feat(engine)!: `findOne`, `update` and `delete` declare what they answer, and their hook seams are guarded (#16231) by os-musk · Pull Request #16783 · objectstack-ai/objectstack

os-musk · 2026-09-08T05:16:38Z

Clause-②: yes

Executes the maintainer ruling on #16231 — option A, 「同意」, director seat summon #17, decision batch #2, comment 5572153316. Options B (declare only, no enforcement) and C (record any as intended) were refused there and nothing here reopens them.

Angle brackets do not survive this body's sanitizer, so declared types are spelled with square brackets, the same convention the card uses: Promise[Record[string, any] | null] is the real generic.

What this changes

engine.ts has four return hookContext.result sites, one per hook-bearing verb. #15823 closed the find() one — an afterFind handler that replaced the array made a method declared Promise[any[]] resolve to an envelope, silently — and recorded that it could close only that one, because the other three declared Promise[any] and carried nothing a handler could break. A guard cannot exist before a declaration worth guarding does. This PR writes the three declarations down and then closes their seams.

verb	declared before	declared now	where the shape comes from
`findOne`	`Promise[any]`	`Promise[Record[string, any] \| null]`	`driver.findOne` → `Promise[Record[string, unknown] \| null]`
`update`	`Promise[any]`	`Promise[Record[string, any] \| number \| null]`	by-id `driver.update` → record-or-null; predicate `driver.updateMany` → affected count (#4639)
`delete`	`Promise[any]`	`Promise[boolean \| number]`	by-id `driver.delete` → boolean; predicate `driver.deleteMany` → affected count

⭐ The shapes were derived from the code, not from an assumed symmetry with findOne. update and delete each have TWO driver exits and the dispatch ladder (resolveEngineUpdateDispatch / its delete twin) picks between them, which is exactly why their declaration is a UNION and findOne's is not. engine.ts states the predicate half in its own prose at the branch that feeds the realtime publish — the sentence cites #4639 and reads: "A predicate update … an affected-row COUNT, which the strip skips as a non-object." (The verb between those two words is a closing keyword, so it is elided here rather than parked beside a card number.)

⚠️ Row FIELD values stay erased (Record[string, any], not Record[string, unknown]). That is #15823's precedent extended exactly rather than softened: find() declares Promise[any[]], so the CONTAINER is the contract and the rows inside are any. It is also the only spelling that can state "record or null" at all, since any | null collapses to any in TypeScript. The strict alternative was measured and is reported on the card as a strictly larger option.

The census — done FIRST, posted on the card before any declaration shipped

The maintainer accepted ruling A on a stated precondition: count the consumers whose compilation the narrowing breaks, and post the number on the card. Discharged in comment 5578614790.

18 files · 92 compile errors, measured by compiling all 31 workspace packages twice:

control — turbo run typecheck --continue on the unmodified worktree at origin/main 5e53d73d83: 142 tasks, 142 successful, exit 0. A clean baseline, so every treatment error is attributable.
treatment — the same command with the declarations narrowed: 136 successful, 6 failed.
3 non-test src files / 9 sites; 15 test-and-pin files / 83 errors. ⭐ A census scoped to non-test sources would have said 3 files and been wrong by a factor of six — the pins are where this contract is encoded.
The dominant signature is TS18047: 'row' is possibly 'null': the null check the declaration exists to force.
objectstack-ai/objectui, cloned at 67299bf43b: 0 consumers (386 files import @objectstack/spec — the positive control fires — and zero name IDataEngine, IObjectQLEngine, IScopedObjectRepository or IScopedContext). objectstack-ai/cloud is not reachable by this session and is unmeasured; so are npm consumers outside the org.

Every one of the 92 is repaired here.

A second drift class the GUARD found, that the type could not

Four test doubles answered shapes their own IDataDriver contract does not have, invisible while the engine door said any:

{ deleted: 1 } / { deleted: 0 } from delete / deleteMany — packages/spec/src/contracts/data-engine.test.ts, packages/runtime/src/seed-loader.test.ts, packages/objectql/src/engine-filter-tokens.test.ts
an ARRAY of rows from updateMany, which declares Promise[number] — packages/objectql/src/plugin.integration.test.ts (two doubles)
undefined from a bare vi.fn() on update / delete — packages/objectql/src/engine.test.ts (two doubles)

All repaired to the declared shapes, and the { deleted: n } envelope now has a pin of its own so it cannot come back.

⚠️ That discovery changed the refusal's wording, and the change is load-bearing. find()'s refusal can say "your handler replaced ctx.result" because the value at that seam always comes from driver.find, which every driver answers with an array. These three verbs have exits that can answer off-contract themselves, so the sentence now names the SEAM and accuses nobody — "after the 'afterUpdate' dispatch 'ctx.result' is undefined" — and developerMessage names BOTH possible sources. A sentence blaming the handler would have sent four of the repairs above to the wrong file.

Symbols re-derived on `origin/main`, with firing controls

The card's own anchors (:9565 / :9784 / :12103 / :13537, at bdc02182b) had all drifted, so everything was re-derived by symbol via git show origin/main:..., never from a working tree.

Firing control: hookContext occurs 116 times in engine.ts, which is 15,020 lines — both matching the dispatch's stated readings exactly.
four return hookContext.result sites: :9599, :9818, :12137, :13572
find :9439 → Promise[any[]]; findOne :9705, update :10871, delete :13089 → all Promise[any]
packages/spec/src/contracts/data-engine.ts :276 / :278 / :279; scoped-context.ts :148 / :164

The surface the ruling does not name — reported, not absorbed

ObjectRepository at engine.ts :14498+ is the same contract, not a separate one: export class ObjectRepository implements IScopedObjectRepository, the very interface the ruling names at scoped-context.ts:148/164. But narrowing the interface does not narrow the class, because TypeScript's implements accepts Promise[any] against any declared return — any is assignable in both directions.

That matters because ScopedContext.object(name): ObjectRepository returns the class, and ScopedContext IS HookContext.api. ⇒ a hook author writing ctx.api.object('task').findOne(...) still reads any after this PR; only a consumer who annotates the api as IScopedContext gets the narrowed answer. ⛔ Not fixed here — it needs its own consumer census, and widening this PR to take it is what the dispatch forbade. Same for IScopedObjectRepository.updateById (scoped-context.ts:167), still Promise[any]; the ruling names :148/164 and not :167.

Verification

Two-leg ablation, blob-hash-verified restore, measured at c5935b2445 — this patch round touched no file in verb-hook-result-shape.ts's closure, so the reading stands as taken and is stamped rather than restated as if re-run. The three shape predicates in verb-hook-result-shape.ts were mutated to always answer "legal".

⚠️ Two earlier attempts are reported rather than hidden. The first mutation did not COMPILE (TS6133, an unused symbol), so dist never carried it and ablation-dist-preflight correctly said ABSENT. The second compiled but carried its marker in a // comment, which the bundler strips — again ABSENT. Only the third, whose marker is a live string literal read through .length, is the measurement below.
mutate leg: marker on disk 0 → 3 · blob eb59c5c9… → 352bd54d… · pnpm --filter @objectstack/objectql build exit 0 · ablation-dist-preflight … ABLATION_16231_GUARD_DISABLED → ✓ marker present in 4 built files, exit 0 · pin suite 15 failed | 14 passed (29).
restore leg: git checkout HEAD -- PATH · RESTORE ok: blob eb59c5c9e87e67ceb0371bb3084d85ec70338310 == HEAD · git diff HEAD for the path EMPTY · preflight --absent → ✓ marker absent from all 14 built files and ✓ tree: working tree clean against HEAD, exit 0 · pin suite 29 passed (29).
⭐ The 14 that stayed green are held by DESIGN, and that is the correct reading, not a broken ablation. They are exactly the "declared limbs are answerable" cases (7), the "shaping stays legal" cases (5) and the vocabulary cases (2) — none of which exercises a refusal. Every one of the 15 refusal cases went red. The layer holding those 14 is the ENGINE's own dispatch and the driver contract, which the guard does not create and must not disturb; a guard-ablation that reddened them would mean the guard had taken over behaviour it only checks.

