[objectstack-fleet]

Requested by Leehom · project thread
Part of #25522
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

维护者速读

• 改了什么:把 engine.ts 里「驱动选项与引擎租户姿态」整段 6 个方法和它们独用的一个辅助函数原样搬进新文件 engine-driver-options.ts,类上方法签名与注释不变,只把方法体换成转交。engine.ts 22,651 → 22,517 行。
• 为什么改:[maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522 按缝拆分 engine.ts 的第 12 刀;本段在刀前重测的缝表里净减行最多,且不与在途 PR 重叠。
• 风险与回滚:纯搬移,无行为变化;公开 .d.ts 六个文件逐字节不变。回滚 = revert 本 PR。
• 先看:packages/objectql/src/engine-driver-options.ts(搬入的方法体)、packages/objectql/src/engine.ts(6 个转交桩)、scripts/adr-anchors/ 两个 JSON(ADR 锚段落按方法拆分)。
• 两分钟验证:pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2,应见 472 个测试文件全部通过。
• 需要你做的:无,席位落地。

Cut 12 of the packages/objectql/src/engine.ts split (#24586 ruling A, recorded in 6270097840). The claim is 6429419365. The whole "Driver options and engine posture" section moves unedited into a new module, packages/objectql/src/engine-driver-options.ts: buildDriverOptions (the DriverOptions every driver call receives), driverReadScope (the Layer 0 verdict projected onto a read's driver scope), engineLayer0Verdict (that verdict over the engine's own facts), wallExemptedOperation (did the wall's exemption lift an operation's scope), driverWriteTarget (an insert's write target) and resolveEnginePosture (the tenancy posture in force). The one module helper only they use, accessibleOrganizationsOf, moves with them. No behaviour changes. #25522 stays open for the later cuts.

Branch claude/project-thread-isr622 (the card thread's harness-pinned branch), cut from origin/main at 222755ebb, which contains cut 11's merge (fc70ab36ba, #26351). Nothing was edited before that merge landed. origin/main (6390fe52c) was merged in once before this PR opened; none of the commits it brought touch packages/objectql/**, packages/core/src/security/**, content/docs/permissions/**, scripts/adr-anchors/** or scripts/check-system-context-census.mjs.

What changes

Why this area

Re-measured on 222755ebb with cut 11's scripts, unchanged (both screens: query-options erasure sites and module-helper closure). engine.ts is 22,651 lines, 7,202 of them from the last 30 days (git blame --since=2026-09-26T23:28Z). scripts/pm/git-history.mjs count: 130 commits in 30 days, 36 in 7. class ObjectQL holds 318 members, 255 methods and accessors. engine.ts at 222755ebb is byte-identical to cut 11's head, where the table was first pre-measured while #26351 was in the queue.

Seam table at 222755e (41 sections)

