fix(cli): os migrate account-issuer reads sys_account through its driver, not the engine

The read-only boot composes no auth plugin, so sys_account is not a
registered object there, and the engine now refuses a name its registry does
not resolve before any driver is asked. The pre-flight inventories the
physical table in its legacy shape, so it reads through the driver the engine
routes that name to; the missing-table refusal of that read is still the only
one recognised as no rows.

Claude-Session: https://claude.ai/code/session_016tKoy8NJa35Yih1FdzrVmn
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cli/src/commands/migrate/account-issuer.ts

@@ -17,6 +17,14 @@ import {
 } from '../../utils/format.js';
 import { bootSchemaStack } from '../../utils/schema-migrate.js';
 
+/** The table this pre-flight inventories. Never written. */
+const SYS_ACCOUNT = 'sys_account';
+
+/** The driver read this pre-flight issues: `find` only, read-only by construction. */
+interface AccountTableDriver {
+  find(object: string, query: Record<string, unknown>): Promise<unknown>;
+}
+
 /**
  * `os migrate account-issuer` — the PLAN leg of the `sys_account.issuer`
  * retirement (#17440).
@@ -126,26 +134,45 @@ export default class MigrateAccountIssuer extends Command {
       const engine = (stack.kernel as { getService?: (n: string) => unknown }).getService?.call(
         stack.kernel,
         'objectql',
-      );
+      ) as { getDriverForObject?: (object: string) => AccountTableDriver | undefined } | undefined;
 
       if (!flags.json) printStep('Scanning sys_account…');
 
+      // The pre-flight reads the PHYSICAL `sys_account` table through the
+      // driver the engine routes that name to, not through the engine's
+      // `find`. This boot composes no `AuthPlugin`, so `sys_account` is not a
+      // registered object here, and the engine refuses a name its registry
+      // does not resolve (`OBJECT_NOT_FOUND`) before any driver is asked. That
+      // refusal is a fact about this boot's composition, never about the
+      // database: ⛔ reading it as "no rows" would report a table full of
+      // accounts as a clean pre-flight and authorise the drop. The table is
+      // read in its legacy shape, `issuer` included, which is the very column
+      // the registered schema no longer declares, so the driver (the path the
+      // engine leaves to host code) is the reader this inventory needs.
+      const driver = engine?.getDriverForObject?.(SYS_ACCOUNT);
+      if (!driver || typeof driver.find !== 'function') {
+        throw new Error(
+          `No driver serves ${SYS_ACCOUNT} on this stack, so the table cannot be enumerated. ` +
+            'Refusing rather than reporting an unread table as clean.',
+        );
+      }
+
       // [#21552] A database with no `sys_account` table holds no account, so no
       // two rows collide: the probe reads it as no rows. The read is not
-      // avoided, measured: this boot composes no `AuthPlugin`, so `sys_account`
-      // is not a registered object and the held-back sync never lists it, and
+      // avoided, measured: `sys_account` is not a registered object on this
+      // boot, so the held-back sync never lists it, and
       // `stack.tableAbsent('sys_account')` answers false on every database.
-      // The refusal is therefore recognised, with the shared predicate and for
-      // this command's own table only. ⛔ No other refused read is softened: it
-      // still throws the probe's refusal below and is never read as clean.
+      // The driver's missing-table refusal is therefore recognised, with the
+      // shared predicate and for this command's own table only. ⛔ No other
+      // refused read is softened: it still throws the probe's refusal below
+      // and is never read as clean.
       let noAccountTable = false;
-      const readEngine = engine as Parameters<typeof probeAccountIdentityCollisions>[0];
-      const readView: typeof readEngine = {
-        find: async (object, query, options) => {
+      const readView: Parameters<typeof probeAccountIdentityCollisions>[0] = {
+        find: async (object, query) => {
           try {
-            return await readEngine.find(object, query, options);
+            return await driver.find(object, query);
           } catch (error) {
-            if (object !== 'sys_account' || !isMissingTableError(error, object)) throw error;
+            if (object !== SYS_ACCOUNT || !isMissingTableError(error, object)) throw error;
             noAccountTable = true;
             return [];
           }