Tests, working tree clean on each measurement. Every row but one was measured after the commit c5935b2445, and this patch round changes no file those packages compile. @objectstack/spec IS re-measured, on the current head 10d7a9f1d9, because this round adds three cases to packages/spec/src/contracts/data-engine.test.ts:

package	result
`@objectstack/objectql`	286 files / 4837 passed, 0 skipped
`@objectstack/spec`	465 files / 12955 passed, 0 skipped — re-measured on `10d7a9f1d9`; 12952 at `c5935b2445`, and the +3 are this round's F2 pins
`@objectstack/metadata`	52 files / 797 passed, 0 skipped
`@objectstack/metadata-protocol`	169 passed + 2 skipped files / 2433 passed + 10 skipped tests
`@objectstack/plugin-auth`	104 files / 2191 passed, 0 skipped
`@objectstack/plugin-approvals`	42 files / 705 passed, 0 skipped
`@objectstack/rest`	192 files / 3241 passed, 0 skipped
`@objectstack/runtime`	240 files / 3340 passed, 0 skipped
`@objectstack/service-automation`	125 files / 1486 passed, 0 skipped

⚠️ The skipped faces, named and counted — 2 files, 10 tests, both environment-gated on OS_TEST_MYSQL_URL and unrelated to this change: src/migrations/seed-tenancy-backfill.live-mysql.test.ts (5) and src/migrations/sys-setting-identity-index.live-mysql.test.ts (5), both describe.skipIf(!MYSQL_URL).

typecheck legs. tsc --noEmit and the per-package check:test-typecheck ratchet both ran. The ratchet is the leg that matters here, because it sees the test layer the plain build does not: @objectstack/objectql OK (44 files / 242 errors / 69 pinned signatures held), @objectstack/spec OK (54 / 261 / 145), @objectstack/runtime OK (27 / 191 / 69). @objectstack/service-automation compiles its tests through plain tsc --noEmit, which went from 30 errors to exit 0.

Gate reconciliation — derived and re-run in full on the FINAL head 10d7a9f1d9 (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RANFILE, exit 0). Verbatim:

Run reconciliation — 111 derived, 111 run, 0 NOT-MEASURED, 0 UNRUN.
✓ dispatch-gates --ran: 111 derived famil(ies) accounted for — 111 run, 0 NOT-MEASURED.

⛔ What that block is — and what an earlier revision of this body claimed it was. It reconciles COVERAGE: which derived families were run. It says nothing about VERDICTS. This body previously read “…, with all 111 exiting 0” beside it and offered the pair as this PR's gate evidence. The correction is to state what was actually measured, in two parts.

1. A gate's exit 0 is not automatically a reading. check:changeset-no-major run locally has no $GITHUB_EVENT_PATH, so it reads no clause-② declaration and does not judge the level axis at all — and it says so while exiting 0. Measured on head 10d7a9f1d9, verbatim from the gate:

ℹ️ LEVEL AXIS: NOT MEASURED — no clause-② declaration was readable for this PR, so whether `patch` fits the surface was not judged. This is neither a pass nor a failure (#4690).

⇒ that exit 0 sat inside the “all 111 exiting 0” count while the axis it names was RED on CI. The level axis was NOT MEASURED locally, and no local union run can measure it.

2. The verdicts, stated separately from the coverage, on head 10d7a9f1d9: 110 of the 111 exited 0 on the first pass. pnpm check:type-check-debt exited 3 — PREREQUISITE NOT MET, after an OOM under --max-old-space-size=4096 — which is ⛔ NOT MEASURED and never a pass. Re-run at 8192 (the gate pins tsc itself at 6144) it exited 0 with a real reading: 5 ledger entr(ies) re-measured in 177.5s, 55 raw tsc error(s) total, none above its recorded number. ⇒ 111/111 exit 0, one of them only on the second attempt.

The level axis, measured directly. The gate accepts --event, so the axis IS locally measurable once handed the payload CI reads. Same command on every leg, with this PR's real label set and Clause-②: yes.

GREEN on head 10d7a9f1d9 — exit 0:

✓ LEVEL AXIS: this PR declares clause-② `yes`, and no package whose `packages/*/src/**` it moves is graded `patch`.
   · carrier: `needs:contract-review` IS on this PR

RED on the same tree with the three consumer entries regraded patch — exit 1:

⛔ This PR declares clause-② YES and grades a package it grew `patch`.
     - @objectstack/metadata: patch   ← this PR moves @objectstack/metadata's packages/*/src/**
     - @objectstack/metadata-protocol: patch   ← this PR moves @objectstack/metadata-protocol's packages/*/src/**

⚠️ The red leg had to be COMMITTED to be visible: this gate reads changeset content through git show REV:PATH, so a working-tree edit is invisible to it. A first attempt mutated only the working tree, the gate stayed green, and that reading is reported void rather than quoted. Redone on a throwaway detached-HEAD commit (f45635a6a8), never pushed; branch ref and working tree verified unmoved afterwards.

⛔ That green does NOT grade @objectstack/plugin-auth. The red leg names TWO offenders while THREE entries were regraded. PUBLISHED_SOURCE_PATH (check-changeset-no-major.mjs:822) is anchored one directory deep, and this PR's plugin-auth path is packages/plugins/plugin-auth/src/objectql-adapter.ts — a level deeper — so that package never enters the grown set at all. That is #16713. The third entry reads minor because the rule says so, not because any gate confirmed it, and ⛔ this green must not be cited as covering it.

⚠️ The union was re-run on the final head deliberately: the ratchet families (check:type-check-debt, check:type-check-coverage, check:test-source-alias, check:cross-package-test-inputs, check:dual-build-cjs-loads, check:engine-double-contract) measure the tree, so a late commit moves exactly the readings a stale run would have quoted.

⚠️ The derivation itself ran on a STALE TREE, and said so. dispatch-gates reported this branch at least 64 commits behind origin/main, with 21 of the files it derives families FROM changed across that range — in its own words, “a well-formed answer about a tree nobody is on”. The 111 above is therefore this branch's family list, not current main's. Closing that gap is F7 of the contract review; the patch-round table below says why it is not done here.

The first derivation named 88; regenerating content/docs/references/** (the error-code ledger gained three codes) grew the change set and the re-derivation named 111. The extra 23 were run and reconciled. Two went red and were fixed rather than argued: @objectstack/spec check:docs (generated docs out of date — regenerated with gen:schema && gen:docs) and check:doc-authoring (a tracker id had landed inside a runtime string, which reaches operators who cannot resolve one). ⛔ On that run neither check:type-check-debt nor check:dual-build-cjs-loads refused with PREREQUISITE NOT MET: both ran on a fully built closure and reported real measurements (5 ledger entries re-measured, 55 raw tsc errors, none above its recorded number; entries/packages/cjsFiles/probes 104/67/620/1 vs floors 90/58/520/1). ⚠️ On the 10d7a9f1d9 re-run check:type-check-debt DID refuse once, under a 4 GB heap — measured and resolved in part 2 above; the two readings are about two runs, not a contradiction.

Changeset level, and the text it is based on

minor for @objectstack/spec and @objectstack/objectql, and — since F1 of the contract review — minor for the three repaired consumers as well, with the **BREAKING** banner and an ADR-0087 disposition. ⚠️ This paragraph read patch for the consumers until 951369f510; that grading is what F1 refused.

Governing text — the one this level is based on: the WHICH LEVEL maintainer ruling of 2026-09-04 (decision batch [WIP] Add query enhancements and advanced validation features #35, on finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294), recorded at .github/workflows/pr-automation.yml: "During the launch window major stays refused by check-changeset-no-major and breaking-ness is carried by the BREAKING banner plus the ADR-0087 disposition, not by the level", and "A purely additive widening of a published package's public surface … takes at least minor" — which this PR is on its own, since it adds three exported error classes, their codes and their shape predicates to @objectstack/objectql's index.
Text REJECTED as the ceiling: AGENTS.md's "a bug fix in a released package takes a patch changeset — never none". That is the floor against none, not a ceiling, and reading it as one would have shipped this at patch.
⛔ A green from check-changeset-no-major is not by itself the justification: its level axis has a measured blind spot for nested package dirs (carded as [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713). packages/spec/* and packages/objectql/* do match it, so it genuinely grades this one — but the argument above is the reason, not the gate.
ADR-0087 disposition: not-required (no-migration-prescription). Nothing authorable moves — no spec key, no authored metadata property, no accepted request shape, nothing for objectstack migrate meta to rewrite. ⚠️ type-surface-only is the category built for exactly this class and it is not claimed, because its predicate 2 (no-spec-diff) is mechanically false here: the surface the ruling names IS packages/spec/src/contracts/**. Reported below rather than worked around, and ⛔ the **BREAKING** token is carried rather than dropped — dropping it is the erosion [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 was filed to stop.

