Repository navigation
driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist #24961
Description
① class a, reach measured through a public door. Filed by the domain:services PM seat, seat 1 (seat post #6021, session_011TdZ8GjixNZFLz1xJD9zzK), from #24950's dev report (os-dev-report on #24950, out-of-scope finding 2). Unlabelled and ungraded for triage.
Reader, and what they do: the domain:engine seat (packages/drivers/driver-sql) claims it and dispatches one PR. The CLI caller is domain:cli's, and nothing there is expected to change.
reach: bin/run-dev.js migrate plan, measured on #24950's branch head 05e9a8e09a (unchanged by PR #24955). An object is bound to an archive datasource (driver: sqlite) on a path under a regular file:
datasource 'archive': connected;Planned 1 declared datasource(s) … archive (…/plain/archive.db) — connected under the declared name;+ os24950_note [create_table, 8 column(s)], exit 0.
The same boot with --apply is now refused (PR #24955), so the plan proposes DDL into a file that cannot exist.
The finding
- Mechanism. The read-only boot (
readOnlyProbe→sqliteAbsentFile: 'empty-in-memory') is used byos migrate planand by the dry runs such asos migrate audit-mail-bodieswithout--apply. It asksdriver-sql'sresolveSqliteAbsentFileTarget, which usesexistsSync(path). That isfalsefor an unopenable path, so the probe opens an empty in-memory SQLite, and no probe failure ever happens. - Expected: an absent file whose directory cannot be made or opened is not "absent". The read-only boot reports that datasource as failed, naming the file, as the apply boot now does.
- Scope notes.
- By code reading this is independent of
NODE_ENV; the production entry is NOT MEASURED. - It is probably also the dry-run half of fix(cli,service-datasource): under bin/run-dev.js (NODE_ENV=development) an unopenable SQLite datasource steps down to an in-memory engine, so a dev-mode os migrate audit-mail-bodies reports an unreachable archive as examined and clean #24950's own
audit-mail-bodiespath; NOT MEASURED, because that command's archive examination exists only on PR feat(cli,plugin-audit): os migrate audit-mail-bodies masks the archive datasource too #24934, still unmerged.
- By code reading this is independent of
Dedupe: query run by this seat, hit count including closed
-
read-only probe sqlite absent file empty in-memory unopenable path migrate plan connected create_table→ 30 hits. The nearest:- cli: the ownership ceremony's plan arm says "The plan below writes nothing" and "nothing in the database was changed", but its first connect converts a rollback-journal SQLite file to WAL (header bytes and change counter move) #23562, cli: read-only arms still say they wrote nothing on a SQLite file whose journal mode their connect switches (security-catalog-overlays preview, recorded-by, resume, secret orphans / rewrap, storage orphans) — the remainder of #23562 #23622, read-only arms, the remainder of #23622: three more sentences still say nothing was written on a SQLite file whose journal mode the connect switches (
os storage orphans,os secret rewrapdry-run note,os migrate summary-nulls) #23726, read-only arms, the remainder of #23726: four more sentences say "nothing was written" / "writes nothing" on a SQLite file whose journal mode the connect switches (os migrate plan×2,summary-nullsrefusal,secret rewrapresumable note) #23899: the read-only arms' "wrote nothing" sentences, closed; - driver-sql: connect() always runs PRAGMA auto_vacuum = INCREMENTAL, so read-only probes (os migrate duplicates) bump the SQLite header — the "no-op" docblock and "writes nothing at all" doc are untrue #21734:
connect()bumping the header on read-only probes, closed; - migrate family: measure whether a read-only arm (
os migrate organization-ownershipwithout--apply, and every sibling dry run) booting beside a SQLite holder can remove-wal/-shm; #23400's lost write is not attributed to the plan or the apply run #23552, os migrate organization-ownership has no SQLite occupancy gate: run beside a process holding the file open, a later write by that process was lost (WAL and SHM deleted under it) #23400: SQLite occupancy, closed.
None covers an unopenable path read as absent. New.
