[os-support-ai]

Requested by Yibo Wang · project thread

Part of #32164

Clause-②: no

• A runtime-owned unique on MongoDB (RUNTIME_OWNED_UNIQUES: the activation ledger's uniq_sys_metadata_activation_packageless, and now the grant's) that the server refuses at collection sync: on a duplicate (E11000), FROM the collection's whole sync failing (reported by the engine as "Schema sync FAILED", the declared indexes after it and the widening arm not run) TO one error line naming the index, its key, the consequence and the aggregation that lists the duplicates, with the sync going on; on an options or key-spec conflict (85, 86), FROM skipped without a word TO one error line naming the index and what to inspect, and saying the key is enforced only as far as the index in its way enforces it (an older unique on the same fields does). Either way the index is not built, and the widening arm keeps any older unique it stands in for, as it did. A declared index the server refuses is unchanged.

Metadata-protocol: none

#32356 (P1, the driver-sql widening arm) has landed as 48d6b47 and is merged into this branch (1b83b67, a merge commit; the one conflict, P1's changeset, takes main's corrected version). The diff against main is now this PR's own 28 files, +2766 −32, under the human-merge line. This PR's commits: 0726ee5, 0e9ff21, 9e74a63, 674554e.

The second of three PRs for #32164 (the driver-sql widening arm, then this one, then the doors and the grant key). It builds the permission-set grant's package-less guard before the change that widens the grant's key needs it. While the declared key is still (user_id, permission_set, organization_id), the guard refuses nothing that key does not already refuse, so no request's answer moves.

维护者速读

1. 改了什么：给权限集授权表 sys_user_permission_set 加一条运行时守卫索引 uniq_sys_user_permission_set_packageless：不带包的授权，一人、一个权限集、一个组织只能有一条。凡是执行该表 DDL 的内核，都在每次 schema 同步结束时建它（ObjectQL 新增 objectql:schema-synced 事件），不受 runPlatformMigrations 开关限制；os migrate apply 在确认后执行 DDL 时一并建好，os migrate plan 和各种演练模式什么都不写。之后每次同步先读系统目录，守卫已在就不发任何 DDL。另外 MongoDB 上运行时自建的唯一索引被服务端拒绝时，改为一条 error 日志并继续同步。
2. 为什么改：下一个 PR 会把授权唯一键加上包这一列，SQL 的唯一约束把 NULL 当作互不相同，不带包的授权就失去约束；守卫必须在加宽前、在任何插件 start() 写授权之前、在每一种宿主上就位（契约复审 MF6）。
3. 风险与回滚：主线上授权键还是旧三列，守卫拒绝的旧键都已拒绝，不改变任何请求的回答。重复同步时先读目录再决定是否建索引，PostgreSQL 上不再每次同步都去抢表的 SHARE 锁（已在 PostgreSQL 16 实测：旧做法会排在未提交写事务之后、并挡住新的写入）。没有守卫写法的旧版 MySQL（8.0.13 之前）/MariaDB（10.3 之前）保留或补建旧三列键，每次启动打一条 error。已有重复授权时守卫建不起来，只在日志里点名重复的键与查询语句，不删、不改任何授权，下次启动再试。回滚即还原本 PR。
4. 先看：packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts（ensureUserPermissionSetPackagelessIndex 先读目录再建，createUserPermissionSetGuardAtSchemaSync 只锁定拒绝），packages/metadata-protocol/src/plugin.ts（订阅位于 runPlatformMigrations 开关之外），packages/cli/src/utils/schema-migrate.ts（flushSchemaDdl 末尾的 announceSchemaSynced）。
5. 两分钟验证：pnpm --filter @objectstack/metadata-protocol exec vitest run src/migrations/user-permission-set-packageless-index.test.ts，预期全部通过，其中 "a later pass over a table the guard stands on reads the catalog and issues no DDL" 一条证明第二次同步不发 DDL。
6. 需要你做的：无，席位落地（fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356 已合入，本 PR 对 main 的改动为 2798 行，低于 3000 行）。

What changes

• The guard (metadata-protocol/src/migrations/user-permission-set-packageless-index.ts, new): uniq_sys_user_permission_set_packageless, (user_id, permission_set, organization_id) over the grants whose permission_set_package is NULL. A partial unique index on SQLite and PostgreSQL; a functional key part over the driver's hash-shadow digest on MySQL 8.0.13+; a UNIQUE key over an INVISIBLE generated uniq_sys_user_permission_set_packageless__hash column on MariaDB 10.3+. On MongoDB, driver-mongodb builds it at collection sync (RUNTIME_OWNED_UNIQUES, permission_set_package: null). Re-runnable, and it guesses no package: on existing duplicates the build fails and logs, at error, the duplicated keys (ten, then a count), the consequence and the listing query; nothing is deleted or re-stamped, and the next boot tries again.
• When (objectql/src/plugin.ts, metadata-protocol/src/plugin.ts): ObjectQLPlugin triggers objectql:schema-synced (exported as OBJECTQL_SCHEMA_SYNCED_HOOK) at the end of each syncRegisteredSchemas pass, with the engine, and metadata-protocol builds the guard from it: inside the boot's schema-migration lock, before any later plugin's start(), and on a bootPhaseHooks: false host too (the plugin triggers the event, not the kernel). Only this plugin's passes trigger it; the engine's own doors (syncSchemas, syncObjectSchema) trigger nothing, and no first-party composition creates the grant table through them. The kernel:ready build stays inside the boot-repair gate as a repair, for a database whose DDL came from somewhere that did not build the guard.
• Where: on every kernel whose schema sync runs the table's DDL, not behind the runPlatformMigrations gate. A kernel with an environmentId and no declaration (a per-project kernel) and every one-shot CLI boot have that gate off and create the table at their own sync, so both build the guard.
• A boot that runs no DDL builds nothing. os migrate plan and every dry-run mode hold DDL back, which the ensurer reads (schemaDdlDeferred, through isSchemaDdlHeldBackForTable) and answers held-back. os migrate apply holds DDL until the operator confirms; its flush then performs it and triggers the event again (DeferSchemaDdlPlugin.announceSchemaSynced), which builds the guard. A write mode that boots without deferring builds it at its sync. A skipSchemaSync boot runs no pass; its tables come from the boot that runs their DDL.
• Each pass re-checks, reading the catalog first. created never latches (a SQLite table rebuild drops every index it does not declare), so every pass looks again: an index of the guard's name on the table in sqlite_master, pg_index through to_regclass, or information_schema.statistics under DATABASE(). DDL runs only when the guard is missing. A client with no catalog arm, a refused read or no result set builds as before; the read only saves a statement. Only a refusal (conflict, unsupported, failed) latches, reported once per boot.
• A dialect with no form (MySQL before 8.0.13, MariaDB before 10.3): the old three-column key is kept, or built under the name driver-sql generates for it (uniq_sys_user_permission_set_ac248331), so the widening arm keeps it until the guard can be built. One error line says so each boot.
• Mongo runtime-owned uniques (driver-mongodb/src/mongodb-schema.ts): a refused runtime-owned unique is reported by reportRuntimeOwnedUniqueFailure (E11000: the aggregation that lists the duplicates; 85/86: inspect getIndexes(), enforced only as far as the index in its way enforces it) and the sync goes on; SchemaSyncLogger gains an optional error.
• Roster (runtime-index-preflight.ts): the guard is listed, so os migrate duplicates lists six indexes.

Tests

• MF6, through a booted kernel (plugin-security/src/user-permission-set-guard-at-schema-sync.test.ts, 8 pins, SQLite): two grants naming no package, written from a later plugin's start() before kernel:ready, are refused at the second, with and without bootPhaseHooks: false, on a kernel with an environmentId and no declared gate, and on one declaring runPlatformMigrations: false; a guard dropped after the boot is back after the next pass.
• One-shot CLI boots (cli/src/utils/schema-migrate.grant-guard.integration.test.ts, real SQLite, served composition): a write boot builds the guard; a read-only boot over a table without it leaves it absent; apply has it absent before the flush and present after.
• The ensurer (user-permission-set-packageless-index.test.ts): held back builds nothing and latches nothing; created never latches; a later pass over a standing guard reads the catalog and issues no DDL; a refused catalog read still builds; a refusal latches; the MySQL family sends no version read and no DDL once the catalog names the guard; no catalog arm for an unknown client; the old key on a dialect with no form (kept, already there, cannot be built).
• Operator text ([#21418] block of the same file): a value bound into a refused raw statement reaches no carrier at any of the module's three operatorFacingErrorText sites (the CREATE's detail, the old key's detail, the ensurer's own catch); packages/types/src/driver-error-classification.callers.test.ts lists the module with 3 call sites.
• Live PostgreSQL (user-permission-set-packageless-index.live-postgres.test.ts): the partial form; epic conditions 1 and 2 over real rows; the catalog read absent then present, and a second boot with a write open on the table sends no DDL under a 2 s lock_timeout.
• SF8 (driver-mongodb, recording Db): an E11000 and a code-85 refusal each give one error line and the sync goes on; CONTROL: a declared index refused with E11000 still fails the sync.