Contract-review patch round — handoff `5582311948`

The isolated CONTRACT_REVIEW_TIER review (comment 5580313505) returned CHANGES REQUIRED, and the re-review of 951369f51 (card comment 5586349339) restated what is still owed before undraft. Both sets, and where each item stands:

item	what the handoff asked	state
F1	raise the three consumer entries to `minor`, and correct this body's “111 run, all exit 0” claim	both halves discharged — levels at `951369f510`; the body correction is under Verification above
F2	a type-level pin for the three declarations under `check:test-typecheck`	discharged — `packages/spec/src/contracts/data-engine.test.ts`
F3	per-door runtime FROM/TO lines naming both sources	discharged — `.changeset/engine-verb-result-declarations.md`
F6	file the two follow-up cards, cite them here	discharged — both already open: #16786, #16787, now cited in 验收备注 below
F7	merge `main`	no longer owed — dropped by the re-review below, which reads `mergeable_state: clean`; note kept for the record
N1	the body still said `patch` for the consumers, and still claimed the 111-family run covered the head while the test table was stamped `c5935b2445`	discharged — both counts, above
F4 / F5	notes, no change owed	untouched

F2, measured in both directions. Three @ts-expect-error cases read the declared member type through IDataEngine[…], so no new engine double is introduced. They are enforced by check:test-typecheck and never by vitest, which strips types without resolving them — the #5286 mechanism that made eighteen pins in this repo phantom checks.

as shipped — exit 0: 54 file(s) / 261 error(s) / 145 pinned signature(s) held, identical to the reading before the pins ⇒ they add zero errors to an EXACT ledger.
ablated, all three declarations reverted to Promise[any] and proved on disk (each anchor 1 → 0, injected marker 0 → 3, blob 7907f0e2… → 6b7b43bf…) — exit 1:

  • src/contracts/data-engine.test.ts: 3 type error(s) carrying a signature the ledger does not
    record — ARRIVED: TS2578: Unused '@ts-expect-error' directive.

restored — git checkout HEAD -- PATH; blob back to 7907f0e2… == HEAD, and git diff HEAD for the path EMPTY.

⇒ reverting ruling A's DECLARATION half now reddens a gate. Before this round it reddened nothing anywhere, which is exactly what F2 named (ADR-0049).

F3. The changeset's runtime half was one sentence covering three doors, and it named only the handler. It is now three FROM/TO lines, one per door, each naming BOTH sources — an after* handler that assigned an off-declaration value, and a DRIVER whose own exit answered off IDataDriver — which is what each refusal's developerMessage already names. The driver limbs cited are read off packages/spec/src/contracts/data-driver.ts: findOne :181 and by-id update :198 (record-or-null), delete :209 (boolean), updateMany :266 / deleteMany :269 (affected count).

F7 — not done here, and no longer owed. The first handoff asked for main to be merged in, while this round's dispatch forbade it unless a conflict actually blocked an edit — “⛔ do not merge main in unless a conflict actually blocks an edit” — and none did. That conflict is now moot: the re-review of 951369f51 (card comment 5586349339, 2026-09-08) does not carry F7 in its owed set and reads mergeable_state: clean with CI 32 success / 0 failure. ⚠️ What does NOT go away is the measured consequence, kept above deliberately: the LOCAL family derivation still ran on a tree at least 64 commits behind, with 21 gate-defining files stale. CI grades the merge of head into base on every push, so the merged tree IS being judged — but no local union run on this branch has judged it, and this body does not claim otherwise.

N1 — the two false statements this body carried, both corrected. (i) “patch for the three repaired consumers” — the entries have read minor since 951369f510; the Changeset-level section now says so and names F1 as the reason. (ii) the 111-family run was quoted beside a test table stamped c5935b2445 — the union is now derived AND re-run in full on the current head 10d7a9f1d9, every measurement block above names the head it was taken on, and @objectstack/spec is genuinely re-measured there because this round changed one of its test files.

验收备注

Findings met on the way, recorded here rather than fixed in this PR:

ScopedContext.object(name) returns the CLASS, so the ruled narrowing does not reach ctx.api. Detailed above. A one-line annotation change plus its own consumer census. ⇒ filed as [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786, which carries item 2 below with it.
IScopedObjectRepository.updateById (scoped-context.ts:167) stays Promise[any] while its update sibling narrows. Not named by the ruling. ⇒ same card, [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786.
@objectstack/metadata-protocol declares record / data non-null on its row receipts, while engine.update's by-id exit can answer null — updateData's own comment states the mechanism ("the post-write readback … is also null when the row still exists but the write moved it out of the caller's row scope"). While the door said any this was invisible. This PR preserves the behaviour exactly and writes the disagreement down at byIdUpdateRecord rather than widening a shipped response shape as a rider.
check-adr-0087-registration's type-surface-only category cannot be claimed by the class it was built for when the narrowed declaration lives in packages/spec/src/contracts/**. Predicate 2 is no-spec-diff, and a spec-owned contract narrowing is the most likely shape of a published type-surface narrowing in this repo. The category's own header says the alternative an author reaches for is dropping the **BREAKING** token, which [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 exists to prevent. ⇒ filed as [finding] check-adr-0087-registration's type-surface-only category is unclaimable by the class it was built for: TWO predicates refuse it whenever the narrowed declaration lives in packages/spec/src/contracts/** #16787.
core-boundary.ratchet.test.ts flags a forbidden package name in any QUOTED string in core.ts's closure, import or not. Prose in a developerMessage naming the metadata protocol package reddened it. Correct-by-construction for the ratchet's purpose, surprising to hit from a message string; worked around in-file with a comment naming why.

⛔ #15267 does not ride along. It is the driver-layer twin (driver-sql / driver-turso publishing Promise[any] on five IDataDriver doors). Neither card contains the other, and ⛔ neither closes as a duplicate of the other.

Draft only. ⛔ Never ready, never auto-merge, never queue — the in-seat contract-tier review runs before anything lands, and needs:contract-review is hung on this PR.

Generated by Claude Code

…s measurement leg Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…heir hook seams Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…clare-engine-verb-results

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…codes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…prose Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…he off-contract driver doubles Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

github-actions · 2026-09-08T05:17:14Z

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/metadata-protocol, @objectstack/metadata, @objectstack/objectql, @objectstack/plugin-auth, @objectstack/spec, touching 35 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/objectql/src/find-hook-result-shape.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

37 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json dd2fd2003485df584092d3a35d774d3543c70686.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

2 changed file(s) yielded no anchor (packages/objectql/src/find-hook-result-shape.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
1 cross-cutting symbol(s) contributed no route anchor: updateData (4 routes)
1 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 66 pages)
4 name(s) were too generic to anchor anything (single lowercase words)
the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json dd2fd2003485df584092d3a35d774d3543c70686 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5780e5cdb08d935109849e73cc20e3b0f39fedb2 — the merge of head 47eea7a805763efa533cb22f1325d9df25db6413 into base dd2fd2003485df584092d3a35d774d3543c70686, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5780e5cdb08d935109849e73cc20e3b0f39fedb2 && git checkout 5780e5cdb08d935109849e73cc20e3b0f39fedb2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin dd2fd2003485df584092d3a35d774d3543c70686 47eea7a805763efa533cb22f1325d9df25db6413 && git checkout -B drift-repro dd2fd2003485df584092d3a35d774d3543c70686 && git merge --no-ff 47eea7a805763efa533cb22f1325d9df25db6413

node scripts/docs-audit/affected-docs.mjs --json dd2fd2003485df584092d3a35d774d3543c70686

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs dd2fd2003485df584092d3a35d774d3543c70686 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

os-zhuang · 2026-09-08T06:26:00Z

Contract review (`CONTRACT_REVIEW_TIER`, isolated seat) — PR #16783 @ `c5935b2`

Verdict: CHANGES REQUIRED — one required gate is red on the head (Check Changeset, level axis), which makes the PR unmergeable regardless of the review; the contract work itself is sound and would be PASS WITH FINDINGS once F1 is fixed.

Ruling implemented: exactly — three declarations (data-engine.ts findOne/update/delete, scoped-context.ts:148/164, ObjectQL itself), three seam guards mirroring find()'s, pins per verb, the census posted on the card before any declaration moved (comment 5578614790), consumer repairs the census names, changeset minor on @objectstack/spec + @objectstack/objectql with the **BREAKING** banner and an ADR-0087 disposition, #15267 not ridden along. Wider only by the three exported predicates/error classes on @objectstack/objectql's index, which is the #15823 precedent's own pattern. Two surfaces outside the ruling's anchors (ObjectRepository/ctx.api, updateById) are reported, not absorbed — see F6.