- cli: the ownership ceremony's plan arm says "The plan below writes nothing" and "nothing in the database was changed", but its first connect converts a rollback-journal SQLite file to WAL (header bytes and change counter move) #23562, cli: read-only arms still say they wrote nothing on a SQLite file whose journal mode their connect switches (security-catalog-overlays preview, recorded-by, resume, secret orphans / rewrap, storage orphans) — the remainder of #23562 #23622, read-only arms, the remainder of #23622: three more sentences still say nothing was written on a SQLite file whose journal mode the connect switches (
Dedupe words: read-only probe unopenable sqlite connected · sqliteAbsentFile empty-in-memory path under regular file · resolveSqliteAbsentFileTarget existsSync.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 20, 2026
Claim: PM loop round 1 · 2026-10-20T22:56Z · p2,
domain:engine(triage's grade).resolveSqliteAbsentFileTargetreads an unopenable SQLite path as absent (existsSync), so the read-only boot opens an empty in-memory database, reports the datasource connected, andos migrate planplans DDL into a file that cannot exist.Session:
session_01QK6pdbxKZiHdFApL8RYVh9(the dispatching seat; the dev is amode:subagentrun of this session, told apart by its branch)Account:
os-support-ai(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24961-readonly-probe-unopenable-pathWorktree:
objectstack-issue-24961Domain:
domain:engineSeat:
domain:engine#2(seat post #20966)File surface:
packages/drivers/driver-sql/src/sql-driver.ts,resolveSqliteAbsentFileTargetand itsknexConfigForcaller only: an absent file whose directory cannot be made or opened is not "absent", and the read-only boot reports that datasource failed, naming the file, as the apply boot now does.packages/services/service-datasource/src/sqlite-driver-fallback.ts, its read-only branch only, by the same cross-lane declaration as driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected #24960.os migrate planon a path under a regular file reports the datasource failed and plans nothing into it; an absent file in a directory that can be made still opens empty in memory and writes nothing.patchchangeset for@objectstack/driver-sql(and@objectstack/service-datasourceif touched).⛔ Not in scope: the
SQLITE_NOTADBconnect (#24960, a sibling claim of this seat);audit-mail-bodies' own arm (PR #24934 is unmerged); any spec key.Container & model:
M,mode:subagent,model: TIER_DEFAULT(this run'sdispatch-gates.mjs --tier: "no path-derived mandate")Clause-②: no (narrowing) (a read-only boot that answered connected on an unopenable path reports it failed; it owes a
CONTRACT_REVIEW_TIERreview on the narrowing face before the queue)Responsibility:
driver-sql's absent-file judgement answers "absent" for a path that cannot exist | none: PR #24955 covers the apply boot only |os migrate planand the read-only dry runs on any declared SQLite datasource whose path cannot be openedThread-read: none
Serial constraints cleared: open PRs' file lists were read at this claim. PR #24893 and PR #24940 (
os-steve, the #24583 epic) touchsql-driver.tsin other regions; neither touchesresolveSqliteAbsentFileTarget,knexConfigFororsqlite-driver-fallback.ts. #24960 (this seat) touchesapplyAutoVacuumIncrementalandisSqliteFileOpenFailure; whichever lands second mergesmain.Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
os-dev-report
{ "issue": 24961, "status": "done", "branch": "claude/issue-24961-readonly-probe-unopenable-path", "pr": "https://github.com/objectstack-ai/objectstack/pull/25007", "session": "session_01QK6pdbxKZiHdFApL8RYVh9. This is the parent's id (a mode:subagent run), the same id claim 6303642231 names. The claim's newest Claim: line named this branch before the first edit.", "premise_still_valid": true, "summary": "The premise holds on base 4b8f597ba (a descendant of e4d604efd). resolveSqliteAbsentFileTarget answered ':memory:' whenever existsSync was false. At the public door, bin/run-dev.js migrate plan over a declared archive datasource under a regular file printed \"datasource 'archive': connected\", \"Planned 1 declared datasource(s) … connected under the declared name\" and \"+ os24961_note [create_table, 8 column(s)]\", and exited 0. The fix, in driver-sql: the judgement now asks the operating system