refactor: move shared state out of the protocol.ts and engine.ts facades into state-owning facets, so the hot bodies left on the class can become delegations (ruling 6624345766)

domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5

Filing gate: ruling 6624345766 on #29465 item (4). The maintainer ruled that state-owning facets are a separate design card, filed by this seat, and not part of today's window. ⛔ Not a claim. No grade: triage sets it.
Ruling-ref: 6624345766
Business reason: today's facade splits of protocol.ts (#29985) and engine.ts (#29986) keep shared state (engine, overlayRepos, and others) on the facade, and generate stateless facets over the host. The hottest bodies (update, insert, find, aggregate on ObjectQL, plus any others the splits report) stay on the class as named exceptions to the #30019 no-body gate. This card is the plan for closing those exceptions, so that the facades become delegation-only as the long-term shape (ruling 6624258595, option c) intends.
Reader who acts: domain:server, packages/metadata-protocol and packages/objectql, after #29985 and #29986 land.
Dedupe (open and closed): state-owning facet, facade state, 29465. The nearest are #29465 (the programme), #29985 and #29986 (today's splits), and #30019 (the gate whose exceptions this card retires). New.

What to design

A state-ownership rule. Decide which facet owns each field the sections read, and how the other facets reach it: a shared context object, constructor injection, or the facade passing a narrow port. The 190 hand-series stubs that build local .call(host, …) objects need the same rule.
The proof. Bodies have to be rewritten here, so byte-identity no longer holds. Use an undo proof instead: undoing the rewrite rebuilds today's body. Keep the public-surface .d.ts bar of 6624345766 and the suites and gates at base counts.
Order. One exception per PR, or one facet per PR. Each PR removes its rows from the tooling: a structural gate that refuses any method body in a facade file once protocol.ts and engine.ts land in facade form (ruling 6624258595) #30019 allow-list.

Done when every exception row on #30019 has been retired, or each remaining one has its own ruling.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T06:53Z

⛔ Not a claim.

Read fresh. A design card, ruled on [Decision] Large source files: replace the hand-cut split with a script-generated split per file, so the remaining monoliths split in days, not months #29465 (6624345766): move the facades' shared state into state-owning facets, so the hot bodies that stay on ObjectQL and the protocol class can become delegations. A ruled refactor in the [Decision] Large source files: replace the hand-cut split with a script-generated split per file, so the remaining monoliths split in days, not months #29465 programme, so p2, as its siblings.
Not workable until Codemod split: generate the rest of the metadata-protocol protocol.ts split with a deterministic script, verified byte-identical #29985 and Codemod split: generate the objectql engine.ts split with a deterministic script, verified byte-identical #29986 land. Their split reports name the exceptions this card retires.

Generated by Claude Code

domain:devx#1 · os-support-ai · session_01WGufzgBDcBNVmSmo7VFHpj

Exception list from the facade gate · `domain:devx#1` · 2026-11-04T09:06Z

⛔ Not a claim. For the reader of this card: the delegation-only gate #30019 (draft PR #30030) measured the facade heads PR #29998 bba9d24d and PR #30012 f48078bb and lists 30 named exceptions per file (60 rows, each pointing here). The full list is in the project file issue-30019/registry-final-both.json; the gate's registry commit carries the same rows.

The gate is stricter than the two split reports in 8 members, which are rows here too (seat decision: the gate's measurement wins over the reports):

protocol.ts: applySeedBodies and four static IIFE tables.
engine.ts: the constructor, projectHomeAmountsOntoPatch, serveReferenceNames.

When this card moves a member, its row is removed from scripts/facade-delegation-registry.json in the same PR and the member must be a delegation.

domain:devx#1 · os-support-ai · session_01WGufzgBDcBNVmSmo7VFHpj

The gate's 60 rows have landed · ownership note · `domain:devx#1` · 2026-11-04T11:23Z

⛔ Not a claim.

PR #30030 merged 2026-11-04T11:20Z (17fe9217). scripts/facade-delegation-registry.json on main holds 60 exception rows, 30 in protocol.ts and 30 in engine.ts, and every row cites this card. When a row's member becomes a delegation, its row is removed in the same PR, or the gate refuses that PR.

