[objectstack-fleet]

Requested by Leehom · project thread
Part of #25522
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

维护者速读

• 改了什么：把 engine.ts 里「迁移标志与证明」一段的 8 个方法体原样搬进新文件 engine-migration-flags.ts，类上方法签名与注释不变，只把方法体换成转交；顺手改正第 12 刀留下的两处过时说明（一行文件头注释、一个 ADR 锚条目）。engine.ts 22,517 → 22,423 行。
• 为什么改：[maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522 按缝拆分 engine.ts 的第 13 刀；本段在刀前重测的缝表里净减行最多，且不与在途 PR 重叠。席位为本刀裁定了「宿主 setter」：被搬方法体写入的类字段，经宿主上的一对 get/set 访问器写回实例。
• 风险与回滚：纯搬移，无行为变化；公开 .d.ts 六个文件逐字节不变；setter 的读写回实例由一次性探针在新旧两版上逐行对照证明。回滚 = revert 本 PR。
• 先看：packages/objectql/src/engine.ts 里 announceOpenMigrationGates 的转交桩（唯一带 setter 的一处）、packages/objectql/src/engine-migration-flags.ts（搬入的方法体与 MigrationFlagsHost）、scripts/adr-anchors/packages__objectql__src__engine-execute-transactions.ts.json（锚段落去掉重复的一半）。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2，应见 472 个测试文件全部通过。
• 需要你做的：无，席位落地。

Cut 13 of the packages/objectql/src/engine.ts split (#24586 ruling A, recorded in 6270097840). The claim is 6430872749, which carries the seat's host-setter ruling for this cut. Eight bodies of the "Migration flags and attestations" section move unedited into a new module, packages/objectql/src/engine-migration-flags.ts: supplyTenantKeyCertifiedResolver (hand a driver the "is this database certified" question), isOrganizationOwnershipCertified (its answer), readFileReferencesFlagRow and isValueShapesMigrationVerified (the two memoized flag readers), readMigrationFlagVerified (the one sys_migration row read behind them), noteAdmittedValueShapeViolation (tally a violation this boot admitted), announceOpenMigrationGates (the once-per-boot open-gate advisory) and wasDatastoreCreatedFromEmpty. Two stale path readers of cut 12 are corrected in the same PR. No behaviour changes. #25522 stays open for the later cuts.

Branch claude/project-thread-9q75rj (the card thread's harness-pinned branch), cut from origin/main at 756220c4a, which contains cut 12's merge (2e7127bc3a, #26371). Nothing was edited before that merge landed: the move was dry-run on #26371's head while it was in the queue, and the four files committed here are byte-identical to that dry run (git hash-object, 4 of 4; engine.ts at 756220c4a is the same blob, a17c9e9b93e6, as at #26371's head).

What changes

Why this area

Re-measured on 756220c4a with cut 11's scripts, unchanged (both screens: query-options erasure sites and module-helper closure). engine.ts is 22,517 lines, 7,134 of them from the last 30 days (git blame --since=2026-09-27T01:21Z). scripts/pm/git-history.mjs count: 131 commits in 30 days, 35 in 7. class ObjectQL holds 318 members, 255 methods and accessors.

Seam table at 756220c (41 sections)