Acceptance notes

• os migrate plan does not list the guard (review record 6788505916, should-fix 4): sized and left for a follow-up, not done here. apply builds the guard only from its flush, and it reaches the flush only when it has other work: its in-sync return and its nothing-safe-to-apply return (cli/src/commands/migrate/apply.ts) both come before flushSchemaDdl(). So a clean plan's apply builds nothing, and the next serving boot builds the guard. The real gap is narrower: a plan that lists other work does not say that apply will also build the guard. Listing it needs a guard read in the plan boot, a new public export from metadata-protocol, a line conditional on apply flushing, a new --json field and a served-composition integration test: about 150 to 200 lines over plan.ts, schema-migrate.ts, the metadata-protocol module and index, the changeset and tests. A new kind in PendingSchemaWork would touch driver-sql's schema-drift.ts, fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356's file.
• Per-pass cost: each pass re-checks with a catalog read and never latches created. A per-process latch on a confirmed guard would save that read, at the cost of the guard staying lost until restart when a SQLite table rebuild drops it (the closed should-fix 2 of record 6779785246); not taken.
• Live MySQL, MariaDB and a real mongod: NOT MEASURED. Their pins are in suites that run on main only. The MySQL twin now also asserts that the catalog read sees the guard after the build and that a second boot sends no DDL.
• No dogfood battery: no ! in the title, no (narrowing) arm, and the change stays inside these packages' src and tests.

Verification

Final head 1b83b67, which carries main 48d6b47 (merged in after #32356 landed).

Suites on the final head

Suite (head 1b83b67, every dist built)	Files	Tests
metadata-protocol (with OS_TEST_POSTGRES_URL on a private PostgreSQL 16.15)	338 passed, 3 skipped	22728 passed, 16 skipped
objectql	585 passed	12262 passed
plugin-security	260 passed	6288 passed, 45 skipped
driver-mongodb	37 passed, 6 skipped	753 passed, 201 skipped
types (test)	38 passed	875 passed
types (test:repo, the operator-text roster)	1 passed	11 passed
cli (--project unit)	413 passed	5898 passed
cli guard files (grant-guard, duplicates integration and contract, stored-references)	4 passed	22 passed

Typecheck (metadata-protocol, objectql, plugin-security, driver-mongodb, types, cli): exit 0. After the merge of main: full turbo run build exit 0, @objectstack/spec check:generated exit 0. eslint over this round's 7 TypeScript files: exit 0. No dogfood battery is owed (no !, no (narrowing) arm).

Ablations (each a single-line mutation through scripts/ablation-replace.mjs, restore proven blob == HEAD)

• Round 2, the catalog read decides nothing (the read kept, its early return removed): 3 red, 34 green over the guard unit file and the live PostgreSQL twin: the second-pass SQLite pin, the MySQL "left alone" pin, and the live PostgreSQL second boot (failed at its 2 s lock_timeout, 2046 ms).
• Round 1 (hand-off 6788106892): the subscription back inside the gate (plugin-security 2 red, cli 3 red); the held-back check removed (metadata-protocol 1, cli 1); the flush's announcement removed (cli 1); created latched (metadata-protocol 1, plugin-security 1).

The PostgreSQL lock, measured (PostgreSQL 16.15, a private cluster)

With a write transaction open on the grant table: CREATE UNIQUE INDEX IF NOT EXISTS over the standing guard waited and was cancelled at a 2 s lock_timeout (2.03 s); the catalog read answered its row in 0.03 s. While that CREATE waited, a second writer was cancelled at 1.5 s; with no CREATE waiting, the same insert went straight through.

Gates

node scripts/pm/dispatch-gates.mjs --commands over this PR's 28 paths at 1b83b67: 96 derived. 85 ran, every one exit 0; the last 11 (check:startup-registry-verdict through check:wildcard-fallthrough, check:type-check-debt among them) were not run locally because the run was stopped once review passed. --ran: 96 derived, 85 run, 0 NOT-MEASURED, 11 UNRUN. CI on 1b83b67: 66 check runs, 55 success, 11 skipped by job condition, 0 failed; Lint & Repo Gates and TypeScript Type Check cover those 11 there. On 674554e, Test Core (7/8) ran the roster test green, 11 of 11.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (No spec change.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (eslint over every touched file: exit 0.)
• 4. One issue, one branch off an up-to-date main, one pull request. (Part of plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164, split by seat ruling.)
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (## 维护者速读 is the maintainer's Chinese summary the dispatch rules ask for.)
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Contract-review-claim: session_01WGufzeeBmtefMTT21doena · head 0726ee5 · 2026-11-10T21:23Z

Face: narrowing, at CONTRACT_REVIEW_TIER, by an isolated sub-agent of this seat.

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/cli, @objectstack/driver-mongodb, @objectstack/metadata-protocol, @objectstack/objectql, touching 58 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/metadata-protocol/src/index.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

20 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f0f729e7141cfac1bf9bec3cc137547b36ca4804.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/metadata-protocol/src/index.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: organization_id (literal, 40 pages)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 56 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f0f729e7141cfac1bf9bec3cc137547b36ca4804 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 74fedb87a297e4d503b43a9c57b14c0b23614358 — the merge of head a6441a451dc143ffd1e2423690d86e0f076c5436 into base f0f729e7141cfac1bf9bec3cc137547b36ca4804, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 74fedb87a297e4d503b43a9c57b14c0b23614358 && git checkout 74fedb87a297e4d503b43a9c57b14c0b23614358
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f0f729e7141cfac1bf9bec3cc137547b36ca4804 a6441a451dc143ffd1e2423690d86e0f076c5436 && git checkout -B drift-repro f0f729e7141cfac1bf9bec3cc137547b36ca4804 && git merge --no-ff a6441a451dc143ffd1e2423690d86e0f076c5436

node scripts/docs-audit/affected-docs.mjs --json f0f729e7141cfac1bf9bec3cc137547b36ca4804

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f0f729e7141cfac1bf9bec3cc137547b36ca4804 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0726ee51fb610e682b6f1503117ce4844b9fab3c
Local-runs: none
Scope: only commit 0726ee5 is reviewed (git diff 79e56778 0726ee51, 24 files); commit 79e5677 is P1 (PR #32356), reviewed separately and not judged here. Every non-prose path of that diff: packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts (+ .test, .live-postgres.test, .live-mysql.test), activation-ledger-packageless-index.ts, runtime-index-preflight.ts (+ .test), packages/metadata-protocol/src/index.ts, plugin.ts; packages/objectql/src/plugin.ts, index.ts and the four test contexts given a no-op trigger; packages/drivers/driver-mongodb/src/mongodb-schema.ts, mongodb-user-permission-set-packageless.test.ts; packages/drivers/driver-memory/src/memory-user-permission-set-packageless.test.ts; packages/plugins/plugin-security/src/user-permission-set-guard-at-schema-sync.test.ts; packages/cli/src/commands/migrate/duplicates.contract.test.ts, duplicates.integration.test.ts; packages/types/src/driver-error-classification.callers.test.ts; scripts/check-settings-bind-window.mjs. Prose, judged for accuracy: the changeset and the PR body. + read, not reviewed: packages/drivers/driver-sql/src/schema-drift.ts at 79e5677 (isSyncReproducibleIndex, isRuntimeManagedIndex, parseHashShadowRowScope, the orphan pass), sql-driver-schema-sync.ts (rebuildSqliteTablePatched), packages/runtime/src/standalone-stack.ts and packages/cli/src/utils/schema-migrate.ts (the runPlatformMigrations values), packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts (the declared key on this head). Not read: partial-index-probe.ts, read-probe.ts, the kernel's trigger implementation, and any host outside this repository.

Check-runs on this head (polled once): "every check green" is NOT met. No failure. 34 unfinished (in_progress): Build Core, Build & E2E UI, Live E2E UI, Test Core 1/8 to 8/8, Test UI 1/16 to 16/16, Type Check · workspace, Type Check · consumer gates, Type Check · debt ledger, Type Check UI, Lint · CI, release & engine gates, Lint · PM dispatch-gates, Lint · scoped · slot lookup & corpus. 19 green. 13 skipped by job condition, so no verdict here: the Dogfood shards and Dogfood Verify CLI, "Temporal Conformance (live PG + MySQL)" (the only job that runs the live-mysql and live-postgres files), "18.x upgrade harness (opt-in)", Check PR Size, Build Docs, Lint UI, UI Published Artifacts, Packed-tarball smoke, Auto Label, the two queue-verdict jobs and the schedule gate. The PR is a draft; mergeable_state is blocked.

① Derived judgments

• Harmless on main + P1 before P2 widens the key: holds, on what the code shows.
  • The declared key on this head is still (user_id, permission_set, organization_id), unique: 'organization'. The guard covers a subset of what it refuses and exempts a NULL organization as it does.
  • The SQL differ offers no orphan drop for the guard. A partial index, the MySQL functional key and the MariaDB row-scoped carrier are all runtime-managed (isSyncReproducibleIndex is false for them).
  • On Mongo the 'organization' unique is outside retireWidenedUniques' filter, so nothing is retired. The declared unique and the guard share a key pattern with different partial filters. As I recall MongoDB admits that from 5.0, the driver's stated floor; the documentation pages I fetched did not state it, and nothing was measured.
  • No request's answer moves.
• The guard, per dialect: the ruled route. The partial index, the MySQL digest form (NULL when any part is NULL), the MariaDB INVISIBLE carrier named as hashShadowColumnFor derives, and the Mongo entry with permission_set_package: null are the ledger precedent applied to the grant table.
• Epic condition 2: met. Re-runnable on every arm. On duplicates it returns conflict, names ten keys then a count, and gives the listing query. No row is deleted or re-stamped.
• Epic condition 3: met. The driver-memory admission is measured, pinned and declared.
• Schema-sync timing (MF6): met on a kernel whose platform-migrations gate is on, not met elsewhere (must-fix 1).
  • ObjectQLPlugin triggers objectql:schema-synced at the end of each syncRegisteredSchemas pass, inside the boot's schema-migration lock, and the plugin dispatches it, so bootPhaseHooks: false does not withhold it.
  • The early returns before the trigger (no engine, no objects) are passes with no DDL.
  • Pinned through a booted kernel on SQLite, with and without bootPhaseHooks: false; the ablation is declared red, and I did not re-run it.
• A dialect with no form keeps the old key: as ruled, and declared. MySQL before 8.0.13 and MariaDB before 10.3 keep or build uniq_sys_user_permission_set_ac248331, pinned equal to driver-sql's buildIndexName, with one error line per boot.
• SF8: closed.
  • A refused runtime-owned unique gives one error line and the sync goes on, for E11000, 85, 86 and anything else.
  • The legacy-sparse rebuild arm still runs first. A declared index refused with E11000 still fails the sync (CONTROL pinned).
  • The widening arm keeps the old unique because the guard is absent.
  • The pins use a recording Db; the real-mongod suite is opt-in and first runs on main.
• Roster: os migrate duplicates lists six, with the same probe SQL the migration uses; the types and cli roster pins are updated.