range	section	first … last member	lines	30-day lines	methods	inferred public	U	private statics
4710-4935	Instance state and constructor	txStore … constructor	226	50	0 (0 public)	-	0	-
4936-4958	Status and registry accessor	getStatus … registry	23	0	2 (2 public)	getStatus	0	-
4959-5302	Hook and function registry	registerHook … triggerHooks	344	6	16 (16 public)	registerHook, triggerHooks	1	-
5303-5658	Hook dispatch internals	hasHooksFor … assertBulkPerRowHookBudget	356	61	7 (0 public)	-	0	-
5659-5819	Action registry and activation	registerAction … setActionActive	161	19	10 (10 public)	-	1	-
5820-6101	Registered resolvers and write-gate probes	_heldFileResolver … registerInsertRecomputeListener	282	116	6 (6 public)	-	0	-
6102-6855	Readable-ids security and permission/formula resolution	readableIdsSecurityReported … resolveDefaultPermissions	754	546	15 (2 public)	-	0	-
6856-6962	Authz invalidation and middleware registration	writeEpoch … hasObjectMiddleware	107	18	4 (4 public)	-	0	-
6963-7140	Execution plumbing (middleware, session, provenance, users)	executeWithMiddleware … buildUser	178	45	7 (0 public)	-	0	-
7141-7471	Driver options and engine posture (this PR)	buildDriverOptions … resolveEnginePosture	331	209	6 (0 public)	-	0	-
7472-7681	Organization probe and system-insert organization	probeInstallOrganizations … transactionCoversDriverFor	210	45	4 (0 public)	-	0	-
7682-8047	Field defaults	resolveNowDefault … defaultFieldEntries	366	4	6 (0 public)	-	0	-
8048-8660	Autonumber	applyAutonumbers … seedAutonumber	613	80	6 (0 public)	-	1	-
8661-9325	Package, app, plugin and driver registration	registrationConversionWarned … registerDriver	665	170	6 (3 public)	registerApp, registerDriver	0	-
9326-9534	Datasource registry	supplyFileColumnsMovedResolver … listUnavailableDatasources	209	1	8 (7 public)	-	3	-
9535-9686	Write guard and realtime publish	assertWriteAllowed … publishBulkDataEvent	152	18	4 (1 public)	-	0	-
9687-9785	Validation-message i18n	setI18nService … objectDisplayLabel	99	14	4 (1 public)	-	0	-
9786-10789	Referential integrity and master-detail resolution	assertReferencesResolve … masterDeclaredFields	1004	415	12 (0 public)	-	0	-
10790-10905	Dangling-reference and cascade inspection	inspectDanglingReferences … inspectCascadeDelete	116	48	2 (2 public)	-	0	-
10906-11000	Crypto and tenancy providers	setCryptoProvider … setTenancyPostureProvider	95	20	4 (4 public)	-	1	-
11001-11420	Secret and internal-field handling	encryptSecretFields … resolveInternalField	420	61	9 (3 public)	-	0	-
11421-11489	Schema lookup and filter judging	getSchema … judgeFilter	69	48	3 (2 public)	-	0	-
11490-11755	Datasource routing	LIFECYCLE_DATASOURCE … setDatasourceMapping	266	20	8 (3 public)	setDatasourceMapping	0	-
11756-11923	Lifecycle init and health	init … resolvePrimaryDatasource	168	16	3 (3 public)	init	0	-
11924-11997	Media and value-shape presence	objectHasMediaField … valueShapeStrictFor	74	13	4 (0 public)	-	0	mediaFieldPresence, coveredValueFieldPresence
11998-12680	Migration flags and attestations	isFileReferencesMigrationVerified … wasDatastoreCreatedFromEmpty	683	81	17 (8 public)	-	0	-
12681-12703	destroy	destroy … destroy	23	0	1 (1 public)	destroy	0	-
12704-12722	Expand/cascade limits (statics)	MAX_EXPAND_DEPTH … MAX_BULK_PER_ROW_HOOK_ROWS	19	0	0 (0 public)	-	0	MAX_EXPAND_DEPTH, MAX_CASCADE_DEPTH
12723-13173	Roll-up summaries	autonumberCounters … recomputeSummaries	451	0	7 (1 public)	-	0	-
13174-13427	Related-record expansion	expandRelatedRecords … expandRelatedRecords	254	10	1 (0 public)	-	0	-
13428-13625	File-reference hydration (stubs, cut 11)	resolveFileReferences … readParentDerivedFiles	198	183	5 (0 public)	-	0	-
13626-14104	Query lowering	resolveWhereTokens … requireFindOnePredicate	479	272	9 (0 public)	-	0	-
14105-14661	find / findOne	find … staticReadonlyCreateStrip	557	142	4 (2 public)	-	0	-
14662-15319	validate	validate … validate	658	447	1 (1 public)	-	0	-
15320-16666	insert / insertMany	readUpdatePriorRow … insertMany	1347	439	3 (2 public)	-	1	-
16667-18600	update	update … update	1934	275	1 (1 public)	-	0	-
18601-20141	Delete cascade and reference walking	planCascadeAtomicity … organizationOwnedRowCounts	1541	733	22 (1 public)	-	0	6 statics
20142-20711	delete	delete … delete	570	47	1 (1 public)	-	0	-
20712-21331	count / aggregate	count … aggregate	620	236	3 (2 public)	-	0	-
21332-21640	execute and transactions	execute … enforceTransactionOrigin	309	74	8 (2 public)	-	0	-
21641-21933	Compatibility API	registerObject … create	293	52	16 (16 public)	-	0	-

