[objectstack-fleet]

Requested by Leehom · project thread
Part of #25522
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

Cut 9 of the packages/objectql/src/engine.ts split (#24586 ruling A, recorded in 6270097840). The claim is 6421730179. Four bodies of the "Execution plumbing" section move unedited into a new module, packages/objectql/src/engine-execution-plumbing.ts: buildSession, buildProvenance, buildEvalUser and buildUser, the builders of the caller envelopes a hook and a validation predicate read. No behaviour changes. #25522 stays open for the later cuts.

Branch claude/project-thread-3pdv8m (the card thread's harness-pinned branch), cut from origin/main at 1eebbc08b, which contains cut 8's merge (43f1da0f6, #26229). Nothing was edited before that merge landed.

Why this area (the fresh seam table)

Measured on origin/main 1eebbc08b with cut 8's script, unchanged. engine.ts is 23,095 lines, 7,373 of them (31.9%) from the last 30 days (git blame -s --since=2026-09-26T17:24Z). scripts/pm/git-history.mjs count (window covered, exit 0): 127 commits in 30 days, 33 in 7. class ObjectQL holds 318 members, 255 methods and accessors plus the constructor. Columns as in cut 8: "inferred public" stays, "U" counts this.FIELD.delete/insert/update( sites, "private statics" stay.

range	section	first … last member	lines	30-day lines	methods	inferred public	U	private statics
4761-4986	Instance state and constructor	txStore … constructor	226	50	0 (0 public)	-	0	-
4987-5009	Status and registry accessor	getStatus … registry	23	0	2 (2 public)	getStatus	0	-
5010-5353	Hook and function registry	registerHook … triggerHooks	344	6	16 (16 public)	registerHook, triggerHooks	1	-
5354-5709	Hook dispatch internals	hasHooksFor … assertBulkPerRowHookBudget	356	61	7 (0 public)	-	0	-
5710-5870	Action registry and activation	registerAction … setActionActive	161	19	10 (10 public)	-	1	-
5871-6152	Registered resolvers and write-gate probes	_heldFileResolver … registerInsertRecomputeListener	282	116	6 (6 public)	-	0	-
6153-6906	Readable-ids security and permission/formula resolution	readableIdsSecurityReported … resolveDefaultPermissions	754	546	15 (2 public)	-	0	-
6907-7013	Authz invalidation and middleware registration	writeEpoch … hasObjectMiddleware	107	18	4 (4 public)	-	0	-
7014-7249	Execution plumbing (middleware, session, provenance, users)	executeWithMiddleware … buildUser	236	37	7 (0 public)	-	0	-
7250-7580	Driver options and engine posture	buildDriverOptions … resolveEnginePosture	331	209	6 (0 public)	-	0	-
7581-7790	Organization probe and system-insert organization	probeInstallOrganizations … transactionCoversDriverFor	210	45	4 (0 public)	-	0	-
7791-8156	Field defaults	resolveNowDefault … defaultFieldEntries	366	4	6 (0 public)	-	0	-
8157-8769	Autonumber	applyAutonumbers … seedAutonumber	613	80	6 (0 public)	-	1	-
8770-9434	Package, app, plugin and driver registration	registrationConversionWarned … registerDriver	665	170	6 (3 public)	registerApp, registerDriver	0	-
9435-9643	Datasource registry	supplyFileColumnsMovedResolver … listUnavailableDatasources	209	1	8 (7 public)	-	3	-
9644-9795	Write guard and realtime publish	assertWriteAllowed … publishBulkDataEvent	152	18	4 (1 public)	-	0	-
9796-9894	Validation-message i18n	setI18nService … objectDisplayLabel	99	14	4 (1 public)	-	0	-
9895-10987	Referential integrity and master-detail resolution	assertReferencesResolve … masterDeclaredFields	1093	429	12 (0 public)	-	0	-
10988-11103	Dangling-reference and cascade inspection	inspectDanglingReferences … inspectCascadeDelete	116	48	2 (2 public)	-	0	-
11104-11198	Crypto and tenancy providers	setCryptoProvider … setTenancyPostureProvider	95	20	4 (4 public)	-	1	-
11199-11618	Secret and internal-field handling	encryptSecretFields … resolveInternalField	420	61	9 (3 public)	-	0	-
11619-11687	Schema lookup and filter judging	getSchema … judgeFilter	69	48	3 (2 public)	-	0	-
11688-11953	Datasource routing	LIFECYCLE_DATASOURCE … setDatasourceMapping	266	20	8 (3 public)	setDatasourceMapping	0	-
11954-12121	Lifecycle init and health	init … resolvePrimaryDatasource	168	16	3 (3 public)	init	0	-
12122-12195	Media and value-shape presence	objectHasMediaField … valueShapeStrictFor	74	13	4 (0 public)	-	0	mediaFieldPresence, coveredValueFieldPresence
12196-12878	Migration flags and attestations	isFileReferencesMigrationVerified … wasDatastoreCreatedFromEmpty	683	81	17 (8 public)	-	0	-
12879-12901	destroy	destroy … destroy	23	0	1 (1 public)	destroy	0	-
12902-12920	Expand/cascade limits (statics)	MAX_EXPAND_DEPTH … MAX_BULK_PER_ROW_HOOK_ROWS	19	0	0 (0 public)	-	0	MAX_EXPAND_DEPTH, MAX_CASCADE_DEPTH
12921-13371	Roll-up summaries	autonumberCounters … recomputeSummaries	451	0	7 (1 public)	-	0	-
13372-13625	Related-record expansion	expandRelatedRecords … expandRelatedRecords	254	10	1 (0 public)	-	0	-
13626-14069	File-reference hydration	resolveFileReferences … readParentDerivedFiles	444	310	5 (0 public)	-	0	-
14070-14548	Query lowering	resolveWhereTokens … requireFindOnePredicate	479	272	9 (0 public)	-	0	-
14549-15105	find / findOne	find … staticReadonlyCreateStrip	557	142	4 (2 public)	-	0	-
15106-15763	validate	validate … validate	658	447	1 (1 public)	-	0	-
15764-17110	insert / insertMany	readUpdatePriorRow … insertMany	1347	439	3 (2 public)	-	1	-
17111-19044	update	update … update	1934	275	1 (1 public)	-	0	-
19045-20585	Delete cascade and reference walking	planCascadeAtomicity … organizationOwnedRowCounts	1541	733	22 (1 public)	-	0	storedReferenceIncludes, remainderAfterMemberRemoval, referenceCheckContext, outlivesOrganization, keepsOrganizationReference, organizationCountContext
20586-21155	delete	delete … delete	570	47	1 (1 public)	-	0	-
21156-21775	count / aggregate	count … aggregate	620	236	3 (2 public)	-	0	-
21776-22084	execute and transactions	execute … enforceTransactionOrigin	309	74	8 (2 public)	-	0	-
22085-22377	Compatibility API	registerObject … create	293	52	16 (16 public)	-	0	-