Read independently: PR body, its one bot comment, card #16231 body + all 8 comments; code via git fetch of the head into a throwaway ref against origin/main (merge-base 8ccf7a1d); CI via check runs and the failing job's log. Nothing in the PR body was taken on trust.

1. The ruling, verbatim, and its provenance

Card #16231, comment 5572153316 (hotlong, MEMBER, director seat), 2026-09-07:

Ruling recorded — A: findOne / update / delete declare what they answer, and the hook seam is guarded the way find() is — after the breakage is measured first (director seat, summon #17, decision batch #2, 2026-09-07)

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat (session_01XesLUWmuhjuRwmU618AZ1M), 2026-09-07T14:4xZ, batch #2 presented as 1B · 2A · 3(1) · 4A · 5(2) with this card as item 4 recommending A with a measure-first premise (the 5571647365 four-facet block); reply, verbatim: 「同意」.

Ruled. The find() rule from #15823 extends to the other three verbs: ObjectQL.findOne declares a record-or-null result, update and delete declare their result shapes (packages/spec/src/contracts/data-engine.ts:276-279 and the scoped-context mirrors at scoped-context.ts:148/164, read on origin/main), and each hook seam guards hookContext.result against its declaration exactly as find() now does. Options B (declare only) and C (record any as intended) are refused.

Premise the dev verifies before any declaration moves (the confidence gap the maintainer accepted): count the consumers, in-repo and in the consuming repos this session can reach, whose compilation the narrowing breaks; post the number on this card. A large number is a fork to report with the list, ⛔ not a reason to fall back to B silently — the ruling stands, the sequencing is the seat's.

Execution, domain:engine lane: one PR — three declarations, three seam guards, pins per verb, consumer repairs the census names, changeset minor for @objectstack/spec (and the engine package) with the BREAKING banner + ADR-0087 disposition (a published .d.ts narrows). Clause-②: yes ⇒ dispatch at CONTRACT_REVIEW_TIER or with the carrier as compensation. #15267 (the driver-layer twin) does not ride along.

This is a maintainer ruling (verbatim 「同意」 to a batch whose item 4 recommended A), recorded by the director seat with provenance — not a seat or triage preference. Triage (5571647365, os-zhuang) recommended A but explicitly did not rule. The "WHICH LEVEL" text the changeset cites is likewise a maintainer ruling (batch #35, on #15294) recorded verbatim in .github/workflows/pr-automation.yml:667-682. The PR body's citations are accurate.

2. Files vs merge-base, governed paths

31 files (A 3, M 28), 8 commits on the branch. Governed paths (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/**): none touched. The two content/docs/references/api/*.mdx edits are the AUTO-GEN surface (AGENTS.md:677), regenerated by gen:schema && gen:docs; the drift bot's "4 release-owned pages affected" is about pages that name touched symbols, not pages this diff edits.

3. The contract change

verb	`origin/main`	head	driver exit(s) actually reached
`IDataEngine.findOne` / `ObjectQL.findOne` / `IScopedObjectRepository.findOne`	`Promise<any>`	`Promise<Record<string, any> \| null>`	`driver.findOne` → `Record<string, unknown> \| null`
`IDataEngine.update` / `ObjectQL.update` / `IScopedObjectRepository.update`	`Promise<any>`	`Promise<Record<string, any> \| number \| null>`	by-id `driver.update` → record-or-null; predicate `driver.updateMany` → count (only two `result =` assignments exist inside `update()`, `engine.ts:11839` and `:12047`)
`IDataEngine.delete` / `ObjectQL.delete`	`Promise<any>`	`Promise<boolean \| number>`	by-id `driver.delete` → boolean; predicate `driver.deleteMany` → count

No throw arm was added to the declarations; the guards add one runtime arm each. "Hook seams are guarded" in code: verb-hook-result-shape.ts exports three typeof/Array.isArray container predicates (isFindOneResultShape, isUpdateResultShape, isDeleteResultShape — identity-free, so in-place mutation and reassignment to a legal shape stay legal; false/0/null are admitted where declared; undefined refused everywhere), and engine.ts calls each immediately after the after* dispatch and before maskSecretFields/stripSearchCompanion*/realtime publish (:9819, :12105, :13585), throwing an error class with code+status (500) — the same placement and envelope as #15823's find() guard.

Consumers (in-repo, non-test, head): packages/metadata/src/loaders/database-loader.ts (3 sites), packages/metadata-protocol/src/protocol.ts (4 by-id engine.update sites + updateData), packages/plugins/plugin-auth/src/objectql-adapter.ts (2), packages/runtime/src/sandbox/body-runner.ts (2), packages/objectql/src/lifecycle/lifecycle-service.ts (2), packages/objectql/src/validation/rule-validator.ts, packages/core/src/utils/{bulk-write,metadata-activation-store}.ts, packages/platform-objects/src/system/migration-flag.ts, packages/metadata-protocol/src/migrations/recorded-by-sentinel.ts, spec migration entries (prose examples), examples/app-showcase (3 ql.update calls, result discarded), examples/app-todo (its own engine shape on the action ctx, not IDataEngine). apps/* and examples/* are workspace members (pnpm-workspace.yaml) and were inside the turbo run typecheck census. Compiled types move only where a result is read without a null check or where the number limb reaches a record slot — the three non-test files the census names, plus 15 test files; I found no fourth. Runtime behaviour on the published doors: yes (Clause-②) — three new 500 refusal paths at the seams. Against every in-repo driver (memory results[0] || null, sql results[0] || null / formatOutput(...) || null / count > 0, mongodb ?? null / deletedCount > 0, turso ?? null / rowsAffected > 0) every exit is on-contract, so no in-repo caller's runtime output changes; the only measured runtime effects were the seven off-contract test doubles the PR repairs. The consumer repairs are no-ops on reachable paths (number limb unreachable from by-id calls) — verified against resolveEngineUpdateDispatch's use at :11252.

4. Changeset

.changeset/engine-verb-result-declarations.md: @objectstack/spec: minor, @objectstack/objectql: minor, @objectstack/metadata: patch, @objectstack/metadata-protocol: patch, @objectstack/plugin-auth: patch. **BREAKING** banner present;  parses — check-adr-0087-registration on the head logs [BREAKING+bang] not-required (no-migration-prescription); the ! commit owes both and both are present. major correctly refused/absent. But the level axis is red — see F1. Type FROM/TO per door is stated; runtime FROM/TO is stated once for all three doors — see F3.

5. Tests

packages/objectql/src/engine-verb-hook-result-shape.test.ts: 29 cases (9/9/9 per verb + 2 vocabulary), counted independently; 15 refusal cases assert instanceof + code + status + event + object + observed via an outcomeOf capture (no bare toThrow()), 14 answerability/shaping cases exercise the real engine over an on-contract driver. Refusal cases redden if any guard is removed (consistent with the PR's 15/14 ablation; the 14 greens are held by the engine/driver, correctly). The { deleted: 1 } envelope has its own pin; the sanitizeRowError SQL-verb constraint is pinned. ErrorCode.safeParse control rejects a near-miss spelling. No it.skip/.only/.todo/xit in any changed test file (scanned all 17). Typecheck coverage: tsconfig.test.json includes src/**/*, typecheck chains check:test-typecheck; CI Type Check · workspace / debt ledger green. The seven double repairs (data-engine.test.ts, engine.test.ts, plugin.integration.test.ts, engine-filter-tokens.test.ts, seed-loader.test.ts) are as described. Gap: the declarations themselves have no pin — see F2.

6. ADR-0112 / vocabulary ledger

FIND_ONE_HOOK_RESULT_NOT_RECORD, UPDATE_HOOK_RESULT_NOT_WRITE_SHAPE, DELETE_HOOK_RESULT_NOT_WRITE_SHAPE are registered in ERROR_CODE_LEDGER (error-code-ledger.zod.ts) with owner/meaning comments, carry readonly status = 500 (what check:error-status-conformance derives from), and the generated contract.mdx / error-code-ledger.mdx are regenerated (+3). The registration footprint is byte-for-byte the precedent's: the six non-test files naming FIND_HOOK_RESULT_NOT_ARRAY on main are exactly the six naming the new codes on the head. ADR-0130 in this repo is the release-artifact co-ownership boundary and has no interplay with these codes; the runtime vocabulary these must be in is ADR-0112 D3/D4's ledger, and they are.