The full per-method screen and price list are in the project file pm-orders/server/25522-cut12-seam-table.md; the move script is pm-orders/server/evidence/25522/move-cut12.mjs and the anchor split anchor-cut12.py.

area	paying bodies under both screens	30-day lines in them	net	verdict
Driver options and engine posture (this PR)	all 6 bodies (161 lines) and the helper accessibleOrganizationsOf, whose two users (engineLayer0Verdict, driverWriteTarget) both move	107 of 161	priced -110 for the four bodies the script calls free, -122 for all six by the rule; -134 measured (the helper and four import bindings go too)	pays most; nothing in the section stays behind
Migration flags and attestations	8 bodies	50 of 154	about -91	its host needs setters (a seat ruling first); not taken, per the order
Readable-ids security and permission/formula resolution	6 bodies	78 of 127	about -87	three bodies blocked by shared module helpers; hot
Package registration, count, Delete cascade and the rest	-	-	-30 to 0	blocked by a shared helper, or pays little

The script lists engineLayer0Verdict as blocked by its helper accessibleOrganizationsOf, whose other user is driverWriteTarget. driverWriteTarget alone does not pay (a 4-line body behind a 5-line stub, +1), but moving it with engineLayer0Verdict lets the helper go too, so the pair pays about -19 together with it. That is the order's reading ("engineLayer0Verdict only together with driverWriteTarget"), and it empties the section.

The shape

• The class keeps all six methods with name, modifiers (private), signature, docblock and position. Each body is now one host literal of exactly the DriverOptionsHost members it reads, plus a .call, marked [#25522 cut 12], as cuts 8, 10 and 11 did. Fields go as getters over a readX closure (txStore, _registry, tenancyPostureProvider); methods go as late-bound closures (isClosedUnitHandle, transactionCoversDriverFor, driverWriteTarget, driverReadScope, wallExemptedOperation, engineLayer0Verdict, resolveEnginePosture), so a spy or double set on the engine is still the one a call reaches.
• One named host. DriverOptionsHost types each member as the class member (ObjectQL['txStore'] and so on); each function's this is the Pick of what it reads. The module imports the engine only as a type.
• The helper. accessibleOrganizationsOf moves with its docblock byte for byte and is not exported; both its users moved. One copy, no re-derivation.
• Imports. The module imports isTenancyDisabled (@objectstack/spec/data), ExecutionContext (type), computeTenantLayer0Verdict (@objectstack/core, with its two-line import comment), resolveTenantFieldName (./tenancy/system-write-organization.js), resolveTenancyPosture (@objectstack/types), normalizeTenancyPosture, TenantLayer0VerdictSchema and the types TenancyPosture / TenantLayer0Verdict (@objectstack/spec/security) and isFederatedObject (./federated-object.js). engine.ts drops isTenancyDisabled, computeTenantLayer0Verdict (with its comment), resolveTenancyPosture (the whole import line), normalizeTenancyPosture and TenantLayer0VerdictSchema, whose last code readers moved (three of them are still named in docblocks that stay, which no linter counts as a use), and gains the module import with a three-line comment. isFederatedObject, resolveTenantFieldName and the two types keep readers in engine.ts and stay imported there.
• The module header names what moved and why nothing stays, and names ADR-0119 and ADR-0067 (the anchor ids, below) without a decision letter.