range	section	first … last member	lines	30-day lines	methods	inferred public	U	private statics
4698-4923	Instance state and constructor	txStore … constructor	226	50	0 (0 public)	-	0	-
4924-4946	Status and registry accessor	getStatus … registry	23	0	2 (2 public)	getStatus	0	-
4947-5290	Hook and function registry	registerHook … triggerHooks	344	6	16 (16 public)	registerHook, triggerHooks	1	-
5291-5646	Hook dispatch internals	hasHooksFor … assertBulkPerRowHookBudget	356	61	7 (0 public)	-	0	-
5647-5807	Action registry and activation	registerAction … setActionActive	161	19	10 (10 public)	-	1	-
5808-6089	Registered resolvers and write-gate probes	_heldFileResolver … registerInsertRecomputeListener	282	116	6 (6 public)	-	0	-
6090-6843	Readable-ids security and permission/formula resolution	readableIdsSecurityReported … resolveDefaultPermissions	754	546	15 (2 public)	-	0	-
6844-6950	Authz invalidation and middleware registration	writeEpoch … hasObjectMiddleware	107	18	4 (4 public)	-	0	-
6951-7128	Execution plumbing (middleware, session, provenance, users)	executeWithMiddleware … buildUser	178	45	7 (0 public)	-	0	-
7129-7337	Driver options and engine posture (stubs, cut 12)	buildDriverOptions … resolveEnginePosture	209	150	6 (0 public)	-	0	-
7338-7547	Organization probe and system-insert organization	probeInstallOrganizations … transactionCoversDriverFor	210	45	4 (0 public)	-	0	-
7548-7913	Field defaults	resolveNowDefault … defaultFieldEntries	366	4	6 (0 public)	-	0	-
7914-8526	Autonumber	applyAutonumbers … seedAutonumber	613	80	6 (0 public)	-	1	-
8527-9191	Package, app, plugin and driver registration	registrationConversionWarned … registerDriver	665	170	6 (3 public)	registerApp, registerDriver	0	-
9192-9400	Datasource registry	supplyFileColumnsMovedResolver … listUnavailableDatasources	209	1	8 (7 public)	-	3	-
9401-9552	Write guard and realtime publish	assertWriteAllowed … publishBulkDataEvent	152	18	4 (1 public)	-	0	-
9553-9651	Validation-message i18n	setI18nService … objectDisplayLabel	99	14	4 (1 public)	-	0	-
9652-10655	Referential integrity and master-detail resolution	assertReferencesResolve … masterDeclaredFields	1004	415	12 (0 public)	-	0	-
10656-10771	Dangling-reference and cascade inspection	inspectDanglingReferences … inspectCascadeDelete	116	48	2 (2 public)	-	0	-
10772-10866	Crypto and tenancy providers	setCryptoProvider … setTenancyPostureProvider	95	20	4 (4 public)	-	1	-
10867-11286	Secret and internal-field handling	encryptSecretFields … resolveInternalField	420	61	9 (3 public)	-	0	-
11287-11355	Schema lookup and filter judging	getSchema … judgeFilter	69	48	3 (2 public)	-	0	-
11356-11621	Datasource routing	LIFECYCLE_DATASOURCE … setDatasourceMapping	266	20	8 (3 public)	setDatasourceMapping	0	-
11622-11789	Lifecycle init and health	init … resolvePrimaryDatasource	168	16	3 (3 public)	init	0	-
11790-11863	Media and value-shape presence	objectHasMediaField … valueShapeStrictFor	74	13	4 (0 public)	-	0	mediaFieldPresence, coveredValueFieldPresence
11864-12546	Migration flags and attestations (this PR)	isFileReferencesMigrationVerified … wasDatastoreCreatedFromEmpty	683	81	17 (8 public)	-	0	-
12547-12569	destroy	destroy … destroy	23	0	1 (1 public)	destroy	0	-
12570-12588	Expand/cascade limits (statics)	MAX_EXPAND_DEPTH … MAX_BULK_PER_ROW_HOOK_ROWS	19	0	0 (0 public)	-	0	MAX_EXPAND_DEPTH, MAX_CASCADE_DEPTH
12589-13039	Roll-up summaries	autonumberCounters … recomputeSummaries	451	0	7 (1 public)	-	0	-
13040-13293	Related-record expansion	expandRelatedRecords … expandRelatedRecords	254	10	1 (0 public)	-	0	-
13294-13491	File-reference hydration (stubs, cut 11)	resolveFileReferences … readParentDerivedFiles	198	183	5 (0 public)	-	0	-
13492-13970	Query lowering	resolveWhereTokens … requireFindOnePredicate	479	272	9 (0 public)	-	0	-
13971-14527	find / findOne	find … staticReadonlyCreateStrip	557	142	4 (2 public)	-	0	-
14528-15185	validate	validate … validate	658	447	1 (1 public)	-	0	-
15186-16532	insert / insertMany	readUpdatePriorRow … insertMany	1347	439	3 (2 public)	-	1	-
16533-18466	update	update … update	1934	275	1 (1 public)	-	0	-
18467-20007	Delete cascade and reference walking	planCascadeAtomicity … organizationOwnedRowCounts	1541	733	22 (1 public)	-	0	6 statics
20008-20577	delete	delete … delete	570	47	1 (1 public)	-	0	-
20578-21197	count / aggregate	count … aggregate	620	236	3 (2 public)	-	0	-
21198-21506	execute and transactions	execute … enforceTransactionOrigin	309	74	8 (2 public)	-	0	-
21507-21799	Compatibility API	registerObject … create	293	52	16 (16 public)	-	0	-

