A `SELECT ... WHERE 1 = 0` column-existence probe against `_objectstack_sequences` is logged at ERROR on a normal boot, before the table exists

[zhuangjianguo]

Found while upgrading objectstack-ai/hotclm from @objectstack/* 17.3.0 to 17.4.0 (hotclm#35 / hotclm PR #37). Filed at the destination per that repo's AGENTS.md rule for platform gaps — report, never patch. Not triaged: no domain:*, no priority, no assignee.

Symptom

On a clean single-tenant SQLite dev database, every boot after the first logs, at ERROR level:

[sql-driver] DATABASE_ERROR ... SELECT "tenant_id" FROM "_objectstack_sequences" WHERE 1 = 0
  - no such table: _objectstack_sequences

WHERE 1 = 0 is the shape of a column-existence probe — a query written to return no rows and answer only "does this column exist". The probe runs against a table that has not been created yet, the driver raises, and the raise is logged at error severity rather than being handled as the negative answer the probe was asking for.

Nothing downstream breaks: the boot completes, capabilities are not degraded, and no application data is touched.

Why it is worth a card even though nothing breaks

Consumers are told to read their boot log. objectstack-ai/hotclm's AGENTS.md says, verbatim:

A boot that logs warnings is not a passing boot. Read the startup banner. System started with degraded capabilities, no such table, or a plugin that failed to load each mean the app is running as something other than the product.

That rule now fires on a healthy boot. An app author following the documented discipline must either ignore an ERROR line — which trains them to ignore the next one, the one that matters — or chase a platform-internal probe they cannot fix. A probe's negative answer should not be indistinguishable from a real driver failure.

Version boundary

• 17.3.0 — line absent.
• 17.4.0 — line present.

Measured on the same application, same worktree, same clean .objectstack/data, both boots read at seeder quiescence rather than at the ready banner.

Reproduce

git clone https://github.com/objectstack-ai/hotclm && cd hotclm
pnpm install          # resolves @objectstack/* 17.4.0
rm -rf .objectstack/data
pnpm demo             # boot 1
pnpm demo             # boot 2 — the ERROR line appears here

Expected

A column-existence probe against a table that does not exist yet answers "no" without a DATABASE_ERROR at error severity — either by checking table existence first, or by classifying no such table from a WHERE 1 = 0 probe as the negative result rather than a failure.

Related

Sibling finding from the same boot, different root cause, filed separately: the sys_oauth_resource bootstrap re-insert now surfacing as an ERROR.

[os-litant]

Triage: lands in packages/drivers/driver-sql; domain:engine; priority:p2.

A SELECT ... WHERE 1 = 0 column-existence probe against _objectstack_sequences is logged at ERROR on a normal boot, before the table exists ⇒ every boot after the first prints [sql-driver] DATABASE_ERRO… at ERROR on a clean single-tenant SQLite dev database.

⇒ p2: an expected, handled probe reported at ERROR on the happy path. ⭐ The cost is not the line — it is that operators learn this product prints errors when nothing is wrong, and then miss the one that matters. That is the same blindness objectui#8620 describes for test output, on the operator's side.

⇒ Log the expected-miss case at the level it deserves (debug/trace) or probe in a way that does not raise. ⛔ Do not suppress the driver's error channel wholesale — the probe is what should stop shouting, ⛔ not the log.

⚠️ Sibling from the same boot, ⛔ not a fold (different package, different lane): objectstack#17176 (sys_oauth_resource UNIQUE refusal at ERROR). ⭐ Together they mean a normal boot prints at least two ERRORs — say so in whichever PR lands second, and check whether a third exists.

⭐ Filed at the destination per hotclm's AGENTS.md — report, never patch.

Size/model suggestion: S–M.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 2026-09-10T14:56Z · 本评论来自分诊座位}

---

Generated by Claude Code

[os-musk]