The per-method move screen for every section and the full pricing are in the project file pm-orders/server/25522-cut9-seam-table.md. A body stays if any of these holds: an inferred-return public method, a U site, a private-static read, an objectql/src/engine.ts#NAME pointer under packages/spec/** or docs/adr/**, an engine self-call, or a static. Bodies earlier cuts moved count as stubs.

Pricing (net engine.ts lines, the seat's rule): a stub costs a comment, the host literal's open and close and the .call, plus two lines per field read and one per method read; a body that reads no member costs two (the comment and the call); the import adds about three.

area	30-day lines	paying bodies	net	why not / why
Execution plumbing (this PR)	37 of 236	4 of 7 bodies, 66 body lines	-55 measured	the coldest section that pays: the four moved bodies carry 0 lines from the last 30 days; none reads an engine member, so there is no host and no getter at all; no engine.ts# pointer names them
Autonumber	80 of 613	adoptExplicitAutonumber 19, isIssuedAutonumberCollision 5, warnAutonumberReadersUnserved 13, seedAutonumber 64	about -75	pays 20 lines more but holds over twice the recent lines; the next candidate
count / aggregate	236 of 620	count 58, rejectCredentialAggregation 38	about -71	hot
Migration flags and attestations	81 of 683	8 bodies	about -91	the section writes five fields, so its host needs setters (a seat ruling first, as cuts 7 and 8 said)
Package registration, Referential integrity, File-reference hydration, Readable-ids, Delete cascade, Driver options, validate	170 to 733	161 to 469	-120 to -439	the hottest sections; the card says take the coldest
Query lowering, Hook dispatch internals, find, Roll-up summaries and the rest	-	-	-1 to -40	pay little

Cut 8 priced this area at about -55 and the head measures exactly -55 (66 lines removed, 11 added). Areas the seat rejected priced about -5 and -15; it accepted -70 to -117. No other area pays better while being as cold: Autonumber is the only one between -55 and -91 below 100 recent lines, and its 80 recent lines include #26026's edit during cut 7.