The full per-method screen and price list are in the project file pm-orders/server/25522-cut13-seam-table.md; the move script is pm-orders/server/evidence/25522/move-cut13.mjs.

area	paying bodies under both screens	30-day lines in them	net	verdict
Migration flags and attestations (this PR)	8 bodies (154 lines)	50 of 154	priced -91; -94 measured	pays most; its one field write is the setter the seat ruled
Readable-ids security and permission/formula resolution	6 bodies (three more stay on shared module helpers)	78 of 127	about -87	second; the hottest section in the file (546 of 754 lines from the last 30 days)
Package registration, count, Delete cascade and the rest	-	-	-30 to 0	blocked by a shared helper, or pays little

Nine members of the section stay: isFileReferencesMigrationVerified (ADR-0104 names it by path), recordObservedDeviation and retractCreationAttestation (each writes through this.update, a self-call the screen keeps in the class), and six bodies too short to pay for a host (haveFileColumnsMoved, readMigrationFlagMemoized, readMigrationFlagRowMemoized, valueShapeViolationsAdmitted, admittedViolationSink, invalidateDataMigrationFlags). Every field of the section stays declared where it was.

The shape

• The class keeps all eight methods with name, modifiers, signature, docblock and position. Each body is now one host literal of exactly the MigrationFlagsHost members it reads, plus a .call, marked [#25522 cut 13], as cuts 8, 10, 11 and 12 did. Fields go as getters over a readX closure (logger, _registry, admittedValueShapeViolations, drivers); methods go as late-bound closures (isOrganizationOwnershipCertified, findOne, readMigrationFlagRowMemoized, readMigrationFlagMemoized, recordObservedDeviation, retractCreationAttestation, objectHasMediaField, objectHasCoveredValueField, readMigrationFlagVerified), so a spy or double set on the engine is still the one a call reaches.
• The setter (seat ruling for this cut). announceOpenMigrationGates is the one moved body that ASSIGNS a field (this.migrationGatesAnnounced = true). Its host carries the accessor pair get migrationGatesAnnounced() { return readMigrationGatesAnnounced(); }, set migrationGatesAnnounced(v) { writeMigrationGatesAnnounced(v); }, where writeMigrationGatesAnnounced = (v: ObjectQL['migrationGatesAnnounced']) => { this.migrationGatesAnnounced = v; } closes over the instance as the getters' readX do. The field stays declared on the class with its initialiser and modifiers untouched; MigrationFlagsHost types it migrationGatesAnnounced: ObjectQL['migrationGatesAnnounced'], not readonly. No other moved body assigns a field, so no other setter exists (noteAdmittedValueShapeViolation calls .set on the admittedValueShapeViolations map it reads; that is a read of the field).
• One named host. MigrationFlagsHost types each member as the class member (ObjectQL['logger'] and so on); each function's this is the Pick of what it reads. The module imports the engine only as a type.
• One type gains export. MigrationFlagRead (the shape of one sys_migration flag read) is the return type of two moved bodies and of members that stay. It stays declared in engine.ts, byte for byte, and gains export in place so the module can name it with import type; no second copy, and no runtime import of engine.ts. index.ts names its exports singly, so the published .d.ts does not move (below).
• Imports. The module imports DATA_MIGRATION_FLAG_OBJECT, the three migration ids, ORGANIZATION_OWNERSHIP_SHAPE_GENERATION, organizationOwnershipShapeGenerationOf, isDataMigrationFlagVerified and hasMovedFileColumns (@objectstack/spec/system), ExecutionContext (type), IDataDriver (type, @objectstack/core), isMissingTableError, valueShapePostureSetByEnv, mediaPostureSetByEnv and the type AdmittedValueShapeViolation. engine.ts drops VALUE_SHAPES_MIGRATION_ID, ORGANIZATION_OWNERSHIP_MIGRATION_ID, ORGANIZATION_OWNERSHIP_SHAPE_GENERATION, organizationOwnershipShapeGenerationOf, hasMovedFileColumns, valueShapePostureSetByEnv and mediaPostureSetByEnv, whose last code readers moved (hasMovedFileColumns is still named in a docblock that stays), and gains the module import with a three-line comment.
• The module header names what moved, what stays and why, and names ADR-0104 and ADR-0131 without a decision letter.