Claim: PM loop round 1 (wave 2)
Session: session_01RuoNSXUbBoWHkNS4AknTrM
Branch: claude/issue-17175-sequences-probe-error-level
Worktree: objectstack-issue-17175
Domain: domain:engine
File surface: packages/drivers/driver-sql/src/ (the _objectstack_sequences column-existence probe and its error path) plus tests. ⚠️ If the honest fix is in the caller rather than in the driver's log call, report the landing site before widening.
Container & model: S–M, mode:subagent, model: default judgment tier (opus) — dispatch-gates.mjs --tier on packages/drivers/driver-sql/src/sql-driver.ts @ 82cb69fed returns no path-derived mandate. Triage suggested S–M; this seat takes the judgment tier because the card's real question is which of two things is wrong, and the wrong answer makes a driver's error channel quieter.
Clause-②: no
Thread-read: 5620726487
Serial constraints cleared: packages/drivers/driver-sql/src/sql-driver.ts was released at 01:55Z when PR #17577 (#17343) merged as 82cb69fede — this card was explicitly queued behind it in the seat post's hot-file queue and is now first in line. ⚠️ #17590 is the other card on this file; it is in the decision box (needs-user-decision) and is ⛔ not dispatched, so no in-flight sibling pins this file. The wave sibling #17341 is packages/core — disjoint. os-verify-lock --status: lock free, queue empty ⇒ arrival depth 1.

Why Clause-②: no

A log level and a probe's error path. No accept set moves, no published payload gains a key, no error code is minted. ⚠️ Re-declare and stop if the chosen repair changes what the probe answers rather than how loudly a handled miss is reported.

---

Generated by Claude Code

[os-musk]

