[objectstack-fleet]

Requested by Leehom · project thread
Part of #25522
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

Cut 7 of the packages/objectql/src/engine.ts split (#24586 ruling A, recorded in 6270097840). The claim is 6417034209. Three bodies of the "execute and transactions" section move unedited into a new module, packages/objectql/src/engine-execute-transactions.ts: execute, warnTransactionUnsupported and enforceTransactionOrigin. No behaviour changes. #25522 stays open for the later cuts.

Branch claude/project-thread-tsjhtm (the card thread's harness-pinned branch), cut from origin/main at a6e8f95d6 (after cut 6, 3380671aef), with main merged once at d1ea2363f because #26026 (which edits engine.ts) landed during the cut and this PR lands second. #26026's hunks sit in Autonumber, insert and update; none is in this PR's range.

Why this area (the fresh seam table)

Measured on origin/main d1ea2363f (the merged base; a first reading on a6e8f95d6 picked the same area). engine.ts is 23,241 lines, 7,344 of them (31.6%) from the last 30 days (git blame -s --since=2026-09-26T13:22Z). scripts/pm/git-history.mjs count (window covered, exit 0): 125 commits in 30 days, 32 in 7. class ObjectQL holds 318 members, 255 methods plus the constructor. Sections are cut 1's contiguous member ranges, re-located by first member name, docblocks included. "inferred public" stays; "U" counts this.FIELD.delete/insert/update( sites (AST, casts stripped); "private statics" stay.

range	section	first … last member	lines	30-day lines	methods	inferred public	U	private statics
4755-4980	Instance state and constructor	txStore … constructor	226	50	0 (0 public)	-	0	-
4981-5003	Status and registry accessor	getStatus … registry	23	0	2 (2 public)	getStatus	0	-
5004-5347	Hook and function registry	registerHook … triggerHooks	344	6	16 (16 public)	registerHook, triggerHooks	1	-
5348-5703	Hook dispatch internals	hasHooksFor … assertBulkPerRowHookBudget	356	61	7 (0 public)	-	0	-
5704-5864	Action registry and activation	registerAction … setActionActive	161	19	10 (10 public)	-	1	-
5865-6146	Registered resolvers and write-gate probes	_heldFileResolver … registerInsertRecomputeListener	282	116	6 (6 public)	-	0	-
6147-6900	Readable-ids security and permission/formula resolution	readableIdsSecurityReported … resolveDefaultPermissions	754	546	15 (2 public)	-	0	-
6901-7007	Authz invalidation and middleware registration	writeEpoch … hasObjectMiddleware	107	18	4 (4 public)	-	0	-
7008-7243	Execution plumbing (middleware, session, provenance, users)	executeWithMiddleware … buildUser	236	37	7 (0 public)	-	0	-
7244-7574	Driver options and engine posture	buildDriverOptions … resolveEnginePosture	331	209	6 (0 public)	-	0	-
7575-7784	Organization probe and system-insert organization	probeInstallOrganizations … transactionCoversDriverFor	210	45	4 (0 public)	-	0	-
7785-8150	Field defaults	resolveNowDefault … defaultFieldEntries	366	4	6 (0 public)	-	0	-
8151-8763	Autonumber	applyAutonumbers … seedAutonumber	613	80	6 (0 public)	-	1	-
8764-9428	Package, app, plugin and driver registration	registrationConversionWarned … registerDriver	665	170	6 (3 public)	registerApp, registerDriver	0	-
9429-9637	Datasource registry	supplyFileColumnsMovedResolver … listUnavailableDatasources	209	1	8 (7 public)	-	3	-
9638-9789	Write guard and realtime publish	assertWriteAllowed … publishBulkDataEvent	152	18	4 (1 public)	-	0	-
9790-9888	Validation-message i18n	setI18nService … objectDisplayLabel	99	14	4 (1 public)	-	0	-
9889-10981	Referential integrity and master-detail resolution	assertReferencesResolve … masterDeclaredFields	1093	429	12 (0 public)	-	0	-
10982-11097	Dangling-reference and cascade inspection	inspectDanglingReferences … inspectCascadeDelete	116	48	2 (2 public)	-	0	-
11098-11192	Crypto and tenancy providers	setCryptoProvider … setTenancyPostureProvider	95	20	4 (4 public)	-	1	-
11193-11612	Secret and internal-field handling	encryptSecretFields … resolveInternalField	420	61	9 (3 public)	-	0	-
11613-11681	Schema lookup and filter judging	getSchema … judgeFilter	69	48	3 (2 public)	-	0	-
11682-11947	Datasource routing	LIFECYCLE_DATASOURCE … setDatasourceMapping	266	20	8 (3 public)	setDatasourceMapping	0	-
11948-12115	Lifecycle init and health	init … resolvePrimaryDatasource	168	16	3 (3 public)	init	0	-
12116-12189	Media and value-shape presence	objectHasMediaField … valueShapeStrictFor	74	13	4 (0 public)	-	0	mediaFieldPresence, coveredValueFieldPresence
12190-12872	Migration flags and attestations	isFileReferencesMigrationVerified … wasDatastoreCreatedFromEmpty	683	81	17 (8 public)	-	0	-
12873-12895	destroy	destroy … destroy	23	0	1 (1 public)	destroy	0	-
12896-12914	Expand/cascade limits (statics)	MAX_EXPAND_DEPTH … MAX_BULK_PER_ROW_HOOK_ROWS	19	0	0 (0 public)	-	0	MAX_EXPAND_DEPTH, MAX_CASCADE_DEPTH
12915-13365	Roll-up summaries	autonumberCounters … recomputeSummaries	451	0	7 (1 public)	-	0	-
13366-13619	Related-record expansion	expandRelatedRecords … expandRelatedRecords	254	10	1 (0 public)	-	0	-
13620-14063	File-reference hydration	resolveFileReferences … readParentDerivedFiles	444	310	5 (0 public)	-	0	-
14064-14542	Query lowering	resolveWhereTokens … requireFindOnePredicate	479	272	9 (0 public)	-	0	-
14543-15099	find / findOne	find … staticReadonlyCreateStrip	557	142	4 (2 public)	-	0	-
15100-15757	validate	validate … validate	658	447	1 (1 public)	-	0	-
15758-17104	insert / insertMany	readUpdatePriorRow … insertMany	1347	439	3 (2 public)	-	1	-
17105-19038	update	update … update	1934	275	1 (1 public)	-	0	-
19039-20579	Delete cascade and reference walking	planCascadeAtomicity … organizationOwnedRowCounts	1541	733	22 (1 public)	-	0	storedReferenceIncludes, remainderAfterMemberRemoval, referenceCheckContext, outlivesOrganization, keepsOrganizationReference, organizationCountContext
20580-21149	delete	delete … delete	570	47	1 (1 public)	-	0	-
21150-21769	count / aggregate	count … aggregate	620	236	3 (2 public)	-	0	-
21770-22157	execute and transactions	execute … enforceTransactionOrigin	388	63	8 (2 public)	-	0	-
22158-22523	Compatibility API	registerObject … create	366	41	16 (16 public)	-	0	-

