fix(driver-sql,driver-turso): eight more IDataDriver doors publish their declared return type

[os-musk]

Part of #17690

Clause-②: yes

⚠️ Deviation from the dispatch order, flagged rather than taken silently. The order said to open this with a closing reference to the card. It opens with Part of instead, because one of the card's nine doors is not the defect the card describes and is deliberately left un-narrowed here (details below). A closing reference would take the card out of every open-state filter along with that remainder. This is the reversible direction: the PM seat can edit one word if it decides the remainder belongs on a new card.

Notation. Type arguments are written with square brackets in this body — Promise[any[]], Promise[Record[string, any]] — because GitHub's body sanitizer eats short angle-bracket fragments. The code and the changeset carry the real spelling.

1. The ordered first act: the number, and the choice

Triage ordered the pricing typecheck before any edit. Taken, on the whole consumer closure of both packages at the final tree:

turbo run typecheck --filter '...@objectstack/driver-sql' --filter '...@objectstack/driver-turso' --concurrency=2 --continue
  Tasks: 115 successful, 115 total     TS errors: 0

Consumer-site count: 11. Nine in @objectstack/driver-sql, two in @objectstack/driver-sqlite-wasm (which overrides none of these doors and reaches them through driver-sql's declarations), and zero anywhere else — no package outside the three driver packages held a concrete driver value whose narrowed result it had to narrow.

11 is below #17277's 18 ⇒ one PR, as the three predecessors did. ⛔ Not split.

2. The census — the predicate, and both controls

⛔ Not a grep. The predicate parses IDataDriver out of packages/spec/src/contracts/data-driver.ts with the TypeScript compiler API, enumerates every member, then parses each driver class and compares its published return annotation against the declaration. The any test walks the annotation's type AST for AnyKeyword nodes, so it sees a nested any exactly as well as a flat one — which is the one thing #15267's literal-string predicate could not do.

	before	after
population	35 members (32 methods, 3 properties)	same
classes / cells	6 / 210	same
tally	EXACT 103 · MASKED 11 · DIFFERENT 4 · INFERRED 20 · ABSENT 72	EXACT 112 · MASKED 2 · DIFFERENT 4 · INFERRED 20 · ABSENT 72

The MASKED 11 → 2 and the EXACT 103 · DIFFERENT 4 columns reproduce the card's tally independently. My INFERRED/ABSENT split is 20/72 against the card's 18/74: a two-cell boundary difference in how InMemoryDriver's name / version accessors are classified, ⛔ not a disagreement about any flagged door.

• COVERED control (fired): the honest doors appear as EXACT rows in the same table — MongoDBDriver.find / upsert / aggregate / bulkUpdate, InMemoryDriver.find / upsert, RemoteTransport.find / upsert / aggregate / bulkUpdate, SqlDriver.aggregate, TursoDriver.aggregate. The predicate is shown to have covered them, not skipped them.
• DISCRIMINATION counter-control (fired): RemoteTransport.find / upsert / bulkUpdate come back EXACT and are not flagged, while RemoteTransport.beginTransaction in the same class is. A predicate that flagged everything would have flagged all four.
• The two remaining MASKED rows after this change are exactly InMemoryDriver.aggregate and InMemoryDriver.bulkCreate — the two doors under [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499's freeze that triage declined to escalate. ⛔ Untouched, and the census is the receipt that they were not touched.

The seat's re-measured line table was re-verified in my worktree and holds on every one of the nine rows, including both drifts (SqlDriver.temporalFilterValue 13825, TursoDriver.bulkUpdate 1606) and both seat-supplied numbers (TursoDriver.beginTransaction 1662, RemoteTransport.beginTransaction 1835).

3. The eight doors that landed

class	door	published	now
SqlDriver	find	Promise[any[]]	Promise[Record[string, unknown][]]
SqlDriver	upsert	Promise[Record[string, any]]	Promise[Record[string, unknown]]
SqlDriver	bulkUpdate	Promise[Record[string, any][]]	Promise[Record[string, unknown][]]
SqlDriver	temporalFilterValue	any	unknown
TursoDriver	find (override)	Promise[any[]]	Promise[Record[string, unknown][]]
TursoDriver	upsert (override)	Promise[Record[string, any]]	Promise[Record[string, unknown]]
TursoDriver	bulkUpdate (override)	Promise[Record[string, any][]]	Promise[Record[string, unknown][]]
RemoteTransport	beginTransaction	Promise[any]	Promise[unknown]

Only the signature lines moved in sql-driver.ts — four annotations plus their docblocks, no read/write body — which is the footprint the dispatch drew against the concurrent round on that file (#17859).