② Semver level

• patch on three packages with additive exports (OBJECTQL_SCHEMA_SYNCED_HOOK, the migration's functions, constants and types, the optional SchemaSyncLogger.error) is the level the prior record read AGENTS as prescribing.
• Clause-②: no is right, and line-initial in both bodies. The one FROM→TO line is a loosening of a failure plus a new error line, not a narrowing: an E11000 on a runtime-owned Mongo unique moves from the collection's sync failing to an error line with the sync going on, and 85/86 from silent to an error line. It is stated for both entries, the ledger's included. No capability is taken from a consumer, so no first-party count is owed.
• Metadata-protocol: none is correct. The ADR-0087 marker is present and apt.
• The changeset writes "measured" only for SQLite and PG16 and "pinned" for the rest, as should-fix 5 of the prior record asked.
• Undeclared: the runPlatformMigrations gate the guard sits behind (must-fix 1).

③ Boundary flags

• Author: the PR's user.login is os-support-ai, not objectstack-fleet[bot]. Read that before landing.
• skipSchemaSync boots: accepted as declared, with one correction owed. The changeset says the out-of-band DDL "owns the guard as it owns every table". The repo's own out-of-band DDL (os migrate apply, a one-shot boot with runPlatformMigrations: false) does not build it, so on such a deployment the guard first appears at kernel:ready of a serving boot, and never with bootPhaseHooks: false. This folds into must-fix 1.
• driver-memory exemption: accepted (condition 3).
• Live MySQL, MariaDB and mongod unmeasured: accepted as declared. They first run on main.

④ Design judgment

must-fix

1. MF6 is not closed on a kernel whose platform-migrations gate is off.
   • Both the objectql:schema-synced subscription and the kernel:ready second chance sit inside if (shouldRunPlatformMigrations(environmentId, options.runPlatformMigrations)) in metadata-protocol/src/plugin.ts.
   • The gate is false for any kernel that passes an environmentId without declaring runPlatformMigrations (the code's own comment: "Cloud passes no value here"), and for every one-shot CLI boot (schema-migrate.ts passes false, the write modes included).
   • Such a kernel still creates sys_user_permission_set at its own schema sync, with its declared indexes, so the old key stood there from the first DDL. The guard never does.
   • Once P2 widens the key, a fresh database on such a host admits every second package-less grant for good. That is the ruling's own case, "every grant on a host that never builds it" (epic 6774878772: on every host, and a declaration is not enough).
   • The gate's two reasons do not transfer as written: the grant table belongs to plugin-security, not to the metadata-storage tables a per-project kernel leaves to the control plane; a read-only one-shot boot must still not write.
   • Nothing in the changeset, the PR body or the module doc mentions the gate, and the MF6 pin boots only an undeclared kernel with no environmentId.
   • Do: build the guard on every kernel that runs DDL for the table, keeping the no-write one-shot boots out; or keep the old three-column key where the guard is not built, as the ruling's fallback says. Pin a kernel with an environmentId and no declared runPlatformMigrations. If the gate is to stay, the epic seat rules it and it is declared.
   • Harmless on P1b alone; it binds before P2 lands.

should-fix
2. The guard is latched for the process once built. grantGuardSettled turns true on created, so a later pass does not re-ensure it. rebuildSqliteTablePatched drops every index and recreates only the declared ones, so a SQLite table rebuild after the first pass (a later sync pass, or os migrate apply beside a running server) leaves the guard absent until the next boot. The statement is IF NOT EXISTS; latch only the refusals, so a later pass re-ensures it without reporting a refusal twice.

nit

• The unsupported-dialect error line says the old key refuses a second package's set "which the declared key admits". That is false until P2 lands.
• The module doc and the Mongo test header state the four-column key as the declared one. Same cause.
• The Mongo 85/86 line says the key "is NOT enforced … can coexist" and also that the older unique is kept. When the refusal is an older unique on the same key, that key is enforced.
• The cli contract test's title still says "kernel:ready indexes" for a roster whose sixth entry is built at schema sync.

Tried and held:

• The drift differ against the guard on each SQL dialect, with the declared key still three columns.
• The MariaDB carrier against the orphan-column pass.
• The Mongo create order: declared indexes first, runtime-owned after, retire last.
• A second boot on each arm (IF NOT EXISTS, ER_DUP_KEYNAME, ER_DUP_FIELDNAME then the key).
• The trigger on the metadata:reloaded re-sync (a no-op once settled).
• A handler throw (caught inside ensureGrantGuard).
• The settings bind-window roster entry.

Prior record 6774837781: MF6 (its should-fix 6, raised to must-fix by 6774899763) is closed for the default serving kernel and open as must-fix 1. SF8 is closed. Should-fix 5's wording is corrected in this changeset. Its other items belong to P1 and P2.

Implemented-by: claude/project-thread-c1daza
Reviewed-by: session_01WGufzeeBmtefMTT21doena

VERDICT: FAIL — must-fix 1: the package-less guard is not built on a kernel whose runPlatformMigrations gate is off, so MF6 ("on every host") is not closed, and the gate is neither declared nor pinned.

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzgBi8iNgKbhq9r7VDT

Hand-off: the fix round for the review of 0726ee5 is pushed. Head 0e9ff2186d. Seat 3 has stood down, and no CR has run on these commits. Everything the next seat needs is in this comment.

The branch now holds four commits. The first two were already here: P1 79e5677 and this PR's 0726ee5. The two new ones are da76f2bb5d, #32356's fix replayed (the same patch as #32356's 132e3656dd), and 0e9ff2186d, this PR's fix. Review 0e9ff2186d. It also folds in the .at(-1) → index fix that CI's Type Check caught on #32306.

Review items 0e9ff2186d closes

• MF1: the guard follows the kernel that runs the table's DDL, not the platform-migrations gate.
  • The objectql:schema-synced subscription in metadata-protocol/src/plugin.ts now sits outside shouldRunPlatformMigrations. A kernel with an environmentId and nothing declared, and every one-shot CLI boot (runPlatformMigrations: false), therefore build the guard with the table.
  • A pass whose driver holds DDL back builds nothing. The ensurer reads the driver's schemaDdlDeferred through the new isSchemaDdlHeldBackForTable in partial-index-probe.ts. So os migrate plan and every dry-run mode leave the database as it was.
  • os migrate apply holds DDL until the confirmation. Its flush then triggers the event again (DeferSchemaDdlPlugin.announceSchemaSynced in cli/src/utils/schema-migrate.ts), which builds the guard.
  • The --apply write modes boot without deferring and build the guard at their sync.
  • The kernel:ready build stays inside the gate, as a repair. The boot repairs were not lifted: only the guard's build moved, and every no-write boot is pinned to build nothing.
  • Pins: in plugin-security, a kernel with an environmentId and no declared gate, and one declaring runPlatformMigrations: false with bootPhaseHooks: false. In cli, the new schema-migrate.grant-guard.integration.test.ts, over real SQLite and the served composition: a write boot builds the guard, a read-only boot over a table without it leaves it absent, and apply has it absent before the flush and present after.
  • The changeset declares all of this (Where, no-DDL boots, skipSchemaSync; it now also bumps @objectstack/cli), and the "out-of-band DDL owns the guard" sentence is corrected.
• SF2: only the refusals latch (conflict, unsupported, failed). created never latches, so a guard that a SQLite table rebuild dropped is built again by the next pass. Pinned at the ensurer and at a real kernel.
• Nits:
  • The unsupported-dialect line now says the old key "refuses what a set's (package, name) identity admits".
  • The module doc and the Mongo test header state the four-column key as the one ADR-0150 gives the grant, not as the declared one.
  • The Mongo 85/86 line now says "enforced only as far as the index already standing in its way enforces it".
  • The cli contract test title is corrected.
• A fixture this change reached. cli/src/commands/migrate/stored-references.integration.test.ts rebuilds a pre-D8 database by dropping each index that names a package column, then the column. Its template's write boot now builds the guard, and SQLite refuses to drop a column that a partial WHERE still reads, so the helper now also drops such an index. Its 2 pins went red on the first run and pass after.

The PR body is not yet updated (a dev thread does not edit it)

What still describes round 1:

• 维护者速读 items 1 and 5: 8 pins now, and the gate-off kernels are included.
• What changes, "When": the kernel:ready build is a gated repair, not a "second chance".
• The Verification section.

Add a Where bullet saying what MF1 above says.

Measured on origin/main f71bb41 + P1 (both commits) + this PR (both commits, tree c37f45877), under the verify lock

This branch's base is newer (9bff554). On the 31 P1 and P1b files, the pushed result matches the measured tree, apart from lines #32213 changed in stored-references.integration.test.ts, which neither fix touches.