Net lines (the seat's rule)

engine.ts goes from 22,651 to 22,517 lines, net -134 (44 added, 178 removed). The module is 304 lines. With the path readers below, the diff against origin/main is 544 changed lines over 7 files (+361 / -183).

Readers of the moved lines (migrated in this PR)

• ADR anchor. scripts/adr-anchors/packages__objectql__src__engine.ts.json describes the transaction seam in one paragraph whose first half is buildDriverOptions's mechanism. The paragraph is divided, one home per half:
  • New entry packages__objectql__src__engine-driver-options.ts.json, adrs: ["ADR-0067", "ADR-0119"] (ADR-0119's same-origin amendment, recorded on the 2026-08-06 ruling with ADR-0067's): the opening sentence ("The transaction seam is same-origin by construction (ambient 事务句柄跨数据源泄漏:凡在事务中执行的被审计写入,合规审计行全部静默丢失(#5226 的真实根因) #5351/[spec] engine.transaction 契约收紧:opts.require fail-closed、跨驱动拒绝、owned-vs-joined 信号(#4619 的契约半边,维护者已批 P2) #5696, 2026-08-06 ruling).") plus the buildDriverOptions sentence verbatim, plus the last clause of the paragraph's closing sentence, "Never restore the unconditional handle lift."
  • The engine.ts entry keeps its three ids, the same opening sentence, the enforceTransactionOrigin sentences verbatim, and the closing sentence's first clause, "Never add a companion transaction on the second driver (no two-phase commit in IDataDriver)."
  • So the only words that change are the split of the closing sentence at its "and" (the second clause now starts a sentence) and the opening sentence, which both halves carry. engine-execute-transactions.ts's entry (cut 7) still carries the whole paragraph; this PR does not edit it.
  • Decision-letter count: check-adr-anchors at base 222755ebb (clean detached worktree): 90 anchored files, 1,877 decision-letter citations, 59,281 resolving citations. At head 1b8e2b8b1: 91, 1,877, 59,285; at the merged head 17781355c: 91, 1,877, 59,316 (main's own citations). The letter-citing body comments that moved (ADR-0131 D8, D9, D13, the ADR-0131 D8 import comment and the helper's ADR-0105 D2) left engine.ts but now count in the newly anchored module, so the count is equal.
• The system-context census page. buildDriverOptions reads execCtx?.isSystem (row 24, "Tenant-audit warning silenced"). The row's anchor in content/docs/permissions/system-context.mdx and its NON_READ_ANCHORS entry in scripts/check-system-context-census.mjs (collapsesOntoRead, file key only) now name engine-driver-options.ts#buildDriverOptions. Control: with the move and neither re-key, the census fails with [ledger-stale-collapse] and [anchor-is-not-a-read-site] on engine.ts#buildDriverOptions; with both re-keys (and the module tracked), it passes: 153 read sites across 83 files (82 at base), 145 of 145 symbols cited.
• The federated injected-column readers table. federated-injected-column-readers.test.ts keys rows FILE#FUNCTION :: SEAM; the two buildDriverOptions rows (isFederatedObject(), resolveTenantFieldName()) are re-keyed to engine-driver-options.ts#buildDriverOptions, dispositions unchanged.
• No objectql/src/engine.ts#NAME pointer under packages/spec/**, docs/adr/**, docs/qa/** or content/** names a moved member other than row 24. Prose that names buildDriverOptions or resolveEnginePosture (ADRs 0034, 0119 and 0131, driver and plugin comments, tests, CHANGELOGs) still resolves, because the methods stay on the class. No core census keys a moved body (row-serving-door-exposure keys .canReadObject( callers and second-object-read-exposure keys referenceTargetOf( callers; the moved bodies make neither call). No moved body holds a query-options/no-any-erasure site (engine.ts stays at 8 in query-options-erasure-baseline.json) or a tenant-audit untyped receiver.