7. CI on head `c5935b2445`

38 check runs: failure 2 (Check Changeset, both workflow runs — same cause, F1), success 30, skipped 6 (Auto Label/Check PR Size duplicates, Packed-tarball smoke (opt-in) ×2, Console Pin Gate), in_progress 0. mergeable_state: unstable. Head is 17 commits behind origin/main (dd2184ae), merge-base 8ccf7a1d.

Findings

F1 — BLOCKING. Check Changeset is red on the level axis. Log, verbatim: ⛔ This PR declares clause-② YES and grades a package it grew patch. naming @objectstack/metadata: patch and @objectstack/metadata-protocol: patch. @objectstack/plugin-auth: patch is the same case and escapes only through the gate's packages/*/src/** blind spot the PR body itself cites (#16713). The PR body's "111 derived, 111 run, all exit 0" is not a reading of this axis: run locally, check-changeset-no-major has no $GITHUB_EVENT_PATH, reads no declaration, and reports NOT MEASURED with exit 0. Expectation: raise the three consumer entries to minor (the fixed group versions in lockstep, so the published version outcome is identical) — or, if the seat rules the declaration wrong for consumer repairs, have that ruled rather than tolerated in the gate; and correct the body's gate claim to say the level axis was NOT MEASURED locally.

F2 — The three declarations have no pin; only the guards do. Reverting findOne/update/delete to Promise<any> while keeping the guards reddens nothing: every census repair (if (!row), typeof x === 'number' ? … : …, result!.assignee) and the one new typed helper (writtenRow(result: Record<string, any> | number | null)) compiles identically against any. Ruling A's declaration half is therefore unenforced (ADR-0049). Expectation: a type-level pin under check:test-typecheck in packages/spec/src/contracts/data-engine.test.ts — e.g. // @ts-expect-error on an un-null-checked property read of findOne's result and on delete's result used as a record, and a number-limb narrowing that fails to compile if update widens back to any.

F3 — Changeset runtime FROM/TO is aggregated, not per door. The type FROM/TO is per verb, but the runtime change ("a host that installs after* handlers … now receives a refusal") is one sentence for three doors, and omits the second source the PR's own developerMessage names: an off-contract driver answer now trips the refusal too. Expectation: three FROM/TO lines (per door: FROM whatever the dispatch left, returned silently → TO 500 <CODE>), each naming both sources.

F4 — byIdUpdateRecord (metadata-protocol/src/protocol.ts) throws a bare Error with no ADR-0112 code on the number limb. Unreachable by construction today, so acceptable as an invariant assertion; note that if it ever fires at an HTTP door it demotes to a generic 500 with no branchable code.

F5 — Observation, no change owed. The update guard checks the batch hookContext after the per-row afterUpdate fan-out; per-row contexts are separate objects (buildPerRowAfterContexts), so a per-row handler's ctx.result reassignment never reaches the seam. That matches the ruling (the batch context is what the call returns) but the engine.ts:12117 comment "a per-row handler can reassign it" overstates it, and no pin covers the per-row path.

F6 — Reported gap is real; needs a card number before landing. ScopedContext.object(name): ObjectRepository (engine.ts:14728) returns the class, whose five verbs still declare Promise<any> (:14571–:14612), so the hook author's door ctx.api.object(x).findOne() is not narrowed. The PR reports it and the PM seat said it will file; no card is referenced yet on the PR or #16231. Expectation: the follow-up card numbers (this and the type-surface-only gate defect) appear on the PR before it leaves draft.

F7 — 17 commits behind main; mergeable_state: unstable. Bring the branch up to date after F1 so the gate re-reads on a current merge-base.

Seat boundaries: no approval/review action, no label, title, body or branch change, no merge, no file edited; throwaway review refs deleted.

Generated by Claude Code

…ause-② declaration requires `Check Changeset`'s level axis is red on this PR: it declares `Clause-②: yes` and grades three packages whose `src/**` the diff moves at `patch`. A purely additive widening of a published package's public surface takes at least `minor` (maintainer ruling 2026-09-04, decision batch #35, on #15294). `@objectstack/metadata` and `@objectstack/metadata-protocol` are the two the gate can name. `@objectstack/plugin-auth` rises for the same reason and is NOT graded by the gate: `PUBLISHED_SOURCE_PATH` is anchored `^packages/([^/]+)/src/` and this package's changed source is `packages/plugins/plugin-auth/src/` — one directory level deeper, so it never enters the gate's "grown" set. That is the blind spot carded as #16713. The level floor comes from the act the PR declares, not from what the instrument happens to measure. No source, test or config byte moves; the level axis is the only thing this commit answers for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…seam guards Ruling A has two halves — the declarations and the seam guards — and only the guard half was pinned. Reverting `findOne` / `update` / `delete` to `Promise<any>` while keeping the guards reddened nothing: every consumer repair the census produced compiles identically against `any`, so those repairs record that a narrowing once happened, not that it still holds. That is ADR-0049's enforce-or-remove target. Three `@ts-expect-error` cases under `check:test-typecheck` close it, on the mechanism the neighbouring #12248 block already relies on: each directive is resolved by tsc today, so a widening back to `Promise<any>` leaves it UNUSED, which is itself an error in a file whose debt ledger is exact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…urces The type FROM/TO was already per verb; the runtime half was one sentence for three doors and named only the handler. The refusals' own `developerMessage` names TWO sources — an `after*` handler that assigned an off-declaration value, and a driver whose exit answered off `IDataDriver` — and the second one is the source the seven test-double repairs in this PR actually came from, which is why the refusal sentence names the seam instead of accusing the handler. Three per-door lines now carry FROM (what the dispatch left, returned silently, and who read it first) to TO (the registered 500 code raised at that seam). Driver limbs cited are read off `packages/spec/src/contracts/data-driver.ts`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

…clare-engine-verb-results

The merge of `origin/main` brought fourteen newly registered error codes into `ERROR_CODE_LEDGER`; this branch adds three. Neither side's bytes can be text merged into the other — both files are generated — so `os-regen-merge.sh` took main's side in the merge commit and this commit re-derives them from the merged source with `gen:schema && gen:docs`. `contract.mdx`'s `Enum<... +N more>` counter reads `+325` = main's `+322` plus this branch's three. `error-code-ledger.mdx` carries both sides' rows; all four hook-result codes (the three added here and the `find()` sibling) are present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018rzQyhLGC5iVs11V3TzRs5

os-regen-merge.sh step 2 took origin/main's side of the generated `content/docs/references/api/contract.mdx` (both sides had moved it — PR #16783 on main, the `refusal` row here); the pre-commit collection point then asked for `gen:schema && gen:docs` on the merged tree, which re-derives the page with both sides' content. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MkQhmuuJAVDjmeWNixwDDH

os-bill · 2026-09-09T07:00:44Z

Director seat adoption record — POST-MERGE audit (leak) — summon #20, session_01Tep4AYXZvyBA7jsvne5KZV (os-bill), 2026-09-09T07:00Z. This PR was flipped ready (06:09:23Z), enqueued (06:11:15Z) and merged (06:36:36Z, squash 854639b3) by os-musk with needs:contract-review still on the PR and on card #16231, and with no CONTRACT_REVIEW_TIER verdict on record for the merged head 47eea7a805 (the last verdict, 5586330317, is on 951369f51). The verdict below is the record the landing lacked: adopted verbatim from an isolated contract-review subagent (explicit model = CONTRACT_REVIEW_TIER); transcript tier check before adoption: every harness-stamped model field reads claude-fable-5-1 (69 stamps, no other value). Merged head re-read at posting time = 47eea7a805. The landing itself (queue entry on an open carrier) is recorded as an incident on #17040 and in the director ledger on #12708; the contract question is answered below.

Contract review (`CONTRACT_REVIEW_TIER`, isolated seat) — PR #16783 @ `47eea7a805763efa533cb22f1325d9df25db6413`

Verdict: PASS WITH FINDINGS

Read-time state, stated first because it changes what this review is: the PR is already merged — squash commit 854639b3 on origin/main, merged_at 2026-09-09T06:36:36Z, merged_by os-musk, via the merge queue, with 0 reviews and no PASS posted on this head; card #16231 was closed by the squash's Fixes #16231 at 06:36:37Z. This review is therefore post-hoc on the contract and a boundary record on the landing. Everything below was re-derived from REST (card body + all 19 comments, PR body + 3 comments + timeline + 13 commits + 31 files + check runs) and from refs/pr-review/16783 fetched into the shared checkout; nothing was posted, no file was edited.

