[objectstack-fleet]

Fixes #24903

Clause-②: no (test only: no product code, accept set or served shape moves)

What changed

One case in packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts is re-staged, and a development control is added beside it. Test only: no product file moves.

• Before: "is force-disabled under NODE_ENV=production (warns, does not alter)" staged relax_not_null. ADR-0113 made that needs_confirm, and reconcileAndWarnDrift (sql-driver.ts) applies only d.category === 'safe'. So the column stayed NOT NULL with or without the production guard, and the case asserted no warning.
• After: the case stages a safe drift: a current_user runtime token written as the column DEFAULT by a pre-data: the SQL driver emits the current_user framework token as a literal column DEFAULT, so the database itself writes a non-id into a lookup('sys_user') #4560 build, which detectManagedDrift classes drop_column_default / safe. Under NODE_ENV=production with autoMigrate: 'safe' it asserts:
  • the DEFAULT is still on the column (columnInfo().owner.defaultValue still carries current_user);
  • the drift is still reported as safe / drop_column_default, so the guard is the only thing that held it back;
  • logger.warn received [schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production, matched on that stable prefix. The em-dash tail is left unpinned.
• Control: "applies the safe drop_column_default drift outside production (control for the guard below)". It is the same table and the same boot with NODE_ENV=development. The DEFAULT is removed, detectManagedDrift() answers [], and no production warning is logged. The pair cannot pass vacuously again.
• NODE_ENV is restored in finally in both cases. The logger is a per-driver vi.fn() object (the file's own makeDriver), so no global spy is left to restore.

Why drop_column_default

The safe ops detectManagedDrift emits on main (schema-drift.ts) are drop_column_default, widen_varchar, replace_unique_index and create_index.

• widen_varchar is gated on enforcesVarcharLength (postgres / mysql only), so it never fires on this file's SQLite driver.
• create_index: syncTableIndexes creates a missing declared index additively during initObjects, whatever autoMigrate says. The guard would not be the only reason it is absent.
• replace_unique_index works, but it needs a tenant-scoped unique field, an organization column and an index read-back. It is already the stage of sql-driver-index-drift.test.ts's production case. PR feat(driver-sql,driver-turso,driver-memory,objectql,cli,metadata-protocol): plain organization key part in new unique indexes; the differ reads COALESCE(tenant) as tenant on a certified database (18.x step 7b-1 + 7b-2) #24893 is also rewriting the NULL-safe key part it compares.
• drop_column_default needs one column and one read-back, and stays in this file's biz_unit fixture idiom. The SQLite rebuild path applies it (sql-driver-runtime-token-default.test.ts measures that).

PR #24893 (draft) edits schema-drift.ts. Its patch changes no category: line, and it does not touch the runtime-token default branch. It does not change which ops are safe.

The guard, as read

reconcileAndWarnDrift: autoOn = this.autoMigrate === 'safe' && this.schemaMode === 'managed', then if (autoOn && this.isProductionEnv()). isProductionEnv() is (process.env.NODE_ENV ?? '').toLowerCase() === 'production', so the check is case-insensitive and reads nothing else. The warning goes out once per drifting table through this.logger.warn, not console.warn. The case spies on that logger.

Verification (head 41b3fdf86, origin/main merged at 19e5338cc)