Tests

Published .d.ts identical (ruling 6348891160), with a positive control

Base: @objectstack/objectql built in a clean detached worktree at 222755ebb (its own pnpm install and ^... closure build; engine.ts blob d68a6760 checked, no module file). Head: built at 1b8e2b8b1. buildDriverOptions.call(host occurs 0 times in the base dist/index.mjs and once in the head's. All six declaration files are byte-identical, and equal to the hashes cuts 7 to 11 recorded:

file	sha256, base = head
core.d.mts	ef178bf0725eccc2f358f082ce13dc5122a6d5a53c19ef630017256f67de03b4
core.d.ts	1d20303a455a909e4b55fd0802fb0b0bcb59ec51784daf27d5ef4c0659410953
index.d.mts	ccf900240aa137abe72f82b8abfc872d42c5645467400134c580285f2a3b3090
index.d.ts	0454d5e70b156d8effbf27b8915587c7cbee241dcd7d698013c0a4c369a02aa5
util-CVzOGxAn.d.mts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53
util-CVzOGxAn.d.ts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53

Positive control: scripts/ablation-replace.mjs dropped private from the driverWriteTarget stub (anchor hit once, x1 to x0; replacement x0 to x1) and rebuilt: all six hashes and the chunk name changed (util-QbuYzUnN.d.ts 6a0616b618e4…, index.d.ts 363d8d91d88e…), and the chunk now prints driverWriteTarget(execCtx: ExecutionContext | undefined): { as a public member. The tool restored the file (blob a17c9e9b93e6 equal to HEAD, git diff HEAD empty); after a rebuild, all six files compared equal to the head build again.

Proof of move-only (TypeScript-AST leaf-token compare)

pm-orders/server/evidence/25522/astcmp.mjs (unchanged from cuts 9 to 11), base engine.ts (222755ebb) against the head module:

• All six bodies are SAME in parameters, return type, type parameters, body tokens and async: buildDriverOptions 379 tokens / 111 lines, driverReadScope 139 / 16, engineLayer0Verdict 45 / 15, wallExemptedOperation 86 / 8, driverWriteTarget 61 / 4, resolveEnginePosture 38 / 7.
• Class: 318 members at both ends, in the same order. 312 are byte-identical, and the 6 stubs keep docblock, modifiers and signature byte-identical up to the body.
• Top level: 224 of 230 base statements are byte-identical in head. The other six: the class; the helper, moved; the @objectstack/spec/data import less isTenancyDisabled; the @objectstack/core import less computeTenantLayer0Verdict and its comment; the @objectstack/types import, dropped; the @objectstack/spec/security import less normalizeTenancyPosture and TenantLayer0VerdictSchema. Head adds the module import.
• The whole move was dry-run first on cut 11's head while refactor(objectql): move file-field hydration on read out of engine.ts into engine-file-reference-hydration.ts (#25522 cut 11) #26351 was in the queue; the files committed here are byte-identical to that dry run (git hash-object, 7 of 7).

Suites

At 1b8e2b8b1 (the cut; the merge of origin/main after it changes no file under packages/objectql/** or packages/core/**):

• pnpm --filter @objectstack/objectql typecheck (tsc --noEmit + check:test-typecheck): VERDICT command-exit 0. pnpm exec eslint --no-inline-config packages/objectql scripts/check-system-context-census.mjs: exit 0.
• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 472 files, 8,789 tests passed (VERDICT command-exit 0). The suites that drive these bodies (engine-driver-read-scope, engine-external-tenant-scope, engine-reference-tenant-scope, engine-timezone-presence-gate, engine-transaction-same-origin, engine-data-events, federated-injected-column-readers) are among them.
• vitest run --project repo in every package that has one, after the ^... closure builds: core 6/6 files (83 tests), objectql 1/1 (5), rest 5/5 (280 passed, 18 skipped), runtime 3/3 (947), spec 79/79 (1,279), types 1/1 (11), all VERDICT command-exit 0.
• Dependants: all six members keep their declarations and all six published .d.ts files are byte-identical, so no dependant can see a difference. CI's TypeScript Type Check covers them.