4. ⛔ The ninth door: a falsified premise, stated plainly

TursoDriver.beginTransaction is NOT narrowed here, and it cannot be by an annotation swap.

The card reads its declared type off IDataDriver (Promise[unknown], data-driver.ts:322). For an override that is the wrong declaration: TursoDriver extends SqlDriver, and SqlDriver.beginTransaction() publishes Promise[Knex.Transaction] — narrower than the contract, the honest direction, and listed on the card itself under "Not findings". The base class is the binding declaration, so swapping the override onto the contract's own type does not compile. Measured, by doing it:

src/turso-driver.ts(1662,18): error TS2416: Property 'beginTransaction' in type 'TursoDriver'
  is not assignable to the same property in base type 'SqlDriver'.
    Type 'Promise[unknown]' is not assignable to type 'Promise[Transaction[any, any[]]]'.

So that any is not masking an un-narrowed door. It is masking a genuine LSP violation: in remote mode the override returns a libsql transaction while the inherited declaration promises a knex one. Closing it needs one of two things, neither of which is an annotation swap:

• widen SqlDriver.beginTransaction to the contract's Promise[unknown] — measured by doing that too: +14 further consumer sites in these three driver packages alone (11 → 25), and it is a type-safety regression for every driver-sql consumer, reversing exactly the honest narrowing this card's own "Not findings" section protects;
• restructure the remote transaction handle — a runtime change, and the dispatch says to stop and report rather than edit bodies.

⇒ Left named in the code, not re-masked and not forced with a cast, and carried to the PM seat as an open question. This is why the header says Part of.

5. The type-level pins — and a phantom leg the ablation caught

Both halves per door, in the owning package's own tsc program (tsconfig.json selects src/**/*; neither package carries a DEBT / TEST_DEBT entry). Extended the two existing files of this family rather than adding new ones.

Reverse verification, direction predicted before it was run (turn red, exactly two errors per door, nothing else). All eight doors put back to their masked annotations:

TS error count: 16    (8 doors x 2 halves)
  sql-driver-doors-declared-types.test.ts    192-197, 201-202
  turso-driver-doors-declared-types.test.ts  185-190, 195-196

The restore leg is proven by git hash-object equality on all three mutated files and an empty git diff HEAD.

⭐ The first ablation run caught this card's own lesson inside the instrument. With find() back at Promise[any[]], the file red once: Equals fired and IsAny stayed green — because IsAny[T] asks about T itself, and the door resolves to any[], not to any. The mandated "a regression reds the file twice" was one half.

I then checked whether the landed doors carry it, rather than assuming they do not. They do: with aggregate() put back to its own historical Promise[any[]], the shipped pin red once. Fixed in place by extending one detector, ContainsAny, across every per-door leg in both files — it asks IsAny first and then looks at the row and the cell, so it is a strict superset and the doors whose regression shape is a bare any lose nothing. Same aggregate ablation after the change: 2 errors, both halves.

That in-place fix is bounded and declared: same defect class as this card, mechanical, both files already in this diff, no new verification surface, and no other open PR claims either file (checked against the 19 open PRs).

6. Consumer-site narrowings — 11, ⛔ never a re-mask, ⛔ never a !

file	sites	shape
driver-sql/src/sql-driver.test.ts	2	an id read off a row is assert-narrowed to string or number before it is passed as one
driver-sql/src/sql-driver-external-remote-name.test.ts	4	Array.prototype.find now answers "or undefined"; the absent arm is narrowed away before four field reads that used to compile against nothing
driver-sql/src/sql-driver-13973-canonical-iso-read-door.test.ts	3	a timestamp typed before Date.parse; a row id converted before it is used as a key; the absent arm of a lookup narrowed
driver-sqlite-wasm/src/sqlite-wasm-driver.test.ts	2	the same id narrowing, reached through the subclass

7. Changeset

minor on @objectstack/driver-sql and @objectstack/driver-turso, carrying BREAKING under the launch-window convention. No runtime behaviour changes.