Net lines (the seat's rule)

engine.ts goes from 22,517 to 22,423 lines, net -94 (66 added, 160 removed). The module is 295 lines. With the two path readers below, the diff against origin/main is 527 changed lines over 4 files (+364 / -163).

Readers of the moved lines

• No reader of the moved bodies needed a change. No objectql/src/engine.ts#NAME pointer under packages/spec/**, docs/adr/**, docs/qa/**, content/** or scripts/** names a moved member (ADR-0104's pointer names isFileReferencesMigrationVerified, which stays). The prose that names them (check-durability-degradation-log-level.mjs comments, test headers, sql-driver.ts, seed-tenancy-backfill.ts, packages/spec/src/contracts/objectql-engine.ts) still resolves, because the methods stay on the class. No ADR anchor paragraph describes a moved body. No moved body reads isSystem (the two { isSystem: true } literals are context construction, not reads; check-system-context-census passes unchanged at 153 read sites), holds a query-options/no-any-erasure site (8 at base and head), a tenant-audit untyped receiver, a .canReadObject( or referenceTargetOf( call (the two core census pins), or a new Error(. isMissingTableError keeps its two-argument form (driver-error-classification.callers.test.ts).
• Decision-letter count: check-adr-anchors at base 756220c4a (clean detached worktree): 91 anchored files, 1,877 decision-letter citations, 59,318 resolving citations across 8,374 files. At head c7df09f88: 91, 1,877, 59,321 across 8,375. No moved body comment cites a decision letter, and the module is not anchored, so the count is equal.

Fold-ins (stale path readers of cut 12)

• engine-realtime-publish.ts's header said accessibleOrganizationsOf stays in engine.ts; cut 12 moved it to engine-driver-options.ts. The sentence now says so (two comment lines).
• scripts/adr-anchors/packages__objectql__src__engine-execute-transactions.ts.json (cut 7) still carried the transaction-seam paragraph's buildDriverOptions half, which engine-driver-options.ts's entry has carried since cut 12. That half now has one home, with buildDriverOptions' body: this entry's invariant is now the engine.ts entry's text exactly (the opening sentence, the enforceTransactionOrigin sentences and the "Never add a companion transaction" clause), with its file and three ids unchanged. The count above includes this edit.

Tests

Published .d.ts identical (ruling 6348891160), with a positive control

Base: @objectstack/objectql built with engine.ts restored to 756220c4a (blob a17c9e9b93e6 checked) and the module removed; head built at c7df09f88; the tree restored and checked (git diff HEAD empty, both blobs equal to HEAD). announceOpenMigrationGates.call(host occurs 0 times in the base dist/index.mjs and once in the head's. All six declaration files are byte-identical, and equal to the hashes cuts 7 to 12 recorded:

file	sha256, base = head
core.d.mts	ef178bf0725eccc2f358f082ce13dc5122a6d5a53c19ef630017256f67de03b4
core.d.ts	1d20303a455a909e4b55fd0802fb0b0bcb59ec51784daf27d5ef4c0659410953
index.d.mts	ccf900240aa137abe72f82b8abfc872d42c5645467400134c580285f2a3b3090
index.d.ts	0454d5e70b156d8effbf27b8915587c7cbee241dcd7d698013c0a4c369a02aa5
util-CVzOGxAn.d.mts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53
util-CVzOGxAn.d.ts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53

Positive control: scripts/ablation-replace.mjs dropped private from the readFileReferencesFlagRow stub (anchor hit once, 1 to 0; blob 4e64ab23e37a to 93b9d017a031) and rebuilt: all six hashes and the chunk name changed (util-BnUvXrEZ.d.ts 8939a58e8fee…, index.d.ts 63b9dacdf4c1…, core.d.ts b6d8ba14102d…), and the chunk now prints readFileReferencesFlagRow() (returning a Promise of MigrationFlagRead) as a public member. The tool restored the file (blob 4e64ab23e37a equal to HEAD, git diff HEAD empty); after a rebuild, all six files compared equal to the head build again.