• Target file: pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2 src/sql-driver-schema-drift.test.ts: 15 passed (was 14).
• Ablation: node scripts/ablation-replace.mjs --file packages/drivers/driver-sql/src/sql-driver.ts --anchor 'if (autoOn && this.isProductionEnv()) {' --replacement 'if (false /* ABLATED-24903 */) {' -- vitest run on that file.
  • Anchor hit x1 to x0, and the replacement landed x0 to x1. Blob b4393f25d41b became 98a32996463a.
  • The production case went red: AssertionError: expected 'null' to contain 'current_user'. The control stayed green: 1 failed / 14 passed.
  • Restored: blob after restore = blob at HEAD = b4393f25d41b, and git diff HEAD is empty.
  • The test imports SqlDriver from ../src/index.js, so no dist/ rebuild sits between the mutation and the run.
• Package checks: pnpm --filter @objectstack/driver-sql typecheck exit 0, run before and after the merge. tsc --listFiles includes this test file.
• Full suite: pnpm --filter @objectstack/driver-sql test exit 0 before and after the merge: 225 files passed and 12 skipped (the live-dialect suites), 3692 tests passed.
• Repo project: pnpm --filter @objectstack/core test:repo exit 0: 6 files, 82 tests.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gives 54 commands. All 54 were re-run on the final head with exit codes captured before any pipe: 54 of 54 exit 0 (26 direct node, 28 pnpm).
  • check:dual-build-cjs-loads and check:lean-entry-closure first exited 3 (PREREQUISITE NOT MET). They were re-run after pnpm build (76/76 tasks) and exited 0.
  • --ran reconciliation: 54 derived, 54 run, 0 NOT-MEASURED (a derived zero).
• Changeset: none. The test file is outside @objectstack/driver-sql's files[] (dist, README.md, CHANGELOG.md). The built dist/ has zero hits for the test file name, and the positive control (the warning text) hits dist/index.js. skip-changeset is declared in the same create.

Acceptance notes

• Pin sweep: the warning text and the guard were swept across every package, qa/, docs/qa/platform-checklist/ and content/docs/.
  • The only other pin of the driver-level guard is sql-driver-index-drift.test.ts, "is force-disabled under NODE_ENV=production — the index survives untouched". It stages replace_unique_index (safe) beside a dev self-heal sibling, so it is not vacuous. It does not assert the warning. Noted, not built.
  • The CLI / runtime pins (dev-self-heal-host-parity, runtime/src/dev-auto-migrate, dev-standalone-self-heal) pin a different layer: the host does not pass autoMigrate in production. They do not pin this driver branch.
  • docs/qa/platform-checklist/areas/cli.json names the warning in a live-boot step and carries this case as knownGaps. Re-adding the case to cli.dev-automigrate-policy's automated.ref is domain:devx's, and is not touched here.
• Built by the os-dev agent for domain:engine seat 1, under claim 6297759904 on driver-sql test: "is force-disabled under NODE_ENV=production (warns, does not alter)" stages needs_confirm relax_not_null, which auto-reconcile never applies anyway — it passes with the production guard deleted and asserts no warning #24903.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2941a1929d214720516c9392b8d2571bb3160648 → packageMentionDocs.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 41b3fdf86a
Local-runs: none

Scope: the net diff against the merge base 19e5338cc8 (1 file, +46/−3): packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts. Read with it: sql-driver.ts's reconcileAndWarnDrift production branch (if (autoOn && this.isProductionEnv())) and isProductionEnv; the file's makeDriver logger mock. Also the card #24903 with the claim 6297759904 and the dispatch 6297804883, the dev's os-dev-report 6299170907 (read as claims), and the PR body.

① Derived judgments

• The production case now pins the guard: right.
  • It stages a safe drift, drop_column_default: a current_user token written as the column DEFAULT by a pre-data: the SQL driver emits the current_user framework token as a literal column DEFAULT, so the database itself writes a non-id into a lookup('sys_user') #4560 build. safe is the only category auto-reconcile applies.
  • Under NODE_ENV=production with autoMigrate: 'safe' it asserts three things:
    • the DEFAULT survives (columnInfo().owner.defaultValue still holds current_user);
    • the drift is still reported as safe / drop_column_default;
    • the driver's logger.warn carried [schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production, the string sql-driver.ts emits.
  • The title's "warns" is now asserted.
• The control: right, and it makes a vacuous re-stage visible. The new sibling sets NODE_ENV=development explicitly, so a runner that exports production cannot turn it into a second production case. On the same seed and metadata it shows the DEFAULT removed, no drift left, and no production warning. Both cases restore NODE_ENV in finally.
• The chosen op: as the dev settled it (A).
  • widen_varchar never fires on SQLite.
  • create_index is applied additively by syncTableIndexes whatever autoMigrate says, so it cannot isolate the guard.
  • replace_unique_index is already the stage of sql-driver-index-drift.test.ts's production case, and it sits in PR feat(driver-sql,driver-turso,driver-memory,objectql,cli,metadata-protocol): plain organization key part in new unique indexes; the differ reads COALESCE(tenant) as tenant on a certified database (18.x step 7b-1 + 7b-2) #24893's churn zone.
  • drop_column_default needs one column and one read-back, and feat(driver-sql,driver-turso,driver-memory,objectql,cli,metadata-protocol): plain organization key part in new unique indexes; the differ reads COALESCE(tenant) as tenant on a certified database (18.x step 7b-1 + 7b-2) #24893 does not touch it.
• The ablation: replacing the production condition with false turns this case red (expected 'null' to contain 'current_user'); the control stays green. The blob was restored equal to HEAD. Judged from the code, removing the branch lets auto-reconcile drop the DEFAULT, so the first assertion fails, as reported.
• No product code moves.