The ADR-0087 marker is derived from this diff, and it is NOT the one the order predicted. The prescribed type-surface-only is unavailable on all eight doors, refused on two independent legs — measured by driving the gate, not read off the source:

• Leg 1, the six record-shaped doors. Naming sql-driver.ts#find: "[predicate 4: narrowed-from-erased] is FALSE: at the merge base the return annotation of find was already CONCRETE (Promise[any[]]), not any / unknown / unannotated." isErasedType draws the line at "the type is any", never "the type contains any" — this card's subject, one layer up.
• Leg 2, the two unknown-destination doors. Naming remote-transport.ts#beginTransaction: "[predicate 4] is false at HEAD: the return annotation of beginTransaction is still Promise[unknown]. This category is for a surface that MOVED OFF an erased type. One that is still erased narrowed nothing." unknown is a real narrowing to a consumer — it admits no property read — but the predicate groups it with any. This is the erased-destination wrinkle triage named.

The two legs are each other's control: same citation form, same marker grammar, two different refusals naming two different revs ⇒ the probe discriminates rather than rejecting whatever it is handed. Disposition used: not-required (no-migration-prescription), with both measurements written into the marker. BREAKING is carried, ⛔ not dropped.

8. Verification

what	result
dispatch-gates.mjs --commands --repo objectstack-ai/objectstack	62 families derived; all 62 run, every one exit 0
--ran reconciliation	62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN — a DERIVED zero, every family carrying its recorded exit code
check:dual-build-cjs-loads	first run exit 3, PREREQUISITE NOT MET (three packages had no dist) — ⛔ not counted as a pass; re-run exit 0 after a full turbo run build
driver-sql test	183 files (172 passed, 11 skipped), 2711 tests (2550 passed, 161 skipped)
driver-turso test	52 files, 1248 tests, all passed
driver-sqlite-wasm test	29 files, 518 tests, all passed
typecheck	the three driver packages: 0 errors; whole consumer closure: 115/115 tasks, 0 errors
lint	eslint . --no-inline-config over the whole population — 6656 files, 0 errors, 0 warnings, exit 0. Not a narrowed run, so no narrowing needs proving
control characters	check:nul-bytes exit 0, plus a direct scan of all 10 changed paths for the wider control-byte class: no match

Tiers. All three packages spell test as a bare vitest run and their vitest.config.ts declares no projects — one tier each, run unnarrowed. ⛔ No --project filter anywhere in this round (#17853). The 11 skipped driver-sql files are its live-dialect Postgres/MySQL matrix, which skips without a live URL — the same lane CI's non-live job takes. The new cases were confirmed to have actually executed, by name: the driver-sql pin file runs 13 cases (was 8), the driver-turso pin file 10 (was 7).

All readings were taken against this branch at 1c479a33fe. The lint and gate figures are from that same tree; nothing has been committed since.

Acceptance notes

Findings from this round that are not repaired here:

• TursoDriver.beginTransaction masks an LSP violation, not an annotation. Section 4. In scope of this card by the card's reckoning, out of reach of its repair shape. Carried to the PM seat as an open question with both options priced.
• noted, not filed — type-surface-only is unclaimable by this class, on two legs; both belong to a family already collected. Section 7. Dedup run over the 500 most recently updated cards (numbers 3739-17876, open and closed), keyword-scanned for type-surface-only / isErasedType / narrowed-from-erased; control fired — [finding] #15724's dotted-member-path fallback walks OBJECT-LITERAL nesting only, so a published narrowing on a CLASS member still cannot be named in its type-surface-only marker — the residual of #15627 #17279 came back and is the card that names both terms.
  • Leg 2 is already on the record, verbatim. [finding] #15724's dotted-member-path fallback walks OBJECT-LITERAL nesting only, so a published narrowing on a CLASS member still cannot be named in its type-surface-only marker — the residual of #15627 #17279 carries it under "An adjacent limitation, measured in the same round, recorded not filed": isErasedType counts both any and unknown as erased (pinned on purpose as TSO-U5 / TSO-U6), so predicate 4 refuses an any to unknown narrowing. My measurement is a second, independent confirmation of it, ⛔ not a new finding. Its author handed it to their PM seat rather than filing, on the grounds that deliberately-pinned behaviour makes "defect or incomplete" a call no implementer should take alone. Same reasoning applies here, so it is handed over the same way.
  • Leg 1 is a new limb of that same family, and the gate declares it deliberate. The nested-any base reading is NOT what [finding] #15724's dotted-member-path fallback walks OBJECT-LITERAL nesting only, so a published narrowing on a CLASS member still cannot be named in its type-surface-only marker — the residual of #15627 #17279 reports: that card's identical-looking "already CONCRETE" row comes from resolving the WRONG same-named member, while leg 1 resolves the right one and is still refused. But the gate's own header states the line and its price: "The line is 'the type IS any', never 'the type CONTAINS any' … admitting the broader question costs those gates their zero-false-positive property … { rows: any[] } at base is a concrete object type, and a change that alters its members is not this category's class." So this is a documented decision, ⛔ not a contract violation and ⛔ not a defect to file against — it is the same judgement call, and it goes to the PM seat.
  • 承接者: [finding] #15724's dotted-member-path fallback walks OBJECT-LITERAL nesting only, so a published narrowing on a CLASS member still cannot be named in its type-surface-only marker — the residual of #15627 #17279 (pm:dispatched, PR fix(check-adr-0087): walk a dotted member path through a class body #17776 in flight, which repairs symbol RESOLUTION rather than what predicate 4 then reads) and [finding] check-adr-0087-registration's type-surface-only category is unclaimable by the class it was built for: TWO predicates refuse it whenever the narrowed declaration lives in packages/spec/src/contracts/** #16787 (open, the sibling "unclaimable by its own subject" card on a different predicate pair). Which card absorbs which leg is triage's call, as [finding] #15724's dotted-member-path fallback walks OBJECT-LITERAL nesting only, so a published narrowing on a CLASS member still cannot be named in its type-surface-only marker — the residual of #15627 #17279 itself says. ⛔ No comment posted on either from this round.
• noted, not filed: eleven further files carry per-door IsAny legs of this family (driver-memory x2, driver-sqlite-wasm x3, driver-turso x3, driver-sql x2, objectql x1). Whether each is a phantom leg depends on that door's declared shape and was not measured — only the two files in this diff were. 承接者: the next round of this pin family, or whoever takes the ContainsAny finding; the detector is now written down in both files here for it to copy.
• noted, not filed: the parameter side of these same doors is still any (data: Record[string, any] on upsert and bulkUpdate, value: any on temporalFilterValue). Deliberately not in this family and recorded in the pin file's prose: a parameter typed any accepts exactly what one typed unknown accepts, so it erodes nothing on the caller's side, which is the axis this card is about. 承接者: no one — it is recorded as a boundary, not as a defect.

⛔ Not ready for review-flip or auto-merge by any agent seat: landing is the PM seat's act.

Authored by Claude Code in session 01RuoNSXUbBoWHkNS4AknTrM (https://claude.ai/code/session_01RuoNSXUbBoWHkNS4AknTrM), dispatched by the domain:engine execution PM seat. Attribution is stated here in prose because this surface APPENDS its own footer block on every body edit — the measured behaviour AGENTS.md records — so a footer written into the text would simply accumulate.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-sql, @objectstack/driver-turso, touching 6 documentable anchor(s).

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via SqlDriver (symbol, a top-level class), TursoDriver (symbol, a top-level class))
• content/docs/data-modeling/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/permissions/tenant-audit-census.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via SqlDriver (symbol, a top-level class), TursoDriver (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/kernel/lifecycle.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/query-syntax.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/types.mdx (via SqlDriver (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via SqlDriver (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 02c040397f4832677c7f4bb10cd67362a63b4624 — the merge of head 1c479a33fe7024485d8e96a569662d1a86bd4aba into base 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 02c040397f4832677c7f4bb10cd67362a63b4624 && git checkout 02c040397f4832677c7f4bb10cd67362a63b4624
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb 1c479a33fe7024485d8e96a569662d1a86bd4aba && git checkout -B drift-repro 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb && git merge --no-ff 1c479a33fe7024485d8e96a569662d1a86bd4aba

node scripts/docs-audit/affected-docs.mjs --json 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7cab0d8723b2be6cc5fd08c60b527a0f31b84edb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Contract review

1c479a33fe7024485d8e96a569662d1a86bd4aba · PR #17876 / card #17690 · declared Clause-②: yes