What stays in the section: executeWithMiddleware (ADR-0139 cites it as engine.ts#executeWithMiddleware), buildReferentialFieldClear (1 body line, the stub would cost 2) and claimReferentialCascadeDelete (5 body lines; it reads the cascadeIssuedDeletes field, so its stub would cost 6).

The shape

• The class keeps all four methods with name, modifiers (private), signature, docblock and position. Each body is now one comment and one return NAME(execCtx);, marked [#25522 cut 9], the form earlier cuts use for a member-free body (objectDisplayLabel, assertBulkPerRowHookBudget, resolveSecret).
• No host object. None of the four bodies reads this (AST screen, casts stripped): each is a function of the ExecutionContext it is handed. The card's rule is that shared state goes through one named host; here there is no shared state to hand over, so the module declares no host interface and imports nothing from the engine, not even as a type.
• Imports. The module's imports are HookContext (@objectstack/spec/data) and ExecutionContext (@objectstack/spec/kernel), both as types, the bindings engine.ts uses. engine.ts keeps every import it had (both still have readers there) and gains the new module import with a two-line comment.
• The module header names the four bodies, says what stays and why, and cites ADR-0068 and ADR-0139 by id only (no decision letter).

Net lines (the seat's rule)

engine.ts goes from 23,095 to 23,040 lines, net -55 (11 added, 66 removed). The module is 122 lines: a 38-line header and imports, four one-line docblocks, and the 66 moved body lines with their signatures and closing braces. With the one re-keyed row of the census page, the diff is 201 changed lines over 3 files (+134 / -67), far under the 3,000-line human-merge threshold.

The published .d.ts does not change (ruling 6348891160)

Base: @objectstack/objectql built with engine.ts restored from 1eebbc08b and the new module removed (tree and index; restored with git checkout HEAD --, blob hashes compared, git status clean). Head: built at 2b013959b. buildSession(execCtx occurs 1 time in the base dist/index.mjs (the inline method) and 3 times in the head's (the function, the method, the call), so each leg built the source it names. All six declaration files are byte-identical, and equal to the hashes cuts 7 and 8 recorded:

file	sha256, base = head
core.d.mts	ef178bf0725eccc2f358f082ce13dc5122a6d5a53c19ef630017256f67de03b4
core.d.ts	1d20303a455a909e4b55fd0802fb0b0bcb59ec51784daf27d5ef4c0659410953
index.d.mts	ccf900240aa137abe72f82b8abfc872d42c5645467400134c580285f2a3b3090
index.d.ts	0454d5e70b156d8effbf27b8915587c7cbee241dcd7d698013c0a4c369a02aa5
util-CVzOGxAn.d.mts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53
util-CVzOGxAn.d.ts	85ef1cbec2b016d5f7afabaa21689c86c6dffc573076fdfdeb8ea0f1a1b1ad53

Positive control: the four moved members are private, so the control drops private from the buildUser stub (anchor landed once, 1 hit after) and rebuilds: all six hashes and the chunk name changed (util-Bxn7XMk8.d.ts 18e7fa2d…, index.d.ts e5d86ee9…), and the util chunk now prints buildUser(execCtx?: ExecutionContext): HookContext['user'];. Restored with git checkout HEAD -- (blob hash compared, git diff HEAD empty, 0 hits), rebuilt, and all six files compared equal to the head build again.