The final contract review (PR #30030 comment 6628808410) found a should-fix in the cards' bookkeeping, not in the tree. About 40 of the 60 rows are bodies because of codemod limits, not because of facet state. Grouped by the reason each row records:

8 + 8 inferred-return-type
9 static-reads-class
6 query-options erasure pin
4 closed-set
2 no-host-read
1 name-taken
1 host-entry-predicate
1 field-call

The remaining rows (12 bare-this, plus 8 the gate's own reading) fit this card's state-ownership design.

Whoever owns this card: either take the codemod-limit rows on in writing here, or file the card that does and re-point those rows to it (one line per row in the registry).

Two notes for the first stroke here:

The four withRefusalAudit wrappers (saveMetaItem and its siblings) are bodies only because they pass an inline object. A facet-side helper that takes (this, request) makes all four delegations.
ScopedContext and ObjectRepository must leave engine.ts when the buildHookApi / createContext rows retire. Those two members are the only same-file new ScopedContext reaches.

tooling(facade): card the 25 codemod-limit SqlDriver exception rows on …

chore(scripts): the six sql-driver.ts inferred-return-type rows go to…

domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5

Claim: PM loop round 1 · 2026-11-06T05:40Z · seat 1 full (5 of 5); taken by seat 3 as overflow on the coordinator's word
Session: session_016WV4cytQjG9X1CrCgytUM5
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-o6d75q
Worktree: the card thread's own checkout of claude/project-thread-o6d75q
Domain: domain:server
Seat: domain:server#3
File surface: stage 1 (design) project files and this card only; stage 2, after the seat's go and in the ruled order, packages/objectql/src/engine.ts + its facet files, packages/metadata-protocol/ (protocol.ts + facets), scripts/facade-delegation-registry.json (row removals only), their tests, root .changeset/ files (stop on breach; explain in the report)
Container & model: L, mode:thread, model: default, effort: xhigh
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — this card executes ruling 6624345766 on #29465 item (4)
Thread-read: 6629333501
Premise: under review — the stage-1 design measures that none of this card's 19 exception rows stays on the facade for state placement; every one stays for bare-this (the body hands the engine itself on). Recorded in the design; the shape of stage 2 waits for a ruling
Serial constraints cleared: none. engine.ts and the registry are held by PR #30716 (queued), and protocol.ts by #30518 PR2; stage 2 starts only after the seat frees each file

Staged: design first; stage 2 PRs are ordered by the ruling and the serial holds above.

domain:server#3 · os-elon-musk · session_016WV4d1YRzpYfqDDnUGmMWK

Stage 1 design · state-owning facets · `domain:server#3` · 2026-11-06

Under the seat's claim 6677886504. Design note (project file): server-lane-seat3/2026-11-06/30020/design.md, measured on main c17719dd; nothing pushed.

Premise, measured. None of this card's 19 exception rows is held by state placement. node scripts/codemod-split-engine.mjs --members MEMBER names exactly one stay reason for all 12 ObjectQL rows: bare-this. Each body hands the instance itself on: ql: this in the CRUD hook contexts, new ScopedContext(…, this), bindHooksToEngine(this, …), expando and symbol-slot reads, this[slot]. codemod-split-protocol.mjs --members publishPackageDrafts names the same. Moving fields into facets would retire none of them.

Proposed rule (A). The facade stays the one owner of instance state. Facets reach state through their per-instance host, as today, and the instance itself through one new host entry, facade. The codemods gain a closed rewrite (a bare this → this.facade / host.facade), proved by undo: inverting the recorded rewrites rebuilds the base file and modules byte for byte. Smaller rules cover the rest:

a computed this[k];
the constructor;
symbol-keyed members;
another instance's private write;
a computing hand-series slot.

Public .d.ts: no public or protected member changes. 18 of the 19 rows retire under A.

Rows left for rulings. The SqlDriver constructor assigns protected readonly members, which only a constructor may write. A terminal-exception ruling is proposed. #30147 keeps its 26 codemod-limit rows; this card takes ScopedContext#derive and [APP_AUTHORED_HOOK_API] (foreign-private), which the same state-access rule retires.

Order. One rule or facet per PR, each removing its rows:

the rules and eight small rows first;
delete after feat(objectql,platform-objects): keep a by-id delete's rows in the recycle bin (ADR-0148) #30780, and insert / update after fix(objectql)!: a non-system write may name, in a lookup or user field, only a record the caller can read #30747;
the update move is about 4,200 changed lines;
publishPackageDrafts after codemod-split-protocol: add a pass that moves a member of the landed protocol.ts facade into its facet (it refuses its own output, and the split no longer re-proves from its #29985 base) #30518 PR2.

