ADR-0053 D-F1 declares `findWithWindowFunctions` "not covered" in THREE places — all three become false when PR #16716 lands, leaving the governed declaration narrower than what is enforced

[os-musk]

Filed by the domain:engine execution PM seat. Surfaced as F4 of the contract-review audit on PR #16716 (5578892124, PASS WITH FINDINGS). ⛔ Deliberately filed as its own governed card rather than folded into #16716 — see Why this is not a rider.

⛔ Filed unassigned and unlabelled, as an observation for triage. ⚠️ Governed surface (docs/adr/**) ⇒ whatever PR carries it is draft-only, terminal four-step, human merge.

The carriers, measured on origin/main ed7243d52b

The audit named two. There are three, and the one it did not name is the most-read line in the file:

#	where	text
1	:3 — the ADR's own Status line	"every @objectstack/driver-sql record read door but findWithWindowFunctions (#16609) presents Field.datetime values and the builtin created_at / updated_at audit stamps as the canonical … text on every dialect"
2	:1081	"findWithWindowFunctions is not one of these doors"
3	:1157	"Not covered: findWithWindowFunctions, which applies no read presentation of any kind today"

⇒ ⭐ carrier 1 is a status line, the sentence a reader takes as the ADR's summary without opening the addendum. The audit's F4 reads :1080-1081 and :1157-1159; a fixer working only from that list would leave the ADR's headline claim false.

Non-governed sibling, also false after the merge and repairable in the code PR: packages/drivers/driver-sql/src/sql-driver-13973-canonical-iso-read-door.test.ts:20-22.

What makes them false

PR #16716 (#16609) routes SqlDriver.findWithWindowFunctions's rows through the same formatOutput pass every other read door uses. ⇒ on the day it lands, the door is one of these doors, it does apply read presentation, and it is covered.

⚠️ The direction of the resulting error is the one the D-F addendum exists to prevent. Its own stated purpose is to keep the declaration as narrow as the enforcement; after #16716 the declaration would be narrower than the enforcement — the inverse. A reader would be told a door hands out raw storage forms when it no longer does, and (per the sibling card #16728, filed for the same class one layer out) the concrete cost of that shape is that it invites a defensive ?? the governing ruling forbids.

Why this is not a rider on #16716

⛔ One governed path decides the whole PR — there is no proportional weighing. Folding a one-line ADR amendment into #16716 converts a Clause-②: yes code PR into a governed PR: draft-only, terminal four-step, human merge. That is a materially different landing path for a change whose substance is driver code.

⇒ Separate card, and the audit itself offers this as the alternative. ⚠️ Sequencing matters and is the seat's to manage: if the code lands first there is a window in which the ADR is false. This card should land before or with #16716, and #16716's body must link it before merge.

Suggested shape, not asserted

One docs-only governed PR amending all three carriers plus the non-governed test header, stating that findWithWindowFunctions presents its rows like every other read door as of #16609.

⚠️ Two things a fixer must not flatten:

1. ⭐ The door moves SEVEN classes, not the two D-F1 rules. The audit enumerated them from formatOutput: the two instant classes plus Field.boolean, Field.object/JSON, numeric strings, Field.date, Field.time, and the external.columnMap row-key rename — the last of which "nobody named". ⇒ D-F1 rules two column classes; the amendment must not silently imply the ADR now governs all seven. Say what the door does, and say which of it D-F1 rules.
2. The Invalid-Date carve-out (D-F3) stays. The status line already carries it ("save an Invalid Date, which has no canonical text and passes through unchanged"). ⛔ An amendment that drops it re-introduces exactly the overstatement PR feat(driver-sql): the read door presents datetime values and audit stamps as canonical ISO-Z text on every dialect (#13973, B1 narrow) #16619's own contract review returned a finding for.

Boundaries

• ⛔ Do not fold into fix(driver-sql)!: findWithWindowFunctions presents its rows like every other read door (#16609) #16716, and ⛔ do not fold fix(driver-sql)!: findWithWindowFunctions presents its rows like every other read door (#16609) #16716 into this.
• ⛔ Do not edit content/docs/releases/.
• ⚠️ Adjacent, distinct, already carded: [finding] Seven out-of-package comments still say formatOutput's audit and datetime repairs sit inside if (this.isSqlite) — false since PR #16619 landed, and one of them tells readers a declared Field.datetime is NOT protected on Postgres/MySQL #16728 (seven out-of-package comments still describing the pre-feat(driver-sql): the read door presents datetime values and audit stamps as canonical ISO-Z text on every dialect (#13973, B1 narrow) #16619 if (this.isSqlite) gate). Same failure class — a declaration left behind by a landing — different surface and different governance. ⛔ Not a duplicate.
• ⚠️ Line numbers are origin/main ed7243d52b and will drift — ⛔ 按符号重新推导, and for prose read the lines rather than matching a pattern.

[os-musk]

Closing as a duplicate of #16782. ⛔ The duplicate is mine, not theirs: #16782 was filed by the director seat at 05:16:05Z, eighteen minutes before this card at 05:34:44Z, from the same audit finding (5578892124 F4). I did not open it before filing.

Everything unique to this card has been folded into #16782 in comment #16782 (comment):

1. The third carrier at :3 — the ADR's Status line, which docs(adr-0053): D-F1 says findWithWindowFunctions applies no read presentation — false once #16716 merges (governed, docs-only) #16782's list did not name. It is the line a reader takes as the ADR's summary without opening the addendum, so a fixer working only from the two addendum sites would leave the headline claim false.
2. The two "must not flatten" constraints — the door moves seven classes while D-F1 rules two, so the amendment must say what the door does and separately which of it D-F1 governs; and the D-F3 Invalid-Date carve-out stays (dropping it re-introduces the overstatement PR feat(driver-sql): the read door presents datetime values and audit stamps as canonical ISO-Z text on every dialect (#13973, B1 narrow) #16619's own contract review returned a finding for).

⛔ Direction of the merge, and why it is this way round. #16782 is already cemented in two places this card is not: PR #16716's body references it, and so does a committed source comment on that branch. Closing #16782 in favour of this card would require a reference swap in committed code. The cheaper repair is the one that touches nothing already cemented.

⭐ Correcting this card's own sequencing. This card said the ADR amendment should land "before or with" #16716. That is wrong and #16782's "open after #16716 is merged" is right: a declaration left narrower than the enforcement is tolerated for a window; a declaration left wider than the enforcement is precisely what the D-F addendum exists to prevent. Landing the ADR first would create the error the card is filed against.

For the record on how this collision happened: the director seat posted its patch-round report at 05:33:07Z, ~90 seconds before this card was authored. ⭐ The guard that actually worked was the dev's read-before-edit on the branch head — ⛔ not any coordination between seats.

Work continues on #16782.

---

Generated by Claude Code