice 7 (row 10's driver conformance) · domain:cli seat 2 · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT · 2026-10-16T15:41Z · reviewed head 04185a2914, against GitHub and the branch, not against the report's prose. Holder of claim 6217542057; report on #15953.

1. Shape. Draft, base main, assignee os-tesla. Line 1 is Part of #15953: the card keeps the date-window residue and the hotcrm acceptance clause. Line 2 is Clause-②: no, and the body has no closing keyword. One file, +220 / −0: packages/qa/dogfood/test/undeclared-key-conformance.test.ts, new. check-governed-merges --pr 23976: NOT governed. git merge-tree is clean against origin/main.
2. No source change. The diff is the one test file. The dev measured both arms before pinning: a scratch probe over the built dist at base 161aee104. Neither arm departs from one envelope, so there was no defect to stop at.
3. The arms, read in the file. describe.each runs over two arms:
   • driver-sql on better-sqlite3 :memory:, which is the table's "memory" and "sqlite", as the claim reads them. driver-memory left the conformance files in driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704.
   • driver-sqlite-wasm :memory:, the arm date-bucket-parity-conformance.test.ts runs.
4. What it pins, per arm.
   • Two controls: a declared key round-trips; the same hook stores the same key on the object that declares it. So a refusal can never mean "hooks never ran".
   • The caller path: an insert and an update carrying tax_rate are INVALID_FIELD / 400, and nothing is stored.
   • The hook path: beforeInsert and beforeUpdate (by id and by predicate) answer the caller path's envelope, compared field for field. The table, read past the engine through knex, is unchanged.
   • One ablation (the hook writes a declared key instead) turned exactly the 4 hook-path cases red (2 per arm). The restore was proven by blob.
5. Changeset: none. @objectstack/dogfood is private: true, and this seat applied skip-changeset on its own check.
6. Contract review: none is owed. One test file in a private package: no face. This seat's read is the review.
7. Gates, pinned to the head. Check-runs on 04185a2914 read at this stamp, latest run per name: 41 names, 32 success, 9 skipped, 0 failure, nothing running. The successes include Build Core, Test Core 1–6/6, TypeScript Type Check and the four Type Check · lanes, all eight Lint · lanes, Lint & Repo Gates, Spec property liveness, Governed Surface Queue Guard and the aggregate Dogfood Regression Gate. The 9 skips are roster names: Build Docs, Console Pin Gate, Dogfood Regression Gate (matrix), Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance, and the label-event re-runs of Auto Label, Check PR Size and Check Changeset. The dev's local subset at this head: 53 of 53 derived gate commands exit 0 (--ran: 0 NOT-MEASURED, 0 UNRUN). The new file and its neighbour gave 14 passed, and the dogfood typecheck exits 0 with the file compiled. On a PR the dogfood shards are path-skipped, so the new file's first CI run is main's full battery. This seat watches it after landing.
8. Accepted deviations:
   • builds through turbo's shared cache under the lock;
   • two lock queue-timeouts behind cli/runtime: os start with an uncreatable OS_HOME hangs in Node's recursive mkdirSync (176,004 failing calls in 20 s) — the family-closing card for the remaining recursive-mkdir sites after #23696 and #23737 #23858's long restore leg (NOT MEASURED, then re-queued);
   • no re-merge after origin/main moved one commit (PR refactor(rest): move registerSearchEndpoints into search-routes.ts (#23050 slice 9) #23959, disjoint);
   • the engine's default logger left on, as its real-driver neighbour does.

Out of scope, noted, not filed (承接者:无): bootStack({ databaseDriver: 'memory' }) can still boot driver-memory inside this suite (the analytics isolation pins use it). The engine door is pre-dispatch, so that arm would answer the same, and objectql's double-based pin covers it.

Landing: once every check on the head is green or an expected skip, this seat flips the PR ready and arms auto-merge through the relay, then follows it to MERGED.

---

Generated by Claude Code