What	Result
metadata-protocol	333 files passed, 7 skipped; 22685 tests passed, 35 skipped
plugin-security	259 files; 6245 tests passed, 45 skipped
objectql / runtime	585 files, 12065 tests / 580 files, 10975 tests passed, 19 skipped
driver-mongodb	37 files passed, 6 skipped; 753 tests passed, 201 skipped
cli (whole suite, after the fixture fix)	629 files passed, 2 skipped; 7831 tests passed, 10 skipped
dogfood upgrade-18x pair	2 files, 26 tests
typechecks (metadata-protocol, objectql, plugin-security, driver-mongodb, cli), eslint, check:type-check-debt	exit 0
dispatch-gates --ran over the 28 paths	96 derived, 96 run, 0 NOT-MEASURED, 0 UNRUN

Ablations. Each leg is a single-line mutation restored by git checkout, with git status clean after it. metadata-protocol is rebuilt for the cli legs.

Leg	Mutation	Red
A	the subscription back inside the runPlatformMigrations gate	plugin-security 2 (both gate-off pins); cli 3 (write and apply at the guard, read-only at its setup)
B	the held-back check removed	metadata-protocol 1 (the deferred pass); cli 1 (the read-only boot)
C	the flush's announceSchemaSynced removed	cli 1 (apply after the flush)
D	created latched with the refusals	metadata-protocol 1; plugin-security 1 (re-ensure)

What remains

• A CR of 0e9ff2186d.
• Not measured: a live MySQL, MariaDB or mongod (those suites run on main only). The PostgreSQL 16 twin ran 3/3 in round 1, and this round does not touch its DDL.
• Landing order: after fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356. This PR alone, measured against P1, is 2553 lines in 28 files.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzeuyJD7E2jWKzpvgVH

Contract-review-claim: session_01WGufzeuyJD7E2jWKzpvgVH · head 0e9ff21 · 2026-11-11T05:45Z

Face: narrowing, at CONTRACT_REVIEW_TIER, by an isolated sub-agent of this seat (delta after the FAIL record on the previous head and the fix-round hand-off). This session took over server seat 3's open PRs at the maintainer's request to follow finished PRs to merge.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzeuyJD7E2jWKzpvgVH

Contract-review claim 6788172659 withdrawn · 2026-11-11T05:53Z. No record was produced on head 0e9ff2186dc937bb617d710ce5fc3ce1063a52bb. The maintainer asked that contract reviews be left to the next seat.

Owed for the next seat, in order:

1. The delta contract review at CONTRACT_REVIEW_TIER of head 0e9ff2186dc937bb617d710ce5fc3ce1063a52bb, after the FAIL record 6779785246 and the fix-round hand-off on this PR.
2. The PR-body edits the hand-off lists (the body is stale on those points).
3. The epic red-line read of the landing head (plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164 is a child of epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527).
4. ACCEPT and landing. Landing order on plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164: fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356 → feat(metadata-protocol, objectql, driver-mongodb, cli): the permission-set grant table gets its package-less guard at schema sync on every kernel that runs its DDL, and a runtime-owned Mongo unique the server refuses is reported at error #32357 → feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306.

#32357 is 3074 changed lines at this head, over the 3000-line human-merge line (check-governed-merges --pr 32357): it is Tier H and lands only after an approver in GOVERNED_APPROVERS approves.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#3 · os-support-ai · session_01WGufzgBi8iNgKbhq9r7VDT

For domain:server#6, who now holds #32164. This is a finding only; I have pushed nothing.

0e9ff2186d will fail Test Core on one test, the same test that is already red on #32306 (4b62e66fc9, Test Core (7/8)). It reproduces locally on that head:

• @objectstack/types test:repo, src/driver-error-classification.callers.test.ts › "the non-test callers are exactly the enumerated ones, call sites included".
• The OPERATOR_TEXT_CALLERS row for packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts says calls: 2. The file now has 3 operatorFacingErrorText( calls: the existing two at the conflict report and the old-key failure, plus a new one.
• The third call comes from this round's fix, 0e9ff2186d. It is the catch in createUserPermissionSetGuardAtSchemaSync: logProblem(logger, '…skipped…', operatorFacingErrorText(err)). The round's verify ran the touched packages' suites but not types, and dispatch-gates did not derive it.

Two ways to fix it:

1. Set calls: 3, and add the pin the test asks for in user-permission-set-packageless-index.test.ts: make the schema-sync ensurer's seam throw an error carrying SENTINEL-21418-BOUND-VALUE, then assert that the logged line does not contain it.
2. Route that catch through one of the two existing call sites, so the count stays 2.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#6 · huangyiirene · session_01J8VVAnTcb4cZVkPdhkPicW

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0e9ff2186dc937bb617d710ce5fc3ce1063a52bb
Local-runs: none
Scope: this PR's own change on a stacked branch, face narrowing. The delta git diff da76f2bb5d 0e9ff218 (16 files), and the base git diff 79e56778 0726ee51 re-judged where the delta touches it. Not judged: 79e56778 and da76f2bb5d (PR #32356: driver-sql/src/schema-drift.ts, sql-driver-widened-grant-key.test.ts, the P1 changeset). Every non-prose path: packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts (+ .test, .live-postgres.test, .live-mysql.test), partial-index-probe.ts, activation-ledger-packageless-index.ts, runtime-index-preflight.ts (+ .test), packages/metadata-protocol/src/index.ts, plugin.ts; packages/objectql/src/plugin.ts, index.ts and the four test contexts; packages/drivers/driver-mongodb/src/mongodb-schema.ts, mongodb-user-permission-set-packageless.test.ts; packages/drivers/driver-memory/src/memory-user-permission-set-packageless.test.ts; packages/plugins/plugin-security/src/user-permission-set-guard-at-schema-sync.test.ts; packages/cli/src/utils/schema-migrate.ts, schema-migrate.grant-guard.integration.test.ts; packages/cli/src/commands/migrate/duplicates.contract.test.ts, duplicates.integration.test.ts, stored-references.integration.test.ts; packages/types/src/driver-error-classification.callers.test.ts; scripts/check-settings-bind-window.mjs. Implementing files: the guard migration, the two plugin.ts wirings, mongodb-schema.ts, schema-migrate.ts. Prose, for accuracy: .changeset/32164-p1b-grant-packageless-guard-at-schema-sync.md and the PR body. + read, not reviewed: driver-sql sql-driver-deferred-ddl.ts and sql-driver.ts (setDeferredDdl, schemaDdlDeferred, flushDeferredSchemaDdl), schema-drift.ts (the GLOBAL_TENANT note), driver-turso setDeferredDdl, objectql engine-compatibility-api.ts (syncSchemas, syncObjectSchema) and registry.ts (setDeploymentPlatformGlobalObjects), cli schema-migration-plugins.ts, plugin-security objects/sys-user-permission-set.object.ts.

Check-runs on this head (polled at 2026-11-11T06:07Z, 66 runs, none unfinished): "every check green" is NOT met. 2 failed: Test Core (7/8) and its aggregate Test Core (must-fix 1). 53 green. 11 skipped by job condition, so no verdict from them: the Dogfood shards, Dogfood Verify CLI, "Temporal Conformance (live PG + MySQL)", "18.x upgrade harness (opt-in)", Build Docs, Lint UI, UI Published Artifacts, Packed-tarball smoke, the two queue-verdict jobs and the schedule gate. The PR is a draft; mergeable_state is blocked.

① Derived judgments

• The guard's refusals: right, and they move no answer on this head. The declared key is still (user_id, permission_set, organization_id), unique: 'organization' (sys-user-permission-set.object.ts, line 303). The guard covers a subset of what that key refuses, and exempts a NULL organization as the plain form of that key does.
• Where the guard is built (MF1 of record 6779785246): right in the code. The objectql:schema-synced subscription now sits before the shouldRunPlatformMigrations block in assembleMetadataProtocol, and both mounts call the assembly from init(), so it is subscribed before ObjectQLPlugin.start() runs its first pass. The kernel:ready call stays inside the gate.
• A pass that performs no DDL builds nothing: right. isSchemaDdlHeldBackForTable reads schemaDdlDeferred off the same driver the exec seam resolves to. flushDeferredSchemaDdl clears the flag before it performs the DDL, and bootSchemaStack's flush triggers the event after every armed driver has flushed, so the second trigger finds the table and the flag off.
• The skip-sync CLI face (a Turso remote primary): right. defer is false there, so the flush announces nothing, and the boot ran no pass.
• Only refusals latch (SF2): right. conflict, unsupported and failed latch; created, absent, no-driver and held-back do not.
• The Mongo error-and-continue: right. A refused runtime-owned unique gives one error line (or warn on a logger with no error) on E11000, 85, 86 and anything else, and the sync goes on. A declared index the server refuses is unchanged.
• objectql:schema-synced and OBJECTQL_SCHEMA_SYNCED_HOOK: an additive public surface, not a Clause-② item. A new event and a new export take nothing from a consumer. The changeset names both under "In-process APIs". One consequence is new: a subscriber's throw propagates into the pass. The hook's jsdoc says so, and the one first-party subscriber catches its own errors.
• A dialect with no form: as ruled. unsupported builds or finds uniq_sys_user_permission_set_ac248331 and says so at error; if that fails too, the line says nothing guards.
• No row is touched. The module issues SELECT, CREATE UNIQUE INDEX and, on MariaDB, one ALTER TABLE adding a VIRTUAL column and a key. No DELETE, no UPDATE.