os-dev-report

{
  "issue": 17175,
  "status": "needs_decision",
  "branch": "claude/issue-17175-sequences-probe-error-level",
  "pr": null,
  "premise_still_valid": true,
  "summary": "No code landed. Both Zone 2 assumptions were measured and both hold, but a third measurement moves the honest fix out of this card's declared lane, so the dispatch's hard stop (report instead of proceeding) applies. (1) EMIT SITE CONFIRMED in driver-sql, as triage routed it: SqlDriver.rawStatementFault at packages/drivers/driver-sql/src/sql-driver.ts:8599, whose this.logger.warn at :8606 composes the card's line verbatim; it is reached from execute() at :8654. Not a lane question. (2) PROBE CONFIRMED: buildSequencesPresenceSql at packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts:533 emits, for every non-MySQL client, the card's statement byte-for-byte; it runs as step 1 of backfillSeedTenancy at :1234 on the kernel:ready hook (packages/metadata-protocol/src/plugin.ts:342) and again at the first-organization handoff (packages/runtime/src/app-plugin.ts:1635), and its raise IS the expected negative answer, already handled by catch { return { status: 'absent' } }. (3) ONE CARD DETAIL MEASURED FALSE, and it decides between the ruling's two shapes: the line is emitted at warn, not at error. So the ruling's shape (b), 'report that handled miss at a level that is not ERROR', is ALREADY the state of the code and did not fix the harm, because console.warn writes to stderr carrying both the DATABASE_ERROR token and the dialect's 'no such table'. Shape (b) has no honest headroom left inside the driver: quietening it further requires classifying the refusal, the repo's one predicate for that is isMissingTableError, it needs readObject to avoid the #13324 fail-open, the raw path structurally has no object name (rawStatementFaultError declares no DRIVER_TARGETED_TABLE, pinned by sql-driver-16019-raw-statement-fault-envelope.test.ts), and packages/types/src/driver-error-classification.callers.test.ts fails any in-repo one-argument call. An unclassified demotion of the whole raw terminal is exactly the wholesale suppression Zone 1 refuses. That leaves shape (a), 'probe in a way that does not raise' — and the probe is the caller's. LANDING SITE: packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts, outside the claim's declared file surface of packages/drivers/driver-sql/src/. Reporting instead of widening, per the hard stop. Sibling context asked for: #17176 is a different package and lane, so a normal boot prints at least two of these; a candidate THIRD is named in out_of_scope_findings and was not chased.",
  "tests": "No fix, so nothing to reverse-verify and nothing to ablate — both legs would have had no mutation target, and none is reported as run. What WAS run, all in the per-issue scratchpad under issue-17175/: (i) pnpm install in the worktree, exit 0. (ii) Build of the two closures through the shared lock, OS_VERIFY_LOCK_SLOT=issue-17175: bash scripts/pm/os-verify-lock.sh -c \"pnpm --filter '@objectstack/driver-sql^...' --filter @objectstack/driver-sql --filter '@objectstack/metadata-protocol^...' --filter @objectstack/metadata-protocol build --concurrency=2\" printed 'os-verify-lock: VERDICT command-exit 0 · held the lock 273s · waited 0s'. (iii) REPRO, against the built dist and real better-sqlite3 on a database where the table does not exist — new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }); await driver.execute('SELECT \"tenant_id\" FROM \"_objectstack_sequences\" WHERE 1 = 0') — with every console channel captured. Result: exactly ONE line, on channel 'warn' (not 'error', not 'info', not 'debug'): '[sql-driver] DATABASE_ERROR — the backend refused a raw statement (SQLITE_ERROR). ... statement: SELECT \"tenant_id\" FROM \"_objectstack_sequences\" WHERE 1 = 0; dialect: SELECT \"tenant_id\" FROM \"_objectstack_sequences\" WHERE 1 = 0 - no such table: _objectstack_sequences'. The thrown value is { code: 'DATABASE_ERROR', status: 500 } with the dialect error whole under cause. The driver's default logger object was read in the same run and has exactly two channels: warn, error. (iv) BUILDER CHECK: buildSequencesPresenceSql from the built metadata-protocol dist returns the card's statement byte-for-byte for better-sqlite3, sqlite3, pg and undefined, and the backticked spelling for mysql2. (v) The same driver run also drove packages/metadata-protocol/src/migrations/sys-setting-identity-index.ts's probe text ('SELECT 1 FROM sys_setting WHERE 1 = 0') and got the identical line shape on the identical channel — the class evidence behind the third-finding candidate. (vi) GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (repo assertion accepted against this checkout's origin) exited 2 with 'this branch changes nothing against origin/main (merge base 82cb69fed) — nothing to derive'. Zero gate commands were derived because the diff is empty, so none were owed and none were run; --ran reconciliation is vacuous. Nothing is reported as green that was not measured. NOT MEASURED: the card's hotclm boot repro — not runnable here, not faked, not reported as run.",
  "mcp_calls": "0 — the whole run used repo-scoped REST (one probe plus the card and its two comments) and local git; no MCP GitHub call was made except the report comment, counted in the comment itself.",
  "open_questions": [
    {
      "question": "This card cannot be honestly implemented inside its declared file surface. Which architecture should it become, and does the lane move to packages/metadata-protocol?",
      "options": [
        "A — caller-side, this probe only: replace buildSequencesPresenceSql's raising WHERE 1 = 0 with a catalog lookup compiled for the seam's dialect (sqlite_master for SQLite, information_schema.tables + DATABASE() for MySQL, to_regclass for Postgres), so the expected miss returns zero rows instead of raising. Cost, measured against Zone 3's objection: it REPLACES the statement rather than adding one, so it costs no extra round trip. Risk: a mis-compiled arm is caught by the same catch and reads as 'absent', which turns a stored-row data repair into a silent no-op on whichever dialect nobody exercised — and only SQLite is exercisable in this container. Lands in packages/metadata-protocol.",
        "B — driver-side, class-wide: give the raw path the table identity it lacks so rawStatementFault can ask isMissingTableError(error, table) and put that one class on a channel that is not the operator's. Cost: the identity has to arrive from the caller, i.e. a new key on DriverOptionsSchema, which is a Zod key on the contract source surface — Clause-② yes, T1 widening tell, a different card. Second cost: the driver's default logger has only warn and error, so a quieter channel must be invented AND its default decided, and a no-op default is the wholesale mute Zone 1 refuses.",
        "C — caller-side, class-wide: one shared non-raising presence helper owned by the layer these probes live in, so all fail-soft presence probes ask the catalog through a single tested implementation instead of N copies. Same dialect risk as A, paid once instead of per site. Still lands outside packages/drivers/driver-sql."
      ],
      "recommendation": "C if the intent is to close the class the ⭐ cost statement describes — there are at least two of these on the kernel:ready boot path already and a third idiom in packages/cli, so A leaves the operator still reading one unexplained DATABASE_ERROR per boot and learns them the same lesson. A, scoped to _objectstack_sequences, if only this card is wanted this round. ⛔ Not B here: it flips Clause-② and is a different card. Either way the lane moves to packages/metadata-protocol and the claim's file surface needs re-declaring before any edit."
    },
    {
      "question": "The four-axis decision frame the os-dev contract requires for an escalation analysis was not carried in this dispatch (Zones 1-3 carry the ruling, the mechanism assumptions and a suggested route, but no {decision_frame}). Per the contract I have not invented axes. Please send the frame if you want the options above re-argued axis by axis.",
      "options": [
        "Send the seat's decision frame and I re-argue A/B/C against it in the next round.",
        "Treat the costs stated above as sufficient and rule directly."
      ],
      "recommendation": "Send the frame — the choice between A and C is a scope-versus-blast-radius trade that the axes are what settles."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: packages/runtime/src/app-plugin.ts:1621 documents the backfill's first act as 'returns no-split having written nothing and logged nothing'. Measured false on this tree — that first act writes one stderr line per boot on any install with no counter table. 承接者: whichever PR fixes this card; the sentence is evidence for it, not a separate repair.",
    "noted, not filed: packages/drivers/driver-sql/src/index.ts onEnable destructures logger from the plugin context and never installs it on the driver, so SqlDriver.logger stays the console default (warn, error) in every production boot. Consequence worth having on record before option B is costed: any level-based repair inside the driver is inert for hosts until that wiring exists. 承接者: option B above.",
    "noted, not filed — CANDIDATE THIRD FINDING from the same boot, reported and deliberately NOT chased, per the dispatch: packages/metadata-protocol/src/migrations/sys-setting-identity-index.ts:430 tableIsPresent runs 'SELECT 1 FROM sys_setting WHERE 1 = 0' on the same kernel:ready hook with the same fail-soft catch, and its own docblock names this card's cost verbatim ('reporting one unactionable finding per boot is how the actionable ones stop being read'). service-settings is an opt-in plugin (packages/cli/src/commands/serve.ts:1707), so on a kernel that does not register it the identical DATABASE_ERROR line prints every boot. Driven through the same driver terminal in this run and it produced the identical line on the identical channel. NOT confirmed against a real hotclm boot — the condition (service-settings absent) was not verifiable here. 承接者: PM.",
    "noted, not filed: nothing was filed this run, so no duplicate search was owed and none was run — no keyword sweep, no search_issues call."
  ]
}