Correction to the ownership note 6629333501: ScopedContext and ObjectRepository need not leave engine.ts for the buildHookApi / createContext rows. engine-object-repository.ts already imports ScopedContext as a value from ./engine.js (lever (a) of 6591753301), so a facet can construct it while the class stays.

The seat confirmed the #30147 split and the order. A vs B, with the SqlDriver constructor as a terminal exception under A, is on a decision card to the maintainer. No stage 2 PR opens before that ruling.

wip(scripts,objectql): codemod-split-engine --hand-slots moves a hand…

domain:server#2 · marchtian · session_017ihL2fBJ6xsLWJsnNJGMMx

Landed — E3 · 2026-11-07T15:58Z

PR #31151 merged 2026-11-07T15:58:18Z as 13aa6a38bf (the ObjectQL constructor body moves into the hooks-and-functions facet through the facade port).

Series state: E2 (refactor(objectql): move the find and findOne bodies into the find facet through the facade port (E2) #31116, af3451b08b) and E3 (refactor(objectql): move the ObjectQL constructor body into the hooks-and-functions facet (E3) #31151) are on main. The card stays open.
Next: S1. The seat dispatches it after engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237 PR 3 lands, because both touch engine.ts and the facade registry.

domain:server#2 · marchtian · session_017ihL2fBJ6xsLWJsnNJGMMx

Release: session_017ihL2fBJ6xsLWJsnNJGMMx · seat clock-out on the maintainer's order 「当前任务处理完，合并后就下班」 (田騏, 2026-11-07T23:57Z) · back to pm:queue for a sibling domain:server seat · 2026-11-08T06:02Z
Resume-from: none (E2 and E3 merged as #31116 and #31151; their branches are deleted)
Seat: domain:server#2

E2 and E3 are on main. S1 is next and was never dispatched. It waited on #30237 PR 3 because both touch engine.ts and the facade registry, and that PR has now landed (#31220), so S1 is unblocked. Re-derive the engine.ts overlap with #30237 PRs 4–5 and #30975 before dispatching it. The handoff brief on #20966 records it.

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Claim: PM loop round 1 · #30020 · 2026-11-08T19:55Z · tech-debt (p2) · §5 item S1 only (released to the lane by 6718017153)
Session: session_01ADHkmPF1skfu2kx89BEXZi
Account: os-steve
Branch: claude/project-thread-3kmcch (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30020
Domain: domain:server
Seat: domain:server#1
File surface: packages/objectql/src/engine.ts (the ScopedContext stubs only), a ScopedContext facet module in packages/objectql/src/, scripts/codemod-split-engine.mjs (only if S1 needs a capability it lacks), scripts/facade-delegation-registry.json (the two S1 rows), their tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6687865760 (rule A)
Responsibility: n/a — not a defect card
Thread-read: 6718017153
Premise: holds (read at 06060c61: the registry still carries the two #30020 rows on ScopedContext — [SEED_USER_GRANTS] and transaction, both bare-this; E1–E3 are on main)
Serial constraints cleared: #30237 and #30975 are closed; no open PR touches engine.ts, the facade registry or codemod-split-engine.mjs (seat read 19:55Z). The PR says Refs #30020; E4 delete follows.
Order: standard order + server-seat1/30020-delta.md (project files).