② Semver level

• No changeset, with the skip-changeset label, which Check Changeset admits for a test-only PR. The file ships nowhere: driver-sql's files is dist, README and CHANGELOG.
• Clause-②: no (test only: …) is at a line start in the PR body.
• check-governed-merges matched 0 of 1 path; 49 changed lines.

③ Boundary flags

• Deviation 1 (the base had moved; main merged and the suites re-run): accepted.
• Deviation 2 (the model-free trailer pair): accepted; that is AGENTS.md's form.
• Deviation 3 (skip-changeset rather than an empty changeset): accepted; that is the repo's rule for a no-ship change.
• Deviation 4 (core test:repo run as asked): accepted.
• Deviation 5 (the pre-edit read recorded in the report): accepted.
• Open questions: both taken as the dev settled them.
• Out-of-scope findings:
  • sql-driver-index-drift.test.ts's production case is not vacuous: it stages a safe op beside a self-heal sibling. It does not assert the warning, but it meets no filing gate.
  • cli.dev-automigrate-policy's knownGaps[2] in docs/qa/platform-checklist/areas/cli.json is domain:devx's to re-add to automated.ref after this lands. The seat tells that lane at landing.
• The merge: git merge-tree against today's origin/main is clean.
• Check-runs on 41b3fdf86a: not concluded at this read (ci-failure UNDETERMINED, 6 still running). The ACCEPT waits for green.

Implemented-by: claude/issue-24903-prod-guard-drift-test
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T19:50Z · ACCEPT

Head: 41b3fdf86a. It carries the rewritten production case, its development control, and a merge of main.

Card #24903 (p2, tests, area:devpath; filed by domain:devx seat 1 from PR #24891): claim 6297759904, dispatch 6297804883. Dev report: 6299170907.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24903. 1 file, +46/−3, test only. Not governed: check-governed-merges matched 0 of 1 path.
Scope	The production-guard case stages a safe drop_column_default drift, and asserts three things under NODE_ENV=production: the DEFAULT survives, the drift is still safe, and the production warning reached the driver's logger. A development control shows the same boot removes the DEFAULT. No product code moves.
Seat's own read	The guard is if (autoOn && this.isProductionEnv()) in reconcileAndWarnDrift, and its warning goes through this.logger.warn, which makeDriver mocks. So the case reads the right channel. git merge-tree against today's origin/main is clean.
Review	TIER_DEFAULT, in-seat. Record 6299521184 is PASS on this head.
Declaration	No changeset, labelled skip-changeset: the file ships in no package. Clause-②: no (test only: …) is at a line start, as on the claim and the PR body.
Cross-lane	None in the diff. cli.dev-automigrate-policy's automated.ref in docs/qa/platform-checklist/areas/cli.json is domain:devx's, and the landing comment tells that lane.
Gates	Dev at 41b3fdf86: 54 derived, 54 run, all exit 0. driver-sql full suite 3692 passed, core test:repo 82 passed. Ablation: the production condition forced false makes the case red and leaves the control green; restored to HEAD.
CI	At this read on 41b3fdf86a: ci-failure GREEN, all 41 check-runs completed, none failed.

Disposition:

• open_questions: both as the dev settled them (record ③): drop_column_default over replace_unique_index, and an explicit NODE_ENV=development control.
• deviations: all accepted (record ③).
• out_of_scope_findings: sql-driver-index-drift.test.ts's production case is not vacuous; it meets no filing gate.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Fixes #24903 then closes the card.

---

Generated by Claude Code