Owed items from the prior review

Owed set = 5586330317 (PASS-conditional @ 951369f51) as restated on the card at 5586349339, plus the first review 5580313505 (@ c5935b2).

item	asked	state @ `47eea7a8`	evidence
N1 (blocking, body) (a)	body said `patch` for the three consumers	discharged	PR body line 139: "`minor` for `@objectstack/spec` and `@objectstack/objectql`, and — since F1 … `minor` for the three repaired consumers" — matches `.changeset/engine-verb-result-declarations.md:1-7` (five entries, all `minor`)
N1 (b)	"111 run, all exit 0" claimed as covering the head; test table stamped `c5935b2445`	discharged as owed at `951369f51`	body lines 98-121: the reconciliation block is relabelled coverage-only, verdicts stated separately (110/111 first pass, `check:type-check-debt` exit 3 = NOT MEASURED then exit 0 at 8 GB), the level axis stated NOT MEASURED without an event payload and measured with `--event` (green line 115, red control line 122-125); `@objectstack/spec` re-measured on `10d7a9f1d9` (line 78); other rows attributed to `c5935b2445` with the reason that the round moved no file they compile (true: `951369f51..10d7a9f1` = changeset + `packages/spec/src/contracts/data-engine.test.ts` only). Residual staleness introduced by the two later commits is F1 below
F2	compile-time pin for the three declarations under `check:test-typecheck`	discharged	`packages/spec/src/contracts/data-engine.test.ts:216-247`: types read through `IDataEngine['findOne'
F3	per-door runtime FROM/TO naming both sources	discharged	changeset :30-34 — one `FROM:`/`TO:` line per door (:31 `findOne`, :32 `update`, :33 `delete`), each naming the `after*` handler AND an off-`IDataDriver` driver exit, each naming its code and `500`; `false`/`0` explicitly declared legal for `delete`
F6	cite #16786 / #16787 on the PR and on the card	discharged	body lines 155, 184-187; card 5586790316. Both cards exist and are open (`#16786` created 2026-09-08T05:22:54Z, `pm:queue`, `priority:p2`; `#16787` 05:23:22Z, `pm:queue`) — verified via REST
F1 (first review, both halves)	consumers to `minor`; body correction	discharged	changeset :3-5 all `minor` (commit `951369f51`); body correction as N1(b)
F7 (dropped by the re-review, re-owed by the takeover dispatch 5594622580)	merge `main`	discharged	`e031554e` merges `origin/main` @ `ee2cb6b4` (parents `10d7a9f1` + `ee2cb6b4`); `47eea7a8` regenerates the two `content/docs/references/api/*.mdx`
F4 / F5 / N2 / N3 / N4	record only	unchanged, re-verified at head	F4: `packages/metadata-protocol/src/protocol.ts:896-905` bare `Error`; F5: `packages/objectql/src/engine.ts:12117-12118` "a per-row handler can reassign it"; N3: `class ObjectRepository` :14557 with `findOne/update/updateById/delete/deleteById` still `Promise<any>` at :14571/:14589/:14597/:14604/:14612, `object(name): ObjectRepository` :14728; N4: predicates `(value: unknown): boolean` at `verb-hook-result-shape.ts:140/205/274`; `IScopedObjectRepository.updateById` still `Promise<any>` at `scoped-context.ts:168`
carrier re-hang on the patched head	seat act	done	PR: `needs:contract-review` labeled 2026-09-09T02:14:46Z by yinlianghui (on `47eea7a8`); card: 01:43:40Z by os-musk. On the PR at read time

Derived judgments

Increment since 951369f51 = four commits: a996f102 (+70 lines, the F2 pins, test-only), 10d7a9f1 (changeset prose +10/−1), e031554e (merge of origin/main @ ee2cb6b4), 47eea7a8 (mdx regen). Nothing moves a published contract beyond the PASS-conditional. The three-dot diff at head (ee2cb6b4...47eea7a8, = origin/main...refs/pr-review/16783) is the same 31 files, 1273+/96−, as at 10d7a9f1; per-file ±line hashes are identical for 30/31 files, the 31st (content/docs/references/api/contract.mdx) differing only in the generated … +322 more → +325 more counter at :30. The squash delta (854639b3^..854639b3) equals that three-dot delta file-for-file and hunk-for-hunk — the queue re-merge changed nothing.
The merge commit e031554e resolved conflicts in four files (git diff-tree --cc): packages/metadata-protocol/src/protocol.ts, packages/metadata/src/loaders/database-loader.ts, packages/objectql/src/plugin.integration.test.ts, packages/spec/src/api/error-code-ledger.zod.ts. For each, the head's hunks against ee2cb6b4 are byte-equal to 10d7a9f1's against 8ccf7a1d ⇒ both sides survived; nothing from main was dropped in source. The merge did take the PR side of the two generated mdx (37 lines of main's rows dropped relative to ee2cb6b4, not shown by --cc because the result equalled one parent); 47eea7a8 regenerated both, and at head every probed code present in main's zod ledger is present in the mdx (DUPLICATE_ARTIFACT_OBJECT_NAME, MEMORY_MULTI_TENANT_UNSUPPORTED, NO_SUCH_RUN, WALLED_MEMBERSHIP_POLICY_UNDECLARED) plus the three new rows; Build Docs and Lint & Repo Gates green.
Ruling A by symbol at head: packages/spec/src/contracts/data-engine.ts:276/:278/:279 → Promise<Record<string, any> | null> / Promise<Record<string, any> | number | null> / Promise<boolean | number>; scoped-context.ts:149/:165 mirror the first two; packages/objectql/src/engine.ts:9713/:10900/:13140 declare the same three; guards at :9832 (isFindOneResultShape), :12119 (isUpdateResultShape, after the per-row fan-out), :13592 (isDeleteResultShape), each immediately after the after* dispatch and ahead of maskSecretFields / stripSearchCompanion* / realtime publish — find()'s placement.
New error codes / ledger rows — yes, three, and each is registered: FIND_ONE_HOOK_RESULT_NOT_RECORD (error-code-ledger.zod.ts:710), DELETE_HOOK_RESULT_NOT_WRITE_SHAPE (:740), UPDATE_HOOK_RESULT_NOT_WRITE_SHAPE (:749), with owner/meaning comments; error classes carry readonly status = 500 (verb-hook-result-shape.ts:154-157/:217-220/:282-285); exported from packages/objectql/src/index.ts:205-223; generated rows in error-code-ledger.mdx:296/:348/:520 and contract.mdx:137/:189/:361. Clause-②: yes is right on that alone, and twice more: three published .d.ts doors narrow, and three new 500 refusal paths open on published verbs. The declaration line is body line 3; the carrier is on the PR.
Consumer repairs are no-ops on reachable paths: protocol.ts:896-905 refuses the number limb at four by-id ingresses (:1135/:12171/:12203/:12586), database-loader.ts:439-440 narrows it to null, objectql-adapter.ts:989/:1098 return null on it; all by-id by construction (payload id, no where/multi). The null-vs-non-null receipt disagreement is written down at protocol.ts:888-895, behaviour preserved.
Out-of-ruling surfaces correctly reported, not absorbed: the ObjectRepository class door ([finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786), updateById ([finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786), type-surface-only unclaimable ([finding] check-adr-0087-registration's type-surface-only category is unclaimable by the class it was built for: TWO predicates refuse it whenever the narrowed declaration lives in packages/spec/src/contracts/** #16787). [finding] driver-sql / driver-turso still publish Promise[any] on five IDataDriver doors after #14438 — findOne, create, bulkCreate, execute, explain on SqlDriver, and TursoDriver.create()'s own override #15267 not ridden along.