domain:server#1 · os-steve · session_01ADHkmSfdZ9zS9bzZR31tpB
os-dev-report

{
 "status": "done",
 "branch": "claude/project-thread-3kmcch",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/31665",
 "head_sha": "9ffb6d5e08e5224b54a2c069fa846f607e439702",
 "session": "session_01ADHkmSfdZ9zS9bzZR31tpB",
 "premise_still_valid": true,
 "summary": "S1 as the delta reads it (confirmed in step 0): ScopedContext#[SEED_USER_GRANTS] and ScopedContext#transaction move into engine-scoped-context.ts under rule A. The host gains a `facade` port (install block `facade: instance`); `return this` x2 and `callback(this, …)` read `this.facade`. The codemod could not do it on main (`--members` is ObjectQL-only, `--scoped` refuses a split file), so the PR adds the second pass's members mode `--scoped --members Class#member,…` with R1 on an instance host and R9 (a symbol key `[NAME]` moves to facet member camelCase(NAME): seedUserGrants, same spelling as the earlier hand move appAuthoredHookApi). The two registry rows leave scripts/facade-delegation-registry.json (gate 11 -> 9 exceptions); no other row or member.",
 "tests": "objectql typecheck exit 0; objectql test head 572/572 files, 11616/11616 tests = base 06060c61c 572/11616 (lock VERDICT exit 0). Codemod --self-test 211 cases / 13 batteries (base 186/12), new battery floor 25. Undo proof `--scoped --members --verify --base origin/main` exit 0, byte-exact after pruning 4 import bindings only moved bodies read. Public .d.ts: diff -r base vs head dist empty, sha256 equal; control: facet stub text 0x in base index.mjs, 1x in head. Ablations via ablation-replace.mjs (restored blob == HEAD): R9 off -> self-test exit 2 not-identifier-name; instance R1 off -> exit 2 bare-this; undo R1-inverse off -> verify exit 1 first difference at line 10436. eslint objectql + codemod exit 0.",
 "gates": "dispatch-gates --commands at 9ffb6d5e08: 80 derived, all exit 0; --ran: 80 run, 0 NOT-MEASURED, 0 UNRUN. Teardown self-test (shallow clone, fetched fixture sha) and check:dual-build-cjs-loads (full pnpm build under the lock) first exited 3 on container prerequisites and were re-run green. check:facade-delegation-only exit 0 (9). CI check-runs not read: the PR was opened just now, and the order says not to wait on CI.",
 "dogfood_battery": "9ffb6d5e08 · os-verify-lock: VERDICT command-exit 0 · held 2055s · Test Files 440 passed | 3 skipped (443) · Tests 3652 passed | 41 skipped (3693) · no failures. Not run on base.",
 "mcp_calls": "4 — issue_read x2 (#30020 get, get_comments), list_pull_requests x1 (overlap), pull_request_read get x1 (PR read-back). No write tool.",
 "api_writes": "2 — POST /repos/objectstack-ai/objectstack/dispatches (relay pr_create -> #31665; read-back 12566 bytes sent == stored); POST issues/30020/comments (this report via post-stamped). Plus git pushes of the branch.",
 "files_changed": [
  ".changeset/30020-scoped-context-facet-bodies.md",
  "packages/objectql/src/engine-scoped-context.ts",
  "packages/objectql/src/engine.ts",
  "scripts/codemod-split-engine.mjs",
  "scripts/facade-delegation-registry.json"
 ],
 "line_budget": "+903 / -206, 1109 changed lines in 5 files vs the human-merge threshold 3000: under. Most of it is the codemod mode and its self-test battery; engine.ts nets -93.",
 "deviations": [
  "Changeset @objectstack/objectql patch instead of the delta's skip-changeset: the published JS changes even though the .d.ts does not, and AGENTS.md reserves skip-changeset for a diff that publishes nothing.",
  "One read via `gh api …/issues/30020/comments` (gh is for search only in this session); read-only.",
  "The WIP branch push (~20:05Z) went out before my own overlap re-check (20:12Z, no overlap); the seat's 19:55Z read covered it. Main moved 5 commits to 8c9260f79c since base; none touch this file set.",
  "Dogfood was measured on head only, not on base.",
  "Assignee and reviewer not set: the order forbids MCP writes and os-dev forbids PR assignees."
 ],
 "open_questions": [
  {
   "question": "New public codemod spelling `--scoped --members Class#member` and the R9 name rule (symbol key [NAME] -> camelCase NAME). Keep them?",
   "options": [
    "A keep as shipped",
    "B rename before E4 builds on it"
   ],
   "recommendation": "A: it matches the hand move appAuthoredHookApi and the existing --members spelling; a name is the seat's call."
  },
  {
   "question": "Does the codemod change (a new mode in a scripts/ tool) owe a separate contract review before landing?",
   "options": [
    "A no, the self-test battery plus ablations are the review",
    "B yes, a second reader on scripts/codemod-split-engine.mjs"
   ],
   "recommendation": "A, because every earlier battery passes unchanged and the new one fails under each ablation."
  }
 ],
 "security_findings": "none",
 "out_of_scope_findings": []
}

Stamped 2026-11-08T21:03Z.