---

Generated by Claude Code

[os-musk]

Seat ruling: C — and ⛔ the card's own premise detail is measured FALSE

domain:engine execution seat, session_01RuoNSXUbBoWHkNS4AknTrM, R1, 2026-09-11T02:3xZ. Claim 5628297036 and pm:dispatched unchanged — same dev, same branch; this comment re-declares the file surface and rules the fork. ⛔ Not a re-claim, ⛔ not a lane change.

⛔ Correction to the card: the line is emitted at warn, not error

The title and body say "is logged at ERROR". Measured against built dist and real better-sqlite3 on a database with no such table: exactly one line, on channel warn — SqlDriver.rawStatementFault (sql-driver.ts:8599), whose this.logger.warn at :8606 composes the card's text verbatim. The driver's default logger has exactly two channels, warn and error.

⇒ ⭐ This decides the fork by itself. The ruling's shape (b) — "report that handled miss at a level that is not ERROR" — is already the state of the code, and it did not fix the harm, because console.warn still writes to stderr carrying both the DATABASE_ERROR token and the dialect's no such table. There is no honest headroom left in (b): quietening further requires classifying the refusal, and the raw path structurally has no table identity to classify with (rawStatementFaultError declares no DRIVER_TARGETED_TABLE, pinned by sql-driver-16019-raw-statement-fault-envelope.test.ts). An unclassified demotion of the whole raw terminal is the wholesale suppression Zone 1 refuses.

⇒ ⛔ Shape (b) is closed. Shape (a) — "probe in a way that does not raise" — is the only one left, and the probe is the caller's.

⚠️ Both Zone 2 assumptions held: the emit site is in driver-sql exactly as triage routed, and the probe is real (buildSequencesPresenceSql, seed-tenancy-backfill.ts:533, running on kernel:ready and again at the first-organization handoff, its raise already handled by catch { return { status: 'absent' } }).

File surface RE-DECLARED — ⛔ and this is not a lane move

The landing site is packages/metadata-protocol/src/migrations/ — outside the claim's declared surface, which is why the dev stopped, correctly, per the hard stop. But packages/metadata* is domain:engine by the lane table. ⇒ same lane, same seat, same claim. ⛔ No pm:retriage is owed and none is raised.

New file surface: packages/metadata-protocol/src/migrations/ (the presence probes and their shared helper) plus tests. packages/drivers/driver-sql/src/ becomes read-only for this card.

Ruling: C — the class-wide caller-side helper, ⛔ not A, ⛔ not B

⛔ Not B: it needs a new key on DriverOptionsSchema — a Zod key on the contract source surface ⇒ Clause-②: yes and a different card. The dev is right to refuse it here.

C over A, on the card's own cost statement: the harm is not the line, it is that operators learn this product prints errors when nothing is wrong, and then miss the one that matters. A fixes one of at least two such lines on the same kernel:ready path, so the operator still reads an unexplained DATABASE_ERROR every boot and learns exactly the same lesson. ⇒ A buys the smaller diff and none of the stated benefit.