Proof of move-only (TypeScript-AST leaf-token compare)

pm-orders/server/evidence/25522/astcmp.mjs (unchanged from cuts 9 to 12), base engine.ts against the head module:

• All eight bodies are SAME in parameters, return type, type parameters, body tokens and async: supplyTenantKeyCertifiedResolver 97 tokens / 16 lines, isOrganizationOwnershipCertified 166 / 19, readFileReferencesFlagRow 19 / 7, isValueShapesMigrationVerified 17 / 6, readMigrationFlagVerified 232 / 37, noteAdmittedValueShapeViolation 96 / 18, announceOpenMigrationGates 201 / 40, wasDatastoreCreatedFromEmpty 94 / 11.
• Class: 318 members at both ends, in the same order. 310 are byte-identical, and the 8 stubs keep docblock, modifiers and signature byte-identical up to the body.
• Top level: 225 of 229 base statements are byte-identical in head. The other four: the class; the @objectstack/spec/system import less the five bindings above; the ./validation/record-validator.js import less valueShapePostureSetByEnv and mediaPostureSetByEnv; interface MigrationFlagRead, now export interface with the same body. Head adds the module import.

Late-binding probe for the setter (one-off, not committed)

pm-orders/server/evidence/25522/zz-probe-cut13.mjs drives the built dist/ of base and head with instance doubles. Both runs print the same 28 lines (diff empty, apart from the engine's own creation log timestamps). The setter lines:

• announceOpenMigrationGates() on a fresh engine: engine.migrationGatesAnnounced reads false before and true after (the write through the moved body is read back on the instance); a second call returns before reading the registry.
• Setting engine.migrationGatesAnnounced = false on the instance makes the next call run again; setting it true makes the next call skip; invalidateDataMigrationFlags() (stays in the class) resets it, and the next call runs.

The rest: announceOpenMigrationGates reaches instance doubles of objectHasMediaField, objectHasCoveredValueField and readMigrationFlagVerified and logs the media advisory; the two public flag readers reach an instance findOne double once per memo slot with { isSystem: true } and log their verified lines; a throwing findOne and an absent ledger answer inconclusive; isOrganizationOwnershipCertified answers false on a missing table and rethrows any other error; the resolver supplyTenantKeyCertifiedResolver hands a driver reaches an isOrganizationOwnershipCertified double set on the instance AFTER the hand-over, and a driver that throws is logged at debug; the admitted-violation tally and its two deviation calls; wasDatastoreCreatedFromEmpty reads a drivers map replaced on the instance.

Suites

At c7df09f88:

• pnpm --filter @objectstack/objectql typecheck (tsc --noEmit + check:test-typecheck): VERDICT command-exit 0. pnpm exec eslint --no-inline-config packages/objectql: exit 0.
• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 472 files, 8,789 tests passed (VERDICT command-exit 0). The suites that drive these bodies (adr0131-tenant-key-certified-supply, value-shape-scan-advisory, sys-migration-single-row-route, adr0104-attestation-evidence, engine-find-missing-table-log-level, engine.test) are among them.
• vitest run --project repo in every package that has one, after the ^... closure builds: core 6/6 files (83 tests), objectql 1/1 (5), rest 5/5 (280 passed, 18 skipped), runtime 3/3 (947), spec 79/79 (1,279), types 1/1 (11), all exit 0.
• Dependants: all eight members keep their declarations and all six published .d.ts files are byte-identical, so no dependant can see a difference. CI's TypeScript Type Check covers them.