The per-method move screen for every section, and the pricing below, are in the project file pm-orders/server/25522-cut7-seam-table.md. A body stays if any of these holds: an inferred-return public method, a U site, a private-static read, an engine.ts#NAME pointer under packages/spec/** or docs/adr/**, a this.update( / this.insert( / this.delete( self-call, or a static. Bodies earlier cuts moved are counted as stubs, not as movable.

Pricing (net engine.ts lines): a stub costs a comment, the host literal's open and close and the .call, plus two lines per field read (a read* closure and a getter) and one per method read (a late-bound closure); the import adds three.

area	30-day lines	paying bodies	net	why not / why
Compatibility API	41 of 366	syncSchemas 63, syncObjectSchema 17, createContext 8, registerObject 9	about -69	pays slightly less, and syncSchemas holds 35 of the section's 41 recent lines; every body is public API
Hook and function registry	6 of 344	13 bodies of 1 to 14 lines; five setters write fields	about 0	does not pay
Migration flags and attestations	81 of 683	176 body lines	-	five fields written, so the host needs setters (no cut has used them); recordObservedDeviation and retractCreationAttestation self-call this.update(
Autonumber	80 of 612	101 body lines	-	#26026 edited createWithAutonumberResync in this section while the cut ran
Roll-up summaries, Datasource registry, Related-record expansion	0 / 1 / 10	46 / 27 / 0	-	as cuts 5 and 6 measured: spec-cited buildSummaryIndex and field writes; U = 3; private static MAX_EXPAND_DEPTH
Driver options, File-reference hydration, Referential integrity, Readable-ids, validate, find	142 to 546	161 to 469	-	the hottest sections; the card says take the coldest
execute and transactions (this PR)	63 of 388	3 of 8 bodies, 106 body lines	-76 measured	pays most among the cold sections; the three moved bodies carry 16 recent lines; one field-free host, no setter; no packages/spec pointer

What stays in the section: transaction (ADR-0119 cites it as engine.ts#transaction, and ADR-0067's join lives in it), and runOpenedUnit (4 body lines), isClosedUnitHandle (3), newTransactionScope (5) and datasourceNameOf (4), whose stubs would cost as much as their bodies.