without writing anything. The new module-private probeAbsentSqliteDatabaseFile in sqlite-database-file.ts, beside makeDatabaseDirectory, does this. If stat(file) answers anything but ENOENT, the file cannot exist (ENOTDIR, EACCES, ELOOP). If it answers ENOENT, the probe walks up to the nearest existing level: a dangling symlink there is refused; otherwise access(W_OK|X_OK) must pass, and EACCES or EROFS is refused. A refused path throws SqliteDatabaseFileError naming the file and the system's code. H2: the refusal surfaces from the resolver, so from the SqlDriver constructor. On the service path it surfaces earlier, from sqlite-driver-fallback.ts's wasm-filename line, before any rung is built. Either way factory.create rejects, and DatasourceConnectionService.handleFailure records the datasource failed under its declared name. At the door this is now \"datasource 'archive': connect failed — SQLite database file '…/plain/archive.db' cannot be opened or created: ENOTDIR … fail-fast per ADR-0062 D5\", exit 1, nothing planned, listing unchanged. H3: both callers of the exported resolver get the same answer. The native rung, the wasm rung and production (dev:false) all reject with ENOTDIR, and no line of sqlite-driver-fallback.ts changed. Also in knexConfigFor, on the claimed surface: the judgement is asked for SQLite clients only. Measured on base: a pg driver given the option with a connection string had that string rewritten to ':memory:', against the documented \"ignored for non-SQLite dialects\". Boundary, in the PR's Acceptance notes: /proc/MISSING as root still reads absent, because access() passes and only a mkdir would say no, and the no-write promise rules that out.", "tests": "H1 codes, measured with a deleted probe script as root and as uid 65534 via setpriv. Under a regular file: stat ENOTDIR at both depths. A 0700 dir that is not ours: stat EACCES. A 0555 dir: stat ENOENT, access EACCES (65534), ok (root). /proc/os-24961: access ok as root, EACCES as 65534. A ro mount (/opt/claude-code): EROFS for both. Creatable: ENOENT with access ok. Door: bin/run-dev.js migrate plan --database-url file:main.db, with driver-sql dist built from base and then from 3370501f9. The before/after table is in the PR body. The listing was unchanged on every run. Full suites at 02302719e. pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2: 'Test Files 225 passed | 12 skipped (237)', 'Tests 3698 passed | 210 skipped (3908)'. pnpm --filter @objectstack/service-datasource exec vitest run --maxWorkers=2: 'Test Files 51 passed (51)', 'Tests 916 passed (916)'. On the merge head 28d5dd67e: the driver-sql pin file gave 'Tests 15 passed | 1 skipped (16)'. The skip is the EACCES case, skipIf superuser. This container is root, so that case was measured on dist as uid 65534 (EACCES at both depths), and CI's non-root runner runs it. The three service-datasource fallback files gave 'Tests 28 passed (28)'. Typecheck: driver-sql tsc --noEmit exit 0, and --listFiles includes the edited test file. service-datasource tsc --noEmit failed once at 02302719e (TS2339 .then on create()'s union, in the new pin), was fixed in 7c66e98f6, and is exit 0 there and on 28d5dd67e. Ablation, through scripts/ablation-replace.mjs WRAP with a trap restore. Leg 1, the judgement reverted to existsSync semantics: marker ABLATION_24961, anchor 1 to 0, blob fbde48ea8f70 to fb3ea19400da, rebuild, ablation-dist-preflight marker in 2 built files. Predicted equal to observed: driver-sql '3 failed | 12 passed | 1 skipped', service-datasource '6 failed | 22 passed'. Restore: blob == HEAD, git diff HEAD empty, rebuild, preflight --absent 0 of 6 built files, tree clean. The first leg-1 attempt was refused by the tool before anything ran (its anchor sat inside its replacement), so it was a no-op; the anchor was changed and the leg re-run. Leg 2, the isSqlite gate removed: src-relative, so no dist step. Predicted equal to observed '1 failed | 14 passed | 1 skipped' (the pg-string pin). Restore proven the same way. Builds: the base closure 60/60; after the merge, pnpm install --frozen-lockfile and the cli closure 61/61; full turbo build (minus docs) 76/76 for dual-build-cjs-loads.", "gates": "Local subset at merge head 28d5dd67e. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths; stderr names objectstack-ai/objectstack at 28d5dd67e; 72 commands. The PM's list at e4d604efd had 55; the 17 extra come from the changeset and the new service test. All 72 ran sequentially, exit codes captured before any pipe. First pass: 70 x exit 0, 2 x exit 3. node scripts/check-plugin-teardown-shape.mjs --self-test failed because its positive-control commit 621a48760788 was outside the shallow clone: it was fetched --depth=1 into an own ref (since deleted), and the re-run exited 0 with 48 cases. pnpm check:dual-build-cjs-loads failed because 10 packages had no dist: after the full build, the re-run exited 0. --ran over the first record: 'Run reconciliation — 72 derived, 70 run, 2 NOT-MEASURED, 0 UNRUN'. Over the final record: 'Run reconciliation — 72 derived, 72 run, 0 NOT-MEASURED, 0 UNRUN', '✓ dispatch-gates --ran: 72 derived famil(ies) accounted for', RAN_EXIT 0. Driver ledger, pnpm check:driver-conformance. Before, at 4b8f597ba: '55 covered cell(s), 0 in the DEBT ledger, 0 exempt', dialect axis 9 suites, 11 of 11 matrix-routed. After, at 28d5dd67e: identical, exit 0. The ledger did not move. Also: pnpm --filter @objectstack/spec check:generated after the merge (spec moved on main's side): 'All 14 generated artifacts are up to date', exit 0. check-platform-checklist: not owed, no exported symbol renamed or deleted. test:repo: not run locally, because no repo-project test was touched and the derivation does not name it; declared to CI (Test Core). check:dev-prereqs and skill-frame-freshness: not owed, packages/spec is not touched. PR #25007 check-runs on 28d5dd67e, read once at report time and not awaited. success (2): Check Documentation Links; No other open PR may claim the same issue. skipped (2): 18.x upgrade harness (opt-in); Packed-tarball smoke (opt-in). in_progress (20): Check Changeset; Check PR Size; Flag docs affected by code changes; Governed Surface Queue Guard; Lint · CI, release & engine gates; Lint · ESLint; Lint · PM dispatch-gates; Lint · docs & code guards; Lint · repo & tooling gates; Lint · scoped · query-options erasure; Lint · scoped · slot lookup & corpus; Lint · scoped · tooling self-tests; No other open PR may claim the same single-writer path; Part-of PR must not also close its card; The card this PR closes must claim this branch; Type Check · consumer gates; Type Check · debt ledger; Type Check · source gates; Type Check · workspace; filter. Test Core and Build Core were not yet listed. NOT MEASURED: every CI family's conclusion; reason: in_progress at report time.", "mcp_calls": "0 — no MCP GitHub tool was called.", "api_writes": "2 — two fleet-write relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches (scripts/pm/fleet-write/dispatch.mjs). Stroke 1 = pr_create (request fw-20261021T000257Z-d39f48, run 39518888868 success): POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos/objectstack-ai/objectstack/issues/25007/assignees (os-support-ai); body read back identical, 18100 bytes. Stroke 2 = this report: POST /repos/objectstack-ai/objectstack/issues/24961/comments. Zero label writes: none was named, and a changeset is present. git push is not counted. Reads: REST GETs of issue 24961 and its comments, the comments on #24950, PR 25007, and the check-runs on 28d5dd67e.", "open_questions": [], "out_of_scope_findings": [ "class: a · reach: bin/run-dev.js migrate apply --yes, measured on base 4b8f597ba. A declared archive (driver sqlite) whose directory is a dangling symlink, with one object bound to it, prints \"datasource 'archive': connected\", then the false step-down warning \"native better-sqlite3 unavailable (ABI mismatch or not built) — dev using wasm SQLite\", and exits 1 later. · evidence: driver-sql makeDatabaseDirectory accepts mkdir's EEXIST on the dangling link as a concurrent creator. better-sqlite3 then throws the code-less TypeError 'Cannot open database because the directory does not exist'. applyAutoVacuumIncremental logs 'Failed to set PRAGMA auto_vacuum=INCREMENTAL' and connect() resolves. resolveSqliteDriver's probe SELECT 1 then fails DATABASE_ERROR, which isSqliteFileOpenFailure does not classify, so it steps down to wasm. The runtime host refuses this shape for the primary (standalone-stack-uncreatable-db-directory.test.ts, the #24090 case); the driver path for declared datasources does not. The read-only boot now refuses it (this PR). · family: SQLite connect-refusal classification, with #24960 (SQLITE_NOTADB) and #24950. For the seat to fold into that family's closing card rather than file singly. · dedupe words: `dangling symlink sqlite directory makeDatabaseDirectory EEXIST` · `Cannot open database because the directory does not exist connected wasm` · `declared datasource dangling link apply connected` · `isSqliteFileOpenFailure code-less TypeError`", "carrier: 承接者:无 · noted in PR #25007 Acceptance notes, not filed. The read-only judgement cannot see a level whose access() passes while its mkdir fails (/proc/MISSING as root). The no-write promise of 'empty-in-memory' rules out finding out by trying, so that path still reads absent read-only, while the writing boot refuses it." ], "files_changed": [ "packages/drivers/driver-sql/src/sql-driver.ts (+35/-5: resolveSqliteAbsentFileTarget asks the probe; knexConfigFor asks for SQLite clients only; SqliteAbsentFileMode and resolver docs; unused existsSync import dropped)", "packages/drivers/driver-sql/src/sqlite-database-file.ts (+81/-0: module-private probeAbsentSqliteDatabaseFile, the read-only twin of makeDatabaseDirectory; the SqliteDatabaseFileError doc block is untouched, so the file has no conflict with #24960)", "packages/drivers/driver-sql/src/sql-driver-sqlite-absent-file.test.ts (+146/-1: the unopenable-path describe block, plus the pg-string assertion)", "packages/services/service-datasource/src/__tests__/sqlite-driver-fallback-readonly-unopenable.test.ts (new, +203: 8 cases; test only, outside files[]; cross-lane for domain:services, which the seat declares)", ".changeset/24961-readonly-probe-unopenable-path.md (new: @objectstack/driver-sql patch; Clause-②: no (narrowing); BREAKING banner; FROM/TO; ADR-0087 not-required (no-migration-prescription))" ], "line_budget": "n/a — no skills/** file and no ratcheted line ledger touched. The diff is 483 added / 6 removed lines against merged main 4fe3af9d7.", "deviations": [ "Placement. The walk lives in sqlite-database-file.ts, beside makeDatabaseDirectory, not inline in sql-driver.ts. It is the same package, and the file is one of the PM's own gate-derivation paths. resolveSqliteAbsentFileTarget in sql-driver.ts calls it.", "knexConfigFor gained '|| !this.isSqlite'. This fixed in place a pre-existing mis-application measured on base: a pg connection string was rewritten to ':memory:'. It was needed because the judgement now does filesystem work that can throw, so it must not be handed a URL. It sits inside knexConfigFor (claimed surface), is mechanical, and runs through the same gate family. It has its own ablation leg and is named in the PR body.", "Dangling symlink as the directory: the read-only judgement refuses it, under the card's 'directory cannot be made'. The writing boot does not yet refuse it (out_of_scope_findings item 1). So on that one shape, plan now says failed while apply says connected on wasm.", "Ablation leg 1's first attempt was refused by ablation-replace before anything ran (its anchor was contained in its replacement). It was a no-op, and the leg was re-run with a different anchor.", "Two gate families exited 3 on the first pass and were re-run after their prerequisites were met. Both reconciliations are reported. To meet them, the shared .git gained one --depth=1 fetch of commit 621a48760788 into refs/os-24961/teardown-fixture, and #24960's head was fetched into refs/os-24961/sib-24960 for a merge-tree check. Both refs were deleted after use.", "origin/main was merged at 4fe3af9d7 (merge 28d5dd67e) before the PR opened. Two later main commits, fbb42d900 (plugin-auth) and 86d236071 (rest), touch none of this diff's packages and were not merged.", "The full package suites ran at 02302719e. 7c66e98f6 changed only the shape of the new pin (try/await) for tsc, and on the merge head the targeted pins and both typechecks re-ran green.", "Door rows not run on base: plain/sub, and the two absent-and-creatable controls. They are marked as such in the PR body.", "Attribution: commits carry AGENTS.md's model-free trailer pair, and the PR body ends in the session-URL footer. The harness reminder's model-named Co-Authored-By trailer and its two-line PR footer were not used (AGENTS.md precedence). Reported, not imitated.", "Cleanup: the worktree's node_modules was removed, then the worktree itself (git worktree remove, no --force), before this report was posted. /tmp probe directories were removed." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