Acceptance notes

• Serial check, re-read before pr_create (17 open PRs at 00:38Z): two touch packages/objectql/**. feat!: ownership queues and assignment rules (ADR-0142 phase 2) #26337 (ADR-0142 phase 2, head 9ada3a920) edits engine.ts in nine hunks (an import near line 245, three declarations near lines 3916, 4221 and 4751, and the insert / update bodies from base line 15629 on) and adds rows to federated-injected-column-readers.test.ts near line 355. None is in the moved section (base lines 7141 to 7471), on the import lines or helper this cut edits, or on the two re-keyed rows (line 188). git merge-tree --write-tree of this head with its head merges cleanly (exit 0). Under the card's rule 4 whichever lands second merges main. feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 edits validation/rule-validator.test.ts only. No open PR touches system-context.mdx, check-system-context-census.mjs or scripts/adr-anchors/.
• Receiver note, not a change in what runs: resolveEnginePosture calls this.tenancyPostureProvider?.(). In the class the call's receiver was the engine; in the module it is the host, whose getter returns the same function. The one production registration (plugin-security's setTenancyPostureProvider(() => this.tenancyPosture)) and every test registration pass arrow functions, so nothing reads the receiver. this.txStore.getStore() and this._registry.getObject(...) keep their own receivers (the store and the registry).
• A stale sentence elsewhere, not edited: engine-realtime-publish.ts's header says accessibleOrganizationsOf stays in engine.ts; after this cut it lives in engine-driver-options.ts. The file is outside this claim's surface, so it is left for the seat to route.
• Next cut from this screen: Migration flags and attestations (about -91) still needs a setter ruling; Readable-ids (about -87) is blocked by three shared module helpers; the rest pay -30 or less. A ruling on Migration flags' setters is the next lever.

Verification

At 17781355c (final head, the merge of origin/main 6390fe52c into 1b8e2b8b1):

• Gates: dispatch-gates --commands derived 111 families on the real diff (the same list at 1b8e2b8b1 and after the merge). Every one was run, each exit code captured before any pipe, then reconciled with --ran: 111 accounted for, 110 run green, 1 NOT MEASURED (exit 3, PREREQUISITE NOT MET; CI runs it): check:dual-build-cjs-loads (needs every package's dist/). Three first answered a prerequisite and were re-run green after the prerequisite was met: check-engine-split-ratio --days 90 and check-plugin-teardown-shape --self-test (shallow clone, re-run after git fetch --unshallow), and check:skill-examples (re-run after building @objectstack/client-react and @objectstack/client: 264 prose examples type-check). Named readings: check-system-context-census OK, check:adr-anchors OK, check:query-options-erasure, check:durability-log-level, check:engine-double-contract, check:lean-entry-closure, check:type-check-debt, check:logger-receiver-detach, check:org-identifier, check:nul-bytes, check-affected-docs, all exit 0.
• Hand gates outside the derivation, all exit 0: check-adr-anchors at base and head (above), check-adr-symbol-anchors (2,664 anchors resolve), check-tenant-audit-census (244 write sites certified), check-platform-checklist --changed-from origin/main (13 anchors judged, 0 lost) and check-commit-card-trailers --range origin/main..HEAD.
• No ablation, because no tested behaviour changed. The whole Test Core farm is CI's.

skip-changeset: move-only. The published .d.ts files are byte-identical, liveness/ and every other published path are untouched, and the module's runtime is the same code under a different file name. The other edits are a docs page, a test key, a repo script and two anchor files.