Acceptance notes

• Serial check, re-read at 01:58Z (31 open PRs): three touch packages/objectql/**. feat!: ownership queues and assignment rules (ADR-0142 phase 2) #26337 (ADR-0142 phase 2, head e45133760) edits engine.ts in nine hunks (an import near line 245, three declarations above the class, and the insert / update bodies); none is in the moved section, on the import lines this cut edits, or on MigrationFlagRead. git merge-tree --write-tree of this head with its head merges cleanly (exit 0). Under the card's rule 4 whichever lands second merges main. docs: TypeScript legacy node10 resolution is unsupported for the 15 packages with subpath exports #26378 edits packages/objectql/README.md only; feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 edits validation/rule-validator.test.ts only. No open PR touches engine-realtime-publish.ts or scripts/adr-anchors/.
• Receiver notes, not a change in what runs: supplyTenantKeyCertifiedResolver hands the driver () => this.isOrganizationOwnershipCertified(); this is now the host, whose member is a late-bound closure over the engine, so the call still lands on the engine's method (the probe sets a double after the hand-over and the resolver reaches it). this.findOne(...) keeps the engine as its receiver through the closure. this._registry.getObject(...), this.drivers.values(), this.admittedValueShapeViolations.get/set(...) and this.logger.info(...) keep their own receivers.
• Next cut from this screen: re-measured on this head, Migration flags pays nothing further (six short bodies, 22 lines). Readable-ids security and permission/formula resolution pays about -87 with six bodies (three more stay on shared module helpers) and is the hottest section in the file; the rest pay -30 or less.

Verification

At c7df09f88:

• Gates: dispatch-gates --commands derived 64 families on the real diff. Every one was run, each exit code captured before any pipe, then reconciled with --ran: 64 accounted for, 63 run green, 1 NOT MEASURED (exit 3, PREREQUISITE NOT MET; CI runs it): check:dual-build-cjs-loads (needs every package's dist/). Two first answered a shallow-clone prerequisite and were re-run green after git fetch --shallow-since=2026-07-22 origin main: check-engine-split-ratio --days 90 and check-plugin-teardown-shape --self-test. Named readings: check:adr-anchors OK, check:nul-bytes, check-engine-split-ratio --self-test, check:lean-entry-closure, check-affected-docs, all exit 0.
• Hand gates outside the derivation, all exit 0: check-adr-anchors at base and head (above), check-system-context-census (153 read sites), check-tenant-audit-census (244 write sites certified, every UNTYPED_RECEIVERS row matched), check-adr-symbol-anchors (2,664 anchors resolve), check-platform-checklist --changed-from origin/main (13 anchors judged, 0 lost), check-commit-card-trailers --range origin/main..HEAD and check-nul-bytes.
• The dry run's wider list: on refactor(objectql): move the driver options and engine posture bodies out of engine.ts into engine-driver-options.ts (#25522 cut 12) #26371's head (the same engine.ts bytes and the same four files), the derivation named 111 families, because that branch's diff also carried cut 12's files; all 111 ran, 107 green and four answering PREREQUISITE NOT MET exactly as on cut 12 (shallow clone, client builds, every package's dist/), among them check:query-options-erasure, check:engine-double-contract, check:type-check-debt, check:objectql-double-limit and check:where-matcher, all exit 0.
• origin/main moved eight commits after the cut (to 7c70f91ce); none touches packages/objectql/src/**, scripts/adr-anchors/** or the census scripts (the nearest is feat(spec,metadata-protocol,service-storage,runtime,cli)!: a seed record can carry a file the package ships, seedFile(path) #26244's packages/spec seed-file addition), so the branch is not merged with it here; CI runs the merge ref.
• No ablation, because no tested behaviour changed. The whole Test Core farm is CI's.

skip-changeset: move-only. The published .d.ts files are byte-identical, liveness/ and every other published path are untouched, and the module's runtime is the same code under a different file name. The other edits are one source comment and one anchor file.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (No packages/spec edit.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes (scoped: eslint --no-inline-config packages/objectql, exit 0).
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (Nothing publishes differently: skip-changeset.)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 block is the maintainer channel the fleet writes in Chinese).
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wzm9du2KfnvCibhjZZYgyq

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 33 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/objectql/src/engine-realtime-publish.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-flow.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/automation/hook-bodies.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/automation/webhooks.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/kernel/contracts/data-engine.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/kernel/contracts/index.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/kernel/events.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/permissions/attachments-access.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/permissions/field-level-security.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/permissions/record-view-auditing.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/permissions/rls.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/permissions/system-context.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/protocol/objectql/query-syntax.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/protocol/objectql/schema.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/ui/react-pages.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))