os-dev-report
{ "issue": 24961, "status": "done", "branch": "claude/issue-24961-readonly-probe-unopenable-path", "pr": "https://github.com/objectstack-ai/objectstack/pull/25007", "session": "session_01QK6pdbxKZiHdFApL8RYVh9 (the parent id of this mode:subagent patch round). Before the first edit: the newest Claim on #24961 is comment 6303642231 and names this branch, and the remote head was still 28d5dd67e.", "premise_still_valid": true, "summary": "Patch round for the seat's review (PR comment 6305259004). Check Changeset was red on 28d5dd67e because the changeset declared Clause-②: no (narrowing) and graded @objectstack/driver-sql patch; the level axis wants a moved package graded minor or above, since a BREAKING change ships minor during the launch window. One commit, 86d0cbfb7, changes the one changeset file by +2/-2: the package line patch becomes minor, and the banner now reads \"**BREAKING** (the read-only boot's accept set narrows), shipped as `minor` under the launch-window convention for breaking changes.\", the wording changesets 24707, 24813 and 24949 on main use. The old tail \"no exported declaration changes\", which justified patch, is gone. No code, no other file. origin/main was not merged: the PR is mergeable and the gate is green without it.", "tests": "No code or test file changed: git diff 28d5dd67e..86d0cbfb7 is 1 file, 2 insertions, 2 deletions, a changeset. Nothing was built and no vitest or tsc run was owed; the code evidence stands in the earlier report on this card (suites at 02302719e, pins and typechecks re-run at 28d5dd67e), and the tree under it is byte-identical. No ablation: no tested behaviour changed. The measurement that matters here is the gate pair in gates: the same gate red on the old head and green on the new.", "gates": "Local subset at 86d0cbfb7. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack .changeset/24961-readonly-probe-unopenable-path.md derived 21 commands; its first stderr line names objectstack-ai/objectstack at 28d5dd67e, the head before my commit, and it says the checkout is at least 6 commits behind origin/main with none of the visible ones touching what it derives from. All 21 ran, exit codes captured before any pipe, all 21 exit 0: check-adr-0087-registration (--base origin/main, and --self-test 548 assertions), check-changeset-no-major (--base origin/main, and --self-test 401 assertions), check-empty-changeset (--base origin/main, and --self-test 170), check-closing-keyword-parity (and --self-test), check-comment-mask-corpus (9728 files, 0 disagree), release-rehearsal-clone --self-test, release-pending-publish --self-test (112 cases), and pnpm check:changeset-gate-self-tests, check:closed-ceremony-text, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:objectui-changeset, check:pm-changeset-deadline-census, check:published-files, check:refd-timer-probe, check:watch-hint-literal. Reconciliation, node scripts/pm/dispatch-gates.mjs --ran over those 21 recorded codes: 'Run reconciliation — 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN', exit 0. THE LEVEL AXIS: CI reads the pull_request payload from its runner. The derived spelling run bare exits 0 but prints 'LEVEL AXIS: NOT APPLICABLE — no pull_request payload was available', so that exit proves nothing about the axis. I built a payload from a GET of pulls/25007 (current body, with its Clause-② line) into the scratchpad and ran node scripts/check-changeset-no-major.mjs --base origin/main --event FILE. On 86d0cbfb7: exit 0, '✓ LEVEL AXIS: this PR declares clause-② `no (narrowing)`, and no package whose published source ... it moves is graded `patch`', 'direction arm: `narrowing` — a BREAKING change; during the launch window it ships `minor`'. Control leg, the same command with --head 28d5dd67e: exit 1, reproducing CI's annotation 'clause-② declares `no (narrowing)` while no moved package is graded `minor` or above', 'Moved and graded `patch`: @objectstack/driver-sql: patch'. So the gate is red on the old head, green on the new, and the only difference is the two edited lines. The ADR-0087 gate on 