🤖 Generated with Claude Code

https://claude.ai/code/session_014SEAruKUVJHjiYsA6bZyLy

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 24 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/tenancy-modes.mdx (via TenancyPosture (symbol, a top-level type))
• content/docs/permissions/system-context.mdx (via buildDriverOptions (symbol, a method of class ObjectQL; a top-level function))
• content/docs/permissions/tenant-audit-census.mdx (via buildDriverOptions (symbol, a method of class ObjectQL; a top-level function))

What this run could not see

• the SDK route bridge reached 55 of 207 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6390fe52cecd263f09225d0d6d9b74412d111a67 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8991c05d8aeea7ace2182c563d20d2fd04326f15 — the merge of head 17781355cdd6796c7604b5a33752d542a7b02cdd into base 6390fe52cecd263f09225d0d6d9b74412d111a67, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8991c05d8aeea7ace2182c563d20d2fd04326f15 && git checkout 8991c05d8aeea7ace2182c563d20d2fd04326f15
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6390fe52cecd263f09225d0d6d9b74412d111a67 17781355cdd6796c7604b5a33752d542a7b02cdd && git checkout -B drift-repro 6390fe52cecd263f09225d0d6d9b74412d111a67 && git merge --no-ff 17781355cdd6796c7604b5a33752d542a7b02cdd

node scripts/docs-audit/affected-docs.mjs --json 6390fe52cecd263f09225d0d6d9b74412d111a67

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6390fe52cecd263f09225d0d6d9b74412d111a67 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-27T00:57Z · head 17781355cd · #25522 cut 12

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape: a draft against main. The body opens with Part of #25522 (⛔ not Fixes; the card stays open for later cuts). Clause-②: no and Metadata-protocol: none are line-initial. skip-changeset applies: the change is move-only. check-governed-merges --pr 26371: NOT governed (0 of 7 paths), 544 changed lines.

2. Premise measured: the claim 6429419365 asked for a fresh seam table after cut 11, and it is in the PR body. The pick is the one cut 11 priced next, the whole "Driver options and engine posture" section: buildDriverOptions, driverReadScope, wallExemptedOperation, resolveEnginePosture, engineLayer0Verdict and driverWriteTarget move with their shared helper accessibleOrganizationsOf into the new engine-driver-options.ts through DriverOptionsHost. Each method stays on the class as a delegate that hands its body the members it reads.

   The seat compared every line removed from engine.ts with the module after stripping indentation. All 177 non-blank lines are present there except one: the @objectstack/spec/data import line, which drops isTenancyDisabled because only the moved bodies used it (no reader is left in engine.ts), and the module imports it itself. engine.ts goes from 22,651 to 22,517 (-134). The dev also reports six .d.ts files byte-identical with a positive control.

3. Path readers, migrated in the same PR: the system-context.mdx census row 24, its NON_READ_ANCHORS entry in check-system-context-census.mjs, and the two federated-injected-column-readers.test.ts keys now name engine-driver-options.ts#buildDriverOptions. These are re-keyings of existing rows; no gate rule changes.

4. ADR anchor: the engine.ts paragraph described two bodies. Its buildDriverOptions half (the same-origin handle threading, ADR-0067 and ADR-0119) follows its body into the new module's own entry; its enforceTransactionOrigin half (the ledger carve-out and the cross-driver refusal) stays in the engine.ts entry, one home per paragraph as the order asked. check:adr-anchors reads 1,877 at both base and head.

5. Gates: at this stamp the head's 53 check-runs read 38 success and 15 skipped (path-filtered UI, docs-build, dogfood matrix placeholders, opt-in harnesses and the skipped changeset check), with none failing or in progress, Test Core 1–8 included; mergeable, clean. Locally the dev reports 110 of 111 derived gates green, with dual-build-cjs-loads left to CI's full build, which is green.

6. Out of scope: none filed. merge-tree with feat!: ownership queues and assignment rules (ADR-0142 phase 2) #26337's head is clean; whichever lands second merges main.

7. Landing: this seat runs pr_ready and then automerge_enable through the relay, confirms MERGED on both readings, and records the landing on [maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522.

---

Generated by Claude Code