Semver / changeset

.changeset/engine-verb-result-declarations.md: @objectstack/spec, @objectstack/objectql, @objectstack/metadata, @objectstack/metadata-protocol, @objectstack/plugin-auth — all minor; title carries feat(engine)!:;  at :11 with its reasoning and the explicit non-claim of type-surface-only; **BREAKING** banner at :13; no major.
Coverage vs the diff (nearest package.json per touched file): non-test src moves in exactly five packages — spec (3 files), objectql (4 non-test files), metadata (1), metadata-protocol (1), plugin-auth (1) — all five graded. Test-only touches in @objectstack/plugin-approvals, @objectstack/rest, @objectstack/runtime, @objectstack/service-automation carry no entry: no published surface moves there and the fixed group versions in lockstep — nothing owed (seat ruling 5585473362 concurred with).
Level axis re-derived, not trusted: the head's scripts/check-changeset-no-major.mjs is byte-identical to the checkout's; run read-only with --base ee2cb6b4 --head refs/pr-review/16783 --event <payload built from the live PR: five labels + real body> → exit 0: ✓ This diff introduces no major bump. / ✓ LEVEL AXIS: this PR declares clause-② yes, and no package whose packages/**/src/** it moves is graded patch. / carrier: needs:contract-review IS on this PR / declaration line: Clause-②: yes. Without an event payload the same run prints LEVEL AXIS: NOT APPLICABLE at exit 0 — the body's "an exit 0 is not automatically a reading" point holds.
The [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713 blind spot is closed on this head: packagesTouched({from: ee2cb6b4, head}) from the gate itself returns nine packages including @objectstack/plugin-auth (the fix landed on main as fix(tooling): resolve the changeset LEVEL axis package from its manifest, so the 51 nested packages are candidates it can refuse #16969 c9a3deb3 and rode in with e031554e). So the green at 47eea7a8 DOES grade plugin-auth; the body's lines 129 and 142 saying it does not were true at 10d7a9f1 and are stale at head (F1). Check Changeset ×2 success on head. Job logs are proxy-blocked (HTTP 000), so the CI text itself was not read; the local reading above is on the identical script and inputs.

Boundary flags

Landed without the review it said it needed, by the seat account. PR timeline, verbatim actors: 06:09:23Z ready_for_review by os-musk → 06:09:27Z auto_merge_enabled by os-musk → 06:11:15Z added_to_merge_queue by os-musk → 06:36:36Z merged by os-musk (squash 854639b3), head_ref_deleted. Reviews on the PR: 0. The last review on the PR is 5586330317 @ 951369f51; no PASS exists for 47eea7a8. The record 5586349339 reserved this to the maintainer ("maintainer-merged when the above lands and the re-review passes … PR stays draft"), and the PR body's own line 192 reads "Draft only. Never ready, never auto-merge, never queue — the in-seat contract-tier review runs before anything lands". os-musk is the login that acted as the domain:engine PM/dev seat throughout this thread (5578060223 onward). Whether the maintainer's hand was on that account at 06:09 is not derivable from the API; it belongs in the summon/governed-merge ledger (objectstack#12708). No governed path was touched, so Governed Surface Queue Guard was correctly CLEAR on both the PR (02:12:54Z) and the merge_group leg (06:09:28Z) and could not have refused.
The merged head carries no dev report and a contradicted card state. 5597043639 (06:27:48Z) records the takeover dev dead at ~03:29Z, "no os-dev-report was written this round", moves the card pm:dispatched → pm:queue and unassigns — while still calling the PR draft, 18 minutes after it had been undrafted and enqueued. Nine minutes later the squash closed the card. At read time [finding] ObjectQL.findOne / update / delete return hookContext.result under a Promise[any] declaration — nothing to guard, because nothing is declared #16231 is closed and still labeled pm:queue + needs:contract-review + domain:engine + priority:p3, assignee empty; the merged PR still carries the carrier. A half-state to clean.
The squash message is the commit list, not the PR body (109 lines, every branch commit's subject + trailer). N1's premise that the body becomes the merge-commit message did not materialize; the merge commit's text is accurate. The PR body remains the stale record (F1).
Governed paths in the diff: none (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/**, .github/** — 0 hits on the three-dot name list). The skills/** and scripts/** churn visible in 951369f51..47eea7a8 --stat is main's own via the merge and cancels in the three-dot.
Seat hygiene note: during this read another process overwrote scratchpad/gh/pr.json with PR client SDK organizations.getActiveMember(organizationId) sends an organizationId the server ignores — it answers the session's ACTIVE organization, whatever id the caller names #16568's payload mid-read; this review re-fetched into an isolated directory. No effect on findings; concurrent seats sharing that directory should not trust its files.

Findings

F1 — non-blocking (post-merge, body-only). The PR body at head is byte-identical to the one the dev published at 10d7a9f1 (25,663 chars) and was not updated for the two later commits, so it is now false or stale in five places: line 91 "re-run in full on the FINAL head 10d7a9f1d9" (head is 47eea7a8); lines 133 and 176 "F7 … not done here" (it was done at e031554e); lines 129 and 142 "that green does NOT grade @objectstack/plugin-auth" (at head it does — see Semver); line 192 "Draft only … never queue" (contradicted by the landing, not by the diff); line 39 "Four test doubles" against the seven its own bullets at 41-43 enumerate and the changeset's "seven" at :35. Expectation: a body edit for the record or a note on the card; no code. The dispatch 5594622580 had named the F7-paragraph recurrence as owed and it was not discharged before the merge.
F2 — non-blocking. The IScopedObjectRepository mirrors the ruling names (scoped-context.ts:149/:165) have no compile-time pin; the F2 pins cover IDataEngine only (data-engine.test.ts:217-219). The dev's reason (that file's harness rejects @ts-expect-error as an instrument) is recorded at 5586790316; reverting those two declarations still reddens nothing. Belongs with [finding] Ruling A on #16231 narrows IScopedObjectRepository, but ctx.api.object(name) resolves through the CLASS ObjectRepository — the hook-facing door keeps Promise<any>, and updateById keeps it too #16786 or its own card.
F3 — record (prior F4). byIdUpdateRecord throws a bare Error with no ADR-0112 code (protocol.ts:896-905); unreachable by construction today.
F4 — record (prior F5). engine.ts:12117-12118 overstates that a per-row handler can reassign the batch ctx.result; per-row contexts are separate objects (buildPerRowAfterContexts :3071); no per-row pin.
F5 — record (prior N4). The three exported shape predicates are typed boolean, not type predicates (verb-hook-result-shape.ts:140/:205/:274); a one-line improvement for a follow-up.
F6 — record. Card [finding] ObjectQL.findOne / update / delete return hookContext.result under a Promise[any] declaration — nothing to guard, because nothing is declared #16231 closed with pm:queue and needs:contract-review still hung and no PASS on record; the merged PR still carries the carrier (boundary flag 2).

Dev's latest os-dev-report (5586790316, rework) and its amendment (5586856565), answered: the single open_questions entry (F7 handoff-vs-dispatch conflict) was withdrawn by the amendment and is moot — F7 is verified done at e031554e. The deviation the dev refused to withdraw (the local 111-family derivation ran on a tree at least 64 commits behind) is accepted as disclosed: CI graded the merge of head into base and is 31/31 green on 47eea7a8; no local union run was ever taken on 47eea7a8 because the takeover round died (5597043639), so the body's "FINAL head" stamps are F1, not a verification gap that blocks a merged PR. The two out-of-scope notes (scoped mirrors unpinned; "Four test doubles" heading) are F2 and F1 here, both re-verified at head. The amendment's "read status as done" holds for 10d7a9f1; for 47eea7a8 there is no report at all (boundary flag 2).

CI at read time

On 47eea7a805763efa533cb22f1325d9df25db6413: 40 check runs, 35 distinct names; latest-per-name 31 success, 4 skipped, 0 failure, 0 in_progress. Skipped: Auto Label and Check PR Size (each has an earlier success run on the same head in run 34302309605; the skipped ones are duplicates from run 34302441537), Packed-tarball smoke (opt-in) ×2, Console Pin Gate. Green includes Check Changeset ×2, Governed Surface Queue Guard ×2 (PR + merge_group), Test Core 1-6/6, Type Check · workspace / source gates / consumer gates / debt ledger, TypeScript Type Check, Lint & Repo Gates, Build Core, Build Docs, Dogfood Regression Gate 1-3/3 + Dogfood Verify CLI, Spec property liveness, Temporal Conformance (live PG + MySQL), Part-of PR must not also close its card, both claim guards, Check Documentation Links. Not waited on; job logs not readable through the proxy.