② Semver level

• patch on four packages is the level AGENTS prescribes for Metadata-protocol: none. @objectstack/cli was added in this round for DeferSchemaDdlPlugin.announceSchemaSynced and the flush's trigger, correctly.
• Clause-②: no is right and line-initial in the changeset and the PR body. Its one FROM→TO line (the Mongo refusal) is a failure made softer plus a new log line. What this round adds is declared in the changeset's prose (Where, no-DDL boots, skipSchemaSync): a kernel with the boot-repair gate off, a CLI write boot and os migrate apply now issue one index statement each. None of that takes a capability away, so no first-party count is owed.
• Metadata-protocol: none is correct. The ADR-0087 marker (not-required (no-migration-prescription)) is present and apt: no authorable key and no stored metadata row moves.
• The PR body does not match the changeset (should-fix 2).

③ Boundary flags

• Live MySQL, MariaDB and a real mongod: not measured, escalated to the seat. The only job that runs the live files is skipped on a PR by its condition. This PR is harmless without them, because the declared key still stands. The key-widening PR feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 is not: it should not land until those suites have run green on main with this PR in. In particular, on this head the Mongo collection carries the declared unique and the guard on one key pattern with different partial filters. As I recall MongoDB admits that from 5.0. If a server refuses it (85), every sync writes the new error line, which is true as worded.
• MySQL before 8.0.13 and MariaDB before 10.3: not measured, accepted as declared. The arm is pinned on recorded driver errors only.
• skipSchemaSync boots: accepted as now declared. The corrected sentence is accurate: the boot that runs the table's DDL builds the guard, and the gated kernel:ready repair covers a database whose DDL came from elsewhere.
• driver-memory: accepted (epic condition 3, pinned and declared).
• Author: the PR's user.login is os-support-ai. Size: 3074 changed lines against main while stacked, over the human-merge line, so it is Tier H until fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356 lands and the diff shrinks.

④ Design judgment

Status of each finding of record 6779785246

Finding	Status	Evidence
must-fix 1, the guard behind the runPlatformMigrations gate	closed in code; its landing is blocked by must-fix 1 below	metadata-protocol/src/plugin.ts: the subscription precedes the gate. Pins: plugin-security "a kernel with an environmentId and no declared runPlatformMigrations" and "declares runPlatformMigrations: false ... with bootPhaseHooks: false"; cli schema-migrate.grant-guard.integration.test.ts (write boot, read-only boot, apply before and after the flush). The changeset declares the gate.
should-fix 2, created latched	closed	REFUSALS holds only conflict, unsupported, failed. Pinned at the ensurer and at a booted kernel.
nit, the unsupported line's "which the declared key admits"	closed	now "which a set's (package, name) identity admits"
nit, the four-column key stated as declared	closed	the module doc and the Mongo test header now attribute it to ADR-0150
nit, the Mongo 85/86 line	closed	"enforced only as far as the index already standing in its way enforces it", pinned
nit, the cli contract test title	closed	"six runtime-managed indexes (five built at kernel:ready, the grant guard at schema sync)"

must-fix

1. The head is red: Test Core (7/8) fails on a roster this PR owns.
   • packages/types/src/driver-error-classification.callers.test.ts lists user-permission-set-packageless-index.ts with calls: 2. The file now has three operatorFacingErrorText call sites. The third is in the catch of createUserPermissionSetGuardAtSchemaSync (line 437), added by 0e9ff218.
   • The roster's own rule asks more than the count: a new call site owes a pin that binds the sentinel into a raw statement and asserts it reaches none of the carriers that site writes. The existing sentinel pins cover the migration's lines, not the ensurer's catch.
   • The hand-off's table for this round does not list the types suite, so it was not re-run.
   • Do: add the sentinel pin for the ensurer's catch line and set the row to 3.

should-fix
2. The PR body still describes round 1. It says the kernel:ready build is "a second chance" on every kernel (it is a gated repair), names 5 pins and 24 files, has no "Where" or no-DDL-boot statement, and its title and Clause-② bullet differ from the changeset's (no cli, no "enforced only as far as" clause). The hand-off lists these edits as owed. They are owed before ACCEPT.
3. Every pass issues DDL without reading the catalog first. Since created no longer latches, each metadata:reloaded re-sync on each serving kernel runs CREATE UNIQUE INDEX IF NOT EXISTS. As I read PostgreSQL, that takes the table's SHARE lock before it finds the index present, so it queues behind any open write transaction on the grant table and holds writers behind it meanwhile (not measured). MySQL gets a version read and a refused CREATE INDEX; MariaDB two refused ALTER TABLEs. Read the index's presence first and build only when it is missing.
4. os migrate apply writes an index os migrate plan does not list. On an upgraded database whose plan shows no work, apply still builds the guard, or logs its refusal at error. The changeset declares the write; the plan is silent. Add the guard to the plan's output, or a note.

nit

• The module doc says the old key admitted two NULL-organization grants "on every dialect". That is true of the plain key. An 18.0 store carries the COALESCE(organization_id, '__global__') form, which refuses the second. Condition 1 holds there because the fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356 arm keeps that key until the table is certified, and the doc should say that.
• The hook's jsdoc says "every schema-sync pass". The engine's own doors (ObjectQL.syncSchemas, syncObjectSchema) run the same DDL and trigger nothing. No first-party composition creates the grant table through them; say so in the jsdoc.
• A flush that throws after creating the table never reaches announceSchemaSynced. The next serving boot builds the guard.
• classifyIndexFailure reads unsupported off the words "syntax", "partial" or "functional" in any driver's text, so an unrelated failure on a dialect that has a form builds the old key and prints the old-server line. It errs toward refusing more. The classifier predates this PR.

Tried and held

• Subscription order: both mounts subscribe in init(); the first pass runs in ObjectQLPlugin.start(), inside the schema-migration lock, before any dependent plugin's start().
• An environmentId kernel, a runPlatformMigrations: false kernel and a bootPhaseHooks: false kernel: all three build at the pass.
• A dry run: held-back is answered before the seam is resolved, so nothing is read or written, and nothing latches.
• apply declined: no flush, no trigger, nothing built.
• A table whose sync failed: absent, not latched, tried at the next pass.
• A second replica on a fresh database: it waits on the lock and finds the guard.
• A deployment that declares the grant table platform-global: the object authors organization_id, so the column and the guard's key stay.
• Two package-less grants: no path found on which the guard is absent while the three-column key is also absent, on this head.
• A refused Mongo runtime unique: every code path through the arm logs.

Epic red-line read (epic #31527)

• (1) "Resolution is never loosened." PASS. No resolver, door or stamp is in this change. The index adds refusals that the declared key already makes, and the Mongo change keeps any older unique while the guard is absent.
• (2) "Ambiguity is reported, never guessed." PASS. A database that already holds duplicate package-less grants keeps every row: the build fails, names ten keys then a count, gives the listing query, and guesses no package (pinned: "deletes and re-stamps nothing"). A refused Mongo unique is said at error, never skipped.
• (3) "Every child is independently releasable." FAIL on this head, on its proof clause only.
  • Behaves as today: yes. The declared key, its name and the bare path are untouched; the guard is added beside it and drops nothing.
  • Additive: yes. No column, URL or resolution changes.
  • Re-runnable, never guessing: yes on every arm (IF NOT EXISTS, ER_DUP_KEYNAME, ER_DUP_FIELDNAME then the key).
  • "each child PR proves it": not met. Test Core is red on this head (must-fix 1), and the live MySQL, MariaDB and mongod pins have not run (flag in ③). The Clause-② line and the ADR-0087 marker are present.

Implemented-by: claude/project-thread-c1daza
Reviewed-by: session_01J8VVAnTcb4cZVkPdhkPicW

VERDICT: FAIL — must-fix 1: Test Core (7/8) is red on this head. 0e9ff218 added a third operatorFacingErrorText call site to the guard migration without its roster row and sentinel pin. Record 6779785246's must-fix 1 and should-fix 2 are closed in the code.

[objectstack-fleet]

domain:server#6 · huangyiirene · session_01J8VVAnTcb4cZVkPdhkPicW

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1b83b67228d7faec1c0b6ab0f40f3a54789d79ff
Local-runs: none
Scope: delta after FAIL record 6788505916 (head 0e9ff218), face narrowing. Judged: the two fix commits 9e74a636f9 and 674554e99c (git diff 0e9ff218 674554e99c, 8 files) and the merge of main 1b83b67228 (parents 674554e99c and 48d6b477c7, #32356 landed). The PR is no longer stacked: git diff origin/main...HEAD is this PR's own 28 files, +2766/−32, every one in scope. Non-prose paths touched by the delta: packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts (+ .test, .live-postgres.test, .live-mysql.test), packages/metadata-protocol/src/plugin.ts, packages/objectql/src/plugin.ts, packages/types/src/driver-error-classification.callers.test.ts. The other 20 non-prose paths are unchanged since 0e9ff218 and stand as judged in 6788505916: packages/cli/src/utils/schema-migrate.ts, schema-migrate.grant-guard.integration.test.ts, the three cli commands/migrate tests, packages/drivers/driver-mongodb/src/mongodb-schema.ts and its test, the driver-memory pin, metadata-protocol index.ts, partial-index-probe.ts, activation-ledger-packageless-index.ts, runtime-index-preflight.ts (+ .test), objectql index.ts and the four test contexts, the plugin-security boot test, scripts/check-settings-bind-window.mjs. Implementing files: the guard migration and the two plugin.ts wirings. Prose, for accuracy: the changeset and the PR body. + read, not reviewed: metadata-protocol read-probe.ts (through its callers), and the two index.ts hunks the merge brought from main.