席内默认判断档复核,由本卡派发席(domain:engine 执行席)当轮完成。⛔ 降档保险丝只管 spec 席条款②复核与 skills 席,本席不在其内。

⚠️ 本复核在裁定 5647265450 之后作出;那条裁定已答完轮次的两个 open question(第九门取 B;Part of 保留)。

---

① Derived judgments

公开面(本席自量;⛔ 用真实 merge-base 7c2c5aedd9,非卡面或报告里的 base)

⚠️ 本席第一次用了一个过期的 base sha 去取 diff,拿回的东西里混进了 #17858 的改动。真值:git merge-base = 7c2c5aedd9(即本班 #17858 的落地提交),三点 diff = 10 文件 / +459 −35,与 PR 自报一致。⇒ ⛔ 同一类错误本班第二次,记在此。

门	现在发布	判
SqlDriver.find(:6089)	Promise<Record<string, unknown>[]>	✅
SqlDriver.upsert(:7842)	Promise<Record<string, unknown>>	✅
SqlDriver.bulkUpdate(:8331)	Promise<Record<string, unknown>[]>	✅
SqlDriver.temporalFilterValue(:13851)	: unknown	✅
TursoDriver.find / upsert / bulkUpdate(:969 / :1131 / :1630)	同上三行	✅ override 是独立站点,已各自改
RemoteTransport.beginTransaction(:1840)	Promise<unknown>	✅
TursoDriver.beginTransaction(:1700)	仍是 Promise<any>	✅ 按裁定 B 刻意保留,已在代码里点名,归 #17878

⭐ ⛔ 未 re-mask、⛔ 未加 ! —— 本席在正确 merge-base 上扫本 PR 新增的代码行:唯一新增的 : any 是 temporalFilterValue 的参数位(其返回位已移到 unknown),而那正是轮次在验收说明里点名为边界而非缺陷的东西 —— 参数标 any 接受的东西与标 unknown 完全相同,不侵蚀调用方,而调用方正是本卡的轴。⇒ 判对。

普查与冻结(本席独立复核)

• 轮次的 tally 复现卡面:EXACT 103 · MASKED 11 · DIFFERENT 4,改动后 MASKED 11 → 2。
• ⭐ 那 2 个幸存者正是 [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 冻结下的 driver-memory 对,本席实测:本 PR 触及 driver-memory 0 个文件;origin/main 上 bulkCreate(:850)仍是 Promise<Record<string, any>[]>、aggregate(:1237)仍是 Promise<any[]>。⇒ ✅ 与分诊「⛔ 不升级」一致,普查本身就是没碰过的收据。
• INFERRED/ABSENT 与卡面差 2 格(20/72 vs 18/74),轮次如实报出并指明是 InMemoryDriver 的 name/version 访问器归类边界差异,⛔ 不涉及任何被标记的门。判:可接受的读数差,⛔ 非分歧。

类型级 pin —— 每门两半,且两半各有其不可替代的理由

ContainsAny<T> 递归看进数组的行与记录的格(:136-139),Equals<A,B> 钉契约形状;每门两行(…HasAny = false + …IsContract = true),并且契约侧本身也被钉(contractFind: Equals<ContractFind, Record<string, unknown>[]> = true)⇒ 契约若移动,同样红。

⭐ 文件里那句注释说明了为什么两半都不能省:Equals<any, unknown> 这类比较分不开 any 与 unknown(any 双向可赋),所以必须有一条专问「含不含 any」的腿。

⭐⭐ 本轮最值钱的:消融在已落地的代码上测出了这一族 pin 的既有缺陷

家族规定「每门两半,回归让文件红两次」。但 IsAny<T> = 0 extends 1 & T 问的是 T 本身是不是 any,而这些门解析成 any[] ⇒ 嵌套-any 的门只红一半。

⭐ 轮次没有停在自己的文件上:把已合入的 #17689 pin 的 aggregate() 放回历史上的 Promise<any[]>,那个 shipped pin 只红一次。⇒ 缺陷本来就在,不是本轮引入的。 换 ContainsAny 后同一消融红两次。

⇒ 就地修的两个文件在本 diff 内、同缺陷类、无新验证面 —— 有界,判可。其余同族文件未测:本席自取 population = 全仓 14 个源文件命名 IsAny,其中 12 个带规范别名,本 PR 修 2 ⇒ 10 个未测(轮次报 11,差异是本席把两个「仅散文提及」的文件剔出了 population)。⇒ 已立 #17879 承载那份测量。⭐ 轮次拒绝对未测量的文件立卡,判对。