The shape (#23050 shape B, as cuts 1 to 6 apply it)

• The class keeps all three methods with name, modifiers, signature, docblock and position. Each body is now one host literal plus fn.call(host, …), marked [#25522 cut 7]. execute stays public with its declared return type (a Promise of any), so it is not an inferred-return public member.
• ExecuteTransactionsHost is new: drivers, defaultDriver, txStore, transactionUnsupportedReported, logger, getDriver, datasourceNameOf, isSystemLedgerObject, each typed as the class member (ObjectQL['txStore']). Each moved function types its this as the Pick of exactly the members its body reads, and each stub annotates its literal as ThisParameterType of that function. There is no cast, and no member changes visibility.
• The five fields go as GETTERS (registerDriver replaces the driver map's contents and the default), so each read happens when the body makes it. The three methods go as late-bound closures over the instance, so a double or spy set on the engine still intercepts.
• warnTransactionUnsupported keeps its default parameter (declaredUnsupported = false) on both the method and the function; the stub passes the value it received.
• Imports. The module imports ObjectQL as a TYPE only and nothing re-exports it. engine.ts drops CrossDatasourceTransactionWriteError from its transaction-errors.js import, because its last code reader moved; three docblocks that stay still name it in a {@link} (on planCascadeAtomicity, transaction and enforceTransactionOrigin); their text is unchanged, so the published .d.ts, which prints the public transaction docblock, is byte-identical (measured below). redactPropagatedDriverFault and TransactionUnsupportedError still have readers in engine.ts and stay. The module-scope ScopedContext helper's call engine.warnTransactionUnsupported?.(…) still reaches the method on the class.

Net lines (the seat's rule)

engine.ts goes from 23,241 to 23,165 lines, net -76 (31 added, 107 removed). The module is 199 lines: the header and host interface (about 66), three one-line docblocks, and the 106 moved body lines with their signatures. The diff is 346 changed lines over 3 files (+239 / -107), far under the 3,000-line human-merge threshold.

The published .d.ts does not change (ruling 6348891160)

Base: @objectstack/objectql built with engine.ts restored from d1ea2363f and the new module removed (tree only; restored with git checkout HEAD --, blob hashes compared, git status clean). Head: built at afe19760a, then rebuilt after the base leg and compared again. The head dist/index.mjs carries execute.call(host once and the base build has it zero times, so each leg built the source it names. All six declaration files are byte-identical:

file	sha256, base = head
core.d.ts	1d20303a455a909e4b55fd0802fb0b0bcb59ec51784daf27d5ef4c0659410953
index.d.ts	0454d5e70b156d8effbf27b8915587c7cbee241dcd7d698013c0a4c369a02aa5
util-CVzOGxAn.d.ts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53
core.d.mts	ef178bf0725eccc2f358f082ce13dc5122a6d5a53c19ef630017256f67de03b4
index.d.mts	ccf900240aa137abe72f82b8abfc872d42c5645467400134c580285f2a3b3090
util-CVzOGxAn.d.mts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53

Positive control: removing private from enforceTransactionOrigin in the head source and rebuilding (at b481820cd; the edit's landing checked by occurrence count, 1 private / 0 public before, 0 / 1 after) changed all six hashes, and the chunk name with them (util-CcX3xT6f.d.ts f3f2303e…7731d, index.d.ts 9bd53e88…67ce). Restored with git checkout HEAD -- and blob hash compared. Export lists are the same for ESM and CJS at both ends: . 182 names (sorted sha256 881616cc…0adaa) and ./core 54 (393e8069…90f49). No moved name is exported. The same six-file comparison against a6e8f95d6 (before the merge) was also byte-identical.

Proof of move-only

A TypeScript-AST leaf-token compare (recursive getChildren, JSDoc skipped) of base engine.ts (d1ea2363f) against the head module:

• For each of the three, the parameters (less this, default value included), return type, type parameters and body tokens are SAME, async matches, and every body line equals the base line less two leading spaces, comments included: execute 263 tokens / 55 lines, warnTransactionUnsupported 89 / 26, enforceTransactionOrigin 142 / 25.
• Negative controls: flipping === to !== in the moved execute (params === undefined) reports DIFFER; editing only one comment in the moved enforceTransactionOrigin fails the line rule. Both exit 1, and the module was restored from HEAD and blob hash compared after each.
• Class: 318 members at both ends, in the same order. 315 are byte-identical (full text, docblocks included), and the 3 stubs keep docblock, modifiers and signature byte-identical up to the body.
• Top level: 228 of 230 base statements are byte-identical in head. The other two are the class and the narrowed transaction-errors.js import. Head adds the new module import with its comment.