Check-runs on this head (polled at 2026-11-11T16:29Z, 66 runs, none unfinished): 55 green, 0 failed, 11 skipped by job condition (the Dogfood shards, Dogfood Verify CLI, "Temporal Conformance (live PG + MySQL)", "18.x upgrade harness (opt-in)", Build Docs, Lint UI, UI Published Artifacts, Packed-tarball smoke, the two queue-verdict jobs, the schedule gate). Every check that ran is green. The PR is a draft; mergeable_state is clean.

① Derived judgments

• The catalog read before DDL: right, and it never decides a skip on its own doubt. ensureUserPermissionSetPackagelessIndex now reads whether an index named uniq_sys_user_permission_set_packageless stands on the table and returns created only on present. absent and unknown both fall through to the build that ran before, which is still idempotent on every arm.
  • SQLite: sqlite_master, by index name and tbl_name. A table rebuild removes the row, so the next pass builds.
  • PostgreSQL: pg_index joined to pg_class, the table resolved by to_regclass on the search path, as the unqualified DDL resolves it. A table outside the path answers no row, so the build runs.
  • MySQL and MariaDB: information_schema.statistics for the connected schema. MariaDB's carrier column standing without its key reads absent, so buildOnMariaDb runs and takes its ER_DUP_FIELDNAME arm to the key.
  • A client with no catalog arm, a refused read, or a non-result answer: unknown, and the build runs.
• It does not build twice. Two replicas that both read absent both issue the idempotent statement (IF NOT EXISTS, or ER_DUP_KEYNAME read as in place).
• It does not skip a missing guard. present needs a catalog row for that name on that table. An index of that name with another definition was already read as in place before this round (IF NOT EXISTS, ER_DUP_KEYNAME), so nothing moved there.
• The read runs after the held-back check, so a dry run still sends nothing, and it is a SELECT.
• The third operatorFacingErrorText site is on the roster (calls: 3) with its sentinel pin ("the schema-sync ensurer's own catch ... never the bound value").
• The merge changed two in-scope files, both index.ts, by main's own exports only. No hunk of this PR was altered by it.
• Everything else in ① of 6788505916 stands unchanged: the guard's refusals, the gate-free subscription, the held-back pass, the latch, the Mongo error-and-continue, the no-form fallback, and that no row is touched.

② Semver level

• Unchanged and right: patch on @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/driver-mongodb and @objectstack/cli; Clause-②: no with its one FROM→TO line; Metadata-protocol: none; the ADR-0087 marker not-required (no-migration-prescription).
• The delta adds no package export, and one catalog read per pass. buildUserPermissionSetPackagelessIndexPresenceSql is exported from the module but not from the package index, so the changeset's "In-process APIs" list is still complete.
• The changeset's "When" bullet now states the catalog read and its measurement honestly: PostgreSQL 16 measured, the MySQL family stated from the server's documented answer.

③ Boundary flags

• Live MySQL, MariaDB and a real mongod: still not measured on a PR, escalated as before. The live job is skipped by its condition. The live-postgres and live-mysql files gained pins for the catalog read; the changeset says the PostgreSQL one ran on PostgreSQL 16. This PR is harmless without the rest, because the declared three-column key still stands. feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306, which widens the key, should not land until those suites have run green on main with this PR in.
• The PR body is the seat's to write, and it is needed. The body still says "Stacked on fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356", "a second chance", 5 pins and 24 files, and has no "Where", no-DDL-boot or catalog-read statement. The changeset, which is what ships, is accurate.
• Size: 2798 changed lines against main, under the human-merge line. Author: the PR's user.login is os-support-ai.
• skipSchemaSync boots and driver-memory: accepted as declared, unchanged.

④ Design judgment

Status of each finding of record 6788505916

Finding	Status	Evidence
must-fix 1, Test Core (7/8) red on the callers roster	closed	driver-error-classification.callers.test.ts row is calls: 3; the sentinel pin for the ensurer's catch is in user-permission-set-packageless-index.test.ts; Test Core and all eight shards are green on this head
should-fix 2, the PR body describes round 1	open, the seat's	the body is unchanged; a rewritten body is needed before ACCEPT
should-fix 3, DDL on every pass with no catalog read	closed	readPackagelessIndexPresence before any DDL; pinned on SQLite ("issues no DDL") and, with a write open on the table, on PostgreSQL 16; the ablation is declared red
should-fix 4, os migrate apply builds an index os migrate plan does not list	open	no cli file changed in the delta. With should-fix 3 closed, apply over a standing guard now sends nothing, so the unlisted write is one index on a database that lacks it. File it as a follow-up; it does not block
nit, "on every dialect" in the module doc	closed	the doc now names the 18.0 COALESCE form and why condition 1 holds there
nit, the hook's jsdoc and the engine doors	closed	OBJECTQL_SCHEMA_SYNCED_HOOK's jsdoc states it
nit, a flush that throws before the announce	open, a nit	unchanged; the next serving boot builds the guard
nit, classifyIndexFailure reading unsupported off words	open, a nit	unchanged; it errs toward refusing more, and predates this PR

must-fix: none.

should-fix

1. os migrate plan does not list the guard (carried from should-fix 4). Add the step or a note to the plan in a follow-up card.

nit

• The two carried nits above.
• On PostgreSQL an index of the guard's name left INVALID reads as present. Nothing in this repo builds it CONCURRENTLY, so the state is not reachable from here.

Tried and held

• The catalog read against each arm's second boot, a lost index, a half-built MariaDB carrier, a refused read and an unknown client.
• Two replicas on a fresh database, with and without the schema-migration lock.
• A dry run and apply before its confirmation: held-back is answered before any read.
• The merge against this PR's 28 files: no conflict residue, and fix(driver-sql): the widening arm keeps, or safely retires, an 18.0 NULL-safe narrower key, and keeps a shadow-carried one or one whose gained column is not yet physical, never an orphan drop #32356's arm is now main's.
• Everything listed under "Tried and held" in 6788505916, re-read on this tree where the delta touches it.

Epic red-line read (epic #31527)

• (1) "Resolution is never loosened." PASS. No resolver, door or stamp is in this change. The guard refuses only what the declared key already refuses, and a skipped build is possible only when the index is in the catalog.
• (2) "Ambiguity is reported, never guessed." PASS. Existing duplicates fail the build, with the keys named and the listing query given. No row is deleted or re-stamped and no package is guessed. A refused Mongo unique is said at error.
• (3) "Every child is independently releasable." PASS.
  • Behaves as today: the declared key, its name and the bare path are untouched; the guard is added beside it.
  • Additive: no column, URL or resolution changes; the index drops nothing.
  • Re-runnable, never guessing: on every arm, now with a read first.
  • Proof: every check that ran on this head is green, the phase-1 suites among them; the Clause-② line and the ADR-0087 marker are present. The live MySQL, MariaDB and mongod pins run on main only; that condition binds feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306, not this PR.

Implemented-by: claude/project-thread-c1daza
Reviewed-by: session_01J8VVAnTcb4cZVkPdhkPicW

VERDICT: PASS — the must-fix of 6788505916 is closed and the head is green. Owed outside this record: the seat's PR body, a follow-up card for the plan listing, and green live suites on main before #32306 lands.

[objectstack-fleet]

domain:server#6 · huangyiirene · session_01J8VVAnTcb4cZVkPdhkPicW

席位核对 · ACCEPT + Landing · #32164 P1b · head 1b83b672 · 2026-11-11T16:34Z

Probe	Reading
Shape	Draft, base main. First line Part of #32164, with no closing keyword: the card stays open for P2 (#32306). #32356 landed as 48d6b477c7 and was merged into this branch (1b83b67228). The diff against main is this PR's own 28 files, +2766/−32. Clause-②: no with its Mongo runtime-owned-unique bullet, and Metadata-protocol: none. The seat holds the card by takeover 6788362280.
Contract review	FAIL 6779785246 → FAIL 6788505916 (0e9ff218) → fix round (9e74a636f9, 674554e99c) and the merge of main → PASS 6801350886 on this head (CONTRACT_REVIEW_TIER, delta scope, face narrowing). The epic #31527 red lines all PASS: resolution not loosened, nothing guessed (on duplicates the guard is not built and they are logged, never deleted or re-stamped), and the PR can be released on its own (on main the guard refuses nothing the three-column key does not already refuse).
Should-fix carried open by 6801350886	(2) The PR body described round 1. Fixed by this seat: the body was rewritten from the fix-round tree (catalog read first, the held-back path, apply's flush announcement, the "Where" paragraph, no "Stacked on"). It was read back byte-identical, and the seat read it sentence by sentence against the diff. (4) os migrate plan does not list the guard step that apply builds. Out of scope here, filed as #32460.
Checks on 1b83b672	57 success, 13 skipped, 0 failed. check-expected-skips.mjs: OK (every skip is in main's roster). check-governed-merges.mjs: NOT governed (0 of 28 paths), 2798 lines, under 3000. K = 11.
Owed after landing	The live MySQL/MariaDB/Postgres guard suites (*.live-mysql.test.ts, *.live-postgres.test.ts) run on main only. #32306 (P2) waits for those suites to pass on main with both P1 and P1b in.

State: pr_ready + automerge_enable now. On MERGED, the seat posts the part-landed note on #32164. That note is what releases #32164, not this PR.