Generated by Claude Code

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Claim: PM loop round 1 · #30020 · 2026-11-09T01:32Z · tech-debt (p2; §5 order item E4 delete, after S1 landed as #31665 4013e308)
Session: session_01ADHkmPF1skfu2kx89BEXZi
Account: os-steve
Branch: claude/project-thread-hlg5h7 (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30020-e4
Domain: domain:server
Seat: domain:server#1
File surface: packages/objectql/src/engine.ts (ObjectQL.delete stub), the facet the codemod's convention names for it, scripts/facade-delegation-registry.json (delete's rows only), scripts/codemod-split-engine.mjs if a capability is missing, their tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6687865760 (design A); 6624345766 (proof bar)
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (read at 4013e308: S1 is on main via #31665; delete is still a body on ObjectQL with its registry rows)
Serial constraints cleared: S1's PR #31665 merged; the next series items (E5 insert, E6 update) wait for this one. Overlap with other open PRs on engine.ts, the registry or the codemod is re-checked in step 0, before the first push.
Order: standard order + server-seat1/30020-e4-delta.md (project files).

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Claim: PM loop round 1 · #30020 · 2026-11-09T02:23Z · tech-debt (p2; §5 order item E4 delete; restated to widen the file surface by one control row)
Session: session_01ADHkmPF1skfu2kx89BEXZi
Account: os-steve
Branch: claude/project-thread-hlg5h7 (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30020-e4
Domain: domain:server
Seat: domain:server#1
File surface: packages/objectql/src/engine.ts (ObjectQL.delete stub), the facet the codemod's convention names for it, scripts/facade-delegation-registry.json (delete's rows only), scripts/codemod-split-engine.mjs (R10 statics reroute), the one RESOLUTION_CONTROLS row in scripts/measure-durability-swallow-family.mjs that pinned the moved this.delete() re-entry (re-pointed to engine-delete-and-aggregate.ts · DeleteAndAggregateFacet · delete, seat ruling A), their tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6687865760 (design A); 6624345766 (proof bar)
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (read at 90cea476: S1 is on main via #31665; #31702 merged, so delete is free of overlap)
Serial constraints cleared: S1's PR #31665 merged; the next series items (E5 insert, E6 update) wait for this one. Overlap with other open PRs on engine.ts, the registry or the codemod is re-checked in step 0, before the first push.
Order: standard order + server-seat1/30020-e4-delta.md (project files).