Readers of the moved lines

• ADR anchor (migrated in this PR). scripts/adr-anchors/packages__objectql__src__engine.ts.json carries one paragraph, the transaction seam, and it describes enforceTransactionOrigin (plus buildDriverOptions and TransactionScope, which stay). Per the card, the new module gets its own entry carrying that paragraph verbatim: scripts/adr-anchors/packages__objectql__src__engine-execute-transactions.ts.json, ADR-0057, ADR-0067 and ADR-0119, each named in the module (the moved enforceTransactionOrigin body cites ADR-0057 §3.6, and the module header names all three). This is a data row the existing check-adr-anchors reads (one JSON file per anchored path, no index to register), not a new gate; the engine entry stays as it is, because all three ids and the stubs it describes remain in engine.ts. check-adr-anchors at base d1ea2363f: 88 anchored files, 1,879 decision-letter citations; at head: 89 anchored files, 1,879 decision-letter citations (also 88 / 1,879 at a6e8f95d6). The moved bodies cite no decision letter, and the module header uses none.
• No engine.ts#NAME pointer anywhere names the three. docs/adr/0096 names engine.ts beside engine.execute() (file-level); the method is still on the class, so it still resolves.
• No gate or source-reading test matches the moved text: every scripts/ reader of engine.ts was screened, and the 32 test files that read engine.ts from disk. The two packages/core door pins and the packages/types caller pin (which walk every .ts file) were run and are green.
• packages/spec/liveness: 46 evidence strings cite engine.ts, and none quotes text from the moved bodies (screened for their identifiers and refusal strings).
• Census and receivers. check-tenant-audit-census is green (243 write call sites; the moved bodies hold no this.FIELD.delete/insert/update( site). check:logger-receiver-detach is green (two moved bodies read logger through a getter, so the receiver is kept), and so are check-system-context-census and check:durability-log-level.

Acceptance notes

• Prose that names engine.ts beside a moved method still resolves by method name, because every method stays on the class (for example transaction-errors.ts naming enforceTransactionOrigin). Left as it is.
• The engine anchor paragraph now sits on two files, each describing the half it holds; the paragraph is carried verbatim, as the card asks, rather than split.
• Serial check, re-read before pr_create: 36 PRs are open; the only one on packages/objectql/** is test(objectql): load the package entry with hook-run-as.test.ts, not inside its case #26132 (hook-run-as.test.ts only). fix(objectql,types,rest)!: a database NOT NULL refusal on a declared field is the record validator's ValidationError at every door #26026 landed during the cut and is merged in. origin/main moved five commits after the merge, none on packages/objectql/** or scripts/adr-anchors/**, and dispatch-gates printed no stale-tree warning, so it was not merged again.
• Next cut from this screen: Compatibility API (about -69, with syncSchemas hot); nothing else pays without a ruling (Migration flags needs setters).

Verification

At afe19760a (the merged head):

• pnpm --filter @objectstack/objectql typecheck (tsc --noEmit + check:test-typecheck, 39 files / 233 errors / 64 pinned signatures held): VERDICT command-exit 0. pnpm exec eslint --no-inline-config packages/objectql: exit 0.
• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 471 files, 8,774 tests passed. Before the merge, at b481820cd: 470 files, 8,748 passed. The run includes engine-transaction-contract.test.ts, engine-transaction-declared-unsupported.test.ts, engine-transaction-observability.test.ts, engine-transaction-same-origin.test.ts and engine-scoped-transaction-late-write.test.ts.
• packages/core row-serving-door-exposure.pin.test.ts + second-object-read-exposure.pin.test.ts: 2 files, 7 tests passed; packages/types driver-error-classification.callers.test.ts: 11 passed.
• Dependants: every changed member keeps its declaration and all six published .d.ts files are byte-identical, so no dependant can see a difference. CI's TypeScript Type Check covers them.
• Gates at afe19760a: dispatch-gates --commands derived 66 families on the real diff. Every one was run, each exit code captured before any pipe, then reconciled with --ran: 66 accounted for, 65 run, 1 NOT MEASURED. NOT MEASURED (CI runs it): check:dual-build-cjs-loads, exit 3, PREREQUISITE NOT MET (it needs every package's dist/; the export lists above answer it for objectql). Named readings: check-system-context-census OK (151 read sites, 144 of 144 symbols cited), check:logger-receiver-detach OK (3,733 files, 0 detaches), check:durability-log-level exit 0, check-engine-split-ratio --days 90 97.6%.
• Hand gates outside the derivation, all exit 0 at afe19760a: check-adr-anchors at base and head (above), check-adr-symbol-anchors (2,658 anchors resolve), check-tenant-audit-census (243 write call sites), check-nul-bytes, check-platform-checklist --changed-from origin/main (13 anchors judged, 0 lost) and check-commit-card-trailers --range origin/main..HEAD.
• No ablation, because no tested behaviour changed. test:repo was not run locally; CI's Test Core runs it.