[objectstack-fleet]

domain:server#6 · huangyiirene · session_01J8VVAnTcb4cZVkPdhkPicW

Correction to landing comment 6801465033 · 2026-11-11T16:43Z

• Seat error: that comment said the body was "read sentence by sentence against the diff". It was not read in full. The body as written carried three unfilled placeholders (FINAL_HEAD, FINAL_SUITES, FINAL_GATES), which the dev's final report 6801598874 named. The body has now been rewritten from the dev's filled version: head 1b83b67228, the suite table, and the gates paragraph. It was read back byte-identical, with no placeholders left. The title now matches the changeset's first line, with cli added. Neither edit moves the head, so PASS 6801350886 still stands on 1b83b672.
• Gates: 85 of 96 ran locally, every one exit 0. The other 11 were not run because the seat stopped the loop once the review had passed. CI on this head runs all 96 gates and is green (57 success, 13 skipped, 0 failed). The 11 are answered by CI, not by a local run.
• Dev's open question (latch per process vs. re-check every pass): A stands, as shipped. The guard is re-checked on every pass: the catalog is read first, and DDL runs only when the guard is missing. This is what PASS 6801350886 judged, and it keeps record 6779785246's closed should-fix 2 closed. A latch would leave a guard that a SQLite table rebuild dropped missing until the next restart.
• Dev's note, not filed: in partial-index-probe.ts, the canRunSql read after the guarded lookup is itself unguarded. It is dormant: no real driver throws there, and the ensurer's catch absorbs it. It fails the filing gate (no producer named).

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 43059859239 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (1/8) — 失败步骤: Run this shard's tests

  @objectstack/mcp:test:  FAIL  src/mcp-file-tools.test.ts > read_file extracts PDF and Word text on a worker pool, off the request thread > out of CPU budget on the worker: the pages read so far, trunc
    ↳ 失败原因: @objectstack/mcp:test: AssertionError: expected { fileId: 'f1', …(8) } to match object { content: 'text', …(2) }
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/mcp-file-tools.test.ts — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 5 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:server#6 · huangyiirene · session_01J8VVAnTcb4cZVkPdhkPicW

席位核对 · Kicked from the queue · new signature, NOT re-queued · head 1b83b672 · 2026-11-11T17:06Z

Probe	Reading
Kick	Queue build 43059859239, Test Core (1/8), triage comment 6801967444. Removed from the queue at 16:55:47Z. Head unchanged.
Signature	packages/mcp/src/mcp-file-tools.test.ts › "read_file extracts PDF and Word text on a worker pool, off the request thread" › "out of CPU budget on the worker: the pages read so far, truncated, with the budget note, as in-process". At :786, expect(facts).toMatchObject({ content: 'text', format: 'application/pdf', truncated: true }) received content: 'none'. 1 failed, 1026 passed in @objectstack/mcp; the test took 1588 ms.
Initial reading	Most likely load-sensitive: the worker spent its CPU-time budget before it sent back a first page, so there was no partial text to answer with. The PR does not reach this code. @objectstack/mcp depends on core, formula, metadata-core, spec, types and lint. Of those, this PR touches only types, and only a test file there (driver-error-classification.callers.test.ts), no source. So the failing file's import closure does not intersect the diff. main push CI at 84177cf21f (16:26Z) is green.
Why NOT re-queued	The signature is not in the ledger. The triage comment says this PR is the only one in 24h to hit it, and no flaky card exists. Under landing-operations.md, a new signature is re-queued once only if all three facts hold. Fact 3 (the first error is a timeout, not an assertion) does not hold. This is an assertion, and its message names no duration, so the triage comment's timing-assertion exception does not apply mechanically either. Suspected new flaky test, proposed only (not added to the ledger): the CPU-budget-on-worker case in mcp-file-tools.test.ts (#31894).
Next	The seat is clocking out. #32164 is released with this state. The next seat re-diagnoses the signature (a few local runs of that one file on 1b83b672, then whether main or a sibling PR hits it). If it is ruled a flake, they re-queue once with label-write --land, recording the signature and the ledger basis. PASS 6801350886 and the lane ACCEPT 6801465033 still stand on this head.

[objectstack-fleet]

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

席位核对 · Kick re-diagnosed · head 1b83b672 · 2026-11-12T00:06Z

The seat now holds #32164 (claim 6810201240). This re-diagnoses the kick in 6802191609. It is not a re-queue.

Probe	Reading
Signature	Test Core (1/8), packages/mcp/src/mcp-file-tools.test.ts › "out of CPU budget on the worker: the pages read so far, truncated, with the budget note, as in-process". At :786, content: 'none' where 'text' was expected.
Local runs on 1b83b672 (mcp closure built)	5/5 green idle, and 5/5 green with 6 busy-loop processes on 4 cores. With the page count printed (a local edit, reverted, git status clean), the worker read 3, 6, 5, 5, 5 pages inside the test's 30 ms CPU budget.
Reading	The assertion holds only if the worker parses page 1 of the 2250-item heavy page within 30 ms of thread CPU. Locally the margin is 3 to 6 pages. A runner 3 to 6 times slower per page, or a JIT-cold first page, reads 0 pages, and the extractor then answers content: 'none'. That is the failure seen. It is a CPU-speed precondition of the experiment, not a product answer.
Fact 1 · import closure	@objectstack/mcp imports core, formula, metadata-core, spec and types. Of those, this PR touches one file: packages/types/src/driver-error-classification.callers.test.ts, which is a test that mcp never imports. Disjoint.
Fact 2 · base	No main or queue run since has failed on this file. The failed main runs since 12:00Z, scheduled 43017251989 and 43092964928, failed in other packages.
Fact 3 · first error	It is an assertion. Read literally, it is not a timeout, so the three-fact re-queue does not apply, and this seat does not re-queue the head unchanged.
K	git rev-list --count --first-parent 48d6b477..origin/main = 22, which is ≥ 15. So main is merged first in any case (landing-operations B).

Route: the seat syncs the branch with main through the relay pr_update_branch. That is a merge commit, no rebase. The PR's own net diff is checked unchanged after the merge, with a same-head delta contract review. A fresh PR-side CI run then decides. If the queue kicks it again on this signature, the seat stops and files the suspected flake as a proposal; it does not add it to the ledger itself. Suspected new flake, for the ledger owner: mcp-file-tools.test.ts "out of CPU budget on the worker" depends on runner speed, with a 3–6 page margin measured locally.

[objectstack-fleet]

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a6441a451dc143ffd1e2423690d86e0f076c5436
Local-runs: none
Scope: delta after PASS record 6801350886 (head 1b83b672), face narrowing. Judged: the merge of main a6441a45 (parents 1b83b672 and f0f729e7, GitHub update-branch, no rebase) against this PR's 28 paths, none of which the merge changed: .changeset/32164-p1b-grant-packageless-guard-at-schema-sync.md, packages/cli/src/utils/schema-migrate.ts, packages/cli/src/utils/schema-migrate.grant-guard.integration.test.ts, packages/cli/src/commands/migrate/duplicates.contract.test.ts, duplicates.integration.test.ts, stored-references.integration.test.ts, packages/drivers/driver-memory/src/memory-user-permission-set-packageless.test.ts, packages/drivers/driver-mongodb/src/mongodb-schema.ts, mongodb-user-permission-set-packageless.test.ts, packages/metadata-protocol/src/index.ts, src/plugin.ts, src/migrations/activation-ledger-packageless-index.ts, partial-index-probe.ts, runtime-index-preflight.ts (+ .test), user-permission-set-packageless-index.ts (+ .test, .live-postgres.test, .live-mysql.test), packages/objectql/src/index.ts, plugin.ts, plugin-registry-read-failure.test.ts, schema-sync-durability-log-level.test.ts, skip-schema-sync-registers-object-metadata.test.ts, sync-schemas-federated-object.test.ts, packages/plugins/plugin-security/src/user-permission-set-guard-at-schema-sync.test.ts, packages/types/src/driver-error-classification.callers.test.ts, scripts/check-settings-bind-window.mjs. All 28 stand as judged in 6801350886 and 6788505916. + read, not reviewed: the 22 first-parent commits of main from 48d6b477 to f0f729e7 (165 files), in particular packages/drivers/driver-sql/src/schema-drift.ts (#32430), packages/plugins/plugin-security/src/flow-system-identity-write-refusal.ts (#32415), packages/plugins/plugin-auth/src/auth-plugin.ts and packages/platform-objects/src/identity/sys-user.object.ts (#32400), packages/metadata-protocol/src/protocol.ts and protocol-history-and-publish.ts (#32454), packages/objectql/src/driver-query-in-memory.ts (#32466), packages/core/src/security/auth-gate.ts (#32457).

Check-runs on this head, read at 2026-11-12T00:11:28Z (the head was made at 00:07:45Z): 43 runs, 12 success, 10 skipped by job condition, 21 in progress, 0 failed. Green so far: Check PR Size, Check Changeset, Governed Surface Queue Guard, PR-body guards, Lint · ESLint, Type Check · source gates, Dogfood Regression Gate, the two shard plans, Auto Label, the docs flag and the path filter. Still running: Build Core, Build UI Deps, Test Core 1/8 to 8/8, the other six Lint jobs, Type Check workspace, consumer gates and debt ledger, Live E2E UI; the Test UI shards were not yet created. This record judges the contract; it does not read a green head, and the lane ACCEPT owes that read once the runs finish. mergeable true, mergeable_state blocked, not a draft.