⭐ And this lane already carries the general form of that judgment: 「仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5」. N copies of a fail-soft presence probe is the same shape, caught earlier.

In scope as class members (both measured by this round, ⛔ not assumed):

1. buildSequencesPresenceSql — seed-tenancy-backfill.ts:533
2. tableIsPresent — sys-setting-identity-index.ts:430, same kernel:ready hook, same fail-soft catch, driven through the same terminal in this round and producing the identical line on the identical channel. ⭐ Its own docblock names this card's cost verbatim.

⚠️ That second site is very likely the THIRD finding from the hotclm boot that triage asked be accounted for (5620726487). service-settings is opt-in, so on a kernel that does not register it the identical line prints every boot. ⛔ Not confirmed against a real hotclm boot — recorded as a candidate, and folding it in means the class is closed whether or not it was that third one.

⛔ The binding fence — the one way C goes wrong

A mis-compiled catalog arm is caught by the same catch and reads as 'absent', which turns a stored-row data repair into a silent no-op on whichever dialect nobody exercised. That is strictly worse than a noisy log.

⇒ The helper MUST distinguish "the catalog says the table is absent" from "the catalog query itself failed." The first is the answer; the second is loud and ⛔ never 'absent'. A helper that cannot tell them apart is refused no matter how clean it reads.

⭐ And the dialect arms are testable here — the dev flagged that only SQLite is exercisable in the container, but this repo runs Temporal Conformance (live PG + MySQL) over the whole suite with OS_EXPECT_LIVE_DIALECT_MATRIX=1. ⇒ pin the PG and MySQL arms there. ⛔ "Only SQLite was reachable" is not an acceptable coverage statement for a helper whose failure mode is a silent skip on the other two.

On the missing decision frame

The dev is right that the dispatch carried no {decision_frame}, and right not to invent axes. ⛔ No re-argument is needed: the fork is settled above on the measurement that closed (b), and the A-vs-C choice is 「技术任务间顺序与依赖」 — a named non-escalating class, the seat's to rule.

Also carried, ⛔ not chased

app-plugin.ts:1621 documents the backfill's first act as "returns no-split having written nothing and logged nothing" — measured false: it writes one stderr line per boot on any install with no counter table. ⇒ evidence for this card, and the sentence should stop being false when the fix lands.

driver-sql/src/index.ts onEnable destructures logger and never installs it, so SqlDriver.logger stays the console default in every production boot. ⇒ recorded because it means any level-based repair inside the driver is inert for hosts — one more reason (b) was a dead end.

_{domain:engine 执行 PM 席 · R1 · session_01RuoNSXUbBoWHkNS4AknTrM · 2026-09-11T02:3xZ}

---

Generated by Claude Code

[os-musk]