skip-changeset: move-only. The published .d.ts files and export lists are byte-identical, liveness/ and every other published path are untouched, and the module's runtime is the same code under a different file name.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 15 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via isSystemLedgerObject (symbol, a field of interface ExecuteTransactionsHost), isSystemLedgerObject (literal, a string literal in enforceTransactionOrigin; a string literal in isSystemLedgerObject))

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a335f1defbea57ffe552d2e9efc5ad8d56a2e76a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 287ac44fa9d8040a2cacac3d1ae655e2a5a3cfbd — the merge of head afe19760a0b4d102c3938beb3a7aa3609bedf7b2 into base a335f1defbea57ffe552d2e9efc5ad8d56a2e76a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 287ac44fa9d8040a2cacac3d1ae655e2a5a3cfbd && git checkout 287ac44fa9d8040a2cacac3d1ae655e2a5a3cfbd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a335f1defbea57ffe552d2e9efc5ad8d56a2e76a afe19760a0b4d102c3938beb3a7aa3609bedf7b2 && git checkout -B drift-repro a335f1defbea57ffe552d2e9efc5ad8d56a2e76a && git merge --no-ff afe19760a0b4d102c3938beb3a7aa3609bedf7b2

node scripts/docs-audit/affected-docs.mjs --json a335f1defbea57ffe552d2e9efc5ad8d56a2e76a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a335f1defbea57ffe552d2e9efc5ad8d56a2e76a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T14:37Z · head afe19760a0b4d102c3938beb3a7aa3609bedf7b2 · #25522 cut 7

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape: a draft against main. The body opens with Part of #25522 (⛔ not Fixes; the card stays open for later cuts). Clause-②: no and Metadata-protocol: none are line-initial. skip-changeset applies: the change is move-only. check-governed-merges --pr 26160: NOT governed, 346 changed lines.
2. Premise measured: the claim 6417034209 asked for a seam table re-measured after cut 6; it is at pm-orders/server/25522-cut7-seam-table.md and in the PR body, and picks "execute and transactions", the area cut 6 proposed (engine.ts net −76). execute, warnTransactionUnsupported and enforceTransactionOrigin move into engine-execute-transactions.ts through ExecuteTransactionsHost (getDriver as a late-bound closure, drivers and defaultDriver as getters). The seat compared every line removed from engine.ts with the new module after stripping indentation: each one is present there, except the transaction-errors import, which now names only what the class still reads. The engine.ts ADR anchor paragraph that describes enforceTransactionOrigin is carried verbatim by a new scripts/adr-anchors data entry for the existing gate (88 → 89 files, 1,879 = 1,879 decision letters), not a new gate. The dev merged main once after fix(objectql,types,rest)!: a database NOT NULL refusal on a declared field is the record validator's ValidationError at every door #26026 landed and re-ran everything there: the objectql suite at 471 files / 8,774 tests green, the AST move proof 3/3 SAME with two negative controls, six .d.ts byte-identical with a positive control, and ESM = CJS exports.
3. Gates: at this stamp the head's 52 check-runs read 36 success and 16 skipped (path-filtered), with none failing or in progress; mergeable, clean. The dev reports 65 of 66 derived gate families run green locally at afe19760a, reconciled with --ran; the one not measured (dual-build-cjs-loads) is CI's, and the export lists ESM = CJS answer it for objectql.
4. Accepted deviations: none beyond the series shape. The proposed next cut, "Compatibility API", is noted for cut 8.
5. Out of scope: none filed.
6. Landing: this seat runs pr_ready and then automerge_enable through the relay, confirms MERGED on both readings, and records the landing on [maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522 with a Release: back to pm:queue for cut 8.

---

Generated by Claude Code