Implemented-by: branch claude/issue-16231-declare-engine-verb-results
Reviewed-by: director seat summon #20 (isolated fable subagent, transcript-verified before adoption)

{"pr":16783,"head":"47eea7a805763efa533cb22f1325d9df25db6413","verdict":"PASS WITH FINDINGS","blocking":[],"clause2":"yes","semver_ok":true,"governed":false,"ci":"31 success / 4 skipped / 0 failure / 0 in_progress (35 names, 40 runs) on 47eea7a; PR already merged 2026-09-09T06:36:36Z by os-musk via merge queue with 0 reviews and no PASS on this head"}

Generated by Claude Code

… main `os-regen-merge.sh` step 4. Both sides had changed the generated page, so step 2 restored main's side and this regenerates it from the merged source: the reference now carries #16783's three new rows and this branch's corrected TSDoc together. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MkQhmuuJAVDjmeWNixwDDH

claude added 8 commits September 8, 2026 02:41

wip(engine): narrow findOne/update/delete result declarations — censu…

bb81a31

…s measurement leg Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

feat(engine): declare findOne/update/delete result shapes and guard t…

6f05931

…heir hook seams Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

test(engine): pin the three declarations and repair the census consumers

8fcfb35

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

Merge remote-tracking branch 'origin/main' into claude/issue-16231-de…

e1c9366

…clare-engine-verb-results

chore(engine): changeset for the verb result declarations

e8faeb0

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

chore(spec): regenerate the error-code ledger docs for the three new …

4acb9ad

…codes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

fix(engine): keep the tracker id out of the update refusal's runtime …

6c60ea0

…prose Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

fix(engine): the seam refusal names the seam, not a culprit; repair t…

c5935b2

…he off-contract driver doubles Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

github-actions Bot added the size/xl label Sep 8, 2026

os-musk added the needs:contract-review label Sep 8, 2026 — with Claude

github-actions Bot added documentation Improvements or additions to documentation tests tooling labels Sep 8, 2026

claude Bot mentioned this pull request Sep 8, 2026

[PM seat] domain:cli — 🟢 os-project-manager · session_015QE8qk46e5CHJxyQEUjbf8 · R71 · (consolidated-seat takeover of 09-09T01:4xZ withdrawn 06:3xZ — see brief) #6024

Open

os-project-manager mentioned this pull request Sep 8, 2026

os dev's MCP connect hint builds all three URLs from the listen origin, so under OS_AUTH_URL=https://… it prints a claude mcp add … http://localhost:<port>/… line the reader is meant to paste #16734

Closed

os-zhuang mentioned this pull request Sep 8, 2026

[PM seat] director(项目总监) — 🟢 os-zhuang（第 15 场）· ⏹️ 第 16–20 场已收班（第 20 场 = 总监契约复审 session_01Tep4AYXZvyBA7jsvne5KZV，收班 2026-09-09T07:20Z） #12708

Open

os-zhuang removed the needs:contract-review label Sep 8, 2026 — with Claude

os-zhuang mentioned this pull request Sep 8, 2026

pm-dispatch: a contract-review verdict without the label handoff is invisible to every seat — name the FAIL end-state in one sentence, and add H51 for "verdict posted on this head, carrier still on" #16836

Closed

os-project-manager mentioned this pull request Sep 8, 2026

[finding] The empty-generator refusal reads Failed to load generator "": is not a valid JS file — a double space, because bundle-require concatenates an empty filepath #16359

Closed

os-musk added the needs:contract-review label Sep 8, 2026 — with Claude

claude added 2 commits September 8, 2026 13:18

os-musk mentioned this pull request Sep 8, 2026

fix(metadata-protocol): stop persisting derived provenance keys, and restate tenant authorship at hydration for every type #16796

Merged

os-musk mentioned this pull request Sep 9, 2026

Update-side: a readonly field is stripped from persistence but still reaches beforeUpdate, so hook-derived columns persist values computed from data the row never contains #16344

Open

os-project-manager mentioned this pull request Sep 9, 2026

Wire config.locale at the runtime's seed-load call sites — the locale axis added by #16510 is inert on the default boot path until a producer supplies it #16595

Closed

yinlianghui mentioned this pull request Sep 9, 2026

[PM seat] domain:engine — 🟢 os-sam · session_01XTBcV7zZHmokdyQgXjbyEU · R1 · (maintainer takeover 09-09T09:5xZ; PRs #16887 #17015 #17073 #17101 owned to merge) #6367

Open

github-actions Bot mentioned this pull request Sep 9, 2026

[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857

Open

yinlianghui mentioned this pull request Sep 9, 2026

[finding] The NUMERIC column family diverges from driver-sql in both migration formats — driver real, generators numeric, and rating is real against integer #16318

Closed

claude added 2 commits September 9, 2026 02:06

Merge remote-tracking branch 'origin/main' into claude/issue-16231-de…

e031554

…clare-engine-verb-results

yinlianghui added the needs:contract-review label Sep 9, 2026 — with Claude

claude Bot mentioned this pull request Sep 9, 2026

feat(runtime, spec): AppPlugin supplies SeedLoaderConfig.locale, so the Seed.locale axis takes effect on the default boot path #17013

Merged

os-project-manager mentioned this pull request Sep 9, 2026

Rule the userMessage bound: 8 doors, 2 behaviours — and packages/rest holds BOTH, at two functions named sendThrownError #14674

Open

os-musk marked this pull request as ready for review September 9, 2026 06:09

os-musk enabled auto-merge September 9, 2026 06:09

os-project-manager mentioned this pull request Sep 9, 2026

bug(cli): @objectstack/cli 17.3.0 pulls better-sqlite3 13.0.3 into the subtree where better-auth@1.7.2 declares peer better-sqlite3@^12.0.0 — every fresh resolve warns unmet peer #16813

Closed

os-musk added this pull request to the merge queue Sep 9, 2026

os-musk mentioned this pull request Sep 9, 2026

Raw-exec consumers that surface error.message as an operator-facing detail now read the composed DATABASE_ERROR sentence — read cause there (follow-up to #16019) #16657

Open

Merged via the queue into main with commit 854639b Sep 9, 2026
40 checks passed

os-musk deleted the claude/issue-16231-declare-engine-verb-results branch September 9, 2026 06:36

This was referenced Sep 9, 2026

fix(spec, core): give PluginSchema.version the loader grammar its describe declares, and enforce it as the ninth key #17067

Merged

feat(spec,driver-sql,cli): one physical representation for the NUMERIC column family, read by all three producers #16887

Merged

os-bill mentioned this pull request Sep 9, 2026

feat(spec): ADR-0112 error envelope gains a producer-side refusal declaration so a deliberate 5xx refusal keeps its caller-authored message (#16335) #17090

Draft

Navigation Menu

Uh oh!

feat(engine)!: `findOne`, `update` and `delete` declare what they answer, and their hook seams are guarded (#16231) - #16783

feat(engine)!: `findOne`, `update` and `delete` declare what they answer, and their hook seams are guarded (#16231)#16783
os-musk merged 13 commits into
mainfrom
claude/issue-16231-declare-engine-verb-results

os-musk commented Sep 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

os-zhuang commented Sep 8, 2026

Ruling recorded — A: `findOne` / `update` / `delete` declare what they answer, and the hook seam is guarded the way `find()` is — after the breakage is measured first (director seat, summon #17, decision batch #2, 2026-09-07)

Uh oh!

Uh oh!

os-bill commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

os-musk commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this changes

The census — done FIRST, posted on the card before any declaration shipped

A second drift class the GUARD found, that the type could not

Symbols re-derived on origin/main, with firing controls

The surface the ruling does not name — reported, not absorbed

Verification

Changeset level, and the text it is based on

Contract-review patch round — handoff 5582311948

验收备注

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📓 Docs Drift Check

Uh oh!

os-zhuang commented Sep 8, 2026

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #16783 @ c5935b2

1. The ruling, verbatim, and its provenance

Ruling recorded — A: findOne / update / delete declare what they answer, and the hook seam is guarded the way find() is — after the breakage is measured first (director seat, summon #17, decision batch #2, 2026-09-07)

2. Files vs merge-base, governed paths

3. The contract change

4. Changeset

5. Tests

6. ADR-0112 / vocabulary ledger

7. CI on head c5935b2445

Findings

Uh oh!

Uh oh!

os-bill commented Sep 9, 2026

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #16783 @ 47eea7a805763efa533cb22f1325d9df25db6413

Owed items from the prior review

Derived judgments

Semver / changeset

Boundary flags

Findings

CI at read time

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

os-musk commented Sep 8, 2026 •

edited

Loading

Symbols re-derived on `origin/main`, with firing controls

Contract-review patch round — handoff `5582311948`

github-actions Bot commented Sep 8, 2026 •

edited

Loading

Contract review (`CONTRACT_REVIEW_TIER`, isolated seat) — PR #16783 @ `c5935b2`

Ruling recorded — A: `findOne` / `update` / `delete` declare what they answer, and the hook seam is guarded the way `find()` is — after the breakage is measured first (director seat, summon #17, decision batch #2, 2026-09-07)

7. CI on head `c5935b2445`

Contract review (`CONTRACT_REVIEW_TIER`, isolated seat) — PR #16783 @ `47eea7a805763efa533cb22f1325d9df25db6413`