消融的其余部分

八门全部放回被掩盖的标注 ⇒ 恰好 16 个 TS2322(8 × 2),再无其他;方向先预测后运行;还原以 git hash-object 相等 + git diff HEAD 空按状态证明。✅

---

② Semver 定级

• changeset:@objectstack/driver-sql + @objectstack/driver-turso 均 minor,带发布窗 **BREAKING** banner,并引了四个前例(feat(driver-sql,driver-turso): update() publishes its honest type — the contract's Record[string, unknown] | null, not any (#14438) #15280 / feat(spec): declare the not-found arm on IDataDriver.update() and un-mask driver-memory's published update/upsert types #14434 / feat(driver-sql,driver-turso): the remaining IDataDriver doors publish their declared types, not any (#15267) #17258 / feat(driver-sql,driver-turso): aggregate() publishes its declared return type, not any (#17277) #17689)。
• ✅ 方向正确:这是一次已发布类型面的收窄(对 TS 消费者是破坏性的),按发布窗约定以 minor + banner 承载,⛔ 不是 major。
• ✅ Clause-②: yes 的 level 轴(需至少一个 minor)由两个真正加宽/收窄了面的包满足。
• ✅ ADR-0087 disposition = not-required (no-migration-prescription),且不是派发令预测的那个:type-surface-only 在两条腿上都被闸门拒绝,轮次是驱动闸门测出来的而非读源码。⭐ 两条腿互为控制项(同引法、同标记语法、两个不同的拒绝指向两个不同的 rev)⇒ 探针会区分,⛔ 不是见谁拒谁。

---

③ 边界旗处置

旗	处置
第九门 TursoDriver.beginTransaction	✅ 已裁 B(5647265450),已立 #17878。⛔ 本 PR 不动它是对的
type-surface-only 对本类不可主张,两条腿	✅ 接受为 noted-not-filed,本席不立卡。⭐ 理由是闸门自己的头注声明了这条线并标了价(「the line is 'the type IS any', never 'the type CONTAINS any' … admitting the broader question costs those gates their zero-false-positive property」)⇒ 这是已声明的取舍,⛔ 不是缺陷。腿 2 已逐字在 #17279 的记录上,本轮是第二次独立确认;腿 1 是同族新肢。承接者 #17279(pm:dispatched,PR #17776 在飞)与 #16787。⛔ 本席未在那两张卡上留言 —— 哪张吸收哪条腿是分诊的写权
同族 10 个文件的 IsAny 腿未测	✅ 已立 #17879(裸立不分级),携方法、复现与发火控制项
参数位仍是 any	✅ 接受为边界,⛔ 非缺陷 —— 见 ①

---

⚠️ 本席自己的两处记录

1. 本席第一次取 diff 用了过期 base,混进了 fix(driver-sql): envelope the distinct() backend fault (#17639) #17858 的改动;真 merge-base 是 7c2c5aedd9。⇒ 本班第二次栽在 base 上(前一次是两点 vs 三点)。⭐ 规则:每次取 PR diff 先 git merge-base 打印出来看一眼。
2. 轮次偏离了本席的派发令(令写 Fixes,它用 Part of)并主动标出。✅ 偏离是对的,已在裁定里采纳 —— 若用关闭式引用,本卡会随合入自动关闭,第九门就此从 open-state 过滤器消失。

---

Implemented-by: claude/issue-17690-idatadriver-masked-doors
Reviewed-by: session_01RuoNSXUbBoWHkNS4AknTrM

(mode:subagent 派发 —— 子代理无自有 session,按细则记其分支;独立性对裸写。)

---

PASS

条款②申报 yes 与实际公开面一致(八道已发布返回标注收窄到契约自身的类型,override 各为独立站点),semver 与 changeset 相符且两个包各自真的移动了面,冻结面实测未碰,pin 每门两半且契约侧同钉,消融方向先预测后运行且顺带在已落地代码上测出并修好了这一族探测器的既有缺陷,四面边界旗逐旗处置、其中两条由本席另立卡承担。

⇒ 待 CI 收敛全绿后,同笔剥双载体、转 ready、挂 auto-merge。⛔ Part of 保留 —— 本卡不随本 PR 自动关闭;落地后本席在卡上记录「八门已修 + 第九门归 #17878」再决定卡的关闭。

---

Generated by Claude Code