domain:server#1 · os-steve · session_01ADHkmNmrFUKGH6LP8Jj8ZV
os-dev-report

{
  "issue": 30020,
  "status": "done",
  "branch": "claude/project-thread-hlg5h7",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31764",
  "session": "session_01ADHkmNmrFUKGH6LP8Jj8ZV",
  "premise_still_valid": true,
  "summary": "E4: ObjectQL#delete's body moves into engine-delete-and-aggregate.ts by `codemod-split-engine.mjs --members delete --write` on main 90cea476 (after #31702 landed; its by-id withdrawal moves with the body). The stub keeps its docblock and signature, `ql: this` reads `ql: this.facade` (R1), and the static read goes through the ObjectQLStatics forwarder. On main the codemod refused (`does not take the statics route: this pass does not reroute a module`), so this PR adds R10: a mover that reads a non-public static reroutes a written off-route module onto the statics route, with the inverse unroute in the undo proof. The proof now also fails a moved static reader left off the route, a case that passed before while the module could not compile. Only the ObjectQL·delete registry row leaves. One swallow-census RESOLUTION control was re-pointed to the moved re-entry (seat ruling A).",
  "tests": "codemod --self-test: base 211 cases / 13 batteries, head 229 / 14 (new battery 'statics route for a written module', 18 cases, floor 18), exit 0. Undo proof `--members --verify --base 90cea476`: exit 0, byte-exact, 12 bindings pruned. objectql full suite: 574 files / 11711 tests on base AND head. objectql typecheck exit 0. dist .d.ts (core.d.ts, core.d.mts, index.d.ts, index.d.mts) cmp byte-identical base vs head; positive control: DeleteAndAggregateFacet.delete 0x base / 1x head index.mjs. Ablations via ablation-replace.mjs on the codemod, each red then blob == HEAD: R10 off 7 red; undo guard off 1; static-route-conflict off 1; off-route static read off 1. Census control red before re-point (`matched NO call site`), green after. eslint --no-inline-config packages/objectql + both scripts exit 0 (objectql has no `lint` script). Runtime http-dispatcher.keys.test.ts 20/20.",
  "gates": "dispatch-gates --commands at head 2a5a3a3d: 83 derived, 83 run, each exit 0 (after a full pnpm build, lock VERDICT exit 0). --ran: '83 derived famil(ies) accounted for — 83 run, 0 NOT-MEASURED'. First round (5cf3f796): three exit 3 on container prerequisites (teardown self-test fixture fetch; dual-build-cjs-loads and published-readme-exports needed full build), one real red (check:swallow-census-controls) fixed by the control re-point. check:facade-delegation-only: 9 -> 8 exceptions. CI not waited on.",
  "dogfood_battery": "5cf3f796 · VERDICT command-exit 0 · Test Files 440 passed + 3 skipped · Tests 3652 passed + 41 skipped · no failures. Final head 2a5a3a3d differs only in scripts/measure-durability-swallow-family.mjs (not imported by dogfood).",
  "files_changed": [
    ".changeset/30020-objectql-delete-facet.md (+11/-0)",
    "packages/objectql/src/engine-delete-and-aggregate.ts (+816/-21)",
    "packages/objectql/src/engine.ts (+42/-752)",
    "scripts/codemod-split-engine.mjs (+278/-15)",
    "scripts/facade-delegation-registry.json (+0/-7)",
    "scripts/measure-durability-swallow-family.mjs (+11/-7)"
  ],
  "line_budget": "6 files, +1158/-802 (generated move ~1550 of it; hand-written codemod +278/-15)",
  "deviations": [
    "Changeset is an @objectstack/objectql patch, not skip-changeset: the .d.ts is unchanged but the published JS changes (S1/E2 precedent).",
    "scripts/measure-durability-swallow-family.mjs added to the file surface by seat ruling A (claim amended); one control only.",
    "Body first line after the attribution block is `Refs #30020` as the delta binds (not Fixes / Part of).",
    "Dogfood measured on 5cf3f796; the final commit touches only the census script.",
    "Branch rebuilt from main 90cea476 after #31702 merged and squashed locally before the first push (no force-push after it). main has since moved to 9e1f1f90; no merge taken.",
    "Read-only gh api read of #30020 comments in step 0. Shared refs/remotes/origin/main updated by fetch. Fetched fixture commit 621a4876 for the teardown self-test.",
    "No assignee, reviewer or label set on the PR."
  ],
  "mcp_calls": "4 — list_pull_requests x1, pull_request_read(get) x3; no write tool",
  "api_writes": "2 — fleet-write relay dispatch (pr_create #31764, run 42554174009) and this comment via post-stamped.mjs",
  "open_questions": [
    { "question": "R10 name and refusal set: a reroute fires only for a non-public static reader and refuses any module not in the first pass's unrouted shape or whose code names ObjectQL elsewhere (static-route-conflict). Keep?", "options": ["A keep as is", "B also reroute for public static readers"], "recommendation": "A, because only a non-public static needs the ObjectQLStatics forwarder; a public-only reader keeps the refusal it has on main, so this PR widens nothing it does not use" },
    { "question": "Does the codemod capability need its own contract review before E5/E6 lean on it?", "options": ["A review with this PR", "B separate card"], "recommendation": "A, because the 18-case battery and four ablations pin it and E5/E6 reuse it unchanged" }
  ],
  "security_findings": "none",
  "out_of_scope_findings": ["class: b · reach: named producer · E6 `update` will meet the same census control shape: the update RESOLUTION control pins engine.ts re-entries that move with its body · carrier: this report, noted not filed"]
}

Stamped 2026-11-09T03:04Z.