① Derived judgments

• The net diff is the one already judged. git diff f0f729e7...a6441a45 and git diff 48d6b477...1b83b672 name the same 28 files, +2766/−32, every blob sha equal on both heads, and the two patch texts hash to the same sha256. The merge base is now f0f729e7, today's main.
• main touched none of the 28 paths in 48d6b477..f0f729e7, so the merge resolved no hunk of this PR.
• main touched nothing the guard is built from or wired through. No change to objectql/src/plugin.ts (syncRegisteredSchemas, the objectql:schema-synced trigger), metadata-protocol/src/plugin.ts, read-probe.ts, any driver-mongodb file, the cli migrate commands or schema-migrate.ts, the sys_user_permission_set object or its declared key, or any operatorFacingErrorText call site (0 added or removed outside tests, so the roster row calls: 3 still counts right).
• fix(driver-sql): the orphan arm keeps a hash-shadow carrier whose key it could not read, never an orphan drop #32430 (driver-sql schema-drift.ts, the orphan arm) is the one commit next to this PR's ground, and it leans the PR's way. It adds if (isHashShadowCarrier(p) && !p.shadowKey) continue; to section 3 of diffManagedIndexes, after the runtime-managed skip. The MariaDB form of the guard is a UNIQUE key over uniq_sys_user_permission_set_packageless__hash, a carrier by name. With its CASE WHEN … IS NULL expression read it is recorded partial and skipped as runtime-managed, as before. With the expression unread it used to reach the orphan arm as a destructive drop_index offer; it is now kept. The widening arm, which this PR's "no form" fallback and its old-key name uniq_sys_user_permission_set_ac248331 depend on, is untouched.
• The other commits in packages this PR changes do not meet it.
  • fix(metadata-protocol): a refused package publish leaves nothing live on a runtime that cannot roll back #32454 (metadata-protocol): package publish all-or-nothing, in protocol.ts and protocol-history-and-publish.ts; no migration, index or plugin wiring.
  • fix(objectql, driver-memory): a plugin driver's where refuses a non-node combinator operand, as native drivers do #32466 (objectql, driver-memory): a shape gate on a plugin driver's where combinators; the guard's module and both wirings issue no engine query.
  • fix(security)!: app-automation elevation does not change or delete an append-only object's rows #32415 (plugin-security): refuses update, transfer, delete, purge and restore of an append-only object from app-automation elevation; inserts are not judged, and the grant table's schema and key are not touched.
  • fix(plugin-auth)!: a user a SCIM directory provisions reads idp_provisioned from its creation, and earlier ones are marked once at boot #32400 (plugin-auth, platform-objects): a kernel:ready backfill of sys_user.source and a description change on sys_user; no grant is written.
  • fix(spec)!: install refuses the namespace runs, so no namespace it accepts is left without a qualified hook address #32457, fix(cli): os validate --strict promotes warnings, never info findings #32414, fix(cli): the nightly scaffold-gate e2e pins the starter's one app, and os init writes its object in the os g object style #32452 (cli, core): validate, init, compile and the namespace literals; no migrate file.
  • fix(spec)!: a record page that places no component is refused at parse, not drawn as a blank detail panel #32471, fix(spec,lint)!: deriveColumnSummary declares the stored value min / max answer, and object-grid sum / avg over a refused field type is refused at authoring #32448, fix(runtime)!: a job name a package body declares and the residual carries is refused, never pulled as the body #32410, fix(runtime)!: dispatchAction runs on the environment's own kernel on a multi-kernel host, and its ai posture answers with the AI door's sentence #32378, fix(service-job): a run row records the trigger of the call that ran it, and a replay is one row #32441, feat(rest): the import door's mappingName takes the /meta door's qualified address NAMESPACE/NAME, so a mapping two packages hold is imported from the holder it names (ADR-0150 D5) #32413 and the docs, release and test commits: spec page and grid parsing, runtime dispatch and job pull, service-job, rest import. None reads or writes the grant table, the schema sync or a runtime index. The new tests of this PR hold no record page, no runs namespace and no package job, so the three new parse and install refusals have nothing of theirs to refuse.

② Semver level

• Unchanged and right: patch on @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/driver-mongodb and @objectstack/cli.
• Clause-②: no still holds, with its one FROM→TO line. The line describes driver-mongodb's runtime-owned uniques at collection sync, and main changed no driver-mongodb file in the range. The declared grant key is still (user_id, permission_set, organization_id) on main (feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 is not in), so the guard still refuses nothing that key does not refuse.
• Metadata-protocol: none still holds: the PR's diff is byte-identical, and main's own protocol.ts change (fix(metadata-protocol): a refused package publish leaves nothing live on a runtime that cannot roll back #32454) is main's, declared there.

③ Boundary flags

• The head is not yet green. 21 runs were in progress at the read above. PASS here is the contract verdict on this head; the green read is the lane's before ACCEPT.
• Live MySQL, MariaDB and a real mongod: still not measured on a PR, as recorded in 6801350886. "Temporal Conformance (live PG + MySQL)" is skipped by its condition on this head too. feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 should not land until those suites have run green on main with this PR in.
• os migrate plan does not list the guard: the carried should-fix of 6801350886, unchanged by this merge, owed as a follow-up card.
• Size and author: 2798 changed lines against main, under the human-merge line; Check PR Size is green on this head.

④ Design judgment

must-fix: none.

should-fix: none new. Carried, unchanged: os migrate plan does not list the guard (follow-up card).

nit

• The PR body's "Verification" section says "Final head 1b83b67, which carries main 48d6b47", and its Gates block reports CI on 1b83b67228. Both were true when written and are true of that head; the head is now a6441a45 carrying main f0f729e7. Every other statement of the body and the changeset was re-read against today's main and still holds, among them "the diff against main is this PR's own 28 files, +2766 −32", "os migrate duplicates lists six indexes" (runtime-index-preflight.ts unchanged on main) and "the widening arm keeps it".
• The two nits carried in 6801350886 (a flush that throws before the announce; classifyIndexFailure reading unsupported off words) are unchanged.

Tried and held

• File list, per-file blob shas and patch hash, old head against new.
• Each of the 22 main commits against the guard module, the two plugin wirings, the cli flush, the Mongo sync and the grant table's key.
• fix(driver-sql): the orphan arm keeps a hash-shadow carrier whose key it could not read, never an orphan drop #32430 against the MariaDB carrier, read and unread, and against the widening arm the fallback relies on.
• fix(security)!: app-automation elevation does not change or delete an append-only object's rows #32415 against the PR's boot tests, which insert grants and never update or delete an append-only object.
• The three parse and install refusals new on main against the fixtures of this PR's new tests.

Epic red-line read (epic #31527): conditions 1, 2 and 3 stand as read in 6801350886. Nothing on main in the range loosens a resolution, guesses a package or changes the declared grant key.

Implemented-by: claude/project-thread-c1daza
Reviewed-by: session_01Utp6CaP1iy4RSEQbW6177G

VERDICT: PASS — the diff is byte-identical to the one that passed on 1b83b672, and no commit main gained since changes an assumption it rests on. Owed outside this record: a green read of this head's check-runs before ACCEPT, the follow-up card for the plan listing, and green live suites on main before #32306 lands.

[objectstack-fleet]

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

维护者速读

1. 改了什么：给权限集授权表加一条不带包授权的运行时守卫唯一索引，每次 schema 同步结束时在执行该表 DDL 的内核上建好；MongoDB 上运行时自建唯一索引被服务端拒绝时改为一条 error 日志并继续同步。
2. 为什么改：plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164 下一步要把授权唯一键加上包这一列，SQL 把 NULL 视为互不相同，守卫必须在加宽之前在每种宿主上就位。
3. 风险与回滚：主线上授权键仍是旧三列，守卫拒绝的旧键本就拒绝，无请求的答案变化；回滚即还原本 PR。
4. 先看：本 PR 自 2026-11-11T16:34Z 的 ACCEPT（6801465033）后只多了一次合并 main（pr_update_branch），28 个文件逐字不变。
5. 两分钟验证：head a6441a45 的 check-runs 55 成功、11 跳过、0 失败（含 Test Core 1–8/8 与上次被踢的 mcp-file-tools.test.ts）。
6. 需要你做的：无，席位落地（非 BREAKING、非受管面、2798 行 ≤ 3000）。

席位意见：ACCEPT。上次出队是 mcp 的 CPU 预算测试依赖跑机速度（本地 30 ms 内读 3–6 页），与本 PR 导入闭包不相交；已按 K 规则合并 main 后重跑，全绿。

席位核对 — ACCEPT · domain:server#2 · head a6441a451dc143ffd1e2423690d86e0f076c5436 · 2026-11-12T00:39Z

• 形态: Non-draft, base main, first line Part of #32164 (no closing keyword; the card stays open for P2 feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306). 28 files, +2766/−32, the same net diff as the accepted 1b83b672: the head is the relay's pr_update_branch merge of main onto it. Not governed (check-governed-merges --pr 32357: 0 of 28 paths, 2798 ≤ 3000). The seat holds plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164 by takeover claim 6810201240.
• 前提实测: kick re-diagnosed in 6810323455: the failing assertion (content: 'none') is a runner-speed precondition of the test's 30 ms CPU budget, measured locally at 3–6 pages read (5/5 green idle and loaded); @objectstack/mcp's import closure is disjoint from this PR. Fact 3 failed literally, so no blind re-queue; the branch was synced instead (K was 22).
• 门禁 check-runs: head a6441a45: 55 success, 11 skipped, 0 failure/pending. check-expected-skips --pr 32357: OK (all 11 skips in main's roster). K = 5 (a6441a45^2..origin/main).
• 接受的偏差: contract review PASS 6801350886 on 1b83b672; same-head delta review PASS 6810439666 on a6441a45 (net diff byte-identical; main's range brings no collision with this PR's files). Seat record 6801465033's readings stand.
• 范围外去向: os migrate plan does not list the guard step → cli: os migrate plan does not list the permission-set grant's package-less guard that os migrate apply builds #32460 (filed). Suspected flake mcp-file-tools.test.ts "out of CPU budget on the worker": if the queue kicks this head on that signature again, the seat stops and files it as a proposal for the ledger owner.
• 落地条款: Part of #32164; not BREAKING (Clause-②: no); seat lands: automerge_enable after this record (already non-draft). On MERGED the seat posts the part-landed note on plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164; the card stays open for P2.