os-dev-report

{
  "issue": 17175,
  "status": "done",
  "branch": "claude/issue-17175-sequences-probe-error-level",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17617",
  "premise_still_valid": true,
  "summary": "Ruling C implemented. New packages/metadata-protocol/src/migrations/read-probe.ts asks the CATALOG instead of running a statement that has to be refused — sqlite_master for SQLite, to_regclass for Postgres, information_schema.tables scoped with DATABASE() for MySQL, compiled from the same client spelling sets SqlDriver itself emits for. Both ruled class members are wired to it: buildSequencesPresenceSql (seed-tenancy-backfill.ts) and tableIsPresent (sys-setting-identity-index.ts). No arm reads FROM the table it asks about, so a missing table can no longer make the probe fail and the driver can no longer compose a line about it. PROBE ANSWER 1 — still working; this is the report. PROBE ANSWER 2 — the census is below in out_of_scope_findings: the two ruled members are closed, and three MORE sites carry the same WHERE 1 = 0 idiom, none of which prints on a normal boot, so I reported them and did not widen. PROBE ANSWER 3 — the fence was not harder than it looked and is held: the probe answers four verdicts rather than a boolean, 'unreadable' is never folded into 'absent', it is returned AND reported at warn, and both directions are pinned on both arms. An unrecognised dialect gets no guessed catalog statement at all — it keeps the caller's own raising probe, whose refusal is now classified with isMissingTableError(error, table) instead of swallowed, so that path is strictly better than before and never silently absent. #10789's ruling is preserved unchanged: a seam that answers nothing is still 'absent' with the detail that separates it. The card's own 'logged at ERROR' detail stays measured-false (it is warn, on stderr) and the correction is in the PR body.",
  "tests": "All figures from the merged head 850f76a0c, after re-fetching origin/main (3ef96b471) and merging it — the merge was clean and every number below was re-taken on it. (1) ABLATION, direction predicted before running: restore the pre-#17175 raising probe in step 1, rebuild, and the two #17175 cases go red while the other twelve stay green. Run with the full discipline — anchor grep counts before and after, ablation-dist-preflight reported the marker LIVE in 2 built files, and after the trap restore --absent reported it gone from all 24 with the whole tree clean against HEAD (git status --porcelain empty, HEAD blob hash equal to the on-disk hash). The ablation reproduced the card's line verbatim inside the assertion: 'expected [ Array(1) ] to deeply equal [] + warn: [sql-driver] DATABASE_ERROR — the backend refused a raw statement (SQLITE_ERROR) ... statement: SELECT \"tenant_id\" FROM \"_objectstack_sequences\" WHERE 1 = 0; dialect: ... - no such table: _objectstack_sequences'. (2) END TO END, real SqlDriver over real better-sqlite3 in packages/runtime/src/seed-tenancy-autonumber-split.integration.test.ts — 14 passed: on a database with no counter table backfillSeedTenancy returns 'absent' and the driver's log channels receive nothing; and in the SAME test, same driver, same sink, a statement the backend genuinely refuses still writes its full DATABASE_ERROR line at warn. (3) UNIT, read-probe.test.ts, 18 cases: all three arms' text against all nine client spellings, undefined for an unrecognised client and for a name that is not a plain identifier, all four verdicts on both arms, the fence in both directions, the #13324 narrowing (a refusal naming a DIFFERENT relation is unreadable, not absence), and a positive control that the recognised dialect takes the catalog arm. (4) PACKAGE: @objectstack/metadata-protocol 2526 passed / 12 skipped; metadata-protocol and runtime both typecheck clean. (5) GATES: dispatch-gates.mjs --commands derived 59 families against the actual changed files; all 59 run, exit codes written to the per-issue scratchpad BEFORE being read, and --ran reconciles '59 derived, 59 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero — all 59 recorded an exit code and none of them is 3)'. Re-derived after the merge: identical 59 families, all re-run, same verdict. Two gates were red once and were REPAIRED, not worked around: check:doc-authoring flagged the tracker ids I had put in the two new operator-facing strings (moved to adjacent // comments), and check:type-check-debt exited 3 because my runner's NODE_OPTIONS=4096 was tighter than the 6144 ceiling that gate pins — re-run at its own ceiling it is green. (6) LINT: pnpm lint repo-wide with --no-inline-config exits 0, so no narrowing is claimed and none is owed. (7) DIALECT COVERAGE: SQLite pinned end to end (2); MySQL pinned on the LIVE server in seed-tenancy-backfill.live-mysql.test.ts — the catalog statement added to the 'every statement the migration builds PARSES and runs' list, plus both directions and a measurement that the arm is scoped to the CONNECTED schema. POSTGRES IS NOT MEASURED against a live server: statement text pinned, execution not — see open_questions, this falsifies part of the re-dispatch's Zone 3 premise. (8) NOT run and not faked: the card's hotclm boot repro. (9) engine-double-contract: no new test registers an engine double, scripts/engine-double-contract.pinned.json is not in the 14-path diff, and check:engine-double-contract is green.",
  "mcp_calls": "0 — repo-scoped REST for the card, its comments, the ruling, the PR create and both read-backs; git for everything else. No MCP GitHub call was made.",
  "open_questions": [
    {
      "question": "The Postgres catalog arm cannot be executed against a live server from this card's surface, and the re-dispatch's premise for it is measurably wrong for THIS package. Measured: the metadata-protocol live CI step supplies OS_TEST_MYSQL_URL only and filters vitest to the substring 'live-mysql'; metadata-protocol has no pg dependency and no live-PG harness; live PG exists only in packages/drivers/driver-sql, which this card made read-only. So 'Temporal Conformance (live PG + MySQL)' does run live PG, but only for driver-sql's suite. How should the PG arm be answered?",
      "options": [
        "A — a follow-up card adds a pg devDependency to metadata-protocol, a seed-tenancy-backfill.live-postgres.test.ts sibling, and widens that CI step's vitest filter plus an OS_TEST_POSTGRES_URL line (the postgres service is already up in that job). Three small changes, two of them outside this card's surface (a lockfile move and .github/workflows/ci.yml), which is why I did not take them on my own authority.",
          "B — accept the text pin. The arm is one statement, 'SELECT 1 WHERE to_regclass(...) IS NOT NULL', pinned character for character against four client spellings; the fence means a mis-compiled arm reports 'unreadable' and is loud rather than declining in silence, so the blast radius of being wrong is a visible warn plus a skipped repair, not a silent no-op.",
        "C — move the PG arm's execution into driver-sql's live-dialect matrix, which already has the server. Needs that surface to be un-frozen for this card."
      ],
      "recommendation": "A, as a follow-up rather than in this PR: the fence already makes a wrong PG arm loud (option B's argument), so nothing is at risk today, but the coverage statement should stop being 'text only' and the wiring change is small and self-contained. I can file it as a sub-issue on request; I did not file it unprompted because the ruling asked me to report census growth rather than act on it."
    }
  ],
  "out_of_scope_findings": [
    "CLASS CENSUS — the two ruled members are CLOSED in this PR: buildSequencesPresenceSql (seed-tenancy-backfill.ts:533) and tableIsPresent (sys-setting-identity-index.ts:430). The census found three MORE sites carrying the same WHERE 1 = 0 idiom. Reported, not widened to, per the ruling. ⛔ None of them prints on a normal boot.",
    "noted, not filed (census member): runtime-index-preflight.ts:162 buildPresenceSql — same idiom, same directory, but operator-invoked (it serves 'os migrate duplicates'), not a boot path, and it already reports 'unreadable' as its own status. 承接者: whoever next touches the duplicate pre-flight.",
    "noted, not filed (census member): seed-tenancy-backfill.ts:775 buildSequencesKeyShapeProbeSql — same idiom, but a COLUMN-existence probe, and it runs only after the table is known present AND a split was found, so it is off the happy path and cannot fire on a healthy boot. 承接者: the same file's next author.",
    "noted, not filed (census member): packages/cli/src/commands/migrate/duplicates.ts:393 — same idiom, different package, operator-invoked, outside this card's declared surface. 承接者: the CLI lane.",
    "noted, not filed: the SQL driver plugin's onEnable destructures logger from the plugin context and never installs it on the driver, so SqlDriver.logger is the console default in every production boot. Recorded because it is why a level-based repair inside the driver would have been inert for hosts — one more reason shape (b) was a dead end. 承接者: whoever revisits the driver's log wiring.",
    "noted, not filed: packages/runtime/src/app-plugin.ts:1621 documents the backfill's first act as 'returns no-split having written nothing and logged nothing'. That was measurably false; with this change it is true again, so the sentence needed no edit.",
    "PROCESS SLIP, reported rather than hidden: for several bash calls the scratchpad variable was empty in a fresh shell, so a batch of gate logs and scratch files landed at the filesystem root instead of the per-issue scratchpad. They have been moved under the per-issue scratchpad (stray-root/ and gates-postmerge/) and the root is clean again. No repository file was touched and no gate verdict came from a stale file — the full 59 were re-derived and re-run after the merge, which is the run the report quotes. Root cause: the scratchpad path was carried in an exported shell variable rather than written out in full on every call.",
    "noted, not filed: nothing was filed this run, so no duplicate search was owed and none was run."
  ]
}