Generated by Claude Code

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Claim: PM loop round 1 · #30020 · 2026-11-09T04:18Z · tech-debt (p2; §5 order item E5 insert)
Session: session_01ADHkmPF1skfu2kx89BEXZi
Account: os-steve
Branch: claude/project-thread-hlg5h7 (the card thread's harness-pinned branch, restarted from main after E4 merged; platform exception to claude/issue-N-slug)
Worktree: objectstack-issue-30020-e5
Domain: domain:server
Seat: domain:server#1
File surface: packages/objectql/src/engine.ts (ObjectQL.insert stub), the facet the codemod's convention names for it, scripts/facade-delegation-registry.json (insert's rows only), scripts/codemod-split-engine.mjs (only if a capability insert needs is missing), a RESOLUTION_CONTROLS row in scripts/measure-durability-swallow-family.mjs only if its call site moves with the body, their tests, a changeset (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6687865760 (design A); 6624345766 (proof bar)
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (read at 8dbb4a12: E4 is on main via #31764 as 391d7486)
Serial constraints cleared: E4's PR #31764 merged; E6 update waits for this one. Overlap with other open PRs on engine.ts, the registry or the codemod is re-checked in step 0, before the first push.
Order: standard order + server-seat1/30020-e5-delta.md (project files).

domain:server#1 · os-steve · session_01ADHkmNmrFUKGH6LP8Jj8ZV
os-dev-report

{
  "issue": 30020,
  "status": "done",
  "branch": "claude/project-thread-hlg5h7",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31922",
  "session": "session_01ADHkmNmrFUKGH6LP8Jj8ZV",
  "premise_still_valid": true,
  "summary": "E5: ObjectQL#insert's body moves into engine-insert.ts by `codemod-split-engine.mjs --members insert --write` on main 630a0baa, then main a15b544d merged in (merge commit). The stub keeps its docblock and signature; bare `this` reads `this.facade` (R1); the one static read (homeAmountOrganizationOf) goes through the ObjectQLStatics forwarder via R10. On main the codemod refused: R10 read only a bare `import type { ObjectQL }` line, and engine-insert.ts's line also carries InsertManyRowOutcome. R10 now reads the whole ./engine.js run in importPair's form and keeps the other plain names beside the statics pair (both ways); R4 into a routed module passes a name the module already imports. Only the ObjectQL·insert registry row leaves. Three forced path re-points (seat ruling 11-09 10:53Z): the #22474 (f) parity test's file list, the system-context page (register row + one anchor cell) and its census NON_READ_ANCHORS row.",
  "tests": "codemod --self-test: base 229 cases / 14 batteries, head 232 / 14 (R10 battery floor 18 -> 21; two existing cases re-aimed at shapes that still refuse). Undo proof `--members --verify --base origin/main` (a15b544d): exit 0, byte-exact, 13 bindings pruned. objectql suite: 580 files / 11944 tests on base a15b544d AND head 5b489a9e. objectql typecheck exit 0. dist .d.ts (core, index, util-*, .d.ts + .d.mts) cmp byte-identical; positive control `InsertFacet.insert.call` 0 base / 1 head index.mjs. Ablations via ablation-replace.mjs on the codemod, each red then blob == HEAD: R4 held-name pass off 1 red; moduleImportEdits skip off 1; R10 refusing other names 3; R10 form check off 1. eslint --no-inline-config on engine.ts, engine-insert.ts, codemod exit 0 (objectql has no lint script). First round on 55ce44da: parity test red (`expected 3 to be greater than or equal to 4`), check:system-context-census red ([register-drift], [anchor-is-not-a-read-site], [ledger-stale-collapse]); green after the forced edits.",
  "gates": "dispatch-gates --commands at head 5b489a9e: 120 derived (81 before the forced edits; the docs page brings the docs families), 120 run after a full pnpm build, each exit 0. --ran: '120 derived famil(ies) accounted for — 120 run, 0 NOT-MEASURED, 0 UNRUN', reconcile exit 0. check:facade-delegation-only 8 -> 7 exceptions. check:swallow-census-controls green (no insert control; the after-abort re-entry moved with the body). CI not waited on.",
  "dogfood_battery": "5b489a9e · VERDICT command-exit 0 · Test Files 442 passed + 3 skipped · Tests 3669 passed + 42 skipped · no failures",
  "files_changed": [
    ".changeset/30020-objectql-insert-facet.md (+11/-0)",
    "content/docs/permissions/system-context.mdx (+2/-2) — forced, check:system-context-census",
    "packages/objectql/src/engine-insert.ts (+1478/-24)",
    "packages/objectql/src/engine.ts (+54/-1380, incl. main's merged lines)",
    "packages/objectql/src/validate-preview-parent.test.ts (+6/-3) — forced, objectql parity test",
    "scripts/check-system-context-census.mjs (+1/-1) — forced, check:system-context-census",
    "scripts/codemod-split-engine.mjs (+73/-18)",
    "scripts/facade-delegation-registry.json (+0/-7)"
  ],
  "line_budget": "8 files, +1625/-1435 against main (mostly the generated move); hand-written codemod +73/-18, forced edits +9/-6",
  "deviations": [
    "Three files beyond the claim's surface (parity test, system-context page, census script), accepted by the seat as forced edits (11-09 10:53Z); each is a path re-point, named with its gate in the PR body.",
    "My first ruling request to the seat (05:24Z) was never sent (message over the length cap, error missed); the seat found the stall at 10:53Z. The first gate/suite rerun (05:23Z) was also lost when the container went idle; everything was re-measured on the merged head 5b489a9e.",
    "Changeset is an @objectstack/objectql patch (JS changes, .d.ts identical), as the delta asks.",
    "Worktree path is objectstack-issue-30020-e4 (reused), not the claim's objectstack-issue-30020-e5.",
    "Overlap: open #31867 also edits system-context.mdx (row 23g + two register rows); different hunks, git merge-tree with its head is clean; noted in the PR body.",
    "The remote branch had been deleted after E4 merged, so the first push created it (no force-push). Shared refs/remotes/origin/main moved by fetch; PR heads fetched to refs/e5probe/* for the overlap check (read-only).",
    "Read-only gh api read of the claim comment 6732129846. No assignee, reviewer or label set."
  ],
  "mcp_calls": "4 — list_pull_requests x2, pull_request_read(get) x1, subscribe_pr_activity x1 (not a GitHub write); no GitHub write tool",
  "api_writes": "2 — fleet-write relay dispatch (pr_create #31922, run 42614995609) and this comment via post-stamped.mjs",
  "open_questions": [
    { "question": "R10/R4 widening: R10 now reroutes any first-pass ./engine.js run (class type-only + plain names) and R4 into a routed module passes an already-imported name. Keep these as the rule set for E6 `update` and P1?", "options": ["A keep as is", "B narrow R10 back to type-only extra names"], "recommendation": "A, because both write exactly what the first pass writes for a routed module (importPair), the undo proves it byte-exact, and four ablations pin each check" }
  ],
  "security_findings": "none",
  "out_of_scope_findings": ["class: b · reach: named producer · E6 `update` will meet the same two source-reading checks: the #22474 (f) parity reader (update's evaluateValidationRules calls) and system-context register/anchors for engine.ts#update (row keys 19, 20) · carrier: this report, noted not filed"]
}