⛔ 7 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v16.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v17/17-0.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v17/17-5.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v17/17-6.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v17/17-7.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))
• content/docs/releases/v17/index.mdx (via findOne (symbol, a field of interface MigrationFlagsHost), findOne (literal, a string literal in findOne; a string literal in isOrganizationOwnershipCertified; a string literal in readMigrationFlagVerified))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/objectql/src/engine-realtime-publish.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 55 of 207 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7c70f91ce1910553ae1be4b19297011ae6ad04c0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from feb7e55d91a0addf0ffb9a508ab9c6d52d668c54 — the merge of head c7df09f8803159f75fec54fbfea8fdbdd5e76379 into base 7c70f91ce1910553ae1be4b19297011ae6ad04c0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin feb7e55d91a0addf0ffb9a508ab9c6d52d668c54 && git checkout feb7e55d91a0addf0ffb9a508ab9c6d52d668c54
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7c70f91ce1910553ae1be4b19297011ae6ad04c0 c7df09f8803159f75fec54fbfea8fdbdd5e76379 && git checkout -B drift-repro 7c70f91ce1910553ae1be4b19297011ae6ad04c0 && git merge --no-ff c7df09f8803159f75fec54fbfea8fdbdd5e76379

node scripts/docs-audit/affected-docs.mjs --json 7c70f91ce1910553ae1be4b19297011ae6ad04c0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7c70f91ce1910553ae1be4b19297011ae6ad04c0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-27T02:34Z · head c7df09f880 · #25522 cut 13

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape: a draft against main. The body opens with Part of #25522, not Fixes, because the card stays open for later cuts. Clause-②: no and Metadata-protocol: none are line-initial. skip-changeset applies because this is a move. check-governed-merges --pr 26403 reads NOT governed (0 of 4 paths), 527 changed lines. None of the four contract faces is touched, so no at-tier review is owed.
2. Premise: the claim 6430872749 asked for a fresh seam table after cut 12. It is in the body, measured on 756220c4a, which includes refactor(objectql): move the driver options and engine posture bodies out of engine.ts into engine-driver-options.ts (#25522 cut 12) #26371. The pick is the section that pays most, "Migration flags and attestations", priced at −91 and landing at −94 (22,517 → 22,423). Eight bodies move into engine-migration-flags.ts behind MigrationFlagsHost. Each method stays on the class with its name, modifiers, signature and docblock, as a delegate that hands its body the members it reads.
3. Move check (the seat's own): every line removed from engine.ts was compared with the new module after stripping indentation. All 158 non-blank lines are present there except two:
   • The ./validation/record-validator.js import line drops valueShapePostureSetByEnv and mediaPostureSetByEnv, which the module now imports itself.
   • interface MigrationFlagRead gains export in place so the module can import type it. There is still one copy, and the dev reports the six published .d.ts files byte-identical, with a positive control.
     The module's other lines are its header, imports, the host interface and the eight function signatures. The dev's AST comparison reads 8 of 8 bodies the same and 318 of 318 class members accounted for.
4. Setter ruling (the claim's): applied exactly once. announceOpenMigrationGates is the only moved body that assigns a field, so its host carries the get/set pair over migrationGatesAnnounced. The field stays declared on the class, and no other host has a setter. The dev's late-binding probe on base and head dist reads the same 28 lines both ways: the moved body's write lands on the instance, and instance writes reach the next moved read.
5. Fold-ins (from the order):
   • The engine-realtime-publish.ts header now says that accessibleOrganizationsOf lives in engine-driver-options.ts. It does, at :93.
   • The engine-execute-transactions.ts ADR anchor drops its buildDriverOptions half. That half's full text, including "never restore the unconditional handle lift", is already in the engine-driver-options.ts entry, so each paragraph now has one home. check:adr-anchors reads 1,877 letters at both base and head.
6. Gates: at this stamp every check-run on the head reads success or skipped (path-filtered UI, docs build, the dogfood matrix placeholder, opt-in harnesses and the skipped changeset check). None reads failed or in progress. Test Core 1–8, Lint & Repo Gates and TypeScript Type Check are green, and dual-build-cjs-loads, NOT MEASURED locally, runs in CI's full build. Locally the dev reports 63 of 64 derived gates green, the objectql suite at 472 files and 8,789 tests, and the --project repo census suites of core, objectql, rest, runtime, spec and types all green.
7. Out of scope: none filed. The next cut by this table is Readable-ids security and permission/formula resolution (about −87).
8. Landing: this seat runs pr_ready and then automerge_enable through the relay, confirms MERGED on both readings, and records the landing on [maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522.

---

Generated by Claude Code