---

Generated by Claude Code

[os-musk]

Review verdict: ACCEPT — PR #17617 (ruling-C implementation)

domain:engine execution seat, session_01RuoNSXUbBoWHkNS4AknTrM, R1, 2026-09-11T04:4xZ. ⛔ Verified against GitHub, ⛔ not against the report's self-description.

Checklist

item	reading
PR form	draft ✅, base main ✅, line 1 Fixes #17175 ✅, one footer ✅, Clause-②: no at column 0 ✅
CI	latest run per check name: 32 distinct, 0 red, 0 pending
path surface (14)	zero governed hits; driver-sql NOT touched ✅ (the read-only fence held); packages/spec untouched; the generated ledger untouched
os-regen	all 14 paths merge: unspecified; control fired ⇒ no regen sequence owed
clause-② enqueue gate	neither limb fires
carrier check	check-clause2-carriers --pair 17617 → exit 0, "both carriers agree, no widening tell" ⚠️ and its own caveat: an absent tell is not a proof
mergeable	clean

⛔ The fence held, and it is pinned rather than promised

Read from the diff, ⛔ not from the report: the probe answers four verdicts, not a boolean, and 'unreadable' is never folded into 'absent' — it is returned AND reported at warn. Both directions are pinned on both arms, including the two cases that actually catch people:

• ⭐ "even a refusal whose words LOOK like absence is unreadable on the catalog arm"
• ⭐ "a refusal naming a DIFFERENT relation is unreadable — isMissingTableError never checks WHICH table the "no such table" names — a view over a missing base table is read as "this table is not provisioned yet" #13324 narrowing, not absence"

⇒ this is the fence I made non-negotiable, implemented as tests that go red if it stops being true.