Proof of move-only

A TypeScript-AST leaf-token compare (recursive getChildren, JSDoc skipped; pm-orders/server/evidence/25522/astcmp.mjs) of base engine.ts (1eebbc08b) against the head module:

• For each of the four, the parameters, return type, type parameters and body tokens are SAME, async matches, and every body line equals the base line less two leading spaces, comments included: buildSession 205 tokens / 43 lines, buildProvenance 109 / 9, buildEvalUser 56 / 6, buildUser 72 / 8.
• Negative controls: flipping !flowRunId to flowRunId in the moved buildProvenance reports DIFFER on its body tokens; editing only one comment in the moved buildUser fails the line rule. Both exit 1, and the module was restored from HEAD and its blob hash compared after each.
• Class: 318 members at both ends, in the same order. 314 are byte-identical (full text, docblocks included), and the 4 stubs keep docblock, modifiers and signature byte-identical up to the body.
• Top level: 231 of 232 base statements are byte-identical in head; the other is the class. Head adds the new module import with its comment.

Readers of the moved lines

• The system-context census page (migrated in this PR). content/docs/permissions/system-context.mdx row 63 anchored packages/objectql/src/engine.ts#buildSession, the read site that carries isSystem into the hook session. The read now lives in the module, so the row anchors packages/objectql/src/engine-execution-plumbing.ts#buildSession; its wording is unchanged. check-system-context-census at base: 151 read sites in 22 packages across 79 files, 144 of 144 symbols cited; at head: 151 sites across 80 files, 144 of 144 cited, OK. Control: with the base page restored over this head, the gate exits 1 with exactly two findings, file-without-a-row for the new module and anchor-is-not-a-read-site for the old anchor; restored from HEAD, blob hash compared, green again.
• ADR anchors. No scripts/adr-anchors/ entry describes a moved body: the engine entry's one paragraph is the transaction seam, and its ids stay cited in engine.ts. So no entry is added. check-adr-anchors at base 1eebbc08b (clean detached worktree): 90 anchored files, 1,881 decision-letter citations; at head: 90 anchored files, 1,881 (resolving citations 59,224 → 59,226, the module header's two ADR ids). The moved bodies cite no decision letter; the docblocks that do (ADR-0090 D10 on buildProvenance) stay on the methods.
• No objectql/src/engine.ts#NAME pointer under packages/spec/** or docs/adr/** names the four. Prose that names a method by file (packages/spec/src/data/hook.zod.ts on buildSession() in packages/objectql/src/engine.ts, script-runner.ts on buildUser(), the plugin and test comments) still resolves, because every method stays on the class in engine.ts; none of them reads source text.
• No gate baseline keys a moved body (durability-read-invention.baseline.json, query-options-erasure-baseline.json and federated-injected-column-readers.test.ts name none of the four); check-org-identifier, which reads the session shape buildSession emits, is green.

Acceptance notes

• Serial check, re-read before pr_create: no open PR touches packages/objectql/src/engine.ts. feat(spec,core,objectql,driver-sql,formula,driver-mongodb,service-analytics): now-anchored filter comparand { $now: true, addDays } shifted by days held on the record #26261 edits three other packages/objectql/src files, feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 a validation test, chore: version packages #25640 the package's package.json and changelog. fix(plugin-audit): render the activity summary in the reader's language #26258 (draft) edits row 45 of system-context.mdx (line 174), 39 lines above this PR's row 63 (line 213); the hunks do not overlap, and whichever lands second merges main per the card. origin/main moved 4 commits after the base, none on packages/objectql/**, content/docs/permissions/** or scripts/adr-anchors/**.
• Next cut from this screen: Autonumber (about -75, four bodies, 80 recent lines). Migration flags still needs a setter ruling.

Verification

At 2b013959b:

• pnpm --filter @objectstack/objectql typecheck (tsc --noEmit + check:test-typecheck, 39 files / 233 errors / 64 pinned signatures held): VERDICT command-exit 0. pnpm exec eslint --no-inline-config packages/objectql: exit 0.
• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 471 files, 8,774 tests passed (VERDICT command-exit 0).
• Dependants: every changed member keeps its declaration and all six published .d.ts files are byte-identical, so no dependant can see a difference. CI's TypeScript Type Check covers them.
• Gates at 2b013959b: dispatch-gates --commands derived 86 families on the real diff. Every one was run, each exit code captured before any pipe, then reconciled with --ran: 86 accounted for, 84 run green, 2 NOT MEASURED (exit 3, PREREQUISITE NOT MET; CI runs both): check:dual-build-cjs-loads (needs every package's dist/) and @objectstack/spec check:skill-examples (needs the full build). Named readings: check-system-context-census OK (above), check:org-identifier, check:logger-receiver-detach, check:durability-log-level, check:doc-anchors, check-affected-docs exit 0; check-engine-split-ratio --days 90 97.6%.
• Hand gates outside the derivation, all exit 0 at 2b013959b: check-adr-anchors at base and head (above), check-adr-symbol-anchors, check-tenant-audit-census, check-nul-bytes, check-platform-checklist --changed-from origin/main and check-commit-card-trailers --range origin/main..HEAD.
• No ablation, because no tested behaviour changed. test:repo was not run locally; CI's Test Core runs it.

skip-changeset: move-only. The published .d.ts files are byte-identical, liveness/ and every other published path are untouched, and the module's runtime is the same code under a different file name. The docs edit changes only the anchor path in one row of the census table.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 4 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via buildSession (symbol, a method of class ObjectQL; a top-level function))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7e4af20efff1cd6c9a6e32b4bbb5106927139100 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 08d258278b93d5d8e8376c7d955e667fabfa8411 — the merge of head 2b013959bfbe17844e95a8e7f5be76ef533e7251 into base 7e4af20efff1cd6c9a6e32b4bbb5106927139100, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 08d258278b93d5d8e8376c7d955e667fabfa8411 && git checkout 08d258278b93d5d8e8376c7d955e667fabfa8411
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7e4af20efff1cd6c9a6e32b4bbb5106927139100 2b013959bfbe17844e95a8e7f5be76ef533e7251 && git checkout -B drift-repro 7e4af20efff1cd6c9a6e32b4bbb5106927139100 && git merge --no-ff 2b013959bfbe17844e95a8e7f5be76ef533e7251

node scripts/docs-audit/affected-docs.mjs --json 7e4af20efff1cd6c9a6e32b4bbb5106927139100

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7e4af20efff1cd6c9a6e32b4bbb5106927139100 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T18:17Z · head 2b013959bfbe17844e95a8e7f5be76ef533e7251 · #25522 cut 9

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape: a draft against main. The body opens with Part of #25522 (⛔ not Fixes; the card stays open for later cuts). Clause-②: no and Metadata-protocol: none are line-initial. skip-changeset applies: the change is move-only. check-governed-merges --pr 26263: NOT governed, 201 changed lines.
2. Premise measured: cut 8 proposed "Execution plumbing", and the fresh seam table (pm-orders/server/25522-cut9-seam-table.md, also in the PR body) confirms it, at net −55. buildSession, buildProvenance, buildEvalUser and buildUser move into a new engine-execution-plumbing.ts as module functions; none reads an engine member, so no host object is needed, and each method stays on the class as a one-line delegate, so an override or a spy is still the one callers reach. The seat compared every line removed from engine.ts with the new module after stripping indentation: all 66 code lines are present there. The one other removed line is the census row in system-context.mdx, re-keyed to the new module in the same PR (the census control reds on the old key). The dev reports six .d.ts byte-identical with a positive control, the AST proof 4/4 SAME with two negative controls, check:adr-anchors 1,881 = 1,881, and the objectql suite at 471 files / 8,774 tests green. fix(plugin-audit): render the activity summary in the reader's language #26258 edits a different row of the same census page, with no overlapping hunk.
3. Gates: at this stamp the head's 53 check-runs read 38 success and 15 skipped (path-filtered UI, docs-build, dogfood matrix placeholders and opt-in harnesses, plus the duplicate-event twins), none failing or in progress. The two families the dev left NOT MEASURED locally are CI's, and CI is green.
4. Accepted deviations: none beyond the series shape. The proposed next cut, "Autonumber" (about −75), is noted for cut 10.
5. Out of scope: none filed.
6. Landing: this seat runs pr_ready and then automerge_enable through the relay, confirms MERGED on both readings, and records the landing on [maintainer] refactor(objectql): split src/engine.ts (23,903 lines, +7,501 in 30 days) along its ObjectQL seams, one move-only slice per PR #25522 with a Release: back to pm:queue for cut 10.

---

Generated by Claude Code