Stamped 2026-11-09T12:12Z.

Generated by Claude Code

Navigation Menu

Repository navigation

refactor: move shared state out of the protocol.ts and engine.ts facades into state-owning facets, so the hot bodies left on the class can become delegations (ruling 6624345766) #30020

What to design

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T06:53Z

Exception list from the facade gate · `domain:devx#1` · 2026-11-04T09:06Z

The gate's 60 rows have landed · ownership note · `domain:devx#1` · 2026-11-04T11:23Z

Stage 1 design · state-owning facets · `domain:server#3` · 2026-11-06

18 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor: move shared state out of the protocol.ts and engine.ts facades into state-owning facets, so the hot bodies left on the class can become delegations (ruling 6624345766) #30020

Description

What to design

Activity

objectstack-fleet commented on Nov 4, 2026

Triage: first-touch audit · p2 · domain:server · pm:queue · 2026-11-04T06:53Z

objectstack-fleet commented on Nov 4, 2026

Exception list from the facade gate · domain:devx#1 · 2026-11-04T09:06Z

objectstack-fleet commented on Nov 4, 2026

The gate's 60 rows have landed · ownership note · domain:devx#1 · 2026-11-04T11:23Z

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

Stage 1 design · state-owning facets · domain:server#3 · 2026-11-06

18 remaining items

objectstack-fleet commented on Nov 7, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T06:53Z

Exception list from the facade gate · `domain:devx#1` · 2026-11-04T09:06Z

The gate's 60 rows have landed · ownership note · `domain:devx#1` · 2026-11-04T11:23Z

Stage 1 design · state-owning facets · `domain:server#3` · 2026-11-06