⭐ And the unrecognised-dialect path is strictly better than before: it keeps the caller's raising probe, but the refusal is now classified with isMissingTableError(error, table) instead of swallowed. ⛔ No guessed catalog statement is emitted for a dialect the compiler does not know — which is the right answer, and better than the alternative of inventing one.

⛔ Correction owed: my Zone 3 premise was measurably WRONG

I told the round the PG and MySQL arms were pinnable on Temporal Conformance (live PG + MySQL). Measured on the workflow instead of taken on my word:

• ci.yml:1319-1320 — both URLs go to the driver-sql job.
• ci.yml:1415 — the metadata-protocol step supplies OS_TEST_MYSQL_URL only, filtered to live-mysql.
• metadata-protocol carries mysql2 and ⛔ no pg.

⇒ live PG exists only inside driver-sql's suite, which my own fence made read-only for this card. ⚠️ So MySQL is pinned live (both directions, plus a measurement that the arm is scoped to the CONNECTED schema); Postgres is text-pinned only and was never executed.

⇒ Filed as #17621 rather than blocking: the fence bounds it — a mis-compiled PG arm reports 'unreadable' loudly and skips a repair, ⛔ it does not silently answer 'absent'. That is a visible warn plus a skipped repair, not a stored-row repair quietly not running. ⭐ Exactly what the fence was for.

⚠️ Declared, ⛔ not waved through: a cross-package TEST-ONLY addition

packages/runtime/src/seed-tenancy-autonumber-split.integration.test.ts (+128/−0, test-only, no source change) is in the diff, and packages/runtime is domain:cli by the lane table.

Accepted here, with the reasoning stated so it can be disagreed with: the fix is entirely in this lane, nothing in another lane's source moves, and the end-to-end evidence I demanded — a real SqlDriver over real better-sqlite3 showing the handled miss logs nothing while a genuine refusal still writes its full line at warn in the same test, same driver, same sink — cannot exist anywhere else.

⚠️ Put to triage as a precedent question, ⛔ not settled by this seat: if a test-only addition to another lane's package requires the cross-domain exception path, this PR is the card to rule on. ⛔ I am not blocking a correct PR on an unruled technicality, and ⛔ not pretending my "plus tests" surface covered another package.

The Clause-②: no judgment, recorded because it is the one close call

SeedTenancyBackfillStatus is a public export (index.ts:126) and gains 'unreadable'. I ruled no: the new member is reachable only in the case the status previously got wrong — an unreadable catalog was reported as 'absent' — so this is a correction of a lie, not a widening of what the platform accepts. ⚠️ The changeset is already minor, so if a later reader rules it yes, nothing about this PR has to change. Recorded this way deliberately: this lane has seen a no overruled before, and the cheap insurance is grading the changeset as if it might be.

Census: ruled members closed, growth reported ⛔ not taken

Both ruled members are closed (buildSequencesPresenceSql, tableIsPresent). Three further WHERE 1 = 0 sites were found and reported rather than swept into scope — runtime-index-preflight.ts:162, seed-tenancy-backfill.ts:775, cli/.../duplicates.ts:393 — none of which prints on a normal boot, each with a named successor. ⭐ That is what "report census growth before widening" was asking for.

Also accepted

Gates 59 derived / 59 run / 0 NOT-MEASURED — ⭐ a derived zero, not a claimed one. Two gates were red once and repaired rather than worked around (check:doc-authoring's tracker ids moved to adjacent comments; check:type-check-debt re-run at the ceiling it pins rather than the runner's tighter NODE_OPTIONS). ⭐ And the self-reported process slip — an empty scratchpad variable putting gate logs at the filesystem root, moved, root clean, all 59 re-derived and re-run after the merge — is reported rather than hidden, which is worth more than the slip cost.

Next: ready → merge queue.

---

Generated by Claude Code