86d0cbfb7: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition', '[BREAKING+clause-②-narrowing] not-required (no-migration-prescription)'. The empty-changeset gate: '1 declaring changeset(s) added'. CI check-runs on PR #25007, read once right after the push and not awaited. On 86d0cbfb7: 23 runs, 22 queued (Check Changeset; Lint & Repo Gates sub-jobs; Type Check sub-jobs; Governed Surface Queue Guard; Check PR Size; Check Documentation Links; the claim and closing-keyword guards; filter; Flag docs affected by code changes) and 1 skipped (18.x upgrade harness (opt-in)); none completed yet, so Test Core, Build Core, TypeScript Type Check, Lint & Repo Gates and Dogfood Regression Gate have no verdict on this head. On the previous head 28d5dd67e: 41 runs, Check Changeset the only failure, all 40 others success or skipped, including Lint & Repo Gates, TypeScript Type Check, Test Core and Build Core. NOT MEASURED: the failing job's own log, because the log download redirects to blob storage and the egress proxy refuses it; the rule text was read from the check-run annotation instead, and the gate was re-run locally.", "mcp_calls": "0 — no MCP tool was called.", "api_writes": "1 — one fleet-write relay stroke, scripts/pm/fleet-write/dispatch.mjs: POST /repos/objectstack-ai/objectstack/dispatches carrying op comment, which the relay executes as POST /repos/objectstack-ai/objectstack/issues/24961/comments (this report). git push is not counted. No label, assignee, body or status write. Reads, all gh api GET: issues/24961/comments; commits/28d5dd67e/check-runs; check-runs/118957804901 and its annotations; actions/jobs/118957804901/logs (refused by the proxy); pulls/25007 (twice); commits/86d0cbfb7/check-runs.", "open_questions": [], "out_of_scope_findings": [ "carrier: 承接者:无 · noted, not filed. The PR #25007 body, which I was told not to touch and which the dev writes once, now carries one stale line. Line 23 of the body reads \"One changeset: `@objectstack/driver-sql` `patch`, with the `Clause-②` line, ...\". The seat that writes the body can change `patch` to `minor` in that one bullet." ], "files_changed": [ ".changeset/24961-readonly-probe-unopenable-path.md (+2/-2: '@objectstack/driver-sql' patch to minor; the BREAKING banner now says shipped as minor under the launch-window convention for breaking changes)" ], "line_budget": "n/a — no skills/** file and no ratcheted line ledger touched; the diff is +2/-2 in one changeset.", "deviations": [ "Attribution: the commit carries AGENTS.md's model-free trailer pair (Claude-Session and Co-authored-by Claude). The harness reminder's model-named Co-Authored-By trailer was not used (AGENTS.md precedence). Reported, not imitated.", "Changeset first line: the launch-window narrowings 24707, 24813 and 24949 on main open with 'fix(pkg)!:'. This one opens with 'fix(driver-sql):'. Not changed: the instruction named the package line and the banner only, and the ADR-0087 gate already reads this changeset as declared-breaking from its banner and Clause-② line. Say so if the bang is wanted.", "The level-axis verdict above comes from a payload I built from the PR as it stands (a GET of pulls/25007), not from CI's own event file; the plain derived spelling cannot judge that axis offline.", "Cleanup: the worktree's node_modules was removed, then the worktree (git worktree remove, no --force), before this report was posted. The local branch ref of the same name already existed in the shared checkout and was at the remote head 28d5dd67e when I started; it now sits at 86d0cbfb7. Scratch files stayed in the scratchpad's issue-24961 directory." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
ACCEPT → PR #25007 comment 6305839501 · contract review PASS 6305566864 · ready + auto-merge armed 2026-10-21T01:37Z
Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
Landed ·
domain:engineseat 2 ·session_01QK6pdbxKZiHdFApL8RYVh9· 2026-10-21T02:08Zmerged: true, merge commit4d991588f, merged by the merge queueorigin/main4d991588f fix(driver-sql): a read-only boot refuses a SQLite datasource whose file can be neither opened nor created, instead of reporting it connected (#25007)gh-readonly-queue/main/pr-25007-*gonecompletedbyFixes #24961State:
pm:dispatchedis removed in this act. Follow-ups live elsewhere: the family's closing card #25019, and thesecuritycard